@asmlift/core 0.6.0 → 0.8.0

package/src/pattern/engine.ts

@@ -67,7 +67,7 @@ export interface RewritePattern {
   // `applies` is DATA, consumed generically by patternApplies — NOT an `arch ==` branch.
   // `isa` pins the ISA; `compilers` pins which COMPILERS emit this idiom (the same shift-sequence
   // for `/2` is produced by agbcc AND gcc, so a compiler LIST, not a single arch, is the honest
-  // predicate); `capabilities` is a hardware predicate. An absent axis means "don't constrain on it".
+  // predicate); `capabilities` is a hardware predicate. An absent field means "don't constrain on it".
   applies: { isa?: string; compilers?: string[]; capabilities?: Partial<{ hwDivide: boolean; hwFloat: boolean }> };
   match: MatchNode; // rooted at the op result to replace
   // NOTE: a RELATIONAL guard (a `where` clause constraining the bound immediates, e.g. "two shift
@@ -91,16 +91,30 @@ export interface RewritePattern {
    *  is one inhabitant. The direction was measured on ONE compiler, so `validatePattern` pins the
    *  declaring pattern's compiler gate to that set; widening it fails loud. */
   unsequencedRightFirst?: [string, string];
+  /** The compilers measured to RECOMPUTE this idiom instead of CSEing it back, when an interior op
+   *  of the match survives the fold because something outside still reads it. On one of these the
+   *  fold refuses that shape (`sharesInterior`, which carries the disassemblies); everywhere else
+   *  it is byte-neutral and refusing it costs matches, so the list is opt-in and per-compiler. A
+   *  compiler absent from it was either measured neutral or not measured — `validatePattern`
+   *  refuses a name that is not in `applies.compilers`, where the fold cannot fire anyway. */
+  recomputesSharedInterior?: string[];
 }
 
-/** Does this pattern apply to `target`? Every DECLARED axis must match: the ISA (so an idiom can be
+/** What the pattern layer reads off a target. STRUCTURAL on purpose: the pattern set is
+ *  serializable data and does not import `target.ts`, so a `TargetDescription` satisfies this by
+ *  shape. It is the layer's ONE channel — `patternApplies` and `applyPattern` both take it, so a
+ *  caller that raises through the patterns cannot hand one of them a target and the other nothing. */
+export interface PatternTarget {
+  id: string;
+  compiler: string;
+  capabilities: { hwDivide: boolean; hwFloat: boolean };
+}
+
+/** Does this pattern apply to `target`? Every DECLARED field must match: the ISA (so an idiom can be
  *  pinned to one frontend), the compiler set (so an idiom fires only for the compilers that emit
  *  it — the reason MIPS+IDO and MIPS+GCC are distinguishable despite one frontend), and every
- *  declared capability. An omitted axis is unconstrained. */
-export function patternApplies(
-  p: RewritePattern,
-  target: { id: string; compiler: string; capabilities: { hwDivide: boolean; hwFloat: boolean } },
-): boolean {
+ *  declared capability. An omitted field is unconstrained. */
+export function patternApplies(p: RewritePattern, target: PatternTarget): boolean {
   if (p.applies.isa && p.applies.isa !== target.id) {
     return false;
   }
@@ -172,7 +186,7 @@ export const SDIV_POW2_2: RewritePattern = {
 // out as its own definition. Folding the triple back to one `smod`/`umod` gives recovery and the
 // structurer the operator the source wrote, and re-emitting `%` reproduces the triple byte-exact.
 //
-// This is NOT the `capabilities.hwDivide` axis: MIPS also divides in hardware and needs no fold at
+// This is NOT the `capabilities.hwDivide` field: MIPS also divides in hardware and needs no fold at
 // all, because `div` leaves the remainder in `hi` and the frontend reads it straight out. The
 // narrower fact is a hardware divide that yields the QUOTIENT ONLY; `isa: 'ppc'` STANDS IN for it
 // until a second ISA earns the capability, and `compilers` carries the measured half, that mwcc's
@@ -271,9 +285,27 @@ export const MUL_CONST_PATTERNS: RewritePattern[] = [MUL_SHIFT_ADD, MUL_SHIFT_SU
 // lsr/asr #24`). The naive lift prints `x << 24 >> 24` — but C's `>>` over the s32-typed value is
 // ARITHMETIC, so the UNSIGNED case recompiles with `asr` where the target has `lsr`: a miscompile
 // (tou8/zextb/tou16 nonmatch). Folding to a cast op both fixes that and reads correctly; recompiling
-// `(u8)x` reproduces `lsl;lsr`. Gated to agbcc: on IDO/GCC the zero-extend is `andi`/`and` (not a
-// shift pair) and `(u8)x` lowers to `andi` there — so this shift-pair shape is agbcc's alone, and the
-// fold must not touch the other compilers (where it would change `srl`↔`andi`). `k = 32 - w`.
+// `(u8)x` reproduces `lsl;lsr`. `k = 32 - w`.
+//
+// THE TWO SIGNEDNESSES ARE GATED SEPARATELY, because MIPS spells them differently and the pair of
+// gates is the measurement. Compiled at each row's own flags — IDO 7.1 `-mips2 -O2 -32 -non_shared
+// -G 0`, KMC gcc `-mips3 -O2`, gcc 2.7.2 `-mips3 -O1`:
+//
+//     (s8)x   sll v0,a0,0x18 ; sra v0,v0,0x18      (s16)x  sll 0x10 ; sra 0x10     all three
+//     (u8)x   andi v0,a0,0xff                                                      all three
+//
+// So the SIGN-extend is a shift pair on MIPS exactly as on agbcc, and folding it is byte-neutral
+// there: the fold changes the printed spelling from `x << 24 >> 24` to `(s8)x` and recompiles to
+// the same two instructions. The ZERO-extend is not — `andi` is not a shift pair, and folding an
+// IDO `srl` to a `zext` would re-spell it as `andi`, a miscompile. So `zextPat` is pinned to agbcc
+// alone, and the row that pin protects is `synthetic:zextb:ido7.1` — whose target IS that `andi`.
+//
+// mwcc/PowerPC is in NEITHER list: it has `extsb`/`extsh`, which the frontend lifts straight to
+// `sext`, so the shift-pair shape is not one it emits and no measurement licenses the fold there.
+/** The compilers measured to lower a SIGNED narrowing cast to a shift pair — see the pair of
+ *  disassemblies above. A compiler outside this list keeps the raw shifts. */
+export const SEXT_SHIFT_PAIR_COMPILERS = ['agbcc', 'ido', 'gcc'];
+
 const zextPat = (w: number, k: number): RewritePattern => ({
   id: `zext${w}`,
   applies: { compilers: ['agbcc'] },
@@ -282,7 +314,10 @@ const zextPat = (w: number, k: number): RewritePattern => ({
 });
 const sextPat = (w: number, k: number): RewritePattern => ({
   id: `sext${w}`,
-  applies: { compilers: ['agbcc'] },
+  applies: { compilers: SEXT_SHIFT_PAIR_COMPILERS },
+  // IDO alone emits the `sll` twice when the pair's own `sll` has a second reader; agbcc and both
+  // MIPS GCCs CSE it back, byte-identically. `sharesInterior` carries the three-spelling table.
+  recomputesSharedInterior: ['ido'],
   match: { op: 'shr_s', attrEquals: { imm: k }, args: [{ op: 'shl', attrEquals: { imm: k }, args: [{ bind: 'X' }] }] },
   replaceWith: { op: 'sext', args: ['X'], attrs: { width: w } },
 });
@@ -296,7 +331,8 @@ const sextPat = (w: number, k: number): RewritePattern => ({
  *  and never reaches the bitfield member recognizer (structure.ts, which matches the raw
  *  `shr(shl(load))` shape only). Honest output, not a miscompile — the field just keeps the cast
  *  spelling at those widths. Teaching the recognizer a zext/sext arm is the coverage extension if
- *  a row ever needs it. */
+ *  a row ever needs it. The SIGNED half of that shadow reaches MIPS too, where the symbol maps are:
+ *  measured over the whole corpus, no row's emitted C moves for it (`pnpm bench sweep`). */
 export const CAST_PATTERNS: RewritePattern[] = [zextPat(8, 24), zextPat(16, 16), sextPat(8, 24), sextPat(16, 16)];
 
 // ── boolean-negation idiom ───────────────────────────────────────────────────────────────────
@@ -408,6 +444,9 @@ const COMMUTATIVE = new Set(['add', 'mul', 'and', 'or', 'xor', 'icmp_eq', 'icmp_
 interface Binds {
   values: Map<string, Value>;
   imms: Map<string, number>;
+  /** Every value matched by an `op` node of the pattern, root included — the ops this rewrite is
+   *  about to REPLACE. `sharesInterior` below turns it into the fold's own legality condition. */
+  interior: Set<Value>;
 }
 
 function tryMatch(node: MatchNode, v: Value, defs: Map<Value, Op>, b: Binds): boolean {
@@ -430,6 +469,7 @@ function tryMatch(node: MatchNode, v: Value, defs: Map<Value, Op>, b: Binds): bo
   if (!d || d.opcode !== node.op) {
     return false;
   }
+  b.interior.add(v);
   if (node.attrEquals) {
     for (const [k, val] of Object.entries(node.attrEquals)) {
       if (d.attrs[k] !== val) {
@@ -459,7 +499,7 @@ function tryMatch(node: MatchNode, v: Value, defs: Map<Value, Op>, b: Binds): bo
       [0, 1],
       [1, 0],
     ] as const) {
-      const trial: Binds = { values: new Map(b.values), imms: new Map(b.imms) };
+      const trial: Binds = { values: new Map(b.values), imms: new Map(b.imms), interior: new Set(b.interior) };
       if (tryMatch(node.args[0], d.operands[i], defs, trial) && tryMatch(node.args[1], d.operands[j], defs, trial)) {
         for (const [k, val] of trial.values) {
           b.values.set(k, val);
@@ -467,6 +507,9 @@ function tryMatch(node: MatchNode, v: Value, defs: Map<Value, Op>, b: Binds): bo
         for (const [k, val] of trial.imms) {
           b.imms.set(k, val);
         }
+        for (const val of trial.interior) {
+          b.interior.add(val);
+        }
         return true;
       }
     }
@@ -523,6 +566,17 @@ function validatePattern(pat: RewritePattern): void {
       );
     }
   }
+  const recompiles = pat.recomputesSharedInterior;
+  if (recompiles?.length) {
+    const on = pat.applies.compilers;
+    const inert = on === undefined ? [] : recompiles.filter((c) => !on.includes(c));
+    if (inert.length) {
+      throw new Error(
+        `pattern '${pat.id}' names [${inert.join(', ')}] in 'recomputesSharedInterior' but does not apply to ` +
+          `${on === undefined ? 'them' : `[${on.join(', ')}]`} — the refusal could never fire, so the declaration is inert`,
+      );
+    }
+  }
   validated.add(pat);
 }
 
@@ -621,8 +675,66 @@ function reordersUnsequenced(
   return false;
 }
 
-/** Apply one pattern greedily to a fixed point. Returns the number of rewrites. */
-export function applyPattern(fn: Fn, pat: RewritePattern): number {
+/** Would this fold RECOMPUTE the idiom rather than re-spell it — leave an INTERIOR op standing
+ *  because something outside the match still reads it, while the replacement computes the same
+ *  thing again?
+ *
+ *  Every pattern here is licensed by a compiled pair showing that the replacement's C recompiles to
+ *  the SAME instructions. That pair is measured on the shape where the fold's interior ops DIE with
+ *  it — `dce` below removes exactly the ops nothing else reads. An interior op with a surviving
+ *  reader does not die, and whether the recompiling compiler then emits the work twice or CSEs it
+ *  back is a COMPILER fact, so it was compiled rather than reasoned. One function, three spellings,
+ *  each toolchain at its own canonical flags:
+ *
+ *      int r1(int x){ int y = x << 24; return (y >> 24) + y; }
+ *
+ *      ido7.1        raw `(a0 << 24 >> 24) + (a0 << 24)`   4 words   == the object of the C above
+ *                    folded `(s8)a0 + (a0 << 24)`          5 words   an extra `sll`
+ *      gcc2.7.2kmc   raw 4 words / folded 4 words, BYTE-IDENTICAL
+ *      gcc2.7.2      raw 4 words / folded 4 words, BYTE-IDENTICAL
+ *      agbcc         raw and folded identical (`lsl;asr;add`) — one `lsl` either way
+ *
+ *  So only IDO recomputes, and `recomputesSharedInterior` carries that list. On the other three the
+ *  fold stays byte-neutral in this shape and refusing it would COST: agbcc's `s16 i; i++` is one
+ *  `lsl #16` read by both the write-back's `lsr` and the comparison's `asr`, and a blanket refusal
+ *  measured `synthetic:{membnarrow,sibwalk}:agbcc` out of MATCH and `kleod:sub_0800A5B8:agbcc` from
+ *  173 to 179.
+ *
+ *  The ROOT is exempt and must be: `replaceAllUsesWith` brings its readers along, which is what
+ *  makes a fold a re-spelling at all. It is the interior — the operands the match walked THROUGH —
+ *  that this asks about. CONSTANTS REACH IT ASYMMETRICALLY, and both answers are the wanted ones:
+ *  a `constImm` node binds a literal and returns before the record, so a shared constant the
+ *  replacement re-spells as a literal never refuses a fold — nothing keeps a register alive for a
+ *  literal. An `{ op: 'const' }` node is walked like any other op and IS interior, so one the
+ *  replacement drops while another op still reads it counts as a survivor and refuses, which is the
+ *  conservative direction for a materialization the compiler may or may not rematerialize.
+ *
+ *  Refusing leaves the raw ops standing, which is the spelling that was byte-exact before any fold
+ *  existed — a worse-READING answer, never a worse-scoring one. */
+function sharesInterior(fn: Fn, root: Op, interior: Set<Value>, defs: Map<Value, Op>): boolean {
+  const matched = new Set([...interior].map((v) => defs.get(v)));
+  for (const b of fn.blocks) {
+    for (const o of b.ops) {
+      if (matched.has(o)) {
+        continue; // a read from INSIDE the idiom is one this rewrite is replacing
+      }
+      for (const v of [...o.operands, ...o.successors.flatMap((x) => x.args)]) {
+        if (v !== root.results[0] && interior.has(v)) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+
+/** Apply one pattern greedily to a fixed point. Returns the number of rewrites.
+ *
+ *  `target` is the same one `patternApplies` filtered with, REQUIRED because exactly one refusal
+ *  reads it (`recomputesSharedInterior`, whose answer is per-compiler). Both towers that fold —
+ *  `pipeline.ts` and `trace.ts` — must hand it over or the traced tower shows a fold `decompile()`
+ *  refuses; required, a caller that omits it is a type error rather than a wrong answer. */
+export function applyPattern(fn: Fn, pat: RewritePattern, target: PatternTarget): number {
   validatePattern(pat);
   let count = 0,
     changed = true;
@@ -635,10 +747,13 @@ export function applyPattern(fn: Fn, pat: RewritePattern): number {
         if (op.results.length !== 1) {
           continue;
         }
-        const binds: Binds = { values: new Map(), imms: new Map() };
+        const binds: Binds = { values: new Map(), imms: new Map(), interior: new Set() };
         if (!tryMatch(pat.match, op.results[0], defs, binds)) {
           continue;
         }
+        if (pat.recomputesSharedInterior?.includes(target.compiler) && sharesInterior(fn, op, binds.interior, defs)) {
+          continue;
+        }
         if (pat.unsequencedRightFirst && reordersUnsequenced(fn, op, pat.unsequencedRightFirst, binds, defs, pat.id)) {
           continue;
         }

package/src/pipeline.ts

@@ -21,6 +21,7 @@ import { LanguageBackend, SFn, gapReasonFor, walkExprs } from './l3/ast';
 import { BASECSE_GATES, hoistBaseLocals } from './l3/basecse';
 import { eliminateDeadStores } from './l3/dce';
 import { mergeCommonTails } from './l3/tailmerge';
+import { dropUnspelledReturns } from './l3/tailret';
 import { DEFAULT_IDIOM_PATTERNS, RewritePattern, applyPattern, dce, patternApplies } from './pattern/engine';
 import { type FnProto, type Prototypes, prototypesFromSymbols } from './proto';
 import { RaiseUnsupportedError } from './raise/errors';
@@ -212,7 +213,7 @@ export function applyIdiomPatterns(fn: Fn, target: TargetDescription, patterns?:
   const active = (patterns ?? DEFAULT_IDIOM_PATTERNS).filter((p) => patternApplies(p, target));
   let hits = 0;
   for (const p of active) {
-    hits += applyPattern(fn, p);
+    hits += applyPattern(fn, p, target);
   }
   if (active.length) {
     dce(fn);
@@ -261,7 +262,7 @@ export function raiseRecovered(
   self?: FnProto,
   pre: PreRecoveryOptions = {},
 ): void {
-  runPreRecovery(
+  const lifted = runPreRecovery(
     fn,
     target,
     (pass, result) => {
@@ -276,7 +277,15 @@ export function raiseRecovered(
   verify(fn);
   assertTypesRecovered(fn);
   hooks.afterRecover?.();
-  if (sinkReturns(fn)) {
+  // `lifted.mergeShapes` is the CFG as it ENTERED pre-recovery, and retsink's `pre-diamond` needs
+  // exactly that: `raise/shortcircuit.ts` manufactures two-armed diamonds out of condition trees the
+  // ROM never merged, and a diamond this pass reads at its own turn may be one of those.
+  if (
+    sinkReturns(fn, {
+      hoistsSingleSetArm: target.compilerBehaviors.hoistsSingleSetArm,
+      mergeShapes: lifted.mergeShapes,
+    })
+  ) {
     verify(fn);
     hooks.afterRetsink?.();
   }
@@ -333,16 +342,37 @@ function attributeOpaques<T>(fn: Fn, body: () => T): T {
     if (!names.size || /unmodelled instruction/.test(e.message)) {
       throw e;
     }
-    // Through `gapReasonFor`, so the classifier sees its canonical text — a hand-written variant
+    // Through `gapReasonFor`, so the classifier sees its canonical text — a hand-written spelling
     // misses the mnemonic-anchored classes and every attributed decline lands in the generic bucket.
     const list = [...names].sort().map(gapReasonFor).join(', ');
     throw new StructureError(`${e.message} — and the function carries ${list}, which is the more likely cause`);
   }
 }
 
+/** The committed readability/quality rewrites, in the order they are committed in: merge a
+ *  statement common to every arm of an if, drop the void returns the assembly did not spell, drop
+ *  dead stores (whose empty-then peephole flips the arm the merge empties), then hoist each leaf
+ *  base the DEFAULT gate table admits into a typed local pointer.
+ *
+ *  THE ORDER IS OBSERVABLE, not a preference: drop the returns before the merge and the same arms
+ *  become peelable, emptying both of them. `l3/tailret.ts` states the mechanism, and
+ *  `test/tailret.test.ts` pins the difference and which side of it this function is on.
+ *
+ *  `hoistBaseLocals`' two arguments are SPELLED, defaults or not: this is the one call to that pass
+ *  that is committed rather than offered, so it is the one whose gate table and whose placement can
+ *  cost a MATCH instead of a candidate (docs/level-tower.md). A committed policy that reads as
+ *  "whatever the default is" is the policy nobody reviews. */
+export function readabilityRewrites(raw: SFn): SFn {
+  return hoistBaseLocals(eliminateDeadStores(dropUnspelledReturns(mergeCommonTails(raw))), BASECSE_GATES, 'head');
+}
+
 /** Stage 4 — structure + its boundary contracts, always as a pair. */
-export function structureChecked(fn: Fn, opts: Parameters<typeof structure>[1]): SFn {
-  const raw = attributeOpaques(fn, () => structure(fn, opts));
+export function structureChecked(
+  fn: Fn,
+  opts: Parameters<typeof structure>[1],
+  hooks?: Parameters<typeof structure>[2],
+): SFn {
+  const raw = attributeOpaques(fn, () => structure(fn, opts, hooks));
   // The boundary contracts run on the pre-DCE tree: the readability pass must never be able to
   // hide a structuring defect by dropping the dead statement that carries it. assertResolved
   // catches an unresolved `?` value; assertDerefsTyped catches an ill-typed deref (e.g. a pointer
@@ -353,16 +383,9 @@ export function structureChecked(fn: Fn, opts: Parameters<typeof structure>[1]):
   assertDerefsTyped(raw);
   assertLocalsWritten(raw);
   assertEffectsPreserved(fn, raw);
-  // Then the readability/quality rewrites: merge a statement common to every arm of an if,
-  // drop dead stores (whose empty-then peephole flips the arm the merge empties), then hoist each
-  // leaf base the DEFAULT gate table admits into a typed local pointer. The hoist moves the deref
-  // cast from each `index` node onto the local's initializer, so re-validate deref typing on the
-  // rewritten tree.
-  // Both arguments SPELLED, defaults or not: this is the one call to this pass that is committed
-  // rather than offered, so it is the one whose gate table and whose placement can cost a MATCH
-  // instead of a candidate (docs/level-tower.md). A committed policy that reads as "whatever the
-  // default is" is the policy nobody reviews.
-  const sfn = hoistBaseLocals(eliminateDeadStores(mergeCommonTails(raw)), BASECSE_GATES, 'head');
+  // The hoist moves the deref cast from each `index` node onto the local's initializer, so
+  // re-validate deref typing on the rewritten tree.
+  const sfn = readabilityRewrites(raw);
   assertDerefsTyped(sfn);
   // Re-checked after the readability rewrites for the same reason deref typing is: a pass that
   // merges arms or drops statements must not be able to lose or duplicate a call.

package/src/proto.ts

@@ -16,7 +16,7 @@ import type { SymbolMap, SymbolTypeFacts } from './symbols';
  *  the extension is an inference off an encoding two different C sources produce. Where the asm
  *  carries no extension, this list is NOT consulted: pinning there would type every parameter of
  *  every row from the declaration, and a declared `u32` kills rank.ts's signed arm before the
- *  differ ever sees it. That half is an axis question and is not answered here. */
+ *  differ ever sees it. That half is a variation question and is not answered here. */
 export type ParamType = string;
 
 /** What the headers know about one function. All fields optional: a partial table (only
@@ -143,7 +143,7 @@ export function validatePrototypes(value: unknown): string[] {
  *  determine one. A pointer is `void *` — address-identical to any object pointer, and asmlift
  *  makes every stride explicit — so nothing is guessed about what it points at. A richer spelling
  *  would also be INERT: `declaredWidth` answers 32 for every `*`, and a CALLEE's parameter types
- *  are read for the list's length alone (test/param-pointee-axis.test.ts). */
+ *  are read for the list's length alone (test/param-pointee-variation.test.ts). */
 function typeSpelling(t: SymbolTypeFacts): ParamType | null {
   if (t.pointer) {
     return 'void *';

package/src/raise/const.ts

@@ -3,17 +3,33 @@
 // A RISC target builds a 32-bit literal in two halves: a high-half load (MIPS `lui`, PPC `lis`) then a
 // low-half `ori`/`addiu`. The frontends lift that pair faithfully as `or(const(hi<<16), const(lo))` /
 // `add(const(hi<<16), const(lo))` — a live binary op over two `const` ops — because neither frontend can
-// see across the two instructions. This pass folds any such const/const `or`/`add` into a single `const`,
+// see across the two instructions. This pass folds such a const/const `or`/`add` into a single `const`,
 // which is the form that (a) type-recovers as one 32-bit literal and (b) recompiles to the exact
 // `lui;ori` / `lis;ori` pair. Without it a magic-division reciprocal or an address literal is never a
 // single value the later passes can reason about.
 //
+// THE CLIENTELE IS "A VALUE THE TARGET MATERIALISES IN TWO INSTRUCTIONS", and it is wider than the
+// RISC pair above in both directions, and both halves are measured:
+//   - It is NOT ARM-free. On Thumb a literal is a pool word plus an immediate `add`, which is exactly a
+//     two-instruction materialisation and lifts as the same const/const pair. Ablating the whole pass
+//     costs three agbcc BYTE-MATCHES — `synthetic:dmafield` MATCH -> diff:29, `synthetic:fieldbase`
+//     MATCH -> diff:22, `synthetic:bgfixed` MATCH -> diff:2 (measured, whole pass off). Do not gate
+//     this pass on a RISC target.
+//   - The pair is NOT confined to ONE block. `synthetic:mergepool:gcc2.7.2kmc` lifts a genuine
+//     `lui;ori` as `or(const 65536, const 9029)` whose two halves are defined in DIFFERENT blocks
+//     (instrumented: `b0=0 b1=1`), because gcc hoisted the high half above the branch. A guard
+//     tightened to a literal same-block test loses folds the corpus depends on.
+// What the refusal below actually excludes is narrower than either: an operand a terminator hands to a
+// successor's block-parameter — a REGISTER the compiler held live across a branch — where the pair is
+// ALSO not recognisable as a hi/lo pair and the result is not an address. See its site for the cost.
+//
 // This cannot be a data-`RewritePattern`: the fold's result is COMPUTED from the two operands' values,
 // which the pattern engine's numeric-exact `attrEquals` cannot express. So it lives here as an always-on
 // recognizer, run before type recovery. Value-preserving and local; a single left-to-right pass suffices
 // (SSA guarantees each const is defined before the op that consumes it, and a folded result feeds
 // forward for any chained materialisation).
-import { Fn, Op, defOpMap, mkOp } from '../ir/core';
+import { Fn, Op, Value, defOpMap, mkOp } from '../ir/core';
+import { MEM_BASE_OPS } from '../ir/opcodes';
 
 // The binary opcodes whose const/const form is a constant. `>> 0` normalises to a signed 32-bit result
 // (hardware wraparound): `|` already yields int32, `+` may exceed it and is truncated to match `addu`/`add`.
@@ -22,11 +38,123 @@ const FOLD: Record<string, (a: number, b: number) => number> = {
   add: (a, b) => (a + b) >> 0,
 };
 
+/** Is `v` a RISC HIGH HALF — what one `lui`/`lis`/`addis` puts in a register? `hi << 16`, for a
+ *  NON-ZERO `hi`. Zero is excluded deliberately, and that exclusion is what makes this test
+ *  trustworthy as a positive: `lui rD, 0` is a no-op no compiler emits, so a `const 0` is never a
+ *  half being materialised — it is an initialised register, exactly the shape the refusal below
+ *  exists to protect.
+ *
+ *  IT COVERS THE RISC HALF OF THE CLIENTELE ONLY, because the 16/16 split is an ISA fact: censused
+ *  over the corpus's const/const fold sites, all 19 RISC ones (gcc2.7.2kmc / mwcc_242_81 / ido7.1)
+ *  are recognisable to it and 0 of the 20 agbcc ones are — an ARM pool word is an arbitrary 32-bit
+ *  value (`0x03001C00`, low half `0x1C00`) and can never pass. The ARM half of the clientele is
+ *  protected by `memBases` and by simply not being edge-carried; four agbcc sites on three rows
+ *  (`dmascope` ×2, `dmascope2`, `dmafield`'s `add(…,112)`) sit behind neither carve-out. If a row
+ *  ever needs the buy-back on ARM, the half-width belongs on the target description —
+ *  `PreRecoveryPass` already threads `target`, and `softdiv` gates on `capabilities.hwDivide` —
+ *  rather than as a second constant here. */
+const isHighHalf = (v: number): boolean => (v & 0xffff) === 0 && v !== 0;
+
+/** Is `v` a LOW HALF — what one `ori`/`addi`/`addiu` can supply? `ori` takes an UNSIGNED 16-bit
+ *  immediate and `addi`/`addiu` a SIGNED one, so the admissible range is the union: mwcc completes an
+ *  `addis` with a NEGATIVE `addi` whenever bit 15 of the low half is set (`0x12350000 + -25924` is
+ *  `0x12345ABC`). Deliberately NOT split per-opcode (`or` unsigned, `add` signed): that narrowing is
+ *  true of the ISA, reaches 0 rows of the corpus, and no fixture reddens when it is removed, so it
+ *  would be an unpinned clause. The half-width belongs on the target description if a row needs it. */
+const isLowHalf = (v: number): boolean => v >= -0x8000 && v <= 0xffff;
+
+/** The constant a foldable const/const pair denotes, or `null` when `opcode` is not one this pass
+ *  folds. Exported because `structure.ts` repairs the refusal's residue at RENDER time and must
+ *  print exactly what an unrefused fold here would have produced — the opcode set and the int32
+ *  normalisation are one decision, so they live in one place. */
+export function foldConstPair(opcode: string, a: number, b: number): number | null {
+  const f = FOLD[opcode];
+  return f ? f(a, b) : null;
+}
+
+/** Does this opcode's const/const form denote a constant? The membership half of `foldConstPair`,
+ *  for callers that must classify an op before they have its operands' values. */
+export const isConstFoldOpcode = (opcode: string): boolean => opcode in FOLD;
+
+/** THE EVIDENCE THE FOLD WOULD OTHERWISE DESTROY, stamped on the literal it produces.
+ *
+ *  Three Thumb shapes put two accesses a constant distance apart, and the assembly tells them
+ *  apart: two pool words (two independent `const` ops), one pool word plus memory-operand
+ *  displacements (`l3/ast.ts`'s `operandOff`), and one pool word plus an `add` to the register
+ *  that already held the first address (`ldr r3,=X; strh [r3]; adds r3,#2; strh [r3]`). The third
+ *  lifts as `add(const X, const 2)` — indistinguishable, once folded, from a literal `X + 2` the
+ *  compiler materialised in two instructions, which is this pass's whole clientele. So the fold
+ *  still happens and the distinction is recorded, exactly as `structure.ts` records `operandOff`
+ *  before its own fold (see the `operandOff` note in l3/ast.ts).
+ *
+ *  WHAT IT ASSERTS is narrow and is a fact about REGISTERS, not about C: at this instruction the
+ *  machine held the base address in a register, used it as an address, and advanced it by `step`
+ *  bytes to reach another address it also used. THE READER decides what to spell — `l3/advance.ts`
+ *  offers a pointer local advanced in place, which is the only C spelling that reproduces the
+ *  `add` on a compiler that folds a constant subscript into the memory operand, and which is
+ *  INERT (same bytes as the subscript) wherever the pointee is not `volatile`.
+ *
+ *  THE THREE REFUSALS, each of which makes the stamp mean something else:
+ *   • `or`, not `add` — a hi/lo `or` is a literal being assembled, never a pointer being moved.
+ *   • the ADDEND is itself a memory base. Then both halves are addresses and neither is the step;
+ *     the shape is not an advance and the stamp would name an arbitrary one of them.
+ *   • either the base or the result is never used AS AN ADDRESS. A register that only feeds
+ *     arithmetic is a value, and `X + 2` over two values is a literal by every reading.
+ *  A zero step is dropped too: it names no advance, and `l3/ast.ts`'s readers all test
+ *  `!== undefined` rather than truthiness, so a stamped 0 would read as a real one. */
+function advanceEvidence(op: Op, a: number, c: number, memBases: ReadonlySet<Value>): { advancedBy?: number } {
+  if (op.opcode !== 'add' || !memBases.has(op.results[0])) {
+    return {};
+  }
+  const baseIdx = memBases.has(op.operands[0]) ? 0 : memBases.has(op.operands[1]) ? 1 : -1;
+  if (baseIdx < 0 || memBases.has(op.operands[1 - baseIdx])) {
+    return {};
+  }
+  const step = baseIdx === 0 ? c : a;
+  return step === 0 ? {} : { advancedBy: step };
+}
+
 /** Fold each const/const `or`/`add` into one `const`, in place. Returns whether anything changed. The
  *  now-dead source consts are left for DCE (they may still have other uses; liveness is not our concern). */
 export function recognizeConsts(fn: Fn): boolean {
   let changed = false;
   const defs = defOpMap(fn);
+  // The two facts the CLIENTELE REFUSAL below reads, both collected in one walk.
+  //   `edgeSlots` — for every value a terminator hands to a successor, WHICH block-parameters it
+  //     feeds. Being in the map at all is "a register the compiler held live across a branch": in
+  //     functional-form SSA the machine had this value in a register at the branch and the join
+  //     reads it back. WHICH parameter is the second question, and the buy-back below needs it.
+  //   `memBases`  — every value used as a memory base, i.e. the values that ARE addresses.
+  const edgeSlots = new Map<Value, Set<Value>>();
+  const memBases = new Set<Value>();
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      for (const sc of op.successors) {
+        sc.args.forEach((v, i) => {
+          const param = sc.block.params[i];
+          if (param === undefined) {
+            return;
+          }
+          const slots = edgeSlots.get(v);
+          if (slots) {
+            slots.add(param);
+          } else {
+            edgeSlots.set(v, new Set([param]));
+          }
+        });
+      }
+      if (MEM_BASE_OPS.has(op.opcode) && op.operands.length > 0) {
+        memBases.add(op.operands[0]);
+      }
+    }
+  }
+  /** Do these two values reach the SAME block-parameter — i.e. are they two arms' feeds of one
+   *  merge? See the refusal for why that is what tells an accumulator from a shared high half. */
+  const meetAtSameParam = (x: Value, y: Value): boolean => {
+    const sx = edgeSlots.get(x);
+    const sy = edgeSlots.get(y);
+    return !!sx && !!sy && [...sx].some((k) => sy.has(k));
+  };
   const constOf = (op: Op | undefined): number | null =>
     op && op.opcode === 'const' ? (op.attrs.value as number) : null;
   for (const b of fn.blocks) {
@@ -41,8 +169,80 @@ export function recognizeConsts(fn: Fn): boolean {
       if (a === null || c === null) {
         continue;
       }
+      // ── THE REFUSAL: this shape is not a literal being materialised ───────────────────────────
+      // An operand a terminator ALSO hands to a successor's block-parameter is a register the compiler
+      // held live across the branch, whose value on this path happens to be a constant. agbcc's
+      // `s = 0; ... if (c) s += 1;` lifts as `add(%s = const 0, const 1)` in the taken arm, where
+      // `%s` is also the value bb0 hands the join. Folding it to `const 1` deletes the accumulator's
+      // last reference, so every later level sees an arm that materialises a literal and spells it
+      // as one (`v = 1;` with an `else v = 0;`) instead of the `s += 1` the target records — and the
+      // enumeration gate for the shipped `/merge-home` variation, which is what would have spelled the
+      // hoisted init, reads FALSE because the merge feed it looks for is gone.
+      //
+      // The mapping is a FUNCTION, not an open question, so this is a default and not a variation: a register
+      // carried across a branch is not a literal being materialised, whichever compiler produced it.
+      //
+      // IT IS A PROXY, and the two carve-outs are where it is bought back. Edge-carrying is evidence
+      // of a register, not proof, and the same `add(const 0, const K)` still folds wherever nothing
+      // carries the zero (6 sites on 5 marioparty3/snowboardkids2 rows) — defensible, since with no
+      // merge there is no home to hoist and the incident cannot occur, but the rule is narrower than
+      // "never fold a const/const pair over a branch".
+      //   - `hiLoPair` — the pass's OWN clientele beats the proxy. mwcc materialises `0x12345678` as
+      //     `lis; addi` and shares the `lis` across a branch whenever the high half is live at the
+      //     join, so the genuine pair IS edge-carried and the proxy refuses it: measured, a
+      //     `base = 0x12340000; if (c) q[0] = base|0x5678; else q[1] = base|0x9ABC; *p = base;` row
+      //     emitted `*a2 = 305397760 + 22136;` on mwcc_242_81 where every other toolchain emitted the
+      //     folded literal. The literal is then no longer ONE value for `recognizeMagicDivision`, type
+      //     recovery or the symbol map — the same never-enumerated failure this refusal exists to fix,
+      //     one level down.
+      //
+      //     `feedsSameMerge` IS A CONDITION ON THAT BUY-BACK: read as a bare "is this a hi/lo pair"
+      //     it re-opens the very incident this refusal exists for. An accumulator's `const 0` init
+      //     passes `isLowHalf`, so `s = 0; if (c) s += 0x10000;` — one 16.16 fixed-point step — is a
+      //     hi/lo pair by the letter of the test, and its MIRROR `s = 0x10000; if (c) s += 1;` is
+      //     one whichever operand is read as the half. Folded, a two-arm `s += 0x10000` row scores
+      //     **diff:1** on mwcc_242_81 with `hasMergeFeedHome` FALSE; refused, **MATCH** with the
+      //     gate TRUE. What separates the two shapes is WHERE THE VALUES GO rather than their bit
+      //     patterns: an accumulator's init and its updated copy are two arms' feeds of ONE block
+      //     parameter — exactly the merge `/merge-home` exists to home — whereas a shared high half
+      //     reaches the join while the COMPLETED literal is stored or returned, never merged with
+      //     the half it was built from. Measured FREE: with it in, 770 synthetic + 252 real rows are
+      //     byte-identical in post-recovery IR, in emitted source and in gap list to the branch
+      //     without it.
+      //   - `memBases` — an address literal, `0x03001C00 + 1206` reached through one arm's base
+      //     register. It decides 0 folds over the corpus's 806 lifted rows and is here as a
+      //     statement of scope; `hiLoPair` is the clause that carries real traffic. Deliberately NOT
+      //     transitive and NOT extended to call arguments: an address literal escaping as a call
+      //     argument is a shape the refusal HELPS (a probe row scored diff:7 -> MATCH with it
+      //     firing), so widening this test would give that back.
+      //
+      // NOT CONVERTIBLE TO A `Gate` TABLE, and the reason is the type rather than the minutes.
+      // `firstRejection` reads a table as a DISJUNCTION of independent refusals; the test below is
+      // a CONJUNCTION with two buy-backs, and "refuse unless exempted" decomposes only by making
+      // every term re-carry the whole conjunction. The census would then report one opaque id and
+      // stay silent about WHICH exemption fired — the only question the paragraphs above ask. Said
+      // here because a selector that ranks passes by refusal count or by instrument minutes points
+      // at this file (`grep -n "raise/const.ts" docs/level-tower.md`), and both readings are wrong
+      // about it for different reasons.
+      //
+      // A REFUSAL IS ALSO A SCHEDULING DECISION, and that coupling is invisible at this site:
+      // `pre-recovery.ts` registers this pass `dce: true` and runs `dce(fn)` only when the pass
+      // returns TRUTHY, so a function whose ONLY const/const pair is refused gets no DCE here at
+      // all — and `addrnum` above is `dce: false`, so this is the first pass that can schedule one.
+      // Measured inert: forcing the cancelled `dce(fn)` removes 0 ops on every invocation of every
+      // reachable row (`sinkacc`, 3 invocations). Worth knowing before this refusal is widened.
+      const edgeCarried = edgeSlots.has(op.operands[0]) || edgeSlots.has(op.operands[1]);
+      const feedsSameMerge =
+        meetAtSameParam(op.results[0], op.operands[0]) || meetAtSameParam(op.results[0], op.operands[1]);
+      const hiLoPair = ((isHighHalf(a) && isLowHalf(c)) || (isHighHalf(c) && isLowHalf(a))) && !feedsSameMerge;
+      if (edgeCarried && !hiLoPair && !memBases.has(op.results[0])) {
+        continue;
+      }
       // Reuse the SAME result Value → every existing use already points at it (no RAUW needed).
-      const folded = mkOp('const', { results: [op.results[0]], attrs: { value: fold(a, c) } });
+      const folded = mkOp('const', {
+        results: [op.results[0]],
+        attrs: { value: fold(a, c), ...advanceEvidence(op, a, c, memBases) },
+      });
       b.ops.splice(i, 1, folded);
       defs.set(op.results[0], folded); // keep the def map current so a chained fold sees this const
       changed = true;

package/src/raise/divpow2.ts

@@ -31,9 +31,9 @@
 // SELF-VERIFYING. asmlift emits a plain `x / 2^k` and the target compiler regenerates ITS own
 // lowering; a wrong divisor recompiles to different bytes and shows up as a nonmatch, never as a
 // false match. The residual exposure is a lost match, not a miscompile — on a compiler that lowers
-// `/2^k` branchlessly, a diamond of this shape came from hand-written biasing, and respelling it
+// `/2^k` branchlessly, a diamond of this shape came from hand-written biasing, and rewriting it
 // costs a match that used to land. Measured positive on ido7.1 (two flips), agbcc and gcc2.7.2kmc
-// (modpow2 stays byte-exact through the respelling); mwcc_242_81 and gcc2.7.2 have no inhabitant, so
+// (modpow2 stays byte-exact through the rewrite); mwcc_242_81 and gcc2.7.2 have no inhabitant, so
 // they are unmeasured rather than clean.
 //
 // It is deliberately IDENTITY-OR-DECLINE about the shape (the bias constant must be exactly