@asmlift/core 0.5.0 → 0.7.0

package/src/backend/pascal.ts

@@ -10,7 +10,8 @@
 // Turbo/Delphi/FreePascal.
 import { IrType, typeToString } from '../ir/types';
 import { BinOp, Expr, LanguageBackend, SFn, Stmt } from '../l3/ast';
-import { type VarTypes, declaredTypes, derefStrideOk, exprCType } from '../l3/typing';
+import { orderSlotLocals } from '../l3/slotorder';
+import { type VarTypes, declaredTypes, derefStrideOk, exprCType, writesNonPointerIntoPointer } from '../l3/typing';
 
 // Infix operators IDO Pascal spells directly.
 const OP: Partial<Record<BinOp, string>> = {
@@ -18,6 +19,10 @@ const OP: Partial<Record<BinOp, string>> = {
   // match C's truncated `%` (sign of the DIVIDEND) — verified: `a mod 3` mis-scores against the
   // IDO C `a % 3` codegen. There is no faithful IDO-Pascal spelling of a signed C remainder, so the
   // backend fails LOUD on `%` (below) rather than emit a silently-wrong `mod`. `/`→`div` DOES match.
+  //
+  // And no `/u`/`%u` either, for the same reason `>>>` is absent from BIT_FN below: `div` over this
+  // backend's signed `Integer` is the SIGNED division, so lending it to the unsigned twin would
+  // emit `div` where the machine did `divu`. They reach the loud decline instead.
   '+': '+',
   '-': '-',
   '*': '*',
@@ -95,7 +100,7 @@ function makePrinter(vt: VarTypes) {
           throw new Error(`pascal backend: a multidimensional array access has no IDO Pascal spelling yet`);
         }
         const bt = exprCType(e.base, vt);
-        if ((bt !== undefined && !derefStrideOk(bt, e.width)) || (bt === undefined && e.width !== 4)) {
+        if ((bt !== undefined && !derefStrideOk(bt, e.width, e.signed)) || (bt === undefined && e.width !== 4)) {
           throw new Error(
             `pascal backend: a ${e.width}-byte access through a base of type '${bt ? typeToString(bt) : '<unknowable>'}' has no faithful spelling (no reinterpret cast)`,
           );
@@ -111,7 +116,10 @@ function makePrinter(vt: VarTypes) {
       // Casts have no faithful IDO-Pascal spelling yet — fail LOUD rather than emit silently-wrong
       // source. Tree-level producers reaching here: the width-narrowing idiom casts (agbcc-gated,
       // so never on this path today), structure.ts's STRUCT-pointer casts (unreachable too — the
-      // `field` case above throws first), and intify's `(s32)ptr` legalization (any target).
+      // `field` case above throws first), intify's `(s32)ptr` legalization (any target), and the
+      // byte-pointer walk of a pointer offset by a runtime value (any target, and reachable with no
+      // `field` in the tree — it declines two functions that used to emit here, whose Pascal was
+      // silently walking ELEMENTS where the asm walked bytes).
       // Scalar deref casts never appear in the tree — the index case above owns that judgment.
       case 'cast':
         throw new Error(`pascal backend: cast has no IDO Pascal spelling yet`);
@@ -148,15 +156,13 @@ function makePrinter(vt: VarTypes) {
       stmts.flatMap((x, i) => ps(fnName, x, ind, tl && i === stmts.length - 1));
     switch (s.k) {
       case 'assign': {
-        // The write-side sibling of the index case's deref discipline: Pascal has no reinterpret
-        // cast, so a definitely-non-pointer value assigned into a pointer-declared var (the shape
-        // the C family legalizes with `(u8 *)…`, cfamily.ts legalizePointerWrites) declines LOUD
-        // here instead of failing three stages later in upas.
-        const dt = vt(s.name);
-        const ct = exprCType(s.value, vt);
-        if (dt?.kind === 'ptr' && ct && ct.kind !== 'ptr' && ct.kind !== 'array') {
+        // The write-side sibling of the index case's deref discipline. The C family answers the
+        // same question (l3/typing.ts writesNonPointerIntoPointer) with a reinterpret cast;
+        // Pascal has none, so it declines LOUD here instead of failing three stages later in upas.
+        if (writesNonPointerIntoPointer(vt(s.name), s.value, vt)) {
+          const ct = exprCType(s.value, vt);
           throw new Error(
-            `pascal backend: assigning a ${typeToString(ct)} value into pointer var '${s.name}' has no faithful spelling (no reinterpret cast)`,
+            `pascal backend: assigning a ${ct ? typeToString(ct) : '<unknowable>'} value into pointer var '${s.name}' has no faithful spelling (no reinterpret cast)`,
           );
         }
         return [`${indent}${s.name} := ${pe(s.value)};`];
@@ -263,7 +269,15 @@ function makePrinter(vt: VarTypes) {
 
 export const pascalBackend: LanguageBackend = {
   id: 'pascal',
-  emit(fn: SFn): string {
+  // `case-of` has no fall-through, and this file's `switch` printing loud-fails a `fallsThrough`
+  // arm. Declared so RECOVERY never mints one for this backend: a comparison-tree switch also
+  // spells as plain if-nesting, which Pascal prints, so the choice is between a decompiled
+  // function and a stub.
+  spellsSwitchFallthrough: false,
+  emit(fn0: SFn): string {
+    // The declaration list is put into the target's own frame order HERE, as the C family does it
+    // in its shared assembler — owned by `emit`, never by a `.emit(` call site (l3/slotorder.ts).
+    const fn = orderSlotLocals(fn0);
     // Same env discipline as the C family (cfamily.ts cFamilyBody): the printer judges derefs
     // against the exact declarations it emits.
     const ps = makePrinter(declaredTypes(fn));

package/src/contracts.ts

@@ -3,10 +3,20 @@
 // decompileRanked / decompileWithReport).
 // A pass that regresses fails AT its boundary with a diagnostic, not three stages later as
 // wrong C.
-import { type Block, type Fn, type Value, successorsOf } from './ir/core';
+import { type Fn, type Value, reachableBlocks } from './ir/core';
 import { type IrType, typeToString } from './ir/types';
 import type { BinOp, Expr, SFn, Stmt } from './l3/ast';
-import { exprChildren, fieldSpellsDot, gapReasonFor, stmtChildren, stmtExprs } from './l3/ast';
+import {
+  exprChildren,
+  fieldSpellsDot,
+  gapReasonFor,
+  mapExprChildren,
+  stmtChildren,
+  stmtExprs,
+  stmtLists,
+  walkExprs,
+} from './l3/ast';
+import { mentionedLocals } from './l3/mentions';
 import { declaredTypes, exprCType } from './l3/typing';
 
 export class ContractError extends Error {
@@ -40,20 +50,35 @@ export function assertTypesRecovered(fn: Fn): void {
   }
 }
 
-/** Post structuring: the AST must reference no unresolved value. The structurer emits the
- *  sentinel var `"?"` when it cannot resolve a value (a dropped def, or an opcode it has no
- *  lowering for) — which would print as uncompilable source. Fail at the structuring boundary
- *  instead of emitting garbage. */
+/** Post structuring: the AST must reference no unresolved name. The structurer emits the sentinel
+ *  var `"?"` when it cannot resolve a value (a dropped def, or an opcode it has no lowering for),
+ *  which would print as uncompilable source. Fail at the boundary instead of emitting garbage.
+ *
+ *  `undefined` is the same failure from the other side — not a spelling the structurer chooses
+ *  (`Expr` declares `name: string`) but a `varName.get(v)!` whose value was never adopted, printing
+ *  as the token `undefined`. Both are checked on every ROUTE a name takes into the AST, and those
+ *  are not all expressions: `var` / `addr` / `field` / `call` carry one, and so does an `assign`'s
+ *  DESTINATION — a bare string field the expression walk never reaches. */
 export function assertResolved(sfn: SFn): void {
   // Derived from the shared exprChildren/stmtExprs/stmtChildren traversal so no statement kind
   // can be missed. A gap `marker` is annotate-mode's DESIGNED spelling of an unresolved value
-  // ("resolved" by construction); only its args could still hide a stray `"?"` — and args are
+  // ("resolved" by construction); only its args could still hide a stray name — and args are
   // exactly its children.
-  const badExpr = (e: Expr): boolean => (e.k === 'var' && e.name === '?') || exprChildren(e).some(badExpr);
-  const badStmt = (s: Stmt): boolean => stmtExprs(s).some(badExpr) || stmtChildren(s).some(badStmt);
+  const badName = (n: string | undefined): boolean => n === '?' || n === undefined;
+  // Every Expr kind that CARRIES a name, not just `var` — each is read through the same
+  // `map.get(d)!` / `attrs.x as string` and prints straight into the source. `carriesName` is asked
+  // separately because an ABSENT name is the case being caught: keying off `nameOf` alone refuses nothing.
+  const carriesName = (e: Expr): boolean => e.k === 'var' || e.k === 'addr' || e.k === 'field' || e.k === 'call';
+  const nameOf = (e: Expr): string | undefined =>
+    e.k === 'call' ? e.fn : e.k === 'marker' ? undefined : (e as { name?: string }).name;
+  const badExpr = (e: Expr): boolean => (carriesName(e) && badName(nameOf(e))) || exprChildren(e).some(badExpr);
+  // An `assign`'s DESTINATION is a bare string field, so the expression walk never reaches it.
+  const badStmt = (s: Stmt): boolean =>
+    (s.k === 'assign' && badName(s.name)) || stmtExprs(s).some(badExpr) || stmtChildren(s).some(badStmt);
   if (sfn.body.some(badStmt)) {
     throw new ContractError(
-      `structuring left an unresolved value ('?') in '${sfn.name}' — a dropped def or unlowered opcode`,
+      `structuring left an unresolved name ('?' or one never adopted) in '${sfn.name}' — ` +
+        `a dropped def, an unlowered opcode, or a name the structurer assumed the naming pipeline gave it`,
     );
   }
 }
@@ -154,15 +179,7 @@ function countCalls(stmts: Stmt[]): { total: CallCounts; path: CallCounts } {
  */
 export function assertEffectsPreserved(fn: Fn, sfn: SFn): void {
   // Reachable blocks only: an unreachable block's call is legitimately never emitted.
-  const seen = new Set<Block>([fn.blocks[0]]);
-  for (const stack = [fn.blocks[0]]; stack.length;) {
-    for (const s of successorsOf(stack.pop()!)) {
-      if (!seen.has(s)) {
-        seen.add(s);
-        stack.push(s);
-      }
-    }
-  }
+  const seen = reachableBlocks(fn);
   const irCalls: CallCounts = new Map();
   // Unmodelled instructions, by the mnemonic the frontend stamped. Same "never dropped" property as
   // a call, and it needs its own tally because an `opaque` carries no `target`.
@@ -186,17 +203,11 @@ export function assertEffectsPreserved(fn: Fn, sfn: SFn): void {
   // only mode with no other backstop against a silently dropped opaque.
   if (irOpaques.size) {
     const emitted = new Set<string>();
-    const we = (e: Expr): void => {
+    for (const e of walkExprs(sfn.body)) {
       if (e.k === 'marker') {
         emitted.add(e.reason);
       }
-      exprChildren(e).forEach(we);
-    };
-    const ws = (s: Stmt): void => {
-      stmtExprs(s).forEach(we);
-      stmtChildren(s).forEach(ws);
-    };
-    sfn.body.forEach(ws);
+    }
     for (const reason of irOpaques) {
       if (!emitted.has(reason)) {
         throw new ContractError(
@@ -222,6 +233,203 @@ export function assertEffectsPreserved(fn: Fn, sfn: SFn): void {
   }
 }
 
+/** Post structuring: a local the body READS must be WRITTEN somewhere in it. A materialized value
+ *  renders as one `v = …` statement at its def's position while every use reads the bare name, so
+ *  any pass that DISCARDS the statement's position — a collapsed switch test block, a suppressed
+ *  edge copy — leaves the reads standing over whatever the register allocator left behind. That is
+ *  the one wrongness the byte differ rewards rather than catches: the candidate compiles, scores,
+ *  and can win.
+ *
+ *  PRESENCE, not reaching definitions. The stronger question needs path sensitivity through
+ *  `switch` fall-through, `do-while` and `break`, where a false positive DECLINES a function that
+ *  is fine; assigned nowhere at all needs none of that and has no legitimate producer. Two local
+ *  kinds are exempt and both say so in their declaration: an `uninit` local stands on an `undef`,
+ *  where the missing assignment IS the recovery, and a `frame` local is the machine's own slot,
+ *  whose store the readability passes between here and L3 may have dropped. */
+export function assertLocalsWritten(sfn: SFn): void {
+  const suspect = new Set(sfn.locals.filter((l) => !l.frame && !l.uninit).map((l) => l.name));
+  if (!suspect.size) {
+    return;
+  }
+  const read = new Set<string>();
+  const written = new Set<string>();
+  // `&v` is a write channel this walk cannot follow — the callee/store behind it may fill the
+  // object — so it counts as one.
+  const walkExpr = (e: Expr): void => {
+    if ((e.k === 'var' || e.k === 'addr') && suspect.has(e.name)) {
+      (e.k === 'addr' ? written : read).add(e.name);
+    }
+    exprChildren(e).forEach(walkExpr);
+  };
+  const walkStmt = (st: Stmt): void => {
+    if (st.k === 'assign' && suspect.has(st.name)) {
+      written.add(st.name);
+    }
+    stmtExprs(st).forEach(walkExpr);
+    stmtChildren(st).forEach(walkStmt);
+  };
+  sfn.body.forEach(walkStmt);
+  const orphans = [...read].filter((n) => !written.has(n));
+  if (orphans.length) {
+    throw new ContractError(
+      `structuring emitted local(s) ${orphans.map((n) => `'${n}'`).join(', ')} in '${sfn.name}' read but ` +
+        `never assigned — a def whose assignment no render position emitted`,
+    );
+  }
+}
+
+/** After a respell variation: a local a pass DELETED from the declaration list is named nowhere in the tree it
+ *  produced.
+ *
+ *  THE FAILURE THIS CATCHES is the mirror of `assertLocalsWritten` above, and the three contracts
+ *  beside it do not see it. A pass that consumes a local — l3/unmerge.ts substituting a merge temp
+ *  into the arms, l3/coalesce.ts folding two names into one, l3/inlinebase.ts deleting a
+ *  const-address pointer — drops the name from `sfn.locals` on the strength of an in-pass count
+ *  that it is no longer mentioned. If that count is ever wrong the result is not a loud variation
+ *  error: it is a candidate handed to the compiler with an undeclared identifier. Normally that is
+ *  a dropped candidate, but in the REAL tier the candidate is compiled inside the project's
+ *  vendored translation unit, where an orphaned name that collides with a context symbol compiles
+ *  and scores. Measured on the shape that inhabits it — `locals = [p]`, body `p = 0; v16 = 1;
+ *  *p = v16;` — `assertResolved`, `assertDerefsTyped` and `assertLocalsWritten` all pass: the name
+ *  is neither `?` nor `undefined`, it is well-typed, and the question the third one asks is the
+ *  OPPOSITE one (read but never written).
+ *
+ *  A DIFFERENTIAL, and that is what makes it safe to run on every respelled tree. "Every name the tree
+ *  mentions is declared" is NOT the invariant and would refuse correct output everywhere:
+ *  structure.ts spells a write to a scalar global as a bare `assign` whose name is declared in the
+ *  project's headers and nowhere in the tree (`gBlendValue = v;` — 71 such occurrences across 22
+ *  winning sources, per l3/unmerge.ts's own note), and `SFn.globals` is the symbol-map-shaped
+ *  subset, not that population. So the check speaks only about names the tree ITSELF declared a
+ *  moment ago and the pass then removed — a set with no legitimate inhabitant, because a pass that
+ *  drops a declaration is asserting exactly this.
+ *
+ *  `addr` counts, like everywhere else: `&v` names the object as surely as a read does. */
+export function assertNoOrphanedLocals(before: SFn, after: SFn): void {
+  const kept = new Set(after.locals.map((l) => l.name));
+  const dropped = new Set(before.locals.map((l) => l.name).filter((n) => !kept.has(n)));
+  if (!dropped.size) {
+    return;
+  }
+  // `l3/mentions.ts`'s walk, not a third copy of the node vocabulary — this is the LOUD BACKSTOP
+  // for the mistake that predicate guards, so it is the last place that should own its own.
+  // Locals only, deliberately: no L3 respell variation drops `SFn.params` (`pruneDeadParams` is L1 block
+  // params, ir/simplify.ts), so a params arm here would be a refusal with no inhabitant.
+  const found = mentionedLocals(after.body, dropped);
+  if (found.size) {
+    throw new ContractError(
+      `a respell variation deleted the declaration of ${[...found]
+        .sort()
+        .map((n) => `'${n}'`)
+        .join(', ')} in '${after.name}' ` +
+        `while the tree still names ${found.size > 1 ? 'them' : 'it'} — an undeclared identifier in the candidate`,
+    );
+  }
+}
+
+/** After a respell variation: every read of a MINTED local — its ADDRESS being taken included — must sit where
+ *  that local's assignment has already run.
+ *
+ *  THE failure a placing variation can ship, and the only one the byte differ rewards: a base local whose
+ *  assignment does not reach a use is a DIFFERENT VARIABLE — C that compiles, scores, and can win
+ *  (the shape #106 shipped). `contracts.ts`'s `assertLocalsWritten` does not see it: it accumulates
+ *  reads and writes as SETS over the whole body, so a local assigned in one arm and read after the
+ *  `if` is written somewhere and passes.
+ *
+ *  Checked on the EMITTED tree rather than argued from the plan, because the plan is what a bug
+ *  would be in. `rank.ts`'s `respell` catches the throw and drops the candidate, so the wrong
+ *  answer becomes a reported variation error instead of a scored spelling.
+ *
+ *  IT LIVES HERE, beside `assertLocalsWritten`, because it has that check's population and that
+ *  check's call site: respell variations that place a def — l3/sinkinit.ts, l3/basecse.ts's first-use policy,
+ *  l3/nearbase.ts, l3/reindex.ts, l3/scopebase.ts, l3/argbase.ts — are the population that can
+ *  produce the failure, so the check belongs on every respelled tree rather than on one variation's.
+ *
+ *  Called ABSOLUTELY by the placing variations that put an init inside a nested list, each over its own
+ *  plan; everywhere else it is reached through `assertPlacementSurvives` below, which is a
+ *  DIFFERENTIAL — so a placement no respelled tree ever satisfied is not judged, and a variation that
+ *  mints nothing is not judged at all.
+ *
+ *  A nested list gets a COPY of the reaching set, so an assignment inside one arm does not count as
+ *  reaching anything after the `if`. */
+export function assertHoistsDominate(sfn: SFn, minted: ReadonlySet<string>): void {
+  if (minted.size === 0) {
+    return;
+  }
+  const readUndominated = (e: Expr, live: ReadonlySet<string>): string | null => {
+    // `&p` COUNTS, the same mention the placing passes query on (l3/hoist.ts): the address is what
+    // a callee reads the cell through, so an init has to precede it as surely as it must precede a
+    // read.
+    if ((e.k === 'var' || e.k === 'addr') && minted.has(e.name) && !live.has(e.name)) {
+      return e.name;
+    }
+    let bad: string | null = null;
+    mapExprChildren(e, (c) => {
+      bad ??= readUndominated(c, live);
+      return c;
+    });
+    return bad;
+  };
+  const judge = (heads: readonly Expr[], live: ReadonlySet<string>): void => {
+    for (const e of heads) {
+      const bad = readUndominated(e, live);
+      if (bad) {
+        throw new ContractError(
+          `'${sfn.name}' reads '${bad}' where its assignment does not reach — ` +
+            `a def placed below a use it claims to serve`,
+        );
+      }
+    }
+  };
+  const walk = (list: Stmt[], live: Set<string>): void => {
+    for (const st of list) {
+      // A `for`'s INIT runs once, before the condition, the inc and the body — so its assignment
+      // reaches all three, and the loop's own parts are statements with their own nested lists.
+      // `l3/reindex.ts` mints an induction variable whose ONLY def is that init, so reading the
+      // `for` as one flat head list rejects every counted walk it spells.
+      if (st.k === 'for') {
+        walk([st.init], live);
+        judge(stmtExprs(st), live);
+        walk([st.inc], new Set(live));
+        walk(st.body, new Set(live));
+        continue;
+      }
+      judge(stmtExprs(st), live);
+      for (const child of stmtLists(st)) {
+        walk(child, new Set(live));
+      }
+      if (st.k === 'assign' && minted.has(st.name)) {
+        live.add(st.name);
+      }
+    }
+  };
+  walk(sfn.body, new Set());
+}
+
+/** The same guarantee across a re-spelling that MOVES statements over a placement another pass
+ *  already made — `rank.ts`'s stacked variations (`/initfirst`, `/pollguard`, `/pollread`), derived
+ *  onto every respelled tree after the variation placed its defs, and the variation-on-variation compositions in
+ *  the same file where a def-moving pass (`sinkInitsToFirstUse`, `nearBaseClusters`,
+ *  `reindexWalks`) runs on a tree a placing variation built. `pollReads` folds a materialized re-read
+ *  back into a loop condition, which is exactly such a move.
+ *
+ *  A DIFFERENTIAL, which is what makes it safe on every variation: the walk judges the reshaped tree
+ *  only where it already described the unshaped one, so a placement it cannot model (a def inside
+ *  a loop body read earlier in the same body is assigned on every iteration but the first) is not
+ *  judged either way. `minted` may name a local `before` does not carry — a mover mints its own —
+ *  and that one is judged absolutely, which is the same thing: a name absent from `before` is
+ *  never read there. */
+export function assertPlacementSurvives(before: SFn, after: SFn, minted: ReadonlySet<string>): void {
+  if (minted.size === 0) {
+    return;
+  }
+  try {
+    assertHoistsDominate(before, minted);
+  } catch {
+    return;
+  }
+  assertHoistsDominate(after, minted);
+}
+
 /** Post structuring: the AST's memory accesses and operators must be SPELLABLE — a `field`
  *  node's base a pointer-to-struct (`->`) or a struct value (`.`, an array element) carrying
  *  that field; no pointer operand under an operator C rejects; and every SCALAR `index` node's
@@ -249,7 +457,7 @@ export function assertDerefsTyped(sfn: SFn): void {
     }
   }
   // Ops C rejects outright on a pointer operand (the additive ops and &&/|| are legal C).
-  const NO_PTR_OPS = new Set<BinOp>(['&', '|', '^', '<<', '>>', '>>>', '*', '/', '%']);
+  const NO_PTR_OPS = new Set<BinOp>(['&', '|', '^', '<<', '>>', '>>>', '*', '/', '/u', '%', '%u']);
   // The comparison operators — where a bare `&SYM` operand is SIGN-ambiguous, not ill-formed.
   const CMP_OPS = new Set(['<', '<=', '>', '>=', '==', '!=']);
   // 1/2/4 only: the decomp typedef vocabulary (C_TYPEDEFS) has no 64-bit scalar, so a width-8
@@ -259,11 +467,13 @@ export function assertDerefsTyped(sfn: SFn): void {
   // Dot-form field bases (struct-array elements) carry the struct STRIDE as their width — any
   // stride matching the element size is legal there (the tree-level struct cast governs the
   // spelling; a stride/size MISMATCH types scalar in exprCType and the field rule flags it).
-  // Collected as fields are visited, BEFORE recursing into their children. Identity-keyed: a
-  // future subtree-SHARING pass (CSE-style) would leak the exemption to aliased bare uses —
-  // trees are freshly built per node today (structure.ts), which this relies on.
+  // Collected as fields are visited, BEFORE recursing into their children — which is what makes
+  // `walkExprs`' PRE-ORDER load-bearing here rather than incidental: the exemption is recorded on
+  // the `field` node and read at the `index` node beneath it. Identity-keyed: a future
+  // subtree-SHARING pass (CSE-style) would leak the exemption to aliased bare uses — trees are
+  // freshly built per node today (structure.ts), which this relies on.
   const structElem = new Set<Expr>();
-  const checkExpr = (e: Expr): void => {
+  for (const e of walkExprs(sfn.body)) {
     if (e.k === 'index' && !structElem.has(e) && !SCALAR_WIDTHS.has(e.width)) {
       bad.push(`index width ${e.width} is not a C scalar width`);
     }
@@ -323,13 +533,7 @@ export function assertDerefsTyped(sfn: SFn): void {
         }
       }
     }
-    exprChildren(e).forEach(checkExpr);
-  };
-  const checkStmt = (s: Stmt): void => {
-    stmtExprs(s).forEach(checkExpr);
-    stmtChildren(s).forEach(checkStmt);
-  };
-  sfn.body.forEach(checkStmt);
+  }
   if (bad.length) {
     throw new ContractError(
       `structuring emitted ill-typed C in '${sfn.name}': ${bad[0]}${bad.length > 1 ? ` (+${bad.length - 1} more)` : ''}`,

package/src/declare.ts

@@ -29,7 +29,25 @@
 //     field) can only LOSE score — the target bytes derive from the truth decls, so a
 //     divergent compile can never false-match. Exception two is the NAME-ONLY data symbol
 //     (`extern u32 name;` — see the default case): required to reproduce symtab-only map
-//     rows outside project headers, justified by the same only-loses-score argument.
+//     rows outside project headers.
+//
+// WHERE THE ONLY-LOSES-SCORE ARGUMENT STOPS. It rests on the target bytes coming from the
+// project's own TRUTH declarations, so a divergent decl compiles to different bytes and simply
+// scores worse. The line is not map-derived vs. synthesized, it is whether the ref carries
+// `access`: that field is read out of the candidate's own IR — the very asm it is then scored
+// against — so a declaration wearing it is FITTED and can only manufacture agreement. Every
+// `synthesized` ref can wear it, and so can a MAP-KNOWN name whose map entry has no shape
+// (symtab-only projects), which is the one fitted case `synthesized` does not mark. Measured
+// over the 252 real benchmark rows with their vendored maps: fitted-and-marked 2, fitted-but-
+// unmarked 0 — so the marker covers today's population, and a symtab-only project is where it
+// would stop.
+//
+// A fitted declaration is a sound ARTIFACT (decls + source really do compile to those bytes) and
+// an unsound CLAIM if the decls are hidden, so a consumer publishing a verdict must show the
+// block beside the source. Its price, against the benchmark's own vendored maps: of 28 fitted
+// NARROW declarations over the 126 rankable agbcc rows, 26 agree with the project's real
+// declaration and 2 do not (27 of 28 agree on the offset-0 ACCESS WIDTH the declaration
+// produces, which is the weaker question of whether the same load is emitted).
 import { type StructFieldDecl, renderStructDecl } from './backend/cfamily';
 import { T } from './ir/types';
 import type { SymbolRef } from './l3/symbol-refs';
@@ -42,6 +60,7 @@ import {
   pointeeFields,
   symbolFieldType,
 } from './symbols';
+import { C_TYPEDEFS } from './target';
 
 /** The u8/s8/u16/s16/u32/s32 spelling for a 1/2/4-byte cell, or null (no faithful narrow type). */
 function intType(size: number, signed: boolean): string | null {
@@ -223,9 +242,11 @@ export function renderDeclarations(refs: SymbolRef[]): string {
         // tree performed only under a decl of that exact width (`extern u16 g;` is `sh` where
         // a guessed u32 is `sw`). Without a bare off-0 access fact, every core spelling goes
         // through `&name` casts, where any object decl is address-identical — u32 is the
-        // fallback cell. A divergent decl can only LOSE score — the target bytes derive from
-        // the truth decls, so a mis-declared compile can never false-match (same argument as
-        // enumIsSigned).
+        // fallback cell.
+        // For a MAP-derived name-only symbol (symtab-only projects) the only-loses-score
+        // argument applies. For a `synthesized` one it does not — the width came from the
+        // target's own asm, so this line is a hypothesis fitted to the bytes; see the module
+        // note's "WHERE THE ONLY-LOSES-SCORE ARGUMENT STOPS".
         const t = access ? intType(access.width, access.signed) : null;
         lines.push(`extern ${quals(info)}${t ?? 'u32'} ${name};`);
         break;
@@ -249,3 +270,19 @@ export function macroDefinesOf(declarations: string | undefined): string {
   const lines = declarations.split('\n').filter((l) => l.startsWith('#define '));
   return lines.length ? lines.join('\n') + '\n' : '';
 }
+
+/** THE self-declared world's compilation context: asmlift's typedef prelude followed by this
+ *  candidate's declaration block. One composition with two callers — the cli's compile seam
+ *  (compile-command.ts, whose probe decides whether the world is self-declared at all) and the
+ *  webapp's wasm scorer, which is ALWAYS in it — because two hand-rolled copies of
+ *  `C_TYPEDEFS + decls` is exactly how the two scoring worlds come to disagree about what a
+ *  candidate was compiled in. */
+export function selfDeclaredContext(declarations: string | undefined): string {
+  return C_TYPEDEFS + (declarations ?? '');
+}
+
+/** The same context straight from a candidate's refs — what a scorer holding `Candidate`s (the
+ *  webapp) needs, and the one place that decides an empty ref list renders no block at all. */
+export function selfDeclaredContextFor(refs: SymbolRef[] | undefined): string {
+  return selfDeclaredContext(refs?.length ? renderDeclarations(refs) : undefined);
+}

package/src/frontend/mips.ts

@@ -517,6 +517,17 @@ export function lift(
     }
   });
 
+  // NO FRAME PARTITION IS CLAIMED, so every def-less slot read refuses (frontend/ssa.ts,
+  // LiveInModel). This frontend has no frame bound at all — `addiu sp,sp,±N` is transparent and
+  // every word sp-relative access becomes `sp@<rawOff>` — so its slot keys span O32's CALLER-owned
+  // register-parameter home area and the incoming stack arguments above it, where a def-less read
+  // is argument 5, not an uninitialised local.
+  //
+  // Claiming one needs the frame SIZE those offsets are measured against, which is not computed
+  // here, plus ensureParam for the register half. The ranges themselves are known: O32 reserves
+  // `[0,16)` as the caller-owned home area (in NEITHER range — caller-owned, but not an argument)
+  // with stack arguments from 16 up, which is what `mips32be.cspec`'s `<localrange>` and stack
+  // `<pentry offset="16">` encode.
   const ssa = makeSsaBuilder(name, blocks.length, preds);
   const { irBlocks, readVar, writeVar, paramReg } = ssa;
   const RET = target.returnReg;

package/src/frontend/ppc.ts

@@ -353,6 +353,17 @@ export function lift(
   // it is exempted from the loud-fail below; an UNrecovered `bctr` still fails loud.
   const jts = asmData ? recoverPpcJumpTables(instrs, asmData) : new Map<number, PpcJT>();
   const recoveredBctr = new Set([...jts.values()].map((j) => j.bctrAddr));
+  // A data reloc on an immediate-forming instruction means objdump printed a LINK-TIME
+  // placeholder (`lis r4,0` + R_PPC_ADDR16_HA sym): the real value is the symbol's half, and
+  // lifting the 0 silently reads the wrong address — plausible-but-wrong C, the forbidden class.
+  // The jump-table idiom's own @tbl pair never reaches these guards: a recovered dispatch block
+  // is the bounds branch's replaced fall-through, pruned as unreachable before decode.
+  const relocPlaceholder = (ins: Instr): void => {
+    throw new PpcUnsupportedError(
+      `cannot lift '${name}': '${ins.mnemonic}' at 0x${ins.addr.toString(16)} carries a data relocation ` +
+        `('${ins.sym}') — the printed immediate is a link-time placeholder, not the value`,
+    );
+  };
   // TRUSTWORTHINESS: fail loud on an unmodelled control transfer rather than dropping it (which
   // would silently miscompile the control flow). CTR-counted loops and indirect branches land here.
   for (const ins of instrs) {
@@ -573,17 +584,17 @@ export function lift(
           for (let k = 0; k < argc; k++) {
             args.push(read(ARG_REGS[k]));
           }
-          // Pushed with `tmp` rather than `emit` so the result register is written AFTER the clobber
-          // is recorded — the order matters: r3.. are volatile under the EABI, so a GUESSED arity
-          // that counted a register set up before an intervening call passes an argument the caller
-          // never set up (`finish()` cuts those back — frontend/ssa.ts), while the call's OWN result
-          // must stay fresh for the next call (`bar(foo())`).
+          // Pushed with `tmp` rather than `emit` so the result register is written separately from
+          // the op — r3.. are volatile under the EABI, so a GUESSED arity that counted a register
+          // set up before an intervening call passes an argument the caller never set up
+          // (`finish()` cuts those back — frontend/ssa.ts), and the call's OWN result is the
+          // CALLEE's write, so `noteCall` records the clobber after it rather than before.
           const res = kit.tmp('call', args, { target: sym });
           if (declared === undefined) {
-            ssa.recordGuessedCall(ops[ops.length - 1], bi, ARG_REGS);
+            ssa.recordGuessedCall(ops[ops.length - 1], bi, { argRegs: ARG_REGS, returnReg: RET });
           }
-          ssa.noteCall(bi);
           write(RET, res);
+          ssa.noteCall(bi);
           break;
         }
         // Stack-frame + link-register bookkeeping. `stwu r1,-N(r1)` / `addi r1,r1,N` adjust the frame
@@ -629,9 +640,16 @@ export function lift(
           write(d, read(s));
           break; // move register (or rD,rS,rS)
         case 'li':
+          // SDA21 address formation encodes rA=0, so objdump prints `li rD,0` + R_PPC_EMB_SDA21
+          if (ins.sym) {
+            relocPlaceholder(ins);
+          }
           write(d, constVal(parseImm(s)));
           break; // load immediate (addi rD,0,imm)
         case 'lis':
+          if (ins.sym) {
+            relocPlaceholder(ins);
+          }
           write(d, constVal((parseImm(s) << 16) >> 0));
           break; // load immediate shifted
         case 'add':
@@ -641,11 +659,25 @@ export function lift(
         // `addi r1,r1,N` is frame teardown (skip); any other addi is a real add-immediate.
         case 'addi':
         case 'addic':
+          // reloc first: a data reloc on a stack adjust is no known compiler's output — loud
+          if (ins.sym) {
+            relocPlaceholder(ins);
+          }
           if (d === 'r1') {
             break;
           }
           emitBin('add', d, read(s), constVal(parseImm(t)));
           break;
+        // add immediate SHIFTED — the register-based `%ha` anchor: mwcc derives an absolute base
+        // from a scaled index (`addis r4,r3,-32736` = r3 + 0x80200000). The jump-table lis/addi
+        // pair recognizer is the only reloc-carrying consumer; an addis over a register is plain
+        // arithmetic, and a reloc-carrying one is a placeholder (guard above).
+        case 'addis':
+          if (ins.sym) {
+            relocPlaceholder(ins);
+          }
+          emitBin('add', d, read(s), constVal((parseImm(t) << 16) >> 0));
+          break;
         case 'subf':
         case 'subfc':
         case 'subfo':
@@ -697,6 +729,10 @@ export function lift(
           emitBin('or', d, read(s), read(t));
           break;
         case 'ori':
+          // `ori rD,rA,sym@l` is the other @l half-former — same placeholder hazard as addi
+          if (ins.sym) {
+            relocPlaceholder(ins);
+          }
           emitBin('or', d, read(s), constVal(parseImm(t)));
           break;
         case 'xor':