@asmlift/core 0.8.0 → 0.9.0

package/src/raise/pre-recovery.ts

@@ -27,16 +27,20 @@ import {
   poolOrderOf,
   restoreUnclaimedScales,
 } from './extscale';
+import { recognizeFloatHelpers } from './floathelpers';
 import { numberPureValues } from './gvn';
 import { recognizeMagicDivision } from './magicdiv';
 import { recognizeMemberArrays } from './memberarrays';
 import { rerootNarrowReads } from './narrow';
 import { type MergeShape, mergeShapes, narrowBlockLocals } from './narrowlocal';
+import { fuseParamPairs } from './pairparams';
 import { PARAM_WIDTH_GATES, narrowEntryParams } from './paramwidth';
 import { type BranchShortCircuitOptions, recognizeBranchShortCircuit, recognizeShortCircuit } from './shortcircuit';
 import { recognizeSoftDiv } from './softdiv';
 import { recognizeStructArrays } from './struct-arrays';
 import { recognizeStructs } from './structs';
+import { TRUNC_LOAD_GATES, foldTruncatedLoads } from './truncload';
+import { recognizeWideHelpers, refuseUnmodelledHelpers } from './widehelpers';
 
 /** Per-call options for the pass list — ONE field per pass that takes any, named for the pass, so
  *  a caller reads which recognizer it is steering and a pass that takes none says so by absence.
@@ -91,8 +95,9 @@ export interface PreRecoveryPass {
 
 /** THE ordered pre-recovery pass list — the single source of truth shared by pipeline / rank / report.
  *  address-numbering → const-materialize → magic-division → pow2-division → soft-division →
- *  scaled-extension → array-legalize → struct-array → member-array → struct-pointer → short-circuit →
- *  branch-short-circuit → narrow-reads → narrow-local → parameter-width → scaled-extension-restore.
+ *  scaled-extension → array-legalize → truncated-load → struct-array → member-array → struct-pointer →
+ *  short-circuit → branch-short-circuit → narrow-reads → narrow-local → parameter-width →
+ *  scaled-extension-restore.
  *  See each recognizer's file for the rationale. */
 export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
   // FIRST: collapsing duplicate address definitions removes block params every later recognizer
@@ -121,7 +126,47 @@ export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
   // ending in `br`. Verified by running it before and after each of them — same result. It sits
   // beside magicdiv so that a reader looking for division recovery finds both together.
   { id: 'divpow2', run: recognizeDivPow2, dce: true },
-  { id: 'softdiv', run: (fn) => recognizeSoftDiv(fn), dce: false, gate: (t) => !t.capabilities.hwDivide },
+  {
+    id: 'softdiv',
+    run: (fn, _self, _opts, target) => recognizeSoftDiv(fn, target),
+    dce: false,
+    gate: (t) => !t.capabilities.hwDivide,
+  },
+  // NOT gated, where `softdiv` is: a float helper computes on floats, which an ISA with no FPU has no
+  // instruction for, and the target's runtime table is what says whether it calls one. A pass apart
+  // from `widehelpers` because it re-types words as floats — a helper's, a parameter a callee
+  // declares `double`, a literal — with its own closed-set refusal, and a single-precision helper
+  // is a float helper that is not wide.
+  {
+    id: 'floathelpers',
+    run: (fn, _self, _opts, target) => recognizeFloatHelpers(fn, target),
+    dce: false,
+  },
+  // NOT gated, where `softdiv` is, and the asymmetry is the argument: a soft DIVISION is
+  // a division the ISA has no instruction for, so a target with a divider never emits one — while
+  // no ISA this repo targets has 64-bit integer arithmetic at all, so a 64-bit helper is software
+  // on every one of them whatever `hwDivide` says.
+  {
+    id: 'widehelpers',
+    run: (fn, _self, _opts, target) => recognizeWideHelpers(fn, target),
+    dce: false,
+  },
+  // AFTER the three helper recognizers, because what it refuses is precisely what they declined: a
+  // call to a name the target's runtime table carries that none of `softdiv`, `floathelpers` and
+  // `widehelpers` folded.
+  // Re-emitting the compiler's own runtime call as source is the one failure that MATCHES, so the
+  // gap has to be written here rather than left to the backend. See raise/widehelpers.ts.
+  //
+  // `dce: false` — an `opaque` carries `effects`, so nothing it replaces becomes dead.
+  {
+    id: 'helperrefuse',
+    run: (fn, _self, _opts, target) => refuseUnmodelledHelpers(fn, target),
+    dce: false,
+  },
+  // AFTER it, because the `concat`s it reads are the ones the frontend built at the call the pass
+  // above has just rewritten — and because a pair the rewrite refused is a pair this must not fuse
+  // into a signature either.
+  { id: 'pairparams', run: (fn) => fuseParamPairs(fn), dce: false },
   // AFTER `const`, which folds a shift pair over a constant to the constant it computes, and BEFORE
   // the three array recognizers, whose input this pass produces: `shl(ext(x), k)` is an element
   // scale they legalize and the fused pair is not. `dce: true` — the `shl` a fold leaves readerless.
@@ -134,6 +179,31 @@ export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
     gate: foldsShiftPairCasts,
   },
   { id: 'arrays', run: recognizeArrays, dce: true },
+  // BEFORE the three struct synthesizers, and that is what the pass is FOR: `raise/structs.ts` is
+  // the pass that refuses one offset read at two widths, and it can only see one width per offset
+  // if the fold has already run. Below it the fold is dead — moved after `structs`,
+  // `pokeemerald:AnimTask_FlashHealthboxOnLevelUp_Step:agbcc` declines again on the same throw.
+  //
+  // EVERY POSITION ABOVE `structs` IS FREE, and that is measured rather than argued: two full
+  // `bench sweep --json` runs, this seat against the entry moved to index 0 — above `addrnum`,
+  // `const`, the three division recognizers, `extscale` and `arrays` — agree on all 2,430 records
+  // over 1,215 rows, compared by ROW IDENTITY on `src`/`len`/`diag`/`marks`/`asm`. (The 84
+  // `af:*:ido7.1` records whose `opts` digest churns between any two sweeps are the corpus-wide
+  // defect, which moves whatever anyone does; a LINE diff would report them as disagreement.)
+  //
+  // So the seat is a READING ORDER rather than a constraint: the three struct synthesizers follow
+  // each other here, and a reader looking for what happens to a base's access set finds them
+  // together. The one position that LOOKS like a prerequisite is `addrnum` — the fold groups
+  // accesses by base VALUE identity, so collapsing duplicate address definitions first reads as
+  // one. It is not, and index 0 is the run that shows it.
+  //
+  // `dce: false` — the rewrite retires nothing (the base keeps its use in the load the fold makes).
+  {
+    id: 'truncload',
+    run: (fn, _self, _opts, target) =>
+      foldTruncatedLoads(fn, target.capabilities.endianness === 'little', TRUNC_LOAD_GATES),
+    dce: false,
+  },
   // struct-arrays AFTER arrays (scalar stride==width shapes are claimed first — see the
   // discriminator note in raise/struct-arrays.ts) and BEFORE structs (an element's field
   // accesses must not be re-derived as constant-offset struct-pointer accesses).
@@ -147,7 +217,11 @@ export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
   // sits there so the three struct synthesizers read in the order of their evidence. `narrowlocal`
   // reads the carrier's extension chain rather than any address, so nothing here orders against it.
   { id: 'member-arrays', run: (fn) => recognizeMemberArrays(fn), dce: true },
-  { id: 'structs', run: recognizeStructs, dce: false },
+  {
+    id: 'structs',
+    run: (fn, _self, _opts, target) => recognizeStructs(fn, target.compilerBehaviors.aggregateBoundary),
+    dce: false,
+  },
   { id: 'shortcircuit', run: recognizeShortCircuit, dce: true },
   // The control-flow sibling, value form FIRST.
   //

package/src/raise/recover.ts

@@ -30,7 +30,7 @@ export function recoverTypes(fn: Fn): void {
   seedSignednessFromOpcodes(fn);
   typeDerefBases(fn);
   propagatePointers(fn);
-  defaultUnknownsToS32(fn);
+  defaultUnknowns(fn);
 }
 
 /** PHASE 1 — signedness from op semantics: the operands of a signed comparison are signed integers,
@@ -115,20 +115,24 @@ function typeDerefBases(fn: Fn): void {
 // incoming `a0`) and a `p = p + stride` walk, so those values stay `unknown` and phase 4 would
 // spell them `int` — an `int→int*` assignment mwcc/agbcc REJECT (gcc warns).
 
-/** PHASE 4 — default every still-unknown value to s32. This is a COMPILER default (agbcc/IDO/GCC
- *  all take plain `int` as the integer default), not a hardware fact — applied uniformly. */
-function defaultUnknownsToS32(fn: Fn): void {
+/** PHASE 4 — default every still-unknown value to SIGNED, at its own width. Signedness is a
+ *  COMPILER default (agbcc/IDO/GCC all take plain `int` as the integer default), not a hardware
+ *  fact, and it is applied uniformly. The WIDTH is not a default at all: it is what the value was
+ *  built at, and a 64-bit value retyped `s32` here would be silently truncated by the first pass
+ *  that believed the type. `setInt` above already defaults this way. */
+function defaultUnknowns(fn: Fn): void {
+  const settle = (v: { type: IrType }) => {
+    if (v.type.kind === 'unknown') {
+      v.type = T.int(v.type.width, true);
+    }
+  };
   for (const b of fn.blocks) {
     for (const p of b.params) {
-      if (p.type.kind === 'unknown') {
-        p.type = T.s(32);
-      }
+      settle(p);
     }
     for (const op of b.ops) {
       for (const r of op.results) {
-        if (r.type.kind === 'unknown') {
-          r.type = T.s(32);
-        }
+        settle(r);
       }
     }
   }

package/src/raise/retsink.ts

@@ -32,7 +32,7 @@
 // retired 2026-09-13).
 //
 // ONE MODEL, NOT TWO. The predicate is `narrowlocal.ts`'s exported `armIsOneSet` — no op that
-// `REEVAL_UNSAFE_OPS` calls unsafe, and EXACTLY one result-producing op — read here by
+// `reevalUnsafe` calls unsafe, and EXACTLY one result-producing op — read here by
 // `arms-are-one-set`. It is cited there line by line to `jump.c:474/:480/:482/:483` and
 // `rtlanal.c:1770-1784`, with the three things an op count alone gets wrong, and a reach census over
 // 13733 blocks. It is SHARED rather than re-derived here because it is one optimizer guard and a

package/src/raise/shortcircuit.ts

@@ -58,7 +58,8 @@ import {
   replaceAllUsesWith,
   successorsOf,
 } from '../ir/core';
-import { EFFECTFUL_OPS, HOIST_UNSAFE_OPS, NEGATED_ICMP, ORDER_SENSITIVE_OPS } from '../ir/opcodes';
+import { effectful, forgetHelperPlacement, orderSensitive, placedAt, speculationUnsafe } from '../ir/discipline';
+import { NEGATED_ICMP } from '../ir/opcodes';
 import { T } from '../ir/types';
 import { type Gate, firstRejection } from '../l3/gates';
 
@@ -226,8 +227,11 @@ export function recognizeShortCircuit(fn: Fn): boolean {
         // value ops (arith, loads, icmp) are safe: the structurer inlines them back into the `&&`/`||` RHS
         // expression, where C's own short-circuit re-guards them. Any side effect ⇒ DECLINE the fold — the
         // merge-variable spelling the fall-through leaves is correct (the side effect stays in B's block),
-        // just possibly non-matching.
-        if (bfeed.ops.slice(0, -1).some((op) => HOIST_UNSAFE_OPS.has(op.opcode))) {
+        // just possibly non-matching. A qualified read is an access, not a value, and stays in its
+        // arm the same way. structure/analysis.ts rests on this refusal: it names a counted op it
+        // finds in a connective's guarded operand at its def, above the branch, because no fold
+        // put one there.
+        if (bfeed.ops.slice(0, -1).some(speculationUnsafe)) {
           continue;
         }
         // NEGATABLE only when the orientation actually inverts the head — asked here rather than up
@@ -244,7 +248,9 @@ export function recognizeShortCircuit(fn: Fn): boolean {
         if (wantNeg && !negation) {
           continue;
         }
-        bfeed.ops.slice(0, -1).forEach(before); // hoist B's pure body (defines Vb; harmless if a dead const)
+        // hoist B's pure body (defines Vb; harmless if a dead const). A helper op it moves no longer
+        // sits where the asm called it (ir/discipline.ts `forgetHelperPlacement`).
+        bfeed.ops.slice(0, -1).forEach((op) => before(forgetHelperPlacement(op)));
         foldWriteOrder(fn.writeOrder, bfeed, h); // …and its writes now follow H's (ir/core.ts)
         let condSide = cond;
         if (negation) {
@@ -577,10 +583,11 @@ export function recognizeBranchShortCircuit(fn: Fn, opts: BranchShortCircuitOpti
           continue;
         }
         // ^g's body must be pure — see the REFUSALS note.
-        // HOIST_UNSAFE_OPS includes `opaque`: an instruction asmlift could not model, and moving it
+        // `speculationUnsafe` answers yes for `opaque`: an instruction asmlift could not model, and moving it
         // out of the arm that guards it is the reordering this refuses. Loud either way today — a
         // decline under `onGap: 'strict'`, an ASMLIFT_ERROR marker under `annotate`.
-        if (g.ops.slice(0, -1).some((op) => HOIST_UNSAFE_OPS.has(op.opcode))) {
+        // A qualified read stays in its arm too, as in the value form above, and for the same reader.
+        if (g.ops.slice(0, -1).some(speculationUnsafe)) {
           continue;
         }
         // Which of ^g's edges rejoins ^h's other successor? That is the shared block. A DIRECT edge
@@ -648,7 +655,7 @@ export function recognizeBranchShortCircuit(fn: Fn, opts: BranchShortCircuitOpti
           }
         }
         rereadInArm(fn, g, otherEdge.block, reread);
-        const body = g.ops.slice(0, -1);
+        const body = g.ops.slice(0, -1).map(forgetHelperPlacement);
         const second = negation ? negation.result : c2;
         const negated: Op[] = negation ? negation.ops : [];
         const res = mkValue(T.unk(32));
@@ -938,7 +945,7 @@ const readsOf = (op: Op): Value[] => [...op.operands, ...op.successors.flatMap((
  *  gate in `opts.armReread` (default {@link ARM_REREAD_GATES}) refuses the site.
  *
  *  The copy is exact at the arm's head because nothing runs between: `g`'s body is pure (its
- *  caller refuses anything in HOIST_UNSAFE_OPS), so a load copied there reads what `g`'s own load
+ *  caller refuses anything `speculationUnsafe`), so a load copied there reads what `g`'s own load
  *  read, and `g` is the arm's ONLY predecessor, so the copy runs exactly when the original's
  *  value would have been live there. On verified IR that also places every escaping read under
  *  the arm: `g` dominates nothing else, because the shared block is reached from ^h directly.
@@ -1086,17 +1093,20 @@ function leavesALoop(fn: Fn, g: Block, arm: Block, preds: ReadonlyMap<Block, rea
  *    - it renders nowhere single: some PURE value between it and a statement has two consumers, so
  *      `emitPos` is null and analysis.ts materializes it whatever stands in the way
  *      (`p[2] = p[1] & 0x80; p[3] = p[1] & 0x80;` — one `and`, two stores);
- *    - it has MORE THAN ONE direct reader, and an effect precedes one of their render positions —
- *      the multi-render rule, `isWrite = EFFECTFUL_OPS`, which exempts nothing;
- *    - it has ONE, and an effect precedes its render position that analysis.ts's `isBarrier`
- *      counts: any `astore`/`opaque`, a `call` that is not rendered inside that same statement,
- *      and a `store` UNLESS it is to a provably disjoint slot of the read's own base
- *      (`disjointConstSlots`, ir/alias.ts — the helper `isBarrier` calls).
+ *    - it has MORE THAN ONE direct reader, and an effect or a helper op analysis.ts names precedes
+ *      one of their render positions — the multi-render rule, which exempts nothing;
+ *    - it has ONE, and an op precedes its render position that analysis.ts's `isBarrier` counts:
+ *      any `astore`/`opaque`, a helper op analysis.ts names, a `call` that is not rendered inside
+ *      that same statement, and a `store` UNLESS it is to a provably disjoint slot of the read's own
+ *      base (`disjointConstSlots`, ir/alias.ts — the helper `isBarrier` calls).
+ *
+ *  `isBarrier`'s pinned-read clause has nothing to mirror: ^g holds no pinned read, since the fold
+ *  refuses a ^g with anything `speculationUnsafe` in it.
  *
  *  A reader in any block other than the arm answers yes — the copy then outlives the arm's first
  *  block. What this does NOT mirror, and which way each gap errs, is ARM_REREAD_GATES' RESIDUE. */
 function readHeldAcrossEffect(c: ArmRereadSite): boolean {
-  const reads = [...c.copy].filter((op) => ORDER_SENSITIVE_OPS.has(op.opcode));
+  const reads = [...c.copy].filter(orderSensitive);
   if (reads.length === 0) {
     return false;
   }
@@ -1127,8 +1137,17 @@ function readHeldAcrossEffect(c: ArmRereadSite): boolean {
     if (cs.length === 1) {
       return at(cs[0]);
     }
-    return ORDER_SENSITIVE_OPS.has(op.opcode) ? posOf(op) : null;
+    return orderSensitive(op) ? posOf(op) : null;
   };
+  // analysis.ts's `namedHelper`: a helper op it names where the asm ran it, which bars a read as a
+  // named call does. It names one whose value renders in another block, or past an effect or
+  // another named helper.
+  const namedHelper = (x: Op): boolean =>
+    placedAt(x) === 'helper' &&
+    (escapes(x.results) ||
+      consumersOf(x.results)
+        .map(at)
+        .some((p) => p === null || c.arm.ops.slice(posOf(x) + 1, p).some((y) => effectful(y) || namedHelper(y))));
   for (const l of reads) {
     if (escapes(l.results)) {
       return true;
@@ -1139,7 +1158,10 @@ function readHeldAcrossEffect(c: ArmRereadSite): boolean {
     }
     const multi = renders.length > 1;
     const bars = (x: Op, pos: number): boolean => {
-      if (!EFFECTFUL_OPS.has(x.opcode)) {
+      if (namedHelper(x)) {
+        return true;
+      }
+      if (!effectful(x)) {
         return false;
       }
       if (multi) {
@@ -1280,7 +1302,7 @@ export const ARM_REREAD_GATES: readonly Gate<ArmRereadSite>[] = [
     why: 'the target read it before the second test on both of its exits; moved, it runs on one',
     sound: false,
     guardedBy: 'branch-shortcircuit.test.ts: REFUSED: a READ only the arm consumes would move under the second test',
-    rejects: (c) => [...c.drop].some((op) => ORDER_SENSITIVE_OPS.has(op.opcode)),
+    rejects: (c) => [...c.drop].some(orderSensitive),
   },
   {
     // THE BYTES HALF of the copy (see `armRereadCone`), and a claim about ONE compiler. The arm of
@@ -1323,7 +1345,7 @@ export const ARM_REREAD_GATES: readonly Gate<ArmRereadSite>[] = [
 
 /** Copy `copy` to the head of `arm`, point every read outside `g` at the copies, and delete `drop`.
  *  A dropped original is deleted rather than left for the hoist: the arm now performs it, and a
- *  dead READ left in ^h is one the structurer may still spell (SPELLED_WHEN_DEAD_OPS). */
+ *  dead READ left in ^h is one the structurer may still spell (ir/discipline.ts `spelledWhenDead`). */
 function rereadInArm(fn: Fn, g: Block, arm: Block, { copy, drop }: ArmReread): void {
   const copyOf = new Map<Value, Value>();
   const copies = g.ops

package/src/raise/softdiv.ts

@@ -15,27 +15,27 @@
 // cannot state: its match keys on a `call`'s STRING `target` attr, which the numeric `attrEquals`
 // cannot express. It is naturally inert on hardware-divide targets (which emit `div`/`divu`,
 // never `bl __divsi3`).
-import { Fn, mkOp } from '../ir/core';
-import type { Opcode } from '../ir/opcodes';
-import type { Prototypes } from '../proto';
+import type { Fn } from '../ir/core';
+import { wordsOf } from '../proto';
+import { type RuntimeHelper, helperOp, isFloatHelper, isWideHelper } from '../runtime-helpers';
+import type { TargetDescription } from '../target';
 
-// runtime helper symbol → { the division op it computes, its argument count }.
-const SOFT_DIV: Record<string, { op: Opcode; params: number }> = {
-  __divsi3: { op: 'sdiv', params: 2 },
-  __udivsi3: { op: 'udiv', params: 2 },
-  __modsi3: { op: 'smod', params: 2 },
-  __umodsi3: { op: 'umod', params: 2 },
-};
-
-/** Signatures for the soft-division runtime helpers, so a `bl __divsi3` recovers both arguments.
- *  Consumed by the frontend's arity lookup BEHIND any caller-supplied prototype (headers win). */
-export const RUNTIME_HELPERS: Prototypes = Object.fromEntries(
-  Object.entries(SOFT_DIV).map(([sym, h]) => [sym, { params: h.params }]),
-);
+/** The 32-bit software divisions, off the target's own helper table. WHICH helpers a compiler emits
+ *  is a compiler fact and lives there (runtime-helpers.ts); which of them THIS pass answers for is
+ *  the question here, and it is the narrow one: a division the ISA has no instruction for. A helper
+ *  that computes on a value wider than a register is a different question — no hardware capability
+ *  can make one unnecessary — and `raise/widehelpers.ts` answers it, ungated. So is a float helper
+ *  of any width, which computes on floats the ISA has no instruction for either, and
+ *  `raise/floathelpers.ts` answers it. */
+const softDivisions = (target: TargetDescription): Record<string, RuntimeHelper> =>
+  Object.fromEntries(
+    Object.entries(target.runtimeHelpers ?? {}).filter(([, h]) => h.op && !isWideHelper(h) && !isFloatHelper(h)),
+  );
 
 /** Rewrite each recognised soft-division helper call to its division op, in place. Returns whether
  *  anything changed. Runs BEFORE type recovery so the new op's operands get signed/unsigned typing. */
-export function recognizeSoftDiv(fn: Fn): boolean {
+export function recognizeSoftDiv(fn: Fn, target: TargetDescription): boolean {
+  const table = softDivisions(target);
   let changed = false;
   for (const b of fn.blocks) {
     for (let i = 0; i < b.ops.length; i++) {
@@ -43,18 +43,16 @@ export function recognizeSoftDiv(fn: Fn): boolean {
       if (op.opcode !== 'call') {
         continue;
       }
-      const helper = SOFT_DIV[op.attrs.target as string];
-      if (!helper) {
+      const helper = table[op.attrs.target as string];
+      if (!helper?.op) {
         continue;
       }
       // Fold only when BOTH arguments were recovered (the signature makes this the norm). A
       // mis-recovered arity leaves the call untouched rather than fabricating a wrong divide.
-      if (op.operands.length !== helper.params || op.results.length !== 1) {
+      if (op.operands.length !== wordsOf(helper.params) || op.results.length !== 1) {
         continue;
       }
-      // Reuse the SAME result Value → every existing use already points at it (no RAUW needed).
-      const div = mkOp(helper.op, { operands: [...op.operands], results: [op.results[0]] });
-      b.ops.splice(i, 1, div);
+      b.ops.splice(i, 1, helperOp(helper.op, op.attrs.target as string, op.operands, op.results[0]));
       changed = true;
     }
   }

package/src/raise/struct-arrays.ts

@@ -18,6 +18,7 @@
 // UNAMBIGUOUS here (the scaled operand is the index, read from the machine code) — the unscaled
 // `add(x, y)` byte form stays out of scope (genuinely ambiguous without types).
 import { Fn, Op, Value, defOpMap, mkOp } from '../ir/core';
+import { carryDiscipline } from '../ir/discipline';
 import { nextStructIndex } from '../ir/struct-names';
 import { IrType, StructField, T, scalarTypeForAccess } from '../ir/types';
 import { collectStructs } from './structs';
@@ -102,7 +103,7 @@ export function recognizeStructArrays(fn: Fn): number {
   // time, because this pass runs once per function and nothing else mints the prefix, and
   // ir/struct-names.ts states why the computed 0 is kept over the assumed one.
   let name = nextStructIndex(
-    [...collectStructs(fn)].map((s) => s.name),
+    [...collectStructs(fn, true)].map((s) => s.name),
     'Elem',
   );
 
@@ -254,17 +255,17 @@ export function recognizeStructArrays(fn: Fn): number {
             operands: [base, index],
             results: [op.results[0]],
             // listOrder rides along: an ldmia-expanded load keeps its stream-order caveat as an aload
-            attrs: {
+            attrs: carryDiscipline(op, {
               elemSize: stride,
               signed: op.attrs.signed as boolean,
               fieldOff: op.attrs.off as number,
               ...(op.attrs.listOrder === true && { listOrder: true }),
-            },
+            }),
           });
         } else if (op.opcode === 'store') {
           bb.ops[i] = mkOp('astore', {
             operands: [base, index, op.operands[1]],
-            attrs: { elemSize: stride, fieldOff: op.attrs.off as number },
+            attrs: carryDiscipline(op, { elemSize: stride, fieldOff: op.attrs.off as number }),
           });
         }
       }