@asmlift/core 0.10.0 → 0.11.0

package/src/frontend/frame-objects.ts

@@ -17,10 +17,10 @@
  *  measured against; IDO, gcc 2.7.2 and mwcc reload past every store of another type (strict
  *  aliasing does not reorder there), so the cast and union refusals below are only more cautious on
  *  MIPS and PPC. */
-import { linearFactor } from '../ir/bits';
+import { type StridedRange, linearFactor } from '../ir/bits';
 import { type Block, type Op, type Value, byValueOperands, calleeName, mkOp, mkValue, successorsOf } from '../ir/core';
 import { type IrType, T, structSpelling, typeEquals, typeToString, unionViewSigns } from '../ir/types';
-import type { Gate } from '../l3/gates';
+import { type Gate, firstRejection } from '../l3/gates';
 import { blockCopyRoles } from '../proto';
 import type { SymbolMap } from '../symbols';
 import { type TargetDescription, blockTransferRead, sourceControlRead, sourceReach } from '../target';
@@ -53,6 +53,11 @@ export interface FrameObjectAudit {
   escapesReliedOn?: ReadonlySet<number>;
   /** every capture the add arm re-minted at a constant offset from it */
   movedCaptures: ReadonlySet<Value>;
+  /** the `laddr`s the frontend minted for a DIRECT frame access (`off(sp)` inside its local area)
+   *  rather than for a captured address: a word reached only through them is one its slot model
+   *  lifts again outside a relift's bytes (`reliftRange`). Thumb, which lifts a direct word access
+   *  as a slot, has none. */
+  directAccesses?: ReadonlySet<Value>;
   /** whether a callee's declaration rules out a struct returned through a hidden pointer at
    *  argument 0 (aggregate.ts `returnsWithoutHiddenPointer`), asked of the frontend's call
    *  declarations */
@@ -62,6 +67,17 @@ export interface FrameObjectAudit {
   /** the retraction rules an escape is judged by; `FRAME_ESCAPE_GATES` when absent, and a
    *  census or an ablation hands in its own (`FRAME_OBJECT_AUDIT`) */
   gates?: readonly Gate<FrameEscape>[];
+  /** the rules that keep a frame's end word in the one object (`reliftRange`);
+   *  `RELIFT_HAND_BACK_GATES` when absent, and a census or an ablation hands in its own */
+  reliftGates?: readonly Gate<HandBack>[];
+  /** THE ARGUMENT HOMES THE FRONTEND KEPT FROM THE SLOT MODEL FOR THE ONE-OBJECT ANSWER ALONE: frame
+   *  words an incoming argument register is stored to on entry, whose narrow reloads the frontend
+   *  left as captures rather than reading them as the word narrowed, because a by-value struct
+   *  parameter's home recompiles as that one object (Thumb `argumentHomes`). Where that answer is
+   *  withheld and the audit refuses, it asks for a relift with them released
+   *  (`FrameObjectRelift.homesReleased`) rather than refusing, and a relift that declines reports
+   *  this refusal first. Absent or empty where none was kept. */
+  releasableHomes?: ReadonlySet<number>;
   /** the bytes a first audit asked to have kept as ONE object in memory (`FrameObjectRelift`):
    *  the frontend routes every access inside them through an `laddr`, and the audit declares
    *  them one object rather than judging each offset on its own */
@@ -100,31 +116,83 @@ export function areaAboveOutgoing({
 export const landsOnArea = (area: FrameRange, at: number, width: number): boolean =>
   at < area.to && at + width > area.from;
 
-/** What an audit answers instead of a refusal when a device may read the frame, or a callee write
- *  it, without bound: lift again with `oneObject` set to these bytes. */
+/** Whether a `width`-byte access at `at` inside a frontend's local area is MEMORY in a relift that
+ *  keeps `kept` as one object: inside it, yes; wholly outside, no — a word the first audit handed
+ *  back to the slot model (`reliftRange`); across its edge, refused, half memory and half slot. */
+export function keptInRelift(kept: FrameRange, at: number, width: number, what: () => string, name: string): boolean {
+  if (at >= kept.from && at + width <= kept.to) {
+    return true;
+  }
+  if (at >= kept.to || at + width <= kept.from) {
+    return false;
+  }
+  throw new FrontendUnsupportedError(
+    `cannot lift '${name}': address-taken stack local — ${what()} reaches across an edge of the bytes ` +
+      `[sp,#${kept.from}) to [sp,#${kept.to}) kept as one object — part memory, part slot`,
+  );
+}
+
+/** What an audit answers instead of a refusal. Where a device may read the frame, or a callee write
+ *  it, without bound: lift again with `oneObject` set to these bytes. Where the one-object answer is
+ *  withheld and the audit refuses a frame with an argument home the frontend kept out of the slot
+ *  model for that answer alone (`FrameObjectAudit.releasableHomes`): lift again with `oneObject`
+ *  unset and `homesReleased`, so the frontend reads those homes as the slots they are. */
 export interface FrameObjectRelift {
-  readonly oneObject: FrameRange;
+  readonly oneObject: FrameRange | undefined;
+  /** with `homesReleased`, the first audit's refusal, which a relift that declines again reports
+   *  first: the frame as the first lift read it, followed by the second lift's own refusal where it
+   *  differs (`bothRefusals`) */
+  readonly homesReleased?: { readonly refusal: FrontendUnsupportedError };
 }
 
 /** THE RELIFT PROTOCOL, AT MOST TWICE, the one copy every frontend that runs the audit calls: lift,
- *  and where the audit answers with bytes to keep as one object (`FrameObjectRelift`), lift once
- *  more with them routed through an `laddr`. The second audit judges them as one object and refuses
- *  rather than asking again, so a second request is an internal error, not a third lift. */
+ *  and where the audit answers with a relift (`FrameObjectRelift`), lift once more as it asks —
+ *  bytes to keep as one object routed through an `laddr`, or argument homes released to the slot
+ *  model. The second audit judges the frame as asked and refuses rather than asking again, so a
+ *  second request is an internal error, not a third lift. A second lift with homes released that
+ *  declines reports the first audit's refusal (`homesReleased.refusal`), then its own where that
+ *  differs. A frontend that hands the audit no `releasableHomes` is never asked to release one. */
 export function liftWithRelift<F>(
   name: string,
-  liftOnce: (oneObject: FrameRange | undefined) => F | FrameObjectRelift,
+  liftOnce: (oneObject: FrameRange | undefined, homesReleased: boolean) => F | FrameObjectRelift,
 ): F {
-  const first = liftOnce(undefined);
+  const first = liftOnce(undefined, false);
   if (!isRelift(first)) {
     return first;
   }
-  const again = liftOnce(first.oneObject);
+  const released = first.homesReleased;
+  let again: F | FrameObjectRelift;
+  try {
+    again = liftOnce(first.oneObject, released !== undefined);
+  } catch (e) {
+    if (released !== undefined && e instanceof FrontendUnsupportedError) {
+      throw bothRefusals(name, released.refusal, e);
+    }
+    throw e;
+  }
   if (isRelift(again)) {
     throw new Error(`internal: the frame-object audit of '${name}' asked for a second relift`);
   }
   return again;
 }
 
+/** A released relift's decline, worded as both lifts read the frame: the first audit's refusal of
+ *  the frame with the homes held, then the second's with them released, which may name another
+ *  obstacle (an escape the first refusal stopped short of). The first leads, so a message that
+ *  only the first lift's refusal explains reads as it would with no release; the second is
+ *  appended only where it says something else. */
+function bothRefusals(
+  name: string,
+  first: FrontendUnsupportedError,
+  second: FrontendUnsupportedError,
+): FrontendUnsupportedError {
+  const lead = `cannot lift '${name}': `;
+  const reason = second.message.startsWith(lead) ? second.message.slice(lead.length) : second.message;
+  return first.message.endsWith(reason)
+    ? first
+    : new FrontendUnsupportedError(`${first.message}; with the argument home released: ${reason}`);
+}
+
 const isRelift = <F>(x: F | FrameObjectRelift): x is FrameObjectRelift =>
   typeof x === 'object' && x !== null && 'oneObject' in x;
 
@@ -348,7 +416,30 @@ export const FRAME_ESCAPE_GATES: readonly Gate<FrameEscape>[] = [
  *  the fold, the split, the one-object answer and the stamp; `foldedHere`, which the split adds to
  *  and the slot-overlap refusal reads; and `ModelChoice.refused`, which the model choice and the
  *  shape stage set and the relift test reads. */
-export function auditFrameObjects({
+export function auditFrameObjects(audit: FrameObjectAudit): FrameObjectVerdict {
+  // AN ARGUMENT HOME HELD FOR AN ANSWER THAT DID NOT COME. The frontend keeps a by-value struct
+  // parameter's home out of the slot model (`releasableHomes`) so the one-object answer can take it
+  // whole. Where this audit declines instead, that answer withheld (an address escapes to a writer
+  // it cannot hold, such as a struct-return temp), the decline becomes a relift with the homes
+  // released. The hold is for byte-exactness, not soundness: a home's narrow reload read as the
+  // word narrowed is the value the entry stored, and the second audit judges the frame whole, so
+  // the release is value-sound whichever refusal fired. Asked of the first lift alone: a relift
+  // that keeps one object has already had the answer the homes were held for.
+  const { oneObject, releasableHomes } = audit;
+  if (oneObject !== undefined || releasableHomes === undefined || releasableHomes.size === 0) {
+    return auditFrame(audit);
+  }
+  try {
+    return auditFrame(audit);
+  } catch (e) {
+    if (e instanceof FrontendUnsupportedError) {
+      return { oneObject: undefined, homesReleased: { refusal: e } };
+    }
+    throw e;
+  }
+}
+
+function auditFrame({
   name,
   irBlocks,
   ownedLocals: owned,
@@ -358,10 +449,12 @@ export function auditFrameObjects({
   capturedObjectIsTheWholeFrame,
   escapesReliedOn = new Set(),
   movedCaptures,
+  directAccesses = new Set(),
   returnsWithoutHiddenPointer,
   symbols,
   target,
   gates = FRAME_ESCAPE_GATES,
+  reliftGates = RELIFT_HAND_BACK_GATES,
   oneObject,
 }: FrameObjectAudit): FrameObjectVerdict {
   const { laddrs: captures, foldedHere } = foldMovedCaptures(irBlocks, movedCaptures);
@@ -437,7 +530,17 @@ export function auditFrameObjects({
     model.unboundedAt.has(e.off) &&
     (e.objectReached !== undefined || e.slotReached !== undefined || e.unaccountedWord !== undefined);
   if (model.onOffer && (model.refused || shapes.overSlot.length > 0 || escapes.some(answered))) {
-    return { oneObject: { from: declared.from, to: declared.to } };
+    return {
+      oneObject: reliftRange({
+        declared,
+        objects,
+        uses,
+        usedSlotOffsets,
+        directAccesses,
+        splits: splitsOneObject(target),
+        gates: reliftGates,
+      }),
+    };
   }
   const failWithheld: Refuse = (why) => fail(model.withheld(why));
   for (const [off, width] of shapes.overSlot) {
@@ -455,6 +558,147 @@ export function auditFrameObjects({
   return { policy: 'per-object', sinks };
 }
 
+/** THE BYTES THE ONE-OBJECT RELIFT KEEPS: the declared local area, less the words at either end
+ *  that are a scalar's and nothing else's — a word the slot model keys and no access names, or one
+ *  the frontend reached only by direct whole-word accesses (`directAccesses`), which escapes
+ *  nowhere — and, past such a word, words nothing touches at all. The frontend lifts a word
+ *  outside the range with its slot model (Thumb `isFrameObjectAccess`, MIPS `keptInRelift`; PPC
+ *  is never handed a narrowed range, `no-split-follows`), so the one object is the bytes its
+ *  escapes and accesses reach, and `provenParts` can split it where they tile: agbcc's reload puts
+ *  spill slots ABOVE the arrays (the Thumb frame grows up, thumb.h:569/573, reload1.c:2274),
+ *  ido7.1 puts them below, and gcc 2.7.2 leaves a pad word between (each array starts at a
+ *  multiple of 8); kept in the one object, such a word joins the part beside it.
+ *
+ *  A word is handed back only where no rule of `RELIFT_HAND_BACK_GATES` keeps it: a reach through
+ *  the object, or no split to follow. What makes a word a scalar's (`scalarWord`) is not tabled,
+ *  and its clauses are not each measured for soundness: a word it gets wrong meets the second
+ *  audit's refusals where an object or an access lands outside the kept bytes (`keepAsOneObject`).
+ *
+ *  The copies do NOT tell a spill from a struct member only stored (`struct { u8 a[16], b[16];
+ *  u32 y; }` with `s.y = x` and nothing reading it): that member is handed back too, and its store
+ *  drops. No value changes, since nothing reads the word through the object (an index or an
+ *  escape reaching it keeps it); what is lost is one store the target made. */
+function reliftRange({
+  declared,
+  objects,
+  uses,
+  usedSlotOffsets,
+  directAccesses,
+  splits,
+  gates,
+}: {
+  declared: FrameRange;
+  objects: ReadonlyMap<number, readonly Op[]>;
+  uses: FrameUses;
+  usedSlotOffsets: ReadonlySet<number>;
+  directAccesses: ReadonlySet<Value>;
+  splits: boolean;
+  gates: readonly Gate<HandBack>[];
+}): FrameRange {
+  const whole = { from: declared.from, to: declared.to };
+  const reaches = frameReaches(uses);
+  const fills = copyStarts(reaches);
+  const kept = (word: number): boolean => firstRejection(gates, { word, reaches, fills, splits }) !== null;
+  const scalarWord = (w: number, pastScalar: boolean): boolean => {
+    const touching = uses.fixed.filter((f) => overlaps(f.at, f.width, w, 4));
+    const owners = [...objects.keys()].filter((o) => overlaps(o, 1, w, 4));
+    if ([...usedSlotOffsets].some((s) => s !== w && overlaps(s, 4, w, 4))) {
+      return false;
+    }
+    if (usedSlotOffsets.has(w) || touching.length === 0) {
+      // …and past one, a word nothing touches: no value lives in it either way
+      return owners.length === 0 && touching.length === 0 && (usedSlotOffsets.has(w) || pastScalar);
+    }
+    return (
+      owners.length === 1 &&
+      owners[0] === w &&
+      !uses.escaped.has(w) &&
+      uses.useCount.get(w) === (uses.accesses.get(w)?.length ?? 0) &&
+      touching.every((f) => {
+        const by = uses.accessOps.get(f.op);
+        return f.at === w && f.width === 4 && by?.off === w && directAccesses.has(by.through);
+      })
+    );
+  };
+  const handedBack = (w: number, pastScalar: boolean): boolean => !kept(w) && scalarWord(w, pastScalar);
+  let { from, to } = whole;
+  while (to - from > 4 && handedBack(to - 4, to < whole.to)) {
+    to -= 4;
+  }
+  while (to - from > 4 && handedBack(from, from > whole.from)) {
+    from += 4;
+  }
+  return { from, to };
+}
+
+/** Whether `keepAsOneObject` may split the one object on this target at all: where it places
+ *  address-taken arrays in a known order and at a known alignment. */
+function splitsOneObject(target: TargetDescription): boolean {
+  return (
+    target.compilerBehaviors.addressTakenArrayOrder !== undefined &&
+    target.compilerBehaviors.addressTakenArrayAlignment !== undefined
+  );
+}
+
+/** What `RELIFT_HAND_BACK_GATES` asks of one end word of the local area: the word, and every
+ *  escape and runtime index of the frame as the bytes each may reach (`frameReaches`). */
+export interface HandBack {
+  readonly word: number;
+  /** every escape and runtime index, with the bytes each may reach */
+  readonly reaches: readonly OwnedReach[];
+  /** where a bounded copy writes into the frame */
+  readonly fills: ReadonlySet<number>;
+  /** the target may split the one object (`splitsOneObject`) */
+  readonly splits: boolean;
+}
+
+/** WHAT KEEPS AN END WORD IN THE ONE OBJECT (`reliftRange`): a reach through the object that may
+ *  land on it, or no split to gain by handing it back. A word handed back is a local whose address
+ *  nothing takes, so the recompile keeps it in a register or drops its store, and whatever reached
+ *  it through the object in the source reads or writes another byte. */
+export const RELIFT_HAND_BACK_GATES: readonly Gate<HandBack>[] = [
+  // `struct S { u8 a[16], b[16]; u32 y; } s; … s.y = x; h(s.a, 16); g(s.b); return s.y + s.a[3];`
+  // on agbcc: `g` may write `s.y` through the address it was handed, and the target reads it back
+  {
+    id: 'escape-without-bound',
+    why: 'a callee handed an address nothing bounds may reach any byte of the frame from it',
+    sound: true,
+    guardedBy: 'frame-audit-stages.test.ts: keeps every word where an escape no literal count bounds may reach it',
+    rejects: (c) => c.reaches.some((r) => r.by === 'escape' && r.reach === null),
+  },
+  // `memcpy(s + 4, src, 8)` over a slot keyed at 8 writes the word the slot model would keep
+  {
+    id: 'copy-reaches-word',
+    why: 'a block copy into or out of the frame names the bytes it moves, and this word is one of them',
+    sound: true,
+    guardedBy: 'frame-audit-stages.test.ts: keeps a word a bounded copy reaches',
+    rejects: (c) => c.reaches.some((r) => r.by === 'escape' && r.reach !== null && mayTouch(r.reach, c.word, 4)),
+  },
+  // An index nothing bounds reaches every byte of the object it is based in, so no split follows
+  // it (`provenParts` keeps the one object whole), and a word handed back would only leave the
+  // bytes the index may reach. `*(u32 *)(s + 32) = x; return s[16 + i];` on agbcc is spelled
+  // exactly as a spill slot beside an index is. An index whose range is proven (its `reach`:
+  // `s[16 + (i & 7) * 2]`) reaches only the bytes it names, so a word outside every such reach is
+  // read through no index, and handing it back loses nothing an index could read.
+  {
+    id: 'runtime-index',
+    why: 'a runtime index may reach this word: nothing bounds it, or its bounded reach covers it',
+    sound: true,
+    guardedBy: 'thumb-frontend.test.ts: a word a runtime index may reach is not handed back to the slot model',
+    rejects: (c) => c.reaches.some((r) => r.by === 'index' && mayTouch(r.reach, c.word, 4)),
+  },
+  // Handing back buys a split and nothing else: two or more copies with a literal count must fill
+  // the area, on a target that splits at all (PPC_MWCC places address-taken arrays in no order
+  // `target.ts` records). Elsewhere it would only cost a stored-only member's store.
+  {
+    id: 'no-split-follows',
+    why: 'a word is handed back only so that the copies can split the one object',
+    sound: false,
+    guardedBy: 'frame-audit-stages.test.ts: keeps every word where no split could follow',
+    rejects: (c) => c.fills.size < 2 || !c.splits,
+  },
+];
+
 /** Refuses the whole function, naming the address-taken local as what it cannot lift. */
 type Refuse = (why: string) => never;
 
@@ -981,10 +1225,70 @@ interface FrameAccess {
 }
 
 /** A load or store judged an access to the object at `off`, and the address value it reaches the
- *  object through: a capture, or a phi that carries one — for a runtime index, the indexed one. */
+ *  object through: a capture, or a phi that carries one — for a runtime index, the indexed one,
+ *  and then `index` is the access as `FrameUses.indexed` records it. Without `index` the access
+ *  is at its own displacement from `through`. */
 interface FrameAccessOp {
   readonly off: number;
   readonly through: Value;
+  readonly index?: IndexedAccess;
+}
+
+/** THE FRAME BYTES `[lo, hi)` ONE USE MAY TOUCH, or `null` where nothing bounds it, which is every
+ *  byte: a runtime index's reach (`FrameUses.indexed`) and an escape's extent
+ *  (`FrameUses.escapeExtents`) are each one. */
+type FrameReach = { readonly lo: number; readonly hi: number } | null;
+
+/** Whether a use reaching `r` may touch any of the `width` bytes at `lo`: every byte where
+ *  nothing bounds it. */
+function mayTouch(r: FrameReach, lo: number, width: number): boolean {
+  return r === null || overlaps(lo, width, r.lo, r.hi - r.lo);
+}
+
+/** Whether two reaches may share a byte. */
+function mayShare(a: FrameReach, b: FrameReach): boolean {
+  return b === null || mayTouch(a, b.lo, b.hi - b.lo);
+}
+
+/** One reach through the frame, with the object whose address it starts from (`owner`), what
+ *  makes it (`by`: an escape of that address, or a runtime index into it), and `into` where it is
+ *  a bounded block copy that WRITES the bytes (the address is its destination). */
+interface OwnedReach {
+  readonly owner: number;
+  readonly by: 'escape' | 'index';
+  readonly reach: FrameReach;
+  readonly into: boolean;
+}
+
+/** EVERY REACH THROUGH THE FRAME, the one list the split of the one object (`provenParts`) and
+ *  the words handed back to the slot model (`reliftRange`) read: each escape's extent, and each
+ *  runtime-indexed access's reach. */
+function frameReaches(uses: FrameUses): OwnedReach[] {
+  return [
+    ...[...uses.escapeExtents].flatMap(([owner, extents]) =>
+      extents.map((e): OwnedReach => ({
+        owner,
+        by: 'escape',
+        reach: e === null ? null : { lo: e.lo, hi: e.hi },
+        into: e?.into === true,
+      })),
+    ),
+    ...[...uses.indexed].flatMap(([owner, accesses]) =>
+      accesses.map((x): OwnedReach => ({ owner, by: 'index', reach: x.reach, into: false })),
+    ),
+  ];
+}
+
+/** Where a bounded block copy writes into the frame: the start of each copy's destination. */
+function copyStarts(reaches: readonly OwnedReach[]): Set<number> {
+  return new Set(reaches.flatMap((r) => (r.into && r.reach !== null ? [r.reach.lo] : [])));
+}
+
+/** One access through a runtime index: its width and signedness, and the bytes it may touch. */
+interface IndexedAccess {
+  readonly width: number;
+  readonly signed: boolean;
+  readonly reach: FrameReach;
 }
 
 /** Every use of every frame object, by offset — what each later stage reads. Each field is
@@ -1006,7 +1310,9 @@ interface FrameUses {
   /** the calls each object is passed to BY VALUE (`foldByValueArgs`), with the struct each passes */
   readonly byValueReads: ReadonlyMap<number, readonly { readonly op: Op; readonly type: IrType }[]>;
   readonly useCount: ReadonlyMap<number, number>;
-  readonly indexed: ReadonlyMap<number, readonly { readonly width: number; readonly signed: boolean }[]>;
+  /** every runtime-indexed access of each object, with the frame bytes `[lo, hi)` it may touch
+   *  (`reach`, `indexedAccess`), or `null` where nothing bounds the index */
+  readonly indexed: ReadonlyMap<number, readonly IndexedAccess[]>;
   readonly members: readonly { readonly at: number; readonly width: number }[];
   readonly memberRefusal: string | undefined;
   /** every escape of each object's address, as the frame bytes it may reach: `[lo, hi)` where a
@@ -1127,7 +1433,7 @@ function classifyFrameUses({
   // The accesses through a runtime-indexed address, per object — kept apart from `accesses`,
   // which types the object at its own offset: `a[i]` says what one ELEMENT is, not what sits at
   // `a`.
-  const indexed = new Map<number, { width: number; signed: boolean }[]>();
+  const indexed = new Map<number, IndexedAccess[]>();
   for (const off of objects.keys()) {
     accesses.set(off, []);
   }
@@ -1256,7 +1562,14 @@ function classifyFrameUses({
         // judged with the rest (`objectShapes`).
         const other = op.opcode === 'add' && op.operands.length === 2 ? op.operands[1 - idx] : undefined;
         if (other !== undefined && taint.get(other) === undefined && defOf.get(other)?.opcode !== 'const') {
-          indexedAccess(irBlocks, { indexed, accessOps }, { off, through: v }, op.results[0], facts.constOf, fail);
+          indexedAccess(
+            irBlocks,
+            { indexed, accessOps },
+            { off, through: v },
+            { sum: op.results[0], range: facts.addressRangeOf(other, blk, 'narrowest') },
+            facts.constOf,
+            fail,
+          );
           continue;
         }
         // A CONSTANT move left after the fold (`foldMovedCaptures`) moves a capture a phi carried.
@@ -1371,19 +1684,30 @@ function transferRead(
 // compiles to `add r4, r4, sp` and the source's `mov r1, sp / add r0, r1, r4` does not: the `u16`
 // twin `((u16 *)sp0)[a0]` misses the same way. Left raw, the access compiles to the source's
 // bytes with or without the `+ 0`.
+//
+// WHAT IT MAY REACH is the object's offset plus every value the index may hold (`range`, ir/bits.ts
+// `stridedRange`, asked at the sum's block): a mask, a zero-fill shift, an unsigned narrow load or a
+// `zext` — by its width, or by its operand's range where that is narrower (`(u8)k` of a counter in
+// [0, 7]); a compare on the way to the access (`if (i < 8) a[i]`); a loop counter its latch bounds,
+// by induction where the latch bounds one side; and linear forms of them. The range is widened by
+// the access's width — the stride is dropped, so the bytes are a superset of the ones reached.
+// Every element is at displacement 0 from the sum (above), so the address is exactly the capture
+// plus the index. An index nothing bounds, or one whose sum could wrap past the top of the address
+// space back below the object, reaches every byte (`null`).
 function indexedAccess(
   irBlocks: readonly Block[],
-  {
-    indexed,
-    accessOps,
-  }: { indexed: Map<number, { width: number; signed: boolean }[]>; accessOps: Map<Op, FrameAccessOp> },
+  { indexed, accessOps }: { indexed: Map<number, IndexedAccess[]>; accessOps: Map<Op, FrameAccessOp> },
   object: FrameAccessOp,
-  sum: Value,
+  { sum, range }: { sum: Value; range: StridedRange | undefined },
   constOf: (v: Value) => number | undefined,
   fail: Refuse,
 ): void {
   const { off } = object;
   const got = indexed.get(off) ?? indexed.set(off, []).get(off)!;
+  const reach = (width: number): FrameReach => {
+    const starts = range === undefined ? null : displaced(range, off, width);
+    return starts === null ? null : { lo: starts.lo, hi: starts.hi + width };
+  };
   const judge = (at: Value, by: number): void => {
     for (const blk of irBlocks) {
       for (const op of blk.ops) {
@@ -1414,8 +1738,10 @@ function indexedAccess(
                 'only a load or store at the indexed address is modelled',
             );
           }
-          got.push({ width: op.attrs.width as number, signed: op.opcode === 'load' && op.attrs.signed === true });
-          accessOps.set(op, object);
+          const width = op.attrs.width as number;
+          const index = { width, signed: op.opcode === 'load' && op.attrs.signed === true, reach: reach(width) };
+          got.push(index);
+          accessOps.set(op, { ...object, index });
         }
       }
     }
@@ -1570,7 +1896,7 @@ function readWindow(
         const base = facts.literalAddrOf(op.operands[0]);
         if (base === undefined) {
           if (!flow.frameOnEveryPath.has(op.operands[0])) {
-            if (!misses(op, facts, cnt)) {
+            if (!misses(op, facts, cnt, blk)) {
               return unbounded('a later store through an unresolved pointer may re-arm');
             }
             spared = true;
@@ -1617,6 +1943,16 @@ function readWindow(
   return { lo, hi, why: 'that reads through it', ...(spared ? { sparedByMiss: true as const } : {}) };
 }
 
+/** The addresses a strided range moved by `off` may hold, where an access `width` bytes wide at
+ *  any of them stays inside one address space — or null where a start could fall below 0 or an
+ *  access wrap past 2^32, so no interval names the bytes it touches. What a runtime index into the
+ *  frame may reach (`indexedAccess`) and where a computed store may land (`misses`) both read it. */
+function displaced(r: StridedRange, off: number, width: number): StridedRange | null {
+  const lo = r.lo + off;
+  const hi = r.hi + off;
+  return lo < 0 || hi + width > 2 ** 32 ? null : { lo, hi, stride: r.stride };
+}
+
 /** A store through a computed pointer that provably misses the control halfword at `cnt`: no
  *  address its base may hold (`addressRangeOf`, a strided interval), displaced by the store's own
  *  offset, starts a store whose bytes overlap `[cnt, cnt + 2)`. agbcc's `gEnts[i].f = 1` after a
@@ -1627,18 +1963,17 @@ function readWindow(
  *  over": an immediate transfer is, but a later store that sets the enable bit again reloads the
  *  source register and reads the frame anew (GBATEK, DMA control bit 15), which is what this
  *  guards against. A store this cannot bound on every value stays an unresolved pointer. */
-function misses(op: Op, facts: FrameAddressFacts, cnt: number): boolean {
-  const r = facts.addressRangeOf(op.operands[0]);
+function misses(op: Op, facts: FrameAddressFacts, cnt: number, blk: Block): boolean {
+  const r = facts.addressRangeOf(op.operands[0], blk);
   if (r === undefined) {
     return false;
   }
-  const off = op.attrs.off as number;
   const width = op.attrs.width as number;
-  const lo = r.lo + off;
-  const hi = r.hi + off;
-  if (lo < 0 || hi + width > 2 ** 32) {
+  const starts = displaced(r, op.attrs.off as number, width);
+  if (starts === null) {
     return false;
   }
+  const { lo, hi } = starts;
   // the first start at or above the lowest one that overlaps, against the highest that does
   const from = cnt - width + 1;
   const first = from <= lo || r.stride === 0 ? lo : lo + Math.ceil((from - lo) / r.stride) * r.stride;
@@ -2166,7 +2501,7 @@ function failIfSlotKeysIt(
  *  holds (`writerNotKept` says which writers it can hold) — or one per part, where the accesses
  *  prove the bytes are several objects no use reads across (`provenParts`) — and every access
  *  inside it is a cast-spelled access to that array (an element of a part, by its index:
- *  structure.ts `frameArrayElement`), or a view of the union it is declared as where two widths
+ *  structure.ts `framePartDecls`), or a view of the union it is declared as where two widths
  *  meet at one byte — so each store the machine made there is a store the
  *  recompile makes too. That is what agbcc does for an object whose address escaped: it keeps
  *  every store to it, in order (flow.c deletes a memory store only when an identical later
@@ -2210,13 +2545,21 @@ function keepAsOneObject({
     fail(`${kept} cannot hold every writer — ${writer}`);
   }
   // A runtime index names no byte, so the rule below is asked of it at EVERY byte it may reach:
-  // all of them. Two indexed widths refuse here; an index beside a member of another width
-  // refuses after the members are checked against each other, so a member pair keeps naming its
-  // own byte (`indexedWidth` says why one width is enough).
-  const index = indexedWidth([...uses.indexed.values()].flat());
-  if (index.refusal !== null) {
-    fail(`a runtime index into ${kept} ${index.refusal}`);
-  }
+  // all of them where nothing bounds it, the bytes its `reach` names where one does — a byte no
+  // index reaches is read at one type whatever the index's is, and accesses that share no byte
+  // cannot serve each other a stale value. Two indexed widths that may share a byte refuse here;
+  // an index beside a member of another width refuses after the members are checked against each
+  // other, so a member pair keeps naming its own byte (`indexedWidth` says why one width is
+  // enough).
+  const indexes = [...uses.indexed.values()].flat();
+  indexes.forEach((x, i) => {
+    for (const y of indexes.slice(i + 1)) {
+      const { refusal } = indexedWidth([x, y]);
+      if (refusal !== null && mayShare(x.reach, y.reach)) {
+        fail(`a runtime index into ${kept} ${refusal}`);
+      }
+    }
+  });
   // ONE TYPE PER BYTE, OR ONE UNION. agbcc at -O2 turns on type-based alias analysis
   // (toplev.c:3616), and compiled, a `u32` read through a cast is served the earlier `u32` store
   // straight past a `u16` store to the same bytes — a stale value. So a byte two accesses of
@@ -2252,8 +2595,9 @@ function keepAsOneObject({
     }
   }
   if (twoWidths !== undefined) {
-    // any runtime index, a byte one too: `indexedWidth` leaves width 1 out because a char access
-    // agrees with every width, but a union view is still spelled for fixed offsets alone
+    // any runtime index, a byte one too, and wherever its reach lies: `indexedWidth` leaves width
+    // 1 out because a char access agrees with every width, but a union view is spelled for fixed
+    // offsets on the object alone, and an indexed access is not one (the rewrite below refuses it)
     const why = unionRefusal({ from, to, uses, indexed: uses.indexed.size > 0 });
     if (why !== null) {
       fail(
@@ -2263,9 +2607,10 @@ function keepAsOneObject({
     }
   }
   for (const [b, had] of widthAt) {
-    if (index.width !== null && had !== index.width) {
+    const by = indexes.find((x) => x.width !== 1 && x.width !== had && mayTouch(x.reach, b, 1));
+    if (by !== undefined) {
       fail(
-        `the byte at [sp,#${b}] of ${kept} is accessed ${had} bytes wide and by a runtime index ${index.width} ` +
+        `the byte at [sp,#${b}] of ${kept} is accessed ${had} bytes wide and by a runtime index ${by.width} ` +
           `bytes wide, ${STALE_ACROSS_TYPES}`,
       );
     }
@@ -2296,7 +2641,8 @@ function keepAsOneObject({
       : [{ from, to }];
   // …stamped `part` where there are several: storage a copy proved one object of the source's, so
   // its bytes are that object's elements rather than the one object's mix of members and spills,
-  // and the emitter may name them as elements (structure.ts `frameArrayElement`)
+  // and the emitter may name them as elements (structure.ts `framePartDecls`), of the type their
+  // accesses agree on (`stampPartElements`, below)
   const laddrs = parts.map(({ from: lo, to: hi }) =>
     mkOp('laddr', {
       results: [mkValue(T.unk(32))],
@@ -2369,6 +2715,9 @@ function keepAsOneObject({
     }
     object.attrs = { ...object.attrs, views: unionViews(irBlocks, base) };
   }
+  if (laddrs.length > 1) {
+    stampPartElements(irBlocks, laddrs, uses.accessOps);
+  }
   irBlocks[0].ops.unshift(...(arrayOrder === 'descending' ? [...laddrs].reverse() : laddrs));
 }
 
@@ -2382,10 +2731,11 @@ function keepAsOneObject({
  *  folded into its own local (l3/constinit.ts).
  *
  *  ONE PART, never a refusal, whenever a byte could be read through two parts: a runtime index
- *  (it names no byte, so it may reach every one), an escape nothing bounds (a callee or a holder
- *  that may reach any byte from the address it was given), a byte no use names (nothing says
- *  which side it belongs to), or a use through a member that lands outside the part its own
- *  address lies in (`&a[16]` read at [-1]: one pointer walking two parts is one object). The
+ *  nothing bounds (it names no byte, so it may reach every one) or one whose `reach` (the range
+ *  ir/bits.ts proves of the index: `a[(i & 7) * 2]`) crosses a part, an escape nothing bounds (a
+ *  callee or a holder that may reach any byte from the address it was given), a byte no use names
+ *  (nothing says which side it belongs to), or a use through a member that lands outside the part
+ *  its own address lies in (`&a[16]` read at [-1]: one pointer walking two parts is one object). The
  *  union views of two widths at one byte are not split either (the caller asks only without
  *  them). An access straddling two runs chains them into one part by construction. */
 function provenParts(
@@ -2395,27 +2745,31 @@ function provenParts(
   alignment: number,
 ): FrameRange[] {
   const whole = [{ from, to }];
-  if (uses.indexed.size > 0) {
-    return whole;
-  }
   const touched: { owner: number; lo: number; hi: number }[] = [];
-  for (const [op, { off }] of uses.accessOps) {
+  for (const [op, { off, index }] of uses.accessOps) {
+    // …an access through a runtime index is not at its own displacement: it is its reach (below)
+    if (index !== undefined) {
+      continue;
+    }
     const at = off + (op.attrs.off as number);
     touched.push({ owner: off, lo: at, hi: at + (op.attrs.width as number) });
   }
+  // An escape and a runtime index each touch every byte they may reach (`frameReaches`), so each
+  // chains the runs it spans as one access as wide would — a reach across a copy's start makes
+  // the two copies one part — and a reach that starts in a part other than its object's fails the
+  // owner test below
+  const reaches = frameReaches(uses);
+  for (const { owner, reach } of reaches) {
+    if (reach === null) {
+      return whole;
+    }
+    touched.push({ owner, ...reach });
+  }
   for (const [off, reads] of uses.byValueReads) {
     reads.forEach(({ type }) =>
       touched.push({ owner: off, lo: off, hi: off + (type.kind === 'struct' ? (type.size ?? Infinity) : Infinity) }),
     );
   }
-  for (const [off, extents] of uses.escapeExtents) {
-    for (const e of extents) {
-      if (e === null) {
-        return whole;
-      }
-      touched.push({ owner: off, ...e });
-    }
-  }
   // …and a boundary only where a bounded copy starts: an address handed to `memcpy` is where
   // the source put an object it fills. A run starting anywhere else is bytes reached from below,
   // which says nothing of where one object ends — the one-object relift reads every slot through
@@ -2426,7 +2780,7 @@ function provenParts(
   // reads `buf[6]` through a base it holds where the target re-formed sp+6. Only a copy's
   // DESTINATION counts: a copy reading OUT of the frame says where the source took bytes from,
   // which is as likely `memcpy(g, &w[2], 8)` from the middle of one array as a second object.
-  const starts = new Set([...uses.escapeExtents.values()].flat().flatMap((e) => (e?.into ? [e.lo] : [])));
+  const starts = copyStarts(reaches);
   const parts: { from: number; to: number }[] = [];
   for (const { lo, hi } of [...touched].sort((a, b) => a.lo - b.lo)) {
     const last = parts.at(-1);
@@ -2525,6 +2879,95 @@ function unionViews(irBlocks: readonly Block[], base: Value): number[] {
     .flatMap(([w, accesses]) => unionViewSigns(w, accesses).map((sg) => (sg && w !== 4 ? -w : w)));
 }
 
+/** THE ELEMENT EACH PROVEN PART IS DECLARED WITH, from the census of its own accesses — the way
+ *  `unionViews` types a union's views from theirs — stamped `elem` on the part's `laddr` (a width in
+ *  bytes, negative for a signed narrow one; absent is the storage default, `u8`).
+ *
+ *  A part is an object of the source's (`provenParts`), and its bare element `sp64[i]` is not the
+ *  same compile as the cast `((u16 *)sp64)[i]` beside a second array whose base agbcc holds (see
+ *  structure.ts `framePartDecls`) — but the bare spelling exists only for an access of the declared
+ *  element's width and extension, so a part of `u16` or `s8` elements declared `u8` reaches no
+ *  access bare. Every access agreeing on one element is the evidence a declaration of it needs. An access that disagrees with the declaration keeps its cast, which is
+ *  one value under any declaration (structure.ts `bareArrayElement`), so the stamp never changes
+ *  what an access reads; nor what it aliases, since a bare element of a `u16` array is a `u16`
+ *  lvalue, the type the cast it replaces names.
+ *
+ *  - One width over every access (a block copy or any other escape has none), aligned to it — the
+ *    part's start, its size and every fixed offset — else the storage default.
+ *  - Its extension from the LOADS: one extension is that one, both is no element (no evidence picks
+ *    between them). An unsigned byte read whose every reader sign-extends it is either: agbcc has
+ *    no `ldrsb` with an immediate offset and mwcc no signed byte load at all, so `s8 a[64]`'s `a[3]`
+ *    is that read (structure.ts `declaredExtendedRead` spells it bare once the part says `s8`). With
+ *    no load committing, such a read makes the element signed, and else a store raise/storesign.ts
+ *    stamped signed does, as `unionViewSigns` reads a view's.
+ *  - A word is one element whatever its loads say (`scalarTypeForAccess`).
+ *  An access whose part is not known — one through a pointer a phi carries, an index nothing bounds
+ *  — leaves every part at the default: its width is not counted, so no census is whole. */
+function stampPartElements(
+  irBlocks: readonly Block[],
+  laddrs: readonly Op[],
+  accessOps: ReadonlyMap<Op, FrameAccessOp>,
+): void {
+  const bases = laddrs.map((d) => d.results[0]);
+  const start = laddrs.map((d) => d.attrs.off as number);
+  const end = laddrs.map((d) => (d.attrs.off as number) + (d.attrs.count as number));
+  const users = new Map<Value, Op[]>();
+  for (const op of irBlocks.flatMap((b) => b.ops)) {
+    op.operands.forEach((v) => (users.get(v) ?? users.set(v, []).get(v)!).push(op));
+  }
+  type Access = { width: number; at: number | null; load: boolean; signed: boolean | null; stamped: boolean };
+  const census = laddrs.map((): Access[] => []);
+  for (const [op, { index }] of accessOps) {
+    const fixed = bases.indexOf(op.operands[0]);
+    const reach = index?.reach ?? null;
+    const part =
+      fixed >= 0 ? fixed : reach === null ? -1 : start.findIndex((lo, i) => reach.lo >= lo && reach.hi <= end[i]);
+    if (part < 0) {
+      return;
+    }
+    const width = op.attrs.width as number;
+    const load = op.opcode === 'load';
+    // …a sign extension as the frontend lifts it: mwcc's `extsb`, or the `lsl #24; asr #24` pair
+    // (the idiom stage folds it to a `sext` later, pattern/engine.ts `sextPat`)
+    const extends8 = (u: Op): boolean =>
+      (u.opcode === 'sext' && u.attrs.width === 8) ||
+      (u.opcode === 'shl' &&
+        u.attrs.imm === 24 &&
+        (users.get(u.results[0]) ?? []).length > 0 &&
+        users.get(u.results[0])!.every((s) => s.opcode === 'shr_s' && s.attrs.imm === 24));
+    const readers = load ? (users.get(op.results[0]) ?? []) : [];
+    const either = width === 1 && op.attrs.signed !== true && readers.length > 0 && readers.every(extends8);
+    census[part].push({
+      width,
+      at: fixed >= 0 ? (op.attrs.off as number) : null,
+      load,
+      signed: !load || either ? null : op.attrs.signed === true,
+      stamped: !load && op.attrs.signed === true,
+    });
+  }
+  laddrs.forEach((d, i) => {
+    const accesses = census[i];
+    const widths = new Set(accesses.map((a) => a.width));
+    if (widths.size !== 1) {
+      return;
+    }
+    const [w] = widths;
+    const count = d.attrs.count as number;
+    if (start[i] % w !== 0 || count % w !== 0 || accesses.some((a) => a.at !== null && a.at % w !== 0)) {
+      return;
+    }
+    const signs = new Set(accesses.flatMap((a) => (a.signed === null ? [] : [a.signed])));
+    if (signs.size > 1) {
+      return;
+    }
+    const signed = signs.size === 1 ? [...signs][0] : accesses.some((a) => a.load || a.stamped);
+    const elem = signed && w !== 4 ? -w : w;
+    if (elem !== 1) {
+      d.attrs = { ...d.attrs, elem };
+    }
+  });
+}
+
 /** One object's shape: `count` elements of `width` bytes. */
 interface ObjectShape {
   readonly width: number;