compiler: audio driver, u16 arithmetic, multi-scanline, slot recycling

Five language features and optimizations from the planned-work backlog:

- **Minimal audio driver**: `play`/`start_music`/`stop_music` now generate
  APU pulse-1/pulse-2 writes from a builtin SFX/music name table, and
  the NMI handler gains a `JSR __audio_tick` splice (via the linker's
  `__audio_used` marker lookup) that ages an SFX countdown counter and
  mutes pulse 1 when the tone expires. Programs that never trigger
  audio pay zero ROM cost.

- **u16 arithmetic and comparisons**: new IR ops `LoadVarHi`, `StoreVarHi`,
  `Add16`, `Sub16`, and six `Cmp*16` variants. The lowering context
  tracks variable types via the analyzer's symbol table and routes
  expressions through the 8-bit or 16-bit path based on operand width.
  Add16 emits `CLC;ADC;ADC` with carry propagating naturally into the
  high byte; compares dispatch high-byte-first with a short-circuit
  low-byte fallback. Fixes a silent miscompile where `big += 1` on a
  u16 var only incremented the low byte.

- **Multi-scanline handlers per state**: `gen_scanline_irq` now
  dispatches on `(current_state, ZP_SCANLINE_STEP)` and reloads the
  MMC3 counter with the delta to the next scanline in the same state.
  `gen_scanline_reload` resets the step counter at the top of each
  NMI so a state with multiple handlers fires them in ascending line
  order. Previously only the first handler per state ever fired.

- **IR temp slot recycling**: `build_use_counts` pre-scans each
  function to count per-temp uses; `retire_op_sources` decrements
  the counts after each op and pushes dead slots back onto
  `free_slots` for later allocation. `bitwise_ops.ne` used to crash
  (debug) or miscompile (release) once it hit 128 concurrent temps;
  with recycling the same function now uses ~4 slots instead of 136.

- **INC/DEC peephole fold + improved dead-load elimination**:
  `fold_inc_dec` collapses `LDA addr; CLC; ADC #1; STA addr` into
  a single `INC addr` (and the SEC/SBC variant into `DEC addr`),
  saving 5 bytes and 5 cycles per increment. The fold is suppressed
  when the next instruction reads carry. `remove_dead_loads` now
  walks past INC/DEC/STX/STY (which don't touch A) to find the
  actual next A-use, catching more dead loads.

Tests: 331 unit + 39 integration (up from 313 + 37), including new
guards for audio, u16, multi-scanline, and slot recycling.

https://claude.ai/code/session_01A8qk3gw2jWSzdiXBZPZSFE

src/linker/mod.rs

@@ -116,6 +116,15 @@ impl Linker {
         all_instructions.extend(runtime::gen_multiply());
         all_instructions.extend(runtime::gen_divide());
 
+        // Audio driver body — linked in whenever user code touched
+        // audio. The driver needs to exist before `__nmi` (the NMI
+        // JSR target must be defined before the caller), so emit it
+        // alongside the math routines. No-cost elision when unused:
+        // the `has_label` check below skips the whole block.
+        if has_label(user_code, "__audio_used") {
+            all_instructions.extend(runtime::gen_audio_tick());
+        }
+
         // NMI handler
         all_instructions.push(Instruction::new(NOP, AM::Label("__nmi".into())));
         // If user code emits an MMC3 reload hook, splice in a JSR
@@ -129,6 +138,17 @@ impl Linker {
         if has_label(user_code, "__ir_mmc3_reload") {
             all_instructions.push(Instruction::new(JSR, AM::Label("__ir_mmc3_reload".into())));
         }
+        // Audio tick: if the user program ever triggered an SFX or
+        // music (detected by the marker label `__audio_used` emitted
+        // by `IrCodeGen` when it sees any audio op), JSR into the
+        // driver's per-frame tick before the normal NMI body. The
+        // tick decrements the SFX counter and silences pulse 1 when
+        // it reaches zero. Programs that never play audio skip both
+        // the splice and the driver body entirely — no ROM cost.
+        let has_audio = has_label(user_code, "__audio_used");
+        if has_audio {
+            all_instructions.push(Instruction::new(JSR, AM::Label("__audio_tick".into())));
+        }
         all_instructions.extend(runtime::gen_nmi());
 
         // IRQ handler

src/linker/tests.rs

@@ -130,6 +130,39 @@ fn link_with_sprites_spanning_multiple_tiles() {
     assert_eq!(placed, sprite_bytes.as_slice());
 }
 
+#[test]
+fn link_splices_audio_tick_when_user_marker_present() {
+    // When user code contains the `__audio_used` marker label (the
+    // IR codegen emits this whenever it sees a `play`/`start_music`/
+    // `stop_music` op), the linker must splice a `JSR __audio_tick`
+    // into the NMI handler prologue AND link in the audio driver
+    // body so the JSR target exists.
+    let linker = Linker::new(Mirroring::Horizontal);
+    let user_code = vec![
+        // Pretend user code with the marker the codegen would emit.
+        Instruction::new(NOP, AM::Label("__audio_used".into())),
+        Instruction::implied(NOP),
+    ];
+    let rom_data = linker.link(&user_code);
+
+    // The ROM should be valid even with the splice — the driver
+    // body has to fit in bank 0 without overflowing.
+    let info = rom::validate_ines(&rom_data).unwrap();
+    assert_eq!(info.prg_banks, 1);
+}
+
+#[test]
+fn link_omits_audio_tick_when_no_marker() {
+    // User code without the marker should not pay any ROM cost
+    // for the audio driver. We can't easily inspect bytes, but we
+    // can at least verify the ROM builds and has a normal shape.
+    let linker = Linker::new(Mirroring::Horizontal);
+    let user_code = vec![Instruction::implied(NOP)];
+    let rom_data = linker.link(&user_code);
+    let info = rom::validate_ines(&rom_data).unwrap();
+    assert_eq!(info.prg_banks, 1);
+}
+
 #[test]
 fn palette_load_writes_to_ppu() {
     let linker = Linker::new(Mirroring::Horizontal);