@asmlift/core 0.8.1 → 0.10.0

package/src/rank.ts

@@ -21,15 +21,17 @@
 import { cBackend } from './backend/c';
 import {
   assertDerefsTyped,
+  assertFrameUnionsViewed,
+  assertLocalStorageStaysInteger,
   assertLocalsWritten,
   assertNoOrphanedLocals,
   assertPlacementSurvives,
+  assertPostIncrUnshared,
   assertResolved,
 } from './contracts';
 import type { AsmData } from './frontend/asmdata';
-import { frontendFor } from './frontend/registry';
-import { hasSetupArgsNarrowing, narrowToSetupArgs } from './frontend/ssa';
-import { Fn, defOpMap } from './ir/core';
+import { hasSetupArgsNarrowing, narrowToSetupArgs, setupArgsDiscardsPassedResult } from './frontend/ssa';
+import { Fn, Value, defOpMap } from './ir/core';
 import { T } from './ir/types';
 import { verify } from './ir/verify';
 import { advancedBases } from './l3/advance';
@@ -42,6 +44,7 @@ import type { Gate } from './l3/gates';
 import type { HoistPlacement } from './l3/hoist';
 import { homeSplitTag, homeSplitWithholds, splitHomeBases } from './l3/homesplit';
 import { inlinableConstBases, inlineConstBases } from './l3/inlinebase';
+import { integerCells } from './l3/intcell';
 import { mulFirstSums } from './l3/mulfirst';
 import { nearBaseClusters } from './l3/nearbase';
 import { spellOperandMembers } from './l3/offmember';
@@ -52,15 +55,18 @@ import { reindexWalks } from './l3/reindex';
 import { hoistScopedBases } from './l3/scopebase';
 import { sinkInitsToFirstUse } from './l3/sinkinit';
 import type { SymbolRef } from './l3/symbol-refs';
+import { signedOverUnsignedCompare } from './l3/typing';
 import { type UnreduceResult, unreduceAccumulators } from './l3/unreduce';
 import { deviceVolatileClaims, volatilePtrLocals, volatileSubsetCandidates } from './l3/volatileptr';
 import { volatileValueLocals } from './l3/volatileval';
 import { volatileDeviceStores } from './l3/volstore';
 import { zeroSubNegates } from './l3/zerosub';
 import { RewritePattern } from './pattern/engine';
-import { applyIdiomPatterns, raiseRecovered, structureChecked } from './pipeline';
-import { type Prototypes, prototypesFromSymbols } from './proto';
+import { applyIdiomPatterns, liftStamped, raiseRecovered, stampBehaviorsFor, structureChecked } from './pipeline';
+import { type FnProto, type Prototypes, declaresVoidReturn, prototypesFromSymbols } from './proto';
+import { type ContextGlobals, splitOwnContext } from './proto-context';
 import { inferGlobalArrays, orderLicensedGlobals, sameDerivedShape } from './raise/globalshape';
+import { OFFSET_NAME_PASS } from './raise/offsetnames';
 import { runPreRecovery } from './raise/pre-recovery';
 import { recoverTypes } from './raise/recover';
 import { sinkStoreTails } from './raise/tailsink';
@@ -68,6 +74,7 @@ import {
   type RefusedDeclarationReason,
   bareGlobalAccessFacts,
   bareGlobalSymbols,
+  initAddressSymbols,
   makeRefCollector,
 } from './rank-declare';
 import {
@@ -80,13 +87,16 @@ import {
   SIGNEDNESS,
   STACKED_SUBSETS,
   STRUCTURE_VARIATIONS,
+  StackedMemberThrew,
   type StructureVariation,
   UNFOLDED_HOISTS,
   applyStacked,
   createdLocals,
+  firstFired,
   sameBases,
 } from './rank-variations';
-import { hasDivergentSharedRet } from './structure/structure';
+import { type Stillborn, stillbornVerdict } from './stillborn';
+import { DefaultAcceptsMemo, DefaultAcceptsMemoMisuse, hasDivergentSharedRet } from './structure/structure';
 import {
   type SymbolInfo,
   type SymbolMap,
@@ -96,7 +106,13 @@ import {
   symbolsByName,
 } from './symbols';
 import { type TargetDescription, structureOptionsFor } from './target';
-import { type SubjectVariationName, type Variation, offeredOn, withSubject } from './variation-tokens';
+import {
+  type SubjectVariationName,
+  type Variation,
+  type VariationName,
+  offeredOn,
+  withSubject,
+} from './variation-tokens';
 
 /** Pin every SCALAR entry param (index not in `ptrIdx`) to the candidate signedness, before
  *  recovery. Answers whether any param was PINNABLE — not whether its type moved: which of the
@@ -106,16 +122,33 @@ import { type SubjectVariationName, type Variation, offeredOn, withSubject } fro
  *  A param NARROWED by raise/paramwidth.ts is not pinnable: the extension it was narrowed at states
  *  the signedness as well as the width — agbcc's shift pair by its `asr`/`lsr`, PPC's `extsb`/`extsh`
  *  by the opcode — so there is no question for the signedness variation to put to the differ, and pinning would
- *  widen it back to 32 bits. */
+ *  widen it back to 32 bits.
+ *
+ *  Nor is a param NOTHING READS. Its declared signedness reaches no instruction, so the two
+ *  candidates would differ only in the signature's text and compile to the same object. The frontend
+ *  mints such params on purpose: an argument register below the highest one read keeps its slot
+ *  (`frontend/ssa.ts` mintArgSlotHoles). Counting one as pinnable would double the fan of every
+ *  function whose only scalar params are unread. */
 function pinScalarParams(fn: Fn, signed: boolean, ptrIdx: Set<number>): boolean {
+  const read = new Set<Value>();
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      op.operands.forEach((v) => read.add(v));
+      op.successors.forEach((s) => s.args.forEach((v) => read.add(v)));
+    }
+  }
   let pinnable = false;
   fn.blocks[0].params.forEach((p, i) => {
-    if (ptrIdx.has(i)) {
+    if (ptrIdx.has(i) || !read.has(p)) {
       return;
     }
-    if (p.type.kind === 'unknown' || (p.type.kind === 'int' && p.type.width === 32)) {
+    // AT THE PARAMETER'S OWN WIDTH. The pin answers a question the asm does not — whether the
+    // source declared this parameter signed — and a 64-bit parameter has that question too; what
+    // it does not have is a spare 32 bits to lose to a constant here. A width the machine already
+    // narrowed (a declared `u8`) is not a scalar this variation re-decides, so it is left alone.
+    if (p.type.kind === 'unknown' || (p.type.kind === 'int' && p.type.width >= 32)) {
       pinnable = true;
-      p.type = signed ? T.s(32) : T.u(32);
+      p.type = T.int(p.type.width, signed);
     }
   });
   return pinnable;
@@ -133,6 +166,10 @@ export interface EnumerateOptions {
   asmData?: AsmData;
   /** address→symbol map (symbols.ts) — same contract as DecompileOptions.symbols */
   symbols?: SymbolMap;
+  /** same contract as DecompileOptions.contextGlobals */
+  contextGlobals?: ContextGlobals;
+  /** same contract as DecompileOptions.ownContextProto */
+  ownContextProto?: FnProto;
   /** Called when a respell variation THROWS or fails a boundary contract, so the failure is visible
    *  instead of the candidate silently not existing. Enumeration continues either way — the default
    *  candidate is unaffected — but a variation that never fires because it always throws is a defect,
@@ -220,15 +257,50 @@ export interface Candidate {
    *
    *  The third admission ground, and the narrowest. A respell variation must preserve semantics by
    *  construction (the POLICY note at the respell site), because on a nonmatch row the best
-   *  spelling is what the user is shown. One spelling cannot meet that bar from inside the pass:
-   *  `l3/unreduce.ts` moves a memory read into a loop whose stores are all device registers, and
-   *  on this board a device store can make the DEVICE write ordinary memory (a DMA trigger), which
-   *  no gate over the C can rule out. What settles it instead is the object: a candidate that
-   *  assembles to the target's own bytes IS the program, whatever a gate could have proved. So the
-   *  spelling is offered, scored, and then either wins on proof or is WITHHELD — never shown as a
-   *  best-effort answer. Both ranking drivers ask `withheldReason`, so neither can publish what the
-   *  other would not. */
+   *  spelling is what the user is shown. Two spellings cannot meet that bar from inside the pass,
+   *  each for its own fact (`PROOF_OBLIGATIONS` states them):
+   *
+   *   • `l3/unreduce.ts` moves a memory read into a loop whose stores are all device registers, and
+   *     on this board a device store can make the DEVICE write ordinary memory (a DMA trigger),
+   *     which no gate over the C can rule out;
+   *   • `l3/intcell.ts` spells a global as the integer a project may have declared it, where a
+   *     pointer declaration scales the offset it adds, and no declaration is in the asm.
+   *
+   *  A third obligation is judged on the finished tree rather than declared by a variation
+   *  (`signedUnsignedCompare` below):
+   *
+   *   • `/signed-cmp`, or a respell over its tree, spells an unsigned compare over signed-rendering
+   *     operands, which compiles to a signed compare unless the operands are non-negative, and the
+   *     compiler's proof of that is not in the asm.
+   *
+   *  What settles all three instead is the object: a candidate that assembles to the target's own
+   *  bytes IS the program, whatever a gate could have proved. So the spelling is offered, scored, and then
+   *  either wins on proof or is WITHHELD — never shown as a best-effort answer. Both ranking drivers
+   *  ask `withheldReason`, so neither can publish what the other would not. */
   matchOnly?: true;
+  /** The tree this source was emitted from spells some unsigned compare so that C evaluates it
+   *  signed (l3/typing.ts `signedOverUnsignedCompare`, judged on the finished tree), which makes it
+   *  `matchOnly` and names the fact it owes. Set for whichever variation got it there: emission
+   *  under `/signed-cmp`, or a respell that substituted into a compare emission had pinned. It is
+   *  the only place this obligation is decided: a pass that rebuilds a compare spreads the node to
+   *  keep its `unsignedCmp` evidence (l3/regspell.ts), a merge that keeps one of two equal nodes
+   *  keeps the evidence of both (l3/ast.ts `unionEvidence`), or drops it only where its own gate proved
+   *  the new spelling compares the same values (l3/initfirst.ts `swapSide`, l3/reindex.ts). */
+  signedUnsignedCompare?: true;
+  /** This candidate's lift is `/setup-args` and drops an earlier callee's result that a call through
+   *  a register is passed (frontend/ssa.ts `setupArgsDiscardsPassedResult`). It loses every score
+   *  tie (compareScored): a tie refutes neither reading, and a shorter spelling must not win by
+   *  dropping a value the callee may read. */
+  discardsPassedResult?: true;
+  /** This candidate's lift is `/narrow-param` and declares a parameter narrow that no prototype
+   *  declares (raise/pre-recovery.ts `onUndeclaredWidth`). It loses every score tie
+   *  (compareScored): a tie refutes neither declaration, and the narrow one changes the bytes of
+   *  every prototyped caller, which this function's score cannot see. */
+  guessesParamWidth?: true;
+  /** This candidate's lift is `/far-cast` and spells a far member store through a cast of its
+   *  base. It loses every score tie (compareScored): a tie means the compiler built the member's
+   *  object too, and the member is the spelling that names the field. */
+  farStoreCast?: true;
 }
 /** A candidate paired with its score `S` (the injected scorer's result shape — must carry `.score`). */
 export interface Scored<S> extends Candidate {
@@ -261,10 +333,20 @@ export interface WithheldCandidate {
   why: string;
 }
 
+/** A candidate that was NEVER COMPILED: the fan was declared stillborn (stillborn.ts) before its
+ *  turn came. Kept apart from `dropped`, which means "the scorer refused it" — nothing refused
+ *  this one, and a count that folded the two would report compiles that never ran. */
+export interface NotCompiledCandidate {
+  variations: readonly string[];
+  /** the text the stop bet the compiler would refuse: a stop is re-placed whenever it changes, and
+   *  the benchmark keys its STOP report on it (`fanNotCompiledDigest`) */
+  source: string;
+}
+
 /** EVERY candidate refused — `rankBy` has no ranked result to return, so it throws this.
  *
- *  The two lists ride on the error, and that is the point of having a class at all: on a row where
- *  nothing scored, `dropped` IS the whole fan, and a bare `Error` discards it. A caller that
+ *  The lists ride on the error, and that is the point of having a class at all: on a row where
+ *  nothing scored, the three of them ARE the whole fan, and a bare `Error` discards it. A caller that
  *  prints one candidate's failure (the `cause`) is showing the LAST spelling the scorer refused,
  *  which is neither the first nor a representative one — the benchmark's own noncompile rows have
  *  up to a thousand siblings behind that single line. The MESSAGE is load-bearing and must stay
@@ -273,11 +355,20 @@ export interface WithheldCandidate {
 export class NoScorableCandidateError extends Error {
   readonly dropped: DroppedCandidate[];
   readonly withheld: WithheldCandidate[];
-  constructor(message: string, dropped: DroppedCandidate[], withheld: WithheldCandidate[], options?: ErrorOptions) {
+  /** empty unless the fan was declared stillborn; `dropped` is then only what WAS compiled */
+  readonly notCompiled: NotCompiledCandidate[];
+  constructor(
+    message: string,
+    dropped: DroppedCandidate[],
+    withheld: WithheldCandidate[],
+    notCompiled: NotCompiledCandidate[],
+    options?: ErrorOptions,
+  ) {
     super(message, options);
     this.name = 'NoScorableCandidateError';
     this.dropped = dropped;
     this.withheld = withheld;
+    this.notCompiled = notCompiled;
   }
 }
 
@@ -301,7 +392,7 @@ export interface RankedResult<S> {
   candidates: Scored<S>[]; // sorted best (lowest) first
   /** candidates whose scoreFn threw — empty when every spelling built */
   dropped: DroppedCandidate[];
-  /** candidates withheld for want of a byte-exact proof — empty unless a `matchOnly` variation fired */
+  /** candidates withheld for want of a byte-exact proof — empty unless a `matchOnly` candidate scored a nonmatch */
   withheld: WithheldCandidate[];
 }
 
@@ -309,14 +400,31 @@ export interface RankedResult<S> {
  *  drivers over one enumeration (this module's sync `rankBy` and the webapp's async await-loop),
  *  and a filter written twice is how they come to publish different answers. Null ⇒ publish.
  *
- *  `score === 0` is objdiff's byte-exact match (cli objdiff.ts states the equivalence), which is
+ *  `score === 0` is objdiff's byte-exact match (@match-kit/scoring states the equivalence), which is
  *  why a bare `.score` suffices and the generic needs no `match` field. */
 export function withheldReason<S extends { score: number }>(c: Candidate, score: S): string | null {
-  return c.matchOnly === true && score.score !== 0
-    ? 'this spelling rests on a device-behaviour fact no gate over the C can settle; only a byte-exact score proves it'
-    : null;
+  if (c.matchOnly !== true || score.score === 0) {
+    return null;
+  }
+  const facts = c.variations.flatMap((v) => PROOF_OBLIGATIONS.get(v) ?? []);
+  if (c.signedUnsignedCompare === true) {
+    facts.push(SIGNED_COMPARE_OBLIGATION);
+  }
+  const fact = facts.length > 0 ? facts.join(' and on ') : 'a fact no gate over the C can settle';
+  return `this spelling rests on ${fact}; only a byte-exact score proves it`;
 }
 
+/** The fact each proof-carrying variation (`needsProof`) rests on, as `withheldReason` publishes it. */
+const PROOF_OBLIGATIONS: ReadonlyMap<string, string> = new Map<VariationName, string>([
+  ['unreduce', 'a device-behaviour fact no gate over the C can settle'],
+  ['int-cell', 'the project declaring the global an integer, which the assembly does not show'],
+]);
+
+/** The fact `Candidate.signedUnsignedCompare` rests on. Keyed by the flag, not by `/signed-cmp`:
+ *  that name is on candidates that owe nothing (a compare over a `u32` operand) and missing from
+ *  respells that do. */
+const SIGNED_COMPARE_OBLIGATION = "the compiler having proved every unsigned compare's operands non-negative";
+
 /** What a respell variation hands `respell`: its tree, or — when the variation cannot establish the
  *  candidate's semantics from inside the pass — the tree paired with that fact. `undefined`/`null`
  *  is a decline. */
@@ -380,6 +488,8 @@ interface TreeSource {
   deviceVolatile?: number;
   /** see `Candidate.matchOnly` — set by a variation that cannot establish its own semantics */
   matchOnly?: true;
+  /** see `Candidate.signedUnsignedCompare` */
+  signedUnsignedCompare?: true;
 }
 
 /** Emit the DISTINCT type/branch-sense candidates for `name` — PURE, no scoring.
@@ -407,15 +517,17 @@ export function enumerateCandidates(
   let lastEmitError: unknown = null;
   // Same merge as `decompile`: the project's DWARF signatures fill in what the caller did not
   // state, so both the annotate pass and the ranked candidates reason about one prototype table.
-  const prototypes = prototypesFromSymbols(opts.symbols, opts.prototypes ?? {});
-  const frontend = frontendFor(target);
+  const ownContext = splitOwnContext(opts.prototypes, name, opts.ownContextProto);
+  const prototypes = prototypesFromSymbols(opts.symbols, ownContext.prototypes ?? {});
   const baseOpts = {
-    ...structureOptionsFor(target, prototypes[name]?.returnsVoid ?? false),
+    ...structureOptionsFor(target, declaresVoidReturn(prototypes[name]), prototypes),
     // See the same line in pipeline.ts: a backend that cannot print switch fall-through must not
     // be handed a tree carrying one, because its refusal costs the whole candidate (and, when
     // every candidate carries it, the whole row).
     spellSwitchFallthrough: backend.spellsSwitchFallthrough,
+    spellSwitchBreak: backend.spellsSwitchBreak,
     ...(opts.symbols ? { symbols: symbolsByName(opts.symbols) } : {}),
+    ...(opts.contextGlobals ? { contextGlobals: opts.contextGlobals } : {}),
   };
   // Branch-sense is a differ-ranked VARIATION, the same class as param signedness: a divergent `if`
   // can be spelled with either sense (`if (c) A else B` vs `if (!c) B else A`), and which one the
@@ -537,12 +649,23 @@ export function enumerateCandidates(
   // it buys is that a lift-time change which splits them enumerates both settings rather than
   // silently dropping one, the failure nothing reports.
   let sharedLiftTreeOwned = false;
+  let sharedLiftExtendedReaders = false;
+  let sharedLiftFoldedStore = false;
   // Shared lift: recover ONCE with no signedness pin, to learn which entry params are
   // pointers/aggregates so they are excluded from the signedness variation (see NO_PIN_KINDS). One
   // extra lift+recover, no compile. (The shared lift deliberately stops after recoverTypes — it only reads the param KINDS, so
   // the totality contract / return-sinking of the full spine are not run on it.)
-  const sharedLift = frontend.lift(name, asm, target, prototypes, opts.asmData, opts.symbols);
-  verify(sharedLift);
+  const sharedLift = liftStamped(
+    name,
+    asm,
+    target,
+    prototypes,
+    opts.asmData,
+    opts.symbols,
+    opts.contextGlobals,
+    undefined,
+    ownContext.ownContextProto,
+  );
   // The ARRAY SHAPES the input assembly evidences (raise/globalshape.ts), for the DECLARATION
   // half. Read off the shared lift's LIFTED form — before the fold below and the tower rewrite it —
   // because the base-materialization order the derivation's licence reads does not survive them.
@@ -557,6 +680,16 @@ export function enumerateCandidates(
         sharedLiftTreeOwned = true;
       },
     },
+    paramWidth: {
+      onExtendedReaders: () => {
+        sharedLiftExtendedReaders = true;
+      },
+    },
+    displaced: {
+      onFoldedStore: () => {
+        sharedLiftFoldedStore = true;
+      },
+    },
   });
   recoverTypes(sharedLift);
   const ptrIdx = new Set<number>(
@@ -581,18 +714,47 @@ export function enumerateCandidates(
   // shared lift's `onTreeOwned` hook has had its chance to fire. Called any earlier it would report a confident
   // `false` for a function that owns a tree. As a `const` below that call, an early call is a TDZ
   // ReferenceError instead — a wrong answer traded for a loud one.
-  const treeOwnedIn = (symbols: typeof opts.symbols): boolean => {
+  //
+  // `/narrow-param`'s gate is read off the same lift the same way: the width pass reports a
+  // parameter the variation's lift would narrow (raise/pre-recovery.ts `ParamWidthOptions`). So is
+  // `/far-cast`'s: the displaced-access fold reports a store it moved into a struct.
+  const liftReportsIn = (
+    symbols: typeof opts.symbols,
+  ): { treeOwned: boolean; extendedReaders: boolean; foldedStore: boolean } => {
     if (symbols === opts.symbols) {
-      return sharedLiftTreeOwned;
+      return {
+        treeOwned: sharedLiftTreeOwned,
+        extendedReaders: sharedLiftExtendedReaders,
+        foldedStore: sharedLiftFoldedStore,
+      };
     }
-    const p = frontend.lift(name, asm, target, prototypes, opts.asmData, symbols);
-    verify(p);
+    const p = liftStamped(
+      name,
+      asm,
+      target,
+      prototypes,
+      opts.asmData,
+      symbols,
+      opts.contextGlobals,
+      undefined,
+      ownContext.ownContextProto,
+    );
     applyIdiomPatterns(p, target, opts.patterns);
-    let seen = false;
+    const seen = { treeOwned: false, extendedReaders: false, foldedStore: false };
     runPreRecovery(p, target, () => verify(p), prototypes[name], {
       shortCircuit: {
         onTreeOwned: () => {
-          seen = true;
+          seen.treeOwned = true;
+        },
+      },
+      paramWidth: {
+        onExtendedReaders: () => {
+          seen.extendedReaders = true;
+        },
+      },
+      displaced: {
+        onFoldedStore: () => {
+          seen.foldedStore = true;
         },
       },
     });
@@ -800,6 +962,14 @@ export function enumerateCandidates(
     s.ptrElems &&
     s.declRank &&
     STRUCTURE_VARIATIONS.every((variation) => !s[variation.flag]);
+  /** Does a failure ABORT THE ROW, rather than drop the setting that threw? Only on the default
+   *  candidate's own path: no variation named by the symbol-map setting or the lift setting —
+   *  `settingVariations` is both, as the candidate spells them — and, where a structure setting is
+   *  named, the default one. Anywhere else the failure is a dropped variation, reported through
+   *  `onEnumerationError` under the same names. The lift, the raise and the structuring all ask
+   *  this one predicate, so a setting that names a new variation is seen by all three. */
+  const abortsRow = (settingVariations: readonly Variation[], s?: StructureSetting): boolean =>
+    settingVariations.length === 0 && (s === undefined || isDefaultSetting(s));
 
   const seen = new Map<string, Candidate>();
   const seenTrees = new Set<string>();
@@ -840,14 +1010,18 @@ export function enumerateCandidates(
   // every OTHER name in the function, so supplying more information made the tool strictly
   // worse. A union cannot — each name is declared by whichever half knows more about it.
   // SCOPE: `declSymbols` is used ONLY here. It must never reach `opts.symbols`/`baseOpts.symbols`
-  // or `frontend.lift` — feeding it to the lift would turn on pool promotion, interior
+  // or `liftStamped` — feeding it to the lift would turn on pool promotion, interior
   // attribution and the `/raw-globals` variation, which is a different (and source-moving) change.
   // THREE halves now, in increasing authority: the name-only pool/reloc symbols, the array shapes
   // the asm evidences for them (raise/globalshape.ts — an `extern u16 gTbl[];` where the bare
   // spelling needs one, and the declaration a candidate spelling `gTbl[i]` cannot compile
   // without), and the project map, which knows more than either.
   const mapSymbols = baseOpts.symbols;
-  const targetSymbols = new Map<string, SymbolInfo>([...bareGlobalSymbols(sharedLift), ...sharedLiftShapes]);
+  const targetSymbols = new Map<string, SymbolInfo>([
+    ...initAddressSymbols(sharedLift),
+    ...bareGlobalSymbols(sharedLift),
+    ...sharedLiftShapes,
+  ]);
   const declSymbols = new Map<string, SymbolInfo>([...targetSymbols, ...(mapSymbols ?? [])]);
   // The four per-enumeration constants named at the seam rather than captured across 60 lines of
   // closure (rank-declare.ts states why they belong on one object).
@@ -856,7 +1030,12 @@ export function enumerateCandidates(
     accessFacts,
     mapSymbols,
     targetNames: new Set(targetSymbols.keys()),
+    // The MERGED table, the same one the frontend was handed above, so the declaration a candidate
+    // carries and the lift that produced it cannot state different things about a callee.
+    prototypes,
+    target,
     refuse,
+    own: Object.hasOwn(prototypes, name) ? prototypes[name] : ownContext.ownContextProto,
   });
   // THE RESPELL SET, as a function whose PARAMETER LIST is the invariant the tree skip below
   // rests on: every source here is a pure function of the structured tree and this call's own
@@ -880,6 +1059,14 @@ export function enumerateCandidates(
   // of `/volatile` — a candidate that did not fail and is still in the fan. The order
   // is the candidates' own (`[pf.name, ...sp.variations]`), so a reported name and an enumerated
   // candidate's variations name the same candidate the same way.
+  //
+  // THE COMPARE-SIGNEDNESS PROOF, asked of every tree a source is emitted from rather than of the
+  // passes that build them. Emission pins each unsigned compare it lowers (structure.ts), but a
+  // respell that substitutes into a compare — `/unmerge` putting an arm's `s16` global where the
+  // pinned `u32` local stood, against an `s32` parameter — re-renders it signed. So the finished
+  // tree is judged here, and a signed rendering of an `icmp_u*` is `matchOnly` whoever produced it.
+  const cmpProof = (tree: SFn): { matchOnly?: true; signedUnsignedCompare?: true } =>
+    signedOverUnsignedCompare(tree) ? { matchOnly: true, signedUnsignedCompare: true } : {};
   const respellTree = (sfn: SFn, preRespellVariations: readonly Variation[] = []): TreeSources => {
     // The walk→index respell variation (l3/reindex.ts) is a THIRD variation on the same footing as
     // signedness and branch sense: whether the source spelled `*p; p++` or `arr[i]` is
@@ -897,7 +1084,7 @@ export function enumerateCandidates(
     // Pascal backend loud-declines). Refusing EVERY tree is still loud — the empty-enumeration
     // check at the end raises the last refusal.
     try {
-      sources.push({ variations: [], source: backend.emit(sfn), ...refsOf(sfn), ...volOf(sfn) });
+      sources.push({ variations: [], source: backend.emit(sfn), ...refsOf(sfn), ...volOf(sfn), ...cmpProof(sfn) });
     } catch (e) {
       reportThrow(preRespellVariations, e);
       return { sources, emit: { error: e } };
@@ -923,9 +1110,11 @@ export function enumerateCandidates(
     // numeric-address pointer local — the joint spelling is reachable from neither variation
     // alone, each composition narrows /volatile to that variation's own locals (volatilePtrLocals'
     // `only`), and each needed a row to demand it. The STACKED variations (STACKED_VARIATIONS) are
-    // derived onto EVERY source: statement order/shape is orthogonal to what any other respell
-    // variation changes — the same kind of independent dimension as signedness —
-    // so they are crossed with every source rather than paired; a third blanket composition needs
+    // derived onto EVERY source: statement order/shape, and the width a narrow local is declared
+    // at, are each orthogonal to what any respell variation outside that table changes — the same
+    // kind of independent dimension as signedness —
+    // so they are crossed with every source rather than paired (two members of the table may
+    // compete for one node, and its order decides; rank-variations.ts); a third blanket composition needs
     // the same argument, not just a row. And a specific PAIRING is admitted on one of two
     // grounds, never on "it might help". FIRST, a row demands the joint spelling AND that
     // spelling is reachable from neither variation alone: /livebase × /indexed, × /sinkinit,
@@ -991,14 +1180,25 @@ export function enumerateCandidates(
         assertResolved(alt);
         assertDerefsTyped(alt);
         assertLocalsWritten(alt);
+        assertPostIncrUnshared(alt);
         assertNoOrphanedLocals(sfn, alt);
-        sources.push({ variations, source: backend.emit(alt), ...refsOf(alt), ...volOf(alt), ...proof });
+        assertLocalStorageStaysInteger(sfn, alt);
+        assertFrameUnionsViewed(alt);
+        sources.push({
+          variations,
+          source: backend.emit(alt),
+          ...refsOf(alt),
+          ...volOf(alt),
+          ...proof,
+          ...cmpProof(alt),
+        });
         // STACKED variations, derived onto EVERY source (the POLICY note above carries the
-        // admission argument). Each is a statement-order/shape fact orthogonal to
-        // representation; subsets compose in the fixed order below. A stacked variation that
+        // admission argument). Each is a statement-order/shape or declaration-width fact
+        // orthogonal to the respell variations outside the table; subsets compose in the fixed
+        // table order, which decides between two members that compete for one node. A stacked variation that
         // never fires declines and costs nothing.
         if (!alreadyShaped) {
-          // A shape REORDERS statements, and it is derived after a variation has placed its defs —
+          // A shape may REORDER statements, and it is derived after a variation has placed its defs —
           // so the placement is re-checked on the shaped tree (contracts.ts). Differential: judged
           // only where the unshaped tree already satisfied the walk, so a variation whose placement
           // it never described is not dropped on the strength of a model that does not apply.
@@ -1018,18 +1218,24 @@ export function enumerateCandidates(
           // which moves only const or pure-read assigns and so cannot lift a read of a base local
           // above its init.
           const minted = createdLocals(sfn, alt);
+          const firedSets = new Set<string>();
           for (const subset of STACKED_SUBSETS) {
             // ONE TRY PER SHAPE — a shape is its own candidate and fails as its own candidate.
             // Sharing the respell variation's outer try would let a throw deriving one subset
             // discard every later one, under that variation's name, which names no shape.
-            const shapeVariations = subset.map((x) => x.name);
+            // A throw past applyStacked is reported under the fired set, the candidate's own name.
+            let shapeVariations: readonly Variation[] = [];
             try {
               const shaped = applyStacked(subset, alt);
-              if (shaped !== null) {
+              if (shaped !== null && firstFired(firedSets, shaped.variations)) {
+                shapeVariations = shaped.variations;
                 assertResolved(shaped.out);
                 assertDerefsTyped(shaped.out);
                 assertLocalsWritten(shaped.out);
+                assertPostIncrUnshared(shaped.out);
                 assertNoOrphanedLocals(alt, shaped.out);
+                assertLocalStorageStaysInteger(alt, shaped.out);
+                assertFrameUnionsViewed(shaped.out);
                 assertPlacementSurvives(alt, shaped.out, minted);
                 sources.push({
                   variations: [...variations, ...shaped.variations],
@@ -1038,10 +1244,12 @@ export function enumerateCandidates(
                   ...volOf(shaped.out),
                   // a shape derived from a proof-gated spelling inherits the requirement
                   ...proof,
+                  ...cmpProof(shaped.out),
                 });
               }
             } catch (e) {
-              reportThrow([...preRespellVariations, ...variations, ...shapeVariations], e);
+              const step = e instanceof StackedMemberThrew ? e.variations : shapeVariations;
+              reportThrow([...preRespellVariations, ...variations, ...step], e);
             }
           }
         }
@@ -1057,19 +1265,21 @@ export function enumerateCandidates(
     // `/argbase` — name a call's argument bases before the call (l3/argbase.ts). A variation on the
     // same footing as the others: the default inline spelling stays in the list, so the differ
     // referees and this can never cost a match.
+    const firedSets = new Set<string>();
     for (const subset of STACKED_SUBSETS) {
       // the truthful variations need the pass to RUN first, so this bypasses respell's
       // variations-then-thunk shape: same try posture, variations from the fired members
       try {
         const shaped = applyStacked(subset, sfn);
-        if (shaped !== null) {
+        if (shaped !== null && firstFired(firedSets, shaped.variations)) {
           // the ONE call whose variations already name shapes — say so, rather than making `respell`
           // read them back out of the variations it was handed
           respell(shaped.variations, () => shaped.out, true);
         }
       } catch (e) {
-        // the report names the full subset — the fired set is unknown mid-throw
-        reportThrow([...preRespellVariations, ...subset.map((x) => x.name)], e);
+        // `respell` reports its own throws, so only a member can throw here
+        const step = e instanceof StackedMemberThrew ? e.variations : subset.map((x) => x.name);
+        reportThrow([...preRespellVariations, ...step], e);
       }
     }
     respell(['argbase'], () => materializeArgBases(sfn));
@@ -1143,9 +1353,9 @@ export function enumerateCandidates(
     // only ties `/vol-store`'s 27, and RT's 32 beats the admitted standalone `/unreduce`'s 35, so
     // "worse than an admitted variation" would exclude neither.
     //
-    // WHAT THE STANDALONE LINES COST, since neither of the two variations ever wins an artifact row
-    // ALONE — every `/unreduce` and `/ptr-field` winner rides inside a `/vol-store` pairing, which
-    // is the property `apps/benchmark/test/census.test.ts` asserts. They are kept because a
+    // WHAT THE STANDALONE LINES COST, since the two variations rarely win an artifact row ALONE —
+    // `apps/benchmark/test/census.test.ts` names every `/unreduce` and `/ptr-field` winner outside
+    // a `/vol-store` pairing, and fails on one it does not name. They are kept because a
     // variation has to be able to LOSE on its own terms: the admission posture (compareScored orders
     // by score) is what makes a wrong respelled source harmless, and it is only observable when the
     // single-variation candidate is in the fan —
@@ -1666,6 +1876,17 @@ export function enumerateCandidates(
     // Which placement the source used is not derivable from the asm, so both are emitted and the
     // differ referees.
     respell(['sinkinit'], () => sinkInitsToFirstUse(sfn));
+    // `/int-cell` — every pointer cell spelled as the integer a project may have declared it,
+    // `g = g + K` and no conversions (l3/intcell.ts). The default's `g = (void *)((u8 *)g + K)` is
+    // right under a pointer declaration of g and rejected by CodeWarrior under an integer one, where
+    // this is the source; which the project declared is not in the asm, so it is published only at
+    // a byte-exact score.
+    respell(['int-cell'], () =>
+      integerCells(sfn, (n) => {
+        const shape = mapSymbols?.get(n)?.shape;
+        return shape !== undefined && shape !== 'scalar';
+      }),
+    );
     // the register-copy variation (l3/regspell.ts): 0–3 results (base; tail assign-back reusing
     // the dead value var; tail assign-back into a fresh var — the tail decision is allocator-
     // ambiguous, so both are ranked).
@@ -1707,8 +1928,13 @@ export function enumerateCandidates(
         { variations: ['raw-globals'], symbols: undefined },
       ]
     : [{ variations: [] }];
+  // The map's POINTER declarations go to the raw setting all the same: a raw name is still a
+  // pointer in the project's file, so arithmetic on its value scales unless spelled in bytes.
+  const pointerGlobals = new Set(
+    [...(baseOpts.symbols?.entries() ?? [])].filter(([, info]) => info.shape === 'pointer').map(([n]) => n),
+  );
   for (const [symbolIndex, symbolSetting] of symbolSettings.entries()) {
-    const symbolSettingOpts = symbolSetting.symbols ? baseOpts : { ...baseOpts, symbols: undefined };
+    const symbolSettingOpts = symbolSetting.symbols ? baseOpts : { ...baseOpts, symbols: undefined, pointerGlobals };
     // `/no-bitfield` names a spelling the MAP makes available, so it has no inhabitant on the
     // symbol-map setting that structures without one: structure() normalizes `spellBitfieldMembers`
     // to false when `symbols` is absent, so both settings structure the identical tree whatever
@@ -1728,7 +1954,23 @@ export function enumerateCandidates(
     const usableStructureSettings = symbolSetting.symbols
       ? structureSettings
       : structureSettings.filter((s) => s.bitfields && s.ptrElems && (s.declRank || rawDerivesRank));
-    const treeOwnedFold = treeOwnedIn(symbolSetting.symbols);
+    // THE `/raw-globals` SETTING IS A VARIATION, so a lift that declines without the map drops it
+    // and keeps the map's candidates (`abortsRow`). The two lifts can disagree on whether a
+    // function lifts at all: a name only the map places is, without it, a pointer the frame-object
+    // audit cannot bound. This is the setting's first lift, and every later one is the same lift
+    // again.
+    let treeOwnedFold: boolean;
+    let extendedReaders: boolean;
+    let foldedStore: boolean;
+    try {
+      ({ treeOwned: treeOwnedFold, extendedReaders, foldedStore } = liftReportsIn(symbolSetting.symbols));
+    } catch (e) {
+      if (abortsRow(symbolSetting.variations)) {
+        throw e;
+      }
+      reportThrow(symbolSetting.variations, e);
+      continue;
+    }
     // The signedness variation DECLINES where the pin has nothing to pin. `pinScalarParams` writes only
     // over an entry param still `unknown`/`int` that is not one of the recovered pointers/
     // aggregates `ptrIdx` excludes; where no param is left, the second pass re-lifts, re-raises and
@@ -1744,7 +1986,22 @@ export function enumerateCandidates(
       if (cand.signed && !pinnable) {
         break;
       }
-      const base = frontend.lift(name, asm, target, prototypes, opts.asmData, symbolSetting.symbols);
+      let tailSlot = false;
+      const base = liftStamped(
+        name,
+        asm,
+        target,
+        prototypes,
+        opts.asmData,
+        symbolSetting.symbols,
+        opts.contextGlobals,
+        {
+          onTailSlot: () => {
+            tailSlot = true;
+          },
+        },
+        ownContext.ownContextProto,
+      );
       // `/setup-args` — pass a prototype-less callee only what the CALLING BLOCK set up; which of
       // the two readings the source spelled is genuinely ambiguous, and frontend/ssa.ts
       // narrowToSetupArgs carries the argument for why the differ is what settles it.
@@ -1810,11 +2067,66 @@ export function enumerateCandidates(
             { variations: ['setup-args'], narrow: true },
           ]
         : [{ variations: [], narrow: false }];
+      // `/narrow-param` — declare a parameter every reader of which is an extension at the widest
+      // reader's width (raise/paramwidth.ts, EVERY READER AN EXTENSION). A lift variation for the
+      // reason `/connective` is: the raise mutates in place, and the parameter's width is what
+      // recovery and every later stage read. Enumerated only where this symbol-map setting's lift
+      // reports such a parameter; crossed with the other two, and the dedup collapses what agrees.
+      const paramSettings: { variations: readonly Variation[]; extendedReaders: boolean }[] = extendedReaders
+        ? [
+            { variations: [], extendedReaders: false },
+            { variations: ['narrow-param'], extendedReaders: true },
+          ]
+        : [{ variations: [], extendedReaders: false }];
+      // `/kept-slot` — keep the delay slot of a MIPS `b`/`j` whose slot ends a common tail both arms
+      // spell, where the default lift retargets it to the copy before its target and merges the
+      // arms (frontend/mips.ts `normaliseBranchLikely`: the two are one object, and which the source
+      // wrote is the differ's to say). A LIFT variation because the rewrite is the CFG every later
+      // stage reads. Enumerated only where this setting's default lift reports such a slot; crossed
+      // with the others, and the dedup collapses what agrees. An IDO reading: GCC 2.7.2 and KMC
+      // cross-jump a tail both arms spell before they fill a slot, so they leave no such tail.
+      const tailSettings: { variations: readonly Variation[]; keepTailSlots: boolean }[] = tailSlot
+        ? [
+            { variations: [], keepTailSlots: false },
+            { variations: ['kept-slot'], keepTailSlots: true },
+          ]
+        : [{ variations: [], keepTailSlots: false }];
+      // `/far-cast` — keep each store the displaced-access fold would move into a struct on the
+      // address it was reached through (raise/structs.ts `foldDisplacedAccesses`). On agbcc the
+      // member store and the cast store are two objects (target.ts `farMemberStoreOrder`), and a
+      // hoisted pointer the source held builds the cast's. Elsewhere a folded store stops aliasing
+      // the loads beside it and a held pointer is spelled as members, which KMC, GCC 2.7.2 and mwcc
+      // build into other objects. So which one the source wrote is the differ's to say, on every
+      // target. A LIFT variation because the fold decides which struct the stores join, which
+      // recovery and every later stage read. Enumerated only where this setting's lift folded a
+      // store.
+      const castSettings: { variations: readonly Variation[]; keepStores: boolean }[] =
+        foldedStore && offeredOn(target, ['far-cast'])
+          ? [
+              { variations: [], keepStores: false },
+              { variations: ['far-cast'], keepStores: true },
+            ]
+          : [{ variations: [], keepStores: false }];
       const liftSettings = narrowSettings.flatMap((l) =>
-        connectiveSettings.map((c) => ({ ...l, ...c, variations: [...l.variations, ...c.variations] })),
+        connectiveSettings.flatMap((c) =>
+          paramSettings.flatMap((w) =>
+            tailSettings.flatMap((k) =>
+              castSettings.map((f) => ({
+                ...l,
+                ...c,
+                ...w,
+                ...k,
+                ...f,
+                variations: [...l.variations, ...c.variations, ...w.variations, ...k.variations, ...f.variations],
+              })),
+            ),
+          ),
+        ),
       );
       for (const liftSetting of liftSettings) {
         let fn: Fn;
+        let discardsPassedResult = false;
+        let guessesParamWidth = false;
         let inferredSymbols = new Map<string, SymbolInfo>();
         let orderLicensed: ReadonlySet<string> = new Set<string>();
         try {
@@ -1823,10 +2135,21 @@ export function enumerateCandidates(
           fn =
             liftSetting.variations.length === 0
               ? base
-              : frontend.lift(name, asm, target, prototypes, opts.asmData, symbolSetting.symbols);
+              : liftStamped(
+                  name,
+                  asm,
+                  target,
+                  prototypes,
+                  opts.asmData,
+                  symbolSetting.symbols,
+                  opts.contextGlobals,
+                  { keepTailSlots: liftSetting.keepTailSlots },
+                  ownContext.ownContextProto,
+                );
           if (liftSetting.narrow && !narrowToSetupArgs(fn)) {
             continue; // nothing to cut after all — the default lift's own candidates already cover it
           }
+          discardsPassedResult = liftSetting.narrow && setupArgsDiscardsPassedResult(fn);
           verify(fn);
           // This lift's OWN array-shape evidence, off its own lifted fn (a symbol map promotes
           // numeric pool words to `gaddr`, so the `/raw-globals` setting genuinely answers differently).
@@ -1855,6 +2178,13 @@ export function enumerateCandidates(
           // declaration. A map that names the symbol an array takes the access to a bare `var`
           // base anyway, which carries no licence: the two never meet.
           orderLicensed = orderLicensedGlobals(fn, target);
+          // …and the NAMES the map holds for the addresses this lift built by arithmetic off a
+          // named one (raise/offsetnames.ts). Per lift setting, off that setting's own map: the
+          // `/raw-globals` sibling has no map and so no name to reach. AFTER the two readings, and
+          // the staleness that leaves them is priced in pipeline.ts's copy of this note.
+          if (symbolSetting.symbols) {
+            OFFSET_NAME_PASS.run(fn, symbolSetting.symbols, stampBehaviorsFor(target, opts.contextGlobals));
+          }
           for (const [n, si] of [...inferredSymbols]) {
             if (baseOpts.symbols?.has(n) === true || !sameDerivedShape(declSymbols.get(n), si)) {
               inferredSymbols.delete(n);
@@ -1875,18 +2205,28 @@ export function enumerateCandidates(
               },
             },
             prototypes[name],
-            { shortCircuit: { foldTreeOwned: liftSetting.connective } },
+            {
+              shortCircuit: { foldTreeOwned: liftSetting.connective },
+              paramWidth: {
+                extendedReaders: liftSetting.extendedReaders,
+                onUndeclaredWidth: () => {
+                  guessesParamWidth = true;
+                },
+              },
+              displaced: { keepStores: liftSetting.keepStores },
+            },
           );
         } catch (e) {
           // THE DEFAULT CARRIES NO VARIATION, by construction: every lift variation appends one, so
-          // `variations.length === 0` is the only spelling of "no lift variation is on" that stays correct
+          // an empty list is the only spelling of "no lift variation is on" that stays correct
           // when a fourth is added — the same reason the structure half below reads its table
           // instead of naming its flags.
-          if (liftSetting.variations.length === 0) {
+          const settingVariations = [...liftSetting.variations, ...symbolSetting.variations];
+          if (abortsRow(settingVariations)) {
             throw e; // the default lift keeps its behavior: a raising failure aborts the row
           }
           // A dropped variation, never an aborted enumeration — the same posture as `respell`.
-          reportThrow(liftSetting.variations, e);
+          reportThrow(settingVariations, e);
           continue;
         }
         // THE SHARED-TAIL VARIATIONS: the same raised fn, structured again with `followEarlyReturns`,
@@ -1894,7 +2234,8 @@ export function enumerateCandidates(
         //   - `/shared-ret` is the follow ALONE, on the fn as raised. Some divergent `if` shares a
         //     `ret` the compiler left in place (`synthetic:gcseinner`).
         //   - `/shared-tail` is the follow after `sinkStoreTails` has rewritten the fn in place, which
-        //     is safe because `structure()` never mutates `fn`, so the earlier passes are done with it.
+        //     is safe because `structure()` writes nothing on `fn` but the `declared` stamps, which it
+        //     re-derives from its map on every call, so the earlier passes are done with it.
         //     It is enumerated only where the sink changed something AND some divergent `if` of the
         //     SUNK fn shares a `ret`. That is the sink's price gate: without it, a tail copied into
         //     arms no `if` shares adds a candidate spelling it in each — 204 synthetic candidates on 8
@@ -1930,6 +2271,8 @@ export function enumerateCandidates(
         // `droppedDefault` is the DEFAULT pass's drops. Each shared-tail pass reads it and keeps its
         // own drops in a copy, so one pass's structuring failure never removes the other's candidate.
         const droppedDefault = new Set<string>();
+        // What `assertDefaultAccepts` learned about this fn, shared by every setting structured from it.
+        let acceptsMemo = new DefaultAcceptsMemo(fn);
         for (const pass of ['default', 'follow', 'sink'] as const) {
           if (pass === 'follow' && !hasDivergentSharedRet(fn)) {
             continue;
@@ -1938,11 +2281,13 @@ export function enumerateCandidates(
             let sunk: boolean;
             try {
               sunk = sinkStoreTails(fn);
+              // The sink rewrites fn in place, so nothing the memo learned before it holds after it.
+              acceptsMemo = new DefaultAcceptsMemo(fn);
               if (sunk) {
                 verify(fn);
               }
             } catch (e) {
-              reportThrow([...liftSetting.variations, 'shared-tail'], e);
+              reportThrow([...liftSetting.variations, 'shared-tail', ...symbolSetting.variations], e);
               break;
             }
             // Unsunk, this fn is the `/shared-ret` pass's again.
@@ -1996,30 +2341,39 @@ export function enumerateCandidates(
               dropped.add(key);
               continue;
             }
-            // structure() reads `fn` and produces a fresh SFn (it does not mutate `fn`), so both branch
-            // senses structure the same recovered function without re-lifting.
+            // structure() produces a fresh SFn and writes nothing on `fn` but the `declared` stamps,
+            // which it re-derives from its map on every call, so both branch senses structure the same
+            // recovered function without re-lifting.
             let sfn: SFn;
             try {
-              sfn = structureChecked(fn, {
-                ...symbolSettingOpts,
-                ...(inferredSymbols.size ? { inferredSymbols } : {}),
-                ...(orderLicensed.size ? { orderLicensedGlobals: orderLicensed } : {}),
-                preserveDivergentBranchSense: s.sense,
-                negateJoinedBranchSense: s.join ? !defSense : defSense,
-                ...(s.flipSites ? { branchSenseFlipSites: s.flipSites } : {}),
-                anchorConstCopies: s.anchor,
-                anchorLoopEntryConsts: s.entry,
-                spellBitfieldMembers: s.bitfields,
-                spellPtrMemberElements: s.ptrElems,
-                spellDeclaredSubscripts: s.declRank,
-                ...STRUCTURE_VARIATIONS.reduce(
-                  (acc, variation) => ({ ...acc, ...variation.options(s[variation.flag]) }),
-                  {},
-                ),
-                ...(alternative ? { followEarlyReturns: true } : {}),
-              });
+              sfn = structureChecked(
+                fn,
+                {
+                  ...symbolSettingOpts,
+                  ...(inferredSymbols.size ? { inferredSymbols } : {}),
+                  ...(orderLicensed.size ? { orderLicensedGlobals: orderLicensed } : {}),
+                  preserveDivergentBranchSense: s.sense,
+                  negateJoinedBranchSense: s.join ? !defSense : defSense,
+                  ...(s.flipSites ? { branchSenseFlipSites: s.flipSites } : {}),
+                  anchorConstCopies: s.anchor,
+                  anchorLoopEntryConsts: s.entry,
+                  spellBitfieldMembers: s.bitfields,
+                  spellPtrMemberElements: s.ptrElems,
+                  spellDeclaredSubscripts: s.declRank,
+                  ...STRUCTURE_VARIATIONS.reduce(
+                    (acc, variation) => ({ ...acc, ...variation.options(s[variation.flag]) }),
+                    {},
+                  ),
+                  ...(alternative ? { followEarlyReturns: true } : {}),
+                },
+                undefined,
+                acceptsMemo,
+              );
             } catch (e) {
-              if (liftVariations.length === 0 && isDefaultSetting(s)) {
+              if (e instanceof DefaultAcceptsMemoMisuse) {
+                throw e; // a memo wired to the wrong fn is a defect here, never a dropped variation
+              }
+              if (abortsRow([...liftVariations, ...symbolSetting.variations], s)) {
                 throw e; // the default lift's default setting keeps its behavior: a failure aborts the row
               }
               // Recorded for EVERY dropped setting: a candidate with more variations on looks its siblings
@@ -2027,7 +2381,7 @@ export function enumerateCandidates(
               dropped.add(key);
               // an anchored setting that fails structuring or its contracts is a dropped variation, never
               // an aborted enumeration — same rule as respell below
-              reportThrow([...liftVariations, ...s.variations], e);
+              reportThrow([...liftVariations, ...s.variations, ...symbolSetting.variations], e);
               continue;
             }
             // A TREE another structure setting already produced. `respellTree` reads the tree and this
@@ -2092,7 +2446,10 @@ export function enumerateCandidates(
                 assertResolved(made);
                 assertDerefsTyped(made);
                 assertLocalsWritten(made);
+                assertPostIncrUnshared(made);
                 assertNoOrphanedLocals(sfn, made);
+                assertLocalStorageStaysInteger(sfn, made);
+                assertFrameUnionsViewed(made);
                 // A backend refusal on this REWRITTEN tree is not a refusal of the row's own
                 // tree, so it never becomes the row's stated cause: `TreeSources.emit` is dropped
                 // here and only the call over the row's own tree above records one.
@@ -2153,6 +2510,16 @@ export function enumerateCandidates(
                 // whichever route the enumeration happened to walk first.
                 if (sp.matchOnly === undefined) {
                   delete dup.matchOnly;
+                  delete dup.signedUnsignedCompare;
+                }
+                if (!discardsPassedResult) {
+                  delete dup.discardsPassedResult;
+                }
+                if (!guessesParamWidth) {
+                  delete dup.guessesParamWidth;
+                }
+                if (!liftSetting.keepStores) {
+                  delete dup.farStoreCast;
                 }
                 continue;
               }
@@ -2175,7 +2542,11 @@ export function enumerateCandidates(
                 preference: symbolIndex,
                 ...(sp.symbolRefs ? { symbolRefs: sp.symbolRefs } : {}),
                 ...(sp.deviceVolatile ? { deviceVolatile: sp.deviceVolatile } : {}),
-                ...(sp.matchOnly ? { matchOnly: sp.matchOnly } : {}),
+                ...(sp.matchOnly ? { matchOnly: true as const } : {}),
+                ...(sp.signedUnsignedCompare ? { signedUnsignedCompare: true as const } : {}),
+                ...(discardsPassedResult ? { discardsPassedResult: true as const } : {}),
+                ...(guessesParamWidth ? { guessesParamWidth: true as const } : {}),
+                ...(liftSetting.keepStores ? { farStoreCast: true as const } : {}),
               };
               seen.set(source, made);
               out.push(made);
@@ -2200,36 +2571,75 @@ export function enumerateCandidates(
 /** Score each candidate with the injected `scoreFn` and rank by score (lowest first). A candidate
  *  whose `scoreFn` throws — e.g. its C failed to compile — is SKIPPED so it cannot sink a sibling
  *  that compiles and matches; only if EVERY candidate fails is the failure surfaced. Synchronous:
- *  the scorer must be sync (the cli/Node objdiff path). The webapp scores asynchronously and does
- *  its own await-loop over `enumerateCandidates`, reusing this module's `Candidate`/`RankedResult`
- *  types but not this driver. */
+ *  the scorer must be sync (the cli/Node objdiff path). An async driver scores on its own schedule
+ *  and then ranks through here against its memoized outcomes (the pooled CLI driver, the webapp).
+ *
+ *  A STILLBORN fan (stillborn.ts) is not compiled to the end: `scoreFn` is called for the default
+ *  candidate and the probes, and the rest ride on the thrown error as `notCompiled`. A `scoreFn`
+ *  that wants the rule to read its refusals throws `CompilerRejection`; any other throw ranks the
+ *  whole fan. */
 export function rankBy<S extends { score: number; rows?: number }>(
   candidates: Candidate[],
   symbol: string,
   scoreFn: (source: string, symbol: string, candidate: Candidate) => S,
 ): RankedResult<S> {
+  const outcomes = new Map<number, { score: S } | { thrown: unknown }>();
+  const outcomeAt = (i: number): { score: S } | { thrown: unknown } => {
+    let outcome = outcomes.get(i);
+    if (outcome === undefined) {
+      try {
+        outcome = { score: scoreFn(candidates[i].source, symbol, candidates[i]) };
+      } catch (e) {
+        outcome = { thrown: e };
+      }
+      outcomes.set(i, outcome);
+    }
+    return outcome;
+  };
+  const stillborn = stillbornVerdict(candidates, (i) => {
+    const outcome = outcomeAt(i);
+    return 'score' in outcome ? 'compiled' : outcome;
+  });
+  if (stillborn !== null) {
+    const thrownAt = (i: number): unknown => {
+      const outcome = outcomeAt(i);
+      if ('score' in outcome) {
+        throw new Error(`internal: a stillborn fan holds a candidate that scored (${i})`);
+      }
+      return outcome.thrown;
+    };
+    throw new NoScorableCandidateError(
+      `no scorable candidate for '${symbol}': ${stillbornNote(stillborn, candidates.length)}\n` +
+        `The default candidate's compile: ${fullMessage(thrownAt(0))}`,
+      stillborn.compiled.map((i) => ({ variations: candidates[i].variations, error: firstLine(thrownAt(i)) })),
+      [],
+      stillborn.notCompiled.map((i) => ({ variations: candidates[i].variations, source: candidates[i].source })),
+      { cause: thrownAt(0) },
+    );
+  }
   const results: (Scored<S> & { order: number })[] = [];
   const dropped: DroppedCandidate[] = []; // candidates that failed to build; only fatal if ALL do
   const withheld: WithheldCandidate[] = []; // candidates that built but did not earn publication
   let lastScoreErr: unknown = null;
   candidates.forEach((c, order) => {
-    try {
-      const score = scoreFn(c.source, symbol, c);
-      const why = withheldReason(c, score);
-      if (why !== null) {
-        withheld.push({
-          variations: c.variations,
-          score: score.score,
-          ...(score.rows === undefined ? {} : { rows: score.rows }),
-          why,
-        });
-        return;
-      }
-      results.push({ ...c, order, score });
-    } catch (e) {
-      lastScoreErr = e;
-      dropped.push({ variations: c.variations, error: firstLine(e) });
+    const outcome = outcomeAt(order);
+    if ('thrown' in outcome) {
+      lastScoreErr = outcome.thrown;
+      dropped.push({ variations: c.variations, error: firstLine(outcome.thrown) });
+      return;
     }
+    const { score } = outcome;
+    const why = withheldReason(c, score);
+    if (why !== null) {
+      withheld.push({
+        variations: c.variations,
+        score: score.score,
+        ...(score.rows === undefined ? {} : { rows: score.rows }),
+        why,
+      });
+      return;
+    }
+    results.push({ ...c, order, score });
   });
   if (results.length === 0) {
     // Naming the withheld count matters here: "no scorable candidate" with a null cause reads as a
@@ -2240,7 +2650,7 @@ export function rankBy<S extends { score: number; rows?: number }>(
     // above stays one line each — it is a roster, not a diagnosis.
     const why =
       lastScoreErr !== null ? fullMessage(lastScoreErr) : `${withheld.length} candidate(s) withheld, none scored`;
-    throw new NoScorableCandidateError(`no scorable candidate for '${symbol}': ${why}`, dropped, withheld, {
+    throw new NoScorableCandidateError(`no scorable candidate for '${symbol}': ${why}`, dropped, withheld, [], {
       cause: lastScoreErr,
     });
   }
@@ -2248,15 +2658,37 @@ export function rankBy<S extends { score: number; rows?: number }>(
   return { winner: results[0], candidates: results.map(({ order: _order, ...c }) => c), dropped, withheld };
 }
 
-/** THE candidate ordering — score, then preference, then readability, then enumeration
- *  order. Exported because there are TWO drivers over the same enumeration (this module's sync
- *  `rankBy` for the Node/objdiff scorer, and the webapp's async await-loop for the wasm one), and
- *  a per-driver copy would let the same input produce two different winners.
+/** The sentence a stillborn fan's error OPENS on: how much of the fan was never compiled, on what
+ *  evidence, and the errors each half's compiled candidates kept. The DEFAULT candidate's own
+ *  diagnostic — the spelling the rule is anchored on, rather than whichever was refused last —
+ *  follows it, so that a printer bounding a long diagnostic keeps the verdict. */
+function stillbornNote(stillborn: Stillborn, fan: number): string {
+  const tally = new Map<string, number>();
+  for (const m of stillborn.messages) {
+    tally.set(m, (tally.get(m) ?? 0) + 1);
+  }
+  const shared = [...tally].map(([m, n]) => `  ${m}${n > 1 ? ` (x${n})` : ''}`).join('\n');
+  return (
+    `${stillborn.notCompiled.length} of ${fan} candidates were NOT COMPILED: in each signedness half, the default ` +
+    `candidate and one probe per variation (${stillborn.compiled.length} compiled) were all rejected, every probe ` +
+    `keeping one of its default's errors:\n${shared}`
+  );
+}
+
+/** THE candidate ordering — score, then semantics, then preference, then readability, then enumeration
+ *  order. Exported because it is asked outside `rankBy` too — the benchmark's sweep driver and
+ *  fan runner order what they read back — and a second copy would let the same input produce two
+ *  different winners.
  *
  *  SCORE dominates absolutely: the differ is the fitness function, and a tie means the variation
  *  that separates these two candidates did not change the bytes — so everything below only chooses what
  *  the READER sees, and can never cost a match.
  *
+ *  A DISCARDED PASSED RESULT next (`Candidate.discardsPassedResult`): equal bytes refute neither
+ *  reading, so the one that drops a value the callee may read wins only where it scores strictly
+ *  better. A GUESSED PARAMETER WIDTH (`Candidate.guessesParamWidth`) likewise: a narrow declaration
+ *  no prototype supplied changes its callers' bytes, which no score here reads.
+ *
  *  PREFERENCE next: a named symbol-map spelling beats its `/raw-globals` sibling at equal bytes.
  *
  *  DEVICE VOLATILITY next: at equal bytes, the spelling that qualifies a DEVICE REGISTER
@@ -2274,7 +2706,14 @@ export function rankBy<S extends { score: number; rows?: number }>(
  *  with no score and no outcome moving. That is a judgement about the source rather than a
  *  measurement of it — the differ never refereed those six — and it is the same judgement this
  *  term was declared to make, taken on the same evidence. What it must never do is change WHICH
- *  candidates exist; that stays an admission question, one variation at a time.
+ *  candidates exist; that stays an admission question, one variation at a time. The CAST COUNT
+ *  below does the same for `/narrow-decl`, which drops one cast per local it narrows and so wins
+ *  every tie against the candidate it is derived onto.
+ *
+ *  A FAR STORE SPELLED THROUGH A CAST (`Candidate.farStoreCast`) next: where `/far-cast` ties the
+ *  member spelling, the compiler built the member's object too, and the member names the field. Its
+ *  `(u8 *)` base is no scalar cast and its line count is no higher, so neither term below would
+ *  prefer the member on its own.
  *
  *  CAST COUNT next, and only WITHIN a preference. A wrong signedness pin is what manufactures casts —
  *  the C backend has to cast a shift operand back to the signedness the machine op needs, so
@@ -2293,20 +2732,22 @@ export function rankBy<S extends { score: number; rows?: number }>(
  *  result deterministic. Spelled explicitly rather than leaning on Array#sort's stability, which
  *  would make each preference an accident of two unrelated decisions.
  *
- *  WHAT NO TERM HERE WEIGHS: a comparison's rendered SIGNEDNESS. `/uns-cmp`'s whole output is
- *  that polarity, and it carries in a DECLARED TYPE rather than a cast — `castCount` reads 0 on
- *  both sides of the tie it loses — so at equal bytes enumeration order decides, and a rival
- *  variation's candidate can publish a signed compare where the asm's is unsigned. Weighing it needs
- *  the candidate's own SFn and the icmp facts it was structured from, neither of which this
- *  comparator carries; `deviceVolatile` is the shape such a term would take. */
+ *  WHAT NO TERM HERE WEIGHS: a comparison's rendered SIGNEDNESS. It needs none: every tree a
+ *  source is emitted from is judged for an unsigned compare that renders signed
+ *  (`Candidate.signedUnsignedCompare`), whichever variation spelled it so, and such a source is
+ *  `matchOnly` — on a nonmatch it is withheld before this comparator sees it, whatever it scores,
+ *  and on a match both spellings are the program. */
 export function compareScored<S extends { score: number }>(
   a: Candidate & { score: S; order: number },
   b: Candidate & { score: S; order: number },
 ): number {
   return (
     a.score.score - b.score.score ||
+    (a.discardsPassedResult ? 1 : 0) - (b.discardsPassedResult ? 1 : 0) ||
+    (a.guessesParamWidth ? 1 : 0) - (b.guessesParamWidth ? 1 : 0) ||
     a.preference - b.preference ||
     (b.deviceVolatile ?? 0) - (a.deviceVolatile ?? 0) ||
+    (a.farStoreCast ? 1 : 0) - (b.farStoreCast ? 1 : 0) ||
     castCount(a.source) - castCount(b.source) ||
     lineCount(a.source) - lineCount(b.source) ||
     a.order - b.order