@asmlift/core 0.3.0 → 0.5.0

package/src/rank.ts

@@ -12,12 +12,16 @@ import { cBackend } from './backend/c';
 import { assertDerefsTyped, assertResolved } from './contracts';
 import type { AsmData } from './frontend/asmdata';
 import { frontendFor } from './frontend/registry';
+import { globalCellOf } from './ir/alias';
 import { Fn, type Value, defOpMap } from './ir/core';
 import { T } from './ir/types';
 import { verify } from './ir/verify';
+import { materializeArgBases } from './l3/argbase';
 import type { LanguageBackend, SFn } from './l3/ast';
+import { coalesceCandidates } from './l3/coalesce';
 import { registerishSpellings } from './l3/regspell';
 import { reindexWalks } from './l3/reindex';
+import { hoistScopedBases } from './l3/scopebase';
 import { type SymbolRef, collectSymbolRefs } from './l3/symbol-refs';
 import { RewritePattern } from './pattern/engine';
 import { applyIdiomPatterns, raiseRecovered, structureChecked } from './pipeline';
@@ -117,12 +121,30 @@ export interface EnumerateOptions {
   asmData?: AsmData;
   /** address→symbol map (symbols.ts) — same contract as DecompileOptions.symbols */
   symbols?: SymbolMap;
+  /** Called when a re-spelling lever THROWS or fails a boundary contract, so the failure is visible
+   *  instead of the candidate silently not existing. Enumeration continues either way — the primary
+   *  spelling is unaffected — but a lever that never fires because it always throws is a defect, and
+   *  without this it looks identical to a lever that correctly declined. */
+  onLeverError?: (label: string, error: string) => void;
 }
 
-/** One distinct candidate spelling (a signedness × branch-sense lever combination), emitted to source. */
+/** One distinct candidate spelling — a point in the axis cross (signedness × branch sense ×
+ *  def-site anchoring × bitfield spelling × symbol-map variant, plus the L3 re-spellings) —
+ *  emitted to source. */
 export interface Candidate {
   label: string;
   source: string;
+  /** Which PREFERENCE GROUP this spelling belongs to — the symbol-variant index (0 = the map's own
+   *  named spellings, 1 = their `/raw-globals` siblings). Enumeration emits the groups in
+   *  preference order, and a lower group WINS a score tie: when both compile to the same bytes the
+   *  reader should get `gCounter.field`, not a byte offset off a hoisted `(u8 *)` base.
+   *
+   *  Carried structurally rather than left to enumeration order because the readability tie-break
+   *  (compareScored) must compare only spellings that are genuinely alternatives of the same
+   *  thing. Ranking a named spelling against a raw-address one on cast count is not a readability
+   *  comparison at all — the raw form's `(u8 *)` base is not counted, so it would win by
+   *  construction, trading named struct fields for anonymous byte offsets. */
+  group: number;
   /** the map-derived VALUE references this candidate's tree contains — what the scoring
    *  layer's declaration synthesis renders. DERIVED, never carried: computed once from the
    *  exact tree this candidate's source was emitted from, at the moment the candidate is
@@ -179,10 +201,32 @@ export function enumerateCandidates(
   // and let the differ referee. The default sense is always among them, so this never scores
   // worse; it only wins where the flip matches.
   const defSense = baseOpts.preserveDivergentBranchSense ?? true;
-  const senseCands = [
-    { suffix: '', sense: defSense },
-    { suffix: '/flip-branch', sense: !defSense },
+  // `/defsite` — def-site-anchored constant merge copies (structure.ts anchorConstCopies) — is a
+  // structuring axis on the same footing as branch sense: where the asm materialized a merge
+  // constant is placement evidence, but whether the SOURCE spelled it there is genuinely
+  // ambiguous, so both placements are emitted and the differ referees. Crossed with branch sense
+  // (an anchored copy empties an arm, which is exactly what changes which sense wins); the dedup
+  // below collapses every variant the anchoring left unchanged.
+  const baseSense = [
+    { suffix: '', sense: defSense, anchor: false, bitfields: true },
+    { suffix: '/flip-branch', sense: !defSense, anchor: false, bitfields: true },
+    { suffix: '/defsite', sense: defSense, anchor: true, bitfields: true },
+    { suffix: '/flip-branch/defsite', sense: !defSense, anchor: true, bitfields: true },
   ];
+  // `/no-bitfield` — keep the honest shift spelling where the map would name a bitfield member.
+  // The named read recompiles at the DECLARATION's access width; where that diverges from the
+  // asm's load width, the shifts are the spelling that matches — so both are emitted and the
+  // differ referees. Enumerated only when the map carries any bitfield member at all (checked
+  // below), so the 2× cross is paid exactly by the functions it can help; the dedup collapses
+  // every variant where no fold fired.
+  const mapHasBitfields =
+    opts.symbols !== undefined &&
+    [...opts.symbols.values()].some((infos) =>
+      infos.some((i) => [...(i.layout ?? []), ...(i.pointee?.layout ?? [])].some((f) => f.bitWidth !== undefined)),
+    );
+  const bitfieldCands = mapHasBitfields
+    ? [...baseSense, ...baseSense.map((s) => ({ ...s, suffix: `${s.suffix}/no-bitfield`, bitfields: false }))]
+    : baseSense;
   // Probe: recover ONCE with no signedness pin, to learn which entry params are pointers/aggregates
   // so they are excluded from the signedness axis (see NO_PIN_KINDS). One extra lift+recover, no
   // compile. (The probe deliberately stops after recoverTypes — it only reads the param KINDS, so
@@ -196,6 +240,28 @@ export function enumerateCandidates(
   // Access facts for name-only symbol declarations (see bareGlobalAccessFacts) — derived once
   // from the probe: widths/offsets are lift-time facts, identical across every candidate.
   const accessFacts = opts.symbols ? bareGlobalAccessFacts(probe) : new Map<string, never>();
+  // `/reread-globals` — the VALUE-HOME axis (structure/analysis.ts AnalyzeOptions). Whether the
+  // source read a global once into a variable or re-read it at each use is not derivable from asm:
+  // the compiler CSEs the second spelling back into one load, and the round-5 dogfood watched agbcc
+  // land on both sides inside a single function (its highest-cost defect, 25 of 27 points on one
+  // klonoa function and 35/50 both ways on another). So both spellings are emitted and the differ
+  // referees — the same footing as signedness and branch sense, and never a default: the cached
+  // spelling stays the primary, so this can only ever ADD a winner.
+  //
+  // Gated on the function having a load that resolves to a named global at all — the only thing the
+  // axis can change. The dedup below collapses the pair wherever it changed nothing.
+  const probeDefs = defOpMap(probe);
+  const readsANamedGlobal = probe.blocks.some((b) =>
+    b.ops.some(
+      (op) => op.opcode === 'load' && globalCellOf(probeDefs, op.operands[0], op.attrs.off as number) !== null,
+    ),
+  );
+  const senseCands = readsANamedGlobal
+    ? [
+        ...bitfieldCands.map((s) => ({ ...s, reread: false })),
+        ...bitfieldCands.map((s) => ({ ...s, suffix: `${s.suffix}/reread-globals`, reread: true })),
+      ]
+    : bitfieldCands.map((s) => ({ ...s, reread: false }));
 
   const seen = new Set<string>();
   const out: Candidate[] = [];
@@ -211,7 +277,7 @@ export function enumerateCandidates(
         { suffix: '/raw-globals', symbols: undefined },
       ]
     : [{ suffix: '' }];
-  for (const sv of symbolVariants) {
+  for (const [svIndex, sv] of symbolVariants.entries()) {
     const svOpts = sv.symbols ? baseOpts : { ...baseOpts, symbols: undefined };
     for (const cand of SIGN_CANDS) {
       const fn = frontend.lift(name, asm, target, prototypes, opts.asmData, sv.symbols);
@@ -223,7 +289,24 @@ export function enumerateCandidates(
       for (const s of senseCands) {
         // structure() reads `fn` and produces a fresh SFn (it does not mutate `fn`), so both branch
         // senses structure the same recovered function without re-lifting.
-        const sfn = structureChecked(fn, { ...svOpts, preserveDivergentBranchSense: s.sense });
+        let sfn: SFn;
+        try {
+          sfn = structureChecked(fn, {
+            ...svOpts,
+            preserveDivergentBranchSense: s.sense,
+            anchorConstCopies: s.anchor,
+            spellBitfieldMembers: s.bitfields,
+            rereadGlobals: s.reread,
+          });
+        } catch (e) {
+          if (!s.anchor && s.bitfields && !s.reread) {
+            throw e; // the base axes keep their behavior: a structuring failure aborts the row
+          }
+          // an anchored variant that fails structuring or its contracts is a dropped lever, never
+          // an aborted enumeration — same rule as respell below
+          opts.onLeverError?.(name + s.suffix, e instanceof Error ? e.message.split('\n')[0] : String(e));
+          continue;
+        }
         // The walk→index re-spelling (l3/reindex.ts) is a THIRD lever on the same footing as
         // signedness and branch sense: whether the source spelled `*p; p++` or `arr[i]` is
         // genuinely ambiguous from asm (compilers strength-reduce the latter into the former), so
@@ -266,24 +349,72 @@ export function enumerateCandidates(
         // to the user — a semantically-wrong re-spelling there is plausible-but-wrong output, the
         // defect class this project exists to avoid. Hence each lever's decline-over-approximate
         // gates, adversarially audited.
-        const respell = (suffix: string, alt: SFn): void => {
+        // Takes a THUNK, so the lever's own computation is inside the try too. A lever that threw
+        // from the pass itself — rather than from the contracts or the backend — would escape and
+        // abort the whole enumeration for this row, primary included: the one way a lever can cost
+        // a match. Making that structural rather than per-call-site means no lever can opt out.
+        const respell = (suffix: string, make: () => SFn | null | undefined): void => {
           try {
+            const alt = make();
+            if (!alt) {
+              return; // the lever declined to fire — no candidate, not a duplicate of the primary
+            }
             assertResolved(alt);
             assertDerefsTyped(alt);
             spellings.push({ suffix, source: backend.emit(alt), ...refsOf(alt) });
-          } catch {
-            // contract-failing or unspellable re-spelling: drop it, keep the primary
+          } catch (e) {
+            // A throwing lever, a contract failure, or an unspellable re-spelling: keep the primary.
+            // REPORTED, not swallowed. `dropped` (below) records only spellings the SCORER refused,
+            // so without this a lever that fails here vanishes with no trace — indistinguishable
+            // from one that correctly declined, which is exactly the hidden failure
+            // DroppedCandidate exists to surface.
+            opts.onLeverError?.(name + suffix, e instanceof Error ? e.message.split('\n')[0] : String(e));
           }
         };
-        const indexed = reindexWalks(sfn);
-        if (indexed) {
-          respell('/indexed', indexed);
-        }
+        // `/argbase` — name a call's argument bases before the call (l3/argbase.ts). A lever on the
+        // same footing as the others: the primary inline spelling stays in the list, so the differ
+        // referees and this can never cost a match.
+        respell('/argbase', () => materializeArgBases(sfn));
+        // `/scopebase` — name a reused global base at the INNERMOST scope holding its uses
+        // (l3/scopebase.ts). Distinct from basecse's function-top hoist, which the primary already
+        // carries: this one fires exactly where that placement would extend a live range the
+        // original never had.
+        // `/scopebase`, and its COALESCED variants. Which locals a register allocator shared is not
+        // derivable from the tree — on the row this was built for the two legal merges score 18 and
+        // 40 against a no-merge 21, so committing to one by declaration order costs 19 points and
+        // discards the winner. Every variant is emitted and the differ referees, exactly as
+        // `/regcopy` does for its allocator-ambiguous tail choice.
+        //
+        // POLICY NOTE: rank.ts's rule is that re-spellings derive from the BASE spelling only —
+        // levers do not compose. These are not a second lever composed onto the first: coalescing is
+        // enumerated as alternative OUTPUTS of the base hoist, in the one place that knows the hoist
+        // just happened. The un-coalesced `/scopebase` stays in the list, so nothing is lost.
+        //
+        // EVERY pass invocation stays INSIDE a thunk — see the paragraph above on why a pass that
+        // runs outside `respell`'s try is the one way a lever can cost a match. `enumerate` re-runs
+        // the hoist per candidate, which is pure and cheap, rather than caching it outside the guard.
+        respell('/scopebase', () => hoistScopedBases(sfn));
+        const enumerate = (label: string, from: () => SFn | null | undefined): void => {
+          let variants: { merged: string; sfn: SFn }[] = [];
+          try {
+            const base = from();
+            variants = base ? coalesceCandidates(base) : [];
+          } catch (e) {
+            opts.onLeverError?.(name + label, e instanceof Error ? e.message.split('\n')[0] : String(e));
+            return;
+          }
+          for (const c of variants) {
+            respell(`${label}-${c.merged}`, () => c.sfn);
+          }
+        };
+        enumerate('/scopebase-coalesce', () => hoistScopedBases(sfn));
+        enumerate('/coalesce', () => sfn);
+        respell('/indexed', () => reindexWalks(sfn));
         // the register-copy spelling (l3/regspell.ts): 0–3 variants (base; tail assign-back reusing
         // the dead value var; tail assign-back into a fresh var — the tail choice is allocator-
         // ambiguous, so both are ranked)
         const REGCOPY_LABELS = ['/regcopy', '/regcopy-ret', '/regcopy-ret-fresh'];
-        registerishSpellings(sfn).forEach((alt, i) => respell(REGCOPY_LABELS[i] ?? `/regcopy-${i}`, alt));
+        registerishSpellings(sfn).forEach((alt, i) => respell(REGCOPY_LABELS[i] ?? `/regcopy-${i}`, () => alt));
         for (const sp of spellings) {
           const source = sp.source;
           // Collapse a spelling that produced identical source (a function with no divergent `if`
@@ -298,6 +429,7 @@ export function enumerateCandidates(
           out.push({
             label: `${cand.label}${s.suffix}${sp.suffix}${sv.suffix}`,
             source,
+            group: svIndex,
             ...(sp.symbolRefs ? { symbolRefs: sp.symbolRefs } : {}),
           });
         }
@@ -332,15 +464,59 @@ export function rankBy<S extends { score: number }>(
   if (results.length === 0) {
     throw new Error(`no scorable candidate for '${symbol}': ${firstLine(lastScoreErr)}`, { cause: lastScoreErr });
   }
-  // Score first; ENUMERATION ORDER breaks a tie. That order is meaningful, not incidental:
-  // enumerateCandidates emits the symbol-map spellings before their `/raw-globals` siblings, so
-  // when both compile to the same bytes the named one wins and the reader gets `gCounter` rather
-  // than a bare address. Spelled as an explicit comparator because relying on Array#sort's
-  // stability would make the preference an accident of two unrelated decisions.
-  results.sort((a, b) => a.score.score - b.score.score || a.order - b.order);
+  results.sort(compareScored);
   return { best: results[0], candidates: results.map(({ order: _order, ...c }) => c), dropped };
 }
 
+/** THE candidate ordering — score, then preference group, then readability, then enumeration
+ *  order. Exported because there are TWO drivers over the same enumeration (this module's sync
+ *  `rankBy` for the Node/objdiff scorer, and the webapp's async await-loop for the wasm one), and
+ *  a per-driver copy would let the same input produce two different winners.
+ *
+ *  SCORE dominates absolutely: the differ is the fitness function, and a tie means the axis that
+ *  separates these two spellings did not change the bytes — so everything below only chooses what
+ *  the READER sees, and can never cost a match.
+ *
+ *  GROUP next: a named symbol-map spelling beats its `/raw-globals` sibling at equal bytes.
+ *
+ *  CAST COUNT next, and only WITHIN a group. A wrong signedness pin is what manufactures casts —
+ *  the C backend has to cast a shift operand back to the signedness the machine op needs, so
+ *  pinning `u32` on a genuinely-signed parameter buys `s32 f(u32 a0) { return (s32)a0 >> a1; }`
+ *  for the same bytes as `s32 f(s32 a0) { return a0 >> a1; }`. Before the backend synthesized that
+ *  cast the wrong pin simply lost on score; now it ties, and enumeration order alone would
+ *  silently install the noisier spelling.
+ *
+ *  ENUMERATION ORDER last, which makes this a strict total order (indices are unique) and the
+ *  result deterministic. Spelled explicitly rather than leaning on Array#sort's stability, which
+ *  would make each preference an accident of two unrelated decisions. */
+export function compareScored<S extends { score: number }>(
+  a: Candidate & { score: S; order: number },
+  b: Candidate & { score: S; order: number },
+): number {
+  return (
+    a.score.score - b.score.score || a.group - b.group || castCount(a.source) - castCount(b.source) || a.order - b.order
+  );
+}
+
+/** Scalar casts in a candidate's rendered source — the readability tie-break above.
+ *
+ *  A TEXT count over the emitted string, matching how the benchmark's own readability metric
+ *  measures the same thing (apps/benchmark/src/eval/quality.ts) — the two must agree about what
+ *  "cast noise" means, or ranking optimizes for something the report then scores differently.
+ *
+ *  It counts the decomp typedef vocabulary only, so a pointer or struct cast is not read as noise
+ *  — those are structural spellings a candidate does not choose. And it carries `quality.ts`'s
+ *  ADDRESS-CAST exemption: `(u32)&gSym` / `(s32)&gSym` is the CORRECT source spelling of integer
+ *  arithmetic on a link-time address, which decomp projects write themselves. Counting it would
+ *  penalize precisely the named spelling this ranking is supposed to prefer.
+ *
+ *  Deterministic, and total on any string. */
+function castCount(source: string): number {
+  const all = source.match(/\((?:u|s)(?:8|16|32)\)/g)?.length ?? 0;
+  const addr = source.match(/\((?:u|s)32\)\s*&/g)?.length ?? 0;
+  return all - addr;
+}
+
 /** First line of whatever the scorer threw — the compiler's own diagnostic, not a stack. */
 function firstLine(e: unknown): string {
   return e instanceof Error ? e.message.split('\n')[0] : String(e ?? 'no candidate produced');

package/src/structure/analysis.ts

@@ -5,6 +5,7 @@
 //     interference check in structure.ts;
 //   • the effect-ordering model — which call/load defs must MATERIALIZE as named temps at
 //     their own program position instead of inlining at their use.
+import { globalCellOf, mayWriteGlobal } from '../ir/alias';
 import { Block, Fn, Op, Value, successorsOf } from '../ir/core';
 
 export interface UseSite {
@@ -24,9 +25,42 @@ export interface StructureAnalysis {
   materialize: Set<Op>;
   /** cached forward reachability (successors-transitive, excluding the start block itself) */
   reachFrom: (b: Block) => Set<Block>;
+  /** where a value's expression ultimately renders — the anchored consumer it inlines into,
+   *  transitively; null = several places / unresolvable (callers treat conservatively) */
+  emitPos: (op: Op) => { blk: Block; idx: number } | null;
+  /** may an op `isWrite` accepts execute between `def` and a statement at `render`, on any
+   *  def-avoiding path — the fold-ordering gate (see the closure's comment) */
+  memWriteBetween: (def: Op, render: { blk: Block; idx: number }, isWrite: (x: Op) => boolean) => boolean;
 }
 
-export function analyze(fn: Fn, returnsVoid: boolean): StructureAnalysis {
+export interface AnalyzeOptions {
+  /** the fn's def map (`defOpMap`) — the structurer already holds one, so it is passed rather than
+   *  rebuilt. Absent ⇒ the global-aware alias rule below cannot resolve anything and every write
+   *  bars, exactly as before it existed. */
+  defs?: Map<Value, Op>;
+  /** THE value-home axis (rank.ts `/reread-globals`). A read of a named global is barred from
+   *  rendering at its use by any write in between — even a store to an unrelated global, which
+   *  cannot possibly change what it sees. That over-conservatism is what invents the locals the
+   *  round-5 dogfood measured as its highest-cost defect ("hoists what agbcc re-reads"):
+   *
+   *      gA = v; gB = v;   with `s32 v = gValue;`   where the source said `gA = gValue; gB = gValue;`
+   *
+   *  With this on, the barrier scan for a load whose address resolves to a named global uses THE
+   *  shared disjointness query (ir/alias.ts) instead of "any write at all". Materializing is always
+   *  sound, so today's spelling is never wrong — only sometimes not the one the compiler was given.
+   *  Which side matches is genuinely per-function (the same dogfood watched agbcc go both ways
+   *  inside ONE function), so this is a differ-refereed candidate axis, never a default. */
+  rereadGlobals?: boolean;
+  /** "does the project declare this global volatile?" — a read of a volatile object may NOT be
+   *  duplicated or moved, so the axis above refuses on one. Answers false for a symbol the map
+   *  does not carry (and for no map at all), which is the same posture the multi-render rule has
+   *  always had: without a declaration nothing here can know, and the differ referees the extra
+   *  load. Where the map DOES know, the axis is silent about it rather than wrong. */
+  volatileGlobal?: (name: string) => boolean;
+}
+
+export function analyze(fn: Fn, returnsVoid: boolean, opts: AnalyzeOptions = {}): StructureAnalysis {
+  const { defs, rereadGlobals = false, volatileGlobal } = opts;
   // ── use registry ────────────────────────────────────────────────────────────────────────
   // Every use of a value, POSITIONED: the consuming op and its block/index. Successor args are
   // uses AT the terminator (they render in argAssigns at block end). A void function's `ret`
@@ -198,29 +232,116 @@ export function analyze(fn: Fn, returnsVoid: boolean): StructureAnalysis {
   // terminator, materialized def) it inlines into, transitively through single-use pure ops.
   // null = renders in several places / unresolvable (treated conservatively by the caller).
   const emitPosCache = new Map<Op, { blk: Block; idx: number } | null>();
+  /** an op that renders AT ITS OWN position: a statement, a terminator, a materialized or dead def */
+  const anchored = (op: Op): boolean =>
+    op.successors.length > 0 ||
+    op.opcode === 'ret' ||
+    op.opcode === 'store' ||
+    op.opcode === 'astore' ||
+    materialize.has(op) ||
+    !op.results.length ||
+    !useSitesOf.has(op.results[0]);
+  const consumersOf = (op: Op): Op[] => [...new Set((useSitesOf.get(op.results[0]) ?? []).map((s) => s.op))];
   const emitPos = (op: Op): { blk: Block; idx: number } | null => {
     if (emitPosCache.has(op)) {
       return emitPosCache.get(op)!;
     }
-    const own = { blk: opBlock.get(op)!, idx: opIndex.get(op)! };
     let res: { blk: Block; idx: number } | null;
-    if (
-      op.successors.length ||
-      op.opcode === 'ret' ||
-      op.opcode === 'store' ||
-      op.opcode === 'astore' ||
-      materialize.has(op) ||
-      !op.results.length ||
-      !useSitesOf.has(op.results[0])
-    ) {
-      res = own; // statements, terminators, materialized/dead defs
+    if (anchored(op)) {
+      res = { blk: opBlock.get(op)!, idx: opIndex.get(op)! };
     } else {
-      const consumers = [...new Set((useSitesOf.get(op.results[0]) ?? []).map((s) => s.op))];
+      const consumers = consumersOf(op);
       res = consumers.length === 1 ? emitPos(consumers[0]) : null;
     }
     emitPosCache.set(op, res);
     return res;
   };
+  // EVERY position a value's expression renders at — `emitPos` generalized to the whole set (it
+  // answers one place or gives up), by following ALL consumers transitively. That matters for
+  // the value-home axis: a pure expression with two consumers (`gOut = e; return e;`) has no single
+  // emit position, so `emitPos` answers null and every memory read feeding it is forced into a
+  // local — even when re-reading at both places is provably equivalent. Null only for a genuine
+  // cycle (defensive: SSA use-def is acyclic through ops), which the caller treats as unresolvable.
+  //
+  // NEVER for a call: two render positions mean two executions, so a call whose consumer renders in
+  // several places must keep answering null and materialize.
+  const emitPosSetCache = new Map<Op, { blk: Block; idx: number }[] | null>();
+  const emitPositions = (op: Op, visiting: Set<Op> = new Set()): { blk: Block; idx: number }[] | null => {
+    const hit = emitPosSetCache.get(op);
+    if (hit !== undefined) {
+      return hit;
+    }
+    if (visiting.has(op)) {
+      return null;
+    }
+    let res: { blk: Block; idx: number }[] | null;
+    if (anchored(op)) {
+      res = [{ blk: opBlock.get(op)!, idx: opIndex.get(op)! }];
+    } else {
+      visiting.add(op);
+      const seenPos = new Set<string>();
+      const acc: { blk: Block; idx: number }[] = [];
+      res = acc;
+      for (const c of consumersOf(op)) {
+        const sub = emitPositions(c, visiting);
+        if (!sub) {
+          res = null;
+          break;
+        }
+        for (const p of sub) {
+          const key = `${blockPos.get(p.blk)}:${p.idx}`;
+          if (!seenPos.has(key)) {
+            seenPos.add(key);
+            acc.push(p);
+          }
+        }
+      }
+      visiting.delete(op);
+    }
+    emitPosSetCache.set(op, res);
+    return res;
+  };
+  // THE def→render path discipline — one implementation, three callers (the two materialization
+  // rules below and structure.ts's bitfield fold, which imports it). May an op `isWrite` accepts
+  // execute between `def` and a statement at `render`, on any def-avoiding path? The def block's
+  // tail, the render block's head, and every between-block on a path; a path re-crossing the def
+  // is the NEXT dynamic instance and does not count. Path-based on purpose: `fn.blocks` is ADDRESS
+  // order, so a linear-position scan misses a block laid out after the render that executes
+  // between def and render on the taken path (an audit round broke exactly that way).
+  const memWriteBetween = (def: Op, render: { blk: Block; idx: number }, isWrite: (x: Op) => boolean): boolean => {
+    const b = opBlock.get(def)!;
+    const oi = opIndex.get(def)!;
+    const wDirty = (list: Op[], from: number, to: number): boolean => {
+      for (let k = from; k < to; k++) {
+        if (isWrite(list[k])) {
+          return true;
+        }
+      }
+      return false;
+    };
+    // Same block: the only def-avoiding path is the straight line between the two indices
+    // (leaving and re-entering the block re-crosses the def). A render BEFORE the def cannot
+    // happen — within a block, uses follow defs — and falls through to the path walk, whose
+    // answer is the conservative one.
+    if (render.blk === b && oi < render.idx) {
+      return wDirty(b.ops, oi + 1, render.idx);
+    }
+    if (wDirty(b.ops, oi + 1, b.ops.length) || wDirty(render.blk.ops, 0, render.idx)) {
+      return true;
+    }
+    for (const x of reachAvoiding(b, b)) {
+      if (x === render.blk && !reachAvoiding(render.blk, b).has(render.blk)) {
+        continue; // acyclic render block: head checked
+      }
+      if (x !== render.blk && !reachAvoiding(x, b).has(render.blk)) {
+        continue; // not on a def→render path
+      }
+      if (wDirty(x.ops, 0, x.ops.length)) {
+        return true;
+      }
+    }
+    return false;
+  };
   // Decide in REVERSE program order so a consumer's own materialization is settled before any
   // producer asks for its emit position (SSA: uses follow defs in dominance/layout order) — and
   // iterate to a fixpoint for IR whose block layout does not follow dominance (hand-built IR):
@@ -229,6 +350,7 @@ export function analyze(fn: Fn, returnsVoid: boolean): StructureAnalysis {
   for (let sizeBefore = -1; sizeBefore !== materialize.size;) {
     sizeBefore = materialize.size;
     emitPosCache.clear();
+    emitPosSetCache.clear(); // both render-position caches read `materialize`, which just grew
     for (let bi = fn.blocks.length - 1; bi >= 0; bi--) {
       const b = fn.blocks[bi];
       for (let oi = b.ops.length - 1; oi >= 0; oi--) {
@@ -268,6 +390,14 @@ export function analyze(fn: Fn, returnsVoid: boolean): StructureAnalysis {
         if (!r || !useSitesOf.has(r)) {
           continue;
         } // dead call → exprstmt (unchanged)
+        // Under the value-home axis: which named global cell this op reads, if any. A constant-
+        // offset `load` only — an `aload`'s runtime index names no single cell, and a call reads
+        // everything. Null ⇒ every write bars, exactly as before.
+        const cell =
+          rereadGlobals && defs && op.opcode === 'load'
+            ? globalCellOf(defs, op.operands[0], op.attrs.off as number)
+            : null;
+        const barsThisRead = cell && defs && !volatileGlobal?.(cell.name) ? mayWriteGlobal(defs, cell.name) : null;
         const sites = useSitesOf.get(r)!;
         const consumers = [...new Set(sites.map((s) => s.op))];
         const isCall = op.opcode === 'call';
@@ -280,50 +410,32 @@ export function analyze(fn: Fn, returnsVoid: boolean): StructureAnalysis {
         // per-use source spelling did (`while (*s != EOS) *d = *s;` reads *s twice per iteration),
         // so it is sound iff every render still sees the def-time memory: NO write anywhere
         // between the def and ANY render (cycle-aware, conservative write set). Otherwise a temp.
-        if (!isCall && consumers.length > 1) {
+        //
+        // WHERE it renders. Without the axis: one position per consumer, and a consumer with no
+        // single position (its own value renders in several places) refuses. With the axis a load
+        // resolves the whole SET instead — the second half of the value-home defect, where the
+        // local is invented not by a barrier but because the pure expression downstream is itself
+        // duplicated (`gOut = (gValue << 1) + gValue; return (gValue << 1) + gValue;`). Never for a
+        // call: several positions there mean several executions.
+        const poss =
+          rereadGlobals && !isCall
+            ? emitPositions(op)
+            : consumers.length > 1
+              ? consumers.map((c) => emitPos(c))
+              : [emitPos(consumers[0])];
+        if (!poss || poss.some((p) => p === null)) {
+          materialize.add(op);
+          continue;
+        }
+        if (poss.length > 1) {
           const MW = new Set(['store', 'astore', 'call', 'opaque']);
-          const wDirty = (list: Op[], from: number, to: number) => {
-            for (let k = from; k < to; k++) {
-              if (MW.has(list[k].opcode)) {
-                return true;
-              }
-            }
-            return false;
-          };
-          const defToRenderDirty = (q: { blk: Block; idx: number }): boolean => {
-            // Same block: the only def-avoiding path is the straight line between the two indices
-            // (leaving and re-entering the block re-crosses the def).
-            if (q.blk === b && oi < q.idx) {
-              return wDirty(b.ops, oi + 1, q.idx);
-            }
-            if (wDirty(b.ops, oi + 1, b.ops.length) || wDirty(q.blk.ops, 0, q.idx)) {
-              return true;
-            }
-            const between = reachAvoiding(b, b);
-            for (const x of between) {
-              if (x === q.blk && !reachAvoiding(q.blk, b).has(q.blk)) {
-                continue;
-              } // acyclic render blk: head checked
-              if (x !== q.blk && !reachAvoiding(x, b).has(q.blk)) {
-                continue;
-              } // not on a def→render path
-              if (wDirty(x.ops, 0, x.ops.length)) {
-                return true;
-              }
-            }
-            return false;
-          };
-          const poss = consumers.map((c) => emitPos(c));
-          if (poss.some((p) => p === null) || poss.some((p) => defToRenderDirty(p!))) {
+          const isWrite = barsThisRead ?? ((x: Op) => MW.has(x.opcode));
+          if (poss.some((p) => memWriteBetween(op, p!, isWrite))) {
             materialize.add(op);
           }
           continue;
         }
-        const pos = emitPos(consumers[0]);
-        if (!pos) {
-          materialize.add(op);
-          continue;
-        }
+        const pos = poss[0]!;
         // A between-op is a BARRIER when it renders as a sequenced statement the def would cross:
         // stores/opaque always; a call/load that is dead (statement), materialized (statement), or
         // inlined into a DIFFERENT statement. A sibling effect inlined into the SAME statement is
@@ -331,6 +443,11 @@ export function analyze(fn: Fn, returnsVoid: boolean): StructureAnalysis {
         // exactly as it originally chose to. Loads never bar a load (reads don't conflict).
         const samePos = (q: { blk: Block; idx: number } | null) => q !== null && q.blk === pos.blk && q.idx === pos.idx;
         const isBarrier = (x: Op): boolean => {
+          // Value-home axis: a store/astore this read is PROVABLY disjoint from (a different named
+          // global) does not sequence against it, so the read may still render at its use.
+          if (barsThisRead && (x.opcode === 'store' || x.opcode === 'astore') && !barsThisRead(x)) {
+            return false;
+          }
           if (x.opcode === 'store') {
             // A store to a PROVABLY-DISJOINT slot of the same base never aliases the load: same
             // base SSA value, both constant offset+width, ranges non-overlapping (the everyday
@@ -362,49 +479,18 @@ export function analyze(fn: Fn, returnsVoid: boolean): StructureAnalysis {
           }
           return false;
         };
-        const gapDirty = (list: Op[], from: number, to: number) => {
-          for (let k = from; k < to; k++) {
-            if (isBarrier(list[k])) {
-              return true;
-            }
-          }
-          return false;
-        };
-        if (pos.blk === b) {
-          if (gapDirty(b.ops, oi + 1, pos.idx)) {
-            materialize.add(op);
-          }
-          continue;
-        }
-        // Cross-block: a call's execution would become path-dependent — always materialize. A
-        // load may inline only if NO write exists on any DEF-AVOIDING def→render path (a path
-        // re-crossing the def is the next dynamic instance): the def block's tail, the render
-        // block's head, and every block between; a render block cyclic WITHOUT passing the def
-        // (an inner loop around the render) is checked in full.
-        if (isCall) {
+        // A CROSS-BLOCK call's execution would become path-dependent — always materialize. Within
+        // its own block a call is judged like everything else, by the barrier scan below.
+        if (isCall && pos.blk !== b) {
           materialize.add(op);
           continue;
         }
-        let dirty = gapDirty(b.ops, oi + 1, b.ops.length) || gapDirty(pos.blk.ops, 0, pos.idx);
-        if (!dirty) {
-          for (const x of reachAvoiding(b, b)) {
-            if (x === pos.blk && !reachAvoiding(pos.blk, b).has(pos.blk)) {
-              continue;
-            } // acyclic render block: head checked
-            if (x !== pos.blk && !reachAvoiding(x, b).has(pos.blk)) {
-              continue;
-            } // not on a def→render path
-            if (gapDirty(x.ops, 0, x.ops.length)) {
-              dirty = true;
-              break;
-            }
-          }
-        }
-        if (dirty) {
+        // Otherwise: inline only if no barrier stands on any def-avoiding def→render path.
+        if (memWriteBetween(op, pos, isBarrier)) {
           materialize.add(op);
         }
       }
     }
   }
-  return { useSitesOf, opIndex, opBlock, liveIn, materialize, reachFrom };
+  return { useSitesOf, opIndex, opBlock, liveIn, materialize, reachFrom, emitPos, memWriteBetween };
 }