@asmlift/core 0.6.0 → 0.7.0

package/README.md

@@ -85,8 +85,8 @@ injected via hooks, never copied. `verify()` runs after every IR-mutating pass;
 | `frontend/{thumb,mips,ppc}.ts`                  | ISA frontends: decode → CFG → L1 with **Braun-2013 block-arg SSA** (`ssa.ts`), incl. loops, calls (signature-driven arity), memory, jump tables. Shared scaffolding: `disasm.ts` (objdump parsing), `splat.ts` (Splat-dialect MIPS → objdump-shaped instrs), `format.ts` (input-format classification), `emit.ts` (per-block emitter kit + `switch_br`), `opaque.ts` (the unmodelled-op → loud-`opaque` contract), `errors.ts` (`FrontendUnsupportedError`; PPC's subclass), `registry.ts`, `asmdata.ts` (Regime-B jump-table side-table)                                                                                                                                                                                             |
 | `pattern/engine.ts`                             | Idiom layer: **rewrite patterns as data** + greedy driver + DCE; `patternApplies` gates on Target capabilities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | `raise/*.ts`                                    | The pre-recovery recognizers, in ONE ordered list (`pre-recovery.ts`): const materialize → magic division (`magicdiv.ts`, Hacker's Delight inverse) → soft division → array legalize → struct-array → member-array (`memberarrays.ts`, a constant offset feeding a variable-index walk is a struct's ARRAY member) → struct-pointer → short-circuit → narrow-reads (`narrow.ts`) → narrow locals (`narrowlocal.ts`, a carrier read only through its own extension IS that width) → parameter width (`paramwidth.ts`, a parameter extended in the prologue is DECLARED at that width); plus `recover.ts` (L1→L2 type recovery), `retsink.ts` (return-sinking), `latch.ts` (empty-latch folding), `errors.ts` (`RaiseUnsupportedError`) |
-| `structure/*.ts`                                | L2→L3 in six modules: `loops.ts` (natural-loop discovery, over `ir/core.ts`'s dominators), `analysis.ts` (use registry, liveness, C4 materialization), `switch-recover.ts` (Regime-A comparison-tree recovery), `hazards.ts` (the checks a loop emitter runs before committing to a loop form), `namecoalesce.ts` (copy coalescing over the interference graph — the `/merge-names` axis), `structure.ts` (SSA-destruction coalescing with interference checks + emission: if/while/do-while/for/switch, break/early-return)                                                                                                                                                                                                          |
-| `l3/*.ts`                                       | `ast.ts`: language-**neutral** structured AST, the one traversal vocabulary (`exprChildren` etc.), and the `LanguageBackend` seam. Post-structure passes `dce.ts` + `basecse.ts`, the shared hoist mechanism `hoist.ts`, the differ-ranked re-spelling levers `regspell.ts` + `reindex.ts` + `argbase.ts` + `scopebase.ts`, and `typing.ts` (the rendered-expression C type the backends and contracts share)                                                                                                                                                                                                                                                                                                                         |
+| `structure/*.ts`                                | L2→L3 in six modules: `loops.ts` (natural-loop discovery, over `ir/core.ts`'s dominators), `analysis.ts` (use registry, liveness, C4 materialization), `switch-recover.ts` (Regime-A comparison-tree recovery), `hazards.ts` (the checks a loop emitter runs before committing to a loop form), `namecoalesce.ts` (copy coalescing over the interference graph — the `/merge-names` variation), `structure.ts` (SSA-destruction coalescing with interference checks + emission: if/while/do-while/for/switch, break/early-return)                                                                                                                                                                                                     |
+| `l3/*.ts`                                       | `ast.ts`: language-**neutral** structured AST, the one traversal vocabulary (`exprChildren` etc.), and the `LanguageBackend` seam. Post-structure passes `dce.ts` + `basecse.ts`, the shared hoist mechanism `hoist.ts`, the differ-ranked respell variations `regspell.ts` + `reindex.ts` + `argbase.ts` + `scopebase.ts`, and `typing.ts` (the rendered-expression C type the backends and contracts share)                                                                                                                                                                                                                                                                                                                         |
 | `backend/{c,cpp,cfamily,pascal}.ts`             | Three backends: C and C++ (CodeWarrior mangling via `mangle.ts`) over the shared `cfamily.ts` substrate, and Pascal (`:=`, `div`, tail-position returns; unspellable constructs throw)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | `pipeline.ts`                                   | `decompile()` + the shared tower spine + annotate-mode stubs/diagnostics                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `trace.ts`                                      | `decompileTraced` — the traced tower (per-stage IR dumps + pattern before/after events), browser-pure; @asmlift/cli's `report.ts` enriches it with objdiff scores/candidates, the playground's Pipeline tab renders it directly                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@asmlift/core",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "license": "MIT",
   "type": "module",
   "description": "Match decompile an assembly function to C or Pascal",

package/src/backend/cfamily.ts

@@ -80,10 +80,18 @@ export function cType(t: IrType): string {
 
 /** Declare a name of a given type, C declarator rules: an array puts its length AFTER the name
  *  (`u8 _pad[4]`), a pointer binds its `*` to the declarator (`void *p`), everything else is
- *  the prefix `cType name`. */
+ *  the prefix `cType name`. A NESTED array spells every extent after the name in declaration
+ *  order (`u8 unk8[6][8]`) — one declarator, not an element type that is itself an array, which
+ *  C has no syntax for and `cType` marks ill-formed as a prefix. */
 function cDeclare(t: IrType, name: string): string {
   if (t.kind === 'array') {
-    return `${cType(t.elem)} ${name}[${t.count}]`;
+    const extents: number[] = [];
+    let e: IrType = t;
+    while (e.kind === 'array') {
+      extents.push(e.count);
+      e = e.elem;
+    }
+    return `${cType(e)} ${name}${extents.map((n) => `[${n}]`).join('')}`;
   }
   if (t.kind === 'ptr') {
     return `${cType(t.to)} *${name}`;
@@ -136,7 +144,19 @@ export type LeafHook = (e: Expr, rec: (e: Expr, p: number) => string) => string
  *  -fprologue-bugfix`), and referring to a volatile object through a non-volatile lvalue is
  *  undefined behaviour (C99 6.7.3p5). */
 function legalizedIndexBase(ix: Extract<Expr, { k: 'index' }>, vt: PrintEnv): Expr {
-  return derefStrideOk(exprCType(ix.base, vt.type), ix.width, ix.signed)
+  // `baseElem` states the element type the base's own DECLARATION gives it, where the type walk
+  // cannot reconstruct one (a map-declared array MEMBER — see l3/ast.ts). It is a FALLBACK, not an
+  // override, and the order is the whole guard: the walk reads the tree in front of it, so
+  // wherever it answers at all it is the better answer and the stated one is not consulted.
+  // Inverted (`declared ?? walked`), a stale statement would stand — `derefStrideOk` cannot catch
+  // one, because it tests the STATED type against the access width and never against the base.
+  // No pass carries a statement onto a foreign base today (each refuses a `field` base by its own
+  // predicate: basecse `isHoistableBase`, scopebase/argbase `eligible`, nearbase's untouched
+  // `field` subtree, reindex's `base.k === 'var'`), but `mapExprChildren` spreads the field across
+  // an arbitrary base substitution, so that is five accidents rather than a check. This ordering
+  // is the check. Measured: zero test moves either way.
+  const declared = ix.baseElem !== undefined ? T.ptr(ix.baseElem) : undefined;
+  return derefStrideOk(exprCType(ix.base, vt.type) ?? declared, ix.width, ix.signed)
     ? ix.base
     : {
         k: 'cast',
@@ -226,11 +246,19 @@ function printExpr(e: Expr, parentPrec: number, vt: PrintEnv, leaf?: LeafHook):
       // Leading constant subscripts (a multidimensional array global's bare spelling) keep the
       // postfix form whatever `idx` is: `g[0][0]` is the element, `*g[0]` would be its ROW.
       //
-      // `lead` implies the base already strides the access width — its only producers register a
-      // matching element type for the global (structure/globalaccess.ts `bareArrayLead` and
-      // `declaredSubscripts`, both through structure.ts's `noteGlobal`). Nothing
-      // else enforced that, and the failure would be quiet-ish: legalization would wrap the base,
-      // spelling `((u16 *)g)[0][i]`, which subscripts a `u16` twice. Check it rather than assume.
+      // `lead` implies the base already strides the access width, and its producers reach that by
+      // TWO different mechanisms. The two GLOBAL ones register a matching element type for the
+      // global (structure/globalaccess.ts `bareArrayLead` and `declaredSubscripts`, both through
+      // structure.ts's `noteGlobal`, so the type walk finds it); the MEMBER one
+      // (structure.ts `pointeeElement`, `gPtr->grid[0][i]`) has no global to register and states
+      // the element type on the node instead (`baseElem`). Nothing else enforced either, and the
+      // failure would be quiet-ish: legalization would wrap the base, spelling `((u16 *)g)[0][i]`,
+      // which subscripts a `u16` twice. Check it rather than assume.
+      //
+      // This throw covers rank >= 2 ONLY, because only a rank >= 2 access carries `lead`. A rank-1
+      // member (the large majority of the corpus's dims-carrying members) has no guard here: a
+      // missing or stale `baseElem` there degrades silently to the cast form the rule replaces,
+      // which is a lost spelling rather than a wrong address.
       if (e.lead && e.lead.length > 0) {
         if (base !== e.base) {
           throw new Error(
@@ -396,8 +424,8 @@ function printSwitchStmt(s: Extract<Stmt, { k: 'switch' }>, indent: string, vt:
   // arm first, loudly), so it is a contract on the next one.
   //
   // `continue;` is deliberately NOT refused: C binds it to the smallest enclosing ITERATION
-  // statement, which a `switch` is not, so it already means what L3 means. What a loop-respelling
-  // pass must preserve is exactly that — the three that can re-spell a loop into one whose
+  // statement, which a `switch` is not, so it already means what L3 means. What a pass that re-spells
+  // a loop must preserve is exactly that — the three that can re-spell a loop into one whose
   // `continue` would run a different increment (`recognizeForLoops` in structure.ts,
   // `respellCountdown` in l3/reindex.ts, and l3/unreduce.ts) each scan switch arms for the node
   // before firing, and a fourth must too.
@@ -539,7 +567,7 @@ function cFamilyBody(fn0: SFn, leaf?: LeafHook): string[] {
     // differently: on a scalar the qualifier binds to the object (`volatile u16 sp0`), on a
     // pointer declarator to the pointee — the INNERMOST one for a multi-level pointer
     // (`volatile u16 ** p`). An object-volatile POINTER (`u16 *volatile p`) has no inhabitant —
-    // no lever or recognizer produces one.
+    // no variation or recognizer produces one.
     lines.push(`    ${l.volatile || l.pointeeVolatile ? 'volatile ' : ''}${cType(l.type)} ${l.name};`);
   }
   for (const s of fn.body) {

package/src/contracts.ts

@@ -16,6 +16,7 @@ import {
   stmtLists,
   walkExprs,
 } from './l3/ast';
+import { mentionedLocals } from './l3/mentions';
 import { declaredTypes, exprCType } from './l3/typing';
 
 export class ContractError extends Error {
@@ -277,10 +278,58 @@ export function assertLocalsWritten(sfn: SFn): void {
   }
 }
 
-/** Post-lever: every read of a MINTED local — its ADDRESS being taken included — must sit where
+/** After a respell variation: a local a pass DELETED from the declaration list is named nowhere in the tree it
+ *  produced.
+ *
+ *  THE FAILURE THIS CATCHES is the mirror of `assertLocalsWritten` above, and the three contracts
+ *  beside it do not see it. A pass that consumes a local — l3/unmerge.ts substituting a merge temp
+ *  into the arms, l3/coalesce.ts folding two names into one, l3/inlinebase.ts deleting a
+ *  const-address pointer — drops the name from `sfn.locals` on the strength of an in-pass count
+ *  that it is no longer mentioned. If that count is ever wrong the result is not a loud variation
+ *  error: it is a candidate handed to the compiler with an undeclared identifier. Normally that is
+ *  a dropped candidate, but in the REAL tier the candidate is compiled inside the project's
+ *  vendored translation unit, where an orphaned name that collides with a context symbol compiles
+ *  and scores. Measured on the shape that inhabits it — `locals = [p]`, body `p = 0; v16 = 1;
+ *  *p = v16;` — `assertResolved`, `assertDerefsTyped` and `assertLocalsWritten` all pass: the name
+ *  is neither `?` nor `undefined`, it is well-typed, and the question the third one asks is the
+ *  OPPOSITE one (read but never written).
+ *
+ *  A DIFFERENTIAL, and that is what makes it safe to run on every respelled tree. "Every name the tree
+ *  mentions is declared" is NOT the invariant and would refuse correct output everywhere:
+ *  structure.ts spells a write to a scalar global as a bare `assign` whose name is declared in the
+ *  project's headers and nowhere in the tree (`gBlendValue = v;` — 71 such occurrences across 22
+ *  winning sources, per l3/unmerge.ts's own note), and `SFn.globals` is the symbol-map-shaped
+ *  subset, not that population. So the check speaks only about names the tree ITSELF declared a
+ *  moment ago and the pass then removed — a set with no legitimate inhabitant, because a pass that
+ *  drops a declaration is asserting exactly this.
+ *
+ *  `addr` counts, like everywhere else: `&v` names the object as surely as a read does. */
+export function assertNoOrphanedLocals(before: SFn, after: SFn): void {
+  const kept = new Set(after.locals.map((l) => l.name));
+  const dropped = new Set(before.locals.map((l) => l.name).filter((n) => !kept.has(n)));
+  if (!dropped.size) {
+    return;
+  }
+  // `l3/mentions.ts`'s walk, not a third copy of the node vocabulary — this is the LOUD BACKSTOP
+  // for the mistake that predicate guards, so it is the last place that should own its own.
+  // Locals only, deliberately: no L3 respell variation drops `SFn.params` (`pruneDeadParams` is L1 block
+  // params, ir/simplify.ts), so a params arm here would be a refusal with no inhabitant.
+  const found = mentionedLocals(after.body, dropped);
+  if (found.size) {
+    throw new ContractError(
+      `a respell variation deleted the declaration of ${[...found]
+        .sort()
+        .map((n) => `'${n}'`)
+        .join(', ')} in '${after.name}' ` +
+        `while the tree still names ${found.size > 1 ? 'them' : 'it'} — an undeclared identifier in the candidate`,
+    );
+  }
+}
+
+/** After a respell variation: every read of a MINTED local — its ADDRESS being taken included — must sit where
  *  that local's assignment has already run.
  *
- *  THE failure a placing lever can ship, and the only one the byte differ rewards: a base local whose
+ *  THE failure a placing variation can ship, and the only one the byte differ rewards: a base local whose
  *  assignment does not reach a use is a DIFFERENT VARIABLE — C that compiles, scores, and can win
  *  (the shape #106 shipped). `contracts.ts`'s `assertLocalsWritten` does not see it: it accumulates
  *  reads and writes as SETS over the whole body, so a local assigned in one arm and read after the
@@ -288,16 +337,16 @@ export function assertLocalsWritten(sfn: SFn): void {
  *
  *  Checked on the EMITTED tree rather than argued from the plan, because the plan is what a bug
  *  would be in. `rank.ts`'s `respell` catches the throw and drops the candidate, so the wrong
- *  answer becomes a reported lever error instead of a scored spelling.
+ *  answer becomes a reported variation error instead of a scored spelling.
  *
  *  IT LIVES HERE, beside `assertLocalsWritten`, because it has that check's population and that
- *  check's call site: levers that place a def — l3/sinkinit.ts, l3/basecse.ts's first-use policy,
+ *  check's call site: respell variations that place a def — l3/sinkinit.ts, l3/basecse.ts's first-use policy,
  *  l3/nearbase.ts, l3/reindex.ts, l3/scopebase.ts, l3/argbase.ts — are the population that can
- *  produce the failure, so the check belongs on every lever tree rather than on one lever's.
+ *  produce the failure, so the check belongs on every respelled tree rather than on one variation's.
  *
- *  Called ABSOLUTELY by the placing levers that put an init inside a nested list, each over its own
+ *  Called ABSOLUTELY by the placing variations that put an init inside a nested list, each over its own
  *  plan; everywhere else it is reached through `assertPlacementSurvives` below, which is a
- *  DIFFERENTIAL — so a placement no lever's tree ever satisfied is not judged, and a lever that
+ *  DIFFERENTIAL — so a placement no respelled tree ever satisfied is not judged, and a variation that
  *  mints nothing is not judged at all.
  *
  *  A nested list gets a COPY of the reaching set, so an assignment inside one arm does not count as
@@ -357,13 +406,13 @@ export function assertHoistsDominate(sfn: SFn, minted: ReadonlySet<string>): voi
 }
 
 /** The same guarantee across a re-spelling that MOVES statements over a placement another pass
- *  already made — `rank.ts`'s statement shapes (`/initfirst`, `/pollguard`, `/pollread`), derived
- *  onto every lever tree after the lever placed its defs, and the lever-on-lever compositions in
+ *  already made — `rank.ts`'s stacked variations (`/initfirst`, `/pollguard`, `/pollread`), derived
+ *  onto every respelled tree after the variation placed its defs, and the variation-on-variation compositions in
  *  the same file where a def-moving pass (`sinkInitsToFirstUse`, `nearBaseClusters`,
- *  `reindexWalks`) runs on a tree a placing lever built. `pollReads` folds a materialized re-read
+ *  `reindexWalks`) runs on a tree a placing variation built. `pollReads` folds a materialized re-read
  *  back into a loop condition, which is exactly such a move.
  *
- *  A DIFFERENTIAL, which is what makes it safe on every lever: the walk judges the reshaped tree
+ *  A DIFFERENTIAL, which is what makes it safe on every variation: the walk judges the reshaped tree
  *  only where it already described the unshaped one, so a placement it cannot model (a def inside
  *  a loop body read earlier in the same body is assigned on every iteration but the first) is not
  *  judged either way. `minted` may name a local `before` does not carry — a mover mints its own —

package/src/frontend/ssa.ts

@@ -742,7 +742,7 @@ export function trimClobberedCallArgs(inp: CallArgTrim): void {
  *  an attr only one of an otherwise-matching pair carries would cost a recovery. */
 const setupArgc = new WeakMap<Op, number>();
 
-/** Whether anything in `fn` HAS the narrower reading — the lever's gate, so the ~99% of functions
+/** Whether anything in `fn` HAS the narrower reading — the variation's gate, so the ~99% of functions
  *  with no narrowable call cost no re-lift. Read it off the lift itself: a later pipeline stage may
  *  replace a `call` op (softdiv rewrites one to a division), and the table is keyed by op. */
 export function hasSetupArgsNarrowing(fn: Fn): boolean {

package/src/frontend/thumb.ts

@@ -932,7 +932,7 @@ function decode(
       const ad = rest.match(/^\.(align|balign|p2align)([wl]?)\b\s*(.*)$/i);
       if (ad) {
         const kind = ad[1].toLowerCase();
-        const patternFill = ad[2] !== ''; // the `w`/`l` variants
+        const patternFill = ad[2] !== ''; // the `w`/`l` forms
         const am = ad[3].trim().match(/^(\d{1,3})(?:\s*,\s*([^,]*?))?\s*$/); // N [, fill]; max-skip → no match
         const n = am ? Number(am[1]) : NaN;
         const pow = kind === 'balign' ? Math.log2(n) : n;
@@ -3416,7 +3416,7 @@ export function lift(
   // handed to a callee arrives there through a frame this conjunct never looks at, and what bounds
   // its extent is the audit's frame-accounting rule rather than anything here.
   //
-  // WHY IT IS NOT WIDENED anyway, since a wider frame is the obvious next lever. Three shapes,
+  // WHY IT IS NOT WIDENED anyway, since a wider frame is the obvious next change. Three shapes,
   // each compiled with agbcc 2.9-arm-000512, `-O2 -mthumb-interwork -Wimplicit -fhex-asm
   // -fprologue-bugfix`, and only the first is about extent at all:
   //

package/src/ir/alias.ts

@@ -86,6 +86,30 @@ export function globalCellOf(defs: Map<Value, Op>, addr: Value, off: number): Gl
   return null;
 }
 
+/**
+ * The NUMERIC address an access denotes, resolved through defs alone — a literal base, or the sum
+ * of two literals — plus the access's own `off`. Null when the address
+ * does not reduce to a literal: a `gaddr` (ask {@link globalCellOf} instead), a parameter, a
+ * materialized base, anything carrying a runtime term.
+ *
+ * The caller that has one asks a question about the BOARD — "is this cell a hardware register" —
+ * so a null here must be read as "unknown", never as "ordinary memory".
+ */
+export function constAddressOf(defs: Map<Value, Op>, addr: Value, off: number): number | null {
+  const d = defs.get(addr);
+  if (d?.opcode === 'const') {
+    return (d.attrs.value as number) + off;
+  }
+  if (d?.opcode === 'add' && d.operands.length === 2) {
+    const a = defs.get(d.operands[0]);
+    const b = defs.get(d.operands[1]);
+    if (a?.opcode === 'const' && b?.opcode === 'const') {
+      return (a.attrs.value as number) + (b.attrs.value as number) + off;
+    }
+  }
+  return null;
+}
+
 /**
  * Are these two accesses through ONE base provably different byte cells — same base value, both at
  * a constant offset and width, ranges non-overlapping? The everyday struct interleave

package/src/ir/core.ts

@@ -117,6 +117,14 @@ export type SlotHomes = Map<Value, Set<number>>;
  *  param have no common scale. LAST write, not first: a predecessor commonly writes one key several
  *  times (1,867 of 5,283 records over three checkouts), and the edge carries what the last left.
  *
+ *  A SECOND CONSUMER READS THE ABSENCE, not the order. `structure.ts`'s `enclosingCarrierName` takes
+ *  a missing `lastWrite` entry on a measured block as the licence to give a nested loop's parameter
+ *  the enclosing header's NAME: the key was not written, so the machine carried the value into the
+ *  inner loop in the register it had — one variable, not a copy. There a stale or over-eager "not
+ *  written" is not a mis-sorted copy but a copy the emitted C no longer makes, so the absence
+ *  semantics below are load-bearing for naming, and a pass that drops a record it should have
+ *  folded changes spellings, not just orders.
+ *
  *  Keyed by OBJECTS (the predecessor block, the destination param), never by arg position, so the
  *  param splices in `ir/simplify.ts` cannot leave it stale. A pass that moves one block's ops into
  *  another owes `foldWriteOrder`.

package/src/ir/opcodes.ts

@@ -237,11 +237,11 @@ export const NEGATED_ICMP: Readonly<Record<string, Opcode>> = Object.fromEntries
 /** Ops with an observable side effect: the flag on the signature, derived rather than re-listed.
  *  `isDceSafe` asks the same question of the FLAG through `opSig` rather than of this set, so the
  *  two cannot disagree. The SET's own consumers are `HOIST_UNSAFE_OPS` below, structure.ts's
- *  `sideEffects` walk (an effectful op whose result nobody reads is still an execution),
+ *  block-purity tests (may this block be folded into a loop header, is this exit owned),
  *  analysis.ts's memory-write barrier, divpow2's bias block (which is DELETED rather than moved),
- *  and the idiom layer's de-sequencing guard (pattern/engine.ts). Three of them —  the
- *  `sideEffects` walk, the barrier and the bias block — each carried a hand-written copy of this
- *  membership, which is how the models drifted apart before. */
+ *  and the idiom layer's de-sequencing guard (pattern/engine.ts). Derived rather than re-listed
+ *  because three of those consumers each carried a hand-written copy of this membership, which is
+ *  how the models drifted apart. */
 export const EFFECTFUL_OPS: ReadonlySet<string> = new Set(
   (Object.keys(OPCODES) as Opcode[]).filter((k) => (OPCODES[k] as OpSig).effects),
 );
@@ -254,8 +254,9 @@ export const EFFECTFUL_OPS: ReadonlySet<string> = new Set(
  *  is raise/shortcircuit.ts, which hoists an arm's body into the block above, and the structurer
  *  inlines an unnamed value back into the `&&`/`||` right-hand side, where C's own short-circuit
  *  re-guards it. Adding the two reads
- *  here costs three byte-matches (kleod:UpdateHUDCounterDisplay, synthetic:breakloop,
- *  synthetic:strcmp1), so the argument is load-bearing rather than merely plausible.
+ *  here cost three byte-matches (kleod:UpdateHUDCounterDisplay, retired 2026-09-13 with its source,
+ *  plus synthetic:breakloop and synthetic:strcmp1), so the argument was load-bearing rather than
+ *  merely plausible. Not re-measured since the kleod row's retirement.
  *
  *  KNOWN GAP: the trapping divides are absent too, and there the re-guard argument does NOT carry
  *  — a hoisted `sdiv` that the structurer NAMES becomes an unconditional statement. Left as it is
@@ -271,9 +272,20 @@ export const EFFECTFUL_OPS: ReadonlySet<string> = new Set(
  *  re-guard at the new point — actually holds at your call site. */
 export const HOIST_UNSAFE_OPS: ReadonlySet<string> = EFFECTFUL_OPS;
 
+/** The ops whose `operands[0]` is a memory-access BASE: `load base`, `store base, value`,
+ *  `aload base, index`, `astore base, index, value` (the operand roles are in the registry above).
+ *  Authored rather than derived — no registry field records the operand ROLE, and the only other
+ *  memory-touching opcode is `call`, whose variadic operands are arguments and not a base.
+ *
+ *  Two consumers ask two different questions of it and both need the same answer, which is why it
+ *  is here and not next to either: `structure/analysis.ts` uses it for the address-home variation's slot
+ *  model, and `raise/const.ts` to recognise a folded literal that IS an address. */
+export const MEM_BASE_OPS: ReadonlySet<string> = new Set(['load', 'store', 'aload', 'astore']);
+
 /** Ops whose answer depends on WHERE they run: an effect (its order against other effects is
  *  observable) or a memory read (it answers whichever stores ran before it). The question a pass
- *  asks before moving a computation to another point on the SAME path. */
+ *  asks before moving a computation to another point on the SAME path. `SPELLED_WHEN_DEAD_OPS`
+ *  below asks a DIFFERENT question and derives, today, the same set. */
 export const ORDER_SENSITIVE_OPS: ReadonlySet<string> = new Set(
   (Object.keys(OPCODES) as Opcode[]).filter((k) => {
     const sig = OPCODES[k] as OpSig;
@@ -281,6 +293,30 @@ export const ORDER_SENSITIVE_OPS: ReadonlySet<string> = new Set(
   }),
 );
 
+/** Ops the structurer must still SPELL when nothing consumes their result — an effect, or a memory
+ *  READ. Consumer: structure.ts's `sideEffects` walk.
+ *
+ *  The read half is the entry worth arguing, because `reads` documents the OPPOSITE about C — a
+ *  load nobody reads is deletable, nothing observes it. That is the C claim. The COMPILER claim
+ *  points the other way: an optimizing compiler deletes every dead read it is ALLOWED to delete, so
+ *  one still in the target is evidence the source's access was `volatile`. Membership here only
+ *  says the structurer may not drop the op silently; whether a `volatile` can actually reach the
+ *  access is a second, ADDRESS-level question the call site asks separately
+ *  (structure.ts `volatileQualifiable`), and a read it answers no to is dropped as before.
+ *
+ *  DERIVED FROM THE REGISTRY, not aliased to `ORDER_SENSITIVE_OPS`, even though the two are
+ *  extensionally identical today and `HOIST_UNSAFE_OPS` above does alias `EFFECTFUL_OPS`. An alias
+ *  makes two DIFFERENT questions incapable of ever differing, so the day one of them acquires an
+ *  opcode the other should not have, the edit lands on both silently. The identity is pinned by a
+ *  test instead (test/pattern.test.ts), where a future divergence surfaces as a decision to make
+ *  rather than a coupling nobody sees. */
+export const SPELLED_WHEN_DEAD_OPS: ReadonlySet<string> = new Set(
+  (Object.keys(OPCODES) as Opcode[]).filter((k) => {
+    const sig = OPCODES[k] as OpSig;
+    return sig.effects || sig.reads;
+  }),
+);
+
 /** Ops that may not be RE-EVALUATED at another program point — order-sensitive, or trapping. The
  *  trap half is what separates this from `ORDER_SENSITIVE_OPS`: it only matters when the new point
  *  can be reached on a path the old one was not, so a consumer that merely re-orders on one path

package/src/ir/simplify.ts

@@ -105,7 +105,7 @@ function trivialPhiValue(incoming: readonly Successor[], i: number, param: Value
 export function firstTrivialPhi(fn: Fn): { block: Block; param: Value } | null {
   // ONE pass over the successor edges, indexed by target — `simplifyTrivialPhis` rescans the
   // whole function per block, which is fine for a mutating fixpoint and not for a check on the
-  // raising tower's hot path (a candidate fan re-raises the same function once per lift variant).
+  // raising tower's hot path (a candidate fan re-raises the same function once per lift).
   const incomingOf = new Map<Block, Successor[]>();
   for (const pb of fn.blocks) {
     for (const op of pb.ops) {

package/src/l3/address.ts

@@ -7,8 +7,8 @@
 // declares which one it means instead of restating four lines and drifting.
 //
 //   • baseConst   — a deref BASE, through SCALAR pointer casts only. A cast to a STRUCT pointer is
-//     the dot-form's base and is refused, because a lever that re-spells THROUGH it collapses the
-//     stride (`((struct S *)K)[i].f` is not `((u8 *)K)[…]`). This is the reading a lever that
+//     the dot-form's base and is refused, because a respell variation that re-spells THROUGH it collapses the
+//     stride (`((struct S *)K)[i].f` is not `((u8 *)K)[…]`). This is the reading a respell variation that
 //     REWRITES the base needs: l3/nearbase.ts's clusters, l3/volstore.ts's qualifier.
 //   • addrConst   — the address an expression IS, through ANY pointer cast. Wider, and safe
 //     because nothing re-spells through it: l3/volatileptr.ts counts volatility claims with it.