@asmlift/core 0.9.0 → 0.10.0

package/src/l3/constinit.ts

@@ -0,0 +1,382 @@
+// asmlift — a local aggregate's constant INITIALIZER, recovered from the copy that fills it.
+//
+// `u8 a[16] = { 0, 1, 2, … };` is not a statement in the machine. A compiler that keeps the
+// aggregate in memory places the initial image as a constant of its own, under a label the source
+// never wrote, and copies it into the frame at entry: agbcc 2.9 writes `.LC0:` in .rodata and
+// `ldr r1,=.LC0; mov r0,sp; mov r2,#16; bl memcpy` (varasm.c `output_constant_def`, expr.c
+// `store_constructor` → `emit_block_move`). The lift reads that image as an ANONYMOUS object
+// (ir/core.ts `LocalObject.anonymous`), so the tree holds the copy as written —
+// `memcpy(sp0, .LC0, 16)` — and the image in `SFn.images`, which no declaration spells. This pass
+// spells the pair back as the declaration it came from: the local's initializer, and no copy.
+//
+// IT RUNS AT EMISSION, NOT IN STRUCTURE. Between the two the tree belongs to the contracts and the
+// respell variations, and every one of them is right about the copy as it stands: it is a call the
+// asm makes (contracts.ts `assertEffectsPreserved` counts it), and it takes the local's address,
+// which is what keeps dead-store elimination and the coalescers off the object. A folded tree
+// would hold a local nothing mentions, which l3/dce.ts deletes — and with it the initializer the
+// compiler keeps (agbcc copies `u8 a[16] = {…}` even when nothing reads `a`). So structure()
+// asks this pass whether the fold is possible and refuses the function loudly where it is not,
+// and the C-family emitter folds (backend/cfamily.ts), the same seam l3/slotorder.ts uses.
+//
+// THE FOLD IS SOUND exactly when the declaration's initializer and the copy are one program:
+//   • the copy is a block copy the C standard fixes (proto.ts `blockCopyRoles`), a TOP-LEVEL
+//     statement of the body, so it runs once and on every path that reaches it;
+//   • its destination is a whole local integer array of the copied size — or a reservation the
+//     frame rounded up by less than a word, reached by nothing but elements inside the copy and its
+//     whole address — not volatile, and nothing before the copy mentions it but a local assigned
+//     its address alone, so moving the copy to the declaration changes no value anything reads (an
+//     initializer runs at entry, the copy at its own position);
+//   • its source is the whole image, which nothing but such copies mentions, and whose size is the
+//     count — one image may fill several locals, since the compiler places one per identical
+//     constant (varasm.c `output_constant_def`), each into its own local. Several arrays in one
+//     frame are each their own local where the frame audit proves the boundaries between them
+//     (frontend/frame-objects.ts `provenParts`). KNOWN GAP: where it keeps the frame's
+//     address-taken bytes as one local instead — a neighbour handed to a callee nothing bounds, or
+//     a compiler whose placement of such arrays is not known (target.ts `addressTakenArrayOrder`)
+//     — the image refuses at the size check;
+//   • the image writes one element width (a struct's mixed widths, or padding alone, has no
+//     element type this pass could declare). An element it relocates holds an address, spelled as
+//     the address constant it is (`u32 a[16] = { (u32)&h1, … }`, which agbcc copies from the same
+//     `.word h1` image as the pointer array the source declared, compiled).
+// The local keeps its own element type where the body reaches it by an offset or a cast — those
+// were spelled against it, so its width must be the image's — and takes the image's where only
+// its whole address and element accesses, which each print their own width, reach it.
+//
+// Thumb is the only frontend that reads an anonymous image today. The rule is asked of the tree,
+// for any compiler, but the only copy it reads is a call (proto.ts `blockCopyRoles`). KNOWN GAP: an
+// INLINE copy — agbcc's `ldmia`/`stmia` for a word-aligned image below its memcpy sizes, lw/sw or
+// lwl/lwr+swl/swr (IDO, gcc 2.7.2, KMC), lwz/stw (mwcc) — declines, naming the copy it does not
+// read; no benchmark row has one, and the MIPS and PPC frontends refuse the address-taken frame
+// local before the copy is reached.
+import { type IrType, typeToString } from '../ir/types';
+import { blockCopyRoles } from '../proto';
+import {
+  type Expr,
+  type InitAddress,
+  type SFn,
+  type SImage,
+  type Stmt,
+  mapExprChildren,
+  mapStmtExprs,
+  mentionedName,
+  walkExprs,
+} from './ast';
+import { localMentions, mentionsAnyLocal } from './mentions';
+
+/** `e` without the casts around it. */
+function bare(e: Expr): Expr {
+  return e.k === 'cast' ? bare(e.e) : e;
+}
+
+/** The value of `e` where it is integer arithmetic on constants alone, or null. A copy's count is
+ *  a constant the machine may build in several instructions — agbcc spells 256 and up as an 8-bit
+ *  immediate shifted (`mov r2,#0x80; lsl r2,r2,#1`), which the tree keeps as `128 << 1`. */
+function constantValue(e: Expr): number | null {
+  const b = bare(e);
+  if (b.k === 'const') {
+    return b.value;
+  }
+  if (b.k !== 'bin') {
+    return null;
+  }
+  const l = constantValue(b.l);
+  const r = constantValue(b.r);
+  if (l === null || r === null) {
+    return null;
+  }
+  switch (b.op) {
+    case '+':
+      return l + r;
+    case '-':
+      return l - r;
+    case '*':
+      return l * r;
+    case '<<':
+      return r >= 0 && r < 32 ? l * 2 ** r : null;
+    case '|':
+      return l >= 0 && r >= 0 && l < 2 ** 31 && r < 2 ** 31 ? l | r : null;
+    default:
+      return null;
+  }
+}
+
+/** The object `e` names whole — `x` or `&x` — or null. */
+function wholeObject(e: Expr): string | null {
+  const b = bare(e);
+  return b.k === 'postincr' ? null : (mentionedName(b) ?? null);
+}
+
+/** Every mention of `name` as an expression in `body`. */
+function mentions(body: readonly Stmt[], name: string): number {
+  let n = 0;
+  for (const e of walkExprs(body as Stmt[])) {
+    if (mentionedName(e) === name) {
+      n++;
+    }
+  }
+  return n;
+}
+
+const byteSize = (t: IrType): number | null =>
+  t.kind === 'int'
+    ? t.width / 8
+    : t.kind === 'array'
+      ? (() => {
+          const e = byteSize(t.elem);
+          return e === null ? null : e * t.count;
+        })()
+      : null;
+
+/** `v`, an element of `width` bytes, read at the given signedness. */
+function resign(v: number, width: number, signed: boolean): number {
+  const bits = 8 * width;
+  const u = ((v % 2 ** bits) + 2 ** bits) % 2 ** bits;
+  return signed && u >= 2 ** (bits - 1) ? u - 2 ** bits : u;
+}
+
+/** One copy's fold: the copy statement's index, the local and its declaration. */
+interface Fold {
+  at: number;
+  local: string;
+  type: IrType;
+  init: (number | InitAddress | null)[];
+  string: boolean;
+}
+
+/** Why `image` cannot fold, as the tail of a sentence naming it, or the fold of each copy of it. */
+function planFolds(sfn: SFn, image: SImage): Fold[] | string {
+  if (image.type.kind !== 'array' || image.type.elem.kind !== 'int') {
+    return 'whose image writes no one element width — a struct, or padding alone';
+  }
+  const copies: number[] = [];
+  sfn.body.forEach((s, i) => {
+    if (
+      s.k === 'exprstmt' &&
+      s.value.k === 'call' &&
+      wholeObject(s.value.args[blockCopyRoles(s.value.fn)?.src ?? -1] ?? { k: 'const', value: 0 }) === image.name
+    ) {
+      copies.push(i);
+    }
+  });
+  if (copies.length === 0) {
+    return (
+      'which no top-level block-copy call (memcpy) takes as its source — the one copy folded into an ' +
+      'initializer; an inline, element-by-element copy of the image, and any other read of it, is not'
+    );
+  }
+  if (mentions(sfn.body, image.name) !== copies.length) {
+    return 'which the body reads other than as the source of a block copy at the top level';
+  }
+  const folds: Fold[] = [];
+  for (const at of copies) {
+    const fold = planCopy(sfn, image, at);
+    if (typeof fold === 'string') {
+      return fold;
+    }
+    folds.push(fold);
+  }
+  return folds;
+}
+
+/** Why the block copy of `image` at body index `at` cannot fold, or its fold. */
+function planCopy(sfn: SFn, image: SImage, at: number): Fold | string {
+  const elem = (image.type as Extract<IrType, { kind: 'array' }>).elem as Extract<IrType, { kind: 'int' }>;
+  const size = byteSize(image.type)!;
+  const call = (sfn.body[at] as Extract<Stmt, { k: 'exprstmt' }>).value as Extract<Expr, { k: 'call' }>;
+  const roles = blockCopyRoles(call.fn)!;
+  if (constantValue(call.args[roles.n] ?? { k: 'var', name: '' }) !== size) {
+    return `whose copy does not move its whole ${size} bytes`;
+  }
+  const local = wholeObject(call.args[roles.dst] ?? { k: 'const', value: 0 });
+  const decl = sfn.locals.find((l) => l.name === local);
+  if (local === null || decl === undefined) {
+    return 'whose copy does not fill a local of this function';
+  }
+  if (decl.init !== undefined) {
+    return `whose copy fills '${local}', which another image already initializes`;
+  }
+  if (decl.volatile || decl.pointeeVolatile) {
+    return `whose copy fills '${local}', which is volatile`;
+  }
+  const declElem = decl.type.kind === 'array' ? decl.type.elem : null;
+  const declSize = byteSize(decl.type);
+  // The copy moves the whole object — a brace initializer's image carries its zero tail — so the
+  // count is the object's size, and a reservation the frame audit measured wider by less than a
+  // word is the frame's own rounding (agbcc rounds a 6-byte array's frame to 8).
+  if (declElem === null || declElem.kind !== 'int' || declSize === null || declSize < size || declSize - size >= 4) {
+    return `whose copy fills '${local}', a ${typeToString(decl.type)}, which is not an integer array of its ${size} bytes`;
+  }
+  // A local that holds nothing but the local's address — `p0 = (u8 *)&sp0;`, the base the
+  // readability hoist (l3/basecse.ts) places at the head of the body, ahead of the copy — reads no
+  // element where it is assigned, so the copy may move past it; its uses are the local's.
+  const aliasAt = aliasesOf(sfn, local);
+  const reach = new Set([local, ...aliasAt.keys()]);
+  const aliasing = new Set(aliasAt.values());
+  const kept = sfn.body.filter((_, i) => i !== at && !aliasing.has(i));
+  if (
+    mentionsAnyLocal(
+      sfn.body.slice(0, at).filter((_, i) => !aliasing.has(i)),
+      reach,
+    )
+  ) {
+    return `whose copy into '${local}' is not the first thing the body does with it`;
+  }
+  const use = uses(kept, reach);
+  const count = size / (elem.width / 8);
+  // Reached as anything but elements, the local may be reached past the bytes copied — the tail a
+  // fill writes after a short string's copy — so the reservation must be the copy's exactly.
+  if (use.other && byteSize(decl.type) !== size) {
+    return `whose copy fills '${local}', a ${typeToString(decl.type)} the body reaches past the ${size} bytes copied`;
+  }
+  if (use.extents.some(([from, to]) => from < 0 || to > size)) {
+    return `whose copy fills '${local}', which the body indexes past the ${size} bytes copied`;
+  }
+  // An offset or a cast was spelled against the local's own element, so the image's must match and
+  // the local keeps its type. Element accesses print their own width, so where only they and the
+  // whole address reach it, the declaration (the frame audit may type it by bytes alone) witnesses
+  // nothing: the image says the element, and its signedness where it writes a negative (agbcc does
+  // only for a signed element), else the reads of that width do.
+  let own: Extract<IrType, { kind: 'int' }>;
+  if (use.other) {
+    if (declElem.width !== elem.width) {
+      return `whose ${elem.width / 8}-byte elements are not the ${declElem.width / 8}-byte elements the body reaches '${local}' by`;
+    }
+    own = declElem;
+  } else {
+    const signs = new Set(use.reads.filter((r) => r.width * 8 === elem.width).map((r) => r.signed));
+    const signed =
+      elem.signed ||
+      (signs.size === 1 ? [...signs][0] : declElem.width === elem.width && use.indexed > 0 && declElem.signed);
+    own = { ...elem, signed };
+  }
+  return {
+    at,
+    local,
+    type: { kind: 'array', elem: own, count },
+    // an address is the address whatever the element's signedness: its cast spells that
+    init: image.init.map((v) => (typeof v === 'number' ? resign(v, elem.width / 8, own.signed) : v)),
+    string: image.string === true && elem.width === 8,
+  };
+}
+
+/** The locals of `sfn` that hold `local`'s address and nothing else — assigned it once, at the top
+ *  level of the body, and never written through `&` — each with the index of that assignment. */
+function aliasesOf(sfn: SFn, local: string): Map<string, number> {
+  const counts = localMentions(sfn);
+  const out = new Map<string, number>();
+  sfn.body.forEach((s, i) => {
+    const m = s.k === 'assign' ? counts.get(s.name) : undefined;
+    if (
+      s.k === 'assign' &&
+      s.name !== local &&
+      m?.assigns === 1 &&
+      m.addrTaken === 0 &&
+      wholeObject(s.value) === local
+    ) {
+      out.set(s.name, i);
+    }
+  });
+  return out;
+}
+
+/** How `body` reaches the object the names in `reach` all denote whole: the byte extent of each
+ *  direct element access with a constant index (`sp0[k]`, `((u8 *)sp0)[k]`, `p0[k]` — the index
+ *  node carries its own width), how many of those there are in all, and whether anything reaches
+ *  it other than as a whole call argument or a direct element access. */
+function uses(
+  body: readonly Stmt[],
+  reach: ReadonlySet<string>,
+): { indexed: number; extents: [number, number][]; reads: { width: number; signed: boolean }[]; other: boolean } {
+  let total = 0;
+  let accounted = 0;
+  let indexed = 0;
+  const extents: [number, number][] = [];
+  const reads: { width: number; signed: boolean }[] = [];
+  const reaches = (e: Expr): boolean => {
+    const n = wholeObject(e);
+    return n !== null && reach.has(n);
+  };
+  for (const e of walkExprs(body as Stmt[])) {
+    const n = mentionedName(e);
+    if (n !== undefined && reach.has(n)) {
+      total++;
+    }
+    if (e.k === 'call') {
+      accounted += e.args.filter(reaches).length;
+    }
+    if (e.k === 'index' && reaches(e.base)) {
+      accounted++;
+      indexed++;
+      reads.push({ width: e.width, signed: e.signed });
+      const k = bare(e.idx);
+      if (k.k === 'const') {
+        extents.push([k.value * e.width, (k.value + 1) * e.width]);
+      }
+    }
+  }
+  return { indexed, extents, reads, other: total !== accounted };
+}
+
+/** Whether every anonymous image `sfn` holds folds into a local's initializer: null when it does,
+ *  else the image's name and the tail of the sentence that refuses it. */
+export function constantImageRefusal(sfn: SFn): { image: string; refused: string } | null {
+  for (const image of sfn.images ?? []) {
+    const plan = planFolds(sfn, image);
+    if (typeof plan === 'string') {
+      return { image: image.name, refused: plan };
+    }
+  }
+  return null;
+}
+
+/** `e` with every access to a folded local that reads one of its elements AS that element spelled
+ *  `a[k]` on the local itself. The structurer spelled the access against the type the frame audit
+ *  gave the local — bytes, unsigned — so a read of the element type this pass gives it (`s8`, from
+ *  the image) came out through the local's address and a cast, `((s8 *)a)[5]`. The two are one C
+ *  value and not one compile: agbcc re-forms `sp + 0x15` for the cast where `b[5]` reads through
+ *  the base it already holds for `b`'s copy (`ldrsb r0, [r5, r0]`). An access of another width or
+ *  signedness keeps its cast, which is the element type it spells. */
+function asElement(e: Expr, by: ReadonlyMap<string, Fold>): Expr {
+  const inner = mapExprChildren(e, (c) => asElement(c, by));
+  if (inner.k !== 'index' || (inner.lead?.length ?? 0) > 0 || inner.baseElem !== undefined) {
+    return inner;
+  }
+  // the object the base names whole, as the fold's own census of element accesses reads it (`uses`)
+  const name = wholeObject(inner.base);
+  const fold = name === null ? undefined : by.get(name);
+  const elem = fold?.type.kind === 'array' ? fold.type.elem : undefined;
+  if (elem?.kind !== 'int' || elem.width !== inner.width * 8 || elem.signed !== inner.signed) {
+    return inner;
+  }
+  return { ...inner, base: { k: 'var', name: name! }, subscript: true };
+}
+
+/** `sfn` with every anonymous image folded into the initializer of each local its copies fill,
+ *  the copies gone and the image with them. Throws where one does not fold: structure() refused
+ *  that function already, so a tree that reaches here unfoldable was made so by a later pass. */
+export function foldConstantImages(sfn: SFn): SFn {
+  if (sfn.images === undefined) {
+    return sfn;
+  }
+  let out: SFn = { ...sfn };
+  delete out.images;
+  for (const image of sfn.images) {
+    const plan = planFolds(out, image);
+    if (typeof plan === 'string') {
+      throw new Error(`cannot spell '${sfn.name}': the compiler's anonymous constant '${image.name}' ${plan}`);
+    }
+    const copies = new Set(plan.map((f) => f.at));
+    const by = new Map(plan.map((f) => [f.local, f]));
+    out = {
+      ...out,
+      body: out.body.filter((_, i) => !copies.has(i)).map((st) => mapStmtExprs(st, (e) => asElement(e, by))),
+      locals: out.locals.map((l) => {
+        const f = by.get(l.name);
+        return f === undefined
+          ? l
+          : { ...l, type: f.type, init: f.init, ...(f.string ? { initString: true as const } : {}) };
+      }),
+    };
+  }
+  return out;
+}

package/src/l3/dce.ts

@@ -25,7 +25,7 @@
 // unresolved `?` value trips the contract first and never reaches DCE; `mustKeep` treating `?` as
 // keep is defense-in-depth for any future caller that skips that check.
 import type { Expr, SFn, Stmt } from './ast';
-import { exprChildren, negateCond, stmtChildren, stmtExprs } from './ast';
+import { exprChildren, keepsHelperRel, negateCond, stmtChildren, stmtExprs } from './ast';
 
 /** Accumulate every LOCAL-eligible `var` name read anywhere in `e` (recurses all sub-exprs). An
  *  `addr` name counts too: taking a local's address makes every store to it observable through the
@@ -196,7 +196,7 @@ function dceBlock(
           if (mustKeep(s.cond, volatiles)) {
             rev.push({ k: 'exprstmt', value: s.cond });
           }
-        } else if (t.out.length === 0) {
+        } else if (t.out.length === 0 && !keepsHelperRel(s.cond)) {
           rev.push({ k: 'if', cond: negateCond(s.cond), then: e.out, else: [] });
         } else {
           rev.push({ k: 'if', cond: s.cond, then: t.out, else: e.out });

package/src/l3/initfirst.ts

@@ -43,12 +43,19 @@ import {
   exprChildren,
   exprEquals,
   exprHasEffect,
+  keepsHelperRel,
   mentionedName,
   stmtChildren,
   stmtExprs,
   walkExprs,
 } from './ast';
-import { arithConversionSignedness, declaredTypes, exprIntWidth, provablyNonNegative } from './typing';
+import {
+  arithConversionSignedness,
+  declaredTypes,
+  exprIntWidth,
+  provablyNonNegative,
+  rendersSignedOverUnsigned,
+} from './typing';
 
 const readsVar = (e: Expr, name: string): boolean =>
   mentionedName(e) === name || exprChildren(e).some((c) => readsVar(c, name));
@@ -95,8 +102,9 @@ const hoistableRead = (e: Expr, ownNames: ReadonlySet<string>, volatileLocals: R
 };
 
 /** A compare operand and the init's value denote the same 32-bit value under different SPELLINGS
- *  when a width-32 cast is all that separates them: `/uns-cmp` wraps one side in `(u32)` to make
- *  the branch unsigned, and on a zero-trip guard that side is the very const the init assigns.
+ *  when a width-32 cast is all that separates them: the unsigned-compare spelling wraps one side in
+ *  `(u32)` to make the branch unsigned, and on a zero-trip guard that side is the very const the
+ *  init assigns.
  *  The swap is still exact — `v = X` stores X's 32 bits and `v` is 32-bit-declared
  *  (meaningPreserved refuses otherwise), so `v` and `(u32)X` carry the same bit pattern and only
  *  the compare's rendered signedness can differ, which meaningPreserved checks separately. A
@@ -137,6 +145,25 @@ const meaningPreserved = (
   return before !== undefined && before === after;
 };
 
+/** `cond` with one side read through `v`, AFTER `meaningPreserved` said yes. That answer is a
+ *  value proof the finished tree cannot repeat: `v` holds X, but `v`'s declaration does not say
+ *  what range X had, so rank.ts's judgment of the tree (typing.ts `signedOverUnsignedCompare`)
+ *  would call an unsigned compare whose ORIGINAL operands were both non-negative signed, and
+ *  withhold a spelling that compares the same values. So a compare that was value-faithful before
+ *  the swap is marked proved: its `unsignedCmp` evidence is dropped. One that was not keeps it. */
+const swapSide = (
+  cond: Extract<Expr, { k: 'bin' }>,
+  side: 'l' | 'r',
+  v: string,
+  env: ReturnType<typeof declaredTypes>,
+): Expr => {
+  const out: Extract<Expr, { k: 'bin' }> = { ...cond, [side]: { k: 'var', name: v } };
+  if (cond.unsignedCmp === true && !rendersSignedOverUnsigned(cond.l, cond.r, env)) {
+    delete out.unsignedCmp;
+  }
+  return out;
+};
+
 /** TOTAL (reads and pure writes) — see the note on stmtTouches. Runs against the pre-rewrite
  *  tree (`skip` is an original-tree statement, found by identity); the rewrites never change a
  *  name's presence in a subtree, so the verdict carries over to the rewritten one. */
@@ -223,7 +250,7 @@ export function initFirstGuards(sfn: SFn): SFn | null {
         then = then.slice(1);
         els = els.slice(1);
       }
-      if (then.length === 0 && els.length > 0) {
+      if (then.length === 0 && els.length > 0 && !keepsHelperRel(cond)) {
         const neg = cond.k === 'bin' ? NEGATE_REL[cond.op] : undefined;
         if (neg !== undefined && cond.k === 'bin') {
           cond = { ...cond, op: neg };
@@ -234,16 +261,20 @@ export function initFirstGuards(sfn: SFn): SFn | null {
       // a COMMON-hoisted variable holds its const on both paths, so the condition's matching
       // const operand reads through it unconditionally — no tail gate needed.
       // A BARE const only, where the guard re-spelling below uses the cast-tolerant `sameValue`:
-      // this site does not run `meaningPreserved`, so it may not swap in a name whose declared
-      // type could re-render the compare's signedness — which is exactly what peeling a `(u32)`
-      // would put on the table. A row that needs `/uns-cmp`'s spelling hoisted here brings the
-      // gate with it.
+      // peeling a `(u32)` here would put a re-rendered signedness on the table with no cast left to
+      // say which. The name's DECLARED type can re-render it too — `if (a1 > 0)` read through a
+      // `u32 v` that holds the 0 is `a1 != 0` — so the swap asks `meaningPreserved` as the guard
+      // re-spelling does.
       for (const hv of hoisted) {
         if (cond.k === 'bin' && NEGATE_REL[cond.op]) {
           if (cond.l.k === 'const' && cond.l.value === hv.value) {
-            cond = { ...cond, l: { k: 'var', name: hv.name } };
+            if (meaningPreserved(cond.l, cond.r, 'l', hv.name, env)) {
+              cond = swapSide(cond, 'l', hv.name, env);
+            }
           } else if (cond.r.k === 'const' && cond.r.value === hv.value) {
-            cond = { ...cond, r: { k: 'var', name: hv.name } };
+            if (meaningPreserved(cond.l, cond.r, 'r', hv.name, env)) {
+              cond = swapSide(cond, 'r', hv.name, env);
+            }
           }
         }
       }
@@ -283,7 +314,7 @@ export function initFirstGuards(sfn: SFn): SFn | null {
         ) {
           out.push(init);
           moved.add(init);
-          cond = { ...cond, [side]: { k: 'var', name: init.name } };
+          cond = swapSide(cond, side, init.name, env);
           then = then.slice(1);
           changed = true;
         }

package/src/l3/intcell.ts

@@ -38,7 +38,8 @@ const isCell = (x: Expr, name: string): boolean =>
  *  a bare value as it stands, anything else converted. */
 function integerValue(value: Expr, name: string): Expr {
   const stored = value.k === 'cast' ? value.e : value;
-  // `(u8 *)((u32)g + r)`: the integer sum the operand-order rule restores to a byte pointer
+  // `(u8 *)((u32)g + r)`: the integer sum the arithmetic table restores to a byte pointer
+  // (structure/pointer-spelling.ts ARITH_ROWS, `restore: 'bytes'`)
   const sum = stored.k === 'cast' && isPtrTo(stored.to, 'u8') ? stored.e : stored;
   if (sum.k === 'bin' && (sum.op === '+' || sum.op === '-') && isCell(sum.l, name)) {
     return { ...sum, l: { k: 'var', name } };