/*
 * 949_dotbase_addr_slice_run — runtime + byte-id net for the array-
 * field-base-address family: #252 (the addr-of + slice SIBLING of #135),
 * #253 (the CHAINED-base close-out), and #257 (the CALL-ARG consumption
 * axis — an inline struct-array-field slice passed straight as a call
 * argument). 949_dotbase_arr_run covers the single-level read/write
 * index path.
 *
 * #252: taking `&x.o[i]` (address-of an element) or slicing
 * `x.o[lo:hi]` / `x.o[lo:]` of a struct's `[N]T`-typed FIELD computed
 * the field's VALUE as the base address instead of its ADDRESS: cgen
 * emitted `MOVL off(BP),AX` (load the field's first 8 bytes as a
 * pointer) where it must emit `LEAQ off(BP),AX` (the field's address)
 * -> garbage pointer -> SEGFAULT. The index read/write path was fixed
 * in #135; the addr-of N_INDEX "complex base" arm and the N_SLICE base
 * arm still fell to the generic cgexpr(base) auto-deref.
 *
 * #253: the same family with a CHAINED base — the inner is itself an
 * N_DOT (`o.p.m[i]` / `o.i.m[i]` / `o.a.b.m[i]`), not a bare ident.
 * `cg_dotbase_addr` / `dotbaseaddr` rejected a non-ident inner, so the
 * caller fell to cgexpr(base) which auto-derefs the array field's first
 * 8 bytes AS a pointer -> garbage base -> SEGFAULT (base64 fillobuf
 * `s.enc.encmap[...]` blocker). The fix recovers the container base via
 * the dot-chain spine (`cg_dotchain_addr` / `dotchainaddr`): the pointer
 * VALUE of inner when inner is a *struct, else the ADDRESS of inner,
 * then adds the field offset. One helper extension per stage closes the
 * whole family — every op (index r/w, addr-of, slice, compound) routes
 * through the same helper. cs==ww BOTH stages broken identically
 * pre-fix (gate-blind, pure correctness — not a byte-id divergence).
 *
 * Byte-id rows (cstage `ww build` + run for exit code; w6c vs w6c_ww
 * `.s` cmp for rule-10 byte-id):
 *   #252 (bare-ident base):
 *   - addr_local_u8   &x.o[1] on a local value-struct, *p read   → 66
 *   - addr_ptr_u8     &x.o[2] via a *struct param, *p read       → 77
 *   - addr_i32        &x.o[2] on [4]i32 field, *p read (esz=4)   → 88
 *   - slice_u8_expl   x.o[1:4] explicit hi, s[0] read            → 66
 *   - slice_u8_dflthi x.o[1:]  default hi,  s[0] read            → 66
 *   - slice_ptr_u8    x.o[1:4] via a *struct param, s[0] read    → 66
 *   - slice_i32_expl  [4]i32 field x.o[1:3], s[1] read (esz=4)   → 88
 *   - slice_i32_dflt  [4]i32 field x.o[1:],  s[2] read (esz=4)   → 55
 *   - control_bare    bare-local [4]u8 &a[1] write + a[1:4] read → 44
 *   #253 (chained base — *struct-field-pointer / deeper / non-u8):
 *   - chain_ptr_rd    o.p.m[1] read (p:*inner field)            → 66
 *   - chain_ptr_wr    o.p.m[2] write, read back via a.m[2]      → 77
 *   - chain_ptr_addr  &o.p.m[2] then *q read                    → 55
 *   - chain_ptr_sl_e  o.p.m[1:4] explicit hi, s[0]              → 66
 *   - chain_ptr_sl_d  o.p.m[1:]  default hi,  s[0]              → 66
 *   - chain_ptr_comp  o.p.m[1] += v compound                    → 66
 *   - chain_deep_lf   o.a.b.m[1] read (a value, b:*inner leaf)  → 66
 *   - chain_triple    o.p.q.m[1] read (two ptr links: dotchain  → 66
 *                     internal deref, pointer-only structs)
 *   - chain_tri_comp  o.p.q.m[1] += v through the triple chain  → 66
 *   - chain_i32_addr  &o.p.m[2] on [4]i32 (esz=4 stride)        → 88
 *   - chain_i32_slice o.p.m[1:3] on [4]i32, s[1] (esz=4)        → 88
 *   - ctrl_ptr_rd     p.m[1] read via *e param (control)        → 66
 *   - ctrl_local_rd   x.m[1] read, value-local field (control)  → 66
 *
 * Run-only rows (byteid=0): the chained VALUE-container arm (`o.i.m`,
 * inner is a value nested struct). These exercise the same fixed helper
 * and run correctly, but a value nested-struct instance trips two
 * orthogonal pre-existing cs!=ww divergences unrelated to #253 — bare-
 * let zero-init policy (wwstage emits an extra `MOVQ $0,off(BP)`) and
 * global DATAW byte count (wwstage over-emits) — so the rule-10 byte-id
 * gate can't apply here until those are fixed (#254). (A third, the
 * signed-narrow index-fallback element-LOAD opcode, was #255 — now
 * fixed; these u8 rows never hit it anyway.) Run correctness alone
 * proves the #253 segfault is gone for this cell.
 *   - chain_val_rd    o.i.m[1] read (i value nested)            → 66
 *   - chain_val_addr  &o.i.m[2] then *q read                    → 55
 *   - chain_val_slice o.i.m[1:4], s[0]                          → 66
 *   - chain_deep_val  o.a.b.m[1] read, full value chain         → 66
 *
 * The bare-local control asserts the N_IDENT base paths still emit
 * correct code; the non-u8 rows assert the esz stride extension is
 * wired (not silently esz=1).
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>

static int
runwait(const char *cmd)
{
	int rc = system(cmd);
	if (rc == -1) return -1;
	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
	return -1;
}

struct row { const char *label; const char *src; int want_exit; int byteid; };

static const struct row rows[] = {
	{ "addr_local_u8",
	  "package main;\n"
	  "type e = struct { o: [4]u8 };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[1] = 66u8;\n"
	  "	let p: *u8 = &x.o[1];\n"
	  "	return (*p): i32;\n"
	  "};\n", 66, 1 },
	{ "addr_ptr_u8",
	  "package main;\n"
	  "type e = struct { o: [4]u8 };\n"
	  "fn rd(x: *e) u8 = { let p: *u8 = &x.o[2]; return *p; };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[2] = 77u8;\n"
	  "	return rd(&x): i32;\n"
	  "};\n", 77, 1 },
	{ "addr_i32",
	  "package main;\n"
	  "type e = struct { o: [4]i32 };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[2] = 88;\n"
	  "	let p: *i32 = &x.o[2];\n"
	  "	return *p;\n"
	  "};\n", 88, 1 },
	{ "slice_u8_expl",
	  "package main;\n"
	  "type e = struct { o: [4]u8 };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[1] = 66u8;\n"
	  "	let s: []u8 = x.o[1:4];\n"
	  "	return s[0]: i32;\n"
	  "};\n", 66, 1 },
	{ "slice_u8_dflthi",
	  "package main;\n"
	  "type e = struct { o: [4]u8 };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[1] = 66u8;\n"
	  "	let s: []u8 = x.o[1:];\n"
	  "	return s[0]: i32;\n"
	  "};\n", 66, 1 },
	{ "slice_ptr_u8",
	  "package main;\n"
	  "type e = struct { o: [4]u8 };\n"
	  "fn sl(x: *e) u8 = { let s: []u8 = x.o[1:4]; return s[0]; };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[1] = 66u8;\n"
	  "	return sl(&x): i32;\n"
	  "};\n", 66, 1 },
	{ "slice_i32_expl",
	  "package main;\n"
	  "type e = struct { o: [4]i32 };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[1] = 99;\n"
	  "	x.o[2] = 88;\n"
	  "	let s: []i32 = x.o[1:3];\n"
	  "	return s[1];\n"
	  "};\n", 88, 1 },
	{ "slice_i32_dflt",
	  "package main;\n"
	  "type e = struct { o: [4]i32 };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[3] = 55;\n"
	  "	let s: []i32 = x.o[1:];\n"
	  "	return s[2];\n"
	  "};\n", 55, 1 },
	{ "control_bare",
	  "package main;\n"
	  "export fn main() i32 = {\n"
	  "	let a: [4]u8;\n"
	  "	a[2] = 44u8;\n"
	  "	let p: *u8 = &a[1];\n"
	  "	*p = 33u8;\n"
	  "	let s: []u8 = a[1:4];\n"
	  "	return s[1]: i32;\n"
	  "};\n", 44, 1 },
	/* #253 chained-base rows. inner/outer types declared per-row so
	 * each source is self-contained. */
	{ "chain_ptr_rd",
	  "package main;\n"
	  "type inner = struct { m: [4]u8 };\n"
	  "type outer = struct { p: *inner };\n"
	  "export fn main() i32 = {\n"
	  "	let a: inner; a.m[1] = 66u8;\n"
	  "	let o: outer; o.p = &a;\n"
	  "	return o.p.m[1]: i32;\n"
	  "};\n", 66, 1 },
	{ "chain_ptr_wr",
	  "package main;\n"
	  "type inner = struct { m: [4]u8 };\n"
	  "type outer = struct { p: *inner };\n"
	  "export fn main() i32 = {\n"
	  "	let a: inner;\n"
	  "	let o: outer; o.p = &a;\n"
	  "	o.p.m[2] = 77u8;\n"
	  "	return a.m[2]: i32;\n"
	  "};\n", 77, 1 },
	{ "chain_ptr_addr",
	  "package main;\n"
	  "type inner = struct { m: [4]u8 };\n"
	  "type outer = struct { p: *inner };\n"
	  "export fn main() i32 = {\n"
	  "	let a: inner; a.m[2] = 55u8;\n"
	  "	let o: outer; o.p = &a;\n"
	  "	let q: *u8 = &o.p.m[2];\n"
	  "	return (*q): i32;\n"
	  "};\n", 55, 1 },
	{ "chain_ptr_sl_e",
	  "package main;\n"
	  "type inner = struct { m: [4]u8 };\n"
	  "type outer = struct { p: *inner };\n"
	  "export fn main() i32 = {\n"
	  "	let a: inner; a.m[1] = 66u8;\n"
	  "	let o: outer; o.p = &a;\n"
	  "	let s: []u8 = o.p.m[1:4];\n"
	  "	return s[0]: i32;\n"
	  "};\n", 66, 1 },
	{ "chain_ptr_sl_d",
	  "package main;\n"
	  "type inner = struct { m: [4]u8 };\n"
	  "type outer = struct { p: *inner };\n"
	  "export fn main() i32 = {\n"
	  "	let a: inner; a.m[1] = 66u8;\n"
	  "	let o: outer; o.p = &a;\n"
	  "	let s: []u8 = o.p.m[1:];\n"
	  "	return s[0]: i32;\n"
	  "};\n", 66, 1 },
	{ "chain_ptr_comp",
	  "package main;\n"
	  "type inner = struct { m: [4]u8 };\n"
	  "type outer = struct { p: *inner };\n"
	  "export fn main() i32 = {\n"
	  "	let a: inner; a.m[1] = 60u8;\n"
	  "	let o: outer; o.p = &a;\n"
	  "	o.p.m[1] += 6u8;\n"
	  "	return o.p.m[1]: i32;\n"
	  "};\n", 66, 1 },
	{ "chain_deep_lf",
	  "package main;\n"
	  "type inner = struct { m: [4]u8 };\n"
	  "type mid = struct { b: *inner };\n"
	  "type top = struct { a: mid };\n"
	  "export fn main() i32 = {\n"
	  "	let z: inner; z.m[1] = 66u8;\n"
	  "	let o: top; o.a.b = &z;\n"
	  "	return o.a.b.m[1]: i32;\n"
	  "};\n", 66, 1 },
	{ "chain_triple",
	  "package main;\n"
	  "type inner = struct { m: [4]u8 };\n"
	  "type amid = struct { q: *inner };\n"
	  "type otop = struct { p: *amid };\n"
	  "export fn main() i32 = {\n"
	  "	let z: inner; z.m[1] = 66u8;\n"
	  "	let aa: amid; aa.q = &z;\n"
	  "	let o: otop; o.p = &aa;\n"
	  "	return o.p.q.m[1]: i32;\n"
	  "};\n", 66, 1 },
	{ "chain_tri_comp",
	  "package main;\n"
	  "type inner = struct { m: [4]u8 };\n"
	  "type amid = struct { q: *inner };\n"
	  "type otop = struct { p: *amid };\n"
	  "export fn main() i32 = {\n"
	  "	let z: inner; z.m[1] = 60u8;\n"
	  "	let aa: amid; aa.q = &z;\n"
	  "	let o: otop; o.p = &aa;\n"
	  "	o.p.q.m[1] += 6u8;\n"
	  "	return o.p.q.m[1]: i32;\n"
	  "};\n", 66, 1 },
	{ "chain_i32_addr",
	  "package main;\n"
	  "type inneri = struct { m: [4]i32 };\n"
	  "type outeri = struct { p: *inneri };\n"
	  "export fn main() i32 = {\n"
	  "	let a: inneri; a.m[2] = 88;\n"
	  "	let o: outeri; o.p = &a;\n"
	  "	let q: *i32 = &o.p.m[2];\n"
	  "	return *q;\n"
	  "};\n", 88, 1 },
	{ "chain_i32_slice",
	  "package main;\n"
	  "type inneri = struct { m: [4]i32 };\n"
	  "type outeri = struct { p: *inneri };\n"
	  "export fn main() i32 = {\n"
	  "	let a: inneri; a.m[1] = 99; a.m[2] = 88;\n"
	  "	let o: outeri; o.p = &a;\n"
	  "	let s: []i32 = o.p.m[1:3];\n"
	  "	return s[1];\n"
	  "};\n", 88, 1 },
	{ "ctrl_ptr_rd",
	  "package main;\n"
	  "type e = struct { m: [4]u8 };\n"
	  "fn rd(p: *e) u8 = { return p.m[1]; };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e; x.m[1] = 66u8;\n"
	  "	return rd(&x): i32;\n"
	  "};\n", 66, 1 },
	{ "ctrl_local_rd",
	  "package main;\n"
	  "type e = struct { m: [4]u8 };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e; x.m[1] = 66u8;\n"
	  "	return x.m[1]: i32;\n"
	  "};\n", 66, 1 },
	/* #255 signed-narrow N_DOT-base index read. Reading x.o[k] of a
	 * [N]i32/i16/i8 struct field via the N_DOT-base index fallback must
	 * sign-extend the narrow element (loadopsz keys on (signed,sz) →
	 * MOVSXD/MOVSWQ/MOVSBQ); pre-fix wwstage left signedness unset and
	 * emitted MOVL/MOVZ* (zero-extend) where cstage emits MOVS* — a
	 * byte-id divergence bootstrap never indexes, so these rows ARE the
	 * net. Negative round-trip (-5 → exit 251 = 256-5). */
	{ "nload_i32",
	  "package main;\n"
	  "type e = struct { o: [4]i32 };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[2] = -5;\n"
	  "	let v: i32 = x.o[2];\n"
	  "	return v;\n"
	  "};\n", 251, 1 },
	{ "nload_i16",
	  "package main;\n"
	  "type e = struct { o: [4]i16 };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[2] = -5i16;\n"
	  "	let v: i16 = x.o[2];\n"
	  "	return v: i32;\n"
	  "};\n", 251, 1 },
	{ "nload_i8",
	  "package main;\n"
	  "type e = struct { o: [4]i8 };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[2] = -5i8;\n"
	  "	let v: i8 = x.o[2];\n"
	  "	return v: i32;\n"
	  "};\n", 251, 1 },
	/* #253 chained VALUE-container arm (o.i.m). Run-only (byteid=0):
	 * a value nested-struct instance trips orthogonal pre-existing
	 * cs!=ww emission divergences (see header). The fixed helper runs
	 * these correctly — the segfault is gone. */
	{ "chain_val_rd",
	  "package main;\n"
	  "type inner = struct { m: [4]u8 };\n"
	  "type outv = struct { i: inner };\n"
	  "export fn main() i32 = {\n"
	  "	let o: outv; o.i.m[1] = 66u8;\n"
	  "	return o.i.m[1]: i32;\n"
	  "};\n", 66, 0 },
	{ "chain_val_addr",
	  "package main;\n"
	  "type inner = struct { m: [4]u8 };\n"
	  "type outv = struct { i: inner };\n"
	  "export fn main() i32 = {\n"
	  "	let o: outv; o.i.m[2] = 55u8;\n"
	  "	let q: *u8 = &o.i.m[2];\n"
	  "	return (*q): i32;\n"
	  "};\n", 55, 0 },
	{ "chain_val_slice",
	  "package main;\n"
	  "type inner = struct { m: [4]u8 };\n"
	  "type outv = struct { i: inner };\n"
	  "export fn main() i32 = {\n"
	  "	let o: outv; o.i.m[1] = 66u8;\n"
	  "	let s: []u8 = o.i.m[1:4];\n"
	  "	return s[0]: i32;\n"
	  "};\n", 66, 0 },
	{ "chain_deep_val",
	  "package main;\n"
	  "type inner = struct { m: [4]u8 };\n"
	  "type mid = struct { b: inner };\n"
	  "type top = struct { a: mid };\n"
	  "export fn main() i32 = {\n"
	  "	let o: top; o.a.b.m[1] = 66u8;\n"
	  "	return o.a.b.m[1]: i32;\n"
	  "};\n", 66, 0 },
	/* #257 call-arg consumption axis. An INLINE slice of a struct
	 * `[N]T`-field passed DIRECTLY as a call argument materialized the
	 * slice .ptr from the field VALUE, not its ADDRESS: the pushargs
	 * N_SLICE inline builder's non-ident else-arm did plain cgexpr(base)
	 * -> the N_DOT field auto-derefs (MOVL field,AX used as .ptr) ->
	 * callee derefs garbage -> SEGFAULT. The let-init / assign-rhs /
	 * return / hoist-to-local contexts already routed through the cgslice
	 * #252 choke-point; only this call-arg builder kept a private
	 * duplicate. Fix routes the else-arm through cg_dotbase_addr /
	 * dotbaseaddr (array-field-gated; chained inner via #253) + extends
	 * the N_IDENT-only esz gate to N_DOT bases (element width from the
	 * checker-stamped base->type). cs==ww both segfaulted identically
	 * pre-fix (gate-blind). */
	{ "callarg_u8",
	  "package main;\n"
	  "type e = struct { o: [4]u8 };\n"
	  "fn rd(b: []u8) i32 = { return b[0]: i32; };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[1] = 66u8;\n"
	  "	return rd(x.o[1:4]);\n"
	  "};\n", 66, 1 },
	{ "callarg_i32",
	  "package main;\n"
	  "type e = struct { o: [4]i32 };\n"
	  "fn rd(b: []i32) i32 = { return b[0]; };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[1] = 88;\n"
	  "	return rd(x.o[1:3]);\n"
	  "};\n", 88, 1 },
	{ "callarg_ptr_u8",
	  "package main;\n"
	  "type e = struct { o: [4]u8 };\n"
	  "fn rd(b: []u8) i32 = { return b[0]: i32; };\n"
	  "fn f(p: *e) i32 = { return rd(p.o[1:4]); };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[1] = 66u8;\n"
	  "	return f(&x);\n"
	  "};\n", 66, 1 },
	{ "callarg_chain",
	  "package main;\n"
	  "type inner = struct { m: [4]u8 };\n"
	  "type outer = struct { p: *inner };\n"
	  "fn rd(b: []u8) i32 = { return b[0]: i32; };\n"
	  "export fn main() i32 = {\n"
	  "	let a: inner; a.m[1] = 66u8;\n"
	  "	let o: outer; o.p = &a;\n"
	  "	return rd(o.p.m[1:4]);\n"
	  "};\n", 66, 1 },
	/* Controls: an N_IDENT slice arg (hoist-to-local) and a bare-local-
	 * array slice arg take the N_IDENT fast-paths, NOT the N_DOT else-arm
	 * — assert they still emit correct code. */
	{ "callarg_ctrl_local",
	  "package main;\n"
	  "type e = struct { o: [4]u8 };\n"
	  "fn rd(b: []u8) i32 = { return b[0]: i32; };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[1] = 66u8;\n"
	  "	let sl: []u8 = x.o[1:4];\n"
	  "	return rd(sl);\n"
	  "};\n", 66, 1 },
	{ "callarg_ctrl_arr",
	  "package main;\n"
	  "fn rd(b: []u8) i32 = { return b[0]: i32; };\n"
	  "export fn main() i32 = {\n"
	  "	let a: [4]u8;\n"
	  "	a[1] = 66u8;\n"
	  "	return rd(a[1:4]);\n"
	  "};\n", 66, 1 },
	/* Helper-deviation guard rows (load-bearing): a slice of a NON-array
	 * field (`[]T` field, str field) passed as a call arg must FALL
	 * THROUGH the array-gated cg_dotbase_addr/dotbaseaddr to cgexpr,
	 * which loads the field's slice/str HEADER .ptr — NOT take the field
	 * ADDRESS (that would treat the header words as inline array data).
	 * The N_DOT esz extension also applies on the fall-through arm: the
	 * slice is re-sliced by the element width (esz=4 for []i32), so
	 * q.v[1:3][0] = backing[1]. If the gate over-fired (emitted &field),
	 * .ptr would point at the header itself -> wrong value / segfault. */
	{ "callarg_slicefield",
	  "package main;\n"
	  "type w = struct { v: []i32 };\n"
	  "fn rd(s: []i32) i32 = { return s[0]; };\n"
	  "export fn main() i32 = {\n"
	  "	let backing: [4]i32;\n"
	  "	backing[1] = 88;\n"
	  "	let q: w;\n"
	  "	q.v = backing[0:4];\n"
	  "	return rd(q.v[1:3]);\n"
	  "};\n", 88, 1 },
	{ "callarg_strfield",
	  "package main;\n"
	  "type w = struct { v: str };\n"
	  "fn rd(s: str) i32 = { return len(s): i32; };\n"
	  "export fn main() i32 = {\n"
	  "	let q: w;\n"
	  "	q.v = \"hello\";\n"
	  "	return rd(q.v[1:4]);\n"
	  "};\n", 3, 1 },
	/* #259 tagged-union array-field indexed STORE via N_DOT base. The
	 * tagged-element store arm computed &arr[i] from a non-ident base
	 * (`x.o`) with a plain cgexpr(base) — the N_DOT array field auto-
	 * derefs (loads the field's first 8 bytes AS a pointer) -> garbage
	 * dest -> SEGFAULT. Last unrouted cell of the array-field-base-
	 * address family (#135/#252/#253/#255/#257 proof-grep residual). Fix
	 * routes the store base through cg_dotbase_addr/dotbaseaddr (array-
	 * gated; viaptr + chained handled by the shared helper). cs==ww
	 * broken identically pre-fix (gate-blind correctness).
	 *
	 * STORE byte-id rows (byteid=1): store-only into a tagged array field
	 * (own value-struct + via *struct param), return a constant. These
	 * gate the #259 store base-address emission cs==ww — the store
	 * portion is byte-identical post-fix (LEAQ base, not auto-deref). */
	{ "tagged_store_own",
	  "package main;\n"
	  "type e = struct { o: [4](i32 | void) };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[1] = 66;\n"
	  "	return 0;\n"
	  "};\n", 0, 1 },
	{ "tagged_store_ptr",
	  "package main;\n"
	  "type e = struct { o: [4](i32 | void) };\n"
	  "fn wr(x: *e) void = { x.o[2] = 77; };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	wr(&x);\n"
	  "	return 0;\n"
	  "};\n", 0, 1 },
	/* #261 tagged-element READ materialization via an N_DOT / chained
	 * N_INDEX base. The #259 store fix UNMASKED a pre-existing latent
	 * cs!=ww in the read-back: wwstage's cgindex N_DOT/N_INDEX-base arm
	 * never set elem_tagged (the detection block was gated on an N_IDENT
	 * base), so a tagged element fell to the SCALAR loadopsz path — one
	 * word into AX + a zeroed tag — where cstage copies the full 16B slot
	 * (AX=tag, DX=payload). Two more sites keyed off the same N_IDENT-only
	 * gate: rhstaggedabicall (let/call-arg widen source) and the return-
	 * path forwardtagged. All three drop the tag/payload-high word -> the
	 * wrong variant. Fix mirrors cstage (classify TY_TAGGED for ANY base,
	 * read the checker-stamped element type_): cgindex slot-copy +
	 * rhstaggedabicall typeistagged(src.type_) + forwardtagged broadened
	 * to N_INDEX/N_DOT. read + call-arg + return + chained 2D all close by
	 * construction. byteid=1 throughout: post-fix the materialization is
	 * byte-identical.
	 *
	 * Tag-survival proof: each shape is tested with BOTH an i32 variant
	 * AND an explicit `= void` variant. The old one-word load that zeroed
	 * the tag would misread the void slot as the i32 variant (tag 0); the
	 * void rows return 1 only if the tag survived. */
	{ "tagged_store_own_rd",
	  "package main;\n"
	  "type e = struct { o: [4](i32 | void) };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[1] = 66;\n"
	  "	let v: (i32 | void) = x.o[1];\n"
	  "	return match (v) {\n"
	  "	case let n: i32 => yield n;\n"
	  "	case void => yield 0: i32;\n"
	  "	};\n"
	  "};\n", 66, 1 },
	{ "tagged_store_ptr_rd",
	  "package main;\n"
	  "type e = struct { o: [4](i32 | void) };\n"
	  "fn wr(x: *e) void = { x.o[2] = 77; };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	wr(&x);\n"
	  "	let v: (i32 | void) = x.o[2];\n"
	  "	return match (v) {\n"
	  "	case let n: i32 => yield n;\n"
	  "	case void => yield 0: i32;\n"
	  "	};\n"
	  "};\n", 77, 1 },
	{ "tagged_rd_void",
	  "package main;\n"
	  "type e = struct { o: [4](i32 | void) };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[1] = void;\n"
	  "	let v: (i32 | void) = x.o[1];\n"
	  "	return match (v) {\n"
	  "	case let n: i32 => yield 99: i32;\n"
	  "	case void => yield 1: i32;\n"
	  "	};\n"
	  "};\n", 1, 1 },
	{ "tagged_callarg_i32",
	  "package main;\n"
	  "type e = struct { o: [4](i32 | void) };\n"
	  "fn take(v: (i32 | void)) i32 = {\n"
	  "	return match (v) {\n"
	  "	case let n: i32 => yield n;\n"
	  "	case void => yield 1: i32;\n"
	  "	};\n"
	  "};\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[2] = 55;\n"
	  "	return take(x.o[2]);\n"
	  "};\n", 55, 1 },
	{ "tagged_callarg_void",
	  "package main;\n"
	  "type e = struct { o: [4](i32 | void) };\n"
	  "fn take(v: (i32 | void)) i32 = {\n"
	  "	return match (v) {\n"
	  "	case let n: i32 => yield 99: i32;\n"
	  "	case void => yield 1: i32;\n"
	  "	};\n"
	  "};\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[2] = void;\n"
	  "	return take(x.o[2]);\n"
	  "};\n", 1, 1 },
	{ "tagged_return_i32",
	  "package main;\n"
	  "type e = struct { o: [4](i32 | void) };\n"
	  "fn ret(x: *e) (i32 | void) = { return x.o[1]; };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[1] = 88;\n"
	  "	let v: (i32 | void) = ret(&x);\n"
	  "	return match (v) {\n"
	  "	case let n: i32 => yield n;\n"
	  "	case void => yield 1: i32;\n"
	  "	};\n"
	  "};\n", 88, 1 },
	{ "tagged_return_void",
	  "package main;\n"
	  "type e = struct { o: [4](i32 | void) };\n"
	  "fn ret(x: *e) (i32 | void) = { return x.o[1]; };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[1] = void;\n"
	  "	let v: (i32 | void) = ret(&x);\n"
	  "	return match (v) {\n"
	  "	case let n: i32 => yield 99: i32;\n"
	  "	case void => yield 1: i32;\n"
	  "	};\n"
	  "};\n", 1, 1 },
	{ "tagged_chained_i32",
	  "package main;\n"
	  "type m = struct { g: [2][2](i32 | void) };\n"
	  "export fn main() i32 = {\n"
	  "	let y: m;\n"
	  "	y.g[1][1] = 44;\n"
	  "	let v: (i32 | void) = y.g[1][1];\n"
	  "	return match (v) {\n"
	  "	case let n: i32 => yield n;\n"
	  "	case void => yield 1: i32;\n"
	  "	};\n"
	  "};\n", 44, 1 },
	{ "tagged_chained_void",
	  "package main;\n"
	  "type m = struct { g: [2][2](i32 | void) };\n"
	  "export fn main() i32 = {\n"
	  "	let y: m;\n"
	  "	y.g[1][1] = void;\n"
	  "	let v: (i32 | void) = y.g[1][1];\n"
	  "	return match (v) {\n"
	  "	case let n: i32 => yield 99: i32;\n"
	  "	case void => yield 1: i32;\n"
	  "	};\n"
	  "};\n", 1, 1 },
	{ "tagged_ctrl_bare_rd",
	  "package main;\n"
	  "export fn main() i32 = {\n"
	  "	let a: [4](i32 | void);\n"
	  "	a[1] = 33;\n"
	  "	let v: (i32 | void) = a[1];\n"
	  "	return match (v) {\n"
	  "	case let n: i32 => yield n;\n"
	  "	case void => yield 1: i32;\n"
	  "	};\n"
	  "};\n", 33, 1 },
	/* #261 NULLABLE-fold deviation: a (*T | void) element is the 8B
	 * one-word fold, NOT the 16B tag+payload slot. The fix mirrors
	 * cstage exactly — classify TY_TAGGED for ANY base WITHOUT excluding
	 * the nullable fold (slot_sz=8 degrades the copy arm to a single
	 * MOVQ). These rows pin that the no-exclusion path is byte-id for the
	 * fold too. The pointer-present / void cases prove the discriminant
	 * (the pointer value itself) survives materialization. The variant
	 * payload is read by constant (no `*p` deref) only to dodge an
	 * ORTHOGONAL pre-existing wwstage checker bug (asserttyped: un on a
	 * deref of a match-bound pointer) — distinct from #261's cgen axis. */
	{ "tagged_null_ptr_rd",
	  "package main;\n"
	  "type e = struct { o: [4](*i32 | void) };\n"
	  "export fn main() i32 = {\n"
	  "	let k: i32 = 7;\n"
	  "	let x: e;\n"
	  "	x.o[1] = &k;\n"
	  "	let v: (*i32 | void) = x.o[1];\n"
	  "	return match (v) {\n"
	  "	case let p: *i32 => yield 55: i32;\n"
	  "	case void => yield 1: i32;\n"
	  "	};\n"
	  "};\n", 55, 1 },
	{ "tagged_null_void_rd",
	  "package main;\n"
	  "type e = struct { o: [4](*i32 | void) };\n"
	  "export fn main() i32 = {\n"
	  "	let x: e;\n"
	  "	x.o[1] = void;\n"
	  "	let v: (*i32 | void) = x.o[1];\n"
	  "	return match (v) {\n"
	  "	case let p: *i32 => yield 99: i32;\n"
	  "	case void => yield 1: i32;\n"
	  "	};\n"
	  "};\n", 1, 1 },
	/* #263 IDENT-source tagged return. `return v` where v is a tagged
	 * LOCAL ident: cstage's passthrough predicate was TYPE-only (no kind
	 * filter), so it forwarded the source's AX/DX unchanged — but cgexpr
	 * of a tagged ident loads only word0 (the tag) into AX, never the
	 * payload into DX, so the payload was DROPPED (cstage exited 0 on the
	 * i32-7 repro; wwstage exited 7 — the runtime oracle that proved
	 * cstage is the bug). Fix gates passthrough to the register-resident
	 * source kinds (N_CALL/N_INDEX/N_DOT) and routes a tagged-ident return
	 * through the scratch-widen path, mirroring wwstage's forwardtagged
	 * kind filter. byteid=1: post-fix the materialization is byte-id with
	 * wwstage's return scratch-widen. The void row proves the tag survives
	 * (the dropped-payload bug would still surface the wrong variant; the
	 * void tag is read correctly either way, so its survival pins the tag
	 * column like the #261 i32-AND-void design). */
	{ "tagged_ident_ret_i32",
	  "package main;\n"
	  "fn g() (i32 | void) = { let v: (i32 | void) = 7i32; return v; };\n"
	  "export fn main() i32 = {\n"
	  "	return match (g()) {\n"
	  "	case let n: i32 => yield n;\n"
	  "	case void => yield 1: i32;\n"
	  "	};\n"
	  "};\n", 7, 1 },
	{ "tagged_ident_ret_void",
	  "package main;\n"
	  "fn g() (i32 | void) = { let v: (i32 | void) = void; return v; };\n"
	  "export fn main() i32 = {\n"
	  "	return match (g()) {\n"
	  "	case let n: i32 => yield 99: i32;\n"
	  "	case void => yield 1: i32;\n"
	  "	};\n"
	  "};\n", 1, 1 },
	/* #263 CONTROLS: the register-resident passthrough must STILL fire
	 * (don't over-gate). CALL-source (forwarding another tagged-returning
	 * fn) + DOT-source (a tagged struct field). INDEX-source is already
	 * covered by tagged_return_i32 above (`return x.o[1]`). */
	{ "tagged_call_ret_ctrl",
	  "package main;\n"
	  "fn inner() (i32 | void) = { let v: (i32 | void) = 42i32; return v; };\n"
	  "fn outer() (i32 | void) = { return inner(); };\n"
	  "export fn main() i32 = {\n"
	  "	return match (outer()) {\n"
	  "	case let n: i32 => yield n;\n"
	  "	case void => yield 1: i32;\n"
	  "	};\n"
	  "};\n", 42, 1 },
	{ "tagged_dot_ret_ctrl",
	  "package main;\n"
	  "type w = struct { f: (i32 | void) };\n"
	  "fn dot(x: *w) (i32 | void) = { return x.f; };\n"
	  "export fn main() i32 = {\n"
	  "	let x: w;\n"
	  "	x.f = 63;\n"
	  "	return match (dot(&x)) {\n"
	  "	case let n: i32 => yield n;\n"
	  "	case void => yield 1: i32;\n"
	  "	};\n"
	  "};\n", 63, 1 },
	/* #265 fold-1 aggregate deref-rhs let-init `let c: T = *p` (T a
	 * struct or array, >8B). Pre-fix NEITHER stage copied the whole
	 * aggregate: cstage DROPPED the copy entirely (c read garbage);
	 * wwstage copied only the FIRST 8 bytes (the scalar `MOVQ AX,off`
	 * tail). Fix: both stages memcpy the ABI-size aggregate slot→slot
	 * via SI — a MOVQ run plus a sized MOVL/MOVW/MOVB tail. Converged
	 * (rule-10, byteid=1). Each row writes DISTINCT values to ALL
	 * members and reads back EVERY member (sum), so a partial/zero copy
	 * fails — a c[0]-only readback would pass a truncated copy. Covers:
	 * struct{[4]u32} 16B + struct{[8]u32} 32B (sha256 `*h` shape, both
	 * `*(&s)` and `*p` pointer-ident) + a bare [4]u32 array + non-8-mult
	 * tails ([3]u32 12B → MOVL tail; [11]u8 11B → MOVW+MOVB tail). The
	 * by-value aggregate RETURN ABI is fold-2 (#267, deferred). */
	{ "deref_struct16",
	  "package main;\n"
	  "type t = struct { h: [4]u32 };\n"
	  "export fn main() i32 = {\n"
	  "	let s: t;\n"
	  "	s.h[0]=10u32; s.h[1]=20u32; s.h[2]=30u32; s.h[3]=40u32;\n"
	  "	let c: t = *(&s);\n"
	  "	return (c.h[0]+c.h[1]+c.h[2]+c.h[3]): i32;\n"
	  "};\n", 100, 1 },
	{ "deref_struct32",
	  "package main;\n"
	  "type t = struct { h: [8]u32 };\n"
	  "export fn main() i32 = {\n"
	  "	let s: t;\n"
	  "	s.h[0]=1u32; s.h[1]=2u32; s.h[2]=3u32; s.h[3]=4u32;\n"
	  "	s.h[4]=5u32; s.h[5]=6u32; s.h[6]=7u32; s.h[7]=8u32;\n"
	  "	let c: t = *(&s);\n"
	  "	return (c.h[0]+c.h[1]+c.h[2]+c.h[3]\n"
	  "	      +c.h[4]+c.h[5]+c.h[6]+c.h[7]): i32;\n"
	  "};\n", 36, 1 },
	{ "deref_ptr32",
	  "package main;\n"
	  "type t = struct { h: [8]u32 };\n"
	  "export fn main() i32 = {\n"
	  "	let s: t;\n"
	  "	s.h[0]=1u32; s.h[1]=2u32; s.h[2]=3u32; s.h[3]=4u32;\n"
	  "	s.h[4]=5u32; s.h[5]=6u32; s.h[6]=7u32; s.h[7]=8u32;\n"
	  "	let p: *t = &s;\n"
	  "	let c: t = *p;\n"
	  "	return (c.h[0]+c.h[1]+c.h[2]+c.h[3]\n"
	  "	      +c.h[4]+c.h[5]+c.h[6]+c.h[7]): i32;\n"
	  "};\n", 36, 1 },
	{ "deref_array16",
	  "package main;\n"
	  "export fn main() i32 = {\n"
	  "	let s: [4]u32;\n"
	  "	s[0]=5u32; s[1]=6u32; s[2]=7u32; s[3]=8u32;\n"
	  "	let c: [4]u32 = *(&s);\n"
	  "	return (c[0]+c[1]+c[2]+c[3]): i32;\n"
	  "};\n", 26, 1 },
	{ "deref_tail12",
	  "package main;\n"
	  "export fn main() i32 = {\n"
	  "	let s: [3]u32;\n"
	  "	s[0]=7u32; s[1]=8u32; s[2]=9u32;\n"
	  "	let c: [3]u32 = *(&s);\n"
	  "	return (c[0]+c[1]+c[2]): i32;\n"
	  "};\n", 24, 1 },
	{ "deref_tail11",
	  "package main;\n"
	  "export fn main() i32 = {\n"
	  "	let s: [11]u8;\n"
	  "	s[0]=1u8; s[1]=2u8; s[2]=3u8; s[3]=4u8; s[4]=5u8;\n"
	  "	s[5]=6u8; s[6]=7u8; s[7]=8u8; s[8]=9u8; s[9]=10u8;\n"
	  "	s[10]=11u8;\n"
	  "	let c: [11]u8 = *(&s);\n"
	  "	return (c[0]+c[1]+c[2]+c[3]+c[4]+c[5]\n"
	  "	      +c[6]+c[7]+c[8]+c[9]+c[10]): i32;\n"
	  "};\n", 66, 1 },
	{ NULL, NULL, 0, 0 }
};

static int
slurp_eq(const char *a, const char *b)
{
	FILE *fa = fopen(a, "rb");
	FILE *fb = fopen(b, "rb");
	if (!fa || !fb) { if (fa) fclose(fa); if (fb) fclose(fb); return -1; }
	int rc = 0;
	for (;;) {
		int ca = fgetc(fa);
		int cb = fgetc(fb);
		if (ca != cb) { rc = -1; break; }
		if (ca == EOF) break;
	}
	fclose(fa); fclose(fb);
	return rc;
}

int
main(void)
{
	const char *bin = getenv("BIN");
	if (!bin) bin = "out/bin";
	char absbin[1024];
	if (bin[0] != '/') {
		char cwd[1024];
		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
		bin = absbin;
	}

	char w6c[1100], w6c_ww[1100];
	snprintf(w6c, sizeof w6c, "%s/w6c", bin);
	snprintf(w6c_ww, sizeof w6c_ww, "%s/w6c_ww", bin);
	if (access(w6c_ww, X_OK) != 0) {
		fprintf(stderr, "dotbaseaddr: w6c_ww missing — cannot run the "
		    "cs==ww byte-id gate (the whole point of this test)\n");
		return 1;
	}

	int n = 0, fail = 0;
	for (int i = 0; rows[i].src; i++, n++) {
		char src[64];
		snprintf(src, sizeof src, "/tmp/wwdbs_%d_%d.ww", getpid(), i);
		FILE *f = fopen(src, "wb");
		if (f == NULL) { fail++; continue; }
		fputs(rows[i].src, f);
		fclose(f);

		char tmpdir[64];
		snprintf(tmpdir, sizeof tmpdir, "/tmp/wwdbs_%d_d_%d",
		    getpid(), i);
		mkdir(tmpdir, 0755);

		char cmd[2048];
		snprintf(cmd, sizeof cmd, "cd %s && %s/ww build %s",
		    tmpdir, bin, src);
		if (runwait(cmd) != 0) {
			fprintf(stderr, "row[%s]: cstage build failed\n",
			    rows[i].label);
			fail++;
			unlink(src); rmdir(tmpdir);
			continue;
		}

		char outbin[128];
		const char *base = strrchr(src, '/');
		base = base ? base + 1 : src;
		snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
		char *dot = strrchr(outbin, '.');
		if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';

		int got = runwait(outbin);
		if (got != rows[i].want_exit) {
			fprintf(stderr, "row[%s]: cstage exit %d, want %d\n",
			    rows[i].label, got, rows[i].want_exit);
			fail++;
		}
		unlink(outbin); rmdir(tmpdir);

		if (!rows[i].byteid) {
			/* Run-only row — byte-id blocked by an orthogonal
			 * pre-existing cs!=ww divergence (see header). */
			unlink(src);
			continue;
		}

		char cs_s[64], ws_s[64];
		snprintf(cs_s, sizeof cs_s, "/tmp/wwdbs_%d_%d_cs.s",
		    getpid(), i);
		snprintf(ws_s, sizeof ws_s, "/tmp/wwdbs_%d_%d_ww.s",
		    getpid(), i);

		snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null",
		    w6c, cs_s, src);
		if (runwait(cmd) != 0) {
			fprintf(stderr, "row[%s]: w6c failed\n", rows[i].label);
			fail++; unlink(src); continue;
		}
		snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null",
		    w6c_ww, ws_s, src);
		if (runwait(cmd) != 0) {
			fprintf(stderr, "row[%s]: w6c_ww failed\n",
			    rows[i].label);
			fail++; unlink(src); unlink(cs_s); continue;
		}
		if (slurp_eq(cs_s, ws_s) != 0) {
			fprintf(stderr,
			    "row[%s]: cstage/wwstage .s DIFFER (rule-10 "
			    "byte-id violation)\n", rows[i].label);
			fail++;
		}
		unlink(src); unlink(cs_s); unlink(ws_s);
	}

	if (fail) {
		fprintf(stderr, "%d/%d dotbase-addr-slice tests failed\n",
		    fail, n);
		return 1;
	}
	printf("dotbaseaddr: %d/%d ok (cstage run + cs==ww byte-id)\n",
	    n, n);
	return 0;
}