@asmlift/core 0.8.1 → 0.10.0

package/src/contracts.ts

@@ -3,21 +3,30 @@
 // decompileRanked / decompileWithReport).
 // A pass that regresses fails AT its boundary with a diagnostic, not three stages later as
 // wrong C.
-import { type Fn, type Value, reachableBlocks } from './ir/core';
-import { type IrType, typeToString } from './ir/types';
-import type { BinOp, Expr, SFn, Stmt } from './l3/ast';
+import { constAddressOf, globalBaseOf } from './ir/alias';
+import { type Fn, type Op, type Value, calleeName, reachableBlocks } from './ir/core';
+import { placedAt } from './ir/discipline';
+import { MEM_BASE_OPS } from './ir/opcodes';
+import { type IrType, memberOf, typeToString } from './ir/types';
+import { cellAddress, qualifiedBase } from './l3/address';
+import { type BinOp, type Expr, type SFn, type Stmt, calleeOf } from './l3/ast';
 import {
+  assignsIn,
   exprChildren,
   fieldSpellsDot,
   gapReasonFor,
   mapExprChildren,
+  mentionedName,
   stmtChildren,
   stmtExprs,
   stmtLists,
+  taintOverAssigns,
   walkExprs,
 } from './l3/ast';
 import { mentionedLocals } from './l3/mentions';
+import { localAddresses } from './l3/storage';
 import { declaredTypes, exprCType } from './l3/typing';
+import { castOffDeclaration } from './l3/volstore';
 
 export class ContractError extends Error {
   constructor(message: string) {
@@ -68,9 +77,14 @@ export function assertResolved(sfn: SFn): void {
   // Every Expr kind that CARRIES a name, not just `var` — each is read through the same
   // `map.get(d)!` / `attrs.x as string` and prints straight into the source. `carriesName` is asked
   // separately because an ABSENT name is the case being caught: keying off `nameOf` alone refuses nothing.
-  const carriesName = (e: Expr): boolean => e.k === 'var' || e.k === 'addr' || e.k === 'field' || e.k === 'call';
+  const carriesName = (e: Expr): boolean =>
+    e.k === 'var' ||
+    e.k === 'addr' ||
+    e.k === 'field' ||
+    (e.k === 'call' && typeof e.fn === 'string') ||
+    e.k === 'postincr';
   const nameOf = (e: Expr): string | undefined =>
-    e.k === 'call' ? e.fn : e.k === 'marker' ? undefined : (e as { name?: string }).name;
+    e.k === 'call' ? calleeOf(e) : e.k === 'marker' ? undefined : (e as { name?: string }).name;
   const badExpr = (e: Expr): boolean => (carriesName(e) && badName(nameOf(e))) || exprChildren(e).some(badExpr);
   // An `assign`'s DESTINATION is a bare string field, so the expression walk never reaches it.
   const badStmt = (s: Stmt): boolean =>
@@ -86,10 +100,10 @@ export function assertResolved(sfn: SFn): void {
 // ── effects: executed once, never dropped ──────────────────────────────────────────────────
 //
 // The three contracts around this one are about TYPING and SPELLABILITY. Nothing checked the
-// property the structurer's materialization model exists to preserve: a call in the asm must run
-// exactly as often in the emitted source. Its two failure modes are the two that hurt most —
-// asmlift's first rule is that a loud failure beats a silently wrong answer, and both of these are
-// silent:
+// property the structurer's materialization model exists to preserve: an execution the asm makes
+// must happen exactly as often in the emitted source. Its two failure modes are the two that hurt
+// most — asmlift's first rule is that a loud failure beats a silently wrong answer, and both of
+// these are silent:
 //
 //   • DROPPED — a call the asm makes has no counterpart in the tree at all;
 //   • RE-RUN  — inlining a call's value at more than one render position (or a structuring copy
@@ -97,22 +111,55 @@ export function assertResolved(sfn: SFn): void {
 //     recovered switch fall-through hit exactly this shape, and only an adversarial reviewer
 //     caught it.
 //
-// Deliberately narrow, so it never declines a function that is fine:
+// What is counted is what each render executes (ir/discipline.ts `counted`): a call, a memory access
+// the lift pinned (the `device` placement), whose qualified spelling the recompile performs once per
+// render, and a read of an object the symbol map declares volatile (`declared`), which the tree
+// spells by the object's name. A store to such an object is checked for its spelling only.
+// Deliberately narrow beyond that, so it never declines a function that is fine:
 //
-//   • CALLS only. Loads legitimately re-render (that is the whole point of the inline-at-use
-//     model, and the alias gate governs it); stores are checked by neither direction here because
-//     the readability DCE pass is allowed to drop a provably dead one.
+//   • CALLS AND QUALIFIED ACCESSES only. A plain load legitimately re-renders (that is the whole point
+//     of the inline-at-use model, and the alias gate governs it); a plain store is checked by
+//     neither direction because the readability DCE pass is allowed to drop a provably dead one.
 //   • PER PATH, not per tree. Structuring may legitimately emit one block twice — two exclusive
-//     switch arms sharing a body, a duplicated return merge — and each path still executes it
-//     once. So the duplication rule compares the maximum over syntactic root-to-leaf paths (a
-//     branch takes the max of its arms, a loop body counts once, a fall-through arm chains into
-//     the next) against the IR's static count.
-//   • Names the IR does not have are ignored, and only calls carrying a target symbol are counted
-//     (every frontend that emits `call` today stamps one).
-type CallCounts = Map<string, number>;
+//     switch arms sharing a body, a duplicated return merge, an exit tail copied into each
+//     `if (…) { …; return; }` that leaves a loop — and each path still executes it once. So the
+//     duplication rule compares the maximum over syntactic root-to-leaf paths (a branch takes the
+//     max of its arms, a loop body counts once, a fall-through arm chains into the next, and a
+//     `return` ends its path) against the IR's static count. What follows a statement every path
+//     leaves is on no path, so it is refused rather than left uncounted: it is code the asm never
+//     ran, and a region duplicated there would pass the count unseen.
+//   • Names the IR does not have are ignored. A call through a register names no callee, so every
+//     one is counted under the single key `call:(*pointer)`: the count holds for indirect calls as
+//     a whole, and a pass that makes one of them call what another calls goes unseen.
+//   • A pinned access is keyed by whether it reads or writes, and by the constant address both sides
+//     can read off it — the IR's base and offset, the tree's `cellAddress` — or `?` where a side
+//     cannot. A read never stands for a write. A `?` render may stand for any pinned access and a
+//     `?` access may render at any address, and each render is one execution, so both rules are
+//     Hall's condition over that compatibility: the renders on a path at any set of addresses are
+//     at most those addresses' accesses plus the `?` accesses, and the accesses at any set of
+//     addresses have at least as many renders there plus the `?` renders. An access through a named
+//     global is counted for re-runs and never as dropped: its qualifier may be the global's
+//     declaration, which leaves nothing in the tree.
+//   • A declared read is keyed by the object it reads, and counted for re-runs only. The tree side
+//     counts each access whose address is that object's name plus arithmetic, once, however it is
+//     spelled — `gSym`, `gSym[i]`, `gSym.f`, `gPtr->f`, a `volatile` cast through `&gSym` — and
+//     never a store target. An access whose base is another access is the inner one's: through
+//     `gPtr->arr[i]` the object is read once. One that reaches the object through a cast with no
+//     `volatile` — the tree's own, or the one the printer puts on a base that does not stride the
+//     access (l3/volstore.ts `castOffDeclaration`) — is a plain read the compiler may hoist or
+//     delete, and is refused. Objects the asm also reads unstamped are skipped, since nothing tells
+//     their renders apart. A pinned access through the object's name may render as one of its
+//     reads.
+//   • A declared store is not counted: it renders at its own position, once. One spelled through a
+//     cast with no `volatile` is a plain store the compiler may delete or sink, and is refused, as
+//     the read is. Objects the asm also writes unstamped are skipped, as for reads.
+/** Executions per key: `call:<target>`, or `call:(*pointer)` for every call through a register;
+ *  `device:r:<0xaddress>` for a pinned read and `device:w:<0xaddress>` for a pinned write, with `?`
+ *  for the address where the counting side cannot read one; or `declared:<object>`. */
+type EffectCounts = Map<string, number>;
 
 /** per-key combine of two count maps (`sum` for sequence, `max` for exclusive alternatives) */
-function combine(a: CallCounts, b: CallCounts, f: (x: number, y: number) => number): CallCounts {
+function combine(a: EffectCounts, b: EffectCounts, f: (x: number, y: number) => number): EffectCounts {
   const out = new Map(a);
   for (const [k, v] of b) {
     out.set(k, f(out.get(k) ?? 0, v));
@@ -120,80 +167,325 @@ function combine(a: CallCounts, b: CallCounts, f: (x: number, y: number) => numb
   return out;
 }
 
-/** every `call` expression under `e`, counted by target name */
-function callsInExpr(e: Expr, into: CallCounts): void {
+const DECLARED = 'declared:';
+const STRIPPED = 'stripped:';
+const STRIPPED_WRITE = 'stripped-write:';
+/** The one callee key every indirect call is counted under: no identifier can spell it. */
+const INDIRECT_CALL = '(*pointer)';
+type Direction = 'r' | 'w';
+const deviceKey = (dir: Direction, addr: number | null): string =>
+  `device:${dir}:${addr === null ? '?' : `0x${addr.toString(16)}`}`;
+
+/** Is this access spelled through a `volatile` pointee? A dot member qualifies through the element
+ *  or member it selects from, any other access through its own base's cast chain. */
+function qualifiedAccessChain(e: Expr): boolean {
+  if (e.k === 'index') {
+    return qualifiedBase(e.base);
+  }
+  if (e.k === 'field') {
+    return fieldSpellsDot(e)
+      ? (e.base.k === 'index' || e.base.k === 'field') && qualifiedAccessChain(e.base)
+      : qualifiedBase(e.base);
+  }
+  return false;
+}
+
+/** The global an access's address is named by: its base through casts, address arithmetic and the
+ *  element or member a dot member selects from, down to `&gSym`, or to a `gSym` that spells its own
+ *  address — an array's name, which decays to it (`addresses`), or the struct a dot member selects
+ *  from (`dotted`). Any other bare `gSym` is the object's VALUE: `*(u16 *)gPtr` reads what the
+ *  pointer points at, not the pointer, so the access names no object. Null too when the base is
+ *  anything else — another access, a local. */
+function accessedObject(base: Expr, addresses: ReadonlySet<string>, dotted = false): string | null {
+  switch (base.k) {
+    case 'var':
+      return dotted || addresses.has(base.name) ? base.name : null;
+    case 'addr':
+      return base.name;
+    case 'cast':
+      return accessedObject(base.e, addresses);
+    case 'bin':
+      return base.op === '+' || base.op === '-'
+        ? (accessedObject(base.l, addresses) ?? accessedObject(base.r, addresses))
+        : null;
+    default:
+      return null;
+  }
+}
+
+/** What the tree side reads a render against: the objects whose every read the asm makes is
+ *  declared, those whose every write is, and the rendered C type of an expression, which decides
+ *  where the printer casts. */
+interface TreeContext {
+  declared: ReadonlySet<string>;
+  written: ReadonlySet<string>;
+  typeOf: (e: Expr) => IrType | undefined;
+  /** The names whose bare spelling is the object's address: the array-declared globals the
+   *  structurer subscripts by name (SFn.globals), and the array or struct statics it defines. */
+  addresses: ReadonlySet<string>;
+}
+
+/** every call under `e`, counted by target name; every qualified memory access, by the address it
+ *  denotes, or by its object where that object's reads are declared, and not at all where it is a
+ *  write the object's declaration places; and every other access and bare global read, by the
+ *  object it names — under `stripped:` (`stripped-write:` for a store target) where the access
+ *  reaches a declared object through a cast that drops its qualifier. `selected` marks an element or member a dot
+ *  member selects from: that is a part of the one access the member spells, not an access of its
+ *  own. `named` marks the base of an access: a `gSym` there is the access's address, counted with
+ *  it. `target` marks a store's target, which is a write. */
+function effectsInExpr(
+  e: Expr,
+  into: EffectCounts,
+  ctx: TreeContext,
+  selected = false,
+  named = false,
+  target = false,
+): void {
+  const bump = (k: string) => into.set(k, (into.get(k) ?? 0) + 1);
+  const access = e.k === 'index' || e.k === 'field';
+  const inner = access && !selected ? dotSelectedAccess(e) : null;
+  const object =
+    inner === null ? null : accessedObject(inner.base, ctx.addresses, inner.k === 'field' && fieldSpellsDot(inner));
+  const ofDeclared = object !== null && !target && ctx.declared.has(object);
+  const writesDeclared = object !== null && target && ctx.written.has(object);
   if (e.k === 'call') {
-    into.set(e.fn, (into.get(e.fn) ?? 0) + 1);
+    bump(`call:${calleeOf(e) ?? INDIRECT_CALL}`);
+  } else if (!selected && qualifiedAccessChain(e)) {
+    if (!writesDeclared) {
+      bump(ofDeclared ? `${DECLARED}${object}` : deviceKey(target ? 'w' : 'r', cellAddress(e)));
+    }
+  } else if (!selected && target && access) {
+    if (writesDeclared && castOffDeclaration(e, ctx.typeOf)) {
+      bump(`${STRIPPED_WRITE}${object}`);
+    }
+  } else if (!selected && access) {
+    if (object !== null) {
+      bump(`${ofDeclared && castOffDeclaration(e, ctx.typeOf) ? STRIPPED : DECLARED}${object}`);
+    }
+  } else if (!target && e.k === 'var' && !(named && (selected || ctx.addresses.has(e.name)))) {
+    // A bare name is a read of the object's value unless it spells the address of an access, which
+    // counts it: the struct a dot member selects from, or an array's decayed name.
+    bump(`${DECLARED}${e.name}`);
   }
-  exprChildren(e).forEach((c) => callsInExpr(c, into));
+  const partOfThis = e.k === 'field' && fieldSpellsDot(e);
+  exprChildren(e).forEach((c) =>
+    effectsInExpr(c, into, ctx, partOfThis && c === e.base, access && c === e.base ? true : named && !access, false),
+  );
 }
 
-/** `total` = every occurrence in the tree; `path` = the most any single syntactic path executes */
-function countCalls(stmts: Stmt[]): { total: CallCounts; path: CallCounts } {
-  let total: CallCounts = new Map();
-  let path: CallCounts = new Map();
-  const add = (r: { total: CallCounts; path: CallCounts }, pathF: (x: number, y: number) => number) => {
-    total = combine(total, r.total, (x, y) => x + y);
-    path = combine(path, r.path, pathF);
-  };
+type Access = Extract<Expr, { k: 'index' } | { k: 'field' }>;
+
+/** A dot member's innermost access, past the element or member it selects from: its base is the
+ *  address of the one access the member spells. */
+function dotSelectedAccess(e: Access): Access {
+  if (e.k === 'field' && fieldSpellsDot(e) && (e.base.k === 'index' || e.base.k === 'field')) {
+    return dotSelectedAccess(e.base);
+  }
+  return e;
+}
+
+/** The executions on the paths through a statement list, split by how each path LEAVES it: falling off
+ *  the end, or by a `return`, `break` or `continue`. Null when no path leaves that way. Each is the
+ *  per-name maximum over the paths of that kind. */
+interface PathCounts {
+  through: EffectCounts | null;
+  ret: EffectCounts | null;
+  brk: EffectCounts | null;
+  cont: EffectCounts | null;
+}
+
+const sum = (a: EffectCounts, b: EffectCounts): EffectCounts => combine(a, b, (x, y) => x + y);
+const most = (...xs: (EffectCounts | null)[]): EffectCounts | null =>
+  xs.reduce<EffectCounts | null>((acc, x) => (x === null ? acc : acc === null ? x : combine(acc, x, Math.max)), null);
+/** `c` run ahead of every path of `p` */
+const after = (c: EffectCounts, p: PathCounts): PathCounts => ({
+  through: p.through && sum(c, p.through),
+  ret: p.ret && sum(c, p.ret),
+  brk: p.brk && sum(c, p.brk),
+  cont: p.cont && sum(c, p.cont),
+});
+/** `a` then `b`: only a path that falls off the end of `a` reaches `b` */
+const seq = (a: PathCounts, b: PathCounts): PathCounts =>
+  a.through === null
+    ? a
+    : {
+        through: b.through && sum(a.through, b.through),
+        ret: most(a.ret, b.ret && sum(a.through, b.ret)),
+        brk: most(a.brk, b.brk && sum(a.through, b.brk)),
+        cont: most(a.cont, b.cont && sum(a.through, b.cont)),
+      };
+/** whichever of the alternatives runs */
+const either = (...ps: PathCounts[]): PathCounts => ({
+  through: most(...ps.map((p) => p.through)),
+  ret: most(...ps.map((p) => p.ret)),
+  brk: most(...ps.map((p) => p.brk)),
+  cont: most(...ps.map((p) => p.cont)),
+});
+const falls = (c: EffectCounts): PathCounts => ({ through: c, ret: null, brk: null, cont: null });
+
+/** `total` = every occurrence in the tree; `paths` = the most any single syntactic path executes,
+ *  by how it leaves `stmts`. A path that leaves by `return` runs nothing after it, so two sequenced
+ *  `if (…) { f(); return; }` arms are one call on any path, not two. `unreached` collects every
+ *  statement that follows one no path falls past: the path count skips it, so the caller refuses it
+ *  rather than let a duplicated region hide there. */
+function countEffects(
+  stmts: Stmt[],
+  ctx: TreeContext,
+  unreached: Stmt[] = [],
+): { total: EffectCounts; paths: PathCounts } {
+  let total: EffectCounts = new Map();
+  let paths = falls(new Map());
   for (const s of stmts) {
-    const own: CallCounts = new Map();
-    stmtExprs(s).forEach((e) => callsInExpr(e, own));
-    add({ total: own, path: own }, (x, y) => x + y);
+    if (paths.through === null) {
+      unreached.push(s);
+    }
+    const own: EffectCounts = new Map();
+    stmtExprs(s).forEach((e) => effectsInExpr(e, own, ctx, false, false, s.k === 'store' && e === s.lval));
+    total = sum(total, own);
+    let here: PathCounts;
     if (s.k === 'if') {
-      const t = countCalls(s.then);
-      const e = countCalls(s.else);
-      // exclusive arms: the path count is whichever arm runs, the total counts both
-      add(
-        { total: combine(t.total, e.total, (x, y) => x + y), path: combine(t.path, e.path, Math.max) },
-        (x, y) => x + y,
-      );
+      const t = countEffects(s.then, ctx, unreached);
+      const e = countEffects(s.else, ctx, unreached);
+      total = sum(total, sum(t.total, e.total));
+      here = after(own, either(t.paths, e.paths));
     } else if (s.k === 'switch') {
-      const arms = s.cases.map((c) => countCalls(c.body));
-      const dflt = countCalls(s.default ?? []);
+      const arms = s.cases.map((c) => countEffects(c.body, ctx, unreached));
+      const dflt = countEffects(s.default ?? [], ctx, unreached);
+      total = arms.reduce((acc, a) => sum(acc, a.total), sum(total, dflt.total));
       // A fall-through arm continues into the NEXT one emitted (the last into `default`), so a
       // path through arm i runs the chain starting at i — the shape the fall-through round's
-      // CRITICAL took. Built from the end; `chain[i]` is that arm's per-path count.
-      const chain: CallCounts[] = new Array(arms.length);
+      // CRITICAL took. Built from the end; `chain[i]` is that arm's paths.
+      const chain: PathCounts[] = new Array(arms.length);
       for (let i = arms.length - 1; i >= 0; i--) {
-        const next = i + 1 < arms.length ? chain[i + 1] : dflt.path;
-        chain[i] = s.cases[i].fallsThrough ? combine(arms[i].path, next, (x, y) => x + y) : arms[i].path;
+        const next = i + 1 < arms.length ? chain[i + 1] : dflt.paths;
+        chain[i] = s.cases[i].fallsThrough ? seq(arms[i].paths, next) : arms[i].paths;
       }
-      const armTotal = arms.reduce((acc, a) => combine(acc, a.total, (x, y) => x + y), dflt.total);
-      const armPath = chain.reduce((acc, c) => combine(acc, c, Math.max), dflt.path);
-      add({ total: armTotal, path: armPath }, (x, y) => x + y);
+      // No `default` is one more alternative: no arm runs. A `break` leaves the switch, so it
+      // continues after it as a fall-off-the-end does.
+      const inner = either(...chain, s.default ? dflt.paths : falls(new Map()));
+      here = after(own, { through: most(inner.through, inner.brk), ret: inner.ret, brk: null, cont: inner.cont });
+    } else if (stmtChildren(s).length > 0) {
+      // A loop: its sequenced children (a body, a `for`'s init/inc) counted ONCE — a loop's dynamic
+      // trip count is not a syntactic occurrence, and the IR side is static too. A `break` or
+      // `continue` in the body lands after the loop or at its test, and the test may exit without
+      // running the body.
+      const body = countEffects(stmtChildren(s), ctx, unreached);
+      total = sum(total, body.total);
+      const p = body.paths;
+      here = after(own, { through: most(p.through, p.brk, p.cont, new Map()), ret: p.ret, brk: null, cont: null });
+    } else if (s.k === 'return') {
+      here = { through: null, ret: own, brk: null, cont: null };
+    } else if (s.k === 'break') {
+      here = { through: null, ret: null, brk: own, cont: null };
+    } else if (s.k === 'continue') {
+      here = { through: null, ret: null, brk: null, cont: own };
     } else {
-      // Sequenced children (a loop body, a `for`'s init/inc): counted ONCE — a loop's dynamic trip
-      // count is not a syntactic occurrence, and the IR side is static too.
-      for (const c of stmtChildren(s)) {
-        add(countCalls([c]), (x, y) => x + y);
-      }
+      here = falls(own);
     }
+    paths = seq(paths, here);
   }
-  return { total, path };
+  return { total, paths };
 }
 
 /**
- * Post structuring: every call the asm makes is emitted, and none is emitted more times than the
- * asm makes it on any one path. See the note above for what this deliberately does not cover.
+ * Post structuring: every call and pinned access the asm makes is emitted, and none of those or of
+ * its declared volatile reads is emitted more times than the asm makes it on any one path. See the
+ * note above for what this deliberately does not cover.
  */
 export function assertEffectsPreserved(fn: Fn, sfn: SFn): void {
   // Reachable blocks only: an unreachable block's call is legitimately never emitted.
   const seen = reachableBlocks(fn);
-  const irCalls: CallCounts = new Map();
+  const irCalls: EffectCounts = new Map();
+  const irDevices: EffectCounts = new Map();
+  // Pinned accesses through a named global: in `irDevices` too, and exempt from the dropped rule.
+  const namedDevices = new Map<string, number>();
+  // …and the reads among them by the object they name, whose renders may be counted as its reads.
+  const pinnedReadsOf: EffectCounts = new Map();
+  const irDeclared: EffectCounts = new Map();
+  // Objects some unplaced read reads too, whose renders the tree side cannot tell from a declared one.
+  const plainlyRead = new Set<string>();
+  // Objects a declared store writes, and those some unplaced store writes too.
+  const declaredWritten = new Set<string>();
+  const plainlyWritten = new Set<string>();
   // Unmodelled instructions, by the mnemonic the frontend stamped. Same "never dropped" property as
   // a call, and it needs its own tally because an `opaque` carries no `target`.
   const irOpaques = new Set<string>();
+  const defs = new Map<Value, Op>();
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      op.results.forEach((r) => defs.set(r, op));
+    }
+  }
+  const bump = (m: EffectCounts, k: string) => m.set(k, (m.get(k) ?? 0) + 1);
+  // Of the unplaced qualified accesses, those whose address may be a stack object the frame audit
+  // qualified, so a refusal names that object rather than a device register.
+  const stackUnplaced: Record<Direction, StackUnplaced> = { r: { may: 0, only: 0 }, w: { may: 0, only: 0 } };
+  const reachOf = addressReach(fn, defs);
   for (const b of seen) {
     for (const op of b.ops) {
-      if (op.opcode === 'call' && typeof op.attrs.target === 'string') {
-        const t = op.attrs.target;
-        irCalls.set(t, (irCalls.get(t) ?? 0) + 1);
-      } else if (op.opcode === 'opaque') {
-        irOpaques.add(gapReasonFor(op.attrs.mnemonic));
+      const reads = op.opcode === 'load' || op.opcode === 'aload';
+      const placement = placedAt(op);
+      switch (placement) {
+        case 'call':
+          bump(irCalls, calleeName(op) ?? INDIRECT_CALL);
+          break;
+        case 'helper':
+          // Placed, not counted: the value it computes is pure.
+          break;
+        case 'device': {
+          const plain = op.opcode === 'load' || op.opcode === 'store';
+          const dir = reads ? 'r' : 'w';
+          const key = deviceKey(dir, plain ? constAddressOf(defs, op.operands[0], op.attrs.off as number) : null);
+          bump(irDevices, key);
+          const reach = key === deviceKey(dir, null) ? reachOf(op.operands[0]) : null;
+          if (reach?.stack === true) {
+            stackUnplaced[dir].may++;
+            if (!reach.other) {
+              stackUnplaced[dir].only++;
+            }
+          }
+          const object = globalBaseOf(defs, op.operands[0]);
+          if (object !== null) {
+            bump(namedDevices, key);
+            if (dir === 'r') {
+              bump(pinnedReadsOf, `${DECLARED}${object}`);
+            }
+          }
+          break;
+        }
+        case 'declared': {
+          const object = globalBaseOf(defs, op.operands[0]);
+          if (object !== null && reads) {
+            bump(irDeclared, `${DECLARED}${object}`);
+          } else if (object !== null) {
+            declaredWritten.add(object);
+          }
+          break;
+        }
+        case null:
+          if (op.opcode === 'opaque') {
+            irOpaques.add(gapReasonFor(op.attrs));
+          } else if (MEM_BASE_OPS.has(op.opcode)) {
+            const object = globalBaseOf(defs, op.operands[0]);
+            if (object !== null) {
+              (reads ? plainlyRead : plainlyWritten).add(object);
+            }
+          }
+          break;
+        default: {
+          // A new placement is keyed here before it is counted, or answered as not counted.
+          const unkeyed: never = placement;
+          throw new ContractError(`the effect contract keys no '${unkeyed as string}' placement`);
+        }
       }
     }
   }
+  for (const object of plainlyRead) {
+    irDeclared.delete(`${DECLARED}${object}`);
+  }
+  for (const object of plainlyWritten) {
+    declaredWritten.delete(object);
+  }
   // DROPPED only, not the RE-RUN half: a gap rendered twice is a diagnostic printed twice, which
   // costs nothing because nothing recompiles it, and structuring legitimately duplicates a shared
   // arm — so a per-path count here would fire on correct output.
@@ -216,21 +508,240 @@ export function assertEffectsPreserved(fn: Fn, sfn: SFn): void {
       }
     }
   }
-  if (!irCalls.size) {
+  if (!irCalls.size && !irDevices.size && !irDeclared.size && !declaredWritten.size) {
     return;
   }
-  const { total, path } = countCalls(sfn.body);
+  const unreached: Stmt[] = [];
+  const vt = declaredTypes(sfn);
+  const ctx: TreeContext = {
+    declared: new Set([...irDeclared.keys()].map((k) => k.slice(DECLARED.length))),
+    written: declaredWritten,
+    typeOf: (e) => exprCType(e, vt),
+    addresses: new Set([
+      ...(sfn.globals ?? []).map((g) => g.name),
+      ...[...(sfn.statics ?? []), ...(sfn.images ?? [])]
+        .filter((st) => st.type.kind === 'array' || st.type.kind === 'struct')
+        .map((st) => st.name),
+    ]),
+  };
+  const { total, paths } = countEffects(sfn.body, ctx, unreached);
+  if (unreached.length) {
+    throw new ContractError(
+      `structuring emitted ${unreached.length} statement(s) no path reaches in '${sfn.name}', after one every path leaves`,
+    );
+  }
+  const path = most(paths.through, paths.ret, paths.brk, paths.cont) ?? new Map<string, number>();
   for (const [name, n] of irCalls) {
-    if (!(total.get(name) ?? 0)) {
+    if (!(total.get(`call:${name}`) ?? 0)) {
       throw new ContractError(`structuring dropped the call to '${name}' in '${sfn.name}' — its effect is lost`);
     }
-    const p = path.get(name) ?? 0;
+    const p = path.get(`call:${name}`) ?? 0;
     if (p > n) {
       throw new ContractError(
         `structuring emitted ${p} calls to '${name}' on one path in '${sfn.name}', where the asm makes ${n}`,
       );
     }
   }
+  if (irDevices.size) {
+    devicesPreserved(sfn.name, irDevices, namedDevices, total, path, stackUnplaced);
+  }
+  for (const object of declaredWritten) {
+    if (total.has(`${STRIPPED_WRITE}${object}`)) {
+      throw new ContractError(
+        `structuring spelled a write to the volatile object '${object}' in '${sfn.name}' through a cast that ` +
+          'drops its qualifier',
+      );
+    }
+  }
+  for (const [key, n] of irDeclared) {
+    const object = key.slice(DECLARED.length);
+    if (total.has(`${STRIPPED}${object}`)) {
+      throw new ContractError(
+        `structuring spelled a read of the volatile object '${object}' in '${sfn.name}' through a cast that ` +
+          'drops its qualifier',
+      );
+    }
+    const p = path.get(key) ?? 0;
+    const made = n + (pinnedReadsOf.get(key) ?? 0);
+    if (p > made) {
+      throw new ContractError(
+        `structuring emitted ${p} reads of the volatile object '${object}' on one path in '${sfn.name}', ` +
+          `where the asm makes ${made}`,
+      );
+    }
+  }
+}
+
+/** One direction of a device count map: the count at each address it reads off, and at `?`. */
+function oneDirection(m: EffectCounts, dir: Direction): { at: Map<string, number>; unplaced: number; all: number } {
+  const prefix = `device:${dir}:`;
+  const at = new Map<string, number>();
+  let unplaced = 0;
+  let all = 0;
+  for (const [k, v] of m) {
+    if (k.startsWith(prefix)) {
+      all += v;
+      if (k === `${prefix}?`) {
+        unplaced = v;
+      } else {
+        at.set(k.slice(prefix.length), v);
+      }
+    }
+  }
+  return { at, unplaced, all };
+}
+
+/** What an address may be: a stack object, something else, or either. */
+interface AddressReach {
+  stack: boolean;
+  other: boolean;
+}
+
+/** What each address may be: a stack object (a `laddr`, moved by `add`/`sub`), anything but a named
+ *  global, or — through a phi whose incoming values differ — either. A fixpoint, so a loop phi
+ *  stepped from a `laddr` is a stack object only. */
+function addressReach(fn: Fn, defs: ReadonlyMap<Value, Op>): (addr: Value) => AddressReach {
+  const incoming = new Map<Value, Value[]>();
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      for (const s of op.successors ?? []) {
+        s.args.forEach((arg, i) => {
+          const param = s.block.params[i];
+          if (param !== undefined) {
+            (incoming.get(param) ?? incoming.set(param, []).get(param)!).push(arg);
+          }
+        });
+      }
+    }
+  }
+  const NONE: AddressReach = { stack: false, other: false };
+  const known = new Map<Value, AddressReach>();
+  const at = (v: Value) => known.get(v) ?? NONE;
+  // A value not yet reached stays NONE, so an `add` waiting on one does not call itself `other`.
+  const step = (v: Value): AddressReach => {
+    const d = defs.get(v);
+    if (d === undefined) {
+      const from = incoming.get(v) ?? [];
+      return from.length === 0
+        ? { stack: false, other: true }
+        : { stack: from.some((a) => at(a).stack), other: from.some((a) => at(a).other) };
+    }
+    if (d.opcode === 'laddr') {
+      return { stack: true, other: false };
+    }
+    // An access through a named global is exempt from the dropped rule, so a phi side that names
+    // one is not what a refusal names.
+    if (d.opcode === 'gaddr') {
+      return NONE;
+    }
+    if (d.opcode !== 'add' && d.opcode !== 'sub') {
+      return { stack: false, other: true };
+    }
+    const roots = (d.opcode === 'add' ? d.operands : d.operands.slice(0, 1)).map(at);
+    const bases = roots.filter((r) => r.stack);
+    if (bases.length > 0) {
+      return { stack: true, other: bases.some((r) => r.other) };
+    }
+    return roots.some((r) => !r.other) ? NONE : { stack: false, other: true };
+  };
+  const values = [...defs.keys(), ...incoming.keys()];
+  for (let changed = true; changed;) {
+    changed = false;
+    for (const v of values) {
+      const was = at(v);
+      const now = step(v);
+      const joined = { stack: was.stack || now.stack, other: was.other || now.other };
+      if (joined.stack !== was.stack || joined.other !== was.other) {
+        known.set(v, joined);
+        changed = true;
+      }
+    }
+  }
+  return (addr) => (known.has(addr) ? at(addr) : { stack: false, other: true });
+}
+
+/** How many unplaced qualified accesses may be a stack object, and how many can be nothing else. */
+interface StackUnplaced {
+  may: number;
+  only: number;
+}
+
+/** What an unplaced qualified access may be, given how many of `unplaced` may or must be a stack
+ *  object. */
+function unplacedNoun(stack: StackUnplaced, unplaced: number): { one: string; many: string } {
+  if (stack.may === 0) {
+    return { one: 'a device register', many: 'device registers' };
+  }
+  if (stack.only >= unplaced) {
+    return { one: 'an address-taken stack local', many: 'address-taken stack locals' };
+  }
+  return { one: 'a device register or a stack local', many: 'device registers or a stack local' };
+}
+
+const NOUNS: Readonly<Record<Direction, { one: string; many: string }>> = {
+  r: { one: 'read of', many: 'reads of' },
+  w: { one: 'write to', many: 'writes to' },
+};
+
+/** The pinned-access half of {@link assertEffectsPreserved}, over the counts keyed by `deviceKey`:
+ *  first that no access is dropped, then that none is re-run, each direction on its own. */
+function devicesPreserved(
+  name: string,
+  ir: EffectCounts,
+  named: EffectCounts,
+  total: EffectCounts,
+  path: EffectCounts,
+  stackUnplaced: Readonly<Record<Direction, StackUnplaced>>,
+): void {
+  const directions = ['r', 'w'] as const;
+  for (const dir of directions) {
+    const made = oneDirection(ir, dir);
+    const exempt = oneDirection(named, dir);
+    const renders = oneDirection(total, dir);
+    // An access through a named global needs no render of its own.
+    const owed = (a: string) => Math.max(0, (made.at.get(a) ?? 0) - (exempt.at.get(a) ?? 0));
+    const short = [...made.at.keys()].filter((a) => owed(a) > (renders.at.get(a) ?? 0));
+    const deficit = short.reduce((n, a) => n + owed(a) - (renders.at.get(a) ?? 0), 0);
+    if (deficit > renders.unplaced) {
+      throw new ContractError(
+        short.length === 1
+          ? `structuring dropped the ${NOUNS[dir].one} the device register at ${short[0]} in '${name}' — ` +
+              'the machine made it and the source does not'
+          : `structuring dropped ${NOUNS[dir].many} the device registers at ${short.join(', ')} in '${name}' — ` +
+              'the machine made them and the source does not',
+      );
+    }
+    const owedAll = [...made.at.keys()].reduce((n, a) => n + owed(a), 0) + Math.max(0, made.unplaced - exempt.unplaced);
+    if (owedAll > renders.all) {
+      throw new ContractError(
+        `structuring dropped a ${NOUNS[dir].one} ${unplacedNoun(stackUnplaced[dir], made.unplaced).one} in ` +
+          `'${name}' — the machine made it and the source does not`,
+      );
+    }
+  }
+  for (const dir of directions) {
+    const made = oneDirection(ir, dir);
+    const onPath = oneDirection(path, dir);
+    let excess = 0;
+    for (const [a, p] of onPath.at) {
+      const n = made.at.get(a) ?? 0;
+      if (p > n + made.unplaced) {
+        throw new ContractError(
+          `structuring emitted ${p} ${NOUNS[dir].many} the device register at ${a} on one path in '${name}', ` +
+            `where the asm makes ${n + made.unplaced}`,
+        );
+      }
+      excess += Math.max(0, p - n);
+    }
+    if (excess > made.unplaced || onPath.all > made.all) {
+      // past the unplaced count, the excess is at the addresses, every one a device register
+      const what = excess > made.unplaced ? 'device registers' : unplacedNoun(stackUnplaced[dir], made.unplaced).many;
+      throw new ContractError(
+        `structuring emitted ${onPath.all} ${NOUNS[dir].many} ${what} on one path in '${name}', where the ` +
+          `asm makes ${made.all}`,
+      );
+    }
+  }
 }
 
 /** Post structuring: a local the body READS must be WRITTEN somewhere in it. A materialized value
@@ -259,12 +770,24 @@ export function assertLocalsWritten(sfn: SFn): void {
     if ((e.k === 'var' || e.k === 'addr') && suspect.has(e.name)) {
       (e.k === 'addr' ? written : read).add(e.name);
     }
+    // `v++` is a read and a write, so it answers both sides.
+    if (e.k === 'postincr' && suspect.has(e.name)) {
+      read.add(e.name);
+      written.add(e.name);
+    }
     exprChildren(e).forEach(walkExpr);
   };
+  // A store to a member of a local struct (`ret.a = v`) writes that local.
+  const memberOf = (e: Expr): string | undefined =>
+    e.k === 'field' && e.dot === true ? (e.base.k === 'var' ? e.base.name : memberOf(e.base)) : undefined;
   const walkStmt = (st: Stmt): void => {
     if (st.k === 'assign' && suspect.has(st.name)) {
       written.add(st.name);
     }
+    const member = st.k === 'store' ? memberOf(st.lval) : undefined;
+    if (member !== undefined && suspect.has(member)) {
+      written.add(member);
+    }
     stmtExprs(st).forEach(walkExpr);
     stmtChildren(st).forEach(walkStmt);
   };
@@ -278,6 +801,46 @@ export function assertLocalsWritten(sfn: SFn): void {
   }
 }
 
+/** Post structuring, and after every respell variation: a `postincr` is the ONLY mention of its
+ *  local inside the full expression holding it.
+ *
+ *  C89 leaves a program undefined when an object is modified and also read elsewhere between two
+ *  sequence points, so `v1++ <= 9 && v1 != 0` is not a spelling asmlift may emit — the compiler
+ *  picks either value, and the candidate still compiles and scores. The producer establishes the
+ *  property on the tree it builds (structure.ts's `emitDoWhile`, judged by `PREUPDATE_COND_GATES`);
+ *  what this catches is a later pass bringing a SECOND mention into that expression — `l3/coalesce.ts`
+ *  renames one local onto another over a whole body, and asks nothing about this.
+ *
+ *  PER FULL EXPRESSION, not per function: a statement boundary is a sequence point, so the loop
+ *  body reading the same name is well-defined, and a pass that duplicates a whole expression owes
+ *  the evaluation-trace argument to `exprHasEffect` rather than to this contract. */
+export function assertPostIncrUnshared(sfn: SFn): void {
+  const overUpdated = (e: Expr): string | undefined => {
+    const mentions = new Map<string, number>();
+    const updated = new Set<string>();
+    const walk = (x: Expr): void => {
+      if (x.k === 'var' || x.k === 'addr' || x.k === 'postincr') {
+        mentions.set(x.name, (mentions.get(x.name) ?? 0) + 1);
+      }
+      if (x.k === 'postincr') {
+        updated.add(x.name);
+      }
+      exprChildren(x).forEach(walk);
+    };
+    walk(e);
+    return [...updated].find((n) => mentions.get(n)! > 1);
+  };
+  const bad = (s: Stmt): string | undefined =>
+    stmtExprs(s).map(overUpdated).find(Boolean) ?? stmtChildren(s).map(bad).find(Boolean);
+  const name = sfn.body.map(bad).find(Boolean);
+  if (name !== undefined) {
+    throw new ContractError(
+      `'${name}' is updated by a post-increment and read again in the same expression in '${sfn.name}' — ` +
+        `C89 leaves which value the other read sees undefined`,
+    );
+  }
+}
+
 /** After a respell variation: a local a pass DELETED from the declaration list is named nowhere in the tree it
  *  produced.
  *
@@ -326,6 +889,131 @@ export function assertNoOrphanedLocals(before: SFn, after: SFn): void {
   }
 }
 
+/** The types a tree reads or writes LOCAL STORAGE at, other than an integer — the frame bytes
+ *  reached by address (l3/storage.ts `localAddresses`), each access typed as it is spelled
+ *  (`exprCType`: the cast on the storage, or the element struct's field). An aggregate is the
+ *  element a `.field` selects from, not an access, so only scalars count. */
+function localStorageNonIntegers(sfn: SFn): Set<string> {
+  const { isAddress, accessAddress } = localAddresses(sfn);
+  const vt = declaredTypes(sfn);
+  const out = new Set<string>();
+  for (const e of walkExprs(sfn.body)) {
+    if ((e.k === 'index' || e.k === 'field') && isAddress(accessAddress(e))) {
+      const t = exprCType(e, vt);
+      if (t !== undefined && t.kind !== 'int' && t.kind !== 'struct' && t.kind !== 'array') {
+        out.add(typeToString(t));
+      }
+    }
+  }
+  return out;
+}
+
+/** After a respell variation: no access to LOCAL STORAGE is re-typed to a non-integer.
+ *
+ *  The frame audit's licence for a runtime index wider than a byte (frontend/frame-objects.ts
+ *  `indexedWidth`) rests on what L3 SPELLS: agbcc at -O2 keeps a read ordered after a store to the
+ *  same bytes only while both are integers of one width, and gives a pointer (or `long`, or a
+ *  float) an alias set of its own, so a variation that re-types the bytes' reads hands the
+ *  compiler a stale read the asm never had — C that compiles, scores, and is wrong. `/ptr-field`'s
+ *  `over-local-storage` gate is the refusal that names itself; this is the backstop for the next
+ *  variation that re-types, failing at its own stage rather than three away.
+ *
+ *  A DIFFERENTIAL, like `assertNoOrphanedLocals`: it judges only a non-integer type the tree it
+ *  derives from did not already read the storage at. The default tree is the frame audit's
+ *  answer, and a type it gives a local object (a header-typed out-parameter's pointer member, say)
+ *  is the source's own spelling, not a variation's claim. */
+export function assertLocalStorageStaysInteger(before: SFn, after: SFn): void {
+  const had = localStorageNonIntegers(before);
+  const added = [...localStorageNonIntegers(after)].filter((t) => !had.has(t));
+  if (added.length) {
+    throw new ContractError(
+      `a respell variation re-typed an access to local storage in '${after.name}' as ${added
+        .sort()
+        .map((t) => `'${t}'`)
+        .join(', ')} — not an integer, so agbcc may read it stale past an integer store to the same bytes`,
+    );
+  }
+}
+
+/** A FRAME UNION IS READ AND WRITTEN ONLY THROUGH ITS VIEWS. The frame audit declares storage
+ *  accessed at two widths over one byte as a union of per-width views (frontend/frame-objects.ts
+ *  `unionViews`, structure.ts `laddrType`), because agbcc gives an access through a union member
+ *  alias set 0 and reorders nothing past it — where a cast on the same bytes is read stale past a
+ *  store of the other width. That licence holds only while EVERY access is a member access:
+ *    - the union's name appears only as the base of a view (`u.half`), and an element of an array
+ *      view is subscripted, element 0 included — `*u.half` dereferences the view's decay, an
+ *      INDIRECT_REF agbcc types by its pointee and reads stale exactly as the cast (compiled);
+ *    - nothing is accessed through its ADDRESS: `&u`, under casts and `+`/`-`, or a local ever
+ *      assigned such a value, as the base of a subscript, an arrow or a deref is the cast
+ *      spelling again. The address itself may go anywhere a value goes — a call's argument, a
+ *      device's source register — since handing it on accesses nothing.
+ *  ABSOLUTE, not a differential: the default tree satisfies it by construction, so any tree that
+ *  does not was made by a variation. Checked on the default tree (pipeline.ts) and on every
+ *  respelled one (rank.ts, beside `assertLocalStorageStaysInteger`). */
+export function assertFrameUnionsViewed(sfn: SFn): void {
+  const unions = new Map(sfn.locals.filter((l) => l.type.kind === 'union').map((l) => [l.name, l.type]));
+  if (unions.size === 0) {
+    return;
+  }
+  const bad = (why: string): never => {
+    throw new ContractError(`'${sfn.name}' ${why} — agbcc may read the frame union stale through it`);
+  };
+  const reaches = (e: Expr, held: ReadonlySet<string>): boolean => {
+    switch (e.k) {
+      case 'addr':
+        return unions.has(e.name);
+      case 'var':
+        return held.has(e.name);
+      case 'cast':
+        return reaches(e.e, held);
+      case 'bin':
+        return (e.op === '+' || e.op === '-') && (reaches(e.l, held) || reaches(e.r, held));
+      default:
+        return false;
+    }
+  };
+  const held = taintOverAssigns(assignsIn(sfn.body), [], (a, t) => reaches(a.value, t));
+  const isView = (e: Expr): boolean =>
+    e.k === 'field' && e.dot === true && e.base.k === 'var' && unions.has(e.base.name);
+  const visit = (e: Expr): void => {
+    if (e.k === 'field' && isView(e)) {
+      if (memberOf(unions.get((e.base as { name: string }).name), e.name) === undefined) {
+        bad(`names '${e.name}', which is no view of the frame union`);
+      }
+      return;
+    }
+    if (e.k === 'index' && isView(e.base)) {
+      if (e.idx.k === 'const' && e.idx.value === 0 && e.subscript !== true) {
+        bad('dereferences a view of a frame union (`*u.view`) instead of subscripting it');
+      }
+      visit(e.base);
+      visit(e.idx);
+      return;
+    }
+    if ((e.k === 'index' || (e.k === 'field' && e.dot !== true)) && reaches(e.base, held)) {
+      bad('accesses a frame union through a pointer to its bytes');
+    }
+    if (e.k === 'var' && unions.has(e.name)) {
+      bad(`uses the frame union '${e.name}' other than through a view`);
+    }
+    exprChildren(e).forEach(visit);
+  };
+  const walk = (list: readonly Stmt[]): void => {
+    for (const st of list) {
+      if (st.k === 'assign' && unions.has(st.name)) {
+        bad(`assigns the frame union '${st.name}' whole`);
+      }
+      stmtExprs(st).forEach(visit);
+      // a `for`'s init and inc are statements of their own, outside both lists
+      stmtLists(st).forEach(walk);
+      if (st.k === 'for') {
+        walk([st.init, st.inc]);
+      }
+    }
+  };
+  walk(sfn.body);
+}
+
 /** After a respell variation: every read of a MINTED local — its ADDRESS being taken included — must sit where
  *  that local's assignment has already run.
  *
@@ -358,9 +1046,10 @@ export function assertHoistsDominate(sfn: SFn, minted: ReadonlySet<string>): voi
   const readUndominated = (e: Expr, live: ReadonlySet<string>): string | null => {
     // `&p` COUNTS, the same mention the placing passes query on (l3/hoist.ts): the address is what
     // a callee reads the cell through, so an init has to precede it as surely as it must precede a
-    // read.
-    if ((e.k === 'var' || e.k === 'addr') && minted.has(e.name) && !live.has(e.name)) {
-      return e.name;
+    // read. `mentionedName` is the vocabulary rather than a pair of arms here for that reason.
+    const n = mentionedName(e);
+    if (n !== undefined && minted.has(n) && !live.has(n)) {
+      return n;
     }
     let bad: string | null = null;
     mapExprChildren(e, (c) => {
@@ -460,9 +1149,12 @@ export function assertDerefsTyped(sfn: SFn): void {
   const NO_PTR_OPS = new Set<BinOp>(['&', '|', '^', '<<', '>>', '>>>', '*', '/', '/u', '%', '%u']);
   // The comparison operators — where a bare `&SYM` operand is SIGN-ambiguous, not ill-formed.
   const CMP_OPS = new Set(['<', '<=', '>', '>=', '==', '!=']);
-  // 1/2/4 only: the decomp typedef vocabulary (C_TYPEDEFS) has no 64-bit scalar, so a width-8
-  // access would print as the nonexistent `(s64 *)` — exactly the three-stages-later failure
-  // this rule pre-empts. (If f64 loads ever land they are floats, not a scalar width here.)
+  // 1/2/4 only. `s64` IS in the typedef vocabulary now (target.ts C_TYPEDEFS), and the 8-byte
+  // ACCESS still is not: nothing in this pipeline recognises a pair of word loads as one 64-bit
+  // read, so a width-8 index here would be a claim no pass makes. The rule pre-empts the
+  // three-stages-later failure either way. (If f64 loads ever land they are floats, not a scalar
+  // width here.) Adding 8 would also silently under-report in `l3/typing.ts` `exprIntWidth`, whose
+  // soundness rests on memory not being a way a 64-bit value enters a rendered expression.
   const SCALAR_WIDTHS = new Set([1, 2, 4]);
   // Dot-form field bases (struct-array elements) carry the struct STRIDE as their width — any
   // stride matching the element size is legal there (the tree-level struct cast governs the
@@ -477,8 +1169,9 @@ export function assertDerefsTyped(sfn: SFn): void {
     if (e.k === 'index' && !structElem.has(e) && !SCALAR_WIDTHS.has(e.width)) {
       bad.push(`index width ${e.width} is not a C scalar width`);
     }
-    // The emitter legalizes pointer operands away from these ops (structure.ts intify); a
-    // pointer surviving here is ill-typed C the compiler will reject.
+    // The emitter legalizes pointer operands away from these ops (structure/pointer-spelling.ts
+    // `ARITH_ROWS`, its `bitwise` row); a pointer surviving here is ill-typed C the compiler will
+    // reject.
     if (e.k === 'bin' && NO_PTR_OPS.has(e.op)) {
       for (const side of [e.l, e.r]) {
         if (ctype(side)?.kind === 'ptr') {
@@ -490,9 +1183,9 @@ export function assertDerefsTyped(sfn: SFn): void {
     // offset by sizeof(SYM), which is unknown for a header-typed global, so `&SYM + N` is byte-
     // inexact. Nothing emits this shape anymore: a load/store base folds byte-correctly (globalOf
     // turns `&SYM + N` into an `index`/`field` node whose base is a bare `addr`), and the additive
-    // lowering intifies every other `addr` operand to `(u32)&SYM` (structure.ts intifyAddr — the
-    // cast types int, so it never lands here). A bare `addr` reaching a `+`/`-` operand is therefore
-    // a lowering REGRESSION — flag it rather than emit wrong bytes.
+    // lowering intifies every other `addr` operand to `(u32)&SYM` (structure/pointer-spelling.ts
+    // ARITH_ROWS — the cast types int, so it never lands here). A bare `addr` reaching a `+`/`-`
+    // operand is therefore a lowering REGRESSION — flag it rather than emit wrong bytes.
     if (e.k === 'bin' && (e.op === '+' || e.op === '-')) {
       const addrSide = e.l.k === 'addr' ? e.l : e.r.k === 'addr' ? e.r : undefined;
       if (addrSide) {
@@ -526,10 +1219,10 @@ export function assertDerefsTyped(sfn: SFn): void {
       if (bt) {
         // type-check against the same dot-vs-arrow spelling the printer will use (shared rule)
         const st = fieldSpellsDot(e) ? bt : bt.kind === 'ptr' ? bt.to : undefined;
-        if (!st || st.kind !== 'struct') {
+        if (!st || (st.kind !== 'struct' && st.kind !== 'union')) {
           bad.push(`member access '${e.name}' on a non-struct base (C type '${typeToString(bt)}')`);
-        } else if (!st.fields.some((f) => f.name === e.name)) {
-          bad.push(`member access '${e.name}' not declared on '${st.name}'`);
+        } else if (memberOf(st, e.name) === undefined) {
+          bad.push(`member access '${e.name}' not declared on '${typeToString(st)}'`);
         }
       }
     }