docs: update session save — deref VAR-actual fixed; self-compiled compiler now parses into the TYPE block (next: OpaqueBase crash)

docs/session-2026-09-25.md

@@ -11,6 +11,7 @@ Started from "the whole compiler source set compiles under V3 and links"
 | `v3-inline-array-fields` | record array fields are **inline** (standard M2 layout), not pointers: SymTab layout, QbeGen data/access/copy, `InitHeap` in place, `SymTab` `ALLOCATE`→`NEW` |
 | `v3-nul-strings` | **NUL-terminated** CHAR arrays (terminator slot at index = count, index = count readable); stdlib `Strings` and the C shim are NUL-based; `m2arg` keeps capacity |
 | `af392e1` | scanner `Reset`: `NEW(buf[i])` (BufBlock needs a descriptor header) |
+| `v3-deref-var-actual` | `^` yields the pointee address: `sfx := TRUE`, so a `VAR` actual `p^`/`a[i]^` passes the pointee address (was `AddrOf(base)`) |
 
 Main suite 111/111 throughout.
 
@@ -21,29 +22,20 @@ It now:
 2. **opens its input** via the self-hosted `FileIO` + shim,
 3. **starts parsing** — and crashes in the scanner's `Reset`.
 
-## Current blocker (reproduced minimally)
-
-For a `VAR` actual that is a **dereferenced pointer** (`p^` where
-`p: POINTER TO ARRAY`), V3 passes the wrong address. Repro:
-
-```modula2
-TYPE Block = ARRAY [0..15] OF CHAR;
-TYPE Buf = ARRAY [0..3] OF POINTER TO Block;
-VAR b : Buf;
-PROCEDURE Fill (VAR a : ARRAY OF CHAR); BEGIN a[0] := 'z' END Fill;
-NEW(b[0]); Fill(b[0]^);          (* emitted: call Fill(l 0, l $Buf_b) *)
-```
-
-The SSA computes `%t = loadl(b[0])` (the pointee address) but the call
-passes `$Buf_b` — Fact's `NoteAddr(q, AddrOf("b"))` overwrites the
-correct address for a `^` result. This is exactly the scanner's
-`FileIO.ReadBytes(src, buf[i]^, read)` (`Reset`), which then writes the
-file contents over `buf`.
-
-**Fix direction**: `Design` must distinguish "q is the loaded value of a
-plain variable" (→ `NoteAddr(q, AddrOf(var))`) from "q is already an
-address" (deref of non-scalar, array/record designator) → `NoteAddr(q, q)`.
-Needs a Design output flag (e.g. `addrQ: BOOLEAN`).
+### Fixed: `VAR` actual of a dereferenced pointer (`v3-deref-var-actual`)
+
+For a `VAR` actual that is a dereferenced pointer (`b[0]^`), V3 passed
+`AddrOf(b)` instead of the pointee address. `Design`'s `^` handler now
+always sets `sfx := TRUE` (q holds the pointee address), so Fact's
+VAR-actual note is `q` itself. Repro `Fill(b[0]^)` now works; the
+scanner's `FileIO.ReadBytes(src, buf[i]^, read)` is correct.
+
+## Current crash
+
+The self-compiled compiler now parses the scanner/parser and reaches the
+source's `TYPE` block, then segfaults in `SymTab.OpaqueBase`
+(`TypeItem ← TypeBlock ← DeclSeq ← ProgModule`), dereferencing a bad
+symbol node (`mov 0x49(%rax),…`). Next runtime bug to chase.
 
 ## Remaining after that