test: migrate deref/narrow/stride family-6 to test/lang @test, retire C twins (fold-2)

Continue fold-2: migrate the pointer-deref / narrow-load / pointer-array-stride
family from bespoke build+run C twins to test/lang @test, retiring each twin in
the same commit. Runtime coverage MOVES from $(TESTS) to test-lang (T1 runs +
asserts via `ww test`) + test-lang-byteid (T2 keeps cs==ww .s byte-id); the
$(TESTS) headline drops 5. Every assert is a primitive int/bool comparison with
a width-preserving (`==`) sink so a stale high half or wrong stride FAILS; the
narrow-signed rows route through an `: i32` cast against a 64B-widened literal
to force sign-extension onto the load. Each .c row maps to one inline @test fn
(50 cases total, strict superset of the C rows):

  947_deref_narrow_run.c  -> deref_narrow_test.ww  (#116, 10 rows: *p reads pointee width not 8B MOVQ; i32/u32/u8/i8/i16/u16 + !i32-alias + enum-i8 + bool/i64 controls)
  949_ptrarr_index_run.c  -> ptrarr_index_test.ww  (#61, 23 rows: p[i]/(&p[i])/(*p)[i] stride by size(T); {1,2,4,8}B, const+var idx, param/local/cast bases, neighbor guards, nested *[2][3], *[3]str header, siphash round())
  949_dotbase_arr_run.c   -> dotbase_arr_test.ww   (#135, 3 rows: (*struct).arrayfield[i] read/write/compound addresses the field)
  944_def_amp_idx_run.c   -> def_amp_idx_test.ww   (#94, 6 rows: &D[i] over a def-array; +plain/read/2D controls)
  944_alias_amp_idx_run.c -> alias_amp_idx_test.ww (#5, 8 rows: &a[i] over an alias-typed base classifies off the chased type; local/global, narrow, fwd-ref, plain+str controls)

The two sibling .c (949_dotbase_addr_slice_run, 944_alias_def_addr_run) stay in
$(TESTS): the first is run-only byteid=0 (#254 cs!=ww rows), the second carries
a LOUD rule-7 reject row — both routed to fold-3 (task #7). Bump
LANGBYTEID_EXPECTED_MIN 38->43.

test/lang/alias_amp_idx_test.ww

@@ -0,0 +1,98 @@
+// alias_amp_idx_test — `&a[i]` over an ALIAS-typed array base must classify
+// arrayness off the CHASED type, not the syntactic tnode, migrated from
+// test/wcc/944_alias_amp_idx_run.c (#5 alias arc). cgun's TK_AMP N_INDEX
+// classify keyed arrayness off the syntactic tnode (N_TNAME), so `&a[i]` over an
+// alias-typed base missed the N_TARRAY gate and materialized the base as MOVQ
+// (element-0 VALUE) instead of LEAQ (storage address) → wild pointer, ww SEGV
+// 139 on the deref (esz was already alias-correct, ONLY the base classify moved).
+// cstage classifies off the chased type and is the runtime-correct reference;
+// the fix re-keys both legs off tichase(base.type_) gated on TY_NAMED, so
+// non-alias rows are byte-id-neutral by construction. The .s is byte-identical
+// cs==ww, so these behavioral @tests are the net.
+//
+// All reads/writes go THROUGH THE TAKEN POINTER; values exceed 255 to break
+// little-endian prefix-luck and the LAST element is checked. amp_ctrl is the
+// plain-local control; amp_l1/amp_l2 are 1-/2-level alias locals; amp_order is
+// the forward-ref shape (the original placed `type arr` after the use — here
+// module-level resolution subsumes it); amp_narrow pins that the alias BASE was
+// the only wrong half (the narrow esz was already right); amp_g1/amp_g2 are
+// alias-typed globals; amp_gctrl holds the plain-global + global-str #11 legs.
+//
+// NOT pinned here (filed, a DIFFERENT site both stages): `&D[i]` over a
+// DEF-array — covered by def_amp_idx_test (#94).
+
+package alias_amp_idx_test;
+
+type arr = [4]int;
+type arr2 = arr;
+type A = [4]u32;
+
+let g1: arr = [1000: int, 2000: int, 3000: int, 4000: int];
+let g2: arr2 = [1000: int, 2000: int, 3000: int, 4000: int];
+let gc: [4]int = [1000: int, 2000: int, 3000: int, 4000: int];
+let gs: str = "wxyz";
+
+@test fn amp_ctrl() void = {
+	let a: [4]int = [1000: int, 2000: int, 3000: int, 4000: int];
+	let p: *int = &a[2];
+	assert(*p == 3000);
+	*p = 7777;
+	assert(a[2] == 7777);
+	let q: *int = &a[3];
+	assert(*q == 4000);
+};
+
+@test fn amp_l1() void = {
+	let a: arr = [1000: int, 2000: int, 3000: int, 4000: int];
+	let p: *int = &a[3];
+	assert(*p == 4000);
+	*p = 8888;
+	assert(a[3] == 8888);
+};
+
+@test fn amp_l2() void = {
+	let a: arr2 = [1000: int, 2000: int, 3000: int, 4000: int];
+	let p: *int = &a[3];
+	assert(*p == 4000);
+	*p = 9999;
+	assert(a[3] == 9999);
+};
+
+@test fn amp_order() void = {
+	let a: arr = [1000: int, 2000: int, 3000: int, 4000: int];
+	let p: *int = &a[3];
+	assert(*p == 4000);
+	*p = 8888;
+	assert(a[3] == 8888);
+};
+
+@test fn amp_narrow() void = {
+	let a: A = [1000: u32, 2000: u32, 3000: u32, 4000: u32];
+	let p: *u32 = &a[3];
+	assert(*p == 4000);
+	*p = 5555;
+	assert(a[3] == 5555);
+};
+
+@test fn amp_g1() void = {
+	let p: *int = &g1[3];
+	assert(*p == 4000);
+	*p = 8888;
+	assert(g1[3] == 8888);
+};
+
+@test fn amp_g2() void = {
+	let p: *int = &g2[3];
+	assert(*p == 4000);
+	*p = 9999;
+	assert(g2[3] == 9999);
+};
+
+@test fn amp_gctrl() void = {
+	let p: *int = &gc[3];
+	assert(*p == 4000);
+	*p = 7777;
+	assert(gc[3] == 7777);
+	let q: *u8 = &gs[3];
+	assert(*q == 'z');
+};

test/lang/def_amp_idx_test.ww

@@ -0,0 +1,56 @@
+// def_amp_idx_test — `&D[i]` over a DEF-array (indexed &-base), migrated from
+// test/wcc/944_def_amp_idx_run.c (#94). BOTH stages SEGV'd at the TK_AMP
+// N_INDEX N_IDENT base classify: a def-array base matched neither the local nor
+// the let leg and fell to a wrong else — cstage zero-based the addend (XORQ
+// BX,BX → wild ptr) while wwstage value-loaded the symbol (MOVQ name(SB) = D[0],
+// not its address). DIVERGENT asm, both wild — only a RUNTIME row pins this
+// class. The fix adds one def-array leg per stage mirroring the working let leg
+// (cs `def_isarraydef → LEAQ name(SB),BX`; ww `defvartnode`→isglobalarr→LEAQ),
+// so the existing i*esz scale + ADDQ round-trips; cs/ww now emit byte-identical
+// LEAQ-SB asm. The `*p` deref is spelled `let v: T = *p;` because `*p: T` parses
+// as `*(p: T)` (cast binds tighter than prefix-*), a spurious "cannot deref".
+//
+// amp_int/amp_u32/amp_arg are the SEGV repros (read the def-array element back
+// through the taken pointer, narrow esz on amp_u32); ctrl_plain/ctrl_read/ctrl_2d
+// are the controls the new leg must not perturb (plain &D, indexed read, 2D
+// &M[1][1]). Distinct def symbol names per shape since they share one module.
+
+package def_amp_idx_test;
+
+def Dint: [3]int = [1000: int, 2000: int, 3000: int];
+def Du32: [3]u32 = [1000: u32, 2000: u32, 3000: u32];
+def M2: [2][2]int = [[10: int, 20: int], [30: int, 40: int]];
+
+fn deref_int(p: *int) int = { let v: int = *p; return v; };
+
+@test fn amp_int() void = {
+	let p: *int = &Dint[2];
+	let v: int = *p;
+	assert(v == 3000);
+};
+
+@test fn amp_u32() void = {
+	let p: *u32 = &Du32[2];
+	let v: u32 = *p;
+	assert(v == 3000u32);
+};
+
+@test fn amp_arg() void = {
+	// &D[2] as a func-arg (context-independent base).
+	assert(deref_int(&Dint[2]) == 3000);
+};
+
+@test fn ctrl_plain() void = {
+	let p: *[3]int = &Dint;
+	assert((*p)[0] == 1000);
+};
+
+@test fn ctrl_read() void = {
+	assert(Dint[1] == 2000);
+};
+
+@test fn ctrl_2d() void = {
+	let q: *int = &M2[1][1];
+	let v: int = *q;
+	assert(v == 40);
+};

test/lang/deref_narrow_test.ww

@@ -0,0 +1,96 @@
+// deref_narrow_test — an integer pointer deref (`*p`) must read its pointee's
+// ACTUAL width, not a fixed 8B MOVQ, migrated from test/wcc/947_deref_narrow_run.c
+// (#116). Before #116 the TK_STAR integer arm emitted a raw `MOVQ (AX),AX`
+// regardless of pointee size, so `*p` over a packed `*i32`/`*u32`/`*iN` slot
+// pulled the next 4–7 bytes into the high half of RAX. Truncating sinks (an i32
+// store) dropped the garbage; WIDTH-PRESERVING sinks (a `==` compare that
+// widens the literal to 8B → CMPQ) saw it. The fix routes the load through
+// localloadop(n->type), the MOVSXD/MOVSWQ/MOVSBQ + MOVL/MOVZWQ/MOVZBQ dispatch
+// already shared by IDENT/DOT/index loads. The .s is byte-identical cs==ww, so
+// these behavioral @tests are the runtime net the byte-id gate can't be.
+//
+// Each @test deliberately uses a `==` (CMPQ-width) sink so a stale high half
+// would make the assert FAIL; the narrow-signed rows route through an `: i32`
+// cast whose compare against a 64B-widened literal forces the sign-extension
+// onto the load. alias/enum rows exercise the TY_NAMED/TBANG/TY_ENUM peel in
+// localloadop's tinfo lookup; the struct-field base on the i16/u16/alias/enum
+// rows dodges the sibling [N]alias array-init store-width concern (out of #116
+// scope). i64_ctrl is the regression guard that a width-correct case keeps MOVQ.
+
+package deref_narrow_test;
+
+type err = !i32;
+type abox = struct { v: err };
+type ibox = struct { v: i16, m: u16 };
+type ubox = struct { v: u16, m: u16 };
+type flag = enum i8 { A = -2i8, B = 1i8 };
+type fbox = struct { v: flag, m: u8 };
+
+@test fn i32_cmpq() void = {
+	let buf: [4]i32 = [10, 20, 30, 40];
+	let p: *i32 = &buf[1];
+	assert(*p == 20);
+};
+
+@test fn u32_zeroext() void = {
+	let buf: [3]u32 = [10u32, 20u32, 0xFFFFFFFFu32];
+	let p: *u32 = &buf[2];
+	assert(*p == 0xFFFFFFFFu32);
+};
+
+@test fn u8_zeroext() void = {
+	let buf: [3]u8 = [10u8, 20u8, 0xFFu8];
+	let p: *u8 = &buf[2];
+	assert(*p == 0xFFu8);
+};
+
+@test fn i8_signext() void = {
+	let buf: [3]i8 = [-1i8, -2i8, -3i8];
+	let p: *i8 = &buf[1];
+	let v: i32 = (*p): i32;
+	assert(v == -2i32);
+};
+
+@test fn alias_signext() void = {
+	// `type err = !i32; *err` — the TY_NAMED/TBANG peel must reach the
+	// underlying i32 width for MOVSXD to fire.
+	let b: abox = abox { v = -7i32: err };
+	let p: *err = &b.v;
+	let r: i32 = (*p): i32;
+	assert(r == -7i32);
+};
+
+@test fn bool_ctrl() void = {
+	let buf: [3]bool = [true, false, true];
+	let p: *bool = &buf[1];
+	assert(*p == false);
+};
+
+@test fn i16_signext() void = {
+	let b: ibox = ibox { v = -200i16, m = 0xABCDu16 };
+	let p: *i16 = &b.v;
+	let r: i32 = (*p): i32;
+	assert(r == -200i32);
+};
+
+@test fn u16_zeroext() void = {
+	let b: ubox = ubox { v = 0xFFFFu16, m = 0xABCDu16 };
+	let p: *u16 = &b.v;
+	assert(*p == 0xFFFFu16);
+};
+
+@test fn enum_signext() void = {
+	// `type flag = enum i8 { ... }; *flag` — TY_NAMED/TY_ENUM peel in
+	// typeissigned + tinfo.size on the NAMED wrapper must land on MOVSBQ.
+	let b: fbox = fbox { v = flag.A, m = 0xABu8 };
+	let p: *flag = &b.v;
+	let r: i32 = ((*p): i8): i32;
+	assert(r == -2i32);
+};
+
+@test fn i64_ctrl() void = {
+	// width-correct case — MUST still emit MOVQ; regression guard.
+	let buf: [3]i64 = [100i64, 200i64, 300i64];
+	let p: *i64 = &buf[1];
+	assert(*p == 200i64);
+};

test/lang/dotbase_arr_test.ww

@@ -0,0 +1,46 @@
+// dotbase_arr_test — an N_INDEX with an N_DOT base on a `[N]T`-typed field
+// (`(*struct).array_field[i]`) must compute the field's ADDRESS, not load its
+// value, migrated from test/wcc/949_dotbase_arr_run.c (#135). Pre-#135 the
+// N_INDEX read + plain-assign + compound fallbacks all invoked cgexpr on the
+// N_DOT base, which auto-derefs and loads the field's first 8 bytes as if a
+// pointer → every read/write/compound through a packed array field segfaulted,
+// cs==ww BOTH stages broken identically (gate-blind). The fix
+// (cg_dotbase_addr/dotbaseaddr) detects an N_DOT base whose FIELD is TY_ARRAY,
+// walks to the inner ident, and emits address-of-field inline; the TY_ARRAY
+// gate keeps it inert on pointer/slice/str fields. The .s is byte-identical, so
+// these behavioral @tests are the runtime net.
+//
+// read_u8 / write_u8 / compound_u8 are the 3 fix shapes on a `*struct` base
+// with an [8]u8 field (the strconv decimal.ha:178 compound shape, #133+#135
+// prereqs). Wider element widths and the TY_ARRAY-gate no-over-fire control are
+// left to the bootstrap byte-id corpus (994/995) per the C twin's note: the i32
+// return ABI's MOVL-vs-MOVSXD is a pre-existing cs/ww divergence below the
+// helper, unrelated to #135.
+
+package dotbase_arr_test;
+
+type t = struct { digits: [8]u8, nd: size };
+
+fn rd(d: *t) i32 = { return d.digits[3]: i32; };
+fn setit(d: *t) void = { d.digits[3] = 99u8; };
+fn bump(d: *t) void = { d.digits[3] += 1u8; };
+
+@test fn read_u8() void = {
+	let x: t;
+	x.digits[0] = 50u8;
+	x.digits[3] = 77u8;
+	assert(rd(&x) == 77i32);
+};
+
+@test fn write_u8() void = {
+	let x: t;
+	setit(&x);
+	assert(x.digits[3]: i32 == 99i32);
+};
+
+@test fn compound_u8() void = {
+	let x: t;
+	x.digits[3] = 10u8;
+	bump(&x);
+	assert(x.digits[3]: i32 == 11i32);
+};

test/lang/ptrarr_index_test.ww

@@ -0,0 +1,237 @@
+// ptrarr_index_test — indexing through a pointer-to-array (`p[i]`, p: *[N]T)
+// must stride by size(T), the pointee array's ELEMENT, never by the whole-array
+// byte size, migrated from test/wcc/949_ptrarr_index_run.c (#61). Three sub-
+// classes of one root:
+//   A. value-route scaling — wwstage's elemsizeofc fed a `*[N]T` pointee into
+//      the "outer stride = whole sub-array" rule (only correct for [N][M]T), so
+//      every read/write/compound through `p[i]` strode N*size(T) (OOB for i>=1)
+//      and a var-idx write emitted an N*8 aggregate copy → caller-frame smash
+//      (exactly lib/hash/siphash round()'s corruption). cstage was correct;
+//      wwstage aligned UP via the idxeffti/idxelemtn choke-point.
+//   B. `&p[i]` addr-of — BOTH stages identically wrong (byte-id-BLIND): the
+//      TK_AMP arm read bu->sub->size without the ptr peel, so &p[3]-&a[0]
+//      returned 3*N*size(T). Only a RUNTIME row pins this class.
+//   C. `(*p)[i]` explicit deref+index — BOTH stages SEGV'd identically: the
+//      deref materialized an 8B scalar load and indexed off that VALUE. Fixed
+//      at the deref choke-point (an ARRAY pointee is its own address, #270-1a).
+//
+// cs==ww is byte-identical, and cstage is runtime-correct, so byte-id (the gate)
+// + these behavioral @tests (cstage-runtime) together pin BOTH stages. The
+// matrix covers elem widths {1,2,4,8}B, const+var indices, param/local/cast
+// bases, read/write/compound routes, neighbor-corruption guards, the &p[i]
+// pointer difference (B), nested *[2][3], *[3]str header elements, the siphash
+// round() mix-in-place shape, and the (*p)[i] deref family (C).
+
+package ptrarr_index_test;
+
+fn pa_rd64c(p: *[4]u64) u64 = { return p[1]; };
+fn pa_rd8v(p: *[4]u8, i: i32) u8 = { return p[i]; };
+fn pa_rd16(p: *[4]u16) u16 = { return p[3]; };
+fn pa_rd32(p: *[4]u32) u32 = { return p[2]; };
+fn pa_rd32s(p: *[4]i32) i32 = { return p[1]; };
+fn pa_wr64c(p: *[4]u64) void = { p[1] = 7u64; };
+fn pa_wr64v(p: *[4]u64, i: i32, x: u64) void = { p[i] = x; };
+fn pa_wr8(p: *[4]u8) void = { p[1] = 9u8; };
+fn pa_add5(p: *[4]u64) void = { p[1] += 5u64; };
+fn pa_addat(p: *[4]u32, i: i32) void = { p[i] += 7u32; };
+fn pa_rd2d(p: *[2][3]u32, i: i32, j: i32) u32 = { return p[i][j]; };
+fn pa_lenof(p: *[3]str, i: i32) i32 = { return p[i].len; };
+fn pa_mix(v: *[4]u64) void = {
+	v[0] += v[1];
+	v[2] += v[3];
+	v[1] += v[0];
+	v[3] += v[2];
+};
+fn pa_deref_rd(p: *[4]u64) u64 = { return (*p)[1]; };
+
+// A: read.
+@test fn rd_u64_param_const() void = {
+	let a: [4]u64 = [100u64, 101u64, 102u64, 103u64];
+	assert(pa_rd64c(&a) == 101u64);
+};
+
+@test fn rd_u8_param_var() void = {
+	let a: [4]u8 = [10u8, 20u8, 30u8, 40u8];
+	assert(pa_rd8v(&a, 2) == 30u8);
+};
+
+@test fn rd_u16_param() void = {
+	let a: [4]u16 = [11u16, 22u16, 33u16, 44u16];
+	assert(pa_rd16(&a) == 44u16);
+};
+
+@test fn rd_u32_param() void = {
+	let a: [4]u32 = [11u32, 22u32, 33u32, 44u32];
+	assert(pa_rd32(&a) == 33u32);
+};
+
+@test fn rd_i32_signed() void = {
+	// signed-narrow elem behind the ptr — pins the MOVSXD the idxeffti'd
+	// elemissigned picks (an undrilled ptr-tinfo read classified ARRAY as
+	// unsigned).
+	let a: [4]i32 = [7, -5, 9, 1];
+	assert(pa_rd32s(&a) == -5i32);
+};
+
+// A: write.
+@test fn wr_u64_param_const() void = {
+	let a: [4]u64 = [1u64, 2u64, 3u64, 4u64];
+	pa_wr64c(&a);
+	assert(a[0] == 1u64);
+	assert(a[1] == 7u64);
+	assert(a[2] == 3u64);
+	assert(a[3] == 4u64);
+};
+
+@test fn wr_u64_varidx_paramrhs() void = {
+	// the corruption proof: pre-fix wwstage emitted a 32B aggregate copy
+	// sourced at &x to base+32*i → frame smash. Neighbor guards assert no
+	// byte outside a[1] moved.
+	let a: [4]u64 = [10u64, 11u64, 12u64, 13u64];
+	let i: i32 = 1;
+	pa_wr64v(&a, i, 77u64);
+	assert(a[0] == 10u64);
+	assert(a[1] == 77u64);
+	assert(a[2] == 12u64);
+	assert(a[3] == 13u64);
+};
+
+@test fn wr_u8_neighbors() void = {
+	let a: [4]u8 = [1u8, 2u8, 3u8, 4u8];
+	pa_wr8(&a);
+	assert(a[0] == 1u8);
+	assert(a[1] == 9u8);
+	assert(a[2] == 3u8);
+	assert(a[3] == 4u8);
+};
+
+// A: compound.
+@test fn compound_u64() void = {
+	let a: [4]u64 = [100u64, 101u64, 102u64, 103u64];
+	pa_add5(&a);
+	assert(a[0] == 100u64);
+	assert(a[1] == 106u64);
+	assert(a[2] == 102u64);
+};
+
+@test fn compound_u32_varidx() void = {
+	let a: [4]u32 = [10u32, 20u32, 30u32, 40u32];
+	pa_addat(&a, 2);
+	assert(a[1] == 20u32);
+	assert(a[2] == 37u32);
+	assert(a[3] == 40u32);
+};
+
+// A: local-ptr base, no call boundary.
+@test fn rd_localptr() void = {
+	let a: [4]u64 = [100u64, 101u64, 102u64, 103u64];
+	let p: *[4]u64 = &a;
+	assert(p[2] == 102u64);
+};
+
+// A: cast base.
+@test fn rd_castbase() void = {
+	let big: [4]u64 = [5u64, 6u64, 7u64, 8u64];
+	let p: *[4]u64 = (&big): *[4]u64;
+	assert(p[1] == 6u64);
+};
+
+// A: nested *[2][3]u32 — inner stride 4, outer 12; the pointee's OWN nesting
+// must coexist with the ptr carve-out. Read, write, neighbor guards.
+@test fn nested_2d() void = {
+	let a: [2][3]u32;
+	a[0][0] = 0u32; a[0][1] = 1u32; a[0][2] = 2u32;
+	a[1][0] = 10u32; a[1][1] = 11u32; a[1][2] = 12u32;
+	assert(pa_rd2d(&a, 1, 2) == 12u32);
+	assert(pa_rd2d(&a, 0, 1) == 1u32);
+	let p: *[2][3]u32 = &a;
+	p[1][0] = 99u32;
+	assert(a[1][0] == 99u32);
+	assert(a[1][1] == 11u32);
+	assert(a[0][2] == 2u32);
+};
+
+// A: *[3]str — 3-word header elements; pins the read-side str-header gate on
+// the idx_eff'd element.
+@test fn rd_str_elem() void = {
+	let a: [3]str;
+	a[0] = "x"; a[1] = "yy"; a[2] = "zzz";
+	assert(pa_lenof(&a, 2) == 3);
+	assert(pa_lenof(&a, 0) == 1);
+	let p: *[3]str = &a;
+	assert(p[1].len == 2);
+};
+
+// B: &p[i] pointer difference — both stages emitted whole-array stride (96)
+// byte-IDENTICALLY pre-fix; only this runtime row sees the class. 3*8 = 24.
+@test fn amp_diff_u64() void = {
+	let a: [4]u64 = [1u64, 2u64, 3u64, 4u64];
+	let p: *[4]u64 = &a;
+	let d: u64 = (&p[3]): u64 - (&a[0]): u64;
+	assert(d == 24u64);
+};
+
+// B: &p[i] difference at a narrow width. 3*2 = 6.
+@test fn amp_diff_u16() void = {
+	let a: [4]u16 = [1u16, 2u16, 3u16, 4u16];
+	let p: *[4]u16 = &a;
+	let d: u64 = (&p[3]): u64 - (&a[0]): u64;
+	assert(d == 6u64);
+};
+
+// A: the live consumer's shape — siphash round() mutates all four lanes through
+// the param ptr, each read feeding a later write.
+@test fn mix_inplace_round() void = {
+	let v: [4]u64 = [1u64, 2u64, 3u64, 4u64];
+	pa_mix(&v);
+	assert(v[0] == 3u64);
+	assert(v[1] == 5u64);
+	assert(v[2] == 7u64);
+	assert(v[3] == 11u64);
+};
+
+// C: (*p)[i] read.
+@test fn deref_rd_u64() void = {
+	let a: [4]u64 = [100u64, 101u64, 102u64, 103u64];
+	let p: *[4]u64 = &a;
+	assert((*p)[1] == 101u64);
+};
+
+@test fn deref_rd_u32() void = {
+	// pins the N_UN-base esz arm (the 8B default would mis-stride).
+	let a: [4]u32 = [11u32, 22u32, 33u32, 44u32];
+	let p: *[4]u32 = &a;
+	assert((*p)[2] == 33u32);
+};
+
+@test fn deref_rd_param() void = {
+	let a: [4]u64 = [100u64, 101u64, 102u64, 103u64];
+	assert(pa_deref_rd(&a) == 101u64);
+};
+
+// C: (*p)[i] write.
+@test fn deref_wr_u64() void = {
+	let a: [4]u64 = [1u64, 2u64, 3u64, 4u64];
+	let p: *[4]u64 = &a;
+	(*p)[1] = 7u64;
+	assert(a[0] == 1u64);
+	assert(a[1] == 7u64);
+	assert(a[2] == 3u64);
+};
+
+@test fn deref_wr_u8() void = {
+	let a: [4]u8 = [1u8, 2u8, 3u8, 4u8];
+	let p: *[4]u8 = &a;
+	(*p)[1] = 9u8;
+	assert(a[0] == 1u8);
+	assert(a[1] == 9u8);
+	assert(a[2] == 3u8);
+};
+
+// C: (*p)[i] compound.
+@test fn deref_compound_u64() void = {
+	let a: [4]u64 = [100u64, 101u64, 102u64, 103u64];
+	let p: *[4]u64 = &a;
+	(*p)[1] += 5u64;
+	assert(a[1] == 106u64);
+};