@geastack/compiler 1.0.15

package/dist/ir/program-facts.js

@@ -0,0 +1,319 @@
+import { representationKey } from '../representation/model.js';
+import { borrowEffectsOf } from './borrow-effects.js';
+import { callableIdentityDemandOf } from './callable-identity-demand.js';
+import { fixedFieldDeletionsOf, integrityRestrictionsOf } from './integrity-restrictions.js';
+import { singleEvaluationClassesOf } from './class-evaluation.js';
+import { callableMemberCandidatesOf } from './callable-member-candidates.js';
+import { cyclicBlocksOf } from './dominance.js';
+import { allOperationsOf } from './model.js';
+import { operandsOfIrOperation } from './queries.js';
+import { buildDyingArgumentIndex } from './transfer.js';
+/**
+ * Constructor cells whose construction this unit should call BY NAME.
+ *
+ * Not every one of them: naming the construct function lets clang inline the
+ * whole construction -- `gea::makeRef`, its pool refill, its `try`/`catch` --
+ * into whatever body constructs, and that is either the point or a disaster
+ * depending on how often the body constructs. Both were measured, on the same
+ * day, with the same compiler:
+ *
+ * - `bench/comparison/fixtures/binary_trees.ts` constructs a million times
+ *   inside a recursive body. Through the carrier the construction is an
+ *   INDIRECT call taking two `gea::Ref` arguments by address, with a retain
+ *   and a release around each: 46.1ms. Named, and therefore inlined: 41.9ms.
+ * - `bench/comparison/fixtures/method_calls.ts` constructs ONCE, before its
+ *   hot loop. Naming it there spent the caller's inlining budget on a
+ *   construction that runs a single time, and the loop's own callee stopped
+ *   being inlined: 38.1ms to 49.0ms.
+ *
+ * So the question is not "can this be devirtualized" -- an earlier attempt
+ * asked that, got `yes` for both, and was reverted as a net loss -- but "does
+ * the program construct through this cell REPEATEDLY". A construction inside a
+ * cyclic block or in a body that calls itself runs many times; one in
+ * straight-line code in a non-recursive body runs as many times as its caller
+ * does. Callback arguments and the known call graph extend that repeated
+ * context to event-driven bodies without marking all initialization hot.
+ *
+ * `noinline` on the construct function was measured too, as the way to have
+ * the direct call without the inlining, and it is worse than either
+ * (binary_trees 41.9ms to 44.5ms): the inlining IS the win where the win is.
+ */
+const buildRepeatedConstructorIndex = (bodies, directCallables) => {
+    const allocated = new Map();
+    const writeCounts = new Map();
+    const written = new Map();
+    for (const body of bodies) {
+        for (const block of body.blocks.values()) {
+            for (const operation of block.operations) {
+                if (operation.kind === 'allocate-constructor' && operation.captures.length === 0)
+                    allocated.set(operation.result.id, operation.declaration);
+                if (operation.kind !== 'binding-write')
+                    continue;
+                writeCounts.set(operation.declaration, (writeCounts.get(operation.declaration) ?? 0) + 1);
+                const declaration = allocated.get(operation.value.value);
+                if (declaration !== undefined)
+                    written.set(operation.declaration, declaration);
+            }
+        }
+    }
+    // Callbacks may be invoked repeatedly by their consumer, including a host
+    // event loop. Propagate that context through known calls instead of treating
+    // every acyclic callback body as one-time initialization. This is an inlining
+    // heuristic; the single-write constructor proof below remains mandatory.
+    const callbacks = new Map();
+    const callbackReads = new Map();
+    for (const body of bodies) {
+        for (const block of body.blocks.values()) {
+            for (const operation of block.operations) {
+                if (operation.kind === 'allocate-callable')
+                    callbacks.set(operation.result.id, operation.functionId);
+                if (operation.kind === 'binding-read')
+                    callbackReads.set(operation.result.id, operation.declaration);
+            }
+        }
+    }
+    const functionOf = (value) => {
+        const declaration = callbackReads.get(value);
+        return callbacks.get(value) ?? (declaration === undefined ? undefined : directCallables.get(declaration));
+    };
+    const repeatedBodies = new Set();
+    const calls = new Map();
+    for (const body of bodies) {
+        const cyclic = cyclicBlocksOf(body);
+        for (const [blockId, block] of body.blocks) {
+            for (const operation of block.operations) {
+                if (operation.kind !== 'call' && operation.kind !== 'construct')
+                    continue;
+                for (const argument of operation.arguments) {
+                    const callback = functionOf(argument.value);
+                    if (callback !== undefined)
+                        repeatedBodies.add(callback);
+                }
+                if (operation.kind !== 'call')
+                    continue;
+                const callee = functionOf(operation.callee.value);
+                if (callee === undefined)
+                    continue;
+                const targets = calls.get(body.sourceOwner) ?? new Set();
+                targets.add(callee);
+                calls.set(body.sourceOwner, targets);
+                if (cyclic.has(blockId) || callee === body.sourceOwner)
+                    repeatedBodies.add(callee);
+            }
+        }
+    }
+    for (const caller of repeatedBodies) {
+        for (const callee of calls.get(caller) ?? [])
+            repeatedBodies.add(callee);
+    }
+    const repeated = new Map();
+    for (const body of bodies) {
+        const cyclic = cyclicBlocksOf(body);
+        const reads = new Map();
+        let recursive = false;
+        for (const block of body.blocks.values()) {
+            for (const operation of block.operations) {
+                if (operation.kind === 'binding-read')
+                    reads.set(operation.result.id, operation.declaration);
+                // A body that calls ITSELF constructs as many times as it recurses,
+                // which is the same fact a cyclic block states one level down. The
+                // callee is a cell like any other, so the same index the emitter
+                // devirtualizes calls through is what answers which body it names.
+                if (operation.kind !== 'call')
+                    continue;
+                const callee = reads.get(operation.callee.value);
+                if (callee !== undefined && directCallables.get(callee) === body.sourceOwner)
+                    recursive = true;
+            }
+        }
+        for (const [blockId, block] of body.blocks) {
+            if (!recursive && !repeatedBodies.has(body.sourceOwner) && !cyclic.has(blockId))
+                continue;
+            for (const operation of block.operations) {
+                if (operation.kind !== 'construct')
+                    continue;
+                const cell = reads.get(operation.callee.value);
+                if (cell === undefined || writeCounts.get(cell) !== 1)
+                    continue;
+                const declaration = written.get(cell);
+                if (declaration !== undefined)
+                    repeated.set(cell, declaration);
+            }
+        }
+    }
+    return repeated;
+};
+/**
+ * Which parameter positions this body may declare `const T&` instead of `T`.
+ *
+ * A `std::string` formal taken by value is a heap copy per call and a
+ * `gea::Ref<T>` one an atomic pair, paid for an argument the caller already
+ * holds for the whole call. Like the target's `borrowsReceiver`, this is the
+ * BODY's spelling only: the ABI, the carrier and the thunk keep the by-value
+ * convention every caller agrees on, and the thunk's own copy binds to the
+ * reference.
+ *
+ * Unlike the receiver, a parameter may ALIAS storage the body can write.
+ * `this.label = f(this.label)` passes the field itself (a plain read is spelled
+ * inline, so the reference binds to `gea_this->label`), and a body that then
+ * assigned that field before reading its parameter would read the new value
+ * where the language gives it the old one. So a body borrows only when it can
+ * change no caller-owned handle/string slot or re-enter program code. The
+ * shared IR effect proof admits native byte stores and non-coercing primitive
+ * calls, but excludes accessors, arbitrary calls, deletes and construction.
+ * There is no `await`/`yield` (a
+ * reference across a suspension dangles -- the coroutine rule
+ * `borrowsReceiver` states), and writes only to its own locals. And a
+ * parameter the body hands on as a DYING argument is not borrowed either: that
+ * read is spelled `std::move(...)` (`emit-narrowing.ts`), which a `const&`
+ * refuses.
+ *
+ * `examples/apps/weather` formats temperatures and labels through forty such
+ * string parameters; every one of them was a copy.
+ */
+/** An `optional` over a reference-counted or string payload: physically one handle, copied by value only because the wrapper states no ownership. */
+const refCarrierByValue = (value) => value.kind === 'optional' &&
+    (value.payload.kind === 'string' || ('ownership' in value.payload && value.payload.ownership === 'shared-refcount'));
+const borrowedFormalsOf = (body, dyingArguments, isBoxed, isCoroutineBody, placements, safeOperations, borrowedForwarding) => {
+    const borrowed = new Set();
+    if (!body.abi || isCoroutineBody(body))
+        return borrowed;
+    const parameters = new Map();
+    const seededBy = new Map();
+    const readsOf = new Map();
+    for (const block of body.blocks.values()) {
+        for (const operation of block.operations) {
+            if (!safeOperations.has(operation))
+                return borrowed;
+            if (operation.kind === 'parameter')
+                parameters.set(operation.result.id, operation.ordinal);
+            if (operation.kind === 'binding-write') {
+                const placement = placements.get(operation.declaration);
+                if (!placement || placement.storage.kind !== 'local' || String(placement.storage.owner) !== String(body.sourceOwner))
+                    return borrowed;
+                seededBy.set(operation.declaration, [...(seededBy.get(operation.declaration) ?? []), operation.value.value]);
+            }
+            if (operation.kind === 'binding-read')
+                readsOf.set(operation.declaration, [...(readsOf.get(operation.declaration) ?? []), operation.result.id]);
+        }
+    }
+    for (const [value, ordinal] of parameters) {
+        const parameter = body.abi.parameters[ordinal];
+        if (!parameter || parameter.ownership === 'borrowed')
+            continue;
+        // A nullable handle (`TreeNode | null`) is passed by value -- `passingOf`
+        // gives an `optional` no ownership of its own -- yet copying it is the
+        // same retain/release as copying the handle it wraps, so it borrows on
+        // the same terms.
+        if (parameter.passing !== 'const-ref' && !refCarrierByValue(parameter.value))
+            continue;
+        // The parameter's own value usually has exactly one reader -- the write
+        // that seeds its cell -- and is therefore "dying" into it. That write is
+        // the one `collectFormalCells` elides (the body then reads the formal by
+        // name), so it moves nothing; but it is elided only under that function's
+        // own conditions -- one write, an unboxed cell, the same carrier -- and a
+        // seed that stays is spelled `std::move(gea_arg_N)`, which a `const&`
+        // refuses. So the same conditions decide here.
+        let moved = false;
+        for (const [declaration, values] of seededBy) {
+            if (!values.includes(value))
+                continue;
+            const placement = placements.get(declaration);
+            const sameCarrier = placement?.representation != null && representationKey(placement.representation) === representationKey(parameter.value);
+            if (values.length !== 1 || isBoxed(declaration) || !sameCarrier)
+                moved = true;
+            for (const read of readsOf.get(declaration) ?? [])
+                if (dyingArguments.has(read) && !borrowedForwarding.has(read))
+                    moved = true;
+        }
+        if (!moved)
+            borrowed.add(ordinal);
+    }
+    return borrowed;
+};
+/**
+ * Everything a translation unit needs to know about the whole program before
+ * it renders a body, in the one dependency order these questions actually
+ * have: a callable must be named before repeated construction through it can
+ * be counted, and both must exist before the borrow fixed point can ask which
+ * calls forward an already-borrowed argument unchanged.
+ */
+export const programFactsOf = (bodies, directCallables, placements, policy) => {
+    const callableMemberCandidates = callableMemberCandidatesOf(bodies, directCallables);
+    const repeatedConstructors = buildRepeatedConstructorIndex(bodies, directCallables);
+    const dyingArguments = buildDyingArgumentIndex(bodies);
+    const borrowEffects = borrowEffectsOf(bodies, directCallables, policy.captureFree, (body) => !policy.isCoroutineBody(body), policy.isPrivateLocal, policy.plainFieldRead);
+    // A fixed point over the whole unit: a call forwarding one of ITS OWN
+    // already-borrowed formals to a callee position that callee also borrows
+    // adds no new alias the callee doesn't already tolerate, so the caller may
+    // borrow that formal too even though it also passes it on. Any other use
+    // -- read for anything but such a forwarded argument -- disqualifies it.
+    // Because a callee's admitted set can grow on a later pass (it may itself
+    // depend on a third body not yet settled), this iterates until nothing
+    // grows, exactly as `borrowEffectsOf`'s own effect proof does.
+    const borrowedFormals = new Map();
+    let borrowingChanged = true;
+    while (borrowingChanged) {
+        borrowingChanged = false;
+        for (const body of bodies) {
+            const forwarded = new Set();
+            const otherUses = new Set();
+            for (const block of body.blocks.values())
+                for (const operation of allOperationsOf(block)) {
+                    const target = operation.kind === 'call' ? borrowEffects.targets.get(operation.callee.value) : undefined;
+                    const admitted = target === undefined ? undefined : borrowedFormals.get(String(target));
+                    for (const operand of operandsOfIrOperation(operation)) {
+                        const positions = operation.kind === 'call'
+                            ? operation.arguments.flatMap((argument, index) => (argument.value === operand.value ? [index] : []))
+                            : [];
+                        if (admitted && positions.length > 0 && positions.every((position) => admitted.has(position)))
+                            forwarded.add(operand.value);
+                        else
+                            otherUses.add(operand.value);
+                    }
+                }
+            for (const value of otherUses)
+                forwarded.delete(value);
+            const owner = String(body.sourceOwner);
+            const next = borrowedFormalsOf(body, dyingArguments, policy.isBoxed, policy.isCoroutineBody, placements, borrowEffects.operations.get(owner) ?? new Set(), forwarded);
+            if (next.size > (borrowedFormals.get(owner)?.size ?? 0))
+                borrowingChanged = true;
+            borrowedFormals.set(owner, next);
+        }
+    }
+    const formalsBorrowedIn = (owner) => borrowedFormals.get(String(owner)) ?? new Set();
+    // See `ProgramFacts.bodyCallsUnsafeKnownCallee`'s doc: a body is flagged the
+    // moment ONE of its 'call' operations names a resolvable target
+    // (`borrowEffects.targets`) that the fixed point above never proved safe
+    // (absent from that owner's own final safe-operation set). An opaque call
+    // -- no resolvable target -- never flags anything here, on purpose: that
+    // hazard is the call-SITE's to rule out, not this body's.
+    const unsafeKnownCallees = new Set();
+    for (const body of bodies) {
+        const owner = String(body.sourceOwner);
+        const safe = borrowEffects.operations.get(owner);
+        for (const block of body.blocks.values())
+            for (const operation of allOperationsOf(block)) {
+                if (operation.kind !== 'call' || !borrowEffects.targets.has(operation.callee.value))
+                    continue;
+                if (!safe?.has(operation))
+                    unsafeKnownCallees.add(owner);
+            }
+    }
+    const bodyCallsUnsafeKnownCallee = (owner) => unsafeKnownCallees.has(String(owner));
+    const callableIdentityDemand = callableIdentityDemandOf(bodies, { classInstanceOf: policy.classInstanceOf });
+    const nativeIntegrityRestricted = integrityRestrictionsOf(bodies);
+    const fixedFieldStateConstant = !nativeIntegrityRestricted && !fixedFieldDeletionsOf(bodies);
+    const singleEvaluationClasses = singleEvaluationClassesOf(bodies);
+    return {
+        callableMemberCandidates,
+        repeatedConstructors,
+        dyingArguments,
+        formalsBorrowedIn,
+        bodyCallsUnsafeKnownCallee,
+        callableIdentityDemand,
+        nativeIntegrityRestricted,
+        fixedFieldStateConstant,
+        singleEvaluationClasses
+    };
+};

package/dist/ir/proven-branches.d.ts

@@ -0,0 +1,16 @@
+import { type PhysicalBodyId, type SemanticResultId } from '../identity/ids.js';
+import type { SemanticGraph } from '../semantics/model/graph.js';
+import { type IrBody } from './model.js';
+import type { SlotDrift } from './lower-operands.js';
+/** Normal-completion truth facts derived from the semantic operations' sealed results. */
+export declare const provenResultTruthiness: (graph: Pick<SemanticGraph, "operations">) => ReadonlyMap<SemanticResultId, boolean>;
+/**
+ * Remove impossible control-flow edges before liveness and certification.
+ * Evaluation of the condition is preserved, including calls and throws. This
+ * pass uses normal-result facts, never a cast's destination type as evidence
+ * that the cast's block is unreachable.
+ */
+export declare const pruneProvenBranches: (bodies: ReadonlyMap<PhysicalBodyId, IrBody>, graph: Pick<SemanticGraph, "operations">, slotDrift?: readonly SlotDrift[]) => {
+    readonly bodies: ReadonlyMap<PhysicalBodyId, IrBody>;
+    readonly slotDrift: readonly SlotDrift[];
+};

package/dist/ir/proven-branches.js

@@ -0,0 +1,219 @@
+import { irValueId } from '../identity/ids.js';
+import { allOperationsOf } from './model.js';
+import { resultOfIrOperation, successorsOfTerminator } from './queries.js';
+import { verifyIrBody } from './verify.js';
+const nonNullPrimitive = (representation) => representation.kind === 'scalar' ||
+    representation.kind === 'string' ||
+    representation.kind === 'symbol' ||
+    (representation.kind === 'tagged-union' &&
+        representation.arms.length > 0 &&
+        representation.arms.every((arm) => nonNullPrimitive(arm.value)));
+const primitiveOrNullish = (representation) => nonNullPrimitive(representation) ||
+    representation.kind === 'null' ||
+    representation.kind === 'undefined' ||
+    (representation.kind === 'optional' && primitiveOrNullish(representation.payload)) ||
+    (representation.kind === 'tagged-union' && representation.arms.every((arm) => primitiveOrNullish(arm.value)));
+/** Normal-completion truth facts derived from the semantic operations' sealed results. */
+export const provenResultTruthiness = (graph) => {
+    const facts = new Map();
+    const read = (source) => {
+        if (source?.kind === 'result')
+            return facts.get(source.result);
+        if (source?.kind !== 'constant')
+            return undefined;
+        switch (source.literal) {
+            case 'undefined':
+            case 'null':
+                return false;
+            case 'boolean':
+                return source.text === 'true';
+            case 'string':
+                return source.text.length !== 0;
+            case 'number':
+                return Number(source.text) !== 0 && !Number.isNaN(Number(source.text));
+            default:
+                return undefined;
+        }
+    };
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const operation of graph.operations.values()) {
+            let truth;
+            if (operation.family === 'property' && operation.internalMethod === 'get' && operation.normalResult === 'undefined')
+                truth = false;
+            else if (operation.family === 'computation' && operation.form === 'logical') {
+                const left = read(operation.operands.find((operand) => operand.role === 'left')?.source);
+                const right = read(operation.operands.find((operand) => operand.role === 'right')?.source);
+                if (operation.operator === '&&')
+                    truth = left === false || right === false ? false : left === true ? right : undefined;
+                if (operation.operator === '||')
+                    truth = left === true || right === true ? true : left === false ? right : undefined;
+            }
+            if (truth === undefined)
+                continue;
+            for (const result of operation.results) {
+                if (result.role !== 'value' || facts.has(result.id))
+                    continue;
+                facts.set(result.id, truth);
+                changed = true;
+            }
+        }
+    }
+    return facts;
+};
+/**
+ * Remove impossible control-flow edges before liveness and certification.
+ * Evaluation of the condition is preserved, including calls and throws. This
+ * pass uses normal-result facts, never a cast's destination type as evidence
+ * that the cast's block is unreachable.
+ */
+export const pruneProvenBranches = (bodies, graph, slotDrift = []) => {
+    const semantic = provenResultTruthiness(graph);
+    if (semantic.size === 0)
+        return { bodies, slotDrift };
+    const absentReads = new Set();
+    for (const operation of graph.operations.values()) {
+        if (operation.family === 'property' && operation.internalMethod === 'get' && operation.normalResult === 'undefined')
+            for (const result of operation.results)
+                if (result.role === 'value')
+                    absentReads.add(result.id);
+    }
+    const output = new Map(bodies);
+    const removedBlocks = new Set();
+    let changedAny = false;
+    for (const [id, body] of bodies) {
+        // These regions have entry/cleanup edges beyond ordinary terminators.
+        // Keep their whole CFG until those edges have an explicit pruning recipe.
+        const protectedFlow = Boolean(body.tryRegions.length || body.iteratorCloseRegions?.length || body.generator || body.generatorPrologueBoundary);
+        const facts = new Map();
+        const operations = [...body.blocks.values()].flatMap((block) => block.operations);
+        for (const operation of operations) {
+            if (operation.kind !== 'get' && operation.kind !== 'phi')
+                continue;
+            const truth = semantic.get(operation.lineage);
+            if (truth !== undefined)
+                facts.set(operation.result.id, truth);
+        }
+        for (const operation of operations) {
+            if (operation.kind !== 'test' || operation.predicate !== 'to-boolean')
+                continue;
+            const truth = facts.get(operation.value.value);
+            if (truth !== undefined)
+                facts.set(operation.result.id, truth);
+        }
+        const blocks = new Map(body.blocks);
+        const expandedValues = new Map(body.values);
+        let ordinal = 0;
+        let changed = false;
+        for (const [blockId, original] of blocks) {
+            const operations = original.operations.flatMap((operation) => {
+                if (operation.kind !== 'get' ||
+                    !absentReads.has(operation.lineage) ||
+                    operation.result.representation.kind !== 'undefined' ||
+                    !primitiveOrNullish(operation.receiver.representation))
+                    return [operation];
+                // The base/key evaluations are separate SSA operations and remain.
+                // A nullable receiver retains GetV's RequireObjectCoercible step.
+                // The existing IR primitive preserves its TypeError without boxing.
+                changed = true;
+                const result = [];
+                if (!nonNullPrimitive(operation.receiver.representation)) {
+                    while (expandedValues.has(irValueId(body.owner, ordinal)))
+                        ordinal++;
+                    const checked = irValueId(body.owner, ordinal++);
+                    expandedValues.set(checked, operation.receiver.representation);
+                    result.push({
+                        kind: 'compute',
+                        lineage: operation.lineage,
+                        form: 'require-object-coercible',
+                        operator: 'RequireObjectCoercible',
+                        operands: [operation.receiver],
+                        result: { id: checked, representation: operation.receiver.representation }
+                    });
+                }
+                result.push({
+                    kind: 'constant',
+                    lineage: operation.lineage,
+                    literal: 'undefined',
+                    text: 'undefined',
+                    result: operation.result
+                });
+                return result;
+            });
+            const block = { ...original, operations };
+            blocks.set(blockId, block);
+            if (protectedFlow || block.terminator.kind !== 'branch')
+                continue;
+            const truth = facts.get(block.terminator.condition.value);
+            if (truth === undefined)
+                continue;
+            blocks.set(blockId, {
+                ...block,
+                terminator: {
+                    kind: 'jump',
+                    lineage: block.terminator.lineage,
+                    target: truth ? block.terminator.whenTrue : block.terminator.whenFalse
+                }
+            });
+            changed = true;
+        }
+        if (!changed)
+            continue;
+        // Replacing a proven, non-throwing lookup does not change any region's
+        // control flow. Keep that operation-level simplification even when this
+        // pass cannot yet remove the region's exceptional or cleanup edges.
+        if (protectedFlow) {
+            output.set(id, { ...body, blocks, values: expandedValues });
+            changedAny = true;
+            continue;
+        }
+        const live = new Set([body.entry]);
+        const pending = [body.entry];
+        while (pending.length) {
+            const block = blocks.get(pending.pop());
+            for (const target of successorsOfTerminator(block.terminator))
+                if (!live.has(target)) {
+                    live.add(target);
+                    pending.push(target);
+                }
+        }
+        const retained = new Map();
+        const values = new Map();
+        for (const blockId of body.blockOrder) {
+            if (!live.has(blockId)) {
+                removedBlocks.add(blockId);
+                continue;
+            }
+            const block = blocks.get(blockId);
+            const next = {
+                ...block,
+                operations: block.operations.map((operation) => operation.kind === 'phi'
+                    ? {
+                        ...operation,
+                        incoming: operation.incoming.filter((edge) => live.has(edge.block) && successorsOfTerminator(blocks.get(edge.block).terminator).includes(blockId))
+                    }
+                    : operation)
+            };
+            retained.set(blockId, next);
+            for (const operation of allOperationsOf(next)) {
+                const result = resultOfIrOperation(operation);
+                if (result)
+                    values.set(result.id, result.representation);
+            }
+        }
+        const pruned = { ...body, blocks: retained, blockOrder: body.blockOrder.filter((block) => live.has(block)), values };
+        const violations = verifyIrBody(pruned);
+        if (violations.length)
+            throw new Error(`Proven branch pruning produced invalid IR: ${JSON.stringify(violations)}`);
+        output.set(id, pruned);
+        changedAny = true;
+    }
+    // Lowering records failed slot conversions before this CFG exists. Drop
+    // only rows attached to blocks this pass has proved unreachable; unrelated
+    // and surviving failures still reach the unchanged certification guard.
+    return {
+        bodies: changedAny ? output : bodies,
+        slotDrift: removedBlocks.size ? slotDrift.filter((row) => !removedBlocks.has(row.block)) : slotDrift
+    };
+};

package/dist/ir/queries.d.ts

@@ -0,0 +1,41 @@
+import type { AllocateArrayObjectOperation, IrBlockId, IrOperand, IrOperation, IrResult, IrTerminatorOperation } from './model.js';
+/**
+ * Uniform queries over an IR operation.
+ *
+ * Split out of `model.ts`: the model states what an operation *is*; these
+ * state what any consumer needs to ask of one -- its successors, the value it
+ * defines, the values it reads -- so no consumer re-derives the answer per
+ * kind and drifts from the others.
+ */
+/**
+ * Whether building this array runs a genuinely dynamic iteration protocol --
+ * a `gather` element drains an already-acquired iterator record
+ * (`ir/model.ts`'s `IrArrayElement`), and GetIterator/IteratorStep/
+ * IteratorValue can each invoke a user-defined method (`producers/
+ * protocol.ts`'s `mintIteratorSteps` marks every one of those steps
+ * `callsUserCode: true`). A `spread` element is the opposite: a native
+ * range-copy off an Array/Set/Map/string/cursor with no protocol dispatch at
+ * all, and an `element`/`hole` is a value the program already has.
+ *
+ * One authority for both DCE passes that ask "is this allocation pure": a
+ * body-local backward slice (`ir/shake.ts`) and a per-value dead-result check
+ * (`ir/dead-values.ts`). Both used to answer `allocate-array-object`
+ * unconditionally `true` -- correct for `[1, 2, 3]`, wrong for
+ * `[...abrupt]`, whose `next()` can throw. An unread `[...abrupt]` then
+ * disappeared whole, silently skipping an iteration the language always runs.
+ */
+export declare const arrayAllocationDrainsDynamicIterator: (operation: AllocateArrayObjectOperation) => boolean;
+/**
+ * Carrier observations do not expose object fields or invoke coercion methods.
+ * Instance tests qualify only through their sealed native membership recipe;
+ * an arbitrary constructor can still execute Symbol.hasInstance. Both callable
+ * escape and reflection must consume this same effect, or an already-native
+ * test can invent an escape that indirectly restores every reflection hook.
+ */
+export declare const observesNativeCarrierOnly: (operation: IrOperation) => boolean;
+/** The block each terminator can transfer control to, in no particular order. */
+export declare const successorsOfTerminator: (terminator: IrTerminatorOperation) => readonly IrBlockId[];
+/** The value this operation defines, or `null` for an operation that only has effects or transfers control. */
+export declare const resultOfIrOperation: (operation: IrOperation) => IrResult | null;
+/** Every value this operation reads, flattened and stripped of role, for uniform representation-consistency checking. */
+export declare const operandsOfIrOperation: (operation: IrOperation) => readonly IrOperand[];