Three same-cluster robustness holes. enumeratedir treated a failed
getdents64 (r<0) as EOF: a mid-walk error silently truncated the
package source list, and a first-read error was misdiagnosed as
"directory contains no WW package sources" -- it now routes the
caller's "cannot read directory" arm. run_test_bin's waitpid had no
EINTR retry and its return was unchecked, so an interrupted wait
left status==0 and reported a false test PASS (the do_run twin
already retried). The coordinator's pkgskipspace now also skips
/* */ before the package clause like the driver's sep_skip_space --
a source opening with a block comment built under ww but failed
coordinator discovery.
The TODO(#11) silent-accept of `for (let (a, a) .. xs)` rested on a
stale premise -- resolvewalk has per-block scopes since #53 and IS
the live w6c_ww checker pass. Bindings now install in a per-LOOP
scope (the N_MCASE pattern), so a duplicate name within one pattern
errs "redeclared in same scope" (cstage parity via stamptuplebinds'
scopedefine-nil check) while sequential same-name loops stay legal.
kwtab restores its stated alphabetical order (`import` before `is`,
both stages, kinds swapped in lockstep with names).
Four seams from one review cluster, all landing on the same checker
files; gates ran on the union (rule 11 body).
?-subset: the wwstage walk compared `...spread` ALIAS nodes on both
sides of the error-subset check, falsely rejecting a spread-carried
error return (`(i64 | ...errs)`, cs-accept/ww-reject) — both sides
now flatten like trycountvariants (cstage Tparams are pre-flattened
at type level).
Multi-let/multi-assign: the tuple gates keyed on the RAW rhs kind,
rejecting a NAMED tuple alias (`type pair = (i64,i64)`; cs clean-
reject, ww asserttyped stop) — both stages chase per #99 alias
transparency, wwstage rettupleof peels the alias so cgmassign keeps
the str element's len/cap stores, and the catA massign-alias error
pin re-rules to a run fixture. The N_MLET diagnostic also printed
its operands swapped (elem/declared reversed vs its wording).
Yield: match_yield_type didn't descend into N_SWITCH, so a yield
inside a switch arm typed the match void and dropped the value
(both stages); and a stray yield outside any match arm reached cgen
unchecked — both stages now gate on a match-arm counter (the
c->loops discipline).
cstage rejects `add(1,2,3)` and `add(4)` (too many / not enough
arguments); wwstage ran no count check at this seam, so both built
-- a stray arg pushed silently, a missing one read garbage
(cs-reject/ww-accept build-verdict divergence). Surplus errs when
params exhaust with args left; missing errs on a leftover regular
param (a leftover TK_ELLIPSIS or FFI "..." is a legal zero-arg
variadic tail). fn-VALUE callees still bail at decl==nil -- their
whole typecheck, arity included, stays task #51.
Two composing defects made a two-enum union mis-tag in wwstage
(live cs!=ww: `let e: (color|shape) = shape.BALL` stored tag 0 —
the color arm — while cstage stored 1). type_eq/typeeq had no
TY_ENUM arm, so ANY two enums fell into the primitive default and
compared equal; enums are nominal (harec: an enum IS its alias
type) and now compare by node identity only. Underneath, the
wwstage post-order revisit re-stamped the constant-folded enum
member (an N_INTLIT) as untyped_int, clobbering the enum stamp the
N_DOT fold applied, so the widen matcher fell to its first-variant
fallback -- the #59.9 N_BIN guard now twins on N_INTLIT (cstage
cexpr is single-pass and never clobbered).
Two silent seams in one sweep. The for-range destructure silently
dropped the 9th+ binding in both stages (bind arrays are sized 8);
the cap now hard-stops per the DEFER_MAX/LOOP_MAX discipline (the
shape is unreachable today -- every wide-tuple construction path
already loud-stops). argtaggedwidensz, the drain-side SSoT for
widened call args, still keyed "natural push" on slot-size equality
while pushargsrev flipped to type equality with #55 -- a same-slot
subset was classified widen by push, natural by drain (counts
coincide today; a classification reader desyncs, the #48 shape).
Both sides now share the wsame key; the widen-branch tag miss for a
concrete source joins the task-2 loud-stop family (tagged subset
sources keep t=0 -- their widentag is never read, the scratch store
remaps).
Lead 17 (enum fold-failure prev+1) DISPROVED: enumvalfold gates
every member init in the checker and its fold set is op-for-op
equal to cgen's enumevalmember, so the fallback only runs inside
already-failing compiles.
cgstructlitfill's `...` total read only an N_INTLIT dim node, so a
def-dimensioned [N]T struct field under-filled: elements 1..N-1 kept
the zero-fill, silently, wwstage only (cstage and the tn twin read
the stamped array length). Read tichase(fi.tnode.type_).alen first;
the surface node stays as the fallback for unstamped shapes.
Hare's rule (harec check.c binarithm): % and the bitwise/shift five
are integer-only; + - * / need numeric operands. ww grouped % with
the numeric ops, and compound assigns never op-checked at all, so
`a % b` on floats compiled half-lowered (live cs!=ww divergence),
`a %= 2.0` plain-stored the rhs (op silently dropped, both stages),
and `s += "cd"` garbled str headers. Gate both at the checker, both
stages; the cgen float-compound fallbacks and the three unknown-
compound legacy defaults (deref/global/local) demote to rule-7 hard
stops. 34 compound-on-tagged/str/slice fixtures re-pin from the old
cgen "not wired" stops to the earlier checker diagnostics; 3 new
reject fixtures pin the closed shapes.
The chained value-struct walker's N_CALL arm handled only <=24B
register returns; an sret-class rhs fell to the scalar tail and
stored ONE word (the sret dest pointer) into the leaf -- silent
truncation in BOTH stages, byteid-blind. Point the callee's hidden
RDI at the BP-relative leaf slot (the single-dot #234 arm verbatim);
a ptr-root/global chain joins the #234-tail loud-stop family.
selfhost/, cmd/, internal/ join the tree-wide sweep: every section
banner dies (91 selfhost + the cmd C-style dividers -> 0); narration
and stale contracts deleted (pre-#22 bundler notes, retired
single-PT_LOAD and no-archive claims, superseded ABI tables); every
ref/harec/qbe cite, task cite, encoding/ELF contract, and rule-10
twin pointer kept; lost lifetime/rationale lines restored where the
sweep over-cut (elf_globals ownership, kwtab linear-scan). Comment-
only proven: all five wwstage tool binaries byte-identical across
the sweep; test-commit, test-byteid (161+1399, 0 pinned-divergent),
and test-bootstrap (fixed point + 991-995 byte-id) all exit 0.
The read-through banked 66 latent-bug leads (checkpoint).
Go compiles only _test.go files as tests; discovery now keys on the
_test.ww suffix alone. The line-leading-@test compatibility allowance
(noncanonical filenames admitted as test sources) is removed from both
driver stages and the coordinator. An @test declaration outside a
*_test.ww file is rejected loudly ("@test declaration outside
*_test.ww", wording byte-identical cs/ww) instead of silently running
under compose or silently dropping in a non-T build (#6). Tree audit
found zero real carriers; the two allowance fixtures flip canonical
(dep_test.ww, widget_test.ww). New pins: direnum attest-noncanon
reject row (both-stage stderr parity) and the coordinator
noncanonical_attest_rejected package row.
Go has no per-file test targets: the PACKAGE is the unit of testing
(`go test ./...`) and same-package test files compose together. The
59-target LIBRARY_TESTS fan-out (per-file -w workdirs, one Make rule
per suite) collapses to one line: `ww test -j $(JOBS) -w
out/wwbuild/wwtest-lib -I lib/ww lib/...` — the regex dir-route
precedent generalized. The lib/regex line and the per-file pattern
rule instance dissolve with it (test/lang keeps its own rule).
Measured before committing (-j4, strings edit row): old per-file
warm 4.7-4.9s; bare walk 5.2-5.6s — a real regression, so the
coordinator first gained the brief's persistent per-package workdir:
`-w DIR` on a package target forwards to wwpackage, which keys
DIR/<dir>_<pkg> per group and hands it to each inner `ww test -c`
build. Reuse stays entirely with the driver's existing
content-identity contract — the coordinator adds pure path policy,
no cache machinery. Both driver stages drop their package-target -w
rejects (forward instead); -w with -c stays rejected at the
coordinator (two ownership contracts). After: 3.9-4.0s on the edit
row, 1.0s warm no-op, 2.5s cold — faster than the old flow on every
row.
package_test's tree -w reject row becomes the positive contract
(cold+warm byte-stable stream, cs/ww same) plus the -c conflict
reject. libbyteid roster shape DECIDED: per-file fx entries stay —
every enrolled file is still standalone-buildable, so coverage is
byte-for-byte unchanged; the dir-mode entry form arrives only with
the B3 shared-helper split that first needs it. Docs: owner table,
target table, -w contract paragraph.
The bbdd8bed residue, ruled by the Go derivation (ww's for IS the Go
for; the cstage grammar is the language definition and already the
Go-shaped one):
- bare `for { }` accepted (align UP to parse.c:1023, incl. for-else);
- 3-clause cond and post each omissible — `for (init;; post)`,
`for (init; cond)`, `for (init;)` (align UP, parse.c:1092-1097);
- 2-clause `for (cond; post)` REJECTED (align DOWN): the form exists
in neither Go nor cstage (parse.c:1101 eats a stray ';' then
requires ')'), so the old wwstage accept was a parser bug. The
reject wording mirrors cstage's failure mode per stage.
forhdr_{brace,emptymid,partial} run fixtures pin the accepted forms
byte-identically; forhdr_twoclause_reject pins both reject fragments.
Corpus pin 1745/346/21/209/1169/3490.
A module-scope let whose rhs runs code (alloc, call — peeled through
cast/?/! wrappers) emitted no DATAW slot: emit_lets' fold-fail
silently skipped the definition and every reference died at LINK
time with 'undefined reference', the one unacceptable failure mode
(rule 7). Hare's model rejects at check time (ref/harec/src/
check.c:4360 'Unable to evaluate initializer at compile time') and
routes runtime init through @init, which ww does not have — so both
frontends now reject at the declaration with identical wording.
alias_infptr_global flips compile->error as the alloc pin (its
letvartnode N_TPTR-over-N_TSTRUCT coverage lives on in the local
alias_infptr_{nest,slicecap} siblings); callinit_global_reject pins
the call shape. Corpus pin 1741/345/21/209/1166/3482.
pushargsrev's five aistagged gates (N_IDENT #55, N_CALL #21, N_INDEX
#12, N_DOT #22a, deref #35) treated a tagged arg as already-tagged
when its SLOT SIZE matched the param's. A same-slot subset union
((bool|void) into (i64|bool|void), both 16B) then natural-pushed the
narrower box's words carrying SOURCE tags — no re-layout, no
cg_widen_tag_remap twin — so the callee matched the wrong arm
(silent: probes exited 10/90 where cstage exits 30/27). cstage keys
widen detection on type equality (cgen.c:10000 same = (pu == au) ||
type_eq) and routes every non-same tagged source through the zeroed
scratch + tag remap; the slot-DIFFER wwstage path already mirrored
that byte-identically, so the fix computes cstage's same check once
(wsame) and replaces each slot-size test with it. This also erases
the last known cs!=ww shape divergence (the 16B-local staging vs
direct-push frame delta on prefix subsets).
8 subsetwiden_* fixtures own the class: call-result/ident/str-payload
/mid-arg remap (the wrong-arm shapes), prefix (the shape-divergence
repro), and bigslot/return-pos/struct-24-to-32 sibling guards. Corpus
pin 1740/343/22/209/1166/3480.
The last Open-driver-work bullet. `-c -o <name>` replaces the fixed
<package>.test stem for exactly one package; the coordinator rejects a
multi-package fan-out ("cannot use -o with multiple packages", Go's
`go test -o` rule) and -o without -c is rejected at the driver
("needs -c for a package target" — a plain run executes from the temp
root, so a caller-owned name has nothing to name). Both driver stages
byte-identical wording; -S keeps its single-file-only reject.
package_test gains the contract row (naming, fixed-stem absence,
artifact runs, both rejects, both drivers); the tree-mode -o row's
pinned wording follows the contract.
`case T1 | T2 =>` (binding-less; cstage parse.c:635-650 chains extra
types through cs->list, bindings stay single-type by design). Three
wwstage layers, no AST change (node.list already exists):
- parser (expr.ww): pipe loop after the non-let arm's first
parsetype;
- checker (check.ww): resolvewalk N_MCASE now walks n.list so each
alt gets its type_ stamp (exhaustiveness/casecovers were already
alt-aware, built ahead of the parser);
- cgen (cgenexpr.ww): the single-pattern want-computation moves
VERBATIM into matcharmwant; a cs.list arm emits CMPQ/JE per alt
funneling into one match_body label, mirroring cgen.c:11118-11141
incl. label mint order and the tag<0 clamp. Nullable arms keep
ignoring alts (both stages).
Graduates the held e2e row (pin 1732/1158/3464); byte-identical on
the repro and the single-pattern control.
cstage parse.c:1027 accepts `for ()` — N_FOR with a nil cond, no
for-else arm, no test emitted (an unconditional loop; a deliberate
Go-flavored ww divergence from Hare, original to the toolchain
import). The wwstage parser had no RPAREN early-out and rejected it.
Selfhost checker and cgen already nil-guard n.cond, so the parser arm
is the whole gap. Graduates the held e2e row (pin 1731/1157/3462).
Adjacent asymmetries left filed, not fixed here (rule 11): the brace
form `for { }`, the empty middle clause of the 3-clause form, and
the REVERSE case (wwstage accepts 2-clause `for (cond; post)` which
cstage rejects).
wwstage dotchainresolve gated its *T roots on an N_TPTR-over-N_TNAME
tnode; an inferred `let p = alloc(S{...})!` rides the checker-
SYNTHESIZED N_TPTR whose pointee is the struct BODY node (the #24
TNAME-normalize covers only the direct struct-lit binding), so the
root gate failed and chained p.field.pseudo reads fell to the
unfused deref arms — shape-only divergence vs cstage's type-keyed
fold (both stages runtime-correct; the historical field(SB) leak the
pin described was already fixed). Widen the local and global root
gates to accept the N_TSTRUCT pointee; correctness stays enforced by
the stamped-tinfo peel below (TY_PTR -> pointee TY_STRUCT).
Graduates alias_g73_heapfill out of DATABYTEID_DIVERGED (2 pins
remain, both the tagged-spill family); adds compile fixtures pinning
the newly-converged siblings (nested read+store, slice .cap,
inferred-global root; pin 1730/22/3460) and a runtime lang row that
mutates then re-points the heap base — a read bypassing the pointer
returns the wrong len.
The #173 remap loop in cgtryprop gated on the tparam's explicit `!`
flag only; a LEGACY union (no marks anywhere) classifies error
variants POSITIONALLY (index 0 is success, cstage cg_variant_is_error
cgen.c:905) — so wwstage emitted no remap and propagated the callee's
raw tag into a differently-ordered caller union, a silent wrong arm
(cstage exit 7, wwstage 9 on the banked r700 row). Add the
variantiserror twin and gate the loop on it; refresh the drifted
cstage cite.
Graduates the held e2e row into the corpus (pin 1727/1156/3454) and
adds legacy-mode rows to test/lang/tryprop_tag_remap_test.ww:
reversed order both directions, slot-0 remap, str payload integrity,
a two-hop chain whose pre-fix runtime pass was double-miss tag
cancellation (the lang byteid leg pins the emitted remap blocks),
and a same-order zero-emission control.
944_alias_cgen_b5_run.c -> alias_g73_heapfill (//ww:compile), joining
its migrated alias_* siblings. The carrier's stated fixture blocker
('//ww:compile links') is stale: the COMPILE cell runs the bare
frontend, no link. The live #24 field(SB) deref-read leak enters
DATABYTEID_DIVERGED, upgrading the carrier's silent byte-id waiver
with a graduation tripwire.
839_xmod_nominal_typeeqast.c -> r839_xmod_nominal_match (run-exit 42),
r839_xmod_a6_concrete (run), r839_xmod_incompat_concrete (error
'not assignable'), r839_xmod_distinct_alias (error 'ambiguous
without nominal layout').
r839_xmod_nominal_match enters DATABYTEID_DIVERGED: the carrier waived
byte-id for the pre-existing cross-module tagged-return spill
divergence; the DIVERGED row makes it loud-on-fix instead. The
typeeqast-layer discriminator itself stays with the lib byteid gate
(test/byteid/libbyteid_test.ww), as the carrier documented.
732_def_const_fold.c -> r732_def_xmod_fold (run-exit 42; stronger than
the carrier's DATA-row grep — links AND reads the folded cross-module
value), r732_def_xmod_cycle (error 'def value: reference chain too
deep', upgrading the needle-less exit!=0 check).
The five same-module exec rows and both same-module fail-loud rows were
already owned by the r732_def_* fixtures; their cs-vs-ww byte identity
rides test-data-byteid, which now also covers the xmod fold row. The
timeout-124 hang distinction devolves to the wwfixture harness timeout.
696_modtype_leaf_collision.c -> r696_modtype_leaf_pos (run-exit 26),
r696_modtype_leaf_neg (staged error; w6c 'no field', w6c_ww
asserttyped: dot — the old no-wwstage-checkfile comment is stale)
697_samemod_prefer.c -> r697_samemod_prefer (compile)
699_use_promote_alias.c -> r699_usepromote_{type,fn,def,var}
(run-exit 42 each)
Single-file multi-package form folds the modcollision/samemodprefer/
usepromote data trees into the fixtures; the trees retire with their
carriers. The dir-tree .wwi transport of colliding type decls is owned
by test/byteid/wwi_test.ww. Coverage upgrades: 697 and the 699 rows
gain the wwstage leg the carriers gated or skipped, and all positive
rows enter the blanket test-data-byteid net.
Evaluate the call pre-grow into a per-site scratch, receiving by the
N_LET matrix (sret / float / odd-tail / GP), then grow, slot, sized
ladder. Both stages, byte-identical. The two reject pins graduate to
16B GP accept rows; three new fixtures cover 24B GP, 3B/4B tails,
16B float, and 40B sret.
Ten of the thirteen were already fully twinned — their runtime rows
migrated in earlier waves (r56_def_*, r79_*, r78_*, r926_*,
r989_m1union_*) and the carriers survived only for a cstage-vs-wwstage
byte-compare the blanket test-data-byteid comparator owns once the
source is a corpus fixture. The other three needed their remaining
inline sources added first: r756_* (4, alias-chain unwrap),
r844_bid_src (size(u64) untyped-int compare), r989_structframe_* (3,
struct-local frame layout). Every new fixture was verified both-stage:
compile exit 0 twice, .s byte-identical, runtime exit as pinned.
The five ww_ww-driver-leg carriers among them (785/786/789/790/
m1union) follow the 815/940/951 precedent: content identity owned by
their corpus twins, driver-leg identity owned by 989_lib_byteid's
sweep. Byte/artifact partition 24 -> 11; carriers 147 -> 134; corpus
pin 1495/2990; the stale 915 sweep figure in the docs corrected to
the true 1,157 non-error count.
fnptrcalleetfn's N_DOT arm required an N_IDENT base, so a.b.cb(...)
fell to the name registry with an empty module hint and emitted
CALL cb(SB) (undefined symbol; cstage calls the stamped ptr indirect).
dotbasestructinfo resolves the base chain through the struct registry
— each link a struct- or *struct-typed field — and the single-dot
path routes through the same resolver unchanged. Closes the last open
shape of the #59.8 name-keyed callee family. Fixture fnptrfield_chain;
corpus pin 1487/2974.
