- Builtin refs: int& -> int* in signature, (*a) deref in body - Class refs: Cls& -> Cls* in signature, p.field -> p->field in body - Call-site & injection via FnRef table (swap(x,y) -> swap(&x,&y)) - Member call ref args also get & injected - Virtual dispatch for pointer-ref params preserved - parse_member_decl: ptr param recording + dot-to-arrow conversion - parse_function: iref body rewrite + fnref call-site rewrite