w6c+wwstage: emit global str/slice len via .len field load (#231)

len(str-or-slice-global) was wrong in both stages, differently. cstage's
len() arm did a BP-relative slot load; localfind returns 0 for a global,
so it emitted `MOVQ 8(BP),AX` — a bogus stack slot. wwstage's arm only
handled locals; a global fell through to cgexpr, which loads the whole
header and leaves AX=.ptr, not .len.

Both stages now emit the global .len load — LEAQ name(SB),CX; MOVQ
8(CX),AX (.len field; header is ptr@0/len@8/cap@16). The LEAQ symbol
routes through the post-#1 value mangle (cstage mahint c->cur_mod,
wwstage emitsymnamehint c.curmod), not a raw name, so a private
same-module same-leaf str global can't re-open the #1 collision.

The local-str case is unchanged (control). Slice-global rows wait on
#233 (cstage rejects `let g: []u8 = [...]` init); the str global proves
the path. Byte-id-blind, so a committed runtime + cs==ww test (797) is
the net.

Makefile

@@ -343,6 +343,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_xmod_ident_prefer \
 	  $(BIN)/test_xmod_valglobal_run \
 	  $(BIN)/test_xmod_valglobal_dot_run \
+	  $(BIN)/test_len_strglobal_run \
 	  $(BIN)/test_widen_pad_zero_run \
 	  $(BIN)/test_named_ptr_alias_variant_widen \
 	  $(BIN)/test_single_field_struct_zeroinit \
@@ -831,6 +832,14 @@ $(BIN)/test_xmod_valglobal_dot_run: test/wcc/796_xmod_valglobal_dot_run.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+# #231: len(str/slice global) must load the .len field via the global's
+# address (LEAQ name(SB),CX; MOVQ 8(CX),AX), not a bogus BP-relative slot
+# (cstage) or the whole header's .ptr (wwstage) — runtime + cs==ww byte-id.
+$(BIN)/test_len_strglobal_run: test/wcc/797_len_strglobal_run.c \
+		$(BIN)/ww $(BIN)/w6c $(BIN)/w6c_ww $(BIN)/w6a $(BIN)/w6l \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 # #15: widening a bare *vtable into a NAMED-alias variant (`stream` =
 # *vtable) of `(file | stream)` must compute the right tag, not default
 # to tag 0. Both-stage byte-id + runtime, plus a degenerate-ambiguity

cmd/w6c/cgen.c

@@ -5216,7 +5216,23 @@ cgexpr(Cg *c, Node *n, Local *locals)
 			if (u && (u->kind == TY_SLICE || u->kind == TY_STR)
 			    && a->kind == N_IDENT) {
 				int off = localfind(locals, a->str);
-				ins2(c, A_MOVQ, amem(D_BP, off + 8), areg(D_AX));
+				if (off == 0 && let_islet(a->str)) {
+					/* #231: str/slice GLOBAL — the .len word
+					 * lives at the global's address+8, not a
+					 * BP-relative slot (off==0 → MOVQ 8(BP)
+					 * read a bogus stack slot). Route through
+					 * the post-#1 value mangle so a private
+					 * same-module same-leaf global isn't
+					 * mis-resolved. */
+					ins2(c, A_LEAQ,
+					    mahint(c, a->str, c->cur_mod),
+					    areg(D_CX));
+					ins2(c, A_MOVQ, amem(D_CX, 8),
+					    areg(D_AX));
+				} else {
+					ins2(c, A_MOVQ, amem(D_BP, off + 8),
+					    areg(D_AX));
+				}
 			} else if (u && u->kind == TY_ARRAY) {
 				ins2(c, A_MOVQ, aimm((long long)u->alen), areg(D_AX));
 			} else {

selfhost/cmd/w6c/main.combined.ww

@@ -22452,6 +22452,22 @@ fn cgcall(c: *cgen, n: *node) void = {
 								emitline("(BP), AX\n");
 								return;
 							};
+							// #231: str/slice GLOBAL — the
+							// local-only path above lacked it,
+							// so cgexpr fell through and left
+							// AX=.ptr (not .len). The .len word
+							// lives at the global's address+8;
+							// route the LEAQ through the post-#1
+							// value mangle (c.curmod) so a
+							// private same-leaf global isn't
+							// mis-resolved.
+							if (isletvar(c, a.str)) {
+								emitline("\tLEAQ\t");
+								emitsymnamehint(c, a.str, c.curmod);
+								emitline("(SB), CX\n");
+								emitline("\tMOVQ\t8(CX), AX\n");
+								return;
+							};
 						};
 						if (u.kind == tykind.TY_ARRAY) {
 							emitline("\tMOVQ\t$");

selfhost/cmd/wcc/cgenexpr.ww

@@ -3792,6 +3792,22 @@ fn cgcall(c: *cgen, n: *node) void = {
 								emitline("(BP), AX\n");
 								return;
 							};
+							// #231: str/slice GLOBAL — the
+							// local-only path above lacked it,
+							// so cgexpr fell through and left
+							// AX=.ptr (not .len). The .len word
+							// lives at the global's address+8;
+							// route the LEAQ through the post-#1
+							// value mangle (c.curmod) so a
+							// private same-leaf global isn't
+							// mis-resolved.
+							if (isletvar(c, a.str)) {
+								emitline("\tLEAQ\t");
+								emitsymnamehint(c, a.str, c.curmod);
+								emitline("(SB), CX\n");
+								emitline("\tMOVQ\t8(CX), AX\n");
+								return;
+							};
 						};
 						if (u.kind == tykind.TY_ARRAY) {
 							emitline("\tMOVQ\t$");

selfhost/cmd/wwdump/main.combined.ww

@@ -22452,6 +22452,22 @@ fn cgcall(c: *cgen, n: *node) void = {
 								emitline("(BP), AX\n");
 								return;
 							};
+							// #231: str/slice GLOBAL — the
+							// local-only path above lacked it,
+							// so cgexpr fell through and left
+							// AX=.ptr (not .len). The .len word
+							// lives at the global's address+8;
+							// route the LEAQ through the post-#1
+							// value mangle (c.curmod) so a
+							// private same-leaf global isn't
+							// mis-resolved.
+							if (isletvar(c, a.str)) {
+								emitline("\tLEAQ\t");
+								emitsymnamehint(c, a.str, c.curmod);
+								emitline("(SB), CX\n");
+								emitline("\tMOVQ\t8(CX), AX\n");
+								return;
+							};
 						};
 						if (u.kind == tykind.TY_ARRAY) {
 							emitline("\tMOVQ\t$");

test/wcc/797_len_strglobal_run.c

@@ -0,0 +1,179 @@
+/*
+ * 797_len_strglobal_run — project #231. Runtime + cs==ww byte-id net for
+ * the `len(str-global)` miscompile.
+ *
+ * THE BUG (both stages wrong, DIFFERENTLY → byte-id was BLIND because the
+ * stages also DIVERGED, but no bootstrap source exercised the shape):
+ *   cstage: a top-level str global N_IDENT fell into the len() arm's
+ *           BP-relative slot load. localfind returns 0 for a global, so it
+ *           emitted `MOVQ 8(BP),AX` — a bogus stack slot (runtime 72).
+ *   wwstage: the len() arm only handled locals (localfindnode != nil);
+ *           a global fell through to cgexpr, which loads the whole header
+ *           and leaves AX=.ptr, not .len (runtime garbage / 37).
+ * The local-str case (`let g: str = "hello"; len(g)`) is correct in both
+ * (control), so the fix targets only the global path.
+ *
+ * THE FIX (#231): both stages emit the global .len load — LEAQ name(SB),CX;
+ * MOVQ 8(CX),AX (.len field; str/slice header is ptr@0/len@8/cap@16). The
+ * LEAQ symbol routes through the post-#1 value mangle (cstage mahint with
+ * c->cur_mod, wwstage emitsymnamehint with c.curmod), NOT a raw name —
+ * else a private same-module same-leaf str global would re-open the #1
+ * collision.
+ *
+ * SCOPE NOTE: a []u8 (slice) global would exercise the same arm (the gate
+ * covers TY_SLICE || TY_STR), but `let g: []u8 = [...]` literal-init is
+ * currently REJECTED by cstage ("let g init not assignable", #233), so the
+ * cstage `ww build` + byte-id rows below cannot compile a slice global yet.
+ * Rowed once #233 lands; the str global proves the code path now.
+ *
+ * EACH ROW CARRIES BOTH DIMENSIONS (795/796 model):
+ *   (a) cstage `ww build` + run, asserting the exit — pins the converged
+ *       asm is runtime-correct (len("hello") == 5).
+ *   (b) w6c vs w6c_ww `.s` cmp — FAILS if the stages diverge (they did,
+ *       differently, pre-fix).
+ *
+ * GATE POLARITY: must stay GREEN. A wrong exit means the global .len load
+ * regressed; a byte-id FAIL means the stages diverged (rule-10).
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row { const char *label; const char *src; int want_exit; };
+
+static const struct row rows[] = {
+	/* str global: len("hello") == 5. Pre-fix cstage 72, wwstage garbage. */
+	{ "str_global_len",
+	  "package main;\n"
+	  "let g: str = \"hello\";\n"
+	  "export fn main() i32 = { return len(g): i32; };\n", 5 },
+	/* control: the local-str case both stages already get right. */
+	{ "str_local_len",
+	  "package main;\n"
+	  "export fn main() i32 = { let g: str = \"hello\"; "
+	  "return len(g): i32; };\n", 5 },
+	{ NULL, NULL, 0 }
+};
+
+static int
+slurp_eq(const char *a, const char *b)
+{
+	FILE *fa = fopen(a, "rb");
+	FILE *fb = fopen(b, "rb");
+	if (!fa || !fb) { if (fa) fclose(fa); if (fb) fclose(fb); return -1; }
+	int rc = 0;
+	for (;;) {
+		int ca = fgetc(fa);
+		int cb = fgetc(fb);
+		if (ca != cb) { rc = -1; break; }
+		if (ca == EOF) break;
+	}
+	fclose(fa); fclose(fb);
+	return rc;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char w6c[1100], w6c_ww[1100];
+	snprintf(w6c, sizeof w6c, "%s/w6c", bin);
+	snprintf(w6c_ww, sizeof w6c_ww, "%s/w6c_ww", bin);
+	if (access(w6c_ww, X_OK) != 0) {
+		fprintf(stderr, "len_strglobal: w6c_ww missing — cannot run the "
+		    "cs==ww byte-id gate\n");
+		return 1;
+	}
+
+	int n = 0, fail = 0;
+	for (int i = 0; rows[i].src; i++, n++) {
+		char src[64];
+		snprintf(src, sizeof src, "/tmp/wwlsg_%d_%d.ww", getpid(), i);
+		FILE *f = fopen(src, "wb");
+		if (f == NULL) { fail++; continue; }
+		fputs(rows[i].src, f);
+		fclose(f);
+
+		/* (a) cstage build + run in a scratch dir. */
+		char tmpdir[64];
+		snprintf(tmpdir, sizeof tmpdir, "/tmp/wwlsg_%d_d_%d", getpid(), i);
+		mkdir(tmpdir, 0755);
+
+		char cmd[2048];
+		snprintf(cmd, sizeof cmd, "cd %s && %s/ww build %s",
+		    tmpdir, bin, src);
+		if (runwait(cmd) != 0) {
+			fprintf(stderr, "row[%s]: cstage build failed\n",
+			    rows[i].label);
+			fail++;
+			unlink(src); rmdir(tmpdir);
+			continue;
+		}
+
+		char outbin[128];
+		const char *base = strrchr(src, '/');
+		base = base ? base + 1 : src;
+		snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+		char *dot = strrchr(outbin, '.');
+		if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+
+		int got = runwait(outbin);
+		if (got != rows[i].want_exit) {
+			fprintf(stderr, "row[%s]: cstage exit %d, want %d\n",
+			    rows[i].label, got, rows[i].want_exit);
+			fail++;
+		}
+		unlink(outbin); rmdir(tmpdir);
+
+		/* (b) cs==ww byte-id gate. */
+		char cs_s[64], ws_s[64];
+		snprintf(cs_s, sizeof cs_s, "/tmp/wwlsg_%d_%d_cs.s", getpid(), i);
+		snprintf(ws_s, sizeof ws_s, "/tmp/wwlsg_%d_%d_ww.s", getpid(), i);
+
+		snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null", w6c, cs_s, src);
+		if (runwait(cmd) != 0) {
+			fprintf(stderr, "row[%s]: w6c failed\n", rows[i].label);
+			fail++; unlink(src); continue;
+		}
+		snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null",
+		    w6c_ww, ws_s, src);
+		if (runwait(cmd) != 0) {
+			fprintf(stderr, "row[%s]: w6c_ww failed\n", rows[i].label);
+			fail++; unlink(src); unlink(cs_s); continue;
+		}
+		if (slurp_eq(cs_s, ws_s) != 0) {
+			fprintf(stderr, "row[%s]: cstage/wwstage .s DIFFER "
+			    "(rule-10 byte-id violation)\n", rows[i].label);
+			fail++;
+		}
+		unlink(src); unlink(cs_s); unlink(ws_s);
+	}
+
+	if (fail) {
+		fprintf(stderr, "%d/%d len str-global tests failed\n", fail, n);
+		return 1;
+	}
+	printf("len_strglobal: %d/%d ok (cstage run + cs==ww byte-id)\n", n, n);
+	return 0;
+}