@asmlift/core 0.8.1 → 0.10.0

package/src/backend/cfamily.ts

@@ -10,8 +10,11 @@
 // below the signature is this file's: declarations, statements, expressions, precedence, the
 // legalizing casts, and the recovered-struct declaration spelling (which is why that lives here
 // too, shared with the scoring layer's synthesized declarations so the two cannot drift).
-import { IrType, T, scalarTypeForAccess, typeToString } from '../ir/types';
-import { BinOp, Expr, SFn, Stmt, dotBase } from '../l3/ast';
+import { doubleLiteral } from '../ir/float-bits';
+import { IrType, T, scalarTypeForAccess, typeEquals, typeToString } from '../ir/types';
+import { BinOp, Expr, InitAddress, SFn, SStatic, Stmt, dotBase } from '../l3/ast';
+import { foldConstantImages } from '../l3/constinit';
+import { legalizePointerCells } from '../l3/ptrcell';
 import { orderSlotLocals } from '../l3/slotorder';
 import {
   type PrintEnv,
@@ -20,14 +23,26 @@ import {
   declaredTypes,
   derefStrideOk,
   exprCType,
+  exprIntWidth,
   printEnv,
   renderedIntSignedness,
   writesNonPointerIntoPointer,
 } from '../l3/typing';
+import { spellableType } from '../proto';
 
 // C operator precedence (lower binds tighter). Used to emit MINIMAL parentheses. Shared: C++ has
 // the same precedence for these operators.
 const PREC: Record<BinOp, number> = {
+  'f*': 3,
+  'f/': 3,
+  'f+': 4,
+  'f-': 4,
+  'f<': 6,
+  'f<=': 6,
+  'f>': 6,
+  'f>=': 6,
+  'f==': 7,
+  'f!=': 7,
   '*': 3,
   '/': 3,
   '/u': 3, // the unsigned twins spell as C's `/` and `%` (see C_SPELLING) — same precedence
@@ -64,17 +79,44 @@ const C_SPELLING: Partial<Record<BinOp, { token: string; signed: boolean }>> = {
   '%u': { token: '%', signed: false },
 };
 
+/** The float operators (l3/ast.ts BinOp) spell as C's own tokens and take no operand pin: C's
+ *  arithmetic over two floats is the IEEE operation the machine did, and its relations over two
+ *  floats are the IEEE compares — false on a NaN, `!=` true. */
+const FLOAT_TOKEN: Partial<Record<BinOp, string>> = {
+  'f+': '+',
+  'f-': '-',
+  'f*': '*',
+  'f/': '/',
+  'f<': '<',
+  'f<=': '<=',
+  'f>': '>',
+  'f>=': '>=',
+  'f==': '==',
+  'f!=': '!=',
+};
+
 /** Spell a recovered type in the decomp C-family typedef vocabulary (`s32`/`u32`/`u8`/`T *`). */
 export function cType(t: IrType): string {
   if (t.kind === 'ptr') {
     return `${cType(t.to)} *`;
   }
   if (t.kind === 'struct') {
-    return `struct ${t.name}`;
+    return t.declared ?? `struct ${t.name}`;
+  }
+  // Declared inline, where the struct member that holds it is declared (ir/types.ts).
+  if (t.kind === 'union') {
+    return `union { ${t.members.map((m) => `${cDeclare(m.type, m.name)};`).join(' ')} }`;
   }
   if (t.kind === 'array') {
     return `${cType(t.elem)}[${t.count}]`;
   } // ill-formed as a prefix; use cDeclare
+  // The C89 KEYWORDS, not the `f32`/`f64` typedefs a decomp project declares: the candidate prelude
+  // (`C_TYPEDEFS`) holds the integer family only, and a keyword needs no declaration in any
+  // translation unit — so no project context that already typedefs `f32` can collide with it.
+  // A float of no stated precision compiles the same under either keyword; `float` is its spelling.
+  if (t.kind === 'float') {
+    return t.width === 64 ? 'double' : 'float';
+  }
   return typeToString(t); // s32 / u32 / u8 / unk32 (treated as s32 upstream)
 }
 
@@ -83,7 +125,7 @@ export function cType(t: IrType): string {
  *  the prefix `cType name`. A NESTED array spells every extent after the name in declaration
  *  order (`u8 unk8[6][8]`) — one declarator, not an element type that is itself an array, which
  *  C has no syntax for and `cType` marks ill-formed as a prefix. */
-function cDeclare(t: IrType, name: string): string {
+export function cDeclare(t: IrType, name: string): string {
   if (t.kind === 'array') {
     const extents: number[] = [];
     let e: IrType = t;
@@ -113,10 +155,11 @@ export interface StructFieldDecl {
   bits?: number;
 }
 
-/** THE struct-declaration spelling — every `struct N { ... };` asmlift prints comes from here,
- *  so the backend's recovered-struct decls and the scoring layer's synthesized decls cannot
- *  drift apart. One line, fields in caller order (the type is self-describing: padding is the
- *  caller's discipline, already present as real fields). */
+/** THE struct-declaration spelling — every `struct N { ... };` asmlift recovers or synthesizes
+ *  comes from here, so the backend's recovered-struct decls and the scoring layer's synthesized
+ *  decls cannot drift apart. A struct the headers own is transcribed from their declaration
+ *  instead (declare.ts `declaredStructDecl`). One line, fields in caller order (the type is
+ *  self-describing: padding is the caller's discipline, already present as real fields). */
 export function renderStructDecl(name: string, fields: StructFieldDecl[]): string {
   const one = (f: StructFieldDecl) =>
     `${f.volatile ? 'volatile ' : ''}${cDeclare(f.type, f.name)}${f.bits !== undefined ? ` : ${f.bits}` : ''};`;
@@ -166,18 +209,23 @@ function legalizedIndexBase(ix: Extract<Expr, { k: 'index' }>, vt: PrintEnv): Ex
       };
 }
 
-/** The 32-bit integer cast that PINS an operand's signedness.
+/** The integer cast that PINS an operand's signedness, AT THE OPERAND'S OWN RANK.
  *
- *  An existing 32-bit integer cast is REPLACED rather than wrapped — `(u32)(s32)&g` and `(u32)&g`
- *  are the same bytes, and the arithmetic rules upstream do emit that inner cast (intifyAddr).
- *  The replacement CARRIES the qualifier: re-typing a `volatile` cast without it drops an
- *  assertion the differ cannot referee the loss of, which is why l3/initfirst.ts's
- *  `stripWideIntCast` refuses the same peel one pass over. */
-function recast32(x: Expr, signed: boolean): Expr {
-  const replaced = x.k === 'cast' && x.to.kind === 'int' && x.to.width === 32 ? x : undefined;
+ *  The width is not a constant: `(s32)a / (s32)b` over two `s64`s does not pin a signedness, it
+ *  truncates the operation to 32 bits and calls a different helper than the machine did. So the
+ *  rank comes from `exprIntWidth`, which is total and answers 64 only where it can prove it.
+ *
+ *  An existing integer cast AT THE SAME WIDTH is REPLACED rather than wrapped — `(u32)(s32)&g` and
+ *  `(u32)&g` are the same bytes, and the arithmetic rules upstream do emit that inner cast
+ *  (structure/pointer-spelling.ts ARITH_ROWS). A cast at a DIFFERENT width is a narrowing the
+ *  source wrote and must be kept. The replacement CARRIES the qualifier: re-typing a `volatile`
+ *  cast without it drops an assertion the differ cannot referee the loss of, which is why
+ *  l3/initfirst.ts's `stripWideIntCast` refuses the same peel one pass over. */
+function recastInt(x: Expr, signed: boolean, width: 32 | 64): Expr {
+  const replaced = x.k === 'cast' && x.to.kind === 'int' && x.to.width === width ? x : undefined;
   return {
     k: 'cast',
-    to: T.int(32, signed),
+    to: T.int(width, signed),
     ...(replaced?.volatile === true ? { volatile: true as const } : {}),
     e: replaced ? replaced.e : x,
   };
@@ -205,14 +253,66 @@ function recast32(x: Expr, signed: boolean): Expr {
  *  the division unsigned. Verified by compiling: `((u32)a / b) / 7` calls `__udivsi3` twice,
  *  `(s32)((u32)a / b) / 7` calls `__udivsi3` then `__divsi3`. */
 function pinnedOperands(e0: Extract<Expr, { k: 'bin' }>, wantSigned: boolean, vt: PrintEnv): [Expr, Expr] {
+  // A shift reads its LEFT operand's rank; a divide reads the wider of the two, which is what the
+  // usual arithmetic conversions make the operation's own rank.
   if (e0.op === '>>' || e0.op === '>>>') {
-    return [renderedIntSignedness(e0.l, vt.type) === wantSigned ? e0.l : recast32(e0.l, wantSigned), e0.r];
+    const w = exprIntWidth(e0.l, vt.type);
+    return [renderedIntSignedness(e0.l, vt.type) === wantSigned ? e0.l : recastInt(e0.l, wantSigned, w), e0.r];
   }
   if (arithConversionSignedness(e0.l, e0.r, vt.type) === wantSigned) {
     return [e0.l, e0.r];
   }
-  const pinSigned = (x: Expr): Expr => (renderedIntSignedness(x, vt.type) === true ? x : recast32(x, true));
-  return wantSigned ? [pinSigned(e0.l), pinSigned(e0.r)] : [recast32(e0.l, false), e0.r];
+  const w = exprIntWidth(e0.l, vt.type) === 64 || exprIntWidth(e0.r, vt.type) === 64 ? 64 : 32;
+  const pinSigned = (x: Expr): Expr => (renderedIntSignedness(x, vt.type) === true ? x : recastInt(x, true, w));
+  return wantSigned ? [pinSigned(e0.l), pinSigned(e0.r)] : [recastInt(e0.l, false, w), e0.r];
+}
+
+/** Does passing `a` to a parameter declared `to` take a conversion C++ will not make implicitly?
+ *  Three do, and C makes each of them implicitly, so the cast spells the conversion C would have
+ *  made and the compiled code is C's: an object pointer to a pointer of another pointee (a conversion
+ *  to `void *`, or one that only adds a qualifier, is implicit in C++ too), an integer to a pointer
+ *  (the literal `0` is the one integer that converts), and a pointer to an integer. Only reached on a
+ *  function compiled as C++ (`SFn.dialect`), or by a C front end that refuses the same three
+ *  (`SFn.strictConversions` — mwcc). */
+function argConversion(a: Expr, to: string, vt: PrintEnv): boolean {
+  const from = exprCType(a, vt.type);
+  // qualifiers never decide it: a `T * const` parameter is a pointer parameter
+  const bare = to
+    .replace(/\b(?:const|volatile)\b/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (bare.endsWith('*')) {
+    if (a.k === 'const' && a.value === 0) {
+      return false;
+    }
+    if (from?.kind !== 'ptr') {
+      return true;
+    }
+    return bare !== 'void *' && bare !== cType(from).replace(/\s+/g, ' ').trim();
+  }
+  return from?.kind === 'ptr';
+}
+
+/** The unqualified pointer a `const` static's address is spelled as where it reaches a place that
+ *  converts it implicitly — an argument, an assigned or stored value, a returned one — or null for
+ *  any other expression. The static is `const` because the target holds it in read-only data, not
+ *  because the source's pointer types say so: mwcc rejects the implicit `const u8[4]` → `u8 *` a
+ *  bare `g(tbl)` makes (compiled), and a pointer cast changes no instruction. */
+function constEscape(e: Expr, vt: PrintEnv): IrType | null {
+  if (e.k === 'addr' && vt.constStatic(e.name)) {
+    const t = vt.type(e.name);
+    return t === undefined ? null : T.ptr(t.kind === 'array' ? t.elem : t);
+  }
+  if (e.k === 'bin' && (e.op === '+' || e.op === '-')) {
+    return constEscape(e.l, vt) ?? (e.op === '+' ? constEscape(e.r, vt) : null);
+  }
+  return null;
+}
+
+/** `e` printed where C converts it implicitly, with a `const` static's address cast (constEscape). */
+function printConverted(e: Expr, vt: PrintEnv, leaf?: LeafHook): string {
+  const to = constEscape(e, vt);
+  return to === null ? printExpr(e, 99, vt, leaf) : `(${cType(to)})${printExpr(e, 2, vt, leaf)}`;
 }
 
 function printExpr(e: Expr, parentPrec: number, vt: PrintEnv, leaf?: LeafHook): string {
@@ -228,14 +328,59 @@ function printExpr(e: Expr, parentPrec: number, vt: PrintEnv, leaf?: LeafHook):
       return e.name;
     case 'const':
       return String(e.value);
+    // a negative literal is a prefix `-`, and parenthesizes where one would (`un` below)
+    case 'fconst': {
+      const s = doubleLiteral(e.bits);
+      return parentPrec < 2 && s.startsWith('-') ? `(${s})` : s;
+    }
     case 'addr': {
-      // `&gSym` — the address of a named global. A prefix operator; parenthesizes under a POSTFIX
-      // parent like the other prefix forms.
+      // `&gSym` — the address of a named global or of a frame-local object. A prefix operator;
+      // parenthesizes under a POSTFIX parent like the other prefix forms.
+      //
+      // AN ARRAY DECAYS INSTEAD, and the declared type is what says so, which is why the decision
+      // is here rather than on the node: `&` on `u8 sp0[16]` spells a `u8 (*)[16]` — a different
+      // type for the same byte, which every typed pointer parameter rejects (`passing arg 1 from
+      // incompatible pointer type`) — where the bare name is the `u8 *` the machine produced.
+      // Compiled both ways, the object is identical, so the `&` buys a diagnostic and nothing
+      // else. An identifier binds tighter than every parent, so the decayed form never
+      // parenthesizes. A name this env cannot type keeps the `&`: an unknown shape is not an
+      // array, and dropping the operator on a scalar would spell its value.
+      if (vt.type(e.name)?.kind === 'array') {
+        return e.name;
+      }
       const g = `&${e.name}`;
       return parentPrec < 2 ? `(${g})` : g;
     }
-    case 'call':
-      return `${e.fn}(${e.args.map((a) => rec(a, 99)).join(', ')})`;
+    case 'call': {
+      if (typeof e.fn !== 'string') {
+        // An unprototyped pointer to a function returning the call's own rank: C passes each
+        // argument as its promoted self, which is what a call with no declaration passes.
+        const ret = cType(T.int(e.wide64 ? 64 : 32, true));
+        return `((${ret} (*)())${rec(e.fn, 2)})(${e.args.map((a) => printConverted(a, vt, leaf)).join(', ')})`;
+      }
+      if (e.sret !== undefined) {
+        throw new Error(`the call to '${e.fn}' returns a struct through memory and is spelled only as a statement`);
+      }
+      const declared = vt.declaredArgs(e.fn);
+      return `${e.fn}(${e.args
+        .map((a, i) => {
+          const to = declared?.[i];
+          // A parameter type this cannot spell is an object pointer (target.ts `declaredArgTypes`),
+          // reached through `void *` from an argument whose own type is known to differ — a value
+          // this function types, or the address of an object it declares (a static) — never from
+          // `&gW` of a global only the project declares, which may already be the parameter's type.
+          const opaque = to !== undefined && !spellableType(to);
+          const typed = exprCType(a, vt.type) !== undefined || (a.k === 'addr' && vt.type(a.name) !== undefined);
+          return to !== undefined && (!opaque || typed) && argConversion(a, to, vt)
+            ? `(${opaque ? 'void *' : to})${rec(a, 2)}`
+            : printConverted(a, vt, leaf);
+        })
+        .join(', ')})`;
+    }
+    // `v++` / `v--`. Postfix over a bare identifier, so it binds tighter than every parent and
+    // never self-parenthesizes.
+    case 'postincr':
+      return `${e.name}${e.by === 1 ? '++' : '--'}`;
     case 'index': {
       // `*base` for the zero offset (a PREFIX operator, so a prefix-shaped base like a cast needs
       // no parens: `*(u8 *)p` — but the whole form must self-parenthesize under a POSTFIX parent:
@@ -267,7 +412,7 @@ function printExpr(e: Expr, parentPrec: number, vt: PrintEnv, leaf?: LeafHook):
         }
         return `${rec(base, 1)}${e.lead.map((l) => `[${rec(l, 99)}]`).join('')}[${rec(e.idx, 99)}]`;
       }
-      if (e.idx.k === 'const' && e.idx.value === 0) {
+      if (e.idx.k === 'const' && e.idx.value === 0 && e.subscript !== true) {
         const s = `*${rec(base, 2)}`;
         return parentPrec < 2 ? `(${s})` : s;
       }
@@ -306,7 +451,8 @@ function printExpr(e: Expr, parentPrec: number, vt: PrintEnv, leaf?: LeafHook):
       // A prefix operator: parenthesize under a POSTFIX parent (`(-a)[1]`), and parenthesize a
       // same-op nested `-` (`-(-a)`, never `--a` — C lexes that as predecrement).
       const inner = rec(e.e, 2);
-      const s = `${e.op}${e.op === '-' && inner.startsWith('-') ? `(${inner})` : inner}`;
+      const op = e.op === 'f-' ? '-' : e.op;
+      const s = `${op}${op === '-' && inner.startsWith('-') ? `(${inner})` : inner}`;
       return parentPrec < 2 ? `(${s})` : s;
     }
     // A gap marker spells as a call to the UNDEFINED macro ASMLIFT_ERROR("reason", args…) — the
@@ -331,25 +477,41 @@ function printExpr(e: Expr, parentPrec: number, vt: PrintEnv, leaf?: LeafHook):
       // operand cast that says which of the pair it is.
       const pair = C_SPELLING[e.op];
       const [l, r] = pair ? pinnedOperands(e, pair.signed, vt) : [e.l, e.r];
-      const s = `${rec(l, p)} ${pair ? pair.token : e.op} ${rec(r, p - 1)}`;
+      const s = `${rec(l, p)} ${pair ? pair.token : (FLOAT_TOKEN[e.op] ?? e.op)} ${rec(r, p - 1)}`;
       return p > parentPrec ? `(${s})` : s;
     }
   }
 }
 
+/** `dest = fn(args)` for a call whose `args[0]` is the address of the struct it returns: a local
+ *  declared with that struct type, named by its address. Any other destination has no spelling
+ *  that hands the callee the same pointer — compiled, `*(struct Blob64 *)&gDst = makeblob(gBlob);`
+ *  is a frame temp and a `memcpy`, where `gDst = makeblob(gBlob);` hands over `&gDst` itself. */
+function structReturnCall(call: Extract<Expr, { k: 'call' }>, vt: PrintEnv, leaf?: LeafHook): string {
+  const [dest, ...rest] = call.args;
+  const declared = dest?.k === 'addr' ? vt.type(dest.name) : undefined;
+  if (dest?.k !== 'addr' || declared === undefined || !typeEquals(declared, call.sret!)) {
+    throw new Error(`the call to '${call.fn}' returns a struct into something other than a local of its type`);
+  }
+  return `${dest.name} = ${printExpr({ k: 'call', fn: call.fn, args: rest }, 99, vt, leaf)}`;
+}
+
 function printStmt(s: Stmt, indent: string, vt: PrintEnv, leaf?: LeafHook): string[] {
   const pe = (e: Expr, p: number) => printExpr(e, p, vt, leaf);
   switch (s.k) {
     case 'assign':
-      return [`${indent}${s.name} = ${pe(s.value, 99)};`];
+      return [`${indent}${s.name} = ${printConverted(s.value, vt, leaf)};`];
     case 'store':
       // The lvalue is a full Expr (`index` or `field`), so the leaf hook spells a member write
       // (`this->x = …`) exactly as it spells a member read.
-      return [`${indent}${pe(s.lval, 2)} = ${pe(s.value, 99)};`];
+      return [`${indent}${pe(s.lval, 2)} = ${printConverted(s.value, vt, leaf)};`];
     case 'exprstmt':
+      if (s.value.k === 'call' && s.value.sret !== undefined) {
+        return [`${indent}${structReturnCall(s.value, vt, leaf)};`];
+      }
       return [`${indent}${pe(s.value, 99)};`];
     case 'return':
-      return [`${indent}return${s.value ? ' ' + pe(s.value, 99) : ''};`];
+      return [`${indent}return${s.value ? ' ' + printConverted(s.value, vt, leaf) : ''};`];
     case 'if': {
       const cond = pe(s.cond, 99);
       if (s.then.length === 1 && s.else.length === 0 && s.then[0].k !== 'if') {
@@ -374,6 +536,7 @@ function printStmt(s: Stmt, indent: string, vt: PrintEnv, leaf?: LeafHook): stri
       return out;
     }
     case 'while': {
+      refuseMisboundBreak(s.body, 'loop');
       const out = [`${indent}while (${pe(s.cond, 99)}) {`];
       for (const t of s.body) {
         out.push(...printStmt(t, indent + '    ', vt, leaf));
@@ -382,6 +545,7 @@ function printStmt(s: Stmt, indent: string, vt: PrintEnv, leaf?: LeafHook): stri
       return out;
     }
     case 'dowhile': {
+      refuseMisboundBreak(s.body, 'loop');
       const out = [`${indent}do {`];
       for (const t of s.body) {
         out.push(...printStmt(t, indent + '    ', vt, leaf));
@@ -394,6 +558,7 @@ function printStmt(s: Stmt, indent: string, vt: PrintEnv, leaf?: LeafHook): stri
       // `recognizeForLoops` and l3/reindex.ts): init/inc are each a SINGLE-LINE `assign` statement. `clause` renders one
       // and strips its trailing `;` so it sits inside the header (`i = 0; c; i = i + 1`). A multi-line
       // statement (an `if`/nested loop) would render mangled — but the recognizer never builds one here.
+      refuseMisboundBreak(s.body, 'loop');
       const clause = (st: Stmt) => printStmt(st, '', vt, leaf).join(' ').replace(/;\s*$/, '').trim();
       const out = [`${indent}for (${clause(s.init)}; ${pe(s.cond, 99)}; ${clause(s.inc)}) {`];
       for (const t of s.body) {
@@ -417,11 +582,12 @@ function printStmt(s: Stmt, indent: string, vt: PrintEnv, leaf?: LeafHook): stri
  *  is one call. */
 function printSwitchStmt(s: Extract<Stmt, { k: 'switch' }>, indent: string, vt: PrintEnv, leaf?: LeafHook): string[] {
   const pe = (e: Expr, p: number) => printExpr(e, p, vt, leaf);
-  // A `break;` in an arm BODY is the innermost LOOP's in L3 (l3/ast.ts) and the SWITCH's in C,
-  // so printing one between `case` labels rebinds it — a changed program that reads as ordinary
+  // A plain `break;` in an arm BODY is the innermost LOOP's in L3 (l3/ast.ts) and the SWITCH's in
+  // C, so printing one between `case` labels rebinds it — a changed program that reads as ordinary
   // C. Refused HERE because the rebinding is the printer's, for every producer rather than for
-  // the two switch regimes. No recovery reaches it today (both regimes decline a loop-exiting
-  // arm first, loudly), so it is a contract on the next one.
+  // the two switch regimes (`refuseMisboundBreak`, which checks a loop body the same way for a
+  // `break` marked `ofSwitch`). The structurer spells a loop exit inside an arm as the switch's
+  // own `break` or refuses it, so no recovery reaches either today: a contract on the next one.
   //
   // `continue;` is deliberately NOT refused: C binds it to the smallest enclosing ITERATION
   // statement, which a `switch` is not, so it already means what L3 means. What a pass that re-spells
@@ -430,9 +596,7 @@ function printSwitchStmt(s: Extract<Stmt, { k: 'switch' }>, indent: string, vt:
   // `respellCountdown` in l3/reindex.ts, and l3/unreduce.ts) each scan switch arms for the node
   // before firing, and a fourth must too.
   for (const body of [...s.cases.map((c) => c.body), s.default ?? []]) {
-    if (switchBoundBreakIn(body)) {
-      throw new Error('c backend: a switch arm carries a loop-scoped `break;`, which C would bind to the switch');
-    }
+    refuseMisboundBreak(body, 'switch');
   }
   const out = [`${indent}switch (${pe(s.scrutinee, 99)}) {`];
   const ci = indent + '    '; // case-label indent
@@ -491,13 +655,26 @@ function printSwitchStmt(s: Extract<Stmt, { k: 'switch' }>, indent: string, vt:
   return out;
 }
 
-/** Does this arm body carry a `break` C would bind to the enclosing SWITCH rather than to the loop
- *  L3 meant? A loop opened inside the arm captures its own, so its body is not walked; a nested
- *  `switch` captures one too and is checked when it is printed. */
-function switchBoundBreakIn(body: Stmt[]): boolean {
-  return body.some(
-    (s) => s.k === 'break' || (s.k === 'if' && (switchBoundBreakIn(s.then) || switchBoundBreakIn(s.else))),
-  );
+/** L3 has two `break`s (l3/ast.ts) and C one: C binds `break;` to the innermost enclosing loop OR
+ *  switch, so a `break` prints as what L3 meant only where its own kind is that innermost
+ *  statement. `body` is a loop body or a switch arm (`owner`); a loop or switch opened inside it
+ *  captures its own breaks and is checked when it is printed, so it is not walked. Refused loud on
+ *  either mismatch — a plain (loop) `break` in an arm, a switch's `break` in a loop body — since
+ *  each prints as ordinary C that leaves a different statement. */
+function refuseMisboundBreak(body: Stmt[], owner: 'loop' | 'switch'): void {
+  const misbound = (ss: Stmt[]): boolean =>
+    ss.some(
+      (s) =>
+        (s.k === 'break' && (s.ofSwitch === true) !== (owner === 'switch')) ||
+        (s.k === 'if' && (misbound(s.then) || misbound(s.else))),
+    );
+  if (misbound(body)) {
+    throw new Error(
+      owner === 'switch'
+        ? 'c backend: a switch arm carries a loop-scoped `break;`, which C would bind to the switch'
+        : 'c backend: a loop body carries a switch-scoped `break;`, which C would bind to the loop',
+    );
+  }
 }
 
 // Does a statement list end in a control-flow terminator (so a trailing `break;` would be dead)?
@@ -512,6 +689,22 @@ function endsTerminated(body: Stmt[]): boolean {
   );
 }
 
+/** Is `e` a pointer to another pointee than the pointer slot `t` declares, as rendered? Its pointer
+ *  type is its C type, or, for the address of a declared object (which `exprCType` leaves
+ *  unknown), a pointer to that object or to an array's element, the way it decays. A `void *` slot
+ *  takes every object pointer implicitly. A `void *` value converts into any pointer slot in C
+ *  (mwcc's C takes `gp = (void *)x` into an `s32 *gp`, compiled) but not in C++ (`cxx`). An unknown
+ *  type is no opinion. */
+function otherPointee(t: IrType | undefined, e: Expr, vt: (name: string) => IrType | undefined, cxx: boolean): boolean {
+  if (t?.kind !== 'ptr' || t.to.kind === 'void') {
+    return false;
+  }
+  const of = e.k === 'addr' ? vt(e.name) : undefined;
+  const ct = of !== undefined ? T.ptr(of.kind === 'array' ? of.elem : of) : exprCType(e, vt);
+  const p = ct?.kind === 'array' ? T.ptr(ct.elem) : ct;
+  return p?.kind === 'ptr' && (cxx || p.to.kind !== 'void') && !typeEquals(p, t);
+}
+
 // C-FAMILY WRITE LEGALIZATION (the assign-side sibling of the deref legalization in printExpr):
 // the C family's answer to `writesNonPointerIntoPointer` is the reinterpret cast to the DECLARED
 // type — exactly what the machine's register move does — where Pascal, having no such cast,
@@ -519,8 +712,21 @@ function endsTerminated(body: Stmt[]): boolean {
 // traversal-vocabulary exemption.)
 function legalizePointerWrites(fn: SFn): SFn {
   const vt = declaredTypes(fn);
+  // …and the mirror: a rendered pointer into an INTEGER slot takes the slot's type. A cast keeps
+  // the sum it wraps, so the bytes are the uncast write's; CodeWarrior rejects that write outright.
+  //
+  // …and, where the compiler refuses the third implicit conversion too (C++, or mwcc's C:
+  // `SFn.strictConversions`), a pointer of ANOTHER pointee into a pointer slot: mwcc rejects
+  // `return t;` from an `s32 *` function when `t` is a `const u32[2]` static (mwcc: "illegal implicit
+  // conversion" of an `unsigned int *` to an `int *`, compiled), and takes it cast (`otherPointee`
+  // says which `void *` converts implicitly).
+  const strict = fn.dialect === 'c++' || fn.strictConversions === true;
   const castTo = (t: IrType | undefined, e: Expr): Expr =>
-    writesNonPointerIntoPointer(t, e, vt) ? { k: 'cast', to: t, e } : e;
+    writesNonPointerIntoPointer(t, e, vt) ||
+    (t?.kind === 'int' && exprCType(e, vt)?.kind === 'ptr') ||
+    (strict && otherPointee(t, e, vt, fn.dialect === 'c++'))
+      ? { k: 'cast', to: t!, e }
+      : e;
   const fix = (s: Stmt): Stmt => {
     switch (s.k) {
       case 'assign':
@@ -555,20 +761,28 @@ function legalizePointerWrites(fn: SFn): SFn {
 /** The body of a C-family function: local declarations + statements, one string per line. The
  *  SIGNATURE (return type + name + params, plus any C++ scope/`this`/mangling) is the caller's —
  *  that is the language-divergent part each backend owns. */
-function cFamilyBody(fn0: SFn, leaf?: LeafHook): string[] {
+function cFamilyBody(fn0: SFn, leaf: LeafHook | undefined, designators: boolean): string[] {
   const fn = legalizePointerWrites(fn0);
   // The legalization env: every printed var's declared type and pointee volatility, from the SAME
   // params/locals the emitted declarations come from — so the printer judges exactly the C the
   // reader will see.
   const vt: PrintEnv = printEnv(fn);
   const lines: string[] = [];
+  for (const st of fn.statics ?? []) {
+    lines.push(...staticDefinition(st));
+  }
   for (const l of fn.locals) {
     // Both facts render at the PREFIX position, where C's declarator grammar reads them
     // differently: on a scalar the qualifier binds to the object (`volatile u16 sp0`), on a
     // pointer declarator to the pointee — the INNERMOST one for a multi-level pointer
-    // (`volatile u16 ** p`). An object-volatile POINTER (`u16 *volatile p`) has no inhabitant —
-    // no variation or recognizer produces one.
-    lines.push(`    ${l.volatile || l.pointeeVolatile ? 'volatile ' : ''}${cType(l.type)} ${l.name};`);
+    // (`volatile u16 **p`). An object-volatile POINTER (`u16 *volatile p`) has no inhabitant —
+    // no variation or recognizer produces one. The NAME is placed by `cDeclare`, the one
+    // placement every declaration position in this backend uses: a local can carry an array type
+    // — the storage extent a frame object pins — and C puts those extents after the name.
+    const head = `    ${l.volatile || l.pointeeVolatile ? 'volatile ' : ''}${cDeclare(l.type, l.name)}`;
+    lines.push(
+      ...(l.init === undefined ? [`${head};`] : initialized(head, l.type, l.init, l.initString === true, designators)),
+    );
   }
   for (const s of fn.body) {
     lines.push(...printStmt(s, '    ', vt, leaf));
@@ -576,6 +790,96 @@ function cFamilyBody(fn0: SFn, leaf?: LeafHook): string[] {
   return lines;
 }
 
+/** One initial number: hex from 10 up, a negative one with its sign, so a byte table reads as the
+ *  bytes and a signed one as its values. */
+const initNumber = (v: number): string =>
+  Math.abs(v) < 10 ? `${v}` : `${v < 0 ? '-' : ''}0x${Math.abs(v).toString(16)}`;
+
+/** One initial element of type `elem`: a number, or the address constant a relocated one holds,
+ *  converted to the element's integer type — `(u32)&sym`, and with an addend `(u32)((u8 *)&sym + k)`:
+ *  the offset in bytes, as the relocation counts it. Not `(u32)&sym + k`, which agbcc folds alike but
+ *  mwcc refuses as an illegal constant expression (compiled); through a byte pointer both write the
+ *  pointer-typed source's word and relocation (`&garr[2]`, `&garr[-1]`, compiled on both). */
+function initElement(v: number | InitAddress, elem: IrType): string {
+  if (typeof v === 'number') {
+    return initNumber(v);
+  }
+  const t = cType(elem);
+  return v.addend === 0
+    ? `(${t})&${v.symbol}`
+    : `(${t})((u8 *)&${v.symbol} ${v.addend < 0 ? '-' : '+'} ${initNumber(Math.abs(v.addend))})`;
+}
+
+/** A byte array's initial elements as a string literal: printable characters as themselves, every
+ *  other byte in three-digit octal (which no following digit can extend), and a `?` after a `?`
+ *  escaped so no trigraph forms. The trailing zeros are left to the declared size, which C fills
+ *  with zeros. */
+function stringLiteral(init: readonly number[]): string {
+  let end = init.length;
+  while (end > 0 && (init[end - 1] & 0xff) === 0) {
+    end--;
+  }
+  let out = '';
+  for (const v of init.slice(0, end)) {
+    const b = v & 0xff;
+    const c = String.fromCharCode(b);
+    out +=
+      b < 0x20 || b > 0x7e || c === '"' || c === '\\' || (c === '?' && out.endsWith('?'))
+        ? `\\${b.toString(8).padStart(3, '0')}`
+        : c;
+  }
+  return `"${out}"`;
+}
+
+/** A function-scope static's definition, as the first lines of the body. An array's elements are
+ *  laid out eight to a line; an alignment the type does not give is an attribute, which gcc and
+ *  mwcc both read after the declarator. */
+function staticDefinition(st: SStatic): string[] {
+  const aligned = st.align === undefined ? '' : ` __attribute__((aligned(${st.align})))`;
+  const head = `    static ${st.const ? 'const ' : ''}${cDeclare(st.type, st.name)}${aligned}`;
+  return st.init === undefined ? [`${head};`] : initialized(head, st.type, st.init, st.string === true, false);
+}
+
+/** A declaration `head` of `type` with its initializer: a string literal, one scalar, or an
+ *  array's elements laid out eight to a line. An element left out (null) is skipped and the next
+ *  one spelled by designator, `[k] = v` — or, where the compiler cannot parse one (`SFn.designators`
+ *  absent: IDO, mwcc) or the language has none (C++), spelled as the zero it is. */
+function initialized(
+  head: string,
+  type: IrType,
+  init: readonly (number | InitAddress | null)[],
+  string: boolean,
+  designators: boolean,
+): string[] {
+  const whole = init.map((v) => v ?? 0);
+  if (string) {
+    // a string's elements are bytes, and no byte holds an address (structure/local-statics.ts)
+    const bytes = whole.filter((v): v is number => typeof v === 'number');
+    if (bytes.length !== whole.length) {
+      throw new Error(`internal: a string initializer of '${head.trim()}' holds an address`);
+    }
+    return [`${head} = ${stringLiteral(bytes)};`];
+  }
+  if (type.kind !== 'array') {
+    return [`${head} = ${initElement(whole[0], type)};`];
+  }
+  const items: string[] = [];
+  init.forEach((v, i) => {
+    if (v !== null || !designators) {
+      const e = initElement(v ?? 0, type.elem);
+      items.push(init[i - 1] === null && designators ? `[${i}] = ${e}` : e);
+    }
+  });
+  if (items.length <= 8) {
+    return [`${head} = { ${items.join(', ')} };`];
+  }
+  const rows: string[] = [];
+  for (let i = 0; i < items.length; i += 8) {
+    rows.push(`        ${items.slice(i, i + 8).join(', ')},`);
+  }
+  return [`${head} = {`, ...rows, '    };'];
+}
+
 /** Struct declarations this function references, one `struct N { ... };` per recovered aggregate.
  *  The struct type is SELF-DESCRIBING: any padding needed to seat fields at their exact offsets is
  *  already present as real `u8[N]` pad fields — both raise/struct-arrays.ts (element strides) and
@@ -585,15 +889,25 @@ function structDecls(fn: SFn): string[] {
   return (fn.structs ?? []).map((s) => renderStructDecl(s.name, s.fields));
 }
 
-/** Assemble a full C-family function from a caller-supplied signature line and the shared body. */
-export function emitCFamily(signature: string, fn0: SFn, leaf?: LeafHook): string {
-  // The declaration list is put into the target's own frame order HERE — in the shared C-family
-  // assembler, reached only from `cBackend.emit` and `cppBackend(...).emit`, so both C-family
-  // backends order and no `.emit(` call site does (l3/slotorder.ts says why `emit` owns it).
-  const fn = orderSlotLocals(fn0);
+/** Assemble a full C-family function from a caller-supplied signature line and the shared body.
+ *  `designators`: the LANGUAGE spells an array element by index in an initializer (C, not C++).
+ *  Whether the compiler's dialect parses one is the function's own fact (`SFn.designators`); an
+ *  initializer is spelled by index only where both say yes. */
+export function emitCFamily(signature: string, fn0: SFn, leaf?: LeafHook, designators = true): string {
+  // The declaration list is put into the target's own frame order, and a pointer cell's integer
+  // uses converted (l3/ptrcell.ts), HERE — in the shared C-family assembler, reached only from
+  // `cBackend.emit` and `cppBackend(...).emit`, so both C-family backends print them and no `.emit(`
+  // call site does (l3/slotorder.ts says why `emit` owns it).
+  // …and the compiler's anonymous constant images folded into the initializers of the locals
+  // their copies fill (l3/constinit.ts), which the tree keeps as copies until here.
+  const fn = orderSlotLocals(legalizePointerCells(foldConstantImages(fn0)));
   const decls = structDecls(fn);
   const preamble = decls.length ? decls.join('\n') + '\n' : '';
-  return preamble + [`${signature} {`, ...cFamilyBody(fn, leaf), '}'].join('\n') + '\n';
+  return (
+    preamble +
+    [`${signature} {`, ...cFamilyBody(fn, leaf, designators && fn.designators === true), '}'].join('\n') +
+    '\n'
+  );
 }
 
 // One C-family comment spelling, shared by the C and C++ backends. A `*` followed by `/`