@asmlift/core 0.8.1 → 0.10.0

package/src/raise/retsink.ts

@@ -32,7 +32,7 @@
 // retired 2026-09-13).
 //
 // ONE MODEL, NOT TWO. The predicate is `narrowlocal.ts`'s exported `armIsOneSet` — no op that
-// `REEVAL_UNSAFE_OPS` calls unsafe, and EXACTLY one result-producing op — read here by
+// `reevalUnsafe` calls unsafe, and EXACTLY one result-producing op — read here by
 // `arms-are-one-set`. It is cited there line by line to `jump.c:474/:480/:482/:483` and
 // `rtlanal.c:1770-1784`, with the three things an op count alone gets wrong, and a reach census over
 // 13733 blocks. It is SHARED rather than re-derived here because it is one optimizer guard and a

package/src/raise/shortcircuit.ts

@@ -42,6 +42,7 @@
 // through untouched (a miss, never a miscompile).
 import { disjointConstSlots } from '../ir/alias';
 import {
+  type AttrVal,
   Block,
   Fn,
   Op,
@@ -58,11 +59,12 @@ import {
   replaceAllUsesWith,
   successorsOf,
 } from '../ir/core';
-import { EFFECTFUL_OPS, HOIST_UNSAFE_OPS, NEGATED_ICMP, ORDER_SENSITIVE_OPS } from '../ir/opcodes';
+import { effectful, forgetHelperPlacement, orderSensitive, placedAt, speculationUnsafe } from '../ir/discipline';
+import { NEGATED_FCMP, NEGATED_ICMP } from '../ir/opcodes';
 import { T } from '../ir/types';
 import { type Gate, firstRejection } from '../l3/gates';
 
-const BOOL_OPS = new Set([...Object.keys(NEGATED_ICMP), 'logic_and', 'logic_or']);
+const BOOL_OPS = new Set([...Object.keys(NEGATED_ICMP), ...Object.keys(NEGATED_FCMP), 'logic_and', 'logic_or']);
 
 /** Run `step` until it stops rewriting, and answer whether it ever did.
  *
@@ -226,8 +228,11 @@ export function recognizeShortCircuit(fn: Fn): boolean {
         // value ops (arith, loads, icmp) are safe: the structurer inlines them back into the `&&`/`||` RHS
         // expression, where C's own short-circuit re-guards them. Any side effect ⇒ DECLINE the fold — the
         // merge-variable spelling the fall-through leaves is correct (the side effect stays in B's block),
-        // just possibly non-matching.
-        if (bfeed.ops.slice(0, -1).some((op) => HOIST_UNSAFE_OPS.has(op.opcode))) {
+        // just possibly non-matching. A qualified read is an access, not a value, and stays in its
+        // arm the same way. structure/analysis.ts rests on this refusal: it names a counted op it
+        // finds in a connective's guarded operand at its def, above the branch, because no fold
+        // put one there.
+        if (bfeed.ops.slice(0, -1).some(speculationUnsafe)) {
           continue;
         }
         // NEGATABLE only when the orientation actually inverts the head — asked here rather than up
@@ -244,7 +249,9 @@ export function recognizeShortCircuit(fn: Fn): boolean {
         if (wantNeg && !negation) {
           continue;
         }
-        bfeed.ops.slice(0, -1).forEach(before); // hoist B's pure body (defines Vb; harmless if a dead const)
+        // hoist B's pure body (defines Vb; harmless if a dead const). A helper op it moves no longer
+        // sits where the asm called it (ir/discipline.ts `forgetHelperPlacement`).
+        bfeed.ops.slice(0, -1).forEach((op) => before(forgetHelperPlacement(op)));
         foldWriteOrder(fn.writeOrder, bfeed, h); // …and its writes now follow H's (ir/core.ts)
         let condSide = cond;
         if (negation) {
@@ -577,10 +584,11 @@ export function recognizeBranchShortCircuit(fn: Fn, opts: BranchShortCircuitOpti
           continue;
         }
         // ^g's body must be pure — see the REFUSALS note.
-        // HOIST_UNSAFE_OPS includes `opaque`: an instruction asmlift could not model, and moving it
+        // `speculationUnsafe` answers yes for `opaque`: an instruction asmlift could not model, and moving it
         // out of the arm that guards it is the reordering this refuses. Loud either way today — a
         // decline under `onGap: 'strict'`, an ASMLIFT_ERROR marker under `annotate`.
-        if (g.ops.slice(0, -1).some((op) => HOIST_UNSAFE_OPS.has(op.opcode))) {
+        // A qualified read stays in its arm too, as in the value form above, and for the same reader.
+        if (g.ops.slice(0, -1).some(speculationUnsafe)) {
           continue;
         }
         // Which of ^g's edges rejoins ^h's other successor? That is the shared block. A DIRECT edge
@@ -648,7 +656,7 @@ export function recognizeBranchShortCircuit(fn: Fn, opts: BranchShortCircuitOpti
           }
         }
         rereadInArm(fn, g, otherEdge.block, reread);
-        const body = g.ops.slice(0, -1);
+        const body = g.ops.slice(0, -1).map(forgetHelperPlacement);
         const second = negation ? negation.result : c2;
         const negated: Op[] = negation ? negation.ops : [];
         const res = mkValue(T.unk(32));
@@ -798,7 +806,9 @@ const NEGATE_BUDGET = 8;
 /** The ops computing `!v`, or `null` when `v` cannot be negated.
  *
  *  Two cases, and no third:
- *    - an `icmp_*` in `NEGATED_ICMP` → the swapped-opcode comparison over the SAME operands.
+ *    - an `icmp_*` in `NEGATED_ICMP`, or an `fcmp_*` in `NEGATED_FCMP` → the swapped-opcode
+ *      comparison over the SAME operands. A float compare negates to its unordered twin, never to
+ *      the flipped relation, which a NaN would tell apart.
  *    - a `logic_and`/`logic_or` → the DUAL connective over its two recursively negated operands.
  *      De Morgan: `!(a || b)` is `!a && !b`. This is the only reason the helper is recursive, and
  *      it is what lets a chain fold past its first level (`a || !(b || c)`).
@@ -816,8 +826,9 @@ const NEGATE_BUDGET = 8;
  *    - the cone exceeds `NEGATE_BUDGET` minted ops.
  *
  *  Ops are MINTED, never mutated: the originals stay where the caller hoisted them and die to the
- *  pass list's own `dce: true` (raise/pre-recovery.ts). Only `icmp_*`/`logic_and`/`logic_or` are
- *  ever rebuilt, all of them pure, so no effect can be duplicated or reordered by construction.
+ *  pass list's own `dce: true` (raise/pre-recovery.ts). Only `icmp_*`/`fcmp_*`/`logic_and`/
+ *  `logic_or` are ever rebuilt, all of them pure, so no effect can be duplicated or reordered by
+ *  construction.
  *
  *  Nothing is SHARED between paths, and that is the point rather than a limitation. Memoizing `go`
  *  in a `Map<Value, Value>` is three lines and would make the budget unnecessary — and it would
@@ -826,11 +837,11 @@ const NEGATE_BUDGET = 8;
  *  Nothing collapses the duplicates later either — `numberPureValues` runs as `addrnum`, far ahead
  *  of both folds. So the per-path rebuild is the mechanism and NEGATE_BUDGET is its price.
  *
- *  What it GUARANTEES about its result, which one caller leans on: every op it mints is an `icmp_*`
- *  or a `logic_and`/`logic_or`, so the returned value is always a C boolean. The value form hands an
- *  un-negated head straight on as the merge VALUE, which is why that caller checks booleanness for
- *  itself before deciding whether to call here at all (see its head gate); the branch form needs no
- *  such check, because its result only ever feeds a `cond_br`.
+ *  What it GUARANTEES about its result, which one caller leans on: every op it mints is an `icmp_*`,
+ *  an `fcmp_*` or a `logic_and`/`logic_or`, so the returned value is always a C boolean. The value
+ *  form hands an un-negated head straight on as the merge VALUE, which is why that caller checks
+ *  booleanness for itself before deciding whether to call here at all (see its head gate); the
+ *  branch form needs no such check, because its result only ever feeds a `cond_br`.
  *
  *  PRECONDITION, earned by the caller and not checked here: every value in the cone must dominate
  *  the point the caller splices `ops` into — the minted comparisons reuse the ORIGINAL leaf
@@ -853,8 +864,18 @@ function negateCondOps(defs: Map<Value, Op>, v: Value, budget: number): { ops: O
       return null;
     }
     const out = mkValue(T.unk(32));
-    if (NEGATED_ICMP[d.opcode]) {
-      ops.push(mkOp(NEGATED_ICMP[d.opcode], { operands: [...d.operands], results: [out] }));
+    const negated = NEGATED_ICMP[d.opcode] ?? NEGATED_FCMP[d.opcode];
+    // A float compare whose runtime helper names the relation the source spelled (raise/
+    // floathelpers.ts `attrs.relation`) has no negation that calls the same helper — gcc folds
+    // `!(a == b)` into `a != b` — so a fold that would negate it off that relation refuses, and one
+    // that negates it back onto the relation keeps the stamp for the structurer to spell.
+    const relation = d.attrs.relation;
+    if (negated && relation === d.opcode) {
+      return null;
+    }
+    if (negated) {
+      const attrs: Record<string, AttrVal> = typeof relation === 'string' ? { relation } : {};
+      ops.push(mkOp(negated, { operands: [...d.operands], results: [out], attrs }));
       return out;
     }
     if (d.opcode === 'logic_and' || d.opcode === 'logic_or') {
@@ -938,7 +959,7 @@ const readsOf = (op: Op): Value[] => [...op.operands, ...op.successors.flatMap((
  *  gate in `opts.armReread` (default {@link ARM_REREAD_GATES}) refuses the site.
  *
  *  The copy is exact at the arm's head because nothing runs between: `g`'s body is pure (its
- *  caller refuses anything in HOIST_UNSAFE_OPS), so a load copied there reads what `g`'s own load
+ *  caller refuses anything `speculationUnsafe`), so a load copied there reads what `g`'s own load
  *  read, and `g` is the arm's ONLY predecessor, so the copy runs exactly when the original's
  *  value would have been live there. On verified IR that also places every escaping read under
  *  the arm: `g` dominates nothing else, because the shared block is reached from ^h directly.
@@ -1086,17 +1107,20 @@ function leavesALoop(fn: Fn, g: Block, arm: Block, preds: ReadonlyMap<Block, rea
  *    - it renders nowhere single: some PURE value between it and a statement has two consumers, so
  *      `emitPos` is null and analysis.ts materializes it whatever stands in the way
  *      (`p[2] = p[1] & 0x80; p[3] = p[1] & 0x80;` — one `and`, two stores);
- *    - it has MORE THAN ONE direct reader, and an effect precedes one of their render positions —
- *      the multi-render rule, `isWrite = EFFECTFUL_OPS`, which exempts nothing;
- *    - it has ONE, and an effect precedes its render position that analysis.ts's `isBarrier`
- *      counts: any `astore`/`opaque`, a `call` that is not rendered inside that same statement,
- *      and a `store` UNLESS it is to a provably disjoint slot of the read's own base
- *      (`disjointConstSlots`, ir/alias.ts — the helper `isBarrier` calls).
+ *    - it has MORE THAN ONE direct reader, and an effect or a helper op analysis.ts names precedes
+ *      one of their render positions — the multi-render rule, which exempts nothing;
+ *    - it has ONE, and an op precedes its render position that analysis.ts's `isBarrier` counts:
+ *      any `astore`/`opaque`, a helper op analysis.ts names, a `call` that is not rendered inside
+ *      that same statement, and a `store` UNLESS it is to a provably disjoint slot of the read's own
+ *      base (`disjointConstSlots`, ir/alias.ts — the helper `isBarrier` calls).
+ *
+ *  `isBarrier`'s pinned-read clause has nothing to mirror: ^g holds no pinned read, since the fold
+ *  refuses a ^g with anything `speculationUnsafe` in it.
  *
  *  A reader in any block other than the arm answers yes — the copy then outlives the arm's first
  *  block. What this does NOT mirror, and which way each gap errs, is ARM_REREAD_GATES' RESIDUE. */
 function readHeldAcrossEffect(c: ArmRereadSite): boolean {
-  const reads = [...c.copy].filter((op) => ORDER_SENSITIVE_OPS.has(op.opcode));
+  const reads = [...c.copy].filter(orderSensitive);
   if (reads.length === 0) {
     return false;
   }
@@ -1127,8 +1151,17 @@ function readHeldAcrossEffect(c: ArmRereadSite): boolean {
     if (cs.length === 1) {
       return at(cs[0]);
     }
-    return ORDER_SENSITIVE_OPS.has(op.opcode) ? posOf(op) : null;
+    return orderSensitive(op) ? posOf(op) : null;
   };
+  // analysis.ts's `namedHelper`: a helper op it names where the asm ran it, which bars a read as a
+  // named call does. It names one whose value renders in another block, or past an effect or
+  // another named helper.
+  const namedHelper = (x: Op): boolean =>
+    placedAt(x) === 'helper' &&
+    (escapes(x.results) ||
+      consumersOf(x.results)
+        .map(at)
+        .some((p) => p === null || c.arm.ops.slice(posOf(x) + 1, p).some((y) => effectful(y) || namedHelper(y))));
   for (const l of reads) {
     if (escapes(l.results)) {
       return true;
@@ -1139,7 +1172,10 @@ function readHeldAcrossEffect(c: ArmRereadSite): boolean {
     }
     const multi = renders.length > 1;
     const bars = (x: Op, pos: number): boolean => {
-      if (!EFFECTFUL_OPS.has(x.opcode)) {
+      if (namedHelper(x)) {
+        return true;
+      }
+      if (!effectful(x)) {
         return false;
       }
       if (multi) {
@@ -1280,7 +1316,7 @@ export const ARM_REREAD_GATES: readonly Gate<ArmRereadSite>[] = [
     why: 'the target read it before the second test on both of its exits; moved, it runs on one',
     sound: false,
     guardedBy: 'branch-shortcircuit.test.ts: REFUSED: a READ only the arm consumes would move under the second test',
-    rejects: (c) => [...c.drop].some((op) => ORDER_SENSITIVE_OPS.has(op.opcode)),
+    rejects: (c) => [...c.drop].some(orderSensitive),
   },
   {
     // THE BYTES HALF of the copy (see `armRereadCone`), and a claim about ONE compiler. The arm of
@@ -1323,7 +1359,7 @@ export const ARM_REREAD_GATES: readonly Gate<ArmRereadSite>[] = [
 
 /** Copy `copy` to the head of `arm`, point every read outside `g` at the copies, and delete `drop`.
  *  A dropped original is deleted rather than left for the hoist: the arm now performs it, and a
- *  dead READ left in ^h is one the structurer may still spell (SPELLED_WHEN_DEAD_OPS). */
+ *  dead READ left in ^h is one the structurer may still spell (ir/discipline.ts `spelledWhenDead`). */
 function rereadInArm(fn: Fn, g: Block, arm: Block, { copy, drop }: ArmReread): void {
   const copyOf = new Map<Value, Value>();
   const copies = g.ops

package/src/raise/softdiv.ts

@@ -15,27 +15,27 @@
 // cannot state: its match keys on a `call`'s STRING `target` attr, which the numeric `attrEquals`
 // cannot express. It is naturally inert on hardware-divide targets (which emit `div`/`divu`,
 // never `bl __divsi3`).
-import { Fn, mkOp } from '../ir/core';
-import type { Opcode } from '../ir/opcodes';
-import type { Prototypes } from '../proto';
+import type { Fn } from '../ir/core';
+import { wordsOf } from '../proto';
+import { type RuntimeHelper, helperOp, isFloatHelper, isWideHelper } from '../runtime-helpers';
+import type { TargetDescription } from '../target';
 
-// runtime helper symbol → { the division op it computes, its argument count }.
-const SOFT_DIV: Record<string, { op: Opcode; params: number }> = {
-  __divsi3: { op: 'sdiv', params: 2 },
-  __udivsi3: { op: 'udiv', params: 2 },
-  __modsi3: { op: 'smod', params: 2 },
-  __umodsi3: { op: 'umod', params: 2 },
-};
-
-/** Signatures for the soft-division runtime helpers, so a `bl __divsi3` recovers both arguments.
- *  Consumed by the frontend's arity lookup BEHIND any caller-supplied prototype (headers win). */
-export const RUNTIME_HELPERS: Prototypes = Object.fromEntries(
-  Object.entries(SOFT_DIV).map(([sym, h]) => [sym, { params: h.params }]),
-);
+/** The 32-bit software divisions, off the target's own helper table. WHICH helpers a compiler emits
+ *  is a compiler fact and lives there (runtime-helpers.ts); which of them THIS pass answers for is
+ *  the question here, and it is the narrow one: a division the ISA has no instruction for. A helper
+ *  that computes on a value wider than a register is a different question — no hardware capability
+ *  can make one unnecessary — and `raise/widehelpers.ts` answers it, ungated. So is a float helper
+ *  of any width, which computes on floats the ISA has no instruction for either, and
+ *  `raise/floathelpers.ts` answers it. */
+const softDivisions = (target: TargetDescription): Record<string, RuntimeHelper> =>
+  Object.fromEntries(
+    Object.entries(target.runtimeHelpers ?? {}).filter(([, h]) => h.op && !isWideHelper(h) && !isFloatHelper(h)),
+  );
 
 /** Rewrite each recognised soft-division helper call to its division op, in place. Returns whether
  *  anything changed. Runs BEFORE type recovery so the new op's operands get signed/unsigned typing. */
-export function recognizeSoftDiv(fn: Fn): boolean {
+export function recognizeSoftDiv(fn: Fn, target: TargetDescription): boolean {
+  const table = softDivisions(target);
   let changed = false;
   for (const b of fn.blocks) {
     for (let i = 0; i < b.ops.length; i++) {
@@ -43,18 +43,16 @@ export function recognizeSoftDiv(fn: Fn): boolean {
       if (op.opcode !== 'call') {
         continue;
       }
-      const helper = SOFT_DIV[op.attrs.target as string];
-      if (!helper) {
+      const helper = table[op.attrs.target as string];
+      if (!helper?.op) {
         continue;
       }
       // Fold only when BOTH arguments were recovered (the signature makes this the norm). A
       // mis-recovered arity leaves the call untouched rather than fabricating a wrong divide.
-      if (op.operands.length !== helper.params || op.results.length !== 1) {
+      if (op.operands.length !== wordsOf(helper.params, target) || op.results.length !== 1) {
         continue;
       }
-      // Reuse the SAME result Value → every existing use already points at it (no RAUW needed).
-      const div = mkOp(helper.op, { operands: [...op.operands], results: [op.results[0]] });
-      b.ops.splice(i, 1, div);
+      b.ops.splice(i, 1, helperOp(helper.op, op.attrs.target as string, op.operands, op.results[0]));
       changed = true;
     }
   }

package/src/raise/storesign.ts

@@ -0,0 +1,153 @@
+// asmlift — the signedness of a NARROW store, read off the constant it stores.
+//
+// A store does not say whether its lvalue is signed: `sh` writes the low half of a register either
+// way, so a 1- or 2-byte `store` gets the unsigned view by convention (`storeSigned` below). But a
+// compiler that converts the constant to the lvalue's type before it materializes it
+// (`compilerBehaviors.narrowStoreConstantTakesLvalueType`) leaves that type in the register's UPPER
+// bits, which the store throws away:
+//
+//     u16 *p; p[6] = -1;       li v0,0xffff   →  const 65535   →  unsigned
+//     s16 *p; p[6] = 0xFFFF;   li v0,-1       →  const -1      →  signed
+//
+// This pass records that as the store's `signed` attr, the slot an `astore` already carries for a
+// member's recorded signedness; raise/arrays.ts and raise/struct-arrays.ts carry it into the
+// `astore` they make. It changes no op and no value: what it moves is which view of the cell the C
+// spells, and both views store the same bytes.
+//
+// It refuses (leaves the attr unset, so the convention stands) for:
+//   - a target that does not declare the behavior;
+//   - a store that already carries `signed`, or a word-wide one;
+//   - a stored value that is not a `const` — a `neg`/`shl` the materialization left unfolded, a
+//     block param, anything computed;
+//   - a constant whose narrow sign bit is clear: both lvalue types materialize it the same way;
+//   - a constant whose upper bits are neither the zero- nor the sign-extension of its low bits:
+//     no conversion to a narrow type produces one;
+//   - a constant some OTHER use reads too, or whose 32-bit value another store writes at another
+//     width. The conversion is a fact about a LITERAL on the right of the store. A variable or a
+//     chained assignment whose value is a known constant is stored unconverted, in the register
+//     a wider use reads: `s32 v = -1; *q = v; p[1] = v;` with `u16 *p` is `li v0,-1; sw v0;
+//     sh v0` on gcc2.7.2 and gcc2.7.2kmc, and `li t6,-1; sw t6; li t7,-1; sh t7` on ido7.1, which
+//     rematerializes it. When that wide use is there, the register says the wider type's sign,
+//     not the lvalue's (the NONLITERAL bodies of
+//     packages/cli/test/matching/narrow-store-constant.test.ts).
+//
+// What it does NOT refuse is such a variable with no wide use: `s32 v = -1; p[6] = v;` (`u16 *p`),
+// or one only returned. Its register is the variable's, not the lvalue's, so the stamp can name a
+// type the source did not declare (`s16 *` there). It is not refused because nothing tells it
+// apart from a literal, and the spelling it gives recompiles to the register the target holds.
+import { Fn, Op, Value, defOpMap } from '../ir/core';
+import type { TargetDescription } from '../target';
+
+/** THE view a store's lvalue is seeded at, `width` bytes wide (`width` for a `store`, `elemSize`
+ *  for an `astore`): the `signed` a recovery recorded on it — this pass's stamp, or a member
+ *  array's own declaration (raise/memberarrays.ts) — else the convention, word ⇒ signed and
+ *  narrow ⇒ unsigned. raise/recover.ts, raise/structs.ts, raise/memberarrays.ts, rank-declare.ts
+ *  and the structurer seed from it; raise/struct-arrays.ts keeps the stamp beside its loads'
+ *  sign instead. What each does when a LOAD disagrees is its own: raise/structs.ts,
+ *  raise/struct-arrays.ts and rank-declare.ts prefer the load, and the structurer spells a member
+ *  that disagrees with the stamp as a cast cell (structure/structure.ts `stampedStoreLval`). */
+export function storeSigned(op: Op, width: number): boolean {
+  return (op.attrs.signed as boolean | undefined) ?? width === 4;
+}
+
+/** The lvalue signedness a constant stored at `width` bytes witnesses, read off the 32-bit register
+ *  it was materialized into: `true` sign-extended, `false` zero-extended, `null` when it says
+ *  neither (see the refusals at the top of this file). */
+export function storedConstantSign(value: number, width: number): boolean | null {
+  if (!Number.isInteger(value) || value < -(2 ** 31) || value >= 2 ** 32 || (width !== 1 && width !== 2)) {
+    return null;
+  }
+  const bits = width * 8;
+  const reg = value | 0;
+  const low = reg & ((1 << bits) - 1);
+  if ((low & (1 << (bits - 1))) === 0) {
+    return null;
+  }
+  if (reg === low) {
+    return false;
+  }
+  return reg === (low << (32 - bits)) >> (32 - bits) ? true : null;
+}
+
+/** Stamp `signed` on every narrow `store` whose stored constant witnesses its lvalue's signedness.
+ *  Returns how many it stamped. */
+export function seedNarrowStoreSigns(fn: Fn, target: TargetDescription): number {
+  if (target.compilerBehaviors.narrowStoreConstantTakesLvalueType !== true) {
+    return 0;
+  }
+  const defs = defOpMap(fn);
+  const stores: Op[] = fn.blocks.flatMap((b) => b.ops.filter((op) => op.opcode === 'store'));
+  // the values read other than as the value a store stores. Not a `ret`'s: before the return
+  // type is known it reads the return register whether the function returns it or not, and gcc
+  // stores a constant from that register in its delay slot (`li v0,-1; jr ra; sh v0,12(a0)`).
+  // Nor an edge's into a block param only a `ret` reads, directly or through more such params:
+  // that is the same register live out of a branch, `beqz a1,L; ...; li v0,0x8000; sh v0,4(a0);
+  // L: jr ra`.
+  const retOnly = retOnlyParams(fn);
+  const otherUses = new Set<Value>();
+  const bump = (v: Value) => otherUses.add(v);
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      op.operands.forEach((v, i) => ((op.opcode === 'store' && i === 1) || op.opcode === 'ret' ? undefined : bump(v)));
+      op.successors.forEach((s) => s.args.forEach((v, i) => (retOnly.has(s.block.params[i]) ? undefined : bump(v))));
+    }
+  }
+  // a stored constant's 32-bit register → the widths it is stored at, across every const op
+  const widthsOf = new Map<number, Set<number>>();
+  for (const op of stores) {
+    const d = defs.get(op.operands[1]);
+    if (d?.opcode === 'const') {
+      const reg = (d.attrs.value as number) | 0;
+      (widthsOf.get(reg) ?? widthsOf.set(reg, new Set()).get(reg)!).add(op.attrs.width as number);
+    }
+  }
+  let n = 0;
+  for (const op of stores) {
+    const d = defs.get(op.operands[1]);
+    if (
+      op.attrs.signed !== undefined ||
+      d?.opcode !== 'const' ||
+      otherUses.has(op.operands[1]) ||
+      widthsOf.get((d.attrs.value as number) | 0)!.size > 1
+    ) {
+      continue;
+    }
+    const signed = storedConstantSign(d.attrs.value as number, op.attrs.width as number);
+    if (signed !== null) {
+      op.attrs.signed = signed;
+      n++;
+    }
+  }
+  return n;
+}
+
+/** The block params (not the entry's: those are the function's parameters) that nothing reads but
+ *  a `ret` and the edges into other such params. */
+function retOnlyParams(fn: Fn): Set<Value> {
+  const read = new Set<Value>();
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      if (op.opcode !== 'ret') {
+        op.operands.forEach((v) => read.add(v));
+      }
+    }
+  }
+  const out = new Set(fn.blocks.slice(1).flatMap((b) => b.params.filter((p) => !read.has(p))));
+  // an edge into a param that is not ret-only reads its argument: drop arguments until none moves
+  for (let moved = true; moved;) {
+    moved = false;
+    for (const b of fn.blocks) {
+      for (const op of b.ops) {
+        for (const s of op.successors) {
+          s.args.forEach((v, i) => {
+            if (out.has(v) && !out.has(s.block.params[i])) {
+              out.delete(v);
+              moved = true;
+            }
+          });
+        }
+      }
+    }
+  }
+  return out;
+}

package/src/raise/struct-arrays.ts

@@ -18,6 +18,7 @@
 // UNAMBIGUOUS here (the scaled operand is the index, read from the machine code) — the unscaled
 // `add(x, y)` byte form stays out of scope (genuinely ambiguous without types).
 import { Fn, Op, Value, defOpMap, mkOp } from '../ir/core';
+import { carryDiscipline } from '../ir/discipline';
 import { nextStructIndex } from '../ir/struct-names';
 import { IrType, StructField, T, scalarTypeForAccess } from '../ir/types';
 import { collectStructs } from './structs';
@@ -92,8 +93,16 @@ function withPadding(dataFields: StructField[], stride: number): StructField[] {
  *  pokeemerald:GetGenderFromSpeciesAndPersonality, whose address is materialized twice). A base
  *  whose element pointers
  *  disagree on stride declines entirely: two strides over one base is a reinterpreted view or
- *  a 2D layout, genuinely ambiguous — decline over guess. */
-export function recognizeStructArrays(fn: Fn): number {
+ *  a 2D layout, genuinely ambiguous — decline over guess.
+ *
+ *  `aggregateBoundary` is the size the compiler rounds EVERY struct to (target.ts
+ *  `compilerBehaviors.aggregateBoundary`): agbcc 4, so `struct { u16 a; u8 _pad0[4]; }` is 8
+ *  bytes there, not the 6 its fields add up to. A group whose stride that rounding would change
+ *  declines, and its accesses keep the byte-offset spelling (`*(u16 *)(base + i * 6)`), which
+ *  says the stride itself. ABSENT means unmeasured (target.ts), and then every group declines the
+ *  same way: no boundary is safe to assume, since one too small is that very mis-stride on agbcc,
+ *  and the caller must say which layout it means — a target's value, or 1 for the natural one. */
+export function recognizeStructArrays(fn: Fn, aggregateBoundary: number | undefined): number {
   const defs = defOpMap(fn);
   let count = 0;
   // The NAME index is not the recognition count: `count` is this function's return value — how
@@ -102,7 +111,7 @@ export function recognizeStructArrays(fn: Fn): number {
   // time, because this pass runs once per function and nothing else mints the prefix, and
   // ir/struct-names.ts states why the computed 0 is kept over the assumed one.
   let name = nextStructIndex(
-    [...collectStructs(fn)].map((s) => s.name),
+    [...collectStructs(fn, true)].map((s) => s.name),
     'Elem',
   );
 
@@ -147,7 +156,7 @@ export function recognizeStructArrays(fn: Fn): number {
     // load/store BASE with a field offset inside one element.
     const elemSet = new Set(elems.map((e) => e.add.results[0]));
     const indexOf = new Map(elems.map((e) => [e.add.results[0], e.index]));
-    const accesses: { op: Op; elem: Value; off: number; width: number; signed: boolean }[] = [];
+    const accesses: { op: Op; elem: Value; off: number; width: number; signed: boolean; stamp?: boolean }[] = [];
     for (const bb of fn.blocks) {
       for (const op of bb.ops) {
         const isMem = (op.opcode === 'load' || op.opcode === 'store') && elemSet.has(op.operands[0]);
@@ -169,6 +178,7 @@ export function recognizeStructArrays(fn: Fn): number {
             off,
             width,
             signed: op.opcode === 'load' ? (op.attrs.signed as boolean) : width === 4,
+            stamp: op.opcode === 'load' ? undefined : (op.attrs.signed as boolean | undefined),
           });
         }
       }
@@ -192,13 +202,14 @@ export function recognizeStructArrays(fn: Fn): number {
     // silently drops one side's zero/sign-extension (adversarially learned: `arr[i].f +
     // (u16)arr[i].f` lost its zext and a byte-exact match with it). A STORE's `signed` is the
     // width===4 CONVENTION, not a machine fact, so it never conflicts — the field takes its
-    // signedness from the loads when any exist.
-    const byOff = new Map<number, { width: number; loadSigned: boolean | null }>();
+    // signedness from the loads when any exist, else from the stores raise/storesign.ts stamped
+    // (the signed view when any says signed, as raise/structs.ts `buildStruct` prefers it).
+    const byOff = new Map<number, { width: number; loadSigned: boolean | null; stamped: boolean | null }>();
     for (const a of accesses) {
       const isLoad = a.op.opcode === 'load';
       const prev = byOff.get(a.off);
       if (!prev) {
-        byOff.set(a.off, { width: a.width, loadSigned: isLoad ? a.signed : null });
+        byOff.set(a.off, { width: a.width, loadSigned: isLoad ? a.signed : null, stamped: a.stamp ?? null });
       } else if (prev.width !== a.width) {
         clean = false;
       } else if (isLoad) {
@@ -207,6 +218,8 @@ export function recognizeStructArrays(fn: Fn): number {
         } else if (prev.loadSigned !== a.signed) {
           clean = false;
         }
+      } else if (a.stamp !== undefined) {
+        prev.stamped = prev.stamped === true || a.stamp;
       }
     }
     const offs = [...byOff.entries()].sort(([x], [y]) => x - y);
@@ -221,16 +234,19 @@ export function recognizeStructArrays(fn: Fn): number {
       }
       maxAlign = Math.max(maxAlign, width);
     }
-    if (stride % maxAlign !== 0) {
+    // The DECLARED struct is rounded to its widest member AND to the compiler's aggregate
+    // boundary; a stride neither divides is one `sizeof` cannot reproduce, and recompiled it reads
+    // the wrong bytes and stores past a frame buffer sized from the asm (sa3 sub_8038910).
+    if (aggregateBoundary === undefined || stride % Math.max(maxAlign, aggregateBoundary) !== 0) {
       clean = false;
     }
     if (!clean) {
       continue;
     }
-    const dataFields: StructField[] = offs.map(([off, { width, loadSigned }]) => ({
+    const dataFields: StructField[] = offs.map(([off, { width, loadSigned, stamped }]) => ({
       off,
-      // store-only field: the width===4 convention, exactly what the old access carried
-      type: scalarTypeForAccess(width, loadSigned ?? width === 4),
+      // a store-only field: its stamped stores' view, else the width===4 convention
+      type: scalarTypeForAccess(width, loadSigned ?? stamped ?? width === 4),
       name: `field_${off}`,
     }));
     const elemStruct = T.struct(`Elem${name++}`, withPadding(dataFields, stride), stride);
@@ -254,17 +270,21 @@ export function recognizeStructArrays(fn: Fn): number {
             operands: [base, index],
             results: [op.results[0]],
             // listOrder rides along: an ldmia-expanded load keeps its stream-order caveat as an aload
-            attrs: {
+            attrs: carryDiscipline(op, {
               elemSize: stride,
               signed: op.attrs.signed as boolean,
               fieldOff: op.attrs.off as number,
               ...(op.attrs.listOrder === true && { listOrder: true }),
-            },
+            }),
           });
         } else if (op.opcode === 'store') {
           bb.ops[i] = mkOp('astore', {
             operands: [base, index, op.operands[1]],
-            attrs: { elemSize: stride, fieldOff: op.attrs.off as number },
+            attrs: carryDiscipline(op, {
+              elemSize: stride,
+              fieldOff: op.attrs.off as number,
+              ...(op.attrs.signed !== undefined && { signed: op.attrs.signed }),
+            }),
           });
         }
       }