@asmlift/core 0.9.0 → 0.11.0

package/src/proto-context.ts

@@ -7,7 +7,6 @@ import {
   type DeclaredType,
   type Derivation,
   type Language,
-  type Parameter,
   type ParsedContext,
   type Qualifier,
   type Range,
@@ -17,17 +16,21 @@ import {
   parseDeclarations,
 } from './cdecl/parse';
 import { asParameter, spellType } from './cdecl/spell';
+import { demangledName, implicitArgumentWords } from './mangle';
 import type { AggregateLayout, AggregateMember, FnProto, ParamType, Prototypes } from './proto';
 import {
   declaredCallArgs,
+  declaredSigned,
   declaredWidth,
   declaresAggregateReturn,
+  declaresVoidReturn,
   isFloatingSpelling,
+  paramClassOf,
   statesNoReturn,
   symbolPrototype,
   validatePrototypes,
 } from './proto';
-import type { SymbolMap } from './symbols';
+import type { SymbolMap, SymbolTypeFacts } from './symbols';
 import type { TargetDescription } from './target';
 
 // asmlift — callee prototypes read out of a DECLARATION CONTEXT: the preprocessed headers a
@@ -68,6 +71,512 @@ export function prototypesFromContext(src: string, language: Language): Prototyp
   return functionPrototypes(ctx, table, layoutReader(ctx, table));
 }
 
+/** What a preprocessed declaration context states about the globals it declares, beyond their
+ *  prototypes. The sets travel together: the aggregate spelling `*(T *)&g` is a cast, which drops
+ *  the declaration's qualifiers, so a reader handed the aggregates without the volatile objects
+ *  would print a plain read of a volatile one. */
+export interface ContextGlobals {
+  /** The objects declared as a struct, a union or an array. Such an object has no value a bare name
+   *  reads: `v = gInfo;` over `extern struct Info gInfo;` is a compile error, and over
+   *  `extern u8 gBuf[];` it reads the address. A project whose symbol map does not describe a
+   *  global (one its linker script places has no DWARF) states it here, so the structurer reads
+   *  this set where it would read the map's `shape`. A type this cannot resolve — an unexpanded
+   *  macro — is left out, which keeps the usage-inferred spelling. */
+  aggregates: ReadonlySet<string>;
+  /** The objects any byte of which is volatile (`hasVolatileStorage`): the object, an array's
+   *  element, a typedef in its chain, or a member of a struct or union in it, nested or anonymous.
+   *  A body this cannot read counts as volatile. The set is not per byte: a read of the plain member
+   *  of `struct { vu16 a; u16 b; }` is placed too, which costs at most a read the compiler kept that
+   *  the source did not ask it to, never one it may drop. raise/declared-volatile.ts stamps every
+   *  access to such an object the map does not lay out, and the structurer then puts the qualifier
+   *  on the cast (`*(volatile u16 *)&gV`). Scalars are in it too: the header already qualifies
+   *  `gReg` where it is spelled bare, and the stamp keeps the raising passes from merging two of its
+   *  reads. */
+  volatiles: ReadonlySet<string>;
+  /** The objects declared as a pointer whose pointee has a volatile byte, read as `volatiles` reads
+   *  an object: `extern volatile u16 *gP;`, `extern volatile struct V *gQ;`. The pointer itself is
+   *  plain, so a read of `gP` is not placed; an access through the value it holds is, and the
+   *  structurer puts the qualifier on the cast it is spelled through (`*(volatile u16 *)gP`).
+   *  Without it, `while (*gP == 0);` lifts as a plain read the compiler hoists out of the loop. */
+  pointeeVolatiles: ReadonlySet<string>;
+  /** Every object the context declares, volatile or not; a function is no object. Read beside
+   *  `volatiles`: an object here and not there is declared with no volatile byte, which is what the
+   *  dead-read pin's `declared-plain` gate reads (frontend/dead-reads.ts) — the source spelled a
+   *  read of it plain, so a read the target keeps that nothing uses is not the source's `volatile`. */
+  declared: ReadonlySet<string>;
+  /** The type each object of `declared` that is no array, pointer or function is declared as, as
+   *  written (`Q_t`, `struct Q`). An object passed bare as a struct by value must be declared as
+   *  that struct (frontend/call-plan.ts `foldByValueArgs`): `gQs` over `extern struct Q gQs[4];` or
+   *  `gO2` over `extern struct O2 gO2;` names the right address and is a type error as an argument
+   *  of `struct Q`. Compared by the struct it names (`structNamed`, which follows the typedefs),
+   *  not by spelling. */
+  objectTypes: ReadonlyMap<string, string>;
+  /** The struct or union each typedef name stands for, as far as its chain goes with no
+   *  derivation: by its tag (`struct Q`), or, for an untagged body, by the typedef name that binds
+   *  it. Read through `structNamed`, which is how two spellings of one struct are told to be one:
+   *  `typedef struct Q {…} Q;` spells the struct `Q`, `struct Q` and every other alias of it. */
+  structTypes: ReadonlyMap<string, string>;
+  /** The storage each object of `declared` that is no aggregate and no function is declared with,
+   *  its typedefs resolved (`declaredWidth`, `declaredSigned`): `extern s32 gN;` is a four-byte
+   *  signed integer, `extern u8 *gP;` a four-byte one whose sign nothing reads, `extern float gF;`
+   *  a four-byte float. A bare name reads and writes exactly this, so the structurer spells a
+   *  global bare only where its one access agrees (structure.ts, the declaration-shape override): a
+   *  byte read of `gN` is `*(u8 *)&gN`, never `gN`, and so is a halfword read of `gF`, which
+   *  reinterprets the bytes where the bare name would convert them. A type this cannot read — a
+   *  typedef carrying an attribute, an unexpanded macro, a name it never saw — is `unread`, which
+   *  agrees with no access: the cast states the access whatever the declaration is. A pointer
+   *  behind an attributed typedef is still read as one (`writtenDerivation`). A C++ reference is
+   *  a `reference`, whose cell no spelling names, so the structurer declines a function that
+   *  touches it. */
+  storage: ReadonlyMap<string, DeclaredStorage>;
+}
+
+/** What one declared object that is no aggregate occupies ({@link ContextGlobals.storage}). */
+export type DeclaredStorage =
+  /** an integer or a pointer of `bytes` bytes; `signed` says whether a read sign-extends it, `char`
+   *  for a plain `char`, whose sign is the compiler's (`compilerBehaviors.plainCharSigned`), and
+   *  undefined where nothing reads it (a pointer). A declaration with no type specifier at all
+   *  (`extern gN;`, C89's implicit `int`) is an `int`. */
+  | { kind: 'integer'; bytes: number; signed: boolean | 'char' | undefined }
+  /** an enum, whose size is the compiler's (`compilerBehaviors.enumBytes`), unless `unsized`: one
+   *  `packed` or holding a value an int cannot (`TypeTable.unsizedEnums`) is no size this knows */
+  | { kind: 'enum'; unsized: boolean }
+  /** a `float` (4 bytes) or a `double` (8) */
+  | { kind: 'float'; bytes: number }
+  /** a C++ reference (`extern int &gRef;`): the symbol is a cell holding the referent's address,
+   *  which no C++ spelling names — `gRef` and `&gRef` both name the referent */
+  | { kind: 'reference' }
+  /** a type this cannot read */
+  | { kind: 'unread' };
+
+/** The struct or union `spelling` names, qualifiers aside, by the identity `structTypes` keys it
+ *  under: `struct Tag` as written, or what a typedef name stands for. Undefined for any other
+ *  spelling, and for a name the context does not resolve to one — which then names no struct this
+ *  can compare, and the spellings are compared as written. */
+export function structNamed(
+  spelling: string,
+  context: Pick<ContextGlobals, 'structTypes'> | undefined,
+): string | undefined {
+  const s = spelling
+    .replace(/\b(?:const|volatile)\b/g, ' ')
+    .trim()
+    .replace(/\s+/g, ' ');
+  return /^(?:struct|union) [A-Za-z_$][\w$]*$/.test(s) ? s : context?.structTypes.get(s);
+}
+
+/** The globals a preprocessed declaration context declares, read for {@link ContextGlobals}. */
+export function globalsFromContext(src: string, language: Language): ContextGlobals {
+  const ctx = parseDeclarations(src, language);
+  const table = typeTable(ctx);
+  const scope: VolatileScope = { table, typedefs: typedefTypes(ctx), bodies: tagBodies(ctx), ctx, read: new Map() };
+  const aggregates = new Set<string>();
+  const volatiles = new Set<string>();
+  const pointeeVolatiles = new Set<string>();
+  const declared = new Set<string>();
+  const objectTypes = new Map<string, string>();
+  const storage = new Map<string, DeclaredStorage>();
+  for (const d of ctx.declarations) {
+    if (d.specifiers.typedef || d.body !== undefined) {
+      continue;
+    }
+    const implicit = language === 'c' ? implicitIntObject(d, table) : undefined;
+    if (implicit !== undefined) {
+      declared.add(implicit);
+      objectTypes.set(implicit, 'int');
+      storage.set(implicit, { kind: 'integer', bytes: 4, signed: true });
+      if (d.specifiers.qualifiers.includes('volatile')) {
+        volatiles.add(implicit);
+      }
+    }
+    for (const x of d.declarators) {
+      if (x.name === undefined || !WORD.test(x.name)) {
+        continue;
+      }
+      const t = declaredType(d.specifiers, x.derivations);
+      if (t.derivations[0]?.kind !== 'function') {
+        declared.add(x.name);
+      }
+      if (t.derivations.length === 0) {
+        objectTypes.set(x.name, t.spelling);
+      }
+      if (isAggregate(t, table, scope.typedefs)) {
+        aggregates.add(x.name);
+      } else if (t.derivations[0]?.kind !== 'function') {
+        storage.set(x.name, declaredStorage(t, table, scope.typedefs, ctx.tokens));
+      }
+      if (hasVolatileStorage(t, scope, 0)) {
+        volatiles.add(x.name);
+      }
+      // derivations run outermost first: the object is a pointer, and what it points at is the rest
+      if (t.derivations[0]?.kind === 'pointer') {
+        const pointee = { ...t, derivations: t.derivations.slice(1) };
+        if (hasVolatileStorage(pointee, scope, 0)) {
+          pointeeVolatiles.add(x.name);
+        }
+      }
+    }
+  }
+  const structTypes = new Map<string, string>();
+  for (const name of scope.typedefs.keys()) {
+    const named = structOfTypedef(name, scope.typedefs);
+    if (named !== undefined) {
+      structTypes.set(name, named);
+    }
+  }
+  return { aggregates, volatiles, pointeeVolatiles, declared, objectTypes, structTypes, storage };
+}
+
+/** The object a C declaration with a storage class and no type specifier declares, C89's implicit
+ *  `int`: `extern gN;` reads as the type name `gN` with no declarator, since the parser cannot tell
+ *  a name from an unknown type with nothing after it. Only a lone word that names no type the
+ *  context declares and no base type is one. */
+function implicitIntObject(d: Declaration, table: TypeTable): string | undefined {
+  const { storage, type, unknownWords } = d.specifiers;
+  if (d.declarators.length > 0 || unknownWords.length > 0 || type.kind !== 'words' || type.words.length !== 1) {
+    return undefined;
+  }
+  const [w] = type.words;
+  const named =
+    !WORD.test(w) ||
+    table.typedefs.has(w) ||
+    table.enums.has(w) ||
+    table.named.has(w) ||
+    declaredWidth(w) !== undefined ||
+    ['void', 'float', 'double', '_Bool'].includes(w);
+  return !named && (storage.includes('extern') || storage.includes('static')) ? w : undefined;
+}
+
+/** The storage an object of type `t`, no aggregate and no function, is declared with
+ *  ({@link DeclaredStorage}). `written` is every typedef as written, an attributed one included
+ *  (`typedefTypes`), which `writtenDerivation` reads past. */
+function declaredStorage(
+  t: DeclaredType,
+  table: TypeTable,
+  written: ReadonlyMap<string, DeclaredType>,
+  tokens: Tokens,
+): DeclaredStorage {
+  const [first] = t.derivations;
+  if (first?.kind === 'reference') {
+    return { kind: 'reference' };
+  }
+  if (first !== undefined && !isPointer(first)) {
+    return { kind: 'unread' };
+  }
+  const r = resolve(t, table.typedefs, tokens);
+  // the derivation the type reaches, through a typedef the table does not read too
+  const behind = r.derivations[0] ?? writtenDerivation(r, written);
+  if (behind?.kind === 'reference') {
+    return { kind: 'reference' };
+  }
+  const spelled = spellType(r, tokens);
+  const bare = spelled
+    .replace(/\b(?:const|volatile)\b/g, ' ')
+    .trim()
+    .replace(/\s+/g, ' ');
+  const bits = declaredWidth(bare === '' ? 'int' : spelled);
+  if (bits !== undefined) {
+    const signed = bare === 'char' ? 'char' : declaredSigned(bare === '' ? 'int' : spelled);
+    return { kind: 'integer', bytes: bits / 8, signed };
+  }
+  if (r.derivations.length > 0) {
+    return { kind: 'unread' };
+  }
+  if (bare === 'float' || bare === 'double') {
+    return { kind: 'float', bytes: bare === 'float' ? 4 : 8 };
+  }
+  if (table.enums.has(bare) || (r.type.kind === 'tag' && r.type.keyword === 'enum')) {
+    return { kind: 'enum', unsized: table.unsizedEnums.has(bare) };
+  }
+  // A pointer behind a typedef that carries an attribute (`typedef u8 *P8
+  // __attribute__((aligned(4)));`), which the table leaves unread because the attribute may retype
+  // it (`realigns`). No attribute changes a pointer's width on these 32-bit targets — `aligned` and
+  // `__declspec(align)` move its alignment alone, and `mode` takes no pointer mode but the 4-byte
+  // one — so it is a 4-byte pointer, read and written bare as a word. Read `unread`, that word is
+  // cast to an integer, which mwcc refuses wherever it flows into a pointer (`gQ = *(s32 *)&gP;`).
+  return behind !== undefined && isPointer(behind)
+    ? { kind: 'integer', bytes: 4, signed: undefined }
+    : { kind: 'unread' };
+}
+
+/** The first derivation a type with none of its own reaches through the typedefs as written
+ *  (`typedefTypes`), an attributed one and a reference the type table does not read included:
+ *  `P8` over `typedef u8 *P8 __attribute__((aligned(4)));` is a pointer, `IR` over
+ *  `typedef int &IR;` a reference. Undefined where the chain ends at a base type or a name it
+ *  never saw. */
+function writtenDerivation(t: DeclaredType, written: ReadonlyMap<string, DeclaredType>): Derivation | undefined {
+  let cur = t;
+  for (let hops = 0; hops < 16 && cur.derivations.length === 0; hops++) {
+    const name = nameOf(cur);
+    const next = name === undefined ? undefined : written.get(name);
+    if (next === undefined || nameOf(next) === name) {
+      return undefined;
+    }
+    cur = next;
+  }
+  return cur.derivations[0];
+}
+
+/** The struct or union the typedef `name` stands for (`ContextGlobals.structTypes`): its tag where
+ *  the chain ends at one, else the last name in the chain, which binds the untagged body. */
+function structOfTypedef(name: string, typedefs: ReadonlyMap<string, DeclaredType>): string | undefined {
+  let binder = name;
+  let at = typedefs.get(name);
+  for (let hops = 0; hops < 16 && at !== undefined && at.derivations.length === 0; hops++) {
+    const t = at.type;
+    if (t.kind === 'tag') {
+      return t.keyword === 'struct' || t.keyword === 'union'
+        ? t.tag === undefined
+          ? binder
+          : `${t.keyword} ${t.tag}`
+        : undefined;
+    }
+    if (t.words.length !== 1 || at.unknownWords.length > 0) {
+      return undefined;
+    }
+    binder = t.words[0];
+    at = typedefs.get(binder);
+  }
+  return undefined;
+}
+
+/** Every struct, union and class body the context defines, by `keyword Tag` (and, in C++, by the bare
+ *  tag, as C++ spells one), attributed or not, at the top level and nested in another body. */
+function tagBodies(ctx: ParsedContext): Map<string, Range> {
+  const out = new Map<string, Range>();
+  const visit = (ds: readonly Declaration[], depth: number): void => {
+    for (const d of ds) {
+      const t = d.specifiers.type;
+      if (t.kind !== 'tag' || t.keyword === 'enum' || t.body === undefined) {
+        continue;
+      }
+      if (t.tag !== undefined && WORD.test(t.tag)) {
+        out.set(`${t.keyword} ${t.tag}`, t.body);
+        if (ctx.language === 'c++') {
+          out.set(t.tag, t.body);
+        }
+      }
+      const members = depth < 8 ? memberDeclarations(ctx, t.body) : undefined;
+      if (members !== undefined) {
+        visit(members, depth + 1);
+      }
+    }
+  };
+  visit(ctx.declarations, 0);
+  return out;
+}
+
+/** Every typedef name the context declares, and the type it stands for as written: with the body a
+ *  typedef defines (`typedef struct { vu8 a; } S;`), its qualifiers (`typedef volatile struct {…} S;`)
+ *  and an array's bounds (`typedef vu8 Buf[4];`), none of which the type table keeps — it binds a
+ *  body's name to the name itself, and it reads no typedef of an array. */
+function typedefTypes(ctx: ParsedContext): Map<string, DeclaredType> {
+  const out = new Map<string, DeclaredType>();
+  for (const d of ctx.declarations) {
+    if (!d.specifiers.typedef) {
+      continue;
+    }
+    for (const x of d.declarators) {
+      const t = declaredType(d.specifiers, x.derivations);
+      // `typedef S S;` restates a name and keeps the type it already stands for
+      const restates = t.type.kind === 'words' && t.type.words.length === 1 && t.type.words[0] === x.name;
+      if (x.name !== undefined && WORD.test(x.name) && !(restates && t.derivations.length === 0)) {
+        out.set(x.name, t);
+      }
+    }
+  }
+  return out;
+}
+
+/** What `hasVolatileStorage` reads a type through, and what it has already read: each typedef name
+ *  and each body by its first token, so a type every member reaches through the same typedefs
+ *  (`mActor_name_t`, then `u16`) is walked once, and a long chain of them costs no nesting depth. */
+interface VolatileScope {
+  table: TypeTable;
+  typedefs: ReadonlyMap<string, DeclaredType>;
+  bodies: ReadonlyMap<string, Range>;
+  ctx: ParsedContext;
+  read: Map<string, boolean>;
+}
+
+/** Whether any byte of an object of type `t` is volatile: the type or an array's element is
+ *  qualified, through the typedef names it is built on, or a struct or union in it has such a member.
+ *  A pointer ends the walk at its own qualifiers, since what it points at is no byte of the object.
+ *  A body that cannot be read, or bodies nested past the bound, is read as volatile: a qualifier
+ *  placed where none was declared only keeps a read the compiler may have dropped. A tag with no
+ *  body here has no member to qualify.
+ *  A name met again while it is being read is a cycle, read as volatile (`once`). */
+function hasVolatileStorage(t: DeclaredType, scope: VolatileScope, depth: number): boolean {
+  if (depth > 32) {
+    return true;
+  }
+  for (const x of t.derivations) {
+    if (x.kind === 'pointer') {
+      return x.qualifiers.includes('volatile');
+    }
+    if (x.kind !== 'array') {
+      return false;
+    }
+  }
+  // GNU's alternate spellings, which the declaration parser keeps as words it does not know, or as
+  // the type's own name when a typedef name follows (`__volatile__ u8 a;`)
+  const words = t.type.kind === 'words' ? [...t.type.words, ...t.unknownWords] : t.unknownWords;
+  if (t.qualifiers.includes('volatile') || words.some((w) => w === '__volatile' || w === '__volatile__')) {
+    return true;
+  }
+  let body: Range | undefined;
+  if (t.type.kind === 'tag') {
+    if (t.type.keyword === 'enum') {
+      return false;
+    }
+    body = t.type.body ?? (t.type.tag !== undefined ? scope.bodies.get(`${t.type.keyword} ${t.type.tag}`) : undefined);
+  } else if (t.type.words.length === 1) {
+    const name = t.type.words[0];
+    const next = scope.typedefs.get(name);
+    if (next !== undefined) {
+      const resolves = next.type.kind === 'words' && next.type.words.length === 1 && next.type.words[0] === name;
+      return !resolves && once(scope, `typedef ${name}`, () => hasVolatileStorage(next, scope, depth));
+    }
+    body = scope.table.named.get(name)?.body ?? scope.bodies.get(name);
+  }
+  if (body === undefined) {
+    return false;
+  }
+  const members = memberDeclarations(scope.ctx, body);
+  const bases = baseClause(scope.ctx, body);
+  if (members === undefined || bases === undefined) {
+    return true;
+  }
+  // a C++ member typedef names a type for the members after it, so they are read through it, in a
+  // scope of their own. That scope also reads a body defined elsewhere through it, which can only
+  // leave more out.
+  const local = typedefTypes({ ...scope.ctx, declarations: members });
+  const inner: VolatileScope =
+    local.size === 0 ? scope : { ...scope, typedefs: new Map([...scope.typedefs, ...local]), read: new Map() };
+  return once(
+    scope,
+    `body ${body.from}`,
+    () =>
+      // a C++ base's members are bytes of the object too, and a base with no body here (one a
+      // namespace defines, which this does not read) is read as volatile
+      bases.some((b) => !definesBody(b, inner) || hasVolatileStorage(b, inner, depth + 1)) ||
+      members.some((m) =>
+        // a C++ member typedef or static member is no byte of the object
+        m.specifiers.typedef || m.specifiers.storage.includes('static')
+          ? false
+          : m.declarators.length === 0
+            ? hasVolatileStorage(declaredType(m.specifiers, []), inner, depth + 1)
+            : m.declarators.some((x) =>
+                hasVolatileStorage(declaredType(m.specifiers, x.derivations), inner, depth + 1),
+              ),
+      ),
+  );
+}
+
+/** The C++ base classes ahead of `body`, each as the type its name spells, or undefined when a
+ *  clause holds anything else (a qualified name, a template argument list, `decltype`), which the
+ *  caller reads as volatile. Read backwards from the `{` to the clause's `:`; reaching the
+ *  tag keyword first means there is no clause. */
+function baseClause(ctx: ParsedContext, body: Range): DeclaredType[] | undefined {
+  if (ctx.language !== 'c++') {
+    return [];
+  }
+  const t = ctx.tokens;
+  let k = body.from - 2;
+  for (; k >= 0 && !t.is(k, ':'); k--) {
+    if (TAG_KEYWORDS.has(t.text(k))) {
+      return [];
+    }
+    if (t.kind(k) !== 'identifier' && !t.is(k, '::') && !t.is(k, ',')) {
+      // an attribute, a template argument list: a `:` between it and the tag keyword is a clause
+      // this does not read, and none means there is no clause
+      for (let j = k; j >= 0 && !t.is(j, ';') && !t.is(j, '}') && !t.is(j, '{') && !TAG_KEYWORDS.has(t.text(j)); j--) {
+        if (t.is(j, ':')) {
+          return undefined;
+        }
+      }
+      return [];
+    }
+  }
+  if (k < 0) {
+    return [];
+  }
+  const out: DeclaredType[] = [];
+  let last: string | undefined;
+  for (let j = k + 1; j < body.from; j++) {
+    if (t.is(j, ',') || j === body.from - 1) {
+      if (last === undefined) {
+        return undefined;
+      }
+      out.push({
+        qualifiers: [],
+        type: { kind: 'words', words: [last] },
+        unknownWords: [],
+        spelling: last,
+        derivations: [],
+      });
+      last = undefined;
+    } else if (t.is(j, '::')) {
+      return undefined;
+    } else if (t.kind(j) === 'identifier' && !BASE_WORDS.has(t.text(j))) {
+      last = t.text(j);
+    }
+  }
+  return out;
+}
+
+/** Whether the base `b` names a typedef or a body this context defines. */
+function definesBody(b: DeclaredType, scope: VolatileScope): boolean {
+  const name = b.spelling;
+  return scope.typedefs.has(name) || scope.table.named.get(name)?.body !== undefined || scope.bodies.has(name);
+}
+
+const TAG_KEYWORDS: ReadonlySet<string> = new Set(['struct', 'class', 'union', 'enum']);
+const BASE_WORDS: ReadonlySet<string> = new Set(['public', 'protected', 'private', 'virtual']);
+
+/** `read()`, remembered under `key`. A key met again while it is being read is a cycle no compiler
+ *  lays out (`typedef T U; typedef U T;`, which C11 and C++ accept), read as volatile, for the same
+ *  reason as an unreadable body. */
+function once(scope: VolatileScope, key: string, read: () => boolean): boolean {
+  const known = scope.read.get(key);
+  if (known !== undefined) {
+    return known;
+  }
+  scope.read.set(key, true);
+  const v = read();
+  scope.read.set(key, v);
+  return v;
+}
+
+/** Whether `t` is a struct, union, class or array type, through the typedef names it is built on.
+ *  A typedef the type table does not read — one of an array, `typedef u16 Arr4[4];` — is followed
+ *  as written (`typedefTypes`), or `extern Arr4 gTB;` reads as a scalar whose offset-0 read is
+ *  spelled `gTB`, the array's address. */
+function isAggregate(t: DeclaredType, table: TypeTable, written: ReadonlyMap<string, DeclaredType>): boolean {
+  let cur = t;
+  for (let hops = 0; hops < 16; hops++) {
+    const [first] = cur.derivations;
+    if (first !== undefined) {
+      return first.kind === 'array';
+    }
+    if (cur.type.kind === 'tag') {
+      return cur.type.keyword !== 'enum';
+    }
+    const name = nameOf(cur);
+    if (name === undefined) {
+      return false;
+    }
+    if (table.named.has(name)) {
+      return true;
+    }
+    const next = table.typedefs.get(name) ?? written.get(name);
+    if (next === undefined || nameOf(next) === name) {
+      return false;
+    }
+    cur = next;
+  }
+  return false;
+}
+
 const WORD = /^[A-Za-z_]\w*$/;
 
 /** `mode(…)` in an attribute, in either spelling: it retypes what it is written on */
@@ -165,6 +674,14 @@ function readTag(
   if ((attributed || wide) && name !== undefined) {
     table.unsizedEnums.add(`enum ${name}`);
   }
+  // In C++ an enum's tag names its type with no keyword, as a typedef bound to its body does in C
+  // (`readTypedefs`), so the bare `Fmt` of `enum Fmt { … }` is that enum, sized as it is.
+  if (ctx.language === 'c++' && name !== undefined) {
+    table.enums.add(name);
+    if (attributed || wide) {
+      table.unsizedEnums.add(name);
+    }
+  }
   return attributed || wide;
 }
 
@@ -580,17 +1097,82 @@ function memberShape(
   return { name: d.name, pointer: stars.length > 0, ...(dims.length > 0 ? { dims } : {}), returns: [] };
 }
 
+/** A declaration's reading: the entry as written, the `key` two declarations are compared by, and
+ *  the `lists` of every declaration it stands for, which say whether a declaration that states no
+ *  parameters can be one with a declaration that does (`composable`). */
+type Read = { proto: FnProto; key: FnProto; lists: readonly ParameterList[] };
+
+/** What a declaration's parentheses say of its parameters, as `composable` needs it: `()` in C,
+ *  which states none; a list this could not read, with how many FIXED parameters its top-level commas
+ *  separate and whether it ends in `...`; or a list it read, with whether every parameter keeps its
+ *  type under the default argument promotions (C99 6.5.2.2p6) — undefined where one may not. */
+type ParameterList =
+  | { kind: 'unstated' }
+  | { kind: 'unread'; fixed: number; variadic: boolean }
+  | { kind: 'read'; fixed: number; variadic: boolean; promotes: boolean };
+
 /** Every function the declarations name by a plain identifier, keyed by it. A declaration that
  *  spells no type is a constructor's, a destructor's or a conversion operator's; one that defines a
  *  body, or spells a `class`, declares no C function. */
 function functionPrototypes(ctx: ParsedContext, table: TypeTable, layoutOf: LayoutOf): Prototypes {
-  const found = new Map<string, FnProto | null>();
+  const found = new Map<string, Read | null>();
+  const written = typedefTypes(ctx);
   // a function one of whose declarations retypes a parameter with `mode`, which gives it the type
   // the mode names in place of the one spelled (c-common.c:563): compiled, `int x
   // __attribute__((mode(DI)))` takes a register pair. Its parameters are not read, in any
   // declaration of it; its return is.
   const unreadParams = new Set<string>();
-  const returnOnly = ({ params: _unread, ...rest }: FnProto): FnProto => rest;
+  // Two declarations of one function name one type, and the entry is that type's: the same reading
+  // twice, or — in C — a declaration whose parameters are not read (`()`, which states none, or a
+  // list this cannot read, `const char *restrict fmt`) beside one whose are, where the return reads
+  // alike and the two are COMPATIBLE (`composable`). The C compiler takes the composite of the two
+  // (C99 6.2.7p3), which is the one that states the parameters, so the entry is that one: dropping
+  // the name would drop the refusals its parameters carry with it, and send the call to the arity
+  // guess. Anything else is a conflict (C++ overloads, or a header this misreads), and the name is
+  // dropped.
+  //
+  // A `()` is read with a list only where it PRECEDES it: one that follows a list is a conflict,
+  // whatever the types (below). And `()` beside a list that is not compatible with it is no
+  // composite: agbcc, gcc2.7.2kmc and
+  // gcc2.7.2 compile `void f(char); void f();` without a word, the later `()` wins, and a call is
+  // compiled UNPROTOTYPED — any arity, no conversion. Read as `f(char)`, `f(1, 2)` would lift as
+  // `f(1)`, and `f(5)` under `f(short, char)` as `f(5, a1)`.
+  const unstated = (p: FnProto) => p.params === undefined && p.variadicParams === undefined;
+  const merged = (kept: Read, a: Read, b: Read): Read => ({ ...kept, lists: [...a.lists, ...b.lists] });
+  const composite = (a: Read, b: Read): Read | null => {
+    if (b.lists.some((l) => l.kind === 'unstated') && a.lists.some((l) => l.kind === 'read')) {
+      // a `()` AFTER a parameter list: mwcc (2.4.2, 2.4.7, 2.3.3) lets it replace the prototype
+      // outright, even where every parameter is a word — `void f(int); void f();` compiles `f(1, 2)`
+      // as two arguments, `f(1.5)` in f1, and `f(1)` under `void f(double)` in r3 — so the list is
+      // no fact about the call. Read as the list, `f(1, 2)` lifts as `f(1)`. gcc and IDO reject what
+      // that call would need, so nothing is lost on them by a conflict.
+      return null;
+    }
+    if (same(a.key, b.key)) {
+      return merged(b, a, b);
+    }
+    // …and where the list follows a `()` that itself followed a list this could not read, the `()`
+    // still replaced it: the two keep their return (`same`, above), and no later list joins them
+    const all = [...a.lists, ...b.lists];
+    if (
+      ctx.language !== 'c' ||
+      all.some((l, i) => l.kind === 'unstated' && all.slice(0, i).some((m) => m.kind !== 'unstated'))
+    ) {
+      return null;
+    }
+    if (unstated(a.key) && same(a.key, returnOnly(b.key)) && composable(a.lists, b.lists)) {
+      return merged(b, a, b);
+    }
+    return unstated(b.key) && same(b.key, returnOnly(a.key)) && composable(b.lists, a.lists) ? merged(a, a, b) : null;
+  };
+  const returnOnly = ({
+    params: _unread,
+    wordParams: _words,
+    byValueParams: _copies,
+    byValueLayouts: _layouts,
+    variadicParams: _fixed,
+    ...rest
+  }: FnProto): FnProto => rest;
   for (const d of ctx.declarations) {
     const s = d.specifiers;
     if (
@@ -614,15 +1196,40 @@ function functionPrototypes(ctx: ParsedContext, table: TypeTable, layoutOf: Layo
       if (retyped) {
         unreadParams.add(x.name);
       }
-      const read = readSignature(declaredType(s, returns), fn, ctx, table.typedefs, (t) => layoutOf(t, 0));
-      const proto = unreadParams.has(x.name) ? returnOnly(read) : read;
+      const reading = (qualifiers: 'kept' | 'dropped') =>
+        readSignature(
+          declaredType(s, returns),
+          fn,
+          ctx,
+          table.typedefs,
+          (t) => layoutOf(t, 0),
+          (t) => passingOf(t, table, written),
+          qualifiers,
+        );
+      const read = reading('kept');
+      // what the declaration says of the function's TYPE, which is what two declarations of it are
+      // compared by: a parameter's top-level qualifiers are not part of it (C99 6.7.5.3p15), so
+      // `void takeW(const struct W w);` and `void takeW(struct W w);` declare one function. Read
+      // as a conflict, they would drop the name, and with it every refusal its entry carries
+      // (`byValueRefusal`, `variadicRefusal`): the call would take the arity guess they exist to
+      // refuse. The entry kept is the later declaration's, spelled as written.
+      const typed = reading('dropped');
+      const [proto, key] = unreadParams.has(x.name) ? [returnOnly(read), returnOnly(typed)] : [read, typed];
+      const lists = [parameterList(fn, ctx, table.typedefs, (t) => passingOf(t, table, written))];
       const prior = found.get(x.name);
-      const had = prior && unreadParams.has(x.name) ? returnOnly(prior) : prior;
-      found.set(x.name, had === undefined || same(had, proto) ? proto : null);
+      const had =
+        prior && unreadParams.has(x.name)
+          ? { ...prior, proto: returnOnly(prior.proto), key: returnOnly(prior.key) }
+          : prior;
+      found.set(
+        x.name,
+        had === undefined ? { proto, key, lists } : had === null ? null : composite(had, { proto, key, lists }),
+      );
     }
   }
   const out: Prototypes = {};
-  for (const [name, p] of found) {
+  for (const [name, read] of found) {
+    const p = read?.proto ?? null;
     const valid = p === null ? undefined : admissible(name, p);
     if (valid !== undefined) {
       out[name] = valid;
@@ -631,6 +1238,101 @@ function functionPrototypes(ctx: ParsedContext, table: TypeTable, layoutOf: Layo
   return out;
 }
 
+/** Whether declarations that state no parameters (`unstated`, each `()` or a list this could not
+ *  read) are compatible with ones that state them (`stated`), as two declarations of one C function
+ *  must be for their composite to be the stated one (C99 6.7.5.3p15). `()` is compatible with a
+ *  list that is not variadic and whose every parameter keeps its type under the default argument
+ *  promotions: not `char`, `short`, `float`, `_Bool`, nor a typedef or an enum that may be one — an
+ *  enum's type is the compiler's to pick, and it may be narrow (`-fshort-enums`, mwcc's `-enum
+ *  min`). A name the context never resolves is read by its spelling as `declaredWidth` reads it
+ *  (`s32` is a word, `u8` a byte) and is otherwise taken to promote. An unread list is compatible with a list of as many fixed parameters, variadic alike. */
+function composable(unstated: readonly ParameterList[], stated: readonly ParameterList[]): boolean {
+  const lists = stated.filter((l) => l.kind === 'read');
+  return (
+    lists.length > 0 &&
+    unstated.every((u) =>
+      lists.every((l) =>
+        u.kind === 'unstated'
+          ? !l.variadic && !l.promotes
+          : u.kind === 'unread' && u.fixed === l.fixed && u.variadic === l.variadic,
+      ),
+    )
+  );
+}
+
+/** Whether `fn`'s parentheses are C's empty list: `(void)`, or one parameter whose type is `void`
+ *  through a typedef (`typedef void V; int k(V);`, C99 6.7.5.3p10). Read as a list of one
+ *  parameter spelled `void`, the second would have the call pass a register nothing set up for it
+ *  (`k()` as `k(a0)`). */
+function isVoidList(
+  fn: Extract<Derivation, { kind: 'function' }>,
+  tokens: Tokens,
+  typedefs: ReadonlyMap<string, DeclaredType>,
+): boolean {
+  if (fn.list.to === fn.list.from + 1 && tokens.is(fn.list.from, 'void')) {
+    return true;
+  }
+  const only = fn.params?.length === 1 && !fn.variadic ? fn.params[0] : undefined;
+  return (
+    only !== undefined &&
+    spellType(resolve(declaredType(only.specifiers, only.declarator.derivations), typedefs, tokens), tokens) === 'void'
+  );
+}
+
+/** What `fn`'s parentheses say of its parameters (`ParameterList`). */
+function parameterList(
+  fn: Extract<Derivation, { kind: 'function' }>,
+  { tokens, language }: ParsedContext,
+  typedefs: ReadonlyMap<string, DeclaredType>,
+  passing: (t: DeclaredType) => Passing,
+): ParameterList {
+  const { params, list } = fn;
+  if (params === undefined) {
+    // the top-level commas, and a trailing `...`
+    let items = list.to > list.from ? 1 : 0;
+    let variadic = false;
+    for (let i = list.from; i < list.to; i++) {
+      const close = tokens.match(i);
+      if (close > i) {
+        i = close;
+      } else if (tokens.is(i, ',')) {
+        items++;
+      } else if (tokens.is(i, '...')) {
+        variadic = true;
+      }
+    }
+    return { kind: 'unread', fixed: variadic ? items - 1 : items, variadic };
+  }
+  if (params.length === 0 && !fn.variadic && language === 'c') {
+    return { kind: 'unstated' };
+  }
+  if (isVoidList(fn, tokens, typedefs)) {
+    return { kind: 'read', fixed: 0, variadic: false, promotes: false };
+  }
+  const promotes = params.some((p) => {
+    const declared = asParameter(declaredType(p.specifiers, p.declarator.derivations));
+    if (passing(declared) === 'by-value') {
+      // a struct, union or class, which no promotion converts
+      return false;
+    }
+    const t = resolve(declared, typedefs, tokens);
+    if (t.derivations.length > 0) {
+      // a pointer, or an array or a function the parameter adjusts to one
+      return false;
+    }
+    if (t.type.kind === 'tag') {
+      return t.type.keyword === 'enum';
+    }
+    const spelled = spellType(withoutTopQualifiers(t), tokens);
+    if (spelled === 'double' || spelled === 'long double') {
+      return false;
+    }
+    const width = declaredWidth(spelled);
+    return width === undefined || width < 32;
+  });
+  return { kind: 'read', fixed: params.length, variadic: fn.variadic, promotes };
+}
+
 /** The entry as a table `validatePrototypes` accepts, the check every `--proto` table passes, so a
  *  context's prototypes can travel as one: a `returns` it refuses is dropped — a return wider than a
  *  register with a parameter list that cannot be printed — and the entry with it if that is not
@@ -649,6 +1351,8 @@ function readSignature(
   { tokens, language }: ParsedContext,
   typedefs: ReadonlyMap<string, DeclaredType>,
   layoutOf: (t: DeclaredType) => AggregateLayout | undefined,
+  passing: (t: DeclaredType) => Passing,
+  qualifiers: 'kept' | 'dropped' = 'kept',
 ): FnProto {
   const proto: FnProto = {};
   const resolved = resolve(ret, typedefs, tokens);
@@ -689,34 +1393,146 @@ function readSignature(
     }
     return proto;
   }
-  if (fn.list.to === fn.list.from + 1 && tokens.is(fn.list.from, 'void')) {
+  if (isVoidList(fn, tokens, typedefs)) {
     proto.params = [];
     return proto;
   }
+  // Each parameter's type, its name taken off: an array or a function nearest the name is a
+  // pointer, and the typedef names it is built on resolve as a return's do. A spelling that sizes to
+  // nothing and is no floating type is read through those names for what it positively is: a type
+  // that still travels in one register — an enum, or an array or function type behind a typedef
+  // name, which the parameter adjusts to a pointer (`GXTexFmt`, `Mtx`, `__va_list`) — listed in
+  // `FnProto.wordParams`; or a struct, union or class passed BY VALUE, which mwcc passes as the
+  // address of a copy in the caller's frame — listed in `FnProto.byValueParams`. A name the context
+  // never resolves is in neither, and every reader leaves it unsized.
+  //
+  // A VARIADIC declaration's are read alike and kept as its fixed parameters (`variadicParams`): its
+  // arity is the call's, so they are no `params`, and no layout is read for a struct among them,
+  // whose call refuses (`variadicRefusal`).
+  const types = params.map((p) => asParameter(declaredType(p.specifiers, p.declarator.derivations)));
+  const spelled = types.map((t) => {
+    const r = resolve(t, typedefs, tokens);
+    return spellType(qualifiers === 'kept' ? r : withoutTopQualifiers(r), tokens);
+  });
   if (fn.variadic) {
-    return proto;
+    proto.variadicParams = spelled;
+  } else {
+    proto.params = spelled;
+  }
+  const unsized = (k: number) => declaredWidth(spelled[k]) === undefined && !isFloatingSpelling(spelled[k]);
+  const listed = (as: Passing) => types.flatMap((t, k) => (unsized(k) && passing(t) === as ? [k] : []));
+  const words = listed('word');
+  const copies = listed('by-value');
+  if (words.length > 0) {
+    proto.wordParams = words;
+  }
+  if (copies.length > 0) {
+    proto.byValueParams = copies;
+  }
+  if (copies.length > 0 && !fn.variadic) {
+    // …and the members of each one the context defines, which size it (`FnProto.byValueLayouts`)
+    const layouts = Object.fromEntries(
+      copies.flatMap((k) => {
+        const l = layoutOf(resolve(types[k], typedefs, tokens));
+        return l === undefined ? [] : [[k, l] as const];
+      }),
+    );
+    if (Object.keys(layouts).length > 0) {
+      proto.byValueLayouts = layouts;
+    }
   }
-  proto.params = params.map((p) => parameterType(p, tokens, typedefs));
   return proto;
 }
 
-/** A parameter's type, its name taken off: an array or a function nearest the name is a pointer, and
- *  the typedef names it is built on resolve as a return's do. */
-function parameterType(p: Parameter, tokens: Tokens, typedefs: ReadonlyMap<string, DeclaredType>): ParamType {
-  const t = asParameter(declaredType(p.specifiers, p.declarator.derivations));
-  return spellType(resolve(t, typedefs, tokens), tokens);
+/** `t` less its top-level qualifiers: the derivation nearest the name's (`char *const`), or the
+ *  base's where there is none (`const struct W`). A pointer's target keeps its own (`const char *`). */
+function withoutTopQualifiers(t: DeclaredType): DeclaredType {
+  const [first, ...rest] = t.derivations;
+  if (first === undefined) {
+    return { ...t, qualifiers: [] };
+  }
+  return first.kind === 'pointer' ? { ...t, derivations: [{ ...first, qualifiers: [] }, ...rest] } : t;
+}
+
+/** How a parameter of type `t` is passed, read through the typedef names it is built on: in ONE
+ *  WORD — an enum the target sizes; a pointer; an array or a function, which a parameter adjusts to
+ *  a pointer — or BY VALUE, a struct, union or class (a tag, or a name bound to a body). Undefined
+ *  where nothing here says: a name this never saw, or an enum the target does not size
+ *  (`unsizedEnums`: `packed`, or a value an int cannot hold), which may take two words. */
+type Passing = 'word' | 'by-value' | undefined;
+
+function passingOf(t: DeclaredType, table: TypeTable, written: ReadonlyMap<string, DeclaredType>): Passing {
+  let cur = t;
+  for (let hops = 0; hops < 16; hops++) {
+    const [first] = cur.derivations;
+    if (first !== undefined) {
+      return first.kind === 'array' || first.kind === 'function' || first.kind === 'reference' || isPointer(first)
+        ? 'word'
+        : undefined;
+    }
+    if (cur.type.kind === 'tag') {
+      const { keyword, tag } = cur.type;
+      if (keyword !== 'enum') {
+        return 'by-value';
+      }
+      return tag !== undefined && table.unsizedEnums.has(`enum ${tag}`) ? undefined : 'word';
+    }
+    const name = nameOf(cur);
+    if (name === undefined) {
+      return undefined;
+    }
+    if (table.named.has(name)) {
+      return 'by-value';
+    }
+    if (table.enums.has(name)) {
+      return table.unsizedEnums.has(name) ? undefined : 'word';
+    }
+    const next = table.typedefs.get(name) ?? written.get(name);
+    if (next === undefined || nameOf(next) === name) {
+      return undefined;
+    }
+    cur = next;
+  }
+  return undefined;
 }
 
 /** The prototypes a lift of `own` reads when a context is in hand: `stated` — a caller's own
  *  prototypes, which win per name — over the context's declarations less those the symbol map
- *  states better (`contextPrototypesUnder`). `own`'s declaration is left out, as the map's is
- *  (`asIfUndecompiled`): a header's signature for the function being decompiled is that kind of
- *  fact, and only what the caller states about it is kept.
+ *  states better (`contextPrototypesUnder`). `own`'s declaration is left out of the table, as the
+ *  map's is (`asIfUndecompiled`): a header's signature for the function being decompiled was written
+ *  with no compiler checking it against a definition while the function was still `INCLUDE_ASM`, so
+ *  it is not stated, and only what the caller states about it bounds the lift HARD.
+ *
+ *  IT BOUNDS THE ARGUMENT REGISTERS SOFTLY INSTEAD ({@link ownContextEntry}, pipeline.ts
+ *  `liftWithinContextBound`). A hard bound puts the risk on the very functions a user decompiles:
+ *  an entry too short turns a real argument into `uninit_<reg>` — wrong C, where every other error
+ *  of the bound only keeps a parameter — and sbk2 has 16 `void f(void);` task callbacks whose
+ *  bodies read a0. The soft bound drops only the registers past the entry that the finished lift
+ *  never reads; one it reads (or one the machine homes to a slot, as IDO -g3 does) stays a
+ *  parameter, with an `[own-arity]` note naming the declaration and the register. (On kleod, whose
+ *  every header its compiler checked, the entry stated as a hard bound takes the lifts with more
+ *  parameters than their header from 52 of 377 to 1 of 373.) Only a typed list the bound can lay
+ *  out is handed over; every other shape abstains. A struct the entry returns through memory is
+ *  read on the same soft footing (pipeline.ts `returnOwnStruct`): lifted as that struct where the
+ *  machine proves the hidden pointer is only its storage, and kept as the pointer function with an
+ *  `[own-return]` note where it does not.
+ *
+ *  The benchmark hands each row the same entry (`withOwnContextMark`, apps/benchmark
+ *  context-proto.ts `rowPrototypes`) where its manifest `proto` states none for the row's own
+ *  function, as m2c's vendored context already carries it; not every real row restates its own
+ *  header entry as `proto`. A user who trusts the entry outright restates it with `--proto`, which
+ *  bounds hard.
  *
  *  A stated entry that says nothing of the return (`statesNoReturn`, which counts `returnsVoid:
- *  false` as nothing) keeps a struct return the context states: it is what says argument 0 may be
- *  a hidden pointer, and an entry stating only the arity would otherwise hand that pointer to the
- *  call as its first argument. */
+ *  false` as nothing) keeps the context's return by `contextReturnUnder`'s rule: a struct return
+ *  always — it is what says argument 0 may be a hidden pointer, and an entry stating only the arity
+ *  would otherwise hand that pointer to the call as its first argument; a register return only
+ *  where the stated `params` number as many as the header's parameters. A list is parameters; a
+ *  COUNT is argument registers (`FnProto.params`), and it is compared with the header's parameter
+ *  count all the same, so under a 64-bit parameter a correct register count keeps no return. That
+ *  costs a lift, never a wrong one: a return kept is the header's own, and one dropped declines as
+ *  an undeclared callee does. `{ returnsVoid: false }` alone states no count, so it keeps no
+ *  register return. */
 export function withContextPrototypes(
   stated: Prototypes | undefined,
   context: Prototypes,
@@ -729,21 +1545,131 @@ export function withContextPrototypes(
   for (const [name, p] of Object.entries(stated ?? {})) {
     const heard = Object.hasOwn(callees, name) ? callees[name] : undefined;
     if (p && statesNoReturn(p)) {
-      out[name] = { ...p, ...aggregateReturnOf(heard) };
+      // `heard` is the entry as the map left it: its return, where it has one, is either the whole
+      // context entry's or one `contextPrototypesUnder` already checked against the map
+      out[name] = { ...p, ...contextReturnUnder(heard ?? undefined, p.params, undefined) };
     }
   }
   return out;
 }
 
-/** The keys that state `p`'s struct or union return, or none where it states no such return. */
-function aggregateReturnOf(p: FnProto | undefined): Pick<FnProto, 'returns' | 'returnLayout'> {
-  if (p === undefined || !declaresAggregateReturn(p)) {
-    return {};
+/** THE CONTEXT'S OWN ENTRY FOR `own`, where it is a TYPED LIST a lift may bound its argument
+ *  registers by — the entry `withContextPrototypes` leaves out — and `undefined` everywhere else.
+ *
+ *  It has two readers, and both are SOFT. The context bound (pipeline.ts `liftWithinContextBound`):
+ *  a register past it that the lift goes on to read stays a parameter, so a header entry too short
+ *  costs a diagnostic, never `uninit_<reg>`. And the entry's struct return (pipeline.ts
+ *  `ownStructReturnThroughMemory`), lifted as that struct only where the machine proves the hidden
+ *  pointer is its storage, and kept as the pointer function with an `[own-return]` note where it
+ *  does not. An entry whose every parameter the bound can lay out is handed over, and so is one
+ *  that returns a struct or union by value whatever its parameters say, since what the return reads
+ *  is the return alone: a hidden pointer comes first in every parameter list, `...` or a struct
+ *  passed by value included (kleod's `struct Unk_0800BEF0_2 sub_0800BEF0(struct Unk_0800BEF0)`).
+ *  The bound reads such an entry through `ownArgumentWordsOn`, which lays out none of those lists
+ *  and so bounds nothing. Where the entry returns no struct, every other shape ABSTAINS:
+ *   - no entry, or one the context dropped (two declarations that conflict: C++ overloads);
+ *   - a variadic declaration (`variadicParams`, no `params`): its arity is each caller's;
+ *   - `()` (no `params` at all): it states none, and a K&R definition may take any;
+ *   - a struct passed by value, or a spelling nothing here sizes: either may fill any number of
+ *     words;
+ *   - a symbol that names a C++ member function or a mangled free function, whose declaration the
+ *     context does not key by the symbol; a context naming one the same is not its declaration, so
+ *     this abstains on it whatever it returns.
+ *  A bare count is no context entry (`prototypesFromContext` reads lists), and abstains as well. */
+export function ownContextEntry(context: Prototypes, own: string): FnProto | undefined {
+  const p = Object.hasOwn(context, own) ? context[own] : undefined;
+  if (p === undefined || p === null || typeof p.params === 'number') {
+    return undefined;
   }
-  return {
-    ...(p.returns !== undefined ? { returns: p.returns } : {}),
-    ...(p.returnLayout !== undefined ? { returnLayout: p.returnLayout } : {}),
-  };
+  if (demangledName(own) !== null || implicitArgumentWords(own) !== 0) {
+    return undefined;
+  }
+  if (declaresAggregateReturn(p)) {
+    return p;
+  }
+  if (!Array.isArray(p.params) || p.variadicParams !== undefined) {
+    return undefined;
+  }
+  const params = p.params;
+  const laidOut = params.every((_, k) => {
+    const cls = paramClassOf(p, params, k);
+    return cls === 'word' || cls === 'wide' || cls === 'float';
+  });
+  return laidOut ? p : undefined;
+}
+
+/** A TABLE'S OWN CONTEXT ENTRY, TAKEN OUT OF IT: where `prototypes`' entry for `own` carries the
+ *  mark (`FnProto.fromContext`), the table without it, and the entry as the soft bound reads it
+ *  ({@link ownContextEntry}, which abstains on any shape it cannot lay out); otherwise the table as
+ *  it is. `given` — an entry the caller hands over beside the table — wins over a marked one.
+ *
+ *  Every entry path asks this before any reader looks at the table, so a marked entry is never
+ *  read as a stated one: a stated entry bounds hard, and a context entry a body reads past would
+ *  turn a real argument into `uninit_<reg>`. */
+export function splitOwnContext(
+  prototypes: Prototypes | undefined,
+  own: string,
+  given?: FnProto,
+): { prototypes: Prototypes | undefined; ownContextProto: FnProto | undefined } {
+  const p = prototypes !== undefined && Object.hasOwn(prototypes, own) ? prototypes[own] : undefined;
+  if (p?.fromContext !== true) {
+    return { prototypes, ownContextProto: given };
+  }
+  const { [own]: _marked, ...rest } = prototypes!;
+  const { fromContext: _mark, ...entry } = p;
+  return { prototypes: rest, ownContextProto: given ?? ownContextEntry({ [own]: entry }, own) };
+}
+
+/** `prototypes` with the context's own entry for `own` carried in it under the mark
+ *  ({@link splitOwnContext} reads it back), where the context has one {@link ownContextEntry}
+ *  hands over and the table states none: how a benchmark row publishes the entry its lift read, so
+ *  that its `--proto` replay lifts as it did. */
+export function withOwnContextMark(
+  prototypes: Prototypes | undefined,
+  own: string,
+  context: Prototypes,
+): Prototypes | undefined {
+  if (prototypes !== undefined && Object.hasOwn(prototypes, own)) {
+    return prototypes;
+  }
+  const entry = ownContextEntry(context, own);
+  return entry === undefined ? prototypes : { ...prototypes, [own]: { ...entry, fromContext: true } };
+}
+
+/** The caller's stated entry for `own`, with the struct or union its stated `returns` names laid out
+ *  by the context — `struct S`, or a typedef of one, `T8` over `typedef struct {u32 a, b;} T8;` —
+ *  read as the context reads a declaration's return (`readSignature`, through a declaration of that
+ *  return the context is handed for the purpose). A `--proto` table spells a type and lays nothing
+ *  out, and `withContextPrototypes` leaves the context's own entry for `own` out, so without this
+ *  the lifted function's own struct return is a spelling: `struct S1` sized by nothing, where the
+ *  rule that decides whether it comes back through a hidden pointer reads a size
+ *  (`returnsInMemory`), and `T8`, which reads as no aggregate at all and lifts as the pointer
+ *  function its hidden pointer makes it (pipeline.ts `ownStructReturnThroughMemory`).
+ *  A return already laid out, a scalar, a pointer or a floating type is left as stated, and so is
+ *  a name the context does not lay out. */
+export function withOwnReturnLayout(
+  stated: Prototypes | undefined,
+  own: string,
+  src: string,
+  language: Language,
+): Prototypes | undefined {
+  const p = stated !== undefined && Object.hasOwn(stated, own) ? stated[own] : undefined;
+  const r = p?.returns?.trim();
+  if (
+    p === undefined ||
+    p === null ||
+    r === undefined ||
+    p.returnLayout !== undefined ||
+    r === 'void' ||
+    r.includes('*') ||
+    declaredWidth(r) !== undefined ||
+    isFloatingSpelling(r)
+  ) {
+    return stated;
+  }
+  const probe = '__asmlift_own_return';
+  const layout = prototypesFromContext(`${src}\n${r} ${probe}(void);\n`, language)[probe]?.returnLayout;
+  return layout === undefined ? stated : { ...stated, [own]: { ...p, returnLayout: layout } };
 }
 
 const same = (a: FnProto | null, b: FnProto): boolean => a !== null && JSON.stringify(a) === JSON.stringify(b);
@@ -752,9 +1678,28 @@ const same = (a: FnProto | null, b: FnProto): boolean => a !== null && JSON.stri
  *  lets any entry it is handed shadow the map's signature for that name, so what reaches it decides
  *  which source wins, per name: a context entry that sizes every parameter wins — it is the
  *  declaration the candidate is compiled against, and its spellings are the ones a C++ call's casts
- *  need; an entry that cannot size one yields to a map signature that can be spelled, which sizes by
- *  byte count what a declaration names (a by-value struct of a register's width); and where the map
- *  spells nothing either, the context entry stays. */
+ *  need; it is taken whole, its return included, and the map is not consulted for it. An entry that
+ *  cannot size one yields to a map signature that can be spelled, which sizes by byte count what a
+ *  declaration names (a by-value struct of a register's width); and where the map spells nothing
+ *  either, the context entry stays.
+ *
+ *  AN ENTRY THAT YIELDS ITS PARAMETERS KEEPS THE RETURN IT STATES where `contextReturnUnder` says
+ *  it may, because the map's signature carries no `returns`. DWARF does say that a pointer, or a
+ *  signed or unsigned base type, comes back in a register; `symbolPrototype` chooses not to spell it
+ *  (`FnProto.returns`: a header states it and nothing derives it), because a spelled return also
+ *  types the call's result and prints in the candidate's declarations, and the map's `void *` is not
+ *  the header's `u8 *` — C++ does not convert it implicitly. So a map-only lift (no context) still
+ *  declines this shape, and a context entry dropped whole leaves every non-void call to that name
+ *  undeclared — and a frame address handed to an undeclared callee may be its hidden struct-return
+ *  pointer (`returnsWithoutHiddenPointer`). pokeemerald's `u8 *ConvertIntToDecimalStringN(u8 *,
+ *  s32, enum StringConvertMode, u8)` is the case: its enum parameter has no width its SPELLING
+ *  states, so the entry yields its parameters and keeps its `u8 *`.
+ *
+ *  THE QUESTION HERE IS ASKED OF THE SPELLINGS, the context's own reading of the names behind them
+ *  (`wordParams`, `byValueParams`) set aside: which source states the declaration better is not
+ *  which one a lowering can place. The map sizes an enum or an array typedef by its byte count and
+ *  spells it, which the context's reading of the name only classifies; so an entry that sizes such
+ *  a parameter through that reading still yields to a map that spells it. Whichever entry wins is the one every reader of it takes. */
 function contextPrototypesUnder(
   context: Prototypes,
   symbols: SymbolMap | undefined,
@@ -763,26 +1708,75 @@ function contextPrototypesUnder(
   if (symbols === undefined) {
     return context;
   }
-  const mapped = new Map<string, FnProto>();
+  const mapped = new Map<string, { signed: FnProto; returned: SymbolTypeFacts | null }>();
   for (const infos of symbols.values()) {
     for (const info of infos) {
       const signed = symbolPrototype(info);
-      if (signed?.params !== undefined && !mapped.has(info.name)) {
-        mapped.set(info.name, signed);
+      if (signed?.params !== undefined && info.signature !== undefined && !mapped.has(info.name)) {
+        mapped.set(info.name, { signed, returned: info.signature.returns });
       }
     }
   }
-  // An entry that yields keeps a struct return it states, over the map's parameters: DWARF names no
-  // struct, so the map states one only by its size (`symbolPrototype`), and never its members.
   return Object.fromEntries(
     Object.entries(context).flatMap(([name, p]): [string, FnProto][] => {
-      const signed = mapped.get(name);
-      if (declaredCallArgs(p, target) !== undefined || signed === undefined) {
+      const map = mapped.get(name);
+      if (declaredCallArgs({ params: p.params }, target) !== undefined || map === undefined) {
         return [[name, p]];
       }
-      return declaresAggregateReturn(p) && signed.returnsVoid !== true
-        ? [[name, { ...signed, ...aggregateReturnOf(p) }]]
-        : [];
+      const kept = contextReturnUnder(p, map.signed.params, map.returned);
+      return kept === undefined ? [] : [[name, { ...map.signed, ...kept }]];
     }),
   );
 }
+
+/** The return a context entry `p` keeps under parameters another source states (`under`: the
+ *  map's signature, or a stated entry that says nothing of the return) — or `undefined` when it
+ *  keeps none. `returned` is the map's DWARF return where the map's signature is the other source,
+ *  `null` for a map that says `void`, and `undefined` where the map is not consulted.
+ *
+ *  A `void` return is not kept: whether the callee returns is the map's to state.
+ *
+ *  A STRUCT RETURN is kept as stated: DWARF names no struct, so the map states one only by its size
+ *  (`symbolPrototype`), and never its members; and keeping it is the safe direction, since it only
+ *  says argument 0 may be a hidden pointer.
+ *
+ *  A REGISTER RETURN says argument 0 is NOT one, so it is the direction that lifts, and it is kept
+ *  only where it is the same fact as the parameters it sits under:
+ *  - the context states every parameter, and as many as `under` does — a count `under` is read as
+ *    a number of parameters here, though it states registers (`withContextPrototypes`). A variadic
+ *    declaration, and a K&R one, state none (`readSignature`), and the map's DWARF parameters
+ *    leave the `...` out — so `int pr(char *, const char *, ...)` under a two-parameter map
+ *    signature would lower `pr(buf, s, a, b)` as `pr(buf, s)`. Dropped whole, the call declines;
+ *  - the return has a width (`declaredWidth`). `float` and `double` have none here, cannot say
+ *    anything about a hidden pointer the map's word does not, and on a target with an FPU make
+ *    call-plan refuse every call to the name (`$f0`, `f1`), whose result is used or not;
+ *  - the map, where it is consulted, does not contradict it: a return the map calls `void`, or a
+ *    width its byte size disagrees with (`int` declared, `u8` defined). This is a rule of the merged entry only — its parameters are the map's and its
+ *    return the header's, and the two are one fact a table must not hold half of. A context entry
+ *    taken whole (it sizes every parameter) never meets the map, and keeps its return unchecked.
+ *  Each refusal leaves the call undeclared (`FnProto.returns`). */
+function contextReturnUnder(
+  p: FnProto | undefined,
+  under: FnProto['params'],
+  returned: SymbolTypeFacts | null | undefined,
+): Pick<FnProto, 'returns' | 'returnLayout'> | undefined {
+  if (p === undefined || returned === null || statesNoReturn(p) || declaresVoidReturn(p)) {
+    return undefined;
+  }
+  const kept = {
+    ...(p.returns !== undefined ? { returns: p.returns } : {}),
+    ...(p.returnLayout !== undefined ? { returnLayout: p.returnLayout } : {}),
+  };
+  if (declaresAggregateReturn(p)) {
+    return kept;
+  }
+  const arity = typeof under === 'number' ? under : under?.length;
+  if (!Array.isArray(p.params) || p.params.length !== arity) {
+    return undefined;
+  }
+  const width = p.returns === undefined ? undefined : declaredWidth(p.returns);
+  if (width === undefined) {
+    return undefined;
+  }
+  return returned !== undefined && returned.size !== null && returned.size * 8 !== width ? undefined : kept;
+}