@asmlift/core 0.4.0 → 0.6.0

package/src/ir/opcodes.ts

@@ -16,6 +16,13 @@ export interface OpSig {
    *  an unconditional position. THE one effect vocabulary — DCE (pattern/engine.ts) and the
    *  short-circuit hoist guard (raise/shortcircuit.ts) both derive from this flag. */
   effects?: boolean;
+  /** reads memory. Deletable when dead — nothing observes a load nobody reads — but NOT movable:
+   *  a load answers whichever stores ran before it, so crossing one changes the value it yields.
+   *  The two questions are separate flags because a load answers them differently. */
+  reads?: boolean;
+  /** may fault on operands the program never actually gave it — the integer divides, on a zero
+   *  divisor. Deletable and movable, but not safe to run on a path that did not run it. */
+  traps?: boolean;
 }
 
 export const OPCODES = {
@@ -60,16 +67,29 @@ export const OPCODES = {
   zext: { operands: 1, results: 1, requiredAttrs: ['width'] },
   sext: { operands: 1, results: 1, requiredAttrs: ['width'] },
   // Division/remainder. `sdiv` is variadic like the shifts: the immediate form (1 operand +
-  // `imm` attr) is the strength-reduced constant divisor an idiom folds to (`sdiv X {imm=2}`);
-  // the register form (2 operands) is a real hardware divide (`div`/`divu` + `mflo`/`mfhi` on an
-  // ISA with `capabilities.hwDivide`); the structurer branches on count. `udiv`/`smod`/`umod`
+  // `imm` attr) is the strength-reduced constant divisor an idiom folds to (`sdiv X {imm=2}`),
+  // the register form is 2 operands, and the structurer branches on count. `udiv`/`smod`/`umod`
   // are 2-operand only. `sdiv`/`udiv` = quotient, `smod`/`umod` = remainder; signedness lives in
-  // the op (recovery types the operands to match), so the backend picks `/`/`%` over
-  // correctly-typed operands.
-  sdiv: { operands: 'variadic', results: 1 },
-  udiv: { operands: 2, results: 1 },
-  smod: { operands: 2, results: 1 },
-  umod: { operands: 2, results: 1 },
+  // the op, and L3 keeps the pair apart (`/`/`%` against `/u`/`%u`) so the C backend can spell
+  // both with C's one token over an operand cast that says which.
+  //
+  // A register form does NOT mean the machine had a divide instruction — never read the ISA off it.
+  // Six recognizers at three layers build these ops, and which fires is a fact about the COMPILER's
+  // lowering, not the hardware. Quotient AND remainder: frontend/mips.ts (`mfhi` off a real `div`),
+  // raise/softdiv.ts (a `bl __modsi3` on an ISA with NO divide, gated `!hwDivide`), and
+  // pattern/engine.ts HWMOD_PATTERNS (`divw`+`mullw`+`subf`, where the hardware divides but has no
+  // remainder instruction). Quotient ONLY: raise/magicdiv.ts, raise/divpow2.ts, SDIV_POW2_2.
+  // KNOWN GAP, by pass ORDER rather than by decision: the quotient-only three run at stage 2.35,
+  // AFTER the stage-2 idiom fold, so no remainder fold can ever see the `sdiv` they build, and a
+  // remainder over a CONSTANT divisor stays written out on every target — visible in the artifact
+  // as `modc`/`umod10`, which recover `%` on agbcc+ido and the decomposition on kmc+mwcc. All four
+  // are byte-exact, so it costs 0 points; closing it re-prices those rows and re-derives both of
+  // HWMOD_PATTERNS' gates (a constant multiply carries no operand order to read), so it is its own
+  // round.
+  sdiv: { operands: 'variadic', results: 1, traps: true },
+  udiv: { operands: 2, results: 1, traps: true },
+  smod: { operands: 2, results: 1, traps: true },
+  umod: { operands: 2, results: 1, traps: true },
   // signed/equality comparisons (result is a boolean-valued u32)
   icmp_slt: { operands: 2, results: 1 },
   icmp_sle: { operands: 2, results: 1 },
@@ -90,13 +110,13 @@ export const OPCODES = {
   logic_and: { operands: 2, results: 1 },
   logic_or: { operands: 2, results: 1 },
   // --- memory ---
-  load: { operands: 1, results: 1, requiredAttrs: ['off', 'width', 'signed'] },
+  load: { operands: 1, results: 1, requiredAttrs: ['off', 'width', 'signed'], reads: true },
   store: { operands: 2, results: 0, requiredAttrs: ['off', 'width'], effects: true },
   // Typed element-scaled array access. Unlike load/store's constant `off`, these carry an
   // explicit runtime `index` operand plus the `elemSize` the index scales by, so the base is a
   // genuine `elem *` and no byte-offset arithmetic leaks into the emitted source. Produced by
   // the array-recognition legalization pass (raise/arrays.ts).
-  aload: { operands: 2, results: 1, requiredAttrs: ['elemSize', 'signed'] }, // aload base, index
+  aload: { operands: 2, results: 1, requiredAttrs: ['elemSize', 'signed'], reads: true }, // aload base, index
   astore: { operands: 3, results: 0, requiredAttrs: ['elemSize'], effects: true }, // astore base, index, value
   // --- call: operands are the argument values (r0..), result is the return value (r0),
   //     `target` attr is the callee symbol. Caller-saved clobbering is implicit. ---
@@ -108,8 +128,54 @@ export const OPCODES = {
   //   - an indexed or non-zero-offset AGGREGATE access → the address-cast `((T *)&gSym)[i]`;
   //   - any other use (e.g. `&gSym` passed to a call) → the `{k:'addr'}` L3 node, printed `&gSym`.
   gaddr: { operands: 0, results: 1, requiredAttrs: ['sym'] },
+  // The address of a FRAME-LOCAL object — gaddr's local twin, for the address-taken stack local
+  // (`mov rD, sp` feeding a DMA register or a callee). `off` is the byte offset inside the frame's
+  // reserved local area; the Thumb frontend's post-lift audit stamps `name`/`width`/`signed` after
+  // proving every access agrees, and the structurer declares the local and renders `&name` exactly
+  // as it renders a gaddr's `&sym`. Operand-free and pure, so GVN numbers it like gaddr and a dead
+  // one is reaped.
+  // `width`/`signed` are stamped by the frontend's frame-object AUDIT — requiring them makes
+  // "the audit ran" a verifier-checkable fact instead of a convention: a frontend that emits a
+  // laddr and skips the audit fails verify loudly instead of rendering `&undefined`.
+  laddr: { operands: 0, results: 1, requiredAttrs: ['off', 'width', 'signed'] },
+  // An UNDEFINED value: a read of storage that carries no INPUT — nothing was entitled to hand this
+  // function a value there, and none of its own stores reached it on this path. Deliberately NOT
+  // "storage nobody could have written": a callee-saved register holds the CALLER's value at entry,
+  // which is exactly what the prologue pushes it for, and the read is undefined all the same
+  // because the ABI gives no caller a way to pass an argument in one. The C declared a local with
+  // no initialiser and assigned it only inside some arms of a conditional or `switch` (a `switch`
+  // with no `default` being the commonest source), so the read is legal to compile and the compiler
+  // emitted the unassigned path faithfully.
+  //
+  // "No input" is established differently in the two places a local lives, and `frontend/ssa.ts`
+  // (LiveInModel) is where each is declared:
+  //   • a FRAME SLOT is storage whose only writer is this function's own stores — SOLE WRITER, not
+  //     merely "owns the storage", because a frame the function owns can still be written by
+  //     someone else once an address into it escapes to a callee, which fills a wider object than
+  //     any in-function access reveals. Whoever mints one owes the retraction on escape
+  //     (frontend/thumb.ts, after the frame-object audit).
+  //   • a REGISTER the ABI does not pass arguments in AND this function's prologue SAVED cannot
+  //     carry a value a caller handed over, and has no address for anything else to reach it by, so
+  //     there is nothing to retract. The save is half of the premise, not a corroboration of it:
+  //     asm that follows no ABI is handed live values in registers it never saved.
+  //
+  // An opcode rather than a live-in because Braun's construction resolves a def-less read to a
+  // live-in, and a live-in of the entry block is a PARAMETER — right for an argument register, a
+  // fabricated argument for anything else.
+  //
+  // Operand-free and pure like `laddr`, and out of raise/gvn.ts's NUMBERABLE set — where numbering
+  // it would be VACUOUS rather than harmful, since two undefs in one function always carry
+  // different keys. "Same key, therefore same value" is empty for a value that has none.
+  //
+  // `key` names the storage (`sp@0`, `r4`); the structurer reads it to name the local
+  // (`uninit_sp0`) and emits NO assignment — that absence is the recovery, and an edge argument
+  // that is one emits no copy either (structure.ts undefCarriesNothing).
+  undef: { operands: 0, results: 1, requiredAttrs: ['key'] },
   // --- black-box escape hatch (keeps lifting total) ---
-  opaque: { operands: 'variadic', results: 1 },
+  // `effects: true`: an instruction asmlift could not model may do anything — write memory, trap,
+  // touch a system register — and `results[0]` is only the part we can name. So a dead `opaque` is
+  // no more reapable than a dead `call`.
+  opaque: { operands: 'variadic', results: 1, effects: true },
   // --- terminators ---
   ret: { operands: 'variadic', results: 0, terminator: true, successors: 0 },
   br: { operands: 0, results: 0, terminator: true, successors: 1 },
@@ -124,6 +190,13 @@ export const OPCODES = {
  *  does not. */
 export type Opcode = keyof typeof OPCODES;
 
+/** The widths a `zext`/`sext` carries — a fact about those two opcodes, so it lives with them
+ *  rather than re-declared per consumer (raise/narrow.ts pairs a narrowing op with its re-widening,
+ *  raise/paramwidth.ts declares a parameter at one). Every frontend that produces the pair produces
+ *  one of these: agbcc's gated shift-pair fold (pattern/engine.ts CAST_PATTERNS) and PPC's
+ *  `extsb`/`extsh` (frontend/ppc.ts). A third width would be a C type the backend cannot spell. */
+export const CAST_WIDTHS: ReadonlySet<number> = new Set([8, 16]);
+
 /** Signature lookup by RUNTIME opcode string (Op.opcode is a plain string — IR consumers switch
  *  on it); undefined for an unregistered opcode. */
 export function opSig(opcode: string): OpSig | undefined {
@@ -138,11 +211,10 @@ export function opSig(opcode: string): OpSig | undefined {
  *  holds by construction (a hand-written map is one typo away from breaking it, and the symptom is a
  *  plainly inverted condition in the emitted C). Completeness against the icmp family is the part
  *  construction cannot give, so a test asserts it (test/pattern.test.ts) — an eleventh comparison
- *  added to `OPCODES` would otherwise degrade three consumers three different ways.
+ *  added to `OPCODES` would otherwise degrade its consumers several different ways.
  *
  *  It lives here for the reason HOIST_UNSAFE_OPS does: every consumer that has to say "the opposite
- *  of this compare" reads THIS one — the MIPS frontend's `slt …; beqz` branch-when-false fold, the
- *  short-circuit recognizer's diamond negation, and the idiom layer's `cmp ^ 1` fold — so they
+ *  of this compare" reads THIS one, so they
  *  cannot drift apart the way inline copies did. Two adjacent facts worth knowing: raise/
  *  shortcircuit.ts derives its `BOOL_OPS` from these keys (asserting negatable-icmp == boolean-op,
  *  true today), and l3/ast.ts `NEGATE_REL` is the SAME relation over the neutral L3 operator
@@ -162,25 +234,82 @@ export const NEGATED_ICMP: Readonly<Record<string, Opcode>> = Object.fromEntries
   ]),
 );
 
-/** Ops with an observable side effect — the derived view raise/shortcircuit.ts consumes. */
+/** Ops with an observable side effect: the flag on the signature, derived rather than re-listed.
+ *  `isDceSafe` asks the same question of the FLAG through `opSig` rather than of this set, so the
+ *  two cannot disagree. The SET's own consumers are `HOIST_UNSAFE_OPS` below, structure.ts's
+ *  `sideEffects` walk (an effectful op whose result nobody reads is still an execution),
+ *  analysis.ts's memory-write barrier, divpow2's bias block (which is DELETED rather than moved),
+ *  and the idiom layer's de-sequencing guard (pattern/engine.ts). Three of them —  the
+ *  `sideEffects` walk, the barrier and the bias block — each carried a hand-written copy of this
+ *  membership, which is how the models drifted apart before. */
 export const EFFECTFUL_OPS: ReadonlySet<string> = new Set(
   (Object.keys(OPCODES) as Opcode[]).filter((k) => (OPCODES[k] as OpSig).effects),
 );
 
-/** Ops that may not be REORDERED across other code — `EFFECTFUL_OPS` plus `opaque`.
+/** Ops that may not be SPECULATED — run on a path that did not run them before. Identical to
+ *  `EFFECTFUL_OPS`, and kept as its own name because its call sites ask the speculation question
+ *  rather than the deletion one.
+ *
+ *  A memory read is deliberately absent, and that is the one entry worth arguing: its only consumer
+ *  is raise/shortcircuit.ts, which hoists an arm's body into the block above, and the structurer
+ *  inlines an unnamed value back into the `&&`/`||` right-hand side, where C's own short-circuit
+ *  re-guards it. Adding the two reads
+ *  here costs three byte-matches (kleod:UpdateHUDCounterDisplay, synthetic:breakloop,
+ *  synthetic:strcmp1), so the argument is load-bearing rather than merely plausible.
+ *
+ *  KNOWN GAP: the trapping divides are absent too, and there the re-guard argument does NOT carry
+ *  — a hoisted `sdiv` that the structurer NAMES becomes an unconditional statement. Left as it is
+ *  because closing it is a separate change with its own measurement; `REEVAL_UNSAFE_OPS` does
+ *  refuse them, so the pre-update sink is not exposed to it.
  *
- *  `effects` is overloaded on two axes, and `opaque` is exactly the op that separates them: a dead
- *  `opaque` MUST stay deletable (`isDceSafe` below says so deliberately — giving it `effects: true`
- *  would strand dead opaques after every pattern rewrite, and they would surface as ASMLIFT_ERROR
- *  gaps in functions that emit cleanly today), while a LIVE one is an instruction asmlift could not
- *  model and must not be moved past anything. So "deletable when dead" and "movable when live" are
- *  different questions and get different views, both derived here rather than re-spelled per
- *  consumer — structure/analysis.ts and structure/structure.ts each carry their own inline copy of
- *  this membership, which is how the two models drifted apart in the first place. */
-export const HOIST_UNSAFE_OPS: ReadonlySet<string> = new Set([...EFFECTFUL_OPS, 'opaque']);
+ *  AND THE EXEMPTION IS NOT TRANSFERABLE, which is worth saying beside it: a second consumer once
+ *  read this set to answer "would gcc have SPECULATED this arm above a compare", where nothing
+ *  re-guards anything, and admitted single-load arms `gcc/jump.c:483`'s `! may_trap_p` refuses.
+ *  Pointing that consumer back at this set costs `synthetic:mergeldcast:agbcc` its byte-match
+ *  (MATCH -> diff:6), measured. That consumer is `raise/narrowlocal.ts` and it reads
+ *  `REEVAL_UNSAFE_OPS` instead. Reach for this set only when the argument above — a C-level
+ *  re-guard at the new point — actually holds at your call site. */
+export const HOIST_UNSAFE_OPS: ReadonlySet<string> = EFFECTFUL_OPS;
+
+/** Ops whose answer depends on WHERE they run: an effect (its order against other effects is
+ *  observable) or a memory read (it answers whichever stores ran before it). The question a pass
+ *  asks before moving a computation to another point on the SAME path. */
+export const ORDER_SENSITIVE_OPS: ReadonlySet<string> = new Set(
+  (Object.keys(OPCODES) as Opcode[]).filter((k) => {
+    const sig = OPCODES[k] as OpSig;
+    return sig.effects || sig.reads;
+  }),
+);
+
+/** Ops that may not be RE-EVALUATED at another program point — order-sensitive, or trapping. The
+ *  trap half is what separates this from `ORDER_SENSITIVE_OPS`: it only matters when the new point
+ *  can be reached on a path the old one was not, so a consumer that merely re-orders on one path
+ *  wants the smaller set. Both are needed because the two consumers differ on exactly the divides:
+ *  a collapsed switch re-renders a test block's ops AT THEIR USES, and every use is dominated by
+ *  the def, so it evaluates them on a SUBSET of the original paths — a narrowing, never a
+ *  speculation. */
+export const REEVAL_UNSAFE_OPS: ReadonlySet<string> = new Set(
+  (Object.keys(OPCODES) as Opcode[]).filter((k) => {
+    const sig = OPCODES[k] as OpSig;
+    return sig.effects || sig.reads || sig.traps;
+  }),
+);
+
+/** Ops that MATERIALIZE a value out of nothing: no operands, no state read, no effect, no trap, no
+ *  control flow — so where one sits in a block says nothing about what ran before it. Derived, so a
+ *  future pure nullary opcode joins without a second edit. Consumed by raise/paramwidth.ts, whose
+ *  prologue scan steps over them; the effect flags are what keep the EFFECTFUL nullary ops (a
+ *  zero-argument `call`, an `opaque` with no sources) out, and an extension behind a call is body
+ *  code rather than a prologue. */
+export const MATERIALIZING_OPS: ReadonlySet<string> = new Set(
+  (Object.keys(OPCODES) as Opcode[]).filter((k) => {
+    const sig = OPCODES[k] as OpSig;
+    return sig.operands === 0 && !sig.terminator && !sig.effects && !sig.reads && !sig.traps;
+  }),
+);
 
 /** May a dead result of this opcode be deleted? Registered, no observable effects, not control
- *  flow. Deliberately includes `opaque` — a dead opaque vanishing is designed behavior. */
+ *  flow. `opaque` is excluded via its `effects` flag — see the note on its signature. */
 export function isDceSafe(opcode: string): boolean {
   const sig = opSig(opcode);
   return !!sig && !sig.effects && !sig.terminator;

package/src/ir/parse.ts

@@ -4,6 +4,12 @@
 // both the debug dump and the test oracle. The parser builds the graph but enforces NO
 // semantics — that is the verifier's job — so malformed-but-well-formed-syntax IR can be
 // constructed and then rejected by verify().
+// The write-order annotation `print(fn, { writeOrder: true })` adds is DISCARDED, not rejected: the
+// text parses (`stripWriteOrderAnnotation`) and the fn comes back with `writeOrder: undefined`.
+// Both halves are deliberate — only a frontend can make that measurement, and a parsed fn that came
+// back measured would structure differently from every other parsed fn, while every stage dump
+// carries the annotation (pipeline.ts, trace.ts) and a dump nobody can paste back in is not an
+// oracle.
 // ROUND-TRIP DOMAIN: parse(print(fn)) holds for L1/scalar types only — `unkN`/`sN`/`uN` and
 // `*`-pointers to them. STRUCT/ARRAY/VOID types print (typeToString) but do NOT parse back; a
 // post-type-recovery dump is a one-way debugging artifact, not a test oracle.
@@ -32,7 +38,7 @@ export function parse(text: string): Fn {
     if (raw[i].trim() === '') {
       continue;
     }
-    body.push(raw[i].trim());
+    body.push(stripWriteOrderAnnotation(raw[i].trim()));
   }
 
   // PASS A — create all blocks and pre-declare every value by its textual name, so
@@ -113,7 +119,18 @@ export function parse(text: string): Fn {
     }
   }
 
-  return { name, blocks: rawBlocks.map((r) => r.block) };
+  // No write order: the text form is the value graph, and the record is a measurement of the
+  // MACHINE. A parsed fn's edges are UNMEASURED, never written-nowhere (ir/core.ts `WriteOrder`).
+  return { name, blocks: rawBlocks.map((r) => r.block), writeOrder: undefined, slotHomes: undefined };
+}
+
+/** Drop the two annotations `print(fn, { writeOrder: true })` appends, and NOTHING else.
+ *
+ *  Anchored on their exact shapes rather than on "text after a `;`", because a `;` is not a comment
+ *  marker in this format: a string attr prints JSON-quoted (`opaque {text="mrs r0, cpsr; …"}`) and
+ *  a list attr prints `[1;2;3]`, so a general trailing-comment strip would eat an operand. */
+function stripWriteOrderAnnotation(line: string): string {
+  return line.replace(/^(\^\w+\(.*\):)\s+;\s+writes=\d+$/, '$1').replace(/\s+;\s+order(?:\s+\^\w+\([^()]*\))+$/, '');
 }
 
 function parseOp(line: string, refValue: (nm: string) => Value, refBlock: (label: string) => Block): Op {

package/src/ir/print.ts

@@ -7,7 +7,17 @@
 import type { AttrVal, Block, Fn, Value } from './core';
 import { typeToString } from './types';
 
-export function print(fn: Fn): string {
+/** WRITE-ORDER ANNOTATION (`ir/core.ts` WriteOrder) — OFF by default and deliberately not part of
+ *  the round-trip artifact. The record is a measurement `parse` cannot reconstruct, and a parsed fn
+ *  that came back MEASURED would structure differently from every other parsed fn, so the text form
+ *  never carries it back in. It is printed for the per-stage DUMPS, which are otherwise unable to
+ *  explain themselves: two functions with identical `stage:lift` output emit different C when their
+ *  records differ. */
+export interface PrintOptions {
+  writeOrder?: boolean;
+}
+
+export function print(fn: Fn, opts: PrintOptions = {}): string {
   const blockLabel = new Map<Block, string>();
   fn.blocks.forEach((b, i) => blockLabel.set(b, `bb${i}`));
 
@@ -31,10 +41,14 @@ export function print(fn: Fn): string {
   }
   const ref = (v: Value) => name.get(v) ?? '%<undef>';
 
+  // Present only when asked for AND measured, so an unmeasured fn prints identically either way —
+  // the distinction a reader of the dump most needs to see.
+  const order = opts.writeOrder ? fn.writeOrder : undefined;
   const lines: string[] = [`fn ${fn.name} {`];
   for (const b of fn.blocks) {
     const params = b.params.map((p) => `${ref(p)}: ${typeToString(p.type)}`).join(', ');
-    lines.push(`^${blockLabel.get(b)}(${params}):`);
+    const writes = order?.writes.get(b);
+    lines.push(`^${blockLabel.get(b)}(${params}):` + (writes === undefined ? '' : `  ; writes=${writes}`));
     for (const op of b.ops) {
       let s = '  ';
       if (op.results.length) {
@@ -52,6 +66,17 @@ export function print(fn: Fn): string {
         s += ' ' + args.join(', ');
       }
       s += fmtAttrs(op.attrs);
+      // Per SUCCESSOR, in successor-arg order: the ordinal of this block's last write to each
+      // destination param's key — what `structure.ts`'s edge-copy sort reads — and `-` for a
+      // destination this block never wrote.
+      if (order?.writes.has(b) && op.successors.length) {
+        const rec = order.lastWrite.get(b);
+        s +=
+          '  ; order ' +
+          op.successors
+            .map((su) => `^${blockLabel.get(su.block)}(${su.block.params.map((p) => rec?.get(p) ?? '-').join(', ')})`)
+            .join(' ');
+      }
       lines.push(s);
     }
   }

package/src/ir/simplify.ts

@@ -51,11 +51,11 @@ export function simplifyTrivialPhis(fn: Fn, onRemoved?: (param: Value) => void):
       const incoming = edgesTo(b);
       for (let i = b.params.length - 1; i >= 0; i--) {
         const param = b.params[i];
-        const distinct = [...new Set(incoming.map((s) => s.args[i]).filter((v) => v !== param))];
-        if (distinct.length !== 1) {
+        const collapsed = trivialPhiValue(incoming, i, param);
+        if (collapsed === null) {
           continue; // a genuine join, or unreachable (no in-edges at all)
         }
-        replaceAllUsesWith(fn, param, distinct[0]);
+        replaceAllUsesWith(fn, param, collapsed);
         onRemoved?.(param);
         b.params.splice(i, 1);
         for (const s of incoming) {
@@ -70,3 +70,190 @@ export function simplifyTrivialPhis(fn: Fn, onRemoved?: (param: Value) => void):
     }
   }
 }
+
+/** The ONE value block param `i` collapses to — the value every in-edge passes it, ignoring a
+ *  back edge's self-reference — or null when it is a genuine join (two distinct values) or the
+ *  block is unreachable (no in-edges at all). THE trivial-phi predicate, shared by the mutating
+ *  fixpoint and the non-mutating check below so the two cannot come to disagree about which params
+ *  are trivial.
+ *
+ *  `=== null` IS THE ONLY SAFE TEST. A genuine collapse value is never null, but it CAN be
+ *  `undefined` where an edge carries fewer args than the block has params — a malformed graph the
+ *  verifier catches elsewhere, and one today's callers pass straight through rather than treat as
+ *  "not trivial". A truthiness test would silently change that.
+ */
+function trivialPhiValue(incoming: readonly Successor[], i: number, param: Value): Value | null {
+  const distinct = [...new Set(incoming.map((s) => s.args[i]).filter((v) => v !== param))];
+  return distinct.length === 1 ? distinct[0] : null;
+}
+
+/**
+ * "Is there a block parameter `simplifyTrivialPhis` would remove?" — the same predicate, asked
+ * without mutating. Returns the first such param and its block, or null.
+ *
+ * A BOUNDARY postcondition rather than an IR invariant, which is why `ir/verify.ts` is the wrong
+ * home for it: a trivial phi is well-formed IR, and two places mint one deliberately and clear it
+ * within their own scope — Braun's construction in `frontend/ssa.ts`, and the `addrnum`
+ * pre-recovery pass, whose numbering half leaves one for its own cleanup half. What no pass may do
+ * is leave one STANDING once the CFG stops moving (pipeline.ts `raiseRecovered`), because from
+ * there down the structurer reads a block parameter as a JOIN and gives it a local of its own.
+ * That is how a CFG-motion pass does its damage three stages away: `raise/retsink.ts` stranded a
+ * single-predecessor merge, the structurer spelled its alias as `v0 = 0; return v0;`, and Regime-A
+ * switch recovery read the block as a SECOND `default` candidate and declined every fall-through
+ * tree over it.
+ */
+export function firstTrivialPhi(fn: Fn): { block: Block; param: Value } | null {
+  // ONE pass over the successor edges, indexed by target — `simplifyTrivialPhis` rescans the
+  // whole function per block, which is fine for a mutating fixpoint and not for a check on the
+  // raising tower's hot path (a candidate fan re-raises the same function once per lift variant).
+  const incomingOf = new Map<Block, Successor[]>();
+  for (const pb of fn.blocks) {
+    for (const op of pb.ops) {
+      for (const s of op.successors) {
+        const prev = incomingOf.get(s.block);
+        if (prev) {
+          prev.push(s);
+        } else {
+          incomingOf.set(s.block, [s]);
+        }
+      }
+    }
+  }
+  for (const b of fn.blocks) {
+    if (b === fn.blocks[0]) {
+      continue;
+    }
+    const incoming = incomingOf.get(b) ?? [];
+    for (let i = 0; i < b.params.length; i++) {
+      const param = b.params[i];
+      if (trivialPhiValue(incoming, i, param) !== null) {
+        return { block: b, param };
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * Remove block params NOTHING READS. Their edge args are dropped with them, so a dead join value
+ * never surfaces downstream: left in place, the structurer dutifully materializes copies for it
+ * on every in-edge (`a3 = v0` after a loop whose counter nobody consumes), and gates keyed on
+ * "does this exit carry anything" see cargo that is not there.
+ *
+ * A read is an OP OPERAND. An edge arg is not one in itself — it forwards a value into a slot, and
+ * that is a read exactly when the slot is live — so liveness is a LEAST FIXPOINT seeded by the op
+ * operands and grown backwards along the edges. Asking instead "does any arg mention it" is what a
+ * per-round reader scan does, and it keeps a mutually-dead CYCLE alive forever: two params feeding
+ * only each other across blocks each count as the other's reader. Such a cycle is what the
+ * frontend's on-demand construction mints around a loop for a register left holding a stale value,
+ * and it is not inert — `raise/struct-arrays.ts` refuses an element pointer that reaches a block
+ * arg, so a dead ring around one costs the struct view of an array it has a single real use of.
+ *
+ * Still conservative in one direction: a param a real op operand reads survives, however dead that
+ * op later proves. Liveness is over the IR as it stands, and op-level DCE belongs to
+ * `pattern/engine.ts`.
+ *
+ * THAT MAKES TWO LIVENESS MODELS OVER ONE GRAPH, and they now DISAGREE about the same edge.
+ * `pattern/engine.ts`'s `dce` still counts every successor arg as a use unconditionally — the rule
+ * abandoned here — and it runs after every changing pre-recovery pass where this runs once, inside
+ * the frontend's `finish()`. The disagreement is one-sided and safe: `dce` is the COARSER of the
+ * two, so it only ever keeps an op this would have let go, never the reverse. Reach today is ZERO
+ * and that is measured rather than argued — re-running this fixpoint over the 458 klonoa functions
+ * that clear the frontend, at three checkpoints (straight after the lift, after the idiom fold and
+ * after type recovery), removes 0 further params at every one. Booked here so a future round that
+ * finds a nonzero reads it as the known divergence rather than a new discovery.
+ *
+ * THE ENTRY BLOCK IS NEVER TOUCHED — its params are the function's signature, and an argument the
+ * body ignores is still an argument (frontend/ssa.ts `ensureParam` creates exactly those on
+ * purpose). They are therefore seeded LIVE rather than merely skipped: an entry block that is also
+ * a loop header has in-edges, and a slot that is kept has to keep whatever feeds it defined. A
+ * function with no blocks has no entry and no params, and is a no-op rather than a throw — this
+ * runs mid-construction, ahead of the verifier that rejects such a graph.
+ * Returns how many were removed.
+ */
+export function pruneDeadParams(fn: Fn, onRemoved?: (param: Value) => void): number {
+  // Liveness travels BACKWARD — from a live slot to the args feeding it — so it is driven off a
+  // WORKLIST over an inverted edge index, not by re-sweeping the graph until a round adds nothing.
+  // Round-robin over `fn.blocks` in forward order advances one hop per round along a chain of
+  // block params, which is quadratic in the chain length. The worklist is linear in
+  // (values + edge args) whatever the block order, and it matters because this is shared L1
+  // substrate that runs once per lift on every ISA. Nothing in the corpus reaches the shape today
+  // — the largest klonoa function that lifts at all is 107 blocks — but that ceiling is a property
+  // of what this frontend currently accepts (274 of the checkout's 732 `.s` decline), not of the
+  // game's code, so `test/dead-params.test.ts` budgets both halves against `parse` of the same
+  // text.
+  //
+  // `edgesTo` is the same index the removal pass needs, so it is built ONCE for both: without it
+  // each removed param re-walks every op in the function.
+  const edgesTo = new Map<Block, Successor[]>();
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      for (const s of op.successors) {
+        const list = edgesTo.get(s.block);
+        if (list === undefined) {
+          edgesTo.set(s.block, [s]);
+        } else {
+          list.push(s);
+        }
+      }
+    }
+  }
+  // Which args feed a given slot. Keyed by the PARAM value (identity is the graph's own), so a
+  // slot that becomes live hands back exactly the values that flow into it.
+  const feeders = new Map<Value, Value[]>();
+  for (const b of fn.blocks) {
+    b.params.forEach((slot, i) => {
+      const args = (edgesTo.get(b) ?? []).map((s) => s.args[i]).filter((a): a is Value => a !== undefined);
+      if (args.length > 0) {
+        feeders.set(slot, (feeders.get(slot) ?? []).concat(args));
+      }
+    });
+  }
+
+  const live = new Set<Value>();
+  const work: Value[] = [];
+  const mark = (v: Value): void => {
+    if (!live.has(v)) {
+      live.add(v);
+      work.push(v);
+    }
+  };
+  for (const p of fn.blocks[0]?.params ?? []) {
+    mark(p);
+  }
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      for (const v of op.operands) {
+        mark(v);
+      }
+    }
+  }
+  for (let v = work.pop(); v !== undefined; v = work.pop()) {
+    for (const a of feeders.get(v) ?? []) {
+      mark(a);
+    }
+  }
+
+  // One removal pass suffices: `live` is the fixpoint over the whole graph, so dropping the slots
+  // outside it cannot make a surviving slot dead, and the args it drops were feeding dead slots.
+  let removed = 0;
+  for (const b of fn.blocks) {
+    if (b === fn.blocks[0]) {
+      continue;
+    }
+    const incoming = edgesTo.get(b) ?? [];
+    for (let i = b.params.length - 1; i >= 0; i--) {
+      const param = b.params[i];
+      if (live.has(param)) {
+        continue;
+      }
+      onRemoved?.(param);
+      b.params.splice(i, 1);
+      for (const s of incoming) {
+        s.args.splice(i, 1);
+      }
+      removed++;
+    }
+  }
+  return removed;
+}

package/src/ir/struct-names.ts

@@ -0,0 +1,42 @@
+// THE STRUCT-NAME ALLOCATOR, in one place because there are three minters of synthesized struct
+// names (raise/structs.ts `Struct<N>`, raise/struct-arrays.ts `Elem<N>`, l3/offmember.ts `Off<N>`)
+// and each had rolled its own scan, at two different strengths.
+//
+// `l3/hoist.ts`'s header states the rule for LOCALS — "every pass that mints a local takes
+// `nameAllocator` (or `takenNames`, to number its own)". This is that rule for structs.
+//
+// THE CONTRACT IS MONOTONE, never first-free: the next index is past EVERY taken one. Skipping a
+// CONTIGUOUS PREFIX is a weaker guarantee than being free — a set holding `Off0` and `Off2` stops
+// a first-free walk at 1, and the name minted after it is `Off2` again, one layout declared twice
+// under one name, which is invisible in the tree (`structs` is a list, not a map) and surfaces
+// either as a compile error or, through a name-deduping consumer, as one access reading another
+// layout's member. That is the class of silent loss PR #127 named for `localNames`.
+//
+// AND AT THE Elem AND Off CALL SITES THE SEED IS 0. Measured, not assumed: instrumenting both and
+// lifting every corpus function gives 1498 `Elem` seeds and 1417 `Off` seeds map-less, 417 and 398
+// map-ful, all zero. Each of those two prefixes has exactly one minter and each minter runs once
+// per function (raise/pre-recovery.ts is a linear pass list, `/offmember` a single respell), so no
+// tree either one is handed can already carry its own prefix.
+//
+// THE `Struct` PREFIX IS THE COUNTER-EXAMPLE, and it is why the contract is not simply "return 0":
+// TWO passes mint it, raise/memberarrays.ts ahead of raise/structs.ts in the pre-recovery list, so
+// the second is routinely handed a graph already carrying the first's `Struct<N>` types and seeds
+// past them (its own note at the seeding site says so).
+//
+// THAT IS NOT THE SAME AS A GUARD WITH NO INHABITANT, and the difference is why this is kept
+// where such a guard is not. A refusal with no inhabitant still asserts a hazard, and starts
+// deleting candidates the day its predicate widens; an allocator with no taken name is the
+// IDENTITY — it returns the same 0 a hand-rolled counter returns. What it buys is that the 0 is a
+// computed fact rather than a caller invariant nothing checks. The price is one scan of the taken
+// names per call, which at the `Elem` site is a type-graph walk.
+export function nextStructIndex(taken: Iterable<string>, prefix: string): number {
+  const re = new RegExp(`^${prefix}(\\d+)$`);
+  let next = 0;
+  for (const name of taken) {
+    const m = re.exec(name);
+    if (m) {
+      next = Math.max(next, Number(m[1]) + 1);
+    }
+  }
+  return next;
+}