@asmlift/core 0.4.0 → 0.6.0

package/README.md

@@ -58,8 +58,8 @@ Everything under `src/` is importable as `@asmlift/core/<path>` (e.g.
 
 ## Architecture
 
-Three ISA frontends (ARMv4T/Thumb, MIPS, PowerPC), four compilers (agbcc, IDO, KMC GCC,
-CodeWarrior), three language backends over one neutral AST — all scored across the package seam
+Three ISA frontends (ARMv4T/Thumb, MIPS, PowerPC), five compilers (agbcc, IDO, KMC GCC, GCC
+2.7.2, CodeWarrior), three language backends over one neutral AST — all scored across the package seam
 by [`@asmlift/cli`](../cli/README.md) with the community `objdiff` engine (in-process, pinned
 `objdiff-wasm`; asmlift never hand-rolls a diff).
 
@@ -79,20 +79,20 @@ injected via hooks, never copied. `verify()` runs after every IR-mutating pass;
 
 ### Modules
 
-| Module                                          | What it is                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| ----------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `ir/{types,core,opcodes,print,parse,verify}.ts` | MLIR-lite substrate: CFG of blocks + typed **block-arguments**, the typed opcode registry (`Opcode`, the one `effects` table DCE and hoist guards derive from), printer + parser (round-trip for L1/scalar types — see the domain note in parse.ts), verifier (arity/attrs/terminators/SSA dominance, located errors)                                                                                                                                                                                                                     |
-| `frontend/{thumb,mips,ppc}.ts`                  | ISA frontends: decode → CFG → L1 with **Braun-2013 block-arg SSA** (`ssa.ts`), incl. loops, calls (signature-driven arity), memory, jump tables. Shared scaffolding: `disasm.ts` (objdump parsing), `splat.ts` (Splat-dialect MIPS → objdump-shaped instrs), `format.ts` (input-format classification), `emit.ts` (per-block emitter kit + `switch_br`), `opaque.ts` (the unmodelled-op → loud-`opaque` contract), `errors.ts` (`FrontendUnsupportedError`; PPC's subclass), `registry.ts`, `asmdata.ts` (Regime-B jump-table side-table) |
-| `pattern/engine.ts`                             | Idiom layer: **rewrite patterns as data** + greedy driver + DCE; `patternApplies` gates on Target capabilities                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| `raise/*.ts`                                    | The pre-recovery recognizers, in ONE ordered list (`pre-recovery.ts`): const materialize → magic division (`magicdiv.ts`, Hacker's Delight inverse) → soft division → array legalize → struct-array → struct-pointer → short-circuit; plus `recover.ts` (L1→L2 type recovery), `retsink.ts` (return-sinking), `errors.ts` (`RaiseUnsupportedError`)                                                                                                                                                                                       |
-| `structure/*.ts`                                | L2→L3 in four modules: `loops.ts` (natural-loop discovery), `analysis.ts` (use registry, liveness, C4 materialization), `switch-recover.ts` (Regime-A comparison-tree recovery), `structure.ts` (SSA-destruction coalescing with interference checks + emission: if/while/do-while/for/switch, break/early-return)                                                                                                                                                                                                                        |
-| `l3/*.ts`                                       | `ast.ts`: language-**neutral** structured AST, the one traversal vocabulary (`exprChildren` etc.), and the `LanguageBackend` seam. Post-structure passes `dce.ts` + `basecse.ts`, the shared hoist mechanism `hoist.ts`, the differ-ranked re-spelling levers `regspell.ts` + `reindex.ts` + `argbase.ts` + `scopebase.ts`, and `typing.ts` (the rendered-expression C type the backends and contracts share)                                                                                                                             |
-| `backend/{c,cpp,cfamily,pascal}.ts`             | Three backends: C and C++ (CodeWarrior mangling via `mangle.ts`) over the shared `cfamily.ts` substrate, and Pascal (`:=`, `div`, tail-position returns; unspellable constructs throw)                                                                                                                                                                                                                                                                                                                                                    |
-| `pipeline.ts`                                   | `decompile()` + the shared tower spine + annotate-mode stubs/diagnostics                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `trace.ts`                                      | `decompileTraced` — the traced tower (per-stage IR dumps + pattern before/after events), browser-pure; @asmlift/cli's `report.ts` enriches it with objdiff scores/candidates, the playground's Pipeline tab renders it directly                                                                                                                                                                                                                                                                                                           |
-| `rank.ts`                                       | Pure candidate enumeration + `rankBy` (an injected score function ranks). @asmlift/cli's differ ranks through `rankBy`; the playground's wasm scorer consumes the same enumeration with its own async loop                                                                                                                                                                                                                                                                                                                                |
-| `target.ts`                                     | `TargetDescription` (ABI + capabilities + compilerBehaviors as data — no `arch ==` in shared code); toolchain paths live in `@asmlift/toolchains`                                                                                                                                                                                                                                                                                                                                                                                         |
-| `contracts.ts`, `proto.ts`, `mangle.ts`         | Boundary contracts; prototype tables; the CodeWarrior mangler                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| Module                                          | What it is                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `ir/{types,core,opcodes,print,parse,verify}.ts` | MLIR-lite substrate: CFG of blocks + typed **block-arguments**, the typed opcode registry (`Opcode`, the one `effects` table DCE and hoist guards derive from), printer + parser (round-trip for L1/scalar types — see the domain note in parse.ts), verifier (arity/attrs/terminators/SSA dominance, located errors); `core.ts` also owns the CFG facts every level reads — `successorsOf`, `predecessors`, `dominators`                                                                                                                                                                                                                                                                                                             |
+| `frontend/{thumb,mips,ppc}.ts`                  | ISA frontends: decode → CFG → L1 with **Braun-2013 block-arg SSA** (`ssa.ts`), incl. loops, calls (signature-driven arity), memory, jump tables. Shared scaffolding: `disasm.ts` (objdump parsing), `splat.ts` (Splat-dialect MIPS → objdump-shaped instrs), `format.ts` (input-format classification), `emit.ts` (per-block emitter kit + `switch_br`), `opaque.ts` (the unmodelled-op → loud-`opaque` contract), `errors.ts` (`FrontendUnsupportedError`; PPC's subclass), `registry.ts`, `asmdata.ts` (Regime-B jump-table side-table)                                                                                                                                                                                             |
+| `pattern/engine.ts`                             | Idiom layer: **rewrite patterns as data** + greedy driver + DCE; `patternApplies` gates on Target capabilities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `raise/*.ts`                                    | The pre-recovery recognizers, in ONE ordered list (`pre-recovery.ts`): const materialize → magic division (`magicdiv.ts`, Hacker's Delight inverse) → soft division → array legalize → struct-array → member-array (`memberarrays.ts`, a constant offset feeding a variable-index walk is a struct's ARRAY member) → struct-pointer → short-circuit → narrow-reads (`narrow.ts`) → narrow locals (`narrowlocal.ts`, a carrier read only through its own extension IS that width) → parameter width (`paramwidth.ts`, a parameter extended in the prologue is DECLARED at that width); plus `recover.ts` (L1→L2 type recovery), `retsink.ts` (return-sinking), `latch.ts` (empty-latch folding), `errors.ts` (`RaiseUnsupportedError`) |
+| `structure/*.ts`                                | L2→L3 in six modules: `loops.ts` (natural-loop discovery, over `ir/core.ts`'s dominators), `analysis.ts` (use registry, liveness, C4 materialization), `switch-recover.ts` (Regime-A comparison-tree recovery), `hazards.ts` (the checks a loop emitter runs before committing to a loop form), `namecoalesce.ts` (copy coalescing over the interference graph — the `/merge-names` axis), `structure.ts` (SSA-destruction coalescing with interference checks + emission: if/while/do-while/for/switch, break/early-return)                                                                                                                                                                                                          |
+| `l3/*.ts`                                       | `ast.ts`: language-**neutral** structured AST, the one traversal vocabulary (`exprChildren` etc.), and the `LanguageBackend` seam. Post-structure passes `dce.ts` + `basecse.ts`, the shared hoist mechanism `hoist.ts`, the differ-ranked re-spelling levers `regspell.ts` + `reindex.ts` + `argbase.ts` + `scopebase.ts`, and `typing.ts` (the rendered-expression C type the backends and contracts share)                                                                                                                                                                                                                                                                                                                         |
+| `backend/{c,cpp,cfamily,pascal}.ts`             | Three backends: C and C++ (CodeWarrior mangling via `mangle.ts`) over the shared `cfamily.ts` substrate, and Pascal (`:=`, `div`, tail-position returns; unspellable constructs throw)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `pipeline.ts`                                   | `decompile()` + the shared tower spine + annotate-mode stubs/diagnostics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `trace.ts`                                      | `decompileTraced` — the traced tower (per-stage IR dumps + pattern before/after events), browser-pure; @asmlift/cli's `report.ts` enriches it with objdiff scores/candidates, the playground's Pipeline tab renders it directly                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `rank.ts`                                       | Pure candidate enumeration + `rankBy` (an injected score function ranks). @asmlift/cli's differ ranks through `rankBy`; the playground's wasm scorer consumes the same enumeration with its own async loop                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `target.ts`                                     | `TargetDescription` (ABI + capabilities + compilerBehaviors as data — no `arch ==` in shared code); toolchain paths live in `@asmlift/toolchains`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `contracts.ts`, `proto.ts`, `mangle.ts`         | Boundary contracts; prototype tables; the CodeWarrior mangler                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 
 Scoring and ranking live across the package seam in [`@asmlift/cli`](../cli/README.md):
 `score.ts` + `objdiff.ts` (toolchain compiles → in-process pinned `objdiff-wasm`, fail-closed)
@@ -133,6 +133,12 @@ Landmarks (not exhaustive — suites are named for what they pin):
 - `contract-invariant` / `contracts` — the loud-fail contract, mutation-proven.
 - `structure-guard` / `structure-soundness` / `audit-regression` — the adversarial-audit repro
   locks.
+- `one-version` — a WORKSPACE-scope invariant, like `offline-list`: every dependency that two or
+  more workspace packages declare must be declared AND resolved at one version. It exists because
+  `packages/cli` scored with `objdiff-wasm` 3.7.3 while `apps/web` scored with 3.7.0, so the
+  playground silently showed 229 where the benchmark published 233 on a byte-identical object
+  pair. Both the package set and the dependency set are derived, so a third consumer is covered
+  without editing the test.
 
 **`test/corpus/` is load-bearing beyond this suite.** The committed disassembly fixtures in
 `test/corpus/` are ALSO imported (via Vite `?raw`) by the playground's example gallery —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@asmlift/core",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "license": "MIT",
   "type": "module",
   "description": "Match decompile an assembly function to C or Pascal",

package/src/backend/c.ts

@@ -12,6 +12,7 @@ export { cComment }; // re-export: the shared spelling lives in cfamily.ts
 
 export const cBackend: LanguageBackend = {
   id: 'c',
+  spellsSwitchFallthrough: true,
   emit(fn: SFn): string {
     const params = fn.params.map((p) => `${cType(p.type)} ${p.name}`).join(', ') || 'void';
     return emitCFamily(`${cType(fn.retType)} ${fn.name}(${params})`, fn);

package/src/backend/cfamily.ts

@@ -3,95 +3,41 @@
 // here, `pasType` in the Pascal backend). The empirical fact grounding the sharing: a
 // CodeWarrior member function's BODY is byte-identical to the same C with `this` as an
 // explicit pointer — so the C++ backend reuses this body spelling VERBATIM and owns only its
-// DIVERGENT surface (the mangled/scoped signature, references, `this`). c.ts and cpp.ts
-// consume exactly the exported seam: `emitCFamily` + `cType` + `LeafHook`.
+// DIVERGENT surface (the mangled/scoped signature, references, `this`).
+//
+// THE SEAM, stated as what it means rather than as a list that rots: a C-family backend owns its
+// SIGNATURE LINE and — for C++, whose member access spells differently — a leaf hook. Everything
+// below the signature is this file's: declarations, statements, expressions, precedence, the
+// legalizing casts, and the recovered-struct declaration spelling (which is why that lives here
+// too, shared with the scoring layer's synthesized declarations so the two cannot drift).
 import { IrType, T, scalarTypeForAccess, typeToString } from '../ir/types';
 import { BinOp, Expr, SFn, Stmt, dotBase } from '../l3/ast';
-import { type VarTypes, declaredTypes, derefStrideOk, exprCType } from '../l3/typing';
-
-/**
- * The C SIGNEDNESS a rendered integer expression actually has — `true`/`false`, or `undefined`
- * when it is not determinable here. The deliberate complement to l3/typing's `exprCType`, which is
- * pointer-ness-accurate and reports every integer as `s32` by contract; this models the two C
- * rules that contract omits, integer PROMOTION and the usual arithmetic CONVERSIONS.
- *
- * It lives HERE, in the C-family backend, because it is a model of C's own rules with no meaning
- * for another language — the same reason the cast it feeds is synthesized here rather than in the
- * tower. `exprCType` stays in l3/ because Pascal consults it too.
- *
- * It exists for one question, and the question is byte-load-bearing: C spells both `>>>` and `>>`
- * as `>>` and chooses between them from the left operand's type. A logical shift rendered over a
- * signed expression recompiles to `asr` where the target has `lsr`, and evaluates to a different
- * value. The C-family backend casts the operand whenever this returns anything but the signedness
- * the operator needs, so `undefined` is the safe answer in every case the model does not cover — a
- * redundant cast is codegen-identical, a missing one is a miscompile.
- *
- * Anything narrower than 32 bits promotes to `int` and is therefore SIGNED, whatever it was
- * declared. Pointers, calls and markers are `undefined`.
- */
-function renderedIntSignedness(e: Expr, varType: VarTypes): boolean | undefined {
-  const rec = (x: Expr): boolean | undefined => renderedIntSignedness(x, varType);
-  // an lvalue-ish leaf: its C type is a declaration / an explicit cast / a carried access width
-  const promoted = (t: IrType | undefined): boolean | undefined =>
-    t?.kind !== 'int' ? undefined : t.width < 32 ? true : t.width === 32 ? t.signed : undefined;
-  switch (e.k) {
-    case 'var':
-    case 'cast':
-    case 'index':
-    case 'field':
-      return promoted(exprCType(e, varType));
-    // A decimal literal is `int` when it fits in one; C89 gives a larger one an unsigned type,
-    // which is not the same operand — so it is left undetermined rather than assumed. INT_MIN is
-    // in that larger class despite fitting: the backend prints it as `-2147483648`, which C lexes
-    // as unary minus applied to `2147483648` — a constant too big for `int`, hence unsigned long.
-    case 'const':
-      return e.value > -2147483648 && e.value <= 2147483647 ? true : undefined;
-    // `-x` / `~x` carry the PROMOTED type of the operand; `!x` is `int`.
-    case 'un':
-      return e.op === '!' ? true : rec(e.e);
-    case 'bin': {
-      // Shifts take the type of the LEFT operand alone — the right is promoted independently.
-      if (e.op === '<<' || e.op === '>>' || e.op === '>>>') {
-        return rec(e.l);
-      }
-      // Comparisons and the logical connectives yield `int`.
-      if (['<', '<=', '>', '>=', '==', '!=', '&&', '||'].includes(e.op)) {
-        return true;
-      }
-      // Usual arithmetic conversions over the remaining binary operators: at equal rank, unsigned
-      // wins. Either side unknown leaves the result unknown — EXCEPT when the known side is
-      // unsigned, which already decides it.
-      //
-      // That exception is the one place this returns a DEFINITE answer from an unknown operand,
-      // and it is sound only because every integer here is rank `int`: at UNEQUAL rank C converts
-      // to the wider type first, so `unsigned int & long long` is SIGNED. Core has no 64-bit
-      // integer type at all (the decomp typedef vocabulary stops at 32 — see contracts.ts
-      // SCALAR_WIDTHS), so the unequal-rank case cannot arise. Adding one would invalidate this.
-      const l = rec(e.l);
-      const r = rec(e.r);
-      if (l === false || r === false) {
-        return false;
-      }
-      return l === true && r === true ? true : undefined;
-    }
-    case 'call':
-    case 'marker':
-    case 'addr':
-      return undefined;
-  }
-}
+import { orderSlotLocals } from '../l3/slotorder';
+import {
+  type PrintEnv,
+  arithConversionSignedness,
+  assertsVolatile,
+  declaredTypes,
+  derefStrideOk,
+  exprCType,
+  printEnv,
+  renderedIntSignedness,
+  writesNonPointerIntoPointer,
+} from '../l3/typing';
 
 // C operator precedence (lower binds tighter). Used to emit MINIMAL parentheses. Shared: C++ has
 // the same precedence for these operators.
 const PREC: Record<BinOp, number> = {
   '*': 3,
   '/': 3,
+  '/u': 3, // the unsigned twins spell as C's `/` and `%` (see C_SPELLING) — same precedence
   '%': 3,
+  '%u': 3,
   '+': 4,
   '-': 4,
   '<<': 5,
   '>>': 5,
-  '>>>': 5, // spells as C's `>>` (see printExpr's shift rule) — same precedence
+  '>>>': 5, // spells as C's `>>` — same precedence
   '<': 6,
   '<=': 6,
   '>': 6,
@@ -105,6 +51,19 @@ const PREC: Record<BinOp, number> = {
   '||': 12,
 };
 
+/** The signedness-carrying operator pairs and the ONE C token each pair shares (l3/ast.ts BinOp).
+ *  Membership here is what makes an operator's operands get pinned; every other operator prints
+ *  its own symbol and needs no cast, because C's own rules for it are sign-blind or already
+ *  agree. */
+const C_SPELLING: Partial<Record<BinOp, { token: string; signed: boolean }>> = {
+  '>>': { token: '>>', signed: true },
+  '>>>': { token: '>>', signed: false },
+  '/': { token: '/', signed: true },
+  '/u': { token: '/', signed: false },
+  '%': { token: '%', signed: true },
+  '%u': { token: '%', signed: false },
+};
+
 /** Spell a recovered type in the decomp C-family typedef vocabulary (`s32`/`u32`/`u8`/`T *`). */
 export function cType(t: IrType): string {
   if (t.kind === 'ptr') {
@@ -163,7 +122,80 @@ export function renderStructDecl(name: string, fields: StructFieldDecl[]): strin
 // backend uses. The default (no hook) is byte-identical C.
 export type LeafHook = (e: Expr, rec: (e: Expr, p: number) => string) => string | null;
 
-function printExpr(e: Expr, parentPrec: number, vt: VarTypes, leaf?: LeafHook): string {
+/** C-FAMILY LEGALIZATION (owned here, per the width-carrying `index` node contract in l3/ast.ts):
+ *  the BASE an `index` node prints through — a deref whose base does not render as a pointer/array
+ *  STRIDING the access width is spelled through the honest reinterpret cast at that width, the
+ *  machine semantics of the access. Materialized as a synthetic cast node so the spelling (text,
+ *  precedence, parens) is exactly that of a tree-level cast, and returns the base UNCHANGED (===)
+ *  when no cast is needed, which is what the multidimensional guard tests.
+ *
+ *  AND IT CARRIES THE QUALIFIER. In C the access takes the OUTER type, so a plain cast over a
+ *  base the tree declared volatile spells an MMIO access the compiler may CSE, reorder or drop —
+ *  `((s32 *)(volatile u16 *)0x4000208)[i]` reads once where `((volatile s32 *)0x4000208)[i]`
+ *  reads twice (agbcc 2.9-arm-000512, `-O2 -mthumb-interwork -Wimplicit -fhex-asm
+ *  -fprologue-bugfix`), and referring to a volatile object through a non-volatile lvalue is
+ *  undefined behaviour (C99 6.7.3p5). */
+function legalizedIndexBase(ix: Extract<Expr, { k: 'index' }>, vt: PrintEnv): Expr {
+  return derefStrideOk(exprCType(ix.base, vt.type), ix.width, ix.signed)
+    ? ix.base
+    : {
+        k: 'cast',
+        to: T.ptr(scalarTypeForAccess(ix.width, ix.signed)),
+        ...(assertsVolatile(ix.base, vt) ? { volatile: true as const } : {}),
+        e: ix.base,
+      };
+}
+
+/** The 32-bit integer cast that PINS an operand's signedness.
+ *
+ *  An existing 32-bit integer cast is REPLACED rather than wrapped — `(u32)(s32)&g` and `(u32)&g`
+ *  are the same bytes, and the arithmetic rules upstream do emit that inner cast (intifyAddr).
+ *  The replacement CARRIES the qualifier: re-typing a `volatile` cast without it drops an
+ *  assertion the differ cannot referee the loss of, which is why l3/initfirst.ts's
+ *  `stripWideIntCast` refuses the same peel one pass over. */
+function recast32(x: Expr, signed: boolean): Expr {
+  const replaced = x.k === 'cast' && x.to.kind === 'int' && x.to.width === 32 ? x : undefined;
+  return {
+    k: 'cast',
+    to: T.int(32, signed),
+    ...(replaced?.volatile === true ? { volatile: true as const } : {}),
+    e: replaced ? replaced.e : x,
+  };
+}
+
+/** C-FAMILY OPERAND-SIGNEDNESS LEGALIZATION, the same discipline as the deref cast one operator
+ *  over. The tower keeps the signedness-carrying pairs apart (`>>>` logical / `>>` arithmetic,
+ *  `/u` `%u` unsigned / `/` `%` signed); C spells each pair with ONE token and picks between them
+ *  from the operand types. So the operands must be made to carry the choice, or an `shr_u`
+ *  recompiles to `asr` where the target has `lsr` AND evaluates differently
+ *  (`*(u8 *)&g << 30 >> 30` promotes to `int`, so a 2-bit field holding 2 comes out -1), and a
+ *  `udiv` calls `__divsi3` where the target called `__udivsi3`.
+ *
+ *  (engine.ts's zext fold covers the same hazard for widths C can NAME, by folding the whole
+ *  shift pair to a cast op. Every other extract width — every bitfield read — lands here.)
+ *
+ *  A SHIFT and a DIVIDE read their operands differently, so the pin does too. A SHIFT takes the
+ *  type of its left operand alone, and the cast goes on unless that operand PROVABLY renders as
+ *  the op needs (renderedIntSignedness's header carries the rule for reading `undefined`).
+ *
+ *  A DIVIDE takes the usual arithmetic conversions over BOTH operands, where unsigned wins at
+ *  equal rank, so the question is what the PAIR renders as. Once the pair renders wrong the two
+ *  directions cost differently: unsigned takes ONE cast, which carries the whole operation, while
+ *  signed has to pin EVERY operand short of a proof, because one unsigned side is enough to make
+ *  the division unsigned. Verified by compiling: `((u32)a / b) / 7` calls `__udivsi3` twice,
+ *  `(s32)((u32)a / b) / 7` calls `__udivsi3` then `__divsi3`. */
+function pinnedOperands(e0: Extract<Expr, { k: 'bin' }>, wantSigned: boolean, vt: PrintEnv): [Expr, Expr] {
+  if (e0.op === '>>' || e0.op === '>>>') {
+    return [renderedIntSignedness(e0.l, vt.type) === wantSigned ? e0.l : recast32(e0.l, wantSigned), e0.r];
+  }
+  if (arithConversionSignedness(e0.l, e0.r, vt.type) === wantSigned) {
+    return [e0.l, e0.r];
+  }
+  const pinSigned = (x: Expr): Expr => (renderedIntSignedness(x, vt.type) === true ? x : recast32(x, true));
+  return wantSigned ? [pinSigned(e0.l), pinSigned(e0.r)] : [recast32(e0.l, false), e0.r];
+}
+
+function printExpr(e: Expr, parentPrec: number, vt: PrintEnv, leaf?: LeafHook): string {
   const rec = (x: Expr, p: number) => printExpr(x, p, vt, leaf);
   if (leaf) {
     const s = leaf(e, rec);
@@ -171,37 +203,6 @@ function printExpr(e: Expr, parentPrec: number, vt: VarTypes, leaf?: LeafHook):
       return s;
     }
   }
-  // C-FAMILY LEGALIZATION (owned here, per the width-carrying `index` node contract in l3/ast.ts):
-  // a deref whose base does not render as a pointer/array STRIDING the access width is spelled
-  // through the honest reinterpret cast at that width — the machine semantics of the access.
-  // Materialized as a synthetic cast node so the spelling (text, precedence, parens) is exactly
-  // that of a tree-level cast.
-  const legalized = (ix: Extract<Expr, { k: 'index' }>): Expr =>
-    derefStrideOk(exprCType(ix.base, vt), ix.width)
-      ? ix.base
-      : { k: 'cast', to: T.ptr(scalarTypeForAccess(ix.width, ix.signed)), e: ix.base };
-  // C-FAMILY SHIFT LEGALIZATION, the same discipline one operator over. The tower keeps the two
-  // right shifts apart (`>>>` logical, `>>` arithmetic); C spells BOTH `>>` and picks between them
-  // from the LEFT OPERAND'S TYPE. So the operand must be made to carry the choice, or an `shr_u`
-  // recompiles to `asr` where the target has `lsr` AND evaluates differently —
-  // `*(u8 *)&g << 30 >> 30` promotes to `int`, so a 2-bit field holding 2 comes out -1.
-  //
-  // (engine.ts's zext fold covers the same hazard for widths C can NAME, by folding the whole
-  // shift pair to a cast op. Every other extract width — every bitfield read — lands here.)
-  //
-  // The cast is added unless the operand PROVABLY renders with the signedness the op needs:
-  // renderedIntSignedness answers `undefined` wherever its model does not reach, and a redundant
-  // cast is codegen-identical while a missing one is a miscompile. An existing 32-bit integer cast
-  // is REPLACED rather than wrapped — `(u32)(s32)&g` and `(u32)&g` are the same bytes, and the
-  // arithmetic rules upstream do emit that inner cast (intifyAddr).
-  const shiftOperand = (e0: Extract<Expr, { k: 'bin' }>): Expr => {
-    const wantSigned = e0.op === '>>';
-    if (renderedIntSignedness(e0.l, vt) === wantSigned) {
-      return e0.l;
-    }
-    const inner = e0.l.k === 'cast' && e0.l.to.kind === 'int' && e0.l.to.width === 32 ? e0.l.e : e0.l;
-    return { k: 'cast', to: T.int(32, wantSigned), e: inner };
-  };
   switch (e.k) {
     case 'var':
       return e.name;
@@ -221,12 +222,13 @@ function printExpr(e: Expr, parentPrec: number, vt: VarTypes, leaf?: LeafHook):
       // `(*p)[1]`, never `*p[1]` which C groups as `*(p[1])`), `base[idx]` otherwise (POSTFIX —
       // binds tighter than any prefix operator, so a cast/unary/deref base is printed at prec 1
       // and parenthesizes itself: `((u8 *)p)[1]`). The postfix form needs no outer parentheses.
-      const base = legalized(e);
+      const base = legalizedIndexBase(e, vt);
       // Leading constant subscripts (a multidimensional array global's bare spelling) keep the
       // postfix form whatever `idx` is: `g[0][0]` is the element, `*g[0]` would be its ROW.
       //
-      // `lead` implies the base already strides the access width — its only producer registers a
-      // matching element type for the global (structure.ts bareArrayLead + noteGlobal). Nothing
+      // `lead` implies the base already strides the access width — its only producers register a
+      // matching element type for the global (structure/globalaccess.ts `bareArrayLead` and
+      // `declaredSubscripts`, both through structure.ts's `noteGlobal`). Nothing
       // else enforced that, and the failure would be quiet-ish: legalization would wrap the base,
       // spelling `((u16 *)g)[0][i]`, which subscripts a `u16` twice. Check it rather than assume.
       if (e.lead && e.lead.length > 0) {
@@ -235,7 +237,7 @@ function printExpr(e: Expr, parentPrec: number, vt: VarTypes, leaf?: LeafHook):
             `c backend: a multidimensional array access needs a base that strides ${e.width} bytes as spelled`,
           );
         }
-        return `${rec(base, 1)}${e.lead.map((l) => `[${l}]`).join('')}[${rec(e.idx, 99)}]`;
+        return `${rec(base, 1)}${e.lead.map((l) => `[${rec(l, 99)}]`).join('')}[${rec(e.idx, 99)}]`;
       }
       if (e.idx.k === 'const' && e.idx.value === 0) {
         const s = `*${rec(base, 2)}`;
@@ -289,20 +291,25 @@ function printExpr(e: Expr, parentPrec: number, vt: VarTypes, leaf?: LeafHook):
     // op. Under a POSTFIX parent ([]/->) the cast itself must parenthesize — `((struct S *)p)->f`,
     // NOT `(struct S *)p->f` (which C parses as a cast OF the member access).
     case 'cast': {
-      const s = `(${cType(e.to)})${rec(e.e, 2)}`;
+      // `volatile` binds to the POINTEE (`(volatile u16 *)a`), which is where the qualifier goes
+      // on a raw-address access — the same prefix position the declaration printer uses for a
+      // pointer local's `pointeeVolatile`.
+      const s = `(${e.volatile ? 'volatile ' : ''}${cType(e.to)})${rec(e.e, 2)}`;
       return parentPrec < 2 ? `(${s})` : s;
     }
     case 'bin': {
       const p = PREC[e.op];
-      // Both right shifts spell C's `>>`; `shiftOperand` supplies the operand cast that says which.
-      const shift = e.op === '>>' || e.op === '>>>';
-      const s = `${rec(shift ? shiftOperand(e) : e.l, p)} ${shift ? '>>' : e.op} ${rec(e.r, p - 1)}`;
+      // Each signedness-carrying pair spells with ONE C token; `pinnedOperands` supplies the
+      // operand cast that says which of the pair it is.
+      const pair = C_SPELLING[e.op];
+      const [l, r] = pair ? pinnedOperands(e, pair.signed, vt) : [e.l, e.r];
+      const s = `${rec(l, p)} ${pair ? pair.token : e.op} ${rec(r, p - 1)}`;
       return p > parentPrec ? `(${s})` : s;
     }
   }
 }
 
-function printStmt(s: Stmt, indent: string, vt: VarTypes, leaf?: LeafHook): string[] {
+function printStmt(s: Stmt, indent: string, vt: PrintEnv, leaf?: LeafHook): string[] {
   const pe = (e: Expr, p: number) => printExpr(e, p, vt, leaf);
   switch (s.k) {
     case 'assign':
@@ -355,8 +362,8 @@ function printStmt(s: Stmt, indent: string, vt: VarTypes, leaf?: LeafHook): stri
       return out;
     }
     case 'for': {
-      // `for (init; cond; inc) { body }`. PRECONDITION (guaranteed by the sole producer, structure.ts
-      // `recognizeForLoops`): init/inc are each a SINGLE-LINE `assign` statement. `clause` renders one
+      // `for (init; cond; inc) { body }`. PRECONDITION (guaranteed by both producers — structure.ts
+      // `recognizeForLoops` and l3/reindex.ts): init/inc are each a SINGLE-LINE `assign` statement. `clause` renders one
       // and strips its trailing `;` so it sits inside the header (`i = 0; c; i = i + 1`). A multi-line
       // statement (an `if`/nested loop) would render mangled — but the recognizer never builds one here.
       const clause = (st: Stmt) => printStmt(st, '', vt, leaf).join(' ').replace(/;\s*$/, '').trim();
@@ -371,33 +378,98 @@ function printStmt(s: Stmt, indent: string, vt: VarTypes, leaf?: LeafHook): stri
       return [`${indent}break;`];
     case 'continue':
       return [`${indent}continue;`];
-    case 'switch': {
-      const out = [`${indent}switch (${pe(s.scrutinee, 99)}) {`];
-      const ci = indent + '    '; // case-label indent
-      const bi = indent + '        '; // case-body indent
-      for (const c of s.cases) {
-        for (const v of c.values) {
-          out.push(`${ci}case ${v}:`);
-        }
-        for (const t of c.body) {
-          out.push(...printStmt(t, bi, vt, leaf));
-        }
-        // A case whose body ends in `return`/`break` (a terminated arm) needs no `break;`; only an
-        // open non-fall-through arm gets one. `fallsThrough` omits it so control drops to the next case.
-        if (!c.fallsThrough && !endsTerminated(c.body)) {
-          out.push(`${bi}break;`);
-        }
-      }
-      if (s.default) {
-        out.push(`${ci}default:`);
-        for (const t of s.default) {
-          out.push(...printStmt(t, bi, vt, leaf));
-        }
+    case 'switch':
+      return printSwitchStmt(s, indent, vt, leaf);
+  }
+}
+
+/** A C `switch`: the arm bodies, the `default:` label's position among them, and the three
+ *  producer-contract refusals that stand between an L3 `switch` node and valid C. Its own function
+ *  because it is the one statement kind whose printing is a program of its own; `printStmt`'s arm
+ *  is one call. */
+function printSwitchStmt(s: Extract<Stmt, { k: 'switch' }>, indent: string, vt: PrintEnv, leaf?: LeafHook): string[] {
+  const pe = (e: Expr, p: number) => printExpr(e, p, vt, leaf);
+  // A `break;` in an arm BODY is the innermost LOOP's in L3 (l3/ast.ts) and the SWITCH's in C,
+  // so printing one between `case` labels rebinds it — a changed program that reads as ordinary
+  // C. Refused HERE because the rebinding is the printer's, for every producer rather than for
+  // the two switch regimes. No recovery reaches it today (both regimes decline a loop-exiting
+  // arm first, loudly), so it is a contract on the next one.
+  //
+  // `continue;` is deliberately NOT refused: C binds it to the smallest enclosing ITERATION
+  // statement, which a `switch` is not, so it already means what L3 means. What a loop-respelling
+  // pass must preserve is exactly that — the three that can re-spell a loop into one whose
+  // `continue` would run a different increment (`recognizeForLoops` in structure.ts,
+  // `respellCountdown` in l3/reindex.ts, and l3/unreduce.ts) each scan switch arms for the node
+  // before firing, and a fourth must too.
+  for (const body of [...s.cases.map((c) => c.body), s.default ?? []]) {
+    if (switchBoundBreakIn(body)) {
+      throw new Error('c backend: a switch arm carries a loop-scoped `break;`, which C would bind to the switch');
+    }
+  }
+  const out = [`${indent}switch (${pe(s.scrutinee, 99)}) {`];
+  const ci = indent + '    '; // case-label indent
+  const bi = indent + '        '; // case-body indent
+  // `?.length`, not just presence: a label with no statement under it is not valid C89, and an
+  // L3 pass (dce, reindex) may empty a default that arrived with statements — the structurer's
+  // own "don't attach an empty default" rule cannot see that.
+  const hasDefault = !!s.default?.length;
+  // Where the `default:` label goes, as a COUNT of case arms before it (l3/ast.ts): absent ⇒
+  // after all of them. A count past the arms matches no position at all and the label would
+  // simply not be printed — the default arm vanishing from a switch that has one — so a
+  // producer that hands one over fails loud, like the falling-arm placement below.
+  const defAt = hasDefault ? (s.defaultAt ?? s.cases.length) : -1;
+  if (hasDefault && (defAt < 0 || defAt > s.cases.length)) {
+    throw new Error(`c backend: a switch places its default at arm ${defAt} of ${s.cases.length}`);
+  }
+  const printDefault = (): void => {
+    out.push(`${ci}default:`);
+    for (const t of s.default!) {
+      out.push(...printStmt(t, bi, vt, leaf));
+    }
+    // A default that is NOT last would otherwise fall into the case below it — the mirror of the
+    // rule for cases. The last one needs no `break;` because there is nothing under it.
+    if (defAt < s.cases.length && !endsTerminated(s.default!)) {
+      out.push(`${bi}break;`);
+    }
+  };
+  s.cases.forEach((c, i) => {
+    if (i === defAt) {
+      // Moving the label in FRONT of a falling arm would divert that arm into the default —
+      // a silent control-flow change. Recovery only positions a default among closed arms, so
+      // this is a producer bug rather than an input shape: fail loud.
+      if (i > 0 && s.cases[i - 1].fallsThrough) {
+        throw new Error(
+          `c backend: a switch places its default after a case that falls through, which would divert it`,
+        );
       }
-      out.push(`${indent}}`);
-      return out;
+      printDefault();
+    }
+    for (const v of c.values) {
+      out.push(`${ci}case ${v}:`);
+    }
+    for (const t of c.body) {
+      out.push(...printStmt(t, bi, vt, leaf));
     }
+    // A case whose body ends in `return`/`break` (a terminated arm) needs no `break;`; only an
+    // open non-fall-through arm gets one. `fallsThrough` omits it so control drops to the next case.
+    if (!c.fallsThrough && !endsTerminated(c.body)) {
+      out.push(`${bi}break;`);
+    }
+  });
+  if (defAt === s.cases.length) {
+    printDefault();
   }
+  out.push(`${indent}}`);
+  return out;
+}
+
+/** Does this arm body carry a `break` C would bind to the enclosing SWITCH rather than to the loop
+ *  L3 meant? A loop opened inside the arm captures its own, so its body is not walked; a nested
+ *  `switch` captures one too and is checked when it is printed. */
+function switchBoundBreakIn(body: Stmt[]): boolean {
+  return body.some(
+    (s) => s.k === 'break' || (s.k === 'if' && (switchBoundBreakIn(s.then) || switchBoundBreakIn(s.else))),
+  );
 }
 
 // Does a statement list end in a control-flow terminator (so a trailing `break;` would be dead)?
@@ -412,26 +484,15 @@ function endsTerminated(body: Stmt[]): boolean {
   );
 }
 
-/** The body of a C-family function: local declarations + statements, one string per line. The
- *  SIGNATURE (return type + name + params, plus any C++ scope/`this`/mangling) is the caller's —
- *  that is the language-divergent part each backend owns. */
 // C-FAMILY WRITE LEGALIZATION (the assign-side sibling of the deref legalization in printExpr):
-// a value whose rendered C type is definitely NON-pointer written into a pointer-declared slot
-// (`v2 = a1 + v0` with `v2: u8 *`; `return a0 + v0` from a ptr-returning fn; `*pp = intexpr`
-// through a pointer-element slot) is an ERROR on mwcc (gcc merely warns) — the honest spelling
-// is the reinterpret cast to the DECLARED type, exactly what the machine's register move does.
-// Unknowable renderings (calls) are left alone: their C type comes from prototypes outside this
-// function. (A rebuilding transform with per-kind semantics — its own switch, per the l3/ast.ts
+// the C family's answer to `writesNonPointerIntoPointer` is the reinterpret cast to the DECLARED
+// type — exactly what the machine's register move does — where Pascal, having no such cast,
+// declines. (A rebuilding transform with per-kind semantics — its own switch, per the l3/ast.ts
 // traversal-vocabulary exemption.)
 function legalizePointerWrites(fn: SFn): SFn {
   const vt = declaredTypes(fn);
-  const castTo = (t: IrType | undefined, e: Expr): Expr => {
-    if (t?.kind !== 'ptr') {
-      return e;
-    }
-    const ct = exprCType(e, vt);
-    return ct && ct.kind !== 'ptr' && ct.kind !== 'array' ? { k: 'cast', to: t, e } : e;
-  };
+  const castTo = (t: IrType | undefined, e: Expr): Expr =>
+    writesNonPointerIntoPointer(t, e, vt) ? { k: 'cast', to: t, e } : e;
   const fix = (s: Stmt): Stmt => {
     switch (s.k) {
       case 'assign':
@@ -463,14 +524,23 @@ function legalizePointerWrites(fn: SFn): SFn {
   return { ...fn, body: fn.body.map(fix) };
 }
 
+/** The body of a C-family function: local declarations + statements, one string per line. The
+ *  SIGNATURE (return type + name + params, plus any C++ scope/`this`/mangling) is the caller's —
+ *  that is the language-divergent part each backend owns. */
 function cFamilyBody(fn0: SFn, leaf?: LeafHook): string[] {
   const fn = legalizePointerWrites(fn0);
-  // The legalization env: every printed var's declared type, from the SAME params/locals the
-  // emitted declarations come from — so the printer judges exactly the C the reader will see.
-  const vt: VarTypes = declaredTypes(fn);
+  // The legalization env: every printed var's declared type and pointee volatility, from the SAME
+  // params/locals the emitted declarations come from — so the printer judges exactly the C the
+  // reader will see.
+  const vt: PrintEnv = printEnv(fn);
   const lines: string[] = [];
   for (const l of fn.locals) {
-    lines.push(`    ${cType(l.type)} ${l.name};`);
+    // Both facts render at the PREFIX position, where C's declarator grammar reads them
+    // differently: on a scalar the qualifier binds to the object (`volatile u16 sp0`), on a
+    // pointer declarator to the pointee — the INNERMOST one for a multi-level pointer
+    // (`volatile u16 ** p`). An object-volatile POINTER (`u16 *volatile p`) has no inhabitant —
+    // no lever or recognizer produces one.
+    lines.push(`    ${l.volatile || l.pointeeVolatile ? 'volatile ' : ''}${cType(l.type)} ${l.name};`);
   }
   for (const s of fn.body) {
     lines.push(...printStmt(s, '    ', vt, leaf));
@@ -488,7 +558,11 @@ function structDecls(fn: SFn): string[] {
 }
 
 /** Assemble a full C-family function from a caller-supplied signature line and the shared body. */
-export function emitCFamily(signature: string, fn: SFn, leaf?: LeafHook): string {
+export function emitCFamily(signature: string, fn0: SFn, leaf?: LeafHook): string {
+  // The declaration list is put into the target's own frame order HERE — in the shared C-family
+  // assembler, reached only from `cBackend.emit` and `cppBackend(...).emit`, so both C-family
+  // backends order and no `.emit(` call site does (l3/slotorder.ts says why `emit` owns it).
+  const fn = orderSlotLocals(fn0);
   const decls = structDecls(fn);
   const preamble = decls.length ? decls.join('\n') + '\n' : '';
   return preamble + [`${signature} {`, ...cFamilyBody(fn, leaf), '}'].join('\n') + '\n';