`il::Type::Ptr` distinct from `W64`. All memory ops use `Ptr` for base

registers. Loads/stores of pointer values use `Ptr` as the type.

Backend treats `Ptr` identically to `W64` for codegen.

### Explicit casts (Phase 3)

Pointer-to-integer is a safe demotion (no instruction needed).

### Provenance rules (Phase 4)

Closed set of pointer-producing instructions documented in `il.rad`:

Reserve, Copy(DataSym/FnAddr), Load with Ptr type, Elem, BinOp::Add

flows are safe and need no dedicated instruction.

### unsafe keyword (Phase 5)

`unsafe fn` and `unsafe { }` blocks. Integer-to-pointer casts

(`addr as *T`) only allowed in unsafe context. Resolver enforces.

SSA type checker in `il/verify.rad`. Tracks `Ptr(bound)` per register.

Checks:

- Memory op bases are Ptr

- Static offset access within allocation bounds

- Elem base is Ptr, result is Ptr(stride)

## Remaining gaps

### Slice re-slicing uses unchecked `add ptr`

`&slice[start..end]` offsets the data pointer via `add ptr` with no

        case il::Instr::Sext { typ, dst, val } => {

            let rd = getDstReg(s, dst, super::SCRATCH1);

            let rs = resolveVal(s, super::SCRATCH1, val);

            emitSext(s.e, rd, rs, typ);

        },

            let rd = getDstReg(s, dst, super::SCRATCH1);

            let rs = resolveVal(s, super::SCRATCH1, val);

            emitMv(s, rd, rs);

        },

        case il::Instr::Ret { val } => {

//! | `Load` with `typ: Ptr` | Derived from an existing pointer         |

//! | `Elem`                 | Bounds-checked element pointer           |

//! | `BinOp::Add` on `Ptr`  | Pointer arithmetic (derived)             |

//! | `Call` returning `Ptr`  | Callee-produced pointer                 |

//! | Block parameter         | Merges pointer values from predecessors  |

//!

//! Any other instruction producing a register used as a memory base is

//! a verifier error.

//!

//! Pointer arithmetic (`BinOp::Add` with `typ: Ptr`) requires exactly

        /// Destination register, always I32.

        dst: Reg,

        /// Source value.

        val: Val,

    },

    ////////////////////

    // Function calls //

    ////////////////////

        case Instr::Copy { dst, .. } => return dst,

        case Instr::BinOp { dst, .. } => return dst,

        case Instr::UnOp { dst, .. } => return dst,

        case Instr::Zext { dst, .. } => return dst,

        case Instr::Sext { dst, .. } => return dst,

        case Instr::Call { dst, .. } => return dst,

        case Instr::Ecall { dst, .. } => return dst,

        case Instr::Elem { dst, .. } => return dst,

        else => return nil,

    }

            withReg(a, f, ctx),

        case Instr::Zext { val, .. } =>

            withReg(val, f, ctx),

        case Instr::Sext { val, .. } =>

            withReg(val, f, ctx),

            withReg(val, f, ctx),

        case Instr::Call { func, args, .. } => {

            withReg(func, f, ctx);

            for arg in args {

                withReg(arg, f, ctx);

        // Conversion operations.

        case super::Instr::Zext { dst, typ, val } =>

            writeTypedUnaryOp(out, a, "zext", typ, dst, val),

        case super::Instr::Sext { dst, typ, val } =>

            writeTypedUnaryOp(out, a, "sext", typ, dst, val),

            writeReg(out, a, dst);

            write(out, " ");

            writeVal(out, a, val);

        }

//! Walks each function's blocks and checks pointer-provenance rules:

//!

//! 1. Every register is assigned a type (W8/W16/W32/W64/Ptr) based on

//!    its defining instruction.

//! 2. Load/Store/Blit base registers must have type Ptr.

//! 4. BinOp::Add with Ptr type requires exactly one Ptr operand.

//! 5. Copy(DataSym)/Copy(FnAddr) produces Ptr; Copy(Imm) produces W64.

//! 6. Reserve always produces Ptr.

//! 7. Static offset checks: field access at constant offsets is validated

//!    against the known allocation size when available.

/// Result of verifying a program.

pub record VerifyResult {

    /// Errors found during verification.

    errors: *mut [VerifyError],

}

/// Verify pointer-type safety of an IL program.

///

/// Returns a list of errors. An empty list means the program passes

/// errors (they are legal in unsafe code).

pub fn verifyProgram(program: *super::Program, arena: *mut alloc::Arena) -> VerifyResult {

    let a = alloc::arenaAllocator(arena);

    let mut errors: *mut [VerifyError] = &mut [];

    for func in program.fns {

        if func.isExtern {

            continue;

        }

    }

}

/// Inferred type of an SSA register: either a word width or pointer.

union RegType {

    /// Not yet defined.

/// Verify a single function.

fn verifyFn(

    func: *super::Fn,

    errors: *mut *mut [VerifyError],

    a: alloc::Allocator,

) {

    // Type map: regId -> RegType.

    let mut regTypes: [RegType; MAX_REGS] = undefined;

    for i in 0..MAX_REGS {

                instrIdx: instrIdx as u32,

                regs: &mut regTypes[..],

                errors,

                a,

            };

        }

    }

}

/// Verify a single instruction: assign dst type and check operands.

    match instr {

        case super::Instr::Reserve { dst, size, .. } => {

            let bound = immVal(size) else {

                setReg(ctx.regs, dst, RegType::Ptr(UNKNOWN_BOUND));

                return;

            setReg(ctx.regs, dst, RegType::Word(typ)),

        case super::Instr::Zext { dst, .. } =>

            setReg(ctx.regs, dst, RegType::Word(super::Type::W64)),

        case super::Instr::Sext { dst, .. } =>

            setReg(ctx.regs, dst, RegType::Word(super::Type::W64)),

            setReg(ctx.regs, dst, RegType::Ptr(UNKNOWN_BOUND));

        }

        case super::Instr::Call { retTy, dst, .. } => {

            if let d = dst {

                setReg(ctx.regs, d, regTypeFromIl(retTy));

    }, a);

}

/// Print verification results to stderr.

pub fn printResult(result: *VerifyResult) {

        io::printError("verify: ok\n");

        return;

    }

    let mut buf: [u8; 10] = undefined;

        io::printError("verify: ");

    }

    for err in result.errors {

        io::printError("verify: ");

        io::printError(err.fnName);

        io::printError(" block ");

    }

    // Pointer-to-integer: safe demotion, no instruction needed.

    if isPtrLike(srcType) and not isPtrLike(dstType) {

        return val;

    }

    if not isPtrLike(srcType) and isPtrLike(dstType) {

        let dst = nextReg(self);

        return il::Val::Reg(dst);

    }

    return lowerNumericCast(self, val, srcType, dstType);

}

fn w32 $unsafeRead(w64 %0) {

  @entry0

    sload w32 %2 %1 0;

    ret %2;

}

fn w32 $main() {

    call w32 %1 $unsafeRead(%0);

    br.eq w32 %1 42 @assert.ok2 @assert.fail1;

  @assert.fail1

    unreachable;

  @assert.ok2

    sload w32 %3 %2 0;

    br.eq w32 %3 42 @assert.ok4 @assert.fail3;

  @assert.fail3

    unreachable;

  @assert.ok4