@asmlift/core 0.3.0 → 0.5.0

package/src/raise/divpow2.ts

@@ -0,0 +1,227 @@
+// asmlift — signed division by a power of two, in its BRANCHING form.
+//
+// `x / 2^k` must round toward zero, but an arithmetic right shift rounds toward minus infinity, so a
+// compiler biases the dividend by `2^k - 1` when it is negative. Two lowerings exist, and asmlift
+// already folded one of them: the branchless `(x + (x >>u 31)) >> 1` that agbcc and GCC emit for
+// `/2` is the SDIV_POW2_2 idiom pattern (pattern/engine.ts). The other is a BRANCH — what IDO emits,
+// and what GCC emits for larger k:
+//
+//	bgez	a0, .L2          ; skip the bias when x >= 0
+//	addiu	at, a0, 1        ; bias = 2^k - 1
+//     .L2:	sra	v0, at, 1        ; >> k
+//
+// That is a CFG diamond, not an instruction window, so the patterns-as-data idiom layer cannot state
+// it — its match DAG is over the def-graph inside a block. It earns a pre-recovery pass for the same
+// reason raise/shortcircuit.ts is one: the thing being recognised is a shape in the CONTROL FLOW.
+// (m2c reached the same conclusion from the other side — its `49b5d87` adds a third and fourth
+// instruction-window pattern for the GCC spellings, and the commit notes GCC reorders the final
+// `sra` and defeats the window. Matching the value graph instead is immune to that.)
+//
+// Both spellings of the merge appear in the corpus and both are recognised here:
+//
+//   SUNK    the shift is after the merge — phi(x, x + 2^k-1) feeding `shr_s(phi, k)`
+//   SPLIT   the shift is duplicated into both arms — phi(shr_s(x, k), shr_s(x + 2^k-1, k)),
+//           which is what a delay-slot fill produces (the `sra` runs on both paths)
+//
+// The identity is arithmetic — for signed x, `(x < 0 ? x + 2^k-1 : x) >> k` is exactly `x / 2^k`
+// under C's truncating division — but by this project's taxonomy that is NOT on its own a licence
+// to run ungated: the compiler-pinned idiom patterns are gated precisely because they trade one
+// spelling for another and are byte-safe only where measured, and this pass does trade a spelling.
+// What carries it is raise/magicdiv.ts's argument, which applies here unchanged: the round-trip is
+// SELF-VERIFYING. asmlift emits a plain `x / 2^k` and the target compiler regenerates ITS own
+// lowering; a wrong divisor recompiles to different bytes and shows up as a nonmatch, never as a
+// false match. The residual exposure is a lost match, not a miscompile — on a compiler that lowers
+// `/2^k` branchlessly, a diamond of this shape came from hand-written biasing, and respelling it
+// costs a match that used to land. Measured positive on ido7.1 (two flips), agbcc and gcc2.7.2kmc
+// (modpow2 stays byte-exact through the respelling); mwcc_242_81 and gcc2.7.2 have no inhabitant, so
+// they are unmeasured rather than clean.
+//
+// It is deliberately IDENTITY-OR-DECLINE about the shape (the bias constant must be exactly
+// `2^k - 1` for the SAME k the shift uses, the guard must test the SAME value the arms divide, and
+// the biased arm must be the negative one — the consistency check m2c's `49b5d87` also adds),
+// because every one of those is a way for a superficially similar diamond to mean something else.
+import { Block, Fn, Op, Value, defOpMap, mkOp, mkValue, predecessors, replaceAllUsesWith } from '../ir/core';
+import { HOIST_UNSAFE_OPS } from '../ir/opcodes';
+import { T } from '../ir/types';
+
+/** `shr_s v {imm=k}` → k, else null. */
+function shiftAmount(defs: Map<Value, Op>, v: Value): { k: number; src: Value; op: Op } | null {
+  const d = defs.get(v);
+  if (!d || d.opcode !== 'shr_s' || d.operands.length !== 1 || typeof d.attrs.imm !== 'number') {
+    return null;
+  }
+  return { k: d.attrs.imm, src: d.operands[0], op: d };
+}
+
+/** `add v, const(2^k - 1)` → the addend's base, else null. The add is commutative. */
+function biasedBy(defs: Map<Value, Op>, v: Value, k: number): Value | null {
+  const d = defs.get(v);
+  if (!d || d.opcode !== 'add' || d.operands.length !== 2) {
+    return null;
+  }
+  for (const [a, b] of [
+    [0, 1],
+    [1, 0],
+  ] as const) {
+    const c = defs.get(d.operands[b]);
+    if (c && c.opcode === 'const' && c.attrs.value === 2 ** k - 1) {
+      return d.operands[a];
+    }
+  }
+  return null;
+}
+
+/**
+ * Fold the branching signed-division-by-2^k diamond into `sdiv x {imm=2^k}`. Returns true if the IR
+ * changed. Leaves the now-dead bias/shift ops behind for the driver's DCE.
+ */
+export function recognizeDivPow2(fn: Fn): boolean {
+  let changed = false;
+  let progress = true;
+  while (progress) {
+    progress = false;
+    const defs = defOpMap(fn);
+    const preds = predecessors(fn);
+    const term = (b: Block) => b.ops[b.ops.length - 1];
+
+    outer: for (const m of fn.blocks) {
+      // The merge carries exactly the quotient (or the value about to be shifted into it), and is
+      // reached only by the two arms of this diamond — a third predecessor means the phi is a join
+      // of something larger and retiring it would drop that edge's value.
+      //
+      // NEITHER end of the diamond may be the ENTRY block. `predecessors()` walks successor edges
+      // only, so an entry that is also a loop header shows two predecessors while really being a
+      // three-way join — the implicit entry edge is invisible, and the head does not dominate it.
+      // The bias-arm case blows up loudly in the verifier; the MERGE case is silent, because its
+      // params are the FUNCTION'S OWN PARAMETERS and `m.params = []` below would quietly delete one,
+      // handing back a signature with an argument missing. raise/shortcircuit.ts documents the same
+      // trap for its feeder; only half of that guard was copied here at first.
+      if (m.params.length !== 1 || (preds.get(m) ?? []).length !== 2 || m === fn.blocks[0]) {
+        continue;
+      }
+      const p = m.params[0];
+      for (const bias of preds.get(m)!) {
+        // The BIAS arm: sole predecessor is the head, and it does nothing but bias (and possibly
+        // shift). The whole block is DELETED, not hoisted, so anything else in it would be silently
+        // dropped — a store, a call or an opaque there would simply stop happening (an opaque
+        // whether or not its result is read: liveness says nothing about what the instruction did).
+        const bt = term(bias);
+        if (bt.opcode !== 'br' || bt.successors[0]?.block !== m || bias === fn.blocks[0]) {
+          continue;
+        }
+        const bp = preds.get(bias) ?? [];
+        if (bp.length !== 1 || bias.ops.some((op) => HOIST_UNSAFE_OPS.has(op.opcode))) {
+          continue;
+        }
+        const h = bp[0];
+        const ht = term(h);
+        if (ht.opcode !== 'cond_br') {
+          continue;
+        }
+        const [taken, fall] = ht.successors;
+        const direct = taken.block === m ? taken : fall.block === m ? fall : null;
+        if (!direct || (taken.block !== bias && fall.block !== bias)) {
+          continue; // the head's two successors must be exactly {merge, bias arm}
+        }
+        const biasedIsTaken = taken.block === bias;
+
+        // Read the two incoming values and split into the SUNK and SPLIT spellings. `k` and the
+        // dividend come from whichever arm shape matches; both arms must agree on both.
+        const vDirect = direct.args[0];
+        const vBias = bt.successors[0].args[0];
+        if (vDirect === undefined || vBias === undefined) {
+          continue;
+        }
+        // SPLIT is TRIED, not assumed, and a failed attempt falls through to SUNK. The direct arm
+        // being a `shr_s` does not make this the split form — the dividend may simply BE a shifted
+        // value (`(a >> 2) / 4`), and treating that as split-with-a-broken-bias-arm used to abandon
+        // a perfectly good sunk diamond.
+        let split: { k: number; x: Value } | null = null;
+        const splitDirect = shiftAmount(defs, vDirect);
+        if (splitDirect) {
+          const splitBias = shiftAmount(defs, vBias);
+          if (
+            splitBias &&
+            splitBias.k === splitDirect.k &&
+            biasedBy(defs, splitBias.src, splitDirect.k) === splitDirect.src
+          ) {
+            split = { k: splitDirect.k, x: splitDirect.src };
+          }
+        }
+        let k: number, x: Value, sunkShift: Op | null;
+        if (split) {
+          // SPLIT: both arms shift. The direct arm shifts the dividend, the bias arm the biased one.
+          k = split.k;
+          x = split.x;
+          sunkShift = null;
+        } else {
+          // SUNK: the merge value is the (maybe biased) dividend, shifted once after the join. The
+          // phi must feed exactly that shift and NOTHING else — the fold stops computing the
+          // unshifted biased value, so any second consumer would silently read the quotient in its
+          // place. A use is an operand OR a successor argument (block args are uses too, and live in
+          // `successors[].args`, which is why `replaceAllUsesWith` rewrites both) — counting only
+          // operands let a phi that was also passed along an edge through this guard, and the arm's
+          // value then came out as the quotient: `(y >> 2) + y` folded to `(x / 4) + (x / 4)`.
+          const uses = fn.blocks
+            .flatMap((b) => b.ops)
+            .filter((op) => op.operands.includes(p) || op.successors.some((su) => su.args.includes(p)));
+          if (uses.length !== 1 || !uses[0].operands.includes(p)) {
+            continue;
+          }
+          const sunk = shiftAmount(defs, uses[0].results[0]);
+          // The shift must be IN the merge block: the cleanup below removes it from there, so a
+          // shift found elsewhere would be searched for and not cleaned, leaving the two out of step.
+          if (!sunk || sunk.src !== p || !m.ops.includes(sunk.op)) {
+            continue;
+          }
+          k = sunk.k;
+          x = vDirect;
+          if (biasedBy(defs, vBias, k) !== x) {
+            continue;
+          }
+          sunkShift = sunk.op;
+        }
+        if (k < 1 || k > 30) {
+          continue; // 2^k must be a representable positive divisor
+        }
+
+        // The guard must test THE DIVIDEND against zero, and route the biased value to the NEGATIVE
+        // side. `x >= 0` takes the direct arm; `x < 0` takes the bias arm. Anything else — a compare
+        // against another value, a different operand, the arms the other way round — is a diamond
+        // that merely looks like this one.
+        const cond = defs.get(ht.operands[0]);
+        if (!cond || cond.operands.length !== 2 || cond.operands[0] !== x) {
+          continue;
+        }
+        const zero = defs.get(cond.operands[1]);
+        if (!zero || zero.opcode !== 'const' || zero.attrs.value !== 0) {
+          continue;
+        }
+        const takenIsNegative = cond.opcode === 'icmp_slt';
+        if (!takenIsNegative && cond.opcode !== 'icmp_sge') {
+          continue;
+        }
+        if (takenIsNegative !== biasedIsTaken) {
+          continue; // the bias is on the wrong side — this is not a round-toward-zero correction
+        }
+
+        // Rewrite: the head computes the quotient outright and falls straight to the merge; the bias
+        // arm and the phi go away. The dead bias/shift ops are left for the driver's DCE.
+        const q = mkValue(T.s());
+        h.ops.splice(h.ops.length - 1, 0, mkOp('sdiv', { operands: [x], results: [q], attrs: { imm: 2 ** k } }));
+        h.ops[h.ops.length - 1] = mkOp('br', { successors: [{ block: m, args: [] }] });
+        if (sunkShift) {
+          replaceAllUsesWith(fn, sunkShift.results[0], q);
+          m.ops = m.ops.filter((op) => op !== sunkShift);
+        }
+        replaceAllUsesWith(fn, p, q);
+        m.params = [];
+        fn.blocks = fn.blocks.filter((b) => b !== bias);
+        changed = true;
+        progress = true;
+        break outer; // defs/preds are stale after the mutation
+      }
+    }
+  }
+  return changed;
+}

package/src/raise/gvn.ts

@@ -0,0 +1,151 @@
+// asmlift — value numbering for OPERAND-FREE PURE definitions (today: `gaddr`).
+//
+// A compiler materializes a global's address wherever it needs one. Two arms of an `if` that both
+// touch `gTable` each get their own pool load, so the frontend lifts two DISTINCT SSA values that
+// denote the same address, and a merge of those arms gets a block param over them:
+//
+//     ^bb6:  %29 = gaddr {sym="gBgTilemapBufs"}   br ^bb9(%29)
+//     ^bb8:  %43 = gaddr {sym="gBgTilemapBufs"}   br ^bb9(%43)
+//     ^bb9(%45: u16*):  … %45[594] …
+//
+// Nothing downstream can see that `%29` and `%43` are equal, so `%45` is a real phi: the structurer
+// destroys it into a local and every later access reads it. The source it came from had no such
+// variable — it just named the global at each use, and let the compiler decide where to put the
+// address. In emitted C, that is the whole difference:
+//
+//     before:  v5 = (u16 *)&gBgTilemapBufs;   …   v5[594] = v5[659];
+//     after:   gBgTilemapBufs[0][594] = gBgTilemapBufs[0][659];
+//
+// RUNS FIRST in PRE_RECOVERY_PASSES: collapsing addresses removes block params every later
+// recognizer would otherwise have to reason around, and it can only shrink the value graph.
+//
+// SOUNDNESS. `gaddr` takes no operands and reads no memory: its result is a function of its `attrs`
+// alone, so two with equal attrs are equal in every execution, on every path, always. Replacing all
+// of them with ONE definition is exact.
+//
+// THE ADMISSION RULE IS `gaddr`, NOT "operand-free and pure" — and the difference is the whole
+// safety argument, so do not relax it to the general-sounding version. `const` is ALSO operand-free
+// and pure, and numbering consts function-wide would be actively harmful: structure/analysis.ts
+// materializes a multi-use `const` that is live across a call into a named local, and its own
+// comment records that this exact widening ("the small-constant regression") already cost matches
+// once. The gate is a MATCHING policy, not a property of the opcode — which is why it is not a flag
+// on the opcode table, where `const` would satisfy it.
+//
+// PLACEMENT. One fresh definition per class is created in the ENTRY block, which dominates every
+// REACHABLE block — so no reachable use can precede it (unreachable blocks are excluded from the
+// scan for exactly that reason; see `reachable` below) (the originals are deleted rather than moved — a fresh Value
+// keeps the rewrite uniform, including for a duplicate that was already in the entry block). That is safe here precisely because the op is free: `gaddr` lowers to
+// nothing on its own — the structurer inlines a pure non-`const` value at each use site (see
+// analysis.ts, whose materialize-into-a-local rule covers `const`, `call` and the memory reads, NOT
+// address ops), so the address is re-spelled at each access exactly as the original source did.
+// Hoisting therefore does not create the long live range that hoisting a LOADED value would.
+// That is a promise ANOTHER module keeps, so `test/addr-placement.test.ts` holds it to it: let
+// analysis.ts materialize an address op and the entry hoist becomes a function-top local — the one
+// this pass exists to delete, reintroduced one level up.
+//
+// SCOPE, deliberately narrow: `code: true` symbols (a promoted function pointer, spelled `(u32)Name`
+// rather than `&Name`) are numbered separately from data ones, because the attr is part of what the
+// value renders as.
+//
+// THE WIN IS CONTINGENT ON THE SYMBOL MAP, which is worth knowing before relying on it. With a map
+// supplying an array's rank the accesses render as `gSym[0][i]`, a `var` base that
+// `l3/basecse.ts`'s `isHoistableBase` cannot see, so nothing re-creates the local this pass
+// deleted. WITHOUT one the same accesses spell as `addr`, basecse sees the reuse, and it hoists a
+// function-top `p0 = (u16 *)&gBgTilemapBufs` — the same local, one level up. Both arms are pinned
+// in `test/addr-placement.test.ts`; before that they rested on a run nobody could repeat.
+//
+// FOUR modules now answer "is this address a local?" with independent policies — here: never;
+// basecse: at the function top, when reused 2+ times; l3/scopebase.ts: at the innermost scope
+// holding the uses; l3/argbase.ts: immediately before a call whose arguments share it. Reconciling
+// them is recorded debt, and the same test pins the two places they actively disagree, because a
+// consolidation has to PICK rather than discover them: a `for`'s init (basecse reads it at loop
+// cadence and refuses, scopebase at the enclosing one and hoists) and a global name shadowed by a
+// local (scopebase must refuse — it re-spells the base as `&g` — while argbase may fire, because it
+// keeps the base expression verbatim).
+import { Block, Fn, Op, Value, mkOp, replaceAllUsesWith } from '../ir/core';
+
+/** Ops whose result depends on `attrs` alone — no operands, no memory, no control flow. */
+const NUMBERABLE = new Set(['gaddr', 'laddr']); // laddr: same argument — operand-free, pure, attr-keyed
+
+/** The value-number key: the opcode plus every attribute, in a stable order. */
+function keyOf(op: Op): string {
+  const attrs = Object.keys(op.attrs)
+    .sort()
+    .map((k) => `${k}=${String(op.attrs[k])}`)
+    .join(',');
+  return `${op.opcode}(${attrs})`;
+}
+
+/**
+ * Collapse operand-free pure definitions that share a key down to one apiece, defined in the entry
+ * block. Returns the number of definitions removed (0 when nothing changed).
+ */
+export function numberPureValues(fn: Fn): number {
+  // REACHABLE blocks only. The entry dominates everything REACHABLE — it does not dominate an
+  // unreachable block, and verify()'s dominator fixpoint models that faithfully (a block with no
+  // predecessors converges to dom = {itself}). Numbering a group with a member in such a block
+  // deletes its local definition and leaves the use reading one the entry holds, which fails
+  // `def does not dominate use` — turning a fully-decompiled function into an ASMLIFT_ERROR stub.
+  // Loud, not silent, but a real loss: the thumb frontend deliberately KEEPS unreachable blocks
+  // ("Other unreachable blocks are LEFT ALONE"), so this shape is supported, not malformed.
+  const reachable = new Set<Block>();
+  const walk = (b: Block): void => {
+    if (reachable.has(b)) {
+      return;
+    }
+    reachable.add(b);
+    for (const op of b.ops) {
+      for (const s of op.successors) {
+        walk(s.block);
+      }
+    }
+  };
+  if (fn.blocks[0]) {
+    walk(fn.blocks[0]);
+  }
+  const groups = new Map<string, { op: Op; block: number }[]>();
+  fn.blocks.forEach((b, bi) => {
+    if (!reachable.has(b)) {
+      return;
+    }
+    for (const op of b.ops) {
+      if (NUMBERABLE.has(op.opcode) && op.results.length === 1) {
+        const k = keyOf(op);
+        groups.set(k, [...(groups.get(k) ?? []), { op, block: bi }]);
+      }
+    }
+  });
+
+  const entry = fn.blocks[0];
+  let removed = 0;
+  const hoisted: Op[] = [];
+  for (const dups of groups.values()) {
+    if (dups.length < 2) {
+      continue; // nothing to number — a single definition already dominates its own uses
+    }
+    // One fresh definition for the class. A fresh Value (rather than reusing the first duplicate's)
+    // keeps the rewrite uniform: every original result is replaced, including the one in the entry
+    // block, so no path is left reading a definition this pass has moved.
+    const survivor = dups[0].op;
+    const value: Value = { type: survivor.results[0].type };
+    hoisted.push(
+      mkOp(survivor.opcode as Parameters<typeof mkOp>[0], { results: [value], attrs: { ...survivor.attrs } }),
+    );
+    for (const d of dups) {
+      replaceAllUsesWith(fn, d.op.results[0], value);
+      removed++;
+    }
+  }
+  if (hoisted.length === 0) {
+    return 0;
+  }
+  // Drop every numbered definition, then seed the survivors at the entry block's head. Done as a
+  // filter over each block's op list rather than by index, because the replacement above may have
+  // rewritten successor args and left the op lists otherwise untouched.
+  const dead = new Set<Op>([...groups.values()].filter((d) => d.length >= 2).flatMap((d) => d.map((x) => x.op)));
+  for (const b of fn.blocks) {
+    b.ops = b.ops.filter((op) => !dead.has(op));
+  }
+  entry.ops.unshift(...hoisted);
+  return removed;
+}

package/src/raise/pre-recovery.ts

@@ -11,12 +11,15 @@
 // pass that changed the IR is INTRINSIC to the pass (it declares whether it leaves dead ops) and lives
 // in the driver.
 import { Fn } from '../ir/core';
+import { simplifyTrivialPhis } from '../ir/simplify';
 import { dce } from '../pattern/engine';
 import type { TargetDescription } from '../target';
 import { recognizeArrays } from './arrays';
 import { recognizeConsts } from './const';
+import { recognizeDivPow2 } from './divpow2';
+import { numberPureValues } from './gvn';
 import { recognizeMagicDivision } from './magicdiv';
-import { recognizeShortCircuit } from './shortcircuit';
+import { recognizeBranchShortCircuit, recognizeShortCircuit } from './shortcircuit';
 import { recognizeSoftDiv } from './softdiv';
 import { recognizeStructArrays } from './struct-arrays';
 import { recognizeStructs } from './structs';
@@ -33,11 +36,35 @@ export interface PreRecoveryPass {
 }
 
 /** THE ordered pre-recovery pass list — the single source of truth shared by pipeline / rank / report.
- *  const-materialize → magic-division → soft-division → array-legalize → struct-array →
- *  struct-pointer → short-circuit. See each recognizer's file for the rationale. */
+ *  address-numbering → const-materialize → magic-division → pow2-division → soft-division → array-legalize →
+ *  struct-array → struct-pointer → short-circuit → branch-short-circuit. See each recognizer's file
+ *  for the rationale. */
 export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
+  // FIRST: collapsing duplicate address definitions removes block params every later recognizer
+  // would otherwise have to reason around, and it can only shrink the value graph.
+  {
+    id: 'addrnum',
+    // Numbering alone is not enough and not safe to ship alone: collapsing the duplicates leaves a
+    // block param whose edges now all carry one value, and the structurer still destroys THAT into
+    // a local (it only reuses a name a carrier already has, and an inlined `gaddr` has none).
+    // Numbering alone costs kleod:UpdateHUDCounterDisplay its match, so the pair is the atomic
+    // unit, expressed as a body rather than a sum of two unrelated counts. It is NOT monotone,
+    // which is worth knowing before tuning either half: dropping the cleanup IMPROVES
+    // kleod:ConfigureEntityBehavior and kleod:CountCollectedGems, neither of them near matching.
+    run: (fn) => {
+      const n = numberPureValues(fn);
+      return n + simplifyTrivialPhis(fn);
+    },
+    dce: false,
+  },
   { id: 'const', run: recognizeConsts, dce: true },
   { id: 'magicdiv', run: recognizeMagicDivision, dce: true },
+  // Position is NOT load-bearing, unlike its neighbours above and below, and saying so is the point:
+  // no other pass can see this shape. magicdiv matches a `mulh` DAG; both short-circuit folds require
+  // a boolean const arm or a `cond_br`-terminated second block, and this diamond has an `add` arm
+  // ending in `br`. Verified by running it before and after each of them — same result. It sits
+  // beside magicdiv so that a reader looking for division recovery finds both together.
+  { id: 'divpow2', run: recognizeDivPow2, dce: true },
   { id: 'softdiv', run: (fn) => recognizeSoftDiv(fn), dce: false, gate: (t) => !t.capabilities.hwDivide },
   { id: 'arrays', run: recognizeArrays, dce: true },
   // struct-arrays AFTER arrays (scalar stride==width shapes are claimed first — see the
@@ -46,6 +73,15 @@ export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
   { id: 'struct-arrays', run: recognizeStructArrays, dce: true },
   { id: 'structs', run: recognizeStructs, dce: false },
   { id: 'shortcircuit', run: recognizeShortCircuit, dce: true },
+  // The control-flow sibling, and this order IS load-bearing — value form FIRST.
+  //
+  // Their input SHAPES are disjoint (the value form's second block ends in `br` carrying a phi
+  // argument, this one's ends in `cond_br`), so neither can eat the other's literal pattern. But
+  // this pass REWRITES its head's condition into a `logic_or`/`logic_and`, and the value form
+  // refuses any head whose condition is not a negatable icmp — so running this one first can
+  // permanently disqualify a value fold that was available. The reverse cannot happen: the value
+  // form replaces its head's `cond_br` with a `br`, which this pass never matches.
+  { id: 'branch-shortcircuit', run: recognizeBranchShortCircuit, dce: true },
 ];
 
 /** Run the pre-recovery passes in order. For each pass whose gate passes and that CHANGES the IR, run

package/src/raise/recover.ts

@@ -40,8 +40,11 @@ export function recoverTypes(fn: Fn): void {
         op.operands.forEach((o) => setInt(o, false));
         op.results.forEach((r) => setInt(r, false));
       }
-      // A rotate is a bitwise permutation: its value operand and result are unsigned (the C
-      // idiom's `>>` must be the LOGICAL shift or the spelling stops round-tripping). The
+      // A rotate is a bitwise permutation, so its value operand and result are unsigned. This is
+      // now a TYPE fact only: the C idiom's logical shift is stated on the node (structure.ts
+      // spells the idiom with `>>>`, and the C backend supplies whatever cast that needs), so the
+      // spelling no longer depends on this seeding to round-trip. Kept because it is true, and
+      // because it keeps the rotated value from rendering as a signed operand elsewhere. The
       // rotate AMOUNT (operand 1, register form) keeps its own signedness.
       if (op.opcode === 'rotr' || op.opcode === 'rotl') {
         setInt(op.operands[0], false);
@@ -199,14 +202,28 @@ function propagatePointers(fn: Fn): void {
   }
 }
 
-/** The recovered return type = the type of the value returned by the first `ret`. */
+/** The recovered return type: `void` when EVERY `ret` is operand-less, otherwise the type of the
+ *  first value any `ret` carries. */
 export function returnType(fn: Fn): IrType {
+  // VOID needs EVERY exit to agree. A function can have several `ret`s, and a frontend decides
+  // per block whether the return register holds anything — so an operand-less FIRST `ret` beside a
+  // valued second one is a real shape (MIPS/PPC compute it per block). Answering `void` off the
+  // first would declare void over a body the structurer still emits `return expr;` in, which is
+  // ill-formed C and a signature that contradicts its own body.
+  const rets = fn.blocks.map((b) => b.ops[b.ops.length - 1]).filter((t) => t?.opcode === 'ret');
+  if (rets.length > 0 && rets.every((t) => t!.operands.length === 0)) {
+    // NO operand is not "unknown type", it is NO VALUE. Every frontend already says it the same
+    // way: MIPS/PPC emit an operand-less `ret` when the return register has no reaching
+    // definition, and Thumb when the epilogue branches THROUGH that register (`bx r0`, where r0
+    // is the return address and so cannot also be a value). Defaulting to `s32` produced a
+    // non-void signature over a body with no `return` value — C's implicit-int function that
+    // falls off its end — contradicting the project's own prototype and keeping otherwise-dead
+    // computation alive to feed a return that never happens.
+    return T.void();
+  }
   for (const b of fn.blocks) {
     const term = b.ops[b.ops.length - 1];
-    if (term?.opcode === 'ret') {
-      if (term.operands.length === 0) {
-        return T.s(32);
-      }
+    if (term?.opcode === 'ret' && term.operands.length > 0) {
       const v = term.operands[0];
       return v.type.kind === 'unknown' ? T.s(32) : v.type;
     }

package/src/raise/retsink.ts

@@ -21,15 +21,20 @@
 //
 // This does NOT recover the boolean-VALUE form `return a && b` — that is shortcircuit.ts's job
 // (the `logic_and`/`logic_or` connective plus agbcc's `(-b|b)>>31` = `b!=0` normalisation).
-import { Block, Fn, mkOp, predecessors } from '../ir/core';
+import { Block, Fn, defOpMap, mkOp, predecessors } from '../ir/core';
+
+/** The fused short-circuit connectives (raise/shortcircuit.ts). A `cond_br` on one of these is the
+ *  post-fusion record of the ≥2 conditions that used to reach a shared arm. */
+const CONNECTIVES = new Set(['logic_and', 'logic_or']);
 
 /** Tail-duplicate a return-only merge block into its unconditional-branch predecessors, but ONLY in the
- *  short-circuit shape (some branch-pred is shared). Returns whether anything changed. A "return-only"
- *  block is exactly one `ret` whose operands are all its own block-params, so each predecessor already
- *  carries the returned value as a successor arg. */
+ *  short-circuit shape (some branch-pred is shared, or the arms are selected by a fused connective).
+ *  Returns whether anything changed. A "return-only" block is exactly one `ret` whose operands are all
+ *  its own block-params, so each predecessor already carries the returned value as a successor arg. */
 export function sinkReturns(fn: Fn): boolean {
   let changed = false;
   const preds = predecessors(fn);
+  const defs = defOpMap(fn);
   const isBrTo = (p: Block, m: Block) => {
     const t = p.ops[p.ops.length - 1];
     return t.opcode === 'br' && t.successors.length === 1 && t.successors[0].block === m;
@@ -52,9 +57,34 @@ export function sinkReturns(fn: Fn): boolean {
     if (brPreds.length === 0) {
       continue;
     }
-    // SHORT-CIRCUIT GATE: at least one branch-pred must be a shared block (≥2 preds of its own). A simple
-    // single-condition select has only single-pred arms and is left as a merge variable (which matches).
-    if (!brPreds.some((p) => (preds.get(p)?.length ?? 0) >= 2)) {
+    // SHORT-CIRCUIT GATE, in two shapes — the chain must be visible in the CFG or in the value domain.
+    //
+    //   (a) UNFUSED: at least one branch-pred is a shared block (≥2 preds of its own) — the common
+    //       early-exit reached from every condition of the chain.
+    //   (b) FUSED: `branch-shortcircuit` (raise/shortcircuit.ts) rewrites the head's condition into a
+    //       `logic_and`/`logic_or` and collapses the second condition block into it. That leaves both
+    //       arms single-pred, so (a) cannot see the chain any more — but the CONNECTIVE is now the
+    //       record of the ≥2 conditions the shared arm used to be. That pass runs in pre-recovery,
+    //       i.e. BEFORE this one, so on `ifand`/`and3` shape (b) is the only one that ever fires.
+    //
+    //       The connective ALONE is not enough, and the extra requirement is BOTH arms being real
+    //       blocks (≥2 `br` preds). `return a || b` (synthetic:lor:agbcc) also ends up as a
+    //       `cond_br` on a `logic_or`, but it is a value-merge: one edge runs from the head STRAIGHT
+    //       into the merge, so the merge has a single `br` pred. Sinking it replaces the merge
+    //       variable that byte-matches: dropping the `brPreds.length >= 2` half of this gate costs
+    //       that row its match. A two-armed diamond is what
+    //       distinguishes `if (a && b) return X; return Y;` from every value-merge.
+    //
+    // A simple single-condition select is excluded by both arms of the gate for the same reason:
+    // `clamp0`/`sel` reach their merge on the `cond_br` edge itself, so they too have exactly one
+    // `br` pred, and their condition is a bare icmp rather than a connective.
+    const selectedByConnective = (p: Block) =>
+      (preds.get(p) ?? []).some((q) => {
+        const t = q.ops[q.ops.length - 1];
+        return t.opcode === 'cond_br' && CONNECTIVES.has(defs.get(t.operands[0])?.opcode ?? '');
+      });
+    const fusedDiamond = brPreds.length >= 2 && brPreds.some(selectedByConnective);
+    if (!brPreds.some((p) => (preds.get(p)?.length ?? 0) >= 2) && !fusedDiamond) {
       continue;
     }
     for (const p of brPreds) {