@asmlift/core 0.5.0 → 0.6.0

package/src/contracts.ts

@@ -3,10 +3,19 @@
 // decompileRanked / decompileWithReport).
 // A pass that regresses fails AT its boundary with a diagnostic, not three stages later as
 // wrong C.
-import { type Block, type Fn, type Value, successorsOf } from './ir/core';
+import { type Fn, type Value, reachableBlocks } from './ir/core';
 import { type IrType, typeToString } from './ir/types';
 import type { BinOp, Expr, SFn, Stmt } from './l3/ast';
-import { exprChildren, fieldSpellsDot, gapReasonFor, stmtChildren, stmtExprs } from './l3/ast';
+import {
+  exprChildren,
+  fieldSpellsDot,
+  gapReasonFor,
+  mapExprChildren,
+  stmtChildren,
+  stmtExprs,
+  stmtLists,
+  walkExprs,
+} from './l3/ast';
 import { declaredTypes, exprCType } from './l3/typing';
 
 export class ContractError extends Error {
@@ -40,20 +49,35 @@ export function assertTypesRecovered(fn: Fn): void {
   }
 }
 
-/** Post structuring: the AST must reference no unresolved value. The structurer emits the
- *  sentinel var `"?"` when it cannot resolve a value (a dropped def, or an opcode it has no
- *  lowering for) — which would print as uncompilable source. Fail at the structuring boundary
- *  instead of emitting garbage. */
+/** Post structuring: the AST must reference no unresolved name. The structurer emits the sentinel
+ *  var `"?"` when it cannot resolve a value (a dropped def, or an opcode it has no lowering for),
+ *  which would print as uncompilable source. Fail at the boundary instead of emitting garbage.
+ *
+ *  `undefined` is the same failure from the other side — not a spelling the structurer chooses
+ *  (`Expr` declares `name: string`) but a `varName.get(v)!` whose value was never adopted, printing
+ *  as the token `undefined`. Both are checked on every ROUTE a name takes into the AST, and those
+ *  are not all expressions: `var` / `addr` / `field` / `call` carry one, and so does an `assign`'s
+ *  DESTINATION — a bare string field the expression walk never reaches. */
 export function assertResolved(sfn: SFn): void {
   // Derived from the shared exprChildren/stmtExprs/stmtChildren traversal so no statement kind
   // can be missed. A gap `marker` is annotate-mode's DESIGNED spelling of an unresolved value
-  // ("resolved" by construction); only its args could still hide a stray `"?"` — and args are
+  // ("resolved" by construction); only its args could still hide a stray name — and args are
   // exactly its children.
-  const badExpr = (e: Expr): boolean => (e.k === 'var' && e.name === '?') || exprChildren(e).some(badExpr);
-  const badStmt = (s: Stmt): boolean => stmtExprs(s).some(badExpr) || stmtChildren(s).some(badStmt);
+  const badName = (n: string | undefined): boolean => n === '?' || n === undefined;
+  // Every Expr kind that CARRIES a name, not just `var` — each is read through the same
+  // `map.get(d)!` / `attrs.x as string` and prints straight into the source. `carriesName` is asked
+  // separately because an ABSENT name is the case being caught: keying off `nameOf` alone refuses nothing.
+  const carriesName = (e: Expr): boolean => e.k === 'var' || e.k === 'addr' || e.k === 'field' || e.k === 'call';
+  const nameOf = (e: Expr): string | undefined =>
+    e.k === 'call' ? e.fn : e.k === 'marker' ? undefined : (e as { name?: string }).name;
+  const badExpr = (e: Expr): boolean => (carriesName(e) && badName(nameOf(e))) || exprChildren(e).some(badExpr);
+  // An `assign`'s DESTINATION is a bare string field, so the expression walk never reaches it.
+  const badStmt = (s: Stmt): boolean =>
+    (s.k === 'assign' && badName(s.name)) || stmtExprs(s).some(badExpr) || stmtChildren(s).some(badStmt);
   if (sfn.body.some(badStmt)) {
     throw new ContractError(
-      `structuring left an unresolved value ('?') in '${sfn.name}' — a dropped def or unlowered opcode`,
+      `structuring left an unresolved name ('?' or one never adopted) in '${sfn.name}' — ` +
+        `a dropped def, an unlowered opcode, or a name the structurer assumed the naming pipeline gave it`,
     );
   }
 }
@@ -154,15 +178,7 @@ function countCalls(stmts: Stmt[]): { total: CallCounts; path: CallCounts } {
  */
 export function assertEffectsPreserved(fn: Fn, sfn: SFn): void {
   // Reachable blocks only: an unreachable block's call is legitimately never emitted.
-  const seen = new Set<Block>([fn.blocks[0]]);
-  for (const stack = [fn.blocks[0]]; stack.length;) {
-    for (const s of successorsOf(stack.pop()!)) {
-      if (!seen.has(s)) {
-        seen.add(s);
-        stack.push(s);
-      }
-    }
-  }
+  const seen = reachableBlocks(fn);
   const irCalls: CallCounts = new Map();
   // Unmodelled instructions, by the mnemonic the frontend stamped. Same "never dropped" property as
   // a call, and it needs its own tally because an `opaque` carries no `target`.
@@ -186,17 +202,11 @@ export function assertEffectsPreserved(fn: Fn, sfn: SFn): void {
   // only mode with no other backstop against a silently dropped opaque.
   if (irOpaques.size) {
     const emitted = new Set<string>();
-    const we = (e: Expr): void => {
+    for (const e of walkExprs(sfn.body)) {
       if (e.k === 'marker') {
         emitted.add(e.reason);
       }
-      exprChildren(e).forEach(we);
-    };
-    const ws = (s: Stmt): void => {
-      stmtExprs(s).forEach(we);
-      stmtChildren(s).forEach(ws);
-    };
-    sfn.body.forEach(ws);
+    }
     for (const reason of irOpaques) {
       if (!emitted.has(reason)) {
         throw new ContractError(
@@ -222,6 +232,155 @@ export function assertEffectsPreserved(fn: Fn, sfn: SFn): void {
   }
 }
 
+/** Post structuring: a local the body READS must be WRITTEN somewhere in it. A materialized value
+ *  renders as one `v = …` statement at its def's position while every use reads the bare name, so
+ *  any pass that DISCARDS the statement's position — a collapsed switch test block, a suppressed
+ *  edge copy — leaves the reads standing over whatever the register allocator left behind. That is
+ *  the one wrongness the byte differ rewards rather than catches: the candidate compiles, scores,
+ *  and can win.
+ *
+ *  PRESENCE, not reaching definitions. The stronger question needs path sensitivity through
+ *  `switch` fall-through, `do-while` and `break`, where a false positive DECLINES a function that
+ *  is fine; assigned nowhere at all needs none of that and has no legitimate producer. Two local
+ *  kinds are exempt and both say so in their declaration: an `uninit` local stands on an `undef`,
+ *  where the missing assignment IS the recovery, and a `frame` local is the machine's own slot,
+ *  whose store the readability passes between here and L3 may have dropped. */
+export function assertLocalsWritten(sfn: SFn): void {
+  const suspect = new Set(sfn.locals.filter((l) => !l.frame && !l.uninit).map((l) => l.name));
+  if (!suspect.size) {
+    return;
+  }
+  const read = new Set<string>();
+  const written = new Set<string>();
+  // `&v` is a write channel this walk cannot follow — the callee/store behind it may fill the
+  // object — so it counts as one.
+  const walkExpr = (e: Expr): void => {
+    if ((e.k === 'var' || e.k === 'addr') && suspect.has(e.name)) {
+      (e.k === 'addr' ? written : read).add(e.name);
+    }
+    exprChildren(e).forEach(walkExpr);
+  };
+  const walkStmt = (st: Stmt): void => {
+    if (st.k === 'assign' && suspect.has(st.name)) {
+      written.add(st.name);
+    }
+    stmtExprs(st).forEach(walkExpr);
+    stmtChildren(st).forEach(walkStmt);
+  };
+  sfn.body.forEach(walkStmt);
+  const orphans = [...read].filter((n) => !written.has(n));
+  if (orphans.length) {
+    throw new ContractError(
+      `structuring emitted local(s) ${orphans.map((n) => `'${n}'`).join(', ')} in '${sfn.name}' read but ` +
+        `never assigned — a def whose assignment no render position emitted`,
+    );
+  }
+}
+
+/** Post-lever: every read of a MINTED local — its ADDRESS being taken included — must sit where
+ *  that local's assignment has already run.
+ *
+ *  THE failure a placing lever can ship, and the only one the byte differ rewards: a base local whose
+ *  assignment does not reach a use is a DIFFERENT VARIABLE — C that compiles, scores, and can win
+ *  (the shape #106 shipped). `contracts.ts`'s `assertLocalsWritten` does not see it: it accumulates
+ *  reads and writes as SETS over the whole body, so a local assigned in one arm and read after the
+ *  `if` is written somewhere and passes.
+ *
+ *  Checked on the EMITTED tree rather than argued from the plan, because the plan is what a bug
+ *  would be in. `rank.ts`'s `respell` catches the throw and drops the candidate, so the wrong
+ *  answer becomes a reported lever error instead of a scored spelling.
+ *
+ *  IT LIVES HERE, beside `assertLocalsWritten`, because it has that check's population and that
+ *  check's call site: levers that place a def — l3/sinkinit.ts, l3/basecse.ts's first-use policy,
+ *  l3/nearbase.ts, l3/reindex.ts, l3/scopebase.ts, l3/argbase.ts — are the population that can
+ *  produce the failure, so the check belongs on every lever tree rather than on one lever's.
+ *
+ *  Called ABSOLUTELY by the placing levers that put an init inside a nested list, each over its own
+ *  plan; everywhere else it is reached through `assertPlacementSurvives` below, which is a
+ *  DIFFERENTIAL — so a placement no lever's tree ever satisfied is not judged, and a lever that
+ *  mints nothing is not judged at all.
+ *
+ *  A nested list gets a COPY of the reaching set, so an assignment inside one arm does not count as
+ *  reaching anything after the `if`. */
+export function assertHoistsDominate(sfn: SFn, minted: ReadonlySet<string>): void {
+  if (minted.size === 0) {
+    return;
+  }
+  const readUndominated = (e: Expr, live: ReadonlySet<string>): string | null => {
+    // `&p` COUNTS, the same mention the placing passes query on (l3/hoist.ts): the address is what
+    // a callee reads the cell through, so an init has to precede it as surely as it must precede a
+    // read.
+    if ((e.k === 'var' || e.k === 'addr') && minted.has(e.name) && !live.has(e.name)) {
+      return e.name;
+    }
+    let bad: string | null = null;
+    mapExprChildren(e, (c) => {
+      bad ??= readUndominated(c, live);
+      return c;
+    });
+    return bad;
+  };
+  const judge = (heads: readonly Expr[], live: ReadonlySet<string>): void => {
+    for (const e of heads) {
+      const bad = readUndominated(e, live);
+      if (bad) {
+        throw new ContractError(
+          `'${sfn.name}' reads '${bad}' where its assignment does not reach — ` +
+            `a def placed below a use it claims to serve`,
+        );
+      }
+    }
+  };
+  const walk = (list: Stmt[], live: Set<string>): void => {
+    for (const st of list) {
+      // A `for`'s INIT runs once, before the condition, the inc and the body — so its assignment
+      // reaches all three, and the loop's own parts are statements with their own nested lists.
+      // `l3/reindex.ts` mints an induction variable whose ONLY def is that init, so reading the
+      // `for` as one flat head list rejects every counted walk it spells.
+      if (st.k === 'for') {
+        walk([st.init], live);
+        judge(stmtExprs(st), live);
+        walk([st.inc], new Set(live));
+        walk(st.body, new Set(live));
+        continue;
+      }
+      judge(stmtExprs(st), live);
+      for (const child of stmtLists(st)) {
+        walk(child, new Set(live));
+      }
+      if (st.k === 'assign' && minted.has(st.name)) {
+        live.add(st.name);
+      }
+    }
+  };
+  walk(sfn.body, new Set());
+}
+
+/** The same guarantee across a re-spelling that MOVES statements over a placement another pass
+ *  already made — `rank.ts`'s statement shapes (`/initfirst`, `/pollguard`, `/pollread`), derived
+ *  onto every lever tree after the lever placed its defs, and the lever-on-lever compositions in
+ *  the same file where a def-moving pass (`sinkInitsToFirstUse`, `nearBaseClusters`,
+ *  `reindexWalks`) runs on a tree a placing lever built. `pollReads` folds a materialized re-read
+ *  back into a loop condition, which is exactly such a move.
+ *
+ *  A DIFFERENTIAL, which is what makes it safe on every lever: the walk judges the reshaped tree
+ *  only where it already described the unshaped one, so a placement it cannot model (a def inside
+ *  a loop body read earlier in the same body is assigned on every iteration but the first) is not
+ *  judged either way. `minted` may name a local `before` does not carry — a mover mints its own —
+ *  and that one is judged absolutely, which is the same thing: a name absent from `before` is
+ *  never read there. */
+export function assertPlacementSurvives(before: SFn, after: SFn, minted: ReadonlySet<string>): void {
+  if (minted.size === 0) {
+    return;
+  }
+  try {
+    assertHoistsDominate(before, minted);
+  } catch {
+    return;
+  }
+  assertHoistsDominate(after, minted);
+}
+
 /** Post structuring: the AST's memory accesses and operators must be SPELLABLE — a `field`
  *  node's base a pointer-to-struct (`->`) or a struct value (`.`, an array element) carrying
  *  that field; no pointer operand under an operator C rejects; and every SCALAR `index` node's
@@ -249,7 +408,7 @@ export function assertDerefsTyped(sfn: SFn): void {
     }
   }
   // Ops C rejects outright on a pointer operand (the additive ops and &&/|| are legal C).
-  const NO_PTR_OPS = new Set<BinOp>(['&', '|', '^', '<<', '>>', '>>>', '*', '/', '%']);
+  const NO_PTR_OPS = new Set<BinOp>(['&', '|', '^', '<<', '>>', '>>>', '*', '/', '/u', '%', '%u']);
   // The comparison operators — where a bare `&SYM` operand is SIGN-ambiguous, not ill-formed.
   const CMP_OPS = new Set(['<', '<=', '>', '>=', '==', '!=']);
   // 1/2/4 only: the decomp typedef vocabulary (C_TYPEDEFS) has no 64-bit scalar, so a width-8
@@ -259,11 +418,13 @@ export function assertDerefsTyped(sfn: SFn): void {
   // Dot-form field bases (struct-array elements) carry the struct STRIDE as their width — any
   // stride matching the element size is legal there (the tree-level struct cast governs the
   // spelling; a stride/size MISMATCH types scalar in exprCType and the field rule flags it).
-  // Collected as fields are visited, BEFORE recursing into their children. Identity-keyed: a
-  // future subtree-SHARING pass (CSE-style) would leak the exemption to aliased bare uses —
-  // trees are freshly built per node today (structure.ts), which this relies on.
+  // Collected as fields are visited, BEFORE recursing into their children — which is what makes
+  // `walkExprs`' PRE-ORDER load-bearing here rather than incidental: the exemption is recorded on
+  // the `field` node and read at the `index` node beneath it. Identity-keyed: a future
+  // subtree-SHARING pass (CSE-style) would leak the exemption to aliased bare uses — trees are
+  // freshly built per node today (structure.ts), which this relies on.
   const structElem = new Set<Expr>();
-  const checkExpr = (e: Expr): void => {
+  for (const e of walkExprs(sfn.body)) {
     if (e.k === 'index' && !structElem.has(e) && !SCALAR_WIDTHS.has(e.width)) {
       bad.push(`index width ${e.width} is not a C scalar width`);
     }
@@ -323,13 +484,7 @@ export function assertDerefsTyped(sfn: SFn): void {
         }
       }
     }
-    exprChildren(e).forEach(checkExpr);
-  };
-  const checkStmt = (s: Stmt): void => {
-    stmtExprs(s).forEach(checkExpr);
-    stmtChildren(s).forEach(checkStmt);
-  };
-  sfn.body.forEach(checkStmt);
+  }
   if (bad.length) {
     throw new ContractError(
       `structuring emitted ill-typed C in '${sfn.name}': ${bad[0]}${bad.length > 1 ? ` (+${bad.length - 1} more)` : ''}`,

package/src/declare.ts

@@ -29,7 +29,25 @@
 //     field) can only LOSE score — the target bytes derive from the truth decls, so a
 //     divergent compile can never false-match. Exception two is the NAME-ONLY data symbol
 //     (`extern u32 name;` — see the default case): required to reproduce symtab-only map
-//     rows outside project headers, justified by the same only-loses-score argument.
+//     rows outside project headers.
+//
+// WHERE THE ONLY-LOSES-SCORE ARGUMENT STOPS. It rests on the target bytes coming from the
+// project's own TRUTH declarations, so a divergent decl compiles to different bytes and simply
+// scores worse. The line is not map-derived vs. synthesized, it is whether the ref carries
+// `access`: that field is read out of the candidate's own IR — the very asm it is then scored
+// against — so a declaration wearing it is FITTED and can only manufacture agreement. Every
+// `synthesized` ref can wear it, and so can a MAP-KNOWN name whose map entry has no shape
+// (symtab-only projects), which is the one fitted case `synthesized` does not mark. Measured
+// over the 252 real benchmark rows with their vendored maps: fitted-and-marked 2, fitted-but-
+// unmarked 0 — so the marker covers today's population, and a symtab-only project is where it
+// would stop.
+//
+// A fitted declaration is a sound ARTIFACT (decls + source really do compile to those bytes) and
+// an unsound CLAIM if the decls are hidden, so a consumer publishing a verdict must show the
+// block beside the source. Its price, against the benchmark's own vendored maps: of 28 fitted
+// NARROW declarations over the 126 rankable agbcc rows, 26 agree with the project's real
+// declaration and 2 do not (27 of 28 agree on the offset-0 ACCESS WIDTH the declaration
+// produces, which is the weaker question of whether the same load is emitted).
 import { type StructFieldDecl, renderStructDecl } from './backend/cfamily';
 import { T } from './ir/types';
 import type { SymbolRef } from './l3/symbol-refs';
@@ -42,6 +60,7 @@ import {
   pointeeFields,
   symbolFieldType,
 } from './symbols';
+import { C_TYPEDEFS } from './target';
 
 /** The u8/s8/u16/s16/u32/s32 spelling for a 1/2/4-byte cell, or null (no faithful narrow type). */
 function intType(size: number, signed: boolean): string | null {
@@ -223,9 +242,11 @@ export function renderDeclarations(refs: SymbolRef[]): string {
         // tree performed only under a decl of that exact width (`extern u16 g;` is `sh` where
         // a guessed u32 is `sw`). Without a bare off-0 access fact, every core spelling goes
         // through `&name` casts, where any object decl is address-identical — u32 is the
-        // fallback cell. A divergent decl can only LOSE score — the target bytes derive from
-        // the truth decls, so a mis-declared compile can never false-match (same argument as
-        // enumIsSigned).
+        // fallback cell.
+        // For a MAP-derived name-only symbol (symtab-only projects) the only-loses-score
+        // argument applies. For a `synthesized` one it does not — the width came from the
+        // target's own asm, so this line is a hypothesis fitted to the bytes; see the module
+        // note's "WHERE THE ONLY-LOSES-SCORE ARGUMENT STOPS".
         const t = access ? intType(access.width, access.signed) : null;
         lines.push(`extern ${quals(info)}${t ?? 'u32'} ${name};`);
         break;
@@ -249,3 +270,19 @@ export function macroDefinesOf(declarations: string | undefined): string {
   const lines = declarations.split('\n').filter((l) => l.startsWith('#define '));
   return lines.length ? lines.join('\n') + '\n' : '';
 }
+
+/** THE self-declared world's compilation context: asmlift's typedef prelude followed by this
+ *  candidate's declaration block. One composition with two callers — the cli's compile seam
+ *  (compile-command.ts, whose probe decides whether the world is self-declared at all) and the
+ *  webapp's wasm scorer, which is ALWAYS in it — because two hand-rolled copies of
+ *  `C_TYPEDEFS + decls` is exactly how the two scoring worlds come to disagree about what a
+ *  candidate was compiled in. */
+export function selfDeclaredContext(declarations: string | undefined): string {
+  return C_TYPEDEFS + (declarations ?? '');
+}
+
+/** The same context straight from a candidate's refs — what a scorer holding `Candidate`s (the
+ *  webapp) needs, and the one place that decides an empty ref list renders no block at all. */
+export function selfDeclaredContextFor(refs: SymbolRef[] | undefined): string {
+  return selfDeclaredContext(refs?.length ? renderDeclarations(refs) : undefined);
+}

package/src/frontend/mips.ts

@@ -517,6 +517,17 @@ export function lift(
     }
   });
 
+  // NO FRAME PARTITION IS CLAIMED, so every def-less slot read refuses (frontend/ssa.ts,
+  // LiveInModel). This frontend has no frame bound at all — `addiu sp,sp,±N` is transparent and
+  // every word sp-relative access becomes `sp@<rawOff>` — so its slot keys span O32's CALLER-owned
+  // register-parameter home area and the incoming stack arguments above it, where a def-less read
+  // is argument 5, not an uninitialised local.
+  //
+  // Claiming one needs the frame SIZE those offsets are measured against, which is not computed
+  // here, plus ensureParam for the register half. The ranges themselves are known: O32 reserves
+  // `[0,16)` as the caller-owned home area (in NEITHER range — caller-owned, but not an argument)
+  // with stack arguments from 16 up, which is what `mips32be.cspec`'s `<localrange>` and stack
+  // `<pentry offset="16">` encode.
   const ssa = makeSsaBuilder(name, blocks.length, preds);
   const { irBlocks, readVar, writeVar, paramReg } = ssa;
   const RET = target.returnReg;

package/src/frontend/ppc.ts

@@ -353,6 +353,17 @@ export function lift(
   // it is exempted from the loud-fail below; an UNrecovered `bctr` still fails loud.
   const jts = asmData ? recoverPpcJumpTables(instrs, asmData) : new Map<number, PpcJT>();
   const recoveredBctr = new Set([...jts.values()].map((j) => j.bctrAddr));
+  // A data reloc on an immediate-forming instruction means objdump printed a LINK-TIME
+  // placeholder (`lis r4,0` + R_PPC_ADDR16_HA sym): the real value is the symbol's half, and
+  // lifting the 0 silently reads the wrong address — plausible-but-wrong C, the forbidden class.
+  // The jump-table idiom's own @tbl pair never reaches these guards: a recovered dispatch block
+  // is the bounds branch's replaced fall-through, pruned as unreachable before decode.
+  const relocPlaceholder = (ins: Instr): void => {
+    throw new PpcUnsupportedError(
+      `cannot lift '${name}': '${ins.mnemonic}' at 0x${ins.addr.toString(16)} carries a data relocation ` +
+        `('${ins.sym}') — the printed immediate is a link-time placeholder, not the value`,
+    );
+  };
   // TRUSTWORTHINESS: fail loud on an unmodelled control transfer rather than dropping it (which
   // would silently miscompile the control flow). CTR-counted loops and indirect branches land here.
   for (const ins of instrs) {
@@ -573,17 +584,17 @@ export function lift(
           for (let k = 0; k < argc; k++) {
             args.push(read(ARG_REGS[k]));
           }
-          // Pushed with `tmp` rather than `emit` so the result register is written AFTER the clobber
-          // is recorded — the order matters: r3.. are volatile under the EABI, so a GUESSED arity
-          // that counted a register set up before an intervening call passes an argument the caller
-          // never set up (`finish()` cuts those back — frontend/ssa.ts), while the call's OWN result
-          // must stay fresh for the next call (`bar(foo())`).
+          // Pushed with `tmp` rather than `emit` so the result register is written separately from
+          // the op — r3.. are volatile under the EABI, so a GUESSED arity that counted a register
+          // set up before an intervening call passes an argument the caller never set up
+          // (`finish()` cuts those back — frontend/ssa.ts), and the call's OWN result is the
+          // CALLEE's write, so `noteCall` records the clobber after it rather than before.
           const res = kit.tmp('call', args, { target: sym });
           if (declared === undefined) {
-            ssa.recordGuessedCall(ops[ops.length - 1], bi, ARG_REGS);
+            ssa.recordGuessedCall(ops[ops.length - 1], bi, { argRegs: ARG_REGS, returnReg: RET });
           }
-          ssa.noteCall(bi);
           write(RET, res);
+          ssa.noteCall(bi);
           break;
         }
         // Stack-frame + link-register bookkeeping. `stwu r1,-N(r1)` / `addi r1,r1,N` adjust the frame
@@ -629,9 +640,16 @@ export function lift(
           write(d, read(s));
           break; // move register (or rD,rS,rS)
         case 'li':
+          // SDA21 address formation encodes rA=0, so objdump prints `li rD,0` + R_PPC_EMB_SDA21
+          if (ins.sym) {
+            relocPlaceholder(ins);
+          }
           write(d, constVal(parseImm(s)));
           break; // load immediate (addi rD,0,imm)
         case 'lis':
+          if (ins.sym) {
+            relocPlaceholder(ins);
+          }
           write(d, constVal((parseImm(s) << 16) >> 0));
           break; // load immediate shifted
         case 'add':
@@ -641,11 +659,25 @@ export function lift(
         // `addi r1,r1,N` is frame teardown (skip); any other addi is a real add-immediate.
         case 'addi':
         case 'addic':
+          // reloc first: a data reloc on a stack adjust is no known compiler's output — loud
+          if (ins.sym) {
+            relocPlaceholder(ins);
+          }
           if (d === 'r1') {
             break;
           }
           emitBin('add', d, read(s), constVal(parseImm(t)));
           break;
+        // add immediate SHIFTED — the register-based `%ha` anchor: mwcc derives an absolute base
+        // from a scaled index (`addis r4,r3,-32736` = r3 + 0x80200000). The jump-table lis/addi
+        // pair recognizer is the only reloc-carrying consumer; an addis over a register is plain
+        // arithmetic, and a reloc-carrying one is a placeholder (guard above).
+        case 'addis':
+          if (ins.sym) {
+            relocPlaceholder(ins);
+          }
+          emitBin('add', d, read(s), constVal((parseImm(t) << 16) >> 0));
+          break;
         case 'subf':
         case 'subfc':
         case 'subfo':
@@ -697,6 +729,10 @@ export function lift(
           emitBin('or', d, read(s), read(t));
           break;
         case 'ori':
+          // `ori rD,rA,sym@l` is the other @l half-former — same placeholder hazard as addi
+          if (ins.sym) {
+            relocPlaceholder(ins);
+          }
           emitBin('or', d, read(s), constVal(parseImm(t)));
           break;
         case 'xor':