@asmlift/core 0.7.0 → 0.8.1

package/src/l3/tailret.ts

@@ -0,0 +1,70 @@
+// L3 spelling pass: drop a void `return;` the assembly says the source never wrote.
+//
+// `structure/retspell.ts` marks a return `unspelled` when the machine reached that epilogue without
+// the `b <epilogue>` a source `return;` compiles to — the reading, and what makes it decidable, is
+// stated there. This pass is the other half: a mark alone is not a licence to delete, because a
+// `return` is still a control transfer in the STATEMENT tree. Deleting one that something follows
+// lets control run on into it, and that is a semantic change, not a spelling one.
+//
+// So the licence is TAIL POSITION and nothing weaker: nothing executes after the statement on any
+// path, all the way up to the end of the function. A return ending a loop body, a `switch` arm, or
+// an `if` arm the function continues past is left exactly where it is, whatever the mark says.
+//
+// TWO SHAPES REFUSE EVEN IN TAIL POSITION, both because removing the statement would leave a
+// statement list that has to be re-spelled rather than shortened:
+//
+//   - the sole statement of a `then` arm. `if (c) { }` is not the answer — `if (!c) { … }` is, and
+//     which sense a compiler emits is a per-SITE question this pass holds nothing to decide.
+//   - the whole function body. A body is not a place a statement can vanish from.
+//
+// An `else` arm IS allowed to empty: an `if` with no else is the same statement, and both the
+// printer (`backend/cfamily.ts`) and `l3/dce.ts` already spell `else: []` that way.
+//
+// THE REFUSALS ARE PROSE, NOT A `Gate` TABLE, and that is the second of the three answers
+// `docs/level-tower.md` sanctions rather than an omission. A table buys the ablation — drop this
+// rule and something breaks — as a test instead of a claim, and it is worth building for a refusal a
+// round has HAD to instrument. None of these was: each is a property of one candidate's own
+// position, and `test/tailret.test.ts` holds a test per refusal, which is the ablation the table
+// would have bought. Convert them when a round has to argue about one.
+//
+// Ordering: after `l3/tailmerge.ts`, whose peel moves `assign`/`store`/`exprstmt` only, so a
+// `return` ending an arm blocks it — run first and this pass hands tailmerge arms it could not
+// otherwise peel, changing rows that have nothing to do with returns. Before `l3/dce.ts`, so its
+// branch peephole sees the `else` this pass empties. `pipeline.ts` commits that order.
+import type { SFn, Stmt } from './ast';
+
+/** Can this statement be deleted outright — a void return the asm did not spell? */
+const isDroppable = (s: Stmt): boolean => s.k === 'return' && s.value === undefined && s.unspelled === true;
+
+/** `stmts` rewritten. `isTail` — control falls off the END of the function after this list, so its
+ *  last statement is in tail position. `mayEmpty` — the list is allowed to come back empty. */
+function walk(stmts: Stmt[], isTail: boolean, mayEmpty: boolean): Stmt[] {
+  const out = stmts.map((s, i) => {
+    const tail = isTail && i === stmts.length - 1;
+    switch (s.k) {
+      case 'if':
+        return { ...s, then: walk(s.then, tail, false), else: walk(s.else, tail, true) };
+      case 'while':
+      case 'dowhile':
+      case 'for':
+        // A return inside a loop is never in tail position: the statement after it is the next
+        // iteration.
+        return { ...s, body: walk(s.body, false, false) };
+      case 'switch':
+        // Nor inside a `switch`: dropping an arm's return diverts it into the arm below.
+        return {
+          ...s,
+          cases: s.cases.map((c) => ({ ...c, body: walk(c.body, false, false) })),
+          ...(s.default ? { default: walk(s.default, false, false) } : {}),
+        };
+      default:
+        return s;
+    }
+  });
+  const last = out[out.length - 1];
+  return isTail && last !== undefined && isDroppable(last) && (out.length > 1 || mayEmpty) ? out.slice(0, -1) : out;
+}
+
+export function dropUnspelledReturns(sfn: SFn): SFn {
+  return { ...sfn, body: walk(sfn.body, true, false) };
+}

package/src/l3/unmerge.ts

@@ -13,8 +13,8 @@
 // own definitions into the join statement and duplicating it back recovers that spelling.
 //
 // A VARIATION, NOT A DEFAULT, and the reason is the tower's: the LIFTED TREE underdetermines the
-// source. This is a compiler claim, so it was compiled — agbcc `gcc 2.9-arm-000512` at
-// `TOOLCHAIN.agbccFlags`, both spellings, `diff` on the `.s`:
+// source. This is a compiler claim, so it was compiled — agbcc `gcc 2.9-arm-000512` at its
+// canonical flags, both spellings, `diff` on the `.s`:
 //
 //   - the example above (an ADDRESS temp and a VALUE temp, against `*gA1 = gB1;` in one arm and
 //     `*gA2 = gB2;` in the other, `v17` typed as the store's own type) is BYTE-IDENTICAL. There

package/src/l3/unreduce.ts

@@ -196,6 +196,7 @@ import {
   exprEquals,
   exprHasEffect,
   exprReadsVolatile,
+  isLoop,
   mapExprChildren,
   stmtChildren,
   stmtExprs,
@@ -813,7 +814,7 @@ export function unreduceAccumulators(
 
   for (let li = 0; li < body.length; li++) {
     const loop = body[li];
-    if (loop.k !== 'while' && loop.k !== 'dowhile' && loop.k !== 'for') {
+    if (!isLoop(loop)) {
       continue;
     }
     // the counter: one name stepped by a constant, whose start stands above the loop

package/src/mangle.ts

@@ -129,6 +129,55 @@ export function demangle(sym: string): CppSig | null {
   return { name, cls, params };
 }
 
+/** A class qualifier off the front of `s` — `12RefCountable`, or `Q23zen17particleGenerator` for a
+ *  nested one — as its scope names and the remaining string; null when `s` does not open with one. */
+function parseQualifier(s: string): { scopes: string[]; rest: string } | null {
+  const nested = /^Q(\d)/.exec(s);
+  let count = nested === null ? 1 : Number(nested[1]);
+  let rest = nested === null ? s : s.slice(2);
+  const scopes: string[] = [];
+  for (; count > 0; count--) {
+    const digits = /^(\d+)/.exec(rest);
+    if (digits === null) {
+      return null;
+    }
+    const len = Number(digits[1]);
+    const id = rest.slice(digits[1].length, digits[1].length + len);
+    if (len === 0 || id.length !== len) {
+      return null;
+    }
+    scopes.push(id);
+    rest = rest.slice(digits[1].length + len);
+  }
+  return { scopes, rest };
+}
+
+/** The name a CodeWarrior function symbol has in its SOURCE — `PlayerState::getStartHour` for
+ *  `getStartHour__11PlayerStateFv`, `zen::particleGenerator::RotAxisX` for a nested class, and the
+ *  constructor and destructor spelled as they are declared (`RefCountable::RefCountable`,
+ *  `System::~System`). Only the name: unlike `demangle` it reads no parameter code, so it answers
+ *  for the references, arrays and const qualifiers that one refuses. Null where `sym` is not a
+ *  mangled function, and for an operator, whose source name is not an identifier. */
+export function demangledName(sym: string): string | null {
+  for (let at = sym.indexOf('__', 1); at > 0; at = sym.indexOf('__', at + 1)) {
+    const name = sym.slice(0, at);
+    const rest = sym.slice(at + 2);
+    const qualified = /^[\dQ]/.test(rest) ? parseQualifier(rest) : { scopes: [], rest };
+    if (qualified === null || !/^C?F/.test(qualified.rest)) {
+      continue;
+    }
+    const { scopes } = qualified;
+    const cls = scopes.at(-1);
+    // every other special name — `__as`, `__nw`, `__pl` — is an operator
+    const member = name === '__ct' ? cls : name === '__dt' && cls !== undefined ? `~${cls}` : name;
+    if (member === undefined || member.startsWith('__')) {
+      return null;
+    }
+    return [...scopes, member].join('::');
+  }
+  return null;
+}
+
 /** Spell a CppType as C++ source (`Vec *`, `unsigned int`). */
 export function spellType(t: CppType): string {
   return t.base + (t.ptr ? ' ' + '*'.repeat(t.ptr) : '');

package/src/pattern/engine.ts

@@ -91,16 +91,30 @@ export interface RewritePattern {
    *  is one inhabitant. The direction was measured on ONE compiler, so `validatePattern` pins the
    *  declaring pattern's compiler gate to that set; widening it fails loud. */
   unsequencedRightFirst?: [string, string];
+  /** The compilers measured to RECOMPUTE this idiom instead of CSEing it back, when an interior op
+   *  of the match survives the fold because something outside still reads it. On one of these the
+   *  fold refuses that shape (`sharesInterior`, which carries the disassemblies); everywhere else
+   *  it is byte-neutral and refusing it costs matches, so the list is opt-in and per-compiler. A
+   *  compiler absent from it was either measured neutral or not measured — `validatePattern`
+   *  refuses a name that is not in `applies.compilers`, where the fold cannot fire anyway. */
+  recomputesSharedInterior?: string[];
+}
+
+/** What the pattern layer reads off a target. STRUCTURAL on purpose: the pattern set is
+ *  serializable data and does not import `target.ts`, so a `TargetDescription` satisfies this by
+ *  shape. It is the layer's ONE channel — `patternApplies` and `applyPattern` both take it, so a
+ *  caller that raises through the patterns cannot hand one of them a target and the other nothing. */
+export interface PatternTarget {
+  id: string;
+  compiler: string;
+  capabilities: { hwDivide: boolean; hwFloat: boolean };
 }
 
 /** Does this pattern apply to `target`? Every DECLARED field must match: the ISA (so an idiom can be
  *  pinned to one frontend), the compiler set (so an idiom fires only for the compilers that emit
  *  it — the reason MIPS+IDO and MIPS+GCC are distinguishable despite one frontend), and every
  *  declared capability. An omitted field is unconstrained. */
-export function patternApplies(
-  p: RewritePattern,
-  target: { id: string; compiler: string; capabilities: { hwDivide: boolean; hwFloat: boolean } },
-): boolean {
+export function patternApplies(p: RewritePattern, target: PatternTarget): boolean {
   if (p.applies.isa && p.applies.isa !== target.id) {
     return false;
   }
@@ -271,9 +285,27 @@ export const MUL_CONST_PATTERNS: RewritePattern[] = [MUL_SHIFT_ADD, MUL_SHIFT_SU
 // lsr/asr #24`). The naive lift prints `x << 24 >> 24` — but C's `>>` over the s32-typed value is
 // ARITHMETIC, so the UNSIGNED case recompiles with `asr` where the target has `lsr`: a miscompile
 // (tou8/zextb/tou16 nonmatch). Folding to a cast op both fixes that and reads correctly; recompiling
-// `(u8)x` reproduces `lsl;lsr`. Gated to agbcc: on IDO/GCC the zero-extend is `andi`/`and` (not a
-// shift pair) and `(u8)x` lowers to `andi` there — so this shift-pair shape is agbcc's alone, and the
-// fold must not touch the other compilers (where it would change `srl`↔`andi`). `k = 32 - w`.
+// `(u8)x` reproduces `lsl;lsr`. `k = 32 - w`.
+//
+// THE TWO SIGNEDNESSES ARE GATED SEPARATELY, because MIPS spells them differently and the pair of
+// gates is the measurement. Compiled at each row's own flags — IDO 7.1 `-mips2 -O2 -32 -non_shared
+// -G 0`, KMC gcc `-mips3 -O2`, gcc 2.7.2 `-mips3 -O1`:
+//
+//     (s8)x   sll v0,a0,0x18 ; sra v0,v0,0x18      (s16)x  sll 0x10 ; sra 0x10     all three
+//     (u8)x   andi v0,a0,0xff                                                      all three
+//
+// So the SIGN-extend is a shift pair on MIPS exactly as on agbcc, and folding it is byte-neutral
+// there: the fold changes the printed spelling from `x << 24 >> 24` to `(s8)x` and recompiles to
+// the same two instructions. The ZERO-extend is not — `andi` is not a shift pair, and folding an
+// IDO `srl` to a `zext` would re-spell it as `andi`, a miscompile. So `zextPat` is pinned to agbcc
+// alone, and the row that pin protects is `synthetic:zextb:ido7.1` — whose target IS that `andi`.
+//
+// mwcc/PowerPC is in NEITHER list: it has `extsb`/`extsh`, which the frontend lifts straight to
+// `sext`, so the shift-pair shape is not one it emits and no measurement licenses the fold there.
+/** The compilers measured to lower a SIGNED narrowing cast to a shift pair — see the pair of
+ *  disassemblies above. A compiler outside this list keeps the raw shifts. */
+export const SEXT_SHIFT_PAIR_COMPILERS = ['agbcc', 'ido', 'gcc'];
+
 const zextPat = (w: number, k: number): RewritePattern => ({
   id: `zext${w}`,
   applies: { compilers: ['agbcc'] },
@@ -282,7 +314,10 @@ const zextPat = (w: number, k: number): RewritePattern => ({
 });
 const sextPat = (w: number, k: number): RewritePattern => ({
   id: `sext${w}`,
-  applies: { compilers: ['agbcc'] },
+  applies: { compilers: SEXT_SHIFT_PAIR_COMPILERS },
+  // IDO alone emits the `sll` twice when the pair's own `sll` has a second reader; agbcc and both
+  // MIPS GCCs CSE it back, byte-identically. `sharesInterior` carries the three-spelling table.
+  recomputesSharedInterior: ['ido'],
   match: { op: 'shr_s', attrEquals: { imm: k }, args: [{ op: 'shl', attrEquals: { imm: k }, args: [{ bind: 'X' }] }] },
   replaceWith: { op: 'sext', args: ['X'], attrs: { width: w } },
 });
@@ -296,7 +331,8 @@ const sextPat = (w: number, k: number): RewritePattern => ({
  *  and never reaches the bitfield member recognizer (structure.ts, which matches the raw
  *  `shr(shl(load))` shape only). Honest output, not a miscompile — the field just keeps the cast
  *  spelling at those widths. Teaching the recognizer a zext/sext arm is the coverage extension if
- *  a row ever needs it. */
+ *  a row ever needs it. The SIGNED half of that shadow reaches MIPS too, where the symbol maps are:
+ *  measured over the whole corpus, no row's emitted C moves for it (`pnpm bench sweep`). */
 export const CAST_PATTERNS: RewritePattern[] = [zextPat(8, 24), zextPat(16, 16), sextPat(8, 24), sextPat(16, 16)];
 
 // ── boolean-negation idiom ───────────────────────────────────────────────────────────────────
@@ -408,6 +444,9 @@ const COMMUTATIVE = new Set(['add', 'mul', 'and', 'or', 'xor', 'icmp_eq', 'icmp_
 interface Binds {
   values: Map<string, Value>;
   imms: Map<string, number>;
+  /** Every value matched by an `op` node of the pattern, root included — the ops this rewrite is
+   *  about to REPLACE. `sharesInterior` below turns it into the fold's own legality condition. */
+  interior: Set<Value>;
 }
 
 function tryMatch(node: MatchNode, v: Value, defs: Map<Value, Op>, b: Binds): boolean {
@@ -430,6 +469,7 @@ function tryMatch(node: MatchNode, v: Value, defs: Map<Value, Op>, b: Binds): bo
   if (!d || d.opcode !== node.op) {
     return false;
   }
+  b.interior.add(v);
   if (node.attrEquals) {
     for (const [k, val] of Object.entries(node.attrEquals)) {
       if (d.attrs[k] !== val) {
@@ -459,7 +499,7 @@ function tryMatch(node: MatchNode, v: Value, defs: Map<Value, Op>, b: Binds): bo
       [0, 1],
       [1, 0],
     ] as const) {
-      const trial: Binds = { values: new Map(b.values), imms: new Map(b.imms) };
+      const trial: Binds = { values: new Map(b.values), imms: new Map(b.imms), interior: new Set(b.interior) };
       if (tryMatch(node.args[0], d.operands[i], defs, trial) && tryMatch(node.args[1], d.operands[j], defs, trial)) {
         for (const [k, val] of trial.values) {
           b.values.set(k, val);
@@ -467,6 +507,9 @@ function tryMatch(node: MatchNode, v: Value, defs: Map<Value, Op>, b: Binds): bo
         for (const [k, val] of trial.imms) {
           b.imms.set(k, val);
         }
+        for (const val of trial.interior) {
+          b.interior.add(val);
+        }
         return true;
       }
     }
@@ -523,6 +566,17 @@ function validatePattern(pat: RewritePattern): void {
       );
     }
   }
+  const recompiles = pat.recomputesSharedInterior;
+  if (recompiles?.length) {
+    const on = pat.applies.compilers;
+    const inert = on === undefined ? [] : recompiles.filter((c) => !on.includes(c));
+    if (inert.length) {
+      throw new Error(
+        `pattern '${pat.id}' names [${inert.join(', ')}] in 'recomputesSharedInterior' but does not apply to ` +
+          `${on === undefined ? 'them' : `[${on.join(', ')}]`} — the refusal could never fire, so the declaration is inert`,
+      );
+    }
+  }
   validated.add(pat);
 }
 
@@ -621,8 +675,66 @@ function reordersUnsequenced(
   return false;
 }
 
-/** Apply one pattern greedily to a fixed point. Returns the number of rewrites. */
-export function applyPattern(fn: Fn, pat: RewritePattern): number {
+/** Would this fold RECOMPUTE the idiom rather than re-spell it — leave an INTERIOR op standing
+ *  because something outside the match still reads it, while the replacement computes the same
+ *  thing again?
+ *
+ *  Every pattern here is licensed by a compiled pair showing that the replacement's C recompiles to
+ *  the SAME instructions. That pair is measured on the shape where the fold's interior ops DIE with
+ *  it — `dce` below removes exactly the ops nothing else reads. An interior op with a surviving
+ *  reader does not die, and whether the recompiling compiler then emits the work twice or CSEs it
+ *  back is a COMPILER fact, so it was compiled rather than reasoned. One function, three spellings,
+ *  each toolchain at its own canonical flags:
+ *
+ *      int r1(int x){ int y = x << 24; return (y >> 24) + y; }
+ *
+ *      ido7.1        raw `(a0 << 24 >> 24) + (a0 << 24)`   4 words   == the object of the C above
+ *                    folded `(s8)a0 + (a0 << 24)`          5 words   an extra `sll`
+ *      gcc2.7.2kmc   raw 4 words / folded 4 words, BYTE-IDENTICAL
+ *      gcc2.7.2      raw 4 words / folded 4 words, BYTE-IDENTICAL
+ *      agbcc         raw and folded identical (`lsl;asr;add`) — one `lsl` either way
+ *
+ *  So only IDO recomputes, and `recomputesSharedInterior` carries that list. On the other three the
+ *  fold stays byte-neutral in this shape and refusing it would COST: agbcc's `s16 i; i++` is one
+ *  `lsl #16` read by both the write-back's `lsr` and the comparison's `asr`, and a blanket refusal
+ *  measured `synthetic:{membnarrow,sibwalk}:agbcc` out of MATCH and `kleod:sub_0800A5B8:agbcc` from
+ *  173 to 179.
+ *
+ *  The ROOT is exempt and must be: `replaceAllUsesWith` brings its readers along, which is what
+ *  makes a fold a re-spelling at all. It is the interior — the operands the match walked THROUGH —
+ *  that this asks about. CONSTANTS REACH IT ASYMMETRICALLY, and both answers are the wanted ones:
+ *  a `constImm` node binds a literal and returns before the record, so a shared constant the
+ *  replacement re-spells as a literal never refuses a fold — nothing keeps a register alive for a
+ *  literal. An `{ op: 'const' }` node is walked like any other op and IS interior, so one the
+ *  replacement drops while another op still reads it counts as a survivor and refuses, which is the
+ *  conservative direction for a materialization the compiler may or may not rematerialize.
+ *
+ *  Refusing leaves the raw ops standing, which is the spelling that was byte-exact before any fold
+ *  existed — a worse-READING answer, never a worse-scoring one. */
+function sharesInterior(fn: Fn, root: Op, interior: Set<Value>, defs: Map<Value, Op>): boolean {
+  const matched = new Set([...interior].map((v) => defs.get(v)));
+  for (const b of fn.blocks) {
+    for (const o of b.ops) {
+      if (matched.has(o)) {
+        continue; // a read from INSIDE the idiom is one this rewrite is replacing
+      }
+      for (const v of [...o.operands, ...o.successors.flatMap((x) => x.args)]) {
+        if (v !== root.results[0] && interior.has(v)) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+
+/** Apply one pattern greedily to a fixed point. Returns the number of rewrites.
+ *
+ *  `target` is the same one `patternApplies` filtered with, REQUIRED because exactly one refusal
+ *  reads it (`recomputesSharedInterior`, whose answer is per-compiler). Both towers that fold —
+ *  `pipeline.ts` and `trace.ts` — must hand it over or the traced tower shows a fold `decompile()`
+ *  refuses; required, a caller that omits it is a type error rather than a wrong answer. */
+export function applyPattern(fn: Fn, pat: RewritePattern, target: PatternTarget): number {
   validatePattern(pat);
   let count = 0,
     changed = true;
@@ -635,10 +747,13 @@ export function applyPattern(fn: Fn, pat: RewritePattern): number {
         if (op.results.length !== 1) {
           continue;
         }
-        const binds: Binds = { values: new Map(), imms: new Map() };
+        const binds: Binds = { values: new Map(), imms: new Map(), interior: new Set() };
         if (!tryMatch(pat.match, op.results[0], defs, binds)) {
           continue;
         }
+        if (pat.recomputesSharedInterior?.includes(target.compiler) && sharesInterior(fn, op, binds.interior, defs)) {
+          continue;
+        }
         if (pat.unsequencedRightFirst && reordersUnsequenced(fn, op, pat.unsequencedRightFirst, binds, defs, pat.id)) {
           continue;
         }

package/src/pipeline.ts

@@ -21,6 +21,7 @@ import { LanguageBackend, SFn, gapReasonFor, walkExprs } from './l3/ast';
 import { BASECSE_GATES, hoistBaseLocals } from './l3/basecse';
 import { eliminateDeadStores } from './l3/dce';
 import { mergeCommonTails } from './l3/tailmerge';
+import { dropUnspelledReturns } from './l3/tailret';
 import { DEFAULT_IDIOM_PATTERNS, RewritePattern, applyPattern, dce, patternApplies } from './pattern/engine';
 import { type FnProto, type Prototypes, prototypesFromSymbols } from './proto';
 import { RaiseUnsupportedError } from './raise/errors';
@@ -212,7 +213,7 @@ export function applyIdiomPatterns(fn: Fn, target: TargetDescription, patterns?:
   const active = (patterns ?? DEFAULT_IDIOM_PATTERNS).filter((p) => patternApplies(p, target));
   let hits = 0;
   for (const p of active) {
-    hits += applyPattern(fn, p);
+    hits += applyPattern(fn, p, target);
   }
   if (active.length) {
     dce(fn);
@@ -348,6 +349,23 @@ function attributeOpaques<T>(fn: Fn, body: () => T): T {
   }
 }
 
+/** The committed readability/quality rewrites, in the order they are committed in: merge a
+ *  statement common to every arm of an if, drop the void returns the assembly did not spell, drop
+ *  dead stores (whose empty-then peephole flips the arm the merge empties), then hoist each leaf
+ *  base the DEFAULT gate table admits into a typed local pointer.
+ *
+ *  THE ORDER IS OBSERVABLE, not a preference: drop the returns before the merge and the same arms
+ *  become peelable, emptying both of them. `l3/tailret.ts` states the mechanism, and
+ *  `test/tailret.test.ts` pins the difference and which side of it this function is on.
+ *
+ *  `hoistBaseLocals`' two arguments are SPELLED, defaults or not: this is the one call to that pass
+ *  that is committed rather than offered, so it is the one whose gate table and whose placement can
+ *  cost a MATCH instead of a candidate (docs/level-tower.md). A committed policy that reads as
+ *  "whatever the default is" is the policy nobody reviews. */
+export function readabilityRewrites(raw: SFn): SFn {
+  return hoistBaseLocals(eliminateDeadStores(dropUnspelledReturns(mergeCommonTails(raw))), BASECSE_GATES, 'head');
+}
+
 /** Stage 4 — structure + its boundary contracts, always as a pair. */
 export function structureChecked(
   fn: Fn,
@@ -365,16 +383,9 @@ export function structureChecked(
   assertDerefsTyped(raw);
   assertLocalsWritten(raw);
   assertEffectsPreserved(fn, raw);
-  // Then the readability/quality rewrites: merge a statement common to every arm of an if,
-  // drop dead stores (whose empty-then peephole flips the arm the merge empties), then hoist each
-  // leaf base the DEFAULT gate table admits into a typed local pointer. The hoist moves the deref
-  // cast from each `index` node onto the local's initializer, so re-validate deref typing on the
-  // rewritten tree.
-  // Both arguments SPELLED, defaults or not: this is the one call to this pass that is committed
-  // rather than offered, so it is the one whose gate table and whose placement can cost a MATCH
-  // instead of a candidate (docs/level-tower.md). A committed policy that reads as "whatever the
-  // default is" is the policy nobody reviews.
-  const sfn = hoistBaseLocals(eliminateDeadStores(mergeCommonTails(raw)), BASECSE_GATES, 'head');
+  // The hoist moves the deref cast from each `index` node onto the local's initializer, so
+  // re-validate deref typing on the rewritten tree.
+  const sfn = readabilityRewrites(raw);
   assertDerefsTyped(sfn);
   // Re-checked after the readability rewrites for the same reason deref typing is: a pass that
   // merges arms or drops statements must not be able to lose or duplicate a call.

package/src/raise/extscale.ts

@@ -157,8 +157,11 @@ export function scaledExtensionOf(op: Op | undefined, defs: Map<Value, Op>): Sca
   return { src: inner.operands[0], width: 32 - l, signed: op.opcode === 'shr_s', shift: l - r, inner };
 }
 
-/** Does `target` lower a narrowing cast to a shift pair — the gate the fold shares with the cast
- *  idiom itself. */
+/** Does `target` lower BOTH narrowing casts to a shift pair? The conjunction is what the two
+ *  consumers need: a fused pair carries either signedness and this fold re-splits it without
+ *  knowing which. It is a stricter question than either cast pattern's own gate, because
+ *  `pattern/engine.ts` measures the halves separately — MIPS spells `(s8)x` as a shift pair and
+ *  `(u8)x` as `andi`, so every MIPS compiler answers `false` here while folding the signed half. */
 export const foldsShiftPairCasts = (target: TargetDescription): boolean =>
   CAST_PATTERNS.every((p) => patternApplies(p, target));
 

package/src/raise/paramwidth.ts

@@ -21,6 +21,76 @@
 // narrow parameter with the `extsb`/`extsh` the frontend lifts to the same op, and the synthetic
 // `sextb`/`tos8` rows keep matching on that toolchain through this pass.
 //
+// BUT THE PROLOGUE TEST IS NOT UNIVERSAL EVIDENCE, AND ON MIPS IT IS NO EVIDENCE AT ALL. Everything
+// above reads the extension's POSITION, which works only where the compiler puts a declaration's
+// extension somewhere a body cast's never goes. IDO 7.1 at -O2 does not: it leads the function with
+// the `sll` for BOTH spellings. Two OTHER facts separate them there, and it takes both — each one
+// alone is refuted by a compiled counterexample, at the row's own flags:
+//
+//                                             home store   widened in place
+//   int f(s8 x){ return x; }                      sw a0     sll a0,a0,0x18     the declaration
+//   int f(s32 x){ return (s8)x; }                   —       sll v0,a0,0x18     a body cast
+//   int f(int x){ x = (signed char)x; return x; }   —       sll a0,a0,0x18     NOT homed
+//   int f(long long x){ return (signed char)x; }  sw a1     sll v0,a1,0x18     NOT in place
+//
+// The last two lines are why the conjunction is the claim. A DEAD ABI ARGUMENT HOME STORE on its
+// own is not "declared narrow" — IDO emits one wherever the incoming register value goes unused,
+// whatever that value's type:
+//
+//   int unused1(int x){ return 7; }         sw a0,0(sp) / jr ra / li v0,7
+//   int ptr1(int *p, int y){ return y; }    sw a0,0(sp) / jr ra / move v0,a1
+//   int ll2i(long long x){ return (int)x; } sw a0,0(sp) / sw a1,4(sp) / jr ra / move v0,a1
+//   int used2(int x, int y){ return x+y; }  jr ra / addu v0,a0,a1        (no store at all)
+//
+// — so the store says the incoming register was not consumed, not that anything was declared
+// narrow, and on the `long long` line that is a 64-bit parameter whose low half the extension would
+// narrow to `s8`; `widened-elsewhere` is what refuses it. WIDENING IN PLACE on its own is not
+// "declared narrow" either: the third line is a plain `int` the source re-assigns, and only the
+// absent home store tells it from the first.
+//
+// The conjunction is NECESSARY-and-measured, not necessary-and-sufficient, and it errs toward
+// refusing: `int m2(signed char a){ int i,s=0; for(i=0;i<10;i++) s+=arr[i]+a; return s; }` is a
+// narrow declaration IDO widens into a SCRATCH register under register pressure (`sll a1,a0,0x18`),
+// so this pass leaves its parameter wide and re-spells the cast. That is a worse-reading answer,
+// not a wrong one.
+//
+// THE PAIR SAYS A NARROW DECLARATION EXISTS, NOT WHICH ONE. The WIDTH comes from the extension,
+// and where a wider mask sits on that extension's result the declaration could have been the wider
+// type — `int f(u16 x){ x = (signed char)x; return x; }` and `int f(s8 x){ return x & 0xffff; }`
+// are ONE object at the row's own flags (`sw a0,0(sp) / sll a0,a0,0x18 / sra a0,a0,0x18 / andi
+// v0,a0,0xffff`), so the asm decides nothing between them and this pass answers `s8`. Refusing on
+// that disagreement is not the repair, because the spelling a refusal falls back to is a DIFFERENT
+// object: `int f(int a){ return ((a << 24) >> 24) & 0xffff; }` is four words with no home store and
+// both shifts in `v0`, so the refusal would cost the byte match under BOTH readings. Where the
+// caller declares the parameter `proto-width` takes the tiebreak; where nobody does, the two
+// readings recompile alike and only a PROTOTYPED CALL SITE of this function could tell them apart.
+//
+// Ungated, this pass narrows the body cast too and loses `synthetic:tos8:ido7.1`, a MATCH. The two
+// MIPS GCCs are a third case again: their two spellings are one BYTE-IDENTICAL object, so nothing
+// in the asm decides the width and the honest answer is to leave the extension standing.
+//
+// So which fact settles the width is a per-COMPILER question, asked as
+// `compilerBehaviors.narrowParamWitness` and answered by `no-declaration-witness`, `unhomed-param`
+// and `widened-elsewhere` below. Both facts it reads are destroyed at lift and survive as the
+// frontend's `Fn.paramEvidence` (ir/core.ts).
+//
+// `not-prologue` STILL FIRES ON SUCH A TARGET, and it costs rather than protects there. IDO's
+// scheduler interleaves the widenings of several narrow parameters with the arithmetic that
+// consumes the earlier ones, and the scan below stops at the first value-reading op, so only the
+// LEADING parameters are seen as prologue:
+//
+//     int d4(s8 a, s8 b, s8 c){ return a+b+c; }   sll a1 / sll a0 / sll a2 / sra a0 / sra a1 /
+//                                                 addu t6,a0,a1 / sra a2 / addu v0,t6,a2
+//       recovered  s32 d4(s8 a0, s8 a1, s32 a2) { return a0 + a1 + (s8)a2; }
+//     int m3(s16 a, s16 b, s16 c, s16 d){ return a*b+c*d; }  all four widenings precede the first
+//       recovered  s32 m3(s16 a0, s16 a1, s16 a2, s16 a3)    multiply — all four narrow
+//
+// So the limit is the SCHEDULE's, not the declaration's, and the gate answers in the refusing
+// direction on the parameters it cuts off. Kept because it is the sound direction and because it is
+// the only gate that keeps a body cast behind real body code from being read as a prologue widening
+// on the position-witness targets; NO row on either tier is known to turn on the IDO half of it —
+// `d4` above is a probe, not a row, and lifting the scan is a change with its own measurement to make.
+//
 // WHAT THE PROLOGUE TEST CANNOT SEE, and why the declaration settles it. The scan steps over the
 // pure materializations agbcc interleaves among the extensions, so a constant the scheduler HOISTED
 // above a mid-body cast leaves `pb` looking like `pa`:
@@ -57,6 +127,7 @@ import { CAST_WIDTHS, MATERIALIZING_OPS } from '../ir/opcodes';
 import { T } from '../ir/types';
 import { type Gate, firstRejection } from '../l3/gates';
 import { type FnProto, declaredWidth } from '../proto';
+import type { NarrowParamWitness } from '../target';
 
 /** What the gates below judge: one entry parameter and the extension that reads it. */
 export interface NarrowParamCandidate {
@@ -75,6 +146,12 @@ export interface NarrowParamCandidate {
   /** the extension is one raise/extscale.ts re-split from a fused pair whose `shl` the machine ran
    *  behind a pool load — see FUSED BEHIND A POOL LOAD */
   fusedBehindPool: boolean;
+  /** what this compiler's object shows for a narrow declaration (target.ts `narrowParamWitness`) */
+  witness: NarrowParamWitness;
+  /** the machine stored this parameter to a stack slot nothing reads back (`ParamObservation`) */
+  homed: boolean;
+  /** the machine put the parameter's own widened value back in its argument register (`ParamObservation`) */
+  selfRedefined: boolean;
 }
 
 export const PARAM_WIDTH_GATES: readonly Gate<NarrowParamCandidate>[] = [
@@ -115,11 +192,34 @@ export const PARAM_WIDTH_GATES: readonly Gate<NarrowParamCandidate>[] = [
   },
   {
     id: 'not-prologue',
-    why: 'an extension behind body code is where the SOURCE wrote the cast',
+    why: 'an extension behind body code is where the SOURCE wrote the cast — and on a schedule that interleaves them, the refusing answer',
     sound: true,
     guardedBy: 'param-width.test.ts: an extension behind a nullary call is body code',
     rejects: (c) => !c.inPrologue,
   },
+  {
+    id: 'no-declaration-witness',
+    why: 'this compiler spells a narrow declaration and a body cast the same way, so the asm decides nothing',
+    sound: true,
+    guardedBy:
+      'param-width.test.ts: a compiler whose two spellings are one object refuses the narrowing, measured or not',
+    rejects: (c) => c.witness === 'none',
+  },
+  {
+    id: 'unhomed-param',
+    why: 'this compiler homes a narrow DECLARED parameter, so the absent home store proves the declaration was wide',
+    sound: true,
+    guardedBy: 'param-width.test.ts: a homing compiler refuses the parameter it did not home',
+    rejects: (c) => c.witness === 'home-store-and-in-place' && !c.homed,
+  },
+  {
+    id: 'widened-elsewhere',
+    why: 'this compiler widens a narrow DECLARED parameter in the argument register itself, so a widening that lands in a scratch register is not a declaration',
+    sound: true,
+    guardedBy:
+      'param-width.test.ts: \u2026and refuses one it homed but widened SOMEWHERE ELSE \u2014 that is a 64-bit half',
+    rejects: (c) => c.witness === 'home-store-and-in-place' && !c.selfRedefined,
+  },
   {
     id: 'fused-behind-pool',
     why: 'a fused cast behind a pool load is body code if unsigned, and either width is the same object if signed',
@@ -144,15 +244,20 @@ function useCount(fn: Fn, v: Value): number {
 }
 
 /** Type an entry parameter at the width its prologue extension proves, and drop the extension.
- *  `self` is the prototype the caller supplied for THIS function, if any; `fusedBehindPool` is
- *  raise/extscale.ts's record of the extensions it re-split behind a pool load
+ *  `witness` is what this compiler's object shows for a narrow declaration (target.ts
+ *  `narrowParamWitness`); `self` is the prototype the caller supplied for THIS function, if any;
+ *  `fusedBehindPool` is raise/extscale.ts's record of the extensions it re-split behind a pool load
  *  (`ScaleRecord.behindPool`). Returns the number of parameters narrowed. */
 export function narrowEntryParams(
   fn: Fn,
+  witness: NarrowParamWitness,
   self?: FnProto,
   gates: readonly Gate<NarrowParamCandidate>[] = PARAM_WIDTH_GATES,
   fusedBehindPool: ReadonlySet<Op> = new Set(),
 ): number {
+  // ABSENT ⇒ NEITHER OBSERVATION, which is the refusing direction on a target that reads them: a
+  // function nobody measured (parsed IR, a hand-built fn) is never narrowed on evidence never taken.
+  const evidence = fn.paramEvidence;
   const entry = fn.blocks[0];
   const declared = Array.isArray(self?.params) ? self.params.map(declaredWidth) : [];
   const entryIsJoin = fn.blocks.some((b) => successorsOf(b).includes(entry));
@@ -188,6 +293,9 @@ export function narrowEntryParams(
       uses: useCount(fn, p),
       declared: declared[entry.params.indexOf(p)],
       fusedBehindPool: fusedBehindPool.has(op),
+      witness,
+      homed: evidence?.get(p)?.deadHome ?? false,
+      selfRedefined: evidence?.get(p)?.selfRedefined ?? false,
     };
     if (firstRejection(gates, c) !== null) {
       continue;

package/src/raise/pre-recovery.ts

@@ -201,9 +201,19 @@ export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
       ),
     dce: false,
   },
+  // The `target` argument is read by TWO of this pass's gates, and unlike `narrowlocal`'s single
+  // conjunct it is not a tuning knob: `narrowParamWitness` says WHICH fact in the object settles a
+  // parameter's declared width on this compiler, and a target that names none refuses outright.
   {
     id: 'paramwidth',
-    run: (fn, self, _opts, _target, lifted) => narrowEntryParams(fn, self, PARAM_WIDTH_GATES, lifted.scales.behindPool),
+    run: (fn, self, _opts, target, lifted) =>
+      narrowEntryParams(
+        fn,
+        target.compilerBehaviors.narrowParamWitness ?? 'none',
+        self,
+        PARAM_WIDTH_GATES,
+        lifted.scales.behindPool,
+      ),
     dce: false,
   },
   // LAST, after every pass that can CLAIM what `extscale` exposed — the two width passes above take