@asmlift/core 0.8.1 → 0.10.0

package/src/ir/parse.ts

@@ -127,6 +127,7 @@ export function parse(text: string): Fn {
     writeOrder: undefined,
     slotHomes: undefined,
     paramEvidence: undefined,
+    localObjects: undefined,
   };
 }
 

package/src/ir/types.ts

@@ -7,6 +7,11 @@ export interface StructField {
   off: number;
   type: IrType;
   name: string;
+  /** A cell the function also reads or writes at another width or extension, declared at its
+   *  widest view because the union of its views would not fit the compiler's layout
+   *  (raise/structs.ts `buildUnionStruct`). An access of any other type is a cast of the base
+   *  (structure.ts `memAccess`). */
+  castViews?: true;
 }
 
 export type IrType =
@@ -17,13 +22,36 @@ export type IrType =
   // from `ptr(int)`+array-index because its access pattern is inconsistent with a homogeneous
   // array (mixed widths / non-uniform offsets). `name` is synthetic today (`Struct0`); a later
   // DWARF pass supplies real names. Fields are sorted by `off`.
-  | { kind: 'struct'; name: string; fields: StructField[]; size?: number }
+  //
+  // `declared` is a struct the project's HEADERS own — one a callee is declared to return
+  // (aggregate.ts `aggregateType`) — holding the headers' own spelling of it (`struct Blob64`,
+  // `BlobT`). No source this lift prints defines it: the declarations block does, which a candidate
+  // compiled inside the project's headers drops, since the headers define it there.
+  | { kind: 'struct'; name: string; fields: StructField[]; size?: number; declared?: string }
   // A fixed-length array `elem[count]`. Today its sole inhabitant is struct padding (a `u8[N]`
   // pad member seats fields at their exact offsets, raise/struct-arrays.ts) — a REAL type,
   // not a printed string. Array-typed fields declare with the length AFTER the name in C
   // (`u8 _pad[4]`), so the backend routes them through a declarator-aware `cDeclare`, not the
   // prefix `cType`.
   | { kind: 'array'; elem: IrType; count: number }
+  // Several VIEWS of one storage cell (raise/structs.ts): a base read or written at more than one
+  // width or extension over the same bytes. Every member sits at offset 0. It carries no name
+  // because it is only ever declared INLINE, as the type of the struct member that holds it, and its
+  // `size` is the one the target's compiler gives it — which is not always its widest view
+  // (`T.union` computes it from the compiler's aggregate boundary).
+  | { kind: 'union'; members: StructField[]; size: number }
+  // An IEEE floating-point value, single (32) or double (64). A KIND and not an `int` width, which is
+  // the one exception to the 64-bit rule at `ir/opcodes.ts` `concat` ("widen the number that is already
+  // there"): a float is not an integer of any width, so every pass that tests `kind === 'int'` must
+  // SKIP it rather than compute on it, and skipping is what a new kind buys. Its values live in the
+  // FPU's own register file, or in a soft-float runtime's register pair, and are computed only by
+  // the float opcodes (`fadd` …); `docs/floating-point.md` says which frontends mint one and what
+  // they still refuse. Two floats of different widths are different types (`typeEquals`), so a
+  // float op mixing them fails `ir/verify.ts`. A null width is a float whose code states no precision:
+  // a PowerPC FPR holds a double whichever the source declared, and `fneg`/`fmr` are one instruction
+  // for both, so `double dneg(double a){ return -a; }` and its `float` twin compile to one object.
+  // Either spelling reproduces it, and a declaration the caller supplies decides between them.
+  | { kind: 'float'; width: 32 | 64 | null }
   | { kind: 'void' }; // a function that returns nothing
 
 /** The scalar type of a memory access of `width` bytes: word ⇒ the s32 integer default;
@@ -34,6 +62,23 @@ export function scalarTypeForAccess(width: number, signed: boolean): IrType {
   return width === 4 ? T.s(32) : T.int(width * 8, signed);
 }
 
+/** The width in bits of the integer a type carries, or null where a type carries no integer. A
+ *  pointer's own width is the machine's and says nothing about what it addresses; an aggregate and
+ *  `void` have no single width at all. `unknown` DOES carry one, which is the point — before type
+ *  recovery every value is `unknown`, so a rule that skipped that kind would be vacuous exactly
+ *  where the frontends build these.
+ *
+ *  THE one copy, for the reason `scalarTypeForAccess` above is: its two consumers read the same
+ *  question under OPPOSITE policies, and a per-consumer copy is how they drift apart. `ir/verify.ts`
+ *  reads null as "this type does not take part in the width rule, so pass"; `runtime-helpers.ts`
+ *  reads null as "this operand carries no integer width, so refuse to fold a 64-bit operation over
+ *  it". Both want exactly this predicate — a pointer handed to `__muldi3` has no width either of
+ *  them may claim — so an `IrType` kind added here reaches the verifier and the recogniser together
+ *  or neither. */
+export function intWidth(t: IrType): number | null {
+  return t.kind === 'int' || t.kind === 'unknown' ? t.width : null;
+}
+
 export const T = {
   unk: (width = 32): IrType => ({ kind: 'unknown', width }),
   int: (width: number, signed: boolean): IrType => ({ kind: 'int', width, signed }),
@@ -42,9 +87,147 @@ export const T = {
   ptr: (to: IrType): IrType => ({ kind: 'ptr', to }),
   struct: (name: string, fields: StructField[], size?: number): IrType => ({ kind: 'struct', name, fields, size }),
   array: (elem: IrType, count: number): IrType => ({ kind: 'array', elem, count }),
+  // Its size is its widest view rounded up to the compiler's aggregate boundary (target.ts).
+  union: (members: StructField[], boundary: number): IrType => {
+    const extent = Math.max(...members.map((m) => (m.type.kind === 'array' ? m.type.count : 1) * viewBytes(m.type)));
+    return { kind: 'union', members, size: Math.ceil(extent / boundary) * boundary };
+  },
+  f32: (): IrType => ({ kind: 'float', width: 32 }),
+  f64: (): IrType => ({ kind: 'float', width: 64 }),
+  fUnstated: (): IrType => ({ kind: 'float', width: null }),
   void: (): IrType => ({ kind: 'void' }),
 };
 
+/** The member name of each view a union holds, by access width. A width with no entry has no view
+ *  (the deref contract admits no other scalar width either), and its overlap still declines. A
+ *  narrow width loaded with both extensions has a view per extension, `u`/`s` prefixed. */
+export const UNION_VIEW_NAMES: Readonly<Record<number, string>> = { 1: 'byte', 2: 'half', 4: 'word' };
+
+/** The extensions a union declares a view of `width` bytes in, from the accesses of that width:
+ *  THE one rule raise/structs.ts `buildUnionStruct` and the frame audit (frontend/frame-objects.ts
+ *  `unionViews`) both declare by, so a struct member's union and a frame object's cannot disagree
+ *  on their views. A word has one view whatever its loads say (`scalarTypeForAccess`); a narrower
+ *  width a view per extension it is LOADED with, unsigned first; a width only stored the signed
+ *  view where a stamped store says signed (raise/storesign.ts) and the unsigned one otherwise. */
+export function unionViewSigns(
+  width: number,
+  accesses: readonly { readonly isLoad: boolean; readonly signed: boolean; readonly stamped: boolean }[],
+): boolean[] {
+  if (width === 4) {
+    return [true];
+  }
+  const loaded = new Set(accesses.filter((a) => a.isLoad).map((a) => a.signed));
+  if (loaded.size === 0) {
+    return [accesses.some((a) => a.stamped && a.signed)];
+  }
+  return [false, true].filter((sg) => loaded.has(sg));
+}
+
+/** The byte width of a union view's element (an array view's element, or the scalar itself). */
+function viewBytes(t: IrType): number {
+  const e = t.kind === 'array' ? t.elem : t;
+  if (e.kind !== 'int') {
+    throw new Error(`a union view is an integer or an array of one, not '${typeToString(t)}'`);
+  }
+  return e.width / 8;
+}
+
+/** A struct as its declaration spells it (`declared`), else by its tag; any other type as printed. */
+export function structSpelling(t: IrType): string {
+  return t.kind === 'struct' ? (t.declared ?? `struct ${t.name}`) : typeToString(t);
+}
+
+/** The member `name` of an aggregate — a struct's field or a union's view — or undefined when `t`
+ *  is not an aggregate or declares no such member. THE one lookup the typing walk and the deref
+ *  contract share, so the two cannot disagree on which member access is well-typed. */
+export function memberOf(t: IrType | undefined, name: string): StructField | undefined {
+  if (t?.kind === 'struct') {
+    return t.fields.find((f) => f.name === name);
+  }
+  if (t?.kind === 'union') {
+    return t.members.find((m) => m.name === name);
+  }
+  return undefined;
+}
+
+/** The union member of a struct that holds byte `off`, and the view of it an access of `width`
+ *  bytes reads — the view of that width and, for a narrow LOAD, of that extension; a store, which
+ *  carries none, takes the width's only view or the unsigned one of two — with the element index
+ *  inside an ARRAY view (null for a scalar one). Undefined when no union member holds `off`; `view`
+ *  undefined when the member has no view for the access. */
+export function unionViewAt(
+  st: Extract<IrType, { kind: 'struct' }>,
+  off: number,
+  width: number,
+  signed: boolean,
+  isStore: boolean,
+): { member: StructField; view: StructField | undefined; index: number | null } | undefined {
+  const member = st.fields.find((f) => f.type.kind === 'union' && f.off <= off && off < f.off + f.type.size);
+  if (member === undefined || member.type.kind !== 'union') {
+    return undefined;
+  }
+  return { member, ...unionView(member.type, off - member.off, width, signed, isStore) };
+}
+
+/** Does a member declared at signedness `declared` read as EXACTLY the type the cast spelling this
+ *  replaces would have produced — `scalarTypeForAccess(width, signed)`? That is the whole
+ *  byte-exactness argument for naming a member instead of casting: same address, same read width,
+ *  same C type, so every operator downstream compiles identically. A 4-byte access renders s32
+ *  whatever the load said (the ISA has one word load), so only a SIGNED member may take its place;
+ *  narrower accesses carry their own signedness and must match it. An undeclared signedness (the
+ *  member is not a base type — a nested struct, an enum, a pointer) is never assumed to match.
+ *  THE one copy of "an access names the member": structure.ts's member spellings and `isCastView`
+ *  below all ask it, so they cannot drift apart. */
+export function spellsAccessType(declared: boolean | undefined, width: number, signed: boolean): boolean {
+  if (declared === undefined) {
+    return false;
+  }
+  return typeEquals(T.int(width * 8, declared), scalarTypeForAccess(width, signed));
+}
+
+/** Does an access of `width` bytes at byte `off`, inside a `castViews` field of the struct, read it
+ *  at a view other than the field's own type — another width or offset, or a load whose type the
+ *  field does not spell (`spellsAccessType`)? A store carries no extension (it truncates to the
+ *  field's bytes whatever their type), so one of the field's width at its offset is the field. */
+export function isCastView(
+  st: Extract<IrType, { kind: 'struct' }>,
+  off: number,
+  width: number,
+  signed: boolean,
+  isStore: boolean,
+): boolean {
+  const f = st.fields.find(
+    (m) => m.castViews === true && m.off <= off && off + width <= m.off + (intWidth(m.type) ?? 0) / 8,
+  );
+  if (f === undefined || f.type.kind !== 'int') {
+    return false;
+  }
+  return off !== f.off || f.type.width !== width * 8 || (!isStore && !spellsAccessType(f.type.signed, width, signed));
+}
+
+/** The view of a union an access of `width` bytes at byte `at` of it reads — the rule
+ *  `unionViewAt` states, asked of a union that is not a struct's member (a frame object declared
+ *  as one, structure.ts `laddrType`). */
+export function unionView(
+  u: Extract<IrType, { kind: 'union' }>,
+  at: number,
+  width: number,
+  signed: boolean,
+  isStore: boolean,
+): { view: StructField | undefined; index: number | null } {
+  const elemOf = (t: IrType): IrType => (t.kind === 'array' ? t.elem : t);
+  const wide = u.members.filter((m) => intWidth(elemOf(m.type)) === width * 8);
+  const signOf = (m: StructField): boolean | undefined => {
+    const e = elemOf(m.type);
+    return e.kind === 'int' ? e.signed : undefined;
+  };
+  const view =
+    width === 4 || (isStore && wide.length === 1)
+      ? wide[0]
+      : wide.find((m) => signOf(m) === (isStore ? false : signed));
+  return { view, index: view?.type.kind === 'array' ? at / width : null };
+}
+
 export function typeToString(t: IrType): string {
   switch (t.kind) {
     case 'unknown':
@@ -57,6 +240,10 @@ export function typeToString(t: IrType): string {
       return t.name;
     case 'array':
       return `${typeToString(t.elem)}[${t.count}]`;
+    case 'union':
+      return `union{${t.members.map((m) => `${typeToString(m.type)} ${m.name}`).join(';')}}`;
+    case 'float':
+      return `f${t.width ?? '?'}`;
     case 'void':
       return 'void';
   }
@@ -67,6 +254,9 @@ export function parseType(s: string): IrType {
   if (s.endsWith('*')) {
     return T.ptr(parseType(s.slice(0, -1)));
   }
+  if (s === 'f32' || s === 'f64' || s === 'f?') {
+    return s === 'f32' ? T.f32() : s === 'f64' ? T.f64() : T.fUnstated();
+  }
   const m = s.match(/^(unk|s|u)(\d+)$/);
   if (!m) {
     throw new Error(`bad type '${s}'`);
@@ -85,12 +275,22 @@ export function typeEquals(a: IrType, b: IrType): boolean {
   if (a.kind === 'int' && b.kind === 'int') {
     return a.width === b.width && a.signed === b.signed;
   }
-  if (a.kind === 'unknown' && b.kind === 'unknown') {
+  if (a.kind === 'void' && b.kind === 'void') {
+    return true;
+  }
+  if ((a.kind === 'unknown' && b.kind === 'unknown') || (a.kind === 'float' && b.kind === 'float')) {
     return a.width === b.width;
   }
   if (a.kind === 'array' && b.kind === 'array') {
     return a.count === b.count && typeEquals(a.elem, b.elem);
   }
+  if (a.kind === 'union' && b.kind === 'union') {
+    return (
+      a.size === b.size &&
+      a.members.length === b.members.length &&
+      a.members.every((m, i) => m.name === b.members[i].name && typeEquals(m.type, b.members[i].type))
+    );
+  }
   // Two structs are equal when their name + field layout match (recovered structs are named
   // by layout-discovery order, so equal name ⇒ equal layout in practice).
   if (a.kind === 'struct' && b.kind === 'struct') {

package/src/ir/verify.ts

@@ -3,16 +3,116 @@
 //   1. every block ends in exactly one terminator (and it is the last op)
 //   2. operands well-formed: opcode registered, correct arity/attrs
 //   3. SSA: each value defined once; every use is defined; def dominates use
-//   4. side data: a fn that carries a write-order record carries one for EVERY block, with every
+//   4. a float value is an operand or result of a float op, a conversion or a compare, or `ret` only
+//      — or a `double` operand of a call whose callee declares one there, or the result of a call
+//      whose callee is declared to return a `float` — and crosses an edge only
+//      into a block parameter of its own type; an `fconst` is a double, sixteen hex digits into an f64
+//   5. side data: a fn that carries a write-order record carries one for EVERY block, with every
 //      ordinal inside that block's own write count (ir/core.ts `WriteOrder`)
-import { Block, Fn, Value, dominators } from './core';
-import { opSig } from './opcodes';
+import { Block, Fn, Op, Value, dominators } from './core';
+import { isDoubleBits } from './float-bits';
+import { FLOAT_COMPUTING, FLOAT_OPS, FLOAT_RESIZE, FLOAT_TO_INT, INT_TO_FLOAT, WIDE_BITS, opSig } from './opcodes';
+import { type IrType, T, intWidth, typeEquals, typeToString } from './types';
 
 export class VerifyError extends Error {}
 
+/** A call hands a float only to a parameter its callee is declared to take a `double` in — the
+ *  operands the frontend lists in `doubles` — and returns one only where its callee is declared to
+ *  return a `float` (`floatReturn`), as that single. */
+function floatsDeclared(op: Op): boolean {
+  const at = Array.isArray(op.attrs.doubles) ? op.attrs.doubles : [];
+  return (
+    op.opcode === 'call' &&
+    op.results.every(
+      (r) => r.type.kind !== 'float' || (op.attrs.floatReturn === 'float' && typeEquals(r.type, T.f32())),
+    ) &&
+    op.operands.every((o, i) => o.type.kind !== 'float' || (at.includes(i) && typeEquals(o.type, T.f64())))
+  );
+}
+
+/** The ops where a float meets an integer or the other precision, each held to the one shape it
+ *  has: a conversion takes a float of either stated precision or none and gives an integer, or the
+ *  reverse; a resize takes its own source width to its own destination width; a compare takes two
+ *  floats of one type and gives a 32-bit integer. The integer side may be narrower than a word once
+ *  recovery has typed it (`(float)x` of a `short` parameter), which converts the value it promotes
+ *  to; the C spelling casts through `s32`/`s64`. */
+function verifyFloatCrossing(op: Op): void {
+  const ins = op.operands.map((o) => o.type);
+  const out = op.results[0].type;
+  const isInt = (t: IrType) => intWidth(t) !== null;
+  const resize = FLOAT_RESIZE[op.opcode];
+  const ok = FLOAT_TO_INT.has(op.opcode)
+    ? ins[0].kind === 'float' && isInt(out)
+    : INT_TO_FLOAT.has(op.opcode)
+      ? isInt(ins[0]) && out.kind === 'float'
+      : resize !== undefined
+        ? typeEquals(ins[0], resize.from === 64 ? T.f64() : T.f32()) &&
+          typeEquals(out, resize.to === 64 ? T.f64() : T.f32())
+        : ins[0].kind === 'float' && typeEquals(ins[0], ins[1]) && intWidth(out) === 32;
+  if (!ok) {
+    throw new VerifyError(`'${op.opcode}' does not take ${ins.map(typeToString).join(', ')} to ${typeToString(out)}`);
+  }
+}
+
 // Opcodes admitting EITHER a 2-operand register form OR a 1-operand + `imm` attr form.
 const TWO_OR_IMM = new Set(['sdiv', 'shl', 'shr_u', 'shr_s']);
 
+// ── 64 DOES NOT MIX ────────────────────────────────────────────────────────────────────────────
+// A 64-bit value is one `Value` whose type carries width 64 (ir/opcodes.ts, `concat`), so every
+// pass that reads `t.width` and is wrong about it is wrong HERE rather than three stages later. The
+// rule below is a QUARANTINE and not full width agreement, and the difference is measured rather
+// than stylistic: full agreement is already false on 32-bit IR, because `raise/paramwidth.ts`
+// narrows a parameter to 8 or 16 bits and `add(p_u8, x_s32)` is an ordinary correct shape. What
+// must hold is that a 64-bit operand never meets a 32-bit one in an op that computes on both.
+//
+// `unknown` PARTICIPATES, and that is the whole point: at L1 every value is `unknown`, so a rule
+// that skipped it would be vacuous exactly where this is meant to be red. The shifts count only
+// their SHIFTED operand — a 64-bit shift by a 32-bit count is what the machine does.
+const WIDTH_UNIFORM = new Set([
+  'add',
+  'sub',
+  'mul',
+  'and',
+  'or',
+  'xor',
+  'neg',
+  'neg_s',
+  'not',
+  'sdiv',
+  'udiv',
+  'smod',
+  'umod',
+]);
+// The shifts count only their SHIFTED operand: a 64-bit value shifted by a 32-bit count is what
+// every one of these machines does. The comparisons count only their OPERANDS: the result of a C
+// comparison is an `int` whatever it compared, which is what `raise/recover.ts` already types it.
+const SHIFTS = new Set(['shl', 'shr_u', 'shr_s']);
+const COMPARES = new Set([
+  'icmp_slt',
+  'icmp_sle',
+  'icmp_sgt',
+  'icmp_sge',
+  'icmp_ult',
+  'icmp_ule',
+  'icmp_ugt',
+  'icmp_uge',
+  'icmp_eq',
+  'icmp_ne',
+]);
+/** Whether `t` takes part in the width rule at all: it does exactly when it carries an integer
+ *  width. `ir/types.ts` owns that question — `raise/widehelpers.ts` asks it too, of the same kinds,
+ *  and reads the null with the opposite polarity. */
+const widthOf = intWidth;
+/** The types an op's width rule quantifies over. */
+const widthParticipants = (op: Op): IrType[] => {
+  const operands = op.operands.map((o) => o.type);
+  if (COMPARES.has(op.opcode)) {
+    return operands;
+  }
+  const results = op.results.map((r) => r.type);
+  return SHIFTS.has(op.opcode) ? [...results, ...operands.slice(0, 1)] : [...results, ...operands];
+};
+
 export function verify(fn: Fn): void {
   if (fn.blocks.length === 0) {
     throw new VerifyError(`fn '${fn.name}' has no blocks`);
@@ -104,11 +204,118 @@ export function verify(fn: Fn): void {
           if (!isTerm && op.successors.length) {
             throw new VerifyError(`non-terminator '${op.opcode}' has successors`);
           }
+          // `laddr` carries two shapes in one set of attrs and `count` is the only thing telling
+          // them apart: one element is a SCALAR typed by the accesses the frame-object audit read
+          // off the machine, and more than one is STORAGE that audit sized without typing, whose
+          // width and signedness are therefore not an access at all. The structurer declares the
+          // second as `u8 name[count]`, so a typed element there would be a type nothing pinned —
+          // the exact answer the audit refuses to invent. (One BYTE encodes like a real `u8`
+          // scalar either way; the declaration is the same one, so nothing has to tell them apart.)
+          if (op.opcode === 'laddr') {
+            const count = op.attrs.count;
+            if (typeof count !== 'number' || !Number.isInteger(count) || count < 1) {
+              throw new VerifyError(`'laddr' count must be a positive integer, got ${String(count)}`);
+            }
+            if (count > 1 && (op.attrs.width !== 1 || op.attrs.signed !== false)) {
+              throw new VerifyError(
+                `'laddr' of ${count} elements is storage no access typed, so it must be unsigned bytes — ` +
+                  `got width ${String(op.attrs.width)}, signed ${String(op.attrs.signed)}`,
+              );
+            }
+            // …and a PART of the one object (frame-objects.ts `provenParts`) is such storage too
+            if (op.attrs.part !== undefined && op.attrs.part !== true) {
+              throw new VerifyError(`'laddr' part must be true, got ${String(op.attrs.part)}`);
+            }
+            if (op.attrs.part === true && count < 2) {
+              throw new VerifyError(`'laddr' part must be storage of two or more bytes, got ${count}`);
+            }
+            // …and storage accessed at two widths over one byte names the VIEWS a union of it
+            // declares (frame-objects.ts `unionViews`): one per element width in bytes, negative
+            // for a signed narrow one, each tiling the storage — so at least two, distinct, of a
+            // width a view is named for, and a word never signed-marked (it has one view).
+            const views = op.attrs.views;
+            if (views !== undefined) {
+              const ok =
+                Array.isArray(views) &&
+                count > 1 &&
+                views.length >= 2 &&
+                new Set(views).size === views.length &&
+                views.every((v) => [1, 2, 4, -1, -2].includes(v) && count % Math.abs(v) === 0);
+              if (!ok) {
+                throw new VerifyError(
+                  `'laddr' views must be two or more distinct element widths (1, 2, 4; negative for a signed ` +
+                    `narrow view) tiling its ${String(count)} bytes, got ${JSON.stringify(views)}`,
+                );
+              }
+            }
+          }
+          // A 64-bit value is BUILT and TAKEN APART by exactly these three, so their shape is
+          // checked here rather than left to whoever reads a half. `concat` is the only producer.
+          if (op.opcode === 'concat' || op.opcode === 'lo32' || op.opcode === 'hi32') {
+            const wide = op.opcode === 'concat' ? op.results[0].type : op.operands[0].type;
+            const narrow = op.opcode === 'concat' ? op.operands.map((o) => o.type) : op.results.map((r) => r.type);
+            const wideW = widthOf(wide);
+            if (wideW !== WIDE_BITS) {
+              throw new VerifyError(
+                `'${op.opcode}' ${op.opcode === 'concat' ? 'result' : 'operand'} must be an integer of ` +
+                  `width ${WIDE_BITS}, got ${String(wideW ?? wide.kind)}`,
+              );
+            }
+            for (const t of narrow) {
+              if (widthOf(t) !== 32) {
+                throw new VerifyError(
+                  `'${op.opcode}' half must be an integer of width 32, got ${String(widthOf(t) ?? t.kind)}`,
+                );
+              }
+            }
+          }
+          // …and everywhere else, 64 does not mix (see the header above this file's checks).
+          if (WIDTH_UNIFORM.has(op.opcode) || SHIFTS.has(op.opcode) || COMPARES.has(op.opcode)) {
+            const ws = widthParticipants(op)
+              .map(widthOf)
+              .filter((w): w is number => w !== null);
+            if (ws.some((w) => w === WIDE_BITS) && ws.some((w) => w !== WIDE_BITS)) {
+              throw new VerifyError(
+                `'${op.opcode}' mixes a ${WIDE_BITS}-bit operand with a narrower one (widths ${ws.join(', ')})`,
+              );
+            }
+          }
+          // A FLOAT IS COMPUTED ON BY THE FLOAT OPS AND RETURNED, AND NOTHING ELSE TOUCHES IT. Both
+          // halves are checked, because each is a silent wrong the other cannot see: a float op over
+          // an integer is a frontend that lost track of a register file, and an integer op over a
+          // float is a pass that matched an opcode without asking what it computes on.
+          const floats = [...op.operands, ...op.results].map((v) => v.type).filter((t) => t.kind === 'float');
+          if (FLOAT_OPS.has(op.opcode)) {
+            const all = [...op.operands, ...op.results].map((v) => v.type);
+            if (floats.length !== all.length || all.some((t) => !typeEquals(t, all[0]))) {
+              throw new VerifyError(`'${op.opcode}' computes on floats only, got ${all.map(typeToString).join(', ')}`);
+            }
+          } else if (FLOAT_COMPUTING.has(op.opcode)) {
+            verifyFloatCrossing(op);
+          } else if (floats.length > 0 && op.opcode !== 'ret' && !floatsDeclared(op)) {
+            throw new VerifyError(`a float value reaches '${op.opcode}', which does not compute on floats`);
+          }
+          // A literal's width is its pattern's, so the pattern and the result must name one width.
+          if (op.opcode === 'fconst' && (!isDoubleBits(op.attrs.bits) || !typeEquals(op.results[0].type, T.f64()))) {
+            throw new VerifyError(
+              `'fconst' is a double literal: bits ${JSON.stringify(op.attrs.bits)} into ${typeToString(op.results[0].type)}`,
+            );
+          }
           for (const k of sig.requiredAttrs ?? []) {
             if (!(k in op.attrs)) {
               throw new VerifyError(`'${op.opcode}' missing required attr '${k}'`);
             }
           }
+          if (op.opcode === 'call') {
+            const named = typeof op.attrs.target === 'string';
+            const indirect = op.attrs.indirect === true;
+            if (named === indirect || 'target' in op.attrs !== named || (indirect && op.operands.length === 0)) {
+              throw new VerifyError(
+                "'call' names its callee in a string 'target' or calls the value in its last operand under " +
+                  "'indirect', and does exactly one of the two",
+              );
+            }
+          }
           for (const u of op.operands) {
             if (!defined.has(u)) {
               throw new VerifyError(`use of undefined value in '${op.opcode}'`);
@@ -128,6 +335,15 @@ export function verify(fn: Fn): void {
                 throw new VerifyError(`use of undefined value in successor args of '${op.opcode}'`);
               }
             }
+            // …and a float crosses an edge only into a block parameter of its own type.
+            s.args.forEach((u, i) => {
+              const p = s.block.params[i].type;
+              if ((u.type.kind === 'float' || p.kind === 'float') && !typeEquals(u.type, p)) {
+                throw new VerifyError(
+                  `successor of '${op.opcode}' passes a ${typeToString(u.type)} to a ${typeToString(p)} block parameter`,
+                );
+              }
+            });
           }
         },
         () => at(b, idx),

package/src/l3/address.ts

@@ -33,6 +33,11 @@ export const baseConst = (e: Expr): number | null =>
       ? baseConst(e.e)
       : null;
 
+/** Does this base already assert volatility — a `volatile` cast at any depth of the cast chain? A
+ *  respell variation that replaces such a base drops the qualifier with it, and every access
+ *  through it becomes a plain one agbcc may delete or hoist. */
+export const qualifiedBase = (e: Expr): boolean => e.k === 'cast' && (e.volatile === true || qualifiedBase(e.e));
+
 /** the numeric address an expression IS, through any number of pointer casts */
 export const addrConst = (e: Expr): number | null =>
   e.k === 'const' ? e.value : e.k === 'cast' && e.to.kind === 'ptr' ? addrConst(e.e) : null;

package/src/l3/argcopy.ts

@@ -101,9 +101,12 @@ export interface ArgCopyRegionCtx {
   readonly reads: number;
   /** a loop encloses the region — its own body, or any list nested below one */
   readonly underLoop: boolean;
+  /** the region is ONE basic block: no statement opens a nested list, and no expression holds a
+   *  short-circuit connective */
+  readonly straightLine: boolean;
 }
 
-/** Which regions are worth offering. NEITHER is sound — each refuses a spelling that is correct
+/** Which regions are worth offering. NONE is sound — each refuses a spelling that is correct
  *  but models nothing, and what they buy is the candidate count: every one of these is a COMPILE,
  *  and this variation multiplies with `/coalesce`. */
 export const ARGCOPY_REGION_GATES: readonly Gate<ArgCopyRegionCtx>[] = [
@@ -117,13 +120,37 @@ export const ARGCOPY_REGION_GATES: readonly Gate<ArgCopyRegionCtx>[] = [
     id: 'loop-region',
     why: 'a copy anywhere inside a loop re-runs every iteration, so it belongs to a region that holds the loop instead — and no region does when the loop is at function top level, where this variation offers nothing at all',
     sound: false,
-    // the second clause has its own test, which `guardedBy` cannot also name (one title per gate):
-    // `argcopy.test.ts: a TOP-LEVEL loop is offered NOTHING`
-    guardedBy: 'argcopy.test.ts: an arm NESTED inside a loop body is refused too',
+    guardedBy: [
+      'argcopy.test.ts: an arm NESTED inside a loop body is refused too',
+      'argcopy.test.ts: a TOP-LEVEL loop is offered NOTHING',
+    ],
     rejects: (c) => c.underLoop,
   },
+  {
+    id: 'straight-line',
+    why: 'a copy whose every read sits in one basic block is forward-propagated away by every compiler in the matrix, so the copy is erased — a `&&` or `||` in the region is an edge the copy can live across, and such a region is offered',
+    sound: false,
+    guardedBy: 'argcopy.test.ts: a STRAIGHT-LINE region is refused',
+    rejects: (c) => c.straightLine,
+  },
 ];
 
+/** Whether `list` is one basic block. A nested list is a branch or a loop; a short-circuit
+ *  connective is a branch too — `p[3] = p[0] > v && p[4] < v` is two blocks, and agbcc keeps a
+ *  copy live across that edge (the synthetic `leafand` row matches only through it). `walkExprs` for the
+ *  reason `countReads` gives: it is the walk `repoint` rewrites by. */
+function isStraightLine(list: Stmt[]): boolean {
+  if (list.some((st) => stmtLists(st).length > 0)) {
+    return false;
+  }
+  for (const e of walkExprs(list)) {
+    if (e.k === 'bin' && (e.op === '&&' || e.op === '||')) {
+      return false;
+    }
+  }
+  return true;
+}
+
 /** How many `var n` leaves the region holds, nested statements included — the region rules'
  *  yardstick for whether a copy has a range to shorten.
  *
@@ -176,7 +203,8 @@ function regions(body: Stmt[]): { at: number[]; list: Stmt[]; underLoop: boolean
  *  for > do-while > if > store). This runs once per region per parameter per candidate, and each
  *  candidate is a compile. */
 function repoint(list: Stmt[], n: string, to: string): Stmt[] {
-  const inExpr = (e: Expr): Expr => (e.k === 'var' && e.name === n ? { ...e, name: to } : mapExprChildren(e, inExpr));
+  const inExpr = (e: Expr): Expr =>
+    (e.k === 'var' || e.k === 'postincr') && e.name === n ? { ...e, name: to } : mapExprChildren(e, inExpr);
   return list.map((s) => mapStmtExprs(s, inExpr));
 }
 
@@ -238,7 +266,11 @@ export function argCopyUnder(
       if (reads === 0) {
         continue;
       }
-      const regionRefused = firstRejection(regionGates, { reads, underLoop: r.underLoop });
+      const regionRefused = firstRejection(regionGates, {
+        reads,
+        underLoop: r.underLoop,
+        straightLine: isStraightLine(r.list),
+      });
       if (regionRefused !== null) {
         refusals.set(regionRefused, (refusals.get(regionRefused) ?? 0) + 1);
         continue;