wcc: address-of symbol-bearing def + cross-module module-qual (#149)

Widen cgaddr / N_UN TK_AMP for addressable globals — the address-of
twin of A.2/A.3's value-LOAD widening (which covered cgexpr N_DOT /
cgindex but never the &-path, so &<mod>.<def> emitted uninitialized-AX
garbage). Two shapes, one class:
- Shape 1 (&G, N_IDENT def): LEAQ masym(G) for struct/array/scalar
  defs. Scalar gate = emit_defs/emit_floatlit_data eligibility exactly
  (fold_int_literal OR rhs-peels-to-N_FLOATLIT) so the addressable set
  equals the symbol-bearing set — never LEAQs a missing symbol. Reuses
  DefStruct/DefArray registries (A.2/A.3); new def_isscalardef/DefAny.
- Shape 2 (&mod.G, N_DOT module-qual): LEAQ leaf (TY_FN -> mafn),
  mirroring the value-READ resolution (cgen.c:6043). Kind-agnostic —
  fixes &mod.def, &mod.let, &mod.scalar, &mod.func. This is fold-4's
  &math.f64info pattern.
Non-addressable def (str-def, computed-float-def) -> loud error both
stages; upgrades #147 &NAN(0.0/0.0) from silent wild-deref to loud
compile error. Computed-float-def symbol emission split to #147
(needs float-const-fold; not needed by gamma/fold-4). wwstage Shape-2
gate carries !deflookup so a def base routes to silent-drop matching
cstage's type-gate (rule-10 parity).

Unblocks gamma-cleanup (#40) + strconv fold-4 (&math.f64info).
Bootstrap-NEUTRAL (no &global in lib/selfhost; only &local). Test 921
(12 rows: same-pkg struct/array/scalar-int/scalar-float + cross-pkg
def_struct/let_struct/scalar_let/func + regression &let/&arr[i] +
2 loud-reject). Make test: 184/184 incl 990-997 byte-id +
combined_ww_fresh.

Followups: #147 (computed-float-def symbol), #152/#153 (pre-existing
ptr-param element read divergences, dodged by 921), #154 (address-of
def subparts &def.field/&def_array[i]).

selfhost/cmd/wwdump/main.combined.ww

@@ -17350,6 +17350,28 @@ fn cgun(c: *cgen, n: *node) void = {
 					emitline("(SB), AX\n");
 					return;
 				};
+				// #149/#147: address-of a top-level def with DATA
+				// storage. emitdefs / emitstructdata / emitarraydata
+				// all emit to emitsymname(name), so the address is
+				// the same LEAQ name(SB) as a let. Address-of twin of
+				// A.2/A.3's LOAD-side widening.
+				if (defisaddressable(c, opnd)) {
+					emitline("\tLEAQ\t");
+					emitsymname(c, nm);
+					emitline("(SB), AX\n");
+					return;
+				};
+				// rule-7: the name IS a def but has no DATA symbol
+				// (str def inlined, or computed-rhs float like
+				// `def NAN = 0.0/0.0`). Loud, not a wild deref.
+				if (deflookup(c, nm)) {
+					let m1: str = "ww: cannot take address of non-addressable def '";
+					os.write(2, m1.ptr, m1.len: u64);
+					os.write(2, nm.ptr, nm.len: u64);
+					let m2: str = "': no DATA symbol (str/computed-rhs def; #149/#147)\n";
+					os.write(2, m2.ptr, m2.len: u64);
+					os.exit(1);
+				};
 				return;
 			};
 			// Address-of through a DOT chain. Mirror of cstage
@@ -17527,6 +17549,47 @@ fn cgun(c: *cgen, n: *node) void = {
 						};
 					};
 				};
+				// #149 Shape 2: `&mod.G` module-qualified address-of
+				// of an exported global (let or def). The base is an
+				// N_IDENT that's neither a local nor a global let, so
+				// it's an SK_USE module qualifier; LEAQ the leaf
+				// symbol. Kind-agnostic (covers cross-module &let /
+				// &def / &scalar) — the address-of twin of the value-
+				// read mod-qual path (cgenexpr.ww). A fn leaf resolves
+				// via emitfnname (fn address), mirroring that read
+				// path's TY_FN branch.
+				if (opnd.lhs != nil) {
+					if (opnd.lhs.kind == nkind.N_IDENT) {
+						let basenm: str = opnd.lhs.str;
+						if (localfindnode(c, basenm) == nil) {
+							// A def base (`&Pdef.field`) is NOT a module
+							// qualifier: cstage's Shape-2 gate (base
+							// type_ == NULL/ty_err) excludes it because
+							// the checker types a def-struct/def-array
+							// base, but the ww gate (not-local && not-let)
+							// does not. Without this guard a def base would
+							// mis-LEAQ the field leaf (e.g. `y(SB)`) while
+							// cstage silent-drops, breaking cs==ww (rule
+							// 10). Excluding defs restores byte-id; the
+							// `&def.field` silent-drop itself is a separate
+							// pre-#149 gap (file as #150-family).
+							if (!isletvar(c, basenm) && !deflookup(c, basenm)) {
+								let fld: str = opnd.str;
+								let frt: *node = fnretlookupmod(c, fld, basenm);
+								if (frt != nil) {
+									emitline("\tLEAQ\t");
+									emitfnname(c, fld, basenm);
+									emitline("(SB), AX\n");
+									return;
+								};
+								emitline("\tLEAQ\t");
+								emitsymname(c, fld);
+								emitline("(SB), AX\n");
+								return;
+							};
+						};
+					};
+				};
 				// Fall through silently (mirrors cstage silent-
 				// drop fallback at the end of the TK_AMP block).
 				return;
@@ -26253,6 +26316,54 @@ fn deflookuprhsmod(c: *cgen, name: str, mod: str) *node = {
 	return deflookuprhs(c, name);
 };
 
+// #149: rhs peels (N_CAST / unary ±) to a float literal — the exact
+// shape emitfloatlitdata (cgen.ww) emits a DATA symbol for. The scalar-
+// float address-of gate must equal that emission set, or `&def` LEAQs a
+// symbol the data pass never wrote. Keep in sync with emitfloatlitdata's
+// peel.
+fn floatlitleaf(rhs: *node) bool = {
+	let r: *node = rhs;
+	for (r != nil) {
+		if (r.kind != nkind.N_CAST) { break; };
+		r = r.lhs;
+	};
+	if (r != nil) {
+		if (r.kind == nkind.N_UN) {
+			if (r.op == tkind.TK_MINUS) {
+				r = r.lhs;
+				for (r != nil) { if (r.kind != nkind.N_CAST) { break; }; r = r.lhs; };
+			} else { if (r.op == tkind.TK_PLUS) {
+				r = r.lhs;
+				for (r != nil) { if (r.kind != nkind.N_CAST) { break; }; r = r.lhs; };
+			}; };
+		};
+	};
+	if (r == nil) { return false; };
+	return r.kind == nkind.N_FLOATLIT;
+};
+
+// #149/#147: a top-level def is addressable for `&def` iff emitdefs emits
+// a DATA symbol for it — struct, array, scalar int (foldintliteral), or
+// scalar float whose rhs peels to a FLOATLIT. Gate held identical to
+// cstage def_is{struct,array,scalar}def so the addressable set matches
+// byte-for-byte (rule 10). str defs and computed-rhs floats (#147
+// `def NAN = 0.0/0.0`) have no symbol and are excluded → routed to the
+// loud error, never a LEAQ of a missing symbol. `opnd` is the `&`-operand
+// N_IDENT; its checker-stamped type_ carries the def's type (same as the
+// cgident float-def read at cgenexpr.ww).
+fn defisaddressable(c: *cgen, opnd: *node) bool = {
+	let nm: str = opnd.str;
+	if (defvarstructinfo(c, nm) != nil) { return true; };
+	let dtn: *node = defvartnode(c, nm);
+	if (dtn != nil) { if (dtn.kind == nkind.N_TARRAY) { return true; }; };
+	let drhs: *node = deflookuprhs(c, nm);
+	if (drhs == nil) { return false; };
+	let v: u64 = 0u64;
+	if (foldintliteral(drhs, &v)) { return true; };
+	if (isfloattype(c, opnd)) { if (floatlitleaf(drhs)) { return true; }; };
+	return false;
+};
+
 // ---- module-private symbol map --------------------------------------
 //
 // Every non-FFI top-level fn decl lives in its module's namespace —