@asmlift/core 0.5.0 → 0.6.0

package/src/l3/pollguard.ts

@@ -0,0 +1,154 @@
+// L3 poll-shape re-spelling levers: `pollGuards` regrows an empty bottom-tested loop's guard;
+// `pollReads` folds a materialized poll's re-read back into its while condition. Each carries
+// its own trace argument below.
+//
+//     do { } while (dma[2] & 0x80000000);   →   if (dma[2] & 0x80000000) { do { } while (…); }
+//
+// For an empty body the two forms compile to the SAME instructions — gcc collapses the guard
+// into the bottom test late (jump optimization), AFTER flow has counted the guard's reads — so
+// the choice leaves no instruction trace, only a register-allocation ripple: the extra
+// source-level read raises the condition operands' ref counts, which re-orders the allocator's
+// priorities for the WHOLE function (the busy-wait's base landing in a low reg vs `ip`). Which
+// form the source spelled is unrecoverable from the bytes; both are emitted and the differ
+// referees.
+//
+// SCOPE (decline over approximate): only a `dowhile` with an EMPTY body regrows a guard —
+// there the two forms have IDENTICAL evaluation traces (each evaluates the condition until its
+// first falsy result; the regrown guard IS the first bottom-test, not an extra one), so
+// volatile reads, calls, any effect in the condition all count the same. A NON-empty body is
+// where the forms genuinely differ (the body runs at least once vs at least zero times), which
+// is why it never wraps. Declines (null) when no empty do-while exists.
+import type { Expr, SFn, Stmt } from './ast';
+import { exprChildren, exprEquals, mapExprChildren, mapStmtLists, stmtChildren, stmtExprs } from './ast';
+
+export function pollGuards(sfn: SFn): SFn | null {
+  let changed = false;
+  const rewrite = (s: Stmt): Stmt => {
+    if (s.k === 'dowhile' && s.body.length === 0) {
+      changed = true;
+      return { k: 'if', cond: s.cond, then: [s], else: [] };
+    }
+    return mapStmtLists(s, (list) => list.map(rewrite));
+  };
+  const body = sfn.body.map(rewrite);
+  return changed ? { ...sfn, body } : null;
+}
+
+// L3 re-spelling lever: a materialized POLL re-reads in its own condition.
+//
+//     v = dma[2]; while ((v & BUSY) != 0) { v = dma[2]; }   →   while ((dma[2] & BUSY) != 0) {}
+//
+// The structurer materializes a loop-carried load into a named temp with a pre-loop read and a
+// per-iteration re-read; the source may have spelled the read INSIDE the condition of an
+// empty-bodied `while`. The two forms have IDENTICAL evaluation traces — the old form reads once
+// before plus once per iteration, the new form reads once per condition evaluation, and both
+// count 1 + iterations — so volatile reads COUNT the same; the condition gates below (call-free,
+// no volatile-rooted or raw derefs) are what make the ORDER identical too: with no other
+// observable effect in the condition, there is nothing for the embedded read to reorder against.
+// What differs is bytes: the pre-read + temp spelling materializes an extra register and
+// instruction the in-condition spelling does not.
+//
+// SCOPE (decline over approximate): each admission is one named predicate below and carries its own
+// refusal's reason; the temp must additionally be the function's OWN non-volatile LOCAL, because a
+// bare global's assigns are stores other code observes and its declaration cannot be dropped.
+// Declines (null) when no poll matches.
+const countVar = (e: Expr, n: string): number =>
+  (e.k === 'var' && e.name === n ? 1 : 0) + exprChildren(e).reduce((a, c) => a + countVar(c, n), 0);
+
+const countAddr = (e: Expr, n: string): number =>
+  (e.k === 'addr' && e.name === n ? 1 : 0) + exprChildren(e).reduce((a, c) => a + countAddr(c, n), 0);
+
+/** call- and marker-free: no effect the fold could move or duplicate. */
+const pure = (e: Expr): boolean => e.k !== 'call' && e.k !== 'marker' && exprChildren(e).every(pure);
+
+/** The var a deref's base stands on, through casts only — null for anything else (a raw address, an
+ *  arithmetic base), which is exactly the set `condDerefsPlain` refuses. */
+const rootVar = (e: Expr): string | null => (e.k === 'var' ? e.name : e.k === 'cast' ? rootVar(e.e) : null);
+
+/** ORDER-safety for the condition's other reads: a deref there must be rooted at a var declared
+ *  non-volatile — a volatile-rooted or raw-address deref is (or may be) an OBSERVABLE read the
+ *  fold would unsequence against X inside one expression, where the original sequenced them. */
+const condDerefsPlain = (e: Expr, volatileLocals: ReadonlySet<string>): boolean => {
+  if (e.k === 'index' || e.k === 'field') {
+    const rv = rootVar(e.base);
+    if (rv === null || volatileLocals.has(rv)) {
+      return false;
+    }
+  }
+  return exprChildren(e).every((c) => condDerefsPlain(c, volatileLocals));
+};
+
+/** Every mention of `n` in a statement list — reads, `&n`, and assign targets, at any depth. */
+const occurs = (list: Stmt[], n: string): number =>
+  list.reduce(
+    (a, st) =>
+      a +
+      stmtExprs(st).reduce((x, e) => x + countVar(e, n) + countAddr(e, n), 0) +
+      (st.k === 'assign' && st.name === n ? 1 : 0) +
+      occurs(stmtChildren(st), n),
+    0,
+  );
+
+/** The loop body must be EXACTLY the one re-read: a single assign of the same variable to the same
+ *  expression. Any other statement there is one the fold would delete along with the loop's body. */
+const bodyIsTheSoleReread = (w: Extract<Stmt, { k: 'while' }>, a: Extract<Stmt, { k: 'assign' }>): boolean =>
+  w.body.length === 1 && w.body[0].k === 'assign' && w.body[0].name === a.name && exprEquals(w.body[0].value, a.value);
+
+/** The condition must read the variable EXACTLY once, as a bare var: a second read would double X's
+ *  per-iteration evaluation, and an `&v` is not a read at all and cannot be substituted. */
+const condReadsVarOnce = (cond: Expr, n: string): boolean => countVar(cond, n) === 1 && countAddr(cond, n) === 0;
+
+/** X must not mention the variable it is assigned to — the folded form evaluates X in a condition
+ *  where that variable no longer exists. */
+const valueIsSelfFree = (value: Expr, n: string): boolean => countVar(value, n) === 0 && countAddr(value, n) === 0;
+
+/** The condition carries no effect and no observable read of its own, which is what makes the
+ *  embedded X unsequenceable against anything: call/marker-free, every deref `condDerefsPlain`. */
+const condFoldable = (cond: Expr, volatileLocals: ReadonlySet<string>): boolean =>
+  pure(cond) && condDerefsPlain(cond, volatileLocals);
+
+/** The pattern owns EVERY occurrence of the variable: both assign targets and the one condition
+ *  read, three in all, counted over the whole function and counting `&v`. Its declaration is dropped
+ *  with the temp, so anything else mentioning it would be left naming a variable that is gone. */
+const ownsEveryOccurrence = (body: Stmt[], n: string): boolean => occurs(body, n) === 3;
+
+export function pollReads(sfn: SFn): SFn | null {
+  const ownPlain = new Set(
+    sfn.locals.filter((l) => l.volatile !== true && l.pointeeVolatile !== true).map((l) => l.name),
+  );
+  const volatileLocals = new Set(
+    sfn.locals.filter((l) => l.volatile === true || l.pointeeVolatile === true).map((l) => l.name),
+  );
+  const subst = (e: Expr, n: string, x: Expr): Expr =>
+    e.k === 'var' && e.name === n ? x : mapExprChildren(e, (c) => subst(c, n, x));
+  const dropped = new Set<string>();
+  const rewriteList = (list: Stmt[]): Stmt[] => {
+    const out: Stmt[] = [];
+    for (let i = 0; i < list.length; i++) {
+      const a = list[i];
+      const w = list[i + 1];
+      if (
+        a.k === 'assign' &&
+        ownPlain.has(a.name) &&
+        w !== undefined &&
+        w.k === 'while' &&
+        bodyIsTheSoleReread(w, a) &&
+        condReadsVarOnce(w.cond, a.name) &&
+        valueIsSelfFree(a.value, a.name) &&
+        pure(a.value) &&
+        condFoldable(w.cond, volatileLocals) &&
+        ownsEveryOccurrence(sfn.body, a.name)
+      ) {
+        out.push({ k: 'while', cond: subst(w.cond, a.name, a.value), body: [] });
+        dropped.add(a.name);
+        i++;
+        continue;
+      }
+      out.push(recurse(a));
+    }
+    return out;
+  };
+  const recurse = (s0: Stmt): Stmt => mapStmtLists(s0, rewriteList);
+  const body = rewriteList(sfn.body);
+  return dropped.size > 0 ? { ...sfn, body, locals: sfn.locals.filter((l) => !dropped.has(l.name)) } : null;
+}

package/src/l3/ptrfield.ts

@@ -0,0 +1,227 @@
+// L3 re-spelling lever: declare a recovered WORD field a POINTER (`void *field_4;` rather than
+// `s32 field_4;`), and cast at each read.
+//
+// raise/structs.ts recovers a field's type from the ACCESS WIDTH alone — a 4-byte load is `s32`,
+// because that is all a load says. On a 32-bit target `void *` fits the same evidence exactly:
+// the two spellings load the same word with the same instruction, so the asm cannot referee them
+// and the struct recovery's own byte-neutrality note applies to the field TYPE as much as to the
+// `->field_N` vs `[idx]` question it was written about.
+//
+// IT IS NOT NEUTRAL TO THE COMPILER, which is the whole reason to spell it. A pointer and an `s32`
+// are different alias sets, so under strict aliasing the loop optimizer may hoist a pointer field's
+// load past an `s32`-typed store it must otherwise keep behind — and on synthetic:dmaptrsrc that
+// hoist is the difference between a byte-exact match and a 35-point diff, once the accumulator is
+// un-reduced back into the loop (that row's fan: `/vol-store/unreduce/ptr-field` 0,
+// `/vol-store/unreduce` 35). Which side matches is per-field knowledge nothing in the asm
+// carries, so both are enumerated and the differ referees.
+//
+// WHERE THE FLAG IS, because two readers have now looked for `-fstrict-aliasing` in the benchmark's
+// agbcc line and not found it: it is not there, and it does not need to be. `-O2` turns it on
+// (gcc 2.9 sets `flag_strict_aliasing` from `optimize >= 2`), which is why the CITATION is a
+// behaviour rather than a flag. Verified in BOTH directions on this row's own shape, objects
+// compared byte-for-byte:
+//     `void *` field, harness flags        → the field load is HOISTED above the loop label
+//     `s32`    field, harness flags        → it STAYS in the loop body
+//     `void *` field, + -fno-strict-aliasing → byte-IDENTICAL to the `s32` build
+//     `s32`    field, + -fstrict-aliasing    → byte-IDENTICAL to itself (the flag was already on)
+// So adding the flag proves nothing and REMOVING it proves everything, which is the direction a
+// reader checking this note should take. The stores the load is hoisted past are the loop's own
+// `*(volatile s32 *)0x040000D4/D8/DC` device writes — `volatile` restricts what may be done with
+// THOSE accesses and does not merge their type into the pointer's alias set.
+//
+// SEMANTICS ARE PRESERVED BY CONSTRUCTION on a target whose pointers are 32 bits: the declaration
+// changes, and every read is wrapped in a cast back to the field's own recovered integer type, so
+// each use computes the same value it did. Nothing else moves. THE 32-BIT ASSUMPTION IS ASSERTED,
+// NOT CHECKED — there is no pointer-width field on TargetDescription to check it against, and the
+// assumption is already tower-wide (`l3/typing.ts`'s `ptrElemBytes` returns 4 for any pointee). On
+// a 64-bit target this lever would change a struct's LAYOUT rather than only its spelling, so the
+// width field is what that target's first row must add, and this note is where to start.
+//
+// IT FLIPS EVERY ADMITTED FIELD AT ONCE, and its own paragraph above says the knowledge is
+// PER-FIELD — so the subset enumeration `l3/volatileptr.ts` does for exactly this reason
+// (`volatileSubsetCandidates`, capped at three locals) is the shape this lever will eventually
+// want. It is not built yet because nothing demands it: swept over 834 corpus trees, the lever
+// fires on 42, and 34 of those have a single admitted field. The six 2-field trees and the two
+// 4-field ones (`sa3:sa2__sub_8083504` flips Struct0.field_8/12 and Struct2.field_8/12 together)
+// are where 1 of 3 and 1 of 15 non-empty subsets is reachable. A row that needs one of the missing
+// subsets is what earns the enumeration — and it will cost candidates, which is why "it might
+// help" is not enough.
+//
+// GATE (PTR_FIELD_GATES, read once per field): the field's recovered type must be a 32-bit
+// integer; it must never be a store LVALUE (the write side would need a cast on the value, which
+// is a second question); and it must never stand as the BASE of another access (a field the tree
+// already dereferences is one the recovery typed from its own use, not from a width). Nothing
+// qualifying ⇒ decline (null).
+//
+// SCOPE, because both of this table's blind spots look exactly like a gate refusing. First, THERE
+// IS NO PAD RULE, deliberately: `plan` builds a ctx only for fields the tree ACCESSES, so "a field
+// nothing reaches" cannot arise — and a rule for it reads as one, then answers for the 78 corpus
+// WRITE-ONLY fields that `written` owns. Second, a field whose
+// BASE TYPE does not resolve is dropped by `plan` before any gate reads it — 151 of the corpus's
+// 820 field nodes, on 20 trees, all of them `[map]` configurations (kleod:CheckTileCollisionVertical,
+// FreeAllDecompBuffers, TransformSingleEntityToScreen and ConfigureEntityBehavior among them).
+// Declining there is right; being unable to say which of the two happened is the defect.
+import { type IrType, T } from '../ir/types';
+import {
+  type Expr,
+  type SFn,
+  type Stmt,
+  type StructType,
+  mapExprChildren,
+  mapStmtExprs,
+  stmtChildren,
+  walkExprs,
+} from './ast';
+import { type Gate, firstRejection } from './gates';
+import { declaredTypes, exprCType } from './typing';
+
+/** One recovered field as the gates read it — built only for fields the tree accesses. */
+interface FieldCtx {
+  /** the recovered type is a 32-bit integer — the width a pointer also fits */
+  word: boolean;
+  written: boolean;
+  /** the field's value stands as the base of an `index` or another `field` */
+  dereferenced: boolean;
+}
+
+export const PTR_FIELD_GATES: readonly Gate<FieldCtx>[] = [
+  {
+    id: 'not-word',
+    why: 'only a word-wide field fits a pointer as well as it fits an integer',
+    sound: true,
+    guardedBy: 'ptrfield.test.ts: a halfword field declines',
+    rejects: (c) => !c.word,
+  },
+  {
+    id: 'written',
+    why: 'the write side needs a cast on the stored value, which is a separate question',
+    sound: true,
+    guardedBy: 'ptrfield.test.ts: a field the tree stores through declines',
+    rejects: (c) => c.written,
+  },
+  {
+    id: 'dereferenced',
+    why: 'a field the tree already dereferences was typed from its use, not from a width',
+    sound: true,
+    guardedBy: 'ptrfield.test.ts: a field standing as an access base declines',
+    rejects: (c) => c.dereferenced,
+  },
+];
+
+/** the struct a `field` node selects from, or null */
+function structOf(base: Expr, vt: ReturnType<typeof declaredTypes>): Extract<IrType, { kind: 'struct' }> | null {
+  const t = exprCType(base, vt);
+  const st = t?.kind === 'ptr' ? t.to : t;
+  return st?.kind === 'struct' ? st : null;
+}
+
+/** `<struct>.<field>` as one key — two structs may both carry a `field_4`. */
+const keyOf = (structName: string, field: string): string => `${structName}.${field}`;
+
+/** The fields PTR_FIELD_GATES admits, keyed by struct and name, each with the integer type its
+ *  reads cast back to. */
+function plan(sfn: SFn): Map<string, IrType> {
+  const vt = declaredTypes(sfn);
+  const seen = new Map<string, FieldCtx & { type: IrType }>();
+  const note = (base: Expr, name: string, edit: (c: FieldCtx) => void): void => {
+    const st = structOf(base, vt);
+    const declared = st?.fields.find((f) => f.name === name)?.type;
+    if (st === null || declared === undefined) {
+      return;
+    }
+    const key = keyOf(st.name, name);
+    const cur = seen.get(key) ?? {
+      word: declared.kind === 'int' && declared.width === 32,
+      written: false,
+      dereferenced: false,
+      type: declared,
+    };
+    edit(cur);
+    seen.set(key, cur);
+  };
+  for (const e of walkExprs(sfn.body)) {
+    if (e.k === 'field') {
+      note(e.base, e.name, () => {});
+    }
+    // a field standing as an access base is one the recovery typed from its own use
+    const inner = e.k === 'index' ? e.base : e.k === 'field' ? e.base : null;
+    if (inner?.k === 'field') {
+      note(inner.base, inner.name, (c) => (c.dereferenced = true));
+    }
+  }
+  for (const s of stores(sfn.body)) {
+    if (s.lval.k === 'field') {
+      note(s.lval.base, s.lval.name, (c) => (c.written = true));
+    }
+  }
+  const out = new Map<string, IrType>();
+  for (const [key, ctx] of seen) {
+    if (firstRejection(PTR_FIELD_GATES, ctx) === null) {
+      out.set(key, ctx.type);
+    }
+  }
+  return out;
+}
+
+/** Every `store` in the tree. ORDER-FREE by construction, which is what lets it use the shared
+ *  `stmtChildren` (a switch's default sits at `defaultAt`, not last): its one caller only sets
+ *  `written` on entries the preceding `walkExprs` pass already created — `note` builds an entry
+ *  from the DECLARED field type, a function of the key alone, so this loop mints no key. */
+function* stores(body: readonly Stmt[]): Generator<Extract<Stmt, { k: 'store' }>> {
+  for (const s of body) {
+    if (s.k === 'store') {
+      yield s;
+    }
+    yield* stores(stmtChildren(s));
+  }
+}
+
+/** The `/ptr-field` candidate, or null when no field qualifies. Read-only: returns a fresh SFn.
+ *
+ *  The struct type appears TWICE in a tree — inline in each `(struct S *)` cast and again in
+ *  `SFn.structs`, which is what a backend prints — so both are re-typed here. Letting them drift
+ *  would print a declaration the expressions' own types contradict. */
+export function pointerFields(sfn: SFn): SFn | null {
+  const admitted = plan(sfn);
+  if (admitted.size === 0) {
+    return null;
+  }
+  const flipStruct = <S extends { name: string; fields: { name: string; type: IrType }[] }>(st: S): S => ({
+    ...st,
+    fields: st.fields.map((f) => (admitted.has(keyOf(st.name, f.name)) ? { ...f, type: T.ptr(T.void()) } : f)),
+  });
+  const flip = (t: IrType): IrType => {
+    switch (t.kind) {
+      case 'struct':
+        return flipStruct(t);
+      case 'ptr':
+        return T.ptr(flip(t.to));
+      case 'array':
+        return T.array(flip(t.elem), t.count);
+      default:
+        return t;
+    }
+  };
+  const vt = declaredTypes(sfn);
+  const sub = (e: Expr): Expr => {
+    if (e.k === 'field') {
+      const st = structOf(e.base, vt);
+      const back = st === null ? undefined : admitted.get(keyOf(st.name, e.name));
+      const inner = mapExprChildren(e, sub);
+      return back === undefined ? inner : { k: 'cast', to: back, e: inner };
+    }
+    const m = mapExprChildren(e, sub);
+    return m.k === 'cast' ? { ...m, to: flip(m.to) } : m;
+  };
+  return {
+    ...sfn,
+    params: sfn.params.map((p) => ({ ...p, type: flip(p.type) })),
+    locals: sfn.locals.map((l) => ({ ...l, type: flip(l.type) })),
+    ...(sfn.globals ? { globals: sfn.globals.map((g) => ({ ...g, type: flip(g.type) })) } : {}),
+    ...(sfn.structs ? { structs: sfn.structs.map((s): StructType => flipStruct(s)) } : {}),
+    // `mapStmtExprs` already recurses into nested statement lists, so ONE call per top-level
+    // statement rewrites the whole subtree — a second walk over its children would apply `sub`
+    // twice and cast each read back to an integer twice over.
+    body: sfn.body.map((s) => mapStmtExprs(s, sub)),
+  };
+}

package/src/l3/regspell.ts

@@ -117,9 +117,106 @@ function isConstExpr(e: Expr): boolean {
   }
 }
 
-/** Apply the register-copy re-spelling. Returns 0–2 variant SFns (without/with the R3 tail);
- *  empty when nothing fired. Pure — never mutates the input. */
-export function registerishSpellings(sfn: SFn): SFn[] {
+/** ONE R3 TAIL, NAMED BY WHAT IT DID rather than by where it landed in the list.
+ *
+ *  The tail is the assign-back before the `return`, and there are two spellings of it: reuse R1's
+ *  now-dead value var, or take a fresh one. R1 may not have fired, in which case there is no dead
+ *  var and only the fresh spelling exists — so the tails are a 1- OR 2-element list and the SECOND
+ *  spelling is not at a fixed index.
+ *
+ *  This field exists because the caller labels these, and a label is the instrument every census
+ *  in this repo reads (it is a `bench diff` FIELD). Index a `['/regcopy', '/regcopy-ret',
+ *  '/regcopy-ret-fresh']` table by POSITION instead and an R1-less function publishes its fresh
+ *  tail as `/regcopy-ret` — the dead-var-reuse name on the spelling that has no dead var to reuse
+ *  — and a census over the token `/regcopy-ret-fresh` then censuses nothing wherever R1 declines,
+ *  which is most of the corpus. */
+export type RegcopyTail = 'none' | 'reuse' | 'fresh';
+
+export interface RegcopySpelling {
+  /** which R3 tail this variant carries — `none` is the un-tailed base */
+  tail: RegcopyTail;
+  sfn: SFn;
+}
+
+interface Diamond {
+  v: string;
+  E: Expr;
+  updArm: 'then' | 'else';
+  upd: Expr;
+  cond: Expr;
+}
+/** `if (cmp) { v = E } else { v = f(E) }` (or arms swapped), f = bin(E, const-ish). */
+function matchDiamond(s: Extract<Stmt, { k: 'if' }>): Diamond | null {
+  if (s.then.length !== 1 || s.else.length !== 1) {
+    return null;
+  }
+  const a = s.then[0];
+  const b = s.else[0];
+  if (a.k !== 'assign' || b.k !== 'assign' || a.name !== b.name) {
+    return null;
+  }
+  const isUpdOf = (upd: Expr, base: Expr): boolean =>
+    upd.k === 'bin' && isPure(upd.r) && exprEq(upd.l, base) && isConstExpr(upd.r);
+  if (isUpdOf(b.value, a.value)) {
+    return { v: a.name, E: a.value, updArm: 'else', upd: b.value, cond: s.cond };
+  }
+  if (isUpdOf(a.value, b.value)) {
+    return { v: a.name, E: b.value, updArm: 'then', upd: a.value, cond: s.cond };
+  }
+  return null;
+}
+/** Does the cond's NON-E operand mention `v`? (The E side becomes the copy; the other side
+ *  must be v-free or the hoisted assignment changes what it compares against.) */
+function condOtherMentions(cond: Expr, E: Expr, v: string): boolean {
+  if (cond.k !== 'bin') {
+    return false;
+  }
+  const other = exprEq(cond.l, E) ? cond.r : exprEq(cond.r, E) ? cond.l : null;
+  const mentions = (e: Expr): boolean => {
+    if (e.k === 'var') {
+      return e.name === v;
+    }
+    let hit = false;
+    mapExprChildren(e, (c) => {
+      hit = hit || mentions(c);
+      return c;
+    });
+    return hit;
+  };
+  return other ? mentions(other) : false;
+}
+/** cond compares E against a pure operand → same comparison reading the named var. */
+function rewriteCond(cond: Expr, E: Expr, name: string): Expr | null {
+  if (cond.k !== 'bin' || !(cond.op in FLIP)) {
+    return null;
+  }
+  if (exprEq(cond.l, E) && isPure(cond.r)) {
+    return { k: 'bin', op: cond.op, l: { k: 'var', name }, r: cond.r };
+  }
+  if (exprEq(cond.r, E) && isPure(cond.l)) {
+    return { k: 'bin', op: cond.op, l: cond.l, r: { k: 'var', name } };
+  }
+  return null;
+}
+function flipCmp(cond: Expr): Expr | null {
+  if (cond.k !== 'bin') {
+    return null;
+  }
+  const op = FLIP[cond.op];
+  return op ? { k: 'bin', op: op as Extract<Expr, { k: 'bin' }>['op'], l: cond.l, r: cond.r } : null;
+}
+/** in `upd`, the occurrence of subtree E replaced by var `name` (E was just assigned to it). */
+function renameSubexpr(e: Expr, E: Expr, name: string): Expr {
+  if (exprEq(e, E)) {
+    return { k: 'var', name };
+  }
+  return mapExprChildren(e, (c) => renameSubexpr(c, E, name));
+}
+
+/** Apply the register-copy re-spelling. Returns 0–3 variants — the base, plus the R3 tail in each
+ *  spelling that exists (reuse needs R1 to have fired, fresh always does) — and an EMPTY list when
+ *  nothing fired. Pure — never mutates the input. */
+export function registerishSpellings(sfn: SFn): RegcopySpelling[] {
   const locals = [...sfn.locals];
   const taken = new Set([...sfn.params, ...sfn.locals].map((x) => x.name));
   let fresh = 0;
@@ -188,81 +285,6 @@ export function registerishSpellings(sfn: SFn): SFn[] {
     return out;
   };
 
-  interface Diamond {
-    v: string;
-    E: Expr;
-    updArm: 'then' | 'else';
-    upd: Expr;
-    cond: Expr;
-  }
-  /** `if (cmp) { v = E } else { v = f(E) }` (or arms swapped), f = bin(E, const-ish). */
-  function matchDiamond(s: Extract<Stmt, { k: 'if' }>): Diamond | null {
-    if (s.then.length !== 1 || s.else.length !== 1) {
-      return null;
-    }
-    const a = s.then[0];
-    const b = s.else[0];
-    if (a.k !== 'assign' || b.k !== 'assign' || a.name !== b.name) {
-      return null;
-    }
-    const isUpdOf = (upd: Expr, base: Expr): boolean =>
-      upd.k === 'bin' && isPure(upd.r) && exprEq(upd.l, base) && isConstExpr(upd.r);
-    if (isUpdOf(b.value, a.value)) {
-      return { v: a.name, E: a.value, updArm: 'else', upd: b.value, cond: s.cond };
-    }
-    if (isUpdOf(a.value, b.value)) {
-      return { v: a.name, E: b.value, updArm: 'then', upd: a.value, cond: s.cond };
-    }
-    return null;
-  }
-  /** Does the cond's NON-E operand mention `v`? (The E side becomes the copy; the other side
-   *  must be v-free or the hoisted assignment changes what it compares against.) */
-  function condOtherMentions(cond: Expr, E: Expr, v: string): boolean {
-    if (cond.k !== 'bin') {
-      return false;
-    }
-    const other = exprEq(cond.l, E) ? cond.r : exprEq(cond.r, E) ? cond.l : null;
-    const mentions = (e: Expr): boolean => {
-      if (e.k === 'var') {
-        return e.name === v;
-      }
-      let hit = false;
-      mapExprChildren(e, (c) => {
-        hit = hit || mentions(c);
-        return c;
-      });
-      return hit;
-    };
-    return other ? mentions(other) : false;
-  }
-  /** cond compares E against a pure operand → same comparison reading the named var. */
-  function rewriteCond(cond: Expr, E: Expr, name: string): Expr | null {
-    if (cond.k !== 'bin' || !(cond.op in FLIP)) {
-      return null;
-    }
-    if (exprEq(cond.l, E) && isPure(cond.r)) {
-      return { k: 'bin', op: cond.op, l: { k: 'var', name }, r: cond.r };
-    }
-    if (exprEq(cond.r, E) && isPure(cond.l)) {
-      return { k: 'bin', op: cond.op, l: cond.l, r: { k: 'var', name } };
-    }
-    return null;
-  }
-  function flipCmp(cond: Expr): Expr | null {
-    if (cond.k !== 'bin') {
-      return null;
-    }
-    const op = FLIP[cond.op];
-    return op ? { k: 'bin', op: op as Extract<Expr, { k: 'bin' }>['op'], l: cond.l, r: cond.r } : null;
-  }
-  /** in `upd`, the occurrence of subtree E replaced by var `name` (E was just assigned to it). */
-  function renameSubexpr(e: Expr, E: Expr, name: string): Expr {
-    if (exprEq(e, E)) {
-      return { k: 'var', name };
-    }
-    return mapExprChildren(e, (c) => renameSubexpr(c, E, name));
-  }
-
   // R2: stage const-expressions used as bin operands into fresh locals, at statement level.
   const r2Stmt = (s: Stmt): Stmt[] => {
     const staged: Stmt[] = [];
@@ -309,23 +331,26 @@ export function registerishSpellings(sfn: SFn): SFn[] {
   // itself allocator-ambiguous (gcc 2.9 wanted R1's dead value var — live-name-count sensitive;
   // another allocator may want the fresh one), so BOTH tails are emitted as candidates rather
   // than asserting one compiler's preference; the source dedupe collapses them when identical.
-  const tails: SFn[] = [];
+  const tails: RegcopySpelling[] = [];
   const last = base.body[base.body.length - 1];
-  if (last?.k === 'return' && last.value && last.value.k !== 'var') {
+  if (last?.k === 'return' && last.value !== undefined && last.value.k !== 'var') {
+    // bound here rather than re-read inside `mk`: a PROPERTY's narrowing does not survive into a
+    // closure, and re-asserting it is what the three casts this replaces were doing
+    const retVal: Expr = last.value;
     const mk = (name: string): SFn => ({
       ...base,
       locals: [...locals],
       body: [
         ...base.body.slice(0, -1),
-        { k: 'assign', name, value: (last as Extract<Stmt, { k: 'return' }>).value! } as Stmt,
-        { k: 'return', value: { k: 'var', name } } as Stmt,
+        { k: 'assign', name, value: retVal },
+        { k: 'return', value: { k: 'var', name } },
       ],
     });
     if (deadValueVar) {
-      tails.push(mk(deadValueVar));
+      tails.push({ tail: 'reuse', sfn: mk(deadValueVar) });
     }
-    tails.push(mk(freshVar(T.s(32))));
+    tails.push({ tail: 'fresh', sfn: mk(freshVar(T.s(32))) });
   }
 
-  return [base, ...tails];
+  return [{ tail: 'none', sfn: base }, ...tails];
 }