Three same-cluster robustness holes. enumeratedir treated a failed
getdents64 (r<0) as EOF: a mid-walk error silently truncated the
package source list, and a first-read error was misdiagnosed as
"directory contains no WW package sources" -- it now routes the
caller's "cannot read directory" arm. run_test_bin's waitpid had no
EINTR retry and its return was unchecked, so an interrupted wait
left status==0 and reported a false test PASS (the do_run twin
already retried). The coordinator's pkgskipspace now also skips
/* */ before the package clause like the driver's sep_skip_space --
a source opening with a block comment built under ww but failed
coordinator discovery.
The TODO(#11) silent-accept of `for (let (a, a) .. xs)` rested on a
stale premise -- resolvewalk has per-block scopes since #53 and IS
the live w6c_ww checker pass. Bindings now install in a per-LOOP
scope (the N_MCASE pattern), so a duplicate name within one pattern
errs "redeclared in same scope" (cstage parity via stamptuplebinds'
scopedefine-nil check) while sequential same-name loops stay legal.
kwtab restores its stated alphabetical order (`import` before `is`,
both stages, kinds swapped in lockstep with names).
Four seams from one review cluster, all landing on the same checker
files; gates ran on the union (rule 11 body).
?-subset: the wwstage walk compared `...spread` ALIAS nodes on both
sides of the error-subset check, falsely rejecting a spread-carried
error return (`(i64 | ...errs)`, cs-accept/ww-reject) — both sides
now flatten like trycountvariants (cstage Tparams are pre-flattened
at type level).
Multi-let/multi-assign: the tuple gates keyed on the RAW rhs kind,
rejecting a NAMED tuple alias (`type pair = (i64,i64)`; cs clean-
reject, ww asserttyped stop) — both stages chase per #99 alias
transparency, wwstage rettupleof peels the alias so cgmassign keeps
the str element's len/cap stores, and the catA massign-alias error
pin re-rules to a run fixture. The N_MLET diagnostic also printed
its operands swapped (elem/declared reversed vs its wording).
Yield: match_yield_type didn't descend into N_SWITCH, so a yield
inside a switch arm typed the match void and dropped the value
(both stages); and a stray yield outside any match arm reached cgen
unchecked — both stages now gate on a match-arm counter (the
c->loops discipline).
cstage rejects `add(1,2,3)` and `add(4)` (too many / not enough
arguments); wwstage ran no count check at this seam, so both built
-- a stray arg pushed silently, a missing one read garbage
(cs-reject/ww-accept build-verdict divergence). Surplus errs when
params exhaust with args left; missing errs on a leftover regular
param (a leftover TK_ELLIPSIS or FFI "..." is a legal zero-arg
variadic tail). fn-VALUE callees still bail at decl==nil -- their
whole typecheck, arity included, stays task #51.
Two composing defects made a two-enum union mis-tag in wwstage
(live cs!=ww: `let e: (color|shape) = shape.BALL` stored tag 0 —
the color arm — while cstage stored 1). type_eq/typeeq had no
TY_ENUM arm, so ANY two enums fell into the primitive default and
compared equal; enums are nominal (harec: an enum IS its alias
type) and now compare by node identity only. Underneath, the
wwstage post-order revisit re-stamped the constant-folded enum
member (an N_INTLIT) as untyped_int, clobbering the enum stamp the
N_DOT fold applied, so the widen matcher fell to its first-variant
fallback -- the #59.9 N_BIN guard now twins on N_INTLIT (cstage
cexpr is single-pass and never clobbered).
Two parse.c operand defects. A bare `-8` (no $) double-negated to
+8: a_parsenum lets strtoll consume the sign, and the caller's
`off * sign` re-applied it (the D_INDIR arm never multiplied, which
is why -8(BP) always worked); the wwstage twin was already correct,
so this was a latent cs!=ww on hand-written source. The name(REG)
non-SB arm faked a D_INDIR off an UNCHECKED reg_lookup and silently
discarded the parsed ident and +disp -- both stages; the shape has
no encoding and now rejects loud.
The archive walk skipped every member whose header name starts
with '/', which also dropped GNU long-name members (/N) -- any
member with a >15-char filename silently never linked. Only '/ '
(symbol index) and '//' (long-name table) are non-objects; /N
members index by content (names are never consulted). A member
that fails loadimage in the selective pull also stayed silently
unlinked with rc=0; it now reports and fails the link (rule 7).
wwstage w6l diagnostics ride the same .len idiom as the w6a sweep.
Every interned symbol -- including branch labels defined via
p.label -- was emitted STB_GLOBAL, so labels were collide-able
across objects and the header's "GLOBAL symbols only" contract was
enforced nowhere (asym.isglobal was set but never read). Labels
stay interned for fixup resolution; the symtab now carries only
exported definitions, undefined externs, and reloc-referenced syms
(a reloc pre-pass marks those). rt/ensure.o drops from 15 emitted
syms to 2. Bootstrap 991-995 hold byte-identical on the new format.
Three w6a defects, one component. MOVB with an SP/BP/SI/DI register
operand encoded AH/CH/DH/BH -- emit_rex suppressed the bare 0x40
that selects SPL/BPL/SIL/DIL (the comment claimed "we always emit
REX"; encode probe: `MOVB SI,(AX)` -> `88 30` = %dh). emit_rex8
forces the byte for low-byte codes 4-7; no current w6c output emits
those shapes, so all existing objects are unchanged. LEAQ and CALL
unsupported operand shapes fell through with zero bytes and no
errs++ (every MOV arm reports); both now err. Every hardcoded
os.write diagnostic length in the wwstage was one byte short
(truncating the newline/quote); all converted to the .len idiom so
the length cannot drift again.
Two silent seams in one sweep. The for-range destructure silently
dropped the 9th+ binding in both stages (bind arrays are sized 8);
the cap now hard-stops per the DEFER_MAX/LOOP_MAX discipline (the
shape is unreachable today -- every wide-tuple construction path
already loud-stops). argtaggedwidensz, the drain-side SSoT for
widened call args, still keyed "natural push" on slot-size equality
while pushargsrev flipped to type equality with #55 -- a same-slot
subset was classified widen by push, natural by drain (counts
coincide today; a classification reader desyncs, the #48 shape).
Both sides now share the wsame key; the widen-branch tag miss for a
concrete source joins the task-2 loud-stop family (tagged subset
sources keep t=0 -- their widentag is never read, the scratch store
remaps).
Lead 17 (enum fold-failure prev+1) DISPROVED: enumvalfold gates
every member init in the checker and its fold set is op-for-op
equal to cgen's enumevalmember, so the fallback only runs inside
already-failing compiles.
cgstructlitfill's `...` total read only an N_INTLIT dim node, so a
def-dimensioned [N]T struct field under-filled: elements 1..N-1 kept
the zero-fill, silently, wwstage only (cstage and the tn twin read
the stamped array length). Read tichase(fi.tnode.type_).alen first;
the surface node stays as the fallback for unstamped shapes.
Hare's rule (harec check.c binarithm): % and the bitwise/shift five
are integer-only; + - * / need numeric operands. ww grouped % with
the numeric ops, and compound assigns never op-checked at all, so
`a % b` on floats compiled half-lowered (live cs!=ww divergence),
`a %= 2.0` plain-stored the rhs (op silently dropped, both stages),
and `s += "cd"` garbled str headers. Gate both at the checker, both
stages; the cgen float-compound fallbacks and the three unknown-
compound legacy defaults (deref/global/local) demote to rule-7 hard
stops. 34 compound-on-tagged/str/slice fixtures re-pin from the old
cgen "not wired" stops to the earlier checker diagnostics; 3 new
reject fixtures pin the closed shapes.
cgdot's local-ident arm silently emitted nothing for a receiver
whose local record carries no type node (inference miss upstream),
leaving the consumer reading stale AX. cgident's tail silently
emitted nothing for any ident that resolved to no local/fn/def/let;
that silence is load-bearing ONLY for the #140 !void error-singleton
value (tag-only, the widen arm stamps the tag) -- keep exactly that
case, mirroring the cstage #140 guard, and hard-stop the rest.
Every variant-index lookup miss (-1) was silently clamped to tag 0
across both stages: tagged return (value + bare-void), widen store
(struct/slice/str/float/scalar arms + push fast path + field store),
widen tag-remap (identity scan + emit loop), match case compare,
is/as typetest, tryprop error remap, and the alloc-nomem propagation
(clamped to 1). All misses are checker-rejected upstream today, so
the clamps were dead -- but any future checker/cgen seam gap would
mis-tag silently (wrong arm, wrong error, false success). Rule 7:
each site now hard-stops with a per-construct diagnostic; nullable
arms keep their raw -1 by design (a miss encodes the void polarity
for `case null`). Corpus asm byte-unchanged; bootstrap fixed point
holds.
The chained value-struct walker's N_CALL arm handled only <=24B
register returns; an sret-class rhs fell to the scalar tail and
stored ONE word (the sret dest pointer) into the leaf -- silent
truncation in BOTH stages, byteid-blind. Point the callee's hidden
RDI at the BP-relative leaf slot (the single-dot #234 arm verbatim);
a ptr-root/global chain joins the #234-tail loud-stop family.
selfhost/, cmd/, internal/ join the tree-wide sweep: every section
banner dies (91 selfhost + the cmd C-style dividers -> 0); narration
and stale contracts deleted (pre-#22 bundler notes, retired
single-PT_LOAD and no-archive claims, superseded ABI tables); every
ref/harec/qbe cite, task cite, encoding/ELF contract, and rule-10
twin pointer kept; lost lifetime/rationale lines restored where the
sweep over-cut (elf_globals ownership, kwtab linear-scan). Comment-
only proven: all five wwstage tool binaries byte-identical across
the sweep; test-commit, test-byteid (161+1399, 0 pinned-divergent),
and test-bootstrap (fixed point + 991-995 byte-id) all exit 0.
The read-through banked 66 latent-bug leads (checkpoint).
Every section banner dies (103 -> 0) across test/lang, the observer
suites, the C carriers, and the five comment-heavy corpus fixtures;
banner provenance (#N cites, carrier numbers, repair-cluster labels)
folded into headers or adjacent WHY comments. Narration deleted; row
provenance, ref cites, divergence pins, and layout contracts kept
(fwd-ref decl-order guards and bootstrap-gate corpus rationale
restored where the sweep over-cut). Comment-only proven: all 3742
wwbuild workdir .s byte-identical before/after; test-commit and
test-byteid (161 lang + 1399 data, 0 pinned-divergent) green.
Go compiles only _test.go files as tests; discovery now keys on the
_test.ww suffix alone. The line-leading-@test compatibility allowance
(noncanonical filenames admitted as test sources) is removed from both
driver stages and the coordinator. An @test declaration outside a
*_test.ww file is rejected loudly ("@test declaration outside
*_test.ww", wording byte-identical cs/ww) instead of silently running
under compose or silently dropping in a non-T build (#6). Tree audit
found zero real carriers; the two allowance fixtures flip canonical
(dep_test.ww, widget_test.ww). New pins: direnum attest-noncanon
reject row (both-stage stderr parity) and the coordinator
noncanonical_attest_rejected package row.
lib/strconv/test/ was the last _test layout deviating from Go's
in-package shape (src/bytes/bytes_test.go declares bytes_test in the
package dir). Its rationale — `import strconv` file-hitting the
sibling strconv.ww — dissolved when #98 made directory packages win
over same-named files on any search entry. libbyteid re-paths the
three fx entries and drops the covered() carve-out: the completeness
scan now keys lib/strconv through the fixtures' dirname. Walk line
flips to "ok lib/strconv [strconv_test, external]".
Unblocked by the package-mode ruling: same-package test files now
compose everywhere (coordinator dir-mode owns test-library and the
libbyteid dir entry owns byte identity), so the per-file standalone
constraint is gone and Go's stdlib layout applies directly. The
15-banner strings_test.ww monolith dissolves into per-ref-file
family files — dup, concat, trim, sub, utf8, iter, tokenize
(tokenize+splitn+cut, all of ref tokenize.ha), pad, replace — plus
helpers_test.ww holding exactly the one cross-family helper (streq),
Go's shared test-helper idiom. Pure moves; family-local helpers
(expect_str_token et al.) stay in their family file. Leading banners
that merely restated the filename dropped; 6 interior sub-family
boundaries remain. lib/ census 141 -> 132.
libbyteid gains the dx() dir-mode entry form decided in B2: compose
every *_test.ww under moddir exactly as pkgcombined does
(module-reset separators, byte-lex order) and byte-id the composed
root through both driver stages. The five per-file strings fx
entries retire into one dx("lib/strings") — every source line they
covered is inside the composed unit, and the completeness scan still
keys the module. NENTEXPECT 60 -> 56.
Recorded, not split: fmt_test's 13 banners are scenario groups over
the one fprint surface and ref/hare/fmt itself keeps a single
+test.ha — a print/wrappers split would fight the ref; memio stays
per the standing ruling (everything ww ports lives in ref
stream.ha).
Go has no per-file test targets: the PACKAGE is the unit of testing
(`go test ./...`) and same-package test files compose together. The
59-target LIBRARY_TESTS fan-out (per-file -w workdirs, one Make rule
per suite) collapses to one line: `ww test -j $(JOBS) -w
out/wwbuild/wwtest-lib -I lib/ww lib/...` — the regex dir-route
precedent generalized. The lib/regex line and the per-file pattern
rule instance dissolve with it (test/lang keeps its own rule).
Measured before committing (-j4, strings edit row): old per-file
warm 4.7-4.9s; bare walk 5.2-5.6s — a real regression, so the
coordinator first gained the brief's persistent per-package workdir:
`-w DIR` on a package target forwards to wwpackage, which keys
DIR/<dir>_<pkg> per group and hands it to each inner `ww test -c`
build. Reuse stays entirely with the driver's existing
content-identity contract — the coordinator adds pure path policy,
no cache machinery. Both driver stages drop their package-target -w
rejects (forward instead); -w with -c stays rejected at the
coordinator (two ownership contracts). After: 3.9-4.0s on the edit
row, 1.0s warm no-op, 2.5s cold — faster than the old flow on every
row.
package_test's tree -w reject row becomes the positive contract
(cold+warm byte-stable stream, cs/ww same) plus the -c conflict
reject. libbyteid roster shape DECIDED: per-file fx entries stay —
every enrolled file is still standalone-buildable, so coverage is
byte-for-byte unchanged; the dir-mode entry form arrives only with
the B3 shared-helper split that first needs it. Docs: owner table,
target table, -w contract paragraph.
Go does not distinguish bootstrap observers from unit tests: an
in-process test is a unit test. 738 is pure parsefile calls (arena +
lexinit + parserinit, AST assertions, zero subprocess or artifact
claims) — the 200_parse class, misfiled among the residuals. The
fleet partition now reads six units / six bootstrap / three platform
and the residual class is empty; COMPILER_WRAPPER_SOURCES drops it
by the existing filter-out. Doc roster updated (also refreshes the
corpus prose to the current 1745/3490 pin and retires the stale
794-era paragraph).
The bbdd8bed residue, ruled by the Go derivation (ww's for IS the Go
for; the cstage grammar is the language definition and already the
Go-shaped one):
- bare `for { }` accepted (align UP to parse.c:1023, incl. for-else);
- 3-clause cond and post each omissible — `for (init;; post)`,
`for (init; cond)`, `for (init;)` (align UP, parse.c:1092-1097);
- 2-clause `for (cond; post)` REJECTED (align DOWN): the form exists
in neither Go nor cstage (parse.c:1101 eats a stray ';' then
requires ')'), so the old wwstage accept was a parser bug. The
reject wording mirrors cstage's failure mode per stage.
forhdr_{brace,emptymid,partial} run fixtures pin the accepted forms
byte-identically; forhdr_twoclause_reject pins both reject fragments.
Corpus pin 1745/346/21/209/1169/3490.
A module-scope let whose rhs runs code (alloc, call — peeled through
cast/?/! wrappers) emitted no DATAW slot: emit_lets' fold-fail
silently skipped the definition and every reference died at LINK
time with 'undefined reference', the one unacceptable failure mode
(rule 7). Hare's model rejects at check time (ref/harec/src/
check.c:4360 'Unable to evaluate initializer at compile time') and
routes runtime init through @init, which ww does not have — so both
frontends now reject at the declaration with identical wording.
alias_infptr_global flips compile->error as the alloc pin (its
letvartnode N_TPTR-over-N_TSTRUCT coverage lives on in the local
alias_infptr_{nest,slicecap} siblings); callinit_global_reject pins
the call shape. Corpus pin 1741/345/21/209/1166/3482.
The two loud siblings filed in d3822d77: (a) an auto-deref *[N]T
indexed base (hs[k].result) failed cgplaceaddr's N_INDEX arm, which
knew only TY_SLICE/TY_ARRAY bases — add the one-pointer hop (the
(*hs)[k] form made implicit; load shape is the slice .ptr word's);
(b) a bare slice-element aggregate source (use(sl[k])) fell off
aggarg_srcaddr's ident-array-only N_INDEX arm into the #271 loud
stop — route the miss through the same cgplaceaddr fallback the
N_DOT arm uses. Both stages, byte-identical (probe matrix: let-copy,
field-assign, call-arg, return, indexed-store all IDENT).
After this, every ADDRESSABLE aggregate source resolves: ident
(local/module-let), deref, dot-chain, and index over array/slice/
ptr-array spines recurse through cgplaceaddr; the remaining loud
paths are rvalue sources (#40 family) and the #274 const-def arg,
both documented divergences. 8 rows added to idxdot_aggcopy_test.
pushargsrev's five aistagged gates (N_IDENT #55, N_CALL #21, N_INDEX
#12, N_DOT #22a, deref #35) treated a tagged arg as already-tagged
when its SLOT SIZE matched the param's. A same-slot subset union
((bool|void) into (i64|bool|void), both 16B) then natural-pushed the
narrower box's words carrying SOURCE tags — no re-layout, no
cg_widen_tag_remap twin — so the callee matched the wrong arm
(silent: probes exited 10/90 where cstage exits 30/27). cstage keys
widen detection on type equality (cgen.c:10000 same = (pu == au) ||
type_eq) and routes every non-same tagged source through the zeroed
scratch + tag remap; the slot-DIFFER wwstage path already mirrored
that byte-identically, so the fix computes cstage's same check once
(wsame) and replaces each slot-size test with it. This also erases
the last known cs!=ww shape divergence (the 16B-local staging vs
direct-push frame delta on prefix subsets).
8 subsetwiden_* fixtures own the class: call-result/ident/str-payload
/mid-arg remap (the wrong-arm shapes), prefix (the shape-divergence
repro), and bigslot/return-pos/struct-24-to-32 sibling guards. Corpus
pin 1740/343/22/209/1166/3480.
Pure move: log_test.ww dissolves along its banner seams into
funcs_test.ww (the six logger-arg rows — lprintlnbasic/single/empty,
lprintflnbasic/indexed/mods — plus the fatal-family subprocess TODO;
ref/hare/log/funcs.ha owns lprintln/lprintfln and the fatal/lfatal
forms) and global_test.ww (defaultwiredtoglobal, setloggerswap,
printflnglobal; ref/hare/log/global.ha owns default/global/setlogger).
Moved blocks are byte-identical; the 9 banner lines are deleted.
Imports minimized per file (log + memio; the stale fmt/io imports
drop).
Helper inventory: streq spans both halves (all six funcs rows;
setloggerswap + printflnglobal on the global side), so it is
duplicated under per-file names per the sanctioned strconv
streq/fstreq precedent — fstreq in funcs_test.ww (decl + 6 call
sites), gstreq in global_test.ww (decl + 6 call sites); bodies
byte-identical apart from the name. Line-multiset diff old-vs-concat
(heads/banners excluded, names normalized): the only residue is the
9-line streq helper counted twice.
Order-safety, proven on the composed run: dir-mode executes
declaration order per file, files byte-lexicographic (funcs_test <
global_test < silent_test). Observed order: lprintlnbasic,
lprintlnsingle, lprintlnempty, lprintflnbasic, lprintflnindexed,
lprintflnmods, defaultwiredtoglobal, setloggerswap, printflnglobal,
silentwritesnothing, silentignoresprintfln — defaultwiredtoglobal
still precedes every log.setlogger caller (setloggerswap and
printflnglobal, both later in its own file; funcs and silent rows
never call setlogger).
Consumers: Makefile LIBRARY_TESTS replaces the log_test.ww entry with
the two new entries in place; test/byteid/libbyteid_test.ww roster row
becomes two fx rows, NENTEXPECT 59->60.
Validation: standalone ww test lib/log/funcs_test.ww (6 passed) and
lib/log/global_test.ww (3 passed); dir mode ww test lib/log (11
passed, no duplicate symbols); byteid compile-only build exit 0, 60
roster appends == NENTEXPECT.
Pure move: bufio_test.ww dissolves along its banner seams into
stream_test.ww (13 stream* rows) and scanner_test.ww (13 scan*/
newscanner*/emptystream/errorsource/boundarycases/multifill/
readaheadcantgrow rows), mirroring ref/hare/bufio/{stream_test+test.ha,
scanner_test+test.ha} ownership. streamscannerunread stays stream-side:
Hare's stream-level unread test lives in stream_test+test.ha:86.
Moved blocks are byte-identical; the 28 file-scope banner lines (and
their // continuation lines) are deleted, the 2 interior banners inside
boundarycases stay. Imports minimized per file (the unused `import
bytes;` drops; utf8 is scanner-only).
Helper inventory: putstr spans both halves (7 scanner rows / 8 call
sites; 8 stream rows / 8 call sites), so it is duplicated under
per-file names per the sanctioned strconv streq/fstreq precedent —
scanner_test.ww keeps `putstr`, the stream copy is `sputstr` (decl,
head comment, 8 call sites; body otherwise byte-identical). The
error-returning source (errvt/errread/errwrite/errsource) moves with
its sole consumer errorsource into scanner_test.ww; the close-recording
source (srcclosed/closevt/closesink/closewrite/closeclose/closesource)
moves with streamclosenopropagate into stream_test.ww. Line-multiset
diff old-vs-concat (heads/banners excluded, sputstr normalized): the
only residue is the 10-line putstr helper counted twice.
Consumers: Makefile LIBRARY_TESTS replaces the bufio_test.ww entry with
the two new entries in place; test/byteid/libbyteid_test.ww roster row
becomes two fx rows, NENTEXPECT 58->59.
Validation: standalone ww test lib/bufio/scanner_test.ww (13 passed)
and lib/bufio/stream_test.ww (13 passed); dir mode ww test lib/bufio
(26 passed, no duplicate symbols); byteid compile-only build exit 0,
59 roster appends == NENTEXPECT.
