@asmlift/core 0.4.0 → 0.6.0

package/src/backend/cpp.ts

@@ -38,6 +38,7 @@ export function cppSymbol(spec: CppFnSpec): string {
 export function cppBackend(spec: CppFnSpec): LanguageBackend {
   return {
     id: 'cpp',
+    spellsSwitchFallthrough: true,
     emit(fn: SFn): string {
       // Map each lifted param var → its C++ meaning: `this` (bare member access) or a named param
       // (a pointer-to-class param uses `->`). A pointer-to-known-class param is a member receiver.

package/src/backend/pascal.ts

@@ -10,7 +10,8 @@
 // Turbo/Delphi/FreePascal.
 import { IrType, typeToString } from '../ir/types';
 import { BinOp, Expr, LanguageBackend, SFn, Stmt } from '../l3/ast';
-import { type VarTypes, declaredTypes, derefStrideOk, exprCType } from '../l3/typing';
+import { orderSlotLocals } from '../l3/slotorder';
+import { type VarTypes, declaredTypes, derefStrideOk, exprCType, writesNonPointerIntoPointer } from '../l3/typing';
 
 // Infix operators IDO Pascal spells directly.
 const OP: Partial<Record<BinOp, string>> = {
@@ -18,6 +19,10 @@ const OP: Partial<Record<BinOp, string>> = {
   // match C's truncated `%` (sign of the DIVIDEND) — verified: `a mod 3` mis-scores against the
   // IDO C `a % 3` codegen. There is no faithful IDO-Pascal spelling of a signed C remainder, so the
   // backend fails LOUD on `%` (below) rather than emit a silently-wrong `mod`. `/`→`div` DOES match.
+  //
+  // And no `/u`/`%u` either, for the same reason `>>>` is absent from BIT_FN below: `div` over this
+  // backend's signed `Integer` is the SIGNED division, so lending it to the unsigned twin would
+  // emit `div` where the machine did `divu`. They reach the loud decline instead.
   '+': '+',
   '-': '-',
   '*': '*',
@@ -95,7 +100,7 @@ function makePrinter(vt: VarTypes) {
           throw new Error(`pascal backend: a multidimensional array access has no IDO Pascal spelling yet`);
         }
         const bt = exprCType(e.base, vt);
-        if ((bt !== undefined && !derefStrideOk(bt, e.width)) || (bt === undefined && e.width !== 4)) {
+        if ((bt !== undefined && !derefStrideOk(bt, e.width, e.signed)) || (bt === undefined && e.width !== 4)) {
           throw new Error(
             `pascal backend: a ${e.width}-byte access through a base of type '${bt ? typeToString(bt) : '<unknowable>'}' has no faithful spelling (no reinterpret cast)`,
           );
@@ -111,7 +116,10 @@ function makePrinter(vt: VarTypes) {
       // Casts have no faithful IDO-Pascal spelling yet — fail LOUD rather than emit silently-wrong
       // source. Tree-level producers reaching here: the width-narrowing idiom casts (agbcc-gated,
       // so never on this path today), structure.ts's STRUCT-pointer casts (unreachable too — the
-      // `field` case above throws first), and intify's `(s32)ptr` legalization (any target).
+      // `field` case above throws first), intify's `(s32)ptr` legalization (any target), and the
+      // byte-pointer walk of a pointer offset by a runtime value (any target, and reachable with no
+      // `field` in the tree — it declines two functions that used to emit here, whose Pascal was
+      // silently walking ELEMENTS where the asm walked bytes).
       // Scalar deref casts never appear in the tree — the index case above owns that judgment.
       case 'cast':
         throw new Error(`pascal backend: cast has no IDO Pascal spelling yet`);
@@ -148,15 +156,13 @@ function makePrinter(vt: VarTypes) {
       stmts.flatMap((x, i) => ps(fnName, x, ind, tl && i === stmts.length - 1));
     switch (s.k) {
       case 'assign': {
-        // The write-side sibling of the index case's deref discipline: Pascal has no reinterpret
-        // cast, so a definitely-non-pointer value assigned into a pointer-declared var (the shape
-        // the C family legalizes with `(u8 *)…`, cfamily.ts legalizePointerWrites) declines LOUD
-        // here instead of failing three stages later in upas.
-        const dt = vt(s.name);
-        const ct = exprCType(s.value, vt);
-        if (dt?.kind === 'ptr' && ct && ct.kind !== 'ptr' && ct.kind !== 'array') {
+        // The write-side sibling of the index case's deref discipline. The C family answers the
+        // same question (l3/typing.ts writesNonPointerIntoPointer) with a reinterpret cast;
+        // Pascal has none, so it declines LOUD here instead of failing three stages later in upas.
+        if (writesNonPointerIntoPointer(vt(s.name), s.value, vt)) {
+          const ct = exprCType(s.value, vt);
           throw new Error(
-            `pascal backend: assigning a ${typeToString(ct)} value into pointer var '${s.name}' has no faithful spelling (no reinterpret cast)`,
+            `pascal backend: assigning a ${ct ? typeToString(ct) : '<unknowable>'} value into pointer var '${s.name}' has no faithful spelling (no reinterpret cast)`,
           );
         }
         return [`${indent}${s.name} := ${pe(s.value)};`];
@@ -263,7 +269,15 @@ function makePrinter(vt: VarTypes) {
 
 export const pascalBackend: LanguageBackend = {
   id: 'pascal',
-  emit(fn: SFn): string {
+  // `case-of` has no fall-through, and this file's `switch` printing loud-fails a `fallsThrough`
+  // arm. Declared so RECOVERY never mints one for this backend: a comparison-tree switch also
+  // spells as plain if-nesting, which Pascal prints, so the choice is between a decompiled
+  // function and a stub.
+  spellsSwitchFallthrough: false,
+  emit(fn0: SFn): string {
+    // The declaration list is put into the target's own frame order HERE, as the C family does it
+    // in its shared assembler — owned by `emit`, never by a `.emit(` call site (l3/slotorder.ts).
+    const fn = orderSlotLocals(fn0);
     // Same env discipline as the C family (cfamily.ts cFamilyBody): the printer judges derefs
     // against the exact declarations it emits.
     const ps = makePrinter(declaredTypes(fn));

package/src/contracts.ts

@@ -3,10 +3,19 @@
 // decompileRanked / decompileWithReport).
 // A pass that regresses fails AT its boundary with a diagnostic, not three stages later as
 // wrong C.
-import type { Fn, Value } from './ir/core';
+import { type Fn, type Value, reachableBlocks } from './ir/core';
 import { type IrType, typeToString } from './ir/types';
 import type { BinOp, Expr, SFn, Stmt } from './l3/ast';
-import { exprChildren, fieldSpellsDot, stmtChildren, stmtExprs } from './l3/ast';
+import {
+  exprChildren,
+  fieldSpellsDot,
+  gapReasonFor,
+  mapExprChildren,
+  stmtChildren,
+  stmtExprs,
+  stmtLists,
+  walkExprs,
+} from './l3/ast';
 import { declaredTypes, exprCType } from './l3/typing';
 
 export class ContractError extends Error {
@@ -40,24 +49,338 @@ export function assertTypesRecovered(fn: Fn): void {
   }
 }
 
-/** Post structuring: the AST must reference no unresolved value. The structurer emits the
- *  sentinel var `"?"` when it cannot resolve a value (a dropped def, or an opcode it has no
- *  lowering for) — which would print as uncompilable source. Fail at the structuring boundary
- *  instead of emitting garbage. */
+/** Post structuring: the AST must reference no unresolved name. The structurer emits the sentinel
+ *  var `"?"` when it cannot resolve a value (a dropped def, or an opcode it has no lowering for),
+ *  which would print as uncompilable source. Fail at the boundary instead of emitting garbage.
+ *
+ *  `undefined` is the same failure from the other side — not a spelling the structurer chooses
+ *  (`Expr` declares `name: string`) but a `varName.get(v)!` whose value was never adopted, printing
+ *  as the token `undefined`. Both are checked on every ROUTE a name takes into the AST, and those
+ *  are not all expressions: `var` / `addr` / `field` / `call` carry one, and so does an `assign`'s
+ *  DESTINATION — a bare string field the expression walk never reaches. */
 export function assertResolved(sfn: SFn): void {
   // Derived from the shared exprChildren/stmtExprs/stmtChildren traversal so no statement kind
   // can be missed. A gap `marker` is annotate-mode's DESIGNED spelling of an unresolved value
-  // ("resolved" by construction); only its args could still hide a stray `"?"` — and args are
+  // ("resolved" by construction); only its args could still hide a stray name — and args are
   // exactly its children.
-  const badExpr = (e: Expr): boolean => (e.k === 'var' && e.name === '?') || exprChildren(e).some(badExpr);
-  const badStmt = (s: Stmt): boolean => stmtExprs(s).some(badExpr) || stmtChildren(s).some(badStmt);
+  const badName = (n: string | undefined): boolean => n === '?' || n === undefined;
+  // Every Expr kind that CARRIES a name, not just `var` — each is read through the same
+  // `map.get(d)!` / `attrs.x as string` and prints straight into the source. `carriesName` is asked
+  // separately because an ABSENT name is the case being caught: keying off `nameOf` alone refuses nothing.
+  const carriesName = (e: Expr): boolean => e.k === 'var' || e.k === 'addr' || e.k === 'field' || e.k === 'call';
+  const nameOf = (e: Expr): string | undefined =>
+    e.k === 'call' ? e.fn : e.k === 'marker' ? undefined : (e as { name?: string }).name;
+  const badExpr = (e: Expr): boolean => (carriesName(e) && badName(nameOf(e))) || exprChildren(e).some(badExpr);
+  // An `assign`'s DESTINATION is a bare string field, so the expression walk never reaches it.
+  const badStmt = (s: Stmt): boolean =>
+    (s.k === 'assign' && badName(s.name)) || stmtExprs(s).some(badExpr) || stmtChildren(s).some(badStmt);
   if (sfn.body.some(badStmt)) {
     throw new ContractError(
-      `structuring left an unresolved value ('?') in '${sfn.name}' — a dropped def or unlowered opcode`,
+      `structuring left an unresolved name ('?' or one never adopted) in '${sfn.name}' — ` +
+        `a dropped def, an unlowered opcode, or a name the structurer assumed the naming pipeline gave it`,
     );
   }
 }
 
+// ── effects: executed once, never dropped ──────────────────────────────────────────────────
+//
+// The three contracts around this one are about TYPING and SPELLABILITY. Nothing checked the
+// property the structurer's materialization model exists to preserve: a call in the asm must run
+// exactly as often in the emitted source. Its two failure modes are the two that hurt most —
+// asmlift's first rule is that a loud failure beats a silently wrong answer, and both of these are
+// silent:
+//
+//   • DROPPED — a call the asm makes has no counterpart in the tree at all;
+//   • RE-RUN  — inlining a call's value at more than one render position (or a structuring copy
+//     that duplicates a region onto a single path) makes one call execute twice. The round that
+//     recovered switch fall-through hit exactly this shape, and only an adversarial reviewer
+//     caught it.
+//
+// Deliberately narrow, so it never declines a function that is fine:
+//
+//   • CALLS only. Loads legitimately re-render (that is the whole point of the inline-at-use
+//     model, and the alias gate governs it); stores are checked by neither direction here because
+//     the readability DCE pass is allowed to drop a provably dead one.
+//   • PER PATH, not per tree. Structuring may legitimately emit one block twice — two exclusive
+//     switch arms sharing a body, a duplicated return merge — and each path still executes it
+//     once. So the duplication rule compares the maximum over syntactic root-to-leaf paths (a
+//     branch takes the max of its arms, a loop body counts once, a fall-through arm chains into
+//     the next) against the IR's static count.
+//   • Names the IR does not have are ignored, and only calls carrying a target symbol are counted
+//     (every frontend that emits `call` today stamps one).
+type CallCounts = Map<string, number>;
+
+/** per-key combine of two count maps (`sum` for sequence, `max` for exclusive alternatives) */
+function combine(a: CallCounts, b: CallCounts, f: (x: number, y: number) => number): CallCounts {
+  const out = new Map(a);
+  for (const [k, v] of b) {
+    out.set(k, f(out.get(k) ?? 0, v));
+  }
+  return out;
+}
+
+/** every `call` expression under `e`, counted by target name */
+function callsInExpr(e: Expr, into: CallCounts): void {
+  if (e.k === 'call') {
+    into.set(e.fn, (into.get(e.fn) ?? 0) + 1);
+  }
+  exprChildren(e).forEach((c) => callsInExpr(c, into));
+}
+
+/** `total` = every occurrence in the tree; `path` = the most any single syntactic path executes */
+function countCalls(stmts: Stmt[]): { total: CallCounts; path: CallCounts } {
+  let total: CallCounts = new Map();
+  let path: CallCounts = new Map();
+  const add = (r: { total: CallCounts; path: CallCounts }, pathF: (x: number, y: number) => number) => {
+    total = combine(total, r.total, (x, y) => x + y);
+    path = combine(path, r.path, pathF);
+  };
+  for (const s of stmts) {
+    const own: CallCounts = new Map();
+    stmtExprs(s).forEach((e) => callsInExpr(e, own));
+    add({ total: own, path: own }, (x, y) => x + y);
+    if (s.k === 'if') {
+      const t = countCalls(s.then);
+      const e = countCalls(s.else);
+      // exclusive arms: the path count is whichever arm runs, the total counts both
+      add(
+        { total: combine(t.total, e.total, (x, y) => x + y), path: combine(t.path, e.path, Math.max) },
+        (x, y) => x + y,
+      );
+    } else if (s.k === 'switch') {
+      const arms = s.cases.map((c) => countCalls(c.body));
+      const dflt = countCalls(s.default ?? []);
+      // A fall-through arm continues into the NEXT one emitted (the last into `default`), so a
+      // path through arm i runs the chain starting at i — the shape the fall-through round's
+      // CRITICAL took. Built from the end; `chain[i]` is that arm's per-path count.
+      const chain: CallCounts[] = new Array(arms.length);
+      for (let i = arms.length - 1; i >= 0; i--) {
+        const next = i + 1 < arms.length ? chain[i + 1] : dflt.path;
+        chain[i] = s.cases[i].fallsThrough ? combine(arms[i].path, next, (x, y) => x + y) : arms[i].path;
+      }
+      const armTotal = arms.reduce((acc, a) => combine(acc, a.total, (x, y) => x + y), dflt.total);
+      const armPath = chain.reduce((acc, c) => combine(acc, c, Math.max), dflt.path);
+      add({ total: armTotal, path: armPath }, (x, y) => x + y);
+    } else {
+      // Sequenced children (a loop body, a `for`'s init/inc): counted ONCE — a loop's dynamic trip
+      // count is not a syntactic occurrence, and the IR side is static too.
+      for (const c of stmtChildren(s)) {
+        add(countCalls([c]), (x, y) => x + y);
+      }
+    }
+  }
+  return { total, path };
+}
+
+/**
+ * Post structuring: every call the asm makes is emitted, and none is emitted more times than the
+ * asm makes it on any one path. See the note above for what this deliberately does not cover.
+ */
+export function assertEffectsPreserved(fn: Fn, sfn: SFn): void {
+  // Reachable blocks only: an unreachable block's call is legitimately never emitted.
+  const seen = reachableBlocks(fn);
+  const irCalls: CallCounts = new Map();
+  // Unmodelled instructions, by the mnemonic the frontend stamped. Same "never dropped" property as
+  // a call, and it needs its own tally because an `opaque` carries no `target`.
+  const irOpaques = new Set<string>();
+  for (const b of seen) {
+    for (const op of b.ops) {
+      if (op.opcode === 'call' && typeof op.attrs.target === 'string') {
+        const t = op.attrs.target;
+        irCalls.set(t, (irCalls.get(t) ?? 0) + 1);
+      } else if (op.opcode === 'opaque') {
+        irOpaques.add(gapReasonFor(op.attrs.mnemonic));
+      }
+    }
+  }
+  // DROPPED only, not the RE-RUN half: a gap rendered twice is a diagnostic printed twice, which
+  // costs nothing because nothing recompiles it, and structuring legitimately duplicates a shared
+  // arm — so a per-path count here would fire on correct output.
+  //
+  // Bites only in ANNOTATE mode (under `strict` the gap is the `?` sentinel and structure() has
+  // already thrown), which is where it is needed: that is the CLI and benchmark default, and the
+  // only mode with no other backstop against a silently dropped opaque.
+  if (irOpaques.size) {
+    const emitted = new Set<string>();
+    for (const e of walkExprs(sfn.body)) {
+      if (e.k === 'marker') {
+        emitted.add(e.reason);
+      }
+    }
+    for (const reason of irOpaques) {
+      if (!emitted.has(reason)) {
+        throw new ContractError(
+          `structuring dropped the ${reason} in '${sfn.name}' — an instruction asmlift could not model left no trace`,
+        );
+      }
+    }
+  }
+  if (!irCalls.size) {
+    return;
+  }
+  const { total, path } = countCalls(sfn.body);
+  for (const [name, n] of irCalls) {
+    if (!(total.get(name) ?? 0)) {
+      throw new ContractError(`structuring dropped the call to '${name}' in '${sfn.name}' — its effect is lost`);
+    }
+    const p = path.get(name) ?? 0;
+    if (p > n) {
+      throw new ContractError(
+        `structuring emitted ${p} calls to '${name}' on one path in '${sfn.name}', where the asm makes ${n}`,
+      );
+    }
+  }
+}
+
+/** Post structuring: a local the body READS must be WRITTEN somewhere in it. A materialized value
+ *  renders as one `v = …` statement at its def's position while every use reads the bare name, so
+ *  any pass that DISCARDS the statement's position — a collapsed switch test block, a suppressed
+ *  edge copy — leaves the reads standing over whatever the register allocator left behind. That is
+ *  the one wrongness the byte differ rewards rather than catches: the candidate compiles, scores,
+ *  and can win.
+ *
+ *  PRESENCE, not reaching definitions. The stronger question needs path sensitivity through
+ *  `switch` fall-through, `do-while` and `break`, where a false positive DECLINES a function that
+ *  is fine; assigned nowhere at all needs none of that and has no legitimate producer. Two local
+ *  kinds are exempt and both say so in their declaration: an `uninit` local stands on an `undef`,
+ *  where the missing assignment IS the recovery, and a `frame` local is the machine's own slot,
+ *  whose store the readability passes between here and L3 may have dropped. */
+export function assertLocalsWritten(sfn: SFn): void {
+  const suspect = new Set(sfn.locals.filter((l) => !l.frame && !l.uninit).map((l) => l.name));
+  if (!suspect.size) {
+    return;
+  }
+  const read = new Set<string>();
+  const written = new Set<string>();
+  // `&v` is a write channel this walk cannot follow — the callee/store behind it may fill the
+  // object — so it counts as one.
+  const walkExpr = (e: Expr): void => {
+    if ((e.k === 'var' || e.k === 'addr') && suspect.has(e.name)) {
+      (e.k === 'addr' ? written : read).add(e.name);
+    }
+    exprChildren(e).forEach(walkExpr);
+  };
+  const walkStmt = (st: Stmt): void => {
+    if (st.k === 'assign' && suspect.has(st.name)) {
+      written.add(st.name);
+    }
+    stmtExprs(st).forEach(walkExpr);
+    stmtChildren(st).forEach(walkStmt);
+  };
+  sfn.body.forEach(walkStmt);
+  const orphans = [...read].filter((n) => !written.has(n));
+  if (orphans.length) {
+    throw new ContractError(
+      `structuring emitted local(s) ${orphans.map((n) => `'${n}'`).join(', ')} in '${sfn.name}' read but ` +
+        `never assigned — a def whose assignment no render position emitted`,
+    );
+  }
+}
+
+/** Post-lever: every read of a MINTED local — its ADDRESS being taken included — must sit where
+ *  that local's assignment has already run.
+ *
+ *  THE failure a placing lever can ship, and the only one the byte differ rewards: a base local whose
+ *  assignment does not reach a use is a DIFFERENT VARIABLE — C that compiles, scores, and can win
+ *  (the shape #106 shipped). `contracts.ts`'s `assertLocalsWritten` does not see it: it accumulates
+ *  reads and writes as SETS over the whole body, so a local assigned in one arm and read after the
+ *  `if` is written somewhere and passes.
+ *
+ *  Checked on the EMITTED tree rather than argued from the plan, because the plan is what a bug
+ *  would be in. `rank.ts`'s `respell` catches the throw and drops the candidate, so the wrong
+ *  answer becomes a reported lever error instead of a scored spelling.
+ *
+ *  IT LIVES HERE, beside `assertLocalsWritten`, because it has that check's population and that
+ *  check's call site: levers that place a def — l3/sinkinit.ts, l3/basecse.ts's first-use policy,
+ *  l3/nearbase.ts, l3/reindex.ts, l3/scopebase.ts, l3/argbase.ts — are the population that can
+ *  produce the failure, so the check belongs on every lever tree rather than on one lever's.
+ *
+ *  Called ABSOLUTELY by the placing levers that put an init inside a nested list, each over its own
+ *  plan; everywhere else it is reached through `assertPlacementSurvives` below, which is a
+ *  DIFFERENTIAL — so a placement no lever's tree ever satisfied is not judged, and a lever that
+ *  mints nothing is not judged at all.
+ *
+ *  A nested list gets a COPY of the reaching set, so an assignment inside one arm does not count as
+ *  reaching anything after the `if`. */
+export function assertHoistsDominate(sfn: SFn, minted: ReadonlySet<string>): void {
+  if (minted.size === 0) {
+    return;
+  }
+  const readUndominated = (e: Expr, live: ReadonlySet<string>): string | null => {
+    // `&p` COUNTS, the same mention the placing passes query on (l3/hoist.ts): the address is what
+    // a callee reads the cell through, so an init has to precede it as surely as it must precede a
+    // read.
+    if ((e.k === 'var' || e.k === 'addr') && minted.has(e.name) && !live.has(e.name)) {
+      return e.name;
+    }
+    let bad: string | null = null;
+    mapExprChildren(e, (c) => {
+      bad ??= readUndominated(c, live);
+      return c;
+    });
+    return bad;
+  };
+  const judge = (heads: readonly Expr[], live: ReadonlySet<string>): void => {
+    for (const e of heads) {
+      const bad = readUndominated(e, live);
+      if (bad) {
+        throw new ContractError(
+          `'${sfn.name}' reads '${bad}' where its assignment does not reach — ` +
+            `a def placed below a use it claims to serve`,
+        );
+      }
+    }
+  };
+  const walk = (list: Stmt[], live: Set<string>): void => {
+    for (const st of list) {
+      // A `for`'s INIT runs once, before the condition, the inc and the body — so its assignment
+      // reaches all three, and the loop's own parts are statements with their own nested lists.
+      // `l3/reindex.ts` mints an induction variable whose ONLY def is that init, so reading the
+      // `for` as one flat head list rejects every counted walk it spells.
+      if (st.k === 'for') {
+        walk([st.init], live);
+        judge(stmtExprs(st), live);
+        walk([st.inc], new Set(live));
+        walk(st.body, new Set(live));
+        continue;
+      }
+      judge(stmtExprs(st), live);
+      for (const child of stmtLists(st)) {
+        walk(child, new Set(live));
+      }
+      if (st.k === 'assign' && minted.has(st.name)) {
+        live.add(st.name);
+      }
+    }
+  };
+  walk(sfn.body, new Set());
+}
+
+/** The same guarantee across a re-spelling that MOVES statements over a placement another pass
+ *  already made — `rank.ts`'s statement shapes (`/initfirst`, `/pollguard`, `/pollread`), derived
+ *  onto every lever tree after the lever placed its defs, and the lever-on-lever compositions in
+ *  the same file where a def-moving pass (`sinkInitsToFirstUse`, `nearBaseClusters`,
+ *  `reindexWalks`) runs on a tree a placing lever built. `pollReads` folds a materialized re-read
+ *  back into a loop condition, which is exactly such a move.
+ *
+ *  A DIFFERENTIAL, which is what makes it safe on every lever: the walk judges the reshaped tree
+ *  only where it already described the unshaped one, so a placement it cannot model (a def inside
+ *  a loop body read earlier in the same body is assigned on every iteration but the first) is not
+ *  judged either way. `minted` may name a local `before` does not carry — a mover mints its own —
+ *  and that one is judged absolutely, which is the same thing: a name absent from `before` is
+ *  never read there. */
+export function assertPlacementSurvives(before: SFn, after: SFn, minted: ReadonlySet<string>): void {
+  if (minted.size === 0) {
+    return;
+  }
+  try {
+    assertHoistsDominate(before, minted);
+  } catch {
+    return;
+  }
+  assertHoistsDominate(after, minted);
+}
+
 /** Post structuring: the AST's memory accesses and operators must be SPELLABLE — a `field`
  *  node's base a pointer-to-struct (`->`) or a struct value (`.`, an array element) carrying
  *  that field; no pointer operand under an operator C rejects; and every SCALAR `index` node's
@@ -85,7 +408,7 @@ export function assertDerefsTyped(sfn: SFn): void {
     }
   }
   // Ops C rejects outright on a pointer operand (the additive ops and &&/|| are legal C).
-  const NO_PTR_OPS = new Set<BinOp>(['&', '|', '^', '<<', '>>', '>>>', '*', '/', '%']);
+  const NO_PTR_OPS = new Set<BinOp>(['&', '|', '^', '<<', '>>', '>>>', '*', '/', '/u', '%', '%u']);
   // The comparison operators — where a bare `&SYM` operand is SIGN-ambiguous, not ill-formed.
   const CMP_OPS = new Set(['<', '<=', '>', '>=', '==', '!=']);
   // 1/2/4 only: the decomp typedef vocabulary (C_TYPEDEFS) has no 64-bit scalar, so a width-8
@@ -95,11 +418,13 @@ export function assertDerefsTyped(sfn: SFn): void {
   // Dot-form field bases (struct-array elements) carry the struct STRIDE as their width — any
   // stride matching the element size is legal there (the tree-level struct cast governs the
   // spelling; a stride/size MISMATCH types scalar in exprCType and the field rule flags it).
-  // Collected as fields are visited, BEFORE recursing into their children. Identity-keyed: a
-  // future subtree-SHARING pass (CSE-style) would leak the exemption to aliased bare uses —
-  // trees are freshly built per node today (structure.ts), which this relies on.
+  // Collected as fields are visited, BEFORE recursing into their children — which is what makes
+  // `walkExprs`' PRE-ORDER load-bearing here rather than incidental: the exemption is recorded on
+  // the `field` node and read at the `index` node beneath it. Identity-keyed: a future
+  // subtree-SHARING pass (CSE-style) would leak the exemption to aliased bare uses — trees are
+  // freshly built per node today (structure.ts), which this relies on.
   const structElem = new Set<Expr>();
-  const checkExpr = (e: Expr): void => {
+  for (const e of walkExprs(sfn.body)) {
     if (e.k === 'index' && !structElem.has(e) && !SCALAR_WIDTHS.has(e.width)) {
       bad.push(`index width ${e.width} is not a C scalar width`);
     }
@@ -159,13 +484,7 @@ export function assertDerefsTyped(sfn: SFn): void {
         }
       }
     }
-    exprChildren(e).forEach(checkExpr);
-  };
-  const checkStmt = (s: Stmt): void => {
-    stmtExprs(s).forEach(checkExpr);
-    stmtChildren(s).forEach(checkStmt);
-  };
-  sfn.body.forEach(checkStmt);
+  }
   if (bad.length) {
     throw new ContractError(
       `structuring emitted ill-typed C in '${sfn.name}': ${bad[0]}${bad.length > 1 ? ` (+${bad.length - 1} more)` : ''}`,

package/src/declare.ts

@@ -29,7 +29,25 @@
 //     field) can only LOSE score — the target bytes derive from the truth decls, so a
 //     divergent compile can never false-match. Exception two is the NAME-ONLY data symbol
 //     (`extern u32 name;` — see the default case): required to reproduce symtab-only map
-//     rows outside project headers, justified by the same only-loses-score argument.
+//     rows outside project headers.
+//
+// WHERE THE ONLY-LOSES-SCORE ARGUMENT STOPS. It rests on the target bytes coming from the
+// project's own TRUTH declarations, so a divergent decl compiles to different bytes and simply
+// scores worse. The line is not map-derived vs. synthesized, it is whether the ref carries
+// `access`: that field is read out of the candidate's own IR — the very asm it is then scored
+// against — so a declaration wearing it is FITTED and can only manufacture agreement. Every
+// `synthesized` ref can wear it, and so can a MAP-KNOWN name whose map entry has no shape
+// (symtab-only projects), which is the one fitted case `synthesized` does not mark. Measured
+// over the 252 real benchmark rows with their vendored maps: fitted-and-marked 2, fitted-but-
+// unmarked 0 — so the marker covers today's population, and a symtab-only project is where it
+// would stop.
+//
+// A fitted declaration is a sound ARTIFACT (decls + source really do compile to those bytes) and
+// an unsound CLAIM if the decls are hidden, so a consumer publishing a verdict must show the
+// block beside the source. Its price, against the benchmark's own vendored maps: of 28 fitted
+// NARROW declarations over the 126 rankable agbcc rows, 26 agree with the project's real
+// declaration and 2 do not (27 of 28 agree on the offset-0 ACCESS WIDTH the declaration
+// produces, which is the weaker question of whether the same load is emitted).
 import { type StructFieldDecl, renderStructDecl } from './backend/cfamily';
 import { T } from './ir/types';
 import type { SymbolRef } from './l3/symbol-refs';
@@ -42,6 +60,7 @@ import {
   pointeeFields,
   symbolFieldType,
 } from './symbols';
+import { C_TYPEDEFS } from './target';
 
 /** The u8/s8/u16/s16/u32/s32 spelling for a 1/2/4-byte cell, or null (no faithful narrow type). */
 function intType(size: number, signed: boolean): string | null {
@@ -223,9 +242,11 @@ export function renderDeclarations(refs: SymbolRef[]): string {
         // tree performed only under a decl of that exact width (`extern u16 g;` is `sh` where
         // a guessed u32 is `sw`). Without a bare off-0 access fact, every core spelling goes
         // through `&name` casts, where any object decl is address-identical — u32 is the
-        // fallback cell. A divergent decl can only LOSE score — the target bytes derive from
-        // the truth decls, so a mis-declared compile can never false-match (same argument as
-        // enumIsSigned).
+        // fallback cell.
+        // For a MAP-derived name-only symbol (symtab-only projects) the only-loses-score
+        // argument applies. For a `synthesized` one it does not — the width came from the
+        // target's own asm, so this line is a hypothesis fitted to the bytes; see the module
+        // note's "WHERE THE ONLY-LOSES-SCORE ARGUMENT STOPS".
         const t = access ? intType(access.width, access.signed) : null;
         lines.push(`extern ${quals(info)}${t ?? 'u32'} ${name};`);
         break;
@@ -249,3 +270,19 @@ export function macroDefinesOf(declarations: string | undefined): string {
   const lines = declarations.split('\n').filter((l) => l.startsWith('#define '));
   return lines.length ? lines.join('\n') + '\n' : '';
 }
+
+/** THE self-declared world's compilation context: asmlift's typedef prelude followed by this
+ *  candidate's declaration block. One composition with two callers — the cli's compile seam
+ *  (compile-command.ts, whose probe decides whether the world is self-declared at all) and the
+ *  webapp's wasm scorer, which is ALWAYS in it — because two hand-rolled copies of
+ *  `C_TYPEDEFS + decls` is exactly how the two scoring worlds come to disagree about what a
+ *  candidate was compiled in. */
+export function selfDeclaredContext(declarations: string | undefined): string {
+  return C_TYPEDEFS + (declarations ?? '');
+}
+
+/** The same context straight from a candidate's refs — what a scorer holding `Candidate`s (the
+ *  webapp) needs, and the one place that decides an empty ref list renders no block at all. */
+export function selfDeclaredContextFor(refs: SymbolRef[] | undefined): string {
+  return selfDeclaredContext(refs?.length ? renderDeclarations(refs) : undefined);
+}

package/src/frontend/mips.ts

@@ -31,7 +31,7 @@ import { assertInputFormat } from './format';
 import type { Frontend } from './frontend';
 import { opaqueDest } from './opaque';
 import { isSplatMips, parseSplatMips } from './splat';
-import { abiSortEntryParams } from './ssa';
+import { abiSortEntryParams, stackSlotKey } from './ssa';
 import { makeSsaBuilder } from './ssa';
 
 type Instr = DisasmInstr;
@@ -54,7 +54,7 @@ const isZero = (r: string) => r === 'zero' || r === '$0';
 const isStackPtr = (r: string) => r === 'sp' || r === '$sp' || r === '$29';
 // SSA-variable name for the stack slot at a constant `sp`-offset. Distinct namespace from the
 // register names (which are alphabetic / `$N`), so it never collides with a real register var.
-const stackSlot = (off: number) => `sp@${off}`;
+const stackSlot = stackSlotKey; // shared spelling: frontend/ssa.ts
 // Sub-word memory mnemonics (widths 1 and 2). Used by the `spSlotSafe` guard in `lift`: a sub-word
 // `sp`-relative access means the word stack-slot model is unsafe for that function.
 const SUBWORD_MEM = new Set(['lb', 'lbu', 'lh', 'lhu', 'sb', 'sh']);
@@ -517,6 +517,17 @@ export function lift(
     }
   });
 
+  // NO FRAME PARTITION IS CLAIMED, so every def-less slot read refuses (frontend/ssa.ts,
+  // LiveInModel). This frontend has no frame bound at all — `addiu sp,sp,±N` is transparent and
+  // every word sp-relative access becomes `sp@<rawOff>` — so its slot keys span O32's CALLER-owned
+  // register-parameter home area and the incoming stack arguments above it, where a def-less read
+  // is argument 5, not an uninitialised local.
+  //
+  // Claiming one needs the frame SIZE those offsets are measured against, which is not computed
+  // here, plus ensureParam for the register half. The ranges themselves are known: O32 reserves
+  // `[0,16)` as the caller-owned home area (in NEITHER range — caller-owned, but not an argument)
+  // with stack arguments from 16 up, which is what `mips32be.cspec`'s `<localrange>` and stack
+  // `<pentry offset="16">` encode.
   const ssa = makeSsaBuilder(name, blocks.length, preds);
   const { irBlocks, readVar, writeVar, paramReg } = ssa;
   const RET = target.returnReg;
@@ -866,8 +877,8 @@ export function lift(
       }
     };
     // TRUSTWORTHINESS GUARD (mirrors the PPC frontend): an unmodelled instruction must not silently
-    // drop its destination register — emit an honest `opaque`: dead ⇒ it vanishes; live ⇒
-    // assertResolved fails LOUD (see frontend/opaque.ts for the policy).
+    // drop its destination register — emit an honest `opaque`, which fails LOUD at assertResolved
+    // whether or not anything reads that register (see frontend/opaque.ts for the policy).
     const emitOpaqueDest = (ins: Instr) => {
       // A `%hi`/`%lo` operand on an instruction NOT modelled as a global consumer — an FP load/store
       // (`lwc1`/`ldc1`), or any unmodelled op — reaches here (the modelled consumers handle their own
@@ -889,8 +900,8 @@ export function lift(
       const od = opaqueDest(ins.mnemonic, ins.ops, {
         isReg: isMipsReg,
         isZero,
-        storeClass: /^(sb|sh|sw|swl|swr|sc|sd|sdl|sdr|swc1|sdc1)$/,
-        skipSafe: /^(nop|ssnop|break)$/,
+        storeClass: /^(sb|sh|sw|swl|swr|sc|sd|sdl|sdr|swc1|sdc1)$/i,
+        skipSafe: /^(nop|ssnop|break)$/i,
         context: `${name} @0x${ins.addr.toString(16)}`,
       });
       if (!od) {
@@ -938,6 +949,13 @@ export function lift(
         // incoming STACK-PASSED argument (5th+ param, O32) or an uninitialised local — neither modelled.
         // Without this, readVar would FABRICATE a phantom entry parameter for the slot, silently emitting a
         // function of wrong arity that returns the wrong argument. Loud-fail instead of miscompiling.
+        //
+        // Those two cases are SEPARABLE, and the Thumb frontend now separates them (frontend/thumb.ts,
+        // incomingArgIndex): a slot at or above the callee's own frame cannot have been written by this
+        // function, so it is an incoming argument; below the frame top it is a local. Doing the same here
+        // needs O32's own frame rule — the 16-byte home area means a stack argument is NOT simply "above
+        // the frame", so the Thumb arithmetic does not carry over — plus ssa.ensureParam for the register
+        // half. Until then this stays one loud decline for both.
         if (!ssa.hasReachingDef(stackSlot(off), bi)) {
           throw new FrontendUnsupportedError(
             `cannot lift '${name}': load from stack slot sp@${off} that was never stored ` +