@asmlift/core 0.4.0 → 0.5.0

package/src/ir/alias.ts

@@ -0,0 +1,75 @@
+// asmlift — memory DISJOINTNESS: the one place that answers "could this write change what that
+// read sees". A pure query over L2 (typed SSA); no structuring or emission state.
+//
+// It exists because the answer was being given at three different strengths in three places, the
+// weakest one governing the most common case (the materialization model's multi-render load rule,
+// which barred on ANY write). A read that is barred by a store to an unrelated global is spelled
+// as a named local the source never had — the "value home" defect the round-5 dogfood measured as
+// its single highest cost. One predicate, one strength, one place to sharpen.
+//
+// The rule is deliberately NAME-based and deliberately narrow:
+//
+//   • two DIFFERENT named globals are different objects, so a store through one can never change
+//     what a read of the other sees. That is a C guarantee about distinct declared objects, not a
+//     heuristic about what the compiler happened to do.
+//   • name comparison suffices because the pool promotion picks ONE canonical name per address,
+//     so a single cell cannot appear under two names within one function (frontend/thumb.ts).
+//   • anything that does not resolve to a name — a materialized base, a variable index, a pointer
+//     parameter — is unknown, and unknown BARS. A call or an `opaque` bars unconditionally: it may
+//     write anything.
+//
+// Being conservative here costs at most a match (an extra local the compiler would have folded);
+// being wrong here is a silently wrong read. Every relaxation must keep that asymmetry.
+import { type Op, type Value } from './core';
+
+/** A byte cell of a named global: the symbol plus the byte offset within it. */
+export interface GlobalCell {
+  name: string;
+  byte: number;
+}
+
+/**
+ * The named global cell an address value denotes, resolved through defs alone — `gaddr`, or
+ * `gaddr + const` in either operand order — plus the access's own `off`. Null when the address
+ * does not reduce to a name (a materialized base, a runtime index, a pointer): the caller must
+ * then treat it as unknown memory.
+ */
+export function globalCellOf(defs: Map<Value, Op>, addr: Value, off: number): GlobalCell | null {
+  const d = defs.get(addr);
+  if (d?.opcode === 'gaddr') {
+    return { name: d.attrs.sym as string, byte: off };
+  }
+  if (d?.opcode === 'add' && d.operands.length === 2) {
+    for (const [x, y] of [
+      [d.operands[0], d.operands[1]],
+      [d.operands[1], d.operands[0]],
+    ] as const) {
+      const g = defs.get(x);
+      const c = defs.get(y);
+      if (g?.opcode === 'gaddr' && c?.opcode === 'const') {
+        return { name: g.attrs.sym as string, byte: (c.attrs.value as number) + off };
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * "May op `x` write the global named `sym`?" — the predicate a read of `sym` must clear on every
+ * path between its def and each of its render positions (analysis.ts `memWriteBetween`).
+ *
+ * Calls and opaques always may. A store/astore may unless its base resolves to a DIFFERENT named
+ * global. Everything else (pure arithmetic, loads) never writes.
+ */
+export function mayWriteGlobal(defs: Map<Value, Op>, sym: string): (x: Op) => boolean {
+  return (x: Op): boolean => {
+    if (x.opcode === 'call' || x.opcode === 'opaque') {
+      return true;
+    }
+    if (x.opcode !== 'store' && x.opcode !== 'astore') {
+      return false;
+    }
+    const t = globalCellOf(defs, x.operands[0], 0);
+    return !(t && t.name !== sym);
+  };
+}

package/src/ir/opcodes.ts

@@ -108,8 +108,21 @@ export const OPCODES = {
   //   - an indexed or non-zero-offset AGGREGATE access → the address-cast `((T *)&gSym)[i]`;
   //   - any other use (e.g. `&gSym` passed to a call) → the `{k:'addr'}` L3 node, printed `&gSym`.
   gaddr: { operands: 0, results: 1, requiredAttrs: ['sym'] },
+  // The address of a FRAME-LOCAL object — gaddr's local twin, for the address-taken stack local
+  // (`mov rD, sp` feeding a DMA register or a callee). `off` is the byte offset inside the frame's
+  // reserved local area; the Thumb frontend's post-lift audit stamps `name`/`width`/`signed` after
+  // proving every access agrees, and the structurer declares the local and renders `&name` exactly
+  // as it renders a gaddr's `&sym`. Operand-free and pure, so GVN numbers it like gaddr and a dead
+  // one is reaped.
+  // `width`/`signed` are stamped by the frontend's frame-object AUDIT — requiring them makes
+  // "the audit ran" a verifier-checkable fact instead of a convention: a frontend that emits a
+  // laddr and skips the audit fails verify loudly instead of rendering `&undefined`.
+  laddr: { operands: 0, results: 1, requiredAttrs: ['off', 'width', 'signed'] },
   // --- black-box escape hatch (keeps lifting total) ---
-  opaque: { operands: 'variadic', results: 1 },
+  // `effects: true`: an instruction asmlift could not model may do anything — write memory, trap,
+  // touch a system register — and `results[0]` is only the part we can name. So a dead `opaque` is
+  // no more reapable than a dead `call`.
+  opaque: { operands: 'variadic', results: 1, effects: true },
   // --- terminators ---
   ret: { operands: 'variadic', results: 0, terminator: true, successors: 0 },
   br: { operands: 0, results: 0, terminator: true, successors: 1 },
@@ -162,25 +175,22 @@ export const NEGATED_ICMP: Readonly<Record<string, Opcode>> = Object.fromEntries
   ]),
 );
 
-/** Ops with an observable side effect — the derived view raise/shortcircuit.ts consumes. */
+/** Ops with an observable side effect: the flag on the signature, derived rather than re-listed.
+ *  Consumed by `isDceSafe`, by `HOIST_UNSAFE_OPS` below, and by structure.ts's `sideEffects` walk
+ *  (an effectful op whose result nobody reads is still an execution). */
 export const EFFECTFUL_OPS: ReadonlySet<string> = new Set(
   (Object.keys(OPCODES) as Opcode[]).filter((k) => (OPCODES[k] as OpSig).effects),
 );
 
-/** Ops that may not be REORDERED across other code — `EFFECTFUL_OPS` plus `opaque`.
- *
- *  `effects` is overloaded on two axes, and `opaque` is exactly the op that separates them: a dead
- *  `opaque` MUST stay deletable (`isDceSafe` below says so deliberately — giving it `effects: true`
- *  would strand dead opaques after every pattern rewrite, and they would surface as ASMLIFT_ERROR
- *  gaps in functions that emit cleanly today), while a LIVE one is an instruction asmlift could not
- *  model and must not be moved past anything. So "deletable when dead" and "movable when live" are
- *  different questions and get different views, both derived here rather than re-spelled per
- *  consumer — structure/analysis.ts and structure/structure.ts each carry their own inline copy of
- *  this membership, which is how the two models drifted apart in the first place. */
-export const HOIST_UNSAFE_OPS: ReadonlySet<string> = new Set([...EFFECTFUL_OPS, 'opaque']);
+/** Ops that may not be REORDERED across other code. Identical to `EFFECTFUL_OPS` — one flag answers
+ *  both "deletable when dead" and "movable when live" — and kept as its own name because the call
+ *  sites ask the reordering question. Derived here rather than re-spelled per consumer:
+ *  structure/analysis.ts and structure/structure.ts each carry their own inline copy of this
+ *  membership, which is how the two models drifted apart in the first place. */
+export const HOIST_UNSAFE_OPS: ReadonlySet<string> = EFFECTFUL_OPS;
 
 /** May a dead result of this opcode be deleted? Registered, no observable effects, not control
- *  flow. Deliberately includes `opaque` — a dead opaque vanishing is designed behavior. */
+ *  flow. `opaque` is excluded via its `effects` flag — see the note on its signature. */
 export function isDceSafe(opcode: string): boolean {
   const sig = opSig(opcode);
   return !!sig && !sig.effects && !sig.terminator;

package/src/l3/argbase.ts

@@ -42,7 +42,12 @@ import type { Expr, SFn, Stmt } from './ast';
 import { mapExprChildren, stmtExprs } from './ast';
 import { nameAllocator } from './hoist';
 
-/** A base this pass may evaluate early: pure, and not something a store can change under us. */
+/** A base this pass may evaluate early: pure, and not something a store can change under us.
+ *
+ *  NO shadowing filter, unlike scopebase.ts's `isLeaf`, and the asymmetry is deliberate: that pass
+ *  re-spells the base as `&g`, which under a shadowing local names a different object, while this
+ *  one keeps the base expression verbatim and places the assignment immediately before the same
+ *  statement. Adding the filter here only loses hoists (test/addr-placement.test.ts). */
 function eligibleBase(base: Expr, globals: ReadonlySet<string>): boolean {
   return base.k === 'addr' || base.k === 'const' || (base.k === 'var' && globals.has(base.name));
 }

package/src/l3/ast.ts

@@ -153,7 +153,7 @@ export interface SwitchCase {
 export interface SFn {
   name: string;
   params: { name: string; type: IrType }[];
-  locals: { name: string; type: IrType }[]; // recovered locals, declared at function top
+  locals: { name: string; type: IrType; volatile?: true }[]; // recovered locals, declared at function top
   /** project globals referenced with a known declaration shape (symbol map) — typed for the
    *  legalization env (exprCType) but NEVER declared by a backend: the project's own headers
    *  declare them, exactly like every other global name asmlift emits. */
@@ -271,6 +271,14 @@ export function exprEquals(a: Expr, b: Expr): boolean {
 // recognizeForLoops) rightly keep their own switches.
 
 /** The direct sub-expressions of `e`, in syntactic order. */
+/** THE spelling of an unmodelled instruction's gap reason, in one place: `structure.ts` writes it
+ *  into the marker, `contracts.ts` matches on it to prove the gap was not dropped, and the benchmark
+ *  classifies declines by it. Two spellings make that contract silently vacuous — enforced-looking
+ *  and never firing. `?` when a frontend stamps no mnemonic. */
+export function gapReasonFor(mnemonic: unknown): string {
+  return `unmodelled instruction '${typeof mnemonic === 'string' ? mnemonic : '?'}'`;
+}
+
 export function exprChildren(e: Expr): Expr[] {
   switch (e.k) {
     case 'var':

package/src/l3/basecse.ts

@@ -21,12 +21,16 @@
 import { type IrType, T, scalarTypeForAccess } from '../ir/types';
 import type { Expr, SFn, Stmt } from './ast';
 import { mapExprChildren, stmtChildren, stmtExprs } from './ast';
+import { type Gate, firstRejection } from './gates';
 import { nameAllocator } from './hoist';
 
 // A HOISTABLE base is a bare `addr` (a global address) or a bare `const` (a numeric pointer
 // address). Both are relocation-invariant leaves whose value the compiler keeps in one register
 // when it indexes them at 2+ sites. Anything else (a local var, a struct-element `p[a0]`, arbitrary
-// arithmetic) is NOT — agbcc may re-derive it.
+// arithmetic) is NOT — agbcc may re-derive it. Admitting the bare `var` that scopebase.ts and
+// argbase.ts take is the obvious consolidation and it is wrong twice over: this pass has no `lead`
+// handling, so a rank-aware `g[0][i]` comes out as `p[0][i]` through a scalar pointer, and it
+// undoes raise/gvn.ts's hoist on exactly the rows a symbol map serves (test/addr-placement.test.ts).
 type HoistableBase = Extract<Expr, { k: 'addr' } | { k: 'const' }>;
 const isHoistableBase = (e: Expr): e is HoistableBase => e.k === 'addr' || e.k === 'const';
 const baseId = (b: HoistableBase): string => (b.k === 'addr' ? `a:${b.name}` : `c:${b.value}`);
@@ -40,12 +44,11 @@ interface Collected {
   meta: Map<string, { base: HoistableBase; width: number; signed: boolean }>;
   /** keys with ANY use inside a loop — disqualified (see the loop note in `hoistReusedGlobalBases`). */
   inLoop: Set<string>;
-  /** per key, how many times each CONSTANT offset was accessed. A constant offset touched 2+ times
-   *  is a SCALAR access at one fixed location (a `*(T*)C |= x` MMIO read-modify-write, or repeated
-   *  `*p`), which the compiler re-materializes rather than register-holds — hoisting it MISMATCHES
-   *  (it broke the ProcessHBlankWait match). A key with ANY repeated constant offset is therefore
-   *  disqualified, even if it ALSO has distinct-offset uses (a mixed scalar+array base). A genuine
-   *  reused array base touches each constant offset once, or uses a variable index (not tallied). */
+  /** per key, how many times each CONSTANT offset was accessed — the input to the
+   *  `repeated-const-offset` gate, which losing the ProcessHBlankWait match is what bought. A
+   *  genuine reused array base touches each constant offset once, or indexes by a variable (not
+   *  tallied); a repeat means a scalar re-access, and ONE is enough to disqualify the base even
+   *  when it also has distinct-offset uses. */
   constOffCount: Map<string, Map<number, number>>;
 }
 
@@ -136,27 +139,57 @@ function rewriteStmt(s: Stmt, localFor: Map<string, string>): Stmt {
   }
 }
 
+/** One base under consideration, keyed as `(base, width, signedness)`. */
+export interface BaseKey {
+  key: string;
+  uses: number;
+  inLoop: boolean;
+  /** some CONSTANT offset through this base is touched 2+ times */
+  repeatedConstOffset: boolean;
+}
+
+/** The admission rules. NONE is sound, and that is a property of the pass rather than an oversight:
+ *  a wrong hoist emits the same address held in a different place, so it costs bytes and a match,
+ *  never meaning. The zero-lost benchmark gate is what referees them.
+ *
+ *  The `loop` rule is the subtle one. A loop-body base is loop-invariant, so the compiler keeps it
+ *  in a register across the loop too — but hoisting to the FUNCTION TOP forces a callee-saved
+ *  register, which can add the prologue push/pop the original avoided. `l3/scopebase.ts` is the
+ *  scope-aware hoist that serves those instead. */
+export const BASECSE_GATES: readonly Gate<BaseKey>[] = [
+  {
+    id: 'single-use',
+    why: 'one access re-materializes as cheaply as a named local',
+    sound: false,
+    rejects: (c) => c.uses < 2,
+  },
+  {
+    id: 'loop',
+    why: 'a function-top hoist of a loop base forces a callee-saved register the original avoided',
+    sound: false,
+    rejects: (c) => c.inLoop,
+  },
+  {
+    id: 'repeated-const-offset',
+    why: 'a fixed offset touched twice is a scalar RMW, which the compiler re-materializes',
+    sound: false,
+    rejects: (c) => c.repeatedConstOffset,
+  },
+];
+
 export function hoistReusedGlobalBases(sfn: SFn): SFn {
   const c: Collected = { count: new Map(), order: [], meta: new Map(), inLoop: new Set(), constOffCount: new Map() };
   collect(sfn.body, c, false);
-  // A repeated CONSTANT offset means a scalar re-access at a fixed location (MMIO RMW / repeated
-  // `*p`) the compiler re-materializes — disqualify the whole base, even mixed with array uses.
-  const hasRepeatedConstOffset = (k: string): boolean => {
-    for (const n of c.constOffCount.get(k)?.values() ?? []) {
-      if (n >= 2) {
-        return true;
-      }
-    }
-    return false;
-  };
-
-  // Reuse 2+ and NOT used inside a loop. A loop-body base is loop-invariant, so the compiler ALSO
-  // keeps it in a register across the loop — but hoisting it to the function top forces a
-  // callee-saved register that can add prologue push/pop the original avoided, worsening the match
-  // (register-pressure matching, not a correctness issue). Straight-line / branch reuse is the safe
-  // win; a loop-body base is left inline for a future scope-aware hoist.
   const { count, order, meta } = c;
-  const hoisted = order.filter((k) => (count.get(k) ?? 0) >= 2 && !c.inLoop.has(k) && !hasRepeatedConstOffset(k));
+  const hoisted = order.filter(
+    (k) =>
+      firstRejection(BASECSE_GATES, {
+        key: k,
+        uses: count.get(k) ?? 0,
+        inLoop: c.inLoop.has(k),
+        repeatedConstOffset: [...(c.constOffCount.get(k)?.values() ?? [])].some((n) => n >= 2),
+      }) === null,
+  );
   if (hoisted.length === 0) {
     return sfn;
   }

package/src/l3/coalesce.ts

@@ -1,6 +1,7 @@
 import { typeToString } from '../ir/types';
 import type { Expr, SFn, Stmt } from './ast';
 import { exprChildren, mapExprChildren, stmtChildren, stmtExprs } from './ast';
+import { type Gate, firstRejection } from './gates';
 
 function namesIn(e: Expr, out: Set<string>): void {
   // `addr` names a GLOBAL, never a local — collected anyway. A name reaching BOTH forms would
@@ -17,7 +18,7 @@ function mentions(e: Expr, n: string): boolean {
   namesIn(e, seen);
   return seen.has(n);
 }
-interface Span {
+export interface Span {
   first: number;
   last: number;
   inLoop: boolean;
@@ -78,69 +79,137 @@ function rename(body: Stmt[], from: string, to: string): Stmt[] {
   };
   return body.map(inStmt);
 }
+/** One candidate merge under consideration: absorb `a` into `b`. */
+export interface MergePair {
+  a: string;
+  b: string;
+  /** `a`'s span */
+  x: Span;
+  /** `b`'s span — the SURVIVOR's, which is why the asymmetric gates read `y` */
+  y: Span;
+  sameType: boolean;
+  eitherIsParam: boolean;
+}
+
+/** The admission rules, in evaluation order. Two arguments the `why` fields have no room for:
+ *
+ *  WHAT `loop` BUYS is the right to read preorder statement order as liveness. Preorder is a
+ *  topological order of the CFG except where a later-indexed statement can run before an earlier
+ *  one, and every position that does that — a `for`'s `init`/`inc`, any loop body — is inside a
+ *  loop. A loop's own CONDITION is not covered: it is visited at the loop statement's own index with
+ *  the ENCLOSING flag, which is safe only because a condition cannot WRITE.
+ *
+ *  ABLATE `first-is-write` ALONE AND NOTHING HAPPENS — `const-fed` masks it, so a survivor first
+ *  mentioned by a read was uninitialized there in the original too. Drop both to see what it does,
+ *  which is to bound the accepted class below by an order of magnitude. `const-fed` likewise bounds
+ *  candidate growth: merges go as `L(L-1)/2` in the local count, each a distinct compile. */
+export const COALESCE_GATES: readonly Gate<MergePair>[] = [
+  {
+    id: 'param',
+    why: 'a param is the function’s own signature, not a recovered local',
+    sound: false,
+    rejects: (c) => c.eitherIsParam,
+  },
+  {
+    id: 'type',
+    why: 'the survivor keeps its own declared type, so the two must agree',
+    sound: false,
+    rejects: (c) => !c.sameType,
+  },
+  {
+    id: 'loop',
+    why: 'a back edge can run a later statement first, so preorder stops implying disjoint liveness',
+    sound: true,
+    guardedBy: 'coalesce-fuzz.test.ts: dropping it clobbers a defined read',
+    rejects: (c) => c.x.inLoop || c.y.inLoop,
+  },
+  {
+    id: 'const-fed',
+    why: 'a load-fed local is one the compiler had a reason to keep where it was',
+    sound: false,
+    rejects: (c) => !c.x.constFed || !c.y.constFed,
+  },
+  {
+    id: 'overlap',
+    why: 'the ranges must not overlap — the survivor would absorb a value still live',
+    sound: true,
+    guardedBy: 'coalesce.test.ts: OVERLAPPING ranges never merge',
+    rejects: (c) => c.x.last >= c.y.first,
+  },
+  {
+    id: 'first-is-write',
+    why: 'a survivor first MENTIONED by a read would see the absorbed value there',
+    sound: false,
+    rejects: (c) => !c.y.firstIsWrite,
+  },
+];
+
 /** Every legal single merge, each as its own tree — NOT one committed choice.
  *
  *  Which pair a register allocator coalesced is not derivable from the L3 tree, and first-fit gets
- *  it wrong: on kleod:UpdateHUDCounterDisplay the two legal merges score 18 and 40 against a
- *  no-merge baseline of 21, and declaration order picks the 40. `rank.ts` already has the idiom for
- *  exactly this — `/regcopy`'s "the tail choice is allocator-ambiguous, so both are ranked" — so
- *  every candidate is emitted and the differ referees.
- *
- *  GATES:
- *   - a local mentioned inside a loop BODY is excluded. SOUND-critical: it is what makes preorder
- *     statement order a sufficient approximation of liveness. Preorder is a topological order of the
- *     CFG except where a later-indexed statement can run before an earlier one, and the positions
- *     that do that — a `for`'s `init`/`inc`, and everything in any loop body — are inside a loop, so
- *     the gate covers them. A loop's own CONDITION is NOT covered: it is visited at the loop
- *     statement's own index with the ENCLOSING loop flag. That is safe only because a condition
- *     cannot WRITE, so it can extend a read range but never reorder a definition — an earlier
- *     version of this comment claimed the gate covered conditions too, which it does not.
- *     Differential fuzzing supports this: removing the gate produces clobbers immediately, leaving
- *     it on produces none. No such harness is committed, so nothing here re-checks it.
- *   - both must be CONSTANT-fed. A codegen heuristic, not soundness — removing it stayed
- *     clobber-free under the same (uncommitted) fuzz and simply scored worse, because a load-fed
- *     local is one the compiler had a reason to keep where it was. It is also what currently BOUNDS
- *     candidate growth: merges are `L(L-1)/2` in the local count, each a distinct source and so a
- *     distinct compile, and nothing else caps that. Corpus-wide today: 2 rows, 13 kept sources.
- *   - the survivor's first mention must be an ASSIGN THAT DOES NOT ALSO READ IT. `b = g(b)` is a
- *     write and a read in one statement; counting it as a pure write let `g` receive the absorbed
- *     value. These two gates are NOT independent: `constFed` also rejects a self-reading assign
- *     (its value is not a literal), so it masks this one. No committed test isolates it — this is
- *     defence-in-depth for the day `constFed` is relaxed, which the note above makes plausible.
+ *  it wrong. Run kleod:UpdateHUDCounterDisplay's published repro script (results.json carries it)
+ *  and read the candidate table: of its two legal merges, one scores WORSE than not merging at all
+ *  and declaration order is the one that picks it. Emitting no merges at all costs that row its
+ *  match, which is what guards this file. `rank.ts` already has the idiom for exactly this —
+ *  `/regcopy`'s "the tail choice is allocator-ambiguous, so both are ranked" — so every candidate is
+ *  emitted and the differ referees.
  *
  *  ACCEPTED, NOT FIXED: a survivor assigned only on SOME paths still absorbs the other's value on
  *  the paths that skip it. The original read an uninitialized local there, so both spellings are
- *  ill-defined rather than one being wrong — but this is a real difference and the differ, not this
- *  gate, is what keeps it from faking a match. */
+ *  ill-defined rather than one being wrong — but this is a real difference and the differ, not any
+ *  gate, is what keeps it from faking a match. The fuzz asserts it stays reachable, so the carve-out
+ *  that excuses it cannot quietly become dead. */
 export function coalesceCandidates(sfn: SFn): { merged: string; sfn: SFn }[] {
+  return coalesceUnder(COALESCE_GATES, sfn).candidates;
+}
+
+/** `coalesceCandidates` with the gate table supplied, plus which gate refused each pair.
+ *
+ *  The parameter exists so a test can run the pass with one gate DROPPED — the ablation as a value,
+ *  rather than as a flag compiled into the shipped path or an input rewritten to dodge a predicate.
+ *  `refusals` is what makes a gate's reachability checkable: a rule nothing ever reaches is a rule
+ *  no test can be failing on purpose. */
+export function coalesceUnder(
+  gates: readonly Gate<MergePair>[],
+  sfn: SFn,
+): { candidates: { merged: string; sfn: SFn }[]; refusals: Map<string, number> } {
+  const refusals = new Map<string, number>();
   if (sfn.locals.length < 2) {
-    return [];
+    return { candidates: [], refusals };
   }
   const params = new Set(sfn.params.map((p) => p.name));
   const typeOf = new Map(sfn.locals.map((l) => [l.name, typeToString(l.type)]));
   const sp = spans(sfn.body);
-  const out: { merged: string; sfn: SFn }[] = [];
+  const candidates: { merged: string; sfn: SFn }[] = [];
   for (const a of sfn.locals.map((l) => l.name)) {
     for (const b of sfn.locals.map((l) => l.name)) {
       const x = sp.get(a);
       const y = sp.get(b);
-      if (a === b || !x || !y || params.has(a) || params.has(b)) {
-        continue;
-      }
-      if (typeOf.get(a) !== typeOf.get(b) || x.inLoop || y.inLoop || !x.constFed || !y.constFed) {
+      // Not a gate: this is what makes the pair a pair at all. A name with no span is one the body
+      // never mentions, so there is no range to reason about.
+      if (a === b || !x || !y) {
         continue;
       }
-      if (x.last >= y.first || !y.firstIsWrite) {
+      const refused = firstRejection(gates, {
+        a,
+        b,
+        x,
+        y,
+        sameType: typeOf.get(a) === typeOf.get(b),
+        eitherIsParam: params.has(a) || params.has(b),
+      });
+      if (refused !== null) {
+        refusals.set(refused, (refusals.get(refused) ?? 0) + 1);
         continue;
       }
       // Labelled by the PAIR, not by an index into enumeration order: an index silently re-points
       // at a different merge if `sfn.locals` ordering ever changes, leaving a recorded provenance
       // that is wrong but plausible.
-      out.push({
+      candidates.push({
         merged: `${a}-${b}`,
         sfn: { ...sfn, body: rename(sfn.body, a, b), locals: sfn.locals.filter((l) => l.name !== a) },
       });
     }
   }
-  return out;
+  return { candidates, refusals };
 }

package/src/l3/dce.ts

@@ -15,8 +15,11 @@
 // read as live throughout), so a removal only happens when the local is provably dead. Only
 // names in `locals` are eligible — globals (side effects, referenced by name from headers) and
 // params are never touched — and a value carrying a side effect / gap signal / memory load is
-// never dropped (see `mustKeep`). Locals are never address-taken in L3 (`addr` names a global),
-// so `var` reads are a COMPLETE account of a local's uses.
+// never dropped (see `mustKeep`). An `addr` node can now name a LOCAL as well as a global (the
+// frame-local object a Thumb `laddr` declares — structure.ts), and an address-taken local's stores
+// are observable through the escaped pointer whether or not any `var` read follows — so an `addr`
+// name counts as a READ below, which pins the local and every store to it. For globals that is a
+// no-op (they were never eligible), so the single rule covers both.
 //
 // Ordering: structureChecked runs `assertResolved` BEFORE this pass, so in strict mode an
 // unresolved `?` value trips the contract first and never reaches DCE; `mustKeep` treating `?` as
@@ -25,9 +28,10 @@ import type { Expr, SFn, Stmt } from './ast';
 import { exprChildren, negateCond, stmtChildren, stmtExprs } from './ast';
 
 /** Accumulate every LOCAL-eligible `var` name read anywhere in `e` (recurses all sub-exprs). An
- *  `addr` node names a global, not a local, so it is not a local read. */
+ *  `addr` name counts too: taking a local's address makes every store to it observable through the
+ *  escaped pointer, so an address-taken local is never dead here. */
 function readsInto(e: Expr, out: Set<string>): void {
-  if (e.k === 'var') {
+  if (e.k === 'var' || e.k === 'addr') {
     out.add(e.name);
   }
   for (const c of exprChildren(e)) {
@@ -48,15 +52,17 @@ function reads(e: Expr): Set<string> {
  *     value asmlift could NOT lift slip past `assertResolved`, silently downgrading a loud gap;
  *   - a memory load (`index`/`field`) — asmlift models no `volatile`, so a possibly-effectful read
  *     is never deleted (this pass never removes a memory access).
+ *   - a read of a VOLATILE local (the frame object whose address escaped) — a volatile read is an
+ *     observable access the machine performed; deleting the dead assignment would delete the read.
  *  A dead assignment whose value contains any of these is kept. */
-function mustKeep(e: Expr): boolean {
+function mustKeep(e: Expr, volatiles: ReadonlySet<string> = new Set()): boolean {
   if (e.k === 'call' || e.k === 'marker' || e.k === 'index' || e.k === 'field') {
     return true;
   }
-  if (e.k === 'var' && e.name === '?') {
+  if (e.k === 'var' && (e.name === '?' || volatiles.has(e.name))) {
     return true;
   }
-  return exprChildren(e).some(mustKeep);
+  return exprChildren(e).some((c) => mustKeep(c, volatiles));
 }
 
 /** Every local read anywhere within these statements (exprs + nested statements). Used to give
@@ -76,6 +82,7 @@ function dceBlock(
   stmts: Stmt[],
   liveOut: ReadonlySet<string>,
   locals: ReadonlySet<string>,
+  volatiles: ReadonlySet<string> = new Set(),
 ): { out: Stmt[]; liveIn: Set<string> } {
   const live = new Set(liveOut);
   const rev: Stmt[] = [];
@@ -89,7 +96,7 @@ function dceBlock(
     const s = stmts[i];
     switch (s.k) {
       case 'assign': {
-        if (locals.has(s.name) && !live.has(s.name) && !mustKeep(s.value)) {
+        if (locals.has(s.name) && !live.has(s.name) && !mustKeep(s.value, volatiles)) {
           continue; // dead local store — drop it; liveness is unchanged (it was a no-op)
         }
         live.delete(s.name); // the write kills the name for statements before it …
@@ -131,8 +138,8 @@ function dceBlock(
         break;
       }
       case 'if': {
-        const t = dceBlock(s.then, live, locals);
-        const e = dceBlock(s.else, live, locals);
+        const t = dceBlock(s.then, live, locals, volatiles);
+        const e = dceBlock(s.else, live, locals, volatiles);
         const nlive = new Set<string>();
         for (const r of reads(s.cond)) {
           nlive.add(r);
@@ -146,7 +153,7 @@ function dceBlock(
         setLive(nlive);
         if (t.out.length === 0 && e.out.length === 0) {
           // both arms empty: keep only if the condition itself has a side effect
-          if (mustKeep(s.cond)) {
+          if (mustKeep(s.cond, volatiles)) {
             rev.push({ k: 'exprstmt', value: s.cond });
           }
         } else if (t.out.length === 0) {
@@ -162,7 +169,7 @@ function dceBlock(
         // loop-carried store is never cut. Body DCE removes only what is dead on EVERY path.
         const loopLive = new Set(live);
         allReadsInto([s], loopLive);
-        const b = dceBlock(s.body, loopLive, locals);
+        const b = dceBlock(s.body, loopLive, locals, volatiles);
         const nlive = new Set(loopLive);
         for (const r of b.liveIn) {
           nlive.add(r);
@@ -174,7 +181,7 @@ function dceBlock(
       case 'for': {
         const loopLive = new Set(live);
         allReadsInto([s], loopLive);
-        const b = dceBlock(s.body, loopLive, locals);
+        const b = dceBlock(s.body, loopLive, locals, volatiles);
         const nlive = new Set(loopLive);
         for (const r of b.liveIn) {
           nlive.add(r);
@@ -188,8 +195,8 @@ function dceBlock(
         // read anywhere in the switch as live throughout — no case-body store is ever cut.
         const swLive = new Set(live);
         allReadsInto([s], swLive);
-        const cases = s.cases.map((c) => ({ ...c, body: dceBlock(c.body, swLive, locals).out }));
-        const def = s.default ? dceBlock(s.default, swLive, locals).out : s.default;
+        const cases = s.cases.map((c) => ({ ...c, body: dceBlock(c.body, swLive, locals, volatiles).out }));
+        const def = s.default ? dceBlock(s.default, swLive, locals, volatiles).out : s.default;
         const nlive = new Set(swLive);
         for (const r of reads(s.scrutinee)) {
           nlive.add(r);
@@ -227,9 +234,15 @@ function referencedNames(stmts: Stmt[], out: Set<string>): void {
 /** Remove dead local stores and simplify the branches they empty out, then drop any local
  *  declaration left unreferenced. Returns a new SFn; the input is not mutated. */
 export function eliminateDeadStores(sfn: SFn): SFn {
-  const locals = new Set(sfn.locals.map((l) => l.name));
-  const body = dceBlock(sfn.body, new Set<string>(), locals).out;
+  // A VOLATILE local is never eligible: its stores are observable through the escaped address (the
+  // DMA hardware reads them) wherever they sit. The `addr`-as-read pin alone only protected stores
+  // UPSTREAM of an `&sp0` occurrence in this backward walk — the legal publish-address-then-fill
+  // ordering (`*dmaReg = &sp0;` THEN `sp0 = v;`) had its store deleted by this very pass, defeating
+  // the volatile the frontend added precisely so the RECOMPILER would not delete it.
+  const volatiles = new Set(sfn.locals.filter((l) => l.volatile).map((l) => l.name));
+  const locals = new Set(sfn.locals.filter((l) => !l.volatile).map((l) => l.name));
+  const body = dceBlock(sfn.body, new Set<string>(), locals, volatiles).out;
   const used = new Set<string>();
   referencedNames(body, used);
-  return { ...sfn, body, locals: sfn.locals.filter((l) => used.has(l.name)) };
+  return { ...sfn, body, locals: sfn.locals.filter((l) => used.has(l.name) || l.volatile) };
 }