@asmlift/core 0.6.0 → 0.7.0

package/src/raise/globalshape.ts

@@ -164,10 +164,12 @@ import type { SFn } from '../l3/ast';
 import { type Gate, firstRejection } from '../l3/gates';
 import type { SymbolInfo } from '../symbols';
 import type { TargetDescription } from '../target';
+import { type ScaledExtension, foldablePairs, foldsShiftPairCasts } from './extscale';
 
 /** One additive term of an address residual: `v` scaled by `scale`, or a pure constant.
- *  `scaleOp` is the op that DID the scaling (a `shl`/`mul`), which is what carries the position
- *  the order licence reads; a term at scale 1 has none. */
+ *  `scaleOp` is the op that DID the scaling (a `shl`/`mul`, or the right shift of a fused cast —
+ *  see `scaleOf`), which is what carries the position the order licence reads; a term at scale 1
+ *  has none. */
 interface Term {
   scale: number;
   /** null ⇒ a constant term, whose value is `konst` */
@@ -618,8 +620,18 @@ function useIndex(fn: Fn): Map<Value, Op[]> {
 }
 
 /** `x * K` / `x << k` read as a scale, or scale 1 for anything else. A CONSTANT operand makes the
- *  whole term constant instead (`const << 2` is a displacement, not a subscript). */
-function scaleOf(v: Value, defs: Map<Value, Op>): Term {
+ *  whole term constant instead (`const << 2` is a displacement, not a subscript).
+ *
+ *  …and a narrowing cast FUSED with its scale, `shr(shl(x, 24), 21)` — `(u8)x << 3` after agbcc's
+ *  combiner merged the pair's right half into the scale. Its RIGHT shift is the scaling op:
+ *  compiled, `gTbl[i]` over a `u8 i` is `lsl` / `ldr` / `lsr` and `((u16 *)gTbl)[i]` is `lsl` /
+ *  `lsr` / `ldr`, so the right half is where the order fork shows. A constant under the pair keeps
+ *  the scale-1 reading — `const` folds that pair to its value before anything spells it.
+ *
+ *  `fused` is raise/extscale.ts's own `foldablePairs`, or null where the target keeps the fold off,
+ *  so a pair is read as a scale exactly when the fold will take it: a scale read anywhere else would
+ *  license an element no pass legalizes. */
+function scaleOf(v: Value, defs: Map<Value, Op>, fused: Map<Op, ScaledExtension> | null): Term {
   const d = defs.get(v);
   const constOf = (x: Value): number | null => {
     const dx = defs.get(x);
@@ -638,6 +650,10 @@ function scaleOf(v: Value, defs: Map<Value, Op>): Term {
       ? { scale: 1 << k, v: d.operands[0], konst: 0, scaleOp: d }
       : { scale: 1, v, konst: 0, scaleOp: null };
   }
+  const pair = d === undefined ? undefined : fused?.get(d);
+  if (d !== undefined && pair !== undefined && constOf(pair.src) === null) {
+    return { scale: 1 << pair.shift, v: pair.src, konst: 0, scaleOp: d };
+  }
   if (d?.opcode === 'mul') {
     for (const [a, b] of [
       [d.operands[0], d.operands[1]],
@@ -655,7 +671,7 @@ function scaleOf(v: Value, defs: Map<Value, Op>): Term {
 /** The additive terms of a byte residual. Only `add` is opened: a `sub` at the top of the tree
  *  makes a term's sign depend on the walk, and a NEGATIVE stride is not an array subscript this
  *  spelling can express, so it refuses rather than dropping the sign. */
-function residualTerms(root: Value, defs: Map<Value, Op>): Term[] | null {
+function residualTerms(root: Value, defs: Map<Value, Op>, fused: Map<Op, ScaledExtension> | null): Term[] | null {
   const out: Term[] = [];
   const walk = (v: Value, depth: number): boolean => {
     if (depth > 16) {
@@ -668,7 +684,7 @@ function residualTerms(root: Value, defs: Map<Value, Op>): Term[] | null {
     if (d?.opcode === 'add') {
       return walk(d.operands[0], depth + 1) && walk(d.operands[1], depth + 1);
     }
-    out.push(scaleOf(v, defs));
+    out.push(scaleOf(v, defs, fused));
     return true;
   };
   return walk(root, 0) ? out : null;
@@ -691,19 +707,23 @@ function residualTerms(root: Value, defs: Map<Value, Op>): Term[] | null {
  *  say in the type. */
 function accessesBySymbol(
   fn: Fn,
+  target: TargetDescription,
   gates: readonly Gate<AddressUse>[],
 ): Map<string, ElementAccess[] | { refusedBy: string }>;
 function accessesBySymbol(
   fn: Fn,
+  target: TargetDescription,
   gates: readonly Gate<AddressUse>[],
   interiorIsEvidence: true,
 ): Map<string, Access[] | { refusedBy: string }>;
 function accessesBySymbol(
   fn: Fn,
+  target: TargetDescription,
   gates: readonly Gate<AddressUse>[],
   interiorIsEvidence = false,
 ): Map<string, Access[] | { refusedBy: string }> {
   const defs = defOpMap(fn);
+  const fused = foldsShiftPairCasts(target) ? foldablePairs(fn, defs) : null;
   const uses = useIndex(fn);
   const out = new Map<string, Access[] | { refusedBy: string }>();
   const refuse = (sym: string, id: string): void => void out.set(sym, { refusedBy: id });
@@ -728,7 +748,7 @@ function accessesBySymbol(
       for (const u of gUses) {
         const isAdd = u.opcode === 'add';
         const other = isAdd ? (u.operands[0] === base ? u.operands[1] : u.operands[0]) : undefined;
-        const terms = other === undefined ? null : residualTerms(other, defs);
+        const terms = other === undefined ? null : residualTerms(other, defs, fused);
         const consumers = (isAdd ? (uses.get(u.results[0]) ?? []) : []).map((m) => {
           const isLoad = m.opcode === 'load' && m.operands[0] === u.results[0];
           const isStore = m.opcode === 'store' && m.operands[0] === u.results[0];
@@ -903,8 +923,8 @@ function extentsOf(strides: number[]): number[] | null {
  *  same addresses whichever one a consumer picked up.
  *
  *  This exists because the SPELLING and the DECLARATION are decided from different derivations —
- *  rank.ts derives the declaration dictionary once off the probe's lift and the spelling per
- *  symbol variant off that variant's own — and a candidate that spells from one and declares from
+ *  rank.ts derives the declaration dictionary once off the shared lift and the spelling per
+ *  lift off that lift's own — and a candidate that spells from one and declares from
  *  the other addresses a different object than the assembly did, compiling either way. */
 export function sameDerivedShape(a: SymbolInfo | undefined, b: SymbolInfo | undefined): boolean {
   if (a === undefined || b === undefined) {
@@ -934,7 +954,7 @@ export function inferGlobalArrays(
     return out;
   }
   const pos = positions(fn);
-  for (const [sym, accs] of accessesBySymbol(fn, gates.address)) {
+  for (const [sym, accs] of accessesBySymbol(fn, target, gates.address)) {
     const si = Array.isArray(accs) ? shapeOf(accs, pos, gates.shape) : null;
     if (si !== null) {
       out.set(sym, si);
@@ -968,7 +988,7 @@ export function orderLicensedGlobals(
     return out;
   }
   const pos = positions(fn);
-  for (const [sym, accs] of accessesBySymbol(fn, gates.address, true)) {
+  for (const [sym, accs] of accessesBySymbol(fn, target, gates.address, true)) {
     if (Array.isArray(accs) && firstRejection(gates.shape, evidenceOf(accs, pos)) === null) {
       out.add(sym);
     }
@@ -991,7 +1011,7 @@ export function arrayShapeRefusals(
     return out;
   }
   const pos = positions(fn);
-  for (const [sym, accs] of accessesBySymbol(fn, gates.address)) {
+  for (const [sym, accs] of accessesBySymbol(fn, target, gates.address)) {
     out.set(sym, Array.isArray(accs) ? firstRejection(gates.shape, evidenceOf(accs, pos)) : accs.refusedBy);
   }
   return out;

package/src/raise/gvn.ts

@@ -64,9 +64,9 @@
 //
 // Several modules answer "is this address a local?" with independent policies — here: never;
 // basecse: at whichever of the two positions `l3/hoist.ts` is handed (the COMMITTED call states
-// the function top, its roster admissions also offer each init's first use), when the gate table
+// the function top, its roster's hoists also offer each init's first use), when the gate table
 // admits the base; l3/scopebase.ts: at the innermost scope holding the uses; l3/argbase.ts:
-// immediately before a call whose arguments share it. The newer placement levers — l3/nearbase.ts,
+// immediately before a call whose arguments share it. The newer placement variations — l3/nearbase.ts,
 // l3/inlinebase.ts, l3/homesplit.ts — answer it too, each with its own.
 // Reconciling them is recorded debt, and the same test pins the two places they actively disagree, because a
 // consolidation has to PICK rather than discover them: a `for`'s init (basecse reads it at loop

package/src/raise/magicdiv.ts

@@ -56,7 +56,7 @@ function magicS(d: number): { M: number; s: number } {
 }
 
 /** Forward UNSIGNED magic generator (Hacker's Delight §10-8). Returns the multiplier `M`, shift `s`,
- *  and the `add` indicator (true ⇒ the "add-correction" variant that needs an extra `+x` term —
+ *  and the `add` indicator (true ⇒ the "add-correction" form that needs an extra `+x` term —
  *  matched by matchUnsignedAddCorrection, not the simple `mulhu>>s` shape). */
 function magicU(d: number): { M: number; s: number; add: boolean } {
   const u = (x: number) => x >>> 0;
@@ -312,7 +312,7 @@ function matchSignedMagic(ctx: Ctx, mul: Op): Match | null {
 }
 
 /** Match the SIMPLE unsigned magic-division DAG `shr_u(mulhu(x, M), s)` (no correction) and
- *  reconstruct+verify the divisor. The add-correction variant (`t + ((x−t)>>1)`) is not matched
+ *  reconstruct+verify the divisor. The add-correction form (`t + ((x−t)>>1)`) is not matched
  *  here — its `mulhu` result feeds a `sub`, not a direct `shr_u`, so this matcher naturally declines it. */
 function matchUnsignedSimpleMagic(ctx: Ctx, mul: Op): Match | null {
   const bound = bindMulOperands(ctx, mul);

package/src/raise/memberarrays.ts

@@ -32,16 +32,16 @@
 // produces no site here. `synthetic:basefold` is that control — its reference IS the cast spelling
 // — and it MATCHES today, untouched.
 //
-// A DEFAULT, NOT A RANKED AXIS, and the reason is a measurement rather than a preference. An axis
+// A DEFAULT, NOT A RANKED VARIATION, and the reason is a measurement rather than a preference. A variation
 // exists where two source spellings collapse onto one asm, so nothing but the differ can separate
 // them. Here the asm separates them itself — line one folds `+K` into the memory operand and
 // produces NO site — so `add(P, K)` feeding an off-0 scaled access is evidence AGAINST the spelling
-// asmlift emits today, not a coin flip. And an axis at this level is a LIFT variant (`/setup-args`'s
+// asmlift emits today, not a coin flip. And a variation at this level is a LIFT variation (`/setup-args`'s
 // position in rank.ts), doubling the whole candidate product for every function with a site: swept
 // over 2288 sa3 and 412 klonoa functions in both symbol-map configurations, the gates below admit
 // two bases, in one function, which declines for an unrelated reason — so the price would be paid
 // to referee a question the corpus never poses. What is NOT settled is line two, and that is a
-// different question: where a base LOCAL goes is the L3 base-local levers' business, taken over
+// different question: where a base LOCAL goes is the L3 base-local variations' business, taken over
 // whatever type the recovery mints, not a second answer to the TYPE this pass decides.
 //
 // WHY THE TRAILING COUNT IS A GATE RATHER THAN A GUESS, and it is the struct's SIZE that makes it
@@ -52,7 +52,7 @@
 // only once the object is big enough. So a count is not a fact to derive but a free parameter with
 // a byte-observable LOWER BOUND, and inventing one invents a size. The count is therefore read off
 // the loop that walks the member — `boundedCount` below — and the whole base DECLINES when no
-// counted loop states one. An INTERIOR member's count is not a choice at all: it is forced by the
+// counted loop states one. An INTERIOR member's count is not an open question at all: it is forced by the
 // member that follows it.
 //
 // THE SIBLING PASSES, and why this is a third one rather than a case inside either.

package/src/raise/narrowlocal.ts

@@ -364,8 +364,24 @@ function mergeArms(preds: Map<Block, Block[]>, fn: Fn, blk: Block): [Block, Bloc
  *      is its jump has none.
  *
  *  Over-refusal here is free by construction: it returns the carrier to the wide-local-plus-cast
- *  spelling this pass emits without the clause. */
-function armIsOneSet(b: Block): boolean {
+ *  spelling this pass emits without the clause.
+ *
+ *  A SECOND READER, AND WHY THE PREDICATE IS SHARED RATHER THAN RE-DERIVED. `raise/retsink.ts`'s
+ *  `arms-are-one-set` asks this same question of the same optimizer for a different purpose: a
+ *  merge-variable select whose arms this guard would have collapsed never comes back as a diamond,
+ *  so a TARGET holding one was written with early returns. Compiled both ways with agbcc -O2
+ *  -mthumb and committed (`test/corpus/agbcc-select-{merge,early}.s`), the three bullets above hold
+ *  term for term in that direction too: `selcomp` (`v = a + b`, one SET) loses its diamond in the
+ *  merge spelling and keeps it in the early one; `selload` (`v = *p`) keeps a diamond in BOTH,
+ *  carrying no information; `selcomp3` (three ops) likewise. ONE DIFFERENCE IS WORTH NAMING: the
+ *  constant bullet's "refusing the foldable case costs nothing" is an argument about THIS pass's
+ *  fallback, and it does not transfer — `selk3` (`v = a + 3`) is one `adds`, so `jump.c`'s own guard
+ *  counts one SET where this predicate counts two, and retsink's refusal of it costs a candidate
+ *  there rather than nothing. That divergence is argued from the optimizer rather than compiled:
+ *  `selk3` is deliberately outside the committed pair. It still never costs an ANSWER (every
+ *  clause in that table is `sound: false`), so the shared conservative predicate is the right one
+ *  until a row asks for the cost model neither pass has. */
+export function armIsOneSet(b: Block): boolean {
   return (
     !b.ops.some((op) => REEVAL_UNSAFE_OPS.has(op.opcode)) && b.ops.filter((op) => op.results.length > 0).length === 1
   );

package/src/raise/paramwidth.ts

@@ -43,6 +43,15 @@
 // What that refusal protects is a function this pass never compiles: agbcc truncates at every
 // PROTOTYPED CALL SITE of a narrow-declared callee — `lsl/asr` ahead of the `bl`, two Thumb
 // instructions per site — so a wrong width here costs bytes the per-function differ cannot see.
+//
+// FUSED BEHIND A POOL LOAD. The prologue scan steps over a pool-loaded address, and a body cast
+// with nothing else ahead of it — `gB = gW[(u8)a]` is `ldr r2,=gB / ldr r1,=gW / lsl r0,#24 /
+// lsr r0,#22` — reaches it looking like a declaration once raise/extscale.ts has re-split the fused
+// pair. The fold knows where the machine put that `lsl` and records it (`ScaleRecord.behindPool`),
+// and `fused-behind-pool` reads the record: an unsigned declared parameter's `lsl` precedes every
+// pool load in the benchmark's agbcc references (extscale.ts's header has the census). Only the
+// fold's own extensions are judged this way; a plain cast's extension sits at its right shift,
+// where its position says nothing about its `lsl`'s.
 import { type Fn, type Op, type Value, replaceAllUsesWith, successorsOf } from '../ir/core';
 import { CAST_WIDTHS, MATERIALIZING_OPS } from '../ir/opcodes';
 import { T } from '../ir/types';
@@ -63,6 +72,9 @@ export interface NarrowParamCandidate {
   uses: number;
   /** the width the caller's own prototype declares for this parameter, if it declares one */
   declared: number | undefined;
+  /** the extension is one raise/extscale.ts re-split from a fused pair whose `shl` the machine ran
+   *  behind a pool load — see FUSED BEHIND A POOL LOAD */
+  fusedBehindPool: boolean;
 }
 
 export const PARAM_WIDTH_GATES: readonly Gate<NarrowParamCandidate>[] = [
@@ -108,6 +120,13 @@ export const PARAM_WIDTH_GATES: readonly Gate<NarrowParamCandidate>[] = [
     guardedBy: 'param-width.test.ts: an extension behind a nullary call is body code',
     rejects: (c) => !c.inPrologue,
   },
+  {
+    id: 'fused-behind-pool',
+    why: 'a fused cast behind a pool load is body code if unsigned, and either width is the same object if signed',
+    sound: true,
+    guardedBy: 'extscale.test.ts: a body cast behind nothing but a pool load keeps its parameter wide',
+    rejects: (c) => c.fusedBehindPool,
+  },
 ];
 
 /** How many times `v` is read anywhere in `fn` — op operands and branch arguments alike. */
@@ -125,12 +144,14 @@ function useCount(fn: Fn, v: Value): number {
 }
 
 /** Type an entry parameter at the width its prologue extension proves, and drop the extension.
- *  `self` is the prototype the caller supplied for THIS function, if any. Returns the number of
- *  parameters narrowed. */
+ *  `self` is the prototype the caller supplied for THIS function, if any; `fusedBehindPool` is
+ *  raise/extscale.ts's record of the extensions it re-split behind a pool load
+ *  (`ScaleRecord.behindPool`). Returns the number of parameters narrowed. */
 export function narrowEntryParams(
   fn: Fn,
   self?: FnProto,
   gates: readonly Gate<NarrowParamCandidate>[] = PARAM_WIDTH_GATES,
+  fusedBehindPool: ReadonlySet<Op> = new Set(),
 ): number {
   const entry = fn.blocks[0];
   const declared = Array.isArray(self?.params) ? self.params.map(declaredWidth) : [];
@@ -166,6 +187,7 @@ export function narrowEntryParams(
       inPrologue: prologue.has(op),
       uses: useCount(fn, p),
       declared: declared[entry.params.indexOf(p)],
+      fusedBehindPool: fusedBehindPool.has(op),
     };
     if (firstRejection(gates, c) !== null) {
       continue;

package/src/raise/pre-recovery.ts

@@ -18,12 +18,21 @@ import type { TargetDescription } from '../target';
 import { recognizeArrays } from './arrays';
 import { recognizeConsts } from './const';
 import { recognizeDivPow2 } from './divpow2';
+import {
+  type PoolOrder,
+  type ScaleRecord,
+  emptyScaleRecord,
+  foldScaledExtensions,
+  foldsShiftPairCasts,
+  poolOrderOf,
+  restoreUnclaimedScales,
+} from './extscale';
 import { numberPureValues } from './gvn';
 import { recognizeMagicDivision } from './magicdiv';
 import { recognizeMemberArrays } from './memberarrays';
 import { rerootNarrowReads } from './narrow';
 import { type MergeShape, mergeShapes, narrowBlockLocals } from './narrowlocal';
-import { narrowEntryParams } from './paramwidth';
+import { PARAM_WIDTH_GATES, narrowEntryParams } from './paramwidth';
 import { type BranchShortCircuitOptions, recognizeBranchShortCircuit, recognizeShortCircuit } from './shortcircuit';
 import { recognizeSoftDiv } from './softdiv';
 import { recognizeStructArrays } from './struct-arrays';
@@ -34,7 +43,7 @@ import { recognizeStructs } from './structs';
  *  A field here selects between spellings its pass can already produce; none of them relaxes a
  *  soundness refusal, and each recognizer documents its own. */
 export interface PreRecoveryOptions {
-  /** raise/shortcircuit.ts `recognizeBranchShortCircuit` — the connective-vs-comparison-tree axis. */
+  /** raise/shortcircuit.ts `recognizeBranchShortCircuit` — the connective-vs-comparison-tree question. */
   shortCircuit?: BranchShortCircuitOptions;
 }
 
@@ -44,9 +53,18 @@ export interface PreRecoveryOptions {
  *  by then divpow2 has deleted a block, both short-circuit folds have rewritten edges, and the
  *  eight `dce: true` passes have changed op counts. So the driver reads it here and hands it down. */
 export interface PreRecoveryFacts {
-  /** the join shape of every block, for raise/narrowlocal.ts's `edge-extends`. Blocks a later pass
-   *  creates are absent, and absent reads as "no diamond" — the refusing direction. */
+  /** the join shape of every block, for raise/narrowlocal.ts's `edge-extends` and, downstream of
+   *  pre-recovery entirely, raise/retsink.ts's `pre-diamond`. Blocks a later pass creates are
+   *  absent, and absent reads as "no diamond" — the refusing direction, in both readers. */
   mergeShapes: Map<Block, MergeShape>;
+  /** which entry-block ops the machine ran after its first pool-loaded address, for
+   *  raise/extscale.ts's behind-a-pool-load record. Read HERE because `addrnum`, the first pass,
+   *  hoists duplicated addresses to the head of the entry block and that order is gone after it. */
+  poolOrder: PoolOrder;
+  /** THE ONE FACT A PASS WRITES rather than the lift: what raise/extscale.ts's fold made, for the
+   *  two passes after it that read it — paramwidth's `fused-behind-pool` gate and
+   *  `extscale-restore`. Empty until the fold runs. */
+  scales: ScaleRecord;
 }
 
 export interface PreRecoveryPass {
@@ -55,7 +73,9 @@ export interface PreRecoveryPass {
   /** run the recognizer; returns a truthy value (a change count, or `true`) iff it CHANGED the IR.
    *  `self` is the prototype the caller supplied for the function being raised — read only by
    *  parameter-width, which checks its inference against a declared width. `lifted` is the
-   *  pre-pass CFG snapshot — read only by narrow-local. */
+   *  pre-pass snapshot — read by narrow-local (its CFG) and scaled-extension (its entry order) —
+   *  plus the fold's record, which scaled-extension writes and parameter-width and
+   *  scaled-extension-restore read. */
   run: (
     fn: Fn,
     self: FnProto | undefined,
@@ -70,9 +90,10 @@ export interface PreRecoveryPass {
 }
 
 /** THE ordered pre-recovery pass list — the single source of truth shared by pipeline / rank / report.
- *  address-numbering → const-materialize → magic-division → pow2-division → soft-division → array-legalize →
- *  struct-array → member-array → struct-pointer → short-circuit → branch-short-circuit → narrow-reads →
- *  narrow-local → parameter-width. See each recognizer's file for the rationale. */
+ *  address-numbering → const-materialize → magic-division → pow2-division → soft-division →
+ *  scaled-extension → array-legalize → struct-array → member-array → struct-pointer → short-circuit →
+ *  branch-short-circuit → narrow-reads → narrow-local → parameter-width → scaled-extension-restore.
+ *  See each recognizer's file for the rationale. */
 export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
   // FIRST: collapsing duplicate address definitions removes block params every later recognizer
   // would otherwise have to reason around, and it can only shrink the value graph.
@@ -81,10 +102,11 @@ export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
     // Numbering alone is not enough and not safe to ship alone: collapsing the duplicates leaves a
     // block param whose edges now all carry one value, and the structurer still destroys THAT into
     // a local (it only reuses a name a carrier already has, and an inlined `gaddr` has none).
-    // Numbering alone costs kleod:UpdateHUDCounterDisplay its match, so the pair is the atomic
-    // unit, expressed as a body rather than a sum of two unrelated counts. It is NOT monotone,
-    // which is worth knowing before tuning either half: dropping the cleanup IMPROVES
-    // kleod:ConfigureEntityBehavior and kleod:CountCollectedGems, neither of them near matching.
+    // Numbering alone cost kleod:UpdateHUDCounterDisplay its match (measured on kleod's
+    // kl-eod-decomp rows, retired 2026-09-13), so the pair is the atomic unit, expressed as a body
+    // rather than a sum of two unrelated counts. It was NOT monotone, which is worth knowing before
+    // tuning either half: dropping the cleanup IMPROVED kleod:ConfigureEntityBehavior and
+    // kleod:CountCollectedGems, neither of them near matching then.
     run: (fn) => {
       const n = numberPureValues(fn);
       return n + simplifyTrivialPhis(fn);
@@ -100,6 +122,17 @@ export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
   // beside magicdiv so that a reader looking for division recovery finds both together.
   { id: 'divpow2', run: recognizeDivPow2, dce: true },
   { id: 'softdiv', run: (fn) => recognizeSoftDiv(fn), dce: false, gate: (t) => !t.capabilities.hwDivide },
+  // AFTER `const`, which folds a shift pair over a constant to the constant it computes, and BEFORE
+  // the three array recognizers, whose input this pass produces: `shl(ext(x), k)` is an element
+  // scale they legalize and the fused pair is not. `dce: true` — the `shl` a fold leaves readerless.
+  // It reads `lifted.poolOrder`, the entry block's order before `addrnum` hoisted its addresses,
+  // and writes `lifted.scales`.
+  {
+    id: 'extscale',
+    run: (fn, _self, _opts, _target, lifted) => foldScaledExtensions(fn, lifted.poolOrder, lifted.scales),
+    dce: true,
+    gate: foldsShiftPairCasts,
+  },
   { id: 'arrays', run: recognizeArrays, dce: true },
   // struct-arrays AFTER arrays (scalar stride==width shapes are claimed first — see the
   // discriminator note in raise/struct-arrays.ts) and BEFORE structs (an element's field
@@ -128,28 +161,35 @@ export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
   // counts 0 fused heads across the 782 rows that lift map-lessly, so the hazard has no producer
   // there. The reverse direction never could: the value form replaces its head's `cond_br` with a
   // `br`, which this pass never matches.
+  // The `target` argument is read by ONE conjunct of ONE gate, as at `narrowlocal` below:
+  // `read-behind-effect`'s "a local costs a second load", compiled on all five bench toolchains and
+  // true on agbcc alone (raise/shortcircuit.ts, target.ts `reloadsLocalReread`).
   {
     id: 'branch-shortcircuit',
-    run: (fn, _self, opts) => recognizeBranchShortCircuit(fn, opts.shortCircuit),
+    run: (fn, _self, opts, target) =>
+      recognizeBranchShortCircuit(fn, {
+        ...opts.shortCircuit,
+        reloadsLocalReread: target.compilerBehaviors.reloadsLocalReread,
+      }),
     dce: true,
   },
   // LAST, and the position IS load-bearing: this pass reads the CFG's edge arguments to find a
   // loop variable's next value, and both short-circuit folds above rewrite the very edges it reads.
   // `dce: false` — the rewrite orphans nothing, since the operand it drops keeps its other use.
   { id: 'narrow', run: rerootNarrowReads, dce: false },
-  // The two WIDTH passes, last and in either order relative to each other: each only DELETES an
-  // extension and retypes the parameter that fed it, so every recognizer above sees the shape it
-  // was written against and neither can match a shape the other creates. They are disjoint by
-  // construction — `narrowlocal` refuses an entry parameter, `paramwidth` reads only entry
-  // parameters — and `narrowlocal` cannot take an extension `narrow` above wants either, since a
-  // parameter carrying BOTH a `zext` and a `sext` has two readers and is refused.
+  // The two WIDTH passes, last of the recognizers and in either order relative to each other: each
+  // only DELETES an extension and retypes the parameter that fed it, so every recognizer above sees
+  // the shape it was written against and neither can match a shape the other creates. They are
+  // disjoint by construction — `narrowlocal` refuses an entry parameter, `paramwidth` reads only
+  // entry parameters — and `narrowlocal` cannot take an extension `narrow` above wants either, since
+  // a parameter carrying BOTH a `zext` and a `sext` has two readers and is refused.
   // `dce: false` on both — the extension each drops is spliced out in place, and its result has no
   // other reader.
   // The `target` argument is read by ONE conjunct of ONE gate — see raise/narrowlocal.ts's
   // `NarrowLocalOptions`. A whole-pass `gate` would be wrong: the pass's SOUND rules are claims
   // about C and run everywhere; only the join-shape evidence is a claim about gcc 2.x's optimizer.
-  // That same conjunct is why this is the one pass reading `lifted`: every pass above it can
-  // rewrite the CFG whose shape it judges.
+  // That same conjunct is why it reads `lifted.mergeShapes`: every pass above it can rewrite the
+  // CFG whose shape it judges.
   {
     id: 'narrowlocal',
     run: (fn, _self, _opts, target, lifted) =>
@@ -161,20 +201,44 @@ export const PRE_RECOVERY_PASSES: PreRecoveryPass[] = [
       ),
     dce: false,
   },
-  { id: 'paramwidth', run: (fn, self) => narrowEntryParams(fn, self), dce: false },
+  {
+    id: 'paramwidth',
+    run: (fn, self, _opts, _target, lifted) => narrowEntryParams(fn, self, PARAM_WIDTH_GATES, lifted.scales.behindPool),
+    dce: false,
+  },
+  // LAST, after every pass that can CLAIM what `extscale` exposed — the two width passes above take
+  // an extension, the array recognizers a scale. What none of them took goes back to the pair the
+  // frontend lifted (raise/extscale.ts, WHAT NOBODY CLAIMED). `dce: true` — the extension it leaves
+  // readerless.
+  {
+    id: 'extscale-restore',
+    run: (fn, _self, _opts, _target, lifted) => restoreUnclaimedScales(fn, lifted.scales),
+    dce: true,
+    gate: foldsShiftPairCasts,
+  },
 ];
 
 /** Run the pre-recovery passes in order. For each pass whose gate passes and that CHANGES the IR, run
  *  `dce` when the pass declares it, then invoke `afterPass(pass, result)` (the caller's verify/trace
- *  hook), if given. */
+ *  hook), if given.
+ *
+ *  RETURNS the facts it read, because a pass AFTER pre-recovery needs one of them too:
+ *  `raise/retsink.ts`'s `pre-diamond` asks whether a return merge was a diamond in the ROM, and
+ *  by its turn `raise/shortcircuit.ts` has manufactured diamonds that were not. The map is the
+ *  driver's to compute — it is the only place that sees `fn` before the first pass — so handing it
+ *  back is cheaper and truer than recomputing something later that cannot be recomputed. */
 export function runPreRecovery(
   fn: Fn,
   target: TargetDescription,
   afterPass?: (pass: PreRecoveryPass, result: number | boolean) => void,
   self?: FnProto,
   opts: PreRecoveryOptions = {},
-): void {
-  const lifted: PreRecoveryFacts = { mergeShapes: mergeShapes(fn) };
+): PreRecoveryFacts {
+  const lifted: PreRecoveryFacts = {
+    mergeShapes: mergeShapes(fn),
+    poolOrder: poolOrderOf(fn),
+    scales: emptyScaleRecord(),
+  };
   for (const pass of PRE_RECOVERY_PASSES) {
     if (pass.gate && !pass.gate(target)) {
       continue;
@@ -187,4 +251,5 @@ export function runPreRecovery(
       afterPass?.(pass, result);
     }
   }
+  return lifted;
 }