@asmlift/core 0.6.0 → 0.7.0

package/src/l3/advance.ts

@@ -0,0 +1,373 @@
+// L3 respell variation: a pointer local the source ADVANCED between two accesses, rather than two
+// addresses the compiler derived from one.
+//
+// `ldr r3,=X; strh [r3]; adds r3,#2; strh [r3]` — the machine held an address in a register, used
+// it, moved it, used it again. `raise/const.ts` folds the lift's `add(const X, const 2)` into the
+// literal `X + 2`, because on Thumb that pair is also how a compiler materialises a 32-bit literal
+// it cannot encode in one instruction, and it records the distinction it is erasing as
+// `index.baseAdvanced` (l3/ast.ts's third evidence field). This pass reads it:
+//
+//     *(u16 *)0x04000048 = a;  *(u16 *)0x0400004A = b;
+//   → u16 *p = (u16 *)0x04000048;  *p = a;  p = p + 1;  *p = b;
+//
+// WHY IT IS A CANDIDATE. Against the INDEXED spelling of the same minted local the advance buys
+// nothing: agbcc folds `p = p + 1; *p` straight back into `strh [r3, #2]`, byte for byte the
+// subscript's own object. What makes it visible is the CONJUNCTION with a `volatile` pointee,
+// which bars that fold and leaves the `add` the target records. Both halves are compiled against
+// `kleod:StreamCmd_SetWindowRegs`'s target object; the four corners are in test/advance.test.ts's
+// header. So this pass emits a spelling and `compareScored` referees; nothing here claims the
+// source wrote it.
+//
+// SOUNDNESS IS ADDRESS EQUALITY. `p` is freshly minted and assigned by nothing else, so at each
+// member's access it holds `A0 + Σ steps so far` — that member's own absolute address — PROVIDED
+// every advance sits between the accesses it separates on every path, and PROVIDED every node this
+// pass re-spells as `*p` is one of those accesses. A top-level statement list has no back edge and
+// runs its statements in order at most once each, so placing each advance at the top level
+// immediately above its member's statement, with the members at STRICTLY INCREASING top-level
+// indices, carries the first half.
+//
+// THE SECOND HALF IS `rewrite`, AND IT MATCHES BY ADDRESS, NOT BY IDENTITY (`:rewrite` below): it
+// replaces EVERY `index` node whose `cellAddress` is a chain member's, wherever it sits. So a
+// second access at a member's address — a twin at the top level, or one inside an arm or a loop
+// body — is re-spelled `*p` at a point where `p` does not hold that address. The two rules that
+// refuse those shapes (`member-second-site`, `member-nested-site`, and their head twins) are
+// therefore SOUND, not narrowing, and the shape is pinned by test/advance.test.ts's `an access at
+// a chain address inside a loop is not re-spelled`.
+//
+// SCOPE (decline over approximate) is `ADVANCE_HEAD_GATES` and `ADVANCE_MEMBER_GATES` below — as
+// tables rather than an `||` chain, so `sound` costs a `guardedBy` and every rule is ablated
+// against the real pass by test/advance.test.ts's battery, which records WHAT THE ABLATED PASS
+// EMITS and checks `sound` against it. NOT by `bench gates`: `pnpm bench gates --pass advance`
+// answers `no censusable pass "advance"`, and structurally must, because this pass is reached
+// through a static import binding in rank.ts rather than through a mutable caller-side record
+// (run/gate-census.ts's header, which measures the `TypeError` a module-namespace write raises).
+// The firing census below was therefore taken by hand, with the recipe it states.
+//
+// FIVE OF THE TWELVE ARE NARROWING rather than soundness and each says which it is. Three are
+// judgements about what the asm shows (`head-already-advanced`, `member-negative-step`,
+// `member-no-evidence` — the last is what makes this a reading rather than a guess); one,
+// `member-signedness`, buys the minted local ONE pointee type where the backend would otherwise
+// spell a correct reinterpret cast; one, `member-element-grid`, is a LOUD refusal — ablated it
+// emits `p0 = p0 + 0.5;`, which is not C. Dropping `member-no-evidence` alone leaves the emitted
+// step `undefined / width` = `NaN`, refused downstream only by the two arithmetic rules'
+// comparisons against it (`NaN % w !== 0`, `NaN !== addr`); the battery's `noncompile` verdicts
+// for both are what hold that.
+//
+// HOW OFTEN EACH FIRES, over the whole corpus — `bench sweep --fan`, both arms, 2,126 records,
+// instrumented on `firstRejection` (2026-09-12), which is HAND INSTRUMENTATION and reproduced by
+// wrapping both tables in `tallying()` (l3/gates.ts) at this pass's one call site in rank.ts,
+// passing `.gates` to `advancedBases`, and printing `.refusals()` when the sweep ends. The numbers
+// count CALLS, and enumeration calls this pass about eleven times per record, once per structure setting's
+// tree:
+//     23,322 calls · 112 found a chain · 23,210 declined
+//     head-second-site 872 · member-no-evidence 664 · head-nested-site 256 · head-already-advanced 144
+//     every other member rule: 0
+// So the eight remaining member rules are pinned by the battery and by NOTHING IN THE CORPUS —
+// where the corpus refuses a chain, it refuses it at the head. Chain lengths found: 96 of two
+// members and 16 of four, no others.
+//
+// WHAT THIS PASS DOES NOT DO, both measured rather than assumed:
+//   • A function with TWO disjoint chains gets one candidate, spelling the FIRST BY POSITION — not
+//     the longest, and the second chain is unreachable by any variation. ZERO of the 112 chain-bearing
+//     calls above held a second chain sharing no address with the first (the instrument kept
+//     scanning), so the second local this would need has no inhabitant to price it.
+//   • The init is `prepend`ed and there is no sunk twin; see the note at `placeBaseLocals` below.
+//   • IT IS MAP-LESS ONLY. Every member is reached through `cellAddress`, which answers null once
+//     a symbol map promotes the pool word to `&REG_WININ` — so with a map this pass enumerates
+//     nothing, and every `/advance` candidate the corpus carries is a `/raw-globals` one. That is
+//     what caps the variation at the six rows `bench sweep --fan --base origin/main` names
+//     (apps/benchmark/dataset/synthetic.ts, at `volwalk`), and it is the question to ask of it the
+//     day the symbol-map direction lands: this capability survives only if `cellAddress` learns
+//     the promoted form.
+import { type IrType, scalarTypeForAccess } from '../ir/types';
+import { cellAddress } from './address';
+import { type Expr, type SFn, type Stmt, mapExprChildren, mapStmtExprs, stmtChildren, stmtExprs } from './ast';
+import { type Gate, firstRejection } from './gates';
+import type { BaseInit } from './hoist';
+import { nameAllocator, placeBaseLocals } from './hoist';
+
+/** One const-addressed access, with the top-level statement it was reached at. */
+export interface Site {
+  stmt: number;
+  addr: number;
+  width: number;
+  signed: boolean;
+  advanced?: number;
+}
+
+/** One candidate member, judged against the chain so far. `twin`/`nested` are the two ways some
+ *  OTHER node in the tree names this site's address — the facts `rewrite`'s by-address match makes
+ *  load-bearing. */
+export interface MemberCtx {
+  prev: Site;
+  site: Site;
+  twin: boolean;
+  nested: boolean;
+}
+export type HeadCtx = Omit<MemberCtx, 'prev'>;
+
+/** The head's own admission. The two address rules are the same PREDICATE as the member table's
+ *  and deliberately not the same rule objects (see gates.ts on why a second consumer owns its
+ *  own): a head that is re-spelled at a second site is wrong for the same reason a member is. */
+export const ADVANCE_HEAD_GATES: readonly Gate<HeadCtx>[] = [
+  {
+    id: 'head-second-site',
+    why: 'the rewrite finds accesses by address, so another access to the same address would read `p` before it is set',
+    sound: true,
+    guardedBy: 'advance.test.ts: a chain address reached at a second site declines',
+    rejects: (c) => c.twin,
+  },
+  {
+    id: 'head-nested-site',
+    why: 'the same address inside an arm or a loop body is re-spelled at a point `p` may not hold',
+    sound: true,
+    guardedBy: 'advance.test.ts: an access at a chain address inside a loop is not re-spelled',
+    rejects: (c) => c.nested,
+  },
+  {
+    id: 'head-already-advanced',
+    why: 'an access the machine reached by stepping from an earlier one continues that chain, and starting a chain there would load an address the machine never loaded',
+    sound: false,
+    guardedBy: 'advance.test.ts: a chain may not START at an advanced site',
+    rejects: (c) => c.site.advanced !== undefined,
+  },
+];
+
+/** Each successor, against the member before it. FIRST rejection wins, so a refusal is
+ *  attributable to one rule. */
+export const ADVANCE_MEMBER_GATES: readonly Gate<MemberCtx>[] = [
+  {
+    id: 'member-no-evidence',
+    why: 'where the lift recorded no step, the pair is the compiler deriving two addresses from one literal',
+    sound: false,
+    guardedBy: 'advance.test.ts: the same pair with no evidence declines',
+    rejects: (c) => c.site.advanced === undefined,
+  },
+  {
+    id: 'member-second-site',
+    why: 'the rewrite finds accesses by address, so another access to the same address would read `p` at the wrong value',
+    sound: true,
+    guardedBy: 'advance.test.ts: a chain address reached at a second site declines',
+    rejects: (c) => c.twin,
+  },
+  {
+    id: 'member-nested-site',
+    why: 'the same address inside an arm or a loop body is re-spelled at a point `p` may not hold',
+    sound: true,
+    guardedBy: 'advance.test.ts: an access at a chain address inside a loop is not re-spelled',
+    rejects: (c) => c.nested,
+  },
+  {
+    id: 'member-statement-order',
+    why: 'the advance must sit between the two accesses it separates, so the indices must increase',
+    sound: true,
+    guardedBy: 'advance.test.ts: two accesses in ONE statement are not a chain',
+    rejects: (c) => c.site.stmt <= c.prev.stmt,
+  },
+  {
+    id: 'member-width',
+    why: 'the new pointer has one pointee width, and `*p` at another width names other bytes',
+    sound: true,
+    guardedBy: 'advance.test.ts: members of different widths decline',
+    rejects: (c) => c.site.width !== c.prev.width,
+  },
+  {
+    id: 'member-signedness',
+    why: 'the new pointer has one pointee type, and a second access of another type would need a cast the source did not write',
+    sound: false,
+    guardedBy: 'advance.test.ts: members of different signedness decline',
+    rejects: (c) => c.site.signed !== c.prev.signed,
+  },
+  {
+    id: 'member-element-grid',
+    why: 'a step that is not a whole number of elements would be written `p = p + step / width` with a fraction, which is not C',
+    sound: false,
+    guardedBy: 'advance.test.ts: a step off the element grid declines',
+    rejects: (c) => c.site.advanced! % c.prev.width !== 0,
+  },
+  {
+    id: 'member-step-lands',
+    why: 'a step that does not land on this access is evidence about some other pair of addresses',
+    sound: true,
+    guardedBy: 'advance.test.ts: a step that does not land on the next access declines',
+    rejects: (c) => c.prev.addr + c.site.advanced! !== c.site.addr,
+  },
+  {
+    id: 'member-negative-step',
+    why: 'a backward step (`p = p + -1`) is correct C, but this variation writes only forward steps',
+    sound: false,
+    guardedBy: 'advance.test.ts: a NEGATIVE step declines',
+    rejects: (c) => c.site.advanced! <= 0,
+  },
+];
+
+/** Every const-addressed `index` node in the body, split into the ones reached EXACTLY ONCE per
+ *  execution of a top-level statement — the only places an advance statement can be put — and the
+ *  ADDRESSES of every other one, which the chain rule refuses outright.
+ *
+ *  A loop's OWN expression joins its body on the second side: a `while` condition runs once per
+ *  iteration, so an advance above the loop and an access in its test are not the same count. A
+ *  top-level `if`'s condition stays on the first side, because the `if` statement itself runs once
+ *  whatever its arms do. */
+function collectSites(body: readonly Stmt[]): { sites: Site[]; nestedAddrs: Set<number> } {
+  const sites: Site[] = [];
+  const nestedAddrs = new Set<number>();
+  const visit = (e: Expr, stmt: number, nested: boolean): void => {
+    if (e.k === 'index') {
+      const addr = cellAddress(e);
+      if (addr !== null) {
+        if (nested) {
+          nestedAddrs.add(addr);
+        } else {
+          sites.push({ stmt, addr, width: e.width, signed: e.signed, advanced: e.baseAdvanced });
+        }
+      }
+    }
+    mapExprChildren(e, (c) => {
+      visit(c, stmt, nested);
+      return c;
+    });
+  };
+  const walk = (stmts: readonly Stmt[], stmt: number, nested: boolean): void => {
+    for (const s of stmts) {
+      const repeats = s.k === 'while' || s.k === 'dowhile' || s.k === 'for';
+      for (const e of stmtExprs(s)) {
+        visit(e, stmt, nested || repeats);
+      }
+      walk(stmtChildren(s), stmt, true);
+    }
+  };
+  body.forEach((s, i) => walk([s], i, false));
+  return { sites, nestedAddrs };
+}
+
+/** The one chain this pass spells, or null.
+ *
+ *  A NON-MEMBER SITE BETWEEN TWO MEMBERS DOES NOT END THE CHAIN. `p` is freshly minted, so an
+ *  access that does not touch it cannot move it — and the clientele is MMIO setup code, where one
+ *  `REG_BLDCNT = y;` between two window writes is the ordinary case. So the head is chosen by the
+ *  head table rather than by position, and the walk scans every later site rather than stopping at
+ *  the first one a gate refuses. Ambiguity is resolved greedily in statement order: where two later
+ *  sites would both extend the chain, the earlier one does.
+ *
+ *  THE TOLERANCE HAS NO CORPUS INHABITANT. MMIO writes with an unrelated const-addressed access
+ *  between two members appear nowhere in the corpus, so this is a rule the file can state
+ *  truthfully rather than reach a sweep can show. */
+function chainOf(sites: readonly Site[], nestedAddrs: ReadonlySet<number>, gates: AdvanceGates): Site[] | null {
+  const head = gates.head ?? ADVANCE_HEAD_GATES;
+  const member = gates.member ?? ADVANCE_MEMBER_GATES;
+  const occurrences = new Map<number, number>();
+  for (const s of sites) {
+    occurrences.set(s.addr, (occurrences.get(s.addr) ?? 0) + 1);
+  }
+  const ctx = (site: Site): HeadCtx => ({
+    site,
+    twin: (occurrences.get(site.addr) ?? 0) > 1,
+    nested: nestedAddrs.has(site.addr),
+  });
+  for (let i = 0; i < sites.length; i++) {
+    if (firstRejection(head, ctx(sites[i])) !== null) {
+      continue;
+    }
+    const chain = [sites[i]];
+    for (let j = i + 1; j < sites.length; j++) {
+      if (firstRejection(member, { prev: chain[chain.length - 1], ...ctx(sites[j]) }) === null) {
+        chain.push(sites[j]);
+      }
+    }
+    if (chain.length >= 2) {
+      return chain;
+    }
+  }
+  return null;
+}
+
+/** The two tables, ablatable — `gates.ts`'s reason: a test drops one entry and re-runs the REAL
+ *  predicate on real input, with no test-only branch in the shipped path. Nothing in `src/` passes
+ *  this; a shipped ablation of a `sound: true` rule emits wrong addresses, which is what
+ *  `ablateHeuristic` refuses. */
+export interface AdvanceGates {
+  head?: readonly Gate<HeadCtx>[];
+  member?: readonly Gate<MemberCtx>[];
+}
+
+/** Re-spell one advanced chain as a pointer local moved in place, or decline (null). */
+export function advancedBases(sfn: SFn, gates: AdvanceGates = {}): SFn | null {
+  const { sites, nestedAddrs } = collectSites(sfn.body);
+  const chain = chainOf(sites, nestedAddrs, gates);
+  if (chain === null) {
+    return null;
+  }
+  const name = nameAllocator(sfn)();
+  const elem: IrType = scalarTypeForAccess(chain[0].width, chain[0].signed);
+  const ptr: IrType = { kind: 'ptr', to: elem };
+  const members = new Set(chain.map((m) => m.addr));
+  // The access itself: every chain member reads `*p`, because `p` has been advanced to exactly its
+  // address. The evidence fields go with the old base — they described how the ADDRESS was
+  // computed, and this spelling is the answer to that question rather than another instance of it.
+  //
+  // BY ADDRESS, NOT BY IDENTITY, and the header's soundness argument turns on it: a node this
+  // finds at a member's address that is NOT the member — a twin, or one inside an arm or a loop —
+  // is re-spelled too, which is why the gates that refuse those shapes are `sound: true`.
+  const rewrite = (e: Expr): Expr => {
+    const m = mapExprChildren(e, rewrite);
+    const addr = m.k === 'index' ? cellAddress(m) : null;
+    if (m.k === 'index' && addr !== null && members.has(addr)) {
+      return { k: 'index', base: { k: 'var', name }, idx: { k: 'const', value: 0 }, width: m.width, signed: m.signed };
+    }
+    return m;
+  };
+  // The emitted distance is the GATED quantity — the step `member-step-lands` tied to this pair of
+  // addresses and `member-element-grid` divided — rather than the address difference, which is the
+  // same number only because those two rules hold. Deriving it separately is how a later ablation
+  // of one of them emits a fractional advance nothing checked.
+  //
+  // WHICH MAKES THE ARITHMETIC HERE TOTAL ONLY BECAUSE OF THE TABLE, and both ways out are LOUD
+  // rather than silent — measured, and pinned by the battery's `noncompile` verdicts rather than
+  // guarded here: with `member-element-grid` dropped this emits `p0 = p0 + 0.5;`, and with
+  // `member-no-evidence` dropped `advanced` is `undefined` and this emits `p0 = p0 + NaN;`.
+  // Neither is C, so a candidate carrying one is dropped at compile with its message rather than
+  // scored — which is why the two rules are `sound: false` and why no `Number.isInteger` refusal
+  // stands here: adding one would turn those two ablations into a DECLINE and delete the evidence
+  // the battery reads. `member-no-evidence` is ablatable by `ablateHeuristic`, so a round that
+  // ships that ablation as a ranked candidate ships noncompiling sources; that is its price.
+  const advanceAt = new Map<number, number>();
+  for (let i = 1; i < chain.length; i++) {
+    advanceAt.set(chain[i].stmt, chain[i].advanced! / chain[i].width);
+  }
+  const body: Stmt[] = [];
+  sfn.body.forEach((s, i) => {
+    const step = advanceAt.get(i);
+    if (step !== undefined) {
+      body.push({
+        k: 'assign',
+        name,
+        value: { k: 'bin', op: '+', l: { k: 'var', name }, r: { k: 'const', value: step } },
+      });
+    }
+    body.push(mapStmtExprs(s, rewrite));
+  });
+  const init: BaseInit = {
+    k: 'assign',
+    name,
+    value: { k: 'cast', to: ptr, e: { k: 'const', value: chain[0].addr } },
+  };
+  const locals = [...sfn.locals, { name, type: ptr as SFn['locals'][number]['type'] }];
+  // `prepend` for `l3/nearbase.ts`'s reason and a second one this pass owns: the init MATERIALISES
+  // the register the chain advances, and the target's own instruction order is what says where the
+  // pool word was loaded. Putting it in first-use order instead moves it below whatever else the
+  // function loads first, which on `kleod:StreamCmd_SetWindowRegs` swaps the two pool words and
+  // costs the match; test/advance.test.ts's `the base init leads` pins the emitted order.
+  //
+  // AND NO `/advance/sinkinit` ALTERNATIVE, unlike `/nearbase`, which ships one for exactly this decision —
+  // not because the decision is better determined here (the generator cannot see the target either
+  // way) but because the twin CANNOT EXIST. `sinkInitsToFirstUse` sinks an init only when
+  // `localMentions` counts ONE assignment to its local ("or the move would cross the other write",
+  // l3/hoist.ts), and an advance IS a second assignment to this one — so the sink declines on every
+  // tree this pass produces, by construction rather than by row: the sink returns null on the
+  // advanced tree, and registering `/advance/sinkinit` adds no candidate to
+  // `kleod:StreamCmd_SetWindowRegs:agbcc`'s fan. The `prepend` decision above is therefore the only
+  // placement this variation HAS, which is a stronger reason to record the compile behind it.
+  const { body: placed } = placeBaseLocals({ ...sfn, locals, body }, [init], 'prepend');
+  return { ...sfn, locals, body: placed };
+}

package/src/l3/argbase.ts

@@ -1,4 +1,4 @@
-// L3 re-spelling lever: materialize the deref BASES of a call's arguments into locals, before the
+// L3 respell variation: materialize the deref BASES of a call's arguments into locals, before the
 // call.
 //
 // When a call's arguments are each a deref through a different fixed address, the compiler loads
@@ -16,9 +16,9 @@
 // order names the bases first (`vu8 *p = &REG_VCOUNT_L; u8 *e = gEntityArray; f(*p, e[8])`), which
 // is what a decomp author writes and what this pass reproduces.
 //
-// A LEVER, not a rewrite: it is emitted as an ADDITIONAL candidate (rank.ts `/argbase`) and the
+// A VARIATION, not a committed rewrite: it is emitted as an ADDITIONAL candidate (rank.ts `/argbase`) and the
 // differ referees, so the inline spelling is always still there to win. That is what bounds the
-// risk — a lever that replaced the primary could lose a match, this one cannot.
+// risk — a rewrite that replaced the default could lose a match, this one cannot.
 //
 // SEMANTICS ARE PRESERVED BY CONSTRUCTION, which matters because on a NONMATCH row the
 // best-scoring candidate is what the user is shown. Only a PURE leaf base is eligible — a global's
@@ -29,7 +29,7 @@
 // KNOWN LIMITATION: the hoisted local is a plain `T *` — `IrType` models no cv-qualifier at all,
 // so naming a VOLATILE cell through it drops the qualifier that macros.ts goes out of its way to
 // carry. Pre-existing and not introduced here (every pointer local in the tower has it), but the
-// two features meet on exactly the MMIO shape this lever targets, so it is written down rather
+// two features meet on exactly the MMIO shape this variation targets, so it is written down rather
 // than left to be rediscovered.
 //
 // GATE: at least TWO arguments of the same call must qualify, with DISTINCT bases. The reordering

package/src/l3/ast.ts

@@ -1,7 +1,7 @@
 // asmlift L3 — the language-NEUTRAL structured AST. A LanguageBackend lowers this to a
 // concrete language (C / Pascal / C++) and prints it. "Return a value" and binary ops
 // are neutral nodes here; each backend owns its own spelling.
-import type { IrType } from '../ir/types';
+import { type IrType, typeEquals } from '../ir/types';
 
 export type Expr =
   | { k: 'var'; name: string }
@@ -74,7 +74,7 @@ export type Expr =
   //   • a local (`var`)   — nothing to reassociate into; already right, and no reader fires.
   //   • a plus tree       — the fold pulls the displacement into the tree, costing an `add` and a
   //                         register. The repair is to home the base in a local so it becomes a
-  //                         `var`, which is the ADDRESS-HOME axis and lives one level down at L2
+  //                         `var`, which is the ADDRESS-HOME variation and lives one level down at L2
   //                         (`structure/analysis.ts`'s `sharedBaseClasses`) because materializing
   //                         a value is a structuring decision, not a spelling.
   //   • a leaf const/addr — the fold bakes the displacement into the literal, changing the `.word`.
@@ -96,6 +96,16 @@ export type Expr =
   // reason — both spellings denote the same cell — and it is per SYMBOL, so every access of one
   // name carries the same answer, which is right for agbcc because one CSEd pool load serves
   // them all.
+  //
+  // `baseAdvanced` is the THIRD, and it answers about the ADDRESS COMPUTATION: this access's
+  // address was reached by ADDING this many bytes to a register that already held — and had just
+  // been used as — another address (`adds r3, #2` between two stores), rather than by a second
+  // pool word or a memory-operand displacement. `raise/const.ts` records it on the literal its
+  // fold produces, because the fold is what makes the three shapes indistinguishable; the
+  // structure seam copies it here. `l3/advance.ts` is what reads it, to offer a pointer local
+  // advanced in place. `exprEquals` ignores it for `operandOff`'s reason. Absence is never proof:
+  // a target whose frontend does not lift the advance stamps nothing, and the value is a byte
+  // count that can be NEGATIVE, so readers test `!== undefined`.
   | {
       k: 'index';
       base: Expr;
@@ -103,8 +113,35 @@ export type Expr =
       width: number;
       signed: boolean;
       lead?: Expr[];
+      /** The ELEMENT type the base's own DECLARATION gives it, for the one base whose stride the
+       *  C type walk cannot reconstruct: a map-declared array MEMBER (`gPtr->arr`), which
+       *  `exprCType` types `undefined` because the `field` node hangs off an untyped `var`. Without
+       *  it the C backend legalizes the base through a reinterpret cast (`((u8 *)gPtr->arr)[i]`),
+       *  which is the CAST form's object again and defeats the whole point of naming the member.
+       *
+       *  IT IS A PRODUCER INVARIANT: the backend cannot vet a stated type. `derefStrideOk` tests
+       *  the STATED type against the access width, never against the base, so it is true by
+       *  construction for anything a producer could state AND for a statement gone stale. What
+       *  the consumer does guard is PRECEDENCE — this field is consulted only where `exprCType`
+       *  answers nothing (cfamily.ts `legalizedIndexBase`), so wherever the walk can read the base
+       *  it corrects a stale statement instead of being overridden by it. The one producer,
+       *  structure/structure.ts `pointeeElement`, sets it from the same `elemSize`/`elemSigned` it
+       *  has just passed `spellsAccessType` on — and that predicate IS
+       *  `typeEquals(T.int(width*8, elemSigned), scalarTypeForAccess(width, signed))`, so
+       *  `derefStrideOk` over the stated pointer is true by construction at every width (4 by
+       *  `width === 4`, 1 and 2 by `to.signed === signed`). The obligation is on the PRODUCER:
+       *  state the type the access's own width and signedness agree with.
+       *
+       *  THE ALTERNATIVE REJECTED: teach `exprCType` the pointee layout, the way
+       *  `sym.noteGlobal` types the bare-array spelling —
+       *  the printer already renders `u8 grid[6][8]` for this member from this same layout. It was
+       *  rejected because `SFn.globals` is also the ADDRESSABLE-BASE list, so typing the symbol
+       *  there admits it as a `/livebase` base (measured on the probe: 8 extra base locals). Typing
+       *  the one node costs no candidates. */
+      baseElem?: IrType;
       operandOff?: number;
       baseOrdered?: true;
+      baseAdvanced?: number;
     }
   // A named struct-field access `base->name` (raise/structs.ts recovered `base` as a struct
   // pointer, so the byte offset resolves to a named field instead of a scaled array index).
@@ -145,7 +182,7 @@ export type Expr =
 //
 // The COMPARISONS stay collapsed, and that asymmetry is the rule applying rather than an omission:
 // which side a compare was spelled from genuinely underdetermines — a signed spelling that
-// byte-matched was proved non-negative by the compiler — so it is refereed as an axis, while a
+// byte-matched was proved non-negative by the compiler — so it is refereed as a variation, while a
 // division helper is a pure function of the expression's C type with no such proof available.
 export type BinOp =
   | '+'
@@ -245,7 +282,7 @@ export interface SFn {
   /** Recovered locals, declared at function top. Two INDEPENDENT volatility facts, mirroring
    *  symbols.ts's cell-vs-pointee split: `volatile` = the local OBJECT is volatile (the
    *  address-escaped frame scratch; dce.ts treats reads of it as observable), `pointeeVolatile`
-   *  = the local is a pointer TO volatile data (the l3/volatileptr.ts lever; a declaration
+   *  = the local is a pointer TO volatile data (the l3/volatileptr.ts variation; a declaration
    *  spelling only — nothing about the local itself is observable).
    *
    *  `frame` is present on a local the structurer recovered from an `laddr` — the asm
@@ -254,7 +291,7 @@ export interface SFn {
    *  SUB-WORD frame object: `strh/ldrh/strb/ldrb` have no `[sp,#imm]` form, so a compiler must
    *  copy `sp` first, while a word spill goes straight to `[sp,#imm]` and is recovered as an
    *  SSA value with no local of its own. So `frame` is NOT the set of every value the machine
-   *  slotted. `loads`/`stores` are the yardstick a qualifier lever must match before it may
+   *  slotted. `loads`/`stores` are the yardstick a qualifier variation must match before it may
    *  declare every access to the object observable: the readability passes between here and L3
    *  may drop a store or render one machine load as two reads, and `volatile` over an access
    *  set asmlift did not preserve is a source that contradicts itself. ABSENT where the counts
@@ -312,7 +349,7 @@ export interface SFn {
    *  exists to keep it out of. So the tree is neutral in its NODES — every node still spells the
    *  same thing in C, C++ and Pascal — and not in its emission policy, which this field is.
    *  `ascending` = the earlier-declared spilled local takes the LOWER `[sp,#k]`. Set by the
-   *  structurer from `StructureOptions.spillSlotOrder`, itself a per-compiler default declared in
+   *  structurer from `StructureOptions.spillSlotOrder`, itself a compiler behavior declared in
    *  `TargetDescription.compilerBehaviors`. ABSENT means the direction is unknown for this target
    *  and `l3/slotorder.ts` is the identity — never "ascending by default". */
   slotOrder?: 'ascending' | 'descending';
@@ -396,7 +433,7 @@ export function exprEquals(a: Expr, b: Expr): boolean {
       const bb = b as typeof a;
       // `volatile` is part of the SPELLING, compared for the same reason `lead` and `dot` are: a
       // CSE or dedup that treats these as equal keeps one node and drops the other, silently
-      // respelling a volatile access as a plain one.
+      // rewriting a volatile access as a plain one.
       return (
         JSON.stringify(a.to) === JSON.stringify(bb.to) &&
         (a.volatile ?? false) === (bb.volatile ?? false) &&
@@ -411,9 +448,9 @@ export function exprEquals(a: Expr, b: Expr): boolean {
       const bb = b as typeof a;
       // `lead` is part of the ADDRESS (`g[0][i]` and `g[1][i]` are different elements), so it
       // must be compared — an omission here would let CSE/dedup collapse two distinct accesses.
-      // `operandOff` deliberately is NOT: two accesses agreeing on everything else denote the same
-      // cell and print the same subscript however the machine spelled the offset, so a CSE that
-      // collapses them respells nothing.
+      // The EVIDENCE fields (`operandOff`, `baseOrdered`, `baseAdvanced`) deliberately are NOT:
+      // two accesses agreeing on everything else denote the same cell and print the same subscript
+      // however the machine spelled the offset, so a CSE that collapses them respells nothing.
       const lead = a.lead ?? [];
       const bLead = bb.lead ?? [];
       return (
@@ -421,6 +458,13 @@ export function exprEquals(a: Expr, b: Expr): boolean {
         a.signed === bb.signed &&
         lead.length === bLead.length &&
         lead.every((v, i) => exprEquals(v, bLead[i])) &&
+        // `baseElem` is part of the SPELLING for the same reason `lead` is: it decides whether the
+        // base takes the reinterpret cast, so two otherwise-equal nodes disagreeing about it print
+        // two different expressions. (Its one producer derives it from the base and the width, so
+        // nodes that agree on those agree here too — this cannot reject a real CSE.)
+        (a.baseElem === undefined
+          ? bb.baseElem === undefined
+          : bb.baseElem !== undefined && typeEquals(a.baseElem, bb.baseElem)) &&
         exprEquals(a.base, bb.base) &&
         exprEquals(a.idx, bb.idx)
       );
@@ -428,7 +472,7 @@ export function exprEquals(a: Expr, b: Expr): boolean {
     case 'field': {
       const bb = b as typeof a;
       // `dot` is part of the SPELLING, and for the same reason `lead` is compared above: a CSE or
-      // dedup that treats these as equal keeps one node and discards the other, silently respelling
+      // dedup that treats these as equal keeps one node and discards the other, silently rewriting
       // `p->field_4` as `p.field_4` (or the reverse). Both compile only for the base type each
       // belongs to, so collapsing them is how a valid access becomes an invalid one — or worse, a
       // valid one against a different object.
@@ -533,7 +577,7 @@ export function stmtExprs(s: Stmt): Expr[] {
  *  heads included, nested statements recursively. The rewrite dual of stmtExprs/stmtChildren, for
  *  the PURE 1:1 case: one expression in, one expression out, every statement kept.
  *
- *  A LEVER THAT HAND-ROLLS ITS OWN MAPPER IS NOT A MISSED MIGRATION. Several do, because their
+ *  A PASS THAT HAND-ROLLS ITS OWN MAPPER IS NOT A MISSED MIGRATION. Several do, because their
  *  contract is not this one — a rewrite that may DECLINE, one that INSERTS statements, one that
  *  rewrites assign TARGETS as well as expressions, one that turns a statement into a list. Check
  *  the contract before pointing one of them here. */
@@ -583,13 +627,13 @@ export function mapStmtExprs(s: Stmt, f: (e: Expr) => Expr): Stmt {
  *  one admits and the other refuses can be re-indexed but never qualified, so the paired
  *  `/indexed/volatile` spelling is unreachable at exactly the hardware addresses it is for.
  *
- *  Two levers reading the same initializers are deliberately NOT here: l3/inlinebase.ts
+ *  Two respell variations reading the same initializers are deliberately NOT here: l3/inlinebase.ts
  *  substitutes the address at each use, l3/nearbase.ts clusters neighbours by distance, and both
  *  need the VALUE, which is the evaluator above. Declining a shift-encoded base there costs a
- *  lever that does not fire, and the population is small: over klonoa's 531 lifting functions,
+ *  variation that does not fire, and the population is small: over klonoa's 531 lifting functions,
  *  one inlinebase-shaped local with no symbol map and none with it; a folded nearbase would form
  *  a new cluster in 4 functions mapless and 1 with the map. Both counts were zero over the agbcc
- *  benchmark rows that lifted when the levers landed — a MEASUREMENT over a corpus that grows, so
+ *  benchmark rows that lifted when the variations landed — a MEASUREMENT over a corpus that grows, so
  *  re-take it rather than quoting it: a new row falsifies the number, not the argument. */
 export function rematerializableAddress(e: Expr): boolean {
   let nonZero = false;
@@ -626,8 +670,8 @@ export function exprHasEffect(e: Expr): boolean {
  *  about a QUALIFIER, and a pass that asks the first where it means the second reorders device
  *  accesses while its gate reports clean.
  *
- *  Three spellings assert one thing, and all three are here because a lever that knew only the cast
- *  would miss the two a later lever writes: a `volatile` cast (where a raw address carries it), a
+ *  Three spellings assert one thing, and all three are here because a pass that knew only the cast
+ *  would miss the two a later variation writes: a `volatile` cast (where a raw address carries it), a
  *  read through a pointer local declared to point at volatile data (l3/volatileptr.ts), and a read
  *  of a `volatile` local object (l3/volatileval.ts). A bare cast counts even with no deref under it
  *  — the qualifier is on the ACCESS the cast exists to spell, and every caller so far is asking
@@ -801,14 +845,14 @@ export function* walkExprs(body: Stmt[]): Generator<Expr> {
 // so this must never be used to negate a general integer expression — only an `if`/loop test or an
 // operand of one of the connectives above.
 //
-// SCOPE of rule 2: it fires wherever a branch-sense lever negates the condition, which is both `if`
+// SCOPE of rule 2: it fires wherever a branch-sense variation negates the condition, which is both `if`
 // classes — `preserveDivergentBranchSense` on divergent ifs, `negateJoinedBranchSense` on
 // reconverging ones — and on the joined class it is a DEFAULT emission, not a differ-only
-// alternative, so a source `&&` can come out as its `||` dual with no lever asked for
+// alternative, so a source `&&` can come out as its `||` dual with no variation asked for
 // (`synthetic:ifand_far`, where the branch range put the fold on the other arm). Neither
-// lever reaches a LOOP test, so a connective that ended up as one has no dual candidate at all —
+// variation reaches a LOOP test, so a connective that ended up as one has no dual candidate at all —
 // the differ never sees the other form, and on such a row this rule changes how the code READS and
-// nothing else. Widening a branch-sense lever to loop tests is what would make it a matching lever
+// nothing else. Widening a branch-sense variation to loop tests is what would make it a matching variation
 // there, and that is a separate change.
 export const NEGATE_REL: Partial<Record<BinOp, BinOp>> = {
   '<': '>=',