@asmlift/core 0.8.1 → 0.10.0

package/src/l3/basecse.ts

@@ -248,15 +248,35 @@ function collect(stmts: Stmt[], c: Collected, loop: boolean): void {
   }
 }
 
-/** Rewrite every `index`-of-hoistable-base whose key is hoisted so its base becomes the hoist local. */
-function rewrite(e: Expr, localFor: Map<string, string>): Expr {
+/** Rewrite every `index`-of-hoistable-base whose key is hoisted so its base becomes the hoist local.
+ *
+ *  A `volatile` cast over a hoisted LEAF keeps its cast and takes the local under it:
+ *  `((volatile s32 *)0x40000D4)[2]` beside a hoisted `p0 = (s32 *)0x40000D4` becomes
+ *  `((volatile s32 *)p0)[2]`. The cast is never hoisted itself (`isHoistableBase`), since the local
+ *  would drop its qualifier; under it the local is the same address, so the access keeps its
+ *  qualifier and its cell, and reads the register the compiler already holds the base in. Inline, a
+ *  qualified access at a nonzero offset makes agbcc materialize a second literal with the offset
+ *  folded in (`.word 0x40000dc` + `ldr r0, [r0]`) where the source read `[r4, #0x8]` off the base
+ *  it had loaded — the `dmaRegs[2];` that ends a DMA macro. `leafLocal` maps a hoisted leaf to its
+ *  local, whichever key hoisted it. */
+function rewrite(e: Expr, localFor: Map<string, string>, leafLocal: ReadonlyMap<string, string>): Expr {
   if (e.k === 'index' && isHoistableBase(e.base)) {
     const nm = localFor.get(keyOf(e.base, e.width, e.signed));
     if (nm) {
-      return { ...e, base: { k: 'var', name: nm }, idx: rewrite(e.idx, localFor) };
+      return { ...e, base: { k: 'var', name: nm }, idx: rewrite(e.idx, localFor, leafLocal) };
+    }
+  }
+  if (e.k === 'index' && e.base.k === 'cast' && e.base.volatile === true && isHoistableLeaf(e.base.e)) {
+    const nm = leafLocal.get(leafId(e.base.e));
+    if (nm) {
+      return {
+        ...e,
+        base: { ...e.base, e: { k: 'var', name: nm } },
+        idx: rewrite(e.idx, localFor, leafLocal),
+      };
     }
   }
-  return mapExprChildren(e, (c) => rewrite(c, localFor));
+  return mapExprChildren(e, (c) => rewrite(c, localFor, leafLocal));
 }
 
 /** One base under consideration, keyed as `(base, width, signedness)`. */
@@ -784,7 +804,15 @@ export function hoistBaseLocals(
     });
   }
 
-  const rewritten = sfn.body.map((s) => mapStmtExprs(s, (e) => rewrite(e, localFor)));
+  const leafLocal = new Map<string, string>();
+  for (const k of hoisted) {
+    const b = meta.get(k)!.base;
+    const leaf = leafId(b.k === 'cast' ? b.e : b);
+    if (!leafLocal.has(leaf)) {
+      leafLocal.set(leaf, localFor.get(k)!);
+    }
+  }
+  const rewritten = sfn.body.map((s) => mapStmtExprs(s, (e) => rewrite(e, localFor, leafLocal)));
   // The new inits join the tree's LEADING run of base inits rather than being prepended above it:
   // when rank's /livebase re-runs this pass the head already carries the default run's, and
   // blindly prepending would spell the new base's pool load above locals the compiler loads first.

package/src/l3/coalesce.ts

@@ -12,23 +12,24 @@
 // and whether fall-through joins the two arms onto one path. `coalesceCandidates` offers both.
 import { typeToString } from '../ir/types';
 import type { Expr, SFn, Stmt } from './ast';
-import { exprChildren, isLoop, mapExprChildren, stmtChildren, stmtExprs } from './ast';
+import { exprChildren, isLoop, mapExprChildren, mentionedName, stmtChildren, stmtExprs } from './ast';
 import { type Gate, firstRejection } from './gates';
 
 function namesIn(e: Expr, out: Set<string>): void {
-  // `addr` names a GLOBAL (`&gSym`) or a LOCAL — the structurer renders an `laddr` frame object
-  // as `&sp0`, an addr node over a name that IS in `sfn.locals`. Both are collected, because a
-  // name mentioned only through `&` still has a live range: a span that ignored its `addr`
-  // mentions would be SHORT, and a short span is a clobber where a long one is only a missed
-  // merge. Collecting a global name costs nothing — it is not in `sfn.locals`, so no pair is
-  // ever built for it.
+  // EVERY mention, through `mentionedName`'s vocabulary rather than this file's own: a span that
+  // misses one is SHORT, and a short span is a clobber where a long one is only a missed merge.
+  // `&sp0` is a LOCAL's mention — the structurer renders an `laddr` frame object as an addr node
+  // over a name that IS in `sfn.locals` — and `n++` in a bottom test is a counter's only mention
+  // inside its own loop. A global name comes along for the ride and costs nothing — it is not in
+  // `sfn.locals`, so no pair is ever built for it.
   //
-  // `rename` DISAGREES WITH THIS, and knowingly: it rewrites only `var` leaves, so a local
-  // absorbed while mentioned through `&` leaves that mention standing against a declaration the
-  // merge deleted. Reconciling the two changes which candidates compile — a measured change, not a
+  // `rename` DISAGREES WITH THIS, and knowingly: it rewrites `var` and `postincr` leaves, so a
+  // local absorbed while mentioned through `&` leaves that mention standing against a declaration
+  // the merge deleted. Reconciling the two changes which candidates compile — a measured change, not a
   // cleanup — so today's behaviour is pinned exactly in coalesce.test.ts ('rename') rather than
   // repaired here.
-  if (e.k === 'var' || e.k === 'addr') out.add(e.name);
+  const n = mentionedName(e);
+  if (n !== undefined) out.add(n);
   for (const c of exprChildren(e)) namesIn(c, out);
 }
 
@@ -62,7 +63,14 @@ export interface Span {
  *  arithmetic over the variable is its own history. The read must be a `var`: `mentions` counts an
  *  `addr` too, and `&a` is not a read of `a`. */
 const readsVarArithmetically = (e: Expr, n: string): boolean => {
-  if (e.k === 'index' || e.k === 'field' || e.k === 'call' || e.k === 'marker' || e.k === 'addr') {
+  if (
+    e.k === 'index' ||
+    e.k === 'field' ||
+    e.k === 'call' ||
+    e.k === 'marker' ||
+    e.k === 'postincr' ||
+    e.k === 'addr'
+  ) {
     return false;
   }
   return (e.k === 'var' && e.name === n) || exprChildren(e).some((c) => readsVarArithmetically(c, n));
@@ -155,7 +163,7 @@ function spans(body: Stmt[]): Map<string, Span> {
 }
 function rename(body: Stmt[], from: string, to: string): Stmt[] {
   const inExpr = (e: Expr): Expr =>
-    e.k === 'var' && e.name === from ? { ...e, name: to } : mapExprChildren(e, inExpr);
+    (e.k === 'var' || e.k === 'postincr') && e.name === from ? { ...e, name: to } : mapExprChildren(e, inExpr);
   const inStmt = (s: Stmt): Stmt => {
     const r = { ...s } as Record<string, unknown>;
     if (s.k === 'assign' && s.name === from) r.name = to;

package/src/l3/constinit.ts

@@ -0,0 +1,382 @@
+// asmlift — a local aggregate's constant INITIALIZER, recovered from the copy that fills it.
+//
+// `u8 a[16] = { 0, 1, 2, … };` is not a statement in the machine. A compiler that keeps the
+// aggregate in memory places the initial image as a constant of its own, under a label the source
+// never wrote, and copies it into the frame at entry: agbcc 2.9 writes `.LC0:` in .rodata and
+// `ldr r1,=.LC0; mov r0,sp; mov r2,#16; bl memcpy` (varasm.c `output_constant_def`, expr.c
+// `store_constructor` → `emit_block_move`). The lift reads that image as an ANONYMOUS object
+// (ir/core.ts `LocalObject.anonymous`), so the tree holds the copy as written —
+// `memcpy(sp0, .LC0, 16)` — and the image in `SFn.images`, which no declaration spells. This pass
+// spells the pair back as the declaration it came from: the local's initializer, and no copy.
+//
+// IT RUNS AT EMISSION, NOT IN STRUCTURE. Between the two the tree belongs to the contracts and the
+// respell variations, and every one of them is right about the copy as it stands: it is a call the
+// asm makes (contracts.ts `assertEffectsPreserved` counts it), and it takes the local's address,
+// which is what keeps dead-store elimination and the coalescers off the object. A folded tree
+// would hold a local nothing mentions, which l3/dce.ts deletes — and with it the initializer the
+// compiler keeps (agbcc copies `u8 a[16] = {…}` even when nothing reads `a`). So structure()
+// asks this pass whether the fold is possible and refuses the function loudly where it is not,
+// and the C-family emitter folds (backend/cfamily.ts), the same seam l3/slotorder.ts uses.
+//
+// THE FOLD IS SOUND exactly when the declaration's initializer and the copy are one program:
+//   • the copy is a block copy the C standard fixes (proto.ts `blockCopyRoles`), a TOP-LEVEL
+//     statement of the body, so it runs once and on every path that reaches it;
+//   • its destination is a whole local integer array of the copied size — or a reservation the
+//     frame rounded up by less than a word, reached by nothing but elements inside the copy and its
+//     whole address — not volatile, and nothing before the copy mentions it but a local assigned
+//     its address alone, so moving the copy to the declaration changes no value anything reads (an
+//     initializer runs at entry, the copy at its own position);
+//   • its source is the whole image, which nothing but such copies mentions, and whose size is the
+//     count — one image may fill several locals, since the compiler places one per identical
+//     constant (varasm.c `output_constant_def`), each into its own local. Several arrays in one
+//     frame are each their own local where the frame audit proves the boundaries between them
+//     (frontend/frame-objects.ts `provenParts`). KNOWN GAP: where it keeps the frame's
+//     address-taken bytes as one local instead — a neighbour handed to a callee nothing bounds, or
+//     a compiler whose placement of such arrays is not known (target.ts `addressTakenArrayOrder`)
+//     — the image refuses at the size check;
+//   • the image writes one element width (a struct's mixed widths, or padding alone, has no
+//     element type this pass could declare). An element it relocates holds an address, spelled as
+//     the address constant it is (`u32 a[16] = { (u32)&h1, … }`, which agbcc copies from the same
+//     `.word h1` image as the pointer array the source declared, compiled).
+// The local keeps its own element type where the body reaches it by an offset or a cast — those
+// were spelled against it, so its width must be the image's — and takes the image's where only
+// its whole address and element accesses, which each print their own width, reach it.
+//
+// Thumb is the only frontend that reads an anonymous image today. The rule is asked of the tree,
+// for any compiler, but the only copy it reads is a call (proto.ts `blockCopyRoles`). KNOWN GAP: an
+// INLINE copy — agbcc's `ldmia`/`stmia` for a word-aligned image below its memcpy sizes, lw/sw or
+// lwl/lwr+swl/swr (IDO, gcc 2.7.2, KMC), lwz/stw (mwcc) — declines, naming the copy it does not
+// read; no benchmark row has one, and the MIPS and PPC frontends refuse the address-taken frame
+// local before the copy is reached.
+import { type IrType, typeToString } from '../ir/types';
+import { blockCopyRoles } from '../proto';
+import {
+  type Expr,
+  type InitAddress,
+  type SFn,
+  type SImage,
+  type Stmt,
+  mapExprChildren,
+  mapStmtExprs,
+  mentionedName,
+  walkExprs,
+} from './ast';
+import { localMentions, mentionsAnyLocal } from './mentions';
+
+/** `e` without the casts around it. */
+function bare(e: Expr): Expr {
+  return e.k === 'cast' ? bare(e.e) : e;
+}
+
+/** The value of `e` where it is integer arithmetic on constants alone, or null. A copy's count is
+ *  a constant the machine may build in several instructions — agbcc spells 256 and up as an 8-bit
+ *  immediate shifted (`mov r2,#0x80; lsl r2,r2,#1`), which the tree keeps as `128 << 1`. */
+function constantValue(e: Expr): number | null {
+  const b = bare(e);
+  if (b.k === 'const') {
+    return b.value;
+  }
+  if (b.k !== 'bin') {
+    return null;
+  }
+  const l = constantValue(b.l);
+  const r = constantValue(b.r);
+  if (l === null || r === null) {
+    return null;
+  }
+  switch (b.op) {
+    case '+':
+      return l + r;
+    case '-':
+      return l - r;
+    case '*':
+      return l * r;
+    case '<<':
+      return r >= 0 && r < 32 ? l * 2 ** r : null;
+    case '|':
+      return l >= 0 && r >= 0 && l < 2 ** 31 && r < 2 ** 31 ? l | r : null;
+    default:
+      return null;
+  }
+}
+
+/** The object `e` names whole — `x` or `&x` — or null. */
+function wholeObject(e: Expr): string | null {
+  const b = bare(e);
+  return b.k === 'postincr' ? null : (mentionedName(b) ?? null);
+}
+
+/** Every mention of `name` as an expression in `body`. */
+function mentions(body: readonly Stmt[], name: string): number {
+  let n = 0;
+  for (const e of walkExprs(body as Stmt[])) {
+    if (mentionedName(e) === name) {
+      n++;
+    }
+  }
+  return n;
+}
+
+const byteSize = (t: IrType): number | null =>
+  t.kind === 'int'
+    ? t.width / 8
+    : t.kind === 'array'
+      ? (() => {
+          const e = byteSize(t.elem);
+          return e === null ? null : e * t.count;
+        })()
+      : null;
+
+/** `v`, an element of `width` bytes, read at the given signedness. */
+function resign(v: number, width: number, signed: boolean): number {
+  const bits = 8 * width;
+  const u = ((v % 2 ** bits) + 2 ** bits) % 2 ** bits;
+  return signed && u >= 2 ** (bits - 1) ? u - 2 ** bits : u;
+}
+
+/** One copy's fold: the copy statement's index, the local and its declaration. */
+interface Fold {
+  at: number;
+  local: string;
+  type: IrType;
+  init: (number | InitAddress | null)[];
+  string: boolean;
+}
+
+/** Why `image` cannot fold, as the tail of a sentence naming it, or the fold of each copy of it. */
+function planFolds(sfn: SFn, image: SImage): Fold[] | string {
+  if (image.type.kind !== 'array' || image.type.elem.kind !== 'int') {
+    return 'whose image writes no one element width — a struct, or padding alone';
+  }
+  const copies: number[] = [];
+  sfn.body.forEach((s, i) => {
+    if (
+      s.k === 'exprstmt' &&
+      s.value.k === 'call' &&
+      wholeObject(s.value.args[blockCopyRoles(s.value.fn)?.src ?? -1] ?? { k: 'const', value: 0 }) === image.name
+    ) {
+      copies.push(i);
+    }
+  });
+  if (copies.length === 0) {
+    return (
+      'which no top-level block-copy call (memcpy) takes as its source — the one copy folded into an ' +
+      'initializer; an inline, element-by-element copy of the image, and any other read of it, is not'
+    );
+  }
+  if (mentions(sfn.body, image.name) !== copies.length) {
+    return 'which the body reads other than as the source of a block copy at the top level';
+  }
+  const folds: Fold[] = [];
+  for (const at of copies) {
+    const fold = planCopy(sfn, image, at);
+    if (typeof fold === 'string') {
+      return fold;
+    }
+    folds.push(fold);
+  }
+  return folds;
+}
+
+/** Why the block copy of `image` at body index `at` cannot fold, or its fold. */
+function planCopy(sfn: SFn, image: SImage, at: number): Fold | string {
+  const elem = (image.type as Extract<IrType, { kind: 'array' }>).elem as Extract<IrType, { kind: 'int' }>;
+  const size = byteSize(image.type)!;
+  const call = (sfn.body[at] as Extract<Stmt, { k: 'exprstmt' }>).value as Extract<Expr, { k: 'call' }>;
+  const roles = blockCopyRoles(call.fn)!;
+  if (constantValue(call.args[roles.n] ?? { k: 'var', name: '' }) !== size) {
+    return `whose copy does not move its whole ${size} bytes`;
+  }
+  const local = wholeObject(call.args[roles.dst] ?? { k: 'const', value: 0 });
+  const decl = sfn.locals.find((l) => l.name === local);
+  if (local === null || decl === undefined) {
+    return 'whose copy does not fill a local of this function';
+  }
+  if (decl.init !== undefined) {
+    return `whose copy fills '${local}', which another image already initializes`;
+  }
+  if (decl.volatile || decl.pointeeVolatile) {
+    return `whose copy fills '${local}', which is volatile`;
+  }
+  const declElem = decl.type.kind === 'array' ? decl.type.elem : null;
+  const declSize = byteSize(decl.type);
+  // The copy moves the whole object — a brace initializer's image carries its zero tail — so the
+  // count is the object's size, and a reservation the frame audit measured wider by less than a
+  // word is the frame's own rounding (agbcc rounds a 6-byte array's frame to 8).
+  if (declElem === null || declElem.kind !== 'int' || declSize === null || declSize < size || declSize - size >= 4) {
+    return `whose copy fills '${local}', a ${typeToString(decl.type)}, which is not an integer array of its ${size} bytes`;
+  }
+  // A local that holds nothing but the local's address — `p0 = (u8 *)&sp0;`, the base the
+  // readability hoist (l3/basecse.ts) places at the head of the body, ahead of the copy — reads no
+  // element where it is assigned, so the copy may move past it; its uses are the local's.
+  const aliasAt = aliasesOf(sfn, local);
+  const reach = new Set([local, ...aliasAt.keys()]);
+  const aliasing = new Set(aliasAt.values());
+  const kept = sfn.body.filter((_, i) => i !== at && !aliasing.has(i));
+  if (
+    mentionsAnyLocal(
+      sfn.body.slice(0, at).filter((_, i) => !aliasing.has(i)),
+      reach,
+    )
+  ) {
+    return `whose copy into '${local}' is not the first thing the body does with it`;
+  }
+  const use = uses(kept, reach);
+  const count = size / (elem.width / 8);
+  // Reached as anything but elements, the local may be reached past the bytes copied — the tail a
+  // fill writes after a short string's copy — so the reservation must be the copy's exactly.
+  if (use.other && byteSize(decl.type) !== size) {
+    return `whose copy fills '${local}', a ${typeToString(decl.type)} the body reaches past the ${size} bytes copied`;
+  }
+  if (use.extents.some(([from, to]) => from < 0 || to > size)) {
+    return `whose copy fills '${local}', which the body indexes past the ${size} bytes copied`;
+  }
+  // An offset or a cast was spelled against the local's own element, so the image's must match and
+  // the local keeps its type. Element accesses print their own width, so where only they and the
+  // whole address reach it, the declaration (the frame audit may type it by bytes alone) witnesses
+  // nothing: the image says the element, and its signedness where it writes a negative (agbcc does
+  // only for a signed element), else the reads of that width do.
+  let own: Extract<IrType, { kind: 'int' }>;
+  if (use.other) {
+    if (declElem.width !== elem.width) {
+      return `whose ${elem.width / 8}-byte elements are not the ${declElem.width / 8}-byte elements the body reaches '${local}' by`;
+    }
+    own = declElem;
+  } else {
+    const signs = new Set(use.reads.filter((r) => r.width * 8 === elem.width).map((r) => r.signed));
+    const signed =
+      elem.signed ||
+      (signs.size === 1 ? [...signs][0] : declElem.width === elem.width && use.indexed > 0 && declElem.signed);
+    own = { ...elem, signed };
+  }
+  return {
+    at,
+    local,
+    type: { kind: 'array', elem: own, count },
+    // an address is the address whatever the element's signedness: its cast spells that
+    init: image.init.map((v) => (typeof v === 'number' ? resign(v, elem.width / 8, own.signed) : v)),
+    string: image.string === true && elem.width === 8,
+  };
+}
+
+/** The locals of `sfn` that hold `local`'s address and nothing else — assigned it once, at the top
+ *  level of the body, and never written through `&` — each with the index of that assignment. */
+function aliasesOf(sfn: SFn, local: string): Map<string, number> {
+  const counts = localMentions(sfn);
+  const out = new Map<string, number>();
+  sfn.body.forEach((s, i) => {
+    const m = s.k === 'assign' ? counts.get(s.name) : undefined;
+    if (
+      s.k === 'assign' &&
+      s.name !== local &&
+      m?.assigns === 1 &&
+      m.addrTaken === 0 &&
+      wholeObject(s.value) === local
+    ) {
+      out.set(s.name, i);
+    }
+  });
+  return out;
+}
+
+/** How `body` reaches the object the names in `reach` all denote whole: the byte extent of each
+ *  direct element access with a constant index (`sp0[k]`, `((u8 *)sp0)[k]`, `p0[k]` — the index
+ *  node carries its own width), how many of those there are in all, and whether anything reaches
+ *  it other than as a whole call argument or a direct element access. */
+function uses(
+  body: readonly Stmt[],
+  reach: ReadonlySet<string>,
+): { indexed: number; extents: [number, number][]; reads: { width: number; signed: boolean }[]; other: boolean } {
+  let total = 0;
+  let accounted = 0;
+  let indexed = 0;
+  const extents: [number, number][] = [];
+  const reads: { width: number; signed: boolean }[] = [];
+  const reaches = (e: Expr): boolean => {
+    const n = wholeObject(e);
+    return n !== null && reach.has(n);
+  };
+  for (const e of walkExprs(body as Stmt[])) {
+    const n = mentionedName(e);
+    if (n !== undefined && reach.has(n)) {
+      total++;
+    }
+    if (e.k === 'call') {
+      accounted += e.args.filter(reaches).length;
+    }
+    if (e.k === 'index' && reaches(e.base)) {
+      accounted++;
+      indexed++;
+      reads.push({ width: e.width, signed: e.signed });
+      const k = bare(e.idx);
+      if (k.k === 'const') {
+        extents.push([k.value * e.width, (k.value + 1) * e.width]);
+      }
+    }
+  }
+  return { indexed, extents, reads, other: total !== accounted };
+}
+
+/** Whether every anonymous image `sfn` holds folds into a local's initializer: null when it does,
+ *  else the image's name and the tail of the sentence that refuses it. */
+export function constantImageRefusal(sfn: SFn): { image: string; refused: string } | null {
+  for (const image of sfn.images ?? []) {
+    const plan = planFolds(sfn, image);
+    if (typeof plan === 'string') {
+      return { image: image.name, refused: plan };
+    }
+  }
+  return null;
+}
+
+/** `e` with every access to a folded local that reads one of its elements AS that element spelled
+ *  `a[k]` on the local itself. The structurer spelled the access against the type the frame audit
+ *  gave the local — bytes, unsigned — so a read of the element type this pass gives it (`s8`, from
+ *  the image) came out through the local's address and a cast, `((s8 *)a)[5]`. The two are one C
+ *  value and not one compile: agbcc re-forms `sp + 0x15` for the cast where `b[5]` reads through
+ *  the base it already holds for `b`'s copy (`ldrsb r0, [r5, r0]`). An access of another width or
+ *  signedness keeps its cast, which is the element type it spells. */
+function asElement(e: Expr, by: ReadonlyMap<string, Fold>): Expr {
+  const inner = mapExprChildren(e, (c) => asElement(c, by));
+  if (inner.k !== 'index' || (inner.lead?.length ?? 0) > 0 || inner.baseElem !== undefined) {
+    return inner;
+  }
+  // the object the base names whole, as the fold's own census of element accesses reads it (`uses`)
+  const name = wholeObject(inner.base);
+  const fold = name === null ? undefined : by.get(name);
+  const elem = fold?.type.kind === 'array' ? fold.type.elem : undefined;
+  if (elem?.kind !== 'int' || elem.width !== inner.width * 8 || elem.signed !== inner.signed) {
+    return inner;
+  }
+  return { ...inner, base: { k: 'var', name: name! }, subscript: true };
+}
+
+/** `sfn` with every anonymous image folded into the initializer of each local its copies fill,
+ *  the copies gone and the image with them. Throws where one does not fold: structure() refused
+ *  that function already, so a tree that reaches here unfoldable was made so by a later pass. */
+export function foldConstantImages(sfn: SFn): SFn {
+  if (sfn.images === undefined) {
+    return sfn;
+  }
+  let out: SFn = { ...sfn };
+  delete out.images;
+  for (const image of sfn.images) {
+    const plan = planFolds(out, image);
+    if (typeof plan === 'string') {
+      throw new Error(`cannot spell '${sfn.name}': the compiler's anonymous constant '${image.name}' ${plan}`);
+    }
+    const copies = new Set(plan.map((f) => f.at));
+    const by = new Map(plan.map((f) => [f.local, f]));
+    out = {
+      ...out,
+      body: out.body.filter((_, i) => !copies.has(i)).map((st) => mapStmtExprs(st, (e) => asElement(e, by))),
+      locals: out.locals.map((l) => {
+        const f = by.get(l.name);
+        return f === undefined
+          ? l
+          : { ...l, type: f.type, init: f.init, ...(f.string ? { initString: true as const } : {}) };
+      }),
+    };
+  }
+  return out;
+}

package/src/l3/dce.ts

@@ -25,13 +25,15 @@
 // unresolved `?` value trips the contract first and never reaches DCE; `mustKeep` treating `?` as
 // keep is defense-in-depth for any future caller that skips that check.
 import type { Expr, SFn, Stmt } from './ast';
-import { exprChildren, negateCond, stmtChildren, stmtExprs } from './ast';
+import { exprChildren, keepsHelperRel, negateCond, stmtChildren, stmtExprs } from './ast';
 
 /** Accumulate every LOCAL-eligible `var` name read anywhere in `e` (recurses all sub-exprs). An
  *  `addr` name counts too: taking a local's address makes every store to it observable through the
- *  escaped pointer, so an address-taken local is never dead here. */
+ *  escaped pointer, so an address-taken local is never dead here. A `postincr` reads its name
+ *  before it writes it, so it pins the store that reaches it — `n++` in a loop test is the only
+ *  reader of the `n = 0` above the loop. */
 function readsInto(e: Expr, out: Set<string>): void {
-  if (e.k === 'var' || e.k === 'addr') {
+  if (e.k === 'var' || e.k === 'addr' || e.k === 'postincr') {
     out.add(e.name);
   }
   for (const c of exprChildren(e)) {
@@ -48,6 +50,7 @@ function reads(e: Expr): Set<string> {
 /** True if `e` carries any reason NOT to speculatively delete its assignment/condition:
  *   - `call` — may write memory/globals (a side effect);
  *   - `marker` — the annotate-mode ASMLIFT_ERROR gap signal, which must survive so the gap stays loud;
+ *   - `postincr` — its write is the loop update; deleting the assignment would delete the update;
  *   - the strict-mode `?` unresolved sentinel (`{k:'var', name:'?'}`) — dropping it would let a
  *     value asmlift could NOT lift slip past `assertResolved`, silently downgrading a loud gap;
  *   - a memory load (`index`/`field`) — a deref's volatility is unknowable here, so a possibly-effectful read
@@ -56,7 +59,7 @@ function reads(e: Expr): Set<string> {
  *     observable access the machine performed; deleting the dead assignment would delete the read.
  *  A dead assignment whose value contains any of these is kept. */
 function mustKeep(e: Expr, volatiles: ReadonlySet<string>): boolean {
-  if (e.k === 'call' || e.k === 'marker' || e.k === 'index' || e.k === 'field') {
+  if (e.k === 'call' || e.k === 'marker' || e.k === 'postincr' || e.k === 'index' || e.k === 'field') {
     return true;
   }
   if (e.k === 'var' && (e.name === '?' || volatiles.has(e.name))) {
@@ -95,6 +98,16 @@ function allAddrNamesInto(stmts: Stmt[], out: Set<string>): void {
   }
 }
 
+/** Where a `break` and a `continue` at this depth land, as the set live there. A jump does not fall
+ *  through to the statement after it: the live set at a jump is its TARGET's, not what the rest of
+ *  the enclosing block reads. `break` targets the innermost loop or switch, `continue` the innermost
+ *  loop; each is that statement's conservative in-scope set (everything read anywhere in it plus
+ *  what is live after it), which also covers the loop's own next test and update. */
+interface JumpLive {
+  brk: ReadonlySet<string>;
+  cont?: ReadonlySet<string>; // absent in a switch no loop encloses
+}
+
 /** Backward live-variable walk over one block. `liveOut` is the set of locals live on exit;
  *  returns the rewritten block and the set live on entry. */
 function dceBlock(
@@ -102,6 +115,7 @@ function dceBlock(
   liveOut: ReadonlySet<string>,
   locals: ReadonlySet<string>,
   volatiles: ReadonlySet<string>,
+  jumps: JumpLive | null,
 ): { out: Stmt[]; liveIn: Set<string> } {
   const live = new Set(liveOut);
   const rev: Stmt[] = [];
@@ -153,12 +167,19 @@ function dceBlock(
       }
       case 'break':
       case 'continue': {
+        // A mid-body `if (c) { v = x; break; }` carries the loop's exit value in `v`, while the
+        // statements after the `if` overwrite `v` for the next iteration. Leaving `live` as the
+        // fall-through set would judge the carried copy dead and drop it.
+        const target = s.k === 'break' ? jumps?.brk : jumps?.cont;
+        if (target) {
+          setLive(new Set(target));
+        }
         rev.push(s);
         break;
       }
       case 'if': {
-        const t = dceBlock(s.then, live, locals, volatiles);
-        const e = dceBlock(s.else, live, locals, volatiles);
+        const t = dceBlock(s.then, live, locals, volatiles, jumps);
+        const e = dceBlock(s.else, live, locals, volatiles, jumps);
         const nlive = new Set<string>();
         for (const r of reads(s.cond)) {
           nlive.add(r);
@@ -175,7 +196,7 @@ function dceBlock(
           if (mustKeep(s.cond, volatiles)) {
             rev.push({ k: 'exprstmt', value: s.cond });
           }
-        } else if (t.out.length === 0) {
+        } else if (t.out.length === 0 && !keepsHelperRel(s.cond)) {
           rev.push({ k: 'if', cond: negateCond(s.cond), then: e.out, else: [] });
         } else {
           rev.push({ k: 'if', cond: s.cond, then: t.out, else: e.out });
@@ -188,7 +209,7 @@ function dceBlock(
         // loop-carried store is never cut. Body DCE removes only what is dead on EVERY path.
         const loopLive = new Set(live);
         allReadsInto([s], loopLive);
-        const b = dceBlock(s.body, loopLive, locals, volatiles);
+        const b = dceBlock(s.body, loopLive, locals, volatiles, { brk: loopLive, cont: loopLive });
         const nlive = new Set(loopLive);
         for (const r of b.liveIn) {
           nlive.add(r);
@@ -200,7 +221,7 @@ function dceBlock(
       case 'for': {
         const loopLive = new Set(live);
         allReadsInto([s], loopLive);
-        const b = dceBlock(s.body, loopLive, locals, volatiles);
+        const b = dceBlock(s.body, loopLive, locals, volatiles, { brk: loopLive, cont: loopLive });
         const nlive = new Set(loopLive);
         for (const r of b.liveIn) {
           nlive.add(r);
@@ -214,8 +235,9 @@ function dceBlock(
         // read anywhere in the switch as live throughout — no case-body store is ever cut.
         const swLive = new Set(live);
         allReadsInto([s], swLive);
-        const cases = s.cases.map((c) => ({ ...c, body: dceBlock(c.body, swLive, locals, volatiles).out }));
-        const def = s.default ? dceBlock(s.default, swLive, locals, volatiles).out : s.default;
+        const inSwitch: JumpLive = { brk: swLive, cont: jumps?.cont };
+        const cases = s.cases.map((c) => ({ ...c, body: dceBlock(c.body, swLive, locals, volatiles, inSwitch).out }));
+        const def = s.default ? dceBlock(s.default, swLive, locals, volatiles, inSwitch).out : s.default;
         const nlive = new Set(swLive);
         for (const r of reads(s.scrutinee)) {
           nlive.add(r);
@@ -263,7 +285,7 @@ export function eliminateDeadStores(sfn: SFn): SFn {
   allAddrNamesInto(sfn.body, addressTaken);
   const volatiles = new Set(sfn.locals.filter((l) => l.volatile).map((l) => l.name));
   const locals = new Set(sfn.locals.filter((l) => !l.volatile && !addressTaken.has(l.name)).map((l) => l.name));
-  const body = dceBlock(sfn.body, new Set<string>(), locals, volatiles).out;
+  const body = dceBlock(sfn.body, new Set<string>(), locals, volatiles, null).out;
   const used = new Set<string>();
   referencedNames(body, used);
   return { ...sfn, body, locals: sfn.locals.filter((l) => used.has(l.name) || l.volatile) };

package/src/l3/gates.ts

@@ -19,8 +19,9 @@ export interface Gate<Ctx> {
   /** Remove it and some candidate is WRONG, not merely worse. Everything else is a codegen
    *  heuristic the differ still referees. This flag is what makes `guardedBy` mandatory. */
   readonly sound: boolean;
-  /** the test that fails when this gate is removed — required for a sound gate */
-  readonly guardedBy?: string;
+  /** the test that fails when this gate is removed — required for a sound gate; a rule with two
+   *  halves names one test per half */
+  readonly guardedBy?: string | readonly string[];
   /** true ⇒ REJECT this candidate */
   readonly rejects: (c: Ctx) => boolean;
 }
@@ -67,6 +68,11 @@ export function ablateHeuristic<Ctx>(gates: readonly Gate<Ctx>[], id: string): r
   return without(gates, id);
 }
 
+/** Every test a gate names as its guard, one per half of the rule. */
+export function guardsOf<Ctx>(g: Gate<Ctx>): readonly string[] {
+  return typeof g.guardedBy === 'string' ? [g.guardedBy] : (g.guardedBy ?? []);
+}
+
 /** Structural defects in a gate table — the part checkable without running the pass. Returns
  *  findings rather than throwing, so core stays free of a test-framework import. */
 export function gateTableDefects<Ctx>(gates: readonly Gate<Ctx>[]): string[] {
@@ -84,7 +90,7 @@ export function gateTableDefects<Ctx>(gates: readonly Gate<Ctx>[]): string[] {
       out.push(`gate '${g.id}' has no usable \`why\``);
     }
     // the one rule that costs something to declare
-    if (g.sound && !g.guardedBy?.trim()) {
+    if (g.sound && !guardsOf(g).some((t) => t.trim())) {
       out.push(`gate '${g.id}' is marked sound but names no guard`);
     }
   }