@asmlift/core 0.5.0 → 0.7.0

package/src/rank.ts

@@ -2,117 +2,128 @@
 // from asm alone (is this value signed or unsigned? which branch sense did the source spell?).
 // Rather than guess, asmlift emits a small set of CANDIDATES and lets an external differ score
 // pick the winner — the differ is the fitness function; types/branch-sense are differ-ranked
-// levers, not asserted truths.
+// variations, not asserted truths.
 //
-// This module owns only the PURE half: producing the distinct candidate spellings. It has NO
+// This module owns only the PURE half: producing the distinct candidates. It has NO
 // scorer (that stays out of @asmlift/core, which is browser-pure). `rankBy` takes an INJECTED
 // scoreFn, so the same enumeration feeds the cli's Node/objdiff scorer and the webapp's
 // wasm/objdiff scorer alike.
+//
+// THREE SIBLING FILES, one job each — never a `rank/` directory, which beside `rank.ts` is a
+// resolver trap:
+//   rank.ts        this file: the enumeration DRIVER and the two ranking drivers over it.
+//   rank-variations.ts   the TABLES the driver walks — structure variations, stacked and pre-respell
+//                  variations, the base-CSE hoist rosters. Their DECLARATION ORDER is published behaviour
+//                  (`compareScored` breaks a score tie by enumeration order), so reordering one
+//                  is a behaviour change and never a tidy-up.
+//   rank-declare.ts  the DECLARATION half: what a candidate's own asm says about the globals it
+//                  names, and which of those names a declaration must refuse to claim.
 import { cBackend } from './backend/c';
-import { assertDerefsTyped, assertResolved } from './contracts';
+import {
+  assertDerefsTyped,
+  assertLocalsWritten,
+  assertNoOrphanedLocals,
+  assertPlacementSurvives,
+  assertResolved,
+} from './contracts';
 import type { AsmData } from './frontend/asmdata';
 import { frontendFor } from './frontend/registry';
-import { globalCellOf } from './ir/alias';
-import { Fn, type Value, defOpMap } from './ir/core';
+import { hasSetupArgsNarrowing, narrowToSetupArgs } from './frontend/ssa';
+import { Fn, defOpMap } from './ir/core';
 import { T } from './ir/types';
 import { verify } from './ir/verify';
+import { advancedBases } from './l3/advance';
 import { materializeArgBases } from './l3/argbase';
 import type { LanguageBackend, SFn } from './l3/ast';
-import { coalesceCandidates } from './l3/coalesce';
-import { registerishSpellings } from './l3/regspell';
+import { type BaseKey, admittedBases, hoistBaseLocals } from './l3/basecse';
+import { armDisjointCandidates, coalesceCandidates } from './l3/coalesce';
+import type { Gate } from './l3/gates';
+import type { HoistPlacement } from './l3/hoist';
+import { homeSplitTag, homeSplitWithholds, splitHomeBases } from './l3/homesplit';
+import { inlinableConstBases, inlineConstBases } from './l3/inlinebase';
+import { mulFirstSums } from './l3/mulfirst';
+import { nearBaseClusters } from './l3/nearbase';
+import { spellOperandMembers } from './l3/offmember';
+import { parkParamsFirst } from './l3/parkfirst';
+import { pointerFields } from './l3/ptrfield';
+import { type RegcopyTail, registerishSpellings } from './l3/regspell';
 import { reindexWalks } from './l3/reindex';
 import { hoistScopedBases } from './l3/scopebase';
-import { type SymbolRef, collectSymbolRefs } from './l3/symbol-refs';
+import { sinkInitsToFirstUse } from './l3/sinkinit';
+import type { SymbolRef } from './l3/symbol-refs';
+import { type UnreduceResult, unreduceAccumulators } from './l3/unreduce';
+import { deviceVolatileClaims, volatilePtrLocals, volatileSubsetCandidates } from './l3/volatileptr';
+import { volatileValueLocals } from './l3/volatileval';
+import { volatileDeviceStores } from './l3/volstore';
+import { zeroSubNegates } from './l3/zerosub';
 import { RewritePattern } from './pattern/engine';
 import { applyIdiomPatterns, raiseRecovered, structureChecked } from './pipeline';
 import { type Prototypes, prototypesFromSymbols } from './proto';
+import { inferGlobalArrays, orderLicensedGlobals, sameDerivedShape } from './raise/globalshape';
 import { runPreRecovery } from './raise/pre-recovery';
 import { recoverTypes } from './raise/recover';
-import { type SymbolMap, symbolsByName } from './symbols';
+import { sinkStoreTails } from './raise/tailsink';
+import {
+  type RefusedDeclarationReason,
+  bareGlobalAccessFacts,
+  bareGlobalSymbols,
+  makeRefCollector,
+} from './rank-declare';
+import {
+  BASEFOLD_HOISTS,
+  type BaseHoist,
+  LIVEBASE_HOISTS,
+  NO_PIN_KINDS,
+  ORDERBASE_HOISTS,
+  PRE_RESPELL_VARIATIONS,
+  SIGNEDNESS,
+  STACKED_SUBSETS,
+  STRUCTURE_VARIATIONS,
+  type StructureVariation,
+  UNFOLDED_HOISTS,
+  applyStacked,
+  createdLocals,
+  sameBases,
+} from './rank-variations';
+import { hasDivergentSharedRet } from './structure/structure';
+import {
+  type SymbolInfo,
+  type SymbolMap,
+  arrayInnerExtents,
+  declaresBitfields,
+  isPtrField,
+  symbolsByName,
+} from './symbols';
 import { type TargetDescription, structureOptionsFor } from './target';
+import { type SubjectVariationName, type Variation, offeredOn, withSubject } from './variation-tokens';
 
-/** The signedness of the entry parameters — the classic ambiguity asm cannot resolve.
+/** Pin every SCALAR entry param (index not in `ptrIdx`) to the candidate signedness, before
+ *  recovery. Answers whether any param was PINNABLE — not whether its type moved: which of the
+ *  two passes writes first is an accident of enumeration order, and the two signedness candidates
+ *  differ exactly where a param can be written at all.
  *
- * Struct LAYOUT is recovered structurally (raise/structs.ts), not as a scored axis here:
- * `->field_N` and `[idx]` compile identically, so the differ cannot referee between them. */
-const SIGN_CANDS = [
-  { label: 'unsigned', signed: false },
-  { label: 'signed', signed: true },
-];
-
-// A recovered POINTER/aggregate param must NOT be signedness-pinned: pinning a still-`unknown`
-// pointer param to a scalar int BEFORE recovery blocks pointer recovery and emits uncompilable
-// `*(s32)`. Only genuine scalars carry the signedness axis.
-const NO_PIN_KINDS = new Set(['ptr', 'struct', 'array']);
-
-/** Pin every SCALAR entry param (index not in `ptrIdx`) to the candidate signedness, before recovery. */
-function pinScalarParams(fn: Fn, signed: boolean, ptrIdx: Set<number>): void {
+ *  A param NARROWED by raise/paramwidth.ts is not pinnable: the extension it was narrowed at states
+ *  the signedness as well as the width — agbcc's shift pair by its `asr`/`lsr`, PPC's `extsb`/`extsh`
+ *  by the opcode — so there is no question for the signedness variation to put to the differ, and pinning would
+ *  widen it back to 32 bits. */
+function pinScalarParams(fn: Fn, signed: boolean, ptrIdx: Set<number>): boolean {
+  let pinnable = false;
   fn.blocks[0].params.forEach((p, i) => {
     if (ptrIdx.has(i)) {
       return;
     }
-    if (p.type.kind === 'unknown' || p.type.kind === 'int') {
+    if (p.type.kind === 'unknown' || (p.type.kind === 'int' && p.type.width === 32)) {
+      pinnable = true;
       p.type = signed ? T.s(32) : T.u(32);
     }
   });
+  return pinnable;
 }
 
-/** Bare-global ACCESS FACTS for name-only map symbols — the width/signedness authority the
- *  declaration synthesis (declare.ts) uses when the map has no shape. The map knows only the
- *  NAME (symtab-only projects: marioparty3); the candidate's own IR knows exactly how the cell
- *  is accessed, and the bare `gSym = v` / `x = gSym` spelling compiles to those bytes only
- *  under a decl of that exact width (`extern u16 g;` is `sh` where a guessed u32 is `sw`).
- *  Mirrors structure()'s scalar-global rule: a fact is recorded only for a symbol accessed
- *  EXCLUSIVELY at offset 0 with ONE width and ONE load signedness — anything else (interior
- *  offsets, address arithmetic, width or sign conflicts) records nothing, because those
- *  spellings go through `&gSym` casts where every object decl is address-identical. */
-function bareGlobalAccessFacts(fn: Fn): Map<string, { width: number; signed: boolean }> {
-  const defs = defOpMap(fn);
-  const symOf = (v: Value): string | null => {
-    const d = defs.get(v);
-    return d?.opcode === 'gaddr' && d.attrs.code !== true ? (d.attrs.sym as string) : null;
-  };
-  const acc = new Map<string, { widths: Set<number>; signs: Set<boolean>; interior: boolean }>();
-  const get = (s: string) => acc.get(s) ?? acc.set(s, { widths: new Set(), signs: new Set(), interior: false }).get(s)!;
-  for (const b of fn.blocks) {
-    for (const op of b.ops) {
-      if (op.opcode === 'load' || op.opcode === 'store') {
-        const s = symOf(op.operands[0]);
-        if (s) {
-          const a = get(s);
-          if ((op.attrs.off as number) !== 0) {
-            a.interior = true;
-          } else {
-            a.widths.add(op.attrs.width as number);
-            if (op.opcode === 'load') {
-              a.signs.add(((op.attrs.signed as boolean) ?? false) && (op.attrs.width as number) < 4);
-            }
-          }
-        }
-      } else if (op.opcode === 'aload' || op.opcode === 'astore') {
-        const s = symOf(op.operands[0]);
-        if (s) {
-          get(s).interior = true;
-        }
-      } else {
-        // any other use of the address (arithmetic, a call arg, a comparison) is interior/escape
-        for (const o of op.operands) {
-          const s = symOf(o);
-          if (s) {
-            get(s).interior = true;
-          }
-        }
-      }
-    }
-  }
-  const out = new Map<string, { width: number; signed: boolean }>();
-  for (const [s, a] of acc) {
-    if (!a.interior && a.widths.size === 1 && a.signs.size <= 1) {
-      out.set(s, { width: [...a.widths][0], signed: a.signs.has(true) });
-    }
-  }
-  return out;
-}
+/** Re-exported so `@asmlift/core/rank` keeps its published surface: `onRefusedDeclaration`'s
+ *  reason type is declared beside the refusals themselves (rank-declare.ts) and consumed from
+ *  here. */
+export type { RefusedDeclarationReason };
 
 export interface EnumerateOptions {
   patterns?: RewritePattern[];
@@ -121,22 +132,62 @@ export interface EnumerateOptions {
   asmData?: AsmData;
   /** address→symbol map (symbols.ts) — same contract as DecompileOptions.symbols */
   symbols?: SymbolMap;
-  /** Called when a re-spelling lever THROWS or fails a boundary contract, so the failure is visible
-   *  instead of the candidate silently not existing. Enumeration continues either way — the primary
-   *  spelling is unaffected — but a lever that never fires because it always throws is a defect, and
-   *  without this it looks identical to a lever that correctly declined. */
-  onLeverError?: (label: string, error: string) => void;
+  /** Called when a respell variation THROWS or fails a boundary contract, so the failure is visible
+   *  instead of the candidate silently not existing. Enumeration continues either way — the default
+   *  candidate is unaffected — but a variation that never fires because it always throws is a defect,
+   *  and without this it looks identical to a variation that correctly declined.
+   *
+   *  `variations` is NOT a candidate's name: it lists what the throwing step itself applied, in
+   *  name order. A lift or structure setting reports its lift and structure variations
+   *  (`['defsite']`). A respell or pre-respell step reports only its pre-respell and respell
+   *  variations (`['unmerge', 'vol-slot']`), never the lift, structure, signedness or symbol-map
+   *  variations of the tree it ran on. So one failure is reported once per signedness, symbol-map
+   *  setting and structured tree it recurs on, each time with the same list, and `[]` means a
+   *  structured tree's own source could not be spelled. */
+  onEnumerationError?: (variations: readonly string[], error: string) => void;
+  /** Called once per (name, reason) when the declaration synthesis REFUSES a name the tree
+   *  references (see `RefusedDeclarationReason`). The name then stays undeclared and the
+   *  candidate fails loudly in a self-declared world — this is what lets the consumer say which
+   *  undeclared name was asmlift's own refusal rather than a symbol it never saw. */
+  onRefusedDeclaration?: (name: string, reason: RefusedDeclarationReason) => void;
+  /** Called with the variation's name (`defsite`) each time a STRUCTURE variation's shared gate says this
+   *  function has no inhabitant for it, so the alternative is never enumerated.
+   *
+   *  The two callbacks below report the enumeration's two SILENT candidate-deleting sites, and
+   *  they exist for `onEnumerationError`'s reason read one level up: a candidate that was never
+   *  enumerated is indistinguishable, from outside, from one the differ simply did not pick, and
+   *  nothing else in the pipeline reports it. A gate that has stopped firing and a gate that
+   *  correctly declines on every corpus row look identical without this.
+   *
+   *  They ride `EnumerateOptions` rather than `RankedResult` deliberately: these are facts about
+   *  the enumeration's INTERNALS, and `RankedResult` is the published candidate set.
+   *
+   *  Nothing shipped passes either one, so a channel that had stopped firing would be invisible in
+   *  exactly the way the channel exists to prevent. `test/enumerate-signals.test.ts` pins that both
+   *  reach a caller. */
+  onVariationGated?: (variation: string) => void;
+  /** Called once per structure setting whose structured tree an earlier setting already produced —
+   *  the tree dedup, which is where most of the cross's factors of two go. See `onVariationGated` for why both
+   *  are here rather than on the result. */
+  onTreeDeduped?: () => void;
+  /** PROBE (`ASMLIFT_PERSITE_SENSE`, wired in the cli): fork the two per-FUNCTION branch-sense
+   *  booleans into one bit per SITE, crossing every sense setting with all 2^n masks over the first
+   *  `n` sense sites. Costs a factor of 2^n on the whole fan, which is the measurement — see the
+   *  per-site sense measurement in the enumeration below. 0/absent = the shipped per-function sense. */
+  perSiteSenseBits?: number;
 }
 
-/** One distinct candidate spelling — a point in the axis cross (signedness × branch sense ×
- *  def-site anchoring × bitfield spelling × symbol-map variant, plus the L3 re-spellings) —
+/** One distinct candidate — one combination of variations (signedness × branch sense ×
+ *  def-site anchoring × bitfield spelling × symbol map, plus the respell variations) —
  *  emitted to source. */
 export interface Candidate {
-  label: string;
+  /** the variations this candidate applied, in enumeration order — signedness first. This list IS
+   *  the candidate's name; `joinVariations` prints it. */
+  variations: readonly string[];
   source: string;
-  /** Which PREFERENCE GROUP this spelling belongs to — the symbol-variant index (0 = the map's own
-   *  named spellings, 1 = their `/raw-globals` siblings). Enumeration emits the groups in
-   *  preference order, and a lower group WINS a score tie: when both compile to the same bytes the
+  /** Which PREFERENCE this candidate carries — the symbol-map setting's index (0 = the map's own
+   *  named spellings, 1 = their `/raw-globals` siblings). Enumeration emits the settings in
+   *  preference order, and a lower preference WINS a score tie: when both compile to the same bytes the
    *  reader should get `gCounter.field`, not a byte offset off a hoisted `(u8 *)` base.
    *
    *  Carried structurally rather than left to enumeration order because the readability tie-break
@@ -144,15 +195,39 @@ export interface Candidate {
    *  thing. Ranking a named spelling against a raw-address one on cast count is not a readability
    *  comparison at all — the raw form's `(u8 *)` base is not counted, so it would win by
    *  construction, trading named struct fields for anonymous byte offsets. */
-  group: number;
-  /** the map-derived VALUE references this candidate's tree contains — what the scoring
-   *  layer's declaration synthesis renders. DERIVED, never carried: computed once from the
-   *  exact tree this candidate's source was emitted from, at the moment the candidate is
-   *  finalized (l3/symbol-refs.ts — no pipeline stage caches refs, so they cannot go stale).
-   *  Present on EVERY spelling variant that names mapped symbols — including '/raw-globals',
-   *  whose tree still names pool/reloc-derived globals (it only drops the map's shaped
-   *  SPELLINGS). Absent without a map — synthesis then has nothing to do. */
+  preference: number;
+  /** the DECLARABLE VALUE references this candidate's tree contains — what the scoring layer's
+   *  declaration synthesis renders. DERIVED, never carried: computed once from the exact tree
+   *  this candidate's source was emitted from, at the moment the candidate is finalized
+   *  (l3/symbol-refs.ts — no pipeline stage caches refs, so they cannot go stale). Present on
+   *  EVERY candidate that names such symbols — including '/raw-globals', whose tree still
+   *  names pool/reloc-derived globals (it only drops the map's shaped SPELLINGS).
+   *
+   *  PRESENT WITHOUT A MAP TOO: a name is read out of the asm's own literal pool or relocation,
+   *  so "a candidate only names symbols the map knows" is false. Where a map DOES know the name
+   *  its facts win; the rest are
+   *  synthesized name-only symbols (`bareGlobalSymbols`) and carry `synthesized: true` — a
+   *  consumer publishing a byte-exact verdict must show those declarations, because they were
+   *  fitted to the same asm the verdict is about (see SymbolRef.synthesized). */
   symbolRefs?: SymbolRef[];
+  /** `volatile` claims this spelling makes on one of the target's device registers — the
+   *  volatility tie-break's input (compareScored). DERIVED from the tree the source was emitted
+   *  from, like `symbolRefs`, because the qualifier and the address it applies to are often two
+   *  statements apart and the rendered text cannot pair them. */
+  deviceVolatile?: number;
+  /** PUBLISHABLE ONLY WHERE THE DIFFER PROVES IT — a byte-exact score, nothing else.
+   *
+   *  The third admission ground, and the narrowest. A respell variation must preserve semantics by
+   *  construction (the POLICY note at the respell site), because on a nonmatch row the best
+   *  spelling is what the user is shown. One spelling cannot meet that bar from inside the pass:
+   *  `l3/unreduce.ts` moves a memory read into a loop whose stores are all device registers, and
+   *  on this board a device store can make the DEVICE write ordinary memory (a DMA trigger), which
+   *  no gate over the C can rule out. What settles it instead is the object: a candidate that
+   *  assembles to the target's own bytes IS the program, whatever a gate could have proved. So the
+   *  spelling is offered, scored, and then either wins on proof or is WITHHELD — never shown as a
+   *  best-effort answer. Both ranking drivers ask `withheldReason`, so neither can publish what the
+   *  other would not. */
+  matchOnly?: true;
 }
 /** A candidate paired with its score `S` (the injected scorer's result shape — must carry `.score`). */
 export interface Scored<S> extends Candidate {
@@ -163,22 +238,158 @@ export interface Scored<S> extends Candidate {
  *  scoring harness that shows only the surviving sibling reports a clean win over a hidden
  *  failure. */
 export interface DroppedCandidate {
-  label: string;
+  variations: readonly string[];
   /** the scorer's first error line (a compiler diagnostic, usually) */
   error: string;
 }
 
+/** A candidate that BUILT and SCORED and was then withheld for want of proof (`Candidate.
+ *  matchOnly`). Kept apart from `dropped`, which means "the scorer refused it": a spelling that
+ *  compiled fine and simply did not earn publication is a different fact, and folding the two
+ *  would make the `[dropped]` line report compile failures that never happened. */
+export interface WithheldCandidate {
+  variations: readonly string[];
+  score: number;
+  /** the denominator that score was measured against — objdiff's row count for THIS candidate's
+   *  alignment, so it moves with the spelling. Present whenever the injected scorer supplies one
+   *  (the cli and webapp objdiff scorers both do); a scorer whose result carries no `rows` leaves
+   *  it absent rather than inventing a scale. A withheld score is read across runs exactly like a
+   *  published one, and a bare numerator there invites the same subtraction on a scale that moved. */
+  rows?: number;
+  /** one line: why publication needed a proof this score did not supply */
+  why: string;
+}
+
+/** EVERY candidate refused — `rankBy` has no ranked result to return, so it throws this.
+ *
+ *  The two lists ride on the error, and that is the point of having a class at all: on a row where
+ *  nothing scored, `dropped` IS the whole fan, and a bare `Error` discards it. A caller that
+ *  prints one candidate's failure (the `cause`) is showing the LAST spelling the scorer refused,
+ *  which is neither the first nor a representative one — the benchmark's own noncompile rows have
+ *  up to a thousand siblings behind that single line. The MESSAGE is load-bearing and must stay
+ *  byte-identical: `bench fidelity` matches it verbatim to recognise a reproduced noncompile
+ *  row. */
+export class NoScorableCandidateError extends Error {
+  readonly dropped: DroppedCandidate[];
+  readonly withheld: WithheldCandidate[];
+  constructor(message: string, dropped: DroppedCandidate[], withheld: WithheldCandidate[], options?: ErrorOptions) {
+    super(message, options);
+    this.name = 'NoScorableCandidateError';
+    this.dropped = dropped;
+    this.withheld = withheld;
+  }
+}
+
+/** EVERY spelling refused BY THE BACKEND, before anything was compiled — `enumerateCandidates`
+ *  has no fan to return, so it throws this.
+ *
+ *  It is a sibling of `NoScorableCandidateError` and a DIFFERENT fact, which is the whole reason
+ *  it is a class: nothing was scored there because nothing COMPILED, and nothing was scored here
+ *  because nothing was ever spelled. A surface that cannot tell the two apart prints one of them
+ *  under the other's name. The message is load-bearing too
+ *  (`packages/core/test/rank-backend-decline.test.ts` matches it). */
+export class NoSpellableCandidateError extends Error {
+  constructor(message: string, options?: ErrorOptions) {
+    super(message, options);
+    this.name = 'NoSpellableCandidateError';
+  }
+}
+
 export interface RankedResult<S> {
-  best: Scored<S>; // lowest score
+  winner: Scored<S>; // lowest score
   candidates: Scored<S>[]; // sorted best (lowest) first
   /** candidates whose scoreFn threw — empty when every spelling built */
   dropped: DroppedCandidate[];
+  /** candidates withheld for want of a byte-exact proof — empty unless a `matchOnly` variation fired */
+  withheld: WithheldCandidate[];
 }
 
-/** Emit the DISTINCT type/branch-sense candidate spellings for `name` — PURE, no scoring.
- *  The ONE difference from `decompile()` is the signedness pin, injected between pre-recovery and
- *  recoverTypes via the `beforeRecover` hook. Duplicate sources are collapsed so the scorer never
- *  recompiles an identical spelling. */
+/** THE publication rule for a `matchOnly` spelling, in one place because there are TWO ranking
+ *  drivers over one enumeration (this module's sync `rankBy` and the webapp's async await-loop),
+ *  and a filter written twice is how they come to publish different answers. Null ⇒ publish.
+ *
+ *  `score === 0` is objdiff's byte-exact match (cli objdiff.ts states the equivalence), which is
+ *  why a bare `.score` suffices and the generic needs no `match` field. */
+export function withheldReason<S extends { score: number }>(c: Candidate, score: S): string | null {
+  return c.matchOnly === true && score.score !== 0
+    ? 'this spelling rests on a device-behaviour fact no gate over the C can settle; only a byte-exact score proves it'
+    : null;
+}
+
+/** What a respell variation hands `respell`: its tree, or — when the variation cannot establish the
+ *  candidate's semantics from inside the pass — the tree paired with that fact. `undefined`/`null`
+ *  is a decline. */
+type RespellResult = SFn | { sfn: SFn; needsProof: boolean } | null | undefined;
+
+/** REQUIRE-ALL composition of respell variations, and the ONE place a proof obligation crosses
+ *  from one variation to the next.
+ *
+ *  `RespellResult` is a union, so a hand-written composition can spell the obligation away by
+ *  accident and stay type-correct: `return pointerFields(u.sfn);` in place of
+ *  `return { sfn: t, needsProof: u.needsProof };` compiles, passes tsc and passes every suite,
+ *  and publishes as asmlift's answer a spelling that was supposed to be withheld unless byte-exact.
+ *  Composing through here makes dropping it INEXPRESSIBLE — a caller lists the stages and never
+ *  touches the flag.
+ *
+ *  The obligation is MONOTONE, which is what lets it be an `or`: it says "no gate over this C can
+ *  settle the fact this spelling rests on", and a later respell variation cannot settle a fact about an
+ *  earlier one. `/ptr-field` re-types a field and never moves a read, so it carries `/unreduce`'s
+ *  obligation through unchanged rather than discharging it.
+ *
+ *  REQUIRE-ALL, never skip-on-decline: one declining stage declines the whole composition, so the
+ *  candidate's variations always name exactly the ones that fired. That is the property the pairing site turns
+ *  on, and the reason it rejects `applyStacked` — see the POLICY note there. */
+export function composeRespellVariations(sfn: SFn, stages: readonly ((s: SFn) => RespellResult)[]): RespellResult {
+  let cur = sfn;
+  let needsProof = false;
+  for (const stage of stages) {
+    const made = stage(cur);
+    if (!made) {
+      return null;
+    }
+    cur = 'sfn' in made ? made.sfn : made;
+    needsProof = needsProof || ('sfn' in made && made.needsProof);
+  }
+  return needsProof ? { sfn: cur, needsProof } : cur;
+}
+
+/** What one `respellTree` call produced: the sources it emitted, plus the DEFAULT source's emit refusal
+ *  where the backend declined the tree it was handed.
+ *
+ *  RETURNED rather than written to the enumeration's shared `lastEmitError`, because only ONE
+ *  caller may record one. `respellTree` runs over the row's own tree and over each pre-respell variation's
+ *  REWRITTEN tree, and a backend refusal of a rewrite is not a refusal of the row's spelling —
+ *  letting it reach `lastEmitError` would put the wrong cause on the row's "no spellable
+ *  candidate" throw. With the value returned, the caller over the row's own tree records and the
+ *  pre-respell caller does not, which is the rule made structural instead of saved and restored around the call.
+ *
+ *  A DISCRIMINATED FIELD, not a nullable error: a variation that throws a falsy value is still
+ *  recorded, where `?? ` would read it as "nothing was thrown". */
+interface TreeSources {
+  sources: TreeSource[];
+  emit?: { error: unknown };
+}
+
+/** One source emitted from a structured tree: the variations that produced it,
+ *  the rendered source, and the tree-derived facts `compareScored` ranks by. */
+interface TreeSource {
+  variations: readonly Variation[];
+  source: string;
+  symbolRefs?: SymbolRef[];
+  deviceVolatile?: number;
+  /** see `Candidate.matchOnly` — set by a variation that cannot establish its own semantics */
+  matchOnly?: true;
+}
+
+/** Emit the DISTINCT type/branch-sense candidates for `name` — PURE, no scoring.
+ *  It differs from `decompile()` in exactly two arguments to the shared spine — the signedness
+ *  pin, injected between pre-recovery and recoverTypes via the `beforeRecover` hook, and the
+ *  `pre.shortCircuit` connective owner (the raiseRecovered call below states both).
+ *  Duplicate sources are collapsed so the scorer never
+ *  recompiles an identical spelling, and the respell set runs once per distinct STRUCTURED TREE
+ *  rather than once per structure setting — a structure variation inert on this function reaches a
+ *  tree an earlier setting already produced, and every respell variation is a pure function of that
+ *  tree. */
 export function enumerateCandidates(
   name: string,
   asm: string,
@@ -186,15 +397,26 @@ export function enumerateCandidates(
   opts: EnumerateOptions = {},
 ): Candidate[] {
   const backend = opts.backend ?? cBackend;
+  /** Report a setting that THREW through `onEnumerationError`, as the variations it names (none for
+   *  the function's own tree). */
+  const reportThrow = (variations: readonly Variation[], e: unknown): void =>
+    opts.onEnumerationError?.(variations, firstLine(e));
+  /** The last refusal from a backend asked to spell a tree — what the empty-enumeration check
+   *  below reports, so "this backend can spell nothing here" names its reason. */
+  let lastEmitError: unknown = null;
   // Same merge as `decompile`: the project's DWARF signatures fill in what the caller did not
   // state, so both the annotate pass and the ranked candidates reason about one prototype table.
   const prototypes = prototypesFromSymbols(opts.symbols, opts.prototypes ?? {});
   const frontend = frontendFor(target);
   const baseOpts = {
     ...structureOptionsFor(target, prototypes[name]?.returnsVoid ?? false),
+    // See the same line in pipeline.ts: a backend that cannot print switch fall-through must not
+    // be handed a tree carrying one, because its refusal costs the whole candidate (and, when
+    // every candidate carries it, the whole row).
+    spellSwitchFallthrough: backend.spellsSwitchFallthrough,
     ...(opts.symbols ? { symbols: symbolsByName(opts.symbols) } : {}),
   };
-  // Branch-sense is a differ-ranked LEVER, the same class as param signedness: a divergent `if`
+  // Branch-sense is a differ-ranked VARIATION, the same class as param signedness: a divergent `if`
   // can be spelled with either sense (`if (c) A else B` vs `if (!c) B else A`), and which one the
   // source compiler emitted is genuinely ambiguous from asm. There is no safe global heuristic
   // (`ifor` wants positive, `simpleif` wants negated, `diamond` wants positive) — emit BOTH senses
@@ -202,240 +424,1750 @@ export function enumerateCandidates(
   // worse; it only wins where the flip matches.
   const defSense = baseOpts.preserveDivergentBranchSense ?? true;
   // `/defsite` — def-site-anchored constant merge copies (structure.ts anchorConstCopies) — is a
-  // structuring axis on the same footing as branch sense: where the asm materialized a merge
+  // structure variation on the same footing as branch sense: where the asm materialized a merge
   // constant is placement evidence, but whether the SOURCE spelled it there is genuinely
   // ambiguous, so both placements are emitted and the differ referees. Crossed with branch sense
   // (an anchored copy empties an arm, which is exactly what changes which sense wins); the dedup
-  // below collapses every variant the anchoring left unchanged.
-  const baseSense = [
-    { suffix: '', sense: defSense, anchor: false, bitfields: true },
-    { suffix: '/flip-branch', sense: !defSense, anchor: false, bitfields: true },
-    { suffix: '/defsite', sense: defSense, anchor: true, bitfields: true },
-    { suffix: '/flip-branch/defsite', sense: !defSense, anchor: true, bitfields: true },
+  // below collapses every candidate the anchoring left unchanged.
+  //
+  // `/defsite/loop-entry` widens it to a LOOP HEADER's entry const (`int s = 0;` above the guard
+  // rather than on the edge into the loop). Its own setting rather than a widening of `/defsite`
+  // because it is a SECOND placement decision: a function carrying both kinds of anchorable const
+  // has THREE spellings, and folding the two decisions into one boolean would delete the middle
+  // one — measured on klonoa's TransitionSelfRemoveFadeIn, where 448 of the 896 sources `/defsite`
+  // reaches became unreachable. Enumerated as a CHAIN (none ⊂ plain ⊂ plain + entry) rather than a
+  // 2×2 cross: the fourth setting costs another quarter of the whole fan — the anchor dimension
+  // multiplies everything below it — and no row has been shown to need it.
+  //
+  // The spelling booleans hand-carried outside `STRUCTURE_VARIATIONS`
+  // (`bitfields`, `ptrElems`, `declRank` and the anchor pair) start from one record, so the
+  // default setting lives in one place instead of six literals that can disagree. Each entry
+  // states only what it VARIES — which is the whole content of the chain above.
+  const STRUCTURE_DEFAULTS = { anchor: false, entry: false, bitfields: true, ptrElems: true, declRank: true };
+  const senseAnchor: (typeof STRUCTURE_DEFAULTS & { variations: readonly Variation[]; sense: boolean })[] = [
+    { ...STRUCTURE_DEFAULTS, variations: [], sense: defSense },
+    { ...STRUCTURE_DEFAULTS, variations: ['flip-branch'], sense: !defSense },
+    { ...STRUCTURE_DEFAULTS, variations: ['defsite'], sense: defSense, anchor: true },
+    { ...STRUCTURE_DEFAULTS, variations: ['flip-branch', 'defsite'], sense: !defSense, anchor: true },
+    { ...STRUCTURE_DEFAULTS, variations: ['defsite', 'loop-entry'], sense: defSense, anchor: true, entry: true },
+    {
+      ...STRUCTURE_DEFAULTS,
+      variations: ['flip-branch', 'defsite', 'loop-entry'],
+      sense: !defSense,
+      anchor: true,
+      entry: true,
+    },
   ];
+  // `/flip-join` — the JOINED-if sibling of `/flip-branch` (structure.ts
+  // negateJoinedBranchSense): a reconverging two-armed if reads the same fall-through-is-then
+  // layout evidence the divergent case does, so the DEFAULT sense is the divergent one's and
+  // this variation emits the other. Read off the TARGET's sense, not this candidate's `s.sense`, so
+  // `/flip-branch` still moves only divergent ifs and the two variations stay independent. The name
+  // therefore names a sense RELATIVE to the target's default: a candidate's variations quoted from a
+  // log identify a candidate only together with the tree that produced it, which is what the `[asmlift source
+  // <commit>]` stamp on the `[ranked]` line is for (docs/ranked-repro.md).
+  // Crossed with the pair above. The two senses are two different sources wherever a two-armed
+  // joined `if` exists at all — agbcc emits different bytes for the arms-swapped spelling — and
+  // all three things that invert the polarity are per-SITE where this variation is per-function, so no
+  // per-function predicate decides it: a short-circuit fold choosing the orientation, a
+  // conditional branch relayed past Thumb's ±256-byte reach, and a rotated loop's zero-trip guard,
+  // where the `if` is the compiler's own and no source sense exists to be faithful to. The FIRST
+  // of the three is now decided per site rather than enumerated — `/site-sense` (rank-variations.ts)
+  // reads the orientation the fold records — and this variation stays because the other two are not.
+  // The third
+  // is what keeps the residue on targets that have neither: rows still win on the variation under
+  // gcc2.7.2 / gcc2.7.2kmc / mwcc, with no `short-circuit` tag and no Thumb branch range to
+  // explain them, and most of those carry `loop`. A function with no two-armed joined if emits identical
+  // source and the dedup collapses it before any compile.
+  const senseOnly = [
+    ...senseAnchor.map((s) => ({ ...s, join: false })),
+    ...senseAnchor.map((s): typeof s & { join: boolean } => ({
+      ...s,
+      variations: [...s.variations, 'flip-join'],
+      join: true,
+    })),
+  ];
+  // THE PER-SITE SENSE MEASUREMENT, a structure variation never enumerated by default: every mask
+  // over the sense sites, crossed with the whole fan. It exists to price the fork the two booleans above cannot express
+  // — 2^n on a function with n sites, which is the number a decidable predicate would replace —
+  // and to say whether the target's configuration is REACHABLE at all. Not enumerated unless the
+  // caller asks; `structure()`'s own `branchSenseFlipSites` is the seam it drives.
+  const maskSites = (m: number): ReadonlySet<number> => new Set([...Array(32).keys()].filter((i) => (m >> i) & 1));
+  const senseMasks = Array.from({ length: 1 << (opts.perSiteSenseBits ?? 0) }, (_, m) => m);
+  const baseSense = senseMasks.flatMap((m) =>
+    senseOnly.map((s) => ({
+      ...s,
+      ...(m === 0 ? {} : { variations: [...s.variations, withSubject('sense', String(m))] }),
+      // Always present, `undefined` at mask 0: an optional key added on one arm of a ternary would
+      // make the two arms different object TYPES, and the list is what the whole fan spreads from.
+      flipSites: m === 0 ? undefined : maskSites(m),
+    })),
+  );
   // `/no-bitfield` — keep the honest shift spelling where the map would name a bitfield member.
   // The named read recompiles at the DECLARATION's access width; where that diverges from the
   // asm's load width, the shifts are the spelling that matches — so both are emitted and the
   // differ referees. Enumerated only when the map carries any bitfield member at all (checked
   // below), so the 2× cross is paid exactly by the functions it can help; the dedup collapses
-  // every variant where no fold fired.
-  const mapHasBitfields =
-    opts.symbols !== undefined &&
-    [...opts.symbols.values()].some((infos) =>
-      infos.some((i) => [...(i.layout ?? []), ...(i.pointee?.layout ?? [])].some((f) => f.bitWidth !== undefined)),
-    );
-  const bitfieldCands = mapHasBitfields
-    ? [...baseSense, ...baseSense.map((s) => ({ ...s, suffix: `${s.suffix}/no-bitfield`, bitfields: false }))]
-    : baseSense;
-  // Probe: recover ONCE with no signedness pin, to learn which entry params are pointers/aggregates
-  // so they are excluded from the signedness axis (see NO_PIN_KINDS). One extra lift+recover, no
-  // compile. (The probe deliberately stops after recoverTypes — it only reads the param KINDS, so
+  // every candidate where no fold fired.
+  const bitfieldSettings =
+    opts.symbols !== undefined && declaresBitfields(opts.symbols)
+      ? [
+          ...baseSense,
+          ...baseSense.map((s): typeof s => ({ ...s, variations: [...s.variations, 'no-bitfield'], bitfields: false })),
+        ]
+      : baseSense;
+  // `/connective`'s enumeration gate, read off the pass's OWN refusal rather than from a second
+  // copy of its matcher: the fold reports every site where the PAIRWISE comparison-tree refusal is
+  // the ONE thing stopping it — asked after `sameArgs` and the negatability check, so a report
+  // means a candidate that DIFFERS, not a refusal merely reached — and a function with none has no
+  // inhabitant for the variation.
+  //
+  // PER SYMBOL-MAP SETTING, on a lift of its OWN, for the reason the `/setup-args` gate below states
+  // for itself: no lift may be governed by a fact measured on a different one. The pin and
+  // `/setup-args` cannot move this answer — neither a parameter's type nor a call's argument list
+  // moves a `cond_br` — but a SYMBOL MAP can, by lifting a pool-loaded comparison constant as a
+  // `gaddr` the const-test test then does not read. Measured once and NOT re-derived since: over
+  // the real rows that lifted, 21 sites mapped and 21 raw with no per-row divergence. Read that as
+  // the REASON the gate is asked per symbol-map setting, not as a fact about today's corpus — it carries no
+  // commit stamp. The SYNTHETIC tier is inside that comparison rather than exempt from it: 9 of
+  // its 770 rows carry a map (`SynthSpec.symbols`) in the committed artifact, and that count moves
+  // every time a map row is added, so re-derive it rather than carrying this one forward. So this
+  // buys no candidate; what
+  // it buys is that a lift-time change which splits them enumerates both settings rather than
+  // silently dropping one, the failure nothing reports.
+  let sharedLiftTreeOwned = false;
+  // Shared lift: recover ONCE with no signedness pin, to learn which entry params are
+  // pointers/aggregates so they are excluded from the signedness variation (see NO_PIN_KINDS). One
+  // extra lift+recover, no compile. (The shared lift deliberately stops after recoverTypes — it only reads the param KINDS, so
   // the totality contract / return-sinking of the full spine are not run on it.)
-  const probe = frontend.lift(name, asm, target, prototypes, opts.asmData, opts.symbols);
-  verify(probe);
-  applyIdiomPatterns(probe, target, opts.patterns);
-  runPreRecovery(probe, target, () => verify(probe));
-  recoverTypes(probe);
-  const ptrIdx = new Set<number>(probe.blocks[0].params.flatMap((p, i) => (NO_PIN_KINDS.has(p.type.kind) ? [i] : [])));
+  const sharedLift = frontend.lift(name, asm, target, prototypes, opts.asmData, opts.symbols);
+  verify(sharedLift);
+  // The ARRAY SHAPES the input assembly evidences (raise/globalshape.ts), for the DECLARATION
+  // half. Read off the shared lift's LIFTED form — before the fold below and the tower rewrite it —
+  // because the base-materialization order the derivation's licence reads does not survive them.
+  // Derived from the shared lift like `accessFacts` beside it, and for the same reason: it is a
+  // lift-time fact. The candidate half reads its OWN lift (each symbol-map setting lifts
+  // differently), just as the structure variations do.
+  const sharedLiftShapes = inferGlobalArrays(sharedLift, target);
+  applyIdiomPatterns(sharedLift, target, opts.patterns);
+  runPreRecovery(sharedLift, target, () => verify(sharedLift), prototypes[name], {
+    shortCircuit: {
+      onTreeOwned: () => {
+        sharedLiftTreeOwned = true;
+      },
+    },
+  });
+  recoverTypes(sharedLift);
+  const ptrIdx = new Set<number>(
+    sharedLift.blocks[0].params.flatMap((p, i) => (NO_PIN_KINDS.has(p.type.kind) ? [i] : [])),
+  );
   // Access facts for name-only symbol declarations (see bareGlobalAccessFacts) — derived once
-  // from the probe: widths/offsets are lift-time facts, identical across every candidate.
-  const accessFacts = opts.symbols ? bareGlobalAccessFacts(probe) : new Map<string, never>();
-  // `/reread-globals` — the VALUE-HOME axis (structure/analysis.ts AnalyzeOptions). Whether the
-  // source read a global once into a variable or re-read it at each use is not derivable from asm:
-  // the compiler CSEs the second spelling back into one load, and the round-5 dogfood watched agbcc
-  // land on both sides inside a single function (its highest-cost defect, 25 of 27 points on one
-  // klonoa function and 35/50 both ways on another). So both spellings are emitted and the differ
-  // referees — the same footing as signedness and branch sense, and never a default: the cached
-  // spelling stays the primary, so this can only ever ADD a winner.
+  // from the shared lift: widths/offsets are lift-time facts, identical across every candidate.
+  // Ungated on `opts.symbols`: map-less candidates now carry name-only refs too (see
+  // `bareGlobalSymbols`), and these facts are their declarations' WIDTH AUTHORITY — without them
+  // every map-less decl would be the `extern u32` fallback and a bare `gCell = x` would compile
+  // to `str` where the target says `strh`. One IR walk; on a function with no `gaddr` at all
+  // (every synthetic corpus row) it returns the same empty map the gate used to hand back.
+  const accessFacts = bareGlobalAccessFacts(sharedLift);
   //
-  // Gated on the function having a load that resolves to a named global at all — the only thing the
-  // axis can change. The dedup below collapses the pair wherever it changed nothing.
-  const probeDefs = defOpMap(probe);
-  const readsANamedGlobal = probe.blocks.some((b) =>
-    b.ops.some(
-      (op) => op.opcode === 'load' && globalCellOf(probeDefs, op.operands[0], op.attrs.off as number) !== null,
-    ),
-  );
-  const senseCands = readsANamedGlobal
+  // The MAPPED setting reads it off the shared lift below, itself a lift in exactly that
+  // configuration — reuse, not inheritance. Only a setting lifting under DIFFERENT symbols pays a
+  // lift of its own, so the price is one per `/raw-globals` setting and zero on a map-less row,
+  // never per candidate.
+  //
+  // DECLARED AFTER THE SHARED LIFT'S OWN `runPreRecovery` ON PURPOSE, and that placement is the
+  // memo's precondition: the mapped case returns `sharedLiftTreeOwned`, which is only the answer once the
+  // shared lift's `onTreeOwned` hook has had its chance to fire. Called any earlier it would report a confident
+  // `false` for a function that owns a tree. As a `const` below that call, an early call is a TDZ
+  // ReferenceError instead — a wrong answer traded for a loud one.
+  const treeOwnedIn = (symbols: typeof opts.symbols): boolean => {
+    if (symbols === opts.symbols) {
+      return sharedLiftTreeOwned;
+    }
+    const p = frontend.lift(name, asm, target, prototypes, opts.asmData, symbols);
+    verify(p);
+    applyIdiomPatterns(p, target, opts.patterns);
+    let seen = false;
+    runPreRecovery(p, target, () => verify(p), prototypes[name], {
+      shortCircuit: {
+        onTreeOwned: () => {
+          seen = true;
+        },
+      },
+    });
+    return seen;
+  };
+  // `/no-ptr-elem` — keep the honest byte arithmetic where the map would spell a whole-element
+  // subscript through a pointer MEMBER (`gBg.pMap[i + 157]`). The two are the same address and
+  // DIFFERENT objects — measured against agbcc, they differ in which register the `add` targets at
+  // every constant tested — so which side matches is per-function knowledge the asm does not
+  // carry, and the differ referees it exactly as it referees `/no-bitfield`.
+  //
+  // THE CROSS IS EXPENSIVE AND THE GATE IS WHAT BOUNDS IT, so the gate is asked of THIS FUNCTION,
+  // not of the map: a pointer member is only ever spelled off a container the function names, and
+  // every named global reaches the IR as a `gaddr`. A map-wide `some` would charge the cross to
+  // every function lifted alongside such a symbol, which is co-occurrence, not reach. The map must
+  // still declare a pointee WIDTH of 1, 2 or 4 — nothing else is an element — and `isPtrField` is
+  // the shared two-fact test, so this gate and the rule it gates cannot disagree about what a
+  // pointer member is.
+  //
+  // (`/no-bitfield` above still asks the MAP rather than the function; narrowing it would be this
+  // same edit against a different measurement. Its cross is censused below beside this one.)
+  //
+  // Where it DOES reach, the cross is the honest price of an alternative the differ has to referee,
+  // and on the corpus's largest fan it is large: `kleod:ProcessInputAndUpdateEntities` enumerates
+  // 58,752 candidates of which 23,040 carry this variation, so removing it leaves 35,712 — a factor of 1.65,
+  // not a doubling. A ROUNDER NUMBER IS NOT A SAFER ONE: re-measure rather than reaching for a
+  // vaguer word. The instrument is `decompileRanked`'s own enumeration, and a direct
+  // `enumerateCandidates` call from a standalone script is NOT it (an ESM/CJS duplicate of this
+  // module answers 544 where the harness answers 952 on `SetupBG3WindowOverlay`).
+  //
+  // The two variations are also NESTED rather than independent — `ptrElemSettings` is built by doubling
+  // `bitfieldSettings`, so this variation's candidates include the `/no-bitfield` ones and adding the
+  // two families' counts double-counts the overlap: on that same row 12,672 of the 23,040 carry BOTH
+  // variations, which is half of `/no-bitfield`'s own 25,344. A per-family price read off either
+  // variation alone therefore double-counts more than half of this row's cross.
+  //
+  // EXACTLY ONE WINNER IN THE ARTIFACT CARRIES `/no-ptr-elem` — `synthetic:ptrelem:agbcc`,
+  // match at 0. READ THAT ONE, NOT A ZERO: the variation is two-sided where it fires. Compile the byte
+  // spelling and the element spelling of the SAME address with the klonoa checkout's own agbcc,
+  // lift each back with that project's own map, and the `/no-ptr-elem` candidate is the ONLY one that matches the
+  // byte target while the default is the only one that matches the element target — on a constant
+  // element offset, at one element in, at a pointee width of 1, and on a STORE.
+  // `cli/test/matching/ptr-elem-variation.test.ts` is that measurement, and deleting the `ptrElemSettings`
+  // cross turns 8 of its 13 assertions red — the four BYTE-target ones (each scoring 1
+  // rather than 0) and the four that check the variation is enumerated at all — while its four
+  // ELEMENT-target ones stay green, which is the two-sidedness itself. A low count over the REAL
+  // tier counts something else: klonoa's map declares a sized pointer member at ONE address, and
+  // every decompiled caller of it happens to be written in the element form.
+  //
+  // WHERE IT GENUINELY DOES NOT REACH, measured on the same probes: at element offset ZERO the two
+  // spellings emit the IDENTICAL source (`((u16 *)gSym.pMap)[a0]`, because with no constant left there
+  // is nothing for the byte form to spell differently), the tree dedup collapses the pair — 10
+  // candidates, not 12 — and neither matches a byte-form target. That is an open gap in the
+  // spelling, not a refusal of this variation.
+  //
+  // STATE THE DENOMINATOR, AND DERIVE IT FROM REACH RATHER THAN FROM CO-OCCURRENCE — the same
+  // distinction the paragraph above draws about the gate, applied to the gate's own price.
+  // "Offered only where a symbol map exists" is true and useless: all 252 real rows carry a map,
+  // so that framing hands back 151 rows with a winner, which is the map-wide `some` this gate was
+  // written to avoid. The gate is per-FUNCTION, so census the FUNCTIONS. Enumerating every real
+  // case (candidates only, `ASMLIFT_CANDCACHE=0`, the harness's own inputs) and counting rows with
+  // any surviving `/no-ptr-elem` candidate: TWO — `kleod:ProcessInputAndUpdateEntities` (23040 of
+  // its 58752) and `kleod:SetupBG3WindowOverlay` (128 of 952), and only the first has a
+  // winner at all, the second being `noncompile`. THE TWO-ROW REACH IS STABLE AND THE
+  // COUNTS ARE NOT — they move with every fan-widening variation, so re-run the census rather than
+  // quoting these. So the REAL tier's "0 winners carry it" is 0 of ONE here, not 0 of 151 and not
+  // 0 of the artifact's row count. That census enumerates 155 of the 252 real rows — the
+  // 151 with a winner plus its 4 `noncompile` rows — and the 97 it cannot enumerate are
+  // exactly the rows the artifact declines. What makes "no row is LOST" a proof rather than a
+  // sample is the soundness rule instead: this variation only ADDS candidates, so a row whose winner
+  // does not carry it cannot move when it is removed. The same census prices `/no-bitfield`: it
+  // survives dedup on FIVE real rows — `ProcessInputAndUpdateEntities` 25344, `CountCollectedGems`
+  // 192, `UpdateWorldMapNodeAnim` 168, `UpdateHUDCounterDisplay` 96, `CopyBGScrollTiles` 4 — every
+  // one of them a row with a winner, and none of the five wins under it. So its map-wide
+  // enumeration gate buys a candidate cross on 5 functions and the dedup collapses it everywhere
+  // else.
+  //
+  // WHERE THE WINNERS ARE, since the REAL tier has none for either variation: the SYNTHETIC tier
+  // carries rows that hand asmlift a map (`SynthSpec.symbols`), and both variations win on one —
+  // `/no-bitfield` on `bfwordread` and `bfwordwrite`, `/no-ptr-elem` on `ptrelem`, each a match at
+  // 0 that becomes a NONMATCH when its own variation is ablated. A CENSUS OF WINNERS' VARIATIONS IS
+  // SCOPED TO ITS TIER AND ITS COMMIT: say which tier a count is over, and re-derive it rather than carrying it
+  // forward.
+  // The name-keyed map `baseOpts` already built, not a second `symbolsByName` walk over the same
+  // input: the function is deterministic and unmemoized, nothing in packages/core mutates a
+  // SymbolMap or a map it returns, and `baseOpts` is never reassigned — so this is the same map,
+  // 25-47 ms cheaper on the large vendored ones. The same idiom `mapSymbols` below uses.
+  const byName = baseOpts.symbols;
+  const fnHasSizedPtrFields =
+    byName !== undefined &&
+    [...bareGlobalSymbols(sharedLift).keys()].some((n) => {
+      const i = byName.get(n);
+      return (
+        i !== undefined &&
+        [...(i.layout ?? []), ...(i.pointee?.layout ?? [])].some(
+          (f) => isPtrField(f) && (f.pointeeSize === 1 || f.pointeeSize === 2 || f.pointeeSize === 4),
+        )
+      );
+    });
+  const ptrElemSettings = fnHasSizedPtrFields
+    ? [
+        ...bitfieldSettings,
+        ...bitfieldSettings.map((s): typeof s => ({
+          ...s,
+          variations: [...s.variations, 'no-ptr-elem'],
+          ptrElems: false,
+        })),
+      ]
+    : bitfieldSettings;
+  // `/flat-rank` — spell a multidimensional global's access as the FLAT byte arithmetic
+  // (`*(u16 *)((r << 11) + (i << 1) + (u32)&g)`) where the default recovers the map's declared
+  // subscripts (`g[r][i]`). The recovery's evidence is a term at the declared ROW stride, and that
+  // is evidence the residual carries a row — NOT evidence about which of the two spellings that
+  // both produce it was written. Compiled (structure.ts `spellDeclaredSubscripts` carries the
+  // table): the two differ only in where the pool load sits under agbcc, kmc and mwcc, and are
+  // BYTE-IDENTICAL under IDO, which also distributes the flat sum into the same separate scales.
+  // So the asm underdetermines it on every compiler measured, and the differ referees — the same
+  // posture as `/no-ptr-elem` and `/no-bitfield`.
+  //
+  // THE GATE IS ASKED OF THIS FUNCTION, not of the map, for `/no-ptr-elem`'s reason: a declared
+  // subscript is only ever recovered off a global the function NAMES, and every named global
+  // reaches the IR as a `gaddr`. `arrayInnerExtents` is the recovery's own rank test, called here
+  // rather than re-spelled, so the gate cannot be narrower than the rule it gates. It is still a
+  // superset — it does not know the access WIDTH, and it cannot know whether any residual carries
+  // a row term — so where the variation changes nothing the tree dedup below collapses the pair and the
+  // fan does not grow. OVER THE ARTIFACT'S 957 ROWS: 10 name such a symbol at all — 9 of them in
+  // their winning `symbolsUsed`, the tenth (`kleod:SetupBG3WindowOverlay`) in a source its row
+  // cannot compile, which is why the count is taken off the emitted sources and not off
+  // `symbolsUsed`, where a row with no winner is invisible. RE-DERIVE THIS PAIR RATHER THAN
+  // RE-ANCHORING IT: adding one map-bearing row moves it, and one of the nine is exactly that —
+  // `synthetic:sbscope:agbcc`, whose map declares `dims: [4, 1024]`.
+  //
+  // THE GATE READS THE MAP **OR** THE DERIVED SHAPES, and the map half alone was a live bug: since
+  // raise/globalshape.ts, `structure()` builds the symbol render context from the UNION of the
+  // project map and the shapes the asm evidences, so a MAP-LESS function whose own strides nest
+  // (`synthetic:tblrank2:agbcc`) now spells `gPtrTbl[a0][a1]` by default while its flat sibling
+  // `*(s32 *)((a1 << 2) + (a0 << 3) + (u32)&gPtrTbl)` — a genuinely different tree — was
+  // enumerated nowhere. A variation exists BECAUSE the asm underdetermines the question; supplying the
+  // rank from a new place does not make it determined, and nothing reports a candidate that was
+  // never enumerated. Map first, exactly as everywhere else: a name the map knows is answered by
+  // the map.
+  const derivedOrMapped = (n: string): SymbolInfo | undefined => byName?.get(n) ?? sharedLiftShapes.get(n);
+  const fnNamesMultidimArray = [...bareGlobalSymbols(sharedLift).keys()].some((n) => {
+    const i = derivedOrMapped(n);
+    return i !== undefined && i.shape === 'array' && (arrayInnerExtents(i)?.length ?? 0) > 0;
+  });
+  const declRankSettings = fnNamesMultidimArray
     ? [
-        ...bitfieldCands.map((s) => ({ ...s, reread: false })),
-        ...bitfieldCands.map((s) => ({ ...s, suffix: `${s.suffix}/reread-globals`, reread: true })),
+        ...ptrElemSettings,
+        ...ptrElemSettings.map((s): typeof s => ({
+          ...s,
+          variations: [...s.variations, 'flat-rank'],
+          declRank: false,
+        })),
       ]
-    : bitfieldCands.map((s) => ({ ...s, reread: false }));
+    : ptrElemSettings;
+  // The structure-variation chain, derived from STRUCTURE_VARIATIONS: each admitted variation doubles
+  // the list, the settings without it first — order is load-bearing for the dropped-default skip
+  // below (every default sibling enumerates before the alternative that applies the variation, so
+  // an alternative's stripped-key lookup always finds a sibling that has already run or been
+  // condemned). Each variation's rationale lives on its table
+  // entry; both settings are always emitted and the differ referees, never a fixed default — the
+  // dedup below collapses a pair wherever the variation changed nothing.
+  const sharedLiftDefs = defOpMap(sharedLift);
+  type StructureSetting = (typeof ptrElemSettings)[number] & Record<StructureVariation['flag'], boolean>;
+  /** Every structure variation OFF — seeded from the table so an added variation is one table entry and not a second
+   *  hand-edited literal, in table order like everything else derived from it.
+   *
+   *  WHAT THE CAST CANNOT CATCH: a `StructureVariation['flag']` union member with NO table entry.
+   *  `Object.fromEntries` types its result by the key type it was handed, not by the union, so the
+   *  assertion is taken on trust where the hand-written literal was checked. Such a member is
+   *  inert either way — every reader of these flags iterates `STRUCTURE_VARIATIONS`, so a flag with no
+   *  entry is never read — but it stops being a type error and becomes an absent field. */
+  const allStructureVariationsOff = Object.fromEntries(
+    STRUCTURE_VARIATIONS.map((variation) => [variation.flag, false]),
+  ) as Record<StructureVariation['flag'], boolean>;
+  let structureSettings: StructureSetting[] = declRankSettings.map((s) => ({ ...s, ...allStructureVariationsOff }));
+  for (const variation of STRUCTURE_VARIATIONS) {
+    if (variation.sharedGate !== undefined && !variation.sharedGate(sharedLift, sharedLiftDefs)) {
+      opts.onVariationGated?.(variation.name);
+      continue;
+    }
+    structureSettings = [
+      ...structureSettings,
+      ...structureSettings.map((s) => {
+        const on: StructureSetting = { ...s, variations: [...s.variations, variation.name] };
+        on[variation.flag] = true;
+        return on;
+      }),
+    ];
+  }
+  /** Is this a setting where no structure variation is on, other than `/flip-branch`? The default-setting abort guard's
+   *  other half: at the default LIFT setting a failure here aborts the row, because it says the lift
+   *  is broken rather than that one variation cannot spell this tree.
+   *
+   *  `s.variations.length === 0` IS NOT THE SAME TEST, which is why this is a named predicate rather than
+   *  the length check it looks like. `/flip-branch` names a branch sense RELATIVE to the target's
+   *  default, so both of its senses pass this test: the flipped one carries a variation, and `sense` is
+   *  not among the flags read here. `/flip-join` does not pass, because `join` is one of the five
+   *  hand-carried booleans below. The table's own flags decide, plus those five. */
+  const isDefaultSetting = (s: StructureSetting): boolean =>
+    !s.anchor &&
+    !s.join &&
+    s.bitfields &&
+    s.ptrElems &&
+    s.declRank &&
+    STRUCTURE_VARIATIONS.every((variation) => !s[variation.flag]);
 
-  const seen = new Set<string>();
+  const seen = new Map<string, Candidate>();
+  const seenTrees = new Set<string>();
+  /** the pre-respell variations' own tree dedup — see their loop for why it is not `seenTrees` */
+  const seenPreRespell = new Set<string>();
   const out: Candidate[] = [];
-  // The SYMBOL-MAP spelling is itself a ranked LEVER on the same footing as signedness/branch
+  // The map-derived VALUE references one emitted tree contains, applied at every point a candidate
+  // is finalized and derived from the tree that candidate emitted. No pipeline stage carries refs
+  // (SFn has no such field), so a future l3 pass that rewrites the tree can never leave a stale ref
+  // behind: whatever tree reaches emit is the tree the refs describe, by construction. Collected
+  // against the FULL name-keyed map for EVERY candidate — the '/raw-globals' sibling drops
+  // the map's shaped SPELLINGS, but its tree still NAMES pool/reloc-derived globals (ARM
+  // `.word gSym`, MIPS `%lo(gSym)`), and those references need declarations in the self-declared
+  // scoring world exactly like the named candidate's (without them every raw sibling fails to compile
+  // there, and the eval-winning raw candidate becomes unreproducible outside project headers).
+  // The volatility tie-break's input, derived at the same moment as the refs and for the same
+  // reason: whatever tree reaches emit is the tree it describes. Absent on a target that declares
+  // no device window, which is how every non-GBA target opts out.
+  const volOf = (tree: SFn): { deviceVolatile?: number } => {
+    const n = deviceVolatileClaims(tree, target.capabilities.deviceRegisters);
+    return n > 0 ? { deviceVolatile: n } : {};
+  };
+  // Every refusal is reported at most once per (name, reason): `refsOf` runs per CANDIDATE over
+  // the same dictionary derived from the shared lift, so without this the caller would hear the
+  // same refusal once per candidate in the fan (hundreds of times on a wide row).
+  const refusalsSeen = new Set<string>();
+  const refuse = (name: string, reason: RefusedDeclarationReason): void => {
+    if (refusalsSeen.has(`${name}\u0000${reason}`)) {
+      return;
+    }
+    refusalsSeen.add(`${name}\u0000${reason}`);
+    opts.onRefusedDeclaration?.(name, reason);
+  };
+  // The names the tree spells are read out of the asm's own literal pool / relocations and
+  // synthesized as name-only symbols (`bareGlobalSymbols`); where a symbol MAP knows a name, the
+  // map's facts WIN. A UNION rather than an either/or: the per-CALL fallback it replaced
+  // (`opts.symbols ?? bareGlobalSymbols(...)`) let ONE map entry switch the synthesis off for
+  // every OTHER name in the function, so supplying more information made the tool strictly
+  // worse. A union cannot — each name is declared by whichever half knows more about it.
+  // SCOPE: `declSymbols` is used ONLY here. It must never reach `opts.symbols`/`baseOpts.symbols`
+  // or `frontend.lift` — feeding it to the lift would turn on pool promotion, interior
+  // attribution and the `/raw-globals` variation, which is a different (and source-moving) change.
+  // THREE halves now, in increasing authority: the name-only pool/reloc symbols, the array shapes
+  // the asm evidences for them (raise/globalshape.ts — an `extern u16 gTbl[];` where the bare
+  // spelling needs one, and the declaration a candidate spelling `gTbl[i]` cannot compile
+  // without), and the project map, which knows more than either.
+  const mapSymbols = baseOpts.symbols;
+  const declSymbols = new Map<string, SymbolInfo>([
+    ...bareGlobalSymbols(sharedLift),
+    ...sharedLiftShapes,
+    ...(mapSymbols ?? []),
+  ]);
+  // The four per-enumeration constants named at the seam rather than captured across 60 lines of
+  // closure (rank-declare.ts states why they belong on one object).
+  const refsOf = makeRefCollector({ declSymbols, accessFacts, mapSymbols, refuse });
+  // THE RESPELL SET, as a function whose PARAMETER LIST is the invariant the tree skip below
+  // rests on: every source here is a pure function of the structured tree and this call's own
+  // constants, so a tree an earlier structure setting already produced can only re-emit sources
+  // `seen` already holds. Inline in that loop the invariant would be a comment asking future respell
+  // variations not to read `fn` or the structure flags; as a signature, a variation that needs one
+  // has to widen it in front of a reviewer. The same argument l3/ast.ts's `walkExprs` header makes
+  // for its own shape, and it counts for more here: a variation reading `fn` would not misprint a
+  // candidate, it would DELETE one,
+  // and nothing in the harness reports a candidate that was never enumerated.
+  // `preRespellVariations` names the tree this call re-spells, and it is a diagnostic argument only: it
+  // reaches `onEnumerationError` and nothing else, so the invariant the parameter list states above —
+  // every source is a pure function of the tree and this call's own constants — is untouched by
+  // it. It exists because the pre-respell variations call this on a REWRITTEN tree, where a refusal
+  // of the default source is a refusal of the rewrite, not of the row's own tree.
+  //
+  // IT PREFIXES EVERY `onEnumerationError` IN THIS FUNCTION, not just the default emit's, and that is
+  // the whole point rather than a detail: every one of them is reachable from both calls, and the
+  // variations each one already carries are, on a pre-respell tree, variations applied to the
+  // rewrite. Reported without this prefix, a refusal of `/unmerge/volatile` reads as a refusal
+  // of `/volatile` — a candidate that did not fail and is still in the fan. The order
+  // is the candidates' own (`[pf.name, ...sp.variations]`), so a reported name and an enumerated
+  // candidate's variations name the same candidate the same way.
+  const respellTree = (sfn: SFn, preRespellVariations: readonly Variation[] = []): TreeSources => {
+    // The walk→index respell variation (l3/reindex.ts) is a THIRD variation on the same footing as
+    // signedness and branch sense: whether the source spelled `*p; p++` or `arr[i]` is
+    // genuinely ambiguous from asm (compilers strength-reduce the latter into the former), so
+    // when a loop re-spells, BOTH representations are emitted and the differ referees. The
+    // respelled tree passes the same boundary contracts as the default; one that fails them is
+    // dropped here — never scored, never able to win.
+    const sources: TreeSource[] = [];
+    // The DEFAULT source takes the same posture as every respell variation below: a backend that
+    // declines by throwing costs this tree — its default source and the respelled sources built
+    // from it — never the row. The opposite posture from the STRUCTURE refusal below, which aborts
+    // the row at the default setting, and for the reason that separates them: that one says the lift is
+    // broken, this one that the target language has no spelling for a tree the lift got right
+    // (structuring is language-neutral, and the signedness pins it inserts are `cast` nodes the
+    // Pascal backend loud-declines). Refusing EVERY tree is still loud — the empty-enumeration
+    // check at the end raises the last refusal.
+    try {
+      sources.push({ variations: [], source: backend.emit(sfn), ...refsOf(sfn), ...volOf(sfn) });
+    } catch (e) {
+      reportThrow(preRespellVariations, e);
+      return { sources, emit: { error: e } };
+    }
+    // Respell variations — each on the same footing as signedness/branch sense, each guarded:
+    // it must pass the same boundary contracts as the default AND emit (a backend that declines
+    // by throwing — Pascal loud-fails unspellable shapes — drops the candidate, never aborts the
+    // enumeration). A dropped respell variation loses nothing: the default remains.
+    //
+    // POLICY: respell variations derive from the tree they are handed, un-respelled (its default
+    // source), only — they do not compose unless
+    // one of these compositions sanctions it, each with its own admission bar: `/volatile`
+    // narrowed onto a variation's own locals, the STACKED variations and the PAIRINGS, which all
+    // derive from or compose onto a source, plus the PRE-RESPELL variations (PRE_RESPELL_VARIATIONS,
+    // applied to the TREE before this respell set runs over it; its admission bar is stated at the
+    // table) —
+    // plus MULTI-RESULT variations: one variation whose single application has several legitimate
+    // results (which locals a coalesce merges, which pointers /volatile qualifies) emits
+    // each as its own candidate via `respellEach`, capped at the variation, with the default
+    // retained; the results may also ride an already-sanctioned composition (the /livebase/volatile
+    // subsets), since they add no new variation to it.
+    // `/volatile` composes only onto a variation whose output CENTRES ON a
+    // numeric-address pointer local — the joint spelling is reachable from neither variation
+    // alone, each composition narrows /volatile to that variation's own locals (volatilePtrLocals'
+    // `only`), and each needed a row to demand it. The STACKED variations (STACKED_VARIATIONS) are
+    // derived onto EVERY source: statement order/shape is orthogonal to what any other respell
+    // variation changes — the same kind of independent dimension as signedness —
+    // so they are crossed with every source rather than paired; a third blanket composition needs
+    // the same argument, not just a row. And a specific PAIRING is admitted on one of two
+    // grounds, never on "it might help". FIRST, a row demands the joint spelling AND that
+    // spelling is reachable from neither variation alone: /livebase × /indexed, × /sinkinit,
+    // × /nearbase and × /coalesce, /scopebase × /coalesce, plus /vol-store × /unreduce and that
+    // pair × /ptr-field —
+    // each with its demanding row at the respell site. (A TRIPLE is admitted on the same ground
+    // and no weaker one: it is one joint spelling with one demanding row, and the pairs BELOW it
+    // are not thereby admitted — on synthetic:dmaptrsrc the two intermediate pairs measure 27 and
+    // 32 against the triple's 0, and neither is in the fan.) SECOND, a
+    // variation COMMITS a policy the differ would otherwise never see — /nearbase × /sinkinit,
+    // where `l3/nearbase.ts` picks one of two init orderings inside the pass, so without the
+    // pairing that decision decides a match with no candidate beside it to lose to. The second
+    // ground is narrower than it looks: it needs a committed decision INSIDE a variation with an
+    // existing variation that expresses the alternative, not a variation one could imagine wanting
+    // twice. Anything else stays un-composed. A pairing is admitted for the hoist mechanism, not per
+    // entry, so it runs over every LIVEBASE_HOISTS entry that sets `pairings`: adding an entry
+    // changes which bases get bound, not what pairing a hoist with /coalesce means.
+    // And a respell variation must PRESERVE SEMANTICS by construction: the differ referees
+    // byte-exactness (a wrong candidate can never fake a score-0 match), but on a NONMATCH row the
+    // best-scoring source is shown to the user — a semantically-wrong respelled source there is
+    // plausible-but-wrong output, the defect class this project exists to avoid. THE ONE
+    // EXCEPTION IS THE SAME RULE READ FORWARD: where a variation cannot establish its semantics from
+    // inside the pass — `l3/unreduce.ts` moving a read into a loop whose device stores may make
+    // the DEVICE write memory — the spelling is marked `Candidate.matchOnly` and published ONLY
+    // at a byte-exact score, which is the clause in brackets above used as a licence instead of a
+    // consolation. It is never shown as a best-effort answer, so the nonmatch case the sentence
+    // is about cannot arise. Hence each
+    // variation's decline-over-approximate gates, adversarially audited.
+    // Takes a THUNK, so the variation's own computation is inside the try too. A variation that
+    // threw from the pass itself — rather than from the contracts or the backend — would escape and
+    // abort the whole enumeration for this row, default included: the one way a variation can cost
+    // a match. Making that structural rather than per-call-site means no variation can opt out.
+    //
+    // WHICH boundary contracts run here, and why it is three of the four. A respell variation gets
+    // the tree `structureChecked` already validated, so what these re-check is what a VARIATION can
+    // break, not what structuring can. `assertResolved` and `assertDerefsTyped` catch an
+    // unspellable tree — a candidate the compiler would reject, which the harness would report
+    // as a dropped candidate with no cause. `assertLocalsWritten` catches the one wrongness the
+    // differ REWARDS: a pass that moves or suppresses an assignment and never emits it leaves
+    // the reads standing over whatever the allocator left behind, and that candidate compiles,
+    // scores, and can win (the shape #106 shipped). Respell variations that place a def —
+    // l3/sinkinit.ts, l3/basecse.ts's first-use policy, l3/nearbase.ts, l3/scopebase.ts,
+    // l3/argbase.ts — are exactly the ones that can produce it, so the check belongs on every
+    // respelled tree rather than on theirs. It cost nothing when measured: 0 violations over the 34357 trees the
+    // artifact's agbcc rows enumerated in both symbol-map configurations. A count with no commit
+    // stamp — re-run it rather than reading it as today's.
+    // `assertEffectsPreserved` is the fourth and is NOT here: it needs the L1 `fn`, and
+    // `respellTree`'s parameter list is the invariant the tree-dedup skip rests on (see its header).
+    // Widening it for a contract is a defensible change and an argued one — not a silent import.
+    // A respell variation returns its tree, or `{ sfn, needsProof }` when it cannot establish its own
+    // semantics from inside the pass (Candidate.matchOnly carries the argument).
+    const respell = (variations: readonly Variation[], make: () => RespellResult, alreadyShaped = false): void => {
+      if (!offeredOn(target, variations)) {
+        return;
+      }
+      try {
+        const made = make();
+        if (!made) {
+          return; // the variation declined to fire — no candidate, not a duplicate of the default
+        }
+        const alt = 'sfn' in made ? made.sfn : made;
+        const proof: { matchOnly?: true } = 'sfn' in made && made.needsProof ? { matchOnly: true } : {};
+        assertResolved(alt);
+        assertDerefsTyped(alt);
+        assertLocalsWritten(alt);
+        assertNoOrphanedLocals(sfn, alt);
+        sources.push({ variations, source: backend.emit(alt), ...refsOf(alt), ...volOf(alt), ...proof });
+        // STACKED variations, derived onto EVERY source (the POLICY note above carries the
+        // admission argument). Each is a statement-order/shape fact orthogonal to
+        // representation; subsets compose in the fixed order below. A stacked variation that
+        // never fires declines and costs nothing.
+        if (!alreadyShaped) {
+          // A shape REORDERS statements, and it is derived after a variation has placed its defs —
+          // so the placement is re-checked on the shaped tree (contracts.ts). Differential: judged
+          // only where the unshaped tree already satisfied the walk, so a variation whose placement
+          // it never described is not dropped on the strength of a model that does not apply.
+          //
+          // `minted` is a NAME DIFF, so for a RENAMING variation (`/regspell`, `/merge-names`) it
+          // also holds locals the variation never PLACED. Harmless and deliberate: the differential's
+          // early return absorbs a name the unshaped tree already fails on, and a renamed local
+          // whose def a shape moved below a read is the same wrongness as a placed one.
+          //
+          // KNOWN GAP on the other side of the same diff: a variation that RELOCATES a local it did not
+          // mint contributes no name, so the shape differential does not judge it. The `scope`
+          // placement is the one that does this — it sinks the run `structureChecked` already
+          // committed (l3/basecse.ts judges those itself, over the placer's own report of the
+          // motion) — and closing it here needs that report threaded out to this level. Not widened
+          // to every relocated local instead: judging those would drop candidates across the whole
+          // fan with nothing measured to license it. What keeps it uninhabited is `initFirstGuards`,
+          // which moves only const or pure-read assigns and so cannot lift a read of a base local
+          // above its init.
+          const minted = createdLocals(sfn, alt);
+          for (const subset of STACKED_SUBSETS) {
+            // ONE TRY PER SHAPE — a shape is its own candidate and fails as its own candidate.
+            // Sharing the respell variation's outer try would let a throw deriving one subset
+            // discard every later one, under that variation's name, which names no shape.
+            const shapeVariations = subset.map((x) => x.name);
+            try {
+              const shaped = applyStacked(subset, alt);
+              if (shaped !== null) {
+                assertResolved(shaped.out);
+                assertDerefsTyped(shaped.out);
+                assertLocalsWritten(shaped.out);
+                assertNoOrphanedLocals(alt, shaped.out);
+                assertPlacementSurvives(alt, shaped.out, minted);
+                sources.push({
+                  variations: [...variations, ...shaped.variations],
+                  source: backend.emit(shaped.out),
+                  ...refsOf(shaped.out),
+                  ...volOf(shaped.out),
+                  // a shape derived from a proof-gated spelling inherits the requirement
+                  ...proof,
+                });
+              }
+            } catch (e) {
+              reportThrow([...preRespellVariations, ...variations, ...shapeVariations], e);
+            }
+          }
+        }
+      } catch (e) {
+        // A throwing variation, a contract failure, or an unspellable respelled tree: keep the
+        // default. REPORTED, not swallowed. `dropped` (below) records only candidates the SCORER
+        // refused, so without this a variation that fails here vanishes with no trace — indistinguishable
+        // from one that correctly declined, which is exactly the hidden failure
+        // DroppedCandidate exists to surface.
+        reportThrow([...preRespellVariations, ...variations], e);
+      }
+    };
+    // `/argbase` — name a call's argument bases before the call (l3/argbase.ts). A variation on the
+    // same footing as the others: the default inline spelling stays in the list, so the differ
+    // referees and this can never cost a match.
+    for (const subset of STACKED_SUBSETS) {
+      // the truthful variations need the pass to RUN first, so this bypasses respell's
+      // variations-then-thunk shape: same try posture, variations from the fired members
+      try {
+        const shaped = applyStacked(subset, sfn);
+        if (shaped !== null) {
+          // the ONE call whose variations already name shapes — say so, rather than making `respell`
+          // read them back out of the variations it was handed
+          respell(shaped.variations, () => shaped.out, true);
+        }
+      } catch (e) {
+        // the report names the full subset — the fired set is unknown mid-throw
+        reportThrow([...preRespellVariations, ...subset.map((x) => x.name)], e);
+      }
+    }
+    respell(['argbase'], () => materializeArgBases(sfn));
+    // `/zerosub` — spell a negate of a SHARED subtraction as `0 - x` (l3/zerosub.ts). gcc 2.9
+    // folds `-(a - b)` into `(b - a)` before CSE but leaves `0 - (a - b)` as a negate of the
+    // subtraction itself, so over a value the function also uses elsewhere the two spellings are
+    // a computation and a register apart — and both are reachable from a real source. The differ
+    // referees; its gate keeps it off every shape where the fold rule does not apply, which is
+    // every operand but a shared subtraction.
+    respell(['zerosub'], () => zeroSubNegates(sfn));
+    // `/volatile` — declare a pointer local holding a NUMERIC address as pointing to volatile
+    // data (l3/volatileptr.ts). A raw constant has no declaration anywhere, so the original
+    // qualifier is not derivable — and it is codegen-visible (a volatile MEM is barred from
+    // motion, which lands the allocator on different homes). Both spellings are emitted and
+    // the differ referees.
+    respell(['volatile'], () => volatilePtrLocals(sfn));
+    // `/vol-slot` — declare a STACK-HOMED scalar local volatile (l3/volatileval.ts). The
+    // qualifier takes away the allocator's freedom to keep the value in a callee-saved
+    // register across a call, and which of the three ways a slot can arise (a volatile local,
+    // an address-taken one, plain register pressure) the source used is not derivable from
+    // the asm. A DECLARATION respell variation, not a structure variation (docs/level-tower.md's
+    // third fork): it changes nothing structure() decides, so it rides each structured tree as `structure()`
+    // produced it, like its `/volatile` sibling, rather than doubling every enumeration, and its frame-flag gate
+    // costs nothing on a function with no slot.
+    respell(['vol-slot'], () => volatileValueLocals(sfn));
+    /** `/vol-store`'s pass with the target's device-register window handed over — the window that
+     *  keeps it off ordinary memory. Written once because five call sites take it. */
+    const volStore = (from: SFn): SFn | null => volatileDeviceStores(from, target.capabilities.deviceRegisters);
+    // `/vol-store` — pin a store at a fixed DEVICE-REGISTER address `volatile` (l3/volstore.ts).
+    // Where `/volatile` above qualifies a pointer LOCAL holding the address, this qualifies the
+    // access itself, which is the spelling a `REG_*` macro produces and the one structure.ts
+    // leaves when the address re-materializes at each use. Codegen-visible: agbcc's `load_mems`
+    // hoists an unpinned fixed-address store clean out of a loop (gcc/loop.c:8934), so the pinned
+    // spelling is the only one that reproduces a device-driving loop body at all. Its window gate
+    // is the target's own `deviceRegisters` range, which is what keeps it off ordinary memory.
+    respell(['vol-store'], () => volStore(sfn));
+    /** `/unreduce` with both halves of the device model handed over — the SPELLING range and the
+     *  MEMORY-MODEL trigger list (target.ts). Written once because three call sites take it. */
+    const unreduced = (from: SFn): UnreduceResult | null =>
+      unreduceAccumulators(from, target.capabilities.deviceRegisters, target.capabilities.deviceMemoryWriters);
+    // `/unreduce` — delete a loop-carried accumulator and spell each read as its closed form
+    // (l3/unreduce.ts). Strength reduction is a compiler pass, so the accumulated form is what the
+    // asm shows whichever form the source had; the un-reduced form is the other pre-image, and it
+    // reaches a preheader slot no C statement can (a compiler-created giv init is inserted after
+    // the invariant hoist, gcc/loop.c:1151 then :1173). The scalar-value sibling of `/indexed`,
+    // which makes the same argument for a pointer walk.
+    respell(['unreduce'], () => unreduced(sfn));
+    // `/ptr-field` — declare a recovered WORD field a pointer (l3/ptrfield.ts). raise/structs.ts
+    // types a field from the access width alone, and on a 32-bit target `void *` fits that
+    // evidence exactly — but not the compiler's alias analysis, which is what lets a pointer
+    // field's load leave a loop an `s32` store pins it inside. Both are enumerated.
+    respell(['ptr-field'], () => pointerFields(sfn));
+    // `/offmember` — spell a leaf base's constant subscript as a struct MEMBER (l3/offmember.ts),
+    // so the offset stays in the load's displacement instead of folding into the pool literal.
+    // The SECOND source of the shape `/basefold` already reads: that row answers the same
+    // evidence with a named base, this one with an aggregate member, and the two are different C
+    // and different register pressure. Offered only where the target declares the fold (its registry
+    // entry's target gate, which `respell` asks): MIPS and PPC put the addend in the instruction by
+    // construction, so nothing there says a member put it there, exactly as with BASEFOLD_HOISTS.
+    respell(['offmember'], () => spellOperandMembers(sfn));
+    // The `/vol-store` × `/unreduce` PAIRING — row-demanded (synthetic:dmafill), and the joint
+    // spelling is reachable from neither variation alone: pinning the stores keeps three of them in
+    // the loop body, which is what makes the loop's register pressure — and so the placement of
+    // the induction init — observable at all. Alone the two score 19 and 34 against the row's own
+    // 30; together, 0. The TRIPLE adds `/ptr-field` for synthetic:dmaptrsrc, whose closed form
+    // reads a struct field the un-reduce puts back inside the loop: 27 · 35 · 42 alone, 0
+    // together. The intermediate pairs are not admitted, and the reason is that NO ROW DEMANDS
+    // ONE — neither could win where they are reachable: compiled on synthetic:dmaptrsrc, VT TIES
+    // `/vol-store`'s 27 and RT LOSES to it at 32. Rank a pair against the BEST already-admitted
+    // candidate (on synthetic:dmaptrsrc the triple, at 0), not against any admitted variation: VT
+    // only ties `/vol-store`'s 27, and RT's 32 beats the admitted standalone `/unreduce`'s 35, so
+    // "worse than an admitted variation" would exclude neither.
+    //
+    // WHAT THE STANDALONE LINES COST, since neither of the two variations ever wins an artifact row
+    // ALONE — every `/unreduce` and `/ptr-field` winner rides inside a `/vol-store` pairing, which
+    // is the property `apps/benchmark/test/census.test.ts` asserts. They are kept because a
+    // variation has to be able to LOSE on its own terms: the admission posture (compareScored orders
+    // by score) is what makes a wrong respelled source harmless, and it is only observable when the
+    // single-variation candidate is in the fan —
+    // `synthetic:dmastride` exists to show exactly that for `/unreduce`, at 33 against its match.
+    //
+    // AND THE SUBSET APPLIER IS NOT THE RIGHT MECHANISM HERE, though it looks like it: rebuilding
+    // this as a STACKED_SUBSETS-style table would admit VT and RT by construction, because
+    // `applyStacked` is SKIP-ON-DECLINE and would emit "everything that fired" on any tree where
+    // one of the three declines. That is the property the stacked variations are designed around and
+    // the one the pairing policy forbids — a pair reaches the fan only when a row demands it.
+    //
+    // Both compose through `composeRespellVariations`, which carries `/unreduce`'s proof obligation across
+    // the stages after it — hand-writing that carry made dropping it a type-correct edit.
+    respell(['vol-store', 'unreduce'], () => composeRespellVariations(sfn, [volStore, unreduced]));
+    respell(['vol-store', 'unreduce', 'ptr-field'], () =>
+      composeRespellVariations(sfn, [volStore, unreduced, pointerFields]),
+    );
+    // `/inlinebase` — spell a CONSTANT-address pointer local at its uses instead
+    // (l3/inlinebase.ts). The local is structure/analysis.ts's value home for a `const` the
+    // asm kept in a callee-saved register across a call; the register is real, but a constant
+    // re-spelled per use is CSEd back into that same one, so which the source had is not
+    // derivable. Its own bare-`const`-initializer gate keeps it off l3/basecse.ts's reuse
+    // hoists, whose placement variations already answer that question.
+    //
+    // TWO RESULTS, not a composition: deleting the local also deletes the only place
+    // a `volatile` POINTEE could be written, and a raw address has no declaration anywhere
+    // else to carry it. So the qualified spelling is emitted too, `/volatile` narrowed to
+    // exactly the locals this variation deletes. Usually the bytes separate them and the score
+    // decides (11 against 12 on pokeemerald:EReader_Reset), but where the compiler was not
+    // exploiting the non-volatility they are byte-identical — as they are on that row's
+    // WINNING shape, the one that also qualifies the slot — and `compareScored`'s device-
+    // volatility term picks the qualified candidate, 0x4000208 being REG_IME.
+    //
+    // COST — it fires broadly: on 33 of the 69 klonoa functions that lift with no symbol map
+    // (a symbol-map sweep sees fewer, since an absolute pool constant lifts to a `gaddr`
+    // there). Both outputs together add 766 candidates over 47058, +1.6%, and up to +67% on
+    // one function (EntityPositionFromLevelTable) — the same class of price the enumeration
+    // already pays for `/volatile`, and cheaper than a structure variation over the same question
+    // would be — the decision the variation's header argues. `/vol-slot` adds nothing at all there: no
+    // klonoa function reaches its frame gate.
+    const inlineVolatile = (): SFn | null => {
+      const only = new Set(inlinableConstBases(sfn));
+      const q = only.size ? volatilePtrLocals(sfn, only) : null;
+      return q ? inlineConstBases(q) : null;
+    };
+    respell(['inlinebase', 'volatile'], inlineVolatile);
+    respell(['inlinebase'], () => inlineConstBases(sfn));
+    // The `/inlinebase` × `/vol-slot` PAIRING — row-demanded, and the joint spelling is
+    // reachable from neither variation alone: on pokeemerald:EReader_Reset the default scores 11,
+    // `/inlinebase` alone 11 and `/vol-slot` alone 2, and the pair 0. The two touch disjoint
+    // locals (one pointer-typed, one a scalar frame slot), so applying them in either order
+    // gives the same spelling — and each of `/inlinebase`'s two outputs carries it.
+    respell(['inlinebase', 'volatile', 'vol-slot'], () => {
+      const r = inlineVolatile();
+      return r ? volatileValueLocals(r) : null;
+    });
+    respell(['inlinebase', 'vol-slot'], () => {
+      const r = inlineConstBases(sfn);
+      return r ? volatileValueLocals(r) : null;
+    });
+    // `/scopebase` — name a reused global base at the INNERMOST scope holding its uses
+    // (l3/scopebase.ts). Distinct from basecse's function-top hoist, which the default already
+    // carries: this one fires exactly where that placement would extend a live range the
+    // original never had.
+    // `/scopebase`, and its COALESCED results. Which locals a register allocator shared is not
+    // derivable from the tree — on the row this was built for the two legal merges score 18 and
+    // 40 against a no-merge 21, so committing to one by declaration order costs 19 points and
+    // discards the winner. Every result is emitted and the differ referees, exactly as
+    // `/regcopy` does for its allocator-ambiguous tail decision.
+    //
+    // POLICY NOTE: this is a PAIRING, `/scopebase` × `/coalesce`, admitted for the row above, which
+    // demands the joint spelling (18 against the no-merge 21). `respellEach` makes the coalesce's
+    // results from the tree `/scopebase` produced, in the one place that knows the hoist happened.
+    // Unlike the `/livebase` × `/coalesce` pairings it takes `coalesceCandidates`' whole merge set,
+    // not the arm-disjoint subset. The name lists both variations because both were applied. A
+    // candidate's variations name what was applied, not a route a deletion must remove: these
+    // results are minted by their own `respellEach` call, so deleting `respell(['scopebase'], …)` does
+    // not delete them. The un-coalesced `/scopebase` stays in the list, so nothing is lost.
+    //
+    // EVERY pass invocation stays INSIDE a thunk — see the paragraph above on why a pass that
+    // runs outside `respell`'s try is the one way a variation can cost a match. `respellEach` re-runs
+    // the hoist per candidate, which is pure and cheap, rather than caching it outside the guard.
+    respell(['scopebase'], () => hoistScopedBases(sfn));
+    // `/regionbase` — the same pass under its second region rule: a base the source spells inside N
+    // disjoint regions becomes N locals, one per region, rather than one at function scope. A VARIATION
+    // beside `/scopebase`, not a replacement for it: both spellings and the un-hoisted default stay
+    // in the list, so the differ settles which allocation the original had.
+    const regionbase = (): SFn | null => hoistScopedBases(sfn, { regions: 'per-region' });
+    respell(['regionbase'], regionbase);
+    // …and its `/volatile` composition, narrowed to exactly the locals this variation mints — the
+    // same composition `/livebase` and `/inlinebase` already carry, for the same reason. The shape
+    // this variation exists for is a DEVICE base (the DMA block at 0x040000D4), and the project's own
+    // reference spells it `vu32 *dmaRegs`; without the composition every region local this variation
+    // wins with is published UNqualified, and `compareScored`'s `deviceVolatile` term — which prefers
+    // the qualified candidate on a tie — never sees a qualified candidate to prefer. It is a candidate like
+    // any other where the qualifier costs bytes, and the differ referees.
+    const regionVolatile = (): SFn | null => {
+      const r = regionbase();
+      return r ? volatilePtrLocals(r, createdLocals(sfn, r)) : null;
+    };
+    respell(['regionbase', 'volatile'], regionVolatile);
+    // …and the `/vol-store` triple, the pairing this variation is the first to inhabit (see
+    // l3/volstore.ts, where the two qualifiers' reach over a tree's OWN locals is disjoint).
+    // `/volatile` qualifies a pointer LOCAL and `/vol-store` a STORE SITE, and this variation leaves
+    // both in one function: it homes the regions holding two or more direct uses and leaves every
+    // other spelling of the same device address inline. On `synthetic:dmascope` that residue is
+    // the write to REG_DMA0CNT that STARTS the transfer, and without the triple it is published
+    // bare beside three `volatile s32 *` region locals.
+    respell(['regionbase', 'volatile', 'vol-store'], () => {
+      const v = regionVolatile();
+      return v ? volStore(v) : null;
+    });
+    /** One candidate per result of a multi-result variation, `name` applied to the result's own
+     *  subject after `prefix`. */
+    const respellEach = (
+      prefix: readonly Variation[],
+      name: SubjectVariationName,
+      from: () => SFn | null | undefined,
+      resultsOf: (s: SFn) => { merged: string; sfn: SFn }[] = coalesceCandidates,
+    ): void => {
+      if (!offeredOn(target, [...prefix, name])) {
+        return;
+      }
+      let results: { variations: readonly Variation[]; sfn: SFn }[] = [];
+      try {
+        const base = from();
+        results = (base ? resultsOf(base) : []).map((c) => ({
+          variations: [...prefix, withSubject(name, c.merged)],
+          sfn: c.sfn,
+        }));
+      } catch (e) {
+        reportThrow([...preRespellVariations, ...prefix, name], e);
+        return;
+      }
+      for (const c of results) {
+        respell(c.variations, () => c.sfn);
+      }
+    };
+    respellEach(['scopebase'], 'coalesce', () => hoistScopedBases(sfn));
+    respellEach([], 'coalesce', () => sfn);
+    // `/volatile`'s per-local SUBSETS: which pointers the source declared volatile is
+    // per-pointer knowledge (an MMIO block and a plain RAM table sit side by side, and
+    // qualifying the table blocks the read collapse its region wants), so each proper
+    // non-empty subset is its own candidate — the same alternative-OUTPUTS mechanism as the
+    // coalesce merges, not a pairing (l3/volatileptr.ts volatileSubsetCandidates carries the
+    // ≤3 cap). The all-qualifiers form is plain `/volatile` above; the `/livebase/volatile`
+    // composition's subsets ride below with that composition's own `only` scope.
+    respellEach(
+      [],
+      'volatile',
+      () => sfn,
+      (s) => volatileSubsetCandidates(s),
+    );
+    respell(['indexed'], () => reindexWalks(sfn));
+    respell(['indexed', 'volatile'], () => {
+      const kept = new Set<string>();
+      const r = reindexWalks(sfn, kept);
+      return r ? volatilePtrLocals(r, kept) : null;
+    });
+    // `/livebase` — hoist a reused leaf base the default basecse pass REFUSED (l3/basecse.ts,
+    // LIVEBASE_GATES): its `loop` and `repeated-const-offset` rules predict re-materialization,
+    // and an MMIO poll (store then re-read the same fixed offset while it spins) is the shape
+    // where the prediction is wrong — the compiler holds ONE base register across stores, the
+    // loop, and the read-back. The default already carries every base those rules admit, so a
+    // hoist-nothing result means the variation has nothing to add and declines.
+    // One family per hoist; a hoist binding exactly what an earlier hoist bound is the same
+    // source under different variations, so it declines for that too. `/basefold`'s TWO hoists and
+    // `/unfolded` stay on the roster where the target declares the fold, and `/orderbase` where it
+    // declares the array-shape fork (each registry entry's target gate), so a target with neither is
+    // offered the two `/livebase` hoists and nothing else. The array-shape fork is the opt-in
+    // raise/globalshape.ts carries: with it off nothing is stamped, so `order-licensed` would refuse
+    // every key anyway and the filter only saves the census.
+    const hoists: readonly BaseHoist[] = [
+      ...LIVEBASE_HOISTS,
+      ...BASEFOLD_HOISTS,
+      ...UNFOLDED_HOISTS,
+      ...ORDERBASE_HOISTS,
+    ].filter((h) => offeredOn(target, h.variations));
+    // AND THE SAME SKIP KEYED ON THE LICENCE ITSELF WOULD BUY NOTHING, which is worth a paragraph
+    // because this hoist is where the next reader will propose it. `orderLicensedGlobals` is decidable
+    // on the lifted fn, so the hoist could also be dropped wherever THAT set is empty. It would be
+    // sound, and it would be inert, for the same one reason: an empty licence stamps no
+    // `baseOrdered` (structure.ts `stampOrderedBases`), so `order-licensed` refuses every key, so
+    // `hoist` returns null and this hoist's three emission sites — two `respell`s and the `respellEach`
+    // whose generator fans over volatile SUBSETS, so the third is a set and not one spelling — emit
+    // nothing. Which GENERALIZES to every variation carrying a licence: a skip like it is sound exactly
+    // where the variation would have emitted no candidate, so a sound one shrinks the fan by zero, so it
+    // removes no COMPILE, and one compile per candidate is where a ranked run's cost is; what it
+    // saves is one `admittedBases` walk per tree. `docs/level-tower.md` carries the general form.
+    // Measured on klonoa's `LoadBGTilemapData`, the checkout function whose 112,896-candidate fan
+    // raises the question: the licence is empty on every lift setting of BOTH symbol-map configurations —
+    // four named symbols DO reach the licence table map-ful and the ADDRESS gates refuse all four,
+    // so "the pool spells no names" is not the reason — and the skip fires on every tree there and
+    // removes not one candidate.
+    //
+    // IF IT IS EVER BUILT ANYWAY, IT IS `orderLicensedGlobals(fn, target)` READ AT THE SITE BELOW
+    // that hands `orderLicensed` to the structuring call, PER LIFT SETTING — never per function,
+    // and never either of the two predicates standing beside it in that same loop. All three wrong
+    // readings delete the SAME four live candidates on `sub_806800C` in the sa3 checkout, in BOTH
+    // symbol-map configurations: `unsigned/setup-args/orderbase` and its `/flip-join`, `/derived-home` and
+    // `/flip-join/derived-home` siblings.
+    //   · PER FUNCTION — `/setup-args` narrows the lift and can license a name the default lift does
+    //     not, so the first lift setting's answer is not the function's.
+    //   · `inferGlobalArrays`, seven lines above the licence call and off the same `fn` — a
+    //     documented strict SUBSET (`raise/globalshape.ts`), and measurably empty on functions
+    //     where the licence is not, several of them carrying `/orderbase` candidates.
+    //   · the licence RECOMPUTED after `raiseRecovered` — not the next statement but the third,
+    //     ten lines down, past the map-precedence delete over `inferredSymbols` and
+    //     `applyIdiomPatterns`. `raise/globalshape.ts` says in its own module note that the raising
+    //     tower destroys the order evidence, but the tempting next step — "so it reads empty
+    //     everywhere and the skip is free" — is FALSE: it reads NON-empty on a function whose
+    //     `/orderbase` candidates it then deletes anyway. Firing less often is not a defence.
+    // A per-row variations/source diff catches the last two, and CANNOT catch the first. Both of those
+    // delete `unsigned/orderbase` off `synthetic:bgarr:agbcc`, the exact source that row publishes
+    // as its score-0 MATCH — a row carrying no symbol map, so its single configuration is the one the
+    // gate actually runs. The per-function reading needs `/setup-args` AND `/orderbase` in ONE
+    // candidate's variations, and NO published winner carries both — so a green corpus gate is evidence about two of
+    // these readings and none at all about the third. That property is the gate, not a count:
+    // apps/benchmark/test/census.test.ts asserts it over the committed artifact.
+
+    // The CENSUS is a pure function of (this tree, that table) and every hoist asks for every
+    // earlier hoist's, from thunks each composition re-invokes — quadratic in the roster, times the
+    // number of compositions. Memoized on the gate table's identity. The value is a list of key
+    // STRINGS whose two readers here only compare and count it, so a memo hit shares no tree.
+    const censuses = new Map<readonly Gate<BaseKey>[], readonly string[]>();
+    const census = (g: readonly Gate<BaseKey>[]): readonly string[] => {
+      const hit = censuses.get(g);
+      if (hit) {
+        return hit;
+      }
+      const v = admittedBases(sfn, g);
+      censuses.set(g, v);
+      return v;
+    };
+    /** Does an EARLIER hoist already bind exactly `bound` at this placement? Then this hoist is
+     *  that hoist's source under different variations and declines.
+     *
+     *  Same bases in the same POSITION is the same spelling; the same bases somewhere else is not,
+     *  which is why the placement is a conjunct and not an afterthought. `rows` is the slice's
+     *  own list, so the two readers scope it differently — the roster hoist asks over the whole
+     *  hoist roster, the homesplit pairing over the PAIRED hoists only, because a skip there
+     *  must never drop a withhold no other hoist enumerates. Captures `census`, so a repeated table
+     *  costs one memo lookup rather than a second walk. */
+    const shadowedByEarlier = (
+      rows: readonly { placement: HoistPlacement; gates: readonly Gate<BaseKey>[] }[],
+      i: number,
+      placement: HoistPlacement,
+      bound: readonly string[],
+    ): boolean => rows.slice(0, i).some((r) => r.placement === placement && sameBases(bound, census(r.gates)));
+    const livebases = hoists.map(({ variations, gates, placement, pairings }, i) => {
+      const hoist = (): SFn | null => {
+        const bound = census(gates);
+        if (bound.length === 0) {
+          return null;
+        }
+        return shadowedByEarlier(hoists, i, placement, bound) ? null : hoistBaseLocals(sfn, gates, placement);
+      };
+      const volatiles = (): SFn | null => {
+        const r = hoist();
+        return r ? volatilePtrLocals(r, createdLocals(sfn, r)) : null;
+      };
+      return { variations, hoist, volatiles, pairings, gates, placement };
+    });
+    // THE PLACEMENT DIFFERENTIAL, one composition inwards. `respell` re-checks a variation's
+    // placement across the stacked variations derived onto it; the variation-on-variation
+    // compositions below are the same hazard in the same file and are outside it, because the
+    // composition happens INSIDE one `make()` thunk and the intermediate tree never reaches
+    // `respell`'s check. A def-MOVING pass (`sinkInitsToFirstUse`, `nearBaseClusters`,
+    // `reindexWalks`) running on a tree a PLACING variation built can move a def below a use exactly
+    // as a shape can. Same
+    // differential, so a placement neither pass can model is not judged either way, and the throw
+    // lands inside the thunk — a reported, dropped candidate.
+    //
+    // BOTH SIDES' minted locals, because the mover MINTS TOO: `nearBaseClusters` creates the
+    // cluster base it then places, and `reindexWalks` creates the induction variable, so the
+    // outer variation's name diff alone is empty for a standalone mover and a strict subset for a
+    // composition — the mover's own stranding of its own local walks straight through. Judging a
+    // name the BEFORE tree does not carry keeps the differential honest rather than turning it
+    // absolute: a name absent from `before` is never read there, so that walk passes and only the
+    // `after` placement is judged.
+    const survives = (before: SFn | null, after: SFn | null): SFn | null => {
+      if (before !== null && after !== null) {
+        assertPlacementSurvives(before, after, new Set([...createdLocals(sfn, before), ...createdLocals(sfn, after)]));
+      }
+      return after;
+    };
+    // Every composition below runs over the hoists a demanding row earned, never the whole roster.
+    const paired = livebases.filter((l) => l.pairings);
+    for (const { variations, hoist, volatiles } of livebases) {
+      respell(variations, hoist);
+      respell([...variations, 'volatile'], volatiles);
+      respellEach(variations, 'volatile', hoist, (r) => volatileSubsetCandidates(r, createdLocals(sfn, r)));
+    }
+    // The livebase × indexed PAIRINGS (see POLICY): row-demanded, and the joint spelling is
+    // reachable from neither variation alone (the
+    // frame-copy + DMA shape).
+    for (const { variations, hoist, volatiles } of paired) {
+      respell([...variations, 'indexed'], () => {
+        const r = hoist();
+        return r ? survives(r, reindexWalks(r)) : null;
+      });
+      respell([...variations, 'volatile', 'indexed'], () => {
+        const r = volatiles();
+        return r ? survives(r, reindexWalks(r)) : null;
+      });
+    }
+    // The livebase × sinkinit PAIRINGS — the same admission again: row-demanded
+    // (kleod:DecompressDma, on kl-eod-decomp's source, before 2026-09-13), and the joint spelling is reachable from neither variation alone. The
+    // bases whose placement moves the row are the ones only this variation's ablation binds, and
+    // `/sinkinit` alone reads the DEFAULT hoist's head, which does not carry them.
+    for (const { variations, hoist, volatiles } of paired) {
+      respell([...variations, 'sinkinit'], () => {
+        const r = hoist();
+        return r ? survives(r, sinkInitsToFirstUse(r)) : null;
+      });
+      respell([...variations, 'volatile', 'sinkinit'], () => {
+        const r = volatiles();
+        return r ? survives(r, sinkInitsToFirstUse(r)) : null;
+      });
+    }
+    // The livebase x homesplit PAIRINGS, row-demanded (see POLICY; synthetic:dmapoll): ONE base
+    // kept at the head and a SECOND split per region, which neither variation spells alone because
+    // each applies its own policy to every base it binds: compiled
+    // against that row's own object, the score reaches 0 only where the two policies land on
+    // DIFFERENT bases, and every uniform choice is worse. The endpoint figures live in
+    // l3/homesplit.ts, which is the measurement's one home, along with why this is a PIPE and
+    // never a merge.
+    //
+    // WHICH key is withheld is not derivable, so every admitted key is its own candidate, with that
+    // key as the variation's SUBJECT — a candidate's variations are its identity, and one name over
+    // two withholds names two programs. `HOMESPLIT_FAN_GATES`' `homesplit-fan-cap` is what bounds the
+    // pairing. ADDITIVE, like every variation here: `/livebase-block`, `/regionbase`, `/scopebase`
+    // and the un-hoisted default all stay in the list, which is what keeps `synthetic:dmaflat` — where the
+    // composed spelling scores 13 against its own 0 — at MATCH.
+    for (const [i, { variations, gates, placement }] of paired.entries()) {
+      const bound = census(gates);
+      // The ROSTER's dedup, which `hoist` applies to every other composition and this loop has to
+      // ask for itself: every pairing piped from a shadowed hoist is that hoist's source under
+      // different variations too. Asked over the PAIRED hoists only — the earlier hoist runs the identical pipe and
+      // emits the identical source. Without it both run and `seen` collapses the pair afterwards,
+      // having paid a head hoist, region plan, rewrite and emit for each.
+      if (shadowedByEarlier(paired, i, placement, bound)) {
+        continue;
+      }
+      // The function-level half of the pairing's admission, asked ONCE over the census: both its
+      // rules read the key count and nothing else, so inside the pipe they would cost that whole
+      // pipe to report a fact this loop already holds.
+      for (const key of homeSplitWithholds(bound)) {
+        const homesplitVariations = [...variations, withSubject('homesplit', homeSplitTag(key))];
+        const homesplit = (): SFn | null => {
+          const p = splitHomeBases(sfn, {
+            gates,
+            placement,
+            key,
+            ...(target.capabilities.deviceRegisters ? { deviceRegisters: target.capabilities.deviceRegisters } : {}),
+          });
+          return p ? survives(p.homed, p.split) : null;
+        };
+        const homesplitVolatile = (): SFn | null => {
+          const r = homesplit();
+          return r ? volatilePtrLocals(r, createdLocals(sfn, r)) : null;
+        };
+        respell(homesplitVariations, homesplit);
+        respell([...homesplitVariations, 'volatile'], homesplitVolatile);
+        respell([...homesplitVariations, 'volatile', 'vol-store'], () => {
+          const v = homesplitVolatile();
+          return v ? volStore(v) : null;
+        });
+      }
+    }
+    // `/mulfirst` — product-first commutative sums (l3/mulfirst.ts): IDO/mwcc schedule the
+    // independent operand's load above the product's mflo/mullw, so def order re-spells a
+    // product-first source as load-first. Both orders are emitted; the differ referees.
+    respell(['mulfirst'], () => mulFirstSums(sfn));
+    // `/nearbase` — neighbor absolute addresses derive from one shared base local
+    // (l3/nearbase.ts): one object's cells anchored as separate pool constants re-spell as
+    // offsets off its lowest address, within the target's declared derivation reach. Both
+    // spellings are emitted; the differ referees.
+    const nearSpan = target.compilerBehaviors.nearBaseSpan;
+    const near = (base: SFn | null): SFn | null =>
+      base !== null && nearSpan !== undefined ? survives(base, nearBaseClusters(base, nearSpan)) : null;
+    // …and WHERE its cluster inits sit, which is a second question with its own answer.
+    // `l3/nearbase.ts` places them above the run already there, and that is a committed choice
+    // made on one row (`synthetic:dmafield`) rather than on a compiler fact — a cluster base is
+    // reached at 2+ addresses by construction, so "first touched late" says nothing about it, and
+    // which order the source wrote is per-function knowledge the asm does not carry. With no
+    // second candidate that choice decides a MATCH rather than a candidate, which is the whole
+    // reason this row is here. `/sinkinit` here is the same transform it is everywhere else — each leading base init at its own first use — applied to a run whose order
+    // `prepend` chose, so where first use does not separate two inits the cluster base still leads
+    // (that tie is the one thing this is NOT identical to `placeBaseLocals(…, 'first-use')` on;
+    // pinned in test/sinkinit.test.ts). Priced over the corpus at 590 candidate sources on 15 of
+    // 1140 observations — where the two orderings agree the sink declines and nothing is added.
+    const nearSunk = (base: SFn | null): SFn | null => {
+      const r = near(base);
+      return r ? survives(r, sinkInitsToFirstUse(r)) : null;
+    };
+    respell(['nearbase'], () => near(sfn));
+    respell(['nearbase', 'sinkinit'], () => nearSunk(sfn));
+    // `/advance` — a pointer local the source MOVED between two accesses (l3/advance.ts), read off
+    // the `add` the target performed on an address register that already held an address it used.
+    //
+    // THE `/volatile` COMPOSITION IS THE ONE THAT PAYS, and both halves are measured on
+    // `kleod:StreamCmd_SetWindowRegs:agbcc`. Against the INDEXED spelling of the same minted local
+    // the advance buys nothing — agbcc folds `p = p + 1; *p` back into `strh [r3, #2]`, so
+    // `/advance` and `/nearbase` both score 15/23 there — and against the qualified one it is the
+    // match: `/advance/volatile` 0/22, because `volatile` bars that fold and leaves the `add` the
+    // target records.
+    //
+    // WHY THE CONJUNCTION IS A VARIATION AND NOT A COMPILER BEHAVIOR, since the four corners in
+    // test/advance.test.ts's header read as a FUNCTION from the asm: on agbcc a surviving
+    // `adds r3,#2` between two accesses through one address register is produced by exactly one of
+    // the four sources, so volatility and the advance are both determined once the stamp is there.
+    // What the mapping is a function OF is one compiler — agbcc — and the accesses that carry the
+    // stamp: every access agbcc DID fold carries no stamp, so an always-on rewrite gated by a compiler
+    // behavior would never see them, but nothing says the next compiler's fold has the same shape. It stays a variation for
+    // as long as agbcc is the only target that reaches the stamp (the corpus census below), and the
+    // day a second one does, `compilerBehaviors` is where this belongs rather than a variation.
+    //
+    // THE PLAIN `/advance` IS GATED ON THE COMPILER BEHAVIOUR IT IS INERT UNDER — its registry entry's
+    // target gate names a `compilerBehaviors` flag, as `foldsConstAddrOffset` keys `/offmember` above,
+    // but with the POLARITY REVERSED: that flag admits a variation where the compiler folds, this one
+    // withholds one. agbcc FOLDS the advance back (`compilerBehaviors.foldsPointerAdvance`, its four
+    // compiled corners in test/advance.test.ts's header), so the plain spelling emits the same stores
+    // as the indexed one this roster already offers, and it never wins on a row that reaches it:
+    // `/advance` 15/23 against this row's 0/22 match, and it LOSES outright on the other four — `offhi_split`
+    // 33/64 vs 12/61 · `offhi_fused` 31/63 vs 0/58 · `dma_fill_uninit` 76/114 vs 0/103 ·
+    // `volwalk` 5/7 vs 0/7 (2026-09-12).
+    //
+    // THOSE `/advance` HALVES ARE NOT REPRODUCIBLE BY A BARE `bench fan`, because this withhold is
+    // what removes them from every agbcc fan. The falsifying command is the ablation: flip
+    // `foldsPointerAdvance` to `false` in target.ts and re-run `pnpm bench fan <sym>` on the five
+    // rows — the plain `/advance` reappears at the scores above, or these numbers are wrong.
+    //
+    // ABSENT ⇒ FALSY ⇒ THE VARIATION SHIPS, so every compiler whose pair nobody has compiled keeps
+    // exactly the coverage it had: a compiler that does not fold `p = p + 1; *p` back would score
+    // the spelling apart, and that is the case the variation exists for. `/advance/volatile` is not
+    // gated — `volatile` is what bars the fold, and that composition is this row's match.
+    //
+    // NO `/vol-store` COMPOSITION. That variation pins a store whose WHOLE ADDRESS is a device constant,
+    // and this one has just replaced those constants with a local — so on the shape `/advance`
+    // fires for, the pair reaches only whatever OTHER const-addressed device store the function
+    // still has, which no row on the corpus has beside an advanced chain. A pairing with no
+    // inhabitant is candidates without a row behind them.
+    //
+    // AND NO `/nearbase` OR `/livebase` PAIRING, which is a different answer from the one those two
+    // give each other ("each variation's constants are invisible to the other's model"). Here they are
+    // not: all three mint a local for a const address, and `l3/advance.ts` needs its members to
+    // still BE const-addressed accesses (`cellAddress`), which is exactly what a nearbase cluster
+    // or a livebase hoist has already replaced. Running `/advance` on such a tree is a NO-REACH,
+    // not a decline — the same hazard `l3/nearbase.ts` records for committed base-CSE, which
+    // `/advance` inherits: where `structureChecked` has already hoisted the chain's pool word, the
+    // members arrive as a `var` base and this pass enumerates nothing at all.
+    //
+    // AND IT IS MAP-LESS ONLY, which is what caps its reach: with a symbol map the pool word
+    // promotes to `&REG_WININ` and `l3/address.ts`'s `cellAddress` answers null, so every
+    // `/advance` candidate on this row carries `/raw-globals` (`bench fan
+    // kleod:StreamCmd_SetWindowRegs:agbcc --enumerate`, 2026-09-12: 17 candidates, the one
+    // advanced candidate `unsigned/advance/volatile/raw-globals`). A capability that reads a CONST
+    // address does not survive the symbol-map direction unless `cellAddress` learns the promoted
+    // form; test/advance.test.ts records that at the row it exists for.
+    const advance = (): SFn | null => survives(sfn, advancedBases(sfn));
+    respell(['advance'], advance);
+    respell(['advance', 'volatile'], () => {
+      const a = advance();
+      return a ? volatilePtrLocals(a, createdLocals(sfn, a)) : null;
+    });
+    // The livebase × nearbase PAIRINGS — the same admission as livebase × indexed above:
+    // the volatile triple is the row-demanded one, and the joint spelling is reachable from
+    // neither variation alone (a neighbor-cell object and a multi-index MMIO block in one
+    // function — each variation's constants are invisible to the other's model); the plain
+    // sibling rides for symmetry with /livebase/indexed.
+    for (const { variations, hoist, volatiles } of paired) {
+      respell([...variations, 'nearbase'], () => near(hoist()));
+      respell([...variations, 'volatile', 'nearbase'], () => near(volatiles()));
+      respell([...variations, 'nearbase', 'sinkinit'], () => nearSunk(hoist()));
+      respell([...variations, 'volatile', 'nearbase', 'sinkinit'], () => nearSunk(volatiles()));
+    }
+    // The livebase × coalesce PAIRINGS — same admission again: the volatile triple is the
+    // row-demanded one, the joint spelling reachable from neither variation alone (an MMIO base
+    // worth homing and a counter shared across both arms of one if, in one function); the
+    // plain sibling rides for symmetry.
+    // ARM-DISJOINT merges only: the demanding row's shared counter is that class, and the
+    // span-model merges already ride the plain /coalesce variation — pairing them too would
+    // multiply candidates with no row behind it.
+    for (const { variations, hoist, volatiles } of paired) {
+      respellEach(variations, 'coalesce', hoist, armDisjointCandidates);
+      respellEach([...variations, 'volatile'], 'coalesce', volatiles, armDisjointCandidates);
+    }
+    // `/parkfirst` — incoming-argument parks lead the entry prefix (l3/parkfirst.ts): the
+    // park's `mov` lifts to pure SSA aliasing, so its position is unrecoverable and the
+    // default order is emission's. Both orders are emitted; the differ referees.
+    respell(['parkfirst'], () => parkParamsFirst(sfn));
+    // `/sinkinit` — each leading pointer-base init sinks to its own first use (l3/sinkinit.ts):
+    // the base hoist places every init at the head of the body, which keeps the base live across
+    // everything above its first use and can cost a callee-saved register the original avoided.
+    // Which placement the source used is not derivable from the asm, so both are emitted and the
+    // differ referees.
+    respell(['sinkinit'], () => sinkInitsToFirstUse(sfn));
+    // the register-copy variation (l3/regspell.ts): 0–3 results (base; tail assign-back reusing
+    // the dead value var; tail assign-back into a fresh var — the tail decision is allocator-
+    // ambiguous, so both are ranked).
+    //
+    // NAMED BY THE TAIL THE RESULT CARRIES, NEVER BY ITS INDEX. The reuse tail exists only
+    // where R1 fired, so the list is 1, 2 or 3 long and the fresh tail sits at no fixed position;
+    // an index-keyed table names the fresh spelling `/regcopy-ret` on every R1-less function
+    // — the dead-var-reuse name on the one spelling that has no dead var — and `winnerVariations` is
+    // what every census in this repo counts, `bench diff` included. The exhaustive record is the
+    // pin: a new tail kind is a type error here rather than a silent `/regcopy-3`.
+    // `cli/test/matching/regspell-candidate.test.ts` holds the correspondence.
+    const REGCOPY_VARIATION: Record<RegcopyTail, Variation> = {
+      none: 'regcopy',
+      reuse: withSubject('regcopy', 'ret'),
+      fresh: withSubject('regcopy', 'ret-fresh'),
+    };
+    registerishSpellings(sfn).forEach((alt) => respell([REGCOPY_VARIATION[alt.tail]], () => alt.sfn));
+    return { sources };
+  };
+  // The SYMBOL-MAP spelling is itself a ranked VARIATION on the same footing as signedness/branch
   // sense: naming a global changes agbcc's codegen (the eager-load effect), and which side
   // byte-wins is genuinely per-function — the dogfood's landed matches split between extern
   // spellings and raw-address macros. So when a map is present the raw-global spelling is ALSO
   // enumerated ('/raw-globals') and the differ referees; the dedup below collapses the pair
   // wherever the map changed nothing, so this never scores worse than either side alone.
-  const symbolVariants: { suffix: string; symbols?: typeof opts.symbols }[] = opts.symbols
+  //
+  // Does the `/raw-globals` setting have a RANK of its own to spell? Read off the DERIVED shapes the
+  // map does not answer for — the only ones a map-less structuring ever sees — because those are
+  // exactly the shapes `/flat-rank`'s decline just below is about. A superset of what the raw
+  // setting's own lift derives (it is read off the shared lift's), for the reason the
+  // structure-variation gate above is one too: this only ADDS an alternative, and where it changes
+  // nothing the tree dedup collapses it.
+  const rawDerivesRank = [...sharedLiftShapes].some(
+    ([n, i]) => byName?.get(n) === undefined && (arrayInnerExtents(i)?.length ?? 0) > 0,
+  );
+  const symbolSettings: { variations: readonly Variation[]; symbols?: typeof opts.symbols }[] = opts.symbols
     ? [
-        { suffix: '', symbols: opts.symbols },
-        { suffix: '/raw-globals', symbols: undefined },
+        { variations: [], symbols: opts.symbols },
+        { variations: ['raw-globals'], symbols: undefined },
       ]
-    : [{ suffix: '' }];
-  for (const [svIndex, sv] of symbolVariants.entries()) {
-    const svOpts = sv.symbols ? baseOpts : { ...baseOpts, symbols: undefined };
-    for (const cand of SIGN_CANDS) {
-      const fn = frontend.lift(name, asm, target, prototypes, opts.asmData, sv.symbols);
-      verify(fn);
-      applyIdiomPatterns(fn, target, opts.patterns);
-      // The shared tower spine (pipeline.ts) — the candidate's ONE difference from decompile() is the
-      // signedness pin, injected between pre-recovery and recoverTypes via the beforeRecover hook.
-      raiseRecovered(fn, target, { beforeRecover: () => pinScalarParams(fn, cand.signed, ptrIdx) });
-      for (const s of senseCands) {
-        // structure() reads `fn` and produces a fresh SFn (it does not mutate `fn`), so both branch
-        // senses structure the same recovered function without re-lifting.
-        let sfn: SFn;
+    : [{ variations: [] }];
+  for (const [symbolIndex, symbolSetting] of symbolSettings.entries()) {
+    const symbolSettingOpts = symbolSetting.symbols ? baseOpts : { ...baseOpts, symbols: undefined };
+    // `/no-bitfield` names a spelling the MAP makes available, so it has no inhabitant on the
+    // symbol-map setting that structures without one: structure() normalizes `spellBitfieldMembers`
+    // to false when `symbols` is absent, so both settings structure the identical tree whatever
+    // reads it. This declines to build the second one rather than leaving the tree skip to collapse it, which is
+    // worth 512 of LoadBGTilemapData's 1536 structurings under docs/ranked-repro.md's flags.
+    // Declining is not pruning — same posture as the signedness decline below, and the same
+    // candidate list; bitfield-members.test.ts pins the normalization the decline rests on.
+    // …and `/no-ptr-elem` names a spelling only the MAP makes available, for the same reason:
+    // structure() normalizes `spellPtrMemberElements` to false without `symbols`, so both settings
+    // structure the identical tree on the raw setting. `/flat-rank` IS NOT a third such spelling,
+    // and the difference is why its decline is asked of the EVIDENCE and not of the map: the
+    // declared subscripts come off a render context structure() builds from the UNION of the map
+    // and the shapes this function's own strides evidence (raise/globalshape.ts), so the raw setting
+    // derives a rank of its own. The decline therefore stands only where no derived shape carries
+    // a rank for that setting to spell — the condition under which both settings really do structure
+    // the identical tree.
+    const usableStructureSettings = symbolSetting.symbols
+      ? structureSettings
+      : structureSettings.filter((s) => s.bitfields && s.ptrElems && (s.declRank || rawDerivesRank));
+    const treeOwnedFold = treeOwnedIn(symbolSetting.symbols);
+    // The signedness variation DECLINES where the pin has nothing to pin. `pinScalarParams` writes only
+    // over an entry param still `unknown`/`int` that is not one of the recovered pointers/
+    // aggregates `ptrIdx` excludes; where no param is left, the second pass re-lifts, re-raises and
+    // re-structures a function BYTE-IDENTICAL to the first, reaching a tree the first pass already
+    // spelled. Declining is not pruning: the candidate list is the same list, reached without
+    // building the duplicates. What the decline saves is therefore invisible in the candidates —
+    // signedness-variation.test.ts counts LIFTS, the one reading of the enumeration that it moves.
+    //
+    // Read off the pin's OWN call, per symbol-map setting — the `/raw-globals` setting lifts without
+    // the map and answers for itself, so no lift is governed by a fact measured on a different one.
+    let pinnable = false;
+    for (const cand of SIGNEDNESS) {
+      if (cand.signed && !pinnable) {
+        break;
+      }
+      const base = frontend.lift(name, asm, target, prototypes, opts.asmData, symbolSetting.symbols);
+      // `/setup-args` — pass a prototype-less callee only what the CALLING BLOCK set up; which of
+      // the two readings the source spelled is genuinely ambiguous, and frontend/ssa.ts
+      // narrowToSetupArgs carries the argument for why the differ is what settles it.
+      //
+      // A LIFT VARIATION, in the same position in a candidate's variations as the signedness pin and
+      // the symbol-map setting — not a respell variation under the POLICY note below. Dropping an
+      // argument changes the IR every structure variation then reads: the value the argument carried loses a
+      // consumer, so what materializes changes with it, and a row whose callee arities are GUESSED
+      // can need the narrowed lift to reach a spelling neither side reaches alone —
+      // `kleod:ReadKeyInput` did, until its manifest declared those arities to asmlift as its own
+      // `ctx` already declared them to m2c; it now matches on the default lift, at
+      // `unsigned/derived-home`, enumerating no alternative lift at all.
+      // Only sources the narrowing actually changed reach a compiler: one that changes nothing
+      // downstream emits the default source and the dedup collapses it, and a DECLARED
+      // arity records nothing and enumerates no alternative lift at all. What survives the dedup is
+      // the variation's real price, and it is not free: it added 1201 distinct candidates, all of
+      // them in the 13 rows whose narrowing changes anything downstream. Quoted as a DELTA with no
+      // denominator, because the agbcc row count it was taken over has moved since — measured
+      // before those six kleod rows declared their callee arities,
+      // and declaring one takes its row out of that count.
+      //
+      // `/connective` — spell a same-scrutinee const-test chain as `x == 0 || x == 2` rather than
+      // leaving it to switch recovery. They are mutually exclusive within one raise
+      // (raise/shortcircuit.ts's REFUSALS note has the mechanism: a folded `logic_or` is not the
+      // `icmp` switch-recover.ts requires), so no predicate settles it — the differ does.
+      // Enumerated only where THIS LIFT SETTING's lift reports the PAIRWISE refusal, which a handful of
+      // corpus rows do.
+      //
+      // WHAT IT IS *NOT* FOR: the shared-arm spelling `switch (x) { case 0: case 2: … }`. That is
+      // the structurer's DEFAULT (switch-recover.ts groups case values sharing a body), and it is
+      // the same object as the `||` only in the DEGENERATE shape — one case group plus `default:`,
+      // where the dispatch has nothing to balance (agbcc 12 instructions each and one .text md5,
+      // IDO 64 bytes each and one md5). A second group parts them: agbcc 20 against 16, the switch
+      // building a balanced `bgt` dispatch where the chain tests sequentially; IDO 80 bytes each,
+      // different bytes. So on a recovered MULTI-GROUP switch the connective is a genuine second
+      // spelling, and this variation is the only thing that reaches it.
+      //
+      // WHERE IT IS WORTH 0 POINTS IT IS STILL NOT WORTH NOTHING, and the two kinds of row differ.
+      // On `kleod:ProcessInputAndUpdateEntities` the grouping alone reaches the same score the
+      // variation reaches with it, yet the published winner there carries `/connective` and spells its
+      // site `gUnk_030034C0 == 0 || gUnk_030034C0 == 2` — so deleting the variation moves that row's
+      // SOURCE. It moves the SCORE on the other kind of row, where switch recovery declined
+      // ENTIRELY and the tree came out as nested `if`s: `kleod:CountCollectedGems` and
+      // `kleod:CheckWorldCompletion`, neither with a `switch` at all. Telling the two apart needs
+      // an L3 fact (did recovery produce a grouped arm?) at a raise-level hook, which is a level
+      // inversion; the fan is the price instead. NO ABLATION PAIR IS QUOTED HERE: the artifact
+      // carries only the with-variation score, so half a refreshed pair would manufacture a delta
+      // across two bases — re-run the ablation to price it.
+      //
+      // It is a LIFT variation because the raise mutates in place: a second raise policy needs
+      // its own copy of the lifted fn, exactly as `/setup-args` needs one to narrow. Crossed with
+      // `/setup-args` rather than nested under it — dropping a call argument and choosing this
+      // shape are independent, and the four combinations dedup down to whatever the trees differ on.
+      const connectiveSettings: { variations: readonly Variation[]; connective: boolean }[] = treeOwnedFold
+        ? [
+            { variations: [], connective: false },
+            { variations: ['connective'], connective: true },
+          ]
+        : [{ variations: [], connective: false }];
+      const narrowSettings: { variations: readonly Variation[]; narrow: boolean }[] = hasSetupArgsNarrowing(base)
+        ? [
+            { variations: [], narrow: false },
+            { variations: ['setup-args'], narrow: true },
+          ]
+        : [{ variations: [], narrow: false }];
+      const liftSettings = narrowSettings.flatMap((l) =>
+        connectiveSettings.map((c) => ({ ...l, ...c, variations: [...l.variations, ...c.variations] })),
+      );
+      for (const liftSetting of liftSettings) {
+        let fn: Fn;
+        let inferredSymbols = new Map<string, SymbolInfo>();
+        let orderLicensed: ReadonlySet<string> = new Set<string>();
         try {
-          sfn = structureChecked(fn, {
-            ...svOpts,
-            preserveDivergentBranchSense: s.sense,
-            anchorConstCopies: s.anchor,
-            spellBitfieldMembers: s.bitfields,
-            rereadGlobals: s.reread,
-          });
+          // A SETTING THAT NAMES ANY VARIATION IS WHAT NEEDS ITS OWN COPY, the catch below's spelling: naming the
+          // flags here would leave a fourth lift variation sharing the default's already-mutated `base`.
+          fn =
+            liftSetting.variations.length === 0
+              ? base
+              : frontend.lift(name, asm, target, prototypes, opts.asmData, symbolSetting.symbols);
+          if (liftSetting.narrow && !narrowToSetupArgs(fn)) {
+            continue; // nothing to cut after all — the default lift's own candidates already cover it
+          }
+          verify(fn);
+          // This lift's OWN array-shape evidence, off its own lifted fn (a symbol map promotes
+          // numeric pool words to `gaddr`, so the `/raw-globals` setting genuinely answers differently).
+          //
+          // NEVER A NAME THE PROJECT MAP KNOWS, and the filter is here rather than left to
+          // structure()'s map-first lookup because THE `/raw-globals` SETTING STRUCTURES WITH NO MAP
+          // AND DECLARES WITH ONE. `declSymbols` is derived from the shared lift and map-last (the map
+          // wins every name it knows), so on an asm whose pool NAMES its globals the raw setting could spell a
+          // subscript off THIS function's strides — `gFoo[i][j]`, inner extent 2 — while the
+          // declaration beside it came from the map — `extern u32 gFoo[][8];` — and the emitted C
+          // would stride by 8. Compiling, and the wrong address. One name the map describes is
+          // one name this derivation does not claim, on either setting.
+          //
+          // AND NEVER A SHAPE THE DECLARATION BLOCK WILL NOT CARRY, which is the same hazard one
+          // step further out. `declSymbols` is built ONCE, off the shared lift; this map is built
+          // per lift, off that lift's own. Where the two lifts disagree about a name the map
+          // does NOT know, the map-precedence delete above says nothing and the raw setting would
+          // again spell from one shape and declare from another. So the test is not "the map
+          // knows this name" but "whatever will be DECLARED for this name says the same thing" —
+          // a name the two answer differently keeps the cast form, which needs no declaration.
+          inferredSymbols = inferGlobalArrays(fn, target);
+          // The ORDER half, off the same lift. NO map-precedence filter, and the
+          // asymmetry is the point: a shape is a DECLARATION, so a name the map describes must
+          // not be spelled from this function's strides — a licence declares nothing, and the
+          // spelling it enables keeps the cast (`(T *)&gSym`), which is byte-correct under any
+          // declaration. A map that names the symbol an array takes the access to a bare `var`
+          // base anyway, which carries no licence: the two never meet.
+          orderLicensed = orderLicensedGlobals(fn, target);
+          for (const [n, si] of [...inferredSymbols]) {
+            if (baseOpts.symbols?.has(n) === true || !sameDerivedShape(declSymbols.get(n), si)) {
+              inferredSymbols.delete(n);
+            }
+          }
+          applyIdiomPatterns(fn, target, opts.patterns);
+          // The shared tower spine (pipeline.ts). TWO differences from `decompile()`, both passed
+          // here: the signedness pin, injected between pre-recovery and recoverTypes via the
+          // `beforeRecover` hook, and the `pre.shortCircuit` connective owner, which `decompile()`
+          // leaves at its default. Stated in full so this copy and pipeline.ts's cannot silently
+          // diverge again — a third argument added here is a third line in both.
+          raiseRecovered(
+            fn,
+            target,
+            {
+              beforeRecover: () => {
+                pinnable = pinScalarParams(fn, cand.signed, ptrIdx) || pinnable;
+              },
+            },
+            prototypes[name],
+            { shortCircuit: { foldTreeOwned: liftSetting.connective } },
+          );
         } catch (e) {
-          if (!s.anchor && s.bitfields && !s.reread) {
-            throw e; // the base axes keep their behavior: a structuring failure aborts the row
+          // THE DEFAULT CARRIES NO VARIATION, by construction: every lift variation appends one, so
+          // `variations.length === 0` is the only spelling of "no lift variation is on" that stays correct
+          // when a fourth is added — the same reason the structure half below reads its table
+          // instead of naming its flags.
+          if (liftSetting.variations.length === 0) {
+            throw e; // the default lift keeps its behavior: a raising failure aborts the row
           }
-          // an anchored variant that fails structuring or its contracts is a dropped lever, never
-          // an aborted enumeration — same rule as respell below
-          opts.onLeverError?.(name + s.suffix, e instanceof Error ? e.message.split('\n')[0] : String(e));
+          // A dropped variation, never an aborted enumeration — the same posture as `respell`.
+          reportThrow(liftSetting.variations, e);
           continue;
         }
-        // The walk→index re-spelling (l3/reindex.ts) is a THIRD lever on the same footing as
-        // signedness and branch sense: whether the source spelled `*p; p++` or `arr[i]` is
-        // genuinely ambiguous from asm (compilers strength-reduce the latter into the former), so
-        // when a loop re-spells, BOTH representations are emitted and the differ referees. The
-        // re-spelling passes the same boundary contracts as the primary; one that fails them is
-        // dropped here — never scored, never able to win.
-        // Each spelling's symbol refs are DERIVED from its own final tree right where the
-        // spelling is emitted — the single point a candidate comes into existence. No pipeline
-        // stage carries refs (SFn has no such field), so a future l3 pass that rewrites the tree
-        // can never leave a stale ref behind: whatever tree reaches emit is the tree the refs
-        // describe, by construction. Collected against the FULL name-keyed map for EVERY
-        // spelling variant — the '/raw-globals' sibling drops the map's shaped SPELLINGS, but
-        // its tree still NAMES pool/reloc-derived globals (ARM `.word gSym`, MIPS `%lo(gSym)`),
-        // and those references need declarations in the self-declared scoring world exactly
-        // like the named variant's (without them every raw sibling fails to compile there,
-        // and the eval-winning raw candidate becomes unreproducible outside project headers).
-        const refsOf = (tree: SFn): { symbolRefs?: SymbolRef[] } => {
-          const refs = baseOpts.symbols
-            ? collectSymbolRefs(tree.body, baseOpts.symbols, tree.name).map((r) => {
-                // name-only symbols carry the IR-derived access facts — the width authority
-                // for their synthesized declaration (shaped symbols keep the map's truth)
-                const access = r.info.shape === undefined ? accessFacts.get(r.name) : undefined;
-                return access ? { ...r, access } : r;
-              })
-            : [];
-          return refs.length ? { symbolRefs: refs } : {};
-        };
-        const spellings: { suffix: string; source: string; symbolRefs?: SymbolRef[] }[] = [
-          { suffix: '', source: backend.emit(sfn), ...refsOf(sfn) },
-        ];
-        // Representation re-spellings — each a lever on the same footing as signedness/branch sense,
-        // each guarded: it must pass the same boundary contracts as the primary AND emit (a backend
-        // that declines by throwing — Pascal loud-fails unspellable shapes — drops the candidate,
-        // never aborts the enumeration). A dropped re-spelling loses nothing: the primary remains.
+        // THE SHARED-TAIL VARIATIONS: the same raised fn, structured again with `followEarlyReturns`,
+        // in two passes after the default one.
+        //   - `/shared-ret` is the follow ALONE, on the fn as raised. Some divergent `if` shares a
+        //     `ret` the compiler left in place (`synthetic:gcseinner`).
+        //   - `/shared-tail` is the follow after `sinkStoreTails` has rewritten the fn in place, which
+        //     is safe because `structure()` never mutates `fn`, so the earlier passes are done with it.
+        //     It is enumerated only where the sink changed something AND some divergent `if` of the
+        //     SUNK fn shares a `ret`. That is the sink's price gate: without it, a tail copied into
+        //     arms no `if` shares adds a candidate spelling it in each — 204 synthetic candidates on 8
+        //     rows (`gcsedup`, `gcseinnerdup`, `armexpr`, `mergeu16`, `ladder4`, `ladder5`,
+        //     `ladidx2`, `revlad5s`), every one of them MATCH today.
+        // They are lift variations rather than structure variations because the sink is an IR
+        // rewrite, and they run here rather than in pipeline.ts's spine because that costs no second
+        // lift. Neither is the default: the same IR comes from both sources (raise/tailsink.ts), and
+        // the follow alone as a default costs `synthetic:sw_fallguard:ido7.1` 13/19 → 19/23 and
+        // `synthetic:gcseflat:agbcc` 19/53 → 22/54.
         //
-        // POLICY: re-spellings derive from the BASE spelling only — levers do not compose
-        // (an /indexed + /regcopy product is deferred until a row demands it). And a lever must
-        // PRESERVE SEMANTICS by construction: the differ referees byte-exactness (a wrong candidate
-        // can never fake a score-0 match), but on a NONMATCH row the best-scoring source is shown
-        // to the user — a semantically-wrong re-spelling there is plausible-but-wrong output, the
-        // defect class this project exists to avoid. Hence each lever's decline-over-approximate
-        // gates, adversarially audited.
-        // Takes a THUNK, so the lever's own computation is inside the try too. A lever that threw
-        // from the pass itself — rather than from the contracts or the backend — would escape and
-        // abort the whole enumeration for this row, primary included: the one way a lever can cost
-        // a match. Making that structural rather than per-call-site means no lever can opt out.
-        const respell = (suffix: string, make: () => SFn | null | undefined): void => {
-          try {
-            const alt = make();
-            if (!alt) {
-              return; // the lever declined to fire — no candidate, not a duplicate of the primary
-            }
-            assertResolved(alt);
-            assertDerefsTyped(alt);
-            spellings.push({ suffix, source: backend.emit(alt), ...refsOf(alt) });
-          } catch (e) {
-            // A throwing lever, a contract failure, or an unspellable re-spelling: keep the primary.
-            // REPORTED, not swallowed. `dropped` (below) records only spellings the SCORER refused,
-            // so without this a lever that fails here vanishes with no trace — indistinguishable
-            // from one that correctly declined, which is exactly the hidden failure
-            // DroppedCandidate exists to surface.
-            opts.onLeverError?.(name + suffix, e instanceof Error ? e.message.split('\n')[0] : String(e));
-          }
-        };
-        // `/argbase` — name a call's argument bases before the call (l3/argbase.ts). A lever on the
-        // same footing as the others: the primary inline spelling stays in the list, so the differ
-        // referees and this can never cost a match.
-        respell('/argbase', () => materializeArgBases(sfn));
-        // `/scopebase` — name a reused global base at the INNERMOST scope holding its uses
-        // (l3/scopebase.ts). Distinct from basecse's function-top hoist, which the primary already
-        // carries: this one fires exactly where that placement would extend a live range the
-        // original never had.
-        // `/scopebase`, and its COALESCED variants. Which locals a register allocator shared is not
-        // derivable from the tree — on the row this was built for the two legal merges score 18 and
-        // 40 against a no-merge 21, so committing to one by declaration order costs 19 points and
-        // discards the winner. Every variant is emitted and the differ referees, exactly as
-        // `/regcopy` does for its allocator-ambiguous tail choice.
+        // TWO BITS, NOT ONE, because the sink can DELETE the follow. A store tail that is itself the
+        // `ret` both sides of an `if` reach is copied into its `br` sources, and then no shared `ret`
+        // is left. `synthetic:gcsejoin:agbcc` is ordinary loop-free C of that shape, and it scored
+        // 7/37 while the follow was tried only behind the sink. No per-tail predicate on this IR picks
+        // between the two: refusing to sink a tail that is already a follow costs
+        // `synthetic:gcseflat:agbcc` 0/49 → 19/53 and `synthetic:gcsearms6:agbcc` 0/84 → 23/87, and
+        // those two need a tail that is BOTH. So the follow-alone candidate is enumerated wherever
+        // the fn as raised has a follow, sunk or not. Its price over a single bundled follow-and-sink
+        // pass is +76 synthetic candidates, on those two rows, and +0 real: where the sink does not
+        // fire only the `/shared-ret` pass runs, and on every real row where it fires the fn as
+        // raised has no follow.
         //
-        // POLICY NOTE: rank.ts's rule is that re-spellings derive from the BASE spelling only —
-        // levers do not compose. These are not a second lever composed onto the first: coalescing is
-        // enumerated as alternative OUTPUTS of the base hoist, in the one place that knows the hoist
-        // just happened. The un-coalesced `/scopebase` stays in the list, so nothing is lost.
+        // EACH BIT IS PER LIFT, not per site: the `/shared-tail` pass sinks every store tail
+        // and follows every divergent `if` at once, so a function with two sites gets the both-on
+        // candidate only. Counted over both tiers (`ProcessInputAndUpdateEntities` excepted), three
+        // functions carry two of something: `synthetic:maskchain:agbcc` two follow sites,
+        // `synthetic:gcsearms6:agbcc` two sunk tails — both MATCH — and
+        // `pokeemerald:SetMauvilleOldManLanguage:agbcc` two sunk tails after which no `if` shares a
+        // `ret`, so the price gate above refuses and its fan is unchanged. Every other function
+        // carries at most one of each.
         //
-        // EVERY pass invocation stays INSIDE a thunk — see the paragraph above on why a pass that
-        // runs outside `respell`'s try is the one way a lever can cost a match. `enumerate` re-runs
-        // the hoist per candidate, which is pure and cheap, rather than caching it outside the guard.
-        respell('/scopebase', () => hoistScopedBases(sfn));
-        const enumerate = (label: string, from: () => SFn | null | undefined): void => {
-          let variants: { merged: string; sfn: SFn }[] = [];
-          try {
-            const base = from();
-            variants = base ? coalesceCandidates(base) : [];
-          } catch (e) {
-            opts.onLeverError?.(name + label, e instanceof Error ? e.message.split('\n')[0] : String(e));
-            return;
+        // `droppedDefault` is the DEFAULT pass's drops. Each shared-tail pass reads it and keeps its
+        // own drops in a copy, so one pass's structuring failure never removes the other's candidate.
+        const droppedDefault = new Set<string>();
+        for (const pass of ['default', 'follow', 'sink'] as const) {
+          if (pass === 'follow' && !hasDivergentSharedRet(fn)) {
+            continue;
           }
-          for (const c of variants) {
-            respell(`${label}-${c.merged}`, () => c.sfn);
+          if (pass === 'sink') {
+            let sunk: boolean;
+            try {
+              sunk = sinkStoreTails(fn);
+              if (sunk) {
+                verify(fn);
+              }
+            } catch (e) {
+              reportThrow([...liftSetting.variations, 'shared-tail'], e);
+              break;
+            }
+            // Unsunk, this fn is the `/shared-ret` pass's again.
+            if (!sunk || !hasDivergentSharedRet(fn)) {
+              break;
+            }
           }
-        };
-        enumerate('/scopebase-coalesce', () => hoistScopedBases(sfn));
-        enumerate('/coalesce', () => sfn);
-        respell('/indexed', () => reindexWalks(sfn));
-        // the register-copy spelling (l3/regspell.ts): 0–3 variants (base; tail assign-back reusing
-        // the dead value var; tail assign-back into a fresh var — the tail choice is allocator-
-        // ambiguous, so both are ranked)
-        const REGCOPY_LABELS = ['/regcopy', '/regcopy-ret', '/regcopy-ret-fresh'];
-        registerishSpellings(sfn).forEach((alt, i) => respell(REGCOPY_LABELS[i] ?? `/regcopy-${i}`, () => alt));
-        for (const sp of spellings) {
-          const source = sp.source;
-          // Collapse a spelling that produced identical source (a function with no divergent `if`
-          // structures the same either way): no point scoring a duplicate spelling. Deduping the
-          // WHOLE emitted set (not just scored survivors) is equivalent — an identical source
-          // scores identically, so it can never change `best` — and it keeps the candidate set to
-          // the genuinely distinct spellings.
-          if (seen.has(source)) {
-            continue;
+          const alternative = pass !== 'default';
+          const dropped = alternative ? new Set(droppedDefault) : droppedDefault;
+          const liftVariations: readonly Variation[] =
+            pass === 'follow'
+              ? [...liftSetting.variations, 'shared-ret']
+              : pass === 'sink'
+                ? [...liftSetting.variations, 'shared-tail']
+                : liftSetting.variations;
+          // the per-lift gates, on THIS lift's fn — see the table doc
+          const offForThisLift = STRUCTURE_VARIATIONS.filter(
+            (variation) => variation.perLiftGate !== undefined && !variation.perLiftGate(fn),
+          );
+          const settingsForLift = usableStructureSettings.filter((s) =>
+            offForThisLift.every((variation) => !s[variation.flag]),
+          );
+          // `/merge-names` combinations whose un-merged sibling was DROPPED. `structure()` already
+          // refuses to let the variation unlock a function the default declines, but it can only see its own
+          // refusals — a boundary contract fails out here, in `structureChecked`. Without this a
+          // `/reread-globals/merge-names` candidate could ship where plain `/reread-globals` did not,
+          // which is the same trade one level up. `structureSettings` puts each `mergeNames:false` sibling
+          // first, so the entry is always recorded before its merged sibling is reached.
+          //
+          // The shared-tail passes read the DEFAULT pass's set as well: neither `X/shared-ret` nor
+          // `X/shared-tail` ever ships where `X` was dropped. The follow and the sink each give the
+          // structurer a shape it can accept where the default declined — sound, but the same
+          // trade one level up again.
+          for (const s of settingsForLift) {
+            const key = s.variations.join('/');
+            if (alternative && droppedDefault.has(key)) {
+              continue;
+            }
+            if (
+              STRUCTURE_VARIATIONS.some(
+                (variation) =>
+                  variation.strip &&
+                  s[variation.flag] &&
+                  dropped.has(s.variations.filter((v) => v !== variation.name).join('/')),
+              )
+            ) {
+              // A SKIPPED setting is recorded exactly like a dropped one, or the closure would not be
+              // transitive: with plain X dropped and X/inplace skipped-but-unrecorded,
+              // X/inplace/merge-names would find neither stripped key and run — shipping a
+              // candidate carrying two variations where its ancestor failed the boundary contracts.
+              dropped.add(key);
+              continue;
+            }
+            // structure() reads `fn` and produces a fresh SFn (it does not mutate `fn`), so both branch
+            // senses structure the same recovered function without re-lifting.
+            let sfn: SFn;
+            try {
+              sfn = structureChecked(fn, {
+                ...symbolSettingOpts,
+                ...(inferredSymbols.size ? { inferredSymbols } : {}),
+                ...(orderLicensed.size ? { orderLicensedGlobals: orderLicensed } : {}),
+                preserveDivergentBranchSense: s.sense,
+                negateJoinedBranchSense: s.join ? !defSense : defSense,
+                ...(s.flipSites ? { branchSenseFlipSites: s.flipSites } : {}),
+                anchorConstCopies: s.anchor,
+                anchorLoopEntryConsts: s.entry,
+                spellBitfieldMembers: s.bitfields,
+                spellPtrMemberElements: s.ptrElems,
+                spellDeclaredSubscripts: s.declRank,
+                ...STRUCTURE_VARIATIONS.reduce(
+                  (acc, variation) => ({ ...acc, ...variation.options(s[variation.flag]) }),
+                  {},
+                ),
+                ...(alternative ? { followEarlyReturns: true } : {}),
+              });
+            } catch (e) {
+              if (liftVariations.length === 0 && isDefaultSetting(s)) {
+                throw e; // the default lift's default setting keeps its behavior: a failure aborts the row
+              }
+              // Recorded for EVERY dropped setting: a candidate with more variations on looks its siblings
+              // up by stripping one variation at a time, and the stripped key can itself carry the other.
+              dropped.add(key);
+              // an anchored setting that fails structuring or its contracts is a dropped variation, never
+              // an aborted enumeration — same rule as respell below
+              reportThrow([...liftVariations, ...s.variations], e);
+              continue;
+            }
+            // A TREE another structure setting already produced. `respellTree` reads the tree and this
+            // call's own constants, nothing that varies per setting — its signature is the argument —
+            // so a repeated tree can only re-emit sources `seen` already holds: the candidate list,
+            // its order and its variations are exactly the ones the whole fan produces, reached
+            // without re-deriving forty passes. A structure variation is INERT on most functions
+            // (nothing to re-read, no bitfield member, no joined if), and an inert one is a factor of
+            // two in the cross that changes nothing: on the klonoa checkout's `LoadBGTilemapData`
+            // under docs/ranked-repro.md's flags, 640 of 1024 structure settings (62.5%) re-derive a
+            // tree an earlier one already emitted.
+            //
+            // Keyed on the JSON text, in a Set of STRINGS — a value comparison, so it can never
+            // merge two trees the way a hash could. Its one direction of error is a MISS (a
+            // differing key order re-runs a respell set whose sources then dedup as they do today), and
+            // the property that rules the other direction out — that the text determines the tree —
+            // is pinned by rank-tree-key.test.ts rather than assumed.
+            //
+            // The key therefore spans EVIDENCE fields too, `index.operandOff` among them, which
+            // `exprEquals` deliberately ignores (l3/ast.ts). The two are right to disagree: two
+            // trees identical but for that field denote the same cells, so a CSE may collapse them,
+            // and they admit different bases under `BASEFOLD_GATES`, so a fan may not. Dropping it
+            // from the key would be the direction the paragraph above rules out. It carries a
+            // DISPLACEMENT rather than a presence flag, so it can split two trees that print the
+            // same subscript off different addends — re-priced when it widened, over klonoa's
+            // `LoadBGTilemapData` under docs/ranked-repro.md's flags: 66816 candidates either way,
+            // and all 66816 `[score]` lines identical. It splits 0 keys, so the miss it can cause
+            // has no inhabitant.
+            const treeKey = JSON.stringify(sfn);
+            if (seenTrees.has(treeKey)) {
+              opts.onTreeDeduped?.();
+              continue;
+            }
+            seenTrees.add(treeKey);
+            // The row's OWN tree, so this is the one call whose backend refusal is the row's cause.
+            const own = respellTree(sfn);
+            const sources = own.sources;
+            if (own.emit) {
+              lastEmitError = own.emit.error;
+            }
+            // The PRE-RESPELL variations (PRE_RESPELL_VARIATIONS, the last composition the POLICY note
+            // names): rewrite the TREE, then run the whole respell set over the result, so every
+            // respell variation derives from the rewrite instead of composing onto it. The gate is the pass's
+            // own decline; the contracts are `respell`'s three, for `respell`'s reasons.
+            for (const pf of PRE_RESPELL_VARIATIONS) {
+              try {
+                const made = pf.apply(sfn);
+                if (made === null) {
+                  continue;
+                }
+                // The SAME tree dedup the row's own tree above gets, and for the same reason: `respellTree`
+                // is a pure function of the tree, so running it again on a tree it has already run on buys nothing
+                // and makes the row's quoted fan cost a number that is partly duplicates. A SEPARATE
+                // set, not `seenTrees`: adding a rewritten tree there would let it skip a later
+                // STRUCTURED tree that happens to equal it, and that tree's own pre-respell output —
+                // which nothing has computed — would go with it.
+                const madeKey = JSON.stringify(made);
+                if (seenPreRespell.has(madeKey)) {
+                  continue;
+                }
+                seenPreRespell.add(madeKey);
+                assertResolved(made);
+                assertDerefsTyped(made);
+                assertLocalsWritten(made);
+                assertNoOrphanedLocals(sfn, made);
+                // A backend refusal on this REWRITTEN tree is not a refusal of the row's own
+                // tree, so it never becomes the row's stated cause: `TreeSources.emit` is dropped
+                // here and only the call over the row's own tree above records one.
+                //
+                // It is reported instead through `onEnumerationError` under `pf.name`, which is what
+                // `respellTree`'s second argument is for: a default emit refusal does not THROW —
+                // `respellTree` returns it — so the `catch` below never sees it, and reported with no
+                // variations it would read as a refusal of the row's default source while the
+                // variation's whole half of the fan was deleted.
+                const respelled = respellTree(made, [pf.name]).sources;
+                for (const sp of respelled) {
+                  sources.push({ ...sp, variations: [pf.name, ...sp.variations] });
+                }
+              } catch (e) {
+                reportThrow([pf.name], e);
+              }
+            }
+            for (const sp of sources) {
+              const source = sp.source;
+              // Collapse a candidate whose source is identical (a function with no divergent `if`
+              // structures the same either way): no point scoring a duplicate. Deduping the
+              // WHOLE emitted set (not just scored survivors) is equivalent — an identical source
+              // scores identically, so it can never change the winner — and it keeps the candidate set to
+              // the genuinely distinct sources.
+              //
+              // A CANDIDATE'S PUBLISHED VARIATIONS ARE THEREFORE NOT AN ATTRIBUTION, and every argument
+              // in this tree that counts winners' variations is unsound to exactly that extent. The
+              // variations kept are the FIRST route's; the later routes are discarded, silently and by
+              // design. Adding one hoist renamed candidates on 21 agbcc rows whose emitted source sets
+              // were byte-identical — a CANDIDATE-SET census (whole fan unchanged, some candidate
+              // renamed), which counts something different from a census of WINNERS: over published
+              // winners the same hoist moved 5 names, 2 of them renames.
+              //
+              // AND A CENSUS OF VARIATIONS CANNOT EVEN SEPARATE A RENAME FROM A CHANGED SOURCE. Of those 5
+              // winners, THREE changed the source they publish — `synthetic:unfoldpark`
+              // (402 → 397 bytes, score 9 → 0), `kleod:ConfigureEntityBehavior` (3677 → 3993,
+              // 233 → 230) and `synthetic:livepark` (337 → 346, both MATCH) — while
+              // `synthetic:foldpark` and `kleod:DecompressDma` (kl-eod-decomp's source, before 2026-09-13) were byte-identical renames. The two
+              // look the same from here; only the emitted SOURCE tells them apart (`bench diff`
+              // publishes that field, `bench regression` does not).
+              //
+              // So "N rows win under this family" bounds nothing: a family can win zero winners and
+              // still be the only route to a source, and a family can win five and have introduced
+              // three. Price a family by ABLATING it and re-running the rows
+              // (LIVEBASE_BLOCK_GATES carries the recipe); a zero census is not a death certificate,
+              // and a nonzero one is not a mechanism.
+              // THE SEAM FIX IS BOOKED AND NOT BUILT: keep the losing routes on the surviving
+              // candidate (`variations` plus an `alsoReachedBy`) and a census by mechanism
+              // becomes one. It is not free — every consumer that reads `variations` as the derivation
+              // would have to say which it means, and the published `winnerVariations` must not
+              // change — so build it when a round needs the census, not before. Until then the only
+              // sound census is an ablation.
+              const dup = seen.get(source);
+              if (dup !== undefined) {
+                // The same TEXT, reached twice. `matchOnly` is a property of the DERIVATION and the
+                // published artifact is the text, so a spelling some sound route also produces is a
+                // proven one however the first route reached it — clear the flag rather than keeping
+                // whichever route the enumeration happened to walk first.
+                if (sp.matchOnly === undefined) {
+                  delete dup.matchOnly;
+                }
+                continue;
+              }
+              const variations: readonly Variation[] = [
+                cand.variation,
+                ...liftVariations,
+                ...s.variations,
+                ...sp.variations,
+                ...symbolSetting.variations,
+              ];
+              // `respell`, `respellEach` and the hoist roster ask `offeredOn` before a pass runs; this
+              // asks it of the whole name, so a mint site that skips the question is an enumeration
+              // error and the drawer's target line stays what enumeration does.
+              if (!offeredOn(target, variations)) {
+                throw new Error(`'${variations.join('/')}' is withheld on ${target.compiler} but was enumerated`);
+              }
+              const made: Candidate = {
+                variations,
+                source,
+                preference: symbolIndex,
+                ...(sp.symbolRefs ? { symbolRefs: sp.symbolRefs } : {}),
+                ...(sp.deviceVolatile ? { deviceVolatile: sp.deviceVolatile } : {}),
+                ...(sp.matchOnly ? { matchOnly: sp.matchOnly } : {}),
+              };
+              seen.set(source, made);
+              out.push(made);
+            }
           }
-          seen.add(source);
-          out.push({
-            label: `${cand.label}${s.suffix}${sp.suffix}${sv.suffix}`,
-            source,
-            group: svIndex,
-            ...(sp.symbolRefs ? { symbolRefs: sp.symbolRefs } : {}),
-          });
         }
       }
     }
   }
+  // Every tree the fan produced was refused by the backend. Each refusal on its own is a dropped
+  // candidate; all of them together is the row, and it stays LOUD — the alternative is a caller
+  // ranking an empty list and reporting no match for a function nothing ever tried to spell.
+  if (out.length === 0) {
+    throw new NoSpellableCandidateError(
+      `no spellable candidate for '${name}': ${firstLine(lastEmitError ?? 'no candidate produced')}`,
+      { cause: lastEmitError },
+    );
+  }
   return out;
 }
 
@@ -445,70 +2177,132 @@ export function enumerateCandidates(
  *  the scorer must be sync (the cli/Node objdiff path). The webapp scores asynchronously and does
  *  its own await-loop over `enumerateCandidates`, reusing this module's `Candidate`/`RankedResult`
  *  types but not this driver. */
-export function rankBy<S extends { score: number }>(
+export function rankBy<S extends { score: number; rows?: number }>(
   candidates: Candidate[],
   symbol: string,
   scoreFn: (source: string, symbol: string, candidate: Candidate) => S,
 ): RankedResult<S> {
   const results: (Scored<S> & { order: number })[] = [];
-  const dropped: DroppedCandidate[] = []; // spellings that failed to build; only fatal if ALL do
+  const dropped: DroppedCandidate[] = []; // candidates that failed to build; only fatal if ALL do
+  const withheld: WithheldCandidate[] = []; // candidates that built but did not earn publication
   let lastScoreErr: unknown = null;
   candidates.forEach((c, order) => {
     try {
-      results.push({ ...c, order, score: scoreFn(c.source, symbol, c) });
+      const score = scoreFn(c.source, symbol, c);
+      const why = withheldReason(c, score);
+      if (why !== null) {
+        withheld.push({
+          variations: c.variations,
+          score: score.score,
+          ...(score.rows === undefined ? {} : { rows: score.rows }),
+          why,
+        });
+        return;
+      }
+      results.push({ ...c, order, score });
     } catch (e) {
       lastScoreErr = e;
-      dropped.push({ label: c.label, error: firstLine(e) });
+      dropped.push({ variations: c.variations, error: firstLine(e) });
     }
   });
   if (results.length === 0) {
-    throw new Error(`no scorable candidate for '${symbol}': ${firstLine(lastScoreErr)}`, { cause: lastScoreErr });
+    // Naming the withheld count matters here: "no scorable candidate" with a null cause reads as a
+    // scorer failure, and a list that was entirely proof-gated is a different thing entirely.
+    const why =
+      lastScoreErr !== null ? firstLine(lastScoreErr) : `${withheld.length} candidate(s) withheld, none scored`;
+    throw new NoScorableCandidateError(`no scorable candidate for '${symbol}': ${why}`, dropped, withheld, {
+      cause: lastScoreErr,
+    });
   }
   results.sort(compareScored);
-  return { best: results[0], candidates: results.map(({ order: _order, ...c }) => c), dropped };
+  return { winner: results[0], candidates: results.map(({ order: _order, ...c }) => c), dropped, withheld };
 }
 
-/** THE candidate ordering — score, then preference group, then readability, then enumeration
+/** THE candidate ordering — score, then preference, then readability, then enumeration
  *  order. Exported because there are TWO drivers over the same enumeration (this module's sync
  *  `rankBy` for the Node/objdiff scorer, and the webapp's async await-loop for the wasm one), and
  *  a per-driver copy would let the same input produce two different winners.
  *
- *  SCORE dominates absolutely: the differ is the fitness function, and a tie means the axis that
- *  separates these two spellings did not change the bytes — so everything below only chooses what
+ *  SCORE dominates absolutely: the differ is the fitness function, and a tie means the variation
+ *  that separates these two candidates did not change the bytes — so everything below only chooses what
  *  the READER sees, and can never cost a match.
  *
- *  GROUP next: a named symbol-map spelling beats its `/raw-globals` sibling at equal bytes.
+ *  PREFERENCE next: a named symbol-map spelling beats its `/raw-globals` sibling at equal bytes.
+ *
+ *  DEVICE VOLATILITY next: at equal bytes, the spelling that qualifies a DEVICE REGISTER
+ *  (`capabilities.deviceRegisters`) is the one to publish. A dropped `volatile` on an MMIO cell is
+ *  a real bug in the C that only this compiler at these flags hides — the differ cannot referee
+ *  it, because the compiler was not exploiting the non-volatility on this input. Gated on the
+ *  window rather than counting the word, because outside it the qualifier is a claim about
+ *  ordinary memory that the asm does not support — over the bench, counting the word
+ *  alone decides twelve rows and only two of them touch a device address. A declared term rather
+ *  than an enumeration order, which an unrelated variation's candidates can slide between.
  *
- *  CAST COUNT next, and only WITHIN a group. A wrong signedness pin is what manufactures casts —
+ *  IT IS A PREFERENCE, AND EVERY NEW MINTER INHERITS IT. `deviceVolatileClaims` only ever ADDS a
+ *  claim, so any variation that qualifies a device access wins its own tie by construction: when
+ *  `/vol-store` joined the roster, six rows changed their published `winnerVariations` and `source`
+ *  with no score and no outcome moving. That is a judgement about the source rather than a
+ *  measurement of it — the differ never refereed those six — and it is the same judgement this
+ *  term was declared to make, taken on the same evidence. What it must never do is change WHICH
+ *  candidates exist; that stays an admission question, one variation at a time.
+ *
+ *  CAST COUNT next, and only WITHIN a preference. A wrong signedness pin is what manufactures casts —
  *  the C backend has to cast a shift operand back to the signedness the machine op needs, so
  *  pinning `u32` on a genuinely-signed parameter buys `s32 f(u32 a0) { return (s32)a0 >> a1; }`
  *  for the same bytes as `s32 f(s32 a0) { return a0 >> a1; }`. Before the backend synthesized that
  *  cast the wrong pin simply lost on score; now it ties, and enumeration order alone would
  *  silently install the noisier spelling.
  *
+ *  LINE COUNT next, the other half of the same job: two spellings can tie on score AND on casts
+ *  and still differ by a whole control-flow shape — a `/defsite`-anchored `v0 = 0; if (c) v0 = 1;`
+ *  against the braced `if/else` its sibling emits. Counted the way the report counts it
+ *  (apps/benchmark/src/eval/quality.ts `lines`), for the same reason `castCount` is: ranking must
+ *  not optimize for something the published metric measures differently.
+ *
  *  ENUMERATION ORDER last, which makes this a strict total order (indices are unique) and the
  *  result deterministic. Spelled explicitly rather than leaning on Array#sort's stability, which
- *  would make each preference an accident of two unrelated decisions. */
+ *  would make each preference an accident of two unrelated decisions.
+ *
+ *  WHAT NO TERM HERE WEIGHS: a comparison's rendered SIGNEDNESS. `/uns-cmp`'s whole output is
+ *  that polarity, and it carries in a DECLARED TYPE rather than a cast — `castCount` reads 0 on
+ *  both sides of the tie it loses — so at equal bytes enumeration order decides, and a rival
+ *  variation's candidate can publish a signed compare where the asm's is unsigned. Weighing it needs
+ *  the candidate's own SFn and the icmp facts it was structured from, neither of which this
+ *  comparator carries; `deviceVolatile` is the shape such a term would take. */
 export function compareScored<S extends { score: number }>(
   a: Candidate & { score: S; order: number },
   b: Candidate & { score: S; order: number },
 ): number {
   return (
-    a.score.score - b.score.score || a.group - b.group || castCount(a.source) - castCount(b.source) || a.order - b.order
+    a.score.score - b.score.score ||
+    a.preference - b.preference ||
+    (b.deviceVolatile ?? 0) - (a.deviceVolatile ?? 0) ||
+    castCount(a.source) - castCount(b.source) ||
+    lineCount(a.source) - lineCount(b.source) ||
+    a.order - b.order
   );
 }
 
+/** Non-blank lines in a candidate's rendered source — the compactness tie-break above, counted
+ *  exactly as `quality.ts` counts `lines`. Deterministic, and total on any string. */
+function lineCount(source: string): number {
+  return source.split('\n').filter((l) => l.trim().length > 0).length;
+}
+
 /** Scalar casts in a candidate's rendered source — the readability tie-break above.
  *
- *  A TEXT count over the emitted string, matching how the benchmark's own readability metric
- *  measures the same thing (apps/benchmark/src/eval/quality.ts) — the two must agree about what
- *  "cast noise" means, or ranking optimizes for something the report then scores differently.
+ *  A WITHIN-PREFERENCE tie-break over two spellings of ONE function, and deliberately NARROWER than
+ *  the published readability metric (apps/benchmark/src/eval/quality.ts `casts`): it counts the
+ *  decomp SCALAR typedef vocabulary only — `(u8)` … `(s32)` — so a pointer, struct or C-keyword
+ *  cast is not read as noise, those being structural spellings a candidate does not choose.
+ *
+ *  ONE exemption, the `&` form: `(u32)&gSym` / `(s32)&gSym` is the CORRECT source spelling of
+ *  integer arithmetic on a link-time address, which decomp projects write themselves, and
+ *  counting it would penalize precisely the named spelling this ranking is supposed to prefer.
  *
- *  It counts the decomp typedef vocabulary only, so a pointer or struct cast is not read as noise
- *  — those are structural spellings a candidate does not choose. And it carries `quality.ts`'s
- *  ADDRESS-CAST exemption: `(u32)&gSym` / `(s32)&gSym` is the CORRECT source spelling of integer
- *  arithmetic on a link-time address, which decomp projects write themselves. Counting it would
- *  penalize precisely the named spelling this ranking is supposed to prefer.
+ *  NOT a second copy of the published metric, and it must not be read as one: that one counts a
+ *  wider vocabulary and exempts more, so a number here is not comparable to a number there. What
+ *  the two share is only the direction — fewer casts reads better.
  *
  *  Deterministic, and total on any string. */
 function castCount(source: string): number {
@@ -517,7 +2311,9 @@ function castCount(source: string): number {
   return all - addr;
 }
 
-/** First line of whatever the scorer threw — the compiler's own diagnostic, not a stack. */
+/** First line of whatever a variation, a backend or the scorer threw — the compiler's own diagnostic,
+ *  not a stack. TOTAL on any value, including a non-Error throw, so no caller has to re-spell the
+ *  `instanceof` test; a caller wanting a word for "nothing was thrown" supplies it at the call. */
 function firstLine(e: unknown): string {
-  return e instanceof Error ? e.message.split('\n')[0] : String(e ?? 'no candidate produced');
+  return e instanceof Error ? e.message.split('\n')[0] : String(e);
 }