@asmlift/core 0.9.0 → 0.10.0

package/src/rank.ts

@@ -21,6 +21,8 @@
 import { cBackend } from './backend/c';
 import {
   assertDerefsTyped,
+  assertFrameUnionsViewed,
+  assertLocalStorageStaysInteger,
   assertLocalsWritten,
   assertNoOrphanedLocals,
   assertPlacementSurvives,
@@ -53,14 +55,16 @@ import { reindexWalks } from './l3/reindex';
 import { hoistScopedBases } from './l3/scopebase';
 import { sinkInitsToFirstUse } from './l3/sinkinit';
 import type { SymbolRef } from './l3/symbol-refs';
+import { signedOverUnsignedCompare } from './l3/typing';
 import { type UnreduceResult, unreduceAccumulators } from './l3/unreduce';
 import { deviceVolatileClaims, volatilePtrLocals, volatileSubsetCandidates } from './l3/volatileptr';
 import { volatileValueLocals } from './l3/volatileval';
 import { volatileDeviceStores } from './l3/volstore';
 import { zeroSubNegates } from './l3/zerosub';
 import { RewritePattern } from './pattern/engine';
-import { applyIdiomPatterns, liftStamped, raiseRecovered, structureChecked } from './pipeline';
-import { type Prototypes, declaresVoidReturn, prototypesFromSymbols } from './proto';
+import { applyIdiomPatterns, liftStamped, raiseRecovered, stampBehaviorsFor, structureChecked } from './pipeline';
+import { type FnProto, type Prototypes, declaresVoidReturn, prototypesFromSymbols } from './proto';
+import { type ContextGlobals, splitOwnContext } from './proto-context';
 import { inferGlobalArrays, orderLicensedGlobals, sameDerivedShape } from './raise/globalshape';
 import { OFFSET_NAME_PASS } from './raise/offsetnames';
 import { runPreRecovery } from './raise/pre-recovery';
@@ -70,6 +74,7 @@ import {
   type RefusedDeclarationReason,
   bareGlobalAccessFacts,
   bareGlobalSymbols,
+  initAddressSymbols,
   makeRefCollector,
 } from './rank-declare';
 import {
@@ -82,14 +87,16 @@ import {
   SIGNEDNESS,
   STACKED_SUBSETS,
   STRUCTURE_VARIATIONS,
+  StackedMemberThrew,
   type StructureVariation,
   UNFOLDED_HOISTS,
   applyStacked,
   createdLocals,
+  firstFired,
   sameBases,
 } from './rank-variations';
 import { type Stillborn, stillbornVerdict } from './stillborn';
-import { hasDivergentSharedRet } from './structure/structure';
+import { DefaultAcceptsMemo, DefaultAcceptsMemoMisuse, hasDivergentSharedRet } from './structure/structure';
 import {
   type SymbolInfo,
   type SymbolMap,
@@ -159,6 +166,10 @@ export interface EnumerateOptions {
   asmData?: AsmData;
   /** address→symbol map (symbols.ts) — same contract as DecompileOptions.symbols */
   symbols?: SymbolMap;
+  /** same contract as DecompileOptions.contextGlobals */
+  contextGlobals?: ContextGlobals;
+  /** same contract as DecompileOptions.ownContextProto */
+  ownContextProto?: FnProto;
   /** Called when a respell variation THROWS or fails a boundary contract, so the failure is visible
    *  instead of the candidate silently not existing. Enumeration continues either way — the default
    *  candidate is unaffected — but a variation that never fires because it always throws is a defect,
@@ -255,16 +266,41 @@ export interface Candidate {
    *   • `l3/intcell.ts` spells a global as the integer a project may have declared it, where a
    *     pointer declaration scales the offset it adds, and no declaration is in the asm.
    *
-   *  What settles both instead is the object: a candidate that assembles to the target's own bytes
-   *  IS the program, whatever a gate could have proved. So the spelling is offered, scored, and then
+   *  A third obligation is judged on the finished tree rather than declared by a variation
+   *  (`signedUnsignedCompare` below):
+   *
+   *   • `/signed-cmp`, or a respell over its tree, spells an unsigned compare over signed-rendering
+   *     operands, which compiles to a signed compare unless the operands are non-negative, and the
+   *     compiler's proof of that is not in the asm.
+   *
+   *  What settles all three instead is the object: a candidate that assembles to the target's own
+   *  bytes IS the program, whatever a gate could have proved. So the spelling is offered, scored, and then
    *  either wins on proof or is WITHHELD — never shown as a best-effort answer. Both ranking drivers
    *  ask `withheldReason`, so neither can publish what the other would not. */
   matchOnly?: true;
+  /** The tree this source was emitted from spells some unsigned compare so that C evaluates it
+   *  signed (l3/typing.ts `signedOverUnsignedCompare`, judged on the finished tree), which makes it
+   *  `matchOnly` and names the fact it owes. Set for whichever variation got it there: emission
+   *  under `/signed-cmp`, or a respell that substituted into a compare emission had pinned. It is
+   *  the only place this obligation is decided: a pass that rebuilds a compare spreads the node to
+   *  keep its `unsignedCmp` evidence (l3/regspell.ts), a merge that keeps one of two equal nodes
+   *  keeps the evidence of both (l3/ast.ts `unionEvidence`), or drops it only where its own gate proved
+   *  the new spelling compares the same values (l3/initfirst.ts `swapSide`, l3/reindex.ts). */
+  signedUnsignedCompare?: true;
   /** This candidate's lift is `/setup-args` and drops an earlier callee's result that a call through
    *  a register is passed (frontend/ssa.ts `setupArgsDiscardsPassedResult`). It loses every score
    *  tie (compareScored): a tie refutes neither reading, and a shorter spelling must not win by
    *  dropping a value the callee may read. */
   discardsPassedResult?: true;
+  /** This candidate's lift is `/narrow-param` and declares a parameter narrow that no prototype
+   *  declares (raise/pre-recovery.ts `onUndeclaredWidth`). It loses every score tie
+   *  (compareScored): a tie refutes neither declaration, and the narrow one changes the bytes of
+   *  every prototyped caller, which this function's score cannot see. */
+  guessesParamWidth?: true;
+  /** This candidate's lift is `/far-cast` and spells a far member store through a cast of its
+   *  base. It loses every score tie (compareScored): a tie means the compiler built the member's
+   *  object too, and the member is the spelling that names the field. */
+  farStoreCast?: true;
 }
 /** A candidate paired with its score `S` (the injected scorer's result shape — must carry `.score`). */
 export interface Scored<S> extends Candidate {
@@ -356,7 +392,7 @@ export interface RankedResult<S> {
   candidates: Scored<S>[]; // sorted best (lowest) first
   /** candidates whose scoreFn threw — empty when every spelling built */
   dropped: DroppedCandidate[];
-  /** candidates withheld for want of a byte-exact proof — empty unless a `matchOnly` variation fired */
+  /** candidates withheld for want of a byte-exact proof — empty unless a `matchOnly` candidate scored a nonmatch */
   withheld: WithheldCandidate[];
 }
 
@@ -371,6 +407,9 @@ export function withheldReason<S extends { score: number }>(c: Candidate, score:
     return null;
   }
   const facts = c.variations.flatMap((v) => PROOF_OBLIGATIONS.get(v) ?? []);
+  if (c.signedUnsignedCompare === true) {
+    facts.push(SIGNED_COMPARE_OBLIGATION);
+  }
   const fact = facts.length > 0 ? facts.join(' and on ') : 'a fact no gate over the C can settle';
   return `this spelling rests on ${fact}; only a byte-exact score proves it`;
 }
@@ -381,6 +420,11 @@ const PROOF_OBLIGATIONS: ReadonlyMap<string, string> = new Map<VariationName, st
   ['int-cell', 'the project declaring the global an integer, which the assembly does not show'],
 ]);
 
+/** The fact `Candidate.signedUnsignedCompare` rests on. Keyed by the flag, not by `/signed-cmp`:
+ *  that name is on candidates that owe nothing (a compare over a `u32` operand) and missing from
+ *  respells that do. */
+const SIGNED_COMPARE_OBLIGATION = "the compiler having proved every unsigned compare's operands non-negative";
+
 /** What a respell variation hands `respell`: its tree, or — when the variation cannot establish the
  *  candidate's semantics from inside the pass — the tree paired with that fact. `undefined`/`null`
  *  is a decline. */
@@ -444,6 +488,8 @@ interface TreeSource {
   deviceVolatile?: number;
   /** see `Candidate.matchOnly` — set by a variation that cannot establish its own semantics */
   matchOnly?: true;
+  /** see `Candidate.signedUnsignedCompare` */
+  signedUnsignedCompare?: true;
 }
 
 /** Emit the DISTINCT type/branch-sense candidates for `name` — PURE, no scoring.
@@ -471,14 +517,17 @@ export function enumerateCandidates(
   let lastEmitError: unknown = null;
   // Same merge as `decompile`: the project's DWARF signatures fill in what the caller did not
   // state, so both the annotate pass and the ranked candidates reason about one prototype table.
-  const prototypes = prototypesFromSymbols(opts.symbols, opts.prototypes ?? {});
+  const ownContext = splitOwnContext(opts.prototypes, name, opts.ownContextProto);
+  const prototypes = prototypesFromSymbols(opts.symbols, ownContext.prototypes ?? {});
   const baseOpts = {
     ...structureOptionsFor(target, declaresVoidReturn(prototypes[name]), prototypes),
     // See the same line in pipeline.ts: a backend that cannot print switch fall-through must not
     // be handed a tree carrying one, because its refusal costs the whole candidate (and, when
     // every candidate carries it, the whole row).
     spellSwitchFallthrough: backend.spellsSwitchFallthrough,
+    spellSwitchBreak: backend.spellsSwitchBreak,
     ...(opts.symbols ? { symbols: symbolsByName(opts.symbols) } : {}),
+    ...(opts.contextGlobals ? { contextGlobals: opts.contextGlobals } : {}),
   };
   // Branch-sense is a differ-ranked VARIATION, the same class as param signedness: a divergent `if`
   // can be spelled with either sense (`if (c) A else B` vs `if (!c) B else A`), and which one the
@@ -600,11 +649,23 @@ export function enumerateCandidates(
   // it buys is that a lift-time change which splits them enumerates both settings rather than
   // silently dropping one, the failure nothing reports.
   let sharedLiftTreeOwned = false;
+  let sharedLiftExtendedReaders = false;
+  let sharedLiftFoldedStore = false;
   // Shared lift: recover ONCE with no signedness pin, to learn which entry params are
   // pointers/aggregates so they are excluded from the signedness variation (see NO_PIN_KINDS). One
   // extra lift+recover, no compile. (The shared lift deliberately stops after recoverTypes — it only reads the param KINDS, so
   // the totality contract / return-sinking of the full spine are not run on it.)
-  const sharedLift = liftStamped(name, asm, target, prototypes, opts.asmData, opts.symbols);
+  const sharedLift = liftStamped(
+    name,
+    asm,
+    target,
+    prototypes,
+    opts.asmData,
+    opts.symbols,
+    opts.contextGlobals,
+    undefined,
+    ownContext.ownContextProto,
+  );
   // The ARRAY SHAPES the input assembly evidences (raise/globalshape.ts), for the DECLARATION
   // half. Read off the shared lift's LIFTED form — before the fold below and the tower rewrite it —
   // because the base-materialization order the derivation's licence reads does not survive them.
@@ -619,6 +680,16 @@ export function enumerateCandidates(
         sharedLiftTreeOwned = true;
       },
     },
+    paramWidth: {
+      onExtendedReaders: () => {
+        sharedLiftExtendedReaders = true;
+      },
+    },
+    displaced: {
+      onFoldedStore: () => {
+        sharedLiftFoldedStore = true;
+      },
+    },
   });
   recoverTypes(sharedLift);
   const ptrIdx = new Set<number>(
@@ -643,17 +714,47 @@ export function enumerateCandidates(
   // shared lift's `onTreeOwned` hook has had its chance to fire. Called any earlier it would report a confident
   // `false` for a function that owns a tree. As a `const` below that call, an early call is a TDZ
   // ReferenceError instead — a wrong answer traded for a loud one.
-  const treeOwnedIn = (symbols: typeof opts.symbols): boolean => {
+  //
+  // `/narrow-param`'s gate is read off the same lift the same way: the width pass reports a
+  // parameter the variation's lift would narrow (raise/pre-recovery.ts `ParamWidthOptions`). So is
+  // `/far-cast`'s: the displaced-access fold reports a store it moved into a struct.
+  const liftReportsIn = (
+    symbols: typeof opts.symbols,
+  ): { treeOwned: boolean; extendedReaders: boolean; foldedStore: boolean } => {
     if (symbols === opts.symbols) {
-      return sharedLiftTreeOwned;
+      return {
+        treeOwned: sharedLiftTreeOwned,
+        extendedReaders: sharedLiftExtendedReaders,
+        foldedStore: sharedLiftFoldedStore,
+      };
     }
-    const p = liftStamped(name, asm, target, prototypes, opts.asmData, symbols);
+    const p = liftStamped(
+      name,
+      asm,
+      target,
+      prototypes,
+      opts.asmData,
+      symbols,
+      opts.contextGlobals,
+      undefined,
+      ownContext.ownContextProto,
+    );
     applyIdiomPatterns(p, target, opts.patterns);
-    let seen = false;
+    const seen = { treeOwned: false, extendedReaders: false, foldedStore: false };
     runPreRecovery(p, target, () => verify(p), prototypes[name], {
       shortCircuit: {
         onTreeOwned: () => {
-          seen = true;
+          seen.treeOwned = true;
+        },
+      },
+      paramWidth: {
+        onExtendedReaders: () => {
+          seen.extendedReaders = true;
+        },
+      },
+      displaced: {
+        onFoldedStore: () => {
+          seen.foldedStore = true;
         },
       },
     });
@@ -916,7 +1017,11 @@ export function enumerateCandidates(
   // spelling needs one, and the declaration a candidate spelling `gTbl[i]` cannot compile
   // without), and the project map, which knows more than either.
   const mapSymbols = baseOpts.symbols;
-  const targetSymbols = new Map<string, SymbolInfo>([...bareGlobalSymbols(sharedLift), ...sharedLiftShapes]);
+  const targetSymbols = new Map<string, SymbolInfo>([
+    ...initAddressSymbols(sharedLift),
+    ...bareGlobalSymbols(sharedLift),
+    ...sharedLiftShapes,
+  ]);
   const declSymbols = new Map<string, SymbolInfo>([...targetSymbols, ...(mapSymbols ?? [])]);
   // The four per-enumeration constants named at the seam rather than captured across 60 lines of
   // closure (rank-declare.ts states why they belong on one object).
@@ -930,6 +1035,7 @@ export function enumerateCandidates(
     prototypes,
     target,
     refuse,
+    own: Object.hasOwn(prototypes, name) ? prototypes[name] : ownContext.ownContextProto,
   });
   // THE RESPELL SET, as a function whose PARAMETER LIST is the invariant the tree skip below
   // rests on: every source here is a pure function of the structured tree and this call's own
@@ -953,6 +1059,14 @@ export function enumerateCandidates(
   // of `/volatile` — a candidate that did not fail and is still in the fan. The order
   // is the candidates' own (`[pf.name, ...sp.variations]`), so a reported name and an enumerated
   // candidate's variations name the same candidate the same way.
+  //
+  // THE COMPARE-SIGNEDNESS PROOF, asked of every tree a source is emitted from rather than of the
+  // passes that build them. Emission pins each unsigned compare it lowers (structure.ts), but a
+  // respell that substitutes into a compare — `/unmerge` putting an arm's `s16` global where the
+  // pinned `u32` local stood, against an `s32` parameter — re-renders it signed. So the finished
+  // tree is judged here, and a signed rendering of an `icmp_u*` is `matchOnly` whoever produced it.
+  const cmpProof = (tree: SFn): { matchOnly?: true; signedUnsignedCompare?: true } =>
+    signedOverUnsignedCompare(tree) ? { matchOnly: true, signedUnsignedCompare: true } : {};
   const respellTree = (sfn: SFn, preRespellVariations: readonly Variation[] = []): TreeSources => {
     // The walk→index respell variation (l3/reindex.ts) is a THIRD variation on the same footing as
     // signedness and branch sense: whether the source spelled `*p; p++` or `arr[i]` is
@@ -970,7 +1084,7 @@ export function enumerateCandidates(
     // Pascal backend loud-declines). Refusing EVERY tree is still loud — the empty-enumeration
     // check at the end raises the last refusal.
     try {
-      sources.push({ variations: [], source: backend.emit(sfn), ...refsOf(sfn), ...volOf(sfn) });
+      sources.push({ variations: [], source: backend.emit(sfn), ...refsOf(sfn), ...volOf(sfn), ...cmpProof(sfn) });
     } catch (e) {
       reportThrow(preRespellVariations, e);
       return { sources, emit: { error: e } };
@@ -1068,7 +1182,16 @@ export function enumerateCandidates(
         assertLocalsWritten(alt);
         assertPostIncrUnshared(alt);
         assertNoOrphanedLocals(sfn, alt);
-        sources.push({ variations, source: backend.emit(alt), ...refsOf(alt), ...volOf(alt), ...proof });
+        assertLocalStorageStaysInteger(sfn, alt);
+        assertFrameUnionsViewed(alt);
+        sources.push({
+          variations,
+          source: backend.emit(alt),
+          ...refsOf(alt),
+          ...volOf(alt),
+          ...proof,
+          ...cmpProof(alt),
+        });
         // STACKED variations, derived onto EVERY source (the POLICY note above carries the
         // admission argument). Each is a statement-order/shape or declaration-width fact
         // orthogonal to the respell variations outside the table; subsets compose in the fixed
@@ -1095,19 +1218,24 @@ export function enumerateCandidates(
           // which moves only const or pure-read assigns and so cannot lift a read of a base local
           // above its init.
           const minted = createdLocals(sfn, alt);
+          const firedSets = new Set<string>();
           for (const subset of STACKED_SUBSETS) {
             // ONE TRY PER SHAPE — a shape is its own candidate and fails as its own candidate.
             // Sharing the respell variation's outer try would let a throw deriving one subset
             // discard every later one, under that variation's name, which names no shape.
-            const shapeVariations = subset.map((x) => x.name);
+            // A throw past applyStacked is reported under the fired set, the candidate's own name.
+            let shapeVariations: readonly Variation[] = [];
             try {
               const shaped = applyStacked(subset, alt);
-              if (shaped !== null) {
+              if (shaped !== null && firstFired(firedSets, shaped.variations)) {
+                shapeVariations = shaped.variations;
                 assertResolved(shaped.out);
                 assertDerefsTyped(shaped.out);
                 assertLocalsWritten(shaped.out);
                 assertPostIncrUnshared(shaped.out);
                 assertNoOrphanedLocals(alt, shaped.out);
+                assertLocalStorageStaysInteger(alt, shaped.out);
+                assertFrameUnionsViewed(shaped.out);
                 assertPlacementSurvives(alt, shaped.out, minted);
                 sources.push({
                   variations: [...variations, ...shaped.variations],
@@ -1116,10 +1244,12 @@ export function enumerateCandidates(
                   ...volOf(shaped.out),
                   // a shape derived from a proof-gated spelling inherits the requirement
                   ...proof,
+                  ...cmpProof(shaped.out),
                 });
               }
             } catch (e) {
-              reportThrow([...preRespellVariations, ...variations, ...shapeVariations], e);
+              const step = e instanceof StackedMemberThrew ? e.variations : shapeVariations;
+              reportThrow([...preRespellVariations, ...variations, ...step], e);
             }
           }
         }
@@ -1135,19 +1265,21 @@ export function enumerateCandidates(
     // `/argbase` — name a call's argument bases before the call (l3/argbase.ts). A variation on the
     // same footing as the others: the default inline spelling stays in the list, so the differ
     // referees and this can never cost a match.
+    const firedSets = new Set<string>();
     for (const subset of STACKED_SUBSETS) {
       // the truthful variations need the pass to RUN first, so this bypasses respell's
       // variations-then-thunk shape: same try posture, variations from the fired members
       try {
         const shaped = applyStacked(subset, sfn);
-        if (shaped !== null) {
+        if (shaped !== null && firstFired(firedSets, shaped.variations)) {
           // the ONE call whose variations already name shapes — say so, rather than making `respell`
           // read them back out of the variations it was handed
           respell(shaped.variations, () => shaped.out, true);
         }
       } catch (e) {
-        // the report names the full subset — the fired set is unknown mid-throw
-        reportThrow([...preRespellVariations, ...subset.map((x) => x.name)], e);
+        // `respell` reports its own throws, so only a member can throw here
+        const step = e instanceof StackedMemberThrew ? e.variations : subset.map((x) => x.name);
+        reportThrow([...preRespellVariations, ...step], e);
       }
     }
     respell(['argbase'], () => materializeArgBases(sfn));
@@ -1828,8 +1960,10 @@ export function enumerateCandidates(
     // audit cannot bound. This is the setting's first lift, and every later one is the same lift
     // again.
     let treeOwnedFold: boolean;
+    let extendedReaders: boolean;
+    let foldedStore: boolean;
     try {
-      treeOwnedFold = treeOwnedIn(symbolSetting.symbols);
+      ({ treeOwned: treeOwnedFold, extendedReaders, foldedStore } = liftReportsIn(symbolSetting.symbols));
     } catch (e) {
       if (abortsRow(symbolSetting.variations)) {
         throw e;
@@ -1852,7 +1986,22 @@ export function enumerateCandidates(
       if (cand.signed && !pinnable) {
         break;
       }
-      const base = liftStamped(name, asm, target, prototypes, opts.asmData, symbolSetting.symbols);
+      let tailSlot = false;
+      const base = liftStamped(
+        name,
+        asm,
+        target,
+        prototypes,
+        opts.asmData,
+        symbolSetting.symbols,
+        opts.contextGlobals,
+        {
+          onTailSlot: () => {
+            tailSlot = true;
+          },
+        },
+        ownContext.ownContextProto,
+      );
       // `/setup-args` — pass a prototype-less callee only what the CALLING BLOCK set up; which of
       // the two readings the source spelled is genuinely ambiguous, and frontend/ssa.ts
       // narrowToSetupArgs carries the argument for why the differ is what settles it.
@@ -1918,12 +2067,66 @@ export function enumerateCandidates(
             { variations: ['setup-args'], narrow: true },
           ]
         : [{ variations: [], narrow: false }];
+      // `/narrow-param` — declare a parameter every reader of which is an extension at the widest
+      // reader's width (raise/paramwidth.ts, EVERY READER AN EXTENSION). A lift variation for the
+      // reason `/connective` is: the raise mutates in place, and the parameter's width is what
+      // recovery and every later stage read. Enumerated only where this symbol-map setting's lift
+      // reports such a parameter; crossed with the other two, and the dedup collapses what agrees.
+      const paramSettings: { variations: readonly Variation[]; extendedReaders: boolean }[] = extendedReaders
+        ? [
+            { variations: [], extendedReaders: false },
+            { variations: ['narrow-param'], extendedReaders: true },
+          ]
+        : [{ variations: [], extendedReaders: false }];
+      // `/kept-slot` — keep the delay slot of a MIPS `b`/`j` whose slot ends a common tail both arms
+      // spell, where the default lift retargets it to the copy before its target and merges the
+      // arms (frontend/mips.ts `normaliseBranchLikely`: the two are one object, and which the source
+      // wrote is the differ's to say). A LIFT variation because the rewrite is the CFG every later
+      // stage reads. Enumerated only where this setting's default lift reports such a slot; crossed
+      // with the others, and the dedup collapses what agrees. An IDO reading: GCC 2.7.2 and KMC
+      // cross-jump a tail both arms spell before they fill a slot, so they leave no such tail.
+      const tailSettings: { variations: readonly Variation[]; keepTailSlots: boolean }[] = tailSlot
+        ? [
+            { variations: [], keepTailSlots: false },
+            { variations: ['kept-slot'], keepTailSlots: true },
+          ]
+        : [{ variations: [], keepTailSlots: false }];
+      // `/far-cast` — keep each store the displaced-access fold would move into a struct on the
+      // address it was reached through (raise/structs.ts `foldDisplacedAccesses`). On agbcc the
+      // member store and the cast store are two objects (target.ts `farMemberStoreOrder`), and a
+      // hoisted pointer the source held builds the cast's. Elsewhere a folded store stops aliasing
+      // the loads beside it and a held pointer is spelled as members, which KMC, GCC 2.7.2 and mwcc
+      // build into other objects. So which one the source wrote is the differ's to say, on every
+      // target. A LIFT variation because the fold decides which struct the stores join, which
+      // recovery and every later stage read. Enumerated only where this setting's lift folded a
+      // store.
+      const castSettings: { variations: readonly Variation[]; keepStores: boolean }[] =
+        foldedStore && offeredOn(target, ['far-cast'])
+          ? [
+              { variations: [], keepStores: false },
+              { variations: ['far-cast'], keepStores: true },
+            ]
+          : [{ variations: [], keepStores: false }];
       const liftSettings = narrowSettings.flatMap((l) =>
-        connectiveSettings.map((c) => ({ ...l, ...c, variations: [...l.variations, ...c.variations] })),
+        connectiveSettings.flatMap((c) =>
+          paramSettings.flatMap((w) =>
+            tailSettings.flatMap((k) =>
+              castSettings.map((f) => ({
+                ...l,
+                ...c,
+                ...w,
+                ...k,
+                ...f,
+                variations: [...l.variations, ...c.variations, ...w.variations, ...k.variations, ...f.variations],
+              })),
+            ),
+          ),
+        ),
       );
       for (const liftSetting of liftSettings) {
         let fn: Fn;
         let discardsPassedResult = false;
+        let guessesParamWidth = false;
         let inferredSymbols = new Map<string, SymbolInfo>();
         let orderLicensed: ReadonlySet<string> = new Set<string>();
         try {
@@ -1932,7 +2135,17 @@ export function enumerateCandidates(
           fn =
             liftSetting.variations.length === 0
               ? base
-              : liftStamped(name, asm, target, prototypes, opts.asmData, symbolSetting.symbols);
+              : liftStamped(
+                  name,
+                  asm,
+                  target,
+                  prototypes,
+                  opts.asmData,
+                  symbolSetting.symbols,
+                  opts.contextGlobals,
+                  { keepTailSlots: liftSetting.keepTailSlots },
+                  ownContext.ownContextProto,
+                );
           if (liftSetting.narrow && !narrowToSetupArgs(fn)) {
             continue; // nothing to cut after all — the default lift's own candidates already cover it
           }
@@ -1970,7 +2183,7 @@ export function enumerateCandidates(
           // `/raw-globals` sibling has no map and so no name to reach. AFTER the two readings, and
           // the staleness that leaves them is priced in pipeline.ts's copy of this note.
           if (symbolSetting.symbols) {
-            OFFSET_NAME_PASS.run(fn, symbolSetting.symbols, target.compilerBehaviors);
+            OFFSET_NAME_PASS.run(fn, symbolSetting.symbols, stampBehaviorsFor(target, opts.contextGlobals));
           }
           for (const [n, si] of [...inferredSymbols]) {
             if (baseOpts.symbols?.has(n) === true || !sameDerivedShape(declSymbols.get(n), si)) {
@@ -1992,7 +2205,16 @@ export function enumerateCandidates(
               },
             },
             prototypes[name],
-            { shortCircuit: { foldTreeOwned: liftSetting.connective } },
+            {
+              shortCircuit: { foldTreeOwned: liftSetting.connective },
+              paramWidth: {
+                extendedReaders: liftSetting.extendedReaders,
+                onUndeclaredWidth: () => {
+                  guessesParamWidth = true;
+                },
+              },
+              displaced: { keepStores: liftSetting.keepStores },
+            },
           );
         } catch (e) {
           // THE DEFAULT CARRIES NO VARIATION, by construction: every lift variation appends one, so
@@ -2049,6 +2271,8 @@ export function enumerateCandidates(
         // `droppedDefault` is the DEFAULT pass's drops. Each shared-tail pass reads it and keeps its
         // own drops in a copy, so one pass's structuring failure never removes the other's candidate.
         const droppedDefault = new Set<string>();
+        // What `assertDefaultAccepts` learned about this fn, shared by every setting structured from it.
+        let acceptsMemo = new DefaultAcceptsMemo(fn);
         for (const pass of ['default', 'follow', 'sink'] as const) {
           if (pass === 'follow' && !hasDivergentSharedRet(fn)) {
             continue;
@@ -2057,6 +2281,8 @@ export function enumerateCandidates(
             let sunk: boolean;
             try {
               sunk = sinkStoreTails(fn);
+              // The sink rewrites fn in place, so nothing the memo learned before it holds after it.
+              acceptsMemo = new DefaultAcceptsMemo(fn);
               if (sunk) {
                 verify(fn);
               }
@@ -2120,25 +2346,33 @@ export function enumerateCandidates(
             // recovered function without re-lifting.
             let sfn: SFn;
             try {
-              sfn = structureChecked(fn, {
-                ...symbolSettingOpts,
-                ...(inferredSymbols.size ? { inferredSymbols } : {}),
-                ...(orderLicensed.size ? { orderLicensedGlobals: orderLicensed } : {}),
-                preserveDivergentBranchSense: s.sense,
-                negateJoinedBranchSense: s.join ? !defSense : defSense,
-                ...(s.flipSites ? { branchSenseFlipSites: s.flipSites } : {}),
-                anchorConstCopies: s.anchor,
-                anchorLoopEntryConsts: s.entry,
-                spellBitfieldMembers: s.bitfields,
-                spellPtrMemberElements: s.ptrElems,
-                spellDeclaredSubscripts: s.declRank,
-                ...STRUCTURE_VARIATIONS.reduce(
-                  (acc, variation) => ({ ...acc, ...variation.options(s[variation.flag]) }),
-                  {},
-                ),
-                ...(alternative ? { followEarlyReturns: true } : {}),
-              });
+              sfn = structureChecked(
+                fn,
+                {
+                  ...symbolSettingOpts,
+                  ...(inferredSymbols.size ? { inferredSymbols } : {}),
+                  ...(orderLicensed.size ? { orderLicensedGlobals: orderLicensed } : {}),
+                  preserveDivergentBranchSense: s.sense,
+                  negateJoinedBranchSense: s.join ? !defSense : defSense,
+                  ...(s.flipSites ? { branchSenseFlipSites: s.flipSites } : {}),
+                  anchorConstCopies: s.anchor,
+                  anchorLoopEntryConsts: s.entry,
+                  spellBitfieldMembers: s.bitfields,
+                  spellPtrMemberElements: s.ptrElems,
+                  spellDeclaredSubscripts: s.declRank,
+                  ...STRUCTURE_VARIATIONS.reduce(
+                    (acc, variation) => ({ ...acc, ...variation.options(s[variation.flag]) }),
+                    {},
+                  ),
+                  ...(alternative ? { followEarlyReturns: true } : {}),
+                },
+                undefined,
+                acceptsMemo,
+              );
             } catch (e) {
+              if (e instanceof DefaultAcceptsMemoMisuse) {
+                throw e; // a memo wired to the wrong fn is a defect here, never a dropped variation
+              }
               if (abortsRow([...liftVariations, ...symbolSetting.variations], s)) {
                 throw e; // the default lift's default setting keeps its behavior: a failure aborts the row
               }
@@ -2214,6 +2448,8 @@ export function enumerateCandidates(
                 assertLocalsWritten(made);
                 assertPostIncrUnshared(made);
                 assertNoOrphanedLocals(sfn, made);
+                assertLocalStorageStaysInteger(sfn, made);
+                assertFrameUnionsViewed(made);
                 // A backend refusal on this REWRITTEN tree is not a refusal of the row's own
                 // tree, so it never becomes the row's stated cause: `TreeSources.emit` is dropped
                 // here and only the call over the row's own tree above records one.
@@ -2274,10 +2510,17 @@ export function enumerateCandidates(
                 // whichever route the enumeration happened to walk first.
                 if (sp.matchOnly === undefined) {
                   delete dup.matchOnly;
+                  delete dup.signedUnsignedCompare;
                 }
                 if (!discardsPassedResult) {
                   delete dup.discardsPassedResult;
                 }
+                if (!guessesParamWidth) {
+                  delete dup.guessesParamWidth;
+                }
+                if (!liftSetting.keepStores) {
+                  delete dup.farStoreCast;
+                }
                 continue;
               }
               const variations: readonly Variation[] = [
@@ -2299,8 +2542,11 @@ export function enumerateCandidates(
                 preference: symbolIndex,
                 ...(sp.symbolRefs ? { symbolRefs: sp.symbolRefs } : {}),
                 ...(sp.deviceVolatile ? { deviceVolatile: sp.deviceVolatile } : {}),
-                ...(sp.matchOnly ? { matchOnly: sp.matchOnly } : {}),
+                ...(sp.matchOnly ? { matchOnly: true as const } : {}),
+                ...(sp.signedUnsignedCompare ? { signedUnsignedCompare: true as const } : {}),
                 ...(discardsPassedResult ? { discardsPassedResult: true as const } : {}),
+                ...(guessesParamWidth ? { guessesParamWidth: true as const } : {}),
+                ...(liftSetting.keepStores ? { farStoreCast: true as const } : {}),
               };
               seen.set(source, made);
               out.push(made);
@@ -2440,7 +2686,8 @@ function stillbornNote(stillborn: Stillborn, fan: number): string {
  *
  *  A DISCARDED PASSED RESULT next (`Candidate.discardsPassedResult`): equal bytes refute neither
  *  reading, so the one that drops a value the callee may read wins only where it scores strictly
- *  better.
+ *  better. A GUESSED PARAMETER WIDTH (`Candidate.guessesParamWidth`) likewise: a narrow declaration
+ *  no prototype supplied changes its callers' bytes, which no score here reads.
  *
  *  PREFERENCE next: a named symbol-map spelling beats its `/raw-globals` sibling at equal bytes.
  *
@@ -2463,6 +2710,11 @@ function stillbornNote(stillborn: Stillborn, fan: number): string {
  *  below does the same for `/narrow-decl`, which drops one cast per local it narrows and so wins
  *  every tie against the candidate it is derived onto.
  *
+ *  A FAR STORE SPELLED THROUGH A CAST (`Candidate.farStoreCast`) next: where `/far-cast` ties the
+ *  member spelling, the compiler built the member's object too, and the member names the field. Its
+ *  `(u8 *)` base is no scalar cast and its line count is no higher, so neither term below would
+ *  prefer the member on its own.
+ *
  *  CAST COUNT next, and only WITHIN a preference. A wrong signedness pin is what manufactures casts —
  *  the C backend has to cast a shift operand back to the signedness the machine op needs, so
  *  pinning `u32` on a genuinely-signed parameter buys `s32 f(u32 a0) { return (s32)a0 >> a1; }`
@@ -2480,12 +2732,11 @@ function stillbornNote(stillborn: Stillborn, fan: number): string {
  *  result deterministic. Spelled explicitly rather than leaning on Array#sort's stability, which
  *  would make each preference an accident of two unrelated decisions.
  *
- *  WHAT NO TERM HERE WEIGHS: a comparison's rendered SIGNEDNESS. `/uns-cmp`'s whole output is
- *  that polarity, and it carries in a DECLARED TYPE rather than a cast — `castCount` reads 0 on
- *  both sides of the tie it loses — so at equal bytes enumeration order decides, and a rival
- *  variation's candidate can publish a signed compare where the asm's is unsigned. Weighing it needs
- *  the candidate's own SFn and the icmp facts it was structured from, neither of which this
- *  comparator carries; `deviceVolatile` is the shape such a term would take. */
+ *  WHAT NO TERM HERE WEIGHS: a comparison's rendered SIGNEDNESS. It needs none: every tree a
+ *  source is emitted from is judged for an unsigned compare that renders signed
+ *  (`Candidate.signedUnsignedCompare`), whichever variation spelled it so, and such a source is
+ *  `matchOnly` — on a nonmatch it is withheld before this comparator sees it, whatever it scores,
+ *  and on a match both spellings are the program. */
 export function compareScored<S extends { score: number }>(
   a: Candidate & { score: S; order: number },
   b: Candidate & { score: S; order: number },
@@ -2493,8 +2744,10 @@ export function compareScored<S extends { score: number }>(
   return (
     a.score.score - b.score.score ||
     (a.discardsPassedResult ? 1 : 0) - (b.discardsPassedResult ? 1 : 0) ||
+    (a.guessesParamWidth ? 1 : 0) - (b.guessesParamWidth ? 1 : 0) ||
     a.preference - b.preference ||
     (b.deviceVolatile ?? 0) - (a.deviceVolatile ?? 0) ||
+    (a.farStoreCast ? 1 : 0) - (b.farStoreCast ? 1 : 0) ||
     castCount(a.source) - castCount(b.source) ||
     lineCount(a.source) - lineCount(b.source) ||
     a.order - b.order