diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww
index 20b1fc08..dfa07613 100644
--- a/selfhost/cmd/w6c/main.combined.ww
+++ b/selfhost/cmd/w6c/main.combined.ww
@@ -12588,19 +12588,29 @@ export fn isnullabletype(t: *node) bool = {
 };
 
 // nullableptrtag — 0-based index of the *T variant in a nullable
-// union. The void variant takes the other slot (0 or 1). AST-keyed
-// for now: tinfofornode doesn't populate TY_TAGGED.params yet
-// (check.ww:1287-1337 sets size/align/nullable but not the variant
-// chain), so the tinfo equivalent of cstage cgen.c:405
-// `nullable_ptr_tag` can't read params today. Graduates to a pure
-// tinfo helper in A.6.3f (#50) alongside the variant-index work and
-// the tparam-population glue.
+// union. Mirror of cstage cgen.c:404-416 `nullable_ptr_tag`: linear
+// scan ti.params, strip TY_NAMED on each variant, return idx of first
+// TY_PTR. Phase 1 (26724fe) populated the chain in tinfofornode's
+// TTAGGED arm so this walk could retire the AST-keyed predecessor.
 export fn nullableptrtag(t: *node) i32 = {
 	if (t == nil) { return 0; };
-	if (t.kind != nkind.N_TTAGGED) { return 0; };
-	let a: *node = t.list;
-	if (a != nil) { if (a.kind == nkind.N_TPTR) { return 0; }; };
-	return 1;
+	let ti: *tinfo = t.type_: *tinfo;
+	if (ti == nil) { return 0; };
+	if (ti.kind != tykind.TY_TAGGED) { return 0; };
+	let p: *tparam = ti.params;
+	let i: i32 = 0;
+	for (p != nil) {
+		let vt: *tinfo = p.type_;
+		if (vt != nil) {
+			if (vt.kind == tykind.TY_NAMED) { vt = vt.under; };
+			if (vt != nil) {
+				if (vt.kind == tykind.TY_PTR) { return i; };
+			};
+		};
+		p = p.tnext;
+		i += 1;
+	};
+	return 0;
 };
 
 // voidvariantindex — find the 0-based index of the `void` variant in a
diff --git a/selfhost/cmd/wcc/cgenutil.ww b/selfhost/cmd/wcc/cgenutil.ww
index c0cf2187..49e4b60b 100644
--- a/selfhost/cmd/wcc/cgenutil.ww
+++ b/selfhost/cmd/wcc/cgenutil.ww
@@ -2204,19 +2204,29 @@ export fn isnullabletype(t: *node) bool = {
 };
 
 // nullableptrtag — 0-based index of the *T variant in a nullable
-// union. The void variant takes the other slot (0 or 1). AST-keyed
-// for now: tinfofornode doesn't populate TY_TAGGED.params yet
-// (check.ww:1287-1337 sets size/align/nullable but not the variant
-// chain), so the tinfo equivalent of cstage cgen.c:405
-// `nullable_ptr_tag` can't read params today. Graduates to a pure
-// tinfo helper in A.6.3f (#50) alongside the variant-index work and
-// the tparam-population glue.
+// union. Mirror of cstage cgen.c:404-416 `nullable_ptr_tag`: linear
+// scan ti.params, strip TY_NAMED on each variant, return idx of first
+// TY_PTR. Phase 1 (26724fe) populated the chain in tinfofornode's
+// TTAGGED arm so this walk could retire the AST-keyed predecessor.
 export fn nullableptrtag(t: *node) i32 = {
 	if (t == nil) { return 0; };
-	if (t.kind != nkind.N_TTAGGED) { return 0; };
-	let a: *node = t.list;
-	if (a != nil) { if (a.kind == nkind.N_TPTR) { return 0; }; };
-	return 1;
+	let ti: *tinfo = t.type_: *tinfo;
+	if (ti == nil) { return 0; };
+	if (ti.kind != tykind.TY_TAGGED) { return 0; };
+	let p: *tparam = ti.params;
+	let i: i32 = 0;
+	for (p != nil) {
+		let vt: *tinfo = p.type_;
+		if (vt != nil) {
+			if (vt.kind == tykind.TY_NAMED) { vt = vt.under; };
+			if (vt != nil) {
+				if (vt.kind == tykind.TY_PTR) { return i; };
+			};
+		};
+		p = p.tnext;
+		i += 1;
+	};
+	return 0;
 };
 
 // voidvariantindex — find the 0-based index of the `void` variant in a
diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww
index 5ac78ace..8ca8484f 100644
--- a/selfhost/cmd/wwdump/main.combined.ww
+++ b/selfhost/cmd/wwdump/main.combined.ww
@@ -12588,19 +12588,29 @@ export fn isnullabletype(t: *node) bool = {
 };
 
 // nullableptrtag — 0-based index of the *T variant in a nullable
-// union. The void variant takes the other slot (0 or 1). AST-keyed
-// for now: tinfofornode doesn't populate TY_TAGGED.params yet
-// (check.ww:1287-1337 sets size/align/nullable but not the variant
-// chain), so the tinfo equivalent of cstage cgen.c:405
-// `nullable_ptr_tag` can't read params today. Graduates to a pure
-// tinfo helper in A.6.3f (#50) alongside the variant-index work and
-// the tparam-population glue.
+// union. Mirror of cstage cgen.c:404-416 `nullable_ptr_tag`: linear
+// scan ti.params, strip TY_NAMED on each variant, return idx of first
+// TY_PTR. Phase 1 (26724fe) populated the chain in tinfofornode's
+// TTAGGED arm so this walk could retire the AST-keyed predecessor.
 export fn nullableptrtag(t: *node) i32 = {
 	if (t == nil) { return 0; };
-	if (t.kind != nkind.N_TTAGGED) { return 0; };
-	let a: *node = t.list;
-	if (a != nil) { if (a.kind == nkind.N_TPTR) { return 0; }; };
-	return 1;
+	let ti: *tinfo = t.type_: *tinfo;
+	if (ti == nil) { return 0; };
+	if (ti.kind != tykind.TY_TAGGED) { return 0; };
+	let p: *tparam = ti.params;
+	let i: i32 = 0;
+	for (p != nil) {
+		let vt: *tinfo = p.type_;
+		if (vt != nil) {
+			if (vt.kind == tykind.TY_NAMED) { vt = vt.under; };
+			if (vt != nil) {
+				if (vt.kind == tykind.TY_PTR) { return i; };
+			};
+		};
+		p = p.tnext;
+		i += 1;
+	};
+	return 0;
 };
 
 // voidvariantindex — find the 0-based index of the `void` variant in a