@asmlift/core 0.8.1 → 0.10.0

package/src/structure/hazards.ts

@@ -4,32 +4,38 @@
 //   • may this loop's updates be emitted before its condition/exit/post-loop reads, or would some
 //     read then see a clobbered (post-update) value that the original IR read PRE-update — and
 //     which of those reads can be REPAIRED by moving the copy into the body (`sinkable…`);
-//   • is a value the emitted form DROPS redundant — `sameAtEntry`, which reads an expression on
-//     the loop's entry state so a guard about to be fused away can be checked against the test
-//     that replaces it.
+//   • is a value the emitted form DROPS redundant — `sameAtEntry` (ir/entry.ts, shared with the
+//     raise re-roll), which reads an expression on the loop's entry state so a guard about to be
+//     fused away can be checked against the test that replaces it.
 //
-// WHAT MAKES A SUNK COPY LEGAL. The exit edge's value is not moved, it is REBUILT: the copy lands
-// at the top of the body and spells the arg's def-tree again there. Two things have to hold — the
-// tree gives the same answer there, and every name it reads still denotes the same value — and the
-// arg gates in `PREUPDATE_SINK_GATES` are those two plus the degenerate leaf that is neither.
+// WHAT MAKES A SUNK COPY LEGAL. The exit edge's value is not moved, it is REBUILT: the copy spells
+// the arg's def-tree again inside the body, at the point that tree was already computed at
+// (`preUpdateCopyHome`) — or, for an arg the LATCH did not compute, opening it. Two things
+// have to hold — the tree gives the same answer there, and every name it reads still denotes the
+// same value — and the arg gates in `PREUPDATE_SINK_GATES` are those two plus the degenerate leaf
+// that is neither.
 //
-// The tree must give the same answer at the new point. Two ways it might not, and `REEVAL_UNSAFE_OPS`
-// is the registry view that names both. ORDER: the copy opens the body, so a load in the tree would
-// move ahead of every store the body makes, and an effect would move against the others.
-// SPECULATION: the def dominates the latch, and the loop is single-latch at both call sites, but an
-// early-`return` arm still lets an iteration leave BEFORE the latch — so a tree the top of the body
-// evaluates is one that iteration never evaluated, and a trapping divide would fault where the
-// original returned.
+// The tree must give the same answer at the new point. Two ways it might not, and
+// `reevalUnsafe` (ir/discipline.ts) is the question that names both. ORDER: a load re-evaluated after a
+// store the original preceded answers with what the store wrote, and an effect re-evaluated past
+// another is out of order. SPECULATION: a tree evaluated where the original never was — the def
+// dominates the latch, and the loop is single-latch at both call sites, but an early-`return` arm
+// lets an iteration leave BEFORE it, and a trapping divide would fault where the original returned.
 //
-// One gate covers both because `REEVAL_UNSAFE_OPS` answers both, and the candidate carries no arm
-// information to tell them apart. KNOWN COST: a loop with NO early-return arm speculates nothing,
-// so a divide in its exit-arg tree is refused for a hazard it cannot have. Threading "this loop can
-// leave before its latch" into the candidate is what would recover it; no benchmark row asks yet.
+// WHICH OF THE TWO APPLIES IS A FACT ABOUT THE POSITION, so `arg-safe-to-reevaluate` asks per slot
+// rather than refusing the opcode. At the def's own position nothing is speculated at all: every op
+// under the arg dominates that point, so the copy runs only on iterations that evaluated the whole
+// tree — the question reduces to ORDER, and to ORDER only against the ops that run between each
+// one and the copy in the asm but on the other side of it in the C (`movesPast`). Opening the body
+// instead, both hazards are live for the whole body, and the blanket refusal is the answer.
 //
 // And every name the rebuilt expression reads must still denote the same value there. A loop
-// variable does: the update sits at the bottom, so at the top of the body its name holds exactly
-// the value the edge read. A name the body itself defines does NOT — at the top of the body it
-// still holds the previous iteration.
+// variable does: the update sits at the bottom, so anywhere ahead of it the name holds exactly the
+// value the edge read. A name the body itself defines does NOT, wherever the copy lands ahead of
+// the assignment that writes it — and `arg-reads-current-names` refuses every such name but one
+// shape it can place: a def the analysis named ahead of the copy's home — in the latch, or in a
+// block every iteration runs before it (`writtenAheadOf`) — whose statement has run on every
+// iteration that reaches the copy.
 //
 // KNOWN GAP: `body` is the natural-loop body, which EXCLUDES the blocks an early-return arm owns
 // even though their statements are emitted inside the loop. A name assigned only in such an arm is
@@ -42,9 +48,10 @@
 // The maps are captured as LIVE REFERENCES, deliberately: `varName` is still being populated by
 // the naming pipeline when the factory is created, and each hazard check reads whatever names
 // exist at CALL time (emission runs after naming completes). Snapshotting them would break this.
-import { Block, Op, Value } from '../ir/core';
-import { NEGATED_ICMP, REEVAL_UNSAFE_OPS } from '../ir/opcodes';
-import { Stmt } from '../l3/ast';
+import { Block, Op, Value, successorsOf } from '../ir/core';
+import { effectful, orderSensitive, reevalUnsafe } from '../ir/discipline';
+import { sameAtEntry } from '../ir/entry';
+import { Expr, Stmt } from '../l3/ast';
 import { type Gate, firstRejection } from '../l3/gates';
 import type { UseSite } from './analysis';
 
@@ -67,6 +74,9 @@ export interface LoopHazardDeps {
    *  over the operands cannot see what such an op will render, so predicates that reason about
    *  the rendered expression have to treat it as opaque. LIVE, like `varName`. */
   respelledDefs: ReadonlyMap<Op, unknown>;
+  /** where an op's expression is emitted: its own position when it renders as a statement, the one
+   *  consumer it is inlined into otherwise, null when it has no one position (analysis.ts) */
+  emitPos: (op: Op) => { blk: Block; idx: number } | null;
 }
 
 export interface LoopHazards {
@@ -84,18 +94,43 @@ export interface LoopHazards {
     sub: Map<Value, string>,
     updateWrites: Set<string>,
     region: Set<Block> | null,
+    condRepaired?: boolean,
   ): boolean;
+  testSkipsAnEffect(condV: Value, sub: Map<Value, string>): boolean;
+  preUpdateCondFold(
+    condV: Value,
+    negated: boolean,
+    header: Block,
+    backArgs: readonly Value[],
+    exitArgs: readonly Value[],
+    body: Set<Block>,
+    sub: Map<Value, string>,
+    updates: Stmt[],
+    updateWrites: Set<string>,
+    gates?: readonly Gate<PreUpdateCondCandidate>[],
+  ): PreUpdateCondFold;
   sinkablePreUpdateSlots(
     header: Block,
     exit: Block,
     exitArgs: readonly Value[],
     body: Set<Block>,
+    latch: Block,
     sub: Map<Value, string>,
     updateWrites: Set<string>,
     gates?: readonly Gate<SinkCandidate>[],
-  ): Set<number>;
-  sameAtEntry(a: Value, b: Value, entry: Map<Value, Value>, negated?: boolean): boolean;
+    staleOnZeroTrip?: (slot: number) => boolean,
+  ): Map<number, Op | null>;
+  /** `through`: the values whose defining op may be read through (ir/entry.ts `EntryReading`);
+   *  every value when absent. */
+  sameAtEntry(
+    a: Value,
+    b: Value,
+    entry: Map<Value, Value>,
+    negated?: boolean,
+    through?: (v: Value) => boolean,
+  ): boolean;
   loopWriteSet(updates: Stmt[], bodyBlocks: Iterable<Block>, header: Block): Set<string>;
+  loopWriteSetAhead(ahead: Iterable<Block>, incoming: (b: Block) => Value[][], header: Block): Set<string>;
 }
 
 /** The names a loop update assigns (its non-identity copies) — the write set every loop-emission
@@ -103,7 +138,7 @@ export interface LoopHazards {
 export const updateWriteSet = (updates: Stmt[]): Set<string> =>
   new Set(updates.filter((st): st is Extract<Stmt, { k: 'assign' }> => st.k === 'assign').map((st) => st.name));
 
-/** Why an exit arg cannot be REBUILT at the top of the loop body — see the note above
+/** Why an exit arg cannot be REBUILT inside the loop body — see the note above
  *  `PREUPDATE_SINK_GATES`. The walk collects EVERY one it finds, not the first: with one blocker
  *  per gate, stopping early would let ablating one gate disable another on any tree where the
  *  other's blocker happens to be found first, and the ablation would then be measuring less than
@@ -112,7 +147,7 @@ export type ArgBlocker = 'order-sensitive' | 'stale-name' | 'no-definition';
 
 /** One exit slot weighed for sinking. `destName` is the name the sunk copy would write. */
 export interface SinkCandidate {
-  /** everything that stops the arg's def-tree from being rebuilt at the top of the body */
+  /** everything that stops the arg's def-tree from being rebuilt inside the body */
   argBlockers: ReadonlySet<ArgBlocker>;
   destName: string | undefined;
   /** the names of the loop's own variables */
@@ -132,12 +167,20 @@ export const PREUPDATE_SINK_GATES: readonly Gate<SinkCandidate>[] = [
     id: 'arg-safe-to-reevaluate',
     why: 'an effect, a memory read or a trap gives a different answer where the rebuilt copy lands',
     sound: true,
-    guardedBy: 'hazards.test.ts: ablating arg-safe-to-reevaluate admits an exit arg that reads memory',
+    // Sound for a read, a call or a divide: rebuilt behind a store, a read answers with what the
+    // store wrote, and a call or a divide runs behind it. The analysis names a read or a call
+    // something would cross, a helper op an effect would cross, and a divide this move would carry
+    // past a memory access or an effect (`rebuiltPast`), and a named leaf is not rebuilt. What
+    // still reaches the gate through the pipeline is a divide the ISA computes in a body block
+    // that not every iteration runs, whose name would be stale where the copy lands
+    // (`arg-reads-current-names`). The rest of it is reached from a hand-built analysis, which is
+    // its guard.
+    guardedBy: 'hazards.test.ts: ablating arg-safe-to-reevaluate admits an exit arg whose read crosses a store',
     rejects: (c) => c.argBlockers.has('order-sensitive'),
   },
   {
     id: 'arg-reads-current-names',
-    why: 'a value computed in the body still holds the PREVIOUS iteration at the top of it, where the copy lands',
+    why: 'a value computed in the body may still hold the PREVIOUS iteration where the copy lands, unless its named def runs ahead of it on every iteration',
     sound: true,
     guardedBy: 'hazards.test.ts: ablating arg-reads-current-names admits an arg over a body-computed name',
     rejects: (c) => c.argBlockers.has('stale-name'),
@@ -159,72 +202,205 @@ export const PREUPDATE_SINK_GATES: readonly Gate<SinkCandidate>[] = [
   },
   {
     id: 'dest-free-inside-loop',
-    why: 'the name already denotes a value the loop reads, which a write at the top of the body clobbers',
+    why: 'the name already denotes a value the loop reads, which a write inside the body clobbers',
     sound: true,
     guardedBy: 'hazards.test.ts: ablating dest-free-inside-loop admits a name the loop still reads',
     rejects: (c) => c.destBusyInLoop,
   },
 ];
 
-// `x + 0` / `x - 0` / `x | 0` are `x`. Substituting a loop variable by its init constant turns
-// ordinary index arithmetic into exactly these, and a guard that spells the same value without
-// the arithmetic would otherwise compare unequal.
-function fold(defs: Map<Value, Op>, v: Value): Value {
-  const d = defs.get(v);
-  if (!d || d.operands.length !== 2 || !['add', 'sub', 'or'].includes(d.opcode)) {
-    return v;
+/** The `++` a bottom test's pre-update read folds into, or the id of the gate that refused it —
+ *  which is what the decline names, so `PREUPDATE_COND_GATES`'s reasons reach a reader apart. */
+export type PreUpdateCondFold = { name: string; by: 1 | -1 } | { refused: string };
+
+/** Why a bottom test's pre-update read of a loop variable cannot be spelled `n++` — see the note
+ *  above `PREUPDATE_COND_GATES`. */
+export interface PreUpdateCondCandidate {
+  /** the step the update spells: `n = n + 1` is 1, `n = n - 1` is -1, anything else null */
+  step: 1 | -1 | null;
+  /** loop variables the test reads at their pre-update value */
+  preUpdateNames: number;
+  /** how often the rendered test names THIS variable, its own `++` included */
+  mentions: number;
+  /** an op in the test renders something its operand tree does not show (a respelled def) */
+  unreadable: boolean;
+  /** a short-circuit op is reached through an op that is not one, so its arms' reach is unknown */
+  nestedConnective: boolean;
+  /** the folded leaf is evaluated on every iteration that takes the back edge */
+  onContinue: boolean;
+  /** …and on the iteration that leaves the loop */
+  onExit: boolean;
+  /** the value the update computes is read somewhere other than the back edge */
+  updateObserved: boolean;
+}
+
+/** When a loop update may be folded into the bottom test that reads the variable BEFORE it —
+ *  `do { … } while (v0 != 0 && v1++ <= 9)` in place of an update copy at the foot of the body and a
+ *  test one iteration off.
+ *
+ *  THE FOLD IS ABOUT WHEN THE UPDATE RUNS, and C answers that with the short-circuit operators on
+ *  the path from the test's root down to the leaf. Two obligations come out of that, and they are
+ *  the two gates a reader should look for first. The back edge carries `n + 1`, so every iteration
+ *  that re-enters the loop must have evaluated the `++`: that is `folded-on-every-continue`, and it
+ *  is what turns away a leaf under the RIGHT operand of an `||`, where a true left operand
+ *  re-enters the loop having skipped it. And after the loop the variable's name is read as the
+ *  value the back edge computed (`latchSub`), which the exiting iteration only leaves there if it
+ *  evaluated the `++` too — `folded-on-the-exit-too`, asked only where something reads it.
+ *
+ *  Neither obligation is a claim about where the machine put its own update. Where the two disagree
+ *  the emitted C is still correct and the candidate merely does not match, which is the direction to
+ *  be wrong in — and on the agbcc shape the fold exists for they agree, because the short-circuit
+ *  fold (raise/shortcircuit.ts) is what merged the test's blocks into one in the first place.
+ *
+ *  WHAT THIS TABLE DOES NOT JUDGE is the rest of the test. The fold puts the loop into a
+ *  short-circuit spelling and everything else in the bottom test rides along, an EFFECT included —
+ *  that question is `testSkipsAnEffect` below, asked of every `do-while` rather than only of a
+ *  folded one, because the same arm holds the same call whether or not a counter moved into it.
+ *
+ *  `variable-named-once` is C89's own rule rather than this pass's: an object modified between two
+ *  sequence points may not be read again there, and `contracts.ts`'s `assertPostIncrUnshared` is the
+ *  loud backstop for a later pass bringing a second read in.
+ *
+ *  NOT THE WHOLE LIST OF REFUSALS on this decision. The gates judge the DEF TREE; `spellUpdateInCond`
+ *  (structure.ts) asks the mention count again of what the lowering actually rendered, and throws
+ *  its own `StructureError`.
+ *
+ *  `one-pre-update-variable` is sound for a reason that lives in the CALLER: a fold sets
+ *  `condRepaired`, which switches off the whole condition disjunct of `loopUpdateHazard` rather than
+ *  the folded name's share of it. A second pre-update variable would then be emitted under its
+ *  post-update name with every hazard reporting clean. */
+export const PREUPDATE_COND_GATES: readonly Gate<PreUpdateCondCandidate>[] = [
+  {
+    id: 'test-is-readable',
+    why: 'an op that renders something its operand tree does not show hides whether the test names the variable again',
+    sound: true,
+    guardedBy: 'hazards.test.ts: ablating test-is-readable folds through a respelled def',
+    rejects: (c) => c.unreadable,
+  },
+  {
+    id: 'one-pre-update-variable',
+    why: 'two variables read ahead of their updates would need both updates folded into one expression',
+    sound: true,
+    guardedBy: 'hazards.test.ts: ablating one-pre-update-variable repairs one variable and clobbers the other',
+    rejects: (c) => c.preUpdateNames !== 1,
+  },
+  {
+    id: 'update-is-a-unit-step',
+    why: 'C has no read-then-update operator but ++ and --, so no other update has a spelling inside the test',
+    sound: true,
+    guardedBy: 'hazards.test.ts: ablating update-is-a-unit-step declines rather than minting a step-less node',
+    rejects: (c) => c.step === null,
+  },
+  {
+    id: 'variable-named-once',
+    why: 'C89 leaves undefined which value a second read of an object updated in the same expression sees',
+    sound: true,
+    guardedBy: 'hazards.test.ts: ablating variable-named-once folds a test that reads the variable twice',
+    rejects: (c) => c.mentions !== 1,
+  },
+  {
+    id: 'connectives-join-at-the-root',
+    why: 'a short-circuit reached through some other op decides its arms against that op, not against the test',
+    sound: true,
+    guardedBy: 'hazards.test.ts: ablating connectives-join-at-the-root folds an arm of a negated &&',
+    rejects: (c) => c.nestedConnective,
+  },
+  {
+    id: 'folded-on-every-continue',
+    why: 'a short-circuit ahead of the leaf would skip the update on an iteration that re-enters the loop',
+    sound: true,
+    guardedBy: 'hazards.test.ts: ablating folded-on-every-continue folds a leaf under the right operand of an ||',
+    rejects: (c) => !c.onContinue,
+  },
+  {
+    id: 'folded-on-the-exit-too',
+    why: 'the value after the loop is read, so the update has to run on the iteration that leaves as well',
+    sound: true,
+    guardedBy: 'hazards.test.ts: ablating folded-on-the-exit-too folds a leaf an exiting iteration skips',
+    rejects: (c) => c.updateObserved && !c.onExit,
+  },
+];
+
+/** Whether a position inside the bottom test is evaluated on the iterations where the whole test
+ *  answers TRUE, and on the ones where it answers FALSE. Stated about the test's own value rather
+ *  than about the loop's edges because the polarity is the caller's (`negated`). */
+interface Reach {
+  onTrue: boolean;
+  onFalse: boolean;
+}
+
+const ALWAYS: Reach = { onTrue: true, onFalse: true };
+
+/** The reach each operand of a SHORT-CIRCUIT op inherits. These two are the whole set: they are the
+ *  ops `ARITH_TO_BIN` (arith-ops.ts) renders as `&&`/`||` — a test holds the two lists together,
+ *  since a connective missing from here is read as an ordinary op and its arms inherit a reach they
+ *  do not have — and `Expr` has no conditional form besides them, no ternary, so every other op
+ *  evaluates all of its operands whenever it is itself evaluated and they inherit its reach
+ *  unchanged.
+ *
+ *  In `a && b`, `b` runs only where `a` was true: a TRUE whole implies it ran, a FALSE whole does
+ *  not. `a || b` is the dual.
+ *
+ *  BOTH ARMS ARE STATED ABOUT THE OP'S OWN TRUTH, while `Reach` is stated about the WHOLE test's,
+ *  so composing them down a chain is only valid where the two are the same value — a spine of
+ *  connectives from the root. One `icmp_eq %and, 0` between them inverts the polarity and the arm
+ *  answers backwards, which is `connectives-join-at-the-root`'s refusal: a connective reached
+ *  through any other op is not read at all. */
+export const SHORT_CIRCUIT_ARMS: Readonly<Record<string, (i: number, r: Reach) => Reach>> = {
+  logic_and: (i, r) => (i === 0 ? r : { onTrue: r.onTrue, onFalse: false }),
+  logic_or: (i, r) => (i === 0 ? r : { onTrue: false, onFalse: r.onFalse }),
+};
+
+/** How many values a reach walk may visit. Neither memoises — a value two consumers read renders
+ *  twice, and for `preUpdateCondFold` that count IS the fact being measured — so a shared def tree
+ *  costs a walk once per path. Both answer exhaustion the refusing way, `unreadable` and "an effect
+ *  may be skipped": a walk that stopped early has seen part of the test, and the part it did not
+ *  see is the part a permissive answer would be about. */
+const WALK_BUDGET = 4096;
+
+/** The `± 1` an update spells, or null for every other update — `n = n + 1`, `n = 1 + n` and
+ *  `n = n - 1` are the forms with a `++`/`--`. A cast anywhere in the value is null: the cast would
+ *  have to be spelled around the update, which the operator cannot do. */
+function unitStep(value: Expr, name: string): 1 | -1 | null {
+  if (value.k !== 'bin' || (value.op !== '+' && value.op !== '-')) {
+    return null;
   }
-  const z = defs.get(d.operands[1]);
-  return z?.opcode === 'const' && z.attrs?.value === 0 ? fold(defs, d.operands[0]) : v;
+  const isVar = (e: Expr): boolean => e.k === 'var' && e.name === name;
+  const one = (e: Expr): number | null => (e.k === 'const' && Math.abs(e.value) === 1 ? e.value : null);
+  const k = isVar(value.l) ? one(value.r) : value.op === '+' && isVar(value.r) ? one(value.l) : null;
+  return k === null ? null : ((value.op === '-' ? -k : k) as 1 | -1);
 }
 
-// Does `a`, read on a loop's ENTRY values, denote the same thing as `b`? `entry` maps each header
-// param and back-edge arg to the arg the forward edge passes, so substituting through it models
-// the FIRST iteration — the state a guard in front of the loop tested. `negated` compares against
-// b's logical opposite instead, for the usual case where a guard spells the loop's own test the
-// other way round (`beq` to the exit vs `bne` to the header).
+// WHERE A SUNK COPY IS REBUILT. The copy is not carried into the body, it is SPELLED AGAIN
+// there, so the point it belongs at is the one its value was computed at: the arg's own defining
+// op, when that op is one of `latch`'s — the block whose statements both loop emitters render
+// inline, ahead of the update. Null for every other arg, and the copy opens the body instead.
+// THREE args get that answer, not two: one with no position in the body at all (a block param, or
+// a def outside the loop), and one the body DID compute, in a body block that is not the latch.
+// The last is the narrow case and the one a wider sink would widen — the value has a position, it
+// is just not in the block whose `sideEffects` walk is handed the copies.
 //
-// Structural, not semantic: distinct ops with the same opcode, attributes and operands compare
-// equal (two `const 0`s do), anything else does not. A false negative costs a loud decline, which
-// is the direction to be wrong in. Memoised like `readsClobbered`'s `seen`: a value its own
-// consumer reads twice would otherwise double the work at every level.
-function sameAtEntry(defs: Map<Value, Op>, a: Value, b: Value, entry: Map<Value, Value>, negated = false): boolean {
-  const memo = new Map<Value, Map<Value, boolean>>();
-  const sameOp = (da: Op, db: Op, opcodeOk: boolean): boolean =>
-    opcodeOk &&
-    da.operands.length === db.operands.length &&
-    JSON.stringify(da.attrs ?? null) === JSON.stringify(db.attrs ?? null) &&
-    da.operands.every((o, i) => same(o, db.operands[i]));
-  const same = (x0: Value, y0: Value): boolean => {
-    const x = fold(defs, entry.get(x0) ?? x0);
-    const y = fold(defs, y0);
-    if (x === y) {
-      return true;
-    }
-    let row = memo.get(x);
-    if (!row) {
-      memo.set(x, (row = new Map()));
-    }
-    const hit = row.get(y);
-    if (hit !== undefined) {
-      return hit;
-    }
-    const da = defs.get(x);
-    const db = defs.get(y);
-    const r = !!da && !!db && sameOp(da, db, da.opcode === db.opcode);
-    row.set(y, r);
-    return r;
-  };
-  if (!negated) {
-    return same(a, b);
-  }
-  const da = defs.get(fold(defs, entry.get(a) ?? a));
-  const db = defs.get(fold(defs, b));
-  return !!da && !!db && sameOp(da, db, NEGATED_ICMP[da.opcode] === db.opcode);
+// READING AN OP'S INDEX AS THE SOURCE'S STATEMENT ORDER IS A COMPILER CLAIM, and the project
+// names the direction next door: target.ts's `readsStayWhereWritten` declares from compiled pairs
+// that a compiler EMITS a read in the block the source spelled it in, and states outright that
+// the converse — the asm's block is where the source read — is false and may not be defaulted.
+// This is that inference one level down, inside a block, and it consults no target: on a
+// scheduling compiler an op's index is the scheduler's order, not the source's.
+//
+// It owes no declaration because it buys a SPELLING, not an answer. `sideEffects` renders the
+// whole block in that same index order, so a copy placed among those statements agrees with every
+// one of them whatever the compiler did; and the motion that would change an ANSWER is the one
+// `movesPast` measures, in the order it renders. Where the asm's order is not the source's, the
+// failure is a candidate that does not match. Nothing off agbcc reaches it today — 0 sunk copies
+// over the whole `--tier synthetic --toolchain ido7.1` run (163 rows), and the four non-agbcc
+// `loop-preupdate` rows are all mwcc.
+export function preUpdateCopyHome(defs: Map<Value, Op>, opBlock: Map<Op, Block>, a: Value, latch: Block): Op | null {
+  const d = defs.get(a);
+  return d !== undefined && opBlock.get(d) === latch ? d : null;
 }
 
 export function makeLoopHazards(deps: LoopHazardDeps): LoopHazards {
-  const { defs, varName, useSitesOf, liveIn, opBlock, materialize, respelledDefs } = deps;
+  const { defs, varName, useSitesOf, liveIn, opBlock, materialize, respelledDefs, emitPos } = deps;
 
   // The names one loop iteration writes under its VARIABLES' names: the update copies, plus a
   // loop-variable name a materialized body def writes IN PLACE. Adoption (seedLoopParams) makes
@@ -249,6 +425,32 @@ export function makeLoopHazards(deps: LoopHazardDeps): LoopHazards {
     return writes;
   };
 
+  // The same set, for an iteration that leaves part-way through its body rather than at its latch:
+  // the loop-variable names written by the time control reaches the end of `ahead` (the body blocks
+  // between the header and a mid-body `break`). No update copy has run there; a name is written by
+  // a param copy on an edge INTO one of those blocks (`incoming` gives each in-edge's args), unless
+  // every such copy is an identity — the elision `argAssigns` makes — or by a materialized def in
+  // place, as `loopWriteSet` counts it. Only loop-variable names, for `loopWriteSet`'s reason: any
+  // other name is written once per iteration, so a read of it is this iteration's value.
+  const loopWriteSetAhead = (ahead: Iterable<Block>, incoming: (b: Block) => Value[][], header: Block): Set<string> => {
+    const blocks = [...ahead];
+    const writes = loopWriteSet([], blocks, header);
+    const paramNames = new Set(header.params.map((p) => varName.get(p)));
+    for (const bb of blocks) {
+      if (bb === header) {
+        continue;
+      }
+      const ins = incoming(bb);
+      bb.params.forEach((p, k) => {
+        const nm = varName.get(p);
+        if (nm !== undefined && paramNames.has(nm) && ins.some((args) => varName.get(args[k]) !== nm)) {
+          writes.add(nm);
+        }
+      });
+    }
+    return writes;
+  };
+
   // Does rendering `v` under `sub` read a variable that a pending loop update (`updateWrites`, the
   // names it assigns) overwrites, via a path OTHER than a `sub`-mapped back-edge arg? Such a read is a
   // PRE-update value the update clobbers → a read-after-write hazard when the update is emitted first.
@@ -311,8 +513,10 @@ export function makeLoopHazards(deps: LoopHazardDeps): LoopHazards {
     //
     // AND IT DECLINES ONLY BECAUSE OF HOW THE VALUE IS SPELLED. `sinkablePreUpdateSlots` below
     // REPAIRS this hazard, re-emitting the copy inside the body ahead of the update, whenever the
-    // pre-update value crosses the exit as an edge ARG; read from the header PARAM instead it
-    // arrives here, with no exit slot to sink. Both spellings, and the agbcc listing, are in
+    // pre-update value crosses the exit as an edge ARG; a value a body OP computed is named at its
+    // def where the code past the latch's exit reads it (`escapesAheadOfUpdate`, analysis.ts, which
+    // lists where it refuses); read from the header PARAM instead it arrives here, with neither an
+    // exit slot to sink nor an op to name. All three spellings, and the agbcc listing, are in
     // test/loop-preupdate-escape.test.ts. Routing the param one into the sink is a structure.ts
     // change with a fan effect on every row, not an edit to this predicate.
     const escaped = (v: Value): boolean => {
@@ -354,23 +558,192 @@ export function makeLoopHazards(deps: LoopHazardDeps): LoopHazards {
     sub: Map<Value, string>,
     updateWrites: Set<string>,
     region: Set<Block> | null,
+    // The bottom test's own read is spelled `n++` instead of declining (`preUpdateCondFold`), so
+    // the caller has already answered this disjunct. The other two are untouched by that fold: the
+    // update still runs, so an exit slot and an escaped body value still read the post-update name.
+    condRepaired = false,
   ): boolean =>
-    readsClobbered(condV, sub, updateWrites) ||
+    (!condRepaired && readsClobbered(condV, sub, updateWrites)) ||
     exitArgs.some((a) => readsClobbered(a, sub, updateWrites)) ||
     loopEscapeHazard(body, sub, updateWrites, region);
 
+  // DOES THE RENDERED BOTTOM TEST PUT AN EFFECT WHERE A SHORT CIRCUIT MAY SKIP IT? The `&&`/`||` the
+  // test renders as evaluate their right operand conditionally; the machine's branch did not, for
+  // anything the fold above may have brought into the test. Where the skipped position holds an
+  // EFFECT the emitted loop runs it fewer times than the asm does.
+  //
+  // The effect flag is the whole test and no block position is consulted, because for an effectful
+  // op the two say the same thing: every effectful op is `speculationUnsafe` (ir/discipline.ts), so
+  // raise/shortcircuit.ts never lifts one out of the arm it guards and a genuinely short-circuited
+  // effect never reaches a connective here. A memory read is exempt there — C's own short circuit
+  // re-guards it at the new point — and stays exempt here for the same reason. The reads for which
+  // re-guarding is not merely a spelling — the qualified ones (ir/discipline.ts `counted`) — are
+  // `speculationUnsafe` too, so one in the connective ran above it, and structure/analysis.ts names
+  // it there.
+  //
+  // NO SPINE CONDITION, unlike the gates that read the same `Reach`: those ask which LOOP EDGE a
+  // position is evaluated on, which an op between the connectives inverts. This asks only whether
+  // the position is evaluated EVERY time the test is, and `!(a && b)` skips `b` exactly where
+  // `a && b` does. `SHORT_CIRCUIT_ARMS` composes to that answer on its own — an arm function clears
+  // one side of the reach and nothing down the chain restores it — so the polarity never enters.
+  //
+  // A def the walk cannot read through is DESCENDED rather than refused, which is the other
+  // direction from the fold's `unreadable`: a def spelled another way still names the values its
+  // operands stand for, so an effect below one is an effect in that position. The budget is the
+  // answer given without looking, so it goes the refusing way.
+  const testSkipsAnEffect = (condV: Value, sub: Map<Value, string>): boolean => {
+    let budget = WALK_BUDGET;
+    let found = false;
+    const walk = (x: Value, r: Reach): void => {
+      if (found || sub.has(x) || varName.has(x)) {
+        return;
+      }
+      if (budget-- <= 0) {
+        found = true;
+        return;
+      }
+      const d = defs.get(x);
+      if (d === undefined) {
+        return;
+      }
+      if (effectful(d) && !(r.onTrue && r.onFalse)) {
+        found = true;
+        return;
+      }
+      const arm = SHORT_CIRCUIT_ARMS[d.opcode];
+      d.operands.forEach((o, i) => walk(o, arm === undefined ? r : arm(i, r)));
+    };
+    walk(condV, ALWAYS);
+    return found;
+  };
+
+  // WHICH SPELLING A PRE-UPDATE READ IN THE BOTTOM TEST HAS. Returns the update to fold and the
+  // step to fold it as, or the id of the gate that refused — `PREUPDATE_COND_GATES` above carries
+  // the refusals and the argument. A fold implies the condition's hazard is REPAIRED, and nothing
+  // else: the exit slots and the escaped body values are `loopUpdateHazard`'s other two disjuncts
+  // and are unaffected by the fold, which is why they are asked for separately and why
+  // `one-pre-update-variable` keeps this to the single-variable case.
+  //
+  // The walk is `readsClobbered`'s, with two things added that the boolean does not need: it COUNTS
+  // occurrences instead of stopping at the first (C89's sequence-point rule is about the count), it
+  // tracks, per name, whether the leaf's position is reached when the whole test is TRUE and when
+  // it is FALSE (`SHORT_CIRCUIT_ARMS`). A name reached twice takes the INTERSECTION of the two
+  // positions' reach, which `variable-named-once` then refuses anyway — kept so the field means the
+  // same thing whichever gate is ablated.
+  //
+  // NOT MEMOISED, unlike `readsClobbered`'s `seen`: a value read twice renders twice, and that is
+  // the fact being counted. `WALK_BUDGET` bounds the DAG blow-up that costs, and exhausting it is
+  // `unreadable` — the same answer a def whose lowering the walk cannot see gets.
+  const preUpdateCondFold = (
+    condV: Value,
+    negated: boolean,
+    header: Block,
+    backArgs: readonly Value[],
+    exitArgs: readonly Value[],
+    body: Set<Block>,
+    sub: Map<Value, string>,
+    updates: Stmt[],
+    updateWrites: Set<string>,
+    gates: readonly Gate<PreUpdateCondCandidate>[] = PREUPDATE_COND_GATES,
+  ): PreUpdateCondFold => {
+    let budget = WALK_BUDGET;
+    let unreadable = false;
+    let nestedConnective = false;
+    const mentions = new Map<string, number>();
+    const pre = new Map<string, Reach>();
+    const note = (name: string, r: Reach): void => {
+      mentions.set(name, (mentions.get(name) ?? 0) + 1);
+      if (!updateWrites.has(name)) {
+        return;
+      }
+      const was = pre.get(name);
+      pre.set(name, was === undefined ? r : { onTrue: was.onTrue && r.onTrue, onFalse: was.onFalse && r.onFalse });
+    };
+    // `spine` says the path from the root here ran through connectives only, which is the condition
+    // under which `r` is about this op's own truth as well as the whole test's.
+    const walk = (x: Value, r: Reach, spine: boolean): void => {
+      if (budget-- <= 0) {
+        unreadable = true;
+        return;
+      }
+      const post = sub.get(x);
+      if (post !== undefined) {
+        mentions.set(post, (mentions.get(post) ?? 0) + 1); // a post-update read: no hazard, still a mention
+        return;
+      }
+      const own = varName.get(x);
+      if (own !== undefined) {
+        note(own, r);
+        return;
+      }
+      const d = defs.get(x);
+      if (d === undefined) {
+        return;
+      }
+      if (respelledDefs.has(d)) {
+        unreadable = true;
+        return;
+      }
+      const arm = SHORT_CIRCUIT_ARMS[d.opcode];
+      if (arm !== undefined && !spine) {
+        nestedConnective = true;
+      }
+      d.operands.forEach((o, i) => walk(o, arm === undefined ? r : arm(i, r), arm !== undefined));
+    };
+    walk(condV, ALWAYS, true);
+    const [name] = [...pre.keys()];
+    const reach = name === undefined ? ALWAYS : pre.get(name)!;
+    const assigns = updates.filter((st): st is Extract<Stmt, { k: 'assign' }> => st.k === 'assign' && st.name === name);
+    const u = backArgs[header.params.findIndex((p) => varName.get(p) === name)];
+    const c: PreUpdateCondCandidate = {
+      step: assigns.length === 1 ? unitStep(assigns[0].value, name) : null,
+      preUpdateNames: pre.size,
+      mentions: mentions.get(name) ?? 0,
+      unreadable,
+      nestedConnective,
+      onContinue: negated ? reach.onFalse : reach.onTrue,
+      onExit: negated ? reach.onTrue : reach.onFalse,
+      updateObserved:
+        u === undefined || exitArgs.includes(u) || (useSitesOf.get(u) ?? []).some((s) => !body.has(s.blk)),
+    };
+    const refusal = firstRejection(gates, c);
+    if (refusal !== null) {
+      return { refused: refusal };
+    }
+    // Asked again at the return, not `c.step!`: ablating `update-is-a-unit-step` is a question about
+    // the CENSUS, and the node's shape is not negotiable — a `{ by: null }` renders as `n--` over a
+    // body the emitter has already dropped the real update from. So the ablation gets that gate's
+    // refusal back rather than a malformed fold.
+    if (c.step === null) {
+      return { refused: 'update-is-a-unit-step' };
+    }
+    return { name, by: c.step };
+  };
+
   // Which pre-update exit copies can be REPAIRED instead of declined. The exiting edge hands a
   // loop variable's top-of-iteration value to a merge param, and post-loop that name has moved on
   // one iteration; emitting the copy inside the body, AHEAD of the update, restores it — the
   // trailing-pointer idiom (`for (fast = slow = head; ...; fast = fast->next) slow = fast;`).
-  // Returns the exit slots that may move; the caller emits them at the top of the body and drops
-  // them from the post-loop copies.
+  // Returns the exit slots that may move, each mapped to the point the caller rebuilds it at — an
+  // op of the latch, or null for the copies that open the body — and the caller drops each one from
+  // the post-loop copies.
+  //
+  // `staleOnZeroTrip` offers the fused-guard emitter's other slots too: one whose post-loop copy
+  // would not reproduce the value the guard's exit edge carries past a loop that never ran, such as
+  // a value the body names (`t = g(i); h(4);` in `for (…)`, exiting with `t`). Moved into the body
+  // and seeded from that edge like a pre-update copy, it is the same program on both paths, and it
+  // is weighed by the same gates.
   //
   // The idiom reaches here at all because the compiler DID keep a second register for the trailing
   // value and SSA construction folded the copy away, leaving the exit edge as the only place the
   // value is still named. Where the compiler kept two loop-carried registers instead, the value is
   // a back-edge arg and the un-rotation substitution already reads it — no repair needed.
   //
+  // Each admitted slot comes back WITH THE POSITION IT WAS JUDGED AT, because permission and
+  // placement are one answer: `arg-safe-to-reevaluate` clears the tree against that position and no
+  // other, so an emitter free to re-derive its own would be free to place a copy where nothing
+  // cleared it — silently, since the statement is still emitted and still reads names that resolve.
+  //
   // `PREUPDATE_SINK_GATES` holds the per-candidate refusals, ablatable one at a time. Two rules are
   // properties of the EDGE rather than of a candidate and stay here: the exit edge is a PARALLEL
   // copy, so splitting it across two program points must not let two slots claim one name, nor let
@@ -380,19 +753,23 @@ export function makeLoopHazards(deps: LoopHazardDeps): LoopHazards {
   // slot's destination — needs no rule, and the copies are emitted sequentially because of it.
   // Every leaf such an expression could read is already refused by a per-candidate gate: a header
   // param makes the other slot fail `dest-not-loop-variable`; a body-defined value is
-  // `stale-name`; and a value defined outside the loop but read on the exit edge is live-in at the
-  // header (analysis.ts counts a successor arg as a use at the predecessor's end), which makes the
-  // other slot fail `dest-free-inside-loop`.
+  // `stale-name`, or — the one it takes as current, a def named ahead of the home — a body value
+  // under the other slot's destination, which fails `dest-free-inside-loop`; and a value defined
+  // outside the loop but read on the exit edge is live-in at the header (analysis.ts counts a
+  // successor arg as a use at the predecessor's end), which makes the other slot fail
+  // `dest-free-inside-loop` too.
   const sinkablePreUpdateSlots = (
     header: Block,
     exit: Block,
     exitArgs: readonly Value[],
     body: Set<Block>,
+    latch: Block,
     sub: Map<Value, string>,
     updateWrites: Set<string>,
     gates: readonly Gate<SinkCandidate>[] = PREUPDATE_SINK_GATES,
-  ): Set<number> => {
-    const none = new Set<number>();
+    staleOnZeroTrip: (slot: number) => boolean = () => false,
+  ): Map<number, Op | null> => {
+    const none = new Map<number, Op | null>();
     const headerNames = new Set(header.params.map((p) => varName.get(p)));
     // Is `v` defined by the loop body itself — an op in one of its blocks, or a block param?
     // An op with no `opBlock` entry counts as INSIDE: the map is total over the function, and the
@@ -410,18 +787,35 @@ export function makeLoopHazards(deps: LoopHazardDeps): LoopHazards {
     // that check plus the body's own defs and params covers every way the name is still in use.
     // The loop's OWN variables are left to `dest-not-loop-variable` — a header param is also a
     // body param, so the two gates partition the names instead of overlapping.
-    const busyInLoop = (name: string, self: Value): boolean => {
+    //
+    // A value with NO name is in use under the name too when it renders through it: live into the
+    // header, it is inlined inside the loop and spells its operands' names there. agbcc hoists `k &
+    // 3` of `H[k & 3] = …` ahead of a loop that reuses `k`'s register for `s`, and the exit copy of
+    // `s`, offered `k`'s name and sunk into the body, would overwrite the `a3` that `H[a3 & 3]` reads.
+    // Reading `self` is reading the same value, not another one under its name.
+    const rendersName = (w: Value, name: string, self: Value, seen: Set<Value>): boolean => {
+      if (seen.has(w)) {
+        return false;
+      }
+      seen.add(w);
+      const n = varName.get(w);
+      if (n !== undefined) {
+        return n === name && w !== self;
+      }
+      return (defs.get(w)?.operands ?? []).some((o) => rendersName(o, name, self, seen));
+    };
+    const busyInLoop = (name: string, self: Value, alsoSelf?: Value): boolean => {
       for (const [v, n] of varName) {
-        if (n !== name || v === self || header.params.includes(v)) {
+        if (n !== name || v === self || v === alsoSelf || header.params.includes(v)) {
           continue;
         }
         if (liveIn.get(header)!.has(v) || definedInBody(v)) {
           return true;
         }
       }
-      return false;
+      return [...liveIn.get(header)!].some((w) => !varName.has(w) && rendersName(w, name, self, new Set()));
     };
-    // Everything that stops `a` from being REBUILT at the top of the body. Walks the def-tree
+    // Everything that stops `a` from being REBUILT inside the body. Walks the def-tree
     // where `exprWith(null)` will when the copy is spelled — stopping at a NAMED value, which
     // renders as its name, and at a value with no reaching def, which renders as a gap.
     //
@@ -434,20 +828,134 @@ export function makeLoopHazards(deps: LoopHazardDeps): LoopHazards {
     //
     // `undef` and `laddr` render a name from their own side maps rather than `varName`, and both
     // are position-independent — an `undef` is never assigned, a `laddr` is an address.
-    const blockersOf = (a: Value): ReadonlySet<ArgBlocker> => {
+    //
+    // Does re-evaluating `d` at the copy's position answer differently? `home` is that position
+    // (`preUpdateCopyHome`), so the ops that can tell are the ones STRICTLY BETWEEN the two, and one
+    // ahead of `d` that renders after the home (below) — and only when both are the latch's, because
+    // a def in any other block is separated from the copy by whole blocks this does not walk.
+    // `orderSensitive` is the between-set for all three ways `d` can care: a read wants no store
+    // crossed, an effect no other effect or read, and a trap none of those performed ahead of the fault.
+    //
+    // NOT A RESTATEMENT OF WHAT `materialize` ALREADY BOUNDS, which is the reading to guard against.
+    // That pass NAMES an order-sensitive value whose consumer is not adjacent to it, and a named
+    // leaf is not rebuilt, so this scan never weighs it. But it measures the distance to the edge
+    // copy's own part of the TERMINATOR and lets pass what shares that statement, while the copy is
+    // rebuilt at `home`, ahead of every part — and it lets a read pass a read.
+    //
+    // AND NOT ONLY BETWEEN. An order-sensitive op AHEAD of `d` that the rebuilt tree does not hold
+    // is crossed too when it RENDERS after the home (`rendersAfter`): inlined into an update copy at
+    // the foot of the body, it runs after the member the asm ran it before. A call there is named
+    // by the analysis (the member lies between it and its copy, in another part of the terminator,
+    // and bars it), so what still reaches this arm is a read, and a read crosses only a member that
+    // is not one: two reads commute, whichever runs first (`preupdate_exit_reads`: `u = q[1]; r = *q
+    // + 1; s = s + u;`).
+    //
+    // `latch.ops` INDEX ORDER IS EXECUTION ORDER — what `slice` reads. The one ISA fact that bends
+    // it cannot reach here: a MIPS branch-likely NULLIFIES its delay slot, so placement gives that
+    // slot its own block on the taken edge rather than a later index in the latch, and `i < 0`
+    // then refuses it as a def this block does not hold.
+    //
+    // `i < 0` carries a second refusal: a def in ANOTHER block, separated from the copy's position
+    // in the latch by whole blocks nothing here walks. Its witness is hazards.test.ts's `a read from
+    // ANOTHER body block is refused even though the arg itself is a latch op`.
+    //
+    // THE BETWEEN-SET DOES NOT EXEMPT THE TREE BEING REBUILT, where `pattern/engine.ts`'s
+    // index-order scan does exempt its own cone — a cone member is inlined into the very expression
+    // that moves, so it is no barrier to it. Two order-sensitive ops under one arg move together,
+    // but the compiler orders them inside the expression, not the asm: every corpus compiler calls
+    // before it reads (analysis.ts, the barrier scan), so a read ahead of a call in one tree comes
+    // back behind it. Left narrow on purpose; the AHEAD arm does exempt the tree, because a member
+    // ahead of `d` is weighed by this same scan from its own side.
+    //
+    // PER SLOT, and two slots sharing one order-sensitive def spell it TWICE — one `ldr` feeding
+    // two exit args becomes two reads in the emitted C. For a READ that is legal by this same scan:
+    // either nothing order-sensitive lies between the two homes, or the second slot is refused and
+    // the edge stands down whole. It costs a spelling; only a `volatile` qualifier would make the
+    // extra access observable. A variation mints one the differ referees (l3/volatileptr.ts), and
+    // the default candidate carries one on a read the device pin or the symbol map qualifies — but
+    // the analysis places such a read as it places a call (ir/discipline.ts `counted`), naming one
+    // with two uses or one that rides an edge copy, so neither reaches this scan twice, and
+    // `assertEffectsPreserved` (contracts.ts) counts both on the path whatever reaches here anyway.
+    const movesPast = (d: Op, home: Op, tree: ReadonlySet<Op>): boolean => {
+      const i = latch.ops.indexOf(d);
+      const p = latch.ops.indexOf(home);
+      if (i < 0 || i > p || latch.ops.slice(i + 1, p).some(orderSensitive)) {
+        return true;
+      }
+      return latch.ops
+        .slice(0, i)
+        .some((o) => orderSensitive(o) && !tree.has(o) && !(isRead(o) && isRead(d)) && rendersAfter(o, p));
+    };
+    // A memory read and nothing else: two of them commute, whichever runs first. Two qualified
+    // reads would not, and never meet in the AHEAD arm: the analysis names a qualified read that
+    // another qualified read stands between it and its render (`isBarrier`), so a qualified op ahead
+    // of `d` renders at its own index.
+    const isRead = (o: Op): boolean => orderSensitive(o) && !effectful(o);
+    // Does latch op `o` RENDER after index `p`? Where it renders is `emitPos`: the terminator's
+    // index stands for every copy it carries, and those land at or after the foot of the body; an
+    // op with no one position, or none in the latch, counts as after.
+    const rendersAfter = (o: Op, p: number): boolean => {
+      const q = emitPos(o);
+      return q === null || q.blk !== latch || q.idx > p;
+    };
+    // A body-defined name that IS current where the copy lands: a def the analysis NAMED (so it
+    // renders as a statement at its own position) that every iteration reaching the copy has just
+    // run — in the latch strictly ahead of the copy's home, which `sideEffects` renders in index
+    // order, or in another body block on every path from the header to the latch (`everyIteration`).
+    // The name holds this iteration's value, not the previous one's. That it is the ONLY write to
+    // the name is the other two conjuncts' job, which this leaves standing: a loop variable's name
+    // (`headerNames`) and a name any other value in the loop also answers to (`busyInLoop`) still
+    // refuse. So does every other body-defined name — one defined AFTER the home, in a block an
+    // iteration can skip, or not named by a def at all (a block param) — and the copy that opens
+    // the body (`home === null`) has no position to be behind. The home ITSELF counts as ahead:
+    // `sideEffects` spells a copy homed at an op after that op's own statement, so a copy of the
+    // named value its home computes reads what that statement just wrote.
+    const writtenAheadOf = (x: Value, home: Op | null): boolean => {
+      const d = defs.get(x);
+      if (home === null || d === undefined || !materialize.has(d)) {
+        return false;
+      }
+      const b = opBlock.get(d);
+      if (b !== latch) {
+        return b !== undefined && everyIteration(b);
+      }
+      return latch.ops.indexOf(d) <= latch.ops.indexOf(home);
+    };
+    // Does every path from the header to the latch, inside the body, run block `b`?
+    const everyIteration = (b: Block): boolean => {
+      if (b === header) {
+        return true;
+      }
+      if (!body.has(b)) {
+        return false;
+      }
+      const reached = new Set<Block>([header, b]);
+      const stack = [header];
+      while (stack.length > 0) {
+        for (const s of successorsOf(stack.pop()!)) {
+          if (body.has(s) && !reached.has(s)) {
+            reached.add(s);
+            stack.push(s);
+          }
+        }
+      }
+      return !reached.has(latch);
+    };
+    const blockersOf = (a: Value, home: Op | null): ReadonlySet<ArgBlocker> => {
       const seen = new Set<Value>();
       const found = new Set<ArgBlocker>();
+      const tree = new Set<Op>();
       const walk = (x: Value): void => {
         if (seen.has(x)) {
           return;
         }
         seen.add(x);
         if (header.params.includes(x)) {
-          return; // a loop variable: at the top of the body its name holds exactly this
+          return; // a loop variable: ahead of the update its name holds exactly this
         }
         const n = varName.get(x);
         if (n !== undefined) {
-          if (definedInBody(x) || headerNames.has(n) || busyInLoop(n, x)) {
+          if ((definedInBody(x) && !writtenAheadOf(x, home)) || headerNames.has(n) || busyInLoop(n, x)) {
             found.add('stale-name');
           }
           return;
@@ -457,45 +965,64 @@ export function makeLoopHazards(deps: LoopHazardDeps): LoopHazards {
           found.add('no-definition');
           return;
         }
-        if (REEVAL_UNSAFE_OPS.has(d.opcode) || respelledDefs.has(d)) {
-          found.add('order-sensitive');
-        }
+        tree.add(d);
         d.operands.forEach(walk);
       };
       walk(a);
+      // Weighed once the whole tree is known, because `movesPast` exempts its members. A respelled
+      // def is opaque — what it renders is a memory read this walk never sees — so it is refused at
+      // every position rather than measured.
+      for (const d of tree) {
+        if (respelledDefs.has(d) || (reevalUnsafe(d) && (home === null || movesPast(d, home, tree)))) {
+          found.add('order-sensitive');
+        }
+      }
       return found;
     };
-    const dest = new Map<number, string>();
+    const cleared = new Map<number, { name: string; home: Op | null }>();
     exitArgs.forEach((a, j) => {
-      if (!readsClobbered(a, sub, updateWrites)) {
+      if (!readsClobbered(a, sub, updateWrites) && !staleOnZeroTrip(j)) {
         return; // no hazard on this slot — nothing to repair
       }
       const destName = varName.get(exit.params[j]);
+      const home = preUpdateCopyHome(defs, opBlock, a, latch);
       const c: SinkCandidate = {
-        argBlockers: blockersOf(a),
+        argBlockers: blockersOf(a, home),
         destName,
         headerNames,
         updateWrites,
-        destBusyInLoop: destName !== undefined && busyInLoop(destName, exit.params[j]),
+        // An arg the BODY defines under the destination's name is the one write that name already
+        // has there: its own statement rewrites the name each iteration, so its copy is `dest =
+        // dest` and the seed is all the slot needs. An arg from outside the loop under that name
+        // (a parameter kmc keeps in the destination's register) is read by the body, and a seed
+        // ahead of the loop would overwrite it.
+        destBusyInLoop:
+          destName !== undefined && busyInLoop(destName, exit.params[j], definedInBody(a) ? a : undefined),
       };
       if (firstRejection(gates, c) === null) {
-        dest.set(j, destName!);
+        cleared.set(j, { name: destName!, home });
       }
     });
-    const names = new Set(dest.values());
-    if (dest.size === 0 || names.size !== dest.size) {
+    const names = new Set([...cleared.values()].map((c) => c.name));
+    if (cleared.size === 0 || names.size !== cleared.size) {
       return none;
     }
-    return exitArgs.some((a, j) => !dest.has(j) && readsClobbered(a, sub, names)) ? none : new Set(dest.keys());
+    return exitArgs.some((a, j) => !cleared.has(j) && readsClobbered(a, sub, names))
+      ? none
+      : new Map([...cleared].map(([j, c]) => [j, c.home]));
   };
 
   return {
     readsClobbered,
     loopEscapeHazard,
     loopUpdateHazard,
+    testSkipsAnEffect,
+    preUpdateCondFold,
     sinkablePreUpdateSlots,
-    sameAtEntry: (a, b, entry, negated = false) => sameAtEntry(defs, a, b, entry, negated),
+    sameAtEntry: (a, b, entry, negated = false, through = undefined) =>
+      sameAtEntry(defs, a, b, through ? { entry, through } : { entry }, negated),
     loopWriteSet,
+    loopWriteSetAhead,
   };
 }
 
@@ -504,8 +1031,8 @@ export function makeLoopHazards(deps: LoopHazardDeps): LoopHazards {
  *  `pred` after proving no value in `name`'s class has a definition able to run before that edge.
  *  It reads each such definition's home off `paramBlock`/`opBlock`, and a SUNK pre-update exit copy
  *  is written somewhere else than its home says: its destination is the loop EXIT's param, so the
- *  model homes it after the loop, while `preUpdateCopies` really writes it at the top of the body,
- *  on every iteration, ahead of any edge inside that body.
+ *  model homes it after the loop, while `preUpdateCopies` really writes it INSIDE the body, on
+ *  every iteration, ahead of the update and of any edge the header dominates.
  *
  *  Nothing today puts the two together — a merge inside the body that adopted the exit param's name
  *  is a block param `definedInBody` sees, so `dest-free-inside-loop` refuses the sink before it