@asmlift/core 0.8.1 → 0.9.0

package/src/ir/opcodes.ts

@@ -13,8 +13,8 @@ export interface OpSig {
   successors?: number | 'variadic';
   requiredAttrs?: readonly string[];
   /** observable side effect (memory write / call): never deleted when dead, never hoisted into
-   *  an unconditional position. THE one effect vocabulary — DCE (pattern/engine.ts) and the
-   *  short-circuit hoist guard (raise/shortcircuit.ts) both derive from this flag. */
+   *  an unconditional position. THE one effect vocabulary — every question ir/discipline.ts asks of an
+   *  op derives from this flag and the two below. */
   effects?: boolean;
   /** reads memory. Deletable when dead — nothing observes a load nobody reads — but NOT movable:
    *  a load answers whichever stores ran before it, so crossing one changes the value it yields.
@@ -109,6 +109,48 @@ export const OPCODES = {
   // which recompiles to the branch diamond the source emitted.
   logic_and: { operands: 2, results: 1 },
   logic_or: { operands: 2, results: 1 },
+  // --- a 64-bit value and its two halves ---
+  // A 64-bit integer is ONE value of `{kind:'int'|'unknown', width:64}`, never two results and never
+  // a new `IrType` kind. The rule that decides it: for TYPES, widen the number that is already
+  // there; for OPERATIONS, add a new opcode. Existing code tests `t.kind === 'int'` and reads
+  // `t.width`, so a wider width makes a pass that is wrong about it fail LOUDLY, while a new kind
+  // would make the same pass skip SILENTLY. Existing code switches on `op.opcode`, so a new opcode
+  // makes an existing pass skip, which is the safe direction there.
+  //
+  // So the arithmetic opcodes above gain NOTHING: `add`, `sub`, `mul`, the shifts and the `icmp_*`
+  // family carry the width in their operand types. Only the three ops that have no 32-bit spelling
+  // are new — building a 64-bit value out of two halves, and reading either half back.
+  //
+  // `concat lo, hi` is TRANSIENT the way `mulh` is: it renders only in the shapes something above
+  // it recognises (a widen, a literal, an ABI pair), and one that survives to the structurer is a
+  // loud gap. `lo32`/`hi32` invert that property and are PERMANENT, because C spells them exactly —
+  // `(u32)v` and `(u32)(v >> 32)`.
+  //
+  // WHY `hi32` AND NOT `lo32(shr_u v {imm:32})`, which is the same value in two ops rather than
+  // three: spelling a projection as a 64-bit SHIFT puts a 64-bit arithmetic op into the IR at every
+  // pair site, and hands it to every pass that matches a shift — `raise/divpow2.ts` on
+  // `shr_s {imm}`, `raise/extscale.ts` on `shl`, `raise/narrow.ts` on a narrow/re-widen pair. Those
+  // passes would then be REACHED by a 64-bit operand instead of skipping it. A third opcode nothing
+  // else matches is what buys the isolation.
+  concat: { operands: 2, results: 1 }, // concat lo, hi → the 64-bit value whose low half is `lo`
+  lo32: { operands: 1, results: 1 },
+  hi32: { operands: 1, results: 1 },
+  // --- hardware floating point ---
+  // IEEE arithmetic on `{kind:'float'}` values, and on nothing else (ir/verify.ts checks both
+  // directions). NEW OPCODES rather than `add`/`sub` over a float-typed operand, by the rule the
+  // 64-bit section above states for OPERATIONS: every pass that matches `add` is an integer rewrite
+  // — a pointer walk, a reassociation, a constant fold, an idiom pattern — and a new opcode is what
+  // makes each of them skip. Pure: under the default IEEE environment none of them traps, so a
+  // dead one is reaped like any integer op.
+  fadd: { operands: 2, results: 1 },
+  fsub: { operands: 2, results: 1 },
+  fmul: { operands: 2, results: 1 },
+  fdiv: { operands: 2, results: 1 },
+  fneg: { operands: 1, results: 1 },
+  // A double LITERAL: `bits` is its IEEE pattern as sixteen hex digits (ir/float-bits.ts). Its own
+  // opcode rather than a `const` over a float type for the reason the arithmetic above has its own:
+  // every pass that matches `const` is an integer fold.
+  fconst: { operands: 0, results: 1, requiredAttrs: ['bits'] },
   // --- memory ---
   load: { operands: 1, results: 1, requiredAttrs: ['off', 'width', 'signed'], reads: true },
   store: { operands: 2, results: 0, requiredAttrs: ['off', 'width'], effects: true },
@@ -119,8 +161,10 @@ export const OPCODES = {
   aload: { operands: 2, results: 1, requiredAttrs: ['elemSize', 'signed'], reads: true }, // aload base, index
   astore: { operands: 3, results: 0, requiredAttrs: ['elemSize'], effects: true }, // astore base, index, value
   // --- call: operands are the argument values (r0..), result is the return value (r0),
-  //     `target` attr is the callee symbol. Caller-saved clobbering is implicit. ---
-  call: { operands: 'variadic', results: 1, requiredAttrs: ['target'], effects: true },
+  //     `target` attr is the callee symbol — or, with `indirect: true` and no `target`, the
+  //     callee is the address in the LAST operand (ir/core.ts `calleeValue`). Exactly one of the
+  //     two, which `ir/verify.ts` checks. Caller-saved clobbering is implicit. ---
+  call: { operands: 'variadic', results: 1, effects: true },
   // The ADDRESS of a named global (agbcc `ldr rD, .Lpool` where the pool word is `.word gSym`).
   // Pure, 0 operands. Globals come from the project headers, so they are referenced by name, never
   // declared as locals. The structurer lowers it three ways (see scalarGlobals in structure.ts):
@@ -134,10 +178,17 @@ export const OPCODES = {
   // proving every access agrees, and the structurer declares the local and renders `&name` exactly
   // as it renders a gaddr's `&sym`. Operand-free and pure, so GVN numbers it like gaddr and a dead
   // one is reaped.
-  // `width`/`signed` are stamped by the frontend's frame-object AUDIT — requiring them makes
-  // "the audit ran" a verifier-checkable fact instead of a convention: a frontend that emits a
-  // laddr and skips the audit fails verify loudly instead of rendering `&undefined`.
-  laddr: { operands: 0, results: 1, requiredAttrs: ['off', 'width', 'signed'] },
+  // `width`/`signed`/`count` are stamped by the frontend's frame-object AUDIT — requiring them
+  // makes "the audit ran" a verifier-checkable fact instead of a convention: a frontend that emits
+  // a laddr and skips the audit fails verify loudly instead of rendering `&undefined`. The SHAPE
+  // the three of them encode is checked there too (ir/verify.ts), because the attrs are
+  // disjunctive and only `count` tells the two arms apart.
+  // The object is `count` elements of `width` bytes, so its storage spans `width * count`. A
+  // SCALAR is count 1, typed by the access width and signedness every access agreed on. Count
+  // above 1 is STORAGE the audit sized without typing — no access pins an element type, so it is
+  // width 1, unsigned, and declares as `u8 name[count]`; nothing else may mint one, because the
+  // only thing that licenses an untyped object is the frame accounting the audit solves.
+  laddr: { operands: 0, results: 1, requiredAttrs: ['off', 'width', 'signed', 'count'] },
   // An UNDEFINED value: a read of storage that carries no INPUT — nothing was entitled to hand this
   // function a value there, and none of its own stores reached it on this path. Deliberately NOT
   // "storage nobody could have written": a callee-saved register holds the CALLER's value at entry,
@@ -153,7 +204,7 @@ export const OPCODES = {
   //     merely "owns the storage", because a frame the function owns can still be written by
   //     someone else once an address into it escapes to a callee, which fills a wider object than
   //     any in-function access reveals. Whoever mints one owes the retraction on escape
-  //     (frontend/thumb.ts, after the frame-object audit).
+  //     (the frame-object audit, frontend/frame-objects.ts).
   //   • a REGISTER the ABI does not pass arguments in AND this function's prologue SAVED cannot
   //     carry a value a caller handed over, and has no address for anything else to reach it by, so
   //     there is nothing to retract. The save is half of the premise, not a corroboration of it:
@@ -199,13 +250,28 @@ export const OPCODES = {
  *  does not. */
 export type Opcode = keyof typeof OPCODES;
 
+/** The width of a 64-bit IR value, named once so the three places that build one and the verifier
+ *  that checks them cannot come to disagree about it. */
+export const WIDE_BITS = 64;
+
 /** The widths a `zext`/`sext` carries — a fact about those two opcodes, so it lives with them
  *  rather than re-declared per consumer (raise/narrow.ts pairs a narrowing op with its re-widening,
  *  raise/paramwidth.ts declares a parameter at one). Every frontend that produces the pair produces
  *  one of these: agbcc's gated shift-pair fold (pattern/engine.ts CAST_PATTERNS) and PPC's
- *  `extsb`/`extsh` (frontend/ppc.ts). A third width would be a C type the backend cannot spell. */
+ *  `extsb`/`extsh` (frontend/ppc.ts). A third width would be a C type the backend cannot spell.
+ *
+ *  32 IS NOT ONE OF THEM, and the widening to 64 does not come here. The machine spells that widen
+ *  as a PAIR — agbcc `asr rN,rM,#31` or `mov rN,#0`, PPC `srawi`, MIPS `sra` — so it is a `concat`
+ *  shape (`concat(x, shr_s(x,31))` signed, `concat(x, const 0)` unsigned), which is also the only
+ *  form that says HOW the half was widened. This set keeps its one job: refuse an extension with no
+ *  C spelling. */
 export const CAST_WIDTHS: ReadonlySet<number> = new Set([8, 16]);
 
+/** The float opcodes: the only ops a `{kind:'float'}` value may be an operand or a result of,
+ *  besides `ret` (ir/verify.ts). Authored beside the registry because no signature field says what
+ *  an op computes ON. */
+export const FLOAT_OPS: ReadonlySet<string> = new Set(['fadd', 'fsub', 'fmul', 'fdiv', 'fneg', 'fconst']);
+
 /** Signature lookup by RUNTIME opcode string (Op.opcode is a plain string — IR consumers switch
  *  on it); undefined for an unregistered opcode. */
 export function opSig(opcode: string): OpSig | undefined {
@@ -214,17 +280,16 @@ export function opSig(opcode: string): OpSig | undefined {
 
 /** The comparison whose result is the logical NEGATION of each `icmp_*` — `!(a < b)` is `a >= b`.
  *
- *  Unlike EFFECTFUL_OPS/HOIST_UNSAFE_OPS below, this is AUTHORED data seated beside the registry,
- *  not a view derived from it: nothing in `OPCODES` states which comparison opposes which. What is
+ *  AUTHORED data seated beside the registry, not a view derived from it: nothing in `OPCODES`
+ *  states which comparison opposes which. What is
  *  derived is its SYMMETRY — the five involutive pairs are expanded both ways, so `neg(neg(c)) === c`
  *  holds by construction (a hand-written map is one typo away from breaking it, and the symptom is a
  *  plainly inverted condition in the emitted C). Completeness against the icmp family is the part
  *  construction cannot give, so a test asserts it (test/pattern.test.ts) — an eleventh comparison
  *  added to `OPCODES` would otherwise degrade its consumers several different ways.
  *
- *  It lives here for the reason HOIST_UNSAFE_OPS does: every consumer that has to say "the opposite
- *  of this compare" reads THIS one, so they
- *  cannot drift apart the way inline copies did. Two adjacent facts worth knowing: raise/
+ *  It lives here so that every consumer that has to say "the opposite of this compare" reads THIS
+ *  one, and they cannot drift apart the way inline copies did. Two adjacent facts worth knowing: raise/
  *  shortcircuit.ts derives its `BOOL_OPS` from these keys (asserting negatable-icmp == boolean-op,
  *  true today), and l3/ast.ts `NEGATE_REL` is the SAME relation over the neutral L3 operator
  *  vocabulary — deliberately separate, because signedness lives in the operand types there, so the
@@ -243,103 +308,17 @@ export const NEGATED_ICMP: Readonly<Record<string, Opcode>> = Object.fromEntries
   ]),
 );
 
-/** Ops with an observable side effect: the flag on the signature, derived rather than re-listed.
- *  `isDceSafe` asks the same question of the FLAG through `opSig` rather than of this set, so the
- *  two cannot disagree. The SET's own consumers are `HOIST_UNSAFE_OPS` below, structure.ts's
- *  block-purity tests (may this block be folded into a loop header, is this exit owned),
- *  analysis.ts's memory-write barrier, divpow2's bias block (which is DELETED rather than moved),
- *  and the idiom layer's de-sequencing guard (pattern/engine.ts). Derived rather than re-listed
- *  because three of those consumers each carried a hand-written copy of this membership, which is
- *  how the models drifted apart. */
-export const EFFECTFUL_OPS: ReadonlySet<string> = new Set(
-  (Object.keys(OPCODES) as Opcode[]).filter((k) => (OPCODES[k] as OpSig).effects),
-);
-
-/** Ops that may not be SPECULATED — run on a path that did not run them before. Identical to
- *  `EFFECTFUL_OPS`, and kept as its own name because its call sites ask the speculation question
- *  rather than the deletion one.
- *
- *  A memory read is deliberately absent, and that is the one entry worth arguing: its only consumer
- *  is raise/shortcircuit.ts, which hoists an arm's body into the block above, and the structurer
- *  inlines an unnamed value back into the `&&`/`||` right-hand side, where C's own short-circuit
- *  re-guards it. Adding the two reads
- *  here cost three byte-matches (kleod:UpdateHUDCounterDisplay, retired 2026-09-13 with its source,
- *  plus synthetic:breakloop and synthetic:strcmp1), so the argument was load-bearing rather than
- *  merely plausible. Not re-measured since the kleod row's retirement.
- *
- *  KNOWN GAP: the trapping divides are absent too, and there the re-guard argument does NOT carry
- *  — a hoisted `sdiv` that the structurer NAMES becomes an unconditional statement. Left as it is
- *  because closing it is a separate change with its own measurement; `REEVAL_UNSAFE_OPS` does
- *  refuse them, so the pre-update sink is not exposed to it.
- *
- *  AND THE EXEMPTION IS NOT TRANSFERABLE, which is worth saying beside it: a second consumer once
- *  read this set to answer "would gcc have SPECULATED this arm above a compare", where nothing
- *  re-guards anything, and admitted single-load arms `gcc/jump.c:483`'s `! may_trap_p` refuses.
- *  Pointing that consumer back at this set costs `synthetic:mergeldcast:agbcc` its byte-match
- *  (MATCH -> diff:6), measured. That consumer is `raise/narrowlocal.ts` and it reads
- *  `REEVAL_UNSAFE_OPS` instead. Reach for this set only when the argument above — a C-level
- *  re-guard at the new point — actually holds at your call site. */
-export const HOIST_UNSAFE_OPS: ReadonlySet<string> = EFFECTFUL_OPS;
-
 /** The ops whose `operands[0]` is a memory-access BASE: `load base`, `store base, value`,
  *  `aload base, index`, `astore base, index, value` (the operand roles are in the registry above).
  *  Authored rather than derived — no registry field records the operand ROLE, and the only other
  *  memory-touching opcode is `call`, whose variadic operands are arguments and not a base.
  *
- *  Two consumers ask two different questions of it and both need the same answer, which is why it
- *  is here and not next to either: `structure/analysis.ts` uses it for the address-home variation's slot
- *  model, and `raise/const.ts` to recognise a folded literal that IS an address. */
+ *  Three consumers ask three different questions of it and all need the same answer, which is why
+ *  it is here and not next to any: `structure/analysis.ts` uses it for the address-home variation's
+ *  slot model, `raise/const.ts` to recognise a folded literal that IS an address, and
+ *  `ir/discipline.ts` to tell a device access's `volatile` from a frame object's. */
 export const MEM_BASE_OPS: ReadonlySet<string> = new Set(['load', 'store', 'aload', 'astore']);
 
-/** Ops whose answer depends on WHERE they run: an effect (its order against other effects is
- *  observable) or a memory read (it answers whichever stores ran before it). The question a pass
- *  asks before moving a computation to another point on the SAME path. `SPELLED_WHEN_DEAD_OPS`
- *  below asks a DIFFERENT question and derives, today, the same set. */
-export const ORDER_SENSITIVE_OPS: ReadonlySet<string> = new Set(
-  (Object.keys(OPCODES) as Opcode[]).filter((k) => {
-    const sig = OPCODES[k] as OpSig;
-    return sig.effects || sig.reads;
-  }),
-);
-
-/** Ops the structurer must still SPELL when nothing consumes their result — an effect, or a memory
- *  READ. Consumer: structure.ts's `sideEffects` walk.
- *
- *  The read half is the entry worth arguing, because `reads` documents the OPPOSITE about C — a
- *  load nobody reads is deletable, nothing observes it. That is the C claim. The COMPILER claim
- *  points the other way: an optimizing compiler deletes every dead read it is ALLOWED to delete, so
- *  one still in the target is evidence the source's access was `volatile`. Membership here only
- *  says the structurer may not drop the op silently; whether a `volatile` can actually reach the
- *  access is a second, ADDRESS-level question the call site asks separately
- *  (structure.ts `volatileQualifiable`), and a read it answers no to is dropped as before.
- *
- *  DERIVED FROM THE REGISTRY, not aliased to `ORDER_SENSITIVE_OPS`, even though the two are
- *  extensionally identical today and `HOIST_UNSAFE_OPS` above does alias `EFFECTFUL_OPS`. An alias
- *  makes two DIFFERENT questions incapable of ever differing, so the day one of them acquires an
- *  opcode the other should not have, the edit lands on both silently. The identity is pinned by a
- *  test instead (test/pattern.test.ts), where a future divergence surfaces as a decision to make
- *  rather than a coupling nobody sees. */
-export const SPELLED_WHEN_DEAD_OPS: ReadonlySet<string> = new Set(
-  (Object.keys(OPCODES) as Opcode[]).filter((k) => {
-    const sig = OPCODES[k] as OpSig;
-    return sig.effects || sig.reads;
-  }),
-);
-
-/** Ops that may not be RE-EVALUATED at another program point — order-sensitive, or trapping. The
- *  trap half is what separates this from `ORDER_SENSITIVE_OPS`: it only matters when the new point
- *  can be reached on a path the old one was not, so a consumer that merely re-orders on one path
- *  wants the smaller set. Both are needed because the two consumers differ on exactly the divides:
- *  a collapsed switch re-renders a test block's ops AT THEIR USES, and every use is dominated by
- *  the def, so it evaluates them on a SUBSET of the original paths — a narrowing, never a
- *  speculation. */
-export const REEVAL_UNSAFE_OPS: ReadonlySet<string> = new Set(
-  (Object.keys(OPCODES) as Opcode[]).filter((k) => {
-    const sig = OPCODES[k] as OpSig;
-    return sig.effects || sig.reads || sig.traps;
-  }),
-);
-
 /** Ops that MATERIALIZE a value out of nothing: no operands, no state read, no effect, no trap, no
  *  control flow — so where one sits in a block says nothing about what ran before it. Derived, so a
  *  future pure nullary opcode joins without a second edit. Consumed by raise/paramwidth.ts, whose
@@ -352,10 +331,3 @@ export const MATERIALIZING_OPS: ReadonlySet<string> = new Set(
     return sig.operands === 0 && !sig.terminator && !sig.effects && !sig.reads && !sig.traps;
   }),
 );
-
-/** May a dead result of this opcode be deleted? Registered, no observable effects, not control
- *  flow. `opaque` is excluded via its `effects` flag — see the note on its signature. */
-export function isDceSafe(opcode: string): boolean {
-  const sig = opSig(opcode);
-  return !!sig && !sig.effects && !sig.terminator;
-}

package/src/ir/parse.ts

@@ -127,6 +127,7 @@ export function parse(text: string): Fn {
     writeOrder: undefined,
     slotHomes: undefined,
     paramEvidence: undefined,
+    localObjects: undefined,
   };
 }
 

package/src/ir/types.ts

@@ -17,13 +17,36 @@ export type IrType =
   // from `ptr(int)`+array-index because its access pattern is inconsistent with a homogeneous
   // array (mixed widths / non-uniform offsets). `name` is synthetic today (`Struct0`); a later
   // DWARF pass supplies real names. Fields are sorted by `off`.
-  | { kind: 'struct'; name: string; fields: StructField[]; size?: number }
+  //
+  // `declared` is a struct the project's HEADERS own — one a callee is declared to return
+  // (aggregate.ts `aggregateType`) — holding the headers' own spelling of it (`struct Blob64`,
+  // `BlobT`). No source this lift prints defines it: the declarations block does, which a candidate
+  // compiled inside the project's headers drops, since the headers define it there.
+  | { kind: 'struct'; name: string; fields: StructField[]; size?: number; declared?: string }
   // A fixed-length array `elem[count]`. Today its sole inhabitant is struct padding (a `u8[N]`
   // pad member seats fields at their exact offsets, raise/struct-arrays.ts) — a REAL type,
   // not a printed string. Array-typed fields declare with the length AFTER the name in C
   // (`u8 _pad[4]`), so the backend routes them through a declarator-aware `cDeclare`, not the
   // prefix `cType`.
   | { kind: 'array'; elem: IrType; count: number }
+  // Several VIEWS of one storage cell (raise/structs.ts): a base read or written at more than one
+  // width or extension over the same bytes. Every member sits at offset 0. It carries no name
+  // because it is only ever declared INLINE, as the type of the struct member that holds it, and its
+  // `size` is the one the target's compiler gives it — which is not always its widest view
+  // (`T.union` computes it from the compiler's aggregate boundary).
+  | { kind: 'union'; members: StructField[]; size: number }
+  // An IEEE floating-point value, single (32) or double (64). A KIND and not an `int` width, which is
+  // the one exception to the 64-bit rule at `ir/opcodes.ts` `concat` ("widen the number that is already
+  // there"): a float is not an integer of any width, so every pass that tests `kind === 'int'` must
+  // SKIP it rather than compute on it, and skipping is what a new kind buys. Its values live in the
+  // FPU's own register file, or in a soft-float runtime's register pair, and are computed only by
+  // the float opcodes (`fadd` …); `docs/floating-point.md` says which frontends mint one and what
+  // they still refuse. Two floats of different widths are different types (`typeEquals`), so a
+  // float op mixing them fails `ir/verify.ts`. A null width is a float whose code states no precision:
+  // a PowerPC FPR holds a double whichever the source declared, and `fneg`/`fmr` are one instruction
+  // for both, so `double dneg(double a){ return -a; }` and its `float` twin compile to one object.
+  // Either spelling reproduces it, and a declaration the caller supplies decides between them.
+  | { kind: 'float'; width: 32 | 64 | null }
   | { kind: 'void' }; // a function that returns nothing
 
 /** The scalar type of a memory access of `width` bytes: word ⇒ the s32 integer default;
@@ -34,6 +57,23 @@ export function scalarTypeForAccess(width: number, signed: boolean): IrType {
   return width === 4 ? T.s(32) : T.int(width * 8, signed);
 }
 
+/** The width in bits of the integer a type carries, or null where a type carries no integer. A
+ *  pointer's own width is the machine's and says nothing about what it addresses; an aggregate and
+ *  `void` have no single width at all. `unknown` DOES carry one, which is the point — before type
+ *  recovery every value is `unknown`, so a rule that skipped that kind would be vacuous exactly
+ *  where the frontends build these.
+ *
+ *  THE one copy, for the reason `scalarTypeForAccess` above is: its two consumers read the same
+ *  question under OPPOSITE policies, and a per-consumer copy is how they drift apart. `ir/verify.ts`
+ *  reads null as "this type does not take part in the width rule, so pass"; `runtime-helpers.ts`
+ *  reads null as "this operand carries no integer width, so refuse to fold a 64-bit operation over
+ *  it". Both want exactly this predicate — a pointer handed to `__muldi3` has no width either of
+ *  them may claim — so an `IrType` kind added here reaches the verifier and the recogniser together
+ *  or neither. */
+export function intWidth(t: IrType): number | null {
+  return t.kind === 'int' || t.kind === 'unknown' ? t.width : null;
+}
+
 export const T = {
   unk: (width = 32): IrType => ({ kind: 'unknown', width }),
   int: (width: number, signed: boolean): IrType => ({ kind: 'int', width, signed }),
@@ -42,9 +82,68 @@ export const T = {
   ptr: (to: IrType): IrType => ({ kind: 'ptr', to }),
   struct: (name: string, fields: StructField[], size?: number): IrType => ({ kind: 'struct', name, fields, size }),
   array: (elem: IrType, count: number): IrType => ({ kind: 'array', elem, count }),
+  // Its size is its widest view rounded up to the compiler's aggregate boundary (target.ts).
+  union: (members: StructField[], boundary: number): IrType => {
+    const extent = Math.max(...members.map((m) => (m.type.kind === 'array' ? m.type.count : 1) * viewBytes(m.type)));
+    return { kind: 'union', members, size: Math.ceil(extent / boundary) * boundary };
+  },
+  f32: (): IrType => ({ kind: 'float', width: 32 }),
+  f64: (): IrType => ({ kind: 'float', width: 64 }),
+  fUnstated: (): IrType => ({ kind: 'float', width: null }),
   void: (): IrType => ({ kind: 'void' }),
 };
 
+/** The byte width of a union view's element (an array view's element, or the scalar itself). */
+function viewBytes(t: IrType): number {
+  const e = t.kind === 'array' ? t.elem : t;
+  if (e.kind !== 'int') {
+    throw new Error(`a union view is an integer or an array of one, not '${typeToString(t)}'`);
+  }
+  return e.width / 8;
+}
+
+/** The member `name` of an aggregate — a struct's field or a union's view — or undefined when `t`
+ *  is not an aggregate or declares no such member. THE one lookup the typing walk and the deref
+ *  contract share, so the two cannot disagree on which member access is well-typed. */
+export function memberOf(t: IrType | undefined, name: string): StructField | undefined {
+  if (t?.kind === 'struct') {
+    return t.fields.find((f) => f.name === name);
+  }
+  if (t?.kind === 'union') {
+    return t.members.find((m) => m.name === name);
+  }
+  return undefined;
+}
+
+/** The union member of a struct that holds byte `off`, and the view of it an access of `width`
+ *  bytes reads — the view of that width and, for a narrow LOAD, of that extension; a store, which
+ *  carries none, takes the width's only view or the unsigned one of two — with the element index
+ *  inside an ARRAY view (null for a scalar one). Undefined when no union member holds `off`; `view`
+ *  undefined when the member has no view for the access. */
+export function unionViewAt(
+  st: Extract<IrType, { kind: 'struct' }>,
+  off: number,
+  width: number,
+  signed: boolean,
+  isStore: boolean,
+): { member: StructField; view: StructField | undefined; index: number | null } | undefined {
+  const member = st.fields.find((f) => f.type.kind === 'union' && f.off <= off && off < f.off + f.type.size);
+  if (member === undefined || member.type.kind !== 'union') {
+    return undefined;
+  }
+  const elemOf = (t: IrType): IrType => (t.kind === 'array' ? t.elem : t);
+  const wide = member.type.members.filter((m) => intWidth(elemOf(m.type)) === width * 8);
+  const signOf = (m: StructField): boolean | undefined => {
+    const e = elemOf(m.type);
+    return e.kind === 'int' ? e.signed : undefined;
+  };
+  const view =
+    width === 4 || (isStore && wide.length === 1)
+      ? wide[0]
+      : wide.find((m) => signOf(m) === (isStore ? false : signed));
+  return { member, view, index: view?.type.kind === 'array' ? (off - member.off) / width : null };
+}
+
 export function typeToString(t: IrType): string {
   switch (t.kind) {
     case 'unknown':
@@ -57,6 +156,10 @@ export function typeToString(t: IrType): string {
       return t.name;
     case 'array':
       return `${typeToString(t.elem)}[${t.count}]`;
+    case 'union':
+      return `union{${t.members.map((m) => `${typeToString(m.type)} ${m.name}`).join(';')}}`;
+    case 'float':
+      return `f${t.width ?? '?'}`;
     case 'void':
       return 'void';
   }
@@ -67,6 +170,9 @@ export function parseType(s: string): IrType {
   if (s.endsWith('*')) {
     return T.ptr(parseType(s.slice(0, -1)));
   }
+  if (s === 'f32' || s === 'f64' || s === 'f?') {
+    return s === 'f32' ? T.f32() : s === 'f64' ? T.f64() : T.fUnstated();
+  }
   const m = s.match(/^(unk|s|u)(\d+)$/);
   if (!m) {
     throw new Error(`bad type '${s}'`);
@@ -85,12 +191,22 @@ export function typeEquals(a: IrType, b: IrType): boolean {
   if (a.kind === 'int' && b.kind === 'int') {
     return a.width === b.width && a.signed === b.signed;
   }
-  if (a.kind === 'unknown' && b.kind === 'unknown') {
+  if (a.kind === 'void' && b.kind === 'void') {
+    return true;
+  }
+  if ((a.kind === 'unknown' && b.kind === 'unknown') || (a.kind === 'float' && b.kind === 'float')) {
     return a.width === b.width;
   }
   if (a.kind === 'array' && b.kind === 'array') {
     return a.count === b.count && typeEquals(a.elem, b.elem);
   }
+  if (a.kind === 'union' && b.kind === 'union') {
+    return (
+      a.size === b.size &&
+      a.members.length === b.members.length &&
+      a.members.every((m, i) => m.name === b.members[i].name && typeEquals(m.type, b.members[i].type))
+    );
+  }
   // Two structs are equal when their name + field layout match (recovered structs are named
   // by layout-discovery order, so equal name ⇒ equal layout in practice).
   if (a.kind === 'struct' && b.kind === 'struct') {

package/src/ir/verify.ts

@@ -3,16 +3,75 @@
 //   1. every block ends in exactly one terminator (and it is the last op)
 //   2. operands well-formed: opcode registered, correct arity/attrs
 //   3. SSA: each value defined once; every use is defined; def dominates use
-//   4. side data: a fn that carries a write-order record carries one for EVERY block, with every
+//   4. a float value is an operand or result of a float op or `ret` only — or a `double` operand of
+//      a call whose callee declares one there — and crosses an edge only into a block parameter of
+//      its own type; an `fconst` is a double, sixteen hex digits into an f64
+//   5. side data: a fn that carries a write-order record carries one for EVERY block, with every
 //      ordinal inside that block's own write count (ir/core.ts `WriteOrder`)
-import { Block, Fn, Value, dominators } from './core';
-import { opSig } from './opcodes';
+import { Block, Fn, Op, Value, dominators } from './core';
+import { isDoubleBits } from './float-bits';
+import { FLOAT_OPS, WIDE_BITS, opSig } from './opcodes';
+import { type IrType, T, intWidth, typeEquals, typeToString } from './types';
 
 export class VerifyError extends Error {}
 
+/** A call hands a float only to a parameter its callee is declared to take a `double` in — the
+ *  operands the frontend lists in `doubles` — and returns none. */
+function doublesDeclared(op: Op): boolean {
+  const at = op.attrs.doubles;
+  return (
+    op.opcode === 'call' &&
+    Array.isArray(at) &&
+    op.results.every((r) => r.type.kind !== 'float') &&
+    op.operands.every((o, i) => o.type.kind !== 'float' || (at.includes(i) && typeEquals(o.type, T.f64())))
+  );
+}
+
 // Opcodes admitting EITHER a 2-operand register form OR a 1-operand + `imm` attr form.
 const TWO_OR_IMM = new Set(['sdiv', 'shl', 'shr_u', 'shr_s']);
 
+// ── 64 DOES NOT MIX ────────────────────────────────────────────────────────────────────────────
+// A 64-bit value is one `Value` whose type carries width 64 (ir/opcodes.ts, `concat`), so every
+// pass that reads `t.width` and is wrong about it is wrong HERE rather than three stages later. The
+// rule below is a QUARANTINE and not full width agreement, and the difference is measured rather
+// than stylistic: full agreement is already false on 32-bit IR, because `raise/paramwidth.ts`
+// narrows a parameter to 8 or 16 bits and `add(p_u8, x_s32)` is an ordinary correct shape. What
+// must hold is that a 64-bit operand never meets a 32-bit one in an op that computes on both.
+//
+// `unknown` PARTICIPATES, and that is the whole point: at L1 every value is `unknown`, so a rule
+// that skipped it would be vacuous exactly where this is meant to be red. The shifts count only
+// their SHIFTED operand — a 64-bit shift by a 32-bit count is what the machine does.
+const WIDTH_UNIFORM = new Set(['add', 'sub', 'mul', 'and', 'or', 'xor', 'neg', 'not', 'sdiv', 'udiv', 'smod', 'umod']);
+// The shifts count only their SHIFTED operand: a 64-bit value shifted by a 32-bit count is what
+// every one of these machines does. The comparisons count only their OPERANDS: the result of a C
+// comparison is an `int` whatever it compared, which is what `raise/recover.ts` already types it.
+const SHIFTS = new Set(['shl', 'shr_u', 'shr_s']);
+const COMPARES = new Set([
+  'icmp_slt',
+  'icmp_sle',
+  'icmp_sgt',
+  'icmp_sge',
+  'icmp_ult',
+  'icmp_ule',
+  'icmp_ugt',
+  'icmp_uge',
+  'icmp_eq',
+  'icmp_ne',
+]);
+/** Whether `t` takes part in the width rule at all: it does exactly when it carries an integer
+ *  width. `ir/types.ts` owns that question — `raise/widehelpers.ts` asks it too, of the same kinds,
+ *  and reads the null with the opposite polarity. */
+const widthOf = intWidth;
+/** The types an op's width rule quantifies over. */
+const widthParticipants = (op: Op): IrType[] => {
+  const operands = op.operands.map((o) => o.type);
+  if (COMPARES.has(op.opcode)) {
+    return operands;
+  }
+  const results = op.results.map((r) => r.type);
+  return SHIFTS.has(op.opcode) ? [...results, ...operands.slice(0, 1)] : [...results, ...operands];
+};
+
 export function verify(fn: Fn): void {
   if (fn.blocks.length === 0) {
     throw new VerifyError(`fn '${fn.name}' has no blocks`);
@@ -104,11 +163,90 @@ export function verify(fn: Fn): void {
           if (!isTerm && op.successors.length) {
             throw new VerifyError(`non-terminator '${op.opcode}' has successors`);
           }
+          // `laddr` carries two shapes in one set of attrs and `count` is the only thing telling
+          // them apart: one element is a SCALAR typed by the accesses the frame-object audit read
+          // off the machine, and more than one is STORAGE that audit sized without typing, whose
+          // width and signedness are therefore not an access at all. The structurer declares the
+          // second as `u8 name[count]`, so a typed element there would be a type nothing pinned —
+          // the exact answer the audit refuses to invent. (One BYTE encodes like a real `u8`
+          // scalar either way; the declaration is the same one, so nothing has to tell them apart.)
+          if (op.opcode === 'laddr') {
+            const count = op.attrs.count;
+            if (typeof count !== 'number' || !Number.isInteger(count) || count < 1) {
+              throw new VerifyError(`'laddr' count must be a positive integer, got ${String(count)}`);
+            }
+            if (count > 1 && (op.attrs.width !== 1 || op.attrs.signed !== false)) {
+              throw new VerifyError(
+                `'laddr' of ${count} elements is storage no access typed, so it must be unsigned bytes — ` +
+                  `got width ${String(op.attrs.width)}, signed ${String(op.attrs.signed)}`,
+              );
+            }
+          }
+          // A 64-bit value is BUILT and TAKEN APART by exactly these three, so their shape is
+          // checked here rather than left to whoever reads a half. `concat` is the only producer.
+          if (op.opcode === 'concat' || op.opcode === 'lo32' || op.opcode === 'hi32') {
+            const wide = op.opcode === 'concat' ? op.results[0].type : op.operands[0].type;
+            const narrow = op.opcode === 'concat' ? op.operands.map((o) => o.type) : op.results.map((r) => r.type);
+            const wideW = widthOf(wide);
+            if (wideW !== WIDE_BITS) {
+              throw new VerifyError(
+                `'${op.opcode}' ${op.opcode === 'concat' ? 'result' : 'operand'} must be an integer of ` +
+                  `width ${WIDE_BITS}, got ${String(wideW ?? wide.kind)}`,
+              );
+            }
+            for (const t of narrow) {
+              if (widthOf(t) !== 32) {
+                throw new VerifyError(
+                  `'${op.opcode}' half must be an integer of width 32, got ${String(widthOf(t) ?? t.kind)}`,
+                );
+              }
+            }
+          }
+          // …and everywhere else, 64 does not mix (see the header above this file's checks).
+          if (WIDTH_UNIFORM.has(op.opcode) || SHIFTS.has(op.opcode) || COMPARES.has(op.opcode)) {
+            const ws = widthParticipants(op)
+              .map(widthOf)
+              .filter((w): w is number => w !== null);
+            if (ws.some((w) => w === WIDE_BITS) && ws.some((w) => w !== WIDE_BITS)) {
+              throw new VerifyError(
+                `'${op.opcode}' mixes a ${WIDE_BITS}-bit operand with a narrower one (widths ${ws.join(', ')})`,
+              );
+            }
+          }
+          // A FLOAT IS COMPUTED ON BY THE FLOAT OPS AND RETURNED, AND NOTHING ELSE TOUCHES IT. Both
+          // halves are checked, because each is a silent wrong the other cannot see: a float op over
+          // an integer is a frontend that lost track of a register file, and an integer op over a
+          // float is a pass that matched an opcode without asking what it computes on.
+          const floats = [...op.operands, ...op.results].map((v) => v.type).filter((t) => t.kind === 'float');
+          if (FLOAT_OPS.has(op.opcode)) {
+            const all = [...op.operands, ...op.results].map((v) => v.type);
+            if (floats.length !== all.length || all.some((t) => !typeEquals(t, all[0]))) {
+              throw new VerifyError(`'${op.opcode}' computes on floats only, got ${all.map(typeToString).join(', ')}`);
+            }
+          } else if (floats.length > 0 && op.opcode !== 'ret' && !doublesDeclared(op)) {
+            throw new VerifyError(`a float value reaches '${op.opcode}', which does not compute on floats`);
+          }
+          // A literal's width is its pattern's, so the pattern and the result must name one width.
+          if (op.opcode === 'fconst' && (!isDoubleBits(op.attrs.bits) || !typeEquals(op.results[0].type, T.f64()))) {
+            throw new VerifyError(
+              `'fconst' is a double literal: bits ${JSON.stringify(op.attrs.bits)} into ${typeToString(op.results[0].type)}`,
+            );
+          }
           for (const k of sig.requiredAttrs ?? []) {
             if (!(k in op.attrs)) {
               throw new VerifyError(`'${op.opcode}' missing required attr '${k}'`);
             }
           }
+          if (op.opcode === 'call') {
+            const named = typeof op.attrs.target === 'string';
+            const indirect = op.attrs.indirect === true;
+            if (named === indirect || 'target' in op.attrs !== named || (indirect && op.operands.length === 0)) {
+              throw new VerifyError(
+                "'call' names its callee in a string 'target' or calls the value in its last operand under " +
+                  "'indirect', and does exactly one of the two",
+              );
+            }
+          }
           for (const u of op.operands) {
             if (!defined.has(u)) {
               throw new VerifyError(`use of undefined value in '${op.opcode}'`);
@@ -128,6 +266,15 @@ export function verify(fn: Fn): void {
                 throw new VerifyError(`use of undefined value in successor args of '${op.opcode}'`);
               }
             }
+            // …and a float crosses an edge only into a block parameter of its own type.
+            s.args.forEach((u, i) => {
+              const p = s.block.params[i].type;
+              if ((u.type.kind === 'float' || p.kind === 'float') && !typeEquals(u.type, p)) {
+                throw new VerifyError(
+                  `successor of '${op.opcode}' passes a ${typeToString(u.type)} to a ${typeToString(p)} block parameter`,
+                );
+              }
+            });
           }
         },
         () => at(b, idx),