Hojun-Cho
1074239859
The N_UN/TK_STAR plain-deref assign arm fell to a single fldstoreop for every pointee, so `*p = v` with p:*tagged wrote the rhs into the tag word and never the payload -- identically in both stages, leaving the byte-id gate green while the store corrupted the tag (#263-class, gate-blind). Gate on TY_TAGGED and route through cg_widen_tagged_store into a scratch slot, then word-copy to the destination -- the proven runtime-index arm. Scalar pointees keep the single-store path unchanged.