Selected stage: loom-lower-graph-memory. Test exactly output obligation mlir-obligation:280282c586f6f8051d51d7e3 with its governing context; report any stage at

LLVM memcpy, memmove, and memset intrinsics are expanded into their exact structured loop semantics before ownership selection. Supported LLVM load/store (including volatile and atomic contracts), atomicrmw, cmpxchg, and fence forms are then normalized before recursive region lowering, after which the same frontier rules apply.

When graph publication can trace every captured memory capability to a known root, an exact service rooted at a unique thread argument mechanically inherits that argument's llvm.noalias fact. If a root is unknown, appears through more than one captured capability, or does not resolve to that argument, publication must omit the fact.

memref.get_global, memref.alloca, globals, static pointer bases, and unrecognized capability producers are not canonical roots. A pre-final analysis may conservatively group an unresolved access while building an event network, but finalization rejects any such residual producer rather than granting it an external-memory authority.

A memory input binds an established external memref capability through an exact graph-launch type match. An LLVM pointer never satisfies a graph memory port.

The finalized-graph gate also rejects residual memref.load/memref.store, memref.get_global, raw pointer arithmetic, pointer-bearing operations, builtin.unrealized_conversion_cast, and unknown memory-capability producers. An unsupported effectful operation inside a structured region must likewise fail closed instead of being hoisted.

This document is the memory-order source of truth for graph-local SCF to Dataflow lowering. The concrete owner is loom-lower-graph-memory; it normalizes supported memory leaves and recursively lowers structured graph regions in one traversal.

A canonical root is found by peeling an accepted side-effect-free memref view until reaching an explicit storage or boundary root. The finalized surface recognizes:

• a graph memory input, whose root identity comes from its launch binding;
• a dataflow.memory.service result at that binding, which preserves the root of its exact pointer operand while changing only the value-plane pointer into a memory-plane capability;
• a fresh memref.alloc result, whose root is unique for each invocation;
• a verified side-effect-free view that preserves the source root.

Graph launch memory bindings require exact memref capability types. An LLVM pointer cannot bind a graph memref through a conversion, inferred base, or special address-space-zero rule.

Until the typed producer and verifier establish this provenance, the boundary fails closed. Forged, malformed, foreign-owner, or domain-mismatched provenance is invalid even when the residual SCF shape is otherwise supported.

The owner rejects before mutation when:

• raw or unverifiably owned parallel SCF reaches a graph;
• an effectful or unmodeled nested operation reaches a graph;
• a residual LLVM load, store, atomicrmw, cmpxchg, fence, memcpy, memmove, or memset remains after normalization and therefore has no explicit completion event;
• a source memory access has not been normalized to the canonical linear memory-space form required by its scalar or vector Dataflow actor;
• structured control carries a memref result or memref loop state;
• the graph entry lacks the leading none execution value.

LLVM target-specific sync scopes without a compiler-target owner and atomic accesses without an explicit power-of-two source alignment fail closed. Every residual raw LLVM memory operation fails closed.

Distinct graph memory inputs are conservatively may-alias unless explicit no-alias evidence distinguishes them. Distinct fresh allocations are independent roots.

The lowering does not select parallel width, ownership, serialization, unrolling, reduction order, or any other schedule policy. Those decisions must be made before graph-region lowering and normalized into supported structured input.

A source-origin llvm.alloca accepted by the Structured PromoteOrderedBufferToChannel decision is not an exception to this rule. That decision must remove the complete proved allocation closure before D0; a residual allocation or pointer use remains non-canonical and is rejected.

Residual scf.parallel or scf.forall is checked across every graph before the pass mutates any graph. Raw or unowned parallel input fails.

arbitrary nesting of scf.if, source-sequential scf.for, and scf.while;

Access-to-partition membership is kept in a transient operation map before SCF operands are projected. Selector demuxing must not change alias identity.

pre-mutation rejection of residual scf.parallel and scf.forall that reach a graph without an already materialized schedule boundary.

normalized scalar memref.load and memref.store leaves over a canonical linear memory space;

One vector addressed memory actor is one canonical firing. Its active lanes do not create independent frontier records or an implicit lane order.