@asmlift/core 0.5.0 → 0.7.0

package/src/backend/cfamily.ts

@@ -3,95 +3,41 @@
 // here, `pasType` in the Pascal backend). The empirical fact grounding the sharing: a
 // CodeWarrior member function's BODY is byte-identical to the same C with `this` as an
 // explicit pointer — so the C++ backend reuses this body spelling VERBATIM and owns only its
-// DIVERGENT surface (the mangled/scoped signature, references, `this`). c.ts and cpp.ts
-// consume exactly the exported seam: `emitCFamily` + `cType` + `LeafHook`.
+// DIVERGENT surface (the mangled/scoped signature, references, `this`).
+//
+// THE SEAM, stated as what it means rather than as a list that rots: a C-family backend owns its
+// SIGNATURE LINE and — for C++, whose member access spells differently — a leaf hook. Everything
+// below the signature is this file's: declarations, statements, expressions, precedence, the
+// legalizing casts, and the recovered-struct declaration spelling (which is why that lives here
+// too, shared with the scoring layer's synthesized declarations so the two cannot drift).
 import { IrType, T, scalarTypeForAccess, typeToString } from '../ir/types';
 import { BinOp, Expr, SFn, Stmt, dotBase } from '../l3/ast';
-import { type VarTypes, declaredTypes, derefStrideOk, exprCType } from '../l3/typing';
-
-/**
- * The C SIGNEDNESS a rendered integer expression actually has — `true`/`false`, or `undefined`
- * when it is not determinable here. The deliberate complement to l3/typing's `exprCType`, which is
- * pointer-ness-accurate and reports every integer as `s32` by contract; this models the two C
- * rules that contract omits, integer PROMOTION and the usual arithmetic CONVERSIONS.
- *
- * It lives HERE, in the C-family backend, because it is a model of C's own rules with no meaning
- * for another language — the same reason the cast it feeds is synthesized here rather than in the
- * tower. `exprCType` stays in l3/ because Pascal consults it too.
- *
- * It exists for one question, and the question is byte-load-bearing: C spells both `>>>` and `>>`
- * as `>>` and chooses between them from the left operand's type. A logical shift rendered over a
- * signed expression recompiles to `asr` where the target has `lsr`, and evaluates to a different
- * value. The C-family backend casts the operand whenever this returns anything but the signedness
- * the operator needs, so `undefined` is the safe answer in every case the model does not cover — a
- * redundant cast is codegen-identical, a missing one is a miscompile.
- *
- * Anything narrower than 32 bits promotes to `int` and is therefore SIGNED, whatever it was
- * declared. Pointers, calls and markers are `undefined`.
- */
-function renderedIntSignedness(e: Expr, varType: VarTypes): boolean | undefined {
-  const rec = (x: Expr): boolean | undefined => renderedIntSignedness(x, varType);
-  // an lvalue-ish leaf: its C type is a declaration / an explicit cast / a carried access width
-  const promoted = (t: IrType | undefined): boolean | undefined =>
-    t?.kind !== 'int' ? undefined : t.width < 32 ? true : t.width === 32 ? t.signed : undefined;
-  switch (e.k) {
-    case 'var':
-    case 'cast':
-    case 'index':
-    case 'field':
-      return promoted(exprCType(e, varType));
-    // A decimal literal is `int` when it fits in one; C89 gives a larger one an unsigned type,
-    // which is not the same operand — so it is left undetermined rather than assumed. INT_MIN is
-    // in that larger class despite fitting: the backend prints it as `-2147483648`, which C lexes
-    // as unary minus applied to `2147483648` — a constant too big for `int`, hence unsigned long.
-    case 'const':
-      return e.value > -2147483648 && e.value <= 2147483647 ? true : undefined;
-    // `-x` / `~x` carry the PROMOTED type of the operand; `!x` is `int`.
-    case 'un':
-      return e.op === '!' ? true : rec(e.e);
-    case 'bin': {
-      // Shifts take the type of the LEFT operand alone — the right is promoted independently.
-      if (e.op === '<<' || e.op === '>>' || e.op === '>>>') {
-        return rec(e.l);
-      }
-      // Comparisons and the logical connectives yield `int`.
-      if (['<', '<=', '>', '>=', '==', '!=', '&&', '||'].includes(e.op)) {
-        return true;
-      }
-      // Usual arithmetic conversions over the remaining binary operators: at equal rank, unsigned
-      // wins. Either side unknown leaves the result unknown — EXCEPT when the known side is
-      // unsigned, which already decides it.
-      //
-      // That exception is the one place this returns a DEFINITE answer from an unknown operand,
-      // and it is sound only because every integer here is rank `int`: at UNEQUAL rank C converts
-      // to the wider type first, so `unsigned int & long long` is SIGNED. Core has no 64-bit
-      // integer type at all (the decomp typedef vocabulary stops at 32 — see contracts.ts
-      // SCALAR_WIDTHS), so the unequal-rank case cannot arise. Adding one would invalidate this.
-      const l = rec(e.l);
-      const r = rec(e.r);
-      if (l === false || r === false) {
-        return false;
-      }
-      return l === true && r === true ? true : undefined;
-    }
-    case 'call':
-    case 'marker':
-    case 'addr':
-      return undefined;
-  }
-}
+import { orderSlotLocals } from '../l3/slotorder';
+import {
+  type PrintEnv,
+  arithConversionSignedness,
+  assertsVolatile,
+  declaredTypes,
+  derefStrideOk,
+  exprCType,
+  printEnv,
+  renderedIntSignedness,
+  writesNonPointerIntoPointer,
+} from '../l3/typing';
 
 // C operator precedence (lower binds tighter). Used to emit MINIMAL parentheses. Shared: C++ has
 // the same precedence for these operators.
 const PREC: Record<BinOp, number> = {
   '*': 3,
   '/': 3,
+  '/u': 3, // the unsigned twins spell as C's `/` and `%` (see C_SPELLING) — same precedence
   '%': 3,
+  '%u': 3,
   '+': 4,
   '-': 4,
   '<<': 5,
   '>>': 5,
-  '>>>': 5, // spells as C's `>>` (see printExpr's shift rule) — same precedence
+  '>>>': 5, // spells as C's `>>` — same precedence
   '<': 6,
   '<=': 6,
   '>': 6,
@@ -105,6 +51,19 @@ const PREC: Record<BinOp, number> = {
   '||': 12,
 };
 
+/** The signedness-carrying operator pairs and the ONE C token each pair shares (l3/ast.ts BinOp).
+ *  Membership here is what makes an operator's operands get pinned; every other operator prints
+ *  its own symbol and needs no cast, because C's own rules for it are sign-blind or already
+ *  agree. */
+const C_SPELLING: Partial<Record<BinOp, { token: string; signed: boolean }>> = {
+  '>>': { token: '>>', signed: true },
+  '>>>': { token: '>>', signed: false },
+  '/': { token: '/', signed: true },
+  '/u': { token: '/', signed: false },
+  '%': { token: '%', signed: true },
+  '%u': { token: '%', signed: false },
+};
+
 /** Spell a recovered type in the decomp C-family typedef vocabulary (`s32`/`u32`/`u8`/`T *`). */
 export function cType(t: IrType): string {
   if (t.kind === 'ptr') {
@@ -121,10 +80,18 @@ export function cType(t: IrType): string {
 
 /** Declare a name of a given type, C declarator rules: an array puts its length AFTER the name
  *  (`u8 _pad[4]`), a pointer binds its `*` to the declarator (`void *p`), everything else is
- *  the prefix `cType name`. */
+ *  the prefix `cType name`. A NESTED array spells every extent after the name in declaration
+ *  order (`u8 unk8[6][8]`) — one declarator, not an element type that is itself an array, which
+ *  C has no syntax for and `cType` marks ill-formed as a prefix. */
 function cDeclare(t: IrType, name: string): string {
   if (t.kind === 'array') {
-    return `${cType(t.elem)} ${name}[${t.count}]`;
+    const extents: number[] = [];
+    let e: IrType = t;
+    while (e.kind === 'array') {
+      extents.push(e.count);
+      e = e.elem;
+    }
+    return `${cType(e)} ${name}${extents.map((n) => `[${n}]`).join('')}`;
   }
   if (t.kind === 'ptr') {
     return `${cType(t.to)} *${name}`;
@@ -163,7 +130,92 @@ export function renderStructDecl(name: string, fields: StructFieldDecl[]): strin
 // backend uses. The default (no hook) is byte-identical C.
 export type LeafHook = (e: Expr, rec: (e: Expr, p: number) => string) => string | null;
 
-function printExpr(e: Expr, parentPrec: number, vt: VarTypes, leaf?: LeafHook): string {
+/** C-FAMILY LEGALIZATION (owned here, per the width-carrying `index` node contract in l3/ast.ts):
+ *  the BASE an `index` node prints through — a deref whose base does not render as a pointer/array
+ *  STRIDING the access width is spelled through the honest reinterpret cast at that width, the
+ *  machine semantics of the access. Materialized as a synthetic cast node so the spelling (text,
+ *  precedence, parens) is exactly that of a tree-level cast, and returns the base UNCHANGED (===)
+ *  when no cast is needed, which is what the multidimensional guard tests.
+ *
+ *  AND IT CARRIES THE QUALIFIER. In C the access takes the OUTER type, so a plain cast over a
+ *  base the tree declared volatile spells an MMIO access the compiler may CSE, reorder or drop —
+ *  `((s32 *)(volatile u16 *)0x4000208)[i]` reads once where `((volatile s32 *)0x4000208)[i]`
+ *  reads twice (agbcc 2.9-arm-000512, `-O2 -mthumb-interwork -Wimplicit -fhex-asm
+ *  -fprologue-bugfix`), and referring to a volatile object through a non-volatile lvalue is
+ *  undefined behaviour (C99 6.7.3p5). */
+function legalizedIndexBase(ix: Extract<Expr, { k: 'index' }>, vt: PrintEnv): Expr {
+  // `baseElem` states the element type the base's own DECLARATION gives it, where the type walk
+  // cannot reconstruct one (a map-declared array MEMBER — see l3/ast.ts). It is a FALLBACK, not an
+  // override, and the order is the whole guard: the walk reads the tree in front of it, so
+  // wherever it answers at all it is the better answer and the stated one is not consulted.
+  // Inverted (`declared ?? walked`), a stale statement would stand — `derefStrideOk` cannot catch
+  // one, because it tests the STATED type against the access width and never against the base.
+  // No pass carries a statement onto a foreign base today (each refuses a `field` base by its own
+  // predicate: basecse `isHoistableBase`, scopebase/argbase `eligible`, nearbase's untouched
+  // `field` subtree, reindex's `base.k === 'var'`), but `mapExprChildren` spreads the field across
+  // an arbitrary base substitution, so that is five accidents rather than a check. This ordering
+  // is the check. Measured: zero test moves either way.
+  const declared = ix.baseElem !== undefined ? T.ptr(ix.baseElem) : undefined;
+  return derefStrideOk(exprCType(ix.base, vt.type) ?? declared, ix.width, ix.signed)
+    ? ix.base
+    : {
+        k: 'cast',
+        to: T.ptr(scalarTypeForAccess(ix.width, ix.signed)),
+        ...(assertsVolatile(ix.base, vt) ? { volatile: true as const } : {}),
+        e: ix.base,
+      };
+}
+
+/** The 32-bit integer cast that PINS an operand's signedness.
+ *
+ *  An existing 32-bit integer cast is REPLACED rather than wrapped — `(u32)(s32)&g` and `(u32)&g`
+ *  are the same bytes, and the arithmetic rules upstream do emit that inner cast (intifyAddr).
+ *  The replacement CARRIES the qualifier: re-typing a `volatile` cast without it drops an
+ *  assertion the differ cannot referee the loss of, which is why l3/initfirst.ts's
+ *  `stripWideIntCast` refuses the same peel one pass over. */
+function recast32(x: Expr, signed: boolean): Expr {
+  const replaced = x.k === 'cast' && x.to.kind === 'int' && x.to.width === 32 ? x : undefined;
+  return {
+    k: 'cast',
+    to: T.int(32, signed),
+    ...(replaced?.volatile === true ? { volatile: true as const } : {}),
+    e: replaced ? replaced.e : x,
+  };
+}
+
+/** C-FAMILY OPERAND-SIGNEDNESS LEGALIZATION, the same discipline as the deref cast one operator
+ *  over. The tower keeps the signedness-carrying pairs apart (`>>>` logical / `>>` arithmetic,
+ *  `/u` `%u` unsigned / `/` `%` signed); C spells each pair with ONE token and picks between them
+ *  from the operand types. So the operands must be made to carry the choice, or an `shr_u`
+ *  recompiles to `asr` where the target has `lsr` AND evaluates differently
+ *  (`*(u8 *)&g << 30 >> 30` promotes to `int`, so a 2-bit field holding 2 comes out -1), and a
+ *  `udiv` calls `__divsi3` where the target called `__udivsi3`.
+ *
+ *  (engine.ts's zext fold covers the same hazard for widths C can NAME, by folding the whole
+ *  shift pair to a cast op. Every other extract width — every bitfield read — lands here.)
+ *
+ *  A SHIFT and a DIVIDE read their operands differently, so the pin does too. A SHIFT takes the
+ *  type of its left operand alone, and the cast goes on unless that operand PROVABLY renders as
+ *  the op needs (renderedIntSignedness's header carries the rule for reading `undefined`).
+ *
+ *  A DIVIDE takes the usual arithmetic conversions over BOTH operands, where unsigned wins at
+ *  equal rank, so the question is what the PAIR renders as. Once the pair renders wrong the two
+ *  directions cost differently: unsigned takes ONE cast, which carries the whole operation, while
+ *  signed has to pin EVERY operand short of a proof, because one unsigned side is enough to make
+ *  the division unsigned. Verified by compiling: `((u32)a / b) / 7` calls `__udivsi3` twice,
+ *  `(s32)((u32)a / b) / 7` calls `__udivsi3` then `__divsi3`. */
+function pinnedOperands(e0: Extract<Expr, { k: 'bin' }>, wantSigned: boolean, vt: PrintEnv): [Expr, Expr] {
+  if (e0.op === '>>' || e0.op === '>>>') {
+    return [renderedIntSignedness(e0.l, vt.type) === wantSigned ? e0.l : recast32(e0.l, wantSigned), e0.r];
+  }
+  if (arithConversionSignedness(e0.l, e0.r, vt.type) === wantSigned) {
+    return [e0.l, e0.r];
+  }
+  const pinSigned = (x: Expr): Expr => (renderedIntSignedness(x, vt.type) === true ? x : recast32(x, true));
+  return wantSigned ? [pinSigned(e0.l), pinSigned(e0.r)] : [recast32(e0.l, false), e0.r];
+}
+
+function printExpr(e: Expr, parentPrec: number, vt: PrintEnv, leaf?: LeafHook): string {
   const rec = (x: Expr, p: number) => printExpr(x, p, vt, leaf);
   if (leaf) {
     const s = leaf(e, rec);
@@ -171,37 +223,6 @@ function printExpr(e: Expr, parentPrec: number, vt: VarTypes, leaf?: LeafHook):
       return s;
     }
   }
-  // C-FAMILY LEGALIZATION (owned here, per the width-carrying `index` node contract in l3/ast.ts):
-  // a deref whose base does not render as a pointer/array STRIDING the access width is spelled
-  // through the honest reinterpret cast at that width — the machine semantics of the access.
-  // Materialized as a synthetic cast node so the spelling (text, precedence, parens) is exactly
-  // that of a tree-level cast.
-  const legalized = (ix: Extract<Expr, { k: 'index' }>): Expr =>
-    derefStrideOk(exprCType(ix.base, vt), ix.width)
-      ? ix.base
-      : { k: 'cast', to: T.ptr(scalarTypeForAccess(ix.width, ix.signed)), e: ix.base };
-  // C-FAMILY SHIFT LEGALIZATION, the same discipline one operator over. The tower keeps the two
-  // right shifts apart (`>>>` logical, `>>` arithmetic); C spells BOTH `>>` and picks between them
-  // from the LEFT OPERAND'S TYPE. So the operand must be made to carry the choice, or an `shr_u`
-  // recompiles to `asr` where the target has `lsr` AND evaluates differently —
-  // `*(u8 *)&g << 30 >> 30` promotes to `int`, so a 2-bit field holding 2 comes out -1.
-  //
-  // (engine.ts's zext fold covers the same hazard for widths C can NAME, by folding the whole
-  // shift pair to a cast op. Every other extract width — every bitfield read — lands here.)
-  //
-  // The cast is added unless the operand PROVABLY renders with the signedness the op needs:
-  // renderedIntSignedness answers `undefined` wherever its model does not reach, and a redundant
-  // cast is codegen-identical while a missing one is a miscompile. An existing 32-bit integer cast
-  // is REPLACED rather than wrapped — `(u32)(s32)&g` and `(u32)&g` are the same bytes, and the
-  // arithmetic rules upstream do emit that inner cast (intifyAddr).
-  const shiftOperand = (e0: Extract<Expr, { k: 'bin' }>): Expr => {
-    const wantSigned = e0.op === '>>';
-    if (renderedIntSignedness(e0.l, vt) === wantSigned) {
-      return e0.l;
-    }
-    const inner = e0.l.k === 'cast' && e0.l.to.kind === 'int' && e0.l.to.width === 32 ? e0.l.e : e0.l;
-    return { k: 'cast', to: T.int(32, wantSigned), e: inner };
-  };
   switch (e.k) {
     case 'var':
       return e.name;
@@ -221,21 +242,30 @@ function printExpr(e: Expr, parentPrec: number, vt: VarTypes, leaf?: LeafHook):
       // `(*p)[1]`, never `*p[1]` which C groups as `*(p[1])`), `base[idx]` otherwise (POSTFIX —
       // binds tighter than any prefix operator, so a cast/unary/deref base is printed at prec 1
       // and parenthesizes itself: `((u8 *)p)[1]`). The postfix form needs no outer parentheses.
-      const base = legalized(e);
+      const base = legalizedIndexBase(e, vt);
       // Leading constant subscripts (a multidimensional array global's bare spelling) keep the
       // postfix form whatever `idx` is: `g[0][0]` is the element, `*g[0]` would be its ROW.
       //
-      // `lead` implies the base already strides the access width — its only producer registers a
-      // matching element type for the global (structure.ts bareArrayLead + noteGlobal). Nothing
-      // else enforced that, and the failure would be quiet-ish: legalization would wrap the base,
-      // spelling `((u16 *)g)[0][i]`, which subscripts a `u16` twice. Check it rather than assume.
+      // `lead` implies the base already strides the access width, and its producers reach that by
+      // TWO different mechanisms. The two GLOBAL ones register a matching element type for the
+      // global (structure/globalaccess.ts `bareArrayLead` and `declaredSubscripts`, both through
+      // structure.ts's `noteGlobal`, so the type walk finds it); the MEMBER one
+      // (structure.ts `pointeeElement`, `gPtr->grid[0][i]`) has no global to register and states
+      // the element type on the node instead (`baseElem`). Nothing else enforced either, and the
+      // failure would be quiet-ish: legalization would wrap the base, spelling `((u16 *)g)[0][i]`,
+      // which subscripts a `u16` twice. Check it rather than assume.
+      //
+      // This throw covers rank >= 2 ONLY, because only a rank >= 2 access carries `lead`. A rank-1
+      // member (the large majority of the corpus's dims-carrying members) has no guard here: a
+      // missing or stale `baseElem` there degrades silently to the cast form the rule replaces,
+      // which is a lost spelling rather than a wrong address.
       if (e.lead && e.lead.length > 0) {
         if (base !== e.base) {
           throw new Error(
             `c backend: a multidimensional array access needs a base that strides ${e.width} bytes as spelled`,
           );
         }
-        return `${rec(base, 1)}${e.lead.map((l) => `[${l}]`).join('')}[${rec(e.idx, 99)}]`;
+        return `${rec(base, 1)}${e.lead.map((l) => `[${rec(l, 99)}]`).join('')}[${rec(e.idx, 99)}]`;
       }
       if (e.idx.k === 'const' && e.idx.value === 0) {
         const s = `*${rec(base, 2)}`;
@@ -289,20 +319,25 @@ function printExpr(e: Expr, parentPrec: number, vt: VarTypes, leaf?: LeafHook):
     // op. Under a POSTFIX parent ([]/->) the cast itself must parenthesize — `((struct S *)p)->f`,
     // NOT `(struct S *)p->f` (which C parses as a cast OF the member access).
     case 'cast': {
-      const s = `(${cType(e.to)})${rec(e.e, 2)}`;
+      // `volatile` binds to the POINTEE (`(volatile u16 *)a`), which is where the qualifier goes
+      // on a raw-address access — the same prefix position the declaration printer uses for a
+      // pointer local's `pointeeVolatile`.
+      const s = `(${e.volatile ? 'volatile ' : ''}${cType(e.to)})${rec(e.e, 2)}`;
       return parentPrec < 2 ? `(${s})` : s;
     }
     case 'bin': {
       const p = PREC[e.op];
-      // Both right shifts spell C's `>>`; `shiftOperand` supplies the operand cast that says which.
-      const shift = e.op === '>>' || e.op === '>>>';
-      const s = `${rec(shift ? shiftOperand(e) : e.l, p)} ${shift ? '>>' : e.op} ${rec(e.r, p - 1)}`;
+      // Each signedness-carrying pair spells with ONE C token; `pinnedOperands` supplies the
+      // operand cast that says which of the pair it is.
+      const pair = C_SPELLING[e.op];
+      const [l, r] = pair ? pinnedOperands(e, pair.signed, vt) : [e.l, e.r];
+      const s = `${rec(l, p)} ${pair ? pair.token : e.op} ${rec(r, p - 1)}`;
       return p > parentPrec ? `(${s})` : s;
     }
   }
 }
 
-function printStmt(s: Stmt, indent: string, vt: VarTypes, leaf?: LeafHook): string[] {
+function printStmt(s: Stmt, indent: string, vt: PrintEnv, leaf?: LeafHook): string[] {
   const pe = (e: Expr, p: number) => printExpr(e, p, vt, leaf);
   switch (s.k) {
     case 'assign':
@@ -355,8 +390,8 @@ function printStmt(s: Stmt, indent: string, vt: VarTypes, leaf?: LeafHook): stri
       return out;
     }
     case 'for': {
-      // `for (init; cond; inc) { body }`. PRECONDITION (guaranteed by the sole producer, structure.ts
-      // `recognizeForLoops`): init/inc are each a SINGLE-LINE `assign` statement. `clause` renders one
+      // `for (init; cond; inc) { body }`. PRECONDITION (guaranteed by both producers — structure.ts
+      // `recognizeForLoops` and l3/reindex.ts): init/inc are each a SINGLE-LINE `assign` statement. `clause` renders one
       // and strips its trailing `;` so it sits inside the header (`i = 0; c; i = i + 1`). A multi-line
       // statement (an `if`/nested loop) would render mangled — but the recognizer never builds one here.
       const clause = (st: Stmt) => printStmt(st, '', vt, leaf).join(' ').replace(/;\s*$/, '').trim();
@@ -371,36 +406,98 @@ function printStmt(s: Stmt, indent: string, vt: VarTypes, leaf?: LeafHook): stri
       return [`${indent}break;`];
     case 'continue':
       return [`${indent}continue;`];
-    case 'switch': {
-      const out = [`${indent}switch (${pe(s.scrutinee, 99)}) {`];
-      const ci = indent + '    '; // case-label indent
-      const bi = indent + '        '; // case-body indent
-      for (const c of s.cases) {
-        for (const v of c.values) {
-          out.push(`${ci}case ${v}:`);
-        }
-        for (const t of c.body) {
-          out.push(...printStmt(t, bi, vt, leaf));
-        }
-        // A case whose body ends in `return`/`break` (a terminated arm) needs no `break;`; only an
-        // open non-fall-through arm gets one. `fallsThrough` omits it so control drops to the next case.
-        if (!c.fallsThrough && !endsTerminated(c.body)) {
-          out.push(`${bi}break;`);
-        }
-      }
-      // `?.length`, not just presence: a label with no statement under it is not valid C89, and an
-      // L3 pass (dce, reindex) may empty a default that arrived with statements — the structurer's
-      // own "don't attach an empty default" rule cannot see that.
-      if (s.default?.length) {
-        out.push(`${ci}default:`);
-        for (const t of s.default) {
-          out.push(...printStmt(t, bi, vt, leaf));
-        }
+    case 'switch':
+      return printSwitchStmt(s, indent, vt, leaf);
+  }
+}
+
+/** A C `switch`: the arm bodies, the `default:` label's position among them, and the three
+ *  producer-contract refusals that stand between an L3 `switch` node and valid C. Its own function
+ *  because it is the one statement kind whose printing is a program of its own; `printStmt`'s arm
+ *  is one call. */
+function printSwitchStmt(s: Extract<Stmt, { k: 'switch' }>, indent: string, vt: PrintEnv, leaf?: LeafHook): string[] {
+  const pe = (e: Expr, p: number) => printExpr(e, p, vt, leaf);
+  // A `break;` in an arm BODY is the innermost LOOP's in L3 (l3/ast.ts) and the SWITCH's in C,
+  // so printing one between `case` labels rebinds it — a changed program that reads as ordinary
+  // C. Refused HERE because the rebinding is the printer's, for every producer rather than for
+  // the two switch regimes. No recovery reaches it today (both regimes decline a loop-exiting
+  // arm first, loudly), so it is a contract on the next one.
+  //
+  // `continue;` is deliberately NOT refused: C binds it to the smallest enclosing ITERATION
+  // statement, which a `switch` is not, so it already means what L3 means. What a pass that re-spells
+  // a loop must preserve is exactly that — the three that can re-spell a loop into one whose
+  // `continue` would run a different increment (`recognizeForLoops` in structure.ts,
+  // `respellCountdown` in l3/reindex.ts, and l3/unreduce.ts) each scan switch arms for the node
+  // before firing, and a fourth must too.
+  for (const body of [...s.cases.map((c) => c.body), s.default ?? []]) {
+    if (switchBoundBreakIn(body)) {
+      throw new Error('c backend: a switch arm carries a loop-scoped `break;`, which C would bind to the switch');
+    }
+  }
+  const out = [`${indent}switch (${pe(s.scrutinee, 99)}) {`];
+  const ci = indent + '    '; // case-label indent
+  const bi = indent + '        '; // case-body indent
+  // `?.length`, not just presence: a label with no statement under it is not valid C89, and an
+  // L3 pass (dce, reindex) may empty a default that arrived with statements — the structurer's
+  // own "don't attach an empty default" rule cannot see that.
+  const hasDefault = !!s.default?.length;
+  // Where the `default:` label goes, as a COUNT of case arms before it (l3/ast.ts): absent ⇒
+  // after all of them. A count past the arms matches no position at all and the label would
+  // simply not be printed — the default arm vanishing from a switch that has one — so a
+  // producer that hands one over fails loud, like the falling-arm placement below.
+  const defAt = hasDefault ? (s.defaultAt ?? s.cases.length) : -1;
+  if (hasDefault && (defAt < 0 || defAt > s.cases.length)) {
+    throw new Error(`c backend: a switch places its default at arm ${defAt} of ${s.cases.length}`);
+  }
+  const printDefault = (): void => {
+    out.push(`${ci}default:`);
+    for (const t of s.default!) {
+      out.push(...printStmt(t, bi, vt, leaf));
+    }
+    // A default that is NOT last would otherwise fall into the case below it — the mirror of the
+    // rule for cases. The last one needs no `break;` because there is nothing under it.
+    if (defAt < s.cases.length && !endsTerminated(s.default!)) {
+      out.push(`${bi}break;`);
+    }
+  };
+  s.cases.forEach((c, i) => {
+    if (i === defAt) {
+      // Moving the label in FRONT of a falling arm would divert that arm into the default —
+      // a silent control-flow change. Recovery only positions a default among closed arms, so
+      // this is a producer bug rather than an input shape: fail loud.
+      if (i > 0 && s.cases[i - 1].fallsThrough) {
+        throw new Error(
+          `c backend: a switch places its default after a case that falls through, which would divert it`,
+        );
       }
-      out.push(`${indent}}`);
-      return out;
+      printDefault();
+    }
+    for (const v of c.values) {
+      out.push(`${ci}case ${v}:`);
+    }
+    for (const t of c.body) {
+      out.push(...printStmt(t, bi, vt, leaf));
     }
+    // A case whose body ends in `return`/`break` (a terminated arm) needs no `break;`; only an
+    // open non-fall-through arm gets one. `fallsThrough` omits it so control drops to the next case.
+    if (!c.fallsThrough && !endsTerminated(c.body)) {
+      out.push(`${bi}break;`);
+    }
+  });
+  if (defAt === s.cases.length) {
+    printDefault();
   }
+  out.push(`${indent}}`);
+  return out;
+}
+
+/** Does this arm body carry a `break` C would bind to the enclosing SWITCH rather than to the loop
+ *  L3 meant? A loop opened inside the arm captures its own, so its body is not walked; a nested
+ *  `switch` captures one too and is checked when it is printed. */
+function switchBoundBreakIn(body: Stmt[]): boolean {
+  return body.some(
+    (s) => s.k === 'break' || (s.k === 'if' && (switchBoundBreakIn(s.then) || switchBoundBreakIn(s.else))),
+  );
 }
 
 // Does a statement list end in a control-flow terminator (so a trailing `break;` would be dead)?
@@ -415,26 +512,15 @@ function endsTerminated(body: Stmt[]): boolean {
   );
 }
 
-/** The body of a C-family function: local declarations + statements, one string per line. The
- *  SIGNATURE (return type + name + params, plus any C++ scope/`this`/mangling) is the caller's —
- *  that is the language-divergent part each backend owns. */
 // C-FAMILY WRITE LEGALIZATION (the assign-side sibling of the deref legalization in printExpr):
-// a value whose rendered C type is definitely NON-pointer written into a pointer-declared slot
-// (`v2 = a1 + v0` with `v2: u8 *`; `return a0 + v0` from a ptr-returning fn; `*pp = intexpr`
-// through a pointer-element slot) is an ERROR on mwcc (gcc merely warns) — the honest spelling
-// is the reinterpret cast to the DECLARED type, exactly what the machine's register move does.
-// Unknowable renderings (calls) are left alone: their C type comes from prototypes outside this
-// function. (A rebuilding transform with per-kind semantics — its own switch, per the l3/ast.ts
+// the C family's answer to `writesNonPointerIntoPointer` is the reinterpret cast to the DECLARED
+// type — exactly what the machine's register move does — where Pascal, having no such cast,
+// declines. (A rebuilding transform with per-kind semantics — its own switch, per the l3/ast.ts
 // traversal-vocabulary exemption.)
 function legalizePointerWrites(fn: SFn): SFn {
   const vt = declaredTypes(fn);
-  const castTo = (t: IrType | undefined, e: Expr): Expr => {
-    if (t?.kind !== 'ptr') {
-      return e;
-    }
-    const ct = exprCType(e, vt);
-    return ct && ct.kind !== 'ptr' && ct.kind !== 'array' ? { k: 'cast', to: t, e } : e;
-  };
+  const castTo = (t: IrType | undefined, e: Expr): Expr =>
+    writesNonPointerIntoPointer(t, e, vt) ? { k: 'cast', to: t, e } : e;
   const fix = (s: Stmt): Stmt => {
     switch (s.k) {
       case 'assign':
@@ -466,14 +552,23 @@ function legalizePointerWrites(fn: SFn): SFn {
   return { ...fn, body: fn.body.map(fix) };
 }
 
+/** The body of a C-family function: local declarations + statements, one string per line. The
+ *  SIGNATURE (return type + name + params, plus any C++ scope/`this`/mangling) is the caller's —
+ *  that is the language-divergent part each backend owns. */
 function cFamilyBody(fn0: SFn, leaf?: LeafHook): string[] {
   const fn = legalizePointerWrites(fn0);
-  // The legalization env: every printed var's declared type, from the SAME params/locals the
-  // emitted declarations come from — so the printer judges exactly the C the reader will see.
-  const vt: VarTypes = declaredTypes(fn);
+  // The legalization env: every printed var's declared type and pointee volatility, from the SAME
+  // params/locals the emitted declarations come from — so the printer judges exactly the C the
+  // reader will see.
+  const vt: PrintEnv = printEnv(fn);
   const lines: string[] = [];
   for (const l of fn.locals) {
-    lines.push(`    ${l.volatile ? 'volatile ' : ''}${cType(l.type)} ${l.name};`);
+    // Both facts render at the PREFIX position, where C's declarator grammar reads them
+    // differently: on a scalar the qualifier binds to the object (`volatile u16 sp0`), on a
+    // pointer declarator to the pointee — the INNERMOST one for a multi-level pointer
+    // (`volatile u16 ** p`). An object-volatile POINTER (`u16 *volatile p`) has no inhabitant —
+    // no variation or recognizer produces one.
+    lines.push(`    ${l.volatile || l.pointeeVolatile ? 'volatile ' : ''}${cType(l.type)} ${l.name};`);
   }
   for (const s of fn.body) {
     lines.push(...printStmt(s, '    ', vt, leaf));
@@ -491,7 +586,11 @@ function structDecls(fn: SFn): string[] {
 }
 
 /** Assemble a full C-family function from a caller-supplied signature line and the shared body. */
-export function emitCFamily(signature: string, fn: SFn, leaf?: LeafHook): string {
+export function emitCFamily(signature: string, fn0: SFn, leaf?: LeafHook): string {
+  // The declaration list is put into the target's own frame order HERE — in the shared C-family
+  // assembler, reached only from `cBackend.emit` and `cppBackend(...).emit`, so both C-family
+  // backends order and no `.emit(` call site does (l3/slotorder.ts says why `emit` owns it).
+  const fn = orderSlotLocals(fn0);
   const decls = structDecls(fn);
   const preamble = decls.length ? decls.join('\n') + '\n' : '';
   return preamble + [`${signature} {`, ...cFamilyBody(fn, leaf), '}'].join('\n') + '\n';

package/src/backend/cpp.ts

@@ -38,6 +38,7 @@ export function cppSymbol(spec: CppFnSpec): string {
 export function cppBackend(spec: CppFnSpec): LanguageBackend {
   return {
     id: 'cpp',
+    spellsSwitchFallthrough: true,
     emit(fn: SFn): string {
       // Map each lifted param var → its C++ meaning: `this` (bare member access) or a named param
       // (a pointer-to-class param uses `->`). A pointer-to-known-class param is a member receiver.