@asmlift/core 0.5.0 → 0.6.0

package/src/backend/cfamily.ts

@@ -3,95 +3,41 @@
 // here, `pasType` in the Pascal backend). The empirical fact grounding the sharing: a
 // CodeWarrior member function's BODY is byte-identical to the same C with `this` as an
 // explicit pointer — so the C++ backend reuses this body spelling VERBATIM and owns only its
-// DIVERGENT surface (the mangled/scoped signature, references, `this`). c.ts and cpp.ts
-// consume exactly the exported seam: `emitCFamily` + `cType` + `LeafHook`.
+// DIVERGENT surface (the mangled/scoped signature, references, `this`).
+//
+// THE SEAM, stated as what it means rather than as a list that rots: a C-family backend owns its
+// SIGNATURE LINE and — for C++, whose member access spells differently — a leaf hook. Everything
+// below the signature is this file's: declarations, statements, expressions, precedence, the
+// legalizing casts, and the recovered-struct declaration spelling (which is why that lives here
+// too, shared with the scoring layer's synthesized declarations so the two cannot drift).
 import { IrType, T, scalarTypeForAccess, typeToString } from '../ir/types';
 import { BinOp, Expr, SFn, Stmt, dotBase } from '../l3/ast';
-import { type VarTypes, declaredTypes, derefStrideOk, exprCType } from '../l3/typing';
-
-/**
- * The C SIGNEDNESS a rendered integer expression actually has — `true`/`false`, or `undefined`
- * when it is not determinable here. The deliberate complement to l3/typing's `exprCType`, which is
- * pointer-ness-accurate and reports every integer as `s32` by contract; this models the two C
- * rules that contract omits, integer PROMOTION and the usual arithmetic CONVERSIONS.
- *
- * It lives HERE, in the C-family backend, because it is a model of C's own rules with no meaning
- * for another language — the same reason the cast it feeds is synthesized here rather than in the
- * tower. `exprCType` stays in l3/ because Pascal consults it too.
- *
- * It exists for one question, and the question is byte-load-bearing: C spells both `>>>` and `>>`
- * as `>>` and chooses between them from the left operand's type. A logical shift rendered over a
- * signed expression recompiles to `asr` where the target has `lsr`, and evaluates to a different
- * value. The C-family backend casts the operand whenever this returns anything but the signedness
- * the operator needs, so `undefined` is the safe answer in every case the model does not cover — a
- * redundant cast is codegen-identical, a missing one is a miscompile.
- *
- * Anything narrower than 32 bits promotes to `int` and is therefore SIGNED, whatever it was
- * declared. Pointers, calls and markers are `undefined`.
- */
-function renderedIntSignedness(e: Expr, varType: VarTypes): boolean | undefined {
-  const rec = (x: Expr): boolean | undefined => renderedIntSignedness(x, varType);
-  // an lvalue-ish leaf: its C type is a declaration / an explicit cast / a carried access width
-  const promoted = (t: IrType | undefined): boolean | undefined =>
-    t?.kind !== 'int' ? undefined : t.width < 32 ? true : t.width === 32 ? t.signed : undefined;
-  switch (e.k) {
-    case 'var':
-    case 'cast':
-    case 'index':
-    case 'field':
-      return promoted(exprCType(e, varType));
-    // A decimal literal is `int` when it fits in one; C89 gives a larger one an unsigned type,
-    // which is not the same operand — so it is left undetermined rather than assumed. INT_MIN is
-    // in that larger class despite fitting: the backend prints it as `-2147483648`, which C lexes
-    // as unary minus applied to `2147483648` — a constant too big for `int`, hence unsigned long.
-    case 'const':
-      return e.value > -2147483648 && e.value <= 2147483647 ? true : undefined;
-    // `-x` / `~x` carry the PROMOTED type of the operand; `!x` is `int`.
-    case 'un':
-      return e.op === '!' ? true : rec(e.e);
-    case 'bin': {
-      // Shifts take the type of the LEFT operand alone — the right is promoted independently.
-      if (e.op === '<<' || e.op === '>>' || e.op === '>>>') {
-        return rec(e.l);
-      }
-      // Comparisons and the logical connectives yield `int`.
-      if (['<', '<=', '>', '>=', '==', '!=', '&&', '||'].includes(e.op)) {
-        return true;
-      }
-      // Usual arithmetic conversions over the remaining binary operators: at equal rank, unsigned
-      // wins. Either side unknown leaves the result unknown — EXCEPT when the known side is
-      // unsigned, which already decides it.
-      //
-      // That exception is the one place this returns a DEFINITE answer from an unknown operand,
-      // and it is sound only because every integer here is rank `int`: at UNEQUAL rank C converts
-      // to the wider type first, so `unsigned int & long long` is SIGNED. Core has no 64-bit
-      // integer type at all (the decomp typedef vocabulary stops at 32 — see contracts.ts
-      // SCALAR_WIDTHS), so the unequal-rank case cannot arise. Adding one would invalidate this.
-      const l = rec(e.l);
-      const r = rec(e.r);
-      if (l === false || r === false) {
-        return false;
-      }
-      return l === true && r === true ? true : undefined;
-    }
-    case 'call':
-    case 'marker':
-    case 'addr':
-      return undefined;
-  }
-}
+import { orderSlotLocals } from '../l3/slotorder';
+import {
+  type PrintEnv,
+  arithConversionSignedness,
+  assertsVolatile,
+  declaredTypes,
+  derefStrideOk,
+  exprCType,
+  printEnv,
+  renderedIntSignedness,
+  writesNonPointerIntoPointer,
+} from '../l3/typing';
 
 // C operator precedence (lower binds tighter). Used to emit MINIMAL parentheses. Shared: C++ has
 // the same precedence for these operators.
 const PREC: Record<BinOp, number> = {
   '*': 3,
   '/': 3,
+  '/u': 3, // the unsigned twins spell as C's `/` and `%` (see C_SPELLING) — same precedence
   '%': 3,
+  '%u': 3,
   '+': 4,
   '-': 4,
   '<<': 5,
   '>>': 5,
-  '>>>': 5, // spells as C's `>>` (see printExpr's shift rule) — same precedence
+  '>>>': 5, // spells as C's `>>` — same precedence
   '<': 6,
   '<=': 6,
   '>': 6,
@@ -105,6 +51,19 @@ const PREC: Record<BinOp, number> = {
   '||': 12,
 };
 
+/** The signedness-carrying operator pairs and the ONE C token each pair shares (l3/ast.ts BinOp).
+ *  Membership here is what makes an operator's operands get pinned; every other operator prints
+ *  its own symbol and needs no cast, because C's own rules for it are sign-blind or already
+ *  agree. */
+const C_SPELLING: Partial<Record<BinOp, { token: string; signed: boolean }>> = {
+  '>>': { token: '>>', signed: true },
+  '>>>': { token: '>>', signed: false },
+  '/': { token: '/', signed: true },
+  '/u': { token: '/', signed: false },
+  '%': { token: '%', signed: true },
+  '%u': { token: '%', signed: false },
+};
+
 /** Spell a recovered type in the decomp C-family typedef vocabulary (`s32`/`u32`/`u8`/`T *`). */
 export function cType(t: IrType): string {
   if (t.kind === 'ptr') {
@@ -163,7 +122,80 @@ export function renderStructDecl(name: string, fields: StructFieldDecl[]): strin
 // backend uses. The default (no hook) is byte-identical C.
 export type LeafHook = (e: Expr, rec: (e: Expr, p: number) => string) => string | null;
 
-function printExpr(e: Expr, parentPrec: number, vt: VarTypes, leaf?: LeafHook): string {
+/** C-FAMILY LEGALIZATION (owned here, per the width-carrying `index` node contract in l3/ast.ts):
+ *  the BASE an `index` node prints through — a deref whose base does not render as a pointer/array
+ *  STRIDING the access width is spelled through the honest reinterpret cast at that width, the
+ *  machine semantics of the access. Materialized as a synthetic cast node so the spelling (text,
+ *  precedence, parens) is exactly that of a tree-level cast, and returns the base UNCHANGED (===)
+ *  when no cast is needed, which is what the multidimensional guard tests.
+ *
+ *  AND IT CARRIES THE QUALIFIER. In C the access takes the OUTER type, so a plain cast over a
+ *  base the tree declared volatile spells an MMIO access the compiler may CSE, reorder or drop —
+ *  `((s32 *)(volatile u16 *)0x4000208)[i]` reads once where `((volatile s32 *)0x4000208)[i]`
+ *  reads twice (agbcc 2.9-arm-000512, `-O2 -mthumb-interwork -Wimplicit -fhex-asm
+ *  -fprologue-bugfix`), and referring to a volatile object through a non-volatile lvalue is
+ *  undefined behaviour (C99 6.7.3p5). */
+function legalizedIndexBase(ix: Extract<Expr, { k: 'index' }>, vt: PrintEnv): Expr {
+  return derefStrideOk(exprCType(ix.base, vt.type), ix.width, ix.signed)
+    ? ix.base
+    : {
+        k: 'cast',
+        to: T.ptr(scalarTypeForAccess(ix.width, ix.signed)),
+        ...(assertsVolatile(ix.base, vt) ? { volatile: true as const } : {}),
+        e: ix.base,
+      };
+}
+
+/** The 32-bit integer cast that PINS an operand's signedness.
+ *
+ *  An existing 32-bit integer cast is REPLACED rather than wrapped — `(u32)(s32)&g` and `(u32)&g`
+ *  are the same bytes, and the arithmetic rules upstream do emit that inner cast (intifyAddr).
+ *  The replacement CARRIES the qualifier: re-typing a `volatile` cast without it drops an
+ *  assertion the differ cannot referee the loss of, which is why l3/initfirst.ts's
+ *  `stripWideIntCast` refuses the same peel one pass over. */
+function recast32(x: Expr, signed: boolean): Expr {
+  const replaced = x.k === 'cast' && x.to.kind === 'int' && x.to.width === 32 ? x : undefined;
+  return {
+    k: 'cast',
+    to: T.int(32, signed),
+    ...(replaced?.volatile === true ? { volatile: true as const } : {}),
+    e: replaced ? replaced.e : x,
+  };
+}
+
+/** C-FAMILY OPERAND-SIGNEDNESS LEGALIZATION, the same discipline as the deref cast one operator
+ *  over. The tower keeps the signedness-carrying pairs apart (`>>>` logical / `>>` arithmetic,
+ *  `/u` `%u` unsigned / `/` `%` signed); C spells each pair with ONE token and picks between them
+ *  from the operand types. So the operands must be made to carry the choice, or an `shr_u`
+ *  recompiles to `asr` where the target has `lsr` AND evaluates differently
+ *  (`*(u8 *)&g << 30 >> 30` promotes to `int`, so a 2-bit field holding 2 comes out -1), and a
+ *  `udiv` calls `__divsi3` where the target called `__udivsi3`.
+ *
+ *  (engine.ts's zext fold covers the same hazard for widths C can NAME, by folding the whole
+ *  shift pair to a cast op. Every other extract width — every bitfield read — lands here.)
+ *
+ *  A SHIFT and a DIVIDE read their operands differently, so the pin does too. A SHIFT takes the
+ *  type of its left operand alone, and the cast goes on unless that operand PROVABLY renders as
+ *  the op needs (renderedIntSignedness's header carries the rule for reading `undefined`).
+ *
+ *  A DIVIDE takes the usual arithmetic conversions over BOTH operands, where unsigned wins at
+ *  equal rank, so the question is what the PAIR renders as. Once the pair renders wrong the two
+ *  directions cost differently: unsigned takes ONE cast, which carries the whole operation, while
+ *  signed has to pin EVERY operand short of a proof, because one unsigned side is enough to make
+ *  the division unsigned. Verified by compiling: `((u32)a / b) / 7` calls `__udivsi3` twice,
+ *  `(s32)((u32)a / b) / 7` calls `__udivsi3` then `__divsi3`. */
+function pinnedOperands(e0: Extract<Expr, { k: 'bin' }>, wantSigned: boolean, vt: PrintEnv): [Expr, Expr] {
+  if (e0.op === '>>' || e0.op === '>>>') {
+    return [renderedIntSignedness(e0.l, vt.type) === wantSigned ? e0.l : recast32(e0.l, wantSigned), e0.r];
+  }
+  if (arithConversionSignedness(e0.l, e0.r, vt.type) === wantSigned) {
+    return [e0.l, e0.r];
+  }
+  const pinSigned = (x: Expr): Expr => (renderedIntSignedness(x, vt.type) === true ? x : recast32(x, true));
+  return wantSigned ? [pinSigned(e0.l), pinSigned(e0.r)] : [recast32(e0.l, false), e0.r];
+}
+
+function printExpr(e: Expr, parentPrec: number, vt: PrintEnv, leaf?: LeafHook): string {
   const rec = (x: Expr, p: number) => printExpr(x, p, vt, leaf);
   if (leaf) {
     const s = leaf(e, rec);
@@ -171,37 +203,6 @@ function printExpr(e: Expr, parentPrec: number, vt: VarTypes, leaf?: LeafHook):
       return s;
     }
   }
-  // C-FAMILY LEGALIZATION (owned here, per the width-carrying `index` node contract in l3/ast.ts):
-  // a deref whose base does not render as a pointer/array STRIDING the access width is spelled
-  // through the honest reinterpret cast at that width — the machine semantics of the access.
-  // Materialized as a synthetic cast node so the spelling (text, precedence, parens) is exactly
-  // that of a tree-level cast.
-  const legalized = (ix: Extract<Expr, { k: 'index' }>): Expr =>
-    derefStrideOk(exprCType(ix.base, vt), ix.width)
-      ? ix.base
-      : { k: 'cast', to: T.ptr(scalarTypeForAccess(ix.width, ix.signed)), e: ix.base };
-  // C-FAMILY SHIFT LEGALIZATION, the same discipline one operator over. The tower keeps the two
-  // right shifts apart (`>>>` logical, `>>` arithmetic); C spells BOTH `>>` and picks between them
-  // from the LEFT OPERAND'S TYPE. So the operand must be made to carry the choice, or an `shr_u`
-  // recompiles to `asr` where the target has `lsr` AND evaluates differently —
-  // `*(u8 *)&g << 30 >> 30` promotes to `int`, so a 2-bit field holding 2 comes out -1.
-  //
-  // (engine.ts's zext fold covers the same hazard for widths C can NAME, by folding the whole
-  // shift pair to a cast op. Every other extract width — every bitfield read — lands here.)
-  //
-  // The cast is added unless the operand PROVABLY renders with the signedness the op needs:
-  // renderedIntSignedness answers `undefined` wherever its model does not reach, and a redundant
-  // cast is codegen-identical while a missing one is a miscompile. An existing 32-bit integer cast
-  // is REPLACED rather than wrapped — `(u32)(s32)&g` and `(u32)&g` are the same bytes, and the
-  // arithmetic rules upstream do emit that inner cast (intifyAddr).
-  const shiftOperand = (e0: Extract<Expr, { k: 'bin' }>): Expr => {
-    const wantSigned = e0.op === '>>';
-    if (renderedIntSignedness(e0.l, vt) === wantSigned) {
-      return e0.l;
-    }
-    const inner = e0.l.k === 'cast' && e0.l.to.kind === 'int' && e0.l.to.width === 32 ? e0.l.e : e0.l;
-    return { k: 'cast', to: T.int(32, wantSigned), e: inner };
-  };
   switch (e.k) {
     case 'var':
       return e.name;
@@ -221,12 +222,13 @@ function printExpr(e: Expr, parentPrec: number, vt: VarTypes, leaf?: LeafHook):
       // `(*p)[1]`, never `*p[1]` which C groups as `*(p[1])`), `base[idx]` otherwise (POSTFIX —
       // binds tighter than any prefix operator, so a cast/unary/deref base is printed at prec 1
       // and parenthesizes itself: `((u8 *)p)[1]`). The postfix form needs no outer parentheses.
-      const base = legalized(e);
+      const base = legalizedIndexBase(e, vt);
       // Leading constant subscripts (a multidimensional array global's bare spelling) keep the
       // postfix form whatever `idx` is: `g[0][0]` is the element, `*g[0]` would be its ROW.
       //
-      // `lead` implies the base already strides the access width — its only producer registers a
-      // matching element type for the global (structure.ts bareArrayLead + noteGlobal). Nothing
+      // `lead` implies the base already strides the access width — its only producers register a
+      // matching element type for the global (structure/globalaccess.ts `bareArrayLead` and
+      // `declaredSubscripts`, both through structure.ts's `noteGlobal`). Nothing
       // else enforced that, and the failure would be quiet-ish: legalization would wrap the base,
       // spelling `((u16 *)g)[0][i]`, which subscripts a `u16` twice. Check it rather than assume.
       if (e.lead && e.lead.length > 0) {
@@ -235,7 +237,7 @@ function printExpr(e: Expr, parentPrec: number, vt: VarTypes, leaf?: LeafHook):
             `c backend: a multidimensional array access needs a base that strides ${e.width} bytes as spelled`,
           );
         }
-        return `${rec(base, 1)}${e.lead.map((l) => `[${l}]`).join('')}[${rec(e.idx, 99)}]`;
+        return `${rec(base, 1)}${e.lead.map((l) => `[${rec(l, 99)}]`).join('')}[${rec(e.idx, 99)}]`;
       }
       if (e.idx.k === 'const' && e.idx.value === 0) {
         const s = `*${rec(base, 2)}`;
@@ -289,20 +291,25 @@ function printExpr(e: Expr, parentPrec: number, vt: VarTypes, leaf?: LeafHook):
     // op. Under a POSTFIX parent ([]/->) the cast itself must parenthesize — `((struct S *)p)->f`,
     // NOT `(struct S *)p->f` (which C parses as a cast OF the member access).
     case 'cast': {
-      const s = `(${cType(e.to)})${rec(e.e, 2)}`;
+      // `volatile` binds to the POINTEE (`(volatile u16 *)a`), which is where the qualifier goes
+      // on a raw-address access — the same prefix position the declaration printer uses for a
+      // pointer local's `pointeeVolatile`.
+      const s = `(${e.volatile ? 'volatile ' : ''}${cType(e.to)})${rec(e.e, 2)}`;
       return parentPrec < 2 ? `(${s})` : s;
     }
     case 'bin': {
       const p = PREC[e.op];
-      // Both right shifts spell C's `>>`; `shiftOperand` supplies the operand cast that says which.
-      const shift = e.op === '>>' || e.op === '>>>';
-      const s = `${rec(shift ? shiftOperand(e) : e.l, p)} ${shift ? '>>' : e.op} ${rec(e.r, p - 1)}`;
+      // Each signedness-carrying pair spells with ONE C token; `pinnedOperands` supplies the
+      // operand cast that says which of the pair it is.
+      const pair = C_SPELLING[e.op];
+      const [l, r] = pair ? pinnedOperands(e, pair.signed, vt) : [e.l, e.r];
+      const s = `${rec(l, p)} ${pair ? pair.token : e.op} ${rec(r, p - 1)}`;
       return p > parentPrec ? `(${s})` : s;
     }
   }
 }
 
-function printStmt(s: Stmt, indent: string, vt: VarTypes, leaf?: LeafHook): string[] {
+function printStmt(s: Stmt, indent: string, vt: PrintEnv, leaf?: LeafHook): string[] {
   const pe = (e: Expr, p: number) => printExpr(e, p, vt, leaf);
   switch (s.k) {
     case 'assign':
@@ -355,8 +362,8 @@ function printStmt(s: Stmt, indent: string, vt: VarTypes, leaf?: LeafHook): stri
       return out;
     }
     case 'for': {
-      // `for (init; cond; inc) { body }`. PRECONDITION (guaranteed by the sole producer, structure.ts
-      // `recognizeForLoops`): init/inc are each a SINGLE-LINE `assign` statement. `clause` renders one
+      // `for (init; cond; inc) { body }`. PRECONDITION (guaranteed by both producers — structure.ts
+      // `recognizeForLoops` and l3/reindex.ts): init/inc are each a SINGLE-LINE `assign` statement. `clause` renders one
       // and strips its trailing `;` so it sits inside the header (`i = 0; c; i = i + 1`). A multi-line
       // statement (an `if`/nested loop) would render mangled — but the recognizer never builds one here.
       const clause = (st: Stmt) => printStmt(st, '', vt, leaf).join(' ').replace(/;\s*$/, '').trim();
@@ -371,36 +378,98 @@ function printStmt(s: Stmt, indent: string, vt: VarTypes, leaf?: LeafHook): stri
       return [`${indent}break;`];
     case 'continue':
       return [`${indent}continue;`];
-    case 'switch': {
-      const out = [`${indent}switch (${pe(s.scrutinee, 99)}) {`];
-      const ci = indent + '    '; // case-label indent
-      const bi = indent + '        '; // case-body indent
-      for (const c of s.cases) {
-        for (const v of c.values) {
-          out.push(`${ci}case ${v}:`);
-        }
-        for (const t of c.body) {
-          out.push(...printStmt(t, bi, vt, leaf));
-        }
-        // A case whose body ends in `return`/`break` (a terminated arm) needs no `break;`; only an
-        // open non-fall-through arm gets one. `fallsThrough` omits it so control drops to the next case.
-        if (!c.fallsThrough && !endsTerminated(c.body)) {
-          out.push(`${bi}break;`);
-        }
-      }
-      // `?.length`, not just presence: a label with no statement under it is not valid C89, and an
-      // L3 pass (dce, reindex) may empty a default that arrived with statements — the structurer's
-      // own "don't attach an empty default" rule cannot see that.
-      if (s.default?.length) {
-        out.push(`${ci}default:`);
-        for (const t of s.default) {
-          out.push(...printStmt(t, bi, vt, leaf));
-        }
+    case 'switch':
+      return printSwitchStmt(s, indent, vt, leaf);
+  }
+}
+
+/** A C `switch`: the arm bodies, the `default:` label's position among them, and the three
+ *  producer-contract refusals that stand between an L3 `switch` node and valid C. Its own function
+ *  because it is the one statement kind whose printing is a program of its own; `printStmt`'s arm
+ *  is one call. */
+function printSwitchStmt(s: Extract<Stmt, { k: 'switch' }>, indent: string, vt: PrintEnv, leaf?: LeafHook): string[] {
+  const pe = (e: Expr, p: number) => printExpr(e, p, vt, leaf);
+  // A `break;` in an arm BODY is the innermost LOOP's in L3 (l3/ast.ts) and the SWITCH's in C,
+  // so printing one between `case` labels rebinds it — a changed program that reads as ordinary
+  // C. Refused HERE because the rebinding is the printer's, for every producer rather than for
+  // the two switch regimes. No recovery reaches it today (both regimes decline a loop-exiting
+  // arm first, loudly), so it is a contract on the next one.
+  //
+  // `continue;` is deliberately NOT refused: C binds it to the smallest enclosing ITERATION
+  // statement, which a `switch` is not, so it already means what L3 means. What a loop-respelling
+  // pass must preserve is exactly that — the three that can re-spell a loop into one whose
+  // `continue` would run a different increment (`recognizeForLoops` in structure.ts,
+  // `respellCountdown` in l3/reindex.ts, and l3/unreduce.ts) each scan switch arms for the node
+  // before firing, and a fourth must too.
+  for (const body of [...s.cases.map((c) => c.body), s.default ?? []]) {
+    if (switchBoundBreakIn(body)) {
+      throw new Error('c backend: a switch arm carries a loop-scoped `break;`, which C would bind to the switch');
+    }
+  }
+  const out = [`${indent}switch (${pe(s.scrutinee, 99)}) {`];
+  const ci = indent + '    '; // case-label indent
+  const bi = indent + '        '; // case-body indent
+  // `?.length`, not just presence: a label with no statement under it is not valid C89, and an
+  // L3 pass (dce, reindex) may empty a default that arrived with statements — the structurer's
+  // own "don't attach an empty default" rule cannot see that.
+  const hasDefault = !!s.default?.length;
+  // Where the `default:` label goes, as a COUNT of case arms before it (l3/ast.ts): absent ⇒
+  // after all of them. A count past the arms matches no position at all and the label would
+  // simply not be printed — the default arm vanishing from a switch that has one — so a
+  // producer that hands one over fails loud, like the falling-arm placement below.
+  const defAt = hasDefault ? (s.defaultAt ?? s.cases.length) : -1;
+  if (hasDefault && (defAt < 0 || defAt > s.cases.length)) {
+    throw new Error(`c backend: a switch places its default at arm ${defAt} of ${s.cases.length}`);
+  }
+  const printDefault = (): void => {
+    out.push(`${ci}default:`);
+    for (const t of s.default!) {
+      out.push(...printStmt(t, bi, vt, leaf));
+    }
+    // A default that is NOT last would otherwise fall into the case below it — the mirror of the
+    // rule for cases. The last one needs no `break;` because there is nothing under it.
+    if (defAt < s.cases.length && !endsTerminated(s.default!)) {
+      out.push(`${bi}break;`);
+    }
+  };
+  s.cases.forEach((c, i) => {
+    if (i === defAt) {
+      // Moving the label in FRONT of a falling arm would divert that arm into the default —
+      // a silent control-flow change. Recovery only positions a default among closed arms, so
+      // this is a producer bug rather than an input shape: fail loud.
+      if (i > 0 && s.cases[i - 1].fallsThrough) {
+        throw new Error(
+          `c backend: a switch places its default after a case that falls through, which would divert it`,
+        );
       }
-      out.push(`${indent}}`);
-      return out;
+      printDefault();
+    }
+    for (const v of c.values) {
+      out.push(`${ci}case ${v}:`);
+    }
+    for (const t of c.body) {
+      out.push(...printStmt(t, bi, vt, leaf));
     }
+    // A case whose body ends in `return`/`break` (a terminated arm) needs no `break;`; only an
+    // open non-fall-through arm gets one. `fallsThrough` omits it so control drops to the next case.
+    if (!c.fallsThrough && !endsTerminated(c.body)) {
+      out.push(`${bi}break;`);
+    }
+  });
+  if (defAt === s.cases.length) {
+    printDefault();
   }
+  out.push(`${indent}}`);
+  return out;
+}
+
+/** Does this arm body carry a `break` C would bind to the enclosing SWITCH rather than to the loop
+ *  L3 meant? A loop opened inside the arm captures its own, so its body is not walked; a nested
+ *  `switch` captures one too and is checked when it is printed. */
+function switchBoundBreakIn(body: Stmt[]): boolean {
+  return body.some(
+    (s) => s.k === 'break' || (s.k === 'if' && (switchBoundBreakIn(s.then) || switchBoundBreakIn(s.else))),
+  );
 }
 
 // Does a statement list end in a control-flow terminator (so a trailing `break;` would be dead)?
@@ -415,26 +484,15 @@ function endsTerminated(body: Stmt[]): boolean {
   );
 }
 
-/** The body of a C-family function: local declarations + statements, one string per line. The
- *  SIGNATURE (return type + name + params, plus any C++ scope/`this`/mangling) is the caller's —
- *  that is the language-divergent part each backend owns. */
 // C-FAMILY WRITE LEGALIZATION (the assign-side sibling of the deref legalization in printExpr):
-// a value whose rendered C type is definitely NON-pointer written into a pointer-declared slot
-// (`v2 = a1 + v0` with `v2: u8 *`; `return a0 + v0` from a ptr-returning fn; `*pp = intexpr`
-// through a pointer-element slot) is an ERROR on mwcc (gcc merely warns) — the honest spelling
-// is the reinterpret cast to the DECLARED type, exactly what the machine's register move does.
-// Unknowable renderings (calls) are left alone: their C type comes from prototypes outside this
-// function. (A rebuilding transform with per-kind semantics — its own switch, per the l3/ast.ts
+// the C family's answer to `writesNonPointerIntoPointer` is the reinterpret cast to the DECLARED
+// type — exactly what the machine's register move does — where Pascal, having no such cast,
+// declines. (A rebuilding transform with per-kind semantics — its own switch, per the l3/ast.ts
 // traversal-vocabulary exemption.)
 function legalizePointerWrites(fn: SFn): SFn {
   const vt = declaredTypes(fn);
-  const castTo = (t: IrType | undefined, e: Expr): Expr => {
-    if (t?.kind !== 'ptr') {
-      return e;
-    }
-    const ct = exprCType(e, vt);
-    return ct && ct.kind !== 'ptr' && ct.kind !== 'array' ? { k: 'cast', to: t, e } : e;
-  };
+  const castTo = (t: IrType | undefined, e: Expr): Expr =>
+    writesNonPointerIntoPointer(t, e, vt) ? { k: 'cast', to: t, e } : e;
   const fix = (s: Stmt): Stmt => {
     switch (s.k) {
       case 'assign':
@@ -466,14 +524,23 @@ function legalizePointerWrites(fn: SFn): SFn {
   return { ...fn, body: fn.body.map(fix) };
 }
 
+/** The body of a C-family function: local declarations + statements, one string per line. The
+ *  SIGNATURE (return type + name + params, plus any C++ scope/`this`/mangling) is the caller's —
+ *  that is the language-divergent part each backend owns. */
 function cFamilyBody(fn0: SFn, leaf?: LeafHook): string[] {
   const fn = legalizePointerWrites(fn0);
-  // The legalization env: every printed var's declared type, from the SAME params/locals the
-  // emitted declarations come from — so the printer judges exactly the C the reader will see.
-  const vt: VarTypes = declaredTypes(fn);
+  // The legalization env: every printed var's declared type and pointee volatility, from the SAME
+  // params/locals the emitted declarations come from — so the printer judges exactly the C the
+  // reader will see.
+  const vt: PrintEnv = printEnv(fn);
   const lines: string[] = [];
   for (const l of fn.locals) {
-    lines.push(`    ${l.volatile ? 'volatile ' : ''}${cType(l.type)} ${l.name};`);
+    // Both facts render at the PREFIX position, where C's declarator grammar reads them
+    // differently: on a scalar the qualifier binds to the object (`volatile u16 sp0`), on a
+    // pointer declarator to the pointee — the INNERMOST one for a multi-level pointer
+    // (`volatile u16 ** p`). An object-volatile POINTER (`u16 *volatile p`) has no inhabitant —
+    // no lever or recognizer produces one.
+    lines.push(`    ${l.volatile || l.pointeeVolatile ? 'volatile ' : ''}${cType(l.type)} ${l.name};`);
   }
   for (const s of fn.body) {
     lines.push(...printStmt(s, '    ', vt, leaf));
@@ -491,7 +558,11 @@ function structDecls(fn: SFn): string[] {
 }
 
 /** Assemble a full C-family function from a caller-supplied signature line and the shared body. */
-export function emitCFamily(signature: string, fn: SFn, leaf?: LeafHook): string {
+export function emitCFamily(signature: string, fn0: SFn, leaf?: LeafHook): string {
+  // The declaration list is put into the target's own frame order HERE — in the shared C-family
+  // assembler, reached only from `cBackend.emit` and `cppBackend(...).emit`, so both C-family
+  // backends order and no `.emit(` call site does (l3/slotorder.ts says why `emit` owns it).
+  const fn = orderSlotLocals(fn0);
   const decls = structDecls(fn);
   const preamble = decls.length ? decls.join('\n') + '\n' : '';
   return preamble + [`${signature} {`, ...cFamilyBody(fn, leaf), '}'].join('\n') + '\n';

package/src/backend/cpp.ts

@@ -38,6 +38,7 @@ export function cppSymbol(spec: CppFnSpec): string {
 export function cppBackend(spec: CppFnSpec): LanguageBackend {
   return {
     id: 'cpp',
+    spellsSwitchFallthrough: true,
     emit(fn: SFn): string {
       // Map each lifted param var → its C++ meaning: `this` (bare member access) or a named param
       // (a pointer-to-class param uses `->`). A pointer-to-known-class param is a member receiver.

package/src/backend/pascal.ts

@@ -10,7 +10,8 @@
 // Turbo/Delphi/FreePascal.
 import { IrType, typeToString } from '../ir/types';
 import { BinOp, Expr, LanguageBackend, SFn, Stmt } from '../l3/ast';
-import { type VarTypes, declaredTypes, derefStrideOk, exprCType } from '../l3/typing';
+import { orderSlotLocals } from '../l3/slotorder';
+import { type VarTypes, declaredTypes, derefStrideOk, exprCType, writesNonPointerIntoPointer } from '../l3/typing';
 
 // Infix operators IDO Pascal spells directly.
 const OP: Partial<Record<BinOp, string>> = {
@@ -18,6 +19,10 @@ const OP: Partial<Record<BinOp, string>> = {
   // match C's truncated `%` (sign of the DIVIDEND) — verified: `a mod 3` mis-scores against the
   // IDO C `a % 3` codegen. There is no faithful IDO-Pascal spelling of a signed C remainder, so the
   // backend fails LOUD on `%` (below) rather than emit a silently-wrong `mod`. `/`→`div` DOES match.
+  //
+  // And no `/u`/`%u` either, for the same reason `>>>` is absent from BIT_FN below: `div` over this
+  // backend's signed `Integer` is the SIGNED division, so lending it to the unsigned twin would
+  // emit `div` where the machine did `divu`. They reach the loud decline instead.
   '+': '+',
   '-': '-',
   '*': '*',
@@ -95,7 +100,7 @@ function makePrinter(vt: VarTypes) {
           throw new Error(`pascal backend: a multidimensional array access has no IDO Pascal spelling yet`);
         }
         const bt = exprCType(e.base, vt);
-        if ((bt !== undefined && !derefStrideOk(bt, e.width)) || (bt === undefined && e.width !== 4)) {
+        if ((bt !== undefined && !derefStrideOk(bt, e.width, e.signed)) || (bt === undefined && e.width !== 4)) {
           throw new Error(
             `pascal backend: a ${e.width}-byte access through a base of type '${bt ? typeToString(bt) : '<unknowable>'}' has no faithful spelling (no reinterpret cast)`,
           );
@@ -111,7 +116,10 @@ function makePrinter(vt: VarTypes) {
       // Casts have no faithful IDO-Pascal spelling yet — fail LOUD rather than emit silently-wrong
       // source. Tree-level producers reaching here: the width-narrowing idiom casts (agbcc-gated,
       // so never on this path today), structure.ts's STRUCT-pointer casts (unreachable too — the
-      // `field` case above throws first), and intify's `(s32)ptr` legalization (any target).
+      // `field` case above throws first), intify's `(s32)ptr` legalization (any target), and the
+      // byte-pointer walk of a pointer offset by a runtime value (any target, and reachable with no
+      // `field` in the tree — it declines two functions that used to emit here, whose Pascal was
+      // silently walking ELEMENTS where the asm walked bytes).
       // Scalar deref casts never appear in the tree — the index case above owns that judgment.
       case 'cast':
         throw new Error(`pascal backend: cast has no IDO Pascal spelling yet`);
@@ -148,15 +156,13 @@ function makePrinter(vt: VarTypes) {
       stmts.flatMap((x, i) => ps(fnName, x, ind, tl && i === stmts.length - 1));
     switch (s.k) {
       case 'assign': {
-        // The write-side sibling of the index case's deref discipline: Pascal has no reinterpret
-        // cast, so a definitely-non-pointer value assigned into a pointer-declared var (the shape
-        // the C family legalizes with `(u8 *)…`, cfamily.ts legalizePointerWrites) declines LOUD
-        // here instead of failing three stages later in upas.
-        const dt = vt(s.name);
-        const ct = exprCType(s.value, vt);
-        if (dt?.kind === 'ptr' && ct && ct.kind !== 'ptr' && ct.kind !== 'array') {
+        // The write-side sibling of the index case's deref discipline. The C family answers the
+        // same question (l3/typing.ts writesNonPointerIntoPointer) with a reinterpret cast;
+        // Pascal has none, so it declines LOUD here instead of failing three stages later in upas.
+        if (writesNonPointerIntoPointer(vt(s.name), s.value, vt)) {
+          const ct = exprCType(s.value, vt);
           throw new Error(
-            `pascal backend: assigning a ${typeToString(ct)} value into pointer var '${s.name}' has no faithful spelling (no reinterpret cast)`,
+            `pascal backend: assigning a ${ct ? typeToString(ct) : '<unknowable>'} value into pointer var '${s.name}' has no faithful spelling (no reinterpret cast)`,
           );
         }
         return [`${indent}${s.name} := ${pe(s.value)};`];
@@ -263,7 +269,15 @@ function makePrinter(vt: VarTypes) {
 
 export const pascalBackend: LanguageBackend = {
   id: 'pascal',
-  emit(fn: SFn): string {
+  // `case-of` has no fall-through, and this file's `switch` printing loud-fails a `fallsThrough`
+  // arm. Declared so RECOVERY never mints one for this backend: a comparison-tree switch also
+  // spells as plain if-nesting, which Pascal prints, so the choice is between a decompiled
+  // function and a stub.
+  spellsSwitchFallthrough: false,
+  emit(fn0: SFn): string {
+    // The declaration list is put into the target's own frame order HERE, as the C family does it
+    // in its shared assembler — owned by `emit`, never by a `.emit(` call site (l3/slotorder.ts).
+    const fn = orderSlotLocals(fn0);
     // Same env discipline as the C family (cfamily.ts cFamilyBody): the printer judges derefs
     // against the exact declarations it emits.
     const ps = makePrinter(declaredTypes(fn));