wcc_ww/check: inferred struct-lit let plants the synthesized TNAME — field(SB) name-leak + tagged-field assign bound (#24)

For an annotation-less `let p = pt{...}` checkletassign planted exprtype's
N_STRUCTLIT result — the struct decl's BODY node (N_TSTRUCT, per #66) — as
the let's type. Every cgen local-arm dispatch (cgdot read, cgassign
tagged-field store, the alias peel) is N_TNAME-keyed, so the body matched
no arm: field reads fell to the module-qualified fallback and emitted the
FIELD NAME as a global symbol (MOVQ f(SB) — link-fail, #211 name-leak
family; silent corruption if a same-named global exists), and a tagged-
field assign fell to the assign-resolver TY_TAGGED loud bound. Both PG5
wwstage symptoms, one root; plain structs leaked too. Normalizing the
inferred binding to the synthesized TNAME (mktname + tinfofornode stamp)
routes every consumer down the already-byte-id annotated path. cstage
needs no twin: check.c:1477 clet carries Sym.type (tinfo) and its
emission is annotation-invariant (probed). Test 811: 10 rows x 2 drivers
+ 10 asm-byte-id; pre-fix wwstage link-fails every unannotated row
(incl. the `...` autofill and parenthesized forms; nested s.f.g ran
but cs!=ww asm).

Makefile

@@ -398,6 +398,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_insert_elem \
 	  $(BIN)/test_arrlit_overlong \
 	  $(BIN)/test_idx_structlit_store \
+	  $(BIN)/test_inferred_let_struct \
 	  $(BIN)/test_placeaddr_store \
 	  $(BIN)/test_tryprop_multisuccess \
 	  $(BIN)/test_append_place \
@@ -1086,6 +1087,19 @@ $(BIN)/test_idx_structlit_store: test/wcc/809_idx_structlit_store.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+# #24 (fold-5 prereq, PG5 wwstage pair): field read/assign through an
+# annotation-less struct-literal binding `let p = pt{...}` — pre-fix
+# the wwstage checker planted the struct BODY node (N_TSTRUCT) as the
+# inferred let's type, no N_TNAME-keyed cgen arm matched, and `p.f`
+# leaked the FIELD NAME as a global symbol (`MOVQ f(SB)`, link-fail;
+# #211 name-leak family) while a tagged-field assign hit the
+# assign-resolver loud bound. Runtime rows + asm byte-id per row.
+$(BIN)/test_inferred_let_struct: test/wcc/811_inferred_let_struct.c \
+		$(BIN)/ww $(BIN)/w6c $(BIN)/w6c_ww $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/ww_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 # F8+F9 (tasks #5/#12, regex fold-2b): `?` interim single-success gate
 # (|success| > 1 loud-rejected on BOTH stages until task #14's
 # subset-union typing) + direct `f()? is T` / `match (f()?)` reject

selfhost/cmd/w6c/main.combined.ww

@@ -14627,6 +14627,24 @@ fn checkletassign(c: *checker, n: *node) void = {
 	// Defaulting (untyped_int → i32, etc.) is exprtype's job at use
 	// sites, not the binding site.
 	if (n.lhs == nil) {
+		// #24 (fold-5 prereq): a struct-lit init's exprtype returns the
+		// decl's BODY node (N_TSTRUCT, L3103 per #66) — but every cgen
+		// local-arm dispatch (cgdot read, cgassign tagged-field store,
+		// cgun addr-of) is N_TNAME-keyed, so planting the body dropped
+		// `p.f` to the module-qualified `MOVQ f(SB)` fallback (link-fail
+		// name-leak; #211 family). Normalize to the synthesized TNAME so
+		// the inferred binding is indistinguishable from the annotated
+		// one downstream. cstage needs no twin: check.c:1477 clet carries
+		// Sym.type (tinfo), and its emission is annotation-invariant
+		// (probed identical asm annotated vs not).
+		if (src != nil && src.kind == nkind.N_TSTRUCT
+		    && n.rhs.kind == nkind.N_STRUCTLIT
+		    && n.rhs.lhs != nil && n.rhs.lhs.kind == nkind.N_IDENT) {
+			let ltn: *node = mktname(c, n.rhs.lhs.str);
+			ltn.type_ = tinfofornode(c, ltn): *void;
+			n.lhs = ltn;
+			return;
+		};
 		if (src != nil) { n.lhs = src; };
 		return;
 	};

selfhost/cmd/wcc/check.ww

@@ -4363,6 +4363,24 @@ fn checkletassign(c: *checker, n: *node) void = {
 	// Defaulting (untyped_int → i32, etc.) is exprtype's job at use
 	// sites, not the binding site.
 	if (n.lhs == nil) {
+		// #24 (fold-5 prereq): a struct-lit init's exprtype returns the
+		// decl's BODY node (N_TSTRUCT, L3103 per #66) — but every cgen
+		// local-arm dispatch (cgdot read, cgassign tagged-field store,
+		// cgun addr-of) is N_TNAME-keyed, so planting the body dropped
+		// `p.f` to the module-qualified `MOVQ f(SB)` fallback (link-fail
+		// name-leak; #211 family). Normalize to the synthesized TNAME so
+		// the inferred binding is indistinguishable from the annotated
+		// one downstream. cstage needs no twin: check.c:1477 clet carries
+		// Sym.type (tinfo), and its emission is annotation-invariant
+		// (probed identical asm annotated vs not).
+		if (src != nil && src.kind == nkind.N_TSTRUCT
+		    && n.rhs.kind == nkind.N_STRUCTLIT
+		    && n.rhs.lhs != nil && n.rhs.lhs.kind == nkind.N_IDENT) {
+			let ltn: *node = mktname(c, n.rhs.lhs.str);
+			ltn.type_ = tinfofornode(c, ltn): *void;
+			n.lhs = ltn;
+			return;
+		};
 		if (src != nil) { n.lhs = src; };
 		return;
 	};

selfhost/cmd/wwdump/main.combined.ww

@@ -14627,6 +14627,24 @@ fn checkletassign(c: *checker, n: *node) void = {
 	// Defaulting (untyped_int → i32, etc.) is exprtype's job at use
 	// sites, not the binding site.
 	if (n.lhs == nil) {
+		// #24 (fold-5 prereq): a struct-lit init's exprtype returns the
+		// decl's BODY node (N_TSTRUCT, L3103 per #66) — but every cgen
+		// local-arm dispatch (cgdot read, cgassign tagged-field store,
+		// cgun addr-of) is N_TNAME-keyed, so planting the body dropped
+		// `p.f` to the module-qualified `MOVQ f(SB)` fallback (link-fail
+		// name-leak; #211 family). Normalize to the synthesized TNAME so
+		// the inferred binding is indistinguishable from the annotated
+		// one downstream. cstage needs no twin: check.c:1477 clet carries
+		// Sym.type (tinfo), and its emission is annotation-invariant
+		// (probed identical asm annotated vs not).
+		if (src != nil && src.kind == nkind.N_TSTRUCT
+		    && n.rhs.kind == nkind.N_STRUCTLIT
+		    && n.rhs.lhs != nil && n.rhs.lhs.kind == nkind.N_IDENT) {
+			let ltn: *node = mktname(c, n.rhs.lhs.str);
+			ltn.type_ = tinfofornode(c, ltn): *void;
+			n.lhs = ltn;
+			return;
+		};
 		if (src != nil) { n.lhs = src; };
 		return;
 	};

test/wcc/811_inferred_let_struct.c

@@ -0,0 +1,367 @@
+/*
+ * 811_inferred_let_struct — cstage and wwstage agree, byte-for-byte and
+ * at runtime, on field access through an ANNOTATION-LESS struct-literal
+ * binding `let p = pt { ... };` (task #24, fold-5 prereq; the PG5
+ * wwstage pair).
+ *
+ * The bug (wwstage only): for an inferred binding the checker planted
+ * the struct decl's BODY node (N_TSTRUCT, exprtype N_STRUCTLIT returns
+ * ms.decl.lhs per #66) as the let's type — but every cgen local-arm
+ * dispatch (cgdot field read, cgassign tagged-field store, the alias
+ * peel) is N_TNAME-keyed. The body matched no arm, so `p.f` fell
+ * through to the module-qualified fallback and emitted the FIELD NAME
+ * as a global symbol (`MOVQ f(SB), AX` — the #211 name-leak family;
+ * loud at link, silent corruption if a same-named global exists), and
+ * a tagged-field assign fell to the assign-resolver's TY_TAGGED loud
+ * bound ("assign-resolver: tagged field not wired"). cstage was
+ * unaffected: check.c:1477 clet carries Sym.type (tinfo) and its
+ * emission is annotation-invariant.
+ *
+ * The fix (wwstage checker, check.ww checkletassign): normalize the
+ * inferred binding to the synthesized N_TNAME (mktname), making it
+ * indistinguishable from the annotated form downstream — every read/
+ * assign/is/as arm then takes the already-byte-id annotated route.
+ *
+ * Mutation coverage: on pre-fix wwstage every unannotated row LINK-
+ * FAILS (undefined reference to the field name), so run_driver's -1
+ * catches a regression outright; the annotated rows pin that the
+ * normalization didn't perturb the annotated path (byte-id rows assert
+ * cstage == wwstage asm for all rows).
+ *
+ *   row                  | shape                              | want
+ *   ---------------------+------------------------------------+------
+ *   plain_read           | let p = pt{..}; p.x*10 + p.y       | 42
+ *   tagged_read_is_as    | (void|size) field: read + is/as    | 6
+ *   tagged_void_read     | min=void; `is void` arm            | 7
+ *   tagged_assign        | r.min = 2: size through inferred   | 3
+ *   tagged_str_field     | (void|str): assign + as-str .len   | 14
+ *   boxed_prebound       | field-wise build, box into union,  | 103
+ *                        | match-extract, is/as (PG5h)        |
+ *   annotated_pin        | same as tagged_assign but with an  | 3
+ *                        | explicit `: rep` annotation        |
+ *   nested_read          | plain nested s.f.g read (master    | 42
+ *                        | ran right but cs!=ww asm)          |
+ *   ellipsis_fill        | pt{ x = 4, ... } autofill (master  | 40
+ *                        | wwstage link-failed)               |
+ *   paren_form           | (pt{..}) — parser unwraps parens,  | 42
+ *                        | same N_STRUCTLIT rhs (master       |
+ *                        | wwstage link-failed)               |
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row { const char *label; const char *src; int want; };
+
+static const struct row rows[] = {
+	{ "plain_read",
+	  "package main;\n"
+	  "type pt = struct { x: size, y: size };\n"
+	  "export fn main() i32 = {\n"
+	  "\tlet p = pt { x = 4: size, y = 2: size };\n"
+	  "\treturn (p.x * 10 + p.y): i32;\n"
+	  "};\n",
+	  42 },
+
+	{ "tagged_read_is_as",
+	  "package main;\n"
+	  "type rep = struct { id: size, min: (void | size) };\n"
+	  "export fn main() i32 = {\n"
+	  "\tlet r = rep { id = 1: size, min = 5: size };\n"
+	  "\tlet acc = 0: size;\n"
+	  "\tacc += r.id;\n"
+	  "\tif (r.min is size) { acc += r.min as size; };\n"
+	  "\treturn acc: i32;\n"
+	  "};\n",
+	  6 },
+
+	{ "tagged_void_read",
+	  "package main;\n"
+	  "type rep = struct { id: size, min: (void | size) };\n"
+	  "export fn main() i32 = {\n"
+	  "\tlet r = rep { id = 0: size, min = void };\n"
+	  "\tlet acc = 0: size;\n"
+	  "\tif (r.min is void) { acc += 7; };\n"
+	  "\tif (r.min is size) { acc += r.min as size; };\n"
+	  "\treturn acc: i32;\n"
+	  "};\n",
+	  7 },
+
+	{ "tagged_assign",
+	  "package main;\n"
+	  "type rep = struct { id: size, min: (void | size) };\n"
+	  "export fn main() i32 = {\n"
+	  "\tlet r = rep { id = 0: size, min = void };\n"
+	  "\tr.id = 1;\n"
+	  "\tr.min = 2: size;\n"
+	  "\tlet acc = 0: size;\n"
+	  "\tacc += r.id;\n"
+	  "\tif (r.min is size) { acc += r.min as size; };\n"
+	  "\treturn acc: i32;\n"
+	  "};\n",
+	  3 },
+
+	{ "tagged_str_field",
+	  "package main;\n"
+	  "type rep = struct { id: size, min: (void | size), name: (void | str) };\n"
+	  "export fn main() i32 = {\n"
+	  "\tlet b = rep { id = 0: size, min = void, name = void };\n"
+	  "\tb.id = 2;\n"
+	  "\tb.min = 9: size;\n"
+	  "\tb.name = \"hey\";\n"
+	  "\tlet acc = 0: size;\n"
+	  "\tacc += b.id;\n"
+	  "\tif (b.min is size) { acc += b.min as size; };\n"
+	  "\tif (b.name is str) { acc += (b.name as str).len: size; };\n"
+	  "\treturn acc: i32;\n"
+	  "};\n",
+	  14 },
+
+	/* PG5h: field-wise construction through the inferred binding,
+	 * boxed into a tagged union, match-extracted, is/as off the
+	 * binding — the fold-5b inst_repeat consumer shape. */
+	{ "boxed_prebound",
+	  "package main;\n"
+	  "type inst_lit = rune;\n"
+	  "type rep3 = struct { id: size, min: (void | size), max: (void | size) };\n"
+	  "type inst = (inst_lit | rep3);\n"
+	  "export fn main() i32 = {\n"
+	  "\tlet r = rep3 { id = 0: size, min = void, max = void };\n"
+	  "\tr.id = 1;\n"
+	  "\tr.min = 2: size;\n"
+	  "\tr.max = 5: size;\n"
+	  "\tlet pre = 0: size;\n"
+	  "\tif (r.min is size) { pre += r.min as size; };\n"
+	  "\tif (pre != 2) { return 200 + pre: i32; };\n"
+	  "\tlet v: inst = r;\n"
+	  "\tlet acc = 0: size;\n"
+	  "\tmatch (v) {\n"
+	  "\tcase let ir: rep3 => {\n"
+	  "\t\tacc += ir.id;\n"
+	  "\t\tif (ir.min is size) { acc += ir.min as size; };\n"
+	  "\t\tif (ir.max is size && ir.max as size == 5) { acc += 100; };\n"
+	  "\t};\n"
+	  "\tcase let l: inst_lit => { acc += 1; };\n"
+	  "\t};\n"
+	  "\treturn acc: i32;\n"
+	  "};\n",
+	  103 },
+
+	/* Regression pin: the explicit annotation must stay on its prior
+	 * (already byte-id) route — the normalization only fires for the
+	 * inferred binding. */
+	{ "annotated_pin",
+	  "package main;\n"
+	  "type rep = struct { id: size, min: (void | size) };\n"
+	  "export fn main() i32 = {\n"
+	  "\tlet r: rep = rep { id = 0: size, min = void };\n"
+	  "\tr.id = 1;\n"
+	  "\tr.min = 2: size;\n"
+	  "\tlet acc = 0: size;\n"
+	  "\tacc += r.id;\n"
+	  "\tif (r.min is size) { acc += r.min as size; };\n"
+	  "\treturn acc: i32;\n"
+	  "};\n",
+	  3 },
+
+	/* Plain nested s.f.g through the inferred binding: on master
+	 * wwstage this RAN correctly but emitted different asm (the body-
+	 * node planting took a divergent cgdot route) — pins byte-id. */
+	{ "nested_read",
+	  "package main;\n"
+	  "type in_ = struct { g: size };\n"
+	  "type out_ = struct { f: in_ };\n"
+	  "export fn main() i32 = {\n"
+	  "\tlet s = out_ { f = in_ { g = 6: size } };\n"
+	  "\treturn (s.f.g * 7): i32;\n"
+	  "};\n",
+	  42 },
+
+	/* Trailing-`...` autofill (parse/expr.ww TK_ELLIPSIS, stash on
+	 * s.op): same N_STRUCTLIT rhs kind, so the normalization must
+	 * cover it — master wwstage link-failed this form too. */
+	{ "ellipsis_fill",
+	  "package main;\n"
+	  "type pt = struct { x: size, y: size };\n"
+	  "export fn main() i32 = {\n"
+	  "\tlet p = pt { x = 4: size, ... };\n"
+	  "\treturn (p.x * 10 + p.y): i32;\n"
+	  "};\n",
+	  40 },
+
+	/* Parenthesized literal: the parser unwraps parens (no N_PAREN
+	 * node), so the rhs is the same bare N_STRUCTLIT — pins that the
+	 * form-coverage claim holds at the parse layer. */
+	{ "paren_form",
+	  "package main;\n"
+	  "type pt = struct { x: size, y: size };\n"
+	  "export fn main() i32 = {\n"
+	  "\tlet p = (pt { x = 4: size, y = 2: size });\n"
+	  "\treturn (p.x * 10 + p.y): i32;\n"
+	  "};\n",
+	  42 },
+};
+
+static int
+run_driver(const char *driver, const struct row *r, int i)
+{
+	char src[64], tmpdir[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/ils_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/ils_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -1;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, src);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "row[%s]: build via %s failed\n",
+		    r->label, driver);
+		unlink(src); rmdir(tmpdir);
+		return -1;
+	}
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+	int got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return got;
+}
+
+/* asm_byte_identical — generate .s via cstage's w6c and wwstage's
+ * w6c_ww and diff. Pre-fix the unannotated rows emitted `MOVQ
+ * <field>(SB), AX` on wwstage only, so the diff was non-empty (and
+ * the wwstage link failed). */
+static int
+asm_byte_identical(const char *bin, const struct row *r, int i)
+{
+	char src[64], cs[64], ws[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/ils_asm_%d_%d.ww", getpid(), i);
+	snprintf(cs,  sizeof cs,  "/tmp/ils_asm_%d_%d_c.s", getpid(), i);
+	snprintf(ws,  sizeof ws,  "/tmp/ils_asm_%d_%d_w.s", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -1;
+	fputs(r->src, f);
+	fclose(f);
+
+	snprintf(cmd, sizeof cmd, "%s/w6c -o %s %s 2>/dev/null", bin, cs, src);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "row[%s]: w6c errored\n", r->label);
+		unlink(src);
+		return -1;
+	}
+	snprintf(cmd, sizeof cmd, "%s/w6c_ww -o %s %s 2>/dev/null",
+	    bin, ws, src);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "row[%s]: w6c_ww errored\n", r->label);
+		unlink(src); unlink(cs);
+		return -1;
+	}
+
+	FILE *fc = fopen(cs, "rb");
+	FILE *fw = fopen(ws, "rb");
+	int rc = 0;
+	if (!fc || !fw) {
+		rc = -1;
+	} else {
+		for (;;) {
+			int a = fgetc(fc);
+			int b = fgetc(fw);
+			if (a != b) { rc = -1; break; }
+			if (a == EOF) break;
+		}
+	}
+	if (fc) fclose(fc);
+	if (fw) fclose(fw);
+	if (rc != 0)
+		fprintf(stderr, "row[%s]: cstage vs wwstage asm differs\n",
+		    r->label);
+	unlink(src); unlink(cs); unlink(ws);
+	return rc;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	char wdrv[1024];
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+
+	struct { const char *name; const char *path; int gated_on_existence; }
+	drivers[] = {
+		{ "cstage",  cdrv, 0 },
+		{ "wwstage", wdrv, 1 },
+		{ NULL, NULL, 0 },
+	};
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+
+	for (int d = 0; drivers[d].name; d++) {
+		if (drivers[d].gated_on_existence
+		    && access(drivers[d].path, X_OK) != 0) {
+			fprintf(stderr, "inferred_let_struct: skip %s (no %s)\n",
+			    drivers[d].name, drivers[d].path);
+			continue;
+		}
+		for (int i = 0; i < n; i++) {
+			int got = run_driver(drivers[d].path, &rows[i], i);
+			total++;
+			if (got != rows[i].want) {
+				fprintf(stderr,
+				    "inferred_let_struct[%s][%s]: exit=%d want=%d\n",
+				    drivers[d].name, rows[i].label,
+				    got, rows[i].want);
+				fail++;
+			}
+		}
+	}
+
+	if (access(wdrv, X_OK) == 0) {
+		for (int i = 0; i < n; i++) {
+			total++;
+			if (asm_byte_identical(bin, &rows[i], i) != 0)
+				fail++;
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr,
+		    "inferred_let_struct: %d/%d fixtures failed\n", fail, total);
+		return 1;
+	}
+	printf("inferred_let_struct: all %d fixtures passed\n", total);
+	return 0;
+}