@asmlift/core 0.5.0 → 0.7.0

package/src/raise/shortcircuit.ts

@@ -36,14 +36,49 @@
 // folds bottom-up: the innermost diamond becomes a bare condition, which the next diamond consumes as its
 // Vb, and so on. SCOPE: the shared-arm must be reachable as a single-predecessor `br` feeder; the `||`
 // form where the const-1 "true" block has TWO predecessors (`return a || b`) is not folded.
-// Guards stay conservative: the CONST is exactly 0/1, Vb is a bool op or 0/1 const, the head condition is a
-// negatable icmp, and any deviation falls through untouched (a miss, never a miscompile).
-import { Block, Fn, Op, Value, defOpMap, mkOp, mkValue, predecessors, replaceAllUsesWith } from '../ir/core';
-import { HOIST_UNSAFE_OPS, NEGATED_ICMP } from '../ir/opcodes';
+// Guards stay conservative: the CONST is exactly 0/1, Vb is a bool op or 0/1 const, and the head condition
+// is NEGATABLE whenever the orientation inverts it — an icmp by opcode swap or a `logic_and`/`logic_or` by
+// De Morgan, both via `negateCondOps`, which the control-flow form below shares. Any deviation falls
+// through untouched (a miss, never a miscompile).
+import { disjointConstSlots } from '../ir/alias';
+import {
+  Block,
+  Fn,
+  Op,
+  Successor,
+  Value,
+  defOpMap,
+  dominators,
+  foldWriteOrder,
+  forwardingTarget,
+  mkOp,
+  mkValue,
+  predecessors,
+  reachableBlocks,
+  replaceAllUsesWith,
+  successorsOf,
+} from '../ir/core';
+import { EFFECTFUL_OPS, HOIST_UNSAFE_OPS, NEGATED_ICMP, ORDER_SENSITIVE_OPS } from '../ir/opcodes';
 import { T } from '../ir/types';
+import { type Gate, firstRejection } from '../l3/gates';
 
 const BOOL_OPS = new Set([...Object.keys(NEGATED_ICMP), 'logic_and', 'logic_or']);
 
+/** Run `step` until it stops rewriting, and answer whether it ever did.
+ *
+ *  Both folds in this file are driven the same way and have to be: `defOpMap` and `predecessors`
+ *  are stale the moment a block is spliced or dropped, so a scan performs at most ONE rewrite and
+ *  then starts over. `step` is that scan — it recomputes everything it reads, does at most one
+ *  rewrite, and returns whether it did — which makes the rescan point a function boundary instead
+ *  of a `break` to a label. */
+function untilFixpoint(step: () => boolean): boolean {
+  let changed = false;
+  while (step()) {
+    changed = true;
+  }
+  return changed;
+}
+
 /** Fold `(-x | x) >> 31` (logical shift) → `x != 0`, in place. agbcc's branchless is-nonzero idiom. */
 // NOT exported: it must run before the diamond fold, an ordering only recognizeShortCircuit's
 // internal call preserves.
@@ -86,7 +121,6 @@ function recognizeBoolNormalize(fn: Fn): boolean {
 
 /** Collapse a simple boolean short-circuit diamond into one `logic_and`/`logic_or`, in place. */
 export function recognizeShortCircuit(fn: Fn): boolean {
-  let changed = recognizeBoolNormalize(fn);
   const term = (b: Block) => b.ops[b.ops.length - 1];
   const constOf = (defs: Map<Value, Op>, v: Value): number | null => {
     const d = defs.get(v);
@@ -97,12 +131,15 @@ export function recognizeShortCircuit(fn: Fn): boolean {
     return !!d && BOOL_OPS.has(d.opcode);
   };
 
-  let progress = true;
-  while (progress) {
-    progress = false;
+  // TWO STATEMENTS, not `recognizeBoolNormalize(fn) || untilFixpoint(…)`: the normalisation must
+  // run BEFORE the fold (it is what turns agbcc's branchless is-nonzero into the `icmp_ne` the
+  // diamond's second operand has to be), and `||` would skip the fold whenever it reported a
+  // change. Both results are returned, because either one is a change to the IR.
+  const normalized = recognizeBoolNormalize(fn);
+  const folded = untilFixpoint(() => {
     const defs = defOpMap(fn);
     const preds = predecessors(fn);
-    outer: for (const m of fn.blocks) {
+    for (const m of fn.blocks) {
       if (m.params.length !== 1) {
         continue;
       }
@@ -124,9 +161,8 @@ export function recognizeShortCircuit(fn: Fn): boolean {
         // below: `predecessors()` walks successor edges only, so an entry block that is also a loop
         // header shows one predecessor while actually running BEFORE it on the first iteration.
         // Hoisting its body then reorders it and deleting it moves `fn.blocks[0]`. Silent — verify,
-        // assertResolved and assertDerefsTyped all pass. PRE-EXISTING (this fold predates the branch
-        // form and `main` miscompiles the same MIPS input); fixed here because the branch form's
-        // note used to assert this one was safe.
+        // assertResolved and assertDerefsTyped all pass. Pinned by 'a feeder that is the entry block
+        // is not folded away'; the branch form has the same refusal and its own test.
         if (bfeed === fn.blocks[0]) {
           continue;
         }
@@ -162,10 +198,24 @@ export function recognizeShortCircuit(fn: Fn): boolean {
           continue;
         }
         const cond = ht.operands[0];
-        const condDef = defs.get(cond);
-        if (!condDef || !NEGATED_ICMP[condDef.opcode]) {
+        // The head condition must be a C BOOLEAN computed here — a negatable comparison or a
+        // `logic_and`/`logic_or`, which is exactly `BOOL_OPS` and exactly the set `negateCondOps`
+        // accepts at top level, so a fused connective head still folds. Mere def-existence is NOT
+        // the test — `call` declares `results: 1` (ir/opcodes.ts), so `defOpMap` maps a call result
+        // like any other — because the const/const reduction below hands `cond` ITSELF on as the
+        // merge value (`res = condSide`), replacing a phi that was `cond ? 1 : 0`. A non-boolean
+        // head there is a silent WRONG VALUE, not a missed fold: `and(6, 3)` emitted where the
+        // program yields 1. The branch form carries no such obligation — its result only ever feeds
+        // a `cond_br`, which reads truthiness — which is why this gate lives here and not in the
+        // shared helper, whose own result is boolean by construction and so covers the negated case.
+        //
+        // Instrumented over the whole benchmark under BOTH lift configurations, it refuses
+        // NOTHING — every head reaching it is a negatable icmp — while the pass folds 6 value-form
+        // diamonds per configuration, 3 of them through the const/const reduction. An invariant's
+        // guard, not a filter any row depends on.
+        if (!isBool(defs, cond)) {
           continue;
-        } // head condition must be a negatable icmp
+        }
 
         // The `cond`-side operand is negated iff `cond` guards the short-circuit (taken+0 / fall+1).
         const wantNeg = (c === 0 && mIsTaken) || (c === 1 && mIsFall);
@@ -180,11 +230,26 @@ export function recognizeShortCircuit(fn: Fn): boolean {
         if (bfeed.ops.slice(0, -1).some((op) => HOIST_UNSAFE_OPS.has(op.opcode))) {
           continue;
         }
+        // NEGATABLE only when the orientation actually inverts the head — asked here rather than up
+        // with the other head checks, so a fused `logic_and`/`logic_or` head (what the branch form
+        // below leaves behind, and what an earlier round of THIS pass leaves behind in a chain) is
+        // not refused when nothing needs inverting. `negateCondOps` is the branch form's helper too,
+        // so both siblings refuse the same three shapes. Its dominance precondition holds here for a
+        // different reason than there: `cond` is ^h's OWN terminator operand, so its whole cone
+        // dominates the point `before` splices into.
+        //
+        // Minted below every other refusal and above the first mutation: a site refused for any
+        // other reason pays nothing, and a refusal below the hoist would leave ^h half-rewritten.
+        const negation = wantNeg ? negateCondOps(defs, cond, NEGATE_BUDGET) : null;
+        if (wantNeg && !negation) {
+          continue;
+        }
         bfeed.ops.slice(0, -1).forEach(before); // hoist B's pure body (defines Vb; harmless if a dead const)
+        foldWriteOrder(fn.writeOrder, bfeed, h); // …and its writes now follow H's (ir/core.ts)
         let condSide = cond;
-        if (wantNeg) {
-          condSide = mkValue(T.unk(32));
-          before(mkOp(NEGATED_ICMP[condDef.opcode], { operands: [...condDef.operands], results: [condSide] }));
+        if (negation) {
+          negation.ops.forEach((op) => before(op));
+          condSide = negation.result;
         }
         // Vb const → the phi reduces to the (possibly negated) condition; Vb bool → a && / || connective.
         let res = condSide;
@@ -203,13 +268,12 @@ export function recognizeShortCircuit(fn: Fn): boolean {
           m.params = [];
         }
         fn.blocks = fn.blocks.filter((x) => x !== bfeed);
-        changed = true;
-        progress = true;
-        break outer; // defs/preds are stale after mutation — recompute on the next iteration
+        return true; // defs/preds are stale after mutation — the driver rescans
       }
     }
-  }
-  return changed;
+    return false;
+  });
+  return normalized || folded;
 }
 
 // ── the CONTROL-FLOW form ───────────────────────────────────────────────────────────────────────
@@ -253,35 +317,235 @@ export function recognizeShortCircuit(fn: Fn): boolean {
 //     not a hand-written `||`. switch-recover.ts requires every test's `cond_br` operand to be an
 //     `icmp` (its `isCmpOpcode` gate), and a `logic_or` is not one, so folding first PERMANENTLY
 //     disqualifies the recovery and a clean `switch (x) { case 1: case 2: … }` degrades to a chain
-//     of nested `if`s. The switch is the better recovery and it is the more specific one, so it
-//     wins the shape. Cost: a genuine source-level `x == 1 || x == 2` that is NOT part of a wider
-//     tree also declines — the same conservative trade loops.ts makes when it refuses to infer a
-//     header from `cond_br` shape.
+//     of nested `if`s. The two spellings are mutually exclusive within one raise and BOTH are
+//     legitimate C, and which of them the asm rules out depends on the shape: `x == 0 || x == 2`
+//     and `switch (x) { case 0: case 2: }` are ONE object only where the switch has a single case
+//     group plus `default:` (agbcc 12 instructions each, one md5; IDO 64 bytes each, one md5), and
+//     part as soon as there is a second group to balance a dispatch against (agbcc 20 against 16,
+//     IDO 80 bytes and different bytes). So this is a DEFAULT rather than a decision: the switch
+//     is the more specific recovery and wins the shape here, while
+//     `foldTreeOwned` spells the connective instead and the differ referees (rank.ts's
+//     `/connective`). ONLY THIS CLAUSE. Its notion of "same scrutinee" is switch-recover.ts's own
+//     PRE1 — a NECESSARY condition for recovery, never a sufficient one, so what it refuses is
+//     "a switch could not be ruled out here" and it is a proxy too, just a far tighter one than
+//     the relayed clause. Priced over the set it REFUSES rather than the set it admits: it fires on
+//     6 rows, protects 2 (`pokeemerald:IsStringLengthAtLeast`,
+//     `pokeemerald:TrySetCantSelectMoveBattleScript`), and on the other 4 the published winner
+//     folds THROUGH it — `kleod:CheckWorldCompletion`'s refused site is `v5 == 3 || v5 == 5` on an
+//     ordinary inner-loop counter with no dispatch region near it. It is the variation, not the clause,
+//     that keeps those 4. A structural discriminator is L1-visible and would be strictly better —
+//     is the shared block the entry of a region with dispatch-shaped in-edges, is the scrutinee
+//     defined by the enclosing loop header — and is UNBUILT.
+//     The relayed clause below is a different statement (see its own note: a blunt proxy that
+//     fires on an ordinary loop counter), it has NO inhabitant anywhere in the benchmark, and a
+//     candidate born there would carry a `/connective` variation for a fold that answers
+//     no connective-vs-tree question. It stays absolute.
+//   - the shared block was reached through a RELAY, and either test's scrutinee is compared against
+//     constants more than once in the function. This one is ABSOLUTE — `foldTreeOwned` does not
+//     widen it. Same reason as the bullet above, widened because the reach is: a relay is what
+//     agbcc puts on a tree's default edge, so resolving one walks this fold into a dispatch chain,
+//     where the sibling that gives the tree away may be neither test in
+//     hand — the split node is RELATIONAL and only its children are equalities, which is precisely
+//     what the pairwise test cannot see. Without it `sub_807BD88` and `sub_808491C` each lose a
+//     `switch` (sa3).
+//
+//     It is BLUNT, and that is why it is held to the relayed case. The count does not distinguish a
+//     dispatch chain from any variable tested against constants at two sites: on `sub_8080AD4` it
+//     fires on `v2 > 2` and `v2 != 2` — one ordinary loop counter — and refusing there costs the
+//     function its whole decompilation, because the only fold it has is the `do…while` exit. Its
+//     notion of "same scrutinee" is SSA-value identity, which is switch-recover.ts's own PRE1, so it
+//     cannot refuse a tree that recovery could not have taken either — but it is a proxy for "am I
+//     inside a dispatch chain", not a test of it. A direct edge onto a relational split node still
+//     escapes: `sub_807F334` folds `x > 1 && x == 2` and loses a `switch` on main and here alike.
+//   - BOTH of ^g's edges rejoin the shared block, with NEITHER of them landing on it directly. Then
+//     there is no "other" arm and nothing decides which side the connective guards. Only resolution
+//     creates this — an edge that arrives directly is preferred exactly so the MIPS divide-guard
+//     idiom, whose emptied trap block forwards to the same place, keeps folding as it always has
+//     (`af:adds:ido7.1` and the `divv`/`gcd`/`modv` rows).
 //   - ^g holds a side effect — its ops move into ^h, which runs UNCONDITIONALLY. A store in `b`
 //     would then execute even when `a` already decided the branch. (`a || (*p = 1)`.)
-//   - a value defined in ^g is used outside ^g, or used more than once. Then the structurer
-//     MATERIALIZES it into a local, which renders as a statement BEFORE the `if` — turning `b`'s
-//     conditional computation into an unconditional one. Single-use-and-local is precisely the
-//     shape analysis.ts inlines into the connective's right operand, where C's own short-circuit
+//   - a value defined in ^g is used more than once inside ^g. Then the structurer MATERIALIZES it
+//     into a local, which renders as a statement BEFORE the `if` — turning `b`'s conditional
+//     computation into an unconditional one. Single-use-and-local is precisely the shape
+//     analysis.ts inlines into the connective's right operand, where C's own short-circuit
 //     re-guards it. This is what keeps a load in `b` from being hoisted across the guard in `a`.
+//   - a value defined in ^g is ALSO read past ^g, and a rule in `ARM_REREAD_GATES` refuses
+//     re-deriving it in the arm. A read past ^g is otherwise not a refusal: on verified IR it can
+//     only sit under the arm ^g's non-shared edge enters (^g dominates nothing else — the shared
+//     block is reached from ^h too), so the arm RE-DERIVES it (`armRereadCone`) and ^g keeps only
+//     its own use. Refusing every such read splits the condition into a nest whose shared block
+//     the structurer duplicates into both negative branches — `synthetic:ladder5` and
+//     `synthetic:ladidx2`. The two
+//     are different evidence: `ladidx2` is `if (a && (p->f & 0x7F) == 0x7F) { p->f &= 0x80; }`,
+//     which names `p->f` twice while agbcc reads it once and carries the register into the arm,
+//     so its copy is a LOAD; `ladder5`'s arm reuses an ADDRESS its test computed, a
+//     pure cone analysis.ts re-derives at every use anyway. Two of the table's rules are sound
+//     (the copy must not run on a path the original did not); the rest are fidelity, and say
+//     which bytes they protect.
 //   - the two edges into the shared block carry DIFFERENT args. Only one edge survives the fold,
 //     so it can only carry one argument list; picking either would silently drop the other path's
 //     phi input.
-//   - ^g's two successors are the same block, or ^g's condition is not a negatable icmp when the
-//     orientation needs negating.
+//   - ^g's two successors are the same block, or ^g's condition cannot be NEGATED when the
+//     orientation needs negating. `negateCondOps` decides that, over two shapes: a negatable
+//     `icmp_*` (the swapped opcode) and a `logic_and`/`logic_or` (De Morgan — the dual connective
+//     over recursively negated operands). The connective case is what lets a chain fold past its
+//     FIRST level: this pass is iterative, so by the time it tries an outer diamond the inner one is
+//     already fused and ^g's condition is a connective, which `NEGATED_ICMP` — a table over
+//     comparison opcodes — has no entry for. Refuse it and `a || !(b || c)` stops after one level at
+//     all 13 sites this fires on (`synthetic:llcmp:agbcc`, `:gcc2.7.2kmc`, and 11 real agbcc
+//     functions in klonoa+sa3); on the two benchmark rows the structurer then tail-duplicates the
+//     shared return into both arms. The helper's own refusals — no def, a non-negatable leaf
+//     ANYWHERE in the cone (no partial De Morgan), a cone over the node budget — are on the helper.
+//
+//     De Morgan DUPLICATES leaf comparisons, so a duplicated leaf could gain a second consumer that
+//     analysis.ts renders as a statement BEFORE the `if` — the hazard the single-icmp negation
+//     always carried. Measured over those 11 BRANCH-form sites: NO site gains a local (one,
+//     `sub_80B7CD0`, loses one, 8 → 7) and every site that already decompiled gets SHORTER. Two
+//     (`sub_80930B8`, `sub_80932E0`) go from DECLINED to a full decompilation — folding a loop-exit
+//     connective removes the back-edge loop recovery was refusing — so they get LONGER (1 → 112 and
+//     1 → 55 lines) and are the only sites whose local count rises at all, 0 → 22 and 0 → 7. A
+//     decompilation appearing, not a leaf escaping.
+//
+//     That number is SCOPED to this fold and does not carry to the value form, which shares the
+//     helper but no use-count condition: `definedValuesStayLocal` (bottom of this file)
+//     independently forbids a ^g-defined value with a second consumer HERE, while the value form
+//     relies on the original cone dying to the pass list's own `dce: true`. There is nothing to
+//     transfer the number to yet either — instrumenting the value form over the whole benchmark
+//     under both lift configurations counts 6 folds per configuration, every head a single icmp.
+//
+//     The `/connective` LIFT VARIATION is a separate question from the default lift, and is unwidened:
+//     `onTreeOwned` below is what tells rank.ts the variation exists for a row, and this check sits ABOVE
+//     it. Over the whole benchmark under BOTH configurations rank.ts lifts with (`foldTreeOwned`
+//     false and true), against the same rows with the connective case ablated: the recovered IR
+//     moves on the same 2 rows under each, `onTreeOwned` fires on the same rows either way, and
+//     nothing new throws.
 //
 // Every refusal falls through untouched, leaving the tail-duplicated spelling — a miss, never a
 // miscompile. Applied ITERATIVELY, so `a || b || c` folds left-to-right, each round consuming one
 // more condition block.
-export function recognizeBranchShortCircuit(fn: Fn): boolean {
-  let changed = false;
+//
+// WHICH SPELLING, and why the fold alone does not decide it. `if (a && b) X else Y` and its dual
+// `if (!a || !b) Y else X` are the same program and NOT the same bytes — agbcc lays the arms out in
+// source order, so which was written is recorded in the branch senses. This rewrite keeps ^h's
+// unchanged successor slot, so the connective comes out in the orientation those senses spell, and
+// which of the two that is depends on the branch RANGE below, not on the source. Reaching the
+// other is `negateCond`'s job (l3/ast.ts distributes `!(a && b)`), and rank.ts's `/flip-join` variation
+// is what asks for it on a RECONVERGING if — the default spells the layout reading and the variation
+// spells its dual, so both orientations are compiled and the differ picks (synthetic:ifand_near
+// matches at the default, synthetic:ifor_near on the variation).
+//
+// What neither reaches is the MIXED spelling. `negateJoinedBranchSense` is a per-FUNCTION boolean,
+// so the variation negates every joined `if` at once — and of the 28 real rows carrying the
+// `short-circuit` tag, 16 hold two or more TWO-ARMED ifs (counted by `else`, which is what the
+// variation's own `thenS.length && elseS.length` gate needs) and 12 hold two or more conditions
+// carrying a connective. TWO-ARMED is the count that matters: both sense booleans exclude a
+// one-armed `if` by construction, so a tally of `if (` of any kind is the wrong denominator.
+// The per-SITE negation is `/site-sense` (rank-variations.ts), which reads the orientation this fold
+// stamps on the fused branch (`scSharedOnFall`, below) instead of the per-function boolean. A gate
+// on whether to ENUMERATE the variation does not reach the mixed spelling and removes one the differ
+// would referee.
+//
+// The De Morgan negation below forecloses a third spelling, at a measured price: it DISTRIBUTES, so
+// the leaves come out negated (`a || (!b && !c)`) and `a || !(b || c)` has no
+// candidate — the IR has no `logic_not` to build one from (ir/opcodes.ts). Compiled both ways on
+// the `a || (b && c)` guard shape at agbcc's default flags, the two source spellings assemble to
+// the same bytes (12/12 rows, score 0), so the foreclosure costs nothing here. A shape that ever
+// separated them would be a new variation, not a bug in this fold.
+//
+// WHICH slot ^g lands in is decided by the asm's branch POLARITY, and on Thumb the branch RANGE
+// decides the polarity — so the same source `&&` reaches this pass two different ways:
+//
+//   short branch   `beq shared`         ^g is ^h's FALL  → logic_or
+//   long branch    `bne ^g / b shared`  ^g is ^h's TAKEN → logic_and
+//
+// agbcc inverts a conditional it cannot reach, so past ±256 bytes it emits the second form, and the
+// trampoline it leaves on the `b` sits on the edge into the SHARED block — which `forwardingTarget`
+// (ir/core.ts) looks through. Only that edge needs it: the INVERTED branch is the one that still
+// reaches, so `bne ^g` always arrives at ^g directly and no relay can sit between them.
+//
+// SO THE CONNECTIVE THIS FOLD MINTS IS THE RANGE'S, NEVER THE SOURCE'S: both `synthetic:ifand_near`
+// (source `&&`) and `synthetic:ifor_near` (source `||`) are short-branch rows and both come out
+// `logic_or`. Which SPELLING then wins is the joined-sense default's question, one layer up, and
+// BOTH halves have a dual candidate there — `ifand_near:agbcc` matches at the default (`unsigned`),
+// while `ifor_near:agbcc` and the long-branch `ifand_far:agbcc` each match on `/flip-join`.
+//
+// `gIsFall` IS NOT THE CARRIER FOR A PER-SITE SENSE, and that was measured rather than argued. It
+// reads the branch RANGE, exactly as the table above says — so in any function small enough for
+// every branch to be short it is the SAME at every site, including sites whose sources wrote
+// opposite connectives. Instrumented at the fold and run through the bench: a two-site row whose
+// first site wrote `&&` and whose second wrote its dual reads `gIsFall=true` at BOTH
+// (`synthetic:joinsense`), and a four-site ladder row with two sites inverted in the source reads
+// `true` at all four (`synthetic:mixsense`). The positive control reads the other way —
+// `synthetic:ifand_far`, the long-branch row, gives `false` against
+// `synthetic:ifand_near`'s `true`. So carrying this boolean to L3
+// as a node stamp (the `#144` `Expr.baseOrdered` shape) would hand every site of such a function
+// one answer and reach exactly the two configurations `negateJoinedBranchSense` already reaches.
+//
+// WHAT IS THE CARRIER is the OTHER boolean this loop computes — whether the SHARED block was
+// reached from ^g by its branch or by falling into it — and the fold stamps it as
+// `scSharedOnFall`. It separates every site the sources above wrote as a dual from every site
+// they did not, at constant branch range, because it reads the source's connective rather than
+// the range: an `&&` sends every failing test AWAY to the shared block, an `||` falls into it.
+//
+// IT IS HALF THE CARRIER. Which SOURCE arm the shared block is only names the spelling once you
+// also know which SUCCESSOR SLOT it lands in here, and the slot is `gIsFall` — stamped beside it
+// as `scSharedIsTaken`. `gIsFall` false puts the shared arm in the FALL slot, which happens at the
+// long-branch `&&` AND at every CHAINED fold, since an inner fold leaves the head's taken edge
+// pointing at the next test. There the source's `then` is in the taken slot however ^g reached the
+// shared block, so BOTH values of `scSharedOnFall` read POSITIVE — measured, not derived: the two
+// inhabited layouts stamp opposite `scSharedOnFall` (`synthetic:chainsense` false,
+// `synthetic:ifand_far` true) and want the same spelling, because the long branch is exactly the
+// layout that falsifies the source-order premise ON that stamp.
+//
+// AND THAT IS STILL NOT ALL OF IT, because the long branch INVERTS the last test and so moves the
+// shared arm between slots: a long `||` puts it back in the TAKEN slot and stamps the pair a short
+// `&&` stamps (`synthetic:ifor_far` against `synthetic:ifand_near`, measured from their own asm),
+// while wanting the opposite spelling. The third stamp is `scEdgeRelayed`, the trampoline the
+// inversion leaves on one of the two edges — see its own note at the stamp. The table the consumer
+// reads is `structure.ts`'s `senseFromFoldEvidence` site default, and one of its cells is
+// undecided by all three facts (`kleod:CheckWorldCompletion:agbcc`, two sites, opposite senses).
+//
+// Every refusal falls through untouched — a miss, never a miscompile.
+/** Per-call options for `recognizeBranchShortCircuit` — the tree-ownership refusal's two ends. */
+export interface BranchShortCircuitOptions {
+  /** Take the fold at a site the PAIRWISE comparison-tree refusal owns, spelling the connective
+   *  where the default leaves the tree for switch-recover.ts. rank.ts's `/connective` variation; see the
+   *  REFUSALS note. It widens the SHAPE the fold accepts and nothing about what the fold may move —
+   *  every other refusal still applies, the RELAYED clause included.
+   *
+   *  A NEW REFUSAL CONDITION, stated because it is one: this is per-FUNCTION and the question is
+   *  per-SITE. Every tree-owned site in a function flips together, so a function with two of them
+   *  wanting OPPOSITE spellings has no candidate that spells the mix, and nothing reports the gap.
+   *  A per-FUNCTION predicate cannot decide a per-SITE question — the same shape the joined-if
+   *  default hit — and here it costs completeness rather than correctness. The alternative is a
+   *  fork per site: `kleod:CheckWorldCompletion` refuses at 10 and goes 96 → 192 candidates as one
+   *  boolean, where a per-site fork would be 1024×. That is why the boolean, not an oversight. */
+  foldTreeOwned?: boolean;
+  /** Called at each site the pairwise tree-ownership refusal is the ONE thing stopping the fold —
+   *  how rank.ts learns the variation has an inhabitant here without re-running the matcher. Asked LAST,
+   *  after `sameArgs` and the negatability check, so a report means a `/connective` candidate that
+   *  differs from its sibling: reporting a refusal merely REACHED would double the row's whole
+   *  candidate cross for a lift that produces duplicates the dedup collapses. (Its sibling gate
+   *  `hasSetupArgsNarrowing` asks the same question the same way — does the variation CHANGE anything.)
+   *  The pass re-scans after every rewrite, so one site can report more than once; read it as a
+   *  boolean. */
+  onTreeOwned?: () => void;
+  /** The RE-READ admission's refusals — {@link ARM_REREAD_GATES} when absent. A parameter so a
+   *  census can hand in `tallying(ARM_REREAD_GATES).gates` and a test can ablate one rule; the
+   *  census does, through `bench gates --pass arm-reread` (apps/benchmark/src/run/gate-census.ts). */
+  armReread?: readonly Gate<ArmRereadSite>[];
+  /** The TARGET's `compilerBehaviors.reloadsLocalReread` (target.ts), which one conjunct of one rule
+   *  in {@link ARM_REREAD_GATES} reads — `read-behind-effect`. Threaded by raise/pre-recovery.ts from
+   *  the target it already holds, the way `narrowlocal`'s `hoistsSingleSetArm` is. Absent ⇒ false. */
+  reloadsLocalReread?: boolean;
+}
+
+export function recognizeBranchShortCircuit(fn: Fn, opts: BranchShortCircuitOptions = {}): boolean {
   const term = (b: Block) => b.ops[b.ops.length - 1];
-  let progress = true;
-  while (progress) {
-    progress = false;
+  return untilFixpoint(() => {
     const defs = defOpMap(fn);
     const preds = predecessors(fn);
-    outer: for (const h of fn.blocks) {
+    for (const h of fn.blocks) {
       const ht = term(h);
       if (ht.opcode !== 'cond_br') {
         continue;
@@ -312,29 +576,39 @@ export function recognizeBranchShortCircuit(fn: Fn): boolean {
         if (gTaken.block === gFall.block) {
           continue;
         }
-        // A comparison TREE over one scrutinee belongs to switch recovery, not to this fold.
-        if (sameScrutineeConstTests(defs, ht.operands[0], gt.operands[0])) {
-          continue;
-        }
-        // ^g's body must be pure, and every value it defines must be consumed only by ^g itself —
-        // see the REFUSALS note: an escaping or reused value becomes a statement hoisted out of the
-        // short circuit.
+        // ^g's body must be pure — see the REFUSALS note.
         // HOIST_UNSAFE_OPS includes `opaque`: an instruction asmlift could not model, and moving it
         // out of the arm that guards it is the reordering this refuses. Loud either way today — a
         // decline under `onGap: 'strict'`, an ASMLIFT_ERROR marker under `annotate`.
-        const body = g.ops.slice(0, -1);
-        if (body.some((op) => HOIST_UNSAFE_OPS.has(op.opcode))) {
+        if (g.ops.slice(0, -1).some((op) => HOIST_UNSAFE_OPS.has(op.opcode))) {
           continue;
         }
-        if (!definedValuesStayLocal(fn, g)) {
+        // Which of ^g's edges rejoins ^h's other successor? That is the shared block. A DIRECT edge
+        // wins, so resolution only ever adds reach — it never re-picks an edge this fold already had.
+        const sharedTarget = forwardingTarget(sharedFromH.block);
+        const rejoins = (e: Successor): boolean => forwardingTarget(e.block) === sharedTarget;
+        const direct = gTaken.block === sharedFromH.block ? gTaken : gFall.block === sharedFromH.block ? gFall : null;
+        // With neither edge direct, both may resolve onto the shared block — and then there is no
+        // "other" arm left and nothing decides which side the connective guards.
+        if (direct === null && rejoins(gTaken) && rejoins(gFall)) {
           continue;
         }
-        // Which of ^g's edges rejoins ^h's other successor? That is the shared block.
-        const sharedEdge =
-          gTaken.block === sharedFromH.block ? gTaken : gFall.block === sharedFromH.block ? gFall : null;
+        const sharedEdge = direct ?? (rejoins(gTaken) ? gTaken : rejoins(gFall) ? gFall : null);
         if (!sharedEdge) {
           continue;
         }
+        // A comparison TREE over one scrutinee belongs to switch recovery, not to this fold. A relay
+        // is what agbcc puts on a tree's default edge, so a shared block reached through one is
+        // searched function-wide; a direct edge keeps the pairwise test. See the REFUSALS note —
+        // the wider test is blunt, and that is why it is not asked everywhere.
+        const throughRelay = sharedEdge.block !== sharedFromH.block;
+        if (
+          throughRelay &&
+          (inComparisonTree(fn, defs, ht.operands[0]) || inComparisonTree(fn, defs, gt.operands[0]))
+        ) {
+          continue; // the relayed clause is absolute — `foldTreeOwned` does not widen it
+        }
+        const treeOwned = !throughRelay && sameScrutineeConstTests(defs, ht.operands[0], gt.operands[0]);
         const otherEdge = sharedEdge === gTaken ? gFall : gTaken;
         if (!sameArgs(sharedFromH.args, sharedEdge.args)) {
           continue;
@@ -343,16 +617,40 @@ export function recognizeBranchShortCircuit(fn: Fn): boolean {
         // reach the SHARED block", `logic_and` asks "does ^g reach the OTHER block".
         const wantEdge = gIsFall ? sharedEdge : otherEdge;
         const c2 = gt.operands[0];
-        const c2Def = defs.get(c2);
-        let second = c2;
-        const negated: Op[] = [];
-        if (wantEdge !== gTaken) {
-          if (!c2Def || !NEGATED_ICMP[c2Def.opcode]) {
+        // ^g's condition may itself be a CONNECTIVE — the fold is iterative, so an inner diamond is
+        // already fused by the time the outer one is tried, and negating one is De Morgan rather
+        // than an opcode swap. `negateCondOps` does both, and returns null on anything else.
+        const negation = wantEdge !== gTaken ? negateCondOps(defs, c2, NEGATE_BUDGET) : null;
+        if (wantEdge !== gTaken && !negation) {
+          continue;
+        }
+        // Every value ^g defines is consumed only by ^g itself, once, or re-derived in the arm —
+        // see the REFUSALS note: an escaping or reused value becomes a statement hoisted out of
+        // the short circuit. Asked AFTER `sameArgs` and the negatability check, so a census of
+        // `ARM_REREAD_GATES` counts only sites nothing cheaper refuses — above `sameArgs` it would
+        // credit `read-behind-effect` with void functions whose shared edges carry different dead
+        // `r0` values. The verdict is a conjunction of pure tests, so the order moves no fold. And
+        // BEFORE tree ownership, so `onTreeOwned` keeps its meaning — the one thing in the way.
+        const reread = armRereadCone(fn, g, otherEdge.block, preds, opts);
+        if (!reread || !definedValuesStayLocal(fn, g, reread)) {
+          continue;
+        }
+        // LAST refusal, so `onTreeOwned` reports a site where tree ownership is the ONE thing in the
+        // way — which is why the negatability check stays above it even though it MINTS the negated
+        // cone (up to NEGATE_BUDGET ops) and discards it whenever this gate refuses. That discard is
+        // free rather than merely cheap: `mkValue` is `{ type }` with no identity counter
+        // (ir/core.ts) and nothing is spliced until below, so a site refused here leaves the CFG
+        // byte-identical. See the option's doc for why the position is the gate's meaning.
+        if (treeOwned) {
+          opts.onTreeOwned?.();
+          if (!opts.foldTreeOwned) {
             continue;
           }
-          second = mkValue(T.unk(32));
-          negated.push(mkOp(NEGATED_ICMP[c2Def.opcode], { operands: [...c2Def.operands], results: [second] }));
         }
+        rereadInArm(fn, g, otherEdge.block, reread);
+        const body = g.ops.slice(0, -1);
+        const second = negation ? negation.result : c2;
+        const negated: Op[] = negation ? negation.ops : [];
         const res = mkValue(T.unk(32));
         const connective = mkOp(gIsFall ? 'logic_or' : 'logic_and', {
           operands: [ht.operands[0], second],
@@ -361,7 +659,69 @@ export function recognizeBranchShortCircuit(fn: Fn): boolean {
         // ^g's body moves ahead of ^h's terminator; ^h keeps the successor SLOT that did not change
         // (taken=shared for `||`, taken=other for `&&`), so the frontend's branch sense survives.
         h.ops.splice(h.ops.length - 1, 1, ...body, ...negated, connective, {
-          ...mkOp('cond_br', { operands: [res] }),
+          // THE ORIENTATION EVIDENCE, kept because only this pass can see it. `scSharedOnFall`
+          // says the SHARED block — the arm both tests reach — was reached from ^g by
+          // FALL-THROUGH rather than by ^g's branch. gcc lays a condition's arms out in source
+          // order, so an `&&` sends every failing test AWAY to the shared block (the source's
+          // `else`) while an `||` lets the last test FALL INTO it (the source's `then`) — which is
+          // the one thing that separates `if (a && b) X else Y` from its dual `if (!a || !b) Y
+          // else X`, two different objects that fold to the same connective and the same successor
+          // slots. Consumed at L3 by `StructureOptions.senseFromFoldEvidence`.
+          //
+          // `gIsFall` is NOT that separator and is stamped for a different reason. It reads the
+          // branch RANGE: over `synthetic:joinsense` (two sites, opposite source connectives) and
+          // `synthetic:mixsense` (four sites, two inverted) it is TRUE at every site of both,
+          // where `scSharedOnFall` separates them. What it is, is the SLOT — the successor order
+          // below is `gIsFall`'s — so `scSharedIsTaken` says where the shared arm went and
+          // `scSharedOnFall` says which source arm it is. The shared arm in the FALL slot means the
+          // taken slot holds the source's `then` whatever `scSharedOnFall` reads, so only the TAKEN
+          // quadrants can negate; `structure.ts` owns that table and the layout premise under it.
+          //
+          // `scEdgeRelayed` — the THIRD fact, and the only one of the three that is neither the
+          // source's connective nor a slot. It says a long-branch TRAMPOLINE sat on one of this
+          // fold's two edges: agbcc inverts a conditional it cannot reach in ±256 bytes and leaves
+          // a `br`-only block behind, which is exactly the inversion that breaks `scSharedOnFall`'s
+          // source-order premise. Measured on the four orientation rows, lifted from their own
+          // compiled asm (`ONLY=synthetic:<row>:agbcc` through the probe in the round's ledger):
+          //
+          //   row           source     onFall  isTaken  relayed   /site-sense spells
+          //   ifand_near    a && b     false   true     false     a && b     ✅
+          //   ifor_near     a || b     true    true     false     a || b     ✅
+          //   ifand_far     a && b     true    false    true      a && b     ✅
+          //   ifor_far      a || b     false   true     TRUE      its DUAL   ❌ without this stamp
+          //
+          // `ifand_near` and `ifor_far` stamp the IDENTICAL pair and want OPPOSITE spellings, so no
+          // two of these booleans can decide the site. The relay is what separates them, and
+          // `synthetic:ifor_far` is the only row whose spelling it decides — the row exists for this
+          // stamp, because its SCORE cannot referee it (MATCH 0/139 on `/flip-join`, like
+          // `ifand_far`'s 0/140).
+          //
+          // A PROXY, and named as one: what decides the spelling is the branch INVERSION, and what
+          // is observable here is the trampoline the inversion leaves. They coincide on every input
+          // measured, and a relay arriving from some other cause at a taken-slot site would read as
+          // an inversion that did not happen. The `&&` long branch relays the SHARED edge and the
+          // `||` long branch the OTHER one — measured on `ifand_far` and `ifor_far`, and both
+          // layouts pinned in `test/branch-shortcircuit.test.ts` — which is why both are asked.
+          //
+          // POSITIONAL, unlike its two neighbours: `scSharedOnFall` and `scEdgeRelayed` name arms
+          // and survive anything, while `scSharedIsTaken` names a SUCCESSOR SLOT of the very op it
+          // rides on. THE INVARIANT IT NEEDS IS NOT "nothing assigns `.successors`" — something
+          // does. It is that no pass between here and `structure` may REORDER a stamped `cond_br`'s
+          // successor slots. Downstream of this fold `raiseRecovered` (pipeline.ts) runs
+          // `sinkReturns` and `foldEmptyLatches`; `raise/latch.ts` holds the one successor rewrite in
+          // `packages/core/src` (grep `successors[i] =` / `successors.push|splice`) —
+          // `op.successors[i] = { block: onward.block, … }`, which repoints a slot IN PLACE at its
+          // own index and therefore keeps the stamp true. `sinkReturns` only replaces `br`
+          // terminators. A pass that canonicalised a stamped `cond_br`'s edges would turn the
+          // reading over with no refusal firing, and would have to re-stamp.
+          ...mkOp('cond_br', {
+            operands: [res],
+            attrs: {
+              scSharedOnFall: sharedEdge === gFall,
+              scSharedIsTaken: gIsFall,
+              scEdgeRelayed: throughRelay || forwardingTarget(otherEdge.block) !== otherEdge.block,
+            },
+          }),
           successors: gIsFall
             ? [
                 { block: sharedEdge.block, args: [...sharedEdge.args] },
@@ -372,63 +732,664 @@ export function recognizeBranchShortCircuit(fn: Fn): boolean {
                 { block: sharedEdge.block, args: [...sharedEdge.args] },
               ],
         });
+        foldWriteOrder(fn.writeOrder, g, h); // ^g's writes now follow ^h's own (ir/core.ts)
         fn.blocks = fn.blocks.filter((x) => x !== g);
-        changed = true;
-        progress = true;
-        break outer; // defs/preds are stale after the mutation — recompute on the next round
+        // ^h's old shared edge is gone, so the relay it pointed at may have become unreachable —
+        // and once that link goes, so may the next, all the way down the chain. `dominators`
+        // (ir/core.ts) gives a block with no in-edges only ITSELF, which empties the intersection at
+        // everything it still branches to, so a half-dropped chain declines two passes later with a
+        // def-does-not-dominate-use out of `verify`.
+        //
+        // REACHABILITY, not predecessor count: in-edges from blocks that are themselves unreachable
+        // leave a block just as orphaned, and the thumb frontend does hand over unreachable blocks
+        // (see raise/gvn.ts). Only relays are dropped — the chain ends at the first block that does
+        // real work, and that one stays whatever its in-edges look like.
+        //
+        // The relay test below is `isBodyless` (ir/core.ts) MINUS its parameter clause, and the
+        // omission is what the reachability guard above buys: an unreachable block binds nothing, so
+        // a param on one says nothing about a live edge, while refusing it would leave the chain
+        // HALF-DROPPED — and a half-dropped chain fails `verify` two passes later with a
+        // def-does-not-dominate-use. `isBodyless` itself is unchanged and right for its own three
+        // callers, every one of which asks about a block that is still reached.
+        for (let link = sharedFromH.block; link.ops.length === 1 && link.ops[0].opcode === 'br';) {
+          const dead = link;
+          if (dead === fn.blocks[0] || reachableBlocks(fn).has(dead)) {
+            break;
+          }
+          link = dead.ops[0].successors[0].block;
+          fn.blocks = fn.blocks.filter((x) => x !== dead);
+        }
+        return true; // defs/preds are stale after the mutation — the driver rescans
       }
     }
-  }
-  return changed;
+    return false;
+  });
 }
 
-/** Do `c1` and `c2` compare the SAME value against CONSTANTS? That is the signature of a
- *  comparison-tree `switch`, which switch-recover.ts owns — see the REFUSALS note. Equality tests
- *  only: a switch tree dispatches on `==`/`!=`, while a RELATIONAL pair (`x >= lo && x <= hi`, the
- *  range check) is a genuine connective this fold should still take. */
+/** How many ops `negateCondOps` may KEEP for one negation. De Morgan rebuilds the cone PER PATH and
+ *  shares nothing — deliberately, see the helper's note — so a fold's cost is linear in the cone's
+ *  nodes and this is the cheap stop on it.
+ *
+ *  What 8 decides, said as the shape rather than as headroom, because "8" reads like more room than
+ *  it is. A negation mints one op per cone node and a binary expansion has leaves = internal + 1, so
+ *  a minted count is always ODD: 1, 3, 5, 7, 9. At 8 a FOUR-clause inner conjunct (7 ops) folds and
+ *  a FIVE-clause one (9 ops) does not; 7 and 8 are therefore one gate, and so is 9 over everything
+ *  measured here, the deepest cone in the 2,047 lifted klonoa+sa3 functions minting 5 (17
+ *  connective negations, 0 refused). Clause COUNT is not the measure either: a FLAT `a || b || c || …`
+ *  chain pays nothing at all, because ^g's condition is never a connective in that shape.
+ *
+ *  The bound is on ops KEPT, and the frontier is a NODE COUNT — not a shape. Pinned as such rather
+ *  than argued: branch-shortcircuit.test.ts's "the fold's frontier is the cone's NODE COUNT, not its
+ *  shape" enumerates all 23,714 binary cone shapes with up to 10 internal nodes (21 nodes) and
+ *  asserts the PUBLIC fold takes one exactly when `2k + 1 <= budget`.
+ *  Shape decides only WHICH guard refuses and how many ops had been
+ *  minted when it did, neither of them visible to a caller — at budget 8 a 15-node cone is caught by
+ *  the ENTRY guard at 9 (left chain) or 8 (balanced cone) or by the POST-check at 15 (right chain).
+ *  Because `go` pushes a parent only after its children, a refused walk transiently mints more than
+ *  the budget before unwinding — `2 * budget - 1` at the worst shape, that right chain, at every
+ *  budget measured. Bounded, and nothing escapes it.
+ *
+ *  A refusal here is SILENT, unlike the `onTreeOwned` gate above which exists so a sweep need not
+ *  re-instrument. So raising this constant is not free advice: finding a corpus site that wants it
+ *  means patching a hook back into this file. No callback is added because no consumer has asked for
+ *  one; test/branch-shortcircuit.test.ts pins both sides of the frontier instead. */
+const NEGATE_BUDGET = 8;
+
+/** The ops computing `!v`, or `null` when `v` cannot be negated.
+ *
+ *  Two cases, and no third:
+ *    - an `icmp_*` in `NEGATED_ICMP` → the swapped-opcode comparison over the SAME operands.
+ *    - a `logic_and`/`logic_or` → the DUAL connective over its two recursively negated operands.
+ *      De Morgan: `!(a || b)` is `!a && !b`. This is the only reason the helper is recursive, and
+ *      it is what lets a chain fold past its first level (`a || !(b || c)`).
+ *
+ *  REFUSALS — each returns `null`, which the caller turns into its existing `continue`, so the CFG
+ *  is left exactly as it was and the structurer emits today's tail-duplicated spelling. A bytes
+ *  miss, never a wrong answer:
+ *    - the value has no def in this function, which means a block param — a call RESULT has one,
+ *      `call` declaring `results: 1` (ir/opcodes.ts), and is refused by the next bullet instead;
+ *    - the def is neither a negatable icmp nor a connective (a call, any arithmetic) — there is no
+ *      sound inverse to build, and `!x` as `x == 0` is a DIFFERENT spelling, not this fold's
+ *      business;
+ *    - ANY leaf anywhere in the cone is non-negatable ⇒ the WHOLE negation is refused. Half a
+ *      De Morgan is not a conservative approximation of one;
+ *    - the cone exceeds `NEGATE_BUDGET` minted ops.
+ *
+ *  Ops are MINTED, never mutated: the originals stay where the caller hoisted them and die to the
+ *  pass list's own `dce: true` (raise/pre-recovery.ts). Only `icmp_*`/`logic_and`/`logic_or` are
+ *  ever rebuilt, all of them pure, so no effect can be duplicated or reordered by construction.
+ *
+ *  Nothing is SHARED between paths, and that is the point rather than a limitation. Memoizing `go`
+ *  in a `Map<Value, Value>` is three lines and would make the budget unnecessary — and it would
+ *  create exactly the hazard this fold exists to remove: a shared negated sub-condition has two
+ *  consumers, and analysis.ts renders a value with two consumers as a statement BEFORE the `if`.
+ *  Nothing collapses the duplicates later either — `numberPureValues` runs as `addrnum`, far ahead
+ *  of both folds. So the per-path rebuild is the mechanism and NEGATE_BUDGET is its price.
+ *
+ *  What it GUARANTEES about its result, which one caller leans on: every op it mints is an `icmp_*`
+ *  or a `logic_and`/`logic_or`, so the returned value is always a C boolean. The value form hands an
+ *  un-negated head straight on as the merge VALUE, which is why that caller checks booleanness for
+ *  itself before deciding whether to call here at all (see its head gate); the branch form needs no
+ *  such check, because its result only ever feeds a `cond_br`.
+ *
+ *  PRECONDITION, earned by the caller and not checked here: every value in the cone must dominate
+ *  the point the caller splices `ops` into — the minted comparisons reuse the ORIGINAL leaf
+ *  operands. The branch fold gets it free from ^g's single-predecessor gate: with ^h ^g's only
+ *  predecessor, every def in the cone either sits in ^g's body (spliced in ahead of these ops) or
+ *  dominates ^h. A caller without that invariant emits a def that does not dominate its use — loud
+ *  at `verify`, but this helper does not look.
+ *
+ *  It stays in this file rather than joining `NEGATED_ICMP` in ir/opcodes.ts: that table is a fact
+ *  about opcodes, this MINTS ops, and both consumers are the two folds above — the value form and
+ *  the branch form, which is the whole reason it is a helper and not inline. */
+function negateCondOps(defs: Map<Value, Op>, v: Value, budget: number): { ops: Op[]; result: Value } | null {
+  const ops: Op[] = [];
+  const go = (x: Value): Value | null => {
+    if (ops.length >= budget) {
+      return null;
+    }
+    const d = defs.get(x);
+    if (!d) {
+      return null;
+    }
+    const out = mkValue(T.unk(32));
+    if (NEGATED_ICMP[d.opcode]) {
+      ops.push(mkOp(NEGATED_ICMP[d.opcode], { operands: [...d.operands], results: [out] }));
+      return out;
+    }
+    if (d.opcode === 'logic_and' || d.opcode === 'logic_or') {
+      const a = go(d.operands[0]);
+      if (a === null) {
+        return null;
+      }
+      const b = go(d.operands[1]);
+      if (b === null) {
+        return null;
+      }
+      // Operands are pushed BEFORE the connective, so the op list is already in dominating order.
+      ops.push(mkOp(d.opcode === 'logic_and' ? 'logic_or' : 'logic_and', { operands: [a, b], results: [out] }));
+      return out;
+    }
+    return null;
+  };
+  const result = go(v);
+  return result === null || ops.length > budget ? null : { ops, result };
+}
+
+/** Do `c1` and `c2` compare the SAME value against CONSTANTS? The signature of a comparison-tree
+ *  `switch`, which switch-recover.ts owns — see the REFUSALS note. Equality tests only: a switch
+ *  dispatches on `==`/`!=`, while a RELATIONAL pair (`x >= lo && x <= hi`, the range check) is a
+ *  genuine connective this fold should still take. */
 function sameScrutineeConstTests(defs: Map<Value, Op>, c1: Value, c2: Value): boolean {
-  const eqTest = (v: Value): { scrutinee: Value } | null => {
-    const d = defs.get(v);
-    if (!d || (d.opcode !== 'icmp_eq' && d.opcode !== 'icmp_ne')) {
+  const s1 = constTestScrutinee(defs, c1);
+  const isEq = (v: Value): boolean => {
+    const op = defs.get(v)?.opcode;
+    return op === 'icmp_eq' || op === 'icmp_ne';
+  };
+  return s1 !== null && s1 === constTestScrutinee(defs, c2) && isEq(c1) && isEq(c2);
+}
+
+/** Is `c`'s scrutinee compared against constants by MORE THAN ONE `cond_br` in the function?
+ *
+ *  The function-wide question, for the case where the shared block was reached through a relay. A
+ *  tree's split node is RELATIONAL and its children are equalities (`if (x > 10) { if (x == 20) }`),
+ *  so the two tests in hand need not look alike, and the one that would give the tree away may be
+ *  neither of them. Counting every constant test on the scrutinee catches the split either way. */
+function inComparisonTree(fn: Fn, defs: Map<Value, Op>, c: Value): boolean {
+  const scrutinee = constTestScrutinee(defs, c);
+  if (scrutinee === null) {
+    return false;
+  }
+  let seen = 0;
+  for (const b of fn.blocks) {
+    const t = b.ops[b.ops.length - 1];
+    if (t?.opcode === 'cond_br' && constTestScrutinee(defs, t.operands[0]) === scrutinee && ++seen > 1) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/** The value an `icmp_* <value>, <const>` tests, or null when `c` is not one. */
+function constTestScrutinee(defs: Map<Value, Op>, c: Value): Value | null {
+  const d = defs.get(c);
+  if (!d || NEGATED_ICMP[d.opcode] === undefined) {
+    return null;
+  }
+  const [x, y] = d.operands;
+  const xc = defs.get(x)?.opcode === 'const';
+  const yc = defs.get(y)?.opcode === 'const';
+  // exactly one side constant — `x == y` between two variables is no switch test
+  return xc === yc ? null : xc ? y : x;
+}
+
+/** `armRereadCone`'s answer: the ops the arm copies, and the originals that then leave ^g. */
+interface ArmReread {
+  copy: ReadonlySet<Op>;
+  drop: ReadonlySet<Op>;
+}
+
+const readsOf = (op: Op): Value[] => [...op.operands, ...op.successors.flatMap((s) => s.args)];
+
+/** What the arm must RE-DERIVE for the fold to go ahead: `copy` is every `g`-defined value read
+ *  outside `g` with the part of its operand cone `g` computes, and `drop` the originals in `copy`
+ *  nothing left in `g` reads — the ones that would MOVE rather than duplicate. Both empty when
+ *  nothing escapes — then no gate is asked, because there is nothing to re-derive; null when a
+ *  gate in `opts.armReread` (default {@link ARM_REREAD_GATES}) refuses the site.
+ *
+ *  The copy is exact at the arm's head because nothing runs between: `g`'s body is pure (its
+ *  caller refuses anything in HOIST_UNSAFE_OPS), so a load copied there reads what `g`'s own load
+ *  read, and `g` is the arm's ONLY predecessor, so the copy runs exactly when the original's
+ *  value would have been live there. On verified IR that also places every escaping read under
+ *  the arm: `g` dominates nothing else, because the shared block is reached from ^h directly.
+ *  That is the MEANING half, and it holds however analysis.ts spells the copy. It is not the bytes
+ *  half — see ARM_REREAD_GATES' `read-behind-effect`. */
+function armRereadCone(
+  fn: Fn,
+  g: Block,
+  arm: Block,
+  preds: Map<Block, Block[]>,
+  opts: BranchShortCircuitOptions,
+): ArmReread | null {
+  const defOf = new Map<Value, Op>();
+  for (const op of g.ops) {
+    for (const r of op.results) {
+      defOf.set(r, op);
+    }
+  }
+  const readers = fn.blocks
+    .filter((b) => b !== g)
+    .flatMap((b) => b.ops.filter((op) => readsOf(op).some((v) => defOf.has(v))));
+  if (readers.length === 0) {
+    return { copy: new Set(), drop: new Set() };
+  }
+  const site = armRereadSite(fn, g, arm, preds, defOf, readers, opts.reloadsLocalReread === true);
+  return firstRejection(opts.armReread ?? ARM_REREAD_GATES, site) === null
+    ? { copy: site.copy, drop: site.drop }
+    : null;
+}
+
+/** One site the RE-READ admission judges: a condition block ^g that defines a value something past
+ *  it reads, and the arm ^g's non-shared edge enters — where that value would be re-derived.
+ *
+ *  THE FIELDS ARE LAZY. `copy` walks the operand cone and `drop` the whole of ^g, and the two
+ *  cheapest gates refuse without asking either. */
+export interface ArmRereadSite {
+  readonly fn: Fn;
+  /** ^g, the second condition block the fold would merge into ^h */
+  readonly g: Block;
+  /** the block ^g's non-shared edge enters — where the copy goes */
+  readonly arm: Block;
+  readonly preds: ReadonlyMap<Block, readonly Block[]>;
+  /** the op in ^g defining each value ^g defines */
+  readonly defOf: ReadonlyMap<Value, Op>;
+  /** every op outside ^g that reads a value ^g defines — never empty (see `armRereadCone`) */
+  readonly readers: readonly Op[];
+  /** those values and the part of their operand cone ^g computes: what the arm would copy */
+  readonly copy: ReadonlySet<Op>;
+  /** the originals in `copy` nothing left in ^g reads — deleted from ^g, so they MOVE to the arm.
+   *  Reverse order, so an original that fed only another dropped original goes too. */
+  readonly drop: ReadonlySet<Op>;
+  /** the target's compiler loads a LOCAL initialised with a read its test already performed a
+   *  second time (`BranchShortCircuitOptions.reloadsLocalReread`) */
+  readonly targetReloadsLocalReread: boolean;
+}
+
+function armRereadSite(
+  fn: Fn,
+  g: Block,
+  arm: Block,
+  preds: Map<Block, Block[]>,
+  defOf: Map<Value, Op>,
+  readers: Op[],
+  targetReloadsLocalReread: boolean,
+): ArmRereadSite {
+  let copy: Set<Op> | undefined;
+  let drop: Set<Op> | undefined;
+  const coneOf = (): Set<Op> => {
+    const out = new Set<Op>();
+    for (const work = readers.flatMap(readsOf).filter((v) => defOf.has(v)); work.length;) {
+      const d = defOf.get(work.pop()!);
+      if (d && !out.has(d)) {
+        out.add(d);
+        work.push(...d.operands);
+      }
+    }
+    return out;
+  };
+  const dropOf = (c: ReadonlySet<Op>): Set<Op> => {
+    const out = new Set<Op>();
+    const live = new Set<Value>();
+    for (let i = g.ops.length - 1; i >= 0; i--) {
+      const op = g.ops[i];
+      if (c.has(op) && op.results.every((r) => !live.has(r))) {
+        out.add(op);
+      } else {
+        readsOf(op).forEach((v) => live.add(v));
+      }
+    }
+    return out;
+  };
+  return {
+    fn,
+    g,
+    arm,
+    preds,
+    defOf,
+    readers,
+    targetReloadsLocalReread,
+    get copy() {
+      return (copy ??= coneOf());
+    },
+    get drop() {
+      return (drop ??= dropOf(this.copy));
+    },
+  };
+}
+
+/** Whether leaving ^g for `arm` leaves a natural loop ^g is in — some back-edge `t→h` (h dominates
+ *  t) whose body, h plus everything reaching t without passing h, holds ^g and not the arm. */
+function leavesALoop(fn: Fn, g: Block, arm: Block, preds: ReadonlyMap<Block, readonly Block[]>): boolean {
+  const dom = dominators(fn);
+  for (const t of fn.blocks) {
+    for (const h of successorsOf(t)) {
+      if (!dom.get(t)?.has(h)) {
+        continue;
+      }
+      const body = new Set<Block>([h]);
+      for (const work = [t]; work.length;) {
+        const b = work.pop()!;
+        if (!body.has(b)) {
+          body.add(b);
+          work.push(...(preds.get(b) ?? []));
+        }
+      }
+      if (body.has(g) && !body.has(arm)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
+/** Whether analysis.ts would spell the arm's copy of a READ as a LOCAL rather than inline — a
+ *  MIRROR of analysis.ts's placement and barrier rules (structure/analysis.ts: `emitPos`, the
+ *  single-render `isBarrier`, the multi-render `isWrite`), not a coarser stand-in for them. It is
+ *  separate code, so the two can drift: the DIFFERENTIAL in the matching suite
+ *  (shortcircuit-branch.test.ts) is what holds them together. The copy sits at the arm's head, so
+ *  every question is about the arm block.
+ *
+ *  Only the copied READS are asked about. An address member of the cone (`add`, `gaddr`) re-derives
+ *  at every use and carries nothing, however the address is spelled — so `p[i]` and `p[5]` get the
+ *  same answer. A read answers yes when:
+ *
+ *    - it renders nowhere single: some PURE value between it and a statement has two consumers, so
+ *      `emitPos` is null and analysis.ts materializes it whatever stands in the way
+ *      (`p[2] = p[1] & 0x80; p[3] = p[1] & 0x80;` — one `and`, two stores);
+ *    - it has MORE THAN ONE direct reader, and an effect precedes one of their render positions —
+ *      the multi-render rule, `isWrite = EFFECTFUL_OPS`, which exempts nothing;
+ *    - it has ONE, and an effect precedes its render position that analysis.ts's `isBarrier`
+ *      counts: any `astore`/`opaque`, a `call` that is not rendered inside that same statement,
+ *      and a `store` UNLESS it is to a provably disjoint slot of the read's own base
+ *      (`disjointConstSlots`, ir/alias.ts — the helper `isBarrier` calls).
+ *
+ *  A reader in any block other than the arm answers yes — the copy then outlives the arm's first
+ *  block. What this does NOT mirror, and which way each gap errs, is ARM_REREAD_GATES' RESIDUE. */
+function readHeldAcrossEffect(c: ArmRereadSite): boolean {
+  const reads = [...c.copy].filter((op) => ORDER_SENSITIVE_OPS.has(op.opcode));
+  if (reads.length === 0) {
+    return false;
+  }
+  // The arm as analysis.ts will see it: the copied cone at its head (position 0 — nothing runs
+  // before it), then the arm's own ops. A copied op's consumers are the arm ops and the OTHER copied
+  // ops reading it, so a read feeding a copied `add` the arm reads renders where that `add` does.
+  const cone = c.g.ops.filter((op) => c.copy.has(op));
+  const posOf = (op: Op): number => Math.max(0, c.arm.ops.indexOf(op));
+  const escapes = (vs: readonly Value[]): boolean =>
+    c.fn.blocks.some((b) => b !== c.g && b !== c.arm && b.ops.some((op) => readsOf(op).some((v) => vs.includes(v))));
+  const consumersOf = (vs: readonly Value[]): Op[] =>
+    [...cone, ...c.arm.ops].filter((op) => readsOf(op).some((v) => vs.includes(v)));
+  // `emitPos`: a statement renders where it stands, a value where its one consumer renders. A pure
+  // value with two consumers renders in both — null. A load or call with two is one analysis.ts
+  // names (a call executes once), so it renders where it stands. A consumer outside the arm leaves
+  // the position unresolved — null, the other-block clause.
+  const at = (op: Op): number | null => {
+    if (op.successors.length > 0 || op.opcode === 'ret' || op.results.length === 0) {
+      return posOf(op);
+    }
+    if (escapes(op.results)) {
       return null;
     }
-    const [x, y] = d.operands;
-    const xc = defs.get(x)?.opcode === 'const';
-    const yc = defs.get(y)?.opcode === 'const';
-    // exactly one side constant — `x == y` between two variables is no switch test
-    return xc === yc ? null : { scrutinee: xc ? y : x };
+    const cs = consumersOf(op.results);
+    if (cs.length === 0) {
+      return posOf(op);
+    }
+    if (cs.length === 1) {
+      return at(cs[0]);
+    }
+    return ORDER_SENSITIVE_OPS.has(op.opcode) ? posOf(op) : null;
   };
-  const a = eqTest(c1);
-  const b = eqTest(c2);
-  return a !== null && b !== null && a.scrutinee === b.scrutinee;
+  for (const l of reads) {
+    if (escapes(l.results)) {
+      return true;
+    }
+    const renders = consumersOf(l.results).map(at);
+    if (renders.some((i) => i === null)) {
+      return true;
+    }
+    const multi = renders.length > 1;
+    const bars = (x: Op, pos: number): boolean => {
+      if (!EFFECTFUL_OPS.has(x.opcode)) {
+        return false;
+      }
+      if (multi) {
+        return true;
+      }
+      if (x.opcode === 'store') {
+        return !(l.opcode === 'load' && disjointConstSlots(l, x));
+      }
+      if (x.opcode === 'call') {
+        return at(x) !== pos;
+      }
+      return true;
+    };
+    if (renders.some((pos) => c.arm.ops.slice(0, pos!).some((x) => bars(x, pos!)))) {
+      return true;
+    }
+  }
+  return false;
 }
 
-/** True when every value `g` defines is read at most once, and any read is inside `g`.
+// ── THE RE-READ ADMISSION'S REFUSALS, AS DATA ─────────────────────────────────────────────────
+//
+// A table so its refusals can be counted: taken as an OPTIONAL parameter
+// (`BranchShortCircuitOptions.armReread`), and censused from outside core by
+// `pnpm bench gates --pass arm-reread`, which swaps this pass's
+// entry in `PRE_RECOVERY_PASSES` (apps/benchmark/src/run/gate-census.ts). The table is asked only
+// at a site `sameArgs` and the negatability check have already passed, so a count is its own.
+//
+// SOUND is two rules — `entry-arm` and `second-pred` put the copy on a path the original never
+// ran. The other five are FIDELITY: each refuses a site where re-deriving costs bytes the nest did
+// not, and a wrong answer there is a miss, never wrong C, because the copy stays under the guard
+// either way.
+//
+// RESIDUE, named because it is not in the table:
+//
+//   - the USE-COUNT half of `definedValuesStayLocal` — a value ^g reads twice itself is
+//     materialized before the `if` — which judges ^g's own reads rather than this site's
+//     re-derivation, and runs after the table on every fold, escaping or not.
+//   - what `read-behind-effect` does not mirror of analysis.ts, of two kinds that err opposite
+//     ways. (1) `/reread-globals`. Under that STRUCTURE variation analysis.ts lets a store to a
+//     DIFFERENT named global through (`mayWriteGlobal`, ir/alias.ts), so there the copy inlines —
+//     but this pass runs once per LIFT, and rank.ts structures every `/reread-globals` candidate
+//     from a lift it shares with the others (`liftSettings`), so the verdict cannot follow the
+//     variation without a lift of its own. It errs toward REFUSING, at a measured price:
+//     `if (a && (gQ2[1] & 0x7f) == 0x7f) { gK = 1; gQ2[1] &= 0x80; return; } fnB();` keeps a 3/23
+//     nest where the fold matches on that variation (MATCH 0/21 with this rule ablated), and so does the
+//     same arm over a struct global's member; no corpus row. (2) the scopes analysis.ts
+//     materializes a read in for reasons OTHER than a barrier — `liveAcrossLoop`, the address-home
+//     variation, a load fed to a `cond_br` edge. They err toward ADMITTING: a local, under the guard,
+//     one extra load on agbcc; no inhabitant measured. The DIFFERENTIAL in
+//     packages/cli/test/matching/shortcircuit-branch.test.ts is what notices either one growing.
+//
+// MEASURED over the whole corpus, every row's default lift and whole enumerated fan with its
+// symbol map, both tiers (LBG and ProcessInputAndUpdateEntities default lift only): something
+// escapes ^g at a site on 10 rows. Against main the default source or the fan moves on 6 —
+// synthetic `ladder4`/`ladder5`/`ladidx1`/`ladidx2`, kleod `CountCollectedGems`, sa3
+// `EwramFree` — and on no other row; `nestinit` and `ucmp:mwcc_242_81` are refused here and come
+// out as main did, and `CheckTileCollisionVertical` and `TrySetCantSelectMoveBattleScript` are
+// refused at every site and come out as main did too — held
+// there by `loop-exit`, `moves-a-read` and `read-behind-effect`, whose prices outside the corpus
+// are on each rule. `read-behind-effect`'s target scoping and its analysis.ts mirror move nothing
+// in the corpus — default source and fan byte-identical on all 784 synthetic and 252 real rows,
+// and the same verdict at every site — so what they buy is off the corpus, on the rule.
+export const ARM_REREAD_GATES: readonly Gate<ArmRereadSite>[] = [
+  {
+    id: 'entry-arm',
+    why: 'an arm that is the function’s first block is also reached on entry, where the copy would run too',
+    sound: true,
+    guardedBy: 'branch-shortcircuit.test.ts: REFUSED: a value the ARM re-reads, when the arm is the entry block',
+    rejects: (c) => c.arm === c.fn.blocks[0],
+  },
+  {
+    // With readers present the second predecessor can only be one ^g's copy dominates — a loop
+    // back into the arm, re-running the re-read against memory the loop has since written.
+    id: 'second-pred',
+    why: 'a second way into the arm would run the copy on a path that never ran the original',
+    sound: true,
+    guardedBy: 'branch-shortcircuit.test.ts: REFUSED: a value the ARM re-reads, when the arm has a second predecessor',
+    rejects: (c) => (c.preds.get(c.arm) ?? []).length !== 1,
+  },
+  {
+    // The loop-guard shape, `for (i = 0; i < n; …)` under an `if`: agbcc tests the register it just
+    // set to the induction's start (`mov r3, #0; cmp r3, r5`) and carries that register into the
+    // loop, so ^g's condition reads a VARIABLE the arm goes on to own. A copy re-derives the
+    // constant and the fold hands the outer `if` a `0 < n` loop recovery needed as its own guard
+    // — `synthetic:nestinit:agbcc` MATCH → 6/49.
+    id: 'edge-arg',
+    why: 'a value an edge carries is a variable the arm owns, not an expression it re-reads',
+    sound: false,
+    guardedBy: 'branch-shortcircuit.test.ts: REFUSED: a value the ARM carries on as an edge ARGUMENT',
+    rejects: (c) => c.readers.some((op) => op.successors.some((s) => s.args.some((v) => c.defOf.has(v)))),
+  },
+  {
+    // A value the SSA builder homed in a frame slot (`fn.slotHomes`) is one the target held in a
+    // DECLARED local and reloads in the arm (`ldr rN, [sp, #k]`). The copy re-derives it instead,
+    // and the copy's result carries no home, so the local and its `[sp, #k]` traffic are spelled
+    // away and the frame order `l3/slotorder.ts` reads loses that name — silently, the failure
+    // `replaceAllUsesWith` (ir/core.ts) ships an equally inhabitant-less guard against. Those are
+    // the bytes it protects. NO INHABITANT in either tier or in any probe written against this
+    // table, and stated rather than argued away: only Thumb stamps homes, and on agbcc a value
+    // spilled in ^g is one live across a call in the arm, which `read-behind-effect` refuses on
+    // its own unless the copy is a pure ADDRESS — the only shape where this rule alone would decide.
+    id: 'slot-home',
+    why: 'the machine kept this value in a stack slot rather than re-deriving it',
+    sound: false,
+    guardedBy: 'branch-shortcircuit.test.ts: REFUSED: a value the ARM re-reads, when the frame homed it',
+    rejects: (c) => [...c.copy].some((op) => op.results.some((r) => c.fn.slotHomes?.has(r))),
+  },
+  {
+    // A loop body's `if (a && … && d) { …; return; }`: the fold fuses the WHOLE condition into the
+    // loop header, whose out-edge is then this early-return arm, and loop recovery reads it as the
+    // loop's exit and declines the latch's (`unrecovered back-edge`). The shape is not this
+    // admission's — the same loop with an arm that re-reads nothing folds the same way and
+    // declines on main too — but this admission is what reached it: a probe of kleod
+    // `CheckTileCollisionVertical`'s shape (not a corpus row) went diff:11/57 → declined, and the
+    // real row's eight `/reread-globals` candidates all threw, which `bench run` does not report.
+    // Refusing the re-read at a loop exit keeps exactly the nest main produced there. No row this
+    // admission matches has its arm outside a loop ^g is in.
+    //
+    // What it protects that no corpus row pins is the ordinary SEARCH LOOP: `for (i = 0; i < 8;
+    // i++) { if (q[i] != 0 && (v = p[i]) > 5) { r[0] = v; return; } } fnB();` matches as the nest
+    // and scores 21/33 fused, and its `p[i] &= 0x80` twin MATCH against 31/37. The first is in the
+    // matching suite (shortcircuit-branch.test.ts), which fails with this rule ablated.
+    id: 'loop-exit',
+    why: "fusing a loop body's whole condition makes this arm the header's exit, which loop recovery misreads",
+    sound: false,
+    guardedBy: 'branch-shortcircuit.test.ts: REFUSED: a value the ARM re-reads, when the arm LEAVES the loop',
+    rejects: (c) => leavesALoop(c.fn, c.g, c.arm, c.preds),
+  },
+  {
+    // `if (a) { v = p->f; if (b) use(v); }`: the target reads `p->f` on BOTH exits of `b`, before
+    // `b`'s own reads; moved, it runs on one, after them. No row this admission matches moves
+    // anything (the census: every fire site's `drop` is empty), and moving the read cost
+    // the probe `if (gA) { v = gP->f[5]; if (gQ == 3) sink(v); }` its MATCH (0/20 → 15/24) and
+    // turned a device-register read into one on one path only. Moving a PURE original stays: it
+    // re-derives at every use whatever this does.
+    id: 'moves-a-read',
+    why: 'the target read it before the second test on both of its exits; moved, it runs on one',
+    sound: false,
+    guardedBy: 'branch-shortcircuit.test.ts: REFUSED: a READ only the arm consumes would move under the second test',
+    rejects: (c) => [...c.drop].some((op) => ORDER_SENSITIVE_OPS.has(op.opcode)),
+  },
+  {
+    // THE BYTES HALF of the copy (see `armRereadCone`), and a claim about ONE compiler. The arm of
+    // `if (a && (p[1] & 0x7f) == 0x7f) { … }` loads `p[1]` again or not by SPELLING — loads of
+    // `p[1]`, compiled at each bench toolchain's flags:
+    //
+    //                                        agbcc  ido7.1  gcc2.7.2kmc  gcc2.7.2  mwcc_242_81
+    //     p[1] &= 0x80;                        1      1         1          1          1
+    //     q[0] = 5; p[1] &= 0x80;              1      2         2          2          2
+    //     p[3] = 5; p[1] &= 0x80;              1      1         2          2          2
+    //     fnB(); p[2] = p[1];                  2      2         2          2          2
+    //     u8 v = p[1]; p[2] = v;               2      1         1          1          1
+    //     u8 v = p[1]; q[0] = 5; p[2] = v;     2      1         1          1          1
+    //     u8 v = p[1]; fnB(); p[2] = v;        2      1         1          1          1
+    //
+    // A LOCAL at the arm's head costs agbcc a second load and costs the other four nothing — the
+    // target's `compilerBehaviors.reloadsLocalReread` (target.ts), the conjunct below. analysis.ts
+    // spells the copy inline unless something stands between it and a use, and otherwise
+    // materializes a local at the arm's head: correct, under the guard, and on agbcc a second
+    // load. So on agbcc a read analysis.ts would materialize is refused, and the nest main spells
+    // stays — `{ fnB(); sink(v); }`, `{ sink(v); sink(v); }` and `{ gP->f[3] = 0; sink(v); }` each
+    // match only as the nest. Elsewhere the local IS the target's spelling: on mwcc,
+    // `if (a) { u8 v = p[3]; if ((v & 0x7f) == 0x7f) { fnA(); p[4] = v; return; } } fnB();` was
+    // 3/24 with this rule running there and matches without it.
+    //
+    // WHICH copies analysis.ts materializes is asked with analysis.ts's own rules
+    // (`readHeldAcrossEffect`): only the copied READS, never the address arithmetic beside them,
+    // and a store to a provably disjoint slot is no barrier. The coarser rule — ANY effect bars,
+    // seeded from every copied op — holds 13 agbcc probes at 3 to 8 points that byte-match under
+    // this one (`r->x = 5; r->fl &= 0x80;`, `p[3] = 5; p[1] &= 0x80;`, `p[i] &= 0x80; fnB(); p[i]
+    // = 1;` among them), scores 8 more worse, and scores none of 249 probes over five toolchains
+    // better. What this one does not mirror is the RESIDUE above.
+    id: 'read-behind-effect',
+    why: 'a re-read written as a local costs a second load on a target whose compiler reloads one',
+    sound: false,
+    guardedBy: 'branch-shortcircuit.test.ts: REFUSED: a READ the arm holds across an effect is not re-derived',
+    rejects: (c) => c.targetReloadsLocalReread && readHeldAcrossEffect(c),
+  },
+];
+
+/** Copy `copy` to the head of `arm`, point every read outside `g` at the copies, and delete `drop`.
+ *  A dropped original is deleted rather than left for the hoist: the arm now performs it, and a
+ *  dead READ left in ^h is one the structurer may still spell (SPELLED_WHEN_DEAD_OPS). */
+function rereadInArm(fn: Fn, g: Block, arm: Block, { copy, drop }: ArmReread): void {
+  const copyOf = new Map<Value, Value>();
+  const copies = g.ops
+    .filter((op) => copy.has(op))
+    .map((op): Op => ({
+      opcode: op.opcode,
+      operands: op.operands.map((v) => copyOf.get(v) ?? v),
+      results: op.results.map((r) => {
+        const c = mkValue(r.type);
+        copyOf.set(r, c);
+        return c;
+      }),
+      attrs: { ...op.attrs },
+      successors: [],
+    }));
+  const redirect = (v: Value): Value => copyOf.get(v) ?? v;
+  for (const b of fn.blocks) {
+    if (b === g) {
+      continue;
+    }
+    for (const op of b.ops) {
+      op.operands = op.operands.map(redirect);
+      for (const s of op.successors) {
+        s.args = s.args.map(redirect);
+      }
+    }
+  }
+  arm.ops.unshift(...copies);
+  g.ops = g.ops.filter((op) => !drop.has(op));
+}
+
+/** True when every value `g` defines is read at most once, and any read is inside `g` or is one
+ *  `armRereadCone` answered for — reads outside `g` move to the arm's copy, and reads BY a
+ *  dropped original leave with it. The use-count half is the residue ARM_REREAD_GATES names.
  *
  *  The VALUE form above needs no such check, and the asymmetry is real rather than drift: its feeder
  *  ends in `br M`, so the feeder has no successor of its own to dominate and every value it defines
  *  is either read in the feeder or carried to `M` as the phi argument the fold consumes. Here ^g
  *  ends in `cond_br` and its `other` successor IS ^g-dominated, so a ^g-defined value genuinely can
- *  escape, and only this check stops it.
+ *  escape, and only this check and the arm's copy stop it.
  *
- *  An earlier version of this note justified the asymmetry by "the feeder dominates nothing but
- *  itself because M has 2+ predecessors", and told the reader not to unify the guards. That was
- *  WRONG — the entry block dominates every block whatever M's predecessor count — and it was wrong
- *  about the one guard the two folds genuinely DO share, the `fn.blocks[0]` refusal, which the value
- *  form was missing entirely. Both now have it. When changing either fold, check the other. */
-function definedValuesStayLocal(fn: Fn, g: Block): boolean {
+ *  What the two folds genuinely DO share is the `fn.blocks[0]` refusal, and each has a test that
+ *  pins its own half: 'a feeder that is the entry block is not folded away' for the value form, and
+ *  'the ENTRY block is never folded away' for the branch form. They are deliberately NOT routed
+ *  through one shared `isEntry` helper — a helper enforces nothing, and it is the two tests that
+ *  hold each fold to the refusal. When changing either fold, check the other. */
+function definedValuesStayLocal(fn: Fn, g: Block, { copy, drop }: ArmReread): boolean {
   const defined = new Set<Value>(g.ops.flatMap((op) => op.results));
   if (defined.size === 0) {
     return true;
   }
+  const copied = new Set<Value>([...copy].flatMap((op) => op.results));
   const uses = new Map<Value, number>();
   for (const b of fn.blocks) {
     for (const op of b.ops) {
-      for (const v of [...op.operands, ...op.successors.flatMap((s) => s.args)]) {
+      if (drop.has(op)) {
+        continue;
+      }
+      for (const v of readsOf(op)) {
         if (!defined.has(v)) {
           continue;
         }
         if (b !== g) {
+          if (copied.has(v)) {
+            continue; // re-derived in the arm (`rereadInArm`)
+          }
           return false; // escapes ^g — the structurer would render it before the `if`
         }
         uses.set(v, (uses.get(v) ?? 0) + 1);