wcc: address-of symbol-bearing def + cross-module module-qual (#149)

Widen cgaddr / N_UN TK_AMP for addressable globals — the address-of
twin of A.2/A.3's value-LOAD widening (which covered cgexpr N_DOT /
cgindex but never the &-path, so &<mod>.<def> emitted uninitialized-AX
garbage). Two shapes, one class:
- Shape 1 (&G, N_IDENT def): LEAQ masym(G) for struct/array/scalar
  defs. Scalar gate = emit_defs/emit_floatlit_data eligibility exactly
  (fold_int_literal OR rhs-peels-to-N_FLOATLIT) so the addressable set
  equals the symbol-bearing set — never LEAQs a missing symbol. Reuses
  DefStruct/DefArray registries (A.2/A.3); new def_isscalardef/DefAny.
- Shape 2 (&mod.G, N_DOT module-qual): LEAQ leaf (TY_FN -> mafn),
  mirroring the value-READ resolution (cgen.c:6043). Kind-agnostic —
  fixes &mod.def, &mod.let, &mod.scalar, &mod.func. This is fold-4's
  &math.f64info pattern.
Non-addressable def (str-def, computed-float-def) -> loud error both
stages; upgrades #147 &NAN(0.0/0.0) from silent wild-deref to loud
compile error. Computed-float-def symbol emission split to #147
(needs float-const-fold; not needed by gamma/fold-4). wwstage Shape-2
gate carries !deflookup so a def base routes to silent-drop matching
cstage's type-gate (rule-10 parity).

Unblocks gamma-cleanup (#40) + strconv fold-4 (&math.f64info).
Bootstrap-NEUTRAL (no &global in lib/selfhost; only &local). Test 921
(12 rows: same-pkg struct/array/scalar-int/scalar-float + cross-pkg
def_struct/let_struct/scalar_let/func + regression &let/&arr[i] +
2 loud-reject). Make test: 184/184 incl 990-997 byte-id +
combined_ww_fresh.

Followups: #147 (computed-float-def symbol), #152/#153 (pre-existing
ptr-param element read divergences, dodged by 921), #154 (address-of
def subparts &def.field/&def_array[i]).

Makefile

@@ -343,6 +343,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_struct_composite_init_run \
 	  $(BIN)/test_array_static_init_run \
 	  $(BIN)/test_array_init_acceptiffits_run \
+	  $(BIN)/test_amp_def_global_run \
 	  $(BIN)/test_f64cgen_run \
 	  $(BIN)/test_f64crossmod_run \
 	  $(BIN)/test_tuprecv_run \
@@ -1171,6 +1172,11 @@ $(BIN)/test_array_init_acceptiffits_run: test/wcc/920_array_init_acceptiffits_ru
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+$(BIN)/test_amp_def_global_run: test/wcc/921_amp_def_global_run.c \
+		$(BIN)/ww $(BIN)/w6c $(BIN)/w6c_ww $(BIN)/w6a $(BIN)/w6l \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 $(BIN)/test_f64cgen_run: test/wcc/951_f64cgen_run.c $(BIN)/ww $(BIN)/w6c \
 		$(BIN)/w6a $(BIN)/w6l $(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<

cmd/w6c/cgen.c

@@ -722,6 +722,19 @@ struct DefArray {
 };
 static DefArray *defarrays;
 
+/* #149: every top-level `def`, regardless of kind. Backs the address-of
+ * path's is-any-def check (loud error on `&<non-addressable def>`) and
+ * the scalar-addressable gate. Mirrors wwstage collectdefs / deflookup,
+ * which already track all N_DEF. */
+typedef struct DefAny DefAny;
+struct DefAny {
+	const char *name;
+	Type	*type;
+	Node	*rhs;
+	DefAny	*next;
+};
+static DefAny *defall;
+
 /* Slot size for a top-level `let` of type t, or 0 if the type isn't
  * supported as a writable global yet. Tagged unions are deferred.
  * enums route through their storage type.
@@ -926,6 +939,7 @@ let_collect(Cg *c, Node *file)
 	letvars = NULL;
 	defstructs = NULL;
 	defarrays = NULL;
+	defall = NULL;
 	if (file == NULL) return;
 	for (Node *d = file->list; d; d = d->next) {
 		if (d->kind == N_LET) {
@@ -940,6 +954,15 @@ let_collect(Cg *c, Node *file)
 		}
 		if (d->kind == N_DEF) {
 			if (d->str == NULL || d->str[0] == '\0') continue;
+			/* #149: track every def (any kind) so the address-of
+			 * path can tell a def from an unknown ident and loud-
+			 * error on `&<non-addressable def>`. */
+			DefAny *dn = amalloc(c->a, sizeof *dn);
+			dn->name = d->str;
+			dn->type = d->type;
+			dn->rhs = d->rhs;
+			dn->next = defall;
+			defall = dn;
 			/* #129 A.2: struct-typed defs now have DATA storage
 			 * (emit_defs struct arm); register them so the N_DOT
 			 * struct-let LEAQ-and-offset shape widens to cover
@@ -987,6 +1010,54 @@ def_isarraydef(const char *name)
 	return 0;
 }
 
+/* #149: rhs peels (N_CAST / unary ±) to a float literal — the exact
+ * shape emit_floatlit_data (cgen.c) emits a DATA symbol for. The scalar-
+ * def address-of gate MUST equal that emission set, or `&def` LEAQs a
+ * symbol the data pass never wrote. Keep in sync with the peel inside
+ * emit_floatlit_data. */
+static int
+floatlit_leaf(Node *rhs)
+{
+	Node *r = rhs;
+	while (r != NULL && r->kind == N_CAST) r = r->lhs;
+	if (r != NULL && r->kind == N_UN
+	    && (r->op == TK_MINUS || r->op == TK_PLUS)) {
+		r = r->lhs;
+		while (r != NULL && r->kind == N_CAST) r = r->lhs;
+	}
+	return r != NULL && r->kind == N_FLOATLIT;
+}
+
+/* #149/#147: a scalar (int/float) def is addressable iff emit_defs emits
+ * a DATA symbol for it — int via fold_int_literal, float via the
+ * FLOATLIT-leaf shape. Gate is held identical to emit_defs's emission
+ * gate so the addressable set matches byte-for-byte. Computed-rhs floats
+ * (`def NAN = 0.0/0.0`, #147) fold to no symbol and are excluded → they
+ * route to the address-of loud error, never a LEAQ of a missing sym. */
+static int
+def_isscalardef(const char *name)
+{
+	if (name == NULL) return 0;
+	for (DefAny *dn = defall; dn; dn = dn->next) {
+		if (strcmp(dn->name, name) != 0) continue;
+		if (dn->rhs == NULL) return 0;
+		u64 v;
+		if (fold_int_literal(dn->rhs, &v)) return 1;
+		if (let_isfloat(dn->type) && floatlit_leaf(dn->rhs)) return 1;
+		return 0;
+	}
+	return 0;
+}
+
+static int
+def_isanydef(const char *name)
+{
+	if (name == NULL) return 0;
+	for (DefAny *dn = defall; dn; dn = dn->next)
+		if (strcmp(dn->name, name) == 0) return 1;
+	return 0;
+}
+
 static int
 let_islet(const char *name)
 {
@@ -2229,13 +2300,60 @@ cgexpr(Cg *c, Node *n, Local *locals)
 				int off = localfind(locals, opnd->str);
 				if (off != 0) {
 					ins2(c, A_LEAQ, amem(D_BP, off), areg(D_AX));
-				} else if (let_islet(opnd->str)) {
+				} else if (let_islet(opnd->str)
+				    || def_isstructdef(opnd->str)
+				    || def_isarraydef(opnd->str)
+				    || def_isscalardef(opnd->str)) {
+					/* #149/#147: address-of a top-level def
+					 * with DATA storage. emit_defs / emit_
+					 * struct_data / emit_array_data all emit
+					 * to mod_mangle(name), so the address is
+					 * the same LEAQ name(SB) as a let. The
+					 * address-of twin of A.2/A.3's LOAD-side
+					 * widening. */
 					ins2(c, A_LEAQ, masym(c, opnd->str),
 					    areg(D_AX));
+				} else if (def_isanydef(opnd->str)) {
+					/* #149/#147 rule-7: the name IS a def but
+					 * has no DATA symbol (str def inlined, or
+					 * computed-rhs float like `def NAN =
+					 * 0.0/0.0`). Loud, not a wild deref. */
+					fatal("cannot take address of non-"
+					    "addressable def '%s': no DATA symbol "
+					    "(str/computed-rhs def; #149/#147)",
+					    opnd->str);
 				}
 				break;
 			}
 			if (opnd && opnd->kind == N_DOT) {
+				/* #149 Shape 2: `&mod.G` — module-qualified
+				 * address-of of an exported global (let or def).
+				 * The checker leaves SK_USE module idents untyped
+				 * (NULL/ty_err); detect that and LEAQ the leaf
+				 * symbol. Kind-agnostic (covers cross-module &let
+				 * / &def / &scalar) — the address-of twin of the
+				 * value-read mod-qual path below. A TY_FN leaf
+				 * resolves via mafn (fn address), mirroring the
+				 * read path's TY_FN branch. Placed before the
+				 * spine walk, which aborts on the untyped base
+				 * anyway. */
+				if (opnd->lhs && opnd->lhs->kind == N_IDENT
+				    && (opnd->lhs->type == NULL
+				        || opnd->lhs->type == ty_err)) {
+					Type *lt = opnd->type;
+					Type *lu = (lt && lt->kind == TY_NAMED)
+					    ? lt->under : lt;
+					if (lu && lu->kind == TY_FN)
+						ins2(c, A_LEAQ,
+						    mafn(c, opnd->str,
+						        opnd->lhs->str),
+						    areg(D_AX));
+					else
+						ins2(c, A_LEAQ,
+						    masym(c, opnd->str),
+						    areg(D_AX));
+					break;
+				}
 				/* Address-of through a DOT chain. The early-exit
 				 * above handled `&ident` and `&base[i]`; everything
 				 * else was silently dropped. Three shapes converge

selfhost/cmd/w6c/main.combined.ww

@@ -17350,6 +17350,28 @@ fn cgun(c: *cgen, n: *node) void = {
 					emitline("(SB), AX\n");
 					return;
 				};
+				// #149/#147: address-of a top-level def with DATA
+				// storage. emitdefs / emitstructdata / emitarraydata
+				// all emit to emitsymname(name), so the address is
+				// the same LEAQ name(SB) as a let. Address-of twin of
+				// A.2/A.3's LOAD-side widening.
+				if (defisaddressable(c, opnd)) {
+					emitline("\tLEAQ\t");
+					emitsymname(c, nm);
+					emitline("(SB), AX\n");
+					return;
+				};
+				// rule-7: the name IS a def but has no DATA symbol
+				// (str def inlined, or computed-rhs float like
+				// `def NAN = 0.0/0.0`). Loud, not a wild deref.
+				if (deflookup(c, nm)) {
+					let m1: str = "ww: cannot take address of non-addressable def '";
+					os.write(2, m1.ptr, m1.len: u64);
+					os.write(2, nm.ptr, nm.len: u64);
+					let m2: str = "': no DATA symbol (str/computed-rhs def; #149/#147)\n";
+					os.write(2, m2.ptr, m2.len: u64);
+					os.exit(1);
+				};
 				return;
 			};
 			// Address-of through a DOT chain. Mirror of cstage
@@ -17527,6 +17549,47 @@ fn cgun(c: *cgen, n: *node) void = {
 						};
 					};
 				};
+				// #149 Shape 2: `&mod.G` module-qualified address-of
+				// of an exported global (let or def). The base is an
+				// N_IDENT that's neither a local nor a global let, so
+				// it's an SK_USE module qualifier; LEAQ the leaf
+				// symbol. Kind-agnostic (covers cross-module &let /
+				// &def / &scalar) — the address-of twin of the value-
+				// read mod-qual path (cgenexpr.ww). A fn leaf resolves
+				// via emitfnname (fn address), mirroring that read
+				// path's TY_FN branch.
+				if (opnd.lhs != nil) {
+					if (opnd.lhs.kind == nkind.N_IDENT) {
+						let basenm: str = opnd.lhs.str;
+						if (localfindnode(c, basenm) == nil) {
+							// A def base (`&Pdef.field`) is NOT a module
+							// qualifier: cstage's Shape-2 gate (base
+							// type_ == NULL/ty_err) excludes it because
+							// the checker types a def-struct/def-array
+							// base, but the ww gate (not-local && not-let)
+							// does not. Without this guard a def base would
+							// mis-LEAQ the field leaf (e.g. `y(SB)`) while
+							// cstage silent-drops, breaking cs==ww (rule
+							// 10). Excluding defs restores byte-id; the
+							// `&def.field` silent-drop itself is a separate
+							// pre-#149 gap (file as #150-family).
+							if (!isletvar(c, basenm) && !deflookup(c, basenm)) {
+								let fld: str = opnd.str;
+								let frt: *node = fnretlookupmod(c, fld, basenm);
+								if (frt != nil) {
+									emitline("\tLEAQ\t");
+									emitfnname(c, fld, basenm);
+									emitline("(SB), AX\n");
+									return;
+								};
+								emitline("\tLEAQ\t");
+								emitsymname(c, fld);
+								emitline("(SB), AX\n");
+								return;
+							};
+						};
+					};
+				};
 				// Fall through silently (mirrors cstage silent-
 				// drop fallback at the end of the TK_AMP block).
 				return;
@@ -26253,6 +26316,54 @@ fn deflookuprhsmod(c: *cgen, name: str, mod: str) *node = {
 	return deflookuprhs(c, name);
 };
 
+// #149: rhs peels (N_CAST / unary ±) to a float literal — the exact
+// shape emitfloatlitdata (cgen.ww) emits a DATA symbol for. The scalar-
+// float address-of gate must equal that emission set, or `&def` LEAQs a
+// symbol the data pass never wrote. Keep in sync with emitfloatlitdata's
+// peel.
+fn floatlitleaf(rhs: *node) bool = {
+	let r: *node = rhs;
+	for (r != nil) {
+		if (r.kind != nkind.N_CAST) { break; };
+		r = r.lhs;
+	};
+	if (r != nil) {
+		if (r.kind == nkind.N_UN) {
+			if (r.op == tkind.TK_MINUS) {
+				r = r.lhs;
+				for (r != nil) { if (r.kind != nkind.N_CAST) { break; }; r = r.lhs; };
+			} else { if (r.op == tkind.TK_PLUS) {
+				r = r.lhs;
+				for (r != nil) { if (r.kind != nkind.N_CAST) { break; }; r = r.lhs; };
+			}; };
+		};
+	};
+	if (r == nil) { return false; };
+	return r.kind == nkind.N_FLOATLIT;
+};
+
+// #149/#147: a top-level def is addressable for `&def` iff emitdefs emits
+// a DATA symbol for it — struct, array, scalar int (foldintliteral), or
+// scalar float whose rhs peels to a FLOATLIT. Gate held identical to
+// cstage def_is{struct,array,scalar}def so the addressable set matches
+// byte-for-byte (rule 10). str defs and computed-rhs floats (#147
+// `def NAN = 0.0/0.0`) have no symbol and are excluded → routed to the
+// loud error, never a LEAQ of a missing symbol. `opnd` is the `&`-operand
+// N_IDENT; its checker-stamped type_ carries the def's type (same as the
+// cgident float-def read at cgenexpr.ww).
+fn defisaddressable(c: *cgen, opnd: *node) bool = {
+	let nm: str = opnd.str;
+	if (defvarstructinfo(c, nm) != nil) { return true; };
+	let dtn: *node = defvartnode(c, nm);
+	if (dtn != nil) { if (dtn.kind == nkind.N_TARRAY) { return true; }; };
+	let drhs: *node = deflookuprhs(c, nm);
+	if (drhs == nil) { return false; };
+	let v: u64 = 0u64;
+	if (foldintliteral(drhs, &v)) { return true; };
+	if (isfloattype(c, opnd)) { if (floatlitleaf(drhs)) { return true; }; };
+	return false;
+};
+
 // ---- module-private symbol map --------------------------------------
 //
 // Every non-FFI top-level fn decl lives in its module's namespace —

selfhost/cmd/wcc/cgen.ww

@@ -2385,6 +2385,54 @@ fn deflookuprhsmod(c: *cgen, name: str, mod: str) *node = {
 	return deflookuprhs(c, name);
 };
 
+// #149: rhs peels (N_CAST / unary ±) to a float literal — the exact
+// shape emitfloatlitdata (cgen.ww) emits a DATA symbol for. The scalar-
+// float address-of gate must equal that emission set, or `&def` LEAQs a
+// symbol the data pass never wrote. Keep in sync with emitfloatlitdata's
+// peel.
+fn floatlitleaf(rhs: *node) bool = {
+	let r: *node = rhs;
+	for (r != nil) {
+		if (r.kind != nkind.N_CAST) { break; };
+		r = r.lhs;
+	};
+	if (r != nil) {
+		if (r.kind == nkind.N_UN) {
+			if (r.op == tkind.TK_MINUS) {
+				r = r.lhs;
+				for (r != nil) { if (r.kind != nkind.N_CAST) { break; }; r = r.lhs; };
+			} else { if (r.op == tkind.TK_PLUS) {
+				r = r.lhs;
+				for (r != nil) { if (r.kind != nkind.N_CAST) { break; }; r = r.lhs; };
+			}; };
+		};
+	};
+	if (r == nil) { return false; };
+	return r.kind == nkind.N_FLOATLIT;
+};
+
+// #149/#147: a top-level def is addressable for `&def` iff emitdefs emits
+// a DATA symbol for it — struct, array, scalar int (foldintliteral), or
+// scalar float whose rhs peels to a FLOATLIT. Gate held identical to
+// cstage def_is{struct,array,scalar}def so the addressable set matches
+// byte-for-byte (rule 10). str defs and computed-rhs floats (#147
+// `def NAN = 0.0/0.0`) have no symbol and are excluded → routed to the
+// loud error, never a LEAQ of a missing symbol. `opnd` is the `&`-operand
+// N_IDENT; its checker-stamped type_ carries the def's type (same as the
+// cgident float-def read at cgenexpr.ww).
+fn defisaddressable(c: *cgen, opnd: *node) bool = {
+	let nm: str = opnd.str;
+	if (defvarstructinfo(c, nm) != nil) { return true; };
+	let dtn: *node = defvartnode(c, nm);
+	if (dtn != nil) { if (dtn.kind == nkind.N_TARRAY) { return true; }; };
+	let drhs: *node = deflookuprhs(c, nm);
+	if (drhs == nil) { return false; };
+	let v: u64 = 0u64;
+	if (foldintliteral(drhs, &v)) { return true; };
+	if (isfloattype(c, opnd)) { if (floatlitleaf(drhs)) { return true; }; };
+	return false;
+};
+
 // ---- module-private symbol map --------------------------------------
 //
 // Every non-FFI top-level fn decl lives in its module's namespace —

selfhost/cmd/wcc/cgenexpr.ww

@@ -2664,6 +2664,28 @@ fn cgun(c: *cgen, n: *node) void = {
 					emitline("(SB), AX\n");
 					return;
 				};
+				// #149/#147: address-of a top-level def with DATA
+				// storage. emitdefs / emitstructdata / emitarraydata
+				// all emit to emitsymname(name), so the address is
+				// the same LEAQ name(SB) as a let. Address-of twin of
+				// A.2/A.3's LOAD-side widening.
+				if (defisaddressable(c, opnd)) {
+					emitline("\tLEAQ\t");
+					emitsymname(c, nm);
+					emitline("(SB), AX\n");
+					return;
+				};
+				// rule-7: the name IS a def but has no DATA symbol
+				// (str def inlined, or computed-rhs float like
+				// `def NAN = 0.0/0.0`). Loud, not a wild deref.
+				if (deflookup(c, nm)) {
+					let m1: str = "ww: cannot take address of non-addressable def '";
+					os.write(2, m1.ptr, m1.len: u64);
+					os.write(2, nm.ptr, nm.len: u64);
+					let m2: str = "': no DATA symbol (str/computed-rhs def; #149/#147)\n";
+					os.write(2, m2.ptr, m2.len: u64);
+					os.exit(1);
+				};
 				return;
 			};
 			// Address-of through a DOT chain. Mirror of cstage
@@ -2841,6 +2863,47 @@ fn cgun(c: *cgen, n: *node) void = {
 						};
 					};
 				};
+				// #149 Shape 2: `&mod.G` module-qualified address-of
+				// of an exported global (let or def). The base is an
+				// N_IDENT that's neither a local nor a global let, so
+				// it's an SK_USE module qualifier; LEAQ the leaf
+				// symbol. Kind-agnostic (covers cross-module &let /
+				// &def / &scalar) — the address-of twin of the value-
+				// read mod-qual path (cgenexpr.ww). A fn leaf resolves
+				// via emitfnname (fn address), mirroring that read
+				// path's TY_FN branch.
+				if (opnd.lhs != nil) {
+					if (opnd.lhs.kind == nkind.N_IDENT) {
+						let basenm: str = opnd.lhs.str;
+						if (localfindnode(c, basenm) == nil) {
+							// A def base (`&Pdef.field`) is NOT a module
+							// qualifier: cstage's Shape-2 gate (base
+							// type_ == NULL/ty_err) excludes it because
+							// the checker types a def-struct/def-array
+							// base, but the ww gate (not-local && not-let)
+							// does not. Without this guard a def base would
+							// mis-LEAQ the field leaf (e.g. `y(SB)`) while
+							// cstage silent-drops, breaking cs==ww (rule
+							// 10). Excluding defs restores byte-id; the
+							// `&def.field` silent-drop itself is a separate
+							// pre-#149 gap (file as #150-family).
+							if (!isletvar(c, basenm) && !deflookup(c, basenm)) {
+								let fld: str = opnd.str;
+								let frt: *node = fnretlookupmod(c, fld, basenm);
+								if (frt != nil) {
+									emitline("\tLEAQ\t");
+									emitfnname(c, fld, basenm);
+									emitline("(SB), AX\n");
+									return;
+								};
+								emitline("\tLEAQ\t");
+								emitsymname(c, fld);
+								emitline("(SB), AX\n");
+								return;
+							};
+						};
+					};
+				};
 				// Fall through silently (mirrors cstage silent-
 				// drop fallback at the end of the TK_AMP block).
 				return;

selfhost/cmd/wwdump/main.combined.ww

@@ -17350,6 +17350,28 @@ fn cgun(c: *cgen, n: *node) void = {
 					emitline("(SB), AX\n");
 					return;
 				};
+				// #149/#147: address-of a top-level def with DATA
+				// storage. emitdefs / emitstructdata / emitarraydata
+				// all emit to emitsymname(name), so the address is
+				// the same LEAQ name(SB) as a let. Address-of twin of
+				// A.2/A.3's LOAD-side widening.
+				if (defisaddressable(c, opnd)) {
+					emitline("\tLEAQ\t");
+					emitsymname(c, nm);
+					emitline("(SB), AX\n");
+					return;
+				};
+				// rule-7: the name IS a def but has no DATA symbol
+				// (str def inlined, or computed-rhs float like
+				// `def NAN = 0.0/0.0`). Loud, not a wild deref.
+				if (deflookup(c, nm)) {
+					let m1: str = "ww: cannot take address of non-addressable def '";
+					os.write(2, m1.ptr, m1.len: u64);
+					os.write(2, nm.ptr, nm.len: u64);
+					let m2: str = "': no DATA symbol (str/computed-rhs def; #149/#147)\n";
+					os.write(2, m2.ptr, m2.len: u64);
+					os.exit(1);
+				};
 				return;
 			};
 			// Address-of through a DOT chain. Mirror of cstage
@@ -17527,6 +17549,47 @@ fn cgun(c: *cgen, n: *node) void = {
 						};
 					};
 				};
+				// #149 Shape 2: `&mod.G` module-qualified address-of
+				// of an exported global (let or def). The base is an
+				// N_IDENT that's neither a local nor a global let, so
+				// it's an SK_USE module qualifier; LEAQ the leaf
+				// symbol. Kind-agnostic (covers cross-module &let /
+				// &def / &scalar) — the address-of twin of the value-
+				// read mod-qual path (cgenexpr.ww). A fn leaf resolves
+				// via emitfnname (fn address), mirroring that read
+				// path's TY_FN branch.
+				if (opnd.lhs != nil) {
+					if (opnd.lhs.kind == nkind.N_IDENT) {
+						let basenm: str = opnd.lhs.str;
+						if (localfindnode(c, basenm) == nil) {
+							// A def base (`&Pdef.field`) is NOT a module
+							// qualifier: cstage's Shape-2 gate (base
+							// type_ == NULL/ty_err) excludes it because
+							// the checker types a def-struct/def-array
+							// base, but the ww gate (not-local && not-let)
+							// does not. Without this guard a def base would
+							// mis-LEAQ the field leaf (e.g. `y(SB)`) while
+							// cstage silent-drops, breaking cs==ww (rule
+							// 10). Excluding defs restores byte-id; the
+							// `&def.field` silent-drop itself is a separate
+							// pre-#149 gap (file as #150-family).
+							if (!isletvar(c, basenm) && !deflookup(c, basenm)) {
+								let fld: str = opnd.str;
+								let frt: *node = fnretlookupmod(c, fld, basenm);
+								if (frt != nil) {
+									emitline("\tLEAQ\t");
+									emitfnname(c, fld, basenm);
+									emitline("(SB), AX\n");
+									return;
+								};
+								emitline("\tLEAQ\t");
+								emitsymname(c, fld);
+								emitline("(SB), AX\n");
+								return;
+							};
+						};
+					};
+				};
 				// Fall through silently (mirrors cstage silent-
 				// drop fallback at the end of the TK_AMP block).
 				return;
@@ -26253,6 +26316,54 @@ fn deflookuprhsmod(c: *cgen, name: str, mod: str) *node = {
 	return deflookuprhs(c, name);
 };
 
+// #149: rhs peels (N_CAST / unary ±) to a float literal — the exact
+// shape emitfloatlitdata (cgen.ww) emits a DATA symbol for. The scalar-
+// float address-of gate must equal that emission set, or `&def` LEAQs a
+// symbol the data pass never wrote. Keep in sync with emitfloatlitdata's
+// peel.
+fn floatlitleaf(rhs: *node) bool = {
+	let r: *node = rhs;
+	for (r != nil) {
+		if (r.kind != nkind.N_CAST) { break; };
+		r = r.lhs;
+	};
+	if (r != nil) {
+		if (r.kind == nkind.N_UN) {
+			if (r.op == tkind.TK_MINUS) {
+				r = r.lhs;
+				for (r != nil) { if (r.kind != nkind.N_CAST) { break; }; r = r.lhs; };
+			} else { if (r.op == tkind.TK_PLUS) {
+				r = r.lhs;
+				for (r != nil) { if (r.kind != nkind.N_CAST) { break; }; r = r.lhs; };
+			}; };
+		};
+	};
+	if (r == nil) { return false; };
+	return r.kind == nkind.N_FLOATLIT;
+};
+
+// #149/#147: a top-level def is addressable for `&def` iff emitdefs emits
+// a DATA symbol for it — struct, array, scalar int (foldintliteral), or
+// scalar float whose rhs peels to a FLOATLIT. Gate held identical to
+// cstage def_is{struct,array,scalar}def so the addressable set matches
+// byte-for-byte (rule 10). str defs and computed-rhs floats (#147
+// `def NAN = 0.0/0.0`) have no symbol and are excluded → routed to the
+// loud error, never a LEAQ of a missing symbol. `opnd` is the `&`-operand
+// N_IDENT; its checker-stamped type_ carries the def's type (same as the
+// cgident float-def read at cgenexpr.ww).
+fn defisaddressable(c: *cgen, opnd: *node) bool = {
+	let nm: str = opnd.str;
+	if (defvarstructinfo(c, nm) != nil) { return true; };
+	let dtn: *node = defvartnode(c, nm);
+	if (dtn != nil) { if (dtn.kind == nkind.N_TARRAY) { return true; }; };
+	let drhs: *node = deflookuprhs(c, nm);
+	if (drhs == nil) { return false; };
+	let v: u64 = 0u64;
+	if (foldintliteral(drhs, &v)) { return true; };
+	if (isfloattype(c, opnd)) { if (floatlitleaf(drhs)) { return true; }; };
+	return false;
+};
+
 // ---- module-private symbol map --------------------------------------
 //
 // Every non-FFI top-level fn decl lives in its module's namespace —

test/wcc/921_amp_def_global_run.c

@@ -0,0 +1,290 @@
+/*
+ * 921_amp_def_global_run — address-of a module-level global (#149) +
+ * scalar-def address-of (#147 consolidation). Regression net for the
+ * cgaddr def-symbol / module-qualified gap: A.2 (0ed0b39) + A.3
+ * (9e3bc4e) widened the VALUE-LOAD path for struct/array defs but the
+ * ADDRESS-OF twin (cgexpr N_UN TK_AMP / cgun) never handled def-symbols
+ * nor module-qualified globals, so `&def` / `&mod.global` emitted an
+ * uninitialised AX (PUSHQ AX / POPQ DI / CALL — no LEAQ) → garbage
+ * pointer, despite the DATA symbol existing. cs+ww were BYTE-IDENTICAL
+ * on the bug (gate-blind), so each row carries BOTH dimensions:
+ *   (a) `ww build` + run, asserting the exit code == the value reached
+ *       THROUGH the pointer (a garbage pointer yields a wrong value, not
+ *       a false exit-0 — the probe lesson).
+ *   (b) w6c vs w6c_ww `.s` cmp — FAILS if the stages diverge (rule-10).
+ *
+ * Two operand shapes, one class (cgaddr-doesn't-handle-defs):
+ *   Shape 1 `&G`        — N_IDENT, G a top-level def (struct/array/scalar)
+ *   Shape 2 `&mod.G`    — N_DOT, mod a module qualifier (kind-agnostic:
+ *                         cross-module let / def / scalar / fn)
+ * The fold-4 / γ-cleanup driver is the cross-module struct-def row
+ * (`&mod.def_struct`, the `&math::f64info` shape).
+ *
+ * Non-addressable defs (str def inlined; computed-rhs float like
+ * `def NAN = 0.0/0.0` — #147, no DATA symbol) are NOT silently dropped:
+ * `&them` is a LOUD build error in both stages (rule-7). Those rows set
+ * want_build_fail.
+ *
+ * NOTE: array-element reads THROUGH a `*[N]T` pointer param have a
+ * pre-existing cs!=ww divergence (narrow MOVSXD/MOVL + esz-stride),
+ * unrelated to #149 — so the def-array row reads element 0 via a
+ * `*[N]T -> *T` cast + plain deref, which isolates the `&A` LEAQ.
+ *
+ * Single-file multi-package form (like 953_f64crossmod_run): `package
+ * myf; ... package main; import myf; ...` so w6c/w6c_ww see the cross-
+ * module reference without -I plumbing.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row {
+	const char *label;
+	const char *src;
+	int want_exit;
+	int want_build_fail;	/* 1: w6c must reject (loud rule-7 error) */
+};
+
+static const struct row rows[] = {
+	/* Shape 1 — same-pkg `&def`. */
+	{ "def_struct",
+	  "package main;\n"
+	  "type pt = struct { x: i32, y: i32 };\n"
+	  "def P: pt = pt{x=7, y=11};\n"
+	  "fn rd(p: *pt) i32 = { return p.x + p.y; };\n"
+	  "export fn main() i32 = { return rd(&P); };\n", 18, 0 },
+	{ "def_array",
+	  "package main;\n"
+	  "def A: [3]i64 = [18i64, 11i64, 0i64];\n"
+	  "fn rd(p: *[3]i64) i64 = { let q: *i64 = p: *i64; return *q; };\n"
+	  "export fn main() i32 = { return rd(&A): i32; };\n", 18, 0 },
+	{ "def_scalar_int",
+	  "package main;\n"
+	  "def N: i32 = 42;\n"
+	  "fn rd(p: *i32) i32 = { return *p; };\n"
+	  "export fn main() i32 = { return rd(&N); };\n", 42, 0 },
+	{ "def_scalar_float",
+	  "package main;\n"
+	  "def D: f64 = 0.5;\n"
+	  "fn rd(p: *f64) f64 = { return *p; };\n"
+	  "export fn main() i32 = { return (rd(&D) * 100.0): i32; };\n", 50, 0 },
+
+	/* Shape 2 — cross-pkg `&mod.G` (kind-agnostic). */
+	{ "xmod_def_struct",	/* the &math::f64info / fold-4 shape */
+	  "package myf;\n"
+	  "export type pt = struct { x: i32, y: i32 };\n"
+	  "export def P: pt = pt{x=7, y=11};\n"
+	  "package main;\n"
+	  "import myf;\n"
+	  "fn rd(p: *myf.pt) i32 = { return p.x + p.y; };\n"
+	  "export fn main() i32 = { return rd(&myf.P); };\n", 18, 0 },
+	{ "xmod_let_struct",
+	  "package myf;\n"
+	  "export type pt = struct { x: i32, y: i32 };\n"
+	  "export let L: pt = pt{x=7, y=11};\n"
+	  "package main;\n"
+	  "import myf;\n"
+	  "fn rd(p: *myf.pt) i32 = { return p.x + p.y; };\n"
+	  "export fn main() i32 = { return rd(&myf.L); };\n", 18, 0 },
+	{ "xmod_scalar_let",
+	  "package myf;\n"
+	  "export let S: i32 = 42;\n"
+	  "package main;\n"
+	  "import myf;\n"
+	  "fn rd(p: *i32) i32 = { return *p; };\n"
+	  "export fn main() i32 = { return rd(&myf.S); };\n", 42, 0 },
+	{ "xmod_func",		/* Shape 2 TY_FN leaf → LEAQ fn(SB) */
+	  "package myf;\n"
+	  "export fn helper() i32 = { return 42; };\n"
+	  "package main;\n"
+	  "import myf;\n"
+	  "fn take(p: *fn() i32) i32 = { return 7; };\n"
+	  "export fn main() i32 = { return take(&myf.helper); };\n", 7, 0 },
+
+	/* Regressions — paths the fix must NOT disturb. */
+	{ "reg_let_struct",	/* &let_struct worked same-pkg pre-#149 */
+	  "package main;\n"
+	  "type pt = struct { x: i32, y: i32 };\n"
+	  "let L: pt = pt{x=7, y=11};\n"
+	  "fn rd(p: *pt) i32 = { return p.x + p.y; };\n"
+	  "export fn main() i32 = { return rd(&L); };\n", 18, 0 },
+	{ "reg_amp_arr_idx",	/* &local_arr[i] */
+	  "package main;\n"
+	  "fn rd(p: *i64) i64 = { return *p; };\n"
+	  "export fn main() i32 = {\n"
+	  "	let a: [3]i64 = [5i64, 18i64, 9i64];\n"
+	  "	let p: *i64 = &a[1];\n"
+	  "	return rd(p): i32; };\n", 18, 0 },
+
+	/* rule-7 LOUD: `&non-addressable def` (no DATA symbol). */
+	{ "fail_str_def",
+	  "package main;\n"
+	  "def MSG: str = \"hello\";\n"
+	  "fn rd(p: *str) i32 = { return 7; };\n"
+	  "export fn main() i32 = { return rd(&MSG); };\n", 0, 1 },
+	{ "fail_computed_float",	/* #147 `def NAN = 0.0/0.0` shape */
+	  "package main;\n"
+	  "def D: f64 = 1.0 / 4.0;\n"
+	  "fn rd(p: *f64) f64 = { return *p; };\n"
+	  "export fn main() i32 = { return (rd(&D) * 100.0): i32; };\n", 0, 1 },
+
+	{ NULL, NULL, 0, 0 }
+};
+
+static int
+slurp_eq(const char *a, const char *b)
+{
+	FILE *fa = fopen(a, "rb");
+	FILE *fb = fopen(b, "rb");
+	if (!fa || !fb) { if (fa) fclose(fa); if (fb) fclose(fb); return -1; }
+	int rc = 0;
+	for (;;) {
+		int ca = fgetc(fa);
+		int cb = fgetc(fb);
+		if (ca != cb) { rc = -1; break; }
+		if (ca == EOF) break;
+	}
+	fclose(fa); fclose(fb);
+	return rc;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char w6c[1100], w6c_ww[1100];
+	snprintf(w6c, sizeof w6c, "%s/w6c", bin);
+	snprintf(w6c_ww, sizeof w6c_ww, "%s/w6c_ww", bin);
+	if (access(w6c_ww, X_OK) != 0) {
+		fprintf(stderr, "amp_def_global: w6c_ww missing — cannot run the "
+		    "cs==ww byte-id gate (the whole point of this test)\n");
+		return 1;
+	}
+
+	int n = 0, fail = 0;
+	for (int i = 0; rows[i].src; i++, n++) {
+		char src[64];
+		snprintf(src, sizeof src, "/tmp/wwamp_%d_%d.ww", getpid(), i);
+		FILE *f = fopen(src, "wb");
+		if (f == NULL) { fail++; continue; }
+		fputs(rows[i].src, f);
+		fclose(f);
+
+		if (rows[i].want_build_fail) {
+			/* rule-7 LOUD: both stages must REJECT (`&` of a non-
+			 * addressable def has no DATA symbol). Build to .s and
+			 * assert non-zero exit on each stage. */
+			char cmd[2048], dump[64];
+			snprintf(dump, sizeof dump, "/tmp/wwamp_%d_%d.s",
+			    getpid(), i);
+			snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null",
+			    w6c, dump, src);
+			if (runwait(cmd) == 0) {
+				fprintf(stderr, "row[%s]: w6c ACCEPTED &non-"
+				    "addressable-def (want loud reject)\n",
+				    rows[i].label);
+				fail++;
+			}
+			snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null",
+			    w6c_ww, dump, src);
+			if (runwait(cmd) == 0) {
+				fprintf(stderr, "row[%s]: w6c_ww ACCEPTED &non-"
+				    "addressable-def (want loud reject)\n",
+				    rows[i].label);
+				fail++;
+			}
+			unlink(src); unlink(dump);
+			continue;
+		}
+
+		/* (a) cstage build + run; assert exit == value reached
+		 * through the pointer. */
+		char tmpdir[64];
+		snprintf(tmpdir, sizeof tmpdir, "/tmp/wwamp_%d_d_%d",
+		    getpid(), i);
+		mkdir(tmpdir, 0755);
+
+		char cmd[2048];
+		snprintf(cmd, sizeof cmd, "cd %s && %s/ww build %s",
+		    tmpdir, bin, src);
+		if (runwait(cmd) != 0) {
+			fprintf(stderr, "row[%s]: cstage build failed\n",
+			    rows[i].label);
+			fail++;
+			unlink(src); rmdir(tmpdir);
+			continue;
+		}
+
+		char outbin[128];
+		const char *base = strrchr(src, '/');
+		base = base ? base + 1 : src;
+		snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+		char *dot = strrchr(outbin, '.');
+		if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+
+		int got = runwait(outbin);
+		if (got != rows[i].want_exit) {
+			fprintf(stderr, "row[%s]: cstage exit %d, want %d\n",
+			    rows[i].label, got, rows[i].want_exit);
+			fail++;
+		}
+		unlink(outbin); rmdir(tmpdir);
+
+		/* (b) cs==ww byte-id gate. */
+		char cs_s[64], ws_s[64];
+		snprintf(cs_s, sizeof cs_s, "/tmp/wwamp_%d_%d_cs.s",
+		    getpid(), i);
+		snprintf(ws_s, sizeof ws_s, "/tmp/wwamp_%d_%d_ww.s",
+		    getpid(), i);
+
+		snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null",
+		    w6c, cs_s, src);
+		if (runwait(cmd) != 0) {
+			fprintf(stderr, "row[%s]: w6c failed\n", rows[i].label);
+			fail++; unlink(src); continue;
+		}
+		snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null",
+		    w6c_ww, ws_s, src);
+		if (runwait(cmd) != 0) {
+			fprintf(stderr, "row[%s]: w6c_ww failed\n",
+			    rows[i].label);
+			fail++; unlink(src); unlink(cs_s); continue;
+		}
+		if (slurp_eq(cs_s, ws_s) != 0) {
+			fprintf(stderr,
+			    "row[%s]: cstage/wwstage .s DIFFER (rule-10 "
+			    "byte-id violation)\n", rows[i].label);
+			fail++;
+		}
+		unlink(src); unlink(cs_s); unlink(ws_s);
+	}
+
+	if (fail) {
+		fprintf(stderr, "%d/%d amp-def-global tests failed\n", fail, n);
+		return 1;
+	}
+	printf("amp_def_global: %d/%d ok (cstage run + cs==ww byte-id)\n",
+	    n, n);
+	return 0;
+}