Volatile Is a Promise, Not a Keyword Decoration

Volatile exists because the compiler cannot see your peripherals. In class, we ban “just add volatile” as advice until the student can point to the line in the datasheet that races the optimizer.

We run a paired exercise: compile with aggressive opts, watch the symptom, then reintroduce volatile only where the memory map demands it. The emotional arc is predictable — relief, then suspicion, then curiosity.

Students write a two-sentence contract above each volatile block: what hardware action invalidates the cache assumption, and what measurement proves it. That contract travels into code review later.

We close the module with a limitation disclosure: volatile does not fix IRQ races or torn multi-byte reads. We preview atomics only enough to explain why the next course layer exists.