wcc: loop-label stack guards its depth loudly, both stages

wwstage's unguarded loop-label push wrote out of bounds at depth 17
(compiler-heap corruption); cstage guarded but emitted a wrong break
target. Loud cap error at the limit, both stages, agreeing wording.

test/wcc/989_loopcap_run.c

@@ -0,0 +1,171 @@
+/*
+ * 989_loopcap_run (#42, F13 c2) — the loop-label stack must fail loud at its
+ * cap in BOTH stages, not silently corrupt the heap / emit a wrong target.
+ *
+ * THE BUG (cat-A): wwstage cgfor / cgforrange pushed end+continue labels into
+ * loopendbuf/loopcontbuf (sized exactly LOOP_MAX=16) with NO bounds check, so
+ * nesting depth 17 wrote one past the heap allocation — silent compiler-heap
+ * corruption. The cstage twins DID guard (`if (nloops < LOOP_MAX)`) but then
+ * silently emitted the 16th loop's break/continue label for the 17th loop — a
+ * wrong jump target, also silent. Both stages were wrong at the boundary and
+ * diverged. The runtime-correct target (CAP-SEMANTICS rule): a hard compile
+ * error at the shared cap (LOOP_MAX) in BOTH stages — ww adds the bounds
+ * check, cstage turns its silent skip into a fatal.
+ *
+ *   row         | depth | shape                       | result (cs==ww)
+ *   ------------+-------+-----------------------------+-----------------
+ *   at_cap_16   | 16    | exactly LOOP_MAX nested for | exit 0 (byte-id)
+ *   over_cap_17 | 17    | one past the cap            | build FAILS loud
+ *
+ * over_cap_17 was RED pre-c2 on BOTH stages (ww OOB write, cs wrong JMP
+ * target, divergent and silent under rc=0). at_cap_16 pins the boundary stays
+ * accepted byte-identically.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row { const char *label; int depth; int want_build_fail; int want_exit; };
+
+static const struct row rows[] = {
+	{ "at_cap_16",   16, 0, 0 },
+	{ "over_cap_17", 17, 1, 0 },
+};
+
+/* Emit `depth` nested `for (n < 1) { ... }` over one shared counter that the
+ * innermost body sets to 1, so every level terminates. */
+static int
+write_src(const char *path, int depth)
+{
+	FILE *f = fopen(path, "wb");
+	if (!f) return -1;
+	fputs("package main;\n"
+	      "export fn main() i32 = {\n"
+	      "\tlet n: i32 = 0;\n\t", f);
+	for (int i = 0; i < depth; i++) fputs("for (n < 1) { ", f);
+	fputs("n = 1;", f);
+	for (int i = 0; i < depth; i++) fputs(" };", f);
+	fputs("\n\treturn 0;\n};\n", f);
+	fclose(f);
+	return 0;
+}
+
+static int
+build_run(const char *driver, const struct row *r, int i, int *brc)
+{
+	char src[64], tmpdir[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/lcap_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/lcap_%d_d_%d", getpid(), i);
+
+	if (write_src(src, r->depth) != 0) { *brc = -1; return -1; }
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, src);
+	*brc = runwait(cmd);
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+
+	int got = -1;
+	if (*brc == 0) got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return got;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[1024], wdrv[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+	int have_ww = (access(wdrv, X_OK) == 0);
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+
+	for (int i = 0; i < n; i++) {
+		total++;
+		int cbrc, gc = build_run(cdrv, &rows[i], i, &cbrc);
+
+		if (rows[i].want_build_fail) {
+			if (cbrc == 0) {
+				fprintf(stderr, "loopcap[cstage][%s]: built rc=0, "
+				    "expected loud build failure (#42)\n", rows[i].label);
+				fail++;
+			}
+		} else {
+			if (cbrc != 0 || gc != rows[i].want_exit) {
+				fprintf(stderr, "loopcap[cstage][%s]: brc=%d exit=%d "
+				    "want_exit=%d\n", rows[i].label, cbrc, gc,
+				    rows[i].want_exit);
+				fail++;
+			}
+		}
+
+		if (!have_ww) {
+			fprintf(stderr, "loopcap: skip wwstage (no %s)\n", wdrv);
+			continue;
+		}
+		int wbrc, gw = build_run(wdrv, &rows[i], i, &wbrc);
+
+		if (rows[i].want_build_fail) {
+			if (wbrc == 0) {
+				fprintf(stderr, "loopcap[wwstage][%s]: built rc=0, "
+				    "expected loud build failure (#42)\n", rows[i].label);
+				fail++;
+			}
+			if ((cbrc == 0) != (wbrc == 0)) {
+				fprintf(stderr, "loopcap[%s]: build-fail divergence "
+				    "cs_rc=%d ww_rc=%d (#42)\n", rows[i].label, cbrc, wbrc);
+				fail++;
+			}
+		} else {
+			if (wbrc != 0 || gw != rows[i].want_exit) {
+				fprintf(stderr, "loopcap[wwstage][%s]: brc=%d exit=%d "
+				    "want_exit=%d\n", rows[i].label, wbrc, gw,
+				    rows[i].want_exit);
+				fail++;
+			}
+			if (gw != gc) {
+				fprintf(stderr, "loopcap[%s]: cs=%d != ww=%d "
+				    "(loop-cap divergence — #42)\n", rows[i].label, gc, gw);
+				fail++;
+			}
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr, "loopcap_run: %d/%d checks failed\n", fail, total);
+		return 1;
+	}
+	printf("loopcap_run: %d/%d ok\n", total, total);
+	return 0;
+}