@asmlift/core 0.9.0 → 0.11.0

package/src/structure/cross-jumped-tail.ts

@@ -0,0 +1,216 @@
+// THE LAYOUT OF A CROSS-JUMPED RETURN TAIL: does the asm show that the compiler merged a return
+// tail the source wrote into every arm, where the structurer took the join past early returns?
+//
+// A compiler that cross-jumps return tails (target.ts `crossJumpsReturnTails`, gcc 2.x jump.c)
+// leaves the same CFG for `if (a) { x = 1; tail(); return; } ... tail();` and for `if (a) x = 1;
+// ... tail();`: one copy of the tail, which every arm reaches. The two spellings differ in WHERE
+// that copy sits and in WHICH arms became one block, because `do_cross_jump` keeps the copy of
+// the LATER jumping arm and jumps the earlier one to a new label before it. That label stops
+// further merging (`INSN_UID (JUMP_LABEL (insn)) < max_uid`). So the copies spelling leaves one of
+// three marks in the object:
+//
+//   (A) THE TAIL IS NOT LAST. The surviving copy ends in an unconditional jump (A1), and a block of
+//       the construct that never reaches the tail is laid out after it (A2). That is an arm that
+//       did not use the tail, left where the source wrote it. The join writes the tail after the
+//       whole construct, where it falls into what follows it. A bare return block does not count
+//       for A2: the epilogue an early `return` reaches is laid out last under either spelling.
+//       The copy can survive split over two blocks: an arm's own jump enters it part-way, so the
+//       join falls into the rest of the tail, and that rest ends in the jump. So A1 reads the end
+//       of the join's run of fall-throughs, not the join block alone.
+//   (B) IDENTICAL ARMS STAYED APART. Two arms that reach the tail and nothing else, each by an
+//       unconditional jump, have the same instructions. Under the join, each such arm jumps to the
+//       join's one original label, and jump2's search of the other jumps to that label merges
+//       identical bodies. Under the copies, the first cross-jump made a new label, and that search
+//       never ran. An arm that FALLS into the join is not one of them: it is tried only against
+//       the code before the label, which a call ending it defeats (flow.c's use-nop), so agbcc
+//       keeps a falling `g(2)` apart from a jumping `g(2)` under the join too
+//       (`probe-rettail-pd-join.c`).
+//   (C) A CALL CUT FROM ITS ARGUMENTS. The join starts with a call, and two predecessors that reach
+//       only the join each hold one same instruction after their own last call. `do_cross_jump`
+//       compares backward from each jump, one instruction at a time, and stops at the first pair
+//       that differs; arms that set the call's arguments in different orders, or where one arm
+//       finds an argument already in its register, differ just above the call. So the merge cuts
+//       the call from its argument setup, and leaves a copy of that setup in each arm. The join
+//       writes the setup once, after its label, and an instruction both arms hold in the same
+//       place would have been merged up into it.
+//
+// Bodies are compared as the frontend recorded them, the relocated symbol included
+// (frontend/ssa.ts `recordAsmLayout`): in a relocatable MIPS object `gT = c` and `gW = c` are the
+// same two instructions, and only the relocation names the global (`probe-rettail-pc-join.c`).
+//
+// A MARK IS EVIDENCE, NOT PROOF. jump2 cross-jumps any shared code, not only a return tail: two
+// identical arms of a join-written `if`, or a call both arms end in, merge the same way, and leave
+// the merged block ending in a jump with an early-return arm laid out after it (A). Both readings
+// of such a site are verified readings of the asm, and on the hand probes neither matches. So a
+// mark moves which reading is the DEFAULT, never what is lifted, and its worth is measured, not
+// derived.
+//
+// MEASURED. Over the 620 real functions where the join re-spells the default (2026-11-05), each
+// reading really compiled: the bound plus (A1 & A2) | B gives MATCH 44, against 35 for the copies
+// everywhere and 40 for the size bound alone, with no match lost. A and B were chosen on those 620.
+// The split tail of A1 and mark C were read off held-out sources instead: 160 generated functions
+// written WITH the copies, early returns between the arms (2026-11-06). There the size bound with A
+// and B alone loses 7 of the copies' matches on agbcc, 9 on gcc2.7.2kmc and 2 on gcc2.7.2; with the
+// split tail and C it loses 2, 3 and 1, and gains as many as before (5, 5, 2). Over 300 paired
+// functions, half written each way, the two lose no match; 3 join-written ones on each GCC 2.7.2
+// lane move to the copies and score further. On the 620 they move 3 functions, all to the copies'
+// own spelling: 2 closer, 1 further, MATCH still 44. What no layout read recovers: a tie the two
+// spellings leave in the same layout, where only the register allocation differs, and a call merged
+// across arms that pass it different arguments. The probe pairs in cross-jumped-tail.test.ts check
+// each mark and each shape that is no mark.
+//
+// READ BY NO DEFAULT. Over held-out real functions (pokeemerald, 2026-11-06) the size bound with
+// these marks still loses 9 of the copies' matches on agbcc, none of them marked; over the 160
+// generated functions (2026-11-09) it still loses 3 on gcc2.7.2kmc and 1 on gcc2.7.2. So both
+// compilers that cross-jump default to the copies outright (they leave out target.ts
+// `joinPastReturnsByDefault`), and the probe pairs still pin each mark.
+//
+// Read only from the frontend's layout record (ir/core.ts `AsmLayout`). A block with no entry, such
+// as one a raise pass made up, is no evidence either way. A function with no record (parsed IR)
+// has no mark.
+import type { AsmLayout, Block, Fn } from '../ir/core';
+import type { JoinPastReturnsSite } from './structure';
+
+const succsOf = (b: Block): Block[] => [...new Set(b.ops[b.ops.length - 1]?.successors.map((s) => s.block) ?? [])];
+
+/** Every block reachable from `from`, `from` included, never entering `avoid`. */
+function reach(from: Block, avoid?: Block): Set<Block> {
+  const seen = new Set<Block>();
+  const stack = [from];
+  while (stack.length) {
+    const x = stack.pop()!;
+    if (x === avoid || seen.has(x)) {
+      continue;
+    }
+    seen.add(x);
+    stack.push(...succsOf(x));
+  }
+  return seen;
+}
+
+const isBareReturn = (b: Block): boolean => b.ops.length === 1 && b.ops[0].opcode === 'ret';
+
+/** Does `site` show either mark of a cross-jumped return tail in `fn`'s asm layout? */
+export function crossJumpedTail(fn: Fn, site: JoinPastReturnsSite): boolean {
+  const layout: AsmLayout | undefined = fn.asmLayout;
+  const at = layout?.get(site.join);
+  if (layout === undefined || at === undefined) {
+    return false;
+  }
+  return (
+    (tailEndsInJump(layout, site.join) && armLaidOutAfter(fn, layout, site, at.index)) ||
+    identicalArms(fn, layout, site.join) ||
+    callCutFromArguments(fn, layout, site.join)
+  );
+}
+
+/** (A1): the tail from the join, followed through its fall-throughs, ends in an unconditional jump. */
+function tailEndsInJump(layout: AsmLayout, join: Block): boolean {
+  const seen = new Set<Block>();
+  for (let b: Block = join; ;) {
+    const at = layout.get(b);
+    if (at === undefined || seen.has(b)) {
+      return false;
+    }
+    if (at.endsInJump) {
+      return true;
+    }
+    seen.add(b);
+    // a fall-through is the next block in the asm; anything else is no run of the tail
+    const next = succsOf(b);
+    if (next.length !== 1 || layout.get(next[0])?.index !== at.index + 1) {
+      return false;
+    }
+    b = next[0];
+  }
+}
+
+/** (C): the join's first instruction is a call, and two of its predecessors, each with the join as
+ *  its only successor, hold a same instruction after their own last call.
+ *
+ *  BLIND TO WHERE IN THE ARM THAT INSTRUCTION SITS, and to what it computes, on purpose. The text
+ *  compared is the instruction as printed, so a shared statement is not needed: on MIPS the address
+ *  half of a relocated global (`lui at,0x0 <gT>`) and a store from a register that holds a different
+ *  value in each arm (`sw v0,0(at) <gT>`) read the same. So any two call-free arms that write one
+ *  global fire it when the join opens with a call (`if (a == 0) { gV = b; gT = 1; } else if (a ==
+ *  1) { gV = c; gT = 2; } ... k(a);`, 26 lines off as copies, 0 as the join, on both MIPS GCC lanes),
+ *  and it publishes the copies there, which do not match. Counting only
+ *  an instruction that sets up a register the join reads (an argument of its call, or a saved
+ *  register read past it) clears that case, and loses two matches the copies have: on
+ *  `probe-rettail-pc-copies` the arms keep `gV = a` above the cut call, a store that sets up no
+ *  register, and the join then scores 23 lines off on gcc2.7.2 and 30 on gcc2.7.2kmc, really
+ *  compiled (2026-11-06). A mark that fires wrongly publishes the copies, the default before the
+ *  join, and one that misses can lose a match the copies had; so C stays wide. */
+function callCutFromArguments(fn: Fn, layout: AsmLayout, join: Block): boolean {
+  if (layout.get(join)?.calls[0] !== 0) {
+    return false;
+  }
+  const seen = new Set<string>();
+  for (const p of predecessors(fn).get(join) ?? []) {
+    const at = layout.get(p);
+    if (at === undefined || succsOf(p).length !== 1) {
+      continue;
+    }
+    const setup = new Set(at.body.slice((at.calls[at.calls.length - 1] ?? -1) + 1));
+    if ([...setup].some((ins) => seen.has(ins))) {
+      return true;
+    }
+    for (const ins of setup) {
+      seen.add(ins);
+    }
+  }
+  return false;
+}
+
+/** (A2): a block of the construct, reached from its branch short of the join, that never reaches
+ *  the join and is laid out after it. A bare return does not count. */
+function armLaidOutAfter(fn: Fn, layout: AsmLayout, site: JoinPastReturnsSite, joinIndex: number): boolean {
+  const fromJoin = reach(site.join);
+  const reachesJoin = new Set<Block>([site.join]);
+  const preds = predecessors(fn);
+  const stack = [site.join];
+  while (stack.length) {
+    for (const p of preds.get(stack.pop()!) ?? []) {
+      if (!reachesJoin.has(p)) {
+        reachesJoin.add(p);
+        stack.push(p);
+      }
+    }
+  }
+  for (const x of reach(site.branch, site.join)) {
+    const xi = layout.get(x)?.index;
+    if (xi !== undefined && xi > joinIndex && !fromJoin.has(x) && !reachesJoin.has(x) && !isBareReturn(x)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/** (B): two predecessors of the join, each with the join as its only successor and each ending in an
+ *  unconditional jump to it, whose asm bodies are the same non-empty instructions. */
+function identicalArms(fn: Fn, layout: AsmLayout, join: Block): boolean {
+  const seen = new Set<string>();
+  for (const p of predecessors(fn).get(join) ?? []) {
+    const at = layout.get(p);
+    if (at === undefined || !at.endsInJump || at.body.length === 0 || succsOf(p).length !== 1) {
+      continue;
+    }
+    const body = at.body;
+    const key = body.join('\n');
+    if (seen.has(key)) {
+      return true;
+    }
+    seen.add(key);
+  }
+  return false;
+}
+
+function predecessors(fn: Fn): Map<Block, Block[]> {
+  const preds = new Map<Block, Block[]>(fn.blocks.map((b) => [b, []]));
+  for (const b of fn.blocks) {
+    for (const s of succsOf(b)) {
+      preds.get(s)?.push(b);
+    }
+  }
+  return preds;
+}

package/src/structure/globalaccess.ts

@@ -1,17 +1,29 @@
 // THE GLOBAL-ACCESS ADDRESS DECOMPOSITION — the pure half of the symbol-map access spellings.
 //
-// Everything here is a function of an `Expr`, a `SymbolInfo` and a width: no structurer state, no
-// naming walk, no loop context. It answers three questions the access spellings in structure.ts
-// ask over and over — is this address `&gSym` plus something; does that something divide into
-// whole elements; and do the terms of it name the DECLARED subscripts of a multidimensional array
-// — and it answers them the same way for every caller, which is the point of the split: the
-// rank-pinning fallback and the declared-subscript recovery share `bareArrayElement`, so the two
-// cannot disagree about what a bare element spelling is.
+// Everything here is a function of an `Expr`, the map's declarations and a width: no structurer
+// state, no naming walk, no loop context. It answers three questions the access spellings in
+// structure.ts ask over and over — is this address `&gSym` plus something; does that something
+// divide into whole elements; and do the terms of it name the DECLARED subscripts of a
+// multidimensional array — and it answers them the same way for every caller, which is the point
+// of the split: the rank-pinning fallback and the declared-subscript recovery share
+// `bareArrayElement`, so the two cannot disagree about what a bare element spelling is. The same
+// holds for what the map declares a named member to be (`ptrMemberDecl`), which the access folds
+// and the pointer spelling (pointer-spelling.ts) both read.
 import type { Expr } from '../l3/ast';
-import { type SymbolInfo, arrayInnerExtents } from '../symbols';
+import {
+  type DeclaredField,
+  type SymbolInfo,
+  type SymbolStructField,
+  arrayInnerExtents,
+  declaredFields,
+  isArrayField,
+  isBitfieldField,
+  isPtrField,
+  pointeeFields,
+} from '../symbols';
 
 // `&gSym`, possibly wearing the value-context integer cast the additive lowering adds
-// (`(u32)&gSym` — see `intifyAddr` in structure.ts's lowerDef): both spell the same link-time
+// (`(u32)&gSym` — see `ARITH_ROWS` in pointer-spelling.ts): both spell the same link-time
 // constant, so the fold rules match through the cast and every access that CAN spell a named
 // element still does.
 // WIDTH 32 ONLY — a NARROWING cast (`(u8)&gSym`, from a zext/sext lowering) is a different
@@ -63,6 +75,42 @@ export function globalByteBase(e: Expr): { name: string; residual: Expr } | null
   return null;
 }
 
+/** {@link globalOf} with the address any number of `+` down — FOR THE BARE-ARRAY SPELLING ONLY, the
+ *  one consumer whose declaration says what the residual indexes. An interior address the lift
+ *  rewrote as the object's plus a constant before the index was added (IDO's `addiu t, sp, 0x58`
+ *  for the second of two copied arrays reaches the lift as `(u32)sp56 + 32 + v8`) has its object
+ *  one `+` further down than globalByteBase looks. The sum's terms are flattened, exactly one of
+ *  them an address, and the rest are the residual: its runtime terms in order and its constants
+ *  summed into one trailing term (`v8 + 32`). Not for the cast forms, which keep the sum as written
+ *  (`*(s8 *)((u32)sp0 + 3 + a0)`). `off` is the access's own displacement, summed into the same
+ *  trailing constant. */
+export function nestedGlobalOf(e: Expr, width: number, off: number): { name: string; idx: Expr } | null {
+  const terms: Expr[] = [];
+  const flatten = (x: Expr): void => {
+    if (x.k === 'bin' && x.op === '+') {
+      flatten(x.l);
+      flatten(x.r);
+    } else {
+      terms.push(x);
+    }
+  };
+  flatten(e);
+  const at = terms.filter((x) => addrIn(x) !== null);
+  if (at.length !== 1) {
+    return null;
+  }
+  const rest = terms.filter((x) => x !== at[0]);
+  const bias = rest.reduce((n, x) => (x.k === 'const' ? n + x.value : n), off);
+  const runtime = rest
+    .filter((x) => x.k !== 'const')
+    .reduce<Expr | null>((l, r) => (l === null ? r : { k: 'bin', op: '+', l, r }), null);
+  if (bias % width !== 0) {
+    return null;
+  }
+  const idx = runtime === null ? { k: 'const' as const, value: 0 } : elementIndex(runtime, width);
+  return idx === null ? null : { name: addrIn(at[0])!.name, idx: addOffset(idx, bias / width) };
+}
+
 // THE one gate on the BARE-NAME array-global spelling (`gSym[i]` rather than `((T *)&gSym)[i]`),
 // shared by the constant-offset and variable-index access paths so the two cannot disagree.
 // Returns the `index` node's `lead` fragment when the bare form is spellable, or null to fall
@@ -81,10 +129,19 @@ export function globalByteBase(e: Expr): { name: string; residual: Expr } | null
 // inner extent) gets no bare form at all; `((T *)&gSym)[i]` is byte-identical and valid under ANY
 // declaration, which is why it is the safe fallback. See symbols.ts arrayInnerExtents for why an
 // ABSENT rank is read as 1 rather than as unknown.
-export function bareArrayLead(si: SymbolInfo, width: number, signed: boolean): { lead?: Expr[] } | null {
+//
+// …and a CONSTANT subscript must name an element of the declaration, where it states its extent: a
+// subscript past a rank-1 array's end (or before its start) is not an element of it, so it keeps
+// the cast form, which states only the address. A runtime subscript is the access's own business —
+// for a frame part, the audit that split it bounded the reach (frame-objects.ts `provenParts`).
+export function bareArrayLead(si: SymbolInfo, width: number, signed: boolean, idx?: Expr): { lead?: Expr[] } | null {
   if (!bareArrayElement(si, width, signed)) {
     return null;
   }
+  const extent = si.dims?.length === 1 ? si.dims[0] : undefined;
+  if (idx?.k === 'const' && (idx.value < 0 || (typeof extent === 'number' && idx.value >= extent))) {
+    return null;
+  }
   const inner = arrayInnerExtents(si);
   return inner === null ? null : inner.length === 0 ? {} : { lead: inner.map((): Expr => ({ k: 'const', value: 0 })) };
 }
@@ -298,3 +355,93 @@ export function addOffset(idx: Expr, n: number): Expr {
     ? { k: 'const', value: idx.value + n }
     : { k: 'bin', op: '+', l: idx, r: { k: 'const', value: n } };
 }
+
+/** May a member be NAMED by an access of this direction, given the qualifiers on its declaration?
+ *  The named spelling REPLACES a cast through `(u8 *)`, which carries no qualifier at all, so a
+ *  qualifier the name reintroduces changes what the compiler emits:
+ *    • `volatile` makes the access observable — the load may no longer be folded or reordered,
+ *      which is a different instruction sequence (measured: 6 insns where the cast form was 5);
+ *    • `const` under a STORE is a hard error, where the cast form merely cast the qualifier away.
+ *  Either way the honest spelling is the cast form, so the member simply is not nameable here. */
+export function memberQualsAllow(f: SymbolStructField, containerConst: boolean | undefined, isStore: boolean): boolean {
+  if (f.volatile) {
+    return false;
+  }
+  return !(isStore && (f.const || containerConst));
+}
+
+/** The member a `width`-byte access at byte `byte` of a struct global names, `gSym.member`: one at
+ *  that offset and of that size, no array or bitfield, whose qualifiers allow the access. An ARRAY
+ *  member would match a byte access by (offset, size) and spell `.x`, which is not an lvalue of
+ *  that width; a plain read of a BITFIELD's bytes is not a read of its bits. */
+export function structMemberAt(
+  si: SymbolInfo,
+  byte: number,
+  width: number,
+  isStore: boolean,
+): DeclaredField | undefined {
+  if (si.shape !== 'struct') {
+    return undefined;
+  }
+  const f = declaredFields(si.layout)?.find(
+    (x) => x.offset === byte && x.size === width && !isArrayField(x) && !isBitfieldField(x),
+  );
+  return f !== undefined && memberQualsAllow(f, si.const, isStore) ? f : undefined;
+}
+
+/** The members a symbol's declaration seats: a struct global's own, or a pointer global's
+ *  pointee's. */
+export interface MemberLookup {
+  fieldsOf(name: string): DeclaredField[] | null;
+}
+
+/** {@link MemberLookup.fieldsOf} over `info`, MEMOIZED per symbol. `declaredFields` validates every
+ *  member and returns a fresh sorted copy on every call, and pointer-spelling.ts's `roleOf`
+ *  asks it for every member operand of every arithmetic op lowered, so an uncached lookup is an
+ *  O(n log n) allocation on a hot path — inside a `structure()` a ranked run repeats once per
+ *  candidate, 17,856 times on the largest fan. */
+export function memoFieldsOf(info: (name: string) => SymbolInfo | undefined): MemberLookup['fieldsOf'] {
+  const cache = new Map<string, DeclaredField[] | null>();
+  return (name) => {
+    const hit = cache.get(name);
+    if (hit !== undefined) {
+      return hit;
+    }
+    const si = info(name);
+    const fields =
+      si?.shape === 'struct' ? declaredFields(si.layout) : si?.shape === 'pointer' ? pointeeFields(si.pointee) : null;
+    cache.set(name, fields);
+    return fields;
+  };
+}
+
+/** The map member a `field` node NAMES, or null when it names none — THE one resolver for "what
+ *  does the declaration say about this member", for rules that must reason about a member's type
+ *  after the access rules have already spelled it. Both named spellings resolve, through the same
+ *  shared gate their spelling passed: `gSym.member` off a struct global's {@link declaredFields},
+ *  `gPtr->member` off the pointee's ({@link pointeeFields}). A synthesized `field_K` — the
+ *  recovered-struct spelling, which no map declares — resolves to null, and so does any base that
+ *  is not a map-shaped global, which is what makes every caller refuse rather than guess.
+ *
+ *  The pointee arm reaches only what the MAP lets it: `pointeeAccess` gates every `gPtr->member`
+ *  spelling on `spellsAccessType(f.signed, …)`, so a pointer field declaring no signedness — which
+ *  is every one in the corpus's vendored maps — is never named, and a pointer read one indirection
+ *  down spells `((s32 *)gQ)[1]`. That is a fact about those maps, not about this code: `SymbolMap`
+ *  is a caller-supplied input, and one field flips it (`signed: true` on a 4-byte pointer member
+ *  of a pointee yields `(u8 *)gQ->pInner`, cast and all, pinned in pointer-members.test.ts). So
+ *  the arm is live and tested, and the byte-arithmetic rule that reads this answer is correct for
+ *  it — where resolving a pointee member to null would reopen the double-scaling hole silently. */
+export function declaredMemberOf(x: Expr, sym: MemberLookup | undefined): DeclaredField | null {
+  if (x.k !== 'field' || x.base.k !== 'var' || sym === undefined) {
+    return null;
+  }
+  return sym.fieldsOf(x.base.name)?.find((f) => f.name === x.name) ?? null;
+}
+
+/** The map member a `field` node names when the declaration makes it a POINTER — {@link
+ *  isPtrField} being the shared two-fact test, so this and the synthesized declaration cannot
+ *  disagree about what a member is. */
+export function ptrMemberDecl(x: Expr, sym: MemberLookup | undefined): DeclaredField | null {
+  const f = declaredMemberOf(x, sym);
+  return f !== null && isPtrField(f) ? f : null;
+}

package/src/structure/hazards.ts

@@ -4,9 +4,9 @@
 //   • may this loop's updates be emitted before its condition/exit/post-loop reads, or would some
 //     read then see a clobbered (post-update) value that the original IR read PRE-update — and
 //     which of those reads can be REPAIRED by moving the copy into the body (`sinkable…`);
-//   • is a value the emitted form DROPS redundant — `sameAtEntry`, which reads an expression on
-//     the loop's entry state so a guard about to be fused away can be checked against the test
-//     that replaces it.
+//   • is a value the emitted form DROPS redundant — `sameAtEntry` (ir/entry.ts, shared with the
+//     raise re-roll), which reads an expression on the loop's entry state so a guard about to be
+//     fused away can be checked against the test that replaces it.
 //
 // WHAT MAKES A SUNK COPY LEGAL. The exit edge's value is not moved, it is REBUILT: the copy spells
 // the arg's def-tree again inside the body, at the point that tree was already computed at
@@ -50,7 +50,7 @@
 // exist at CALL time (emission runs after naming completes). Snapshotting them would break this.
 import { Block, Op, Value, successorsOf } from '../ir/core';
 import { effectful, orderSensitive, reevalUnsafe } from '../ir/discipline';
-import { NEGATED_ICMP } from '../ir/opcodes';
+import { sameAtEntry } from '../ir/entry';
 import { Expr, Stmt } from '../l3/ast';
 import { type Gate, firstRejection } from '../l3/gates';
 import type { UseSite } from './analysis';
@@ -120,7 +120,15 @@ export interface LoopHazards {
     gates?: readonly Gate<SinkCandidate>[],
     staleOnZeroTrip?: (slot: number) => boolean,
   ): Map<number, Op | null>;
-  sameAtEntry(a: Value, b: Value, entry: Map<Value, Value>, negated?: boolean): boolean;
+  /** `through`: the values whose defining op may be read through (ir/entry.ts `EntryReading`);
+   *  every value when absent. */
+  sameAtEntry(
+    a: Value,
+    b: Value,
+    entry: Map<Value, Value>,
+    negated?: boolean,
+    through?: (v: Value) => boolean,
+  ): boolean;
   loopWriteSet(updates: Stmt[], bodyBlocks: Iterable<Block>, header: Block): Set<string>;
   loopWriteSetAhead(ahead: Iterable<Block>, incoming: (b: Block) => Value[][], header: Block): Set<string>;
 }
@@ -324,7 +332,7 @@ interface Reach {
 const ALWAYS: Reach = { onTrue: true, onFalse: true };
 
 /** The reach each operand of a SHORT-CIRCUIT op inherits. These two are the whole set: they are the
- *  ops `ARITH_TO_BIN` (structure.ts) renders as `&&`/`||` — a test holds the two lists together,
+ *  ops `ARITH_TO_BIN` (arith-ops.ts) renders as `&&`/`||` — a test holds the two lists together,
  *  since a connective missing from here is read as an ordinary op and its arms inherit a reach they
  *  do not have — and `Expr` has no conditional form besides them, no ternary, so every other op
  *  evaluates all of its operands whenever it is itself evaluated and they inherit its reach
@@ -363,63 +371,6 @@ function unitStep(value: Expr, name: string): 1 | -1 | null {
   return k === null ? null : ((value.op === '-' ? -k : k) as 1 | -1);
 }
 
-// `x + 0` / `x - 0` / `x | 0` are `x`. Substituting a loop variable by its init constant turns
-// ordinary index arithmetic into exactly these, and a guard that spells the same value without
-// the arithmetic would otherwise compare unequal.
-function fold(defs: Map<Value, Op>, v: Value): Value {
-  const d = defs.get(v);
-  if (!d || d.operands.length !== 2 || !['add', 'sub', 'or'].includes(d.opcode)) {
-    return v;
-  }
-  const z = defs.get(d.operands[1]);
-  return z?.opcode === 'const' && z.attrs?.value === 0 ? fold(defs, d.operands[0]) : v;
-}
-
-// Does `a`, read on a loop's ENTRY values, denote the same thing as `b`? `entry` maps each header
-// param and back-edge arg to the arg the forward edge passes, so substituting through it models
-// the FIRST iteration — the state a guard in front of the loop tested. `negated` compares against
-// b's logical opposite instead, for the usual case where a guard spells the loop's own test the
-// other way round (`beq` to the exit vs `bne` to the header).
-//
-// Structural, not semantic: distinct ops with the same opcode, attributes and operands compare
-// equal (two `const 0`s do), anything else does not. A false negative costs a loud decline, which
-// is the direction to be wrong in. Memoised like `readsClobbered`'s `seen`: a value its own
-// consumer reads twice would otherwise double the work at every level.
-function sameAtEntry(defs: Map<Value, Op>, a: Value, b: Value, entry: Map<Value, Value>, negated = false): boolean {
-  const memo = new Map<Value, Map<Value, boolean>>();
-  const sameOp = (da: Op, db: Op, opcodeOk: boolean): boolean =>
-    opcodeOk &&
-    da.operands.length === db.operands.length &&
-    JSON.stringify(da.attrs ?? null) === JSON.stringify(db.attrs ?? null) &&
-    da.operands.every((o, i) => same(o, db.operands[i]));
-  const same = (x0: Value, y0: Value): boolean => {
-    const x = fold(defs, entry.get(x0) ?? x0);
-    const y = fold(defs, y0);
-    if (x === y) {
-      return true;
-    }
-    let row = memo.get(x);
-    if (!row) {
-      memo.set(x, (row = new Map()));
-    }
-    const hit = row.get(y);
-    if (hit !== undefined) {
-      return hit;
-    }
-    const da = defs.get(x);
-    const db = defs.get(y);
-    const r = !!da && !!db && sameOp(da, db, da.opcode === db.opcode);
-    row.set(y, r);
-    return r;
-  };
-  if (!negated) {
-    return same(a, b);
-  }
-  const da = defs.get(fold(defs, entry.get(a) ?? a));
-  const db = defs.get(fold(defs, b));
-  return !!da && !!db && sameOp(da, db, NEGATED_ICMP[da.opcode] === db.opcode);
-}
-
 // WHERE A SUNK COPY IS REBUILT. The copy is not carried into the body, it is SPELLED AGAIN
 // there, so the point it belongs at is the one its value was computed at: the arg's own defining
 // op, when that op is one of `latch`'s — the block whose statements both loop emitters render
@@ -1068,7 +1019,8 @@ export function makeLoopHazards(deps: LoopHazardDeps): LoopHazards {
     testSkipsAnEffect,
     preUpdateCondFold,
     sinkablePreUpdateSlots,
-    sameAtEntry: (a, b, entry, negated = false) => sameAtEntry(defs, a, b, entry, negated),
+    sameAtEntry: (a, b, entry, negated = false, through = undefined) =>
+      sameAtEntry(defs, a, b, through ? { entry, through } : { entry }, negated),
     loopWriteSet,
     loopWriteSetAhead,
   };