@asmlift/core 0.8.0 → 0.9.0

package/src/l3/address.ts

@@ -33,6 +33,11 @@ export const baseConst = (e: Expr): number | null =>
       ? baseConst(e.e)
       : null;
 
+/** Does this base already assert volatility — a `volatile` cast at any depth of the cast chain? A
+ *  respell variation that replaces such a base drops the qualifier with it, and every access
+ *  through it becomes a plain one agbcc may delete or hoist. */
+export const qualifiedBase = (e: Expr): boolean => e.k === 'cast' && (e.volatile === true || qualifiedBase(e.e));
+
 /** the numeric address an expression IS, through any number of pointer casts */
 export const addrConst = (e: Expr): number | null =>
   e.k === 'const' ? e.value : e.k === 'cast' && e.to.kind === 'ptr' ? addrConst(e.e) : null;

package/src/l3/argcopy.ts

@@ -101,9 +101,12 @@ export interface ArgCopyRegionCtx {
   readonly reads: number;
   /** a loop encloses the region — its own body, or any list nested below one */
   readonly underLoop: boolean;
+  /** the region is ONE basic block: no statement opens a nested list, and no expression holds a
+   *  short-circuit connective */
+  readonly straightLine: boolean;
 }
 
-/** Which regions are worth offering. NEITHER is sound — each refuses a spelling that is correct
+/** Which regions are worth offering. NONE is sound — each refuses a spelling that is correct
  *  but models nothing, and what they buy is the candidate count: every one of these is a COMPILE,
  *  and this variation multiplies with `/coalesce`. */
 export const ARGCOPY_REGION_GATES: readonly Gate<ArgCopyRegionCtx>[] = [
@@ -117,13 +120,37 @@ export const ARGCOPY_REGION_GATES: readonly Gate<ArgCopyRegionCtx>[] = [
     id: 'loop-region',
     why: 'a copy anywhere inside a loop re-runs every iteration, so it belongs to a region that holds the loop instead — and no region does when the loop is at function top level, where this variation offers nothing at all',
     sound: false,
-    // the second clause has its own test, which `guardedBy` cannot also name (one title per gate):
-    // `argcopy.test.ts: a TOP-LEVEL loop is offered NOTHING`
-    guardedBy: 'argcopy.test.ts: an arm NESTED inside a loop body is refused too',
+    guardedBy: [
+      'argcopy.test.ts: an arm NESTED inside a loop body is refused too',
+      'argcopy.test.ts: a TOP-LEVEL loop is offered NOTHING',
+    ],
     rejects: (c) => c.underLoop,
   },
+  {
+    id: 'straight-line',
+    why: 'a copy whose every read sits in one basic block is forward-propagated away by every compiler in the matrix, so the copy is erased — a `&&` or `||` in the region is an edge the copy can live across, and such a region is offered',
+    sound: false,
+    guardedBy: 'argcopy.test.ts: a STRAIGHT-LINE region is refused',
+    rejects: (c) => c.straightLine,
+  },
 ];
 
+/** Whether `list` is one basic block. A nested list is a branch or a loop; a short-circuit
+ *  connective is a branch too — `p[3] = p[0] > v && p[4] < v` is two blocks, and agbcc keeps a
+ *  copy live across that edge (the synthetic `leafand` row matches only through it). `walkExprs` for the
+ *  reason `countReads` gives: it is the walk `repoint` rewrites by. */
+function isStraightLine(list: Stmt[]): boolean {
+  if (list.some((st) => stmtLists(st).length > 0)) {
+    return false;
+  }
+  for (const e of walkExprs(list)) {
+    if (e.k === 'bin' && (e.op === '&&' || e.op === '||')) {
+      return false;
+    }
+  }
+  return true;
+}
+
 /** How many `var n` leaves the region holds, nested statements included — the region rules'
  *  yardstick for whether a copy has a range to shorten.
  *
@@ -176,7 +203,8 @@ function regions(body: Stmt[]): { at: number[]; list: Stmt[]; underLoop: boolean
  *  for > do-while > if > store). This runs once per region per parameter per candidate, and each
  *  candidate is a compile. */
 function repoint(list: Stmt[], n: string, to: string): Stmt[] {
-  const inExpr = (e: Expr): Expr => (e.k === 'var' && e.name === n ? { ...e, name: to } : mapExprChildren(e, inExpr));
+  const inExpr = (e: Expr): Expr =>
+    (e.k === 'var' || e.k === 'postincr') && e.name === n ? { ...e, name: to } : mapExprChildren(e, inExpr);
   return list.map((s) => mapStmtExprs(s, inExpr));
 }
 
@@ -238,7 +266,11 @@ export function argCopyUnder(
       if (reads === 0) {
         continue;
       }
-      const regionRefused = firstRejection(regionGates, { reads, underLoop: r.underLoop });
+      const regionRefused = firstRejection(regionGates, {
+        reads,
+        underLoop: r.underLoop,
+        straightLine: isStraightLine(r.list),
+      });
       if (regionRefused !== null) {
         refusals.set(regionRefused, (refusals.get(regionRefused) ?? 0) + 1);
         continue;

package/src/l3/ast.ts

@@ -6,8 +6,28 @@ import { type IrType, typeEquals } from '../ir/types';
 export type Expr =
   | { k: 'var'; name: string }
   | { k: 'const'; value: number }
+  // A `double` literal, carried as its IEEE bit pattern (ir/float-bits.ts) — a kind apart from the
+  // integer `const`, so no integer fold, range test or signedness reading ever takes it for one.
+  | { k: 'fconst'; bits: string }
   | { k: 'bin'; op: BinOp; l: Expr; r: Expr }
-  | { k: 'un'; op: '-' | '~' | '!'; e: Expr }
+  | { k: 'un'; op: '-' | '~' | '!' | 'f-'; e: Expr }
+  // A post-increment `name++` (`by` 1) or post-decrement `name--` (`by` -1): the value the local
+  // held BEFORE the update, with the update as a side effect. The only expression form here that
+  // WRITES anything, so `exprHasEffect` answers for it alongside `call` and `marker` — that is what
+  // every pass asking "may I move or duplicate this" already consults. It also NAMES a local, so
+  // `mentionedName` answers for it beside `var` and `addr`, and the two walks that classify their
+  // own leaves — `l3/mentions.ts` and `contracts.ts`'s `assertLocalsWritten` — count it on both
+  // sides, because `v++` reads the name and writes it.
+  //
+  // The target is a NAME rather than an Expr because its one producer has one: structure.ts's
+  // `emitDoWhile`, folding a loop update into a bottom test that reads the variable at its
+  // pre-update value (`while (v0 != 0 && v1++ <= 9)`). A general lvalue has no inhabitant.
+  //
+  // WHERE IT MAY STAND IS THE PRODUCER'S OBLIGATION, not a property of the node: C89 leaves the
+  // program undefined when the same object is also read elsewhere between two sequence points, and
+  // short-circuit operators decide whether the update happens at all. `PREUPDATE_COND_GATES`
+  // (structure/hazards.ts) holds both rules for the one producer.
+  | { k: 'postincr'; name: string; by: 1 | -1 }
   // A C-style value cast `(T)e`. Tree-level producers: a width-narrowing cast `(u8)e` (the
   // recovered form of a byte/half extend idiom — zext/sext IR ops), the STRUCT-pointer cast
   // (structure.ts memAccess/arrayAccess struct paths — see the note on `field` below), and the
@@ -22,12 +42,42 @@ export type Expr =
   // cv-qualifier, deliberately: volatility is a SPELLING, carried at the declaration or the
   // cast, the same split SFn.locals makes for `volatile`/`pointeeVolatile`.
   | { k: 'cast'; to: IrType; e: Expr; volatile?: true }
-  | { k: 'call'; fn: string; args: Expr[] }
+  // A call. `wide64` is the INTEGER RANK the callee's return renders with, and it is carried on the
+  // node because nothing downstream can derive it: a callee's return type comes from a prototype
+  // outside the emitted function, so `exprCType` answers `undefined` for a call and every reader of
+  // the rendered rank would otherwise read C's implicit `int`.
+  //
+  // IT IS TRUE OF THE C THAT IS COMPILED BECAUSE THE SOURCES AGREE, and that agreement is a
+  // property of one lookup rather than of two modules happening to match. The width is set where
+  // the frontend was TOLD it — a compiler's own runtime-helper signature, whose callee the
+  // candidate never declares because the helper table IS the declaration, or a project's
+  // `FnProto.returns`, which `proto.ts` `spellableProto` admits only when the same entry can be
+  // PRINTED as the callee's own prototype. `prototypesFromSymbols` resolves that table once, so
+  // the frontend that stamps this and the collector that prints the declaration read one answer.
+  // The filters in `rank-declare.ts` can still withhold a printed declaration (a name the emitted
+  // C uses for its own storage, a non-identifier, a reserved name) — every one of them kills the
+  // SPELLING or the whole row rather than leaving this stamp standing over an implicitly-`int`
+  // callee.
+  //
+  // `sret` is the type of a struct the callee returns BY VALUE through memory. `args[0]` is then the
+  // hidden pointer the frontend read from the first argument register — the address of the struct
+  // the call fills — and the rest are the declared arguments. The only C spelling is a statement,
+  // `dest = fn(rest)`, so such a call stands alone.
+  //
+  // `fn` is the callee's NAME, or for an indirect call the EXPRESSION whose value is the address
+  // called (ir/core.ts `calleeValue`) — a child of the node like its arguments, listed first in
+  // `exprChildren`. That is no evaluation order: C leaves it unspecified, and agbcc loads the callee
+  // after the arguments.
+  | { k: 'call'; fn: string | Expr; args: Expr[]; wide64?: true; sret?: IrType }
   // The ADDRESS of a named global, `&gSym` (agbcc pool `.word gSym`, frontend `gaddr` op). A
   // DEREF of it collapses to the bare global: memAccess/arrayAccess spell `*(&gSym)` as `gSym`
   // and `(&gSym)[i]` as `gSym[i]` (a global name decays to a pointer). Only a genuinely
   // address-TAKEN global (passed by address, `&gSym` as a call arg) prints the `&` form. The
   // global's type comes from the project headers, so it is never declared as a local.
+  //
+  // An ARRAY's address is spelled by the bare name, and that is a fact of C's declarator grammar
+  // rather than of the address — so the C printer decides it from the name's declared type, and
+  // this node carries nothing about it (backend/cfamily.ts, `case 'addr'`).
   | { k: 'addr'; name: string }
   // A memory access `base[idx]` (printed `*base` when idx is the constant 0), CARRYING the
   // access's element width (bytes) and signedness. `idx` counts elements of `width` bytes.
@@ -184,7 +234,19 @@ export type Expr =
 // which side a compare was spelled from genuinely underdetermines — a signed spelling that
 // byte-matched was proved non-negative by the compiler — so it is refereed as a variation, while a
 // division helper is a pure function of the expression's C type with no such proof available.
+//
+// THE FLOAT OPERATORS (`f+` `f-` `f*` `f/`) are the third split, and they are earned by what an
+// integer operator MEANS to the passes that read one rather than by a spelling: C writes both with
+// the same token, but `/` here is the SIGNED divide the C-family backend pins with `(s32)` casts,
+// and `+`/`-` are the pointer walks, reassociations and constant folds of a dozen L3 passes. A float
+// under any of those is a wrong program, so it gets operators none of them match — the same reason
+// the IR has `fadd` rather than a float-typed `add`. The unary minus splits the same way (`f-` on
+// `un`).
 export type BinOp =
+  | 'f+'
+  | 'f-'
+  | 'f*'
+  | 'f/'
   | '+'
   | '-'
   | '*'
@@ -342,6 +404,10 @@ export interface SFn {
    *  legalization env (exprCType) but NEVER declared by a backend: the project's own headers
    *  declare them, exactly like every other global name asmlift emits. */
   globals?: { name: string; type: IrType }[];
+  /** The function-scope statics this function DEFINES (structure/local-statics.ts), declared at
+   *  the top of its body ahead of the locals. Unlike `globals`, the backend declares these: no
+   *  header does, because the source defined them here. */
+  statics?: SStatic[];
   retType: IrType;
   body: Stmt[];
   /** Struct types this function's fields reference, declared above it by the backend. Empty
@@ -359,6 +425,30 @@ export interface SFn {
    *  `TargetDescription.compilerBehaviors`. ABSENT means the direction is unknown for this target
    *  and `l3/slotorder.ts` is the identity — never "ascending by default". */
   slotOrder?: 'ascending' | 'descending';
+  /** Each declared callee's parameter types (an entry the printer cannot spell is `undefined`):
+   *  what an argument converts to. Read by the C-family printer where `dialect` says C++, which
+   *  refuses three conversions C makes implicitly (backend/cfamily.ts `argConversion`), and by the
+   *  pointer-cell conversions in every dialect (l3/ptrcell.ts). */
+  declaredArgs?: Readonly<Record<string, readonly (string | undefined)[]>>;
+  /** Each declared callee's return type as the project spells it, never printed: whether a call a
+   *  pointer cell is compared with returns a pointer (l3/ptrcell.ts). */
+  declaredReturns?: Readonly<Record<string, string>>;
+  /** The emitted C is compiled AS C++. An emission policy like `slotOrder`. */
+  dialect?: 'c++';
+}
+
+/** One function-scope static's definition: `static [const] T name[count] = { init };`. `init` is
+ *  the initial elements in order, absent for a static with no initializer (the target's bss).
+ *  `align` is an alignment in bytes wider than the type's own, which the definition must state. */
+export interface SStatic {
+  name: string;
+  type: IrType;
+  const?: true;
+  align?: number;
+  init?: number[];
+  /** the initializer is spelled as a string literal — a byte array the compiler aligns as a
+   *  string (structure/local-statics.ts) */
+  string?: true;
 }
 
 /** A struct declaration surfaced to the backend (name + field list). Mirrors the IR struct
@@ -427,6 +517,8 @@ export function exprEquals(a: Expr, b: Expr): boolean {
       return a.name === (b as typeof a).name;
     case 'const':
       return a.value === (b as typeof a).value;
+    case 'fconst':
+      return a.bits === (b as typeof a).bits;
     case 'bin': {
       const bb = b as typeof a;
       return a.op === bb.op && exprEquals(a.l, bb.l) && exprEquals(a.r, bb.r);
@@ -435,6 +527,10 @@ export function exprEquals(a: Expr, b: Expr): boolean {
       const bb = b as typeof a;
       return a.op === bb.op && exprEquals(a.e, bb.e);
     }
+    case 'postincr': {
+      const bb = b as typeof a;
+      return a.name === bb.name && a.by === bb.by;
+    }
     case 'cast': {
       const bb = b as typeof a;
       // `volatile` is part of the SPELLING, compared for the same reason `lead` and `dot` are: a
@@ -448,7 +544,25 @@ export function exprEquals(a: Expr, b: Expr): boolean {
     }
     case 'call': {
       const bb = b as typeof a;
-      return a.fn === bb.fn && a.args.length === bb.args.length && a.args.every((x, i) => exprEquals(x, bb.args[i]));
+      // `wide64` is part of the node's IDENTITY, compared for the same reason `volatile` is one
+      // cast up: it decides the rank every operand pin is taken at, so two calls that differ in it
+      // are two different expressions and a dedup that kept one would respell the other's
+      // arithmetic.
+      //
+      // NO PIPELINE INPUT REACHES THIS TERM TODAY, and saying so is cheaper than a witness that
+      // cannot exist: the stamp is a pure function of the callee name (`structure.ts` reads the
+      // call result's IR width, which the frontend set from the callee's declared return), so two
+      // `call` nodes sharing `fn` and `args` always share `wide64` and deleting the term leaves
+      // the whole core suite green. What pins it is a direct test of THIS function's contract in
+      // test/int64-repr.test.ts, over two nodes built by hand — which is the honest bar, because
+      // the claim being made is about `exprEquals` and not about a path through the pipeline.
+      return (
+        (typeof a.fn === 'string' || typeof bb.fn === 'string' ? a.fn === bb.fn : exprEquals(a.fn, bb.fn)) &&
+        (a.wide64 ?? false) === (bb.wide64 ?? false) &&
+        (a.sret === undefined ? bb.sret === undefined : bb.sret !== undefined && typeEquals(a.sret, bb.sret)) &&
+        a.args.length === bb.args.length &&
+        a.args.every((x, i) => exprEquals(x, bb.args[i]))
+      );
     }
     case 'index': {
       const bb = b as typeof a;
@@ -493,12 +607,49 @@ export function exprEquals(a: Expr, b: Expr): boolean {
   }
 }
 
-/** THE spelling of an unmodelled instruction's gap reason, in one place: `structure.ts` writes it
- *  into the marker, `contracts.ts` matches on it to prove the gap was not dropped, and the benchmark
+/** Do two statements print the same C? The leaf statements compare through {@link exprEquals},
+ *  and an `if` arm by arm; every other kind answers no, which can only keep apart two statements a
+ *  caller might have merged. */
+export function stmtEquals(a: Stmt, b: Stmt): boolean {
+  switch (a.k) {
+    case 'assign':
+      return b.k === 'assign' && a.name === b.name && exprEquals(a.value, b.value);
+    case 'store':
+      return b.k === 'store' && exprEquals(a.lval, b.lval) && exprEquals(a.value, b.value);
+    case 'exprstmt':
+      return b.k === 'exprstmt' && exprEquals(a.value, b.value);
+    case 'return':
+      return (
+        b.k === 'return' &&
+        (a.unspelled ?? false) === (b.unspelled ?? false) &&
+        (a.value === undefined ? b.value === undefined : b.value !== undefined && exprEquals(a.value, b.value))
+      );
+    case 'if':
+      return b.k === 'if' && exprEquals(a.cond, b.cond) && stmtsEqual(a.then, b.then) && stmtsEqual(a.else, b.else);
+    default:
+      return false;
+  }
+}
+
+/** {@link stmtEquals} over two lists, in order. */
+export function stmtsEqual(a: readonly Stmt[], b: readonly Stmt[]): boolean {
+  return a.length === b.length && a.every((s, i) => stmtEquals(s, b[i]));
+}
+
+/** THE spelling of an `opaque`'s gap reason, in one place: `structure.ts` writes it into the
+ *  marker, `contracts.ts` matches on it to prove the gap was not dropped, and the benchmark
  *  classifies declines by it. Two spellings make that contract silently vacuous — enforced-looking
- *  and never firing. `?` when a frontend stamps no mnemonic. */
-export function gapReasonFor(mnemonic: unknown): string {
-  return `unmodelled instruction '${typeof mnemonic === 'string' ? mnemonic : '?'}'`;
+ *  and never firing, since it is an EQUALITY between what the IR carries and what the output shows.
+ *
+ *  TWO PRODUCERS, TWO SENTENCES, and they name different capabilities: an INSTRUCTION no frontend
+ *  decodes (`adc`), and a call into the compiler's own RUNTIME that no recogniser folded
+ *  (`__div2i`). The attrs decide which, so a producer chooses by what it stamps rather than by
+ *  spelling a string. `?` when a frontend stamps neither. */
+export function gapReasonFor(attrs: { mnemonic?: unknown; helper?: unknown }): string {
+  if (typeof attrs.helper === 'string') {
+    return `no model for the runtime helper '${attrs.helper}'`;
+  }
+  return `unmodelled instruction '${typeof attrs.mnemonic === 'string' ? attrs.mnemonic : '?'}'`;
 }
 
 // ── the ONE traversal vocabulary ───────────────────────────────────────────────────────────────
@@ -513,7 +664,9 @@ export function exprChildren(e: Expr): Expr[] {
   switch (e.k) {
     case 'var':
     case 'const':
+    case 'fconst':
     case 'addr':
+    case 'postincr':
       return [];
     case 'bin':
       return [e.l, e.r];
@@ -521,7 +674,7 @@ export function exprChildren(e: Expr): Expr[] {
     case 'cast':
       return [e.e];
     case 'call':
-      return e.args;
+      return typeof e.fn === 'string' ? e.args : [e.fn, ...e.args];
     case 'index':
       return [e.base, ...(e.lead ?? []), e.idx];
     case 'field':
@@ -536,7 +689,9 @@ export function mapExprChildren(e: Expr, f: (c: Expr) => Expr): Expr {
   switch (e.k) {
     case 'var':
     case 'const':
+    case 'fconst':
     case 'addr':
+    case 'postincr':
       return e;
     case 'bin':
       return { ...e, l: f(e.l), r: f(e.r) };
@@ -544,7 +699,7 @@ export function mapExprChildren(e: Expr, f: (c: Expr) => Expr): Expr {
     case 'cast':
       return { ...e, e: f(e.e) };
     case 'call':
-      return { ...e, args: e.args.map(f) };
+      return { ...e, ...(typeof e.fn === 'string' ? {} : { fn: f(e.fn) }), args: e.args.map(f) };
     case 'index':
       return { ...e, base: f(e.base), ...(e.lead ? { lead: e.lead.map(f) } : {}), idx: f(e.idx) };
     case 'field':
@@ -654,7 +809,7 @@ export function rematerializableAddress(e: Expr): boolean {
       case 'un':
         break;
       default:
-        ok = false; // var, addr, index, field, call, marker
+        ok = false; // var, addr, postincr, index, field, call, marker
         return;
     }
     for (const c of exprChildren(x)) {
@@ -665,10 +820,27 @@ export function rematerializableAddress(e: Expr): boolean {
   return ok && nonZero;
 }
 
-/** Whether the tree contains a node with an EFFECT no re-ordering may move: a call, or a marker
- *  standing in for an unmodelled instruction (annotate mode). */
+/** The local or global a node NAMES, or undefined for one that names none — the whole Expr
+ *  vocabulary a "which names does this tree mention" walk has to know about, in one place, because
+ *  a collector that misses a kind reports a SHORT live range and a short range is a clobber where a
+ *  long one is only a missed merge.
+ *
+ *  `call`'s `fn` is not one of them: it names a function, and the walks that care about that ask
+ *  for it beside this (l3/hoist.ts). A walk that must tell the kinds APART — `&v` is a write where
+ *  a bare `v` is a read — keeps its own arms; this answers the name, not what is done to it. */
+export function mentionedName(e: Expr): string | undefined {
+  return e.k === 'var' || e.k === 'addr' || e.k === 'postincr' ? e.name : undefined;
+}
+
+/** The callee a call names, or undefined for an indirect one. */
+export function calleeOf(e: Extract<Expr, { k: 'call' }>): string | undefined {
+  return typeof e.fn === 'string' ? e.fn : undefined;
+}
+
+/** Whether the tree contains a node with an EFFECT no re-ordering may move: a call, a marker
+ *  standing in for an unmodelled instruction (annotate mode), or a post-increment's write. */
 export function exprHasEffect(e: Expr): boolean {
-  return e.k === 'call' || e.k === 'marker' || exprChildren(e).some(exprHasEffect);
+  return e.k === 'call' || e.k === 'marker' || e.k === 'postincr' || exprChildren(e).some(exprHasEffect);
 }
 
 /** Whether the tree performs an access to a `volatile` object — the OTHER thing no re-ordering may

package/src/l3/coalesce.ts

@@ -12,23 +12,24 @@
 // and whether fall-through joins the two arms onto one path. `coalesceCandidates` offers both.
 import { typeToString } from '../ir/types';
 import type { Expr, SFn, Stmt } from './ast';
-import { exprChildren, isLoop, mapExprChildren, stmtChildren, stmtExprs } from './ast';
+import { exprChildren, isLoop, mapExprChildren, mentionedName, stmtChildren, stmtExprs } from './ast';
 import { type Gate, firstRejection } from './gates';
 
 function namesIn(e: Expr, out: Set<string>): void {
-  // `addr` names a GLOBAL (`&gSym`) or a LOCAL — the structurer renders an `laddr` frame object
-  // as `&sp0`, an addr node over a name that IS in `sfn.locals`. Both are collected, because a
-  // name mentioned only through `&` still has a live range: a span that ignored its `addr`
-  // mentions would be SHORT, and a short span is a clobber where a long one is only a missed
-  // merge. Collecting a global name costs nothing — it is not in `sfn.locals`, so no pair is
-  // ever built for it.
+  // EVERY mention, through `mentionedName`'s vocabulary rather than this file's own: a span that
+  // misses one is SHORT, and a short span is a clobber where a long one is only a missed merge.
+  // `&sp0` is a LOCAL's mention — the structurer renders an `laddr` frame object as an addr node
+  // over a name that IS in `sfn.locals` — and `n++` in a bottom test is a counter's only mention
+  // inside its own loop. A global name comes along for the ride and costs nothing — it is not in
+  // `sfn.locals`, so no pair is ever built for it.
   //
-  // `rename` DISAGREES WITH THIS, and knowingly: it rewrites only `var` leaves, so a local
-  // absorbed while mentioned through `&` leaves that mention standing against a declaration the
-  // merge deleted. Reconciling the two changes which candidates compile — a measured change, not a
+  // `rename` DISAGREES WITH THIS, and knowingly: it rewrites `var` and `postincr` leaves, so a
+  // local absorbed while mentioned through `&` leaves that mention standing against a declaration
+  // the merge deleted. Reconciling the two changes which candidates compile — a measured change, not a
   // cleanup — so today's behaviour is pinned exactly in coalesce.test.ts ('rename') rather than
   // repaired here.
-  if (e.k === 'var' || e.k === 'addr') out.add(e.name);
+  const n = mentionedName(e);
+  if (n !== undefined) out.add(n);
   for (const c of exprChildren(e)) namesIn(c, out);
 }
 
@@ -62,7 +63,14 @@ export interface Span {
  *  arithmetic over the variable is its own history. The read must be a `var`: `mentions` counts an
  *  `addr` too, and `&a` is not a read of `a`. */
 const readsVarArithmetically = (e: Expr, n: string): boolean => {
-  if (e.k === 'index' || e.k === 'field' || e.k === 'call' || e.k === 'marker' || e.k === 'addr') {
+  if (
+    e.k === 'index' ||
+    e.k === 'field' ||
+    e.k === 'call' ||
+    e.k === 'marker' ||
+    e.k === 'postincr' ||
+    e.k === 'addr'
+  ) {
     return false;
   }
   return (e.k === 'var' && e.name === n) || exprChildren(e).some((c) => readsVarArithmetically(c, n));
@@ -155,7 +163,7 @@ function spans(body: Stmt[]): Map<string, Span> {
 }
 function rename(body: Stmt[], from: string, to: string): Stmt[] {
   const inExpr = (e: Expr): Expr =>
-    e.k === 'var' && e.name === from ? { ...e, name: to } : mapExprChildren(e, inExpr);
+    (e.k === 'var' || e.k === 'postincr') && e.name === from ? { ...e, name: to } : mapExprChildren(e, inExpr);
   const inStmt = (s: Stmt): Stmt => {
     const r = { ...s } as Record<string, unknown>;
     if (s.k === 'assign' && s.name === from) r.name = to;

package/src/l3/dce.ts

@@ -29,9 +29,11 @@ import { exprChildren, negateCond, stmtChildren, stmtExprs } from './ast';
 
 /** Accumulate every LOCAL-eligible `var` name read anywhere in `e` (recurses all sub-exprs). An
  *  `addr` name counts too: taking a local's address makes every store to it observable through the
- *  escaped pointer, so an address-taken local is never dead here. */
+ *  escaped pointer, so an address-taken local is never dead here. A `postincr` reads its name
+ *  before it writes it, so it pins the store that reaches it — `n++` in a loop test is the only
+ *  reader of the `n = 0` above the loop. */
 function readsInto(e: Expr, out: Set<string>): void {
-  if (e.k === 'var' || e.k === 'addr') {
+  if (e.k === 'var' || e.k === 'addr' || e.k === 'postincr') {
     out.add(e.name);
   }
   for (const c of exprChildren(e)) {
@@ -48,6 +50,7 @@ function reads(e: Expr): Set<string> {
 /** True if `e` carries any reason NOT to speculatively delete its assignment/condition:
  *   - `call` — may write memory/globals (a side effect);
  *   - `marker` — the annotate-mode ASMLIFT_ERROR gap signal, which must survive so the gap stays loud;
+ *   - `postincr` — its write is the loop update; deleting the assignment would delete the update;
  *   - the strict-mode `?` unresolved sentinel (`{k:'var', name:'?'}`) — dropping it would let a
  *     value asmlift could NOT lift slip past `assertResolved`, silently downgrading a loud gap;
  *   - a memory load (`index`/`field`) — a deref's volatility is unknowable here, so a possibly-effectful read
@@ -56,7 +59,7 @@ function reads(e: Expr): Set<string> {
  *     observable access the machine performed; deleting the dead assignment would delete the read.
  *  A dead assignment whose value contains any of these is kept. */
 function mustKeep(e: Expr, volatiles: ReadonlySet<string>): boolean {
-  if (e.k === 'call' || e.k === 'marker' || e.k === 'index' || e.k === 'field') {
+  if (e.k === 'call' || e.k === 'marker' || e.k === 'postincr' || e.k === 'index' || e.k === 'field') {
     return true;
   }
   if (e.k === 'var' && (e.name === '?' || volatiles.has(e.name))) {
@@ -95,6 +98,16 @@ function allAddrNamesInto(stmts: Stmt[], out: Set<string>): void {
   }
 }
 
+/** Where a `break` and a `continue` at this depth land, as the set live there. A jump does not fall
+ *  through to the statement after it: the live set at a jump is its TARGET's, not what the rest of
+ *  the enclosing block reads. `break` targets the innermost loop or switch, `continue` the innermost
+ *  loop; each is that statement's conservative in-scope set (everything read anywhere in it plus
+ *  what is live after it), which also covers the loop's own next test and update. */
+interface JumpLive {
+  brk: ReadonlySet<string>;
+  cont?: ReadonlySet<string>; // absent in a switch no loop encloses
+}
+
 /** Backward live-variable walk over one block. `liveOut` is the set of locals live on exit;
  *  returns the rewritten block and the set live on entry. */
 function dceBlock(
@@ -102,6 +115,7 @@ function dceBlock(
   liveOut: ReadonlySet<string>,
   locals: ReadonlySet<string>,
   volatiles: ReadonlySet<string>,
+  jumps: JumpLive | null,
 ): { out: Stmt[]; liveIn: Set<string> } {
   const live = new Set(liveOut);
   const rev: Stmt[] = [];
@@ -153,12 +167,19 @@ function dceBlock(
       }
       case 'break':
       case 'continue': {
+        // A mid-body `if (c) { v = x; break; }` carries the loop's exit value in `v`, while the
+        // statements after the `if` overwrite `v` for the next iteration. Leaving `live` as the
+        // fall-through set would judge the carried copy dead and drop it.
+        const target = s.k === 'break' ? jumps?.brk : jumps?.cont;
+        if (target) {
+          setLive(new Set(target));
+        }
         rev.push(s);
         break;
       }
       case 'if': {
-        const t = dceBlock(s.then, live, locals, volatiles);
-        const e = dceBlock(s.else, live, locals, volatiles);
+        const t = dceBlock(s.then, live, locals, volatiles, jumps);
+        const e = dceBlock(s.else, live, locals, volatiles, jumps);
         const nlive = new Set<string>();
         for (const r of reads(s.cond)) {
           nlive.add(r);
@@ -188,7 +209,7 @@ function dceBlock(
         // loop-carried store is never cut. Body DCE removes only what is dead on EVERY path.
         const loopLive = new Set(live);
         allReadsInto([s], loopLive);
-        const b = dceBlock(s.body, loopLive, locals, volatiles);
+        const b = dceBlock(s.body, loopLive, locals, volatiles, { brk: loopLive, cont: loopLive });
         const nlive = new Set(loopLive);
         for (const r of b.liveIn) {
           nlive.add(r);
@@ -200,7 +221,7 @@ function dceBlock(
       case 'for': {
         const loopLive = new Set(live);
         allReadsInto([s], loopLive);
-        const b = dceBlock(s.body, loopLive, locals, volatiles);
+        const b = dceBlock(s.body, loopLive, locals, volatiles, { brk: loopLive, cont: loopLive });
         const nlive = new Set(loopLive);
         for (const r of b.liveIn) {
           nlive.add(r);
@@ -214,8 +235,9 @@ function dceBlock(
         // read anywhere in the switch as live throughout — no case-body store is ever cut.
         const swLive = new Set(live);
         allReadsInto([s], swLive);
-        const cases = s.cases.map((c) => ({ ...c, body: dceBlock(c.body, swLive, locals, volatiles).out }));
-        const def = s.default ? dceBlock(s.default, swLive, locals, volatiles).out : s.default;
+        const inSwitch: JumpLive = { brk: swLive, cont: jumps?.cont };
+        const cases = s.cases.map((c) => ({ ...c, body: dceBlock(c.body, swLive, locals, volatiles, inSwitch).out }));
+        const def = s.default ? dceBlock(s.default, swLive, locals, volatiles, inSwitch).out : s.default;
         const nlive = new Set(swLive);
         for (const r of reads(s.scrutinee)) {
           nlive.add(r);
@@ -263,7 +285,7 @@ export function eliminateDeadStores(sfn: SFn): SFn {
   allAddrNamesInto(sfn.body, addressTaken);
   const volatiles = new Set(sfn.locals.filter((l) => l.volatile).map((l) => l.name));
   const locals = new Set(sfn.locals.filter((l) => !l.volatile && !addressTaken.has(l.name)).map((l) => l.name));
-  const body = dceBlock(sfn.body, new Set<string>(), locals, volatiles).out;
+  const body = dceBlock(sfn.body, new Set<string>(), locals, volatiles, null).out;
   const used = new Set<string>();
   referencedNames(body, used);
   return { ...sfn, body, locals: sfn.locals.filter((l) => used.has(l.name) || l.volatile) };

package/src/l3/gates.ts

@@ -19,8 +19,9 @@ export interface Gate<Ctx> {
   /** Remove it and some candidate is WRONG, not merely worse. Everything else is a codegen
    *  heuristic the differ still referees. This flag is what makes `guardedBy` mandatory. */
   readonly sound: boolean;
-  /** the test that fails when this gate is removed — required for a sound gate */
-  readonly guardedBy?: string;
+  /** the test that fails when this gate is removed — required for a sound gate; a rule with two
+   *  halves names one test per half */
+  readonly guardedBy?: string | readonly string[];
   /** true ⇒ REJECT this candidate */
   readonly rejects: (c: Ctx) => boolean;
 }
@@ -67,6 +68,11 @@ export function ablateHeuristic<Ctx>(gates: readonly Gate<Ctx>[], id: string): r
   return without(gates, id);
 }
 
+/** Every test a gate names as its guard, one per half of the rule. */
+export function guardsOf<Ctx>(g: Gate<Ctx>): readonly string[] {
+  return typeof g.guardedBy === 'string' ? [g.guardedBy] : (g.guardedBy ?? []);
+}
+
 /** Structural defects in a gate table — the part checkable without running the pass. Returns
  *  findings rather than throwing, so core stays free of a test-framework import. */
 export function gateTableDefects<Ctx>(gates: readonly Gate<Ctx>[]): string[] {
@@ -84,7 +90,7 @@ export function gateTableDefects<Ctx>(gates: readonly Gate<Ctx>[]): string[] {
       out.push(`gate '${g.id}' has no usable \`why\``);
     }
     // the one rule that costs something to declare
-    if (g.sound && !g.guardedBy?.trim()) {
+    if (g.sound && !guardsOf(g).some((t) => t.trim())) {
       out.push(`gate '${g.id}' is marked sound but names no guard`);
     }
   }