@asmlift/core 0.9.0 → 0.11.0

package/src/rank.ts

@@ -20,7 +20,11 @@
 //                  names, and which of those names a declaration must refuse to claim.
 import { cBackend } from './backend/c';
 import {
+  assertCaseGotosNarrow,
   assertDerefsTyped,
+  assertEffectsPreserved,
+  assertFrameUnionsViewed,
+  assertLocalStorageStaysInteger,
   assertLocalsWritten,
   assertNoOrphanedLocals,
   assertPlacementSurvives,
@@ -28,6 +32,7 @@ import {
   assertResolved,
 } from './contracts';
 import type { AsmData } from './frontend/asmdata';
+import type { CalleeBodies } from './frontend/callee-body';
 import { hasSetupArgsNarrowing, narrowToSetupArgs, setupArgsDiscardsPassedResult } from './frontend/ssa';
 import { Fn, Value, defOpMap } from './ir/core';
 import { T } from './ir/types';
@@ -53,14 +58,24 @@ import { reindexWalks } from './l3/reindex';
 import { hoistScopedBases } from './l3/scopebase';
 import { sinkInitsToFirstUse } from './l3/sinkinit';
 import type { SymbolRef } from './l3/symbol-refs';
+import { signedOverUnsignedCompare } from './l3/typing';
 import { type UnreduceResult, unreduceAccumulators } from './l3/unreduce';
 import { deviceVolatileClaims, volatilePtrLocals, volatileSubsetCandidates } from './l3/volatileptr';
 import { volatileValueLocals } from './l3/volatileval';
 import { volatileDeviceStores } from './l3/volstore';
 import { zeroSubNegates } from './l3/zerosub';
 import { RewritePattern } from './pattern/engine';
-import { applyIdiomPatterns, liftStamped, raiseRecovered, structureChecked } from './pipeline';
-import { type Prototypes, declaresVoidReturn, prototypesFromSymbols } from './proto';
+import {
+  applyIdiomPatterns,
+  liftStamped,
+  offsetNameBehaviorsFor,
+  raiseRecovered,
+  sourceLineCount,
+  structureChecked,
+  structureReturnTailReading,
+} from './pipeline';
+import { type FnProto, type Prototypes, declaresVoidReturn, prototypesFromSymbols } from './proto';
+import { type ContextGlobals, splitOwnContext } from './proto-context';
 import { inferGlobalArrays, orderLicensedGlobals, sameDerivedShape } from './raise/globalshape';
 import { OFFSET_NAME_PASS } from './raise/offsetnames';
 import { runPreRecovery } from './raise/pre-recovery';
@@ -70,6 +85,7 @@ import {
   type RefusedDeclarationReason,
   bareGlobalAccessFacts,
   bareGlobalSymbols,
+  initAddressSymbols,
   makeRefCollector,
 } from './rank-declare';
 import {
@@ -82,14 +98,22 @@ import {
   SIGNEDNESS,
   STACKED_SUBSETS,
   STRUCTURE_VARIATIONS,
+  StackedMemberThrew,
   type StructureVariation,
   UNFOLDED_HOISTS,
   applyStacked,
   createdLocals,
+  firstFired,
   sameBases,
 } from './rank-variations';
 import { type Stillborn, stillbornVerdict } from './stillborn';
-import { hasDivergentSharedRet } from './structure/structure';
+import {
+  DefaultAcceptsMemo,
+  DefaultAcceptsMemoMisuse,
+  FOR_BOUND_GATES,
+  StructureError,
+  hasDivergentSharedRet,
+} from './structure/structure';
 import {
   type SymbolInfo,
   type SymbolMap,
@@ -159,6 +183,12 @@ export interface EnumerateOptions {
   asmData?: AsmData;
   /** address→symbol map (symbols.ts) — same contract as DecompileOptions.symbols */
   symbols?: SymbolMap;
+  /** same contract as DecompileOptions.contextGlobals */
+  contextGlobals?: ContextGlobals;
+  /** same contract as DecompileOptions.ownContextProto */
+  ownContextProto?: FnProto;
+  /** same contract as DecompileOptions.calleeBodies */
+  calleeBodies?: CalleeBodies;
   /** Called when a respell variation THROWS or fails a boundary contract, so the failure is visible
    *  instead of the candidate silently not existing. Enumeration continues either way — the default
    *  candidate is unaffected — but a variation that never fires because it always throws is a defect,
@@ -255,16 +285,41 @@ export interface Candidate {
    *   • `l3/intcell.ts` spells a global as the integer a project may have declared it, where a
    *     pointer declaration scales the offset it adds, and no declaration is in the asm.
    *
-   *  What settles both instead is the object: a candidate that assembles to the target's own bytes
-   *  IS the program, whatever a gate could have proved. So the spelling is offered, scored, and then
+   *  A third obligation is judged on the finished tree rather than declared by a variation
+   *  (`signedUnsignedCompare` below):
+   *
+   *   • `/signed-cmp`, or a respell over its tree, spells an unsigned compare over signed-rendering
+   *     operands, which compiles to a signed compare unless the operands are non-negative, and the
+   *     compiler's proof of that is not in the asm.
+   *
+   *  What settles all three instead is the object: a candidate that assembles to the target's own
+   *  bytes IS the program, whatever a gate could have proved. So the spelling is offered, scored, and then
    *  either wins on proof or is WITHHELD — never shown as a best-effort answer. Both ranking drivers
    *  ask `withheldReason`, so neither can publish what the other would not. */
   matchOnly?: true;
+  /** The tree this source was emitted from spells some unsigned compare so that C evaluates it
+   *  signed (l3/typing.ts `signedOverUnsignedCompare`, judged on the finished tree), which makes it
+   *  `matchOnly` and names the fact it owes. Set for whichever variation got it there: emission
+   *  under `/signed-cmp`, or a respell that substituted into a compare emission had pinned. It is
+   *  the only place this obligation is decided: a pass that rebuilds a compare spreads the node to
+   *  keep its `unsignedCmp` evidence (l3/regspell.ts), a merge that keeps one of two equal nodes
+   *  keeps the evidence of both (l3/ast.ts `unionEvidence`), or drops it only where its own gate proved
+   *  the new spelling compares the same values (l3/initfirst.ts `swapSide`, l3/reindex.ts). */
+  signedUnsignedCompare?: true;
   /** This candidate's lift is `/setup-args` and drops an earlier callee's result that a call through
    *  a register is passed (frontend/ssa.ts `setupArgsDiscardsPassedResult`). It loses every score
    *  tie (compareScored): a tie refutes neither reading, and a shorter spelling must not win by
    *  dropping a value the callee may read. */
   discardsPassedResult?: true;
+  /** This candidate's lift is `/narrow-param` and declares a parameter narrow that no prototype
+   *  declares (raise/pre-recovery.ts `onUndeclaredWidth`). It loses every score tie
+   *  (compareScored): a tie refutes neither declaration, and the narrow one changes the bytes of
+   *  every prototyped caller, which this function's score cannot see. */
+  guessesParamWidth?: true;
+  /** This candidate's lift is `/far-cast` and spells a far member store through a cast of its
+   *  base. It loses every score tie (compareScored): a tie means the compiler built the member's
+   *  object too, and the member is the spelling that names the field. */
+  farStoreCast?: true;
 }
 /** A candidate paired with its score `S` (the injected scorer's result shape — must carry `.score`). */
 export interface Scored<S> extends Candidate {
@@ -356,7 +411,7 @@ export interface RankedResult<S> {
   candidates: Scored<S>[]; // sorted best (lowest) first
   /** candidates whose scoreFn threw — empty when every spelling built */
   dropped: DroppedCandidate[];
-  /** candidates withheld for want of a byte-exact proof — empty unless a `matchOnly` variation fired */
+  /** candidates withheld for want of a byte-exact proof — empty unless a `matchOnly` candidate scored a nonmatch */
   withheld: WithheldCandidate[];
 }
 
@@ -371,6 +426,9 @@ export function withheldReason<S extends { score: number }>(c: Candidate, score:
     return null;
   }
   const facts = c.variations.flatMap((v) => PROOF_OBLIGATIONS.get(v) ?? []);
+  if (c.signedUnsignedCompare === true) {
+    facts.push(SIGNED_COMPARE_OBLIGATION);
+  }
   const fact = facts.length > 0 ? facts.join(' and on ') : 'a fact no gate over the C can settle';
   return `this spelling rests on ${fact}; only a byte-exact score proves it`;
 }
@@ -381,6 +439,11 @@ const PROOF_OBLIGATIONS: ReadonlyMap<string, string> = new Map<VariationName, st
   ['int-cell', 'the project declaring the global an integer, which the assembly does not show'],
 ]);
 
+/** The fact `Candidate.signedUnsignedCompare` rests on. Keyed by the flag, not by `/signed-cmp`:
+ *  that name is on candidates that owe nothing (a compare over a `u32` operand) and missing from
+ *  respells that do. */
+const SIGNED_COMPARE_OBLIGATION = "the compiler having proved every unsigned compare's operands non-negative";
+
 /** What a respell variation hands `respell`: its tree, or — when the variation cannot establish the
  *  candidate's semantics from inside the pass — the tree paired with that fact. `undefined`/`null`
  *  is a decline. */
@@ -444,6 +507,29 @@ interface TreeSource {
   deviceVolatile?: number;
   /** see `Candidate.matchOnly` — set by a variation that cannot establish its own semantics */
   matchOnly?: true;
+  /** see `Candidate.signedUnsignedCompare` */
+  signedUnsignedCompare?: true;
+}
+
+/** Did `bound-plus-one-counter-wraps` CAUSE this structuring's decline? The rule fires from every
+ *  attempt `forPlanAt` makes, committed or not, and on loops the thrown refusal never reaches
+ *  (`synthetic:sw_gotocase_inner:ido7.1` fires it and declines on its switches' cases), so its firing
+ *  alone says nothing about the decline. The question is asked the one way that answers it: the
+ *  same structuring with that rule off. Where that one structures, the refusal was the rule's, and
+ *  the other pin, whose counter the rule admits, can take the loop; where it still throws, the
+ *  decline is the function's and the row aborts as any other default decline does. The tree the
+ *  ablated run builds is discarded — it is the `for` the rule refuses as wrong under this pin.
+ *  Not holding every pinnable decline instead: that would let the signed pin past any structure
+ *  refusal that reads a declared type, not only this one, and re-lift every declined row. */
+function declinesOnCounterSign(fn: Fn, opts: Parameters<typeof structureChecked>[1]): boolean {
+  try {
+    structureChecked(fn, opts, {
+      forBoundGates: FOR_BOUND_GATES.filter((g) => g.id !== 'bound-plus-one-counter-wraps'),
+    });
+    return true;
+  } catch {
+    return false;
+  }
 }
 
 /** Emit the DISTINCT type/branch-sense candidates for `name` — PURE, no scoring.
@@ -469,16 +555,31 @@ export function enumerateCandidates(
   /** The last refusal from a backend asked to spell a tree — what the empty-enumeration check
    *  below reports, so "this backend can spell nothing here" names its reason. */
   let lastEmitError: unknown = null;
+  /** THE UNSIGNED PIN'S DECLINE, HELD FOR THE SIGNED ONE. The default candidate's structuring aborts
+   *  the row (`abortsRow`) on the premise that a structure refusal does not depend on the pin. One
+   *  does: `forPlanAt`'s `bound-plus-one-counter-wraps` reads the counter's declared type, so IDO's
+   *  counted loop (`synthetic:sw_gotocase2:ido7.1`) takes its `for` under the `s32` pin and not the
+   *  `u32` one, and without the `for` the switch's loop exit cannot be spelled at all. The decline is
+   *  held only where that rule CAUSED it (`declinesOnCounterSign`), and then the rest of the unsigned
+   *  pin is skipped: its other settings would run behind a declined default, which `abortsRow` exists
+   *  to forbid. The signed pin runs as it would have; a row that then produces no candidate declines
+   *  with the held error. Nothing the signed pin builds is new: it is the same pass, under its own
+   *  default setting and its own gates. */
+  let heldPinDecline: unknown = undefined;
   // Same merge as `decompile`: the project's DWARF signatures fill in what the caller did not
   // state, so both the annotate pass and the ranked candidates reason about one prototype table.
-  const prototypes = prototypesFromSymbols(opts.symbols, opts.prototypes ?? {});
+  const ownContext = splitOwnContext(opts.prototypes, name, opts.ownContextProto);
+  const prototypes = prototypesFromSymbols(opts.symbols, ownContext.prototypes ?? {});
   const baseOpts = {
     ...structureOptionsFor(target, declaresVoidReturn(prototypes[name]), prototypes),
     // See the same line in pipeline.ts: a backend that cannot print switch fall-through must not
     // be handed a tree carrying one, because its refusal costs the whole candidate (and, when
     // every candidate carries it, the whole row).
     spellSwitchFallthrough: backend.spellsSwitchFallthrough,
+    spellSwitchBreak: backend.spellsSwitchBreak,
+    spellEarlyReturns: backend.spellsEarlyReturn,
     ...(opts.symbols ? { symbols: symbolsByName(opts.symbols) } : {}),
+    ...(opts.contextGlobals ? { contextGlobals: opts.contextGlobals } : {}),
   };
   // Branch-sense is a differ-ranked VARIATION, the same class as param signedness: a divergent `if`
   // can be spelled with either sense (`if (c) A else B` vs `if (!c) B else A`), and which one the
@@ -600,11 +701,23 @@ export function enumerateCandidates(
   // it buys is that a lift-time change which splits them enumerates both settings rather than
   // silently dropping one, the failure nothing reports.
   let sharedLiftTreeOwned = false;
+  let sharedLiftExtendedReaders = false;
+  let sharedLiftFoldedStore = false;
   // Shared lift: recover ONCE with no signedness pin, to learn which entry params are
   // pointers/aggregates so they are excluded from the signedness variation (see NO_PIN_KINDS). One
   // extra lift+recover, no compile. (The shared lift deliberately stops after recoverTypes — it only reads the param KINDS, so
   // the totality contract / return-sinking of the full spine are not run on it.)
-  const sharedLift = liftStamped(name, asm, target, prototypes, opts.asmData, opts.symbols);
+  const sharedLift = liftStamped(
+    name,
+    asm,
+    target,
+    prototypes,
+    opts.asmData,
+    opts.symbols,
+    opts.contextGlobals,
+    { calleeBodies: opts.calleeBodies },
+    ownContext.ownContextProto,
+  );
   // The ARRAY SHAPES the input assembly evidences (raise/globalshape.ts), for the DECLARATION
   // half. Read off the shared lift's LIFTED form — before the fold below and the tower rewrite it —
   // because the base-materialization order the derivation's licence reads does not survive them.
@@ -619,6 +732,16 @@ export function enumerateCandidates(
         sharedLiftTreeOwned = true;
       },
     },
+    paramWidth: {
+      onExtendedReaders: () => {
+        sharedLiftExtendedReaders = true;
+      },
+    },
+    displaced: {
+      onFoldedStore: () => {
+        sharedLiftFoldedStore = true;
+      },
+    },
   });
   recoverTypes(sharedLift);
   const ptrIdx = new Set<number>(
@@ -643,17 +766,47 @@ export function enumerateCandidates(
   // shared lift's `onTreeOwned` hook has had its chance to fire. Called any earlier it would report a confident
   // `false` for a function that owns a tree. As a `const` below that call, an early call is a TDZ
   // ReferenceError instead — a wrong answer traded for a loud one.
-  const treeOwnedIn = (symbols: typeof opts.symbols): boolean => {
+  //
+  // `/narrow-param`'s gate is read off the same lift the same way: the width pass reports a
+  // parameter the variation's lift would narrow (raise/pre-recovery.ts `ParamWidthOptions`). So is
+  // `/far-cast`'s: the displaced-access fold reports a store it moved into a struct.
+  const liftReportsIn = (
+    symbols: typeof opts.symbols,
+  ): { treeOwned: boolean; extendedReaders: boolean; foldedStore: boolean } => {
     if (symbols === opts.symbols) {
-      return sharedLiftTreeOwned;
+      return {
+        treeOwned: sharedLiftTreeOwned,
+        extendedReaders: sharedLiftExtendedReaders,
+        foldedStore: sharedLiftFoldedStore,
+      };
     }
-    const p = liftStamped(name, asm, target, prototypes, opts.asmData, symbols);
+    const p = liftStamped(
+      name,
+      asm,
+      target,
+      prototypes,
+      opts.asmData,
+      symbols,
+      opts.contextGlobals,
+      { calleeBodies: opts.calleeBodies },
+      ownContext.ownContextProto,
+    );
     applyIdiomPatterns(p, target, opts.patterns);
-    let seen = false;
+    const seen = { treeOwned: false, extendedReaders: false, foldedStore: false };
     runPreRecovery(p, target, () => verify(p), prototypes[name], {
       shortCircuit: {
         onTreeOwned: () => {
-          seen = true;
+          seen.treeOwned = true;
+        },
+      },
+      paramWidth: {
+        onExtendedReaders: () => {
+          seen.extendedReaders = true;
+        },
+      },
+      displaced: {
+        onFoldedStore: () => {
+          seen.foldedStore = true;
         },
       },
     });
@@ -916,7 +1069,11 @@ export function enumerateCandidates(
   // spelling needs one, and the declaration a candidate spelling `gTbl[i]` cannot compile
   // without), and the project map, which knows more than either.
   const mapSymbols = baseOpts.symbols;
-  const targetSymbols = new Map<string, SymbolInfo>([...bareGlobalSymbols(sharedLift), ...sharedLiftShapes]);
+  const targetSymbols = new Map<string, SymbolInfo>([
+    ...initAddressSymbols(sharedLift),
+    ...bareGlobalSymbols(sharedLift),
+    ...sharedLiftShapes,
+  ]);
   const declSymbols = new Map<string, SymbolInfo>([...targetSymbols, ...(mapSymbols ?? [])]);
   // The four per-enumeration constants named at the seam rather than captured across 60 lines of
   // closure (rank-declare.ts states why they belong on one object).
@@ -930,6 +1087,7 @@ export function enumerateCandidates(
     prototypes,
     target,
     refuse,
+    own: Object.hasOwn(prototypes, name) ? prototypes[name] : ownContext.ownContextProto,
   });
   // THE RESPELL SET, as a function whose PARAMETER LIST is the invariant the tree skip below
   // rests on: every source here is a pure function of the structured tree and this call's own
@@ -953,6 +1111,14 @@ export function enumerateCandidates(
   // of `/volatile` — a candidate that did not fail and is still in the fan. The order
   // is the candidates' own (`[pf.name, ...sp.variations]`), so a reported name and an enumerated
   // candidate's variations name the same candidate the same way.
+  //
+  // THE COMPARE-SIGNEDNESS PROOF, asked of every tree a source is emitted from rather than of the
+  // passes that build them. Emission pins each unsigned compare it lowers (structure.ts), but a
+  // respell that substitutes into a compare — `/unmerge` putting an arm's `s16` global where the
+  // pinned `u32` local stood, against an `s32` parameter — re-renders it signed. So the finished
+  // tree is judged here, and a signed rendering of an `icmp_u*` is `matchOnly` whoever produced it.
+  const cmpProof = (tree: SFn): { matchOnly?: true; signedUnsignedCompare?: true } =>
+    signedOverUnsignedCompare(tree) ? { matchOnly: true, signedUnsignedCompare: true } : {};
   const respellTree = (sfn: SFn, preRespellVariations: readonly Variation[] = []): TreeSources => {
     // The walk→index respell variation (l3/reindex.ts) is a THIRD variation on the same footing as
     // signedness and branch sense: whether the source spelled `*p; p++` or `arr[i]` is
@@ -970,7 +1136,7 @@ export function enumerateCandidates(
     // Pascal backend loud-declines). Refusing EVERY tree is still loud — the empty-enumeration
     // check at the end raises the last refusal.
     try {
-      sources.push({ variations: [], source: backend.emit(sfn), ...refsOf(sfn), ...volOf(sfn) });
+      sources.push({ variations: [], source: backend.emit(sfn), ...refsOf(sfn), ...volOf(sfn), ...cmpProof(sfn) });
     } catch (e) {
       reportThrow(preRespellVariations, e);
       return { sources, emit: { error: e } };
@@ -1050,6 +1216,7 @@ export function enumerateCandidates(
     // `assertEffectsPreserved` is the fourth and is NOT here: it needs the L1 `fn`, and
     // `respellTree`'s parameter list is the invariant the tree-dedup skip rests on (see its header).
     // Widening it for a contract is a defensible change and an argued one — not a silent import.
+    // The PRE-RESPELL loop below has `fn` in scope and no such invariant, so it runs it there.
     // A respell variation returns its tree, or `{ sfn, needsProof }` when it cannot establish its own
     // semantics from inside the pass (Candidate.matchOnly carries the argument).
     const respell = (variations: readonly Variation[], make: () => RespellResult, alreadyShaped = false): void => {
@@ -1068,7 +1235,17 @@ export function enumerateCandidates(
         assertLocalsWritten(alt);
         assertPostIncrUnshared(alt);
         assertNoOrphanedLocals(sfn, alt);
-        sources.push({ variations, source: backend.emit(alt), ...refsOf(alt), ...volOf(alt), ...proof });
+        assertLocalStorageStaysInteger(sfn, alt);
+        assertFrameUnionsViewed(alt);
+        assertCaseGotosNarrow(alt);
+        sources.push({
+          variations,
+          source: backend.emit(alt),
+          ...refsOf(alt),
+          ...volOf(alt),
+          ...proof,
+          ...cmpProof(alt),
+        });
         // STACKED variations, derived onto EVERY source (the POLICY note above carries the
         // admission argument). Each is a statement-order/shape or declaration-width fact
         // orthogonal to the respell variations outside the table; subsets compose in the fixed
@@ -1095,19 +1272,25 @@ export function enumerateCandidates(
           // which moves only const or pure-read assigns and so cannot lift a read of a base local
           // above its init.
           const minted = createdLocals(sfn, alt);
+          const firedSets = new Set<string>();
           for (const subset of STACKED_SUBSETS) {
             // ONE TRY PER SHAPE — a shape is its own candidate and fails as its own candidate.
             // Sharing the respell variation's outer try would let a throw deriving one subset
             // discard every later one, under that variation's name, which names no shape.
-            const shapeVariations = subset.map((x) => x.name);
+            // A throw past applyStacked is reported under the fired set, the candidate's own name.
+            let shapeVariations: readonly Variation[] = [];
             try {
               const shaped = applyStacked(subset, alt);
-              if (shaped !== null) {
+              if (shaped !== null && firstFired(firedSets, shaped.variations)) {
+                shapeVariations = shaped.variations;
                 assertResolved(shaped.out);
                 assertDerefsTyped(shaped.out);
                 assertLocalsWritten(shaped.out);
                 assertPostIncrUnshared(shaped.out);
                 assertNoOrphanedLocals(alt, shaped.out);
+                assertLocalStorageStaysInteger(alt, shaped.out);
+                assertFrameUnionsViewed(shaped.out);
+                assertCaseGotosNarrow(shaped.out);
                 assertPlacementSurvives(alt, shaped.out, minted);
                 sources.push({
                   variations: [...variations, ...shaped.variations],
@@ -1116,10 +1299,12 @@ export function enumerateCandidates(
                   ...volOf(shaped.out),
                   // a shape derived from a proof-gated spelling inherits the requirement
                   ...proof,
+                  ...cmpProof(shaped.out),
                 });
               }
             } catch (e) {
-              reportThrow([...preRespellVariations, ...variations, ...shapeVariations], e);
+              const step = e instanceof StackedMemberThrew ? e.variations : shapeVariations;
+              reportThrow([...preRespellVariations, ...variations, ...step], e);
             }
           }
         }
@@ -1135,19 +1320,21 @@ export function enumerateCandidates(
     // `/argbase` — name a call's argument bases before the call (l3/argbase.ts). A variation on the
     // same footing as the others: the default inline spelling stays in the list, so the differ
     // referees and this can never cost a match.
+    const firedSets = new Set<string>();
     for (const subset of STACKED_SUBSETS) {
       // the truthful variations need the pass to RUN first, so this bypasses respell's
       // variations-then-thunk shape: same try posture, variations from the fired members
       try {
         const shaped = applyStacked(subset, sfn);
-        if (shaped !== null) {
+        if (shaped !== null && firstFired(firedSets, shaped.variations)) {
           // the ONE call whose variations already name shapes — say so, rather than making `respell`
           // read them back out of the variations it was handed
           respell(shaped.variations, () => shaped.out, true);
         }
       } catch (e) {
-        // the report names the full subset — the fired set is unknown mid-throw
-        reportThrow([...preRespellVariations, ...subset.map((x) => x.name)], e);
+        // `respell` reports its own throws, so only a member can throw here
+        const step = e instanceof StackedMemberThrew ? e.variations : subset.map((x) => x.name);
+        reportThrow([...preRespellVariations, ...step], e);
       }
     }
     respell(['argbase'], () => materializeArgBases(sfn));
@@ -1828,8 +2015,10 @@ export function enumerateCandidates(
     // audit cannot bound. This is the setting's first lift, and every later one is the same lift
     // again.
     let treeOwnedFold: boolean;
+    let extendedReaders: boolean;
+    let foldedStore: boolean;
     try {
-      treeOwnedFold = treeOwnedIn(symbolSetting.symbols);
+      ({ treeOwned: treeOwnedFold, extendedReaders, foldedStore } = liftReportsIn(symbolSetting.symbols));
     } catch (e) {
       if (abortsRow(symbolSetting.variations)) {
         throw e;
@@ -1848,11 +2037,27 @@ export function enumerateCandidates(
     // Read off the pin's OWN call, per symbol-map setting — the `/raw-globals` setting lifts without
     // the map and answers for itself, so no lift is governed by a fact measured on a different one.
     let pinnable = false;
-    for (const cand of SIGNEDNESS) {
+    pins: for (const cand of SIGNEDNESS) {
       if (cand.signed && !pinnable) {
         break;
       }
-      const base = liftStamped(name, asm, target, prototypes, opts.asmData, symbolSetting.symbols);
+      let tailSlot = false;
+      const base = liftStamped(
+        name,
+        asm,
+        target,
+        prototypes,
+        opts.asmData,
+        symbolSetting.symbols,
+        opts.contextGlobals,
+        {
+          onTailSlot: () => {
+            tailSlot = true;
+          },
+          calleeBodies: opts.calleeBodies,
+        },
+        ownContext.ownContextProto,
+      );
       // `/setup-args` — pass a prototype-less callee only what the CALLING BLOCK set up; which of
       // the two readings the source spelled is genuinely ambiguous, and frontend/ssa.ts
       // narrowToSetupArgs carries the argument for why the differ is what settles it.
@@ -1918,12 +2123,66 @@ export function enumerateCandidates(
             { variations: ['setup-args'], narrow: true },
           ]
         : [{ variations: [], narrow: false }];
+      // `/narrow-param` — declare a parameter every reader of which is an extension at the widest
+      // reader's width (raise/paramwidth.ts, EVERY READER AN EXTENSION). A lift variation for the
+      // reason `/connective` is: the raise mutates in place, and the parameter's width is what
+      // recovery and every later stage read. Enumerated only where this symbol-map setting's lift
+      // reports such a parameter; crossed with the other two, and the dedup collapses what agrees.
+      const paramSettings: { variations: readonly Variation[]; extendedReaders: boolean }[] = extendedReaders
+        ? [
+            { variations: [], extendedReaders: false },
+            { variations: ['narrow-param'], extendedReaders: true },
+          ]
+        : [{ variations: [], extendedReaders: false }];
+      // `/kept-slot` — keep the delay slot of a MIPS `b`/`j` whose slot ends a common tail both arms
+      // spell, where the default lift retargets it to the copy before its target and merges the
+      // arms (frontend/mips.ts `normaliseBranchLikely`: the two are one object, and which the source
+      // wrote is the differ's to say). A LIFT variation because the rewrite is the CFG every later
+      // stage reads. Enumerated only where this setting's default lift reports such a slot; crossed
+      // with the others, and the dedup collapses what agrees. An IDO reading: GCC 2.7.2 and KMC
+      // cross-jump a tail both arms spell before they fill a slot, so they leave no such tail.
+      const tailSettings: { variations: readonly Variation[]; keepTailSlots: boolean }[] = tailSlot
+        ? [
+            { variations: [], keepTailSlots: false },
+            { variations: ['kept-slot'], keepTailSlots: true },
+          ]
+        : [{ variations: [], keepTailSlots: false }];
+      // `/far-cast` — keep each store the displaced-access fold would move into a struct on the
+      // address it was reached through (raise/structs.ts `foldDisplacedAccesses`). On agbcc the
+      // member store and the cast store are two objects (target.ts `farMemberStoreOrder`), and a
+      // hoisted pointer the source held builds the cast's. Elsewhere a folded store stops aliasing
+      // the loads beside it and a held pointer is spelled as members, which KMC, GCC 2.7.2 and mwcc
+      // build into other objects. So which one the source wrote is the differ's to say, on every
+      // target. A LIFT variation because the fold decides which struct the stores join, which
+      // recovery and every later stage read. Enumerated only where this setting's lift folded a
+      // store.
+      const castSettings: { variations: readonly Variation[]; keepStores: boolean }[] =
+        foldedStore && offeredOn(target, ['far-cast'])
+          ? [
+              { variations: [], keepStores: false },
+              { variations: ['far-cast'], keepStores: true },
+            ]
+          : [{ variations: [], keepStores: false }];
       const liftSettings = narrowSettings.flatMap((l) =>
-        connectiveSettings.map((c) => ({ ...l, ...c, variations: [...l.variations, ...c.variations] })),
+        connectiveSettings.flatMap((c) =>
+          paramSettings.flatMap((w) =>
+            tailSettings.flatMap((k) =>
+              castSettings.map((f) => ({
+                ...l,
+                ...c,
+                ...w,
+                ...k,
+                ...f,
+                variations: [...l.variations, ...c.variations, ...w.variations, ...k.variations, ...f.variations],
+              })),
+            ),
+          ),
+        ),
       );
       for (const liftSetting of liftSettings) {
         let fn: Fn;
         let discardsPassedResult = false;
+        let guessesParamWidth = false;
         let inferredSymbols = new Map<string, SymbolInfo>();
         let orderLicensed: ReadonlySet<string> = new Set<string>();
         try {
@@ -1932,7 +2191,17 @@ export function enumerateCandidates(
           fn =
             liftSetting.variations.length === 0
               ? base
-              : liftStamped(name, asm, target, prototypes, opts.asmData, symbolSetting.symbols);
+              : liftStamped(
+                  name,
+                  asm,
+                  target,
+                  prototypes,
+                  opts.asmData,
+                  symbolSetting.symbols,
+                  opts.contextGlobals,
+                  { keepTailSlots: liftSetting.keepTailSlots, calleeBodies: opts.calleeBodies },
+                  ownContext.ownContextProto,
+                );
           if (liftSetting.narrow && !narrowToSetupArgs(fn)) {
             continue; // nothing to cut after all — the default lift's own candidates already cover it
           }
@@ -1968,9 +2237,10 @@ export function enumerateCandidates(
           // …and the NAMES the map holds for the addresses this lift built by arithmetic off a
           // named one (raise/offsetnames.ts). Per lift setting, off that setting's own map: the
           // `/raw-globals` sibling has no map and so no name to reach. AFTER the two readings, and
-          // the staleness that leaves them is priced in pipeline.ts's copy of this note.
+          // the staleness that leaves them is priced in pipeline.ts's copy of this note, which also
+          // states the one-spelling-per-cell decline the pass throws from here.
           if (symbolSetting.symbols) {
-            OFFSET_NAME_PASS.run(fn, symbolSetting.symbols, target.compilerBehaviors);
+            OFFSET_NAME_PASS.run(fn, symbolSetting.symbols, offsetNameBehaviorsFor(target, opts.contextGlobals));
           }
           for (const [n, si] of [...inferredSymbols]) {
             if (baseOpts.symbols?.has(n) === true || !sameDerivedShape(declSymbols.get(n), si)) {
@@ -1992,7 +2262,16 @@ export function enumerateCandidates(
               },
             },
             prototypes[name],
-            { shortCircuit: { foldTreeOwned: liftSetting.connective } },
+            {
+              shortCircuit: { foldTreeOwned: liftSetting.connective },
+              paramWidth: {
+                extendedReaders: liftSetting.extendedReaders,
+                onUndeclaredWidth: () => {
+                  guessesParamWidth = true;
+                },
+              },
+              displaced: { keepStores: liftSetting.keepStores },
+            },
           );
         } catch (e) {
           // THE DEFAULT CARRIES NO VARIATION, by construction: every lift variation appends one, so
@@ -2007,6 +2286,33 @@ export function enumerateCandidates(
           reportThrow(settingVariations, e);
           continue;
         }
+        // THE OTHER RETURN-TAIL READING, `/ret-copy` or `/ret-join`, in its own `reading` pass
+        // between the follow and the sink. The default pass structures each setting both ways where
+        // the join past early returns took a join somewhere (`onJoinPastReturns`), and publishes one
+        // (pipeline.ts `structureReturnTailReading`). On a target that declares the join its default
+        // (`joinPastReturnsByDefault`: mwcc 2.4.2 and 2.3.3) it structures the join first
+        // and publishes the copies (`copyReturnTails`) only where they spell the function in fewer
+        // lines, the layout shows a cross-jumped return tail, or an early return keeps a
+        // branch-proven constant unfolded. On every other target it structures the copies first and publishes them, and the
+        // join only where the copies refuse. This pass
+        // enumerates the tree it did not publish, so neither reading is structured twice:
+        //   - `/ret-copy`, the copies, where the join was published. A chain of `if`s each holding
+        //     an early `return;` has no CFG join (`synthetic:retchain`), and where the early returns
+        //     cross-jump into one return tail the follow lands on that tail
+        //     (`synthetic:retchain_xj`); without the join both copy the code below every such `if`
+        //     into its arms, and a switch with a `case` that returns early likewise. The copies are
+        //     kept as a candidate because some rows' bytes are them (`synthetic:sw_fall:ido7.1`);
+        //   - `/ret-join`, the join, where the copies were published: the join copies a return tail
+        //     into each early return in its turn, and where that is the longer spelling it is kept
+        //     as a candidate beside the copies.
+        // A setting whose structuring never took the join has one reading, and pays no candidate.
+        // With both in the fan, the bound moves a ranked score nowhere: `compareScored` orders a
+        // score tie by goto, cast and line counts before enumeration order.
+        //
+        // The shared-tail passes below structure with the copies too: their follow and sink were
+        // ranked against the copies, their winners hold those trees, and crossing them with the join
+        // is a reading nothing has measured.
+        //
         // THE SHARED-TAIL VARIATIONS: the same raised fn, structured again with `followEarlyReturns`,
         // in two passes after the default one.
         //   - `/shared-ret` is the follow ALONE, on the fn as raised. Some divergent `if` shares a
@@ -2049,14 +2355,30 @@ export function enumerateCandidates(
         // `droppedDefault` is the DEFAULT pass's drops. Each shared-tail pass reads it and keeps its
         // own drops in a copy, so one pass's structuring failure never removes the other's candidate.
         const droppedDefault = new Set<string>();
-        for (const pass of ['default', 'follow', 'sink'] as const) {
+        // Per DEFAULT-pass setting whose structuring was a choice between the join past early
+        // returns and the return-tail copies (pipeline.ts `structureReturnTailReading`), the reading
+        // it did not publish: the only trees the `reading` pass enumerates, as `/ret-copy` where the
+        // join was published and `/ret-join` where the copies were.
+        const unpublishedDefault = new Map<string, { readonly reading: 'copies' | 'join'; readonly sfn: SFn }>();
+        // DEFAULT-pass settings whose copies were dropped (they declined or failed a boundary
+        // contract) or barred: the strip closure over them, as `dropped` is over whole settings, so
+        // `X/merge-names` never publishes or offers the copies where `X`'s copies failed.
+        const copiesDropped = new Set<string>();
+        // What `assertDefaultAccepts` learned about this fn, shared by every setting structured from it.
+        let acceptsMemo = new DefaultAcceptsMemo(fn);
+        for (const pass of ['default', 'follow', 'reading', 'sink'] as const) {
           if (pass === 'follow' && !hasDivergentSharedRet(fn)) {
             continue;
           }
+          if (pass === 'reading' && unpublishedDefault.size === 0) {
+            continue;
+          }
           if (pass === 'sink') {
             let sunk: boolean;
             try {
               sunk = sinkStoreTails(fn);
+              // The sink rewrites fn in place, so nothing the memo learned before it holds after it.
+              acceptsMemo = new DefaultAcceptsMemo(fn);
               if (sunk) {
                 verify(fn);
               }
@@ -2084,6 +2406,8 @@ export function enumerateCandidates(
           const settingsForLift = usableStructureSettings.filter((s) =>
             offForThisLift.every((variation) => !s[variation.flag]),
           );
+          // Per setting key structured in THIS pass, the `offWitness` hooks its structuring fired.
+          const witnessed = new Map<string, Set<NonNullable<StructureVariation['offWitness']>>>();
           // `/merge-names` combinations whose un-merged sibling was DROPPED. `structure()` already
           // refuses to let the variation unlock a function the default declines, but it can only see its own
           // refusals — a boundary contract fails out here, in `structureChecked`. Without this a
@@ -2100,14 +2424,50 @@ export function enumerateCandidates(
             if (alternative && droppedDefault.has(key)) {
               continue;
             }
-            if (
+            // THE OTHER RETURN-TAIL READING: the tree the default pass structured and did not publish,
+            // enumerated as it is. It is the same setting's, so the witness and the strip closure
+            // below already answered for it there.
+            const otherReading = pass === 'reading' ? unpublishedDefault.get(key) : undefined;
+            if (pass === 'reading' && otherReading === undefined) {
+              continue;
+            }
+            const settingLiftVariations: readonly Variation[] =
+              otherReading === undefined
+                ? liftVariations
+                : [...liftSetting.variations, otherReading.reading === 'copies' ? 'ret-copy' : 'ret-join'];
+            // THE OFF-SIBLING WITNESS (`StructureVariation.offWitness`): a setting whose variation's
+            // OFF sibling structured without firing the witness would rebuild that sibling's tree, so
+            // it is skipped and reported as the tree dedup it is. A sibling not structured in this
+            // pass (dropped, or skipped above) witnessed nothing, and the setting is structured.
+            //
+            // A setting skipped HERE builds its sibling's structuring, so it fires the hooks the
+            // sibling fired, and it is recorded with the sibling's set. Without that the gate does
+            // not compose: a setting carrying two witnessed variations (`tail-copies/for-continue`)
+            // finds each sibling unrecorded and is structured however inert both are. A setting
+            // skipped here in the default pass has no reading of its own in the `reading` pass:
+            // the sibling's fired set is the union of both its readings' (`structureReturnTailReading`),
+            // so both of this setting's readings are the sibling's trees, which the sibling enumerates.
+            const sameAs = STRUCTURE_VARIATIONS.flatMap((variation) => {
+              if (otherReading !== undefined || variation.offWitness === undefined || !s[variation.flag]) {
+                return [];
+              }
+              const sibling = s.variations.filter((v) => v !== variation.name).join('/');
+              const seen = witnessed.get(sibling);
+              return seen !== undefined && !seen.has(variation.offWitness) ? [seen] : [];
+            });
+            if (sameAs.length > 0) {
+              witnessed.set(key, sameAs[0]);
+              opts.onTreeDeduped?.();
+              continue;
+            }
+            const stripped = (set: ReadonlySet<string>): boolean =>
               STRUCTURE_VARIATIONS.some(
                 (variation) =>
                   variation.strip &&
                   s[variation.flag] &&
-                  dropped.has(s.variations.filter((v) => v !== variation.name).join('/')),
-              )
-            ) {
+                  set.has(s.variations.filter((v) => v !== variation.name).join('/')),
+              );
+            if (otherReading === undefined && stripped(dropped)) {
               // A SKIPPED setting is recorded exactly like a dropped one, or the closure would not be
               // transitive: with plain X dropped and X/inplace skipped-but-unrecorded,
               // X/inplace/merge-names would find neither stripped key and run — shipping a
@@ -2119,28 +2479,97 @@ export function enumerateCandidates(
             // which it re-derives from its map on every call, so both branch senses structure the same
             // recovered function without re-lifting.
             let sfn: SFn;
+            const fired = new Set<NonNullable<StructureVariation['offWitness']>>();
+            const witnessHooks = Object.fromEntries(
+              STRUCTURE_VARIATIONS.flatMap((variation) =>
+                variation.offWitness !== undefined && !s[variation.flag]
+                  ? [[variation.offWitness, () => fired.add(variation.offWitness!)]]
+                  : [],
+              ),
+            );
+            let counterSignRefused = false;
+            const structOpts = {
+              ...symbolSettingOpts,
+              ...(inferredSymbols.size ? { inferredSymbols } : {}),
+              ...(orderLicensed.size ? { orderLicensedGlobals: orderLicensed } : {}),
+              preserveDivergentBranchSense: s.sense,
+              negateJoinedBranchSense: s.join ? !defSense : defSense,
+              ...(s.flipSites ? { branchSenseFlipSites: s.flipSites } : {}),
+              anchorConstCopies: s.anchor,
+              anchorLoopEntryConsts: s.entry,
+              spellBitfieldMembers: s.bitfields,
+              spellPtrMemberElements: s.ptrElems,
+              spellDeclaredSubscripts: s.declRank,
+              ...STRUCTURE_VARIATIONS.reduce(
+                (acc, variation) => ({ ...acc, ...variation.options(s[variation.flag]) }),
+                {},
+              ),
+              ...(alternative ? { followEarlyReturns: true, copyReturnTails: true } : {}),
+            };
+            const hooks = {
+              ...witnessHooks,
+              onCounterSignRefused: () => {
+                counterSignRefused = true;
+              },
+            };
             try {
-              sfn = structureChecked(fn, {
-                ...symbolSettingOpts,
-                ...(inferredSymbols.size ? { inferredSymbols } : {}),
-                ...(orderLicensed.size ? { orderLicensedGlobals: orderLicensed } : {}),
-                preserveDivergentBranchSense: s.sense,
-                negateJoinedBranchSense: s.join ? !defSense : defSense,
-                ...(s.flipSites ? { branchSenseFlipSites: s.flipSites } : {}),
-                anchorConstCopies: s.anchor,
-                anchorLoopEntryConsts: s.entry,
-                spellBitfieldMembers: s.bitfields,
-                spellPtrMemberElements: s.ptrElems,
-                spellDeclaredSubscripts: s.declRank,
-                ...STRUCTURE_VARIATIONS.reduce(
-                  (acc, variation) => ({ ...acc, ...variation.options(s[variation.flag]) }),
-                  {},
-                ),
-                ...(alternative ? { followEarlyReturns: true } : {}),
-              });
+              if (otherReading !== undefined) {
+                sfn = otherReading.sfn;
+              } else if (pass === 'default') {
+                // THE RETURN-TAIL READING, bounded by size and read off the layout (pipeline.ts
+                // `structureReturnTailReading`): on a target that declares the join past early
+                // returns its default, the join, or the copies where they spell this setting's
+                // function shorter or the asm layout or an unfolded return marks them; on every other
+                // target the copies, structured first, and the join only where they refuse, with
+                // their refusal reported under `ret-copy` (the reading the fan then cannot hold). A
+                // setting fails only where both refuse, and that failure is handled below as any
+                // structuring failure. The losing tree is kept for the `reading` pass, so neither
+                // reading is structured twice.
+                const copiesBarred = stripped(copiesDropped);
+                const read = structureReturnTailReading(
+                  fn,
+                  { ...structOpts, joinPastReturns: copiesBarred },
+                  (t) => backend.emit(t),
+                  hooks,
+                  acceptsMemo,
+                );
+                sfn = read.sfn;
+                if (read.unpublished === undefined) {
+                  if (copiesBarred) {
+                    copiesDropped.add(key);
+                  }
+                } else if ('error' in read.unpublished) {
+                  copiesDropped.add(key);
+                  reportThrow(
+                    [...liftVariations, 'ret-copy', ...s.variations, ...symbolSetting.variations],
+                    read.unpublished.error,
+                  );
+                } else {
+                  unpublishedDefault.set(key, read.unpublished);
+                }
+                witnessed.set(key, fired);
+              } else {
+                sfn = structureChecked(fn, structOpts, hooks, acceptsMemo);
+                witnessed.set(key, fired);
+              }
             } catch (e) {
+              if (e instanceof DefaultAcceptsMemoMisuse) {
+                throw e; // a memo wired to the wrong fn is a defect here, never a dropped variation
+              }
               if (abortsRow([...liftVariations, ...symbolSetting.variations], s)) {
-                throw e; // the default lift's default setting keeps its behavior: a failure aborts the row
+                if (!(
+                  counterSignRefused &&
+                  !cand.signed &&
+                  pinnable &&
+                  e instanceof StructureError &&
+                  declinesOnCounterSign(fn, structOpts)
+                )) {
+                  throw e; // the default lift's default setting keeps its behavior: a failure aborts the row
+                }
+                // THE UNSIGNED PIN'S DECLINE, HELD FOR THE SIGNED ONE — and the rest of the unsigned
+                // pin is not built: every other setting of it would run behind a declined default.
+                heldPinDecline ??= e;
+                continue pins;
               }
               // Recorded for EVERY dropped setting: a candidate with more variations on looks its siblings
               // up by stripping one variation at a time, and the stripped key can itself carry the other.
@@ -2191,7 +2620,13 @@ export function enumerateCandidates(
             // The PRE-RESPELL variations (PRE_RESPELL_VARIATIONS, the last composition the POLICY note
             // names): rewrite the TREE, then run the whole respell set over the result, so every
             // respell variation derives from the rewrite instead of composing onto it. The gate is the pass's
-            // own decline; the contracts are `respell`'s three, for `respell`'s reasons.
+            // own decline; the contracts are `respell`'s, for `respell`'s reasons, plus the effect count
+            // `respell` cannot run (its note above): a pre-respell rewrite moves control, not just
+            // spelling — `/unmerge` copies a join into its arms, `/case-end-goto` jumps over the code
+            // between a loop and its arm's end — and the per-path count is what refuses a rewrite that
+            // runs a call twice on one path or drops one. It is also the only production reader of
+            // that count's case-end-goto paths (contracts.ts `PathCounts.end`): structuring never
+            // writes the goto, so without it those paths are read by unit tests alone.
             for (const pf of PRE_RESPELL_VARIATIONS) {
               try {
                 const made = pf.apply(sfn);
@@ -2214,6 +2649,9 @@ export function enumerateCandidates(
                 assertLocalsWritten(made);
                 assertPostIncrUnshared(made);
                 assertNoOrphanedLocals(sfn, made);
+                assertLocalStorageStaysInteger(sfn, made);
+                assertFrameUnionsViewed(made);
+                assertEffectsPreserved(fn, made);
                 // A backend refusal on this REWRITTEN tree is not a refusal of the row's own
                 // tree, so it never becomes the row's stated cause: `TreeSources.emit` is dropped
                 // here and only the call over the row's own tree above records one.
@@ -2274,15 +2712,22 @@ export function enumerateCandidates(
                 // whichever route the enumeration happened to walk first.
                 if (sp.matchOnly === undefined) {
                   delete dup.matchOnly;
+                  delete dup.signedUnsignedCompare;
                 }
                 if (!discardsPassedResult) {
                   delete dup.discardsPassedResult;
                 }
+                if (!guessesParamWidth) {
+                  delete dup.guessesParamWidth;
+                }
+                if (!liftSetting.keepStores) {
+                  delete dup.farStoreCast;
+                }
                 continue;
               }
               const variations: readonly Variation[] = [
                 cand.variation,
-                ...liftVariations,
+                ...settingLiftVariations,
                 ...s.variations,
                 ...sp.variations,
                 ...symbolSetting.variations,
@@ -2299,8 +2744,11 @@ export function enumerateCandidates(
                 preference: symbolIndex,
                 ...(sp.symbolRefs ? { symbolRefs: sp.symbolRefs } : {}),
                 ...(sp.deviceVolatile ? { deviceVolatile: sp.deviceVolatile } : {}),
-                ...(sp.matchOnly ? { matchOnly: sp.matchOnly } : {}),
+                ...(sp.matchOnly ? { matchOnly: true as const } : {}),
+                ...(sp.signedUnsignedCompare ? { signedUnsignedCompare: true as const } : {}),
                 ...(discardsPassedResult ? { discardsPassedResult: true as const } : {}),
+                ...(guessesParamWidth ? { guessesParamWidth: true as const } : {}),
+                ...(liftSetting.keepStores ? { farStoreCast: true as const } : {}),
               };
               seen.set(source, made);
               out.push(made);
@@ -2313,6 +2761,9 @@ export function enumerateCandidates(
   // Every tree the fan produced was refused by the backend. Each refusal on its own is a dropped
   // candidate; all of them together is the row, and it stays LOUD — the alternative is a caller
   // ranking an empty list and reporting no match for a function nothing ever tried to spell.
+  if (out.length === 0 && heldPinDecline !== undefined) {
+    throw heldPinDecline;
+  }
   if (out.length === 0) {
     throw new NoSpellableCandidateError(
       `no spellable candidate for '${name}': ${firstLine(lastEmitError ?? 'no candidate produced')}`,
@@ -2440,7 +2891,8 @@ function stillbornNote(stillborn: Stillborn, fan: number): string {
  *
  *  A DISCARDED PASSED RESULT next (`Candidate.discardsPassedResult`): equal bytes refute neither
  *  reading, so the one that drops a value the callee may read wins only where it scores strictly
- *  better.
+ *  better. A GUESSED PARAMETER WIDTH (`Candidate.guessesParamWidth`) likewise: a narrow declaration
+ *  no prototype supplied changes its callers' bytes, which no score here reads.
  *
  *  PREFERENCE next: a named symbol-map spelling beats its `/raw-globals` sibling at equal bytes.
  *
@@ -2463,6 +2915,11 @@ function stillbornNote(stillborn: Stillborn, fan: number): string {
  *  below does the same for `/narrow-decl`, which drops one cast per local it narrows and so wins
  *  every tie against the candidate it is derived onto.
  *
+ *  A FAR STORE SPELLED THROUGH A CAST (`Candidate.farStoreCast`) next: where `/far-cast` ties the
+ *  member spelling, the compiler built the member's object too, and the member names the field. Its
+ *  `(u8 *)` base is no scalar cast and its line count is no higher, so neither term below would
+ *  prefer the member on its own.
+ *
  *  CAST COUNT next, and only WITHIN a preference. A wrong signedness pin is what manufactures casts —
  *  the C backend has to cast a shift operand back to the signedness the machine op needs, so
  *  pinning `u32` on a genuinely-signed parameter buys `s32 f(u32 a0) { return (s32)a0 >> a1; }`
@@ -2480,12 +2937,11 @@ function stillbornNote(stillborn: Stillborn, fan: number): string {
  *  result deterministic. Spelled explicitly rather than leaning on Array#sort's stability, which
  *  would make each preference an accident of two unrelated decisions.
  *
- *  WHAT NO TERM HERE WEIGHS: a comparison's rendered SIGNEDNESS. `/uns-cmp`'s whole output is
- *  that polarity, and it carries in a DECLARED TYPE rather than a cast — `castCount` reads 0 on
- *  both sides of the tie it loses — so at equal bytes enumeration order decides, and a rival
- *  variation's candidate can publish a signed compare where the asm's is unsigned. Weighing it needs
- *  the candidate's own SFn and the icmp facts it was structured from, neither of which this
- *  comparator carries; `deviceVolatile` is the shape such a term would take. */
+ *  WHAT NO TERM HERE WEIGHS: a comparison's rendered SIGNEDNESS. It needs none: every tree a
+ *  source is emitted from is judged for an unsigned compare that renders signed
+ *  (`Candidate.signedUnsignedCompare`), whichever variation spelled it so, and such a source is
+ *  `matchOnly` — on a nonmatch it is withheld before this comparator sees it, whatever it scores,
+ *  and on a match both spellings are the program. */
 export function compareScored<S extends { score: number }>(
   a: Candidate & { score: S; order: number },
   b: Candidate & { score: S; order: number },
@@ -2493,20 +2949,32 @@ export function compareScored<S extends { score: number }>(
   return (
     a.score.score - b.score.score ||
     (a.discardsPassedResult ? 1 : 0) - (b.discardsPassedResult ? 1 : 0) ||
+    (a.guessesParamWidth ? 1 : 0) - (b.guessesParamWidth ? 1 : 0) ||
     a.preference - b.preference ||
     (b.deviceVolatile ?? 0) - (a.deviceVolatile ?? 0) ||
+    (a.farStoreCast ? 1 : 0) - (b.farStoreCast ? 1 : 0) ||
+    gotoCount(a.source) - gotoCount(b.source) ||
     castCount(a.source) - castCount(b.source) ||
     lineCount(a.source) - lineCount(b.source) ||
     a.order - b.order
   );
 }
 
-/** Non-blank lines in a candidate's rendered source — the compactness tie-break above, counted
- *  exactly as `quality.ts` counts `lines`. Deterministic, and total on any string. */
-function lineCount(source: string): number {
-  return source.split('\n').filter((l) => l.trim().length > 0).length;
+/** `goto` statements in a candidate's rendered source — the readability tie-break above, asked
+ *  before the casts. Each goto asmlift writes (l3/ast.ts: a jump to a case label of the switch it
+ *  sits in, or to the `break;` that ends its arm) is a ranked spelling against a goto-free one —
+ *  copies (`/case-goto`) or a flag (`/case-end-goto`) — and where the two score alike the goto-free
+ *  one is published: a goto is the narrow exception the differ has to earn, never a tie's winner.
+ *  Deterministic, and total on any string. */
+export function gotoCount(source: string): number {
+  return source.match(/\bgoto [A-Za-z_]\w*;/g)?.length ?? 0;
 }
 
+/** Non-blank lines in a candidate's rendered source — the compactness tie-break above, counted
+ *  exactly as `quality.ts` counts `lines`, and the one count the default's return-tail reading is
+ *  bounded by (pipeline.ts `sourceLineCount`). Deterministic, and total on any string. */
+const lineCount = sourceLineCount;
+
 /** Scalar casts in a candidate's rendered source — the readability tie-break above.
  *
  *  A WITHIN-PREFERENCE tie-break over two spellings of ONE function, and deliberately NARROWER than