@asmlift/core 0.9.0 → 0.10.0

package/src/raise/structs.ts

@@ -47,12 +47,15 @@
 // at an offset natural C alignment could not place it at) is rejected LOUD. An overlap is a union
 // member on a base whose layout only this function's accesses describe, and no struct at all on
 // one whose address is declared elsewhere (`recognizeStructs`).
-import { constAddressOf, globalCellOf } from '../ir/alias';
+import { constAddressOf, constDisplacementOf, globalCellOf } from '../ir/alias';
 import { Fn, Op, Value, defOpMap } from '../ir/core';
+import { placedAt } from '../ir/discipline';
 import { nextStructIndex } from '../ir/struct-names';
-import { IrType, StructField, T, scalarTypeForAccess } from '../ir/types';
+import { IrType, StructField, T, UNION_VIEW_NAMES, intWidth, scalarTypeForAccess, unionViewSigns } from '../ir/types';
 import type { StructType } from '../l3/ast';
+import { type Gate, firstRejection } from '../l3/gates';
 import { RaiseUnsupportedError, StructOverlapError } from './errors';
+import { storeSigned } from './storesign';
 
 /** A single observed constant-offset access to a base: the op itself and its program point, its
  *  byte offset, its access width (bytes), and the signedness a recovered field would take from it.
@@ -62,10 +65,11 @@ import { RaiseUnsupportedError, StructOverlapError } from './errors';
  *  like" — and a second copy of the walk would let them come to disagree about the answer while
  *  each looked right on its own.
  *
- *  SIGNEDNESS ON THE STORE HALF IS A POLICY, not a reading: a store carries none, and a word store
- *  makes an `s32` field where a narrower one makes an unsigned one. `buildStruct` then prefers a
- *  LOAD's own signedness at the same offset, which is the reading. raise/truncload.ts never sees
- *  this field — its `covering-store` rule refuses a store cover before the signedness is used. */
+ *  SIGNEDNESS ON THE STORE HALF IS A POLICY, not a reading, unless raise/storesign.ts stamped the
+ *  store from the constant it stores: otherwise a word store makes an `s32` field where a narrower
+ *  one makes an unsigned one. `buildStruct` then prefers a LOAD's own signedness at the same offset,
+ *  which is the reading, over either. raise/truncload.ts never sees this field — its
+ *  `covering-store` rule refuses a store cover before the signedness is used. */
 export interface Access {
   op: Op;
   /** index into `fn.blocks`, for the dominance question raise/truncload.ts asks. */
@@ -78,6 +82,9 @@ export interface Access {
   isLoad: boolean;
 }
 
+/** A store whose signedness raise/storesign.ts read off the constant it stores. */
+const isStamped = (a: Access): boolean => !a.isLoad && a.op.attrs.signed !== undefined;
+
 /** What one walk of a function yields about its constant-offset memory accesses. */
 export interface ConstOffsetAccesses {
   /** every base's constant-offset accesses, in program order. */
@@ -124,7 +131,7 @@ export function constOffsetAccesses(fn: Fn): ConstOffsetAccesses {
             at,
             off: op.attrs.off as number,
             width: op.attrs.width as number,
-            signed: (op.attrs.width as number) === 4,
+            signed: storeSigned(op, op.attrs.width as number),
             isLoad: false,
           });
           break;
@@ -169,25 +176,35 @@ function isArray(accesses: Access[]): boolean {
  *  not settle — a narrow STORE, a read above the low-order end, a cell at a constant address, and a
  *  cover on a path the narrow read does not run — and every one of them throws here.
  *
- *  A THROW IS NOT THE FUNCTION'S VERDICT, AND WHICH THROW IT IS DECIDES THAT. Three throw sites
+ *  A THROW IS NOT THE FUNCTION'S VERDICT, AND WHICH THROW IT IS DECIDES THAT. Four throw sites
  *  below reject a layout and they fall into two CLASSES, which is the split a caller reads:
- *    • `StructOverlapError` — two accesses whose byte ranges collide. TWO of the three sites raise
- *      it, and they carry the same "unions not modelled" text at different offsets: a second access
- *      at an offset already taken with a different width, and one whose range straddles the field
- *      before it (the `aligned > f.off` arm, which is the only one that can see `{s32@0, s16@2}`).
+ *    • `StructOverlapError` — two accesses whose byte ranges collide. THREE of the four sites raise
+ *      it, each message ending "unions not modelled": a second access
+ *      at an offset already taken with a different width, a second LOAD of a narrow cell with the
+ *      other extension (one field would spell one of the two reads wrong), and one whose range
+ *      straddles the field before it (the `aligned > f.off` arm, which is the only one that can see
+ *      `{s32@0, s16@2}`).
  *      Each access alone is spellable at its own offset and width, so a base whose ADDRESS is
  *      declared outside this function's access set can keep its untyped spelling and lift
  *      (`recognizeStructs` below). There is no struct to synthesize, and nothing is lost by not
- *      synthesizing one. Any other base is declared with a union member (`buildUnionStruct`).
+ *      synthesizing one. Any other base is declared with a union member, or a `castViews` field
+ *      where the union would not fit (`buildUnionStruct`).
  *    • `RaiseUnsupportedError` — a field at an offset its own natural alignment could not place it
  *      at. This one has NO per-access spelling downstream: an access at `off` under a wider access's
  *      width folds to the element index `off / width` (structure/structure.ts), which for a
  *      misaligned pair is a FRACTION and not C. It declines whatever the base is. */
-function buildStruct(name: string, accesses: Access[]): IrType {
+function buildStruct(name: string, accesses: Access[], extensionViews = true): IrType {
   // One field per distinct offset; a load's signedness wins over a store's (more information).
   const byOff = new Map<number, Access>();
+  // The extension of every LOAD seen at an offset, kept apart from `byOff`, whose access can be a
+  // store (kept over an unsigned load): the verdict must not hang on the order of the accesses.
+  const loadedSigned = new Map<number, boolean>();
   for (const a of accesses) {
     const prev = byOff.get(a.off);
+    const seen = a.isLoad ? loadedSigned.get(a.off) : undefined;
+    if (a.isLoad && seen === undefined) {
+      loadedSigned.set(a.off, a.signed);
+    }
     if (!prev) {
       byOff.set(a.off, a);
       continue;
@@ -197,9 +214,23 @@ function buildStruct(name: string, accesses: Access[]): IrType {
         `cannot recover struct '${name}': overlapping fields at offset ${a.off} (widths ${prev.width} and ${a.width}) — unions not modelled`,
       );
     }
-    if (a.signed && !prev.signed) {
+    // Two LOADS of one narrow cell with different extensions (`ldrh` and `ldrsh`) are two views of
+    // it, and one field types only one of them: the other read would be spelled through the wrong
+    // extension, a silent wrong (`u16` read as `s16` sign-extends). It is the same overlap class as
+    // two widths at one offset, so it goes the same way: `buildUnionStruct` declares the cell's two
+    // views, a declared address keeps its per-access casts. A word has no extension to disagree on.
+    // `extensionViews` false switches off this overlap class alone (the no-layout gate says why).
+    if (extensionViews && seen !== undefined && a.signed !== seen && a.width < 4) {
+      throw new StructOverlapError(
+        `cannot recover struct '${name}': the ${a.width}-byte cell at offset ${a.off} is loaded both sign- and zero-extended — unions not modelled`,
+      );
+    }
+    // A load reads its signedness, and a stamped store only stands in for one: a load replaces a
+    // stamped store, and otherwise the signed view wins, but never a stamped store's over a load's.
+    const replace = isStamped(prev) && a.isLoad ? true : a.signed && !prev.signed && !(isStamped(a) && prev.isLoad);
+    if (replace) {
       byOff.set(a.off, a);
-    } // prefer the signed (load-derived) view
+    }
   }
   const dataFields: StructField[] = [...byOff.values()]
     .sort((x, y) => x.off - y.off)
@@ -253,10 +284,6 @@ function placeFields(name: string, dataFields: StructField[]): IrType {
   return T.struct(name, fields);
 }
 
-/** The member name of each view a union holds, by access width. A width with no entry has no view
- *  (the deref contract admits no other scalar width either), and its overlap still declines. */
-const VIEW_NAMES: Readonly<Record<number, string>> = { 1: 'byte', 2: 'half', 4: 'word' };
-
 /** The struct for a base whose accesses OVERLAP — `buildStruct` refused it with
  *  `StructOverlapError` — with each overlap declared as a UNION member: the same bytes read or
  *  written at more than one width are views of one cell, and a union is the C that says so.
@@ -281,14 +308,15 @@ const VIEW_NAMES: Readonly<Record<number, string>> = { 1: 'byte', 2: 'half', 4:
  *  one element at the cell's start is a scalar; any other is an array reaching the furthest
  *  element accessed (`u16 half[2]` for the halfword at +2). A cell with ONE view is a plain field;
  *  any other is a member `field_<off>` holding a union of its views — including a single-width cell
- *  loaded both ways. KNOWN GAP: on a base with no overlap anywhere, `buildStruct` never hands over,
- *  and that same cell there is one field typed by its signed load, so its unsigned read is spelled sign-extended.
+ *  loaded both ways, which `buildStruct` hands over as an overlap even on a base with no other one.
  *
  *  THE COMPILER DECIDES THE UNION'S SIZE, not its widest view. `aggregateBoundary` is the size it
  *  aligns and rounds every struct and union to (target.ts `compilerBehaviors.aggregateBoundary`):
  *  agbcc makes `union { u16 h; u8 b; }` four bytes, four-aligned, where the other compilers make
  *  it two. A union that boundary would move — seated off it, or with the next field inside its
- *  rounded size — declines rather than mislaying every access at or after it. An UNMEASURED
+ *  rounded size — is never declared, since it would mislay every access at or after it. Its cell
+ *  is a plain field of its widest view instead, read at its other views through casts, where those
+ *  casts alias it as the union would, and otherwise it declines (`castViewCell`). An UNMEASURED
  *  compiler (undefined) declines every union, since no boundary is safe to assume: one too small
  *  mislays the fields after the union on agbcc, one too large drops the pad in front of them
  *  everywhere else.
@@ -311,17 +339,16 @@ function buildUnionStruct(structName: string, accesses: Access[], aggregateBound
     const start = c[0].off;
     const members = [...new Set(c.map((a) => a.width))].flatMap((width): StructField[] => {
       const group = c.filter((a) => a.width === width);
-      const name = VIEW_NAMES[width];
+      const name = UNION_VIEW_NAMES[width];
       if (name === undefined) {
         throw new RaiseUnsupportedError(
           `cannot recover struct '${structName}': no union view for a ${width}-byte access at offset ${group[0].off}`,
         );
       }
-      // The extensions this width is LOADED with, unsigned first; a word has one type whatever its
-      // loads say, and a width only stored gets the unsigned view.
-      const loaded = new Set(group.filter((a) => a.isLoad).map((a) => a.signed));
-      const signs = width === 4 ? [true] : [false, true].filter((sg) => loaded.has(sg));
-      const views = signs.length === 0 ? [false] : signs;
+      const views = unionViewSigns(
+        width,
+        group.map((a) => ({ isLoad: a.isLoad, signed: a.signed, stamped: isStamped(a) })),
+      );
       const viewOf = (a: Access): boolean => (views.length === 1 ? views[0] : a.isLoad ? a.signed : false);
       return views.map((signed): StructField => {
         const reads = group.filter((a) => viewOf(a) === signed);
@@ -341,18 +368,46 @@ function buildUnionStruct(structName: string, accesses: Access[], aggregateBound
     }
     return { off: start, type: T.union(members, aggregateBoundary), name: `field_${start}` };
   });
-  dataFields.forEach((f, i) => {
+  const fitted = dataFields.map((f, i): StructField => {
     if (f.type.kind !== 'union') {
-      return;
+      return f;
     }
     const next = dataFields[i + 1];
-    if (f.off % f.type.size !== 0 || (next !== undefined && next.off < f.off + f.type.size)) {
+    if (f.off % f.type.size === 0 && (next === undefined || next.off >= f.off + f.type.size)) {
+      return f;
+    }
+    const widest = castViewCell(f.type.members);
+    if (widest === undefined) {
       throw new RaiseUnsupportedError(
         `cannot recover struct '${structName}': the union at offset ${f.off} does not fit this compiler's ${aggregateBoundary}-byte aggregate boundary`,
       );
     }
+    return { off: f.off, type: widest, name: f.name, castViews: true };
   });
-  return placeFields(structName, dataFields);
+  return placeFields(structName, fitted);
+}
+
+/** The type a union's cell is declared at when the union itself cannot be laid out, or undefined
+ *  when its views cannot be spelled as casts of that one field. The field is the widest view, the
+ *  unsigned one where that width has two; every other view must be ALIAS-TRANSPARENT to it, so a cast access aliases the field exactly as a
+ *  union member would: a 1-byte view (a character type, alias set 0 — c-common.c
+ *  `c_get_alias_set`) or the field's own width with the other extension (s16 and u16 share one
+ *  set). Any other view is refused: a `u16` read of a word cell through a cast is reused across a
+ *  word store on agbcc, where the union reloads (`synthetic:ureread`).
+ *
+ *  NO MEASURED COMPILER REACHES THE REFUSAL. Every target but agbcc has a 1-byte boundary, where a
+ *  union of aligned views is never larger than its widest one and always fits. On agbcc a cell
+ *  the size of the boundary is aligned and fits, a misaligned one is `refusePacked`'s, so only a
+ *  cell of 2 bytes or fewer gets here — and its views are bytes or its own width. The refusal is
+ *  the guard for a compiler whose boundary is wider, which the test with a boundary of 8 stands in
+ *  for. */
+function castViewCell(members: readonly StructField[]): IrType | undefined {
+  const width = (m: StructField): number => intWidth(m.type.kind === 'array' ? m.type.elem : m.type) ?? 0;
+  const widest = Math.max(...members.map(width));
+  const cells = members.filter((m) => width(m) === widest && m.type.kind === 'int');
+  const cell = cells.find((m) => m.type.kind === 'int' && !m.type.signed) ?? cells[0];
+  const transparent = members.every((m) => width(m) === 8 || width(m) === widest);
+  return transparent && cell !== undefined ? cell.type : undefined;
 }
 
 /** Size in bytes of a recovered field's type (int width/8; pointer is word-sized 4; a union the
@@ -370,6 +425,305 @@ function fieldSize(t: IrType): number {
   }
 }
 
+export interface DisplacedOptions {
+  /** leave every STORE on its materialised address, folding only the loads (`/far-cast`) */
+  keepStores?: boolean;
+  /** called when a lift without `keepStores` folds a store, which is what offers `/far-cast` */
+  onFoldedStore?: () => void;
+}
+
+/** The target facts the fold reads (target.ts `compilerBehaviors`). */
+export interface DisplacedBehaviors {
+  farMemberStoreOrder?: boolean;
+  farMemberBasePerAccess?: { past: number };
+}
+
+/** One materialised base, as `DISPLACED_BASE_GATES` judges it. */
+export interface DisplacedBase {
+  base: Value;
+  accesses: readonly Access[];
+  disp: { root: Value; k: number; chain: Value[] };
+  defs: Map<Value, Op>;
+  arrayBases: Set<Value>;
+  /** does every use of `v` go to `next` (a link of the chain), or, at the chain's head, to the
+   *  BASE operand of a constant-offset load/store? */
+  onlyFeeds: (v: Value, next: Value | undefined) => boolean;
+  behaviors: DisplacedBehaviors;
+}
+
+/** One root and every access the fold would move onto it, as `DISPLACED_ROOT_GATES` judges it. */
+export interface DisplacedRoot {
+  root: Value;
+  /** the root's own accesses plus the moved ones at their folded offsets */
+  merged: readonly Access[];
+  /** some moved store's value is computed BEFORE its address — the member's order on a target
+   *  with `farMemberStoreOrder`, which no cast or held pointer builds */
+  memberStoreOrder: boolean;
+}
+
+/** The smallest displacement `address-constant` reads as an address rather than a member offset. */
+const ADDRESS_CONSTANT_FLOOR = 1 << 24;
+
+export const DISPLACED_BASE_GATES: readonly Gate<DisplacedBase>[] = [
+  {
+    id: 'not-recovery-root',
+    why: 'the root is typed already, a frame, global or literal address, or a variable-index array',
+    sound: false,
+    rejects: ({ disp: { root: p }, defs, arrayBases }) => {
+      const d = defs.get(p)?.opcode;
+      return (
+        p.type.kind !== 'unknown' ||
+        d === 'laddr' ||
+        d === 'gaddr' ||
+        d === 'const' ||
+        arrayBases.has(p) ||
+        globalCellOf(defs, p, 0) !== null ||
+        constAddressOf(defs, p, 0) !== null
+      );
+    },
+  },
+  {
+    // `*(u16 *)(x + 0x6000000)`, `*(u8 *)(0x6000000 + i * 2)`: a hardware or segment address added
+    // to an index. Read as a member it retypes the integer as a pointer to a struct with a 96 MiB
+    // pad. No struct on these machines comes near 16 MiB (GBA EWRAM is 256 KiB, N64 RDRAM 8 MiB,
+    // GameCube main RAM 24 MiB in all), and every address region a constant names starts past it.
+    id: 'address-constant',
+    why: 'a displacement of 16 MiB or more is an address constant added to an index, not a member offset',
+    sound: false,
+    rejects: ({ disp: { k } }) => Math.abs(k) >= ADDRESS_CONSTANT_FLOOR,
+  },
+  {
+    id: 'claimed-chain',
+    why: 'another struct pass already typed a value of the chain, or an indexed access reaches it',
+    sound: false,
+    rejects: ({ disp: { chain }, arrayBases }) => chain.some((v) => v.type.kind !== 'unknown' || arrayBases.has(v)),
+  },
+  {
+    id: 'held-address',
+    why: 'the address is used as a value too, so the source held it',
+    sound: false,
+    rejects: ({ disp: { chain }, onlyFeeds }) =>
+      !chain.every((v, i) => onlyFeeds(v, i === 0 ? undefined : chain[i - 1])),
+  },
+  {
+    id: 'placed-access',
+    why: 'a volatile or device-pinned access keeps the address it was written through',
+    sound: false,
+    rejects: ({ accesses }) => accesses.some((a) => placedAt(a.op) !== null),
+  },
+  {
+    id: 'negative-offset',
+    why: 'a folded offset below the root is no member',
+    sound: false,
+    rejects: ({ accesses, disp: { k } }) => accesses.some((a) => a.off + k < 0),
+  },
+  {
+    id: 'held-pointer-offsets',
+    why: 'one materialised base at two offsets is a held pointer where every member access gets its own',
+    sound: false,
+    rejects: ({ accesses, disp: { k }, behaviors: { farMemberBasePerAccess: perAccess } }) =>
+      perAccess !== undefined && Math.abs(k) > perAccess.past && new Set(accesses.map((a) => a.off)).size > 1,
+  },
+];
+
+export const DISPLACED_ROOT_GATES: readonly Gate<DisplacedRoot>[] = [
+  {
+    id: 'array-shaped',
+    why: 'uniform-stride or single accesses are no struct evidence, unless a store shows the member order',
+    sound: false,
+    rejects: ({ merged, memberStoreOrder }) => isArray([...merged]) && !memberStoreOrder,
+  },
+  {
+    id: 'no-layout',
+    why: 'the accesses overlap or misalign, so no plain struct lays them out',
+    sound: false,
+    // A cell loaded with both extensions lays out: `recognizeStructs` gives it a view per extension
+    // once the fold has put its reads on one base, and leaving the root unfolded would type the
+    // cell by its unfolded `ldrh` alone (agbcc's `ldrsh` has no immediate form, so every signed
+    // halfword read is a displaced one). Not for an array-shaped set, which the fold types itself,
+    // as one plain struct.
+    // KNOWN GAP (correct C): a WIDTH overlap still rejects the root, though `recognizeStructs`
+    // would lay it out too. `ldrb [r0]` beside agbcc's `mov r3, #0; ldrsh [r0, r3]` keeps the
+    // halfword on its address, `*(s16 *)((u8 *)a0 + 0)`: the right bytes, the right extension.
+    rejects: ({ merged }) => {
+      try {
+        buildStruct('Struct', [...merged], isArray([...merged]));
+        return false;
+      } catch {
+        return true;
+      }
+    },
+  },
+];
+
+/** FOLD A MATERIALISED DISPLACEMENT INTO THE ACCESS: a load/store whose base is `add(p, K)` (or a
+ *  chain of constant adds/subs off `p`) becomes an access of `p` at `off + K`, so `recognizeStructs`
+ *  sees it in `p`'s access set and spells it as the member it is.
+ *
+ *  WHY. Every ISA has a displacement range, and a member past it is reached through an address the
+ *  machine materialises first: Thumb's `adds rX, #38; strb [rX]` (a byte past 31, a half past 62,
+ *  a word past 124), ido's `addiu at, a0, 32767; sb a1, 7232(at)`, KMC's and GCC 2.7.2's
+ *  `lui at, 1; addu at, at, a0; sb a1, -25537(at)`, mwcc's `addis r5, r3, 1; stb r4, -25537(r5)`.
+ *  Unfolded, such an access is keyed on the materialised address, never joins its struct, and is
+ *  spelled as a cast `*((u8 *)p + 38)`. On agbcc that spelling is a different program: for a
+ *  COMPONENT_REF target expand_assignment (gcc/expr.c :2535) expands only the base and store_field
+ *  (:2624) evaluates the right-hand side first, while a cast (INDIRECT_REF) target is expanded whole
+ *  (:2689) before the right-hand side (:2747). A member store of a loaded value therefore loads it
+ *  before the `adds #K`, and the cast store after (`sa3:sub_800F0E8`'s offset-38 byte store), and
+ *  with a constant or a parameter on the right the two still allocate registers differently. The
+ *  cast is a source spelling too: a hoisted `u8 *d = &p->f38; *d = v;` builds the cast's object. So
+ *  the fold is the default and `opts.keepStores` (the `/far-cast` lift) keeps every such store on
+ *  its address for the differ to referee.
+ *  A LOAD through a cast and through a member compile alike, and fold in both lifts — but a load
+ *  through a HELD pointer does not: agbcc materialises one `add` per member access, even for
+ *  adjacent members (`p->f38 + p->f39` is `add #0x26` and `add #0x27`), so one materialised base
+ *  read or written at two distinct offsets (`add r1, #0x26; ldrb [r1]; ldrb [r1, #1]`) is the
+ *  pointer the source held, and the member spelling cannot rebuild it (`held-pointer-offsets`).
+ *  ido does the same past its `addiu` reach, where the assembler gives each member access its own
+ *  `lui`/`addu` (target.ts `farMemberBasePerAccess` states the reach per compiler). On ido, KMC,
+ *  GCC 2.7.2 and mwcc one access through a member and through a cast compile alike, a store of a
+ *  loaded value included, and there the fold buys the type; what it can cost is the neighbours'
+ *  spelling — a folded store no longer aliases the loads beside it, and a held mwcc pointer is
+ *  respelled as members — which is why `/far-cast` is offered there too.
+ *
+ *  THE REFUSALS ARE TWO GATE TABLES, so `pnpm bench gates --pass displaced` can count which one
+ *  keeps a row on the cast spelling: `DISPLACED_BASE_GATES`, asked once per materialised base, and
+ *  `DISPLACED_ROOT_GATES`, asked once per root over the bases that passed. A base the first
+ *  refuses keeps its own accesses on its materialised address while the root's other bases are
+ *  still asked; a root the second refuses keeps every access off it on its address.
+ *  Every gate is a spelling choice, not a soundness rule: the fold rewrites address arithmetic
+ *  into the same address, so no candidate it admits reads different memory, and the differ
+ *  referees. NOT TABLED: `/far-cast`'s `keepStores` skip, which is the variation itself
+ *  rather than a refusal. Runs right before `recognizeStructs`, after raise/truncload.ts, which
+ *  therefore never sees a folded access. Returns the number of accesses folded. */
+export function foldDisplacedAccesses(
+  fn: Fn,
+  opts: DisplacedOptions = {},
+  behaviors: DisplacedBehaviors = {},
+  voidReturn = false,
+  baseGates: readonly Gate<DisplacedBase>[] = DISPLACED_BASE_GATES,
+  rootGates: readonly Gate<DisplacedRoot>[] = DISPLACED_ROOT_GATES,
+): number {
+  const defs = defOpMap(fn);
+  const { accessesOf, arrayBases } = constOffsetAccesses(fn);
+  // Every use of each value: the op and operand index, or null for an edge argument.
+  const uses = new Map<Value, { op: Op | null; at: number }[]>();
+  const use = (v: Value, op: Op | null, at: number) => {
+    let l = uses.get(v);
+    if (!l) {
+      l = [];
+      uses.set(v, l);
+    }
+    l.push({ op, at });
+  };
+  // Where each op stands, for the store-order reading.
+  const position = new Map<Op, { block: number; at: number }>();
+  fn.blocks.forEach((b, block) => {
+    (b.ops as Op[]).forEach((op, at) => {
+      position.set(op, { block, at });
+      op.operands.forEach((v, i) => use(v, op, i));
+      for (const s of op.successors) {
+        for (const v of s.args) {
+          use(v, null, -1);
+        }
+      }
+    });
+  });
+  // A `ret` of a function declared void reads no value: the address merely sits in the return
+  // register when the function ends (`add r0, #0x27; strb r1, [r0]; bx lr`).
+  const onlyFeeds = (v: Value, next: Value | undefined): boolean =>
+    (uses.get(v) ?? []).every(({ op, at }) =>
+      op === null
+        ? false
+        : voidReturn && op.opcode === 'ret'
+          ? true
+          : next === undefined
+            ? (op.opcode === 'load' || op.opcode === 'store') && at === 0
+            : op.results[0] === next && op.opcode !== 'load' && op.opcode !== 'store',
+    );
+  // THE MEMBER'S ORDER (target.ts `farMemberStoreOrder`): the stored value is computed by a
+  // non-constant op in the same block before the chain's first link, AS THIS STORE'S RIGHT-HAND
+  // SIDE: this store is its only reader, and no memory access or call stands between it and the
+  // chain. A constant or a parameter on the right leaves no order to read, so it is no evidence
+  // either way; neither is a value an earlier statement computed (`u8 v = *q; *r = 0; p[38] = v;`),
+  // which the member and the cast spellings both load before the address, byte for byte. Nor is a
+  // value that IS a call: agbcc expands every call of a right-hand side before either target
+  // (MODIFY_EXPR's preexpand_calls, gcc/expr.c:6777), so `p->f60 = k()` and `p[60] = k()` are one
+  // object. What the right-hand side computes from a call's result still orders (`p->f60 = k() + 1`
+  // adds before the address, `p[60] = k() + 1` after it).
+  const effect = (op: Op): boolean =>
+    op.opcode === 'store' ||
+    op.opcode === 'astore' ||
+    op.opcode === 'load' ||
+    op.opcode === 'aload' ||
+    op.opcode === 'call' ||
+    op.opcode === 'opaque';
+  const memberOrdered = (a: Access, chain: Value[]): boolean => {
+    const value = a.op.operands[1];
+    const vdef = defs.get(value);
+    const first = defs.get(chain[chain.length - 1]);
+    const v = vdef && vdef.opcode !== 'const' && vdef.opcode !== 'call' ? position.get(vdef) : undefined;
+    const f = first ? position.get(first) : undefined;
+    return (
+      v !== undefined &&
+      f !== undefined &&
+      v.block === f.block &&
+      v.at < f.at &&
+      (uses.get(value) ?? []).length === 1 &&
+      !(fn.blocks[v.block].ops as Op[]).slice(v.at + 1, f.at).some(effect)
+    );
+  };
+  const byRoot = new Map<Value, { access: Access; k: number; memberOrder: boolean }[]>();
+  for (const [base, accesses] of accessesOf) {
+    const disp = constDisplacementOf(defs, base);
+    if (!disp) {
+      continue;
+    }
+    // `/far-cast`: a store kept on its address keeps the chain's value used by something other
+    // than a folded access, so no load sharing that address folds either.
+    if (opts.keepStores === true && accesses.some((a) => a.op.opcode === 'store')) {
+      continue;
+    }
+    // A refused base stays on its address and its root's other bases are still asked: a held
+    // `u16 *d = &p->f68` beside a member store `p->f38 = *q` keeps `d` and folds the store.
+    if (firstRejection(baseGates, { base, accesses, disp, defs, arrayBases, onlyFeeds, behaviors }) !== null) {
+      continue;
+    }
+    const list = byRoot.get(disp.root) ?? [];
+    byRoot.set(disp.root, list);
+    for (const access of accesses) {
+      const memberOrder =
+        behaviors.farMemberStoreOrder === true && access.op.opcode === 'store' && memberOrdered(access, disp.chain);
+      list.push({ access, k: disp.k, memberOrder });
+    }
+  }
+  let folded = 0;
+  for (const [root, moved] of byRoot) {
+    const merged = [
+      ...(accessesOf.get(root) ?? []),
+      ...moved.map(({ access, k }) => ({ ...access, off: access.off + k })),
+    ];
+    const memberStoreOrder = moved.some((m) => m.memberOrder);
+    if (firstRejection(rootGates, { root, merged, memberStoreOrder }) !== null) {
+      continue;
+    }
+    for (const { access, k } of moved) {
+      access.op.operands[0] = root;
+      access.op.attrs.off = access.off + k;
+      folded++;
+      if (access.op.opcode === 'store') {
+        opts.onFoldedStore?.();
+      }
+    }
+    // An array-shaped set the member's store order admitted: `recognizeStructs` would read it as
+    // an array, so the struct its evidence names is synthesized here.
+    if (isArray(merged)) {
+      root.type = T.ptr(buildStruct(`Struct${firstFreeStructIndex(fn)}`, merged));
+    }
+  }
+  return folded;
+}
+
 /** Recover struct-pointer types from access-pattern evidence. Runs after array legalization and
  *  before type recovery, so `recoverTypes` sees the base already typed and does not flatten it to a
  *  plain pointer. Returns the number of bases recovered as structs. `aggregateBoundary` is the
@@ -399,6 +753,15 @@ export function recognizeStructs(fn: Fn, aggregateBoundary: number | undefined):
     if (base.type.kind !== 'unknown') {
       continue;
     } // already typed (not a bare recovery target)
+    // A FRAME OBJECT'S ADDRESS is never a recovery target: its declaration is the frame audit's
+    // stamp (structure.ts `laddrType` — a scalar, a `u8` array, a struct-return temp, or the union
+    // of the views its accesses use), and every access to it is spelled from that stamp, never
+    // through a type recovered here. Recovered anyway, the one-object area's accesses at several
+    // offsets and widths make a second, per-word union of the same bytes that nothing references
+    // and every candidate prints.
+    if (defs.get(base)?.opcode === 'laddr') {
+      continue;
+    }
 
     const accesses = accessesOf.get(base)!;
     if (isArray(accesses)) {

package/src/raise/truncload.ts

@@ -161,9 +161,10 @@ export const TRUNC_LOAD_GATES: readonly Gate<TruncatedLoad>[] = [
     // spellings a source has for one land here: the bare cast of a number (`*(vu16 *)0x4000004`)
     // through `constAddressOf`, and the named register (`REG_DISPSTAT`) through `globalCellOf`,
     // whose `volatile` is a declaration in the project's headers that no raise pass can read.
-    // The two helpers are ir/alias.ts's, and `constAddressOf` is the address structure.ts's
-    // `volatileQualifiable` asks about — so a load this rule and `qualified-access` admit is one that
-    // predicate answers no to, by construction rather than by measurement.
+    // The two helpers are ir/alias.ts's. A dead read this rule and `qualified-access` admit is one
+    // nobody spells: a read the raw lift never used is stamped by the dead-read pin
+    // (frontend/dead-reads.ts) before this pass runs, `qualified-access` refuses it, and
+    // structure.ts `volatileQualifiable` spells only a qualified read.
     //
     // NOT `capabilities.deviceRegisters`. That window is documented as a question about SPELLING
     // and may be approximate (target.ts), so a soundness rule may not rest on it; asking whether