@asmlift/core 0.8.1 → 0.10.0

package/src/ir/entry.ts

@@ -0,0 +1,159 @@
+// asmlift — does a test placed ahead of a loop compute the loop's own test on the loop's entry values?
+//
+// Three questions ask exactly that, at two levels, and all read the answer from this one predicate:
+//   • structure's GUARD FUSION (`structure.ts`, through `hazards.ts`): the `if` a rotated loop is
+//     wrapped in is deleted when it is the loop's test at the first iteration, and the loop re-tests;
+//   • raise's RE-ROLL (`raise/reroll.ts`): a loop test the compiler peeled into the loop's entry is
+//     deleted when it is the latch's test at the values the entry hands the loop;
+//   • the re-roll's TOP-TEST RESTORE (`entryGuard`, same file): the guard a restored top test
+//     makes redundant is deleted when it is that test at the entry values, with the same exit args.
+//
+// The reading is STRUCTURAL, never semantic: two values are the same when they are one value, or
+// when their defining ops have one opcode, one set of attributes and operands that are the same in
+// turn. A false negative costs a loud decline, the direction to be wrong in. `entry` models the
+// first iteration: on the loop side (`a`), a value it maps is read as the value it maps to, and
+// below that substitution the walk is in the entry's world, where the map no longer applies — a
+// loop-invariant back-edge argument read inside the entry's own expression is itself there, not the
+// param it feeds.
+//
+// `normalize` adds the equalities the re-roll needs and guard fusion does not take: an `add` or
+// `or` of a constant 0 on EITHER side, commutative operands in either order, and a load off
+// `base + c` as the same load off `base` at its offset plus `c` (`str[0]` against `str[i]` at
+// `i = 0`). Each is an identity of the integer operators, so turning it on for guard fusion is a
+// spelling decision, not a soundness one.
+import { Op, Value } from './core';
+import { spelledWhenDead } from './discipline';
+import { NEGATED_ICMP } from './opcodes';
+
+export interface EntryReading {
+  /** the value each loop-side value holds on the loop's first iteration */
+  readonly entry: ReadonlyMap<Value, Value>;
+  /** values whose defining op may be read through; everything else compares by identity. Default:
+   *  every value. An operand-free op that reads no memory (a constant, a symbol address) is always
+   *  read through: it is its attributes wherever it sits. */
+  readonly through?: (v: Value) => boolean;
+  /** the identities above, beyond `x + 0` / `x - 0` / `x | 0` with the zero on the right */
+  readonly normalize?: boolean;
+}
+
+/** Opcodes whose two operands may be read in either order, under `normalize`. */
+const COMMUTES = new Set(['add', 'mul', 'and', 'or', 'xor', 'icmp_eq', 'icmp_ne']);
+
+/** Is `a` (loop side), read on the loop's entry values, the same value as `b`? With `negated`, is it
+ *  `b`'s logical opposite — the usual case where a guard spells the loop's test the other way round. */
+export function sameAtEntry(
+  defs: ReadonlyMap<Value, Op>,
+  a: Value,
+  b: Value,
+  reading: EntryReading,
+  negated = false,
+): boolean {
+  const { entry, through = () => true, normalize = false } = reading;
+  const readable = (v: Value): boolean => {
+    const d = defs.get(v);
+    return d !== undefined && (through(v) || (d.operands.length === 0 && !spelledWhenDead(d)));
+  };
+  const constOf = (v: Value): number | null => {
+    const d = defs.get(v);
+    return d?.opcode === 'const' && typeof d.attrs?.value === 'number' ? d.attrs.value : null;
+  };
+  /** A constant `v` reads as: under `normalize`, as its entry substitution reads. */
+  const constAt = (v: Value, atEntry: boolean): number | null => constOf(normalize ? view(v, atEntry).x : v);
+  /** `x0` as the comparison reads it: through the entry map while on the loop side (`!atEntry`), and
+   *  with `x + 0` / `x - 0` / `x | 0` read as `x` — substituting a loop variable by its init constant
+   *  turns ordinary index arithmetic into exactly these. */
+  function view(x0: Value, atEntry0: boolean): { x: Value; atEntry: boolean } {
+    let x = x0;
+    let atEntry = atEntry0;
+    for (;;) {
+      const mapped = atEntry ? undefined : entry.get(x);
+      if (mapped !== undefined) {
+        x = mapped;
+        atEntry = true;
+        continue;
+      }
+      const d = readable(x) ? defs.get(x) : undefined;
+      if (!d || d.operands.length !== 2 || !['add', 'sub', 'or'].includes(d.opcode)) {
+        return { x, atEntry };
+      }
+      if (constAt(d.operands[1], atEntry) === 0) {
+        x = d.operands[0];
+      } else if (normalize && d.opcode !== 'sub' && constAt(d.operands[0], atEntry) === 0) {
+        x = d.operands[1];
+      } else {
+        return { x, atEntry };
+      }
+    }
+  }
+  /** A load's address as a base and a constant offset, the `+ c` of an `add` folded in. */
+  const address = (d: Op, atEntry0: boolean): { base: Value; off: number; atEntry: boolean } => {
+    const off = Number(d.attrs.off ?? 0);
+    const { x: base, atEntry } = view(d.operands[0], atEntry0);
+    const ad = readable(base) ? defs.get(base) : undefined;
+    if (ad?.opcode === 'add' && ad.operands.length === 2) {
+      for (const k of [0, 1]) {
+        const c = constAt(ad.operands[k], atEntry);
+        if (c !== null) {
+          return { base: ad.operands[1 - k], off: off + c, atEntry };
+        }
+      }
+    }
+    return { base, off, atEntry };
+  };
+  const attrsOf = (d: Op, drop: string | null) =>
+    JSON.stringify(Object.fromEntries(Object.entries(d.attrs ?? {}).filter(([k]) => k !== drop)));
+  // memoised per (x, y, side): a value its own consumer reads twice would otherwise double the work
+  // at every level
+  const memo = new Map<string, boolean>();
+  const ids = new Map<Value, number>();
+  const id = (v: Value) => ids.get(v) ?? (ids.set(v, ids.size), ids.size - 1);
+  /** `da` (read with `atEntry`) and `db` (the entry's own) compute the same value. */
+  const sameOp = (da: Op, db: Op, opcodeOk: boolean, atEntry: boolean): boolean => {
+    if (!opcodeOk || da.operands.length !== db.operands.length) {
+      return false;
+    }
+    if (normalize && da.opcode === 'load' && db.opcode === 'load') {
+      const x = address(da, atEntry);
+      const y = address(db, true);
+      return x.off === y.off && attrsOf(da, 'off') === attrsOf(db, 'off') && same(x.base, x.atEntry, y.base);
+    }
+    if (attrsOf(da, null) !== attrsOf(db, null)) {
+      return false;
+    }
+    if (da.operands.every((o, i) => same(o, atEntry, db.operands[i]))) {
+      return true;
+    }
+    return (
+      normalize &&
+      COMMUTES.has(da.opcode) &&
+      da.operands.length === 2 &&
+      same(da.operands[0], atEntry, db.operands[1]) &&
+      same(da.operands[1], atEntry, db.operands[0])
+    );
+  };
+  function same(x0: Value, atEntry0: boolean, y0: Value): boolean {
+    const { x, atEntry } = view(x0, atEntry0);
+    const { x: y } = view(y0, true);
+    if (x === y) {
+      return true;
+    }
+    const key = `${id(x)},${id(y)},${atEntry ? 1 : 0}`;
+    const hit = memo.get(key);
+    if (hit !== undefined) {
+      return hit;
+    }
+    const da = readable(x) ? defs.get(x) : undefined;
+    const db = readable(y) ? defs.get(y) : undefined;
+    const r = !!da && !!db && sameOp(da, db, da.opcode === db.opcode, atEntry);
+    memo.set(key, r);
+    return r;
+  }
+  if (!negated) {
+    return same(a, false, b);
+  }
+  const { x, atEntry } = view(a, false);
+  const { x: y } = view(b, true);
+  const da = readable(x) ? defs.get(x) : undefined;
+  const db = readable(y) ? defs.get(y) : undefined;
+  return !!da && !!db && sameOp(da, db, NEGATED_ICMP[da.opcode] === db.opcode, atEntry);
+}

package/src/ir/float-bits.ts

@@ -0,0 +1,47 @@
+// asmlift IR — a double literal: the bit pattern the IR carries it as, and the C that spells it.
+//
+// THE IR CARRIES THE BITS, NOT A NUMBER, because a number has one value that is two doubles:
+// `-0` prints and serializes as `0`, so a literal keyed or dumped by its number would be the
+// other zero. Sixteen hex digits name exactly one double, NaN payloads included.
+
+const view = new DataView(new ArrayBuffer(8));
+
+/** The bit pattern, as sixteen hex digits, of the double whose high word (sign and exponent) is
+ *  `hi` and low word is `lo`. */
+export function doubleBits(hi: number, lo: number): string {
+  return (hi >>> 0).toString(16).padStart(8, '0') + (lo >>> 0).toString(16).padStart(8, '0');
+}
+
+/** Whether `bits` is a double's bit pattern: sixteen hex digits, as `doubleBits` spells one. A
+ *  single's eight would name another number read as a double, so nothing here takes one. */
+export const isDoubleBits = (bits: unknown): bits is string => typeof bits === 'string' && /^[0-9a-f]{16}$/.test(bits);
+
+/** The double a bit pattern names. */
+export function doubleOf(bits: string): number {
+  if (!isDoubleBits(bits)) {
+    throw new Error(`'${bits}' is not a double's bit pattern`);
+  }
+  view.setUint32(0, parseInt(bits.slice(0, 8), 16));
+  view.setUint32(4, parseInt(bits.slice(8, 16), 16));
+  return view.getFloat64(0);
+}
+
+/** The C spelling of a finite double: the shortest decimal that reads back as the same double
+ *  (ECMAScript's Number::toString, whose digits are the fewest that do), with a `.0` where it has
+ *  neither a point nor an exponent, so C reads a `double` and not an `int`, and `-0.0` for the
+ *  negative zero.
+ *
+ *  THAT IT READS BACK IS A PREMISE ABOUT THE COMPILER, and the one producer of a literal
+ *  (`raise/floathelpers.ts`) runs only where the target states it
+ *  (`compilerBehaviors.roundTripsDoubleLiterals`, which cites agbcc's source for it). */
+export function doubleLiteral(bits: string): string {
+  const x = doubleOf(bits);
+  if (!Number.isFinite(x)) {
+    throw new Error(`the double ${bits} is not finite and has no C literal`);
+  }
+  if (Object.is(x, -0)) {
+    return '-0.0';
+  }
+  const s = String(x);
+  return /[.e]/.test(s) ? s : `${s}.0`;
+}

package/src/{structure → ir}/loops.ts

@@ -1,4 +1,8 @@
-// asmlift — natural-loop discovery: the pure CFG analysis the structurer consumes.
+// asmlift — natural-loop discovery: the pure CFG analysis the structurer consumes, and the raise
+// passes that rewrite a loop's edges before it (`raise/latch.ts`, `raise/reroll.ts`).
+//
+// A substrate fact like dominance, so it lives here and not under `structure/`: that keeps the
+// dependency between the levels one way — structure imports raise, never the reverse.
 //
 // Produces a DEFINITE header set computed structurally from back-edges — a block is a loop header
 // iff it is a real back-edge target (`h ∈ dom(t)` for an edge `t→h`), never inferred from `cond_br`
@@ -8,7 +12,7 @@
 //
 // Dominance itself is a substrate fact and lives in `ir/core.ts`; `analyzeLoops` takes the map as
 // a parameter, so a caller passes `dominators(fn)` from there.
-import { Block, Fn, predecessors, successorsOf } from '../ir/core';
+import { Block, Fn, predecessors, successorsOf } from './core';
 
 /** One natural loop, keyed by its header. */
 export interface NaturalLoop {

package/src/ir/opcodes.ts

@@ -13,8 +13,8 @@ export interface OpSig {
   successors?: number | 'variadic';
   requiredAttrs?: readonly string[];
   /** observable side effect (memory write / call): never deleted when dead, never hoisted into
-   *  an unconditional position. THE one effect vocabulary — DCE (pattern/engine.ts) and the
-   *  short-circuit hoist guard (raise/shortcircuit.ts) both derive from this flag. */
+   *  an unconditional position. THE one effect vocabulary — every question ir/discipline.ts asks of an
+   *  op derives from this flag and the two below. */
   effects?: boolean;
   /** reads memory. Deletable when dead — nothing observes a load nobody reads — but NOT movable:
    *  a load answers whichever stores ran before it, so crossing one changes the value it yields.
@@ -38,7 +38,14 @@ export const OPCODES = {
   // Effect-free (no `effects` flag) so DCE reaps a dead one.
   mulh: { operands: 2, results: 1 },
   mulhu: { operands: 2, results: 1 },
-  neg: { operands: 1, results: 1 },
+  neg: { operands: 1, results: 1 }, // the wrapping negation, 0 - x as a 32-bit word
+  // The MATHEMATICAL negation: what Thumb's `cmn rA, rB` compares rA against when a signed branch
+  // reads it (frontend/thumb.ts `lowerTerminator`). It differs from `neg` at exactly one operand,
+  // 0x80000000, where its value (+2^31) is no 32-bit word at all. A separate opcode rather than an
+  // attr on `neg` because every word evaluator in core folds `neg` as the wrapping one, and an
+  // attr each of them must remember to read fails OPEN: one that does not know `neg_s` falls to
+  // its default arm and declines. Only the structurer spells it, as `-(s32)x`.
+  neg_s: { operands: 1, results: 1 },
   not: { operands: 1, results: 1 }, // bitwise complement (`mvn`) → ~x
   or: { operands: 2, results: 1 },
   and: { operands: 2, results: 1 },
@@ -109,6 +116,74 @@ export const OPCODES = {
   // which recompiles to the branch diamond the source emitted.
   logic_and: { operands: 2, results: 1 },
   logic_or: { operands: 2, results: 1 },
+  // --- a 64-bit value and its two halves ---
+  // A 64-bit integer is ONE value of `{kind:'int'|'unknown', width:64}`, never two results and never
+  // a new `IrType` kind. The rule that decides it: for TYPES, widen the number that is already
+  // there; for OPERATIONS, add a new opcode. Existing code tests `t.kind === 'int'` and reads
+  // `t.width`, so a wider width makes a pass that is wrong about it fail LOUDLY, while a new kind
+  // would make the same pass skip SILENTLY. Existing code switches on `op.opcode`, so a new opcode
+  // makes an existing pass skip, which is the safe direction there.
+  //
+  // So the arithmetic opcodes above gain NOTHING: `add`, `sub`, `mul`, the shifts and the `icmp_*`
+  // family carry the width in their operand types. Only the three ops that have no 32-bit spelling
+  // are new — building a 64-bit value out of two halves, and reading either half back.
+  //
+  // `concat lo, hi` is TRANSIENT the way `mulh` is: it renders only in the shapes something above
+  // it recognises (a widen, a literal, an ABI pair), and one that survives to the structurer is a
+  // loud gap. `lo32`/`hi32` invert that property and are PERMANENT, because C spells them exactly —
+  // `(u32)v` and `(u32)(v >> 32)`.
+  //
+  // WHY `hi32` AND NOT `lo32(shr_u v {imm:32})`, which is the same value in two ops rather than
+  // three: spelling a projection as a 64-bit SHIFT puts a 64-bit arithmetic op into the IR at every
+  // pair site, and hands it to every pass that matches a shift — `raise/divpow2.ts` on
+  // `shr_s {imm}`, `raise/extscale.ts` on `shl`, `raise/narrow.ts` on a narrow/re-widen pair. Those
+  // passes would then be REACHED by a 64-bit operand instead of skipping it. A third opcode nothing
+  // else matches is what buys the isolation.
+  concat: { operands: 2, results: 1 }, // concat lo, hi → the 64-bit value whose low half is `lo`
+  lo32: { operands: 1, results: 1 },
+  hi32: { operands: 1, results: 1 },
+  // --- hardware floating point ---
+  // IEEE arithmetic on `{kind:'float'}` values, and on nothing else (ir/verify.ts checks both
+  // directions). NEW OPCODES rather than `add`/`sub` over a float-typed operand, by the rule the
+  // 64-bit section above states for OPERATIONS: every pass that matches `add` is an integer rewrite
+  // — a pointer walk, a reassociation, a constant fold, an idiom pattern — and a new opcode is what
+  // makes each of them skip. Pure: under the default IEEE environment none of them traps, so a
+  // dead one is reaped like any integer op.
+  fadd: { operands: 2, results: 1 },
+  fsub: { operands: 2, results: 1 },
+  fmul: { operands: 2, results: 1 },
+  fdiv: { operands: 2, results: 1 },
+  fneg: { operands: 1, results: 1 },
+  // A double LITERAL: `bits` is its IEEE pattern as sixteen hex digits (ir/float-bits.ts). Its own
+  // opcode rather than a `const` over a float type for the reason the arithmetic above has its own:
+  // every pass that matches `const` is an integer fold.
+  fconst: { operands: 0, results: 1, requiredAttrs: ['bits'] },
+  // The CROSSINGS between a float and an integer, C's conversions: `fptosi`/`fptoui` truncate toward
+  // zero into a signed or unsigned integer of the result's width (32 or 64), `sitofp` converts a
+  // signed one, `fpext`/`fptrunc` move between the precisions. The only ops a float and an integer
+  // meet in (ir/verify.ts). No `uitofp`: no compiler here converts an unsigned integer in one step
+  // (agbcc open-codes it around `__floatsisf`), so it would be an opcode with no producer.
+  fptosi: { operands: 1, results: 1 },
+  fptoui: { operands: 1, results: 1 },
+  sitofp: { operands: 1, results: 1 },
+  fpext: { operands: 1, results: 1 },
+  fptrunc: { operands: 1, results: 1 },
+  // The float COMPARES, a 0/1 integer out of two floats of one type. Ten and not six, because
+  // NaN makes C's relations a partial order: `!(a > b)` is true on a NaN and `a <= b` is not, and
+  // every compiler here compiles the two differently. So each ordered relation (`o`, false on a
+  // NaN) has its logical negation as an unordered opcode (`u`, true on a NaN): `fcmp_ule` IS
+  // `!(a > b)`. C's `!=` is `fcmp_une`. They stay out of `NEGATED_ICMP`, whose integer negation
+  // (`<` ↔ `>=`) would be the wrong program here; `NEGATED_FCMP` below is theirs.
+  fcmp_oeq: { operands: 2, results: 1 },
+  fcmp_une: { operands: 2, results: 1 },
+  fcmp_olt: { operands: 2, results: 1 },
+  fcmp_uge: { operands: 2, results: 1 },
+  fcmp_ole: { operands: 2, results: 1 },
+  fcmp_ugt: { operands: 2, results: 1 },
+  fcmp_ogt: { operands: 2, results: 1 },
+  fcmp_ule: { operands: 2, results: 1 },
+  fcmp_oge: { operands: 2, results: 1 },
+  fcmp_ult: { operands: 2, results: 1 },
   // --- memory ---
   load: { operands: 1, results: 1, requiredAttrs: ['off', 'width', 'signed'], reads: true },
   store: { operands: 2, results: 0, requiredAttrs: ['off', 'width'], effects: true },
@@ -119,8 +194,10 @@ export const OPCODES = {
   aload: { operands: 2, results: 1, requiredAttrs: ['elemSize', 'signed'], reads: true }, // aload base, index
   astore: { operands: 3, results: 0, requiredAttrs: ['elemSize'], effects: true }, // astore base, index, value
   // --- call: operands are the argument values (r0..), result is the return value (r0),
-  //     `target` attr is the callee symbol. Caller-saved clobbering is implicit. ---
-  call: { operands: 'variadic', results: 1, requiredAttrs: ['target'], effects: true },
+  //     `target` attr is the callee symbol — or, with `indirect: true` and no `target`, the
+  //     callee is the address in the LAST operand (ir/core.ts `calleeValue`). Exactly one of the
+  //     two, which `ir/verify.ts` checks. Caller-saved clobbering is implicit. ---
+  call: { operands: 'variadic', results: 1, effects: true },
   // The ADDRESS of a named global (agbcc `ldr rD, .Lpool` where the pool word is `.word gSym`).
   // Pure, 0 operands. Globals come from the project headers, so they are referenced by name, never
   // declared as locals. The structurer lowers it three ways (see scalarGlobals in structure.ts):
@@ -134,10 +211,17 @@ export const OPCODES = {
   // proving every access agrees, and the structurer declares the local and renders `&name` exactly
   // as it renders a gaddr's `&sym`. Operand-free and pure, so GVN numbers it like gaddr and a dead
   // one is reaped.
-  // `width`/`signed` are stamped by the frontend's frame-object AUDIT — requiring them makes
-  // "the audit ran" a verifier-checkable fact instead of a convention: a frontend that emits a
-  // laddr and skips the audit fails verify loudly instead of rendering `&undefined`.
-  laddr: { operands: 0, results: 1, requiredAttrs: ['off', 'width', 'signed'] },
+  // `width`/`signed`/`count` are stamped by the frontend's frame-object AUDIT — requiring them
+  // makes "the audit ran" a verifier-checkable fact instead of a convention: a frontend that emits
+  // a laddr and skips the audit fails verify loudly instead of rendering `&undefined`. The SHAPE
+  // the three of them encode is checked there too (ir/verify.ts), because the attrs are
+  // disjunctive and only `count` tells the two arms apart.
+  // The object is `count` elements of `width` bytes, so its storage spans `width * count`. A
+  // SCALAR is count 1, typed by the access width and signedness every access agreed on. Count
+  // above 1 is STORAGE the audit sized without typing — no access pins an element type, so it is
+  // width 1, unsigned, and declares as `u8 name[count]`; nothing else may mint one, because the
+  // only thing that licenses an untyped object is the frame accounting the audit solves.
+  laddr: { operands: 0, results: 1, requiredAttrs: ['off', 'width', 'signed', 'count'] },
   // An UNDEFINED value: a read of storage that carries no INPUT — nothing was entitled to hand this
   // function a value there, and none of its own stores reached it on this path. Deliberately NOT
   // "storage nobody could have written": a callee-saved register holds the CALLER's value at entry,
@@ -153,7 +237,7 @@ export const OPCODES = {
   //     merely "owns the storage", because a frame the function owns can still be written by
   //     someone else once an address into it escapes to a callee, which fills a wider object than
   //     any in-function access reveals. Whoever mints one owes the retraction on escape
-  //     (frontend/thumb.ts, after the frame-object audit).
+  //     (the frame-object audit, frontend/frame-objects.ts).
   //   • a REGISTER the ABI does not pass arguments in AND this function's prologue SAVED cannot
   //     carry a value a caller handed over, and has no address for anything else to reach it by, so
   //     there is nothing to retract. The save is half of the premise, not a corroboration of it:
@@ -163,13 +247,16 @@ export const OPCODES = {
   // live-in, and a live-in of the entry block is a PARAMETER — right for an argument register, a
   // fabricated argument for anything else.
   //
-  // Operand-free and pure like `laddr`, and out of raise/gvn.ts's NUMBERABLE set — where numbering
-  // it would be VACUOUS rather than harmful, since two undefs in one function always carry
-  // different keys. "Same key, therefore same value" is empty for a value that has none.
+  // Operand-free and pure like `laddr`, and out of raise/gvn.ts's NUMBERABLE set, which must keep
+  // it out: two undefs of one key are a storage's content and a `copied` move of it, and numbering
+  // them one value would erase the move.
   //
   // `key` names the storage (`sp@0`, `r4`); the structurer reads it to name the local
   // (`uninit_sp0`) and emits NO assignment — that absence is the recovery, and an edge argument
-  // that is one emits no copy either (structure.ts undefCarriesNothing).
+  // that is one emits no copy either (structure.ts undefCarriesNothing). OPTIONAL `copied: true`:
+  // the value another storage's content arrives at a join keyed elsewhere as (`if (c) x = y;` of
+  // two uninitialised locals, frontend/ssa.ts `markCopiedUndefs`) — the machine moved it, so that
+  // edge copy IS emitted, under the name of the undef its key names.
   undef: { operands: 0, results: 1, requiredAttrs: ['key'] },
   // --- black-box escape hatch (keeps lifting total) ---
   // `effects: true`: an instruction asmlift could not model may do anything — write memory, trap,
@@ -192,6 +279,11 @@ export const OPCODES = {
   // Many-way switch dispatch (Regime B, jump table). The single operand is the scrutinee;
   // successors are the N case blocks followed by the default block (the LAST successor);
   // `cases` is the index-aligned list of the first N successors' case values.
+  // `exhaustive: true` — OPTIONAL, set by a frontend whose dispatch block is entered only past a
+  // bounds test that already sent every value outside `cases` elsewhere, so the default edge is
+  // never taken. It still names a block, because the op needs a last successor; the structurer
+  // reads the attr to emit no `default:` arm for it. A pass that rebuilds the op leaves it off and
+  // gets the default arm back, which is the conservative answer.
   switch_br: { operands: 1, results: 0, terminator: true, successors: 'variadic', requiredAttrs: ['cases'] },
 } as const satisfies Record<string, OpSig>;
 
@@ -199,13 +291,87 @@ export const OPCODES = {
  *  does not. */
 export type Opcode = keyof typeof OPCODES;
 
+/** The width of a 64-bit IR value, named once so the three places that build one and the verifier
+ *  that checks them cannot come to disagree about it. */
+export const WIDE_BITS = 64;
+
 /** The widths a `zext`/`sext` carries — a fact about those two opcodes, so it lives with them
  *  rather than re-declared per consumer (raise/narrow.ts pairs a narrowing op with its re-widening,
  *  raise/paramwidth.ts declares a parameter at one). Every frontend that produces the pair produces
  *  one of these: agbcc's gated shift-pair fold (pattern/engine.ts CAST_PATTERNS) and PPC's
- *  `extsb`/`extsh` (frontend/ppc.ts). A third width would be a C type the backend cannot spell. */
+ *  `extsb`/`extsh` (frontend/ppc.ts). A third width would be a C type the backend cannot spell.
+ *
+ *  32 IS NOT ONE OF THEM, and the widening to 64 does not come here. The machine spells that widen
+ *  as a PAIR — agbcc `asr rN,rM,#31` or `mov rN,#0`, PPC `srawi`, MIPS `sra` — so it is a `concat`
+ *  shape (`concat(x, shr_s(x,31))` signed, `concat(x, const 0)` unsigned), which is also the only
+ *  form that says HOW the half was widened. This set keeps its one job: refuse an extension with no
+ *  C spelling. */
 export const CAST_WIDTHS: ReadonlySet<number> = new Set([8, 16]);
 
+/** The float opcodes: the only ops a `{kind:'float'}` value may be an operand or a result of,
+ *  besides `ret` (ir/verify.ts). Authored beside the registry because no signature field says what
+ *  an op computes ON. */
+export const FLOAT_OPS: ReadonlySet<string> = new Set(['fadd', 'fsub', 'fmul', 'fdiv', 'fneg', 'fconst']);
+
+/** The conversions out of a float into an integer, and into a float out of an integer. */
+export const FLOAT_TO_INT: ReadonlySet<string> = new Set(['fptosi', 'fptoui']);
+export const INT_TO_FLOAT: ReadonlySet<string> = new Set(['sitofp']);
+/** The conversions between the two precisions, each named by the width it converts from and to. */
+export const FLOAT_RESIZE: Readonly<Record<string, { from: 32 | 64; to: 32 | 64 }>> = {
+  fpext: { from: 32, to: 64 },
+  fptrunc: { from: 64, to: 32 },
+};
+
+/** The logical negation of each float compare, NaN included (the registry's note on `fcmp_*`):
+ *  expanded both ways from the pairs, as `NEGATED_ICMP` is. */
+const FCMP_NEGATION_PAIRS: readonly (readonly [Opcode, Opcode])[] = [
+  ['fcmp_oeq', 'fcmp_une'],
+  ['fcmp_olt', 'fcmp_uge'],
+  ['fcmp_ole', 'fcmp_ugt'],
+  ['fcmp_ogt', 'fcmp_ule'],
+  ['fcmp_oge', 'fcmp_ult'],
+];
+export const NEGATED_FCMP: Readonly<Record<string, Opcode>> = Object.fromEntries(
+  FCMP_NEGATION_PAIRS.flatMap(([a, b]) => [
+    [a, b],
+    [b, a],
+  ]),
+);
+
+/** What each float compare answers when its first operand is LESS than, EQUAL to or GREATER than
+ *  its second, and when the two are UNORDERED (either is a NaN): the definition of the ten, from
+ *  which a compare a runtime computes some other way is read (raise/floathelpers.ts). */
+export const FCMP_TRUTH: Readonly<Record<string, readonly [lt: boolean, eq: boolean, gt: boolean, un: boolean]>> = {
+  fcmp_olt: [true, false, false, false],
+  fcmp_ole: [true, true, false, false],
+  fcmp_ogt: [false, false, true, false],
+  fcmp_oge: [false, true, true, false],
+  fcmp_oeq: [false, true, false, false],
+  fcmp_une: [true, false, true, true],
+  fcmp_uge: [false, true, true, true],
+  fcmp_ugt: [false, false, true, true],
+  fcmp_ule: [true, true, false, true],
+  fcmp_ult: [true, false, false, true],
+};
+
+/** The float compare whose truth table (`FCMP_TRUTH`'s order: less, equal, greater, unordered) is
+ *  `truth`, or undefined where none is — always true, say. The one reader of the table backwards,
+ *  for every place that computes a compare's answers some other way (agbcc's helper tests,
+ *  raise/floathelpers.ts; PowerPC's `cror` of two bits, frontend/ppc.ts). */
+export function fcmpOfTruth(truth: readonly boolean[]): Opcode | undefined {
+  return Object.keys(FCMP_TRUTH).find((k) => FCMP_TRUTH[k].every((t, i) => t === truth[i])) as Opcode | undefined;
+}
+
+/** Every op that computes on a float: the arithmetic, the conversions and the compares. A runtime
+ *  helper whose op is one of these is a float helper (runtime-helpers.ts `isFloatHelper`). */
+export const FLOAT_COMPUTING: ReadonlySet<string> = new Set([
+  ...FLOAT_OPS,
+  ...FLOAT_TO_INT,
+  ...INT_TO_FLOAT,
+  ...Object.keys(FLOAT_RESIZE),
+  ...Object.keys(NEGATED_FCMP),
+]);
+
 /** Signature lookup by RUNTIME opcode string (Op.opcode is a plain string — IR consumers switch
  *  on it); undefined for an unregistered opcode. */
 export function opSig(opcode: string): OpSig | undefined {
@@ -214,21 +380,20 @@ export function opSig(opcode: string): OpSig | undefined {
 
 /** The comparison whose result is the logical NEGATION of each `icmp_*` — `!(a < b)` is `a >= b`.
  *
- *  Unlike EFFECTFUL_OPS/HOIST_UNSAFE_OPS below, this is AUTHORED data seated beside the registry,
- *  not a view derived from it: nothing in `OPCODES` states which comparison opposes which. What is
+ *  AUTHORED data seated beside the registry, not a view derived from it: nothing in `OPCODES`
+ *  states which comparison opposes which. What is
  *  derived is its SYMMETRY — the five involutive pairs are expanded both ways, so `neg(neg(c)) === c`
  *  holds by construction (a hand-written map is one typo away from breaking it, and the symptom is a
  *  plainly inverted condition in the emitted C). Completeness against the icmp family is the part
  *  construction cannot give, so a test asserts it (test/pattern.test.ts) — an eleventh comparison
  *  added to `OPCODES` would otherwise degrade its consumers several different ways.
  *
- *  It lives here for the reason HOIST_UNSAFE_OPS does: every consumer that has to say "the opposite
- *  of this compare" reads THIS one, so they
- *  cannot drift apart the way inline copies did. Two adjacent facts worth knowing: raise/
- *  shortcircuit.ts derives its `BOOL_OPS` from these keys (asserting negatable-icmp == boolean-op,
- *  true today), and l3/ast.ts `NEGATE_REL` is the SAME relation over the neutral L3 operator
- *  vocabulary — deliberately separate, because signedness lives in the operand types there, so the
- *  two tables are not candidates for further consolidation. */
+ *  It lives here so that every consumer that has to say "the opposite of this compare" reads THIS
+ *  one, and they cannot drift apart the way inline copies did. Two adjacent facts worth knowing: raise/
+ *  shortcircuit.ts derives its `BOOL_OPS` from these keys and `NEGATED_FCMP`'s (asserting
+ *  negatable compare == boolean-op, true today), and l3/ast.ts `NEGATE_REL` is the SAME relation
+ *  over the neutral L3 operator vocabulary — deliberately separate, because signedness lives in the
+ *  operand types there, so the two tables are not candidates for further consolidation. */
 const ICMP_NEGATION_PAIRS: readonly (readonly [Opcode, Opcode])[] = [
   ['icmp_eq', 'icmp_ne'],
   ['icmp_slt', 'icmp_sge'],
@@ -243,103 +408,17 @@ export const NEGATED_ICMP: Readonly<Record<string, Opcode>> = Object.fromEntries
   ]),
 );
 
-/** Ops with an observable side effect: the flag on the signature, derived rather than re-listed.
- *  `isDceSafe` asks the same question of the FLAG through `opSig` rather than of this set, so the
- *  two cannot disagree. The SET's own consumers are `HOIST_UNSAFE_OPS` below, structure.ts's
- *  block-purity tests (may this block be folded into a loop header, is this exit owned),
- *  analysis.ts's memory-write barrier, divpow2's bias block (which is DELETED rather than moved),
- *  and the idiom layer's de-sequencing guard (pattern/engine.ts). Derived rather than re-listed
- *  because three of those consumers each carried a hand-written copy of this membership, which is
- *  how the models drifted apart. */
-export const EFFECTFUL_OPS: ReadonlySet<string> = new Set(
-  (Object.keys(OPCODES) as Opcode[]).filter((k) => (OPCODES[k] as OpSig).effects),
-);
-
-/** Ops that may not be SPECULATED — run on a path that did not run them before. Identical to
- *  `EFFECTFUL_OPS`, and kept as its own name because its call sites ask the speculation question
- *  rather than the deletion one.
- *
- *  A memory read is deliberately absent, and that is the one entry worth arguing: its only consumer
- *  is raise/shortcircuit.ts, which hoists an arm's body into the block above, and the structurer
- *  inlines an unnamed value back into the `&&`/`||` right-hand side, where C's own short-circuit
- *  re-guards it. Adding the two reads
- *  here cost three byte-matches (kleod:UpdateHUDCounterDisplay, retired 2026-09-13 with its source,
- *  plus synthetic:breakloop and synthetic:strcmp1), so the argument was load-bearing rather than
- *  merely plausible. Not re-measured since the kleod row's retirement.
- *
- *  KNOWN GAP: the trapping divides are absent too, and there the re-guard argument does NOT carry
- *  — a hoisted `sdiv` that the structurer NAMES becomes an unconditional statement. Left as it is
- *  because closing it is a separate change with its own measurement; `REEVAL_UNSAFE_OPS` does
- *  refuse them, so the pre-update sink is not exposed to it.
- *
- *  AND THE EXEMPTION IS NOT TRANSFERABLE, which is worth saying beside it: a second consumer once
- *  read this set to answer "would gcc have SPECULATED this arm above a compare", where nothing
- *  re-guards anything, and admitted single-load arms `gcc/jump.c:483`'s `! may_trap_p` refuses.
- *  Pointing that consumer back at this set costs `synthetic:mergeldcast:agbcc` its byte-match
- *  (MATCH -> diff:6), measured. That consumer is `raise/narrowlocal.ts` and it reads
- *  `REEVAL_UNSAFE_OPS` instead. Reach for this set only when the argument above — a C-level
- *  re-guard at the new point — actually holds at your call site. */
-export const HOIST_UNSAFE_OPS: ReadonlySet<string> = EFFECTFUL_OPS;
-
 /** The ops whose `operands[0]` is a memory-access BASE: `load base`, `store base, value`,
  *  `aload base, index`, `astore base, index, value` (the operand roles are in the registry above).
  *  Authored rather than derived — no registry field records the operand ROLE, and the only other
  *  memory-touching opcode is `call`, whose variadic operands are arguments and not a base.
  *
- *  Two consumers ask two different questions of it and both need the same answer, which is why it
- *  is here and not next to either: `structure/analysis.ts` uses it for the address-home variation's slot
- *  model, and `raise/const.ts` to recognise a folded literal that IS an address. */
+ *  Three consumers ask three different questions of it and all need the same answer, which is why
+ *  it is here and not next to any: `structure/analysis.ts` uses it for the address-home variation's
+ *  slot model, `raise/const.ts` to recognise a folded literal that IS an address, and
+ *  `ir/discipline.ts` to tell a device access's `volatile` from a frame object's. */
 export const MEM_BASE_OPS: ReadonlySet<string> = new Set(['load', 'store', 'aload', 'astore']);
 
-/** Ops whose answer depends on WHERE they run: an effect (its order against other effects is
- *  observable) or a memory read (it answers whichever stores ran before it). The question a pass
- *  asks before moving a computation to another point on the SAME path. `SPELLED_WHEN_DEAD_OPS`
- *  below asks a DIFFERENT question and derives, today, the same set. */
-export const ORDER_SENSITIVE_OPS: ReadonlySet<string> = new Set(
-  (Object.keys(OPCODES) as Opcode[]).filter((k) => {
-    const sig = OPCODES[k] as OpSig;
-    return sig.effects || sig.reads;
-  }),
-);
-
-/** Ops the structurer must still SPELL when nothing consumes their result — an effect, or a memory
- *  READ. Consumer: structure.ts's `sideEffects` walk.
- *
- *  The read half is the entry worth arguing, because `reads` documents the OPPOSITE about C — a
- *  load nobody reads is deletable, nothing observes it. That is the C claim. The COMPILER claim
- *  points the other way: an optimizing compiler deletes every dead read it is ALLOWED to delete, so
- *  one still in the target is evidence the source's access was `volatile`. Membership here only
- *  says the structurer may not drop the op silently; whether a `volatile` can actually reach the
- *  access is a second, ADDRESS-level question the call site asks separately
- *  (structure.ts `volatileQualifiable`), and a read it answers no to is dropped as before.
- *
- *  DERIVED FROM THE REGISTRY, not aliased to `ORDER_SENSITIVE_OPS`, even though the two are
- *  extensionally identical today and `HOIST_UNSAFE_OPS` above does alias `EFFECTFUL_OPS`. An alias
- *  makes two DIFFERENT questions incapable of ever differing, so the day one of them acquires an
- *  opcode the other should not have, the edit lands on both silently. The identity is pinned by a
- *  test instead (test/pattern.test.ts), where a future divergence surfaces as a decision to make
- *  rather than a coupling nobody sees. */
-export const SPELLED_WHEN_DEAD_OPS: ReadonlySet<string> = new Set(
-  (Object.keys(OPCODES) as Opcode[]).filter((k) => {
-    const sig = OPCODES[k] as OpSig;
-    return sig.effects || sig.reads;
-  }),
-);
-
-/** Ops that may not be RE-EVALUATED at another program point — order-sensitive, or trapping. The
- *  trap half is what separates this from `ORDER_SENSITIVE_OPS`: it only matters when the new point
- *  can be reached on a path the old one was not, so a consumer that merely re-orders on one path
- *  wants the smaller set. Both are needed because the two consumers differ on exactly the divides:
- *  a collapsed switch re-renders a test block's ops AT THEIR USES, and every use is dominated by
- *  the def, so it evaluates them on a SUBSET of the original paths — a narrowing, never a
- *  speculation. */
-export const REEVAL_UNSAFE_OPS: ReadonlySet<string> = new Set(
-  (Object.keys(OPCODES) as Opcode[]).filter((k) => {
-    const sig = OPCODES[k] as OpSig;
-    return sig.effects || sig.reads || sig.traps;
-  }),
-);
-
 /** Ops that MATERIALIZE a value out of nothing: no operands, no state read, no effect, no trap, no
  *  control flow — so where one sits in a block says nothing about what ran before it. Derived, so a
  *  future pure nullary opcode joins without a second edit. Consumed by raise/paramwidth.ts, whose
@@ -352,10 +431,3 @@ export const MATERIALIZING_OPS: ReadonlySet<string> = new Set(
     return sig.operands === 0 && !sig.terminator && !sig.effects && !sig.reads && !sig.traps;
   }),
 );
-
-/** May a dead result of this opcode be deleted? Registered, no observable effects, not control
- *  flow. `opaque` is excluded via its `effects` flag — see the note on its signature. */
-export function isDceSafe(opcode: string): boolean {
-  const sig = opSig(opcode);
-  return !!sig && !sig.effects && !sig.terminator;
-}