@asmlift/core 0.9.0 → 0.10.0

package/src/l3/symbol-refs.ts

@@ -17,7 +17,7 @@
 // stale ref, transitively reintroducing the hazards the collector excludes). Deriving at the
 // consumption point makes staleness impossible by construction.
 import type { IrType } from '../ir/types';
-import { type AggregateLayout, type ParamType, type Prototypes, spellableProto } from '../proto';
+import { type AggregateLayout, type FnProto, type ParamType, type Prototypes, spellableProto } from '../proto';
 import type { SymbolInfo } from '../symbols';
 import type { TargetDescription } from '../target';
 import { Expr, SFn, Stmt, exprChildren, mentionedName, stmtChildren, stmtExprs } from './ast';
@@ -63,10 +63,43 @@ export interface SymbolRef {
    *  by its tag (`name`), from the members the declaration lists (`layout`, which the lift laid out
    *  to type the call). */
   returned?: { readonly name: string; readonly declared: string; readonly layout: AggregateLayout };
+  /** The structs a call target is passed BY VALUE (`byValue` on the call), defined the same way
+   *  from the declaration's `byValueLayouts`. */
+  passed?: readonly { readonly name: string; readonly declared: string; readonly layout: AggregateLayout }[];
+  /** A global the body passes BARE as a struct by value (`take(gS)`), as `struct <tag>`: a
+   *  name-only declaration of it is that struct, which the call needs and an integer cell rejects. */
+  passedAs?: string;
   /** The bare name holds a pointer (l3/ptrcell.ts): the body stores one into it, or it meets such a
    *  cell bare and nothing reads it as an integer (`pointerPartners`). A name-only declaration of it
    *  is a pointer, which the store needs and an integer cell rejects on CodeWarrior. */
   holdsPointer?: true;
+  /** A call target with NO spellable prototype whose address a function-scope static's (or an
+   *  anonymous image's) initializer holds. The static's `(u32)&F` precedes every call, so the
+   *  implicit declaration a call makes comes too late for it; `declare.ts` prints that same
+   *  declaration first, `int F();`, which states no parameter and so binds the call as before. */
+  implicitCall?: true;
+  /** THE STRUCT THE FUNCTION ITSELF RETURNS ({@link ownReturnDefinition}): a ref under the
+   *  function's own name that declares nothing of it — its definition is its declaration — and only
+   *  defines `returned`, the type its own signature spells. */
+  definesReturn?: true;
+}
+
+/** The ref that defines the struct `tree` itself returns by value — a type the project's headers
+ *  own (ir/types.ts `declared`), so the candidate's declarations define it as they define a
+ *  callee's (`SymbolRef.returned`) — from the members its own declaration `own` lists. Undefined
+ *  where it returns no such struct, or its declaration lists no members. */
+export function ownReturnDefinition(tree: SFn, own: FnProto | undefined): SymbolRef | undefined {
+  const t = tree.retType;
+  const layout = own?.returnLayout;
+  if (t.kind !== 'struct' || t.declared === undefined || layout?.members === undefined) {
+    return undefined;
+  }
+  return {
+    name: tree.name,
+    info: { name: tree.name, kind: 'code' },
+    returned: { name: t.name, declared: t.declared, layout },
+    definesReturn: true,
+  };
 }
 
 /** The declarable symbols a structured body references in a VALUE context — the input to the
@@ -101,15 +134,31 @@ export function collectSymbolRefs(
   onRefused?: (name: string, reason: 'call-target' | 'self-name') => void,
 ): SymbolRef[] {
   const called = new Set<string>();
-  // the struct a callee returns through memory, as the lift typed it
+  // the struct a callee returns through memory or by value in registers, as the lift typed it
   const returned = new Map<string, Extract<IrType, { kind: 'struct' }>>();
+  // …and the structs it is passed by value, by declared parameter index
+  const passedTo = new Map<string, Map<number, Extract<IrType, { kind: 'struct' }>>>();
+  // …and the globals passed bare as one, by its spelling
+  const passedAs = new Map<string, string>();
   const valueRefs = new Set<string>();
   const visitExpr = (e: Expr): void => {
     const named = mentionedName(e);
     if (e.k === 'call' && typeof e.fn === 'string') {
       called.add(e.fn);
-      if (e.sret?.kind === 'struct') {
-        returned.set(e.fn, e.sret);
+      const struct = e.sret ?? e.returns;
+      if (struct?.kind === 'struct') {
+        returned.set(e.fn, struct);
+      }
+      for (const b of e.byValue ?? []) {
+        if (b.type.kind === 'struct') {
+          const params = passedTo.get(e.fn) ?? passedTo.set(e.fn, new Map()).get(e.fn)!;
+          params.set(b.param, b.type);
+          const arg = e.args[b.at];
+          if (arg?.k === 'var' && symbols.has(arg.name)) {
+            // by its tag, which declares even ahead of the definition and of a typedef of it
+            passedAs.set(arg.name, `struct ${b.type.name}`);
+          }
+        }
       }
     } else if (named !== undefined && symbols.has(named)) {
       valueRefs.add(named);
@@ -126,6 +175,18 @@ export function collectSymbolRefs(
     stmtChildren(s).forEach(visitStmt);
   };
   tree.body.forEach(visitStmt);
+  // A function-scope static's initializer names the globals whose addresses it holds
+  // (`(u32)&MetatileBehavior_IsTallGrass`), which the candidate must declare as much as the body's —
+  // and so does an anonymous image, which the emitter folds into a local's initializer.
+  const initAddresses = new Set<string>();
+  for (const st of [...(tree.statics ?? []), ...(tree.images ?? [])]) {
+    for (const v of st.init ?? []) {
+      if (v !== null && typeof v === 'object' && symbols.has(v.symbol)) {
+        valueRefs.add(v.symbol);
+        initAddresses.add(v.symbol);
+      }
+    }
+  }
   const holdsPointer = new Set([...pointerCellsOf(tree), ...pointerPartners(tree)]);
   // A call target is a ref in its own right, whether or not the body also names it as a value —
   // `Object.hasOwn`, because `prototypes` is caller-supplied JSON and a callee may be named
@@ -137,7 +198,9 @@ export function collectSymbolRefs(
     // function, and `proto.ts` `prototypesFromSymbols` has already taken the `returns` off such an
     // entry, so what arrives here states no printable prototype and the frontend read the call the
     // same way. Testing it a second time at this reader is what let the two answer differently.
-    const p = Object.hasOwn(prototypes, n) ? spellableProto(prototypes[n], target, returned.get(n)) : undefined;
+    const p = Object.hasOwn(prototypes, n)
+      ? spellableProto(prototypes[n], target, returned.get(n), new Set(passedTo.get(n)?.keys()))
+      : undefined;
     if (p !== undefined) {
       proto.set(n, p);
     }
@@ -145,7 +208,11 @@ export function collectSymbolRefs(
   return [...new Set([...valueRefs, ...proto.keys()])]
     .sort()
     .filter((n) => {
-      if (called.has(n) && !proto.has(n)) {
+      // …except where an initializer holds its address: there the name is spelled ahead of every
+      // call, so leaving it to the call's implicit declaration leaves the initializer naming an
+      // undeclared identifier, and the implicit declaration itself is the one that is printed
+      // (`SymbolRef.implicitCall`).
+      if (called.has(n) && !proto.has(n) && !initAddresses.has(n)) {
         onRefused?.(n, 'call-target');
         return false;
       }
@@ -164,12 +231,23 @@ export function collectSymbolRefs(
       const r = p ? returned.get(n) : undefined;
       const layout = r?.declared !== undefined ? prototypes[n].returnLayout : undefined;
       const definition = layout?.members !== undefined ? { name: r!.name, declared: r!.declared!, layout } : undefined;
+      const passed = p
+        ? [...(passedTo.get(n) ?? [])].flatMap(([k, t]) => {
+            const l = prototypes[n].byValueLayouts?.[k];
+            return l?.members !== undefined && t.declared !== undefined
+              ? [{ name: t.name, declared: t.declared, layout: l }]
+              : [];
+          })
+        : [];
       return {
         name: n,
         info,
         ...(p ? { proto: p } : {}),
         ...(definition ? { returned: definition } : {}),
+        ...(passed.length > 0 ? { passed } : {}),
+        ...(passedAs.has(n) ? { passedAs: passedAs.get(n)! } : {}),
         ...(holdsPointer.has(n) ? { holdsPointer: true as const } : {}),
+        ...(called.has(n) && !p ? { implicitCall: true as const } : {}),
       };
     });
 }

package/src/l3/tailmerge.ts

@@ -63,7 +63,7 @@
 // artifact still refuses to compile) but `collectMarkers` then reports it once rather than twice,
 // which is accurate — it is one gap that ran on both paths.
 import type { SFn, Stmt } from './ast';
-import { stmtEquals } from './ast';
+import { stmtEquals, unionStmtEvidence } from './ast';
 
 /** Statements this pass may move. Deliberately narrow — see SCOPE. */
 type Mergeable = Extract<Stmt, { k: 'assign' } | { k: 'store' } | { k: 'exprstmt' }>;
@@ -89,7 +89,9 @@ function rewrite(s: Stmt): Stmt[] {
       // it, but it is the one shape where a zero-arm merge is qualitatively unlike a partial one.
       const tail: Stmt[] = [];
       while (then.length > 0 && els.length > 0 && sameStmt(then[then.length - 1], els[els.length - 1])) {
-        tail.unshift(then[then.length - 1]);
+        // The two print alike, but an unsigned compare in one prints like the signed one in the
+        // other: the moved statement carries the evidence of both (ast.ts `unionEvidence`).
+        tail.unshift(unionStmtEvidence(then[then.length - 1], els[els.length - 1]));
         then.pop();
         els.pop();
       }

package/src/l3/typing.ts

@@ -17,8 +17,8 @@
 // Callers choose their conservative direction: the emission guard treats `undefined` as "not
 // provably a pointer" (adds a cast — valid C either way); the deref contract treats `undefined`
 // as "not provably wrong" (no error).
-import { IrType, T, memberOf, scalarTypeForAccess } from '../ir/types';
-import { type BinOp, type Expr, type SFn, exprChildren } from './ast';
+import { IrType, T, isCastView, memberOf, scalarTypeForAccess } from '../ir/types';
+import { type BinOp, type Expr, type SFn, exprChildren, walkExprs } from './ast';
 
 /** The declared type of a printed variable — the env `exprCType` judges rendered C against.
  *  THE one copy of the SFn→env derivation — printers, contracts and L3 respell variations alike: each
@@ -31,7 +31,7 @@ export function declaredTypes(fn: SFn): VarTypes {
   for (const g of fn.globals ?? []) {
     m.set(g.name, g.type);
   }
-  for (const st of fn.statics ?? []) {
+  for (const st of [...(fn.statics ?? []), ...(fn.images ?? [])]) {
     m.set(st.name, st.type);
   }
   for (const p of fn.params) {
@@ -58,8 +58,9 @@ export function ptrElemBytes(to: IrType): number {
 export interface PrintEnv {
   readonly type: VarTypes;
   readonly volatilePointee: (name: string) => boolean;
-  /** a callee's declared parameter types, on a function compiled as C++ (`SFn.declaredArgs`,
-   *  `SFn.dialect`) */
+  /** a callee's declared parameter types, on a function whose compiler refuses C's implicit pointer
+   *  conversions: compiled as C++ (`SFn.dialect`), or by a C front end that refuses them too
+   *  (`SFn.strictConversions`) (`SFn.declaredArgs`) */
   readonly declaredArgs: (callee: string) => readonly (string | undefined)[] | undefined;
   /** a function-scope static this function defines `const` (`SFn.statics`) */
   readonly constStatic: (name: string) => boolean;
@@ -76,7 +77,9 @@ export function printEnv(fn: SFn): PrintEnv {
     type: declaredTypes(fn),
     volatilePointee: (n) => vol.has(n),
     declaredArgs: (callee) =>
-      fn.dialect === 'c++' && fn.declaredArgs && Object.hasOwn(fn.declaredArgs, callee)
+      (fn.dialect === 'c++' || fn.strictConversions === true) &&
+      fn.declaredArgs &&
+      Object.hasOwn(fn.declaredArgs, callee)
         ? fn.declaredArgs[callee]
         : undefined,
     constStatic: (n) => constStatics.has(n),
@@ -184,8 +187,24 @@ export function exprIntWidth(e: Expr, varType: VarTypes): 32 | 64 {
 export const FLOAT_BINOPS: ReadonlySet<BinOp> = new Set<BinOp>(['f+', 'f-', 'f*', 'f/']);
 
 /** The binary operators whose RESULT is a C `int` whatever their operands are — read by both
- *  halves of the conversion model, which is the point of naming them once. */
-const INT_RESULT_BINOPS = new Set<BinOp>(['<', '<=', '>', '>=', '==', '!=', '&&', '||']);
+ *  halves of the conversion model, which is the point of naming them once. A float compare is one:
+ *  its operands are floats and its result is C's `int`. */
+const INT_RESULT_BINOPS = new Set<BinOp>([
+  '<',
+  '<=',
+  '>',
+  '>=',
+  '==',
+  '!=',
+  '&&',
+  '||',
+  'f<',
+  'f<=',
+  'f>',
+  'f>=',
+  'f==',
+  'f!=',
+]);
 
 /** The USUAL ARITHMETIC CONVERSIONS over two rendered operands.
  *
@@ -221,7 +240,7 @@ export function arithConversionSignedness(l: Expr, r: Expr, varType: VarTypes):
  *
  * THE one rendered-signedness judgment, and it lives beside the declarations it judges against
  * because every consumer shares it: the C-family backend's operand pin, structure.ts's
- * unsigned-compare gate (the /uns-cmp variation) and its signed-compare pin, and — through
+ * unsigned-compare gate (unsignedCompareSpelling) and its signed-compare pin, and — through
  * `arithConversionSignedness` above — initfirst's compare-meaning gate. Two of those models
  * disagreeing about one expression is the drift this placement prevents.
  *
@@ -237,8 +256,8 @@ export function arithConversionSignedness(l: Expr, r: Expr, varType: VarTypes):
  * instruction-for-instruction the same where `f` really returns `int`); a missing one is a
  * miscompile — with `u32 f(void);` in scope `f() / a` calls `__udivsi3` where the machine called
  * `__divsi3`, and `if (f() >= 0)` compiles to `bl f; mov r0, #0`, comparison and both arms gone.
- * The one consumer that reads `undefined` the other way is the /uns-cmp variation's own gate, which is
- * asking whether an operand is ALREADY unsigned.
+ * The one consumer that reads `undefined` the other way is the unsigned-compare spelling's own
+ * gate, which is asking whether an operand is ALREADY unsigned.
  *
  * Anything narrower than 32 bits promotes to `int` and is therefore SIGNED, whatever it was
  * declared. Pointers, calls and markers are `undefined`.
@@ -308,16 +327,41 @@ export function renderedIntSignedness(e: Expr, varType: VarTypes): boolean | und
 }
 
 /** Is the rendered expression provably in [0, 2^31) — the range where a signed and an unsigned
- *  compare agree on every input (and where gcc itself emits the unsigned branch for the signed
- *  spelling)? Narrow unsigned values are the everyday case: a `(u8)x` cast or a `u8`/`u16`
- *  deref promotes to a non-negative `int`. Conservative false elsewhere. */
+ *  compare agree on every input? Narrow unsigned values are the everyday case: a `(u8)x` cast or a
+ *  `u8`/`u16` deref promotes to a non-negative `int`, and so is a mask, `x & 0xFFFF`, whose result
+ *  has no bit its non-negative side lacks; `|` and `^` set a bit only where a side has it, so they
+ *  are non-negative when both sides are. Conservative false elsewhere. A VALUE fact: it says the
+ *  two compares mean the same, not that they compile the same (`spelledNonNegative`). */
 export function provablyNonNegative(e: Expr, varType: VarTypes): boolean {
+  return nonNegative(e, varType, true);
+}
+
+/** The subset of `provablyNonNegative` over which the DEFAULT leaves an unsigned compare uncast
+ *  (structure.ts): everything but an `|`/`^`. Those are non-negative too, so their uncast
+ *  spelling owes no proof, but the pin stays in the default because it is codegen-visible where
+ *  the compiler does not track the bits: mwcc_242_81 compiles
+ *  `if ((unsigned)((a & 0xf0) | (b & 3)) < 0x31u)` beside a `!= 0` test to `cmplwi`, and the lift
+ *  scores 9/15 cast against 13/16 uncast over `s32` parameters (10/15 for the `u32` twin). Without
+ *  the pin in the default that spelling is in no candidate at all, since `/signed-cmp` is the
+ *  uncast one. A mask alone (gcc's own pick of the unsigned branch, kmc `selconst`) keeps the
+ *  uncast default. */
+export function spelledNonNegative(e: Expr, varType: VarTypes): boolean {
+  return nonNegative(e, varType, false);
+}
+
+function nonNegative(e: Expr, varType: VarTypes, orXor: boolean): boolean {
   switch (e.k) {
     case 'const':
       return e.value >= 0 && e.value < 0x80000000;
     case 'un':
       return e.op === '!';
     case 'bin':
+      if (e.op === '&') {
+        return nonNegative(e.l, varType, orXor) || nonNegative(e.r, varType, orXor);
+      }
+      if (orXor && (e.op === '|' || e.op === '^')) {
+        return nonNegative(e.l, varType, orXor) && nonNegative(e.r, varType, orXor);
+      }
       return ['<', '<=', '>', '>=', '==', '!=', '&&', '||'].includes(e.op);
     case 'cast':
       return e.to.kind === 'int' && e.to.width < 32 && !e.to.signed;
@@ -328,6 +372,47 @@ export function provablyNonNegative(e: Expr, varType: VarTypes): boolean {
   }
 }
 
+/** Would C evaluate `l OP r` SIGNED, for an ordering compare the machine did unsigned? Both sides
+ *  render as signed-promoting C (or as a type this env cannot see, which may be), neither is a
+ *  pointer (C compares an address unsigned), and they are not both `nonNeg`. With the default,
+ *  `provablyNonNegative`, a true answer means the C compares DIFFERENT values from the machine:
+ *  the proof obligation, which `signedOverUnsignedCompare` asks of the finished tree.
+ *  structure.ts also asks it with `spelledNonNegative` to place the `(u32)` pin. */
+export function rendersSignedOverUnsigned(
+  l: Expr,
+  r: Expr,
+  varType: VarTypes,
+  nonNeg: (e: Expr, varType: VarTypes) => boolean = provablyNonNegative,
+): boolean {
+  const ptrSide = (x: Expr): boolean => {
+    const t = exprCType(x, varType);
+    return t?.kind === 'ptr' || t?.kind === 'array';
+  };
+  return (
+    !ptrSide(l) &&
+    !ptrSide(r) &&
+    renderedIntSignedness(l, varType) !== false &&
+    renderedIntSignedness(r, varType) !== false &&
+    !(nonNeg(l, varType) && nonNeg(r, varType))
+  );
+}
+
+/** Does the finished tree spell some unsigned compare (`Expr.unsignedCmp`) so that C evaluates it
+ *  signed? Judged over the tree's own declarations, AFTER every pass that rewrites it: emission
+ *  pins each compare it lowers, but a respell that substitutes an arm's value into an emitted
+ *  compare (l3/unmerge.ts puts an `s16` global where a `u32` local stood) re-renders it without
+ *  asking. A name the declarations do not hold — a global the symbol declarations type outside
+ *  the tree — is not provably unsigned, so it counts: this errs toward withholding. */
+export function signedOverUnsignedCompare(sfn: SFn): boolean {
+  const env = declaredTypes(sfn);
+  for (const e of walkExprs(sfn.body)) {
+    if (e.k === 'bin' && e.unsignedCmp === true && rendersSignedOverUnsigned(e.l, e.r, env)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 /** Does this write put a value that renders as a DEFINITELY-NON-POINTER C expression into a
  *  pointer-declared slot? — `v2 = a1 + v0` with `v2: u8 *`, a `return a0 + v0` from a
  *  pointer-returning function, a store through a pointer-element lvalue. The machine's register
@@ -421,8 +506,16 @@ export function exprCType(e: Expr, varType: (name: string) => IrType | undefined
       // would type it `s96`-style garbage and make the field contract reject valid trees. The
       // node width must AGREE with the element size (when the struct declares one): a mismatch
       // means the stride channel is corrupt, so it types scalar and the field contract flags it.
+      // A recovered struct declares no size, so the one other index on its pointer — a CAST VIEW of
+      // a `castViews` field, `((u8 *)p)[1]` (structure.ts `memAccess`) — is told apart by the
+      // same rule that minted it, and reads its scalar.
       const bt = rec(e.base);
-      if (bt?.kind === 'ptr' && bt.to.kind === 'struct' && (bt.to.size === undefined || bt.to.size === e.width)) {
+      if (
+        bt?.kind === 'ptr' &&
+        bt.to.kind === 'struct' &&
+        (bt.to.size === undefined || bt.to.size === e.width) &&
+        !(e.idx.k === 'const' && isCastView(bt.to, e.idx.value * e.width, e.width, e.signed, false))
+      ) {
         return bt.to;
       }
       if (bt?.kind === 'ptr' && derefStrideOk(bt, e.width, e.signed)) {

package/src/l3/unreduce.ts

@@ -137,11 +137,12 @@
 // read off `acc = acc + K`, so it counts in the units of the ACCUMULATOR's declared type: on a
 // `u16 *` a step of 32 advances 64 BYTES. The closed form spells that stride onto the INIT, whose
 // `+` scales by whatever the INIT's own C type says. Where the two disagree the candidate
-// addresses the wrong byte, compiles clean, and carries no marker — structure.ts's `bytePtr`
-// states the same rule from the other end ("a `u16 *` walked by a computed offset addresses TWICE
-// the intended byte, and nothing downstream can see the error"). `stride-units` refuses unless
-// both scales are KNOWN and equal; a narrow integer accumulator is the same question in the other
-// direction, since `u16 acc` wraps at 65536 where `init + (i << 6)` does not.
+// addresses the wrong byte, compiles clean, and carries no marker — the POINTER STRIDE rule of
+// `ARITH_ROWS` in structure/pointer-spelling.ts states the same rule from the other end: a
+// runtime offset on a pointer whose pointee is not one byte walks `(u8 *)p`.
+// `stride-units` refuses unless both scales are KNOWN and equal; a narrow integer accumulator is
+// the same question in the other direction, since `u16 acc` wraps at 65536 where
+// `init + (i << 6)` does not.
 //
 // THAT GATE HAS NO BENCHMARK REACH AT ALL, and neither tier can see it. Censused at the
 // `firstRejection` call site over both — 750 synthetic trees and all 252 real-tier rows, the real

package/src/l3/volatileptr.ts

@@ -27,7 +27,15 @@
 // mapped global through a volatile view the map never granted. No qualifying local ⇒ decline
 // (null), so the variation never emits a duplicate of the default.
 import { addrConst, cellAddress, inRange } from './address';
-import { type Expr, type SFn, type Stmt, mapExprChildren, rematerializableAddress, walkExprs } from './ast';
+import {
+  type Expr,
+  type SFn,
+  assignsIn,
+  mapExprChildren,
+  rematerializableAddress,
+  taintOverAssigns,
+  walkExprs,
+} from './ast';
 
 const exprHas = (e: Expr, pred: (x: Expr) => boolean): boolean => {
   if (pred(e)) {
@@ -41,36 +49,6 @@ const exprHas = (e: Expr, pred: (x: Expr) => boolean): boolean => {
   return hit;
 };
 
-function collectAssigns(stmts: Stmt[], out: { name: string; value: Expr }[]): void {
-  for (const s of stmts) {
-    switch (s.k) {
-      case 'assign':
-        out.push({ name: s.name, value: s.value });
-        break;
-      case 'if':
-        collectAssigns(s.then, out);
-        collectAssigns(s.else, out);
-        break;
-      case 'while':
-      case 'dowhile':
-        collectAssigns(s.body, out);
-        break;
-      case 'for':
-        collectAssigns([s.init, s.inc], out);
-        collectAssigns(s.body, out);
-        break;
-      case 'switch':
-        for (const c of s.cases) {
-          collectAssigns(c.body, out);
-        }
-        collectAssigns(s.default ?? [], out);
-        break;
-      default:
-        break;
-    }
-  }
-}
-
 /** How many of this tree's `volatile` claims land on a DEVICE REGISTER — the gate on rank.ts's
  *  volatility tie-break, so it is counted here beside the variation that mints the claims.
  *
@@ -100,8 +78,7 @@ export function deviceVolatileClaims(sfn: SFn, window?: readonly [number, number
       underSubscript.add(e.base);
     }
   }
-  const assigns: { name: string; value: Expr }[] = [];
-  collectAssigns(sfn.body, assigns);
+  const assigns = assignsIn(sfn.body);
   for (const l of sfn.locals) {
     if (l.type.kind === 'ptr' && (l.pointeeVolatile !== undefined || l.volatile !== undefined)) {
       n += assigns.filter((a) => a.name === l.name && inWindow(a.value)).length;
@@ -143,27 +120,13 @@ export const volatileEligibleValue = (e: Expr): boolean => rematerializableAddre
 
 /** the shared eligibility predicate (the GATE in the header) for one function's locals */
 function eligibility(sfn: SFn): (l: SFn['locals'][number]) => boolean {
-  const assigns: { name: string; value: Expr }[] = [];
-  collectAssigns(sfn.body, assigns);
-  const numericFed = new Set<string>();
-  const tainted = new Set<string>();
-  for (const a of assigns) {
-    if (rematerializableAddress(a.value)) {
-      numericFed.add(a.name);
-    }
-    if (feedsSymbolAddress(a.value)) {
-      tainted.add(a.name);
-    }
-  }
-  for (let grew = true; grew;) {
-    grew = false;
-    for (const a of assigns) {
-      if (!tainted.has(a.name) && exprHas(a.value, (x) => x.k === 'var' && tainted.has(x.name))) {
-        tainted.add(a.name);
-        grew = true;
-      }
-    }
-  }
+  const assigns = assignsIn(sfn.body);
+  const numericFed = new Set(assigns.filter((a) => rematerializableAddress(a.value)).map((a) => a.name));
+  const tainted = taintOverAssigns(
+    assigns,
+    assigns.filter((a) => feedsSymbolAddress(a.value)).map((a) => a.name),
+    (a, t) => exprHas(a.value, (x) => x.k === 'var' && t.has(x.name)),
+  );
   return (l) =>
     l.type.kind === 'ptr' &&
     l.volatile === undefined &&

package/src/mangle.ts

@@ -129,6 +129,36 @@ export function demangle(sym: string): CppSig | null {
   return { name, cls, params };
 }
 
+/** How a class opens where gcc 2 names one: a length (`3Foo`), a nesting count (`Q21A1B`, and
+ *  `Q_12_` past nine levels) or a template (`t3Vec1Zi`). A member function's const and volatile
+ *  marks come before it (`get__C3Fooi`, `get__V3Fooi`, `get__CQ21A1Bi`), and CodeWarrior's class
+ *  opens the same way, its marks following the class (`getStartHour__11PlayerStateCFv`). */
+const GCC2_CLASS = String.raw`(?:\d|Q(?:\d|_\d+_)|t\d)`;
+
+/** How many argument words a C++ symbol may be handed ahead of its declared parameters: 1 where it
+ *  may name a MEMBER function, whose `this` the declared list leaves out; 0 where it cannot; and
+ *  `undefined` for a constructor or destructor, which may also take a flag no declaration states
+ *  (an in-charge or delete flag, beside `this`). Either mangling scheme a target here compiles with
+ *  puts the class right after the `__`, length-prefixed or `Q<n>`-nested: CodeWarrior's
+ *  `pick__3FooFiPi` (`__ct__3FooFv`, `__dt__3FooFv`), and gcc 2's `pick__3FooiPi` (a const method
+ *  `pick__C3FooiPi`, a volatile one `pick__V3FooiPi`, a constructor `__3Foo`, a destructor `_$_3Foo`
+ *  or `_._3Foo`, every one of which this abstains on, nested `_._Q21A1B` included), where a
+ *  TEMPLATE class is spelled `t<n><name><args>` in the class's place (`get__t3Vec1Zii`, a
+ *  constructor `__t3Vec1Zii`, `operator=` `__as__t3Vec1ZiRCt3Vec1Zi`). A free function (`f__Fii`)
+ *  and a plain C name answer 0. A STATIC member mangles as a method does and takes no
+ *  `this`, so 1 is "may", and a reader that needs the exact count must not take it as one.
+ *
+ *  THE PATTERNS ERR TOWARDS A MEMBER, because the errors cost differently: a method read as free
+ *  loses its `this` word, and the own-declaration bound (`proto.ts` `ownArgumentWords`) then turns
+ *  its last parameter into an uninitialised local, where a C name read as a method only leaves one
+ *  more register a parameter. */
+export function implicitArgumentWords(sym: string): 0 | 1 | undefined {
+  if (/^__(?:ct|dt)__/.test(sym) || new RegExp(`^__${GCC2_CLASS}`).test(sym) || /^_[$.]_/.test(sym)) {
+    return undefined;
+  }
+  return new RegExp(`__[CV]*${GCC2_CLASS}`).test(sym) ? 1 : 0;
+}
+
 /** A class qualifier off the front of `s` — `12RefCountable`, or `Q23zen17particleGenerator` for a
  *  nested one — as its scope names and the remaining string; null when `s` does not open with one. */
 function parseQualifier(s: string): { scopes: string[]; rest: string } | null {