@asmlift/core 0.6.0 → 0.8.0

package/README.md

@@ -15,7 +15,8 @@ The operative invariant everywhere: **loud decline > silent miscompile**. Where
 cannot be byte-faithful it throws a typed error (strict mode) or emits an `ASMLIFT_ERROR`-marked
 stub (`onGap: "annotate"`) — never plausible wrong code.
 
-> Not yet published to npm. Inside this repo it resolves via the pnpm workspace.
+> Published as [`@asmlift/core`](https://www.npmjs.com/package/@asmlift/core); inside this repo it
+> resolves through the pnpm workspace.
 
 ## Usage
 
@@ -31,7 +32,10 @@ console.log(source); // s32 my_func(s32 a0) { ... }
 Input is **text**, following what each target's toolchain produces:
 
 - The ARM target reads GBA `.s`, produced by agbcc and pret-style project splits.
-- The MIPS/PPC targets read `objdump -d --no-show-raw-insn` output and Splat-disassembled `.s`.
+- The MIPS targets read `objdump -d --no-show-raw-insn` output and Splat-disassembled `.s`.
+- The PPC target reads `powerpc-eabi-objdump -d -r -M gekko --no-show-raw-insn` output. `-r` carries
+  the relocation lines a `bl`'s callee name lives in, and `-M gekko` names CodeWarrior's machine:
+  the generic dialect decodes the GameCube's paired-single opcodes as POWER VSX.
 
 ### `decompile(name, asm, target, opts?)`
 
@@ -41,9 +45,20 @@ Input is **text**, following what each target's toolchain produces:
 | `patterns`   | Idiom rewrite patterns. Omitted = `DEFAULT_IDIOM_PATTERNS` (self-selects per target: most are compiler-gated, the boolean-negation folds are universal); `[]` = none                                                                                                                                                                                                                   |
 | `prototypes` | Callee arities + void-ness, as a real project takes them from headers — drives call-argument recovery                                                                                                                                                                                                                                                                                  |
 | `asmData`    | Optional `objdump -s -r -t` side-table; required to recover MIPS/PPC jump-table switches                                                                                                                                                                                                                                                                                               |
+| `symbols`    | The project's address→symbol map: names, declaration shapes and signatures for the addresses the assembly only numbers. What each channel buys and how to build the ELF behind it: [`@asmlift/cli`](../cli/README.md#the-symbol-map-elf)                                                                                                                                               |
 | `onGap`      | `"strict"` (default): throw on any gap. `"annotate"`: emit best-effort source with `ASMLIFT_ERROR` markers; every gap is also returned in the structured `diagnostics` array (empty ⇔ gap-free)                                                                                                                                                                                        |
 
-Targets: `ARMV4T_AGBCC`, `MIPS_IDO`, `MIPS_GCC`, `PPC_MWCC` (`@asmlift/core/target`).
+`DecompileResult.assumedSymbols` carries the declarations the returned source is correct only
+BESIDE — array shapes derived from the assembly rather than read from `symbols`. A caller that
+publishes the source alone publishes a spelling whose meaning it has not stated, so render them
+with it.
+
+Targets: `ARMV4T_AGBCC`, `MIPS_IDO`, `MIPS_GCC`, `PPC_MWCC` (`@asmlift/core/target`). A toolchain
+id plus the flags its build compiles the function with resolves to one through
+`targetFor(toolchain, cflags)`, which returns that description alongside the `CodegenProfile` the
+flags describe — optimisation level, debug info, and the words the flag table does not name.
+`TOOLCHAIN_TARGETS` is the registry it reads, and `canonicalFlagsOf` gives a toolchain's default
+set where it has one.
 
 ### Other entry points
 
@@ -58,8 +73,8 @@ Everything under `src/` is importable as `@asmlift/core/<path>` (e.g.
 
 ## Architecture
 
-Three ISA frontends (ARMv4T/Thumb, MIPS, PowerPC), five compilers (agbcc, IDO, KMC GCC, GCC
-2.7.2, CodeWarrior), three language backends over one neutral AST — all scored across the package seam
+Three ISA frontends (ARMv4T/Thumb, MIPS, PowerPC), four compiler families (`agbcc`, `ido`, `gcc`,
+`mwcc` — `codegen-flags.ts`'s `FlagFamily`) over seven target keys, three language backends over one neutral AST — all scored across the package seam
 by [`@asmlift/cli`](../cli/README.md) with the community `objdiff` engine (in-process, pinned
 `objdiff-wasm`; asmlift never hand-rolls a diff).
 
@@ -79,20 +94,24 @@ injected via hooks, never copied. `verify()` runs after every IR-mutating pass;
 
 ### Modules
 
-| Module                                          | What it is                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `ir/{types,core,opcodes,print,parse,verify}.ts` | MLIR-lite substrate: CFG of blocks + typed **block-arguments**, the typed opcode registry (`Opcode`, the one `effects` table DCE and hoist guards derive from), printer + parser (round-trip for L1/scalar types — see the domain note in parse.ts), verifier (arity/attrs/terminators/SSA dominance, located errors); `core.ts` also owns the CFG facts every level reads — `successorsOf`, `predecessors`, `dominators`                                                                                                                                                                                                                                                                                                             |
-| `frontend/{thumb,mips,ppc}.ts`                  | ISA frontends: decode → CFG → L1 with **Braun-2013 block-arg SSA** (`ssa.ts`), incl. loops, calls (signature-driven arity), memory, jump tables. Shared scaffolding: `disasm.ts` (objdump parsing), `splat.ts` (Splat-dialect MIPS → objdump-shaped instrs), `format.ts` (input-format classification), `emit.ts` (per-block emitter kit + `switch_br`), `opaque.ts` (the unmodelled-op → loud-`opaque` contract), `errors.ts` (`FrontendUnsupportedError`; PPC's subclass), `registry.ts`, `asmdata.ts` (Regime-B jump-table side-table)                                                                                                                                                                                             |
-| `pattern/engine.ts`                             | Idiom layer: **rewrite patterns as data** + greedy driver + DCE; `patternApplies` gates on Target capabilities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| `raise/*.ts`                                    | The pre-recovery recognizers, in ONE ordered list (`pre-recovery.ts`): const materialize → magic division (`magicdiv.ts`, Hacker's Delight inverse) → soft division → array legalize → struct-array → member-array (`memberarrays.ts`, a constant offset feeding a variable-index walk is a struct's ARRAY member) → struct-pointer → short-circuit → narrow-reads (`narrow.ts`) → narrow locals (`narrowlocal.ts`, a carrier read only through its own extension IS that width) → parameter width (`paramwidth.ts`, a parameter extended in the prologue is DECLARED at that width); plus `recover.ts` (L1→L2 type recovery), `retsink.ts` (return-sinking), `latch.ts` (empty-latch folding), `errors.ts` (`RaiseUnsupportedError`) |
-| `structure/*.ts`                                | L2→L3 in six modules: `loops.ts` (natural-loop discovery, over `ir/core.ts`'s dominators), `analysis.ts` (use registry, liveness, C4 materialization), `switch-recover.ts` (Regime-A comparison-tree recovery), `hazards.ts` (the checks a loop emitter runs before committing to a loop form), `namecoalesce.ts` (copy coalescing over the interference graph — the `/merge-names` axis), `structure.ts` (SSA-destruction coalescing with interference checks + emission: if/while/do-while/for/switch, break/early-return)                                                                                                                                                                                                          |
-| `l3/*.ts`                                       | `ast.ts`: language-**neutral** structured AST, the one traversal vocabulary (`exprChildren` etc.), and the `LanguageBackend` seam. Post-structure passes `dce.ts` + `basecse.ts`, the shared hoist mechanism `hoist.ts`, the differ-ranked re-spelling levers `regspell.ts` + `reindex.ts` + `argbase.ts` + `scopebase.ts`, and `typing.ts` (the rendered-expression C type the backends and contracts share)                                                                                                                                                                                                                                                                                                                         |
-| `backend/{c,cpp,cfamily,pascal}.ts`             | Three backends: C and C++ (CodeWarrior mangling via `mangle.ts`) over the shared `cfamily.ts` substrate, and Pascal (`:=`, `div`, tail-position returns; unspellable constructs throw)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| `pipeline.ts`                                   | `decompile()` + the shared tower spine + annotate-mode stubs/diagnostics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| `trace.ts`                                      | `decompileTraced` — the traced tower (per-stage IR dumps + pattern before/after events), browser-pure; @asmlift/cli's `report.ts` enriches it with objdiff scores/candidates, the playground's Pipeline tab renders it directly                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| `rank.ts`                                       | Pure candidate enumeration + `rankBy` (an injected score function ranks). @asmlift/cli's differ ranks through `rankBy`; the playground's wasm scorer consumes the same enumeration with its own async loop                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| `target.ts`                                     | `TargetDescription` (ABI + capabilities + compilerBehaviors as data — no `arch ==` in shared code); toolchain paths live in `@asmlift/toolchains`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `contracts.ts`, `proto.ts`, `mangle.ts`         | Boundary contracts; prototype tables; the CodeWarrior mangler                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| Module                                    | What it is                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `ir/*.ts`                                 | MLIR-lite substrate (`types`, `core`, `opcodes`, `print`, `parse`, `verify`, plus `alias.ts`'s alias predicate, `simplify.ts`, `bits.ts` and `struct-names.ts`): CFG of blocks + typed **block-arguments**, the typed opcode registry (`Opcode`, the one `effects` table DCE and hoist guards derive from), printer + parser (round-trip for L1/scalar types — see the domain note in parse.ts), verifier (arity/attrs/terminators/SSA dominance, located errors); `core.ts` also owns the CFG facts every level reads — `successorsOf`, `predecessors`, `dominators`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `frontend/{thumb,mips,ppc}.ts`            | ISA frontends: decode → CFG → L1 with **Braun-2013 block-arg SSA** (`ssa.ts`), incl. loops, calls (signature-driven arity), memory, jump tables. Shared scaffolding: `disasm.ts` (objdump parsing), `splat.ts` (Splat-dialect MIPS → objdump-shaped instrs), `format.ts` (input-format classification), `emit.ts` (per-block emitter kit + `switch_br`), `opaque.ts` (the unmodelled-op → loud-`opaque` contract), `errors.ts` (`FrontendUnsupportedError`; PPC's subclass), `registry.ts`, `asmdata.ts` (Regime-B jump-table side-table), `high-half.ts` (a relocated address's high half is a link-time placeholder, never a value), `reloc-symbol.ts` (the per-KIND policy deciding which linker names C can spell), `stackargs.ts` (the outgoing stack-argument fixpoint, over digested slot events rather than instructions)                                                                                                                                                                                                                                     |
+| `pattern/engine.ts`                       | Idiom layer: **rewrite patterns as data** + greedy driver + DCE; `patternApplies` gates on Target capabilities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `raise/*.ts`                              | The pre-recovery recognizers, in ONE ordered list — `PRE_RECOVERY_PASSES` in `pre-recovery.ts` is the source of truth for the order, and reads: address-numbering (`gvn.ts`) → const-materialize → magic-division (`magicdiv.ts`, Hacker's Delight inverse) → pow2-division (`divpow2.ts`) → soft-division → scaled-extension (`extscale.ts`) → array-legalize → struct-array → member-array (`memberarrays.ts`, a constant offset feeding a variable-index walk is a struct's ARRAY member) → struct-pointer → short-circuit → branch-short-circuit → narrow-reads (`narrow.ts`) → narrow-local (`narrowlocal.ts`, a carrier read only through its own extension IS that width) → parameter-width (`paramwidth.ts`, a parameter extended in the prologue is DECLARED at that width) → scaled-extension-restore; plus `recover.ts` (L1→L2 type recovery), `retsink.ts` + `tailsink.ts` (return- and tail-sinking), `latch.ts` (empty-latch folding), `globalshape.ts` (which derived shapes the source is only correct beside), `errors.ts` (`RaiseUnsupportedError`) |
+| `structure/*.ts`                          | L2→L3: `loops.ts` (natural-loop discovery, over `ir/core.ts`'s dominators), `analysis.ts` (use registry, liveness, C4 materialization), `switch-recover.ts` (Regime-A comparison-tree recovery), `hazards.ts` (the checks a loop emitter runs before committing to a loop form), `namecoalesce.ts` (copy coalescing over the interference graph — the `/merge-names` variation), `structure.ts` (SSA-destruction coalescing with interference checks + emission: if/while/do-while/for/switch, break/early-return), `retspell.ts` (which `return;` the source wrote, read off the epilogue's in-edges), `bitfields.ts` + `globalaccess.ts` (the map-driven bitfield and global-access spellings, both refusal machines)                                                                                                                                                                                                                                                                                                                                               |
+| `l3/*.ts`                                 | `ast.ts`: language-**neutral** structured AST, the one traversal vocabulary (`exprChildren` etc.), and the `LanguageBackend` seam. Post-structure passes `dce.ts` + `basecse.ts`, the shared hoist mechanism `hoist.ts`, the differ-ranked respell variations (`regspell.ts`, `reindex.ts`, `argbase.ts`, `scopebase.ts`, `argcopy.ts` — five of the 31 the registry holds; a module may mint more than one, as `scopebase.ts` does with `/scopebase` and `/regionbase`), the spelling pass `tailret.ts` (drop a void `return;` `structure/retspell.ts` marked unspelled), and `typing.ts` (the rendered-expression C type the backends and contracts share)                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `backend/{c,cpp,cfamily,pascal}.ts`       | Three backends: C and C++ (CodeWarrior mangling via `mangle.ts`) over the shared `cfamily.ts` substrate, and Pascal (`:=`, `div`, tail-position returns; unspellable constructs throw)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `pipeline.ts`                             | `decompile()` + the shared tower spine + annotate-mode stubs/diagnostics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `trace.ts`                                | `decompileTraced` — the traced tower (per-stage IR dumps + pattern before/after events), browser-pure; @asmlift/cli's `report.ts` enriches it with objdiff scores/candidates, the playground's Pipeline tab renders it directly                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `rank.ts`                                 | Pure candidate enumeration + `rankBy` (an injected score function ranks). @asmlift/cli's differ ranks through `rankBy`; the playground's wasm scorer consumes the same enumeration with its own async loop                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `rank-variations.ts`, `rank-declare.ts`   | The two halves `rank.ts` walks rather than hand-codes: the enumeration TABLES (declaration order is published behaviour — it breaks a score tie), and the declarations a candidate needs to compile outside the project's headers, including which names one must REFUSE to claim                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `variation-{tokens,definitions,gates}.ts` | The variation REGISTRY as data: every variation a candidate's name can carry, what each one MEANS for a reader, and the admission tables a definition names. Keyed by the registry in both directions, so a variation with no definition and a definition naming no variation are each a type error                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `codegen-flags.ts`                        | Compiler flags parsed into the codegen profile a function was compiled at — each option that can change what the compiler emits, as a named slot. One flag set reaches both the compile and the decompile                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `symbols.ts`, `declare.ts`, `macros.ts`   | The address→symbol map seam (core consumes the VALUE; the providers that read files live in `@asmlift/cli`), the declaration block a self-declaring candidate carries, and the address-cast macro spelling — a `#define` emits a NUMERIC pool word where an `extern` emits a relocated one, so the two are not interchangeable in the bytes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `target.ts`                               | `TargetDescription` (ABI + capabilities + compilerBehaviors as data — no `arch ==` in shared code); toolchain paths live in `@asmlift/toolchains`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `contracts.ts`, `proto.ts`, `mangle.ts`   | Boundary contracts; prototype tables; the CodeWarrior mangler                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 
 Scoring and ranking live across the package seam in [`@asmlift/cli`](../cli/README.md):
 `score.ts` + `objdiff.ts` (toolchain compiles → in-process pinned `objdiff-wasm`, fail-closed)
@@ -103,12 +122,16 @@ and `rank.ts` (ranked type candidates re-ranked by the differ).
 Recovered today: straight-line, if/else diamonds, natural loops (`while` / `do-while` / `for`,
 properly nested, in-body `break`/early-`return`), comparison-tree and jump-table switches,
 direct calls, constant-offset and variable-index memory (`*p`, `p[n]`, `a[i]`, struct fields),
-magic-number and soft division, short-circuit booleans, width casts. Still DECLINED (loud, never
+magic-number and soft division, short-circuit booleans, width casts, PowerPC small-data access
+through its `R_PPC_EMB_SDA21` relocation, a call's outgoing stack arguments on agbcc, where the
+declaration and the code agree (`stagesOutgoingArgsInFrame`; MIPS still declines the same shape),
+and a MIPS likely branch's nullified delay slot. Still DECLINED (loud, never
 wrong code): **local stack frames** (address-taken locals / sp-as-data; MIPS models word `sp`
 slots and PPC elides callee-saved save slots, so a spill/reload pair is modelled on those two —
 anything the narrow models cannot honour declines),
 **cross-block condition flags** on PPC (a `cmpw` whose branch lands in another block — the
-capability gap behind the mwcc switch stubs), computed tail calls, PIC/`gp`/SDA global access,
+capability gap behind the mwcc switch stubs), computed tail calls, PIC and `gp`-relative access outside PowerPC's
+small-data relocation — MIPS refuses `R_MIPS_GOT16`/`R_MIPS_CALL16`/`R_MIPS_GPREL16` alike —
 switch fall-through, multi-latch/irreducible loops, floats, and 64-bit memory ops. Prototypes
 (callee arities, void-ness) come from a caller-supplied map, as a real project takes them from
 headers.
@@ -130,9 +153,10 @@ Landmarks (not exhaustive — suites are named for what they pin):
   that keeps every already-matching function matching. How to add a fixture — and when a
   matching test is the right tool at all, vs a benchmark row — is under
   [`@asmlift/cli` › Tests](../cli/CONTRIBUTION.md#tests).
-- `contract-invariant` / `contracts` — the loud-fail contract, mutation-proven.
-- `structure-guard` / `structure-soundness` / `audit-regression` — the adversarial-audit repro
-  locks.
+- `contract-invariant`, and `contracts` (in `../cli/test/matching/`) — the loud-fail contract,
+  mutation-proven.
+- `structure-guard`, and `structure-soundness` / `audit-regression` (both in
+  `../cli/test/matching/`) — the adversarial-audit repro locks.
 - `one-version` — a WORKSPACE-scope invariant, like `offline-list`: every dependency that two or
   more workspace packages declare must be declared AND resolved at one version. It exists because
   `packages/cli` scored with `objdiff-wasm` 3.7.3 while `apps/web` scored with 3.7.0, so the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@asmlift/core",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "license": "MIT",
   "type": "module",
   "description": "Match decompile an assembly function to C or Pascal",

package/src/backend/cfamily.ts

@@ -80,10 +80,18 @@ export function cType(t: IrType): string {
 
 /** Declare a name of a given type, C declarator rules: an array puts its length AFTER the name
  *  (`u8 _pad[4]`), a pointer binds its `*` to the declarator (`void *p`), everything else is
- *  the prefix `cType name`. */
+ *  the prefix `cType name`. A NESTED array spells every extent after the name in declaration
+ *  order (`u8 unk8[6][8]`) — one declarator, not an element type that is itself an array, which
+ *  C has no syntax for and `cType` marks ill-formed as a prefix. */
 function cDeclare(t: IrType, name: string): string {
   if (t.kind === 'array') {
-    return `${cType(t.elem)} ${name}[${t.count}]`;
+    const extents: number[] = [];
+    let e: IrType = t;
+    while (e.kind === 'array') {
+      extents.push(e.count);
+      e = e.elem;
+    }
+    return `${cType(e)} ${name}${extents.map((n) => `[${n}]`).join('')}`;
   }
   if (t.kind === 'ptr') {
     return `${cType(t.to)} *${name}`;
@@ -136,7 +144,19 @@ export type LeafHook = (e: Expr, rec: (e: Expr, p: number) => string) => string
  *  -fprologue-bugfix`), and referring to a volatile object through a non-volatile lvalue is
  *  undefined behaviour (C99 6.7.3p5). */
 function legalizedIndexBase(ix: Extract<Expr, { k: 'index' }>, vt: PrintEnv): Expr {
-  return derefStrideOk(exprCType(ix.base, vt.type), ix.width, ix.signed)
+  // `baseElem` states the element type the base's own DECLARATION gives it, where the type walk
+  // cannot reconstruct one (a map-declared array MEMBER — see l3/ast.ts). It is a FALLBACK, not an
+  // override, and the order is the whole guard: the walk reads the tree in front of it, so
+  // wherever it answers at all it is the better answer and the stated one is not consulted.
+  // Inverted (`declared ?? walked`), a stale statement would stand — `derefStrideOk` cannot catch
+  // one, because it tests the STATED type against the access width and never against the base.
+  // No pass carries a statement onto a foreign base today (each refuses a `field` base by its own
+  // predicate: basecse `isHoistableBase`, scopebase/argbase `eligible`, nearbase's untouched
+  // `field` subtree, reindex's `base.k === 'var'`), but `mapExprChildren` spreads the field across
+  // an arbitrary base substitution, so that is five accidents rather than a check. This ordering
+  // is the check. Measured: zero test moves either way.
+  const declared = ix.baseElem !== undefined ? T.ptr(ix.baseElem) : undefined;
+  return derefStrideOk(exprCType(ix.base, vt.type) ?? declared, ix.width, ix.signed)
     ? ix.base
     : {
         k: 'cast',
@@ -226,11 +246,19 @@ function printExpr(e: Expr, parentPrec: number, vt: PrintEnv, leaf?: LeafHook):
       // Leading constant subscripts (a multidimensional array global's bare spelling) keep the
       // postfix form whatever `idx` is: `g[0][0]` is the element, `*g[0]` would be its ROW.
       //
-      // `lead` implies the base already strides the access width — its only producers register a
-      // matching element type for the global (structure/globalaccess.ts `bareArrayLead` and
-      // `declaredSubscripts`, both through structure.ts's `noteGlobal`). Nothing
-      // else enforced that, and the failure would be quiet-ish: legalization would wrap the base,
-      // spelling `((u16 *)g)[0][i]`, which subscripts a `u16` twice. Check it rather than assume.
+      // `lead` implies the base already strides the access width, and its producers reach that by
+      // TWO different mechanisms. The two GLOBAL ones register a matching element type for the
+      // global (structure/globalaccess.ts `bareArrayLead` and `declaredSubscripts`, both through
+      // structure.ts's `noteGlobal`, so the type walk finds it); the MEMBER one
+      // (structure.ts `pointeeElement`, `gPtr->grid[0][i]`) has no global to register and states
+      // the element type on the node instead (`baseElem`). Nothing else enforced either, and the
+      // failure would be quiet-ish: legalization would wrap the base, spelling `((u16 *)g)[0][i]`,
+      // which subscripts a `u16` twice. Check it rather than assume.
+      //
+      // This throw covers rank >= 2 ONLY, because only a rank >= 2 access carries `lead`. A rank-1
+      // member (the large majority of the corpus's dims-carrying members) has no guard here: a
+      // missing or stale `baseElem` there degrades silently to the cast form the rule replaces,
+      // which is a lost spelling rather than a wrong address.
       if (e.lead && e.lead.length > 0) {
         if (base !== e.base) {
           throw new Error(
@@ -396,8 +424,8 @@ function printSwitchStmt(s: Extract<Stmt, { k: 'switch' }>, indent: string, vt:
   // arm first, loudly), so it is a contract on the next one.
   //
   // `continue;` is deliberately NOT refused: C binds it to the smallest enclosing ITERATION
-  // statement, which a `switch` is not, so it already means what L3 means. What a loop-respelling
-  // pass must preserve is exactly that — the three that can re-spell a loop into one whose
+  // statement, which a `switch` is not, so it already means what L3 means. What a pass that re-spells
+  // a loop must preserve is exactly that — the three that can re-spell a loop into one whose
   // `continue` would run a different increment (`recognizeForLoops` in structure.ts,
   // `respellCountdown` in l3/reindex.ts, and l3/unreduce.ts) each scan switch arms for the node
   // before firing, and a fourth must too.
@@ -539,7 +567,7 @@ function cFamilyBody(fn0: SFn, leaf?: LeafHook): string[] {
     // differently: on a scalar the qualifier binds to the object (`volatile u16 sp0`), on a
     // pointer declarator to the pointee — the INNERMOST one for a multi-level pointer
     // (`volatile u16 ** p`). An object-volatile POINTER (`u16 *volatile p`) has no inhabitant —
-    // no lever or recognizer produces one.
+    // no variation or recognizer produces one.
     lines.push(`    ${l.volatile || l.pointeeVolatile ? 'volatile ' : ''}${cType(l.type)} ${l.name};`);
   }
   for (const s of fn.body) {

package/src/backend/pascal.ts

@@ -9,7 +9,7 @@
 // (`rshift` is arithmetic on a signed Integer → `sra`.) This is the concrete difference from
 // Turbo/Delphi/FreePascal.
 import { IrType, typeToString } from '../ir/types';
-import { BinOp, Expr, LanguageBackend, SFn, Stmt } from '../l3/ast';
+import { BinOp, Expr, LanguageBackend, SFn, Stmt, isLoop } from '../l3/ast';
 import { orderSlotLocals } from '../l3/slotorder';
 import { type VarTypes, declaredTypes, derefStrideOk, exprCType, writesNonPointerIntoPointer } from '../l3/typing';
 
@@ -240,7 +240,7 @@ function makePrinter(vt: VarTypes) {
             (st) =>
               st.k === 'return' ||
               (st.k === 'if' && (hasReturn(st.then) || hasReturn(st.else))) ||
-              ((st.k === 'while' || st.k === 'dowhile' || st.k === 'for') && hasReturn(st.body)) ||
+              (isLoop(st) && hasReturn(st.body)) ||
               (st.k === 'switch' && (st.cases.some((c) => hasReturn(c.body)) || hasReturn(st.default ?? []))),
           );
         if (s.cases.some((c) => hasReturn(c.body)) || hasReturn(s.default ?? [])) {