From 3dd842d6e8ccafce954b9c72346f2cfefc9e31d5 Mon Sep 17 00:00:00 2001
From: zinc <zinc@downsta.ir>
Date: Wed, 14 Oct 2026 16:38:21 +0330
Subject: zc0umd: no recast uses a visible u/m/d as its tag (spec 1.6.3); spec:
 the fixed appendix b bugs are marked fixed

---
 docs/SPEC.md | 39 +++++++++++++++++++++++----------------
 1 file changed, 23 insertions(+), 16 deletions(-)

(limited to 'docs')

diff --git a/docs/SPEC.md b/docs/SPEC.md
index 6df55f6..3eda4f3 100644
--- a/docs/SPEC.md
+++ b/docs/SPEC.md
@@ -55,7 +55,7 @@ a name that looks like `x.y` where `x` is not a known module is the three tokens
 | `break` `continue` `return` | S | | | 4.8 |
 | `defer` | S | | | 4.14 |
 | `enum` | S | T | | 5.8 |
-| `include` | S | T | | 5.12 (a statement only by accident, 5.12.7) |
+| `include` | S | T | | 5.12 (in a function body it is an error, 5.12.7) |
 | `embed` | S | T | | 5.11 |
 | `memdebug` | S | T | | 4.11 |
 | `hints` | S | T | | 4.12 |
@@ -395,7 +395,7 @@ a = b = 7                        // assigns both, value 7
 
 3.5.4 `-x` of a float is computed as `0.0 - x`, so `-0.0` evaluates to `+0.0`. do not depend on the sign of zero.
 
-3.5.5 `?:` with one float branch and one integer branch is broken in the reference implementation (appendix b). write both branches as floats.
+3.5.5 `?:` with one float branch and one integer branch converts the integer branch to float: `1 ? 1 : 2.5` is 1.0, `1 ? 2.5 : 1` is 2.5.
 
 ### 3.6 evaluation order and short circuit
 
@@ -507,7 +507,7 @@ other operators (`/ % ^ < ?:` and so on) are not part of a constant expression:
 
 ### 3.15 closures
 
-3.15.1 `fn(a, b) { ... }` in an expression is a closure. parameters may be typed (`fn(int a)`) and tagged. `fn:T(a) { ... }` declares the result type `T` and coerces and checks returns against it. a closure is an owned heap object (a fresh object, 6.1): bind it to a local, pass it to a `.d` parameter or to a borrower, or return it from a `.u` function.
+3.15.1 `fn(a, b) { ... }` in an expression is a closure. parameters (up to 24) may be typed (`fn(int a)`) and tagged. `fn:T(a) { ... }` declares the result type `T` and coerces and checks returns against it. a closure is an owned heap object (a fresh object, 6.1): bind it to a local, pass it to a `.d` parameter or to a borrower, or return it from a `.u` function.
 
 3.15.2 a closure captures the locals and parameters of the enclosing function by reference (shared cells): later changes are visible both ways, and the cells outlive the creating function.
 ```
@@ -624,7 +624,7 @@ o3 int sum(fixed int[?] a) { int s = 0; for (int i = 0; i < len(a); i++) s += a[
 
 ### 4.11 memdebug
 
-`memdebug on;` turns on heap header checks and allocation-site tracking from this point in the file (top level) or from this point in the function (statement); the runtime enables the checks before `main` for the top-level form. `memdebug scrub;` additionally fills freed payloads with 57005; `memdebug off;` stops. with checks on, a use after free prints `zy: use after free from line N`, a double free prints `zy: double free from line N` and returns, a stray address prints `zy: bad heap pointer`. `rt.memreport()` prints a line `leak: line N W words` per live recorded object and returns the count. (`memdebug scrub;` is rejected by the reference implementation, appendix b.)
+`memdebug on;` turns on heap header checks and allocation-site tracking from this point in the file (top level) or from this point in the function (statement); the runtime enables the checks before `main` for the top-level form. `memdebug scrub;` additionally fills freed payloads with 57005; `memdebug off;` stops. with checks on, a use after free prints `zy: use after free from line N`, a double free prints `zy: double free from line N` and returns, a stray address prints `zy: bad heap pointer`. `rt.memreport()` prints a line `leak: line N W words` per live recorded object and returns the count.
 
 ### 4.12 hints
 
@@ -695,7 +695,7 @@ a bare `name(params) { ... }` with no `fn` and no type is not a function declara
 
 5.2.5 `main`. after the unit compiles without errors, the runtime calls `main` with no arguments (declared parameters read unspecified values; `main(a, b)` prints 0 0 in the reference implementation). its return value is ignored and is not the exit status; `main` may be declared `int`, `void` or untyped, in a run-only image as in `zy`. 8.1.
 
-5.2.6 a function is defined once. redefining a name that already has a body is, per the rule, error: f: is defined twice; the reference implementation does not detect an ordinary redefinition (appendix b). a prototype must agree with the definition: error: f: doesn't match its earlier declaration.
+5.2.6 a function is defined once. redefining a name that already has a body in the same module is error: f: is defined twice. a prototype may come before or after the definition and must agree with it: error: f: doesn't match its earlier declaration. a prototype after the definition keeps the definition.
 
 5.2.7 `immediate fn` defines a parse word (7.2). `unchecked fn` and `o3 fn` are 4.9 and 4.10.
 
@@ -703,7 +703,7 @@ a bare `name(params) { ... }` with no `fn` and no type is not a function declara
 
 5.3.1 `T a = e, b, c[10];`, `let g = 1, buf[10];`, `int[10] buf;`, `point origin;`. storage is emitted in place, zero initialised.
 
-5.3.2 an initializer is: a constant expression (3.14), a word string, a byte string, or a brace list or compound literal for an array. anything else is an error: for `int a = f();` error: expected ';', found '('. a float literal initializer is rejected (error: expected a constant) in the reference implementation (appendix b); assign floats in code. a name of another global in the initializer evaluates to its address, not its value: `int a = 5; int b = a + 1;` gives `b` the value `&a + 1`.
+5.3.2 an initializer is: a constant expression (3.14), a word string, a byte string, or a brace list or compound literal for an array. anything else is an error: for `int a = f();` error: expected ';', found '('. a `float`, `f64` or `f32` global takes a float literal initializer (`float g = 1.5;`). a name of another global in the initializer evaluates to its address, not its value: `int a = 5; int b = a + 1;` gives `b` the value `&a + 1`.
 
 5.3.3 a global cannot be tagged (error: tags go on locals and parameters, not globals), cannot be `void`, and an array global needs a length or an initializer.
 
@@ -782,7 +782,7 @@ rt.put_n(util.twice(1));        // error: module access requires `include util;`
 
 5.12.6 in a namespaced file, a declaration `f` is `ns.f`. an unqualified name is looked up first in the file's namespace, then globally, and `rt` is not searched for bare names (3.11.5).
 
-5.12.7 `include` is parsed at the top level; written inside a function body it mis-compiles (appendix b).
+5.12.7 `include` is parsed at the top level; written inside a function body it is error: include is top level only.
 
 5.12.8 when a library is included more than once, it is compiled once.
 
@@ -1086,11 +1086,11 @@ not in the zc0 subset: `struct`, methods, `enum`, `type`, generics, `do`/`while`
 
 ## appendix b: disagreements and bugs
 
-each item gives a minimal program, the expected behavior (per this spec) and the actual behavior of the reference implementation on `build/bin/zy` (unless it names zc0). none are fixed here.
+each item gives a minimal program, the expected behavior (per this spec) and the actual behavior of the reference implementation on `build/bin/zy` (unless it names zc0). items marked fixed are kept for their numbers; the rest are open.
 
 ### b.1 disagreements between the prose docs and the code
 
-1. README ("memory debug"): "`memdebug scrub;` also fills a freed payload with 57005". the compiler compares the word after `memdebug` with the interned name `rt.scrub` instead of `scrub`, so the statement is rejected: `memdebug scrub;` => `zc: line N: memdebug on, memdebug scrub or memdebug off`. (also b.2.1)
+1. fixed: README ("memory debug") says `memdebug scrub;` also fills a freed payload with 57005; the compiler used to compare the word with `rt.scrub` and reject it. it is accepted now (also b.2.1).
 2. README ("zc, the language") says a cast type "has to be a simple type ... `int` or `*node`". the prefix pointer spelling `*node` is not a type (README's own "pointer types" section says so, and `(*int)y` => `int: is a type, not a value`). the postfix form `(node*)x` is the one that works.
 3. README says "operators follow C precedence". this holds for expressions. constant expressions (array lengths, enum values, `const`, `case` labels) have no precedence: `+ - * | & << >>` only, left to right (3.14). `const X = 1 + 2 * 3;` is 9, and `/ % ^` are rejected (`const Z = 6 / 2;` => `expected ';', found '/'`). README does not mention either fact.
 4. README lists `switch` forms `case 1, 2:` and `default:`. the catch-all `case _:` exists in the compiler and is not documented.
@@ -1104,15 +1104,15 @@ each item gives a minimal program, the expected behavior (per this spec) and the
 
 ### b.2 implementation bugs and limitations
 
-1. `memdebug scrub;` is rejected (b.1.1). expected: poison freed payloads with 57005.
+1. fixed: `memdebug scrub;` is accepted and poisons freed payloads with 57005 (b.1.1).
 2. enum members cannot name earlier members of the same enum: `enum { HI = 16, LO = HI + 1 };` => `expected a constant` (the members are defined after the closing brace). members of an earlier enum and constants work.
-3. a function can be silently redefined. `int f() { return 1; } int g() { return f() + 10; } int f() { return 2; }`, then `g()` gives 11 and a later call of `f()` gives 2. expected: error `f: is defined twice` (the message exists in the compiler and is unreachable for an ordinary second definition).
-4. a prototype after the definition hides it. `int f() { return 1; } int f();` then `f()` => `zc: line 0: f is used but never defined`. expected: the definition stays.
-5. `?:` with one float branch and one integer branch converts wrongly. `pf(1 ? 1 : 2.5)` prints `0.000000` (the integer 1's bits read as a float); `pf(1 ? 2.5 : 1)` prints `4612811918334230528.000000` (the taken float converted again as if an integer); `pf(0 ? 2.5 : 1)` prints 1.000000 and `pf(0 ? 1 : 2.5)` 2.500000 (these two are right). expected 1.0, 2.5, 1.0, 2.5.
+3. fixed (now error: f: is defined twice): a function could be silently redefined. `int f() { return 1; } int g() { return f() + 10; } int f() { return 2; }`, then `g()` gives 11 and a later call of `f()` gives 2. expected: error `f: is defined twice` (the message exists in the compiler and is unreachable for an ordinary second definition).
+4. fixed (the definition stays): a prototype after the definition hid it. `int f() { return 1; } int f();` then `f()` => `zc: line 0: f is used but never defined`. expected: the definition stays.
+5. fixed (3.5.5): `?:` with one float branch and one integer branch converted wrongly. `pf(1 ? 1 : 2.5)` prints `0.000000` (the integer 1's bits read as a float); `pf(1 ? 2.5 : 1)` prints `4612811918334230528.000000` (the taken float converted again as if an integer); `pf(0 ? 2.5 : 1)` prints 1.000000 and `pf(0 ? 1 : 2.5)` 2.500000 (these two are right). expected 1.0, 2.5, 1.0, 2.5.
 6. `bool` does not normalise: `bool b = 5; rt.put_n(b); rt.put_n(b == 1); rt.put_n(!b);` prints 5, 0, 0. expected 1, 1, 0 if `bool` is a 0/1 type; it behaves as a plain integer.
-7. a float literal as a global initializer: `float g = 1.5;` at the top level => `expected a constant`. expected: allowed (a float local initializer works).
-8. a global initializer that names another global uses the other global's address, not its value: `int a = 5; int b = a + 1;` gives `b` the value `&a + 1` (1 when `a` is at address 0). expected: the value of `a`, or an error.
-9. `include std;` written inside a function body: `zc: line N: return outside a function`. expected: an error saying include is top level only.
+7. fixed (5.3.2): a float literal as a global initializer (`float g = 1.5;`) was rejected.
+8. not a bug: a global initializer that names another global uses the other global's address (5.3.2, 3.14.2): `int a = 5; int b = a + 1;` gives `b` the value `&a + 1`.
+9. fixed (5.12.7): `include std;` inside a function body gave `return outside a function`; it is now error: include is top level only.
 10. a syntax error hides errors in the statements skipped by recovery: `int a = ; int b = 3 +;` reports only the first error (8.2). by design, but easy to miss.
 11. an unterminated `/* ...` comment is accepted silently (1.2.2); an unterminated string literal is only reported as a later syntax error.
 12. `x as int * y` parses `int*` as the type (3.2.3).
@@ -1120,6 +1120,13 @@ each item gives a minimal program, the expected behavior (per this spec) and the
 14. `len(s)` on a `char*` returns word 0 of the string when `typecheck` is off.
 15. duplicate `case` labels are not diagnosed (4.7.2).
 16. a local `const` cannot be used in a constant expression (b.1.7).
+17. fixed: a bad float or character literal in a function's first statement was not reported (1.4).
+18. fixed: `u*d` with a visible variable `u` (local or global) was read as a recast; it is a product (1.6.3).
+19. fixed: a cast such as `(int*)s` of a `bstr` kept the byte-string flag, so `p[0]` read a byte.
+20. fixed: functions took 23 parameters and closures 19; both take 24 (5.2.2, 3.15.1).
+21. fixed: `return e;` in a `void` function with `typecheck` off returned `e`; the value is dropped and the function yields 0 (4.8.3).
+22. fixed: `case member():` on a tagged member with fields was rejected; it matches by tag (4.7.3).
+23. fixed: `INT_MIN / -1` gave 0 and `INT_MIN % -1` gave INT_MIN in programs compiled by zc0 (software division, `rt.zdiv`); they give INT_MIN and 0 (3.4.3).
 
 ## appendix c: how this spec was checked
 
-- 
cgit v1.2.3


From 4a96db860c95ed6ea8a03cb24c54ebfb9325ada8 Mon Sep 17 00:00:00 2001
From: zinc <zinc@downsta.ir>
Date: Wed, 14 Oct 2026 16:47:08 +0330
Subject: globals: an integer constant initializing a float or f32 global
 converts to float (float g = 2; is 2.0)

---
 docs/SPEC.md                                              | 2 +-
 src/compiler/decl.zc                                      | 3 ++-
 tests/conformance/5-declarations/global_float_int_init.zc | 9 +++++++++
 3 files changed, 12 insertions(+), 2 deletions(-)
 create mode 100644 tests/conformance/5-declarations/global_float_int_init.zc

(limited to 'docs')

diff --git a/docs/SPEC.md b/docs/SPEC.md
index 3eda4f3..f53c469 100644
--- a/docs/SPEC.md
+++ b/docs/SPEC.md
@@ -703,7 +703,7 @@ a bare `name(params) { ... }` with no `fn` and no type is not a function declara
 
 5.3.1 `T a = e, b, c[10];`, `let g = 1, buf[10];`, `int[10] buf;`, `point origin;`. storage is emitted in place, zero initialised.
 
-5.3.2 an initializer is: a constant expression (3.14), a word string, a byte string, or a brace list or compound literal for an array. anything else is an error: for `int a = f();` error: expected ';', found '('. a `float`, `f64` or `f32` global takes a float literal initializer (`float g = 1.5;`). a name of another global in the initializer evaluates to its address, not its value: `int a = 5; int b = a + 1;` gives `b` the value `&a + 1`.
+5.3.2 an initializer is: a constant expression (3.14), a word string, a byte string, or a brace list or compound literal for an array. anything else is an error: for `int a = f();` error: expected ';', found '('. a `float`, `f64` or `f32` global takes a float literal initializer (`float g = 1.5;`); an integer constant initializer converts to float (`float g = 2;` stores 2.0), as it does for a local. a name of another global in the initializer evaluates to its address, not its value: `int a = 5; int b = a + 1;` gives `b` the value `&a + 1`.
 
 5.3.3 a global cannot be tagged (error: tags go on locals and parameters, not globals), cannot be `void`, and an array global needs a length or an initializer.
 
diff --git a/src/compiler/decl.zc b/src/compiler/decl.zc
index 371e8e8..e9500c4 100644
--- a/src/compiler/decl.zc
+++ b/src/compiler/decl.zc
@@ -484,7 +484,8 @@ int gdecl2(int t, int tg, int n) {
 					vv = tv; next(); if (t == tf32) vv = rt.zs2f(rt.zf2s(vv)); *(a + hdelta) = vv;	// an f32 scalar is a rounded double
 				}
 				else {
-					vv = cnorm(t, cexpr()); *(a + hdelta) = vv;
+					vv = cnorm(t, cexpr()); if (t && isfl(t)) { vv = vf_i2f(vv); if (t == tf32) vv = rt.zs2f(rt.zf2s(vv)); }	// float g = 2; is 2.0
+					*(a + hdelta) = vv;
 					if (gok) { if (!gty) gty = tint; else if (gty != tint) gok = 0; }
 				}
 			} else if (gok) gok = 0;	// no initializer: nothing says what it is
diff --git a/tests/conformance/5-declarations/global_float_int_init.zc b/tests/conformance/5-declarations/global_float_int_init.zc
new file mode 100644
index 0000000..ac0e187
--- /dev/null
+++ b/tests/conformance/5-declarations/global_float_int_init.zc
@@ -0,0 +1,9 @@
+// expect: 1/1/1/1/1/
+// spec 5.3.2: an integer constant initializing a float or f32 converts to float, for globals and locals
+include rt;
+void pn(int x) { rt.put_n(x); rt.put_c(10); }
+float g = 2;
+f32 h = 1 + 2;
+float n = -4;
+fn main() { float l = 2; f32 m = 3; pn(g == 2.0); pn(h == 3.0); pn(n == -4.0); pn(l == 2.0); pn(m == 3.0); return 0; }
+// zc0: skip
-- 
cgit v1.2.3


From 37faa46eff8210365b144ccb4758dc3967b68b48 Mon Sep 17 00:00:00 2001
From: zinc <zinc@downsta.ir>
Date: Wed, 14 Oct 2026 16:48:18 +0330
Subject: enum: a member is defined as soon as it is declared, so later values
 can name it (appendix b.2.2)

---
 docs/SPEC.md                                       | 4 ++--
 src/compiler/builtins.zc                           | 8 ++++++--
 src/compiler/expr.zc                               | 4 ++++
 tests/conformance/2-types/enum_names_own_member.zc | 8 ++++++--
 tests/conformance/known.txt                        | 1 -
 5 files changed, 18 insertions(+), 7 deletions(-)

(limited to 'docs')

diff --git a/docs/SPEC.md b/docs/SPEC.md
index f53c469..5f84acc 100644
--- a/docs/SPEC.md
+++ b/docs/SPEC.md
@@ -227,7 +227,7 @@ a struct cannot contain itself by value (error: a struct can't contain itself by
 
 ### 2.8 enums
 
-2.8.1 plain enum. `enum color { RED, GREEN = 5, BLUE };` declares the global constants `RED` 0, `GREEN` 5, `BLUE` 6, also reachable as `color.RED` in expressions and case labels. a member without a value is the previous value plus one, starting at 0. the name is optional (`enum { A, B };`). values are constant expressions (3.14). a member's value cannot name an earlier member of the same enum (the members are defined when the closing brace is reached; error: expected a constant). under `typecheck on;` the enum is a distinct type (2.9).
+2.8.1 plain enum. `enum color { RED, GREEN = 5, BLUE };` declares the global constants `RED` 0, `GREEN` 5, `BLUE` 6, also reachable as `color.RED` in expressions and case labels. a member without a value is the previous value plus one, starting at 0. the name is optional (`enum { A, B };`). values are constant expressions (3.14). a member is defined as soon as it is declared, so a later member's value can name it: `enum { HI = 16, LO = HI + 1 };` gives `LO` 17. under `typecheck on;` the enum is a distinct type (2.9).
 
 2.8.2 tagged enum. when any member has a `{ fields }` block the enum is tagged: `enum shape { circle { int r; }, rect { int w; int h; }, dot };`. rules:
 - it needs a name; payload fields are `int`, `float` or `let` (a word), at most 8 per member; at most 63 members; members take no explicit values.
@@ -1105,7 +1105,7 @@ each item gives a minimal program, the expected behavior (per this spec) and the
 ### b.2 implementation bugs and limitations
 
 1. fixed: `memdebug scrub;` is accepted and poisons freed payloads with 57005 (b.1.1).
-2. enum members cannot name earlier members of the same enum: `enum { HI = 16, LO = HI + 1 };` => `expected a constant` (the members are defined after the closing brace). members of an earlier enum and constants work.
+2. fixed (2.8.1): enum members could not name earlier members of the same enum: `enum { HI = 16, LO = HI + 1 };` => `expected a constant` (the members are defined after the closing brace). members of an earlier enum and constants work.
 3. fixed (now error: f: is defined twice): a function could be silently redefined. `int f() { return 1; } int g() { return f() + 10; } int f() { return 2; }`, then `g()` gives 11 and a later call of `f()` gives 2. expected: error `f: is defined twice` (the message exists in the compiler and is unreachable for an ordinary second definition).
 4. fixed (the definition stays): a prototype after the definition hid it. `int f() { return 1; } int f();` then `f()` => `zc: line 0: f is used but never defined`. expected: the definition stays.
 5. fixed (3.5.5): `?:` with one float branch and one integer branch converted wrongly. `pf(1 ? 1 : 2.5)` prints `0.000000` (the integer 1's bits read as a float); `pf(1 ? 2.5 : 1)` prints `4612811918334230528.000000` (the taken float converted again as if an integer); `pf(0 ? 2.5 : 1)` prints 1.000000 and `pf(0 ? 1 : 2.5)` 2.500000 (these two are right). expected 1.0, 2.5, 1.0, 2.5.
diff --git a/src/compiler/builtins.zc b/src/compiler/builtins.zc
index 214d493..6dc586a 100644
--- a/src/compiler/builtins.zc
+++ b/src/compiler/builtins.zc
@@ -71,8 +71,10 @@ int ptagged(word t) {
 // enum name { A, B = 5 } is a plain enum: each member is a constant, plain (A)
 // and scoped (name.A). a member with a block of fields makes it a tagged enum
 // (see enum_tagged): enum name { circle { int r; }, dot }.
+// the first member of the enum being read, so a member's value can name the members before it; -1 outside
+int enum_open = 0 - 1;
 int kw_enum() {
-	char* n; char* en = 0; int first = npm, cnt = 0, tagged = 0, gi, nf, v = 0, et = 0, sk, ft; char* fname;
+	char* n; char* en = 0; int first = npm, cnt = 0, tagged = 0, gi, nf, v = 0, et = 0, sk, ft, rv = 0; char* fname;
 	stmtonly();
 	next();
 	if (tk == T_ID) { en = tv; next(); }
@@ -97,7 +99,9 @@ int kw_enum() {
 				expect(s_semi);
 			}
 			expect(s_rb);
-		} else if (accept(s_eq)) { pm_val[gi] = cexpr(); pm_exp[gi] = 1; }
+		} else { enum_open = first; if (accept(s_eq)) { pm_val[gi] = cexpr(); pm_exp[gi] = 1; } enum_open = 0 - 1; }
+		if (pm_exp[gi]) rv = pm_val[gi]; else if (!pm_nf[gi]) pm_val[gi] = rv;	// the running value, read by cprim
+		rv++;
 		cnt++;
 		if (!accept(s_comma)) break;
 		if (is_op(s_rb)) break;
diff --git a/src/compiler/expr.zc b/src/compiler/expr.zc
index 230a2d3..e449508 100644
--- a/src/compiler/expr.zc
+++ b/src/compiler/expr.zc
@@ -1959,6 +1959,10 @@ word cprim() {
 			}
 		}
 	}
+	if (tk == T_ID && enum_open >= 0) {	// an earlier member of the enum being read (spec 2.8.1)
+		mc = npm - 1;
+		while (mc > enum_open) { mc--; if (pm_name[mc] == tv && !pm_nf[mc]) { next(); return pm_val[mc]; } }
+	}
 	die("expected a constant");
 	return 0;
 }
diff --git a/tests/conformance/2-types/enum_names_own_member.zc b/tests/conformance/2-types/enum_names_own_member.zc
index 26d4739..1a49106 100644
--- a/tests/conformance/2-types/enum_names_own_member.zc
+++ b/tests/conformance/2-types/enum_names_own_member.zc
@@ -1,4 +1,8 @@
-// expect error: expected a constant
+// expect: 17/3/6/
+// spec 2.8.1: a member is defined as soon as it is declared; a later value can name it
 include rt;
+void pn(int x) { rt.put_n(x); rt.put_c(10); }
 enum e { HI = 16, LO = HI + 1 };
-fn main() { return 0; }
+enum f { A, B, C, D = C + 1, E = D * 2 };
+fn main() { pn(LO); pn(D); pn(E); return 0; }
+// zc0: skip
diff --git a/tests/conformance/known.txt b/tests/conformance/known.txt
index 22a1e3d..723098a 100644
--- a/tests/conformance/known.txt
+++ b/tests/conformance/known.txt
@@ -2,7 +2,6 @@
 # class a: self-hosted compiler bug; b: zc0 deviation (appendix a/b); c: spec issue to settle
 # appendix b.2.8 (a global named in an initializer is its address) is documented behavior per 5.3.2 and 3.14.2: no entry
 4-statements/o3_outside_function_ordinary_block.zc zy c top-level o3 { } is rejected; spec 4.10.2 says it is an ordinary block
-5-declarations/enum_member_names_earlier_b2.zc zy c appendix b.2.2 confirmed, but spec 2.8.1 documents it (members are defined at the closing brace); not fixed, like b.2.8 the spec body wins until decided
 5-declarations/fn_prototype_unnamed_params_b13.zc zy c spec 5.2.1 says prototype parameter names are required, and a type name alone is read as an untyped parameter of that name (paramstart); b.2.13 is a spec choice, not fixed
 9-appendix-b/b2_06_bool_normalises.zc zy c appendix b.2.6 confirmed, but spec 2.1 documents bool as a number that is not normalised
 9-appendix-b/b2_10_recovery_hides_errors.zc zy c appendix b.2.10 confirmed; by design per 8.2
-- 
cgit v1.2.3


From aadfdb87fdb42b42434358e643da8c98dd4647b2 Mon Sep 17 00:00:00 2001
From: zinc <zinc@downsta.ir>
Date: Wed, 14 Oct 2026 16:49:25 +0330
Subject: bool: a value stored into a bool is normalised to 0 or 1 (appendix
 b.2.6)

---
 docs/SPEC.md                                                | 4 ++--
 src/compiler/lex.zc                                         | 5 +++++
 tests/conformance/2-types/bool_normalises.zc                | 7 +++++++
 tests/conformance/2-types/typecheck_number_kinds_convert.zc | 3 ++-
 tests/conformance/known.txt                                 | 1 -
 5 files changed, 16 insertions(+), 4 deletions(-)
 create mode 100644 tests/conformance/2-types/bool_normalises.zc

(limited to 'docs')

diff --git a/docs/SPEC.md b/docs/SPEC.md
index 5f84acc..529b5bf 100644
--- a/docs/SPEC.md
+++ b/docs/SPEC.md
@@ -132,7 +132,7 @@ zc is untyped by default. an untyped name has type `word`, which is compatible w
 | `word` | 1 | the untyped type, compatible with everything |
 | `int` | 1 | 64-bit signed two's complement |
 | `char` | 1 | a full word, treated as a number; `char[n]` takes n words |
-| `bool` | 1 | a number; values are not normalised to 0 or 1 on store (appendix b) |
+| `bool` | 1 | 0 or 1: a value stored into a bool (initializer, assignment, argument, return) becomes 1 when it is nonzero, a float when it is not 0.0 |
 | `void` | 0 | function result only; a variable cannot be void |
 | `float`, `f64` | 1 | ieee binary64 |
 | `f32` | 1 | single precision: a variable holds the value already rounded to float; arrays and pointers of `f32` are packed two per word |
@@ -1109,7 +1109,7 @@ each item gives a minimal program, the expected behavior (per this spec) and the
 3. fixed (now error: f: is defined twice): a function could be silently redefined. `int f() { return 1; } int g() { return f() + 10; } int f() { return 2; }`, then `g()` gives 11 and a later call of `f()` gives 2. expected: error `f: is defined twice` (the message exists in the compiler and is unreachable for an ordinary second definition).
 4. fixed (the definition stays): a prototype after the definition hid it. `int f() { return 1; } int f();` then `f()` => `zc: line 0: f is used but never defined`. expected: the definition stays.
 5. fixed (3.5.5): `?:` with one float branch and one integer branch converted wrongly. `pf(1 ? 1 : 2.5)` prints `0.000000` (the integer 1's bits read as a float); `pf(1 ? 2.5 : 1)` prints `4612811918334230528.000000` (the taken float converted again as if an integer); `pf(0 ? 2.5 : 1)` prints 1.000000 and `pf(0 ? 1 : 2.5)` 2.500000 (these two are right). expected 1.0, 2.5, 1.0, 2.5.
-6. `bool` does not normalise: `bool b = 5; rt.put_n(b); rt.put_n(b == 1); rt.put_n(!b);` prints 5, 0, 0. expected 1, 1, 0 if `bool` is a 0/1 type; it behaves as a plain integer.
+6. fixed (2.1): `bool` did not normalise: `bool b = 5; rt.put_n(b); rt.put_n(b == 1); rt.put_n(!b);` prints 5, 0, 0. expected 1, 1, 0 if `bool` is a 0/1 type; it behaves as a plain integer.
 7. fixed (5.3.2): a float literal as a global initializer (`float g = 1.5;`) was rejected.
 8. not a bug: a global initializer that names another global uses the other global's address (5.3.2, 3.14.2): `int a = 5; int b = a + 1;` gives `b` the value `&a + 1`.
 9. fixed (5.12.7): `include std;` inside a function body gave `return outside a function`; it is now error: include is top level only.
diff --git a/src/compiler/lex.zc b/src/compiler/lex.zc
index 0348cae..d06b81b 100644
--- a/src/compiler/lex.zc
+++ b/src/compiler/lex.zc
@@ -298,6 +298,11 @@ int fcoerce(word dst) {
 		if (dst == tf32 && xty != tf32 && !ispk(xty)) { xenh("zf2s"); xenh("zs2f"); xty = tf32; }
 		return 0;
 	}
+	if (dst[0] == TY_BOOL && xty[0] != TY_BOOL) {	// bool holds 0 or 1: any nonzero value is 1 (spec 2.1)
+		if (xfloat) { op(OP_FLIT); emit(0); op(OP_FEQ); lit(1); op(18); xfloat = 0; }
+		else { lit(0); op(O_PICK); lit(0); op(O_SWAP); op(O_SUB); op(17); lit(63); op(19); lit(0); op(O_SWAP); op(O_SUB); }
+		xty = tbool; return 0;
+	}
 	if (!xfloat) {
 		if (tbytes(dst) && !samesz(dst, xty)) tnorm(dst);
 		return 0;
diff --git a/tests/conformance/2-types/bool_normalises.zc b/tests/conformance/2-types/bool_normalises.zc
new file mode 100644
index 0000000..c734fc5
--- /dev/null
+++ b/tests/conformance/2-types/bool_normalises.zc
@@ -0,0 +1,7 @@
+// expect: 1/1/0/1/0/1/1/
+// spec 2.1: a value stored in a bool is 0 or 1; any nonzero value becomes 1
+include rt;
+void pn(int x) { rt.put_n(x); rt.put_c(10); }
+bool id(bool x) { return x; }
+fn main() { bool b = 5; pn(b); pn(b == 1); pn(!b); b = -7; pn(b); b = 0; pn(b); pn(id(42)); bool f = 0.5; pn(f); return 0; }
+// zc0: skip
diff --git a/tests/conformance/2-types/typecheck_number_kinds_convert.zc b/tests/conformance/2-types/typecheck_number_kinds_convert.zc
index 9c3d76e..f41b42d 100644
--- a/tests/conformance/2-types/typecheck_number_kinds_convert.zc
+++ b/tests/conformance/2-types/typecheck_number_kinds_convert.zc
@@ -1,4 +1,5 @@
-// expect: 44/
+// expect: 1/
+// spec 2.1, 2.9: numbers convert freely; the bool normalises 44 to 1
 include rt;
 typecheck on;
 void pn(int x) { rt.put_n(x); rt.put_c(10); }
diff --git a/tests/conformance/known.txt b/tests/conformance/known.txt
index 723098a..8550c07 100644
--- a/tests/conformance/known.txt
+++ b/tests/conformance/known.txt
@@ -3,7 +3,6 @@
 # appendix b.2.8 (a global named in an initializer is its address) is documented behavior per 5.3.2 and 3.14.2: no entry
 4-statements/o3_outside_function_ordinary_block.zc zy c top-level o3 { } is rejected; spec 4.10.2 says it is an ordinary block
 5-declarations/fn_prototype_unnamed_params_b13.zc zy c spec 5.2.1 says prototype parameter names are required, and a type name alone is read as an untyped parameter of that name (paramstart); b.2.13 is a spec choice, not fixed
-9-appendix-b/b2_06_bool_normalises.zc zy c appendix b.2.6 confirmed, but spec 2.1 documents bool as a number that is not normalised
 9-appendix-b/b2_10_recovery_hides_errors.zc zy c appendix b.2.10 confirmed; by design per 8.2
 9-appendix-b/b2_11_unterminated_comment.zc zy c appendix b.2.11 confirmed, but spec 1.2.2 says an unclosed block comment is not an error
 9-appendix-b/b2_12_as_int_star.zc zy c appendix b.2.12 confirmed, but spec 3.2.3 documents it (parenthesise)
-- 
cgit v1.2.3


From ccbc77c2d3fa348d0de6f32fc540468401e6880b Mon Sep 17 00:00:00 2001
From: zinc <zinc@downsta.ir>
Date: Wed, 14 Oct 2026 16:50:41 +0330
Subject: lexer: a block comment that is never closed is 'unterminated comment'
 (appendix b.2.11)

---
 docs/SPEC.md                                                 | 4 ++--
 src/compiler/lex.zc                                          | 2 ++
 tests/conformance/1-source/comment_block_unclosed.zc         | 3 ++-
 tests/conformance/9-appendix-b/b2_11_unterminated_comment.zc | 2 +-
 tests/conformance/known.txt                                  | 1 -
 tests/langerrors/unterminated_comment_docs.zc                | 4 ++++
 6 files changed, 11 insertions(+), 5 deletions(-)
 create mode 100644 tests/langerrors/unterminated_comment_docs.zc

(limited to 'docs')

diff --git a/docs/SPEC.md b/docs/SPEC.md
index 529b5bf..cc94451 100644
--- a/docs/SPEC.md
+++ b/docs/SPEC.md
@@ -24,7 +24,7 @@ this is the reference for the zc language. it is written from `src/compiler/comp
 
 1.2.1 `//` starts a comment that runs to the end of the line.
 
-1.2.2 `/* ... */` is a block comment. block comments do not nest. a block comment that is never closed runs to the end of the unit and is not an error.
+1.2.2 `/* ... */` is a block comment. block comments do not nest. a block comment that is never closed is error: unterminated comment.
 
 1.2.3 comments are not tokens, but `docs on;` (5.14) and `hints` (4.12) read them: `//` lines directly above a declaration document it, and `//:` lines are implementation notes that document nothing. an inline block comment right before a numeric literal marks the literal as intentional for the magic-number hint. neither changes the generated code.
 
@@ -1114,7 +1114,7 @@ each item gives a minimal program, the expected behavior (per this spec) and the
 8. not a bug: a global initializer that names another global uses the other global's address (5.3.2, 3.14.2): `int a = 5; int b = a + 1;` gives `b` the value `&a + 1`.
 9. fixed (5.12.7): `include std;` inside a function body gave `return outside a function`; it is now error: include is top level only.
 10. a syntax error hides errors in the statements skipped by recovery: `int a = ; int b = 3 +;` reports only the first error (8.2). by design, but easy to miss.
-11. an unterminated `/* ...` comment is accepted silently (1.2.2); an unterminated string literal is only reported as a later syntax error.
+11. fixed (1.2.2): an unterminated `/* ...` comment was accepted silently; it is error: unterminated comment. (an unterminated string literal is still only reported as a later syntax error.)
 12. `x as int * y` parses `int*` as the type (3.2.3).
 13. prototypes need parameter names: `int f(int);` => `expected a name, found ')'`.
 14. `len(s)` on a `char*` returns word 0 of the string when `typecheck` is off.
diff --git a/src/compiler/lex.zc b/src/compiler/lex.zc
index d06b81b..2763333 100644
--- a/src/compiler/lex.zc
+++ b/src/compiler/lex.zc
@@ -428,6 +428,7 @@ int docblock(int nl) {
 		doc_char(c);
 		if (c == 10) bol = 1;
 	}
+	if (ch < 0) { tline = line; serr("unterminated comment"); }
 	while (dn && (dbuf[dn - 1] == 32 || dbuf[dn - 1] == 9 || dbuf[dn - 1] == 10 || dbuf[dn - 1] == 13)) dn--;
 	doc_char(10); dlast = cl; docpending = 1;
 	if (adj) dn = 0;
@@ -489,6 +490,7 @@ int lex1() {
 			if (docs_on) { docblock(nl); tglue = 0; continue; }
 			nextch();
 			while (ch >= 0) { if (ch == '*') { nextch(); if (ch == '/') break; } else nextch(); }
+			if (ch < 0) { tline = line; serr("unterminated comment"); }	// a /* with no */ (spec 1.2.2)
 			nextch(); tglue = 0; continue;
 		}
 		tline = line; toff = cpos() - 1; tbuf[0] = '/'; oplex(1); return 0;
diff --git a/tests/conformance/1-source/comment_block_unclosed.zc b/tests/conformance/1-source/comment_block_unclosed.zc
index 4ae34e7..cb410f9 100644
--- a/tests/conformance/1-source/comment_block_unclosed.zc
+++ b/tests/conformance/1-source/comment_block_unclosed.zc
@@ -1,4 +1,5 @@
-// expect: 4/
+// expect error: unterminated comment
+// spec 1.2.2: a block comment that is never closed is an error
 include rt;
 fn main() { rt.put_n(4); rt.put_c(10); return 0; }
 /* never closed: rt.put_n(9);
diff --git a/tests/conformance/9-appendix-b/b2_11_unterminated_comment.zc b/tests/conformance/9-appendix-b/b2_11_unterminated_comment.zc
index e6e6bbf..ce4b236 100644
--- a/tests/conformance/9-appendix-b/b2_11_unterminated_comment.zc
+++ b/tests/conformance/9-appendix-b/b2_11_unterminated_comment.zc
@@ -1,4 +1,4 @@
-// expect error: unterminated
+// expect error: unterminated comment
 // spec appendix b.2.11: an unterminated /* is accepted silently
 include rt;
 void pn(int x) { rt.put_n(x); rt.put_c(10); }
diff --git a/tests/conformance/known.txt b/tests/conformance/known.txt
index 8550c07..f666106 100644
--- a/tests/conformance/known.txt
+++ b/tests/conformance/known.txt
@@ -4,7 +4,6 @@
 4-statements/o3_outside_function_ordinary_block.zc zy c top-level o3 { } is rejected; spec 4.10.2 says it is an ordinary block
 5-declarations/fn_prototype_unnamed_params_b13.zc zy c spec 5.2.1 says prototype parameter names are required, and a type name alone is read as an untyped parameter of that name (paramstart); b.2.13 is a spec choice, not fixed
 9-appendix-b/b2_10_recovery_hides_errors.zc zy c appendix b.2.10 confirmed; by design per 8.2
-9-appendix-b/b2_11_unterminated_comment.zc zy c appendix b.2.11 confirmed, but spec 1.2.2 says an unclosed block comment is not an error
 9-appendix-b/b2_12_as_int_star.zc zy c appendix b.2.12 confirmed, but spec 3.2.3 documents it (parenthesise)
 9-appendix-b/b2_14_len_char_ptr_typecheck_off.zc zy c appendix b.2.14 confirmed, but spec 3.13.5 leaves it unspecified
 9-appendix-b/b2_15_duplicate_case.zc zy c appendix b.2.15 confirmed; 4.7.2 says duplicates are allowed
diff --git a/tests/langerrors/unterminated_comment_docs.zc b/tests/langerrors/unterminated_comment_docs.zc
new file mode 100644
index 0000000..02f4335
--- /dev/null
+++ b/tests/langerrors/unterminated_comment_docs.zc
@@ -0,0 +1,4 @@
+// expect: unterminated comment
+docs on;
+fn main() { return 0; }
+/* never closed, with docs on
-- 
cgit v1.2.3


From 82f8b735f966be69f9892350fb0a719f3fc436f1 Mon Sep 17 00:00:00 2001
From: zinc <zinc@downsta.ir>
Date: Wed, 14 Oct 2026 16:51:03 +0330
Subject: as: the type after as is read greedily in both compilers; x as int *
 y is a syntax error (appendix b.2.12 settled, no compiler change)

---
 docs/SPEC.md                                                        | 4 ++--
 .../3-expressions/cast_as_then_multiply_parenthesised.zc            | 5 +++++
 tests/conformance/9-appendix-b/b2_12_as_int_star.zc                 | 6 +++---
 tests/conformance/known.txt                                         | 1 -
 4 files changed, 10 insertions(+), 6 deletions(-)
 create mode 100644 tests/conformance/3-expressions/cast_as_then_multiply_parenthesised.zc

(limited to 'docs')

diff --git a/docs/SPEC.md b/docs/SPEC.md
index cc94451..30d547d 100644
--- a/docs/SPEC.md
+++ b/docs/SPEC.md
@@ -361,7 +361,7 @@ a = b = 7                        // assigns both, value 7
 ```
 `&&` and `||` are lower than `|`. this matches c.
 
-3.2.3 `as` is a postfix operator: it applies to the operand to its left and binds tighter than every binary operator, so `a + b as T` is `a + (b as T)`. a type after `as` takes following stars: `x as int * y` parses `int*` then fails. parenthesise.
+3.2.3 `as` is a postfix operator: it applies to the operand to its left and binds tighter than every binary operator, so `a + b as T` is `a + (b as T)`. the type after `as` is read greedily, stars included (`x as char**`), in both compilers: `x as int * y` reads `int*` and then is a syntax error; write `(x as int) * y`.
 
 3.2.4 the condition of `?:` is a `binary` expression (so `a = b ? c : d` is `a = (b ? c : d)`), the middle operand and the last operand are full `expr` (assignments allowed). `a ? b : c = 5` therefore parses as `a ? b : (c = 5)`: with `a` 1 the assignment does not run.
 
@@ -1115,7 +1115,7 @@ each item gives a minimal program, the expected behavior (per this spec) and the
 9. fixed (5.12.7): `include std;` inside a function body gave `return outside a function`; it is now error: include is top level only.
 10. a syntax error hides errors in the statements skipped by recovery: `int a = ; int b = 3 +;` reports only the first error (8.2). by design, but easy to miss.
 11. fixed (1.2.2): an unterminated `/* ...` comment was accepted silently; it is error: unterminated comment. (an unterminated string literal is still only reported as a later syntax error.)
-12. `x as int * y` parses `int*` as the type (3.2.3).
+12. settled (3.2.3): `x as int * y` parses `int*` as the type. this is the rule (the type is read greedily, as zc0 does too), so the program is a syntax error.
 13. prototypes need parameter names: `int f(int);` => `expected a name, found ')'`.
 14. `len(s)` on a `char*` returns word 0 of the string when `typecheck` is off.
 15. duplicate `case` labels are not diagnosed (4.7.2).
diff --git a/tests/conformance/3-expressions/cast_as_then_multiply_parenthesised.zc b/tests/conformance/3-expressions/cast_as_then_multiply_parenthesised.zc
new file mode 100644
index 0000000..ab11217
--- /dev/null
+++ b/tests/conformance/3-expressions/cast_as_then_multiply_parenthesised.zc
@@ -0,0 +1,5 @@
+// expect: 6/
+// spec 3.2.3: (x as int) * y multiplies
+include rt;
+void pn(int x) { rt.put_n(x); rt.put_c(10); }
+fn main() { int x = 2; int y = 3; pn((x as int) * y); return 0; }
diff --git a/tests/conformance/9-appendix-b/b2_12_as_int_star.zc b/tests/conformance/9-appendix-b/b2_12_as_int_star.zc
index fc12792..da54802 100644
--- a/tests/conformance/9-appendix-b/b2_12_as_int_star.zc
+++ b/tests/conformance/9-appendix-b/b2_12_as_int_star.zc
@@ -1,6 +1,6 @@
-// expect: 6/
-// spec appendix b.2.12: x as int * y should multiply
+// expect error: expected ')', found 'y'
+// spec 3.2.3 and appendix b.2.12: the type after as is read greedily, so x as int * y reads int* and then fails; write (x as int) * y
 include rt;
 void pn(int x) { rt.put_n(x); rt.put_c(10); }
 fn main() { int x = 2; int y = 3; pn(x as int * y); return 0; }
-// zc0: skip
+// zc0: error
diff --git a/tests/conformance/known.txt b/tests/conformance/known.txt
index f666106..7cb703e 100644
--- a/tests/conformance/known.txt
+++ b/tests/conformance/known.txt
@@ -4,7 +4,6 @@
 4-statements/o3_outside_function_ordinary_block.zc zy c top-level o3 { } is rejected; spec 4.10.2 says it is an ordinary block
 5-declarations/fn_prototype_unnamed_params_b13.zc zy c spec 5.2.1 says prototype parameter names are required, and a type name alone is read as an untyped parameter of that name (paramstart); b.2.13 is a spec choice, not fixed
 9-appendix-b/b2_10_recovery_hides_errors.zc zy c appendix b.2.10 confirmed; by design per 8.2
-9-appendix-b/b2_12_as_int_star.zc zy c appendix b.2.12 confirmed, but spec 3.2.3 documents it (parenthesise)
 9-appendix-b/b2_14_len_char_ptr_typecheck_off.zc zy c appendix b.2.14 confirmed, but spec 3.13.5 leaves it unspecified
 9-appendix-b/b2_15_duplicate_case.zc zy c appendix b.2.15 confirmed; 4.7.2 says duplicates are allowed
 9-appendix-b/b2_16_local_const_in_const_expr.zc zy c appendix b.2.16 confirmed; 3.14.2 documents it
-- 
cgit v1.2.3


From 77d2f8a44e2503796a7ef5c170e11811a4f7fcfd Mon Sep 17 00:00:00 2001
From: zinc <zinc@downsta.ir>
Date: Wed, 14 Oct 2026 16:58:59 +0330
Subject: prototypes: parameters may be unnamed, int f(int, int*); (appendix
 b.2.13)

---
 docs/SPEC.md                                                |  4 ++--
 src/compiler/decl.zc                                        | 13 +++++++++++--
 .../5-declarations/fn_prototype_unnamed_pointer_params.zc   |  8 ++++++++
 tests/conformance/known.txt                                 |  1 -
 tests/langerrors/param_unnamed_with_body.zc                 |  3 +++
 5 files changed, 24 insertions(+), 5 deletions(-)
 create mode 100644 tests/conformance/5-declarations/fn_prototype_unnamed_pointer_params.zc
 create mode 100644 tests/langerrors/param_unnamed_with_body.zc

(limited to 'docs')

diff --git a/docs/SPEC.md b/docs/SPEC.md
index 30d547d..128f961 100644
--- a/docs/SPEC.md
+++ b/docs/SPEC.md
@@ -683,7 +683,7 @@ node*.u make() { ... }               // owned result (.u)
 fn f(a, b) { ... }                   // untyped; types are inferred
 fn f(int a, b) { ... }               // parameters may mix
 T first<T>(T* p) { ... }             // generic
-int proto(int n);                    // prototype (parameter names are required)
+int proto(int n);                    // prototype (int proto(int); also works: a prototype's parameter names are optional)
 ```
 a bare `name(params) { ... }` with no `fn` and no type is not a function declaration (error: expected a declaration).
 
@@ -1116,7 +1116,7 @@ each item gives a minimal program, the expected behavior (per this spec) and the
 10. a syntax error hides errors in the statements skipped by recovery: `int a = ; int b = 3 +;` reports only the first error (8.2). by design, but easy to miss.
 11. fixed (1.2.2): an unterminated `/* ...` comment was accepted silently; it is error: unterminated comment. (an unterminated string literal is still only reported as a later syntax error.)
 12. settled (3.2.3): `x as int * y` parses `int*` as the type. this is the rule (the type is read greedily, as zc0 does too), so the program is a syntax error.
-13. prototypes need parameter names: `int f(int);` => `expected a name, found ')'`.
+13. fixed (5.2.1): a prototype's parameters may be unnamed (`int f(int, int*);`). a lone type name counts as a type only in a prototype; with a body it is still the parameter's name, and an unnamed typed parameter there is `a parameter needs a name`.
 14. `len(s)` on a `char*` returns word 0 of the string when `typecheck` is off.
 15. duplicate `case` labels are not diagnosed (4.7.2).
 16. a local `const` cannot be used in a constant expression (b.1.7).
diff --git a/src/compiler/decl.zc b/src/compiler/decl.zc
index e9500c4..87281ad 100644
--- a/src/compiler/decl.zc
+++ b/src/compiler/decl.zc
@@ -282,7 +282,7 @@ int body() {
 // into stype, checked against any earlier prototype or prescan result, and
 // where the o3 region for an o3 function is handed to the core)
 int fndef(int chk, int rty, int ret, int n) {
-	int s, np = 0, tags = 0, t, sig, i; char*[24] pn; word[24] pt; word[24] pty; int typed = 0, ft, explicit_rty = !!rty, o3f = o3nxt, lo, hi, pk, lt, lend, lfl = tline, redef;
+	int s, np = 0, tags = 0, t, sig, i; char*[24] pn; word[24] pt; word[24] pty; int typed = 0, ft, explicit_rty = !!rty, o3f = o3nxt, lo, hi, pk, lt, lend, lfl = tline, redef, amb = 0, nonm = 0;
 	o3nxt = 0;
 	if (rty || ntp) typed = 1;
 	if (!dnm) dnm = n;
@@ -327,7 +327,9 @@ int fndef(int chk, int rty, int ret, int n) {
 				} else if (tv == s_d) t = 2; else die("a parameter tag is .m or .d");
 				next();
 			}
-			pnoffs[np] = toff; pnplaces[np] = tpack(); rs_note(RS_PARAM, toff); pn[np] = name();
+			pnoffs[np] = toff; pnplaces[np] = tpack(); rs_note(RS_PARAM, toff);
+			if (!pk && !t && tk == T_ID && istypename(tv)) amb = amb | (1 << np);	// int f(int): a name, or a type if this is a prototype
+			if (pk && tk == T_OP && (tv == s_comma || tv == s_rp)) { pn[np] = 0; nonm = 1; } else pn[np] = name();	// int f(int*, int): a prototype's parameters may be unnamed
 			if (o3f && pty[np] == tword) serr("o3 parameters need a type");
 			if (np >= 12 && t) die("only the first 12 parameters can be tagged");
 			pt[np] = t;
@@ -338,6 +340,13 @@ int fndef(int chk, int rty, int ret, int n) {
 		}
 	}
 	expect(s_rp);
+	if (is_op(s_semi)) {	// a prototype: a lone type name is an unnamed parameter of that type (b.2.13)
+		i = 0;
+		while (i < np) {
+			if (((amb >> i) & 1) && pn[i]) { t = lookup(pn[i]); if (t >= 0 && skind[t] == K_TYPE) { pty[i] = sval[t]; typed = 1; } }
+			i++;
+		}
+	} else if (nonm) serr("a parameter needs a name");
 	sig = ret + np + np + tags * 64;
 	if ((sflag[s] & F_SIG) && !(sflag[s] & F_PRE)) {
 		if (ssig[s] != sig) serrn(n, "doesn't match its earlier declaration");
diff --git a/tests/conformance/5-declarations/fn_prototype_unnamed_pointer_params.zc b/tests/conformance/5-declarations/fn_prototype_unnamed_pointer_params.zc
new file mode 100644
index 0000000..7136bee
--- /dev/null
+++ b/tests/conformance/5-declarations/fn_prototype_unnamed_pointer_params.zc
@@ -0,0 +1,8 @@
+// expect: 7/
+// spec 5.2.1: a prototype's parameters may be unnamed, pointers included
+include rt;
+void pn(int x) { rt.put_n(x); rt.put_c(10); }
+int f(int, int*);
+fn main() { int[1] a; a[0] = 5; pn(f(2, a)); return 0; }
+int f(int k, int* p) { return k + p[0]; }
+// zc0: skip
diff --git a/tests/conformance/known.txt b/tests/conformance/known.txt
index 7cb703e..2fbd331 100644
--- a/tests/conformance/known.txt
+++ b/tests/conformance/known.txt
@@ -2,7 +2,6 @@
 # class a: self-hosted compiler bug; b: zc0 deviation (appendix a/b); c: spec issue to settle
 # appendix b.2.8 (a global named in an initializer is its address) is documented behavior per 5.3.2 and 3.14.2: no entry
 4-statements/o3_outside_function_ordinary_block.zc zy c top-level o3 { } is rejected; spec 4.10.2 says it is an ordinary block
-5-declarations/fn_prototype_unnamed_params_b13.zc zy c spec 5.2.1 says prototype parameter names are required, and a type name alone is read as an untyped parameter of that name (paramstart); b.2.13 is a spec choice, not fixed
 9-appendix-b/b2_10_recovery_hides_errors.zc zy c appendix b.2.10 confirmed; by design per 8.2
 9-appendix-b/b2_14_len_char_ptr_typecheck_off.zc zy c appendix b.2.14 confirmed, but spec 3.13.5 leaves it unspecified
 9-appendix-b/b2_15_duplicate_case.zc zy c appendix b.2.15 confirmed; 4.7.2 says duplicates are allowed
diff --git a/tests/langerrors/param_unnamed_with_body.zc b/tests/langerrors/param_unnamed_with_body.zc
new file mode 100644
index 0000000..bf96698
--- /dev/null
+++ b/tests/langerrors/param_unnamed_with_body.zc
@@ -0,0 +1,3 @@
+// expect: a parameter needs a name
+int f(int*) { return 1; }
+fn main() { return 0; }
-- 
cgit v1.2.3


From 6ef2efb750622819a3ba3ae9ee061e512c1266d6 Mon Sep 17 00:00:00 2001
From: zinc <zinc@downsta.ir>
Date: Wed, 14 Oct 2026 17:00:26 +0330
Subject: len: len on a char* is an error with typecheck off too (appendix
 b.2.14)

---
 docs/SPEC.md                                                       | 4 ++--
 src/compiler/builtins.zc                                           | 3 ++-
 tests/conformance/9-appendix-b/b2_14_len_char_ptr_typecheck_off.zc | 4 ++--
 tests/conformance/known.txt                                        | 1 -
 4 files changed, 6 insertions(+), 6 deletions(-)

(limited to 'docs')

diff --git a/docs/SPEC.md b/docs/SPEC.md
index 128f961..dd04cde 100644
--- a/docs/SPEC.md
+++ b/docs/SPEC.md
@@ -490,7 +490,7 @@ pn(pop(a)); pn(a.pop()); pn(a.len()); // 4 3 2
 a[2];                                  // zy: index 2 out of range (length 2)
 ```
 
-3.13.5 the length of a non-array (`len("text")` on a `char*`) is unspecified when `typecheck` is off (it reads word 0) and error: len needs an array under `typecheck on;`. use `rt.len_w` for word strings and `len` for `bstr`.
+3.13.5 `len` on a `char*` is error: len needs an array, not a char* when `typecheck` is off, and error: len needs an array under `typecheck on;`. use `rt.len_w` for word strings and `len` for `bstr`.
 
 ### 3.14 constant expressions
 
@@ -1117,7 +1117,7 @@ each item gives a minimal program, the expected behavior (per this spec) and the
 11. fixed (1.2.2): an unterminated `/* ...` comment was accepted silently; it is error: unterminated comment. (an unterminated string literal is still only reported as a later syntax error.)
 12. settled (3.2.3): `x as int * y` parses `int*` as the type. this is the rule (the type is read greedily, as zc0 does too), so the program is a syntax error.
 13. fixed (5.2.1): a prototype's parameters may be unnamed (`int f(int, int*);`). a lone type name counts as a type only in a prototype; with a body it is still the parameter's name, and an unnamed typed parameter there is `a parameter needs a name`.
-14. `len(s)` on a `char*` returns word 0 of the string when `typecheck` is off.
+14. fixed (3.13.5): `len(s)` on a `char*` used to return word 0 of the string when `typecheck` was off; it is now a compile error.
 15. duplicate `case` labels are not diagnosed (4.7.2).
 16. a local `const` cannot be used in a constant expression (b.1.7).
 17. fixed: a bad float or character literal in a function's first statement was not reported (1.4).
diff --git a/src/compiler/builtins.zc b/src/compiler/builtins.zc
index 6dc586a..cbc380e 100644
--- a/src/compiler/builtins.zc
+++ b/src/compiler/builtins.zc
@@ -706,7 +706,8 @@ int array_len(word t) {
 		return 0;
 	}
 	if (t[0] == TY_ARR) { op(O_DROP); lit(t[3]); }
-	else { tcneed(t[0] == TY_DYN || t == tword, "len needs an array", t); if (argloc >= 0) { op(O_DROP); vaddr(o3cache[argloc] + 1); op(O_LD); } else if (o3on && t[0] == TY_DYN) op(O_LD); else callname(s_dlen); }
+	else { if (!tc_on && t[0] == TY_PTR && t[4][0] == TY_CHAR) serr("len needs an array, not a char* (use rt.len_w, or a bstr)");	// b.2.14: it would read word 0
+		tcneed(t[0] == TY_DYN || t == tword, "len needs an array", t); if (argloc >= 0) { op(O_DROP); vaddr(o3cache[argloc] + 1); op(O_LD); } else if (o3on && t[0] == TY_DYN) op(O_LD); else callname(s_dlen); }
 	xty = tint;
 	xlenloc = -1; xstamp = 0;
 	if (a >= 0 && t[0] == TY_DYN && t[3]) xlenloc = a;	// the whole expression is len of a fixed array
diff --git a/tests/conformance/9-appendix-b/b2_14_len_char_ptr_typecheck_off.zc b/tests/conformance/9-appendix-b/b2_14_len_char_ptr_typecheck_off.zc
index b0d0d45..0953328 100644
--- a/tests/conformance/9-appendix-b/b2_14_len_char_ptr_typecheck_off.zc
+++ b/tests/conformance/9-appendix-b/b2_14_len_char_ptr_typecheck_off.zc
@@ -1,5 +1,5 @@
-// expect: 3/
-// spec appendix b.2.14: len(char*) with typecheck off returns word 0
+// expect error: len needs an array, not a char*
+// spec 3.13.5 and appendix b.2.14: len on a char* is an error with typecheck off too
 include rt;
 void pn(int x) { rt.put_n(x); rt.put_c(10); }
 typecheck off;
diff --git a/tests/conformance/known.txt b/tests/conformance/known.txt
index 2fbd331..8e6ea97 100644
--- a/tests/conformance/known.txt
+++ b/tests/conformance/known.txt
@@ -3,7 +3,6 @@
 # appendix b.2.8 (a global named in an initializer is its address) is documented behavior per 5.3.2 and 3.14.2: no entry
 4-statements/o3_outside_function_ordinary_block.zc zy c top-level o3 { } is rejected; spec 4.10.2 says it is an ordinary block
 9-appendix-b/b2_10_recovery_hides_errors.zc zy c appendix b.2.10 confirmed; by design per 8.2
-9-appendix-b/b2_14_len_char_ptr_typecheck_off.zc zy c appendix b.2.14 confirmed, but spec 3.13.5 leaves it unspecified
 9-appendix-b/b2_15_duplicate_case.zc zy c appendix b.2.15 confirmed; 4.7.2 says duplicates are allowed
 9-appendix-b/b2_16_local_const_in_const_expr.zc zy c appendix b.2.16 confirmed; 3.14.2 documents it
 1-source/ident_tags_as_variables_glued_star.zc zc0 b u*d with visible u and d is read as a recast (no code); zy follows 1.6.3
-- 
cgit v1.2.3