gen-c: a function returning a fixed array returns the address of a stack local #5710

Re-filed from #3445. An attempt claimed that issue on 2026-09-24 and left an empty branch, and a dispatch row that has spent its retry ceiling keeps its issue for good - so no bee could take it again, however much the brief improved. The work below is carried over unchanged.

What

fn probe(v: i32) -> [4]u8 { var a : [4]u8 = [0,0,0,0]; return a; }

uint8_t* probe(int32_t v) {
    uint8_t a[4] = { 0, 0, 0, 0 };
    return a;
}

warning: address of stack memory associated with local variable 'a' returned [-Wreturn-stack-address]

Apple clang 21. The caller receives a pointer into a frame that no longer exists.

Population

18 sites in 14 files, over 582 generated C translation units. Counted by clang, not by a grep.

specs/base/ternary_encoding.t27      specs/github/comments.t27
specs/cloud/railway_deploy.t27       specs/github/issues.t27
specs/compiler/mod_structure.t27     specs/github/prs.t27
specs/config/schema.t27              specs/github/tests/e2e_full_flow.t27
specs/demos/jones/topology_*.t27     specs/memory/formula_embed.t27
                                     specs/server/mdns.t27

The mechanism already exists, and the spelling cannot reach it

The other array spelling works completely:

fn probe(v: i32) -> [u8; 4] { var a : [u8; 4] = [0,0,0,0]; a[0] = 7; return a; }

typedef struct { uint8_t v[4]; } t27_arr_uint8_t_4;
t27_arr_uint8_t_4 probe(int32_t v) {
    t27_arr_uint8_t_4 a = { 0, 0, 0, 0 };
    a.v[0] = 7;
    return a;
}

Zero diagnostics. c_array_info requires a ;, so [N]T never reaches any of it.

The obvious fix was tried and it is WRONG -- measured

Normalising [N]T -> [T; N] inside c_array_info (guarding size 0, and leaving parameter position to c_static_array_param so [static N] survives -- verified) makes the corpus worse:

The target warning barely moves and nine files stop compiling. The new errors say why:

+56 warning: incompatible pointer types passing 't27_arr_int32_t_3 *' to parameter
+18 't27_arr_int32_t_5 *'      +18 't27_arr_int32_t_27 *'     +13 't27_arr_int32_t_10 *'
+15 error: subscripted value is not an array, pointer, or vector

The type becomes a struct while the indexing (a[i] rather than a.v[i]) and the argument passing at call sites do not. The two spellings have divergent downstream handling, and normalising only the type is not a drop-in.

This change is not in a branch. It was built, measured, and reverted.

What a real fix needs

Three things travelling together, which is why this is an issue and not a PR:

1. the type (done above, and easy),
2. every index of such a value becoming .v[i],
3. every call site passing one, since callees take T x[static N] -- a struct is not that.

Item 3 interacts with #3435: parameters deliberately keep T x[static N], so a struct return feeding a call would need .v at the boundary. Whether returns and parameters should use the same representation is a design question, and it is the one worth answering before any code moves.

Original file list

• specs/base/ternary_encoding.t27
• specs/cloud/railway_deploy.t27
• specs/compiler/mod_structure.t27
• specs/config/schema.t27
• specs/github/comments.t27
• specs/github/issues.t27
• specs/github/prs.t27
• specs/github/tests/e2e_full_flow.t27
• specs/memory/formula_embed.t27
• specs/server/mdns.t27

The instruments

Every one of these reads and prints; none of them writes. Run them from the repository root, with <spec> replaced by the file in ## Boundary:

.t27 is not Rust and not Zig, and a bee fluent in either writes one by
accident. Measured 2026-09-20: a bee filled eight bodies in
specs/file/watcher.t27 with return Ok(());, Err(FileError::WatcherNotFound)
and for i in 0..watchers.length. The parse ratchet refused the whole file --
Unexpected token in expression: RParen, line 123 -- and a spec that does not
parse generates nothing, so every test it already carried stopped running.

At the top level the parser accepts exactly these eight forms, with an optional
pub, and no others:

const   var   fn   enum   struct   test   invariant   bench

There is no trait, no impl, no type X = ..., no generics, no macro. What
a bee reaches for from another language, and what happens:

• Rust's result sugar (Ok(()), Err(E::V), ?) is not a construct here.
• Rust macros (println!, format!, vec!) are not constructs here.
• A range loop (for i in 0..n) is Rust and Zig, not this language.
• Zig builtins (catch unreachable, @intCast, @constCast) are not constructs here.
• Cross-module reuse (use other::fn;) parses and then generates a comment and an unqualified call, so the Zig fails with use of undeclared identifier (use a::b; generates no import, so no spec can reuse a function from another spec #4298). It does not work yet.

t27c parse <spec> answers in one line whether what you wrote is the language.
Run it before you report, every time.

• t27c spec-status <spec> - the compiler's one-word verdict: IMPLEMENTED, PARTIAL, UNWRITTEN, NOPARSE, NOFN. Exit code is 0 whatever it says, so read the word.
• t27c symbols <spec> - every name the file declares, with its kind. Answers "does this already exist here?" before you add it.
• t27c outline <spec> - per function: its locals, what it calls, what it returns. The contract you are implementing against.
• t27c coverage <spec> - which functions have a test and which do not. The issue asks for tests; this is how you check you wrote them.
• t27c lint <spec> - style and shape warnings. It OVER-REPORTS has no test or invariant: measured 2026-09-20 over 60 specs it printed 677 of those where coverage found 190 untested functions, disagreeing on 59 of the 60 - it warns about bit_to_trit_pair in specs/base/ternary_encoding.t27, which test bit_to_trit_pair_zero calls on line 249. Read it as a hint; coverage is the answer.
• t27c typecheck <spec> - types, before generation. Prints Typecheck OK (0 errors, 0 warnings) or the errors.
• t27c test-report <spec> - builds this spec and runs its own tests, which is what the oracle does. BLOCKED means the generated Zig does not compile, with the error beside it.
• python3 tools/dupe_scan.py --name <function> - where that function already lives, if it does. 576 of 4021 bodies here are byte-identical copies.

The rest of the toolbelt is in docs/BEE_TOOLBELT.md.

Queen-runnable restatement (2026-10-05)

Still true on master 13e212a: c_array_info (bootstrap/src/compiler.rs:19083) returns None for any type without ;, so fn probe(v: i32) -> [4]u8 still lowers to uint8_t* probe(int32_t v) returning the address of a stack array. The fix is in hand-written Rust, which a bee may not edit (specs/policy/own_language.t27). What a bee can do is the regression spec in the shape of specs/compiler/zig_test_shadowing.t27: it states the rule, carries both spellings, and answers the design question of the issue in ; prose, so the compiler change (owner track #5980) has a test that goes from wrong to right.

Boundary

• specs/compiler/c_fixed_array_return.t27

User Scenarios & Testing

• Given master has no spec that returns a [N]T array by value, when specs/compiler/c_fixed_array_return.t27 lands, then module CFixedArrayReturn has a function returning [4]u8 and one returning [u8; 4], each built in a local, written by index and returned, and tests that read the returned elements with concrete values (for example element 0 is 7 and element 3 is 0).
• Given the three things a real fix needs (the type, every index as .v[i], every call site that passes one to a [static N] parameter), when the spec lands, then its ; header names them, cites the measured attempt (errors 3849 -> 3878, compiling files 296 -> 287) and states which representation returns and parameters should share, with one test that passes a returned array straight into a function taking [4]u8.

Requirements

• FR-001: The spec MUST contain functions returning [4]u8 and [u8; 4] built in a local, and at least 3 tests that read returned elements and one that feeds a returned array into a [4]u8 parameter.
• FR-002: The spec header MUST state the rule (a fixed-array return is a value, never the address of a frame local) and the design decision in ; prose, citing gen-c: carry a fixed-size array parameter's length into C #3435 for the parameter form.
• FR-003: The change MUST NOT add or modify non-t27 hand-written code (specs/policy/own_language.t27); bootstrap/ is not edited.

Success Criteria

• grep -c 'module CFixedArrayReturn' specs/compiler/c_fixed_array_return.t27 prints 1
• grep -cE '\) -> \[4\]u8' specs/compiler/c_fixed_array_return.t27 prints at least 1
• grep -cE '\) -> \[u8; 4\]' specs/compiler/c_fixed_array_return.t27 prints at least 1
• grep -cE '^[[:space:]]*test ' specs/compiler/c_fixed_array_return.t27 prints at least 4
• t27c typecheck specs/compiler/c_fixed_array_return.t27 | grep -c 'Typecheck OK (0 errors' prints 1