@asmlift/core 0.9.0 → 0.11.0

package/src/ir/core.ts

@@ -59,8 +59,57 @@ export interface Fn {
   /** L1 SIDE DATA (see {@link LocalObjects}); set by a frontend that recovered one, `undefined` on
    *  every other `Fn`. REQUIRED-but-possibly-undefined for exactly the reason `writeOrder` is. */
   localObjects: LocalObjects | undefined;
+  /** L1 SIDE DATA (see {@link AsmLayout}); set by a frontend, `undefined` on parsed IR.
+   *  REQUIRED-but-possibly-undefined for exactly the reason `writeOrder` is. */
+  asmLayout: AsmLayout | undefined;
 }
 
+/** One block's place in the assembly a frontend lifted it from ({@link AsmLayout}). */
+export interface AsmBlockLayout {
+  /** the block's position among the function's blocks in the asm text, first block 0 */
+  readonly index: number;
+  /** the block's instructions without its control transfer, one string per instruction as the
+   *  asm spells it (`mnemonic op,op`), followed by `<sym>` (`<sym+0xN>` with an addend) where a
+   *  relocation fills in a symbol the operands do not name (frontend/ssa.ts `recordAsmLayout`). A
+   *  MIPS delay slot is part of the block it runs in. */
+  readonly body: readonly string[];
+  /** the positions in `body` of the instructions that make a call, as the frontend's ISA reads them
+   *  (Thumb `bl`/`blx` but not a far-jump relay, MIPS `jal`/`jalr`/`bal`, PPC `bl`/`bctrl`/`blrl`) */
+  readonly calls: readonly number[];
+  /** the block ends in an unconditional jump to a label: neither a fall-through, nor a return,
+   *  nor a conditional or indirect branch */
+  readonly endsInJump: boolean;
+}
+
+/** WHERE THE COMPILER PUT EACH BLOCK, and what it holds besides its branch: a measurement only the
+ *  frontend can make. The IR keeps the CFG and drops the order, since `fn.blocks` is a list passes
+ *  are free to rewrite (raise/reroll.ts moves a block ahead of another, and inserts one).
+ *
+ *  The reader is the return-tail chooser (structure/cross-jumped-tail.ts). Where the compiler
+ *  cross-jumps return tails (target.ts `crossJumpsReturnTails`), the layout tells a tail the source
+ *  wrote once from one it wrote into every arm, and the CFG cannot. Keyed by Block OBJECT, so a
+ *  clone re-keys it (cli/src/report.ts `structuredCloneFn`). A block a pass created has no entry,
+ *  and every reader takes a missing entry as "no evidence". Recorded by the Thumb and MIPS
+ *  frontends only: no mark is read on mwcc (it declares neither `crossJumpsReturnTails` nor an
+ *  unfolded taken-edge constant), so frontend/ppc.ts records none until one is, and a PPC lift's
+ *  `asmLayout` is undefined.
+ *
+ *  AN ENTRY DESCRIBES THE ASM BLOCK THE IR BLOCK WAS LIFTED FROM, whatever raising later did to the
+ *  IR block. A return sunk into it, or ops a fold absorbed (shortcircuit, tailsink, divpow2), leave
+ *  the entry as the frontend wrote it. So `endsInJump` and `body` say what the compiler emitted,
+ *  not what the block holds now: over the agbcc lifts of the 620 functions the join re-spells
+ *  (2026-11-05), 786 of 10520 blocks have an entry saying they end in a jump and no longer end in a
+ *  `br`. The return-tail chooser reads exactly that, the asm terminator. A reader of the current
+ *  block reads its ops.
+ *
+ *  BUT ON MIPS THE ASM IS THE NORMALISED ASM. frontend/mips.ts records the layout after
+ *  `normaliseBranchLikely`, which gives a likely branch's slot a block of its own and retargets an
+ *  unconditional `b T` whose slot copies the word at T-4 to that word, emptying the slot.
+ *  Such a `b`'s entry has `body` ending in `nop` where the compiler emitted the copied word
+ *  (`func_80A42DB4_jp`'s `b` at 0x80A42DCC, whose slot is `sw zero,0(a3)`), so every MIPS mark
+ *  reads the normalised body, not the emitted one. */
+export type AsmLayout = Map<Block, AsmBlockLayout>;
+
 /** Where a function-scope static lives, which decides how its definition is spelled: `rodata` is
  *  `const` with an initializer, `data` has an initializer, `bss` has none. */
 export type LocalObjectSection = 'rodata' | 'data' | 'bss';
@@ -86,6 +135,28 @@ export interface LocalObject {
   /** What an object FILE records of where the object sits, absent for an assembler listing, whose
    *  `.align` is among its directives. */
   placement?: LocalObjectPlacement;
+  /** Every address the initializer holds, in offset order — the words a relocation fills in at
+   *  link time, which the bytes alone do not carry. Absent for an object holding none. The bytes
+   *  under one say nothing: the relocation's `addend` is the whole of it. */
+  relocs?: readonly LocalObjectReloc[];
+  /** The object is the compiler's own, under a label the source never wrote (agbcc's `.LC0`): the
+   *  constant image a local aggregate's initializer is copied from. `name` is then the label, no
+   *  declaration spells it, and it reaches the C only as that local's initializer
+   *  (l3/constinit.ts). */
+  anonymous?: true;
+}
+
+/** The bytes of every address an initializer holds ({@link LocalObjectReloc}): a pointer's, on every
+ *  target whose initializers the frontends relocate (agbcc's `.word sym`, mwcc's `R_PPC_ADDR32`). */
+export const LOCAL_OBJECT_ADDRESS_BYTES = 4;
+
+/** One address an initializer holds: the pointer-width word at byte `offset` of the object is
+ *  `symbol`'s address plus `addend` — an ordinary global's, the only kind a declaration outside the
+ *  function can name (frontend/reloc-symbol.ts). */
+export interface LocalObjectReloc {
+  offset: number;
+  symbol: string;
+  addend: number;
 }
 
 /** What an object file records of where a static sits. */
@@ -112,6 +183,12 @@ export interface LocalObjectDirectives {
   /** every value directive writes a string (`.ascii`), as the compiler writes a string literal —
    *  whole, or as the elements of an array or struct of strings */
   string: boolean;
+  /** every run of padding among the value directives, as [byte offset, byte length], when there
+   *  is one: in an array, the elements its brace initializer left out — the compiler writes every
+   *  element the source spelled, zero or not, as a value, and each run it left out as a `.space`
+   *  (varasm.c `output_constructor`), wherever the run falls: after the last value, ahead of the
+   *  first, or between two (a designator, a nested brace's short row). In a struct, alignment too. */
+  gaps?: [number, number][];
 }
 
 /** The function-scope statics a function DEFINES, keyed by {@link LocalObject.symbol} — the object a
@@ -135,14 +212,16 @@ export type LocalObjects = ReadonlyMap<string, LocalObject>;
  *  `deadHome` — THE STORE DOES NOT REACH THE IR. Every slot-modelling frontend spells a word
  *  sp-relative store as a write to the SSA key `sp@k` instead of a `store` op (`stackSlotKey`), so
  *  a slot nothing reloads has no reader, no op and no value: it simply is not there by L1. MIPS and
- *  Thumb lift such a store. PowerPC refuses it, because an unread store may be a call's outgoing
- *  stack argument (frontend/ppc.ts), so a PowerPC lift never reports a dead home. A
+ *  Thumb lift such a store. PowerPC refuses it, because an unread slot store may be a call's
+ *  outgoing stack argument; in a function that makes no call, mwcc's local area takes such a store
+ *  as a store to a frame object instead of a slot (frontend/ppc.ts `measurePpcFrame`). Either way a
+ *  PowerPC lift never reports a dead home. A
  *  parameter stored to two slots, one of them reloaded, still counts — the dead store happened —
  *  and the reader's own gates decide what a parameter with that much traffic may become.
  *
  *  It asks NO FRAME PARTITION, and that is the difference from {@link SlotHomes}. A slot home is a
  *  DECLARATION RANK, so `sp@40` had to be classified as this function's local before it could be
- *  stamped, and MIPS declares no partition and so stamps none. "Stored here and never read back"
+ *  stamped, and MIPS declares no `declaredLocals` and so stamps none. "Stored here and never read back"
  *  needs no such classification: it is a statement about the store, true at any offset.
  *
  *  `selfRedefined` — THE REGISTER IDENTITY DOES NOT REACH THE IR EITHER. SSA renames, so nothing
@@ -178,7 +257,7 @@ export type ParamEvidence = ReadonlyMap<Value, ParamObservation>;
  *  A KEY IS NOT A FRAME COORDINATE, and the frontends differ on exactly that. `sp@40` is a local
  *  on one ABI and the caller's fifth argument on another, so the shared stamp asks the frontend's
  *  own `LiveInModel.declaredLocals` and refuses an offset outside it — Thumb declares a range,
- *  MIPS and PPC declare no partition and so stamp nothing. An entry here therefore means "storage
+ *  MIPS and PPC declare none and so stamp nothing. An entry here therefore means "storage
  *  this function DECLARES, homed at k", not "some sp-relative key".
  *
  *  DECLARES, NOT OWNS, AND THE DIFFERENCE IS AN AGBCC FACT WITH A LIVE DEPENDENCY: `ownedLocals`,
@@ -283,6 +362,35 @@ export function foldWriteOrder(order: WriteOrder | undefined, from: Block, into:
   order.writes.set(into, base + (order.writes.get(from) ?? 0));
 }
 
+/** The `laddr` attribute that marks a function's OWN struct return object: the local its hidden
+ *  struct-return pointer became, or the one its struct returned in a register is built in
+ *  (frontend/own-struct-return.ts). Neither lives in this frame, so no frame offset names it and
+ *  its `off` means nothing. */
+export const OWN_RETURN_OBJECT = 'returned';
+
+/** The `call` attribute of L1 that says its result is the IMAGE of a struct its callee is declared
+ *  to return in the return register (frontend/call-plan.ts `registerStructLocal`): a word the
+ *  frontend reads as any call's, which `liftRegisterStructCalls` (frontend/register-struct-call.ts)
+ *  turns into the struct assigned to a local and re-read off it. No call carries it past that.
+ *  `true`, or {@link STRUCT_HOMED} where the frontend saw the image stored to a frame home. */
+export const REGISTER_STRUCT = 'registerStruct';
+
+/** The value of {@link REGISTER_STRUCT} on a call whose image the function stores to a frame word
+ *  (frontend/ppc.ts): mwcc gives a struct the source names a home, read or not, and one the source
+ *  only returns none — `struct T s = mk(1); return s;` is `bl mk; stw r3,8(r1)`, `return mk(1);` is
+ *  `bl mk` alone. */
+export const STRUCT_HOMED = 'homed';
+
+/** The `laddr` attribute that marks the local a struct returned in a register is assigned to
+ *  (frontend/register-struct-call.ts), holding the callee's name, which names the local. The
+ *  struct lives in the return register, not in this frame, so no frame offset names it and its
+ *  `off` means nothing, as for {@link OWN_RETURN_OBJECT}. */
+export const CALL_RETURN_OBJECT = 'callReturned';
+
+/** The `ret` attribute that says it hands back the {@link OWN_RETURN_OBJECT} whole, by value: its
+ *  operand is that object's address, and the C returns the object. */
+export const RETURNS_OBJECT = 'returnsObject';
+
 export function mkValue(type: IrType): Value {
   return { type };
 }
@@ -297,6 +405,19 @@ export function mkOp(opcode: Opcode, o: Partial<Op> = {}): Op {
   };
 }
 
+/** An op's attributes as one comparable key, keys sorted (so insertion order never tells two
+ *  equal attribute sets apart), leaving out the attribute `drop` names. */
+export function attrsKey(op: Op, drop: string | null = null): string {
+  return JSON.stringify(
+    Object.entries(op.attrs ?? {})
+      .filter(([k]) => k !== drop)
+      .sort(([a], [b]) => a.localeCompare(b)),
+  );
+}
+
+/** One op's identity apart from its operands: opcode, result count and attributes. */
+export const opShape = (op: Op): string => `${op.opcode}/${op.results.length}/${attrsKey(op)}`;
+
 // ── a call's callee: a NAME (`attrs.target`) or, for a call through a register, a VALUE ─────────
 //
 // An INDIRECT call carries `indirect: true` and no `target`, and calls the function whose address
@@ -314,6 +435,15 @@ export function calleeName(op: Op): string | undefined {
   return op.opcode === 'call' && typeof op.attrs.target === 'string' ? op.attrs.target : undefined;
 }
 
+/** The operands a call passes a struct BY VALUE (frontend/call-plan.ts `foldByValueArgs`): each
+ *  one's place in the operands and the declared parameter it is. The two differ by more than a
+ *  hidden return pointer wherever a parameter before it takes two operands, so the parameter is
+ *  carried rather than re-derived. */
+export function byValueOperands(op: Op): { at: number; param: number }[] {
+  const pairs = op.opcode === 'call' ? ((op.attrs.byValue as number[] | undefined) ?? []) : [];
+  return Array.from({ length: pairs.length / 2 }, (_, i) => ({ at: pairs[2 * i], param: pairs[2 * i + 1] }));
+}
+
 /** A call's arguments, the callee value of an indirect call aside. */
 export function callArgs(op: Op): Value[] {
   return calleeValue(op) === undefined ? op.operands : op.operands.slice(0, -1);
@@ -370,7 +500,7 @@ export function successorsOf(b: Block): Block[] {
  *  keeps a walk of its own rather than calling this one — it descends through EVERY op's successors,
  *  which is the same relation on verified IR and a wider one on the hand-built IR its own note is
  *  about. */
-export function reachableBlocks(fn: Fn): Set<Block> {
+export function reachableBlocks(fn: { readonly blocks: readonly Block[] }): Set<Block> {
   const seen = new Set<Block>();
   const entry = fn.blocks[0];
   if (entry === undefined) {
@@ -388,8 +518,35 @@ export function reachableBlocks(fn: Fn): Set<Block> {
   return seen;
 }
 
+/** The blocks `from` reaches along FORWARD edges — never a back-edge, whose target dominates its
+ *  source — `from` itself included. A block of `stop` is reached but not walked past.
+ *
+ *  Forward only, so an enclosing loop's next iteration does not count: the exit of a loop nested in
+ *  another reaches every block of the inner body round the outer back-edge, and a full walk would
+ *  say it runs the inner loop's own arms. Two passes ask "does a loop's exit run this block":
+ *  `raise/latch.ts`'s exit-trampoline scope gate and `structure.ts`'s `offExitPathOf` (the
+ *  duplication policy `codeBreakArm` and `earlyReturnArm` share). */
+export function reachForward(
+  from: Block,
+  dom: ReadonlyMap<Block, ReadonlySet<Block>>,
+  stop: ReadonlySet<Block> = new Set(),
+): Set<Block> {
+  const seen = new Set<Block>();
+  for (const stack = [from]; stack.length > 0;) {
+    const x = stack.pop()!;
+    if (seen.has(x)) {
+      continue;
+    }
+    seen.add(x);
+    if (!stop.has(x)) {
+      stack.push(...successorsOf(x).filter((s) => !dom.get(x)!.has(s)));
+    }
+  }
+  return seen;
+}
+
 /** Predecessor map for the whole function's CFG. */
-export function predecessors(fn: Fn): Map<Block, Block[]> {
+export function predecessors(fn: { readonly blocks: readonly Block[] }): Map<Block, Block[]> {
   const preds = new Map<Block, Block[]>();
   for (const b of fn.blocks) {
     preds.set(b, []);
@@ -405,10 +562,10 @@ export function predecessors(fn: Fn): Map<Block, Block[]> {
 /** Forward dominators (iterative data-flow). dom(b) = {b} ∪ ⋂ dom(preds).
  *
  *  A CFG fact, so it lives beside `predecessors` it is built on rather than with either consumer:
- *  `verify` needs it to check def-dominates-use, `structure/loops.ts` to tell a back-edge from a
+ *  `verify` needs it to check def-dominates-use, `ir/loops.ts` to tell a back-edge from a
  *  forward one, and `raise/latch.ts` to tell a latch from a preheader. */
 
-export function dominators(fn: Fn): Map<Block, Set<Block>> {
+export function dominators(fn: { readonly blocks: readonly Block[] }): Map<Block, Set<Block>> {
   const preds = predecessors(fn);
   const all = new Set(fn.blocks);
   const dom = new Map<Block, Set<Block>>();
@@ -441,6 +598,94 @@ export function dominators(fn: Fn): Map<Block, Set<Block>> {
   return dom;
 }
 
+/** Whether `h` dominates `t`, exactly as `dominators(fn).get(t).has(h)` answers it: the
+ *  same data-flow (dom(b) = {b} ∪ ⋂ dom(preds), the entry alone, every other block starting from all
+ *  of them), iterated to the same greatest fixed point, over one bit per block instead of a `Set`
+ *  per block. raise/shortcircuit.ts's `naturalLoopBodies` asks it once per scan of a function its fold
+ *  keeps changing, where the sets cost a large function's lift most of its raising time. */
+export function dominance(fn: { readonly blocks: readonly Block[] }): (h: Block, t: Block) => boolean {
+  const n = fn.blocks.length;
+  const words = Math.ceil(n / 32);
+  const index = new Map<Block, number>();
+  fn.blocks.forEach((b, i) => index.set(b, i));
+  const preds = predecessors(fn);
+  const dom = fn.blocks.map((_, i) => {
+    const bits = new Uint32Array(words);
+    if (i === 0) {
+      bits[0] = 1;
+    } else {
+      bits.fill(0xffffffff);
+      if (n % 32 !== 0) {
+        bits[words - 1] = 2 ** (n % 32) - 1;
+      }
+    }
+    return bits;
+  });
+  const next = new Uint32Array(words);
+  for (let changed = true; changed;) {
+    changed = false;
+    for (let i = 1; i < n; i++) {
+      const ps = preds.get(fn.blocks[i])!;
+      if (ps.length === 0) {
+        next.fill(0);
+      } else {
+        next.set(dom[index.get(ps[0])!]);
+        for (let k = 1; k < ps.length; k++) {
+          const dp = dom[index.get(ps[k])!];
+          for (let w = 0; w < words; w++) {
+            next[w] &= dp[w];
+          }
+        }
+      }
+      next[i >>> 5] |= 1 << (i & 31);
+      const prev = dom[i];
+      let same = true;
+      for (let w = 0; w < words; w++) {
+        if (next[w] !== prev[w]) {
+          same = false;
+          break;
+        }
+      }
+      if (!same) {
+        prev.set(next);
+        changed = true;
+      }
+    }
+  }
+  return (h, t) => {
+    const hi = index.get(h);
+    const ti = index.get(t);
+    return hi !== undefined && ti !== undefined && (dom[ti][hi >>> 5] & (1 << (hi & 31))) !== 0;
+  };
+}
+
+/** Each block's IMMEDIATE dominator: of its strict `dominators`, which form a chain, the nearest —
+ *  the one every other dominates, so the one with the most dominators of its own. Read off those
+ *  sets rather than computed again, so the tree and the sets cannot disagree; but off the sets of
+ *  the blocks the entry reaches (`reachableBlocks`) alone, because `dominators` counts an edge
+ *  out of an unreachable block as a way in, and one such edge into a loop's join leaves the join
+ *  dominated by nothing but itself. The entry, and every unreachable block, have none.
+ *  `ir/bits.ts`'s `edgeFacts` walks this tree up from a point to read what the branches above it
+ *  prove there. */
+export function immediateDominators(fn: { readonly blocks: readonly Block[] }): Map<Block, Block> {
+  const live = reachableBlocks(fn);
+  const blocks = fn.blocks.filter((b) => live.has(b));
+  const dom = dominators({ blocks });
+  const out = new Map<Block, Block>();
+  for (const b of blocks.slice(1)) {
+    let near: Block | undefined;
+    for (const d of dom.get(b)!) {
+      if (d !== b && (near === undefined || dom.get(d)!.size > dom.get(near)!.size)) {
+        near = d;
+      }
+    }
+    if (near !== undefined) {
+      out.set(b, near);
+    }
+  }
+  return out;
+}
+
 /** A block with NO BODY OF ITS OWN: it declares no parameters and holds a single op, which is
  *  therefore its terminator. It computes nothing and it binds nothing. Three sites ask this and
  *  each adds its own clause (`forwardingTarget` below wants a `br` carrying no args;
@@ -510,7 +755,7 @@ export function forwardingTarget(b: Block): Block {
  *  a CFG fact a parameter for one caller's extra edges — so it stays where it is, and what this
  *  paragraph buys is that the next reader looking for a fourth copy knows which of the two the
  *  third one is. */
-export function mergeClasses(fn: Pick<Fn, 'blocks'>): Map<Value, readonly Value[]> {
+export function mergeClasses(fn: { readonly blocks: readonly Block[] }): Map<Value, readonly Value[]> {
   const parent = new Map<Value, Value>();
   const find = (v: Value): Value => {
     let r = v;

package/src/ir/discipline.ts

@@ -4,8 +4,10 @@
 // Two kinds of fact meet here. The registry's flags (ir/opcodes.ts `OpSig`: `effects`, `reads`,
 // `traps`) are facts about an OPCODE. A PLACEMENT is a fact about one OP, decided once by the pass
 // that knew it: `call` is its own opcode; `helper` is the stamp `runtime-helpers.ts` `helperOp` puts
-// on a value op the asm computed by calling a runtime routine; `device` is the `volatile` the
-// frontend's device-pin pass (frontend/device-pins.ts) puts on a memory access; `declared` is the
+// on a value op the asm computed by calling a runtime routine; `device` is the `volatile` a frontend
+// puts on a memory access, decided by two pins — the device pin (frontend/device-pins.ts), for an
+// access of a device register, and the dead-read pin (frontend/dead-reads.ts), for a read at ANY
+// address whose value the lifted function never uses; `declared` is the
 // stamp raise/declared-volatile.ts puts on an access of an object the symbol map declares volatile —
 // a read only where the compiler could have made it of a `volatile` — as the lift is made and again
 // when structuring starts. Every question below takes the op, so a pass
@@ -50,7 +52,7 @@
 //     a read the stamp cannot place by byte — a runtime index, an `aload` — of an object the map
 //       qualifies only some members of, which may reach a plain member (symbols.ts
 //       `declaresVolatile`).
-import type { Op } from './core';
+import type { Block, Op, Value } from './core';
 import { MEM_BASE_OPS, type OpSig, opSig } from './opcodes';
 
 /** Why an op must run where the asm ran it. */
@@ -107,23 +109,37 @@ const PLACEMENT_ANSWERS: Readonly<Record<Placement, PlacementAnswers>> = {
   },
 };
 
-/** The placement an op carries, or null for an op that may render wherever its value is used. */
-export function placedAt(op: Op): Placement | null {
+/** Every placement stamp an op carries, the one that places it first. An op can carry two: a read
+ *  of an object the map declares volatile is `declared` and, kept by the lift's own pin (frontend/
+ *  dead-reads.ts, frontend/device-pins.ts), `device` too.
+ *
+ *  A declaration that qualifies the object places the access before a lift's own stamp does: both
+ *  say the access is `volatile`, and the declaration is the spelling the source used, so the
+ *  access counts and spells as the object's (raise/declared-volatile.ts re-derives it per map, and
+ *  under a map that declares nothing the lift's stamp places it again — which is why a rebuild
+ *  carries both, `carryDiscipline`). */
+function stampsOf(op: Op): Placement[] {
   if (op.opcode === 'call') {
-    return 'call';
-  }
-  if (MEM_BASE_OPS.has(op.opcode) && op.attrs.volatile === true) {
-    return 'device';
+    return ['call'];
   }
+  const stamps: Placement[] = [];
   if (MEM_BASE_OPS.has(op.opcode) && op.attrs[DECLARED_VOLATILE] === true) {
-    return 'declared';
+    stamps.push('declared');
+  }
+  if (MEM_BASE_OPS.has(op.opcode) && op.attrs.volatile === true) {
+    stamps.push('device');
   }
   // An `opaque` carries `helper` too, naming the call nothing could fold (`refuseUnmodelledHelpers`);
   // it is no value op, and its `effects` flag already places it.
   if (op.opcode !== 'opaque' && typeof op.attrs.helper === 'string') {
-    return 'helper';
+    stamps.push('helper');
   }
-  return null;
+  return stamps;
+}
+
+/** The placement an op carries, or null for an op that may render wherever its value is used. */
+export function placedAt(op: Op): Placement | null {
+  return stampsOf(op)[0] ?? null;
 }
 
 const answered = (op: Op, q: 'keptWhenDead' | 'speculationUnsafe' | 'counted'): boolean => {
@@ -161,12 +177,59 @@ export function effectful(op: Op): boolean {
 }
 
 /** May a dead result be deleted? Registered, no effect, not control flow, and not an op whose
- *  placement keeps it. */
+ *  placement keeps it. A memory read whose value the RAW lift never uses is never asked: the
+ *  frontend stamps it `volatile` first (frontend/dead-reads.ts), because a compiler deletes every
+ *  plain read nobody uses, so one still in the target was qualified. What reaches this question
+ *  plain is a read only asmlift's own rewrites orphaned, or one that pass's gates refused. */
 export function deletableWhenDead(op: Op): boolean {
   const sig = sigOf(op);
   return !!sig && !sig.effects && !sig.terminator && !answered(op, 'keptWhenDead');
 }
 
+/** THE DEAD OPS of these blocks: each op `deletableWhenDead` answers yes for whose single result no
+ *  op outside the set reads, as an operand or as a successor's argument, to a fixed point. The ONE
+ *  definition of dead: pattern/engine.ts `dce` deletes exactly this set, and the dead-read pin
+ *  (frontend/dead-reads.ts) asks it of the raw lift before anything is deleted, so the pin's "dead"
+ *  cannot drift from what the pass would delete.
+ *
+ *  `usesOperands` says whether an op's operands are uses at all. Every op's are, for `dce`; the pin
+ *  passes the one exception a declaration makes: the `ret` of a function its own prototype declares
+ *  void, whose operand the structurer suppresses (structure/analysis.ts `indexUses`). */
+export function deadOps(blocks: readonly Block[], usesOperands: (op: Op) => boolean = () => true): Set<Op> {
+  const dead = new Set<Op>();
+  let changed = true;
+  while (changed) {
+    changed = false;
+    const used = new Set<Value>();
+    for (const b of blocks) {
+      for (const op of b.ops) {
+        if (dead.has(op)) {
+          continue;
+        }
+        if (usesOperands(op)) {
+          for (const o of op.operands) {
+            used.add(o);
+          }
+        }
+        for (const s of op.successors) {
+          for (const a of s.args) {
+            used.add(a);
+          }
+        }
+      }
+    }
+    for (const b of blocks) {
+      for (const op of b.ops) {
+        if (!dead.has(op) && deletableWhenDead(op) && op.results.length === 1 && !used.has(op.results[0])) {
+          dead.add(op);
+          changed = true;
+        }
+      }
+    }
+  }
+  return dead;
+}
+
 /** Must the structurer still SPELL this op when nothing consumes its result — an effect, or a
  *  memory read?
  *
@@ -174,8 +237,9 @@ export function deletableWhenDead(op: Op): boolean {
  *  the C claim: nothing observes a load nobody reads. This one is the COMPILER claim: an optimizing
  *  compiler deletes every dead read it is allowed to delete, so one still in the target is evidence
  *  the source's access was `volatile`. A yes here only says the op may not be dropped silently;
- *  whether a `volatile` can reach the access is an ADDRESS-level question the caller asks
- *  (structure.ts `volatileQualifiable`), and a read it answers no to is dropped.
+ *  whether the read was `volatile` is decided once, by the dead-read pin (frontend/dead-reads.ts),
+ *  and the caller spells a read only where it is `qualified` (structure.ts `volatileQualifiable`),
+ *  dropping one the pin left plain.
  *
  *  Its own function and not `orderSensitive`, though the two agree on every registered opcode: they
  *  ask different questions, and a registry change that splits them is a decision to make at each. */
@@ -238,11 +302,12 @@ export function forgetHelperPlacement(op: Op): Op {
   return op;
 }
 
-/** `attrs`, plus the placement of `from`, for an op a pass builds to stand for `from`: a memory
- *  access keeps its `volatile` or its `declared` stamp, a value op its `helper`. Every op rebuilder
- *  carries the stamps through here, so a placement decided once is not lost to a rebuild that
- *  forgot to copy it. */
+/** `attrs`, plus every placement stamp of `from`, for an op a pass builds to stand for `from`: a
+ *  memory access keeps its `volatile` and its `declared` stamp, a value op its `helper`. Every op
+ *  rebuilder carries the stamps through here, so a placement decided once is not lost to a rebuild
+ *  that forgot to copy it. EVERY stamp, not only the one that places the op: a read carrying both
+ *  `declared` and `device` that kept only `declared` would be left plain — and deleted as dead — by
+ *  a later stamp that no longer finds the declaration. */
 export function carryDiscipline(from: Op, attrs: Op['attrs']): Op['attrs'] {
-  const p = placedAt(from);
-  return p === null ? attrs : { ...attrs, ...PLACEMENT_ANSWERS[p].carried(from) };
+  return stampsOf(from).reduce((acc, p) => ({ ...acc, ...PLACEMENT_ANSWERS[p].carried(from) }), attrs);
 }