A call whose callee is a fn-VALUE (a fn-pointer struct field like w.emit(...),
or a local/param) had no free SK_FN entry, so exprtype's name lookup missed and
the N_CALL went nil-stamped (the fn-ptr-field class of the asserttyped gap
audit — 3 warns at smoke). When the name lookup misses, fall back to harec's
check_expr_call shape: read the result off the checked callee node's own type —
autodereference + dealias to the TY_FN, take its result (ref/harec/src/check.c
:1566-1581). Name lookup stays primary: a fn-NAME callee node carries its
return type, not its fn-type, so an N_TFN check first would mis-yield void for
a fn-returning-fn; only genuine fn-value callees reach the fallback.
Drives the 901 gap-corpus B count to 0 — with A/D already closed, only the
legitimate abort exemption (C) remains before the bail can arm. Byte-id holds
(cgen's fn-ptr detection is structural, independent of the stamp; the lib/io
return-forwarding site is cs==ww on both bootstrap combined.ww).
Hojun-Cho
360b58b267