@asmlift/core 0.6.0 → 0.8.0

package/src/frontend/reloc-symbol.ts

@@ -0,0 +1,109 @@
+// asmlift — the symbol-naming policy for relocations, as data.
+//
+// A relocation hands the frontend a LINKER's name, and a linker's namespace is strictly larger than
+// C's: it holds anonymous constant pools, section-relative labels, C++ vtables and mangled
+// function-scope statics, none of which any C or C++ source can spell. Recovering an address is
+// only half the job — the other half is deciding, per KIND of name, whether the recovered global
+// can be written down at all.
+//
+// The failure this exists to prevent is the one m2c shipped as `unksp0` for years: a gap rendered
+// as an ordinary-looking identifier. `__vt__6System` is the sharpest case — `extern u32
+// __vt__6System;` COMPILES, so nothing downstream would ever complain; the candidate would simply
+// be wrong in a way that reads as right. So the decision is made here, once, by the shape of the
+// name, and every refusing kind gets its own sentence naming what was seen.
+//
+// Consumed by frontend/ppc.ts, which refuses before it recovers. A kind is listed only when it
+// behaves differently: the decomp projects' generated labels (`lbl_1_bss_2464`, `fn_1_458`) are
+// ordinary identifiers that the project's own headers declare and its own sources spell, so they
+// are `plain` and get no entry of their own.
+//
+// THE SCOPE OF THIS POLICY IS THE NAME, AND ONLY ON A DATA RELOCATION.
+//  • Not the TYPE. A name this passes is still rendered at the width the asm implies, which is a
+//    different seam and fails loud in the compiler (docs/symbol-naming-policy.md).
+//  • Not the LINKAGE. A file-scope `static` and an `extern` of the same name compile to the same
+//    object under mwcc — same bytes, same named relocation — so the minted `extern` asserts
+//    nothing the reference did not already assert (measured; see the doc).
+//  • Not a `bl` CALLEE. Those reach the emitter through the call path and are NOT classified here:
+//    a C++ row's candidate is compiled inside an `extern \"C\"` block, where a mangled name written
+//    verbatim denotes exactly that symbol (apps/benchmark/src/compile/real.ts `candidateLinkage`),
+//    so a callee needs no policy the way a global that must be DECLARED does.
+//
+// The evidence, the counts and the corpus behind every rule are in docs/symbol-naming-policy.md.
+
+/** What sort of name a relocation carries. Everything but `plain` is unspellable in C. */
+export type RelocSymbolKind =
+  'plain' | 'anon-pool' | 'section-local' | 'local-static' | 'cpp-vtable' | 'cpp-mangled' | 'not-an-identifier';
+
+/** Classify a relocation's symbol by its spelling. Order matters: the shapes that ARE valid C
+ *  identifiers (`__vt__…`, a mangled class-scoped name) or contain characters a C identifier may
+ *  not (`@`, `.`, `$`) are each recognised before the general identifier test, so the catch-all
+ *  below can be exactly "a name of no kind this policy knows, and not an identifier either". */
+export function classifyRelocSymbol(sym: string): RelocSymbolKind {
+  if (sym.startsWith('@')) {
+    return 'anon-pool'; // `@193` — mwcc's anonymous string/constant pool entries
+  }
+  if (sym.startsWith('.')) {
+    return 'section-local'; // `...bss.0`, `.rodata` — an offset into a section
+  }
+  if (sym.includes('$')) {
+    return 'local-static'; // `sprHideTbl$797` — a function-scope static plus mwcc's TU-wide counter
+  }
+  if (sym.startsWith('__vt__')) {
+    return 'cpp-vtable'; // `__vt__6System` — a compiler-emitted virtual table
+  }
+  // mwcc mangles a class-scoped name as `<name>__<length><Class>` (`statbuff__9CmdStream`) or,
+  // for a nested scope, `<name>__Q<depth><…>` (`__ct__Q26Action5ChildFv`). The marker is the `__`
+  // followed by that LENGTH or `Q<depth>`, never a double underscore on its own: a rule that fired
+  // on `__` would refuse ordinary C globals like `g_my__table` and `__initialised`.
+  //
+  // THE MARKER IS THE SCOPE, NOT THE MANGLING, and the difference is deliberate. A free function's
+  // parameter mangle (`makeObjectBoss__Fv`, `ARAMFinish__FUl` — 89 of the 24,236 distinct symbols a
+  // data relocation names across the three checkouts) is `plain`: what this kind refuses is the
+  // missing DECLARATION, and a free function has no class scope for the symbol map to suppress one
+  // through. 0 of the 4,663 lifted functions in the same sweep emit such a name, so the line is
+  // documented rather than moved; docs/symbol-naming-policy.md names the two measurements that
+  // would have to come first.
+  if (/__(?:\d|Q\d)/.test(sym)) {
+    return 'cpp-mangled';
+  }
+  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(sym) ? 'plain' : 'not-an-identifier';
+}
+
+/** Why a symbol of this kind cannot be written into a candidate, as the tail of a refusal sentence
+ *  — or null for the one kind that can. The caller prefixes the function, mnemonic and address, so
+ *  a reader of the artifact learns the kind without re-deriving it from the name. */
+export function unspellableReason(sym: string): string | null {
+  switch (classifyRelocSymbol(sym)) {
+    case 'plain':
+      return null;
+    case 'anon-pool':
+      return (
+        `names an anonymous constant pool entry ('${sym}') — the compiler generated that name for a ` +
+        `literal it has no declaration for, so no C source can refer to it`
+      );
+    case 'section-local':
+      return (
+        `names a section-relative label ('${sym}') — it denotes an offset into a section, not an ` +
+        `object, so there is nothing to declare`
+      );
+    case 'local-static':
+      return (
+        `names a function-scope static ('${sym}') — the suffix is a translation-unit-wide counter ` +
+        `the compiler assigned, which no source can spell`
+      );
+    case 'cpp-vtable':
+      return (
+        `names a C++ virtual table ('${sym}') — the compiler emits it from a class definition, so ` +
+        `no source spells it (and declaring it anyway would compile, which is why this refuses)`
+      );
+    case 'cpp-mangled':
+      return (
+        `names a C++ class-scoped symbol ('${sym}') — a reference spelled this way reaches exactly ` +
+        `that symbol, but nothing here can DECLARE it: the row's own unit declares the member under ` +
+        `its class scope, which this frontend does not decode, and the candidate would name an ` +
+        `identifier no declaration introduces`
+      );
+    case 'not-an-identifier':
+      return `names '${sym}', which is not a C identifier`;
+  }
+}

package/src/frontend/splat.ts

@@ -15,11 +15,16 @@
 //   • constant immediate EXPRESSIONS (`(0x660104 >> 16)`, `(x & 0xFFFF)`) — the assembler's hi/lo
 //     split of a 32-bit literal, evaluated here to the plain number the decode switch parses.
 //
-// `%hi`/`%lo` operands (a global's address) are preserved verbatim so the MIPS frontend can fold
-// them into a `gaddr` (frontend/mips.ts). The other GOT/PIC relocations (`%gp_rel`, `%got`, …) are
-// declined LOUD — small-data / position-independent access is not modelled. Preserving rather than
-// blindly evaluating is what keeps `parseImm('%hi(SYM)')` from silently becoming a NaN immediate.
-import type { DisasmInstr } from './disasm';
+// `%hi`/`%lo` operands (a global's address) are turned into exactly what a relocatable object
+// carries — an `R_MIPS_HI16`/`R_MIPS_LO16` record on the instruction, plus the immediate the
+// instruction really encodes — so both MIPS dialects reach ONE fold (frontend/mips.ts,
+// frontend/high-half.ts) and neither gets a pairing rule of its own. The encoding is the
+// assembler's: `%hi(x)` is `((x + 0x8000) >> 16) & 0xffff`, ADJUSTED so the sign-extended low half
+// cancels the carry, and `%lo(x)` is the sign-extended low 16 bits — which is what lets the fold
+// recover `x` as `(hi << 16) + (s16)lo` for a positive or a negative offset alike.
+// The other GOT/PIC relocations (`%gp_rel`, `%got`, …) are declined LOUD — small-data /
+// position-independent access is not modelled.
+import type { DisasmInstr, DisasmReloc } from './disasm';
 import { FrontendUnsupportedError } from './errors';
 
 // One instruction line: `/* ROM VRAM BYTES */  MNEMONIC  OPS`. Group 1 is the VRAM address word.
@@ -29,9 +34,12 @@ const INSN_SIGNAL = /\/\*\s*[0-9A-Fa-f]+\s+[0-9A-Fa-f]+\s+[0-9A-Fa-f]+\s*\*\//;
 // A local-label DEFINITION on its own line (`.L800011C0_1DC0:`); the colon is required.
 const LABEL_DEF = /^(\.[\w.$]+):$/;
 // A GOT/PIC relocation operand this reader does not support (small-data / position-independent
-// access) — declined loud. `%hi`/`%lo` are NOT here: they name a global's address and are preserved
-// verbatim for the MIPS frontend to fold into a `gaddr` (see normalizeOperand / frontend/mips.ts).
+// access) — declined loud. `%hi`/`%lo` are NOT here: they name a global's address and become
+// relocation records for the MIPS frontend to fold (see normalizeOperand / frontend/mips.ts).
 const RELOC_OP = /%(gp_rel|gprel|got|call16|call_hi|call_lo|higher|highest|neg|tprel|dtprel)\b/i;
+// Any `%hi`/`%lo` spelling at all, so a half `normalizeOperand`'s pattern cannot resolve is caught
+// rather than falling through to the paths that read an operand as arithmetic.
+const HILO_OP = /%(hi|lo)\s*\(/i;
 // Data directives whose bytes could encode an effect: skipping one inside a function slice would
 // silently delete it, so they decline (mirrors the Thumb frontend's in-code-data guard).
 const DATA_DIRECTIVE =
@@ -120,7 +128,17 @@ export function parseSplatMips(asm: string, name: string): DisasmInstr[] {
         `cannot lift '${name}': data directive '${mnemonic}' in the code stream — skipping it would silently delete its effect`,
       );
     }
-    const ops = m[3].trim() ? splitOperands(m[3].trim()).map((o) => normalizeOperand(name, o)) : [];
+    const normalized = m[3].trim() ? splitOperands(m[3].trim()).map((o) => normalizeOperand(name, o)) : [];
+    const ops = normalized.map((n) => n.op);
+    // At most one relocation per instruction — the same invariant disasm.ts enforces on objdump
+    // output, and for the same reason: two would leave one symbol standing for the other's operand.
+    const relocs = normalized.map((n) => n.reloc).filter((r): r is DisasmReloc => r !== undefined);
+    if (relocs.length > 1) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': two relocation operands on one instruction ('${mnemonic}' at ` +
+          `0x${addr.toString(16)}): '${relocs[0].sym}' and '${relocs[1].sym}'`,
+      );
+    }
     // addi/addiu SIGN-EXTEND their 16-bit immediate; Splat may spell the low half of a materialised
     // constant as an unsigned mask (`(0x8000ABCD & 0xFFFF)` = 0xABCD), so re-sign it here to match
     // the hardware — and the objdump path, which prints the already-signed value. Zero-extending ops
@@ -132,7 +150,7 @@ export function parseSplatMips(asm: string, name: string): DisasmInstr[] {
       labelAddr.set(l, addr);
     }
     pending = [];
-    instrs.push({ addr, mnemonic, ops });
+    instrs.push({ addr, mnemonic, ops, reloc: relocs[0] });
   }
 
   // Resolve every branch/jump's target label to an address. A target that is not a local label of
@@ -194,31 +212,51 @@ function splitOperands(s: string): string[] {
 
 // Rewrite one Splat operand into the canonical objdump spelling the frontend consumes: strip the
 // `$` register sigil, fold a memory operand's displacement expression, evaluate a bare constant
-// expression, preserve a `%hi`/`%lo` global reference, and decline an unsupported PIC relocation.
-function normalizeOperand(name: string, op: string): string {
-  // `%hi(SYM)` / `%lo(SYM + N)` / `%lo(SYM)(base)` — a global's address. Preserved verbatim (with a
-  // de-sigiled base) for the MIPS frontend to fold into a `gaddr`; NOT declined like the PIC relocs.
-  const hilo = op.match(/^(%(?:hi|lo)\([^)]*\))(?:\((\$?[A-Za-z]\w*)\))?$/);
+// expression, split a `%hi`/`%lo` reference into an immediate plus its record, decline a PIC one.
+function normalizeOperand(name: string, op: string): { op: string; reloc?: DisasmReloc } {
+  // `%hi(SYM)` / `%lo(SYM + N)` / `%lo(SYM)(base)` — a global's address. Becomes the relocation
+  // record an object file would carry plus the immediate the instruction really encodes, so the
+  // frontend folds this dialect through the same path as objdump; NOT declined like the PIC relocs.
+  const hilo = op.match(
+    /^%(hi|lo)\(\s*([A-Za-z_.$][\w.$]*)\s*(?:([+-])\s*(0x[0-9a-fA-F]+|\d+))?\s*\)(?:\((\$?[A-Za-z]\w*)\))?$/,
+  );
   if (hilo) {
-    return hilo[2] ? `${hilo[1]}(${hilo[2].replace(/^\$/, '')})` : hilo[1];
+    const addend = hilo[4] ? evalConst(name, hilo[4]) * (hilo[3] === '-' ? -1 : 1) : 0;
+    const imm = hilo[1] === 'hi' ? ((addend + 0x8000) >> 16) & 0xffff : (addend << 16) >> 16;
+    const reloc: DisasmReloc = { type: hilo[1] === 'hi' ? 'R_MIPS_HI16' : 'R_MIPS_LO16', sym: hilo[2], addend: 0 };
+    return { op: hilo[5] ? `${imm}(${hilo[5].replace(/^\$/, '')})` : String(imm), reloc };
+  }
+  // A `%hi`/`%lo` the pattern above did NOT convert is still a relocation operand, and the paths
+  // below it read an operand as arithmetic: `%lo(0x800A1234)($v0)` matches the memory-operand shape
+  // and `evalConst` drops the tokens it does not know, so the displacement becomes the bare number
+  // and the access lifts as an index into the base register. A bare `%hi(…)` falls through to
+  // `plain` and the frontend refuses it one level down as a non-numeric immediate; refusing here
+  // says instead that what it saw was a relocation.
+  if (HILO_OP.test(op)) {
+    throw new FrontendUnsupportedError(
+      `cannot lift '${name}': relocation operand '${op}' — this reader resolves a '%hi'/'%lo' half ` +
+        `only against a symbol ('SYM' or 'SYM ± <integer>'), and will not treat one it cannot resolve ` +
+        `as arithmetic`,
+    );
   }
   if (RELOC_OP.test(op)) {
     throw new FrontendUnsupportedError(
       `cannot lift '${name}': relocation operand '${op}' (small-data / PIC data access) — not modelled`,
     );
   }
+  const plain = (v: string) => ({ op: v });
   // Memory operand `DISP(base)` — base is a register (letter-first), DISP a constant/expression.
   const mem = op.match(/^(.*)\((\$?[A-Za-z]\w*)\)$/);
   if (mem) {
     const disp = mem[1].trim();
     const off = disp === '' ? '0' : String(evalConst(name, disp));
-    return `${off}(${mem[2].replace(/^\$/, '')})`;
+    return plain(`${off}(${mem[2].replace(/^\$/, '')})`);
   }
   // A bare constant expression (`(0x660104 >> 16)`) — the assembler's hi/lo literal split.
   if (op.startsWith('(')) {
-    return String(evalConst(name, op));
+    return plain(String(evalConst(name, op)));
   }
-  return op.replace(/^\$/, '');
+  return plain(op.replace(/^\$/, ''));
 }
 
 // Evaluate a constant integer expression (the assembler's hi/lo split: hex/dec literals with

package/src/frontend/ssa.ts

@@ -15,7 +15,18 @@
 // computation via read/writeVar, push its terminator op last (successors referencing
 // `irBlocks`, args left empty — phi wiring appends them), then call `markFilled(b)`. When all
 // blocks are filled, call `finish()` to remove trivial phis.
-import { Block, Fn, Op, type SlotHomes, Value, type WriteOrder, mkOp, mkValue } from '../ir/core';
+import {
+  Block,
+  Fn,
+  Op,
+  type ParamObservation,
+  type SlotHomes,
+  Value,
+  type WriteOrder,
+  defOpMap,
+  mkOp,
+  mkValue,
+} from '../ir/core';
 import { pruneDeadParams, simplifyTrivialPhis } from '../ir/simplify';
 import { T } from '../ir/types';
 import { FrontendUnsupportedError } from './errors';
@@ -45,8 +56,13 @@ export interface SsaBuilder {
    *  elsewhere a parameter is a phi whose position is aligned with its predecessors' terminator
    *  args, and appending an unpaired one would corrupt that. */
   ensureParam(key: string, b: number): void;
-  /** Whether `reg` has a definition reaching block `b` (best-effort call-arity heuristic). */
-  hasReachingDef(reg: string, b: number, seen?: Set<number>): boolean;
+  /** Whether `reg` has a definition reaching block `b` (best-effort call-arity heuristic).
+   *
+   *  `accept` says what counts as a definition. A frontend that defines a register with something
+   *  that is NOT a value — PowerPC's `@ha` high half — passes a predicate rejecting it, because
+   *  "a def reaches here" and "a value reaches here" are the same question only when every def is
+   *  a value. */
+  hasReachingDef(reg: string, b: number, accept?: (v: Value) => boolean): boolean;
   /** Record that block `b` makes a call HERE: the ABI's caller-saved registers stop being ones the
    *  caller set up. Call it AFTER `recordGuessedCall` for the same instruction, and after writing
    *  the call's own result — the result is the CALLEE's, so it must not count as caller-side
@@ -92,21 +108,22 @@ export interface LiveInModel {
    *  is right for that question — but its offset is an ABI position, not an `expand_decl` rank,
    *  and ranking a declaration list by it would be wrong with no diagnostic.
    *
-   *  TODAY THE TWO RANGES COINCIDE UNDER THUMB, AND THAT IS DELEGATED, NOT PROVED. What keeps
-   *  argument slots out of `SlotHomes` is `prefixStored` (frontend/thumb.ts): a function whose
-   *  frame has an outgoing area DECLINES before it reaches here, so every function that does
-   *  reach here has none. That guard's own comment says "Neither is sound alone and the pair is
-   *  not either", and lifting it is a named next step — so this field exists to make the
-   *  dependency TYPED and LOCAL rather than implicit and cross-module. Whoever lifts that decline
-   *  must narrow this range above the argument block; leaving it equal to `ownedLocals` would
-   *  start minting declaration ranks out of argument slots silently.
+   *  THE TWO RANGES DIFFER UNDER THUMB, AND A PROOF IS WHAT SEPARATES THEM. The frontend passes
+   *  `{ from: area, to: localArea }`, where `area` is the largest outgoing block
+   *  `analyzeOutgoingArgs` (frontend/stackargs.ts) LICENSED — the extent over which a callee's declared
+   *  parameter count and this function's own staging stores agree word for word. That licence, not
+   *  a decline, is what keeps argument slots out of `SlotHomes`: a frame whose outgoing area cannot
+   *  be licensed still declines in the frontend and never reaches here, and a frame with no call
+   *  taking stack arguments has `area` 0, so the ranges coincide exactly when there is provably
+   *  nothing to skip. The dependency is TYPED and LOCAL for that reason — the offsets a frontend
+   *  must not report as declarations are stated here rather than implied across modules.
    *
    *  The class is populated, not hypothetical. Over a sweep of every sa3 and klonoa listing, of
    *  2,001 lifted real agbcc functions 27 carry any L1 slot home, 12 of those also CALL, and 11 of
-   *  those carry a home at offset 0 — the exact offset `prefixStored` encodes as where an argument
-   *  block starts (`PackSaveSector` homes [0,4,…,72], `modf` [0,4,…,36], `RenderDialogSprites`
-   *  [0,4,…,36], and eight more). None reaches the ordering today, for an unrelated reason
-   *  (`l3/slotorder.ts`'s REACH note), so nothing downstream is guarding this.
+   *  those carry a home at offset 0 — the exact offset an outgoing argument block starts at
+   *  (`PackSaveSector` homes [0,4,…,72], `modf` [0,4,…,36], `RenderDialogSprites` [0,4,…,36], and
+   *  eight more). None reaches the ordering today, for an unrelated reason (`l3/slotorder.ts`'s
+   *  REACH note), so nothing downstream is guarding this.
    *
    *  ABSENT ⇒ NO STAMP. MIPS and PPC declare no frame partition at all, so they stamp nothing,
    *  which is the refusing direction. */
@@ -196,7 +213,7 @@ export function makeSsaBuilder(
   const inRange = (off: number, r?: { from: number; to: number }) => r !== undefined && off >= r.from && off < r.to;
   const irBlocks: Block[] = Array.from({ length: blockCount }, () => ({ params: [] as Value[], ops: [] }));
   // `writeOrder` and `slotHomes` are filled in below, where the builder's counters live.
-  const fn: Fn = { name, blocks: irBlocks, writeOrder: undefined, slotHomes: undefined };
+  const fn: Fn = { name, blocks: irBlocks, writeOrder: undefined, slotHomes: undefined, paramEvidence: undefined };
 
   const defs: Array<Map<string, Value>> = irBlocks.map(() => new Map());
   const sealed: boolean[] = irBlocks.map(() => false);
@@ -262,9 +279,9 @@ export function makeSsaBuilder(
     //
     // AND IT ASKS `declaredLocals`, NOT `ownedLocals`, which is a different question with a
     // different answer under agbcc — the outgoing stack-argument area is storage the function owns
-    // and does not declare. The two ranges are equal under Thumb today only because `prefixStored`
-    // declines every function with an outgoing area; see `declaredLocals`' own doc for the
-    // measurement and for what lifting that decline obliges.
+    // and does not declare. Under Thumb the declared range therefore starts where the largest
+    // LICENSED outgoing block ends, and the two coincide only when that block is empty; see
+    // `declaredLocals`' own doc for what earns the narrowing and for the frames still refused.
     if (!inRange(off, model().declaredLocals)) {
       return;
     }
@@ -301,6 +318,44 @@ export function makeSsaBuilder(
       prev.add(off);
     }
   };
+  // PARAMETER EVIDENCE (ir/core.ts `ParamEvidence`), measured HERE for the same reason the clobber
+  // set, the write order and the slot homes are: a slot write is a `writeVar` and a slot read is a
+  // `readVar` in BOTH slot-modelling frontends, so one rule covers them and no frontend can forget
+  // to route a store past a wrapper. The two directions are NOT symmetric: raise/paramwidth.ts reads
+  // an absent observation as proof the declaration was wide, so a missed one costs a narrowing while
+  // a spurious one retypes a parameter the machine never declared narrow.
+  //
+  // RAW, in two ways that matter. Both halves record VALUES rather than verdicts, because the entry
+  // parameters are not final until `pruneDeadParams` has run in `finish()`, which is where the map
+  // is sealed. And the slot half asks no frame partition, unlike `noteSlotHome` directly above: see
+  // `ParamEvidence` for why "stored and never read back" needs none.
+  //
+  // A READ IS A `readVar`, AND `hasReachingDef` IS NOT ONE. The guard in `frontend/mips.ts`'s
+  // `emitLoad` asks whether a slot was ever stored before it reads it; asking is not reading, and
+  // the `readVar` on the line after it is.
+  const slotWrites = new Map<string, Set<Value>>();
+  const slotReads = new Set<string>();
+  const noteSlotTraffic = (key: string, v: Value | null) => {
+    if (slotKeyOffset(key) === null) {
+      return;
+    }
+    if (v === null) {
+      slotReads.add(key);
+      return;
+    }
+    const at = slotWrites.get(key);
+    if (at === undefined) {
+      slotWrites.set(key, new Set([v]));
+    } else {
+      at.add(v);
+    }
+  };
+  // THE FIRST entry-block write to each REGISTER, for `selfRedefined`. First and not any: a later
+  // write is the allocator reusing a register the argument is done with, which says nothing about
+  // the argument. Entry block only, because a widening the machine performs on the argument's own
+  // register is prologue work — a write in a later block has body code before it.
+  const firstEntryWrite = new Map<string, Value>();
+
   const forgetOrder = (p: Value) => {
     for (const m of writeOrder.lastWrite.values()) {
       m.delete(p);
@@ -309,11 +364,18 @@ export function makeSsaBuilder(
 
   const writeVar = (reg: string, b: number, v: Value) => {
     noteSlotHome(reg, v);
+    noteSlotTraffic(reg, v);
+    if (b === 0 && !firstEntryWrite.has(reg)) {
+      firstEntryWrite.set(reg, v);
+    }
     writtenSinceCall[b].add(reg);
     defs[b].set(reg, v);
     lastWriteAt[b].set(reg, writeCount[b]++);
   };
-  const readVar = (reg: string, b: number): Value => defs[b].get(reg) ?? readRecursive(reg, b);
+  const readVar = (reg: string, b: number): Value => {
+    noteSlotTraffic(reg, null);
+    return defs[b].get(reg) ?? readRecursive(reg, b);
+  };
 
   const newPhi = (reg: string, b: number): Value => {
     const phi = mkValue(T.unk(32));
@@ -454,15 +516,21 @@ export function makeSsaBuilder(
     obligedParams[b].set(key, p);
   };
 
-  const hasReachingDef = (reg: string, b: number, seen = new Set<number>()): boolean => {
-    if (defs[b].has(reg)) {
-      return true;
-    }
-    if (seen.has(b)) {
-      return false;
-    }
-    seen.add(b);
-    return preds[b].length > 0 && preds[b].some((p) => hasReachingDef(reg, p, seen));
+  const hasReachingDef = (reg: string, b: number, accept: (v: Value) => boolean = () => true): boolean => {
+    const walk = (at: number, seen: Set<number>): boolean => {
+      const own = defs[at].get(reg);
+      // A def `accept` rejects does not fall through to the predecessors: it is still a def, and
+      // nothing older than it reaches past it.
+      if (own !== undefined) {
+        return accept(own);
+      }
+      if (seen.has(at)) {
+        return false;
+      }
+      seen.add(at);
+      return preds[at].length > 0 && preds[at].some((p) => walk(p, seen));
+    };
+    return walk(b, new Set<number>());
   };
 
   return {
@@ -532,6 +600,35 @@ export function makeSsaBuilder(
         phiKey.delete(p);
         forgetOrder(p);
       });
+      // SEAL THE PARAMETER EVIDENCE (ir/core.ts `ParamEvidence`). Here and not at the store or the
+      // write, because `pruneDeadParams` above is the last thing that can retire an entry
+      // parameter, and an observation about a value no longer in the signature is one the reader
+      // would never find. Every surviving entry parameter gets an entry — EMPTY-but-present on a
+      // function that shows neither, because this builder measured it and found nothing.
+      const evidence = new Map<Value, ParamObservation>();
+      const deadHomed = new Set<Value>();
+      for (const [key, stored] of slotWrites) {
+        if (slotReads.has(key)) {
+          continue; // the slot is read back: the store is live and says nothing about a declaration
+        }
+        for (const v of stored) {
+          deadHomed.add(v);
+        }
+      }
+      const defs0 = defOpMap(fn);
+      for (const p of irBlocks[0].params) {
+        const reg = paramReg.get(p);
+        const first = reg === undefined ? undefined : firstEntryWrite.get(reg);
+        // The redefining op must READ the parameter — that is what makes the write the argument's
+        // own value moving, rather than an unrelated value landing in a register it had finished
+        // with. Direct, not transitive: a chain through body code is body code.
+        const redef = first === undefined ? undefined : defs0.get(first);
+        evidence.set(p, {
+          deadHome: deadHomed.has(p),
+          selfRedefined: redef !== undefined && redef.operands.includes(p),
+        });
+      }
+      fn.paramEvidence = evidence;
       // A STACK SLOT MAY NEVER LEAVE AS AN ENTRY PARAMETER. A slot is memory the function itself
       // allocated, so its value can only come from a store the function made; arriving as a live-in
       // instead means it was read on a path that never stored it, and the signature has grown an
@@ -742,7 +839,7 @@ export function trimClobberedCallArgs(inp: CallArgTrim): void {
  *  an attr only one of an otherwise-matching pair carries would cost a recovery. */
 const setupArgc = new WeakMap<Op, number>();
 
-/** Whether anything in `fn` HAS the narrower reading — the lever's gate, so the ~99% of functions
+/** Whether anything in `fn` HAS the narrower reading — the variation's gate, so the ~99% of functions
  *  with no narrowable call cost no re-lift. Read it off the lift itself: a later pipeline stage may
  *  replace a `call` op (softdiv rewrites one to a division), and the table is keyed by op. */
 export function hasSetupArgsNarrowing(fn: Fn): boolean {