@asmlift/core 0.8.1 → 0.9.0

package/src/rank.ts

@@ -24,12 +24,12 @@ import {
   assertLocalsWritten,
   assertNoOrphanedLocals,
   assertPlacementSurvives,
+  assertPostIncrUnshared,
   assertResolved,
 } from './contracts';
 import type { AsmData } from './frontend/asmdata';
-import { frontendFor } from './frontend/registry';
-import { hasSetupArgsNarrowing, narrowToSetupArgs } from './frontend/ssa';
-import { Fn, defOpMap } from './ir/core';
+import { hasSetupArgsNarrowing, narrowToSetupArgs, setupArgsDiscardsPassedResult } from './frontend/ssa';
+import { Fn, Value, defOpMap } from './ir/core';
 import { T } from './ir/types';
 import { verify } from './ir/verify';
 import { advancedBases } from './l3/advance';
@@ -42,6 +42,7 @@ import type { Gate } from './l3/gates';
 import type { HoistPlacement } from './l3/hoist';
 import { homeSplitTag, homeSplitWithholds, splitHomeBases } from './l3/homesplit';
 import { inlinableConstBases, inlineConstBases } from './l3/inlinebase';
+import { integerCells } from './l3/intcell';
 import { mulFirstSums } from './l3/mulfirst';
 import { nearBaseClusters } from './l3/nearbase';
 import { spellOperandMembers } from './l3/offmember';
@@ -58,9 +59,10 @@ import { volatileValueLocals } from './l3/volatileval';
 import { volatileDeviceStores } from './l3/volstore';
 import { zeroSubNegates } from './l3/zerosub';
 import { RewritePattern } from './pattern/engine';
-import { applyIdiomPatterns, raiseRecovered, structureChecked } from './pipeline';
-import { type Prototypes, prototypesFromSymbols } from './proto';
+import { applyIdiomPatterns, liftStamped, raiseRecovered, structureChecked } from './pipeline';
+import { type Prototypes, declaresVoidReturn, prototypesFromSymbols } from './proto';
 import { inferGlobalArrays, orderLicensedGlobals, sameDerivedShape } from './raise/globalshape';
+import { OFFSET_NAME_PASS } from './raise/offsetnames';
 import { runPreRecovery } from './raise/pre-recovery';
 import { recoverTypes } from './raise/recover';
 import { sinkStoreTails } from './raise/tailsink';
@@ -86,6 +88,7 @@ import {
   createdLocals,
   sameBases,
 } from './rank-variations';
+import { type Stillborn, stillbornVerdict } from './stillborn';
 import { hasDivergentSharedRet } from './structure/structure';
 import {
   type SymbolInfo,
@@ -96,7 +99,13 @@ import {
   symbolsByName,
 } from './symbols';
 import { type TargetDescription, structureOptionsFor } from './target';
-import { type SubjectVariationName, type Variation, offeredOn, withSubject } from './variation-tokens';
+import {
+  type SubjectVariationName,
+  type Variation,
+  type VariationName,
+  offeredOn,
+  withSubject,
+} from './variation-tokens';
 
 /** Pin every SCALAR entry param (index not in `ptrIdx`) to the candidate signedness, before
  *  recovery. Answers whether any param was PINNABLE — not whether its type moved: which of the
@@ -106,16 +115,33 @@ import { type SubjectVariationName, type Variation, offeredOn, withSubject } fro
  *  A param NARROWED by raise/paramwidth.ts is not pinnable: the extension it was narrowed at states
  *  the signedness as well as the width — agbcc's shift pair by its `asr`/`lsr`, PPC's `extsb`/`extsh`
  *  by the opcode — so there is no question for the signedness variation to put to the differ, and pinning would
- *  widen it back to 32 bits. */
+ *  widen it back to 32 bits.
+ *
+ *  Nor is a param NOTHING READS. Its declared signedness reaches no instruction, so the two
+ *  candidates would differ only in the signature's text and compile to the same object. The frontend
+ *  mints such params on purpose: an argument register below the highest one read keeps its slot
+ *  (`frontend/ssa.ts` mintArgSlotHoles). Counting one as pinnable would double the fan of every
+ *  function whose only scalar params are unread. */
 function pinScalarParams(fn: Fn, signed: boolean, ptrIdx: Set<number>): boolean {
+  const read = new Set<Value>();
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      op.operands.forEach((v) => read.add(v));
+      op.successors.forEach((s) => s.args.forEach((v) => read.add(v)));
+    }
+  }
   let pinnable = false;
   fn.blocks[0].params.forEach((p, i) => {
-    if (ptrIdx.has(i)) {
+    if (ptrIdx.has(i) || !read.has(p)) {
       return;
     }
-    if (p.type.kind === 'unknown' || (p.type.kind === 'int' && p.type.width === 32)) {
+    // AT THE PARAMETER'S OWN WIDTH. The pin answers a question the asm does not — whether the
+    // source declared this parameter signed — and a 64-bit parameter has that question too; what
+    // it does not have is a spare 32 bits to lose to a constant here. A width the machine already
+    // narrowed (a declared `u8`) is not a scalar this variation re-decides, so it is left alone.
+    if (p.type.kind === 'unknown' || (p.type.kind === 'int' && p.type.width >= 32)) {
       pinnable = true;
-      p.type = signed ? T.s(32) : T.u(32);
+      p.type = T.int(p.type.width, signed);
     }
   });
   return pinnable;
@@ -220,15 +246,25 @@ export interface Candidate {
    *
    *  The third admission ground, and the narrowest. A respell variation must preserve semantics by
    *  construction (the POLICY note at the respell site), because on a nonmatch row the best
-   *  spelling is what the user is shown. One spelling cannot meet that bar from inside the pass:
-   *  `l3/unreduce.ts` moves a memory read into a loop whose stores are all device registers, and
-   *  on this board a device store can make the DEVICE write ordinary memory (a DMA trigger), which
-   *  no gate over the C can rule out. What settles it instead is the object: a candidate that
-   *  assembles to the target's own bytes IS the program, whatever a gate could have proved. So the
-   *  spelling is offered, scored, and then either wins on proof or is WITHHELD — never shown as a
-   *  best-effort answer. Both ranking drivers ask `withheldReason`, so neither can publish what the
-   *  other would not. */
+   *  spelling is what the user is shown. Two spellings cannot meet that bar from inside the pass,
+   *  each for its own fact (`PROOF_OBLIGATIONS` states them):
+   *
+   *   • `l3/unreduce.ts` moves a memory read into a loop whose stores are all device registers, and
+   *     on this board a device store can make the DEVICE write ordinary memory (a DMA trigger),
+   *     which no gate over the C can rule out;
+   *   • `l3/intcell.ts` spells a global as the integer a project may have declared it, where a
+   *     pointer declaration scales the offset it adds, and no declaration is in the asm.
+   *
+   *  What settles both instead is the object: a candidate that assembles to the target's own bytes
+   *  IS the program, whatever a gate could have proved. So the spelling is offered, scored, and then
+   *  either wins on proof or is WITHHELD — never shown as a best-effort answer. Both ranking drivers
+   *  ask `withheldReason`, so neither can publish what the other would not. */
   matchOnly?: true;
+  /** This candidate's lift is `/setup-args` and drops an earlier callee's result that a call through
+   *  a register is passed (frontend/ssa.ts `setupArgsDiscardsPassedResult`). It loses every score
+   *  tie (compareScored): a tie refutes neither reading, and a shorter spelling must not win by
+   *  dropping a value the callee may read. */
+  discardsPassedResult?: true;
 }
 /** A candidate paired with its score `S` (the injected scorer's result shape — must carry `.score`). */
 export interface Scored<S> extends Candidate {
@@ -261,10 +297,20 @@ export interface WithheldCandidate {
   why: string;
 }
 
+/** A candidate that was NEVER COMPILED: the fan was declared stillborn (stillborn.ts) before its
+ *  turn came. Kept apart from `dropped`, which means "the scorer refused it" — nothing refused
+ *  this one, and a count that folded the two would report compiles that never ran. */
+export interface NotCompiledCandidate {
+  variations: readonly string[];
+  /** the text the stop bet the compiler would refuse: a stop is re-placed whenever it changes, and
+   *  the benchmark keys its STOP report on it (`fanNotCompiledDigest`) */
+  source: string;
+}
+
 /** EVERY candidate refused — `rankBy` has no ranked result to return, so it throws this.
  *
- *  The two lists ride on the error, and that is the point of having a class at all: on a row where
- *  nothing scored, `dropped` IS the whole fan, and a bare `Error` discards it. A caller that
+ *  The lists ride on the error, and that is the point of having a class at all: on a row where
+ *  nothing scored, the three of them ARE the whole fan, and a bare `Error` discards it. A caller that
  *  prints one candidate's failure (the `cause`) is showing the LAST spelling the scorer refused,
  *  which is neither the first nor a representative one — the benchmark's own noncompile rows have
  *  up to a thousand siblings behind that single line. The MESSAGE is load-bearing and must stay
@@ -273,11 +319,20 @@ export interface WithheldCandidate {
 export class NoScorableCandidateError extends Error {
   readonly dropped: DroppedCandidate[];
   readonly withheld: WithheldCandidate[];
-  constructor(message: string, dropped: DroppedCandidate[], withheld: WithheldCandidate[], options?: ErrorOptions) {
+  /** empty unless the fan was declared stillborn; `dropped` is then only what WAS compiled */
+  readonly notCompiled: NotCompiledCandidate[];
+  constructor(
+    message: string,
+    dropped: DroppedCandidate[],
+    withheld: WithheldCandidate[],
+    notCompiled: NotCompiledCandidate[],
+    options?: ErrorOptions,
+  ) {
     super(message, options);
     this.name = 'NoScorableCandidateError';
     this.dropped = dropped;
     this.withheld = withheld;
+    this.notCompiled = notCompiled;
   }
 }
 
@@ -309,14 +364,23 @@ export interface RankedResult<S> {
  *  drivers over one enumeration (this module's sync `rankBy` and the webapp's async await-loop),
  *  and a filter written twice is how they come to publish different answers. Null ⇒ publish.
  *
- *  `score === 0` is objdiff's byte-exact match (cli objdiff.ts states the equivalence), which is
+ *  `score === 0` is objdiff's byte-exact match (@match-kit/scoring states the equivalence), which is
  *  why a bare `.score` suffices and the generic needs no `match` field. */
 export function withheldReason<S extends { score: number }>(c: Candidate, score: S): string | null {
-  return c.matchOnly === true && score.score !== 0
-    ? 'this spelling rests on a device-behaviour fact no gate over the C can settle; only a byte-exact score proves it'
-    : null;
+  if (c.matchOnly !== true || score.score === 0) {
+    return null;
+  }
+  const facts = c.variations.flatMap((v) => PROOF_OBLIGATIONS.get(v) ?? []);
+  const fact = facts.length > 0 ? facts.join(' and on ') : 'a fact no gate over the C can settle';
+  return `this spelling rests on ${fact}; only a byte-exact score proves it`;
 }
 
+/** The fact each proof-carrying variation (`needsProof`) rests on, as `withheldReason` publishes it. */
+const PROOF_OBLIGATIONS: ReadonlyMap<string, string> = new Map<VariationName, string>([
+  ['unreduce', 'a device-behaviour fact no gate over the C can settle'],
+  ['int-cell', 'the project declaring the global an integer, which the assembly does not show'],
+]);
+
 /** What a respell variation hands `respell`: its tree, or — when the variation cannot establish the
  *  candidate's semantics from inside the pass — the tree paired with that fact. `undefined`/`null`
  *  is a decline. */
@@ -408,9 +472,8 @@ export function enumerateCandidates(
   // Same merge as `decompile`: the project's DWARF signatures fill in what the caller did not
   // state, so both the annotate pass and the ranked candidates reason about one prototype table.
   const prototypes = prototypesFromSymbols(opts.symbols, opts.prototypes ?? {});
-  const frontend = frontendFor(target);
   const baseOpts = {
-    ...structureOptionsFor(target, prototypes[name]?.returnsVoid ?? false),
+    ...structureOptionsFor(target, declaresVoidReturn(prototypes[name]), prototypes),
     // See the same line in pipeline.ts: a backend that cannot print switch fall-through must not
     // be handed a tree carrying one, because its refusal costs the whole candidate (and, when
     // every candidate carries it, the whole row).
@@ -541,8 +604,7 @@ export function enumerateCandidates(
   // pointers/aggregates so they are excluded from the signedness variation (see NO_PIN_KINDS). One
   // extra lift+recover, no compile. (The shared lift deliberately stops after recoverTypes — it only reads the param KINDS, so
   // the totality contract / return-sinking of the full spine are not run on it.)
-  const sharedLift = frontend.lift(name, asm, target, prototypes, opts.asmData, opts.symbols);
-  verify(sharedLift);
+  const sharedLift = liftStamped(name, asm, target, prototypes, opts.asmData, opts.symbols);
   // The ARRAY SHAPES the input assembly evidences (raise/globalshape.ts), for the DECLARATION
   // half. Read off the shared lift's LIFTED form — before the fold below and the tower rewrite it —
   // because the base-materialization order the derivation's licence reads does not survive them.
@@ -585,8 +647,7 @@ export function enumerateCandidates(
     if (symbols === opts.symbols) {
       return sharedLiftTreeOwned;
     }
-    const p = frontend.lift(name, asm, target, prototypes, opts.asmData, symbols);
-    verify(p);
+    const p = liftStamped(name, asm, target, prototypes, opts.asmData, symbols);
     applyIdiomPatterns(p, target, opts.patterns);
     let seen = false;
     runPreRecovery(p, target, () => verify(p), prototypes[name], {
@@ -800,6 +861,14 @@ export function enumerateCandidates(
     s.ptrElems &&
     s.declRank &&
     STRUCTURE_VARIATIONS.every((variation) => !s[variation.flag]);
+  /** Does a failure ABORT THE ROW, rather than drop the setting that threw? Only on the default
+   *  candidate's own path: no variation named by the symbol-map setting or the lift setting —
+   *  `settingVariations` is both, as the candidate spells them — and, where a structure setting is
+   *  named, the default one. Anywhere else the failure is a dropped variation, reported through
+   *  `onEnumerationError` under the same names. The lift, the raise and the structuring all ask
+   *  this one predicate, so a setting that names a new variation is seen by all three. */
+  const abortsRow = (settingVariations: readonly Variation[], s?: StructureSetting): boolean =>
+    settingVariations.length === 0 && (s === undefined || isDefaultSetting(s));
 
   const seen = new Map<string, Candidate>();
   const seenTrees = new Set<string>();
@@ -840,7 +909,7 @@ export function enumerateCandidates(
   // every OTHER name in the function, so supplying more information made the tool strictly
   // worse. A union cannot — each name is declared by whichever half knows more about it.
   // SCOPE: `declSymbols` is used ONLY here. It must never reach `opts.symbols`/`baseOpts.symbols`
-  // or `frontend.lift` — feeding it to the lift would turn on pool promotion, interior
+  // or `liftStamped` — feeding it to the lift would turn on pool promotion, interior
   // attribution and the `/raw-globals` variation, which is a different (and source-moving) change.
   // THREE halves now, in increasing authority: the name-only pool/reloc symbols, the array shapes
   // the asm evidences for them (raise/globalshape.ts — an `extern u16 gTbl[];` where the bare
@@ -856,6 +925,10 @@ export function enumerateCandidates(
     accessFacts,
     mapSymbols,
     targetNames: new Set(targetSymbols.keys()),
+    // The MERGED table, the same one the frontend was handed above, so the declaration a candidate
+    // carries and the lift that produced it cannot state different things about a callee.
+    prototypes,
+    target,
     refuse,
   });
   // THE RESPELL SET, as a function whose PARAMETER LIST is the invariant the tree skip below
@@ -923,9 +996,11 @@ export function enumerateCandidates(
     // numeric-address pointer local — the joint spelling is reachable from neither variation
     // alone, each composition narrows /volatile to that variation's own locals (volatilePtrLocals'
     // `only`), and each needed a row to demand it. The STACKED variations (STACKED_VARIATIONS) are
-    // derived onto EVERY source: statement order/shape is orthogonal to what any other respell
-    // variation changes — the same kind of independent dimension as signedness —
-    // so they are crossed with every source rather than paired; a third blanket composition needs
+    // derived onto EVERY source: statement order/shape, and the width a narrow local is declared
+    // at, are each orthogonal to what any respell variation outside that table changes — the same
+    // kind of independent dimension as signedness —
+    // so they are crossed with every source rather than paired (two members of the table may
+    // compete for one node, and its order decides; rank-variations.ts); a third blanket composition needs
     // the same argument, not just a row. And a specific PAIRING is admitted on one of two
     // grounds, never on "it might help". FIRST, a row demands the joint spelling AND that
     // spelling is reachable from neither variation alone: /livebase × /indexed, × /sinkinit,
@@ -991,14 +1066,16 @@ export function enumerateCandidates(
         assertResolved(alt);
         assertDerefsTyped(alt);
         assertLocalsWritten(alt);
+        assertPostIncrUnshared(alt);
         assertNoOrphanedLocals(sfn, alt);
         sources.push({ variations, source: backend.emit(alt), ...refsOf(alt), ...volOf(alt), ...proof });
         // STACKED variations, derived onto EVERY source (the POLICY note above carries the
-        // admission argument). Each is a statement-order/shape fact orthogonal to
-        // representation; subsets compose in the fixed order below. A stacked variation that
+        // admission argument). Each is a statement-order/shape or declaration-width fact
+        // orthogonal to the respell variations outside the table; subsets compose in the fixed
+        // table order, which decides between two members that compete for one node. A stacked variation that
         // never fires declines and costs nothing.
         if (!alreadyShaped) {
-          // A shape REORDERS statements, and it is derived after a variation has placed its defs —
+          // A shape may REORDER statements, and it is derived after a variation has placed its defs —
           // so the placement is re-checked on the shaped tree (contracts.ts). Differential: judged
           // only where the unshaped tree already satisfied the walk, so a variation whose placement
           // it never described is not dropped on the strength of a model that does not apply.
@@ -1029,6 +1106,7 @@ export function enumerateCandidates(
                 assertResolved(shaped.out);
                 assertDerefsTyped(shaped.out);
                 assertLocalsWritten(shaped.out);
+                assertPostIncrUnshared(shaped.out);
                 assertNoOrphanedLocals(alt, shaped.out);
                 assertPlacementSurvives(alt, shaped.out, minted);
                 sources.push({
@@ -1143,9 +1221,9 @@ export function enumerateCandidates(
     // only ties `/vol-store`'s 27, and RT's 32 beats the admitted standalone `/unreduce`'s 35, so
     // "worse than an admitted variation" would exclude neither.
     //
-    // WHAT THE STANDALONE LINES COST, since neither of the two variations ever wins an artifact row
-    // ALONE — every `/unreduce` and `/ptr-field` winner rides inside a `/vol-store` pairing, which
-    // is the property `apps/benchmark/test/census.test.ts` asserts. They are kept because a
+    // WHAT THE STANDALONE LINES COST, since the two variations rarely win an artifact row ALONE —
+    // `apps/benchmark/test/census.test.ts` names every `/unreduce` and `/ptr-field` winner outside
+    // a `/vol-store` pairing, and fails on one it does not name. They are kept because a
     // variation has to be able to LOSE on its own terms: the admission posture (compareScored orders
     // by score) is what makes a wrong respelled source harmless, and it is only observable when the
     // single-variation candidate is in the fan —
@@ -1666,6 +1744,17 @@ export function enumerateCandidates(
     // Which placement the source used is not derivable from the asm, so both are emitted and the
     // differ referees.
     respell(['sinkinit'], () => sinkInitsToFirstUse(sfn));
+    // `/int-cell` — every pointer cell spelled as the integer a project may have declared it,
+    // `g = g + K` and no conversions (l3/intcell.ts). The default's `g = (void *)((u8 *)g + K)` is
+    // right under a pointer declaration of g and rejected by CodeWarrior under an integer one, where
+    // this is the source; which the project declared is not in the asm, so it is published only at
+    // a byte-exact score.
+    respell(['int-cell'], () =>
+      integerCells(sfn, (n) => {
+        const shape = mapSymbols?.get(n)?.shape;
+        return shape !== undefined && shape !== 'scalar';
+      }),
+    );
     // the register-copy variation (l3/regspell.ts): 0–3 results (base; tail assign-back reusing
     // the dead value var; tail assign-back into a fresh var — the tail decision is allocator-
     // ambiguous, so both are ranked).
@@ -1707,8 +1796,13 @@ export function enumerateCandidates(
         { variations: ['raw-globals'], symbols: undefined },
       ]
     : [{ variations: [] }];
+  // The map's POINTER declarations go to the raw setting all the same: a raw name is still a
+  // pointer in the project's file, so arithmetic on its value scales unless spelled in bytes.
+  const pointerGlobals = new Set(
+    [...(baseOpts.symbols?.entries() ?? [])].filter(([, info]) => info.shape === 'pointer').map(([n]) => n),
+  );
   for (const [symbolIndex, symbolSetting] of symbolSettings.entries()) {
-    const symbolSettingOpts = symbolSetting.symbols ? baseOpts : { ...baseOpts, symbols: undefined };
+    const symbolSettingOpts = symbolSetting.symbols ? baseOpts : { ...baseOpts, symbols: undefined, pointerGlobals };
     // `/no-bitfield` names a spelling the MAP makes available, so it has no inhabitant on the
     // symbol-map setting that structures without one: structure() normalizes `spellBitfieldMembers`
     // to false when `symbols` is absent, so both settings structure the identical tree whatever
@@ -1728,7 +1822,21 @@ export function enumerateCandidates(
     const usableStructureSettings = symbolSetting.symbols
       ? structureSettings
       : structureSettings.filter((s) => s.bitfields && s.ptrElems && (s.declRank || rawDerivesRank));
-    const treeOwnedFold = treeOwnedIn(symbolSetting.symbols);
+    // THE `/raw-globals` SETTING IS A VARIATION, so a lift that declines without the map drops it
+    // and keeps the map's candidates (`abortsRow`). The two lifts can disagree on whether a
+    // function lifts at all: a name only the map places is, without it, a pointer the frame-object
+    // audit cannot bound. This is the setting's first lift, and every later one is the same lift
+    // again.
+    let treeOwnedFold: boolean;
+    try {
+      treeOwnedFold = treeOwnedIn(symbolSetting.symbols);
+    } catch (e) {
+      if (abortsRow(symbolSetting.variations)) {
+        throw e;
+      }
+      reportThrow(symbolSetting.variations, e);
+      continue;
+    }
     // The signedness variation DECLINES where the pin has nothing to pin. `pinScalarParams` writes only
     // over an entry param still `unknown`/`int` that is not one of the recovered pointers/
     // aggregates `ptrIdx` excludes; where no param is left, the second pass re-lifts, re-raises and
@@ -1744,7 +1852,7 @@ export function enumerateCandidates(
       if (cand.signed && !pinnable) {
         break;
       }
-      const base = frontend.lift(name, asm, target, prototypes, opts.asmData, symbolSetting.symbols);
+      const base = liftStamped(name, asm, target, prototypes, opts.asmData, symbolSetting.symbols);
       // `/setup-args` — pass a prototype-less callee only what the CALLING BLOCK set up; which of
       // the two readings the source spelled is genuinely ambiguous, and frontend/ssa.ts
       // narrowToSetupArgs carries the argument for why the differ is what settles it.
@@ -1815,6 +1923,7 @@ export function enumerateCandidates(
       );
       for (const liftSetting of liftSettings) {
         let fn: Fn;
+        let discardsPassedResult = false;
         let inferredSymbols = new Map<string, SymbolInfo>();
         let orderLicensed: ReadonlySet<string> = new Set<string>();
         try {
@@ -1823,10 +1932,11 @@ export function enumerateCandidates(
           fn =
             liftSetting.variations.length === 0
               ? base
-              : frontend.lift(name, asm, target, prototypes, opts.asmData, symbolSetting.symbols);
+              : liftStamped(name, asm, target, prototypes, opts.asmData, symbolSetting.symbols);
           if (liftSetting.narrow && !narrowToSetupArgs(fn)) {
             continue; // nothing to cut after all — the default lift's own candidates already cover it
           }
+          discardsPassedResult = liftSetting.narrow && setupArgsDiscardsPassedResult(fn);
           verify(fn);
           // This lift's OWN array-shape evidence, off its own lifted fn (a symbol map promotes
           // numeric pool words to `gaddr`, so the `/raw-globals` setting genuinely answers differently).
@@ -1855,6 +1965,13 @@ export function enumerateCandidates(
           // declaration. A map that names the symbol an array takes the access to a bare `var`
           // base anyway, which carries no licence: the two never meet.
           orderLicensed = orderLicensedGlobals(fn, target);
+          // …and the NAMES the map holds for the addresses this lift built by arithmetic off a
+          // named one (raise/offsetnames.ts). Per lift setting, off that setting's own map: the
+          // `/raw-globals` sibling has no map and so no name to reach. AFTER the two readings, and
+          // the staleness that leaves them is priced in pipeline.ts's copy of this note.
+          if (symbolSetting.symbols) {
+            OFFSET_NAME_PASS.run(fn, symbolSetting.symbols, target.compilerBehaviors);
+          }
           for (const [n, si] of [...inferredSymbols]) {
             if (baseOpts.symbols?.has(n) === true || !sameDerivedShape(declSymbols.get(n), si)) {
               inferredSymbols.delete(n);
@@ -1879,14 +1996,15 @@ export function enumerateCandidates(
           );
         } catch (e) {
           // THE DEFAULT CARRIES NO VARIATION, by construction: every lift variation appends one, so
-          // `variations.length === 0` is the only spelling of "no lift variation is on" that stays correct
+          // an empty list is the only spelling of "no lift variation is on" that stays correct
           // when a fourth is added — the same reason the structure half below reads its table
           // instead of naming its flags.
-          if (liftSetting.variations.length === 0) {
+          const settingVariations = [...liftSetting.variations, ...symbolSetting.variations];
+          if (abortsRow(settingVariations)) {
             throw e; // the default lift keeps its behavior: a raising failure aborts the row
           }
           // A dropped variation, never an aborted enumeration — the same posture as `respell`.
-          reportThrow(liftSetting.variations, e);
+          reportThrow(settingVariations, e);
           continue;
         }
         // THE SHARED-TAIL VARIATIONS: the same raised fn, structured again with `followEarlyReturns`,
@@ -1894,7 +2012,8 @@ export function enumerateCandidates(
         //   - `/shared-ret` is the follow ALONE, on the fn as raised. Some divergent `if` shares a
         //     `ret` the compiler left in place (`synthetic:gcseinner`).
         //   - `/shared-tail` is the follow after `sinkStoreTails` has rewritten the fn in place, which
-        //     is safe because `structure()` never mutates `fn`, so the earlier passes are done with it.
+        //     is safe because `structure()` writes nothing on `fn` but the `declared` stamps, which it
+        //     re-derives from its map on every call, so the earlier passes are done with it.
         //     It is enumerated only where the sink changed something AND some divergent `if` of the
         //     SUNK fn shares a `ret`. That is the sink's price gate: without it, a tail copied into
         //     arms no `if` shares adds a candidate spelling it in each — 204 synthetic candidates on 8
@@ -1942,7 +2061,7 @@ export function enumerateCandidates(
                 verify(fn);
               }
             } catch (e) {
-              reportThrow([...liftSetting.variations, 'shared-tail'], e);
+              reportThrow([...liftSetting.variations, 'shared-tail', ...symbolSetting.variations], e);
               break;
             }
             // Unsunk, this fn is the `/shared-ret` pass's again.
@@ -1996,8 +2115,9 @@ export function enumerateCandidates(
               dropped.add(key);
               continue;
             }
-            // structure() reads `fn` and produces a fresh SFn (it does not mutate `fn`), so both branch
-            // senses structure the same recovered function without re-lifting.
+            // structure() produces a fresh SFn and writes nothing on `fn` but the `declared` stamps,
+            // which it re-derives from its map on every call, so both branch senses structure the same
+            // recovered function without re-lifting.
             let sfn: SFn;
             try {
               sfn = structureChecked(fn, {
@@ -2019,7 +2139,7 @@ export function enumerateCandidates(
                 ...(alternative ? { followEarlyReturns: true } : {}),
               });
             } catch (e) {
-              if (liftVariations.length === 0 && isDefaultSetting(s)) {
+              if (abortsRow([...liftVariations, ...symbolSetting.variations], s)) {
                 throw e; // the default lift's default setting keeps its behavior: a failure aborts the row
               }
               // Recorded for EVERY dropped setting: a candidate with more variations on looks its siblings
@@ -2027,7 +2147,7 @@ export function enumerateCandidates(
               dropped.add(key);
               // an anchored setting that fails structuring or its contracts is a dropped variation, never
               // an aborted enumeration — same rule as respell below
-              reportThrow([...liftVariations, ...s.variations], e);
+              reportThrow([...liftVariations, ...s.variations, ...symbolSetting.variations], e);
               continue;
             }
             // A TREE another structure setting already produced. `respellTree` reads the tree and this
@@ -2092,6 +2212,7 @@ export function enumerateCandidates(
                 assertResolved(made);
                 assertDerefsTyped(made);
                 assertLocalsWritten(made);
+                assertPostIncrUnshared(made);
                 assertNoOrphanedLocals(sfn, made);
                 // A backend refusal on this REWRITTEN tree is not a refusal of the row's own
                 // tree, so it never becomes the row's stated cause: `TreeSources.emit` is dropped
@@ -2154,6 +2275,9 @@ export function enumerateCandidates(
                 if (sp.matchOnly === undefined) {
                   delete dup.matchOnly;
                 }
+                if (!discardsPassedResult) {
+                  delete dup.discardsPassedResult;
+                }
                 continue;
               }
               const variations: readonly Variation[] = [
@@ -2176,6 +2300,7 @@ export function enumerateCandidates(
                 ...(sp.symbolRefs ? { symbolRefs: sp.symbolRefs } : {}),
                 ...(sp.deviceVolatile ? { deviceVolatile: sp.deviceVolatile } : {}),
                 ...(sp.matchOnly ? { matchOnly: sp.matchOnly } : {}),
+                ...(discardsPassedResult ? { discardsPassedResult: true as const } : {}),
               };
               seen.set(source, made);
               out.push(made);
@@ -2200,36 +2325,75 @@ export function enumerateCandidates(
 /** Score each candidate with the injected `scoreFn` and rank by score (lowest first). A candidate
  *  whose `scoreFn` throws — e.g. its C failed to compile — is SKIPPED so it cannot sink a sibling
  *  that compiles and matches; only if EVERY candidate fails is the failure surfaced. Synchronous:
- *  the scorer must be sync (the cli/Node objdiff path). The webapp scores asynchronously and does
- *  its own await-loop over `enumerateCandidates`, reusing this module's `Candidate`/`RankedResult`
- *  types but not this driver. */
+ *  the scorer must be sync (the cli/Node objdiff path). An async driver scores on its own schedule
+ *  and then ranks through here against its memoized outcomes (the pooled CLI driver, the webapp).
+ *
+ *  A STILLBORN fan (stillborn.ts) is not compiled to the end: `scoreFn` is called for the default
+ *  candidate and the probes, and the rest ride on the thrown error as `notCompiled`. A `scoreFn`
+ *  that wants the rule to read its refusals throws `CompilerRejection`; any other throw ranks the
+ *  whole fan. */
 export function rankBy<S extends { score: number; rows?: number }>(
   candidates: Candidate[],
   symbol: string,
   scoreFn: (source: string, symbol: string, candidate: Candidate) => S,
 ): RankedResult<S> {
+  const outcomes = new Map<number, { score: S } | { thrown: unknown }>();
+  const outcomeAt = (i: number): { score: S } | { thrown: unknown } => {
+    let outcome = outcomes.get(i);
+    if (outcome === undefined) {
+      try {
+        outcome = { score: scoreFn(candidates[i].source, symbol, candidates[i]) };
+      } catch (e) {
+        outcome = { thrown: e };
+      }
+      outcomes.set(i, outcome);
+    }
+    return outcome;
+  };
+  const stillborn = stillbornVerdict(candidates, (i) => {
+    const outcome = outcomeAt(i);
+    return 'score' in outcome ? 'compiled' : outcome;
+  });
+  if (stillborn !== null) {
+    const thrownAt = (i: number): unknown => {
+      const outcome = outcomeAt(i);
+      if ('score' in outcome) {
+        throw new Error(`internal: a stillborn fan holds a candidate that scored (${i})`);
+      }
+      return outcome.thrown;
+    };
+    throw new NoScorableCandidateError(
+      `no scorable candidate for '${symbol}': ${stillbornNote(stillborn, candidates.length)}\n` +
+        `The default candidate's compile: ${fullMessage(thrownAt(0))}`,
+      stillborn.compiled.map((i) => ({ variations: candidates[i].variations, error: firstLine(thrownAt(i)) })),
+      [],
+      stillborn.notCompiled.map((i) => ({ variations: candidates[i].variations, source: candidates[i].source })),
+      { cause: thrownAt(0) },
+    );
+  }
   const results: (Scored<S> & { order: number })[] = [];
   const dropped: DroppedCandidate[] = []; // candidates that failed to build; only fatal if ALL do
   const withheld: WithheldCandidate[] = []; // candidates that built but did not earn publication
   let lastScoreErr: unknown = null;
   candidates.forEach((c, order) => {
-    try {
-      const score = scoreFn(c.source, symbol, c);
-      const why = withheldReason(c, score);
-      if (why !== null) {
-        withheld.push({
-          variations: c.variations,
-          score: score.score,
-          ...(score.rows === undefined ? {} : { rows: score.rows }),
-          why,
-        });
-        return;
-      }
-      results.push({ ...c, order, score });
-    } catch (e) {
-      lastScoreErr = e;
-      dropped.push({ variations: c.variations, error: firstLine(e) });
+    const outcome = outcomeAt(order);
+    if ('thrown' in outcome) {
+      lastScoreErr = outcome.thrown;
+      dropped.push({ variations: c.variations, error: firstLine(outcome.thrown) });
+      return;
+    }
+    const { score } = outcome;
+    const why = withheldReason(c, score);
+    if (why !== null) {
+      withheld.push({
+        variations: c.variations,
+        score: score.score,
+        ...(score.rows === undefined ? {} : { rows: score.rows }),
+        why,
+      });
+      return;
     }
+    results.push({ ...c, order, score });
   });
   if (results.length === 0) {
     // Naming the withheld count matters here: "no scorable candidate" with a null cause reads as a
@@ -2240,7 +2404,7 @@ export function rankBy<S extends { score: number; rows?: number }>(
     // above stays one line each — it is a roster, not a diagnosis.
     const why =
       lastScoreErr !== null ? fullMessage(lastScoreErr) : `${withheld.length} candidate(s) withheld, none scored`;
-    throw new NoScorableCandidateError(`no scorable candidate for '${symbol}': ${why}`, dropped, withheld, {
+    throw new NoScorableCandidateError(`no scorable candidate for '${symbol}': ${why}`, dropped, withheld, [], {
       cause: lastScoreErr,
     });
   }
@@ -2248,15 +2412,36 @@ export function rankBy<S extends { score: number; rows?: number }>(
   return { winner: results[0], candidates: results.map(({ order: _order, ...c }) => c), dropped, withheld };
 }
 
-/** THE candidate ordering — score, then preference, then readability, then enumeration
- *  order. Exported because there are TWO drivers over the same enumeration (this module's sync
- *  `rankBy` for the Node/objdiff scorer, and the webapp's async await-loop for the wasm one), and
- *  a per-driver copy would let the same input produce two different winners.
+/** The sentence a stillborn fan's error OPENS on: how much of the fan was never compiled, on what
+ *  evidence, and the errors each half's compiled candidates kept. The DEFAULT candidate's own
+ *  diagnostic — the spelling the rule is anchored on, rather than whichever was refused last —
+ *  follows it, so that a printer bounding a long diagnostic keeps the verdict. */
+function stillbornNote(stillborn: Stillborn, fan: number): string {
+  const tally = new Map<string, number>();
+  for (const m of stillborn.messages) {
+    tally.set(m, (tally.get(m) ?? 0) + 1);
+  }
+  const shared = [...tally].map(([m, n]) => `  ${m}${n > 1 ? ` (x${n})` : ''}`).join('\n');
+  return (
+    `${stillborn.notCompiled.length} of ${fan} candidates were NOT COMPILED: in each signedness half, the default ` +
+    `candidate and one probe per variation (${stillborn.compiled.length} compiled) were all rejected, every probe ` +
+    `keeping one of its default's errors:\n${shared}`
+  );
+}
+
+/** THE candidate ordering — score, then semantics, then preference, then readability, then enumeration
+ *  order. Exported because it is asked outside `rankBy` too — the benchmark's sweep driver and
+ *  fan runner order what they read back — and a second copy would let the same input produce two
+ *  different winners.
  *
  *  SCORE dominates absolutely: the differ is the fitness function, and a tie means the variation
  *  that separates these two candidates did not change the bytes — so everything below only chooses what
  *  the READER sees, and can never cost a match.
  *
+ *  A DISCARDED PASSED RESULT next (`Candidate.discardsPassedResult`): equal bytes refute neither
+ *  reading, so the one that drops a value the callee may read wins only where it scores strictly
+ *  better.
+ *
  *  PREFERENCE next: a named symbol-map spelling beats its `/raw-globals` sibling at equal bytes.
  *
  *  DEVICE VOLATILITY next: at equal bytes, the spelling that qualifies a DEVICE REGISTER
@@ -2274,7 +2459,9 @@ export function rankBy<S extends { score: number; rows?: number }>(
  *  with no score and no outcome moving. That is a judgement about the source rather than a
  *  measurement of it — the differ never refereed those six — and it is the same judgement this
  *  term was declared to make, taken on the same evidence. What it must never do is change WHICH
- *  candidates exist; that stays an admission question, one variation at a time.
+ *  candidates exist; that stays an admission question, one variation at a time. The CAST COUNT
+ *  below does the same for `/narrow-decl`, which drops one cast per local it narrows and so wins
+ *  every tie against the candidate it is derived onto.
  *
  *  CAST COUNT next, and only WITHIN a preference. A wrong signedness pin is what manufactures casts —
  *  the C backend has to cast a shift operand back to the signedness the machine op needs, so
@@ -2305,6 +2492,7 @@ export function compareScored<S extends { score: number }>(
 ): number {
   return (
     a.score.score - b.score.score ||
+    (a.discardsPassedResult ? 1 : 0) - (b.discardsPassedResult ? 1 : 0) ||
     a.preference - b.preference ||
     (b.deviceVolatile ?? 0) - (a.deviceVolatile ?? 0) ||
     castCount(a.source) - castCount(b.source) ||