feat(t27b): structs, field access, pointers and struct results

[gHashTag]

Stacked on #6007 (memory primitives). The base is claude/t27b-memory; retarget it to master once #6007 lands.

What

t27b now lowers structs onto the memory primitives from #6007:

• Declarations and literals. Struct declarations, named and anonymous (result-typed) literals, field defaults, and nested structs.
• Fields. Reads and writes, including nested and compound (b.a.y = 9, p.x += 1).
• Pointers. &x, p.*, *T and *const T, plus field access through a pointer. Self-referential pointees work (next: *const Node).
• Parameters and results.
  • A struct parameter is passed by address and never written.
  • A struct result goes through a hidden last pointer parameter.
  • Such functions form an internal ABI (Program.internal_abi). t27b build does not export them and prints a note saying so.
• Module struct constants. They go to __const, and a scalar field folds to a constant.
• Layout. C rules, computed on first use.
• Address-taken scalars. A scalar local or parameter whose address is taken lives in a frame slot.

Every refusal is precise. The cases are a missing, unknown or duplicate field, a positional initializer, an anonymous .{} with no result type, a write through a constant, a struct or pointer operand, a non-value X.y, a struct that contains itself, and a generic struct.

IR. New ExprKind::Seq { stmts, value } builds a struct temporary at the exact point where its argument is evaluated. Both the interpreter (the oracle) and the code generator implement it, and the random differential generator now emits Seq with stores and copies, with temporaries live around it.

Corpus (t27b corpus specs --jobs 6, 1185 files)

	before (#6007)	after
supported, every test passes	47	70 (223 tests, 84 invariants)
supported, a test fails	0	1 (the reference fails too, see below)
JIT/interpreter mismatch	0	0
codegen limit / crash	0 / 0	0 / 0
timeout	0	2 (load, see below)

• specs/fpga/verification/build_verify.t27, test_module_count: t27c gen + zig test aborts on the same assertion (TOTAL_FPGA_MODULES is 33, the test expects 31). The reference fails here too, so this does not count against t27b.
• The two timeouts, igla/coder/_tmp_pipeline_import.t27 and igla/race/backend.t27, are rejections. At a load average near 780, the t27c front-end parse alone took 10 s and 2 s on them. Both were 0 in the feat(t27b): memory primitives -- frame slots, loads/stores, rodata, bounds (Refs #5977) #6007 run.
• Top remaining rejections: str 389, EnumDecl 104, []const u8 71, f64 53, BenchBlock 48. EnumDecl and f64 belong to the scalar lane; arrays, slices and strings come next in this lane.

Checks

• cargo test --release -p t27b: all pass, including the new structs_fields_pointers_and_results and struct_rejections_are_precise tests, plus the differential run with Seq.
• cargo check --release --target x86_64-unknown-linux-gnu -p t27b --all-targets: ok. The only warnings are from the sealed bootstrap/src/compiler.rs.
• NOW entry: docs/now/2026-10-04-t27b-structs.md, which check_now_entry_shape.py accepts.

Refs #5977

🤖 Generated with Claude Code