@asmlift/core 0.6.0 → 0.8.0

package/src/raise/paramwidth.ts

@@ -21,6 +21,76 @@
 // narrow parameter with the `extsb`/`extsh` the frontend lifts to the same op, and the synthetic
 // `sextb`/`tos8` rows keep matching on that toolchain through this pass.
 //
+// BUT THE PROLOGUE TEST IS NOT UNIVERSAL EVIDENCE, AND ON MIPS IT IS NO EVIDENCE AT ALL. Everything
+// above reads the extension's POSITION, which works only where the compiler puts a declaration's
+// extension somewhere a body cast's never goes. IDO 7.1 at -O2 does not: it leads the function with
+// the `sll` for BOTH spellings. Two OTHER facts separate them there, and it takes both — each one
+// alone is refuted by a compiled counterexample, at the row's own flags:
+//
+//                                             home store   widened in place
+//   int f(s8 x){ return x; }                      sw a0     sll a0,a0,0x18     the declaration
+//   int f(s32 x){ return (s8)x; }                   —       sll v0,a0,0x18     a body cast
+//   int f(int x){ x = (signed char)x; return x; }   —       sll a0,a0,0x18     NOT homed
+//   int f(long long x){ return (signed char)x; }  sw a1     sll v0,a1,0x18     NOT in place
+//
+// The last two lines are why the conjunction is the claim. A DEAD ABI ARGUMENT HOME STORE on its
+// own is not "declared narrow" — IDO emits one wherever the incoming register value goes unused,
+// whatever that value's type:
+//
+//   int unused1(int x){ return 7; }         sw a0,0(sp) / jr ra / li v0,7
+//   int ptr1(int *p, int y){ return y; }    sw a0,0(sp) / jr ra / move v0,a1
+//   int ll2i(long long x){ return (int)x; } sw a0,0(sp) / sw a1,4(sp) / jr ra / move v0,a1
+//   int used2(int x, int y){ return x+y; }  jr ra / addu v0,a0,a1        (no store at all)
+//
+// — so the store says the incoming register was not consumed, not that anything was declared
+// narrow, and on the `long long` line that is a 64-bit parameter whose low half the extension would
+// narrow to `s8`; `widened-elsewhere` is what refuses it. WIDENING IN PLACE on its own is not
+// "declared narrow" either: the third line is a plain `int` the source re-assigns, and only the
+// absent home store tells it from the first.
+//
+// The conjunction is NECESSARY-and-measured, not necessary-and-sufficient, and it errs toward
+// refusing: `int m2(signed char a){ int i,s=0; for(i=0;i<10;i++) s+=arr[i]+a; return s; }` is a
+// narrow declaration IDO widens into a SCRATCH register under register pressure (`sll a1,a0,0x18`),
+// so this pass leaves its parameter wide and re-spells the cast. That is a worse-reading answer,
+// not a wrong one.
+//
+// THE PAIR SAYS A NARROW DECLARATION EXISTS, NOT WHICH ONE. The WIDTH comes from the extension,
+// and where a wider mask sits on that extension's result the declaration could have been the wider
+// type — `int f(u16 x){ x = (signed char)x; return x; }` and `int f(s8 x){ return x & 0xffff; }`
+// are ONE object at the row's own flags (`sw a0,0(sp) / sll a0,a0,0x18 / sra a0,a0,0x18 / andi
+// v0,a0,0xffff`), so the asm decides nothing between them and this pass answers `s8`. Refusing on
+// that disagreement is not the repair, because the spelling a refusal falls back to is a DIFFERENT
+// object: `int f(int a){ return ((a << 24) >> 24) & 0xffff; }` is four words with no home store and
+// both shifts in `v0`, so the refusal would cost the byte match under BOTH readings. Where the
+// caller declares the parameter `proto-width` takes the tiebreak; where nobody does, the two
+// readings recompile alike and only a PROTOTYPED CALL SITE of this function could tell them apart.
+//
+// Ungated, this pass narrows the body cast too and loses `synthetic:tos8:ido7.1`, a MATCH. The two
+// MIPS GCCs are a third case again: their two spellings are one BYTE-IDENTICAL object, so nothing
+// in the asm decides the width and the honest answer is to leave the extension standing.
+//
+// So which fact settles the width is a per-COMPILER question, asked as
+// `compilerBehaviors.narrowParamWitness` and answered by `no-declaration-witness`, `unhomed-param`
+// and `widened-elsewhere` below. Both facts it reads are destroyed at lift and survive as the
+// frontend's `Fn.paramEvidence` (ir/core.ts).
+//
+// `not-prologue` STILL FIRES ON SUCH A TARGET, and it costs rather than protects there. IDO's
+// scheduler interleaves the widenings of several narrow parameters with the arithmetic that
+// consumes the earlier ones, and the scan below stops at the first value-reading op, so only the
+// LEADING parameters are seen as prologue:
+//
+//     int d4(s8 a, s8 b, s8 c){ return a+b+c; }   sll a1 / sll a0 / sll a2 / sra a0 / sra a1 /
+//                                                 addu t6,a0,a1 / sra a2 / addu v0,t6,a2
+//       recovered  s32 d4(s8 a0, s8 a1, s32 a2) { return a0 + a1 + (s8)a2; }
+//     int m3(s16 a, s16 b, s16 c, s16 d){ return a*b+c*d; }  all four widenings precede the first
+//       recovered  s32 m3(s16 a0, s16 a1, s16 a2, s16 a3)    multiply — all four narrow
+//
+// So the limit is the SCHEDULE's, not the declaration's, and the gate answers in the refusing
+// direction on the parameters it cuts off. Kept because it is the sound direction and because it is
+// the only gate that keeps a body cast behind real body code from being read as a prologue widening
+// on the position-witness targets; NO row on either tier is known to turn on the IDO half of it —
+// `d4` above is a probe, not a row, and lifting the scan is a change with its own measurement to make.
+//
 // WHAT THE PROLOGUE TEST CANNOT SEE, and why the declaration settles it. The scan steps over the
 // pure materializations agbcc interleaves among the extensions, so a constant the scheduler HOISTED
 // above a mid-body cast leaves `pb` looking like `pa`:
@@ -43,11 +113,21 @@
 // What that refusal protects is a function this pass never compiles: agbcc truncates at every
 // PROTOTYPED CALL SITE of a narrow-declared callee — `lsl/asr` ahead of the `bl`, two Thumb
 // instructions per site — so a wrong width here costs bytes the per-function differ cannot see.
+//
+// FUSED BEHIND A POOL LOAD. The prologue scan steps over a pool-loaded address, and a body cast
+// with nothing else ahead of it — `gB = gW[(u8)a]` is `ldr r2,=gB / ldr r1,=gW / lsl r0,#24 /
+// lsr r0,#22` — reaches it looking like a declaration once raise/extscale.ts has re-split the fused
+// pair. The fold knows where the machine put that `lsl` and records it (`ScaleRecord.behindPool`),
+// and `fused-behind-pool` reads the record: an unsigned declared parameter's `lsl` precedes every
+// pool load in the benchmark's agbcc references (extscale.ts's header has the census). Only the
+// fold's own extensions are judged this way; a plain cast's extension sits at its right shift,
+// where its position says nothing about its `lsl`'s.
 import { type Fn, type Op, type Value, replaceAllUsesWith, successorsOf } from '../ir/core';
 import { CAST_WIDTHS, MATERIALIZING_OPS } from '../ir/opcodes';
 import { T } from '../ir/types';
 import { type Gate, firstRejection } from '../l3/gates';
 import { type FnProto, declaredWidth } from '../proto';
+import type { NarrowParamWitness } from '../target';
 
 /** What the gates below judge: one entry parameter and the extension that reads it. */
 export interface NarrowParamCandidate {
@@ -63,6 +143,15 @@ export interface NarrowParamCandidate {
   uses: number;
   /** the width the caller's own prototype declares for this parameter, if it declares one */
   declared: number | undefined;
+  /** the extension is one raise/extscale.ts re-split from a fused pair whose `shl` the machine ran
+   *  behind a pool load — see FUSED BEHIND A POOL LOAD */
+  fusedBehindPool: boolean;
+  /** what this compiler's object shows for a narrow declaration (target.ts `narrowParamWitness`) */
+  witness: NarrowParamWitness;
+  /** the machine stored this parameter to a stack slot nothing reads back (`ParamObservation`) */
+  homed: boolean;
+  /** the machine put the parameter's own widened value back in its argument register (`ParamObservation`) */
+  selfRedefined: boolean;
 }
 
 export const PARAM_WIDTH_GATES: readonly Gate<NarrowParamCandidate>[] = [
@@ -103,11 +192,41 @@ export const PARAM_WIDTH_GATES: readonly Gate<NarrowParamCandidate>[] = [
   },
   {
     id: 'not-prologue',
-    why: 'an extension behind body code is where the SOURCE wrote the cast',
+    why: 'an extension behind body code is where the SOURCE wrote the cast — and on a schedule that interleaves them, the refusing answer',
     sound: true,
     guardedBy: 'param-width.test.ts: an extension behind a nullary call is body code',
     rejects: (c) => !c.inPrologue,
   },
+  {
+    id: 'no-declaration-witness',
+    why: 'this compiler spells a narrow declaration and a body cast the same way, so the asm decides nothing',
+    sound: true,
+    guardedBy:
+      'param-width.test.ts: a compiler whose two spellings are one object refuses the narrowing, measured or not',
+    rejects: (c) => c.witness === 'none',
+  },
+  {
+    id: 'unhomed-param',
+    why: 'this compiler homes a narrow DECLARED parameter, so the absent home store proves the declaration was wide',
+    sound: true,
+    guardedBy: 'param-width.test.ts: a homing compiler refuses the parameter it did not home',
+    rejects: (c) => c.witness === 'home-store-and-in-place' && !c.homed,
+  },
+  {
+    id: 'widened-elsewhere',
+    why: 'this compiler widens a narrow DECLARED parameter in the argument register itself, so a widening that lands in a scratch register is not a declaration',
+    sound: true,
+    guardedBy:
+      'param-width.test.ts: \u2026and refuses one it homed but widened SOMEWHERE ELSE \u2014 that is a 64-bit half',
+    rejects: (c) => c.witness === 'home-store-and-in-place' && !c.selfRedefined,
+  },
+  {
+    id: 'fused-behind-pool',
+    why: 'a fused cast behind a pool load is body code if unsigned, and either width is the same object if signed',
+    sound: true,
+    guardedBy: 'extscale.test.ts: a body cast behind nothing but a pool load keeps its parameter wide',
+    rejects: (c) => c.fusedBehindPool,
+  },
 ];
 
 /** How many times `v` is read anywhere in `fn` — op operands and branch arguments alike. */
@@ -125,13 +244,20 @@ function useCount(fn: Fn, v: Value): number {
 }
 
 /** Type an entry parameter at the width its prologue extension proves, and drop the extension.
- *  `self` is the prototype the caller supplied for THIS function, if any. Returns the number of
- *  parameters narrowed. */
+ *  `witness` is what this compiler's object shows for a narrow declaration (target.ts
+ *  `narrowParamWitness`); `self` is the prototype the caller supplied for THIS function, if any;
+ *  `fusedBehindPool` is raise/extscale.ts's record of the extensions it re-split behind a pool load
+ *  (`ScaleRecord.behindPool`). Returns the number of parameters narrowed. */
 export function narrowEntryParams(
   fn: Fn,
+  witness: NarrowParamWitness,
   self?: FnProto,
   gates: readonly Gate<NarrowParamCandidate>[] = PARAM_WIDTH_GATES,
+  fusedBehindPool: ReadonlySet<Op> = new Set(),
 ): number {
+  // ABSENT ⇒ NEITHER OBSERVATION, which is the refusing direction on a target that reads them: a
+  // function nobody measured (parsed IR, a hand-built fn) is never narrowed on evidence never taken.
+  const evidence = fn.paramEvidence;
   const entry = fn.blocks[0];
   const declared = Array.isArray(self?.params) ? self.params.map(declaredWidth) : [];
   const entryIsJoin = fn.blocks.some((b) => successorsOf(b).includes(entry));
@@ -166,6 +292,10 @@ export function narrowEntryParams(
       inPrologue: prologue.has(op),
       uses: useCount(fn, p),
       declared: declared[entry.params.indexOf(p)],
+      fusedBehindPool: fusedBehindPool.has(op),
+      witness,
+      homed: evidence?.get(p)?.deadHome ?? false,
+      selfRedefined: evidence?.get(p)?.selfRedefined ?? false,
     };
     if (firstRejection(gates, c) !== null) {
       continue;

package/src/raise/pre-recovery.ts

@@ -18,12 +18,21 @@ import type { TargetDescription } from '../target';
 import { recognizeArrays } from './arrays';
 import { recognizeConsts } from './const';
 import { recognizeDivPow2 } from './divpow2';
+import {
+  type PoolOrder,
+  type ScaleRecord,
+  emptyScaleRecord,
+  foldScaledExtensions,
+  foldsShiftPairCasts,
+  poolOrderOf,
+  restoreUnclaimedScales,
+} from './extscale';
 import { numberPureValues } from './gvn';
 import { recognizeMagicDivision } from './magicdiv';
 import { recognizeMemberArrays } from './memberarrays';
 import { rerootNarrowReads } from './narrow';
 import { type MergeShape, mergeShapes, narrowBlockLocals } from './narrowlocal';
-import { narrowEntryParams } from './paramwidth';
+import { PARAM_WIDTH_GATES, narrowEntryParams } from './paramwidth';
 import { type BranchShortCircuitOptions, recognizeBranchShortCircuit, recognizeShortCircuit } from './shortcircuit';
 import { recognizeSoftDiv } from './softdiv';
 import { recognizeStructArrays } from './struct-arrays';
@@ -34,7 +43,7 @@ import { recognizeStructs } from './structs';
  *  A field here selects between spellings its pass can already produce; none of them relaxes a
  *  soundness refusal, and each recognizer documents its own. */
 export interface PreRecoveryOptions {
-  /** raise/shortcircuit.ts `recognizeBranchShortCircuit` — the connective-vs-comparison-tree axis. */
+  /** raise/shortcircuit.ts `recognizeBranchShortCircuit` — the connective-vs-comparison-tree question. */
   shortCircuit?: BranchShortCircuitOptions;
 }
 
@@ -44,9 +53,18 @@ export interface PreRecoveryOptions {
  *  by then divpow2 has deleted a block, both short-circuit folds have rewritten edges, and the
  *  eight `dce: true` passes have changed op counts. So the driver reads it here and hands it down. */
 export interface PreRecoveryFacts {
-  /** the join shape of every block, for raise/narrowlocal.ts's `edge-extends`. Blocks a later pass
-   *  creates are absent, and absent reads as "no diamond" — the refusing direction. */
+  /** the join shape of every block, for raise/narrowlocal.ts's `edge-extends` and, downstream of
+   *  pre-recovery entirely, raise/retsink.ts's `pre-diamond`. Blocks a later pass creates are
+   *  absent, and absent reads as "no diamond" — the refusing direction, in both readers. */
   mergeShapes: Map<Block, MergeShape>;
+  /** which entry-block ops the machine ran after its first pool-loaded address, for
+   *  raise/extscale.ts's behind-a-pool-load record. Read HERE because `addrnum`, the first pass,
+   *  hoists duplicated addresses to the head of the entry block and that order is gone after it. */
+  poolOrder: PoolOrder;
+  /** THE ONE FACT A PASS WRITES rather than the lift: what raise/extscale.ts's fold made, for the
+   *  two passes after it that read it — paramwidth's `fused-behind-pool` gate and
+   *  `extscale-restore`. Empty until the fold runs. */
+  scales: ScaleRecord;
 }
 
 export interface PreRecoveryPass {
@@ -55,7 +73,9 @@ export interface PreRecoveryPass {
   /** run the recognizer; returns a truthy value (a change count, or `true`) iff it CHANGED the IR.
    *  `self` is the prototype the caller supplied for the function being raised — read only by
    *  parameter-width, which checks its inference against a declared width. `lifted` is the
-   *  pre-pass CFG snapshot — read only by narrow-local. */
+   *  pre-pass snapshot — read by narrow-local (its CFG) and scaled-extension (its entry order) —
+   *  plus the fold's record, which scaled-extension writes and parameter-width and
+   *  scaled-extension-restore read. */
   run: (
     fn: Fn,
     self: FnProto | undefined,
@@ -70,9 +90,10 @@ export interface PreRecoveryPass {
 }
 
 /** THE ordered pre-recovery pass list — the single source of truth shared by pipeline / rank / report.
- *  address-numbering → const-materialize → magic-division → pow2-division → soft-division → array-legalize →
- *  struct-array → member-array → struct-pointer → short-circuit → branch-short-circuit → narrow-reads →
- *  narrow-local → parameter-width. See each recognizer's file for the rationale. */
+ *  address-numbering → const-materialize → magic-division → pow2-division → soft-division →
+ *  scaled-extension → array-legalize → struct-array → member-array → struct-pointer → short-circuit →
+ *  branch-short-circuit → narrow-reads → narrow-local → parameter-width → scaled-extension-restore.
+ *  See each recognizer's file for the rationale. */
 export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
   // FIRST: collapsing duplicate address definitions removes block params every later recognizer
   // would otherwise have to reason around, and it can only shrink the value graph.
@@ -81,10 +102,11 @@ export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
     // Numbering alone is not enough and not safe to ship alone: collapsing the duplicates leaves a
     // block param whose edges now all carry one value, and the structurer still destroys THAT into
     // a local (it only reuses a name a carrier already has, and an inlined `gaddr` has none).
-    // Numbering alone costs kleod:UpdateHUDCounterDisplay its match, so the pair is the atomic
-    // unit, expressed as a body rather than a sum of two unrelated counts. It is NOT monotone,
-    // which is worth knowing before tuning either half: dropping the cleanup IMPROVES
-    // kleod:ConfigureEntityBehavior and kleod:CountCollectedGems, neither of them near matching.
+    // Numbering alone cost kleod:UpdateHUDCounterDisplay its match (measured on kleod's
+    // kl-eod-decomp rows, retired 2026-09-13), so the pair is the atomic unit, expressed as a body
+    // rather than a sum of two unrelated counts. It was NOT monotone, which is worth knowing before
+    // tuning either half: dropping the cleanup IMPROVED kleod:ConfigureEntityBehavior and
+    // kleod:CountCollectedGems, neither of them near matching then.
     run: (fn) => {
       const n = numberPureValues(fn);
       return n + simplifyTrivialPhis(fn);
@@ -100,6 +122,17 @@ export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
   // beside magicdiv so that a reader looking for division recovery finds both together.
   { id: 'divpow2', run: recognizeDivPow2, dce: true },
   { id: 'softdiv', run: (fn) => recognizeSoftDiv(fn), dce: false, gate: (t) => !t.capabilities.hwDivide },
+  // AFTER `const`, which folds a shift pair over a constant to the constant it computes, and BEFORE
+  // the three array recognizers, whose input this pass produces: `shl(ext(x), k)` is an element
+  // scale they legalize and the fused pair is not. `dce: true` — the `shl` a fold leaves readerless.
+  // It reads `lifted.poolOrder`, the entry block's order before `addrnum` hoisted its addresses,
+  // and writes `lifted.scales`.
+  {
+    id: 'extscale',
+    run: (fn, _self, _opts, _target, lifted) => foldScaledExtensions(fn, lifted.poolOrder, lifted.scales),
+    dce: true,
+    gate: foldsShiftPairCasts,
+  },
   { id: 'arrays', run: recognizeArrays, dce: true },
   // struct-arrays AFTER arrays (scalar stride==width shapes are claimed first — see the
   // discriminator note in raise/struct-arrays.ts) and BEFORE structs (an element's field
@@ -128,28 +161,35 @@ export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
   // counts 0 fused heads across the 782 rows that lift map-lessly, so the hazard has no producer
   // there. The reverse direction never could: the value form replaces its head's `cond_br` with a
   // `br`, which this pass never matches.
+  // The `target` argument is read by ONE conjunct of ONE gate, as at `narrowlocal` below:
+  // `read-behind-effect`'s "a local costs a second load", compiled on all five bench toolchains and
+  // true on agbcc alone (raise/shortcircuit.ts, target.ts `reloadsLocalReread`).
   {
     id: 'branch-shortcircuit',
-    run: (fn, _self, opts) => recognizeBranchShortCircuit(fn, opts.shortCircuit),
+    run: (fn, _self, opts, target) =>
+      recognizeBranchShortCircuit(fn, {
+        ...opts.shortCircuit,
+        reloadsLocalReread: target.compilerBehaviors.reloadsLocalReread,
+      }),
     dce: true,
   },
   // LAST, and the position IS load-bearing: this pass reads the CFG's edge arguments to find a
   // loop variable's next value, and both short-circuit folds above rewrite the very edges it reads.
   // `dce: false` — the rewrite orphans nothing, since the operand it drops keeps its other use.
   { id: 'narrow', run: rerootNarrowReads, dce: false },
-  // The two WIDTH passes, last and in either order relative to each other: each only DELETES an
-  // extension and retypes the parameter that fed it, so every recognizer above sees the shape it
-  // was written against and neither can match a shape the other creates. They are disjoint by
-  // construction — `narrowlocal` refuses an entry parameter, `paramwidth` reads only entry
-  // parameters — and `narrowlocal` cannot take an extension `narrow` above wants either, since a
-  // parameter carrying BOTH a `zext` and a `sext` has two readers and is refused.
+  // The two WIDTH passes, last of the recognizers and in either order relative to each other: each
+  // only DELETES an extension and retypes the parameter that fed it, so every recognizer above sees
+  // the shape it was written against and neither can match a shape the other creates. They are
+  // disjoint by construction — `narrowlocal` refuses an entry parameter, `paramwidth` reads only
+  // entry parameters — and `narrowlocal` cannot take an extension `narrow` above wants either, since
+  // a parameter carrying BOTH a `zext` and a `sext` has two readers and is refused.
   // `dce: false` on both — the extension each drops is spliced out in place, and its result has no
   // other reader.
   // The `target` argument is read by ONE conjunct of ONE gate — see raise/narrowlocal.ts's
   // `NarrowLocalOptions`. A whole-pass `gate` would be wrong: the pass's SOUND rules are claims
   // about C and run everywhere; only the join-shape evidence is a claim about gcc 2.x's optimizer.
-  // That same conjunct is why this is the one pass reading `lifted`: every pass above it can
-  // rewrite the CFG whose shape it judges.
+  // That same conjunct is why it reads `lifted.mergeShapes`: every pass above it can rewrite the
+  // CFG whose shape it judges.
   {
     id: 'narrowlocal',
     run: (fn, _self, _opts, target, lifted) =>
@@ -161,20 +201,54 @@ export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
       ),
     dce: false,
   },
-  { id: 'paramwidth', run: (fn, self) => narrowEntryParams(fn, self), dce: false },
+  // The `target` argument is read by TWO of this pass's gates, and unlike `narrowlocal`'s single
+  // conjunct it is not a tuning knob: `narrowParamWitness` says WHICH fact in the object settles a
+  // parameter's declared width on this compiler, and a target that names none refuses outright.
+  {
+    id: 'paramwidth',
+    run: (fn, self, _opts, target, lifted) =>
+      narrowEntryParams(
+        fn,
+        target.compilerBehaviors.narrowParamWitness ?? 'none',
+        self,
+        PARAM_WIDTH_GATES,
+        lifted.scales.behindPool,
+      ),
+    dce: false,
+  },
+  // LAST, after every pass that can CLAIM what `extscale` exposed — the two width passes above take
+  // an extension, the array recognizers a scale. What none of them took goes back to the pair the
+  // frontend lifted (raise/extscale.ts, WHAT NOBODY CLAIMED). `dce: true` — the extension it leaves
+  // readerless.
+  {
+    id: 'extscale-restore',
+    run: (fn, _self, _opts, _target, lifted) => restoreUnclaimedScales(fn, lifted.scales),
+    dce: true,
+    gate: foldsShiftPairCasts,
+  },
 ];
 
 /** Run the pre-recovery passes in order. For each pass whose gate passes and that CHANGES the IR, run
  *  `dce` when the pass declares it, then invoke `afterPass(pass, result)` (the caller's verify/trace
- *  hook), if given. */
+ *  hook), if given.
+ *
+ *  RETURNS the facts it read, because a pass AFTER pre-recovery needs one of them too:
+ *  `raise/retsink.ts`'s `pre-diamond` asks whether a return merge was a diamond in the ROM, and
+ *  by its turn `raise/shortcircuit.ts` has manufactured diamonds that were not. The map is the
+ *  driver's to compute — it is the only place that sees `fn` before the first pass — so handing it
+ *  back is cheaper and truer than recomputing something later that cannot be recomputed. */
 export function runPreRecovery(
   fn: Fn,
   target: TargetDescription,
   afterPass?: (pass: PreRecoveryPass, result: number | boolean) => void,
   self?: FnProto,
   opts: PreRecoveryOptions = {},
-): void {
-  const lifted: PreRecoveryFacts = { mergeShapes: mergeShapes(fn) };
+): PreRecoveryFacts {
+  const lifted: PreRecoveryFacts = {
+    mergeShapes: mergeShapes(fn),
+    poolOrder: poolOrderOf(fn),
+    scales: emptyScaleRecord(),
+  };
   for (const pass of PRE_RECOVERY_PASSES) {
     if (pass.gate && !pass.gate(target)) {
       continue;
@@ -187,4 +261,5 @@ export function runPreRecovery(
       afterPass?.(pass, result);
     }
   }
+  return lifted;
 }