diff --git a/docs/cookbook-index.md b/docs/cookbook-index.md
index 849ef506cf..57549c4dbb 100644
--- a/docs/cookbook-index.md
+++ b/docs/cookbook-index.md
@@ -2,7 +2,7 @@
> **Generated by `tools/cookbook_index.py` — do not hand-edit** (R33). Regenerate after adding a cookbook section.
>
-> `docs/matching-cookbook.md` is ~716 KB / 506 sections. Grepping it blind is how three P30 wave-1 agents each "discovered" an idiom that was already written down. **Start here, then read the section.** A section appears under every symptom it addresses.
+> `docs/matching-cookbook.md` is ~716 KB / 508 sections. Grepping it blind is how three P30 wave-1 agents each "discovered" an idiom that was already written down. **Start here, then read the section.** A section appears under every symptom it addresses.
**How to use:** name what you SEE in the diff (a stolen delay slot, an extra `la`, a swapped register pair, a `conflicting types` error), find that symptom below, read those sections first. If nothing fits, THEN grind — and add a section when you win.
@@ -435,7 +435,7 @@
- **§162** — THE LICM PAIR: what makes an address a movable AT ALL, and why the preheader order is the body order (P30 S47, `ov_MAIN_012`) L11140
- **§166** — THE DESTINATION-TU ORACLE (P30 S48): the seven-attempt bug that was never codegen L14899
-### build graph, splat & the harness (108)
+### build graph, splat & the harness (109)
- **§4** — Flag/toolchain gotchas L190
- **Build** — mechanism — per-file opt override (splat resegmentation) L288
@@ -545,8 +545,9 @@
- **§163** — S48 WAVES 2-3 HARVEST (P30, 2026-08-11/12): the five that were byte-probed and are actionable L11757
- **§165** — S48 WAVE-4 HARVEST (P30, 2026-08-12): banked the same day the wave landed L13686
- **§166** — THE DESTINATION-TU ORACLE (P30 S48): the seven-attempt bug that was never codegen L14899
+- **§167** — S48 WAVE-5/6 HARVEST (P30, 2026-08-12): the saturation point L14955
-### process, measurement & doctrine (71)
+### process, measurement & doctrine (72)
- **§8e** — The jtbl ALIGNMENT LAW + the pad-spec filter — multi-table .rodata spans (Phase 29, byte-proven; `.run/probe_jtbl/verdict.md`) L530
- **§3-The** — mechanism: game-code dedup is SOURCE-LEVEL, not an object swap (R-D1, the key lesson) L926
@@ -619,6 +620,7 @@
- **§163z** — THE UNVETTED REMAINDER (do not cite as law; each needs a dedupe pass) L11825
- **§164z** — REFUTED CLAIMS: do NOT re-derive these L13620
- **§165z** — REFUTED THIS WAVE: do NOT re-derive L14855
+- **§167z** — REFUTED IN WAVES 5/6: do NOT re-derive L16151
### (unbucketed — title matched no symptom vocabulary) (166)
@@ -1298,3 +1300,5 @@
- **§3-The** — ADDRESS-CLASS TABLE: which load/store pairs even REACH the `/s` clause (P30 S48 wave 4, `func_80185B44`, ov_SC03_014) L14339
- **§165z** — REFUTED THIS WAVE: do NOT re-derive L14855
- **§166** — THE DESTINATION-TU ORACLE (P30 S48): the seven-attempt bug that was never codegen L14899
+- **§167** — S48 WAVE-5/6 HARVEST (P30, 2026-08-12): the saturation point L14955
+- **§167z** — REFUTED IN WAVES 5/6: do NOT re-derive L16151
diff --git a/docs/matching-cookbook.md b/docs/matching-cookbook.md
index c8636f6342..66b2d6ea4f 100644
--- a/docs/matching-cookbook.md
+++ b/docs/matching-cookbook.md
@@ -14948,3 +14948,1259 @@ pinned triple end-to-end, and masked-diff your function out of the WHOLE-TU obje
TUs: 279/279, 0 masked diffs, cpp/cc1 clean; collateral check 71/71 other sized symbols identical.
The same agent corrected the family reach to **×2** (only two `.s` exist, byte-identical modulo the
overlay name) against a map that claimed ×5.
+
+
+---
+
+## §167 — S48 WAVE-5/6 HARVEST (P30, 2026-08-12): the saturation point
+
+27 note-sets, **197 distinct laws claimed**, one independent skeptic each, vetted against a cookbook
+already holding §162-§166 from this same campaign:
+
+| verdict | count | | evidence | count |
+|---|---:|---|---|---:|
+| NEW | 5 | | byte-probed | 92 |
+| SHARPENS | 43 | | single-instance | 75 |
+| COVERED | 126 | | asserted | 30 |
+| UNSOUND | 23 | | | |
+
+**COVERED+UNSOUND: 57% (§164) → 64% (§165) → 76% (here).** The duplicate rate rises monotonically as
+the base grows — **the idiom well for THIS class of function is approaching dry.** Five genuinely new
+laws out of 197 claims is the signal to stop mining waves for idioms and spend the tokens on cracks.
+
+**THE SKEPTICS RAN THEIR OWN A/Bs THIS TIME** — several refutations are byte-measured, not
+argued. The best example: a crack agent claimed "the SOURCE STATEMENT BOUNDARY decides whether the
+scheduler hoists a far-consumed load". The vetter built that exact spelling and got `.text`
+**byte-identical** to the inline form (12 mismatched either way) — then swept eight *positions* and
+got five distinct objects, showing the lever is the statement's POSITION (the already-banked
+`INSN_LUID` tie-break), not the boundary. A plausible mechanism, refuted by measurement, with the
+true lever named in its place.
+
+*(NEW; evidence: byte-probed; from `func_8017EEEC`)*
+
+**§167-01 — A JUMP-TABLE ENTRY THAT LANDS IN THE *INTERIOR* OF ANOTHER ARM'S BODY IS A C CASE FALL-THROUGH — AND `match_one` CANNOT SEE THE DIFFERENCE.** *(NEW. §163c reads the entry values only for the `jtbl[k] == default label` fingerprint; §162a1/§162a2 rule the two EDGES; §165-42 rules an entry at `arm_start+4` (the reorg copy-steal) and says outright it is 'not a case'. This is the interior case, it IS a case, and it is the positive half §161a's corollary (L10989) never stated. It also adds a FIFTH row to §87's blindness ladder — §81's row is a duplicated table at the wrong ADDRESS; this is the right table at the right address with the WRONG WORDS.)*
+
+**Target shape** (`func_8017EEEC`, ov_SC06_011, 108 ins, reach 6):
+
+ lhu $v1,0x34($s0) ; sltiu $v0,$v1,0x5 ; beqz $v0,.L8017F074 ; jr $v0 <- 5-entry dispatch
+ jtbl_801AA880 = [ 0x8017EFB0, 0x8017F074, 0x8017EFF0, 0x8017F074, 0x8017EF3C ]
+ ^interior ^epi ^arm ^epi ^FIRST body
+ 8017EF3C: la $s1,D_801202A0 … 0x60-iteration sweep …
+ 8017EFAC: addiu $s1,$s1,0x10C <- loop ends, NO `j` — falls through
+ 8017EFB0: lw $v0,%lo(D_80126CC8)($v0) <- table entry[0] lands HERE, 0x74 into the arm
+ 8017EFE8: j .L8017F074 <- *this* arm's `break`
+
+**THE LAW.** Every word in the `ADDR_VEC` is a case LABEL. `expand_end_case` emits one word per value in `[minval,maxval]` and the bodies in SOURCE order (§55a), so:
+* the **lowest** body address in the table names the arm written **FIRST**;
+* an entry that lands strictly between two other entries' addresses splits that block into **two arms joined by a `/* fall through */`** — the earlier-addressed case's body flows into the later one. Confirm it with the `j`: gcc emits a `j ` for every `break` **except** the last-emitted arm, so **an arm that ends without a `j` and is not the last arm is a fall-through arm.**
+Read the shape above as `case 4: {sweep} /* fall through */ case 0: {if (D_80126CC8==a0) …} break;` — case 4 first, because 0x8017EF3C < 0x8017EFB0.
+
+**WHY IT IS INVISIBLE — the fifth blindness row.** Moving the sweep from `case 0` to a fall-through `case 4` changes **zero instructions**. Both spellings, pinned triple, masked vs `asm/ov_SC06_011/nonmatchings/ov_SC06_011_jr_8017BEBC/func_8017EEEC.s`:
+
+| source | ins | masked diffs | emitted `.rdata` |
+|---|---|---|---|
+| `case 0: {sweep; if(D_…)…} … case 4: default: break;` | **108** | **0** | `[$L3, $L2, $L12, $L2, $L2]` — entry[0]=sweep, entry[4]=default |
+| `case 4: {sweep} /*fall through*/ case 0: {if(D_…)…} break;` | **108** | **0** | `[$L10, $L2, $L13, $L2, $L3]` — entry[0]=interior, entry[4]=sweep — **the target** |
+
+Two functionally different programs, one instruction stream. `match_one` masks relocations and never looks at `.rodata` at all; `rtu_match` masked-diffs the function out of the whole-TU object and is blind for the same reason. **Both report MATCH on the wrong one.** The error surfaces only after `jtbl_carve` puts the compiled table at the table's real address — as a 2-word whole-binary DIFF with a spotless per-function gate (§52b, with no residual to read).
+
+**THE DIAGNOSTIC TELL — three lines, before writing any C for a `jr` function.**
+1. Take the table's DISTINCT non-epilogue entries and sort them by address. Lowest = the arm written first (§55a).
+2. For each entry, ask where it lands: `== an arm's start` ⇒ ordinary arm; `== arm_start+4` ⇒ §165-42's stolen head insn, **not** a case; `== the epilogue` ⇒ empty case (§162a2/§162a1 at the edges); **strictly interior** ⇒ **case fall-through, and the enclosing arm's case value is the one written first.**
+3. Cross-check with the `j`s: count arms ending in `j `. It must equal (number of arms with a `break`) − (1 if the last-emitted arm breaks). A missing `j` at an arm boundary that carries a table entry IS the fall-through.
+
+**BYTE EVIDENCE.** `func_8017EEEC` (ov_SC06_011, 108 ins). Target table `asm/ov_SC06_011/data/tail18.data.s:21-27`. Both C variants compiled on the pinned triple (`tools/bin/gcc-2.7.2-psx/cc1 -quiet -O2 -G0 -mips1 -mcpu=3000 -mgas -msoft-float -fgnu-linker`, maspsx `--aspsx-version=2.56 --expand-div`), `masked_diff.structured_diff` = 0 for both. The wave-5 draft `.run/wave6/func_8017EEEC/func_8017EEEC.c` (sha1 `baae6aba…`) is the first row and was blessed as a bankable MATCH by two independent agents and by `rtu_match`. *Scope: one function, both directions byte-measured; the mechanism (ADDR_VEC words are case labels, bodies in source order) is structural, not statistical.*
+
+*(NEW; evidence: byte-probed; from `func_801805D4`)*
+
+**§167-02 — `match_one` DECIDES WHETHER TO PREPEND `common.h` BY GREPPING THE RAW DRAFT TEXT, SO THE DIRECTIVE SPELLED INSIDE A COMMENT SUPPRESSES THE REAL ONE.** *(NEW. §40a (L2610) and §42a (L2960) both state that isolation compiles are `-Iinclude` + a prepended `common.h`; each describes the prepend as a fact of the environment and neither says it is CONDITIONAL, let alone on what. §96/§104 establish the class — a scan that reads RAW text counts prose as code — for `reconcile_tu` and `gather_externs`; this is that class inside the gate proxy every drafter runs, and §165-13 is its sibling on the other side of the same file.)*
+
+The check, verbatim (`tools/match_one.py:71-75`):
+
+ src = masked_diff.strip_scalar_typedefs(src)
+ if '#include "common.h"' not in src:
+ src = '#include "common.h"\n' + src
+
+`strip_scalar_typedefs` → `cdecl.strip_provided_typedefs` drops typedef STATEMENTS only; it never masks comments, so comment text reaches the test intact.
+
+**THE LAW.** A draft that spells `#include "common.h"` anywhere — including inside a `/* */` header block — satisfies the test, the prepend is suppressed, and cc1 compiles a TU with no scalar types at all. The diagnostic is a `CC1 FAIL` in which `s32`/`s16`/`u32` **and every parameter and local** are "undeclared (first use this function)" — which reads as an `engine_types` / §163a declaration-conflict problem and has nothing whatever to do with the body.
+
+**BYTE EVIDENCE** (vet-time, pinned triple, `func_801805D4`, ov_SC07_006 / `jr_8017BEBC`). Shipped draft `.run/wave6/func_801805D4/func_801805D4.c`, which paraphrases the directive → **MATCH (212 ins)**. The SAME file with one comment word changed — `(via its common.h include ->` → `(via its #include "common.h" ->`, **no code touched** → **CC1 FAIL**: `t.c:131: parse error before 't'`, `:133: 's32' undeclared`, `:135: 't' undeclared`, `:136: 'u' undeclared`, `:136: 's16' undeclared`, `:136: 'arg1' undeclared`.
+
+**BLAST RADIUS — the same defect is on a second rung of the ladder.** `tools/reloc_verify.py:71` carries the identical `if '#include "common.h"' not in src:` inside `build_object()` (the §88f relocation gate), so a draft that trips `match_one` trips `reloc_verify` the same way and for the same reason.
+
+**DIAGNOSTIC TELL.** A `CC1 FAIL` in which the SCALAR TYPES THEMSELVES are undeclared is never a body problem and never a decl conflict — run `grep -n 'common\.h' ` before reading a single line of C. If the hit is inside a comment, paraphrase it ("via its common.h include"). Tool-side fix is §104's two-text discipline: run the test against `cdecl._mask`ed text, never the raw source.
+
+*(NEW; evidence: byte-probed; from `func_801832F8`)*
+
+**§167-03 — A `short / CONSTANT` DIVISION IS COMPUTED IN HImode, SO ITS QUOTIENT CARRIES AN EXTENSION — AND THE *DESTINATION'S* DECLARED WIDTH DECIDES WHERE THAT `sll 16 ; sra 16` LANDS.** *(§1-I3 gives only the authoring rule for the magic multiply and one ÷10 pair; §164-04 covers pure powers of two, where the shortening leaves no residue. §164-37/§165-29 own the same `get_unwidened`/promotion axis for a SWITCH operand only. Nothing in the file states the division case, the position rule, or the −2 lever.)*
+
+Target shape — a magic-multiply quotient joined to a running total, with a 16-bit round trip on ONE side of the add:
+
+ sra $v0,$a3,3
+ subu $v0,$v0,$v1 <- the quotient, NOT truncated
+ addu $v0,$s1,$v0 <- + pan
+ addu $s1,$v0,$zero
+ sll $v0,$v0,16
+ sra $v0,$v0,16 <- the SUM is truncated
+ bgez $v0,...
+
+**THE LAW.** `c-typeck.c:2023-2033` (`build_binary_op`, the TRUNC_DIV_EXPR arm) sets `shorten = 1` whenever the divisor is an `INTEGER_CST != -1`; `c-typeck.c:2352-2356` then calls `get_narrower` on both operands. So `*(s16 *)p / 20` is evaluated in **HImode**, the magic-multiply quotient is a 16-bit value, and it must be sign-extended before it can join an SImode sum. **Where the `sll 16 ; sra 16` pair lands is decided by the width of the variable the sum is assigned to, not by the division:**
+
+| destination of `pan + field/K` | emitted |
+|---|---|
+| `s16` | quotient bare, extension rides the **SUM** (after the `addu`) — *the target* |
+| `s32` | extension rides the **QUOTIENT** (before the `addu`), sum bare |
+
+**THE −2 LEVER, AND THE CAST THAT IS INERT.** Only a real `s32` local kills the shortening — `get_narrower` strips a cast but cannot strip a VAR_DECL:
+
+ pan + out1.x / 20; -> 32 ins (shortened, quotient extended)
+ pan + (s32)out1.x / 20; -> 32 ins (IDENTICAL — the cast is inert)
+ s32 xv = out1.x; pan + xv / 20; -> 30 ins (no shortening at all)
+
+**Byte evidence.** All on the pinned triple. `func_801832F8` (ov_SC02_041), the agent's own isolators re-run: `.run/wave6/func_801832F8/dbg/isolate.c` (`s32 pan`, pinned) 35 ins with `sll/sra` on the quotient; `isolate2.c` (`s16 pan`, same pin) 35 ins with `sll/sra` on the sum; `isolate3.c` (`s32 pan`, unpinned) 32 ins, same shape as isolate — **the pin is not the variable.** Controls `.../vet832F8/cA,cB,cC,cD` give the table above; `cD` (`/16`) confirms the power-of-two path (§164-04) carries no residue because the `sra` already leaves the value in range. Target anchor: `asm/ov_SC02_041/nonmatchings/ov_SC02_041_jr_8017BEBC/func_801832F8.s` at 801833C4-801833D8 (`pan`) and 80183454-80183464 (`vol`, the same shape with `sll` alone for a sign test) — **both accumulators in this function are `s16`.**
+
+**THE DIAGNOSTIC TELL.** A magic-multiply quotient with a `sll 16 ; sra 16` pair on ONE side of the following `addu`/`subu`, count-neutral. **Read which side.** Extension on the SUM ⇒ the accumulator is a `short`; declare it `s16` and assign to it. Extension on the QUOTIENT ⇒ the accumulator is an `int`. Neither ⇒ the dividend reached the division through a named `s32` local. Do not reach for pins, `(s32)` casts or the permuter — the cast is provably inert and the width is one character of source.
+
+**Bound.** Constant divisors only (`shorten` needs `INTEGER_CST`); a *variable* divisor takes the `divu`+break path (§1-I4) and never shortens. Unsigned dividends shorten unconditionally (`TREE_UNSIGNED (orig_op0)`).
+
+*(NEW; evidence: byte-probed; from `func_801832F8`)*
+
+**§167-04 — A register-pinned struct base's field reads need explicit per-field temps to keep gcc's natural multi-register**
+
+**§16N+1 — A `register __asm__` PIN ON A STRUCT BASE SERIALISES THAT BASE'S OWN FIELD READS INTO ONE REGISTER; NAMED PER-FIELD TEMPS BUY THE PARALLEL FORM BACK. UNPINNED, THE TWO SPELLINGS ARE BYTE-IDENTICAL.** *(a sixth channel for §164-49's class — a pin whose damage is not the pinned register but the code AROUND it. §72/§74 price a pin as a preference and a call-crossing hazard; §165-47 prices singleton pins on one insn; §45-Lever-B/§76 own the REUSED-temp serialisation via `local-alloc.c:472`. None covers a pinned base's own field loads, and none names the cure.)*
+
+Target shape — three halfword fields copied off one base into a stack struct, all three loads ABOVE all three stores, in three different registers:
+
+ lhu $v0,0x6($s3)
+ lhu $v1,0xA($s3)
+ lhu $a2,0xE($s3)
+ addu $a1,$s0,$zero
+ sh $v0,0x20($sp)
+ sh $v1,0x22($sp)
+ jal func_8012EFB8
+ sh $a2,0x24($sp)
+
+**THE LAW.** With the base declared `register s32 base __asm__("$19")`, writing the copies inline —
+`in2.x = *(u16 *)(base + 0x6);` ×3 — emits a strictly serial `lhu $v0 / sh / lhu $v0 / sh / lhu $v0 / sh` chain: each load's destination dies into its own store, so one scratch is reused and sched1 has nothing independent to interleave. Naming the three values first —
+
+ { u16 fx = *(u16 *)(base + 0x6), fy = *(u16 *)(base + 0xA), fz = *(u16 *)(base + 0xE);
+ in2.x = fx; in2.y = fy; in2.z = fz; }
+
+gives three pseudos that are all live before the first store, forcing three registers and letting all three loads rise above all three stores — the target's shape.
+
+**⚠ THE LEVER IS CONDITIONAL ON THE PIN, AND IT IS NOT A LENGTH LEVER.** 2×2 on `func_801832F8` (ov_SC02_041), `match_one` vs `asm/ov_SC02_041/nonmatchings/ov_SC02_041_jr_8017BEBC`:
+
+| base | field reads | result |
+|---|---|---|
+| pinned `$19` | per-field temps | 111 ins, **40** mismatched |
+| pinned `$19` | inline | 111 ins, **54** mismatched |
+| unpinned | per-field temps | 109 ins, 101 mismatched |
+| unpinned | inline | 109 ins, 101 mismatched — **byte-identical to the row above** |
+
+Unpinned, the edit is a no-op: spend it only when the base carries a pin. And **do not price it as instructions** — the pin costs +2 in both spellings and the temps recover none of it; they buy register identity only. (Files: `.../vet832F8/w6_{base,inlinefields,nopin_temps,nopin_inline}.c`.)
+
+**THE DIAGNOSTIC TELL.** The target reads N fields off one base into N DIFFERENT registers and stores them afterwards; your draft emits N `load ; store` pairs through one scratch, same instruction count — **and the base is pinned.** Give each field a named local. If the base is NOT pinned, this residual is somewhere else entirely; do not buy the edit.
+
+*Scope, honestly: one function, one base, three fields, four cells. The mechanism (dying-into-store scratch reuse vs three overlapping live ranges) is reconstructed from the emitted register pattern, not from a `-dl`/`-dg` join; the cheap confirmation nobody has run is `cc1 -da` on the pinned pair and a diff of `.lreg`.*
+
+*(NEW; evidence: byte-probed; from `func_801874C0`)*
+
+**§167-05 — QUALIFYING *BOTH* MEMs OF A DISAMBIGUATED PAIR `volatile` IS THE ONLY WAY TO PUT A DEPENDENCE EDGE BACK. A LONE `volatile` IS BYTE-INERT.** *(NEW. Completes §16Z's ADDRESS-CLASS TABLE, whose rows 1-3 record "**0** — not needed" in the escape column and therefore leave every disambiguated cell with no lever at all. §37, §16Xy, §136d-3, §162q and §165-46 are all edge-DROPPING levers; this is the file's first edge-CREATING one. §164-79/§165-44 name the two-base barrier only as a diagnostic. §16Z states the both-volatile conjunction only for `read_dependence`, i.e. load-vs-load.)*
+
+Target shape — a store and a later load through ONE base pseudo at two constant offsets, where the target keeps them in source order and every draft hoists the load:
+
+ TARGET (both volatile) MINE (every non-volatile spelling)
+ sh $v1,0xA($s0) addiu $a0,$sp,0x10
+ lhu $v0,0x6($s0) <- stays lhu $a1,0x6($s0) <- hoisted ABOVE the store
+ addiu $a0,$sp,0x10 …
+ sh $v1,0xA($s0)
+
+**THE LAW.** All three dependence predicates are one disjunction (`tools/reference/gcc-2.7.2/sched.c:817-838` `true_dependence`, `:844-864` `anti_dependence`, `:866-882` `output_dependence`):
+
+ (MEM_VOLATILE_P (x) && MEM_VOLATILE_P (mem))
+ || (memrefs_conflict_p (…) && ! )
+
+`memrefs_conflict_p` (`:613`) is the first conjunct of the **second** term only. So on §16Z's rows 1-3 — two distinct symbols, `$sp+K` vs a symbol, and **the same base register at two constant offsets whose byte ranges are disjoint** — the second term is dead outright, and **no `/s` grant, no statement order, no register pin and no scope/reuse edit can create the edge**: the `/s` clause only ever *removes* one. The first term is the only remaining door, and it is a **CONJUNCTION**. `sched.c`'s own header comment says it (`:768-771`): *"If both memory references are volatile, then there must always be a dependence between the two references, since their order can not be changed. A volatile and non-volatile reference can be interchanged though."*
+
+**BYTE EVIDENCE — the full 2×2, re-verified at vet time from the objects on disk** (`func_801874C0`, ov_SC03_014, 241 ins; `.run/wave4/func_801874C0/w_*/func_801874C0/t.o`, pinned triple, every variant 241 ins):
+
+| spelling | `objdump` lines differing from the no-volatile baseline |
+|---|---|
+| neither (`w_v6`) | — baseline, 8 mismatched vs target |
+| **store only** `*(volatile s16*)(a0+0xA) = …` (`w_pA1`) | **0 — byte-IDENTICAL** |
+| **load only** `*(volatile u16*)(a0+0x6)` (`w_pA2`) | **0 — byte-IDENTICAL** |
+| **both** (`w_pA`) | **16** — the `lhu 0x6` drops below the `sh 0xA`, the `addiu $a0,$sp,0x10` follows it: **MATCH 241/241** |
+
+**Two controls that pin the mechanism to the alias oracle and to nothing else.**
+* **`w_pA4` — volatile on the store to `0xA` *and* on the load from `0xA` (the SAME address): 0 differing lines.** A pair `memrefs_conflict_p` already conflicts on gains nothing. The qualifier pays **only** where the oracle had disproved the conflict.
+* **A lone `volatile` also defeats cse-hashing for that access, and it moves zero bytes** — which rules out a cse story and leaves the scheduler conjunction.
+
+**Widening is not free — qualify the ONE pair, not the object.** `w_pA3` (store + all three loads) and `w_pA5` (7 accesses) are byte-identical to the minimal pair; `w_pV3` (14) = 246 ins (**+5**); `w_pV1` (whole entity, 38) = **258 ins (+17)**.
+
+**THE DIAGNOSTIC TELL.** A load and a store through the same base pseudo at two constant offsets, the target holding them in source order, your draft hoisting the load, and **every** structural respelling returning the *identical* mismatch count — the flat plateau that means you are not steering the pass that decides. Before writing an "unsteerable" verdict, evaluate `memrefs_conflict_p` by hand for the pair against §16Z's table: **if it returns 0 you are not on a scheduling tie at all — you are missing an edge, and only the volatile pair can supply it.**
+
+**⚠ HONEST SCOPE.** `volatile` here is a compiler-steering construct, near-certainly not what the original author wrote; some non-volatile spelling yielding two *distinct base pseudos* would create the same edge (§164-79) but costs an address materialisation. 20 single-base variants — shared and per-field scratch temps (§162b), `s16*`/`u16*` pointer locals (combine folds them back), struct-vs-array buffers, a single `V8 v[3]`, operand re-association, statement order, arg-address hoisting, pointer-typed prototypes, a copy of the parameter — all sat at exactly 8 mismatched. Unlike a `register __asm__` pin (§165-47/§37), a `volatile` cast is ordinary C and is not special-cased anywhere in `tools/dedup_propagate.py`, so it should not forfeit the h_seq family — untested on a real sweep.
+
+**⚠ TWO LIST CORRECTIONS.** (1) This law is the *explanation* of the §164z `func_8017CA18` entry's observation half ("`volatile` applied to the RMW side is a no-op") — one-sided `volatile` is **supposed** to be inert. (2) The §165z `func_801874C0` entry ("the residual is unreachable by respelling") is **byte-superseded**: the mechanism half was right and already banked as §164-79, but the *unreachable* verdict is now refuted by the `w_pA` object.
+
+*(NEW; evidence: byte-probed — 2×2 ablation plus two controls, re-verified at vet time from the on-disk objects; mechanism source-cited to the pinned `tools/reference/gcc-2.7.2/sched.c`; from `func_801874C0`)*
+
+*(SHARPENS — sharpens §165-03 (L13716-13740), §163e (L11813-11821), §164-72 (L13412), §164-53; evidence: byte-probed; from `func_8017C294`)*
+
+**§167-06 — EVERY RELOAD SPILL SLOT IS 8 BYTES, IN ANY MODE, BECAUSE `alter_reg` PASSES `align = -1`.** *(Derives the constant §165-03 measures and builds its frame formula on; BOUNDS §163e's 'a scalar `s32` gets only 4-byte alignment' to DECLARED locals — carrying that sentence across to a SPILL mis-prices the frame by 4 per slot.)*
+
+**Target shape.** `vars=` exceeds the sum of your declared locals by a multiple of 8, none of the excess is `$sp`-addressed, and you are trying to price a spilled `s16`/`s32`.
+
+**THE LAW.** `reload1.c:657-658` walks `for (i = LAST_VIRTUAL_REGISTER+1; i < max_regno; i++) alter_reg (i, -1);` — ascending pseudo NUMBER (§163e), `from_reg == -1` — and `alter_reg` allocates with `x = assign_stack_local (GET_MODE (regno_reg_rtx[i]), total_size, -1)` (`reload1.c:2349`; the slot-reuse path at `:2382` passes `-1` too). `assign_stack_local`'s `align == -1` arm (`function.c:681-685`) sets `alignment = BIGGEST_ALIGNMENT / BITS_PER_UNIT` and, **uniquely among its three arms, rounds the size**: `size = CEIL_ROUND (size, alignment)`. MIPS sets `BIGGEST_ALIGNMENT 64` (`config/mips/mips.h:1080`). ⇒ **a spilled HImode pseudo, a spilled SImode pseudo and a combine-orphan all cost exactly 8 bytes, 8-aligned. The mode never reaches the frame.** Only DECLARED locals see their own alignment — `assign_stack_temp` takes the `align == 0` arm (`function.c:675-680`), which is the case §163e measured.
+
+**Corollary — the frame is a two-ended pseudo-BIRTH oracle.** Ascending regno + `expand` minting in source order ⇒ the LOWEST spill slot belongs to the earliest-born pseudo (in an arg-spilling function, the incoming-argument pseudo) and the HIGHEST to whatever pass minted last; after expand only `loop.c` mints (§147-CORRECTED A). *A value the target spills at the TOP of the block therefore cannot be a declared local at all.*
+
+**BYTE EVIDENCE** (`.run/wave6/func_8017C294/`, pinned `cc1 -O2 -G0 -mips1 -mcpu=3000`; two drafts, one formula):
+- `dmp_fas/`: declared aggregates `32+32+32+8+8 = 112` (every scalar is a register candidate and contributes 0), `grep -c 'ST_REGS or none' t.i.lreg` = **16**, `t.cc1.s` = `.frame $sp,312,$31 # vars= 256` = `112 + 8×(16 orphans + 2 real spills)`, exact.
+- `dmp_base/` (same body plus `s32 pad[4]`): declared **128**, orphans **14**, same `vars= 256` = `128 + 8×(14+2)`. Different split, same arithmetic.
+
+**DIAGNOSTIC TELL.** **Never price a spill by its C type.** Count orphans with `grep -c 'ST_REGS or none' t.i.lreg` (§165-03) and real spills from `.greg`'s `regs to allocate` minus the placed ones, then multiply **both** by 8 — `vars = Σ(declared locals) + 8×(orphans + real spills)`.
+
+*(SHARPENS — sharpens §165-03 (L13738, the flagged ⚠ open detail), §165-02 (L13914), §147-B CORRECTED (L10117); evidence: byte-probed; from `func_8017C294`)*
+
+**§167-07 — ONLY A DELETION THAT HAPPENS *AFTER* `life_analysis` CAN ORPHAN A PSEUDO — AND AN ORPHAN LEAVES *TWO* DIFFERENT RESIDUES IN `-dc`.** *(Closes §165-03's flagged ⚠ open detail and corrects its causal order; supplies the necessary condition behind §165-02's 'must come from MEMORY'; reconciles §147-B-corrected's `(use)` account with §165-03's 'present in no insn'.)*
+
+**THE PASS ORDER, from `toplev.c`.** cse (`:2865`) → loop → cse2 (`:2926`) → **`flow_analysis` / `life_analysis` (`:2983`)** → **combine (`:3004`)** → sched1 (`:3033`) → `regclass` + `local_alloc` (`:3051-3052`) → `global_alloc` (`:3080`) → reload. `reg_n_refs` is filled by `life_analysis` and is **never recomputed** before `alter_reg` reads it (`reload1.c:2330`, gated `reg_n_refs[i] > 0`).
+
+**THE LAW.** A pseudo whose insns die in **cse / loop / cse2 / jump** is recounted to **zero** by the later flow pass and can never take a slot. A pseudo whose insns die in **combine** keeps its pre-combine count forever and is slotted. **The recipe's real precondition is not 'memory' — memory is what makes the deletion a COMBINE deletion** (there is a load for the widening to fold into). A redundant copy, an alias of a parameter, or a register-sourced short is killed by cse, *upstream of the count*, which is why no amount of retyping buys frame from it.
+
+**TWO RESIDUES, ONE OUTCOME.** §165-03 says the orphan 'appears in no insn in `-dc`'s combine dump'; §147-B-corrected says combine leaves `(use (reg)) + REG_DEAD`. **Both forms exist in one function** (`.run/wave6/func_8017C294/dmp_fas/`, 16 orphans):
+- **`(use)` form, 14 of 16** — `distribute_notes` has a `REG_DEAD` note with no home and plants a bare `(use)` (`combine.c:10835-10847`, §36). `t.i.combine:396` = `(insn 719 191 193 (use (reg:SI 147)) -1 (nil)` with `(expr_list:REG_DEAD (reg:SI 147)` on the next line; `t.i.lreg` = `Register 147 used 4 times across 1 insns in block 4; ST_REGS or none.`
+- **Ghost form, 2 of 16** — nothing survives at all. Pseudos 103/104 (the head `ws`/`hs`) appear as `(set (reg:SI 103) (ashift …))` + `(ashiftrt (reg:SI 103) 16)` in `t.i.cse2:200-206` and `t.i.jump:65-71`, appear **nowhere** in `t.i.combine`, and still print `Register 103 used 2 times across 2 insns in block 0; dies in 0 places; ST_REGS or none.` — a count for two insns that no longer exist.
+
+⇒ **the `(use)` is not what keeps the count alive; flow banked the count before combine ran.** The `(use)` matters only in that it carries no constraints, so `regclass` (after combine) records no class for either form, the all-zero cost vector converges on `ST_REGS`, and §165-03's allocation story runs unchanged.
+
+**BYTE EVIDENCE.** Five dumps under `.run/wave6/func_8017C294/`: `grep -c 'ST_REGS or none' t.i.lreg` = 14 / 16 / 16 / 14 / 16 (`dmp_base`, `dmp_fas`, `dmp_m2`, `dmp_s9`, `dmp_zbss`) against `grep -c '(use (reg' t.i.combine` = 28 / 30 / 30 / 28 / 30 — a **constant offset of 14** (the call-argument and return `(use)`s) ⇒ **+1 orphan ⇔ +1 planted `(use)`**, five bodies, one function.
+
+**DIAGNOSTIC TELL.** You added a narrow memory value and `vars` did not move: find out **which pass ate it**, not which type it had. `grep -n 'reg:SI N' t.i.cse2 t.i.combine t.i.lreg` — absent from `t.i.cse2` onward ⇒ cse killed it, the count went with it, no slot exists at any spelling; present in `t.i.cse2`, absent from `t.i.combine`, still printed in `t.i.lreg` ⇒ ghost form, the slot is already yours.
+
+*(SHARPENS — sharpens L2266-2270 (§ giant-crack recipe item 2) — 'Declare each callee to match the ACTUAL call site — count the `$a0–$a3` (+ stack) set before each `jal`, NOT the canonical sig; evidence: byte-probed; from `func_8017EEEC`)*
+
+**§167-08 — AN ARGUMENT REGISTER THAT IS *READ* BEFORE THE `jal` IS SCRATCH, NOT AN ARGUMENT — COUNT THE DEFS, NOT THE MENTIONS.** *(sharpens the giant-crack recipe's arity rule at L2267, 'count the `$a0–$a3` set before each `jal`', which is right about DEFS and is routinely misread as 'count the $aN mentions'; the complement of §164z's `func_80186C4C` refutation, which killed the inverse inference — a `nop` delay slot does NOT prove a 0-arg callee.)*
+
+**Target shape** (`func_8017EEEC` @8017EFC4, ov_SC06_011) — four `$a`-register mentions around one call, and the callee takes nothing:
+
+ lhu $v1,0x88($s0) ; lhu $a0,0x8A($s0) ; lhu $a1,0x8C($s0)
+ sh $v0,0x34($s0) ; sh $zero,0x5C($s0) ; sh $v1,0x6($s0)
+ sh $a0,0xA($s0) <- $a0 READ as a store SOURCE, before the jal
+ jal func_8017F364
+ sh $a1,0xE($s0) <- $a1 READ in the DELAY SLOT
+
+**THE LAW.** `$a0–$a3` are ordinary caller-saved registers; local-alloc hands them to any pseudo whose live range does not cross the call. `expand_call` materialises real arguments as the **last defs before the `jal`** (a `move`/`lw`/`li` into `$aN` with no intervening use of that register as a source). So: **an `$aN` whose last event before the `jal` is a READ — it is a store's value operand, a compare operand, an address — died before the call and was never an argument.** A store in the delay slot reads its operand *before* the callee runs, so it is not evidence either way on its own; the def/use direction is.
+
+**BYTE EVIDENCE — the counterfactual costs two `move`s and permutes the file.** Same body, only the callee's arity changed, pinned triple:
+
+| spelling | ins | masked diffs |
+|---|---|---|
+| `extern void func_8017F364(void); … func_8017F364();` | **108** | **0 — MATCH** |
+| `extern void func_8017F364(u16,u16); … func_8017F364(t1,t2);` | 110 | **53**, LENGTH-DRIFT |
+
+The 2-arg build is unmistakable: gcc allocates the stored halfwords to `$a2`/`$v1` (`lhu $a2,138($s0) ; lhu $v1,140($s0)`) and emits `move $a0,$a2 ; move $a1,$v1` immediately before the `jal` — **it will not source a store from a register it is about to load an argument into.** The target has no such `move` pair, so the call is 0-arg. Corroborated independently by §166a's oracle: the destination TU `src/ov_SC06_011/ov_SC06_011_jr_8017BEBC.c` defines `void func_8017F364(void)` itself, ~60 lines below the splice point.
+
+**THE DIAGNOSTIC TELL.** Before declaring a callee, walk backwards from the `jal` and mark each `$aN`: **DEF with no later use before the call ⇒ argument. USE (source operand of a store/compare/ALU op) ⇒ scratch.** Then stop at the first `$aN` that is neither — argument registers are filled contiguously from `$a0`. If the TU (or a sibling TU) defines the callee, that definition outranks the register read (§166a).
+
+*(SHARPENS — sharpens §164-12, §136d-2, §164-57, §164-73; evidence: byte-probed; from `func_8017F17C`)*
+
+**§167-09 — A `?:` IN AN `if`'s CONTROLLING EXPRESSION IS EXPANDED ONE CONDITIONAL BRANCH PER ARM. HOIST IT ANYWHERE — TERNARY-INTO-A-LOCAL, `if/else`, OR CONDITIONAL OVERWRITE; ALL THREE ARE BYTE-IDENTICAL.** *(sharpens §164-12, which reaches the SAME `do_jump` COND_EXPR case only via `fold-const.c:3276-3333`'s distribution over an ENCLOSING comparison and is stated for a `?:` used as a comparison OPERAND — the `?:` as the condition itself needs no fold and is not covered. Distinct from §136d-2 / §164-57 / §164-73 / §164-74 / §165-21, every one of which is about the select's VALUE DESTINATION — reg, MEM, call — and none about it being the test.)*
+
+Target shape — TWO branches, the one-instruction arm living entirely in the first branch's delay slot, and no `j` to a join:
+
+ andi $v0,$v1,0x2000
+ bnez $v0,.L8017F330
+ andi $v0,$v1,0x8000 <- the whole ELSE arm, in the delay slot
+ jal func_8012BEE8
+ addu $a0,$s0,$zero <- the THEN arm, falling through
+ .L8017F330: beqz $v0,.L8017F354 <- ONE consumer test
+
+**THE LAW.** `if (c ? A : B)` reaches `do_jump`'s COND_EXPR case (`expr.c:9124-9151`) directly: each arm gets its own `do_jump` aimed at the CONSUMER's true/false labels, so you pay **one conditional branch per arm plus the drop-through** — three conditional branches where the target has two, **+2 ins**. Take the select out of the controlling position and give it a name; both arms then expand as VALUES into one pseudo and a single test sits below the join.
+
+**The dial is POSITION, not spelling.** Pinned cc1 (`-quiet -O2 -G0 -mips1 -mcpu=3000 -mgas -msoft-float`), one function, `r` from a preceding call so the prologue is already emitted:
+
+| spelling | ins | conditional branches |
+|---|---:|---:|
+| `if ((r & 0x2000) ? (r & 0x8000) : h(a0))` | **20** | **3** |
+| `c = (r & 0x2000) ? (r & 0x8000) : h(a0); if (c)` | 18 | 2 |
+| `if ((r&0x2000)==0) c = h(a0); else c = r & 0x8000; if (c)` | 18 | 2 |
+| `c = r & 0x8000; if ((r&0x2000)==0) c = h(a0); if (c)` | 18 | 2 |
+
+The last three are byte-identical up to label numbering. **The +2 is the isolated figure**; the crack note reported +1 from an in-function count — §165-22's precedent, do not use the in-function number as the tell.
+
+**⚠ DO NOT RE-BUY (byte-refuted at vet time).** *"The CALL must be the FALLTHROUGH arm — invert the source condition to choose."* Putting the call in the `else` arm gives the **same 18 instructions and the same 2 branches**, differing only in label numbers: gcc inverts the test for you. (Arm order does move one byte in the degenerate shape with NO preceding call — 16 vs 17 — but that is the prologue's own `sw $31` competing for the slot, not the select.) Likewise do not reach for §2-T4's polarity invert; the polarity is a consequence of the hoist, not a dial.
+
+**BYTE EVIDENCE.** `func_8017F17C` (ov_SC02_026, 133 ins, banked at `src/ov_SC02_026/ov_SC02_026_jr_8017C180.c:3723`) uses the if/else-into-`c` form; the isolated 5-spelling A/B above reproduces the target's exact branch/delay-slot shape from the hoisted form and only from it.
+
+**DIAGNOSTIC TELL.** THREE conditional branches where the target has two, **+2 ins**, and your extra branch tests a value one arm has just computed. Hunt for a `?:` sitting in an `if`'s controlling expression and bind it to a local — any binding will do. Reading the target from the other side: a branch whose **delay slot holds a complete one-instruction arm**, whose fall-through is the other arm, with **no `j` to a join** and a single test after the label, is a two-armed select assigned to a temp — not a threaded condition and not two independent tests.
+
+*(SHARPENS — sharpens §164-20, §160d, §165-02, §16Xy; evidence: byte-probed; from `func_8017F17C`)*
+
+**§167-10 — A SIGNED-NARROW LVALUE COMPARED AND THEN RE-READ COSTS ONE `move` **AND** 8 BYTES OF FRAME — ONE EDIT, TWO SYMPTOMS.** *(extends §164-20's second-read law off the DELAY SLOT — §164-20's three-way tell is keyed on the slot's owner and has no route for a copy that sits between a load and a compare; gives that law a SIGNEDNESS gate; and supplies §165-02 / §16Xy the construct row they lack, joining the copy to the orphan slot. BOUNDS §162i1's "Δ multiple of 8 ⇒ declare `s32 pad[Δ/4]`".)*
+
+Target shape — no delay slot in sight; the copy sits between the load and a compare that clobbers the load's register:
+
+ lh $v0,0x102($s0)
+ addu $a0,$v0,$zero <- the copy IS the second source read
+ slti $v0,$v0,0x20 <- clobbers the load's register
+ ...
+ addiu $v0,$a0,1
+ sh $v0,0x102($s0)
+
+**THE LAW.** Reading ONE signed narrow (HI/QI) memory lvalue in a guard **and again inside the guarded arm** mints two things at once. cse rewrites the second load as `(set P2 P1)` and it survives as a bare `move` (§164-20's mechanism, off the delay slot). And the SImode extension `combine` cannot fold — a narrow use, the `sh` store-back, survives — is stranded as an orphan pseudo that `alter_reg` hands **exactly 8 bytes** of `vars` no instruction ever references (§165-02's rule, §16Xy's `.greg` mechanism). **Hoisting the read into one `s32` local deletes BOTH. Never diagnose them as two residuals.**
+
+**The gate is the load opcode.** Isolated on the pinned cc1 (`-quiet -O2 -G0 -mips1 -mcpu=3000 -mgas -msoft-float`), one 4-line function, `if (*(T*)(p+0x102) < 0x20) { *(T*)(p+0x102) = *(T*)(p+0x102) + 1; g(p); }`:
+
+| T | emitted | vars | ins |
+|---|---|---:|---:|
+| `short` | `lh` + **`move`** + `slt` | **8** | 12 |
+| `signed char` | same shape | **8** | 12 |
+| `unsigned short` | `lhu` + `sltu`, **no copy** | 0 | 11 |
+| `int` | **no copy** (cse collapses it) | 0 | 11 |
+| `short`, read hoisted into `int n` | **no copy** | 0 | 11 |
+| `unsigned short` + a `(short)` cast on the compare | `lh` + **`move`** | **8** | 12 |
+
+The last row is the discriminator: the **signed compare** is the trigger, not the pointer's spelling.
+
+**Bounds, each byte-measured.** An `(s32)` cast on the second read buys nothing (still 8/12 — §21, gcc re-derives). The guard must compare the SAME lvalue the arm re-reads: compare `x` / store from `y` ⇒ 0; two reads passed as call ARGS with no store-back ⇒ 0 (cse commons them); the read-modify-write with no compare at all ⇒ 0. Ordered vs equality compare is irrelevant (`!= 0x20` ⇒ 8/12). A call in the arm is not required. Two independent sites ⇒ `vars= 16`, additive (§16Xy says the same of its own construct).
+
+**BYTE EVIDENCE.** `func_8017F17C` (ov_SC02_026, 133 ins, banked at `src/ov_SC02_026/ov_SC02_026_jr_8017C180.c:3723`). Real `cpp | cc1` pipeline: banked body `.frame $sp,48 # vars= 16, regs= 4/0, args= 16`, 118 cc1-insns. Hoist the `0x102` read into `s32 n` ⇒ `vars= 8`, 117 insns — one `move` and 8 bytes of frame from one character of source. Neutralise the guarded block entirely (`if (0)`) and `vars` drops 16 → 8, locating the 8 bytes.
+
+**⚠ DO NOT RE-BUY — the 8-byte hole above an align-1 local is NOT the struct's slot being rounded.** Measured, 7 spellings: an 8-byte `struct { u8 c[8]; }`, address-taken and assigned from a global, reserves `vars= 8` — identical to `char s[8]`, `int s[2]`, `struct {int a,b;}`; only a 16-byte struct reserves 16. And "the hole absorbed my `s32 pad[1]`" proves nothing: §162i1 byte-proves a one-element array is INERT **everywhere**.
+
+**DIAGNOSTIC TELL.** A bare `move` / `addu rD,rS,$zero` between a narrow LOAD and a compare that CLOBBERS the load's register — no delay slot involved, so §164-20's three-way tell never fires — is a SECOND SOURCE READ, not an allocator artifact. **Check the frame in the same breath:** if you are also 8 bytes light, it is the same edit, and §162i1's "Δ multiple of 8 ⇒ declare `s32 pad[Δ/4]`" will send you to invent a dead local you do not need (measured here: `s32 pad[2]` ⇒ 0x38, FAIL). Then route by the second read's opcode: a second `lw`/`lbu` ⇒ §160d (keep the re-read, the load survives); `addu …,$zero` in a delay slot ⇒ §164-20; `addu …,$zero` before a clobbering compare ⇒ here.
+
+*(SHARPENS — sharpens §166a, §165-36 rule 2, §162g; evidence: byte-probed; from `func_8017F2D4`)*
+
+**§167-11 — THE DESTINATION-TU ORACLE, STATED EXACTLY: the LAST component of the `INCLUDE_ASM` subdir is the TU stem, and the stem ALONE resolves the file.**
+
+§166a says *"the third path component **is** the TU stem"* and draws one shape. Both need fixing before an agent can apply it mechanically.
+
+**THE TWO SHAPES** (they differ by the presence of an overlay component, not by the rule):
+
+ asm//nonmatchings//.s -> src//.c (398 of 476 live TU dirs)
+ asm/nonmatchings//.s -> src/.c ( 78 of 476 — the main exe)
+
+**THE LAW, ordinal-free.** The TU stem is the **last component of the `INCLUDE_ASM` subdir** = the **parent directory of the `.s` file**. Never count from the left: in the overlay form the third component is `nonmatchings`, and §166a's `src//.c` template is wrong for every main-executable stub (`asm/nonmatchings/libgte21/…` is `src/libgte21.c`, not `src/nonmatchings/libgte21.c`).
+
+**WHY IT IS STRUCTURAL, not a convention that could drift.** A splat `c` subsegment is a SINGLE token: `- [0x56c04, c, ov_SC01_005_jr_8017ED5C]` (`config/splat.ov_SC01_005.yaml:125`). That one token generates both `/.c` and `/nonmatchings//`. The paths cannot disagree unless the config is edited between the two.
+
+**BYTE EVIDENCE (whole tree, current HEAD).**
+* **13,630 / 13,630** `INCLUDE_ASM` rows in `src/`: subdir's last component == the containing file's stem. Zero exceptions.
+* **13,630 / 13,630**: the overlay component (when present) == the containing directory; the 2,002 rows with no overlay component all live in `src/` root.
+* **476 / 476** `asm/**/nonmatchings//` dirs holding `.s` resolve to an existing `src` file. The only non-conforming `asm` dirs are `*/data/` (rodata carves) and `asm/header.s` — neither holds a function stub.
+* **4,153 / 4,153** `src/**/*.c` stems are unique repo-wide ⇒ **the stem alone is a sufficient key.** You do not need the overlay component to resolve the TU, which is what makes the ordinal-free phrasing safe across both shapes.
+
+**⚠ AUTHORITATIVE ≠ DURABLE (see §165-36 rule 2).** The oracle binds the **current** `asm/` tree to the **current** `src/` tree. A subdir recorded in a note, a backlog row or a `.run/*_ready.json` is a *stale* path, not an oracle — splat moved `func_8017F2D4` from `…_jr_8017C340` to `…_jr_8017ED5C` and `.run/jr48/wave1_ready.json` still carries the old one. Re-glob `asm/**/nonmatchings/*/.s` before deriving anything.
+
+**THE DIAGNOSTIC TELL.** You are about to splice, and the path in the prose has a *different* stem from the `--asm-subdir` you were handed ⇒ the prose is wrong, every time (a name grep hits callers and prototypes in sibling TUs and reads identical to a destination hit). One-line check, no build: `ls src/$(dirname )`— or simply `find src -name "$(basename ).c"`, which is unambiguous because stems are unique.
+
+*(SHARPENS — sharpens §164-62, §80 (R7), §158, §36 (KEEPALIVE KILLS THE DYING-HARD-REG SUGGESTION, L2498); evidence: byte-probed; from `func_8017F3C8`)*
+
+**§167-12 — THE KEEPALIVE'S ANCHOR CAN BE `volatile` INSTEAD OF A SECOND OPERAND — and §36's bare single-input form is inert only because it is NON-volatile.** *(SHARPENS §164-62, which supplies exactly one anchor — "name a value whose def is at or below the consuming insn" — and never names this one, though its own mechanism paragraph contains the fact that makes it work; widens §80-R7, stated only at behemoth/pin scale; and identifies §158's range-extender as the same construct seen from the `allocno_compare` side rather than the `qty_phys_sugg` side.)*
+
+Target shape — §164-62/§80's in-place-reuse tell on an ordinary leaf, the value held in a callee-saved pin:
+
+ mine: sll $s1,$s1,16 <- destructive, in place; $s1 "dies" at this insn
+ target: sll $v1,$s1,16 <- preserving copy into a fresh scratch
+
+**THE LAW.** `local-alloc.c:1795-1834` records the dying hard reg in `qty_phys_sugg` unconditionally, with no death guard (§80), and `find_free_reg` (`:2150`) honours the suggestion only while that reg is free across the quantity's range — i.e. only while it dies at that insn. §80-R7's cure (keep it alive past the temp) is right, and §164-62 is right that a NON-volatile input-only `asm` is an ordinary schedulable insn carrying only its operands' deps, so written after the consuming insn while naming only the dying source it floats ABOVE and anchors nothing. §164-62 fixes that with a second operand. **`__asm__ __volatile__` is the other fix and needs only the one operand:** `stmt.c:1502` sets `MEM_VOLATILE_P` from the keyword and `sched.c:1957` then takes the clobber-everything barrier path, so the asm cannot float above the insn it was written after, the death moves onto it, and the suggestion never fires. Materialise the comparison into a named boolean first so there is a statement boundary to sit on:
+
+ s16 cmp = sVar2 > sVar3;
+ __asm__ __volatile__("" :: "r"(sVar2)); /* the `volatile` is the whole anchor */
+ if (cmp) { … }
+
+**BYTE EVIDENCE** — `func_8017F3C8` (ov_SC06_011, 66 ins, **NEAR 5/66, not banked**). Eight A/B pairs on one base, one variable each: dropping `__volatile__`; placing the keepalive before the compare; inside either arm after the `if`; and wrapped as a GNU statement-expression evaluated before the compare — **all regress to the in-place `sll $s1,$s1,16` form at 11-13 mismatches**, against 5 for the form above. Both the keyword and the position are load-bearing, independently.
+
+**DIAGNOSTIC TELL.** §164-62's tell unchanged (one-register diff, target's dest a fresh `$v0`/`$v1`, yours the operand's own register, pseudo NUMBER identical across every `-da` dump and only its COLOUR differing). **Before reaching for §164-62's second operand, check whether you wrote `volatile`.** Free confirmation either way: `grep -n '#APP' t.s` — if the block sits ABOVE the insn you wrote it after, the asm is non-volatile and inert; adding `volatile` pins it there at zero bytes. Prefer the volatile form when there is no value defined at or below the consuming insn to name; prefer §164-62's second operand when you are inside a region where a new barrier would move a schedule (§47's rule).
+
+*Scope: one function, eight controlled pairs, measured as mismatch counts against the target rather than a gated MATCH — the function was still 5-off when the probes were taken. Re-confirm on a banked exemplar before treating the position rule as exact.*
+
+*(SHARPENS — sharpens L2465 (§34 'Statement-position / type levers': "a leading `pb = param_3;` rides sched.c:3191-3215's 'don't delay getting parameters' pin so combine folds the parm-save in; evidence: byte-probed; from `func_8017F76C`)*
+
+**§167-13 — A LEADING `p1 = a1;` DOES NOT *RIDE* THE bb0 PARAMETER PIN — IT **TERMINATES** IT, AND ONLY FOR THE COPIES AFTER IT. The dose is "break the run as EARLY as the target needs".** *(SHARPENS L2465 (§34's statement-position lever list), whose one line — "a leading `pb = param_3;` rides `sched.c:3191-3215`'s 'don't delay getting parameters' pin so combine folds the parm-save into it (prologue order)" — names the pin but has the direction, the pass and the dose wrong for this shape; and BOUNDS `docs/gcc-2.7.2-map/sched.md` S8, "anything before the first non-param-copy insn is immovable — don't fight it".)*
+
+Target shape — the call's argument setup WOVEN INTO the prologue save/copy pairs:
+
+ target: sw $s3 / move $s3,$a0 / li $a0,0x3B / sw $s6 / move $s6,$a1 /
+ move $a1,$s3 / sw $s5 / move $s5,$a2 / sw $s4 / move $s4,$a3 / jal
+ mine: sw $s3 / move $s3,$a0 / sw $s6 / move $s6,$a1 / sw $s5 /
+ move $s5,$a2 / sw $s4 / move $s4,$a3 / li $a0,0x3B / move $a1,$s3 / jal
+
+Same instruction count, same register letters, same everything else — the arg setup just sits BELOW every pair.
+
+**THE LAW.** `schedule_block` (`tools/reference/gcc-2.7.2/sched.c:3186-3213`, guarded `reload_completed == 0 && b == 0`) walks the head of bb0 and sets `INSN_REF_COUNT = 1` — *"Keep this insn from ever being scheduled"* — on the **leading run** of `(set pseudo hardreg)` parameter copies. The loop demands `GET_CODE (head) == INSN`, so **any NOTE inside the run ends it**, and a deleted insn is a NOTE. The prologue saves are threaded after global-alloc (`toplev.c:3103`) and weave at **sched2**, where every candidate here ties at priority 1 and at class 3 against the last-scheduled `sw $ra`, so `rank_for_schedule` falls all the way through to `INSN_LUID (tmp) - INSN_LUID (tmp2)` = stream order. Unlevered, all four parm copies are pinned, permanently out-LUID the arg setup, and win every tie — **no statement order anywhere in the body reaches this.**
+
+**THE LEVER.** A leading `s32 p1 = a1;` makes cse DELETE the original a1 parm copy (insn 6 → NOTE) and rewrite the later `p1 = a1` to read `(reg:SI 5 a1)` directly, so it survives as a HIGHER-UID insn further down the stream. That NOTE terminates the pin run **after the a0 copy alone**; a1/a2/a3 become schedulable; sched1's `adjust_priority` birthing boost (`birthing_insn_p`, `REG_N_SETS == 1`) lifts those single-set copies to `0x7f000001` while the arg setups stay at 1; sched1 is BACKWARD, so boosted = picked first = emitted LAST. Post-sched1 the stream is `4 (s3=a0) / 19 ($a0=0x3B) / 16 (s6=a1) / 21 ($a1=s3) / 8 (s5=a2) / 10 (s4=a3) / call` = the target's bb0 verbatim, and because sched2's LUIDs are sched1's output order (sched.md S9) there is nothing left to undo.
+
+**THE DOSING RULE (the operational half, and not what you would guess).** A leading copy frees only the parm copies **after** it. A/B, same file, one line each, pinned triple:
+
+| leading copy | residual |
+|---|---|
+| *(none)* | 8 mismatched |
+| `p3 = a3` | 8 — frees nothing |
+| `p2 = a2` | 7 |
+| `p1 = a1` | **MATCH 154/154** |
+| all three | MATCH |
+
+So the rule is **"break the pin run as EARLY as the target needs"**, not "launder the parameter you happen to use". Also byte-inert here: retyping parameter 1 to `u8 *` (8).
+
+**DIAGNOSTIC TELL.** A residual that is a pure SCHEDULE-REORDER **confined to bb0** — instruction count exact, every register letter already correct — with the call's argument setup (`li $aN,K` / `move $aN,$sN`) sitting BELOW all the `sw $sN`/`move $sN,$aN` prologue pairs the target weaves them into. Do **not** reach for a `register __asm__` pin (§36: pins wreck the save-birthing order) or §67's asm launder: this is a plain C statement, costs zero instructions, and keeps `compiles_standalone` so the draft still propagates to its family (§37).
+
+**⚠ BOUND ON L2465, recorded because the one-liner mispredicts this shape.** The levered copy does **not** ride the pin in prologue order — in the `cc1 -dS` stream it lands BELOW the arg setup — and the deletion is **cse**'s, not combine's. Read L2465 as naming the pin, not as describing the mechanism.
+
+**BYTE EVIDENCE.** `func_8017F76C` (ov_SC02_026, 154 ins, MATCH, clean standalone compile, no pins, no permuter; draft + dumps at `.run/wave4/func_8017F76C/`, header L38-L92). The source half was re-verified at vetting time against `tools/reference/gcc-2.7.2/sched.c:3186-3213`. Second natural instance: the §160g STEP-0 sibling `func_80181F88` (`src/ov_SC03_098/ov_SC03_098_jr_8017D898.c:5153`) carries the same odd-looking leading copy as its first line — **reading a sibling's weird first line beat every scheduler analysis on this function.**
+
+*(SHARPENS — sharpens §164-24 / §16x 'THE PLUS/MINUS CONSTANT MIRROR' (L12384-12405), incl. "A MINUS whose constant is FIRST comes back through the `varsign == -1` code flip (:3766) to the sam; evidence: byte-probed; from `func_8017F76C`)*
+
+**§167-14 — A TWO-TERM `CON - VAR` IS NOT THE SAME TREE AS `-VAR + CON`: `fold`'s `associate:` PATH CANNOT FIRE ON A BARE CONSTANT OPERAND, SO THE SPELLING SURVIVES TO RTL AND PICKS THE OPCODES.** *(BOUNDS §164-24 / "THE PLUS/MINUS CONSTANT MIRROR" (L12384-12405), whose "A MINUS whose constant is FIRST comes back through the `varsign == -1` code flip (`:3766`) to the same tree as the PLUS form" is byte-true for its THREE-term exemplars (`a -= K - J` ≡ `a += J - K`) and byte-FALSE for the two-term form; and bounds §164-16's "parentheses, operand order and same-mode casts are all inert", which holds only once `associate:` can run at all.)*
+
+Target shape — a negate feeding an add-immediate, with the negate in the branch delay slot:
+
+ bnez $v0,L
+ negu $v0,$s0 <- head of the FALL-THROUGH arm, taken into the slot
+ addiu $v0,$v0,0x400
+ j ...
+ L: addiu $v0,$s0,0x400
+
+**THE LAW.** `-base + 0x400` is `PLUS (NEG (base), 1024)` → `subu $2,$0,$4 ; addu $2,$2,1024` (the `negu`/`addiu` pair). `0x400 - base` stays `MINUS (1024, base)`: `split_tree` (`fold-const.c:882-950`) fires only on a PLUS/MINUS node with a decomposable operand, and a bare `INTEGER_CST` beside an opaque `VAR_DECL` offers nothing to split, so `associate:` never runs, the tree reaches RTL as a reverse subtract, and MIPS — which has no reverse-subtract-immediate — must materialise the constant first: `li $2,0x400 ; subu $2,$2,$4`. **Identical instruction COUNT, different opcodes, and a different insn at the HEAD of the arm** — which is exactly what `reorg` moves into the delay slot.
+
+**BYTE EVIDENCE** (re-measured at vetting time, pinned triple `cc1 -O2 -G0 -mips1 -mcpu=3000`, two files differing in one token):
+
+ s = -base + 0x400; -> bne $5,$0,$L2 / subu $2,$0,$4 / j $L3 / addu $2,$2,1024 / $L2: addu $2,$4,1024
+ s = 0x400 - base; -> bne $5,$0,$L2 / li $2,0x400 / j $L3 / subu $2,$2,$4 / $L2: addu $2,$4,1024
+
+Consumer: `func_8017F76C` (ov_SC02_026, 154 ins, MATCH) — `if ((rand() & 1) == 0) spd = -base + 0x400; else spd = base + 0x400;` (the polarity half is §3-T4, read off the target's `bnez`).
+
+**DIAGNOSTIC TELL.** A `li $vN,K` you never asked for occupying a branch delay slot where the target has `negu $vN,$sM`. Reading a target back to source: **`negu` immediately followed by `addiu +K` ⇒ the original wrote `-x + K`; `li K` followed by `subu` ⇒ it wrote `K - x`.** Do not sweep parenthesisations (§164-16: inert) and do not apply §164-24's mirror — with only one splittable term there is nothing to mirror.
+
+*(SHARPENS — sharpens §164-40 (byte evidence, L12714), §165-36 rule 2 (L14646); evidence: byte-probed; from `func_8017F9AC`)*
+
+**§167-15 — PROVENANCE — the cookbook's cite for morph_lerp (…jr_8017BEBC.c:4018) is one line past the helper; the definit**
+
+**⚠ Provenance (R37) — §164-40's `morph_lerp` cite is one line long, and every `func_8017F9AC` entry is gate-outstanding.** L12714 cites the helper at `src/ov_SC07_006/ov_SC07_006_jr_8017BEBC.c:4018`; the definition is **:3994-4017** (:4018 is the blank line after its closing brace) and `func_8017F9AC`'s `INCLUDE_ASM` splice site is **:4086**, not the inherited notes' "~:4089". Re-read against the live tree 2026-08-12. This is §165-36 rule 2 firing on THIS campaign's own entries — coordinates decay inside a single phase, not just across phases; carry the reasoning, re-resolve the line. **And the status line:** `func_8017F9AC` (ov_SC07_006, 275 ins) is **not banked** — backlog row 64, `match_one` MATCH / gate rejected on TU plumbing, `INCLUDE_ASM` still at :4086 — so §164-05, §164-06, §164-07, §164-18, §164-40, §164-41, §165-14 and §165-38 all rest on a MATCH that is in-situ-proven (below) but has never faced the whole-binary arbiter. ⚠ The `func_8017F9AC` *definition* that does exist in `src/` is `ov_SC02_028_jr_8017D898.c:3586` — a different overlay, an unrelated body at the same address. Do not read it as this function banked.
+
+*(SHARPENS — sharpens §88f (L6718-6724), §136 self-verification (L9333-9339), the two offline oracles (L9395-9405), §42c / tools/rtu_match.py (L3033-3043); evidence: byte-probed; from `func_8017F9AC`)*
+
+**§167-16 — THE IN-SITU PROOF: KEEP `INCLUDE_ASM` **LIVE** IN THE BASELINE AND THE WHOLE-TU `.text` sha1 BECOMES THE ORACLE.** *(sharpens §88f — this IS the "missing rung between `match_one` and the binary" it asks `tools/` for, obtained without writing a relocation resolver; sharpens §136's self-verification (L9333-9339) and offline-oracle 2 (L9403-9405), whose collateral check must ALLOW a `j`-addend shift 'of exactly your function's size'; and BOUNDS §42c / `tools/rtu_match.py`, which NEUTRALIZES the stub (`-DINCLUDE_ASM(a,b)=`, rtu_match.py:7,137) and therefore cannot produce this baseline at all.)*
+
+**Target situation.** `match_one`/`rtu_match` say MATCH. That is a candidate, not a bank (§52b) — relocations are masked (§81/§84/§87) and file-scope decl damage is invisible. You want the strongest verdict obtainable *without* a gate cycle.
+
+**THE PROCEDURE.** Scratch-copy the host TU and build **two** objects through the pinned triple (`cpp → cc1 -O2 → maspsx --aspsx-version=2.56 --expand-div → as`):
+* **baseline** — the TU exactly as committed, `INCLUDE_ASM` **left live**. `include/include_asm.h:7` expands to `.include "/.s"`, so `as` assembles the ORIGINAL game asm into the object at the function's exact size.
+* **candidate** — the same TU with the draft body spliced **over** that one `INCLUDE_ASM` line.
+
+Then compare **the entire `.text` section byte-for-byte** and set-compare `objdump -r`.
+
+**THE LAW.** Because the splice replaces the stub *in place*, the candidate's function occupies the same byte range the original asm did — **no size shift exists, so the collateral check collapses to exact `.text` equality with no addend allowance to reason about.** And because the baseline's bytes ARE the shipped code as assembled, the body comparison is against the game, not against the `.s` text, with relocation ENTRIES (symbol + type) directly comparable — closing the wrong-`jal`-target (§81), wrong-`%lo`-symbol/addend (§84) and wrong-`D_`-symbol (§87) classes in one diff. Neutralising the stub throws all of that away.
+
+**BYTE EVIDENCE.** `func_8017F9AC` (ov_SC07_006, 275 ins), artefacts at `.run/wave6/func_8017F9AC/insitu/`: `base.text.bin` and `tu.text.bin` are both **31,064 bytes, sha1 `0cacfe12d5774ea408d822fec2e923ecda49bb19`** — the whole TU `.text` identical spliced-vs-baseline, all 44 neighbour functions included; `relocs.txt` shows the function's 30 relocations agreeing symbol-for-symbol (11 `D_` globals as HI16/LO16 pairs, 4× `R_MIPS_26 func_8004787C`, 2× internal `R_MIPS_26 .text`); `cc1.err` carries **only** the TU's pre-existing `conflicting types for built-in function memcpy` at :2305 — §165-13's warning-visibility check satisfied, zero new diagnostics.
+
+**DIAGNOSTIC TELL — and it discriminates the failure, not just detects it.** One extra TU compile. Read the two shapes apart: **`.text` differs only INSIDE your function's range** ⇒ ordinary codegen, go back to the diff. **`.text` differs OUTSIDE it** ⇒ your probe layer changed the declaration environment (§8d/§161c) and the function's own bytes may be perfect — the class L9405 says 'the target function's own bytes cannot show'. Spend it on any draft where a wrong `%lo` or a file-scope collision would cost a gate cycle.
+
+⚠ **Still not the arbiter.** The whole-binary SHA1 (G3/P9) is (§52b). `func_8017F9AC` passed every clause above and is *still* backlog row 64, unbanked.
+
+*Honest scope: n=1 function, procedure verified from the artefacts on disk; PROCESS, not a compiler law.*
+
+*(SHARPENS — sharpens §165-40, §165-39, §165-14/§NNN (L13999-14029), §42; evidence: byte-probed; from `func_8017FE38`)*
+
+**§167-17 — A READ IS PLACED BY ITS STATEMENT'S POSITION, NOT BY HAVING A STATEMENT OF ITS OWN: the own-statement-but-late spelling is BYTE-IDENTICAL to the inline one.** *(BOUNDS §165-40, which reads as 'sched1 hoists it to the top of the block regardless'; instantiates §165-14's LUID law on a GLOBAL load whose consumer is ~200 instructions away.)*
+
+Target shape — a global `lhu` consumed ~200 instructions later, yet emitted at insn 6-7, with the `addiu` that competes for `$a0` pushed below the store that frees it:
+
+ /* 6 */ lui $v1,%hi(D_800B9A02)
+ /* 7 */ lhu $v1,%lo(D_800B9A02)($v1)
+ ...
+ /* 14 */ sw $a0,4($a3) <- the 0x808080 constant KEEPS $a0
+ /* 15 */ addiu $a0,$a1,0xDC <- $a0 reused only after the store frees it
+ /* 16 */ sll $v1,$v1,0xE
+
+**THE LAW.** Free the read from its consumer's expression **and** put the statement at the head of the block. cc1 emits each statement where it stands and `rank_for_schedule` falls through to `INSN_LUID` on the all-ties case (`sched.c:2425`, §165-14), so source position IS the schedule: an inline sub-expression inherits its enclosing statement's position, and a statement written beside the consumer inherits the same one. **The boundary is not the lever; the POSITION is** — and it is a plateau with a monotone tail, so sweep it (§67).
+
+| `d = *(u16 *)&D_800B9A02;` written … | mismatched vs the MATCH |
+|---|---|
+| head of body — 1st, 2nd or 3rd statement | **0 — MATCH** |
+| after `*(u32 *)(pkt + 4) = 0x808080;` | 7 |
+| after `va = (u8 *)(p + 0xDC);` · after `*(u8 *)(pkt + 7) = 0x2C;` | 11 |
+| its own statement, immediately above `ot = …[d << 14];` | 12 |
+| inline: `ot = (u32)&D_800A6610[(*(u16 *)&D_800B9A02) << 14];` | 12 — **byte-identical `.text` to the row above** |
+
+**BOUNDS §165-40.** §165-40 (same function) says sched1 hoists an independent symbol-address pair to the TOP of its block and prescribes a bare `__asm__ volatile("")` fence to deny it. That holds only up to the LUID tie-break: an independent load moves ahead of *dependent* work but keeps source order against other *independents*, which is why eight positions give five distinct objects. **Sweep the statement before you spend the fence.**
+
+**BYTE EVIDENCE.** `func_8017FE38` (ov_SC07_001, 239 ins, banked at `src/ov_SC07_001/ov_SC07_001_jr_8017BEBC.c:3976`). One-statement A/Bs against the banked body on the pinned triple (`cc1 -O2 -G0 -mips1 -mcpu=3000`, `maspsx --aspsx-version=2.56 --expand-div`), masked-diffed against the banked object; ladder above. The inline and own-statement-late objects differ only in the embedded source filename.
+
+**THE DIAGNOSTIC TELL.** A global `lui`/`lhu` pair the target places in the prologue region while your draft emits it beside its far-away consumer — with an unrelated `addiu $aN,$aM,K` sitting in the slot the target gives the load, and a materialised constant displaced out of `$a0`. Do not fence and do not pin: walk the read's STATEMENT up one statement at a time and take the plateau.
+
+*(SHARPENS — sharpens §78 third block (L6203-6209), §164-74 ⚠ (L13469), §67 refuted hypothesis (L5390-5397), §76; evidence: byte-probed; from `func_8017FE38`)*
+
+**§167-18 — THE TARGET NAMES THE VARIABLE TO REUSE: a value sitting in a register that a DIFFERENT value just vacated was the same SOURCE variable reassigned.** *(§78 and §164-74 both prescribe 'reuse an already-busy variable' and neither says WHICH one; both leave 'maybe it is declaration order' open. This closes both.)*
+
+Target shape — count-neutral, one register, on a mask of a still-live operand:
+
+ mine: andi $a1,$a1,0xFFFF ; … ; addiu $a1,$a1,-0x100 ; sb $a1,0xD($a3)
+ target: andi $v0,$a1,0xFFFF ; … ; addiu $v0,$v0,-0x100 ; sb $v0,0xD($a3)
+
+`$a1` is `y`'s own register — the value being masked. `$v0` is the register the PREVIOUS temp (`tp`, stored two insns earlier at `sh $v0,0x16($a3)`) has just released.
+
+**THE LAW.** A fresh local for the masked value is tied by local-alloc to the source it reads, so it lands in the operand's register. Reassigning the temp whose live range has just ended — `tp = y & 0xFFFF;` written after `x -= tp << 6;` — makes the allocator re-use the register that temp vacated, which is the target's. **Read the target's register choice as a statement about variable IDENTITY: when the target's value sits in a register a now-dead value released, rather than in its own operand's register, the original reassigned THAT variable.** This is the selector §78 and §164-74 do not supply.
+
+**DECLARATION ORDER IS NOT THE KNOB — negative control.** Six spellings of a separate `sv` local (declared first / mid / last in the block, assigned at the load, assigned after the `u0` store, block-scoped inside the `if`) give **`.text` byte-identical across all of them** — 4 mismatched every time. Only the reuse closes it, 4 -> 0. Second instance of §67's 'declaration order is likewise inert', now at HImode and in a call-free leaf. (A seventh probe that moves the ASSIGNMENT rather than the declaration costs 27 — that is §42 statement placement, a different axis; do not conflate them.)
+
+**BYTE EVIDENCE.** `func_8017FE38` (ov_SC07_001, 239 ins, banked at `src/ov_SC07_001/ov_SC07_001_jr_8017BEBC.c:3976`). Drop-one ablation against the banked body on the pinned triple: fresh `sv` = **4 mismatched at 239 ins**; `tp` reuse = **MATCH**. Permutation set `.run/wave4/func_8017FE38/S1…S6.c` (S1/S2/S3/S5/S6 identical `.text`).
+
+**THE DIAGNOSTIC TELL.** Count-neutral, one register, on a value produced by masking a still-live operand: if YOUR register is the operand's and the TARGET's is one a nearby store has just freed, you manufactured an allocno. Do not permute the declaration block and do not pin — rename the assignment onto the dead temp.
+
+*Scope: n=1 function, no `.lreg` dumped; the measurement is the law.*
+
+*(SHARPENS — sharpens §166a (THE DESTINATION-TU ORACLE — 'prove it in situ … splice into a private copy of the real TU, one directory deep, with a `shared` symlink … run the pinned triple end-; evidence: byte-probed; from `func_8017FFD0`)*
+
+**§167-19 — THE WHOLE-TU SYMBOL-LAYOUT ORACLE: keep `INCLUDE_ASM` LIVE, assemble from the repo root, and check every sized symbol's object offset against its SHIPPED VRAM delta.** *(SHARPENS §166a's in-situ recipe, which proves the function's BYTES and the collateral symbols' BYTES but never checks WHERE anything landed; and §8a, whose 'rtu_match … excludes the §8 jtbl rodata, so it MATCHes a body whose switch is subtly wrong' false-MATCH class this closes offline. Distinct from §137a oracle 2, which compares with-splice against without-splice — a SELF-comparison; this one compares against the SHIP.)*
+
+**The recipe — three lines on top of §166a.**
+1. Splice the draft over its own `INCLUDE_ASM` and leave **every OTHER `INCLUDE_ASM` live**. Do **not** neutralize them with `-DINCLUDE_ASM(a,b)=` — that is §42c's `rtu_match` trick and it is the opposite choice. Run `as` with **cwd = repo root** so the stubs' `.include "asm//nonmatchings/…"` paths resolve; the object then holds the TU's whole shipped text, not just your function.
+2. `nm -S` the object and drop zero-size symbols (§166a's `.NON_MATCHING` alias trap, restated — an unsized alias has no offset worth checking).
+3. Require, for every survivor, `st_value == VRAM(sym) − BASE(section)`, with `BASE(.text)` = the TU's first function VRAM and `BASE(.rodata)` = its first jtbl VRAM. Both bases and every symbol VRAM are already in the `.s` headers / `symbols.us.txt`.
+
+**THE LAW.** `.text` offsets are a running sum of sizes, so ONE wrong-length body shifts every symbol after it. Requiring the whole offset VECTOR to equal the shipped deltas therefore proves, in one command and with no target `.s` diff at all: your function's LENGTH, its POSITION (i.e. that nothing above it drifted), the length of every already-banked C sibling in the TU, and — because the `.rodata` base catches them — that the **jump tables are the shipped size**. That last clause is the point: §8a's false-MATCH class (`func_80159C84`'s second jtbl 5 words instead of 6) shifts the following jtbl by 4 and fires here, offline, where `rtu_match`/`match_one` are structurally blind and the file's only prescribed remedy is a full whole-binary gate.
+
+**Byte evidence.** `func_8017FFD0` (ov_SC03_108, 196 ins) spliced over `src/ov_SC03_108/ov_SC03_108_jr_8017F83C.c:2917`, one directory deep with a `shared` symlink so `../shared/engine_core.h` resolves, pinned triple end-to-end (`cpp -Iinclude` → `cc1 -O2 -G0 -mips1 -mcpu=3000 -mgas -msoft-float` → `maspsx --aspsx-version=2.56 --expand-div` → `as -march=r3000 -O1 -G0`): masked diff **196/196, 0 mismatches**, and **21/21 symbols at their exact shipped offsets, layout drift 0** — `func_8017FFD0` at `0x794` = `0x8017FFD0 − 0x8017F83C`. The 21 reconciles exactly against the tree: 15 `.s` under `asm/ov_SC03_108/nonmatchings/ov_SC03_108_jr_8017F83C/`, 4 col-0 C definitions in the TU (`func_8017F83C`:2759, `func_801803E0`:2932, `func_80180814`:3096, `func_8018087C`:3109), and 2 jtbls (`jtbl_801A0510`, `jtbl_801A05D8`).
+
+**⚠ Three bounds — this is a LENGTH/POSITION oracle, not a byte gate.**
+* It cannot see wrong bytes at the right length. §166a's masked diff is still the body check and the whole-binary SHA is still the arbiter (§52b).
+* It is **blind to the last symbol of each section** — nothing follows it to shift. Close that by also comparing each section's total size against `VRAM(last) + size(last) − BASE`.
+* Its live surface is your function + the TU's already-banked C functions + the jtbls. An `INCLUDE_ASM`'d sibling is verbatim shipped assembly and *cannot* drift, so in a 100%-stub TU the oracle gives you back only your own function's length.
+
+**Evidence scope (honest).** n = 1 and **green-only**: it was run on a MATCHing draft and never on a known-bad object. The negative control existed in the same note-set and was never fed to it — the barrier-stripped build of this very function is 189 ins, −28 bytes (§164-09's first table row), which would shift `func_801802E0` and everything below. That the oracle *fires* on drift is arithmetic, not a measurement; run it once on a bad object before quoting it as a gate.
+
+**THE DIAGNOSTIC TELL.** Offsets exact up to symbol K and uniformly off by a constant Δ from K+1 onward ⇒ **symbol K is Δ bytes wrong**, and K is the function to look at — even when K is not the one you spliced.
+
+*(SHARPENS — sharpens §152 (BYTE SIZE is the family key that name- and h_seq-grouping both miss — 'Byte size is an allocator-independent, name-independent, cache-independent family key … One c; evidence: byte-probed; from `func_8017FFD0`)*
+
+**§167-20 — §152's BYTE-SIZE FAMILY KEY IS BAND-DEPENDENT: exact for WHALES, ~92% garbage under 0x100.** *(BOUNDS §152, whose 'one command, exact, no false positives on the case measured' was measured on a 0xECC / 947-instruction body — the one band where it is in fact clean. Does not refute it: size is still the right candidate GENERATOR.)*
+
+§152 keys structural families on the `.s` header size (`grep -rl 'nonmatching .*, 0x' asm/*/nonmatchings/*_jr_/`). Measured over **all 11,681** `asm/*/nonmatchings/*/*.s`, with identity taken as the SHA1 of the opcode-only stream (the mnemonic after each `*/`, delay slots included):
+
+| size band | size-groups (≥2 files) | files | groups holding >1 body | files outside the group's dominant body |
+|---|---|---|---|---|
+| < 0x100 | 62 | 9,103 | 62 | **8,367 (91.9%)** |
+| 0x100–0x200 | 64 | 1,897 | 64 | 1,641 (86.5%) |
+| 0x200–0x400 | 91 | 460 | 89 | 291 (63.3%) |
+| 0x400–0x800 | 21 | 67 | 15 | 21 (31.3%) |
+| ≥ 0x800 | 4 | 14 | **0** | **0 (0.0%)** |
+
+**THE LAW.** Size is a *sieve*, and its selectivity IS the size. Above ~0x800 it is an exact key — which is why §152's whale exemplar had no false positives, and why that result must not be carried down. At ordinary overlay-function sizes it must be composed with a structural oracle before any remap is planned or any reach is reported.
+
+**Byte evidence — the case that found it.** `func_8017FFD0`'s family (ov_SC03_108, 196 ins, 0x310). The §152 command on `0x310` returns **5** files. Four share opcode-stream SHA1 `9afa3e4a…` — ov_SC03_108 `func_8017FFD0`, ov_SC03_110 `func_8018035C`, ov_SC03_112 `func_80181F74`, ov_SC05_001 `func_80183C9C` — and a full instruction-text diff with only symbol names and `.L` labels normalized is drift 0 across all 196 lines, which is what makes that remap a pure 4-symbol substitution. The fifth, `asm/ov_SC04_015/nonmatchings/ov_SC04_015_jr_8017AE2C/func_8017E520.s`, is an unrelated body: identical for four instructions (`addiu;sw;addu;sw` — every -O2 leaf prologue looks like this), then `lhu` where the family has `lh`, then `addiu;sll;sra;sltiu` where the family has `slti;bnez` — a §163b minval-biased `s16` switch dispatch, not a guard.
+
+**THE CHEAP COMPOSITION (keep §152, add two steps).** Size grep as the candidate generator → group candidates by the opcode-only stream → confirm each survivor with a full instruction-text diff, symbols and `.L` labels normalized. Steps 2 and 3 are grep-and-diff, zero tokens, and they turn a band-dependent sieve into an exact key at any size. §152's caution 1 still binds afterwards: `match_one`/`rtu_match` mask exactly the fields a remap rewrites, so only the whole-binary SHA gates the result.
+
+**DIAGNOSTIC TELL.** A size-keyed reach whose members' FIRST branch tests different struct offsets, or where one member extends its switch index and the others do not ⇒ you have a size collision, not a family. Run §164-45's 10-second check across the whole candidate set, not just against the Ghidra seed.
+
+*(SHARPENS — sharpens §45 Lever A (merged accumulator variables; gcc-2.7.2 global-alloc has no coalescing, K8), §164-64 (a local-alloc'd expression temp can claim $a0 and evict parameter 1), §; evidence: byte-probed; from `func_801805D4`)*
+
+**§167-21 — A REASSIGNED PARAMETER CARRIES ITS INCOMING ARGUMENT REGISTER THROUGH THE WHOLE FUNCTION: give the recomputed value its OWN local, and expect NO length change.** *(SHARPENS §45 Lever A, whose law — "gcc-2.7.2 global-alloc has no coalescing (K8), so one hard reg spanning disjoint regions can only come from one reused source variable" — is stated and byte-proven only in the MERGE direction; and §164-64, which supplies the `set_preference`/`prune_preferences` chain but at the opposite polarity, an anonymous temp EVICTING the parameter. Neither prices a reused PARAMETER, and neither warns that the residual is COUNT-NEUTRAL. Distinct from §161b/§162n2, which price an ALIAS of a parameter, not a reassignment of it.)*
+
+**Target shape** — one value recomputed between N inlined blocks, where the FIRST block reads the raw argument register and the later blocks read a callee-saved one:
+
+ mult $v0,$a0 <- block 1: the raw incoming parameter
+ ...
+ jal func_8004787C ; addu $s0,$v0,$zero <- left operand parked across call 2
+ jal func_8004787C ; sra $v0,$v0,4
+ addu $s0,$s0,$v0 <- the recomputed factor lands in $s0
+ ...
+ mult $v0,$s0 <- blocks 2 and 3
+
+**THE LAW.** The parameter's allocno is seeded with a copy preference for its incoming hard register off the prologue's `(set pseudo (reg 4))` (§164-64's citation, `global.c:1535-1619`). Reassign the parameter and both roles share ONE pseudo, so it holds `$4` for its entire life and the recomputed value can never reach `$s0`. Two named variables give two allocnos, and the second is then free to take the register of the anonymous left-operand temp that must survive call 2 — which is what puts the accumulation's result in the same `$s0` the park used.
+
+**BYTE EVIDENCE** (vet-time, pinned triple; `func_801805D4`, ov_SC07_006, 212 ins; base `.run/wave6/func_801805D4/func_801805D4.c`). Baseline with a separate `s32 u` → **MATCH 212**. Delete `u` and reassign the parameter `t` instead, nothing else changed → **mine=212, target=212, 76 mismatched, class `REGALLOC-PERM`, sig `$a0>$s0,$a1>$a0,$a2>$a1,$a3>$a2,$t0>$a3,$t1>$t0,$t2>$t1,$t3>$t2`**. Objdump of both builds at offset `0x128` isolates the single causal instruction: baseline `addu s0,s0,v0`, reassigned `addu a0,s0,v0`; everything downstream is that one register shift propagating through first-fit.
+
+⚠ **The producing note's own mechanism is byte-refuted — do not repeat it.** It reads "forced into a callee-saved reg for the WHOLE function → prologue `addu $s0,$a0,$zero` and a first loop `mult $v0,$s0`." The fused build emits **no prologue parameter copy at all**, its count is **identical**, and **all three** of its loops read `mult $v0,$a0`: the fused pseudo keeps `$a0`, it does not migrate to `$s0`. The prescription's direction is right; the register and the phantom extra instruction are not.
+
+**DIAGNOSTIC TELL.** Equal instruction counts, no prologue copy, and the whole caller-saved file shifted by one slot (`$a0>$s0,$a1>$a0,…`), with the target reading a callee-saved register where you read the raw argument register **in the later blocks only**. That is one variable doing two jobs. Split it before touching `register __asm__` pins, §148-C density sliders or the permuter — it is a one-line declaration edit. §45 Lever A is the same knob run the other way; read the target's FIRST block to decide which direction you need.
+
+*(SHARPENS — sharpens §164-05 (THE INLINE-EXPANSION FRAME ORACLE: frame - args - 4*regs COUNTS THE EXPANSIONS, L11944), §162i1 (the unreferenced-local frame oracle); evidence: byte-probed; from `func_801805D4`)*
+
+**§167-22 — THE INLINE-EXPANSION FRAME ORACLE MUST SUBTRACT THE ALIGNMENT PAD BEFORE DIVIDING: an ODD SAVED-REGISTER COUNT BREAKS THE "exact integer" STEP.** *(SHARPENS §164-05, whose procedure — divide `(frame − args − 4×regs)` by the body count, "an exact integer is your answer" — is byte-proven on two functions whose saved-register areas are 0 bytes (`func_8017DC1C`) and 16 bytes (`func_8017F9AC`). Both are already multiples of 8, so no rounding can occur in either row and the oracle's failure mode is invisible in its own evidence.)*
+
+**Target shape** — the same `static inline` helper, in a caller that saves an ODD number of registers:
+
+ addiu $sp,$sp,-0x68
+ sw $s1,0x5C($sp) ; sw $ra,0x60($sp) ; sw $s0,0x58($sp) <- 3 saved regs = 12 bytes
+ ... and NOTHING else in the function touches $sp
+
+**THE LAW.** gcc-2.7.2/MIPS rounds the total frame up to 8. When `args + vars + 4×regs` is not already 8-aligned the frame carries a 4-byte pad, §164-05's residual absorbs it, and the quotient misses an integer by `4/N` — which reads as "this is not an inline expansion" and sends you to §162i1's dead-local pad, the exact misroute §164-05 exists to prevent. Compute `p = (8 − ((args + 4×regs) mod 8)) mod 8` — equivalently try `p ∈ {0,4}` — and divide `(frame − args − 4×regs − p)`.
+
+**BYTE EVIDENCE** (`func_801805D4`, ov_SC07_006 / `jr_8017BEBC`, 212 ins, MATCH). Frame **0x68 = 104**; outgoing-args area 16 (the function makes four `jal`s); saved regs 3 × 4 = **12** at `0x58`/`0x5C`/`0x60`; the only `$sp` references in the entire function are the 8 prologue/epilogue words (`grep -c '\$sp'` = 8). §164-05 as written gives 104 − 16 − 12 = **76**, and 76/3 = **25.33 — no integer**. The true vars region is `0x10..0x57` = **0x48 = 72 = 3 × 0x18**, i.e. the same 24-byte helper local area measured across 25 expansions on `func_8017DC1C` and 4 on `func_8017F9AC`, with **4 bytes of alignment pad** sitting above the register saves. Same helper, same 24, N = 3 — the law itself reproduces exactly; only the arithmetic recipe needed the pad term.
+
+**DIAGNOSTIC TELL.** The quotient misses an integer by exactly `4/N`. Subtract 4 and re-divide **before** concluding the body is not an inline expansion; an odd saved-register count (3 or 5 `sw $sN`, `$ra` included) is the fingerprint that the pad is present.
+
+*(SHARPENS — sharpens §164-61 / §16Xd (L13164-13181) — the section being bounded, §48-B THE EBB RULE (L3468-3480) — 'cse resets its hash table at a label'; stated for copies that must SURVIVE,; evidence: byte-probed; from `func_80181500`)*
+
+**§167-23 — THE ARG-COPY ARITY TELL IS LABEL-SCOPED, NOT BASIC-BLOCK-SCOPED.** *(bounds §164-61/§16Xd; reads §48-B's EBB boundary for a DELETED copy instead of a surviving one)*
+
+§164-61 scopes its "the `nop` carries no arity information" exemption to "the parameter's own basic block" and tells you to "ask which block the `jal` is in." Read literally that mis-predicts, because **a conditional branch does not end the block that matters here.**
+
+Target shape — one function, one callee, one argument, the two halves 0x18 bytes apart:
+
+ /* 80181508 */ move $s0,$a0 <- the parm save
+ /* 8018151C */ bne $v0,$zero,.L8018153C
+ /* 80181524 */ jal func_80131C78 <- fall-through of a conditional branch:
+ /* 80181528 */ nop <- NO arg copy, delay slot is a real `nop`
+ .L8018153C: <- the FIRST CODE_LABEL in the function
+ /* … */ jal func_80131C78 <- same callee, same argument, past the label
+ /* … */ move $a0,$s0 <- and now the copy appears
+
+**THE LAW.** The copy is deleted by cse, and **cse's block runs label to label**: `cse_end_of_basic_block` scans `while (p && GET_CODE (p) != CODE_LABEL)` (`tools/reference/gcc-2.7.2/cse.c:8039`). A `JUMP_INSN` is not a terminator, so the **not-taken side of every conditional branch is still inside the parameter's own cse block** — which is sound, that side has exactly one predecessor path. Inside it the incoming hard reg still carries the value, the arg-setup `(set (reg $4) (parm-pseudo))` is redundant, and nothing is emitted. At the first `CODE_LABEL` the table resets (§48-B's EBB rule, stated there for copies you need to *survive* — this is the same boundary read for copies that get *deleted*) and every later call must materialise `move $a0,$sN`. **§164-61's exemption is therefore wider than its own prose: it covers every call between function entry and the first label, however many conditional branches sit in between.**
+
+**BYTE EVIDENCE** (`func_80181500`, ov_SC03_107, 212 ins, `match_one` MATCH ×3; `.run/wave6/func_80181500/{func_80181500.c,cc1.s}`). The draft declares `extern void func_80131C78(s32 a0);` and calls it with one argument at **four** sites. cc1 emits the first (`cc1.s:33` → `0x80181524`) with **no arg setup at all**, and all three later ones (`cc1.s:222`, `:352`, and `func_8012B030` at `:359`) with `move $4,$16` in the `jal` delay slot. Same function, same callee, same argument — the only variable is which side of `$L2`/`$L25` the call sits on. This is a **second overlay and a second callee** for §164-61, whose evidence was `func_80186C4C`/`func_8012C218` alone; and note §164-61's own listing already shows `bgtz v0,0x38` at idx 8 with the exempt `jal` at idx 10 — its exemplar was always the fall-through case its prose calls "the entry block."
+
+**DIAGNOSTIC TELL.** Before reading arity out of a `jal` delay slot, find the **first `CODE_LABEL`** in the target `.s` — the lowest address any branch or jump names. A bare-`nop` `jal` **above** that address is arity-SILENT: take the arity from the destination TU (§166), a sibling overlay, or a later call site, and do **not** buy the §17a-1 `((void (*)(void))f)()` cast to explain it. Only a bare `nop` on a `jal` **below** the first label is evidence, and only if `$a0` has not been re-materialised in between.
+
+*(SHARPENS — bounds §164-61/§16Xd (L13164-13181, "THE ARG-COPY ARITY TELL IS BASIC-BLOCK SCOPED"), extends §48-B (L3468-3480) to deleted copies, guards §161c/§17a-1; evidence: byte-probed; from `func_80181500`)*
+
+*(SHARPENS — sharpens §55a / §49-variant (L4099-4102), §162b1 (L11069, incl. tell #2), §162k1 (L11421), §164-48 (L12861); evidence: byte-probed; from `func_80181948`)*
+
+**§167-24 — THE TEMP YOU ADD TO KILL THE BIRTHING BOOST IS ALSO A WIDTH DECLARATION: share it at the VALUE'S OWN WIDTH, or the boost-kill stops being zero-byte.** *(sharpens §55a's §49-variant (L4099-4102) — "route the load through a temp assigned in BOTH halves of a branch ⇒ `reg_n_sets==2` ⇒ boost dead, **at zero byte cost**" — which names no TYPE for that temp; composes it with §162k1 (L11421) / §164-48 (L12861), which price a local's declared width but never as a PRECONDITION of a scheduling lever; and bounds §162b1's tell #2 (L11090), whose mask-cost route sends you to SPLIT the shared temp — which here re-arms the boost.)*
+
+**Target shape** — a jr-switch whose arms bump the same halfword state word, with a 2-insn transposition around a call and NO mask anywhere in the residual:
+
+ case 0: … sh $v0,0x34($s0) <- `state + 1` written back
+ case 1: … lhu/addiu/sh 0x34($s0) <- the same bump, other arm
+ residual: your `beqz` slot holds `move $a0,$s0`; the target's holds `addiu $v0,$a1,1`
+
+**THE LAW.** The §49-variant S2 kill is zero-byte **only when the shared pseudo's MODE matches the value's**. Declared `u16`, every set is HImode, combine's `reg_nonzero_bits` union (`combine.c:718-788`, §162b1) stays inside 0xFFFF and nothing re-widens or re-ranks; declared `s32` — one token, nothing else touched — the function repermutes. **Take the width off the lvalue the value is stored back into, never off the arithmetic.** The correction §162b1 would have you make (split it per arm) is the one edit you must not make: splitting restores `reg_n_sets == 1` and the boost with it.
+
+**BYTE EVIDENCE** (`func_80181948`, ov_SC01_077, 132 ins, `match_one` MATCH; probes and harness in `.run/wave6/func_80181948/`, generator `mk3.py`). One function-scope `u16 t` written in case 0 (`t = state + 1; *(u16*)(a0+0x34) = t;`) and case 1 (`t = *(u16*)(a0+0x34) + 1; …`) ⇒ two sets ⇒ no boost ⇒ **132/0 MATCH**, and `state` moves `$a2`→`$a1` for free. `t3_s32temp.c`, identical but for `u16 t` → `s32 t`: **131 ins, 113 mismatched.** Reusing the function's existing `s32 v0` for the same bump (`t2_reusev0.c`): the same **131/113**. Measured NULLs on the same base, all 132/6 — per-arm block scope, memory re-read, decl-order swap, an extra dummy local, `+=`, `<= 0x170`, a `$2` pin. `register u16 state __asm__("$5")` buys the REGISTER only and leaves the 2-insn swap (132/2), consistent with §164-50: the pin was on the mis-allocated value, not on the boosted insn's dest.
+
+**⚠ THE MECHANISM IS A HYPOTHESIS — do not repeat the originating note's version.** It reads "the s32 temp forces the zero-extend back and wrecks the dispatch". The length went **down** by one, so a re-materialised `andi` is not what happened; 113 mismatched at LENGTH-DRIFT −1 is §164-48's declared-width **allocno re-ranking** signature. No `-dl`/`-dS` was taken of the `s32` build. Ship the precondition, not the story.
+
+**THE DIAGNOSTIC TELL.** You introduced a shared multi-set temp to kill an S2 boost and the mismatch count EXPLODED instead of dropping, with a length drift of ±1. Do not split it back and do not reach for a pin — **re-declare it at the width of the lvalue it is written into, and re-gate.**
+
+*(SHARPENS — sharpens §1-I3, §1-I4, §164-04, §28's div-by-constant magic table (0x66666667→/10, 0x55555556→/3); evidence: byte-probed; from `func_801832F8`)*
+
+**§167-25 — Division idioms confirmed: `x/20` uses gcc's `/5` magic 0x66666667 with shift 1+2=3 (20 = 5·2^2); `(excess*127**
+
+**§16N+2 — THE MAGIC CONSTANT NAMES ONLY THE *ODD PART* OF THE DIVISOR; THE `sra` COUNT CARRIES THE POWER OF TWO. Read them together or you will guess the wrong divisor.** *(sharpens §1-I3, which gives the authoring rule and exactly one pair (0xCCCCCCCD / shift 3 = ÷10) and never says the constant is reusable; and corrects the §28-imported table's `0x66666667 → /10` row, which is a divisor-ladder entry misfiled as a unique mapping. Disjoint from §164-04, which owns the pure-power-of-two `bgez ; addiu 2^k-1 ; sra k` path.)*
+
+Target shape — a reciprocal multiply whose magic you recognise but whose shift you do not:
+
+ lui $a0,(0x66666667 >> 16) ; ori $a0,$a0,(0x66666667 & 0xFFFF)
+ mult $v0,$a0
+ sra $v1,$v1,31
+ mfhi $a3
+ sra $v0,$a3,3 <- the shift is the whole message
+ subu $v0,$v0,$v1
+
+**THE LAW.** `expand_divmod` factors the divisor as `odd × 2^k`, synthesises the magic for the ODD part only, and folds `k` into the post-multiply shift. So **divisor = odd × 2^(shift − base_shift(odd))**, and one magic covers a whole ladder.
+
+| magic | odd part | shift → divisor |
+|---|---|---|
+| `0x55555556` | 3 | 0 → /3 |
+| `0x66666667` | 5 | 1 → /5 · 2 → /10 · 3 → **/20** · 4 → /40 · 5 → /80 |
+| `0x51EB851F` | 25 | 5 → /100 · 6 → /200 · 7 → /400 · 9 → /1600 · 13 → **/25600** |
+
+**Byte evidence — 11 divisors on the pinned triple** (`cpp / cc1-2.7.2 -O2 -G0 -mips1 -mcpu=3000 / maspsx 2.56 / as`), `s32 f(s32 x){ return x / D; }`, D ∈ {3,5,10,20,40,80,100,200,400,1600,25600}: the table above is read straight off the objdumps (`.../vet832F8/dv.c`). Target anchor: `func_801832F8` (ov_SC02_041) uses **both** rows — `0x66666667 / sra 3` for `out1.x / 20` at 801833B0-801833C4 and `0x51EB851F / sra 13` for `(dist-0x100)*127 / 25600` at 80183438-80183454. Neither is a ÷10 or a ÷100.
+
+**THE DIAGNOSTIC TELL.** You recognise the magic, so you write the divisor the table told you and the magic comes out right while the `sra` is off by k. **Multiply the divisor by `2^k` and write it literally** — never hand-craft a magic, never respell as `(x/5) >> 2` (that rounds differently and emits an extra bias). Read it the other way too: an unfamiliar magic plus a large shift is a compound divisor, and the shift alone tells you how many factors of two to strip before you look the odd part up.
+
+*(SHARPENS — sharpens §165-21 (L14195) — TWO *COMPUTED* ARMS WANT ONE SHARED TRAILING STORE; already prescribes this exact cure for this exact target shape (arithmetic in the bnez delay slot, ; evidence: byte-probed; from `func_80183834`)*
+
+**§167-26 — WHEN THE DUPLICATED STORE'S TAIL FALLS THROUGH, THE DUPLICATE-vs-JOIN DIAL IS FREE AND COSTS ONLY THE SAVED-REGISTER ORDER. §165-21's "+2 instructions" is the two-`j` case.** *(sharpens §165-21, whose only measured cost for the duplicated spelling on COMPUTED arms is a length drift; and §48-A1 / §164-32, which own the duplicate↔join allocno dial for a LOCAL's init and a switch arm's BODY but never for a STORE's BASE POINTER. The discriminator is §50-B's cross-jump floor.)*
+
+Target shape — two computed arms updating ONE memory cell by ±K, the tail already merged, **one arm falling through**:
+
+ jal rand
+ …
+ andi $v0,$v0,1
+ bnez $v0,.L1
+ addiu $v0,$sX,-0x400 <- TRUE arm, in the slot
+ addiu $v0,$sX,0x400 <- FALSE arm, falls through
+ .L1: sh $v0,0x12($sY) <- ONE `sh`, reached by FALL-THROUGH, not by a `j`
+
+**THE LAW.** Both spellings emit this identical 135-instruction stream. The only thing that moves is which of {base pointer, loaded value} gets `$s1` and which gets `$s2`:
+
+ if (c) *(u16*)(obj+0x12) = ang-0x400; else *(u16*)(obj+0x12) = ang+0x400; -> BASE = $s1, VALUE = $s2
+ *(u16*)(obj+0x12) = c ? ang-0x400 : ang+0x400; -> VALUE = $s1, BASE = $s2 <- target
+ if (c) d = ang-0x400; else d = ang+0x400; *(u16*)(obj+0x12) = d; -> same as the ternary
+
+Duplicating the store hands the BASE POINTER one extra `REG_N_REFS` at allocation time: `jump_optimize (…, JUMP_CROSS_JUMP, …)` runs after reload (pass order, §45-B), so the second `sh` is real to `global.c:594 allocno_compare` and is refunded before `final`. This is **§48-A1's rule applied to a store's BASE instead of a local's VALUE**, and **§164-32's zero-byte ref-boost run subtractively** — collapse to the join to LOWER the base, duplicate into the arms to RAISE it. *(The refs reading is INFERENCE: no `-dl`/`-dg` dump was taken. What is measured is the direction and the zero length cost.)*
+
+**BYTE EVIDENCE** — `func_80183834` (ov_SC01_077, 135 ins, banked `src/ov_SC01_077/ov_SC01_077_jr_80183324.c:3357`, TU has 0 remaining `INCLUDE_ASM`). Every probe preserved under `.run/wave6/func_80183834/`; **`base.c` → `varO.c` is a one-hunk diff whose only change is the store spelling**:
+
+| spelling | file | result |
+|---|---|---|
+| ternary, ONE store | `varO.c` (= the banked body) | **MATCH 135/135** |
+| named `d`, store after the join | `varL.c` | **MATCH** |
+| duplicated store, plain | `base.c` | 5 mismatched |
+| duplicated store, nested-CSE load order | `varK.c` | 5 mismatched |
+| duplicated store, inverted condition + swapped arms | `varN.c` | 5 mismatched |
+| duplicated store through a `u16 *` base (`*obj`) | `varR.c` | 5 mismatched |
+
+**IT IS NOT A TIE-BREAK, AND PINS ARE STRICTLY WORSE.** Declaration order (`varA.c`) and block scope (`varB.c`, `varI.c`) are **inert** — so §158 / §162o1's decl-order tie-break is not the dial, and the refs inequality is strict, not an exact tie. Pinning BOTH (`varC.c`: `obj`→`$18`, `ang`→`$17`) and pinning `ang` alone (`varG.c`) each cost **+2 instructions and flipped a branch sense**; pinning `obj` alone (`varH.c`) does MATCH but fails `dedup_propagate.compiles_standalone` (§37) and forfeits this exemplar's ×3 reach (§162p rung 3). **Take the spelling, not the pin.**
+
+**THE DIAGNOSTIC TELL — count the `j`s into the shared store, not the instructions.** A two-arm ±const update of one memory cell where your instruction COUNT is exact and the residual is a clean saved-register swap between the store's BASE and the VALUE it stores ⇒ re-spell the store; do not reach for a pin, an §47/§158 slider or the permuter. Which direction to try is read off the tail:
+- **one arm FALLS THROUGH into the `sh`** ⇒ §50-B's `minimum=1` path merges the duplicate for free, the two spellings are length-identical, and the dial is *purely* the register order — **try both directions**;
+- **both arms reach the store by `j`** ⇒ §165-21, the duplicate does not merge and you pay its **+2 instructions**, so only the join spelling is live.
+
+**⚠ Do NOT cite §164-69 as the opposite pole.** Its seven losing join spellings are a **call-bearing, multi-instruction merged TAIL** whose mechanism is sched1's basic-block SCOPE; nothing there is a register permutation on a one-instruction store tail. The two-way framing already belongs to §48-A1, which states both directions outright.
+
+*(SHARPENS — sharpens §136g-1 (L9214-9218), §164-55 (L13035-13063), §164-47 (L12840-12851), §3-T4 (L90-103); evidence: byte-probed; from `func_80187130`)*
+
+**§167-27 — WHEN *EVERY* ARM RETURNS, gcc-2.7.2 PHYSICALLY SWAPS THE TWO ARMS AND INVERTS THE BRANCH (`jump.c:1806`). THE ARM YOU WRITE **FIRST** IS THE ONE THAT LANDS NEXT TO THE EPILOGUE.** *(⚠ BOUNDS §164-55 and §164-47, whose "RTL block order == source statement order" / "only the last-written body can fall into the epilogue" is stated with no precondition; settles the internal contradiction in §3-T4 — its clause (a) "put the target's fall-through block in the `if`" and its clause (b) "`if (ok){…return good;} return 0;` makes `return 0` the fall-through" cannot both hold, and (b) is the one that governs here; supplies the FORWARD-direction lever for the transform §136g-1 already names but only teaches how to DISARM.)*
+
+**Target shape** — a 2-way test where both sides `return`, the branch is taken *forward into* the block that sits last, and that block falls into the epilogue with no `j`:
+
+ bnez $v0,.L801871XX <- branch-if-condition-TRUE, forward
+ li $a0,1 <- delay slot stolen from the block it branches TO
+ j .Lepi <- the OTHER arm, inline, pays the jump
+ move $v0,$zero <- …its return value, in the j's slot
+ .L801871XX: … li $v0,1 <- falls straight into the epilogue, no `j`
+ .Lepi: lw $ra,0x6C($sp) …
+
+**THE LAW.** `jump.c:1800-1875` — `/* Look for if (foo) bar; else break; */` — is a real **block-swapping** transform in gcc-2.7.2. It matches `condjump label1 / range1 / jump label2 / label1: / range2 / / label2:`, calls `invert_jump (insn, label1)`, and then **splices range1 and range2 past each other** with raw `NEXT_INSN`/`PREV_INSN` surgery (`jump.c:1866-1875`). Its preconditions ARE the "every arm returns" shape:
+* `label1` = the if-join label, with `LABEL_NUSES (label1) == 1`;
+* `range1end` (last insn of the then-arm) is a **simplejump** targeting `label2 = next_label (label1)` — i.e. **the then-arm ends in `return` and the label after the if-join IS the return/epilogue label**;
+* `range2end` is a JUMP_INSN followed by a BARRIER — i.e. **the other arm also ends in `return`**;
+* `! first` (a later `jump_optimize` round) and `reload_completed ? ! flag_delayed_branch : 1`.
+
+So **`if (C) { P; return X; } Q; return Y;` emits Q-then-P**, branch-if-`C` to P, and **P — the arm you wrote FIRST — is the epilogue-adjacent block with no `j`.** Put the target's no-jump arm **inside the `if`**, never after it. **The spelling is inert:** `… return Y;` and `… else { return Y; }` are byte-identical, both ways round; only WHICH arm is the then-arm moves anything.
+
+**Byte evidence — `func_80187130` (ov_SC06_018, 86 ins, banked `commit:1713`, `src/ov_SC06_018/ov_SC06_018_jr_80186270.c:3243`).** Five variants through the pinned triple, re-run at vetting (`cpp / cc1-2.7.2 -O2 -G0 -mips1 -mcpu=3000 / maspsx / as`; probe artifacts `.run/match/func_80187130.246967/` and `.242624/`):
+
+| spelling | cc1 `.s` layout | verdict |
+|---|---|---|
+| `if (c != 0) { BODY; return 1; } return 0;` | `bne …,$L2` · `j $L3 ; move $2,$0` · `$L2: BODY … li $2,1` · `$L3:` | **MATCH — the banked body** |
+| `if (c != 0) { BODY; return 1; } else { return 0; }` | **`.s`-identical modulo label numbers** | MATCH |
+| `if (c == 0) { return 0; } BODY; return 1;` | `beq …,$L2` · `BODY … j $L3 ; li $2,1` · `$L2: move $2,$0` | DIFF, **86 vs 86 ins**, 11 mismatched |
+| `if (c == 0) { return 0; } else { BODY; return 1; }` | **`.s`-identical to the row above** | DIFF |
+| then-arm falls to a shared tail (no `return` in the arm) | `beq …,$L2` · **BODY inline** · `$L2: ` — source order, **no swap** | regime control |
+
+The last row is the precondition failing: with the arm falling into an interior join, `range1end` is not a jump to the return label, `jump.c:1806` never fires, and §164-55/§164-47's source-order law holds unmodified. **The two laws are disjoint, not contradictory — the discriminator is whether the label after the if-join is the RETURN label, i.e. whether EVERY arm returns.**
+
+**⚠ This also bounds a §164z verdict.** §164z's `func_80184944` entry reads *"No relocation occurred … gcc-2.7.2 has no block-reordering pass; describing plain source-order emission as the compiler 'physically relocating' a block will send the next agent hunting for a pass that doesn't exist."* That verdict is right **for `func_80184944`** (interior join ⇒ precondition unmet) and its refutation stands, but the pass is not imaginary: it is `jump.c:1806`, it splices insn chains, and `func_80187130` is the byte-proven instance. Read that sentence as "no *bb-reorder*" (gcc-3.x), not as "no block motion in 2.7.2".
+
+**THE DIAGNOSTIC TELL.** A **count-neutral** residual — *no* LENGTH-DRIFT, which is what separates it from §164-55's +1 — in which ONE conditional branch flips `beqz`↔`bnez` **and a 2-instruction `j ; ` pair changes sides of it**, sliding between the function tail and the slot immediately after the branch. `match_one` files it SHIFT-DRIFT / BRANCH-POLARITY and the index routes to §3-T4: **do not invert the condition** (the polarity you can see is `invert_jump`'s output and carries no source information, cf. §165-23) and **do not add a fence** (`jump.c` runs long before `reorg`, §136g-1). Swap which arm is the `if` body: the target's no-jump, epilogue-adjacent arm goes INSIDE the `if`, and the condition is spelled so the branch tests it TRUE.
+
+**Cross-link — the disarm direction.** §136g-1 needs this swap NOT to fire and buys that by putting any label between the if-join and the return label (wrap the body in an `if` with ONE trailing `return`), which also breaks `LABEL_NUSES (label1) == 1`. Same pass, opposite goal — read the target's block order and match it.
+
+*(SHARPENS — bounds §164-55 (L13035), §164-47 (L12851), §3-T4 (L90-103) and §164z's func_80184944 "no relocation" verdict (L13677); completes §136g-1 (L9214); evidence: byte-probed (5 variants, cc1 `.s` + relocation-masked `.o`, re-run at vetting) + source-read `jump.c:1800-1875`; from `func_80187130`)*
+
+*(SHARPENS — sharpens §49 (L3528-3576, THE LUID DIAL) — incl. its Method note: '-dS -dR ... the ready lists, the computed priorities, and the chosen order ... if the priorities are equal, you ; evidence: byte-probed; from `func_801874C0`)*
+
+**§167-28 — WHEN THE TARGET PICKS A *LOWER*-PRIORITY INSN THAN YOUR DRAFT, PRIORITY IS NOT THE DIAL: THE HIGHER-PRIORITY INSN WAS NOT READY, SO YOUR DRAFT IS MISSING A DEPENDENCE EDGE.** *(sharpens §49's Method note, which reads the ready lists only for the EQUAL-priority cell and prescribes the LUID dial; and the `gcc-2.7.2-map/sched.md` §4 recipe, whose ladder is "equal-pri ⇒ S1 / pri differs via a load-or-mul chain ⇒ S3 = intrinsic, route to the permuter" — this is the missing third rung, and it reaches the opposite verdict.)*
+
+**THE LAW.** `schedule_block` traverses each bb **backward** (`sched.c:3144`, *"we are traversing the instructions backwards"*), so *picked earlier* = *placed later*. READY = every **successor** already scheduled (`schedule_insn`, `:2557`). `rank_for_schedule` (`:2385`) returns `INSN_PRIORITY(y) − INSN_PRIORITY(x)` **first**, so the class rule and the LUID tie-break never run across a priority difference. And `priority()` (`:1425`) is `max(1, priority(pred) + insn_cost − 1)` over LOG_LINKS — **a C edit can only ever RAISE a priority, never lower one** (`sched.md` §1.3). Therefore: *a target that places an insn your draft's ready list ranked BELOW another one cannot be explained by any priority you can reach from C.* The higher-priority candidate was **absent from the ready list** — it still owed a successor. Re-read the residual as an alias/dependence question, not as a scheduling tie.
+
+**⚠ BOUND — rule out the one other way a high-priority insn gets passed over.** `schedule_select` (`sched.c:2616-2650`) works the ready list in **equal-priority groups**: it `queue_insn`s every member of the top group that `actual_hazard` blocks, and if the whole group is queued it falls through to the **next, lower-priority group**. That is a lower-priority pick with the higher-priority insn present *and* ready. The dumps separate the two cases: **`;; blocking insn N for K cycles` at that tick ⇒ §165-45's memory-unit story, not this one; no such line ⇒ non-readiness.**
+
+**THE READING, step by step** (worked on `func_801874C0`, ov_SC03_014, 241 ins). At the step after `sh ,0x18($sp)` the matching build picks `addiu $a0,$sp,0x10` (priority 1) over `sh 0xA($s0)` (priority 2 — the `lhu 0xDE` load edge into the `subu` costs 2). Backward ⇒ the `addiu` is *placed last*, and in the matching object it is (`w_pA`: `sh 0xA` → `lhu 0x6` → `addiu $a0,$sp,0x10`); in the 8-mismatch draft it sits four insns earlier (`w_v6`). `sh 0xA($s0)` can only have been unready if something it must precede was still unscheduled, and the only insn between them is `lhu 0x6($s0)` ⇒ the original carried a store→load edge at `0xA`/`0x6` that our alias oracle refuses ⇒ §16Z-vol.
+
+**⚠ THE INSTRUMENT IS NOT NEW — do not re-introduce it.** §49's Method note (`cc1 -dS -dR` → the `.sched`/`.sched2` traces: *"the ready lists, the computed priorities, and the chosen order"*), `sched.md` §3 *Dump tells* and the cookbook at L12914 already name the `;; ready list at T-N` lines, the `INSN_PRIORITY` column, `(7f000001)` = birthing boost, `;; blocking insn N for K cycles` and `;; insn N has a greater potential hazard`. **What is new is the inference across a priority difference**, and the verdict flip it produces: `sched.md` §4 currently sends the unequal-priority case to the permuter as intrinsic.
+
+*(SHARPENS — sharpens §49 (Method note), `gcc-2.7.2-map/sched.md` §4 recipe and §S3, §165-45, §25; evidence: byte-probed on one function (the `w_v6`/`w_pA` object pair), mechanism source-cited to the pinned `sched.c`; from `func_801874C0`)*
+
+*(SHARPENS — sharpens §136g rule 15 (L8921-8925) — split an RMW into `v = *p + 1; … *p = v;` so its load RISES, §165-06 / §164-XX (L13829-13876) — `(*p)++` vs `*p += 1`, the seven-spelling tab; evidence: byte-probed; from `func_801874C0`)*
+
+**§167-29 — A MEMORY RMW WHOSE RESULT IS A CALL ARGUMENT WANTS THE *HYBRID*: RE-READ THE FIELD AT EVERY USE SITE, AND KEEP THE RESULT IN A LOCAL.** *(sharpens §136g rule 15, which splits an RMW into `v = *p + 1; … *p = v;` precisely to make its load RISE — this is the same dial at the opposite polarity, for a target whose load sits mid-block; and §165-06/§164-XX, whose seven-spelling table is about the STORE's `SET_SRC` and never about where the LOAD lands. §49 supplies the argument half. **The drafter's citation of §162b/§76 is wrong — those are scope→allocno/`combine` levers and do not reach load placement.**)*
+
+Target shape — ONE narrow load mid-block, an if/else that bumps the field by two different constants, and the result passed to a call:
+
+ lh $v0,0xDC($s0) <- one load, MID-block, not at its head
+ slti … ; beqz … ; nop <- the compare's delay slot is a real nop
+ addiu $v0,$v0,0x30 / 0x50
+ sll $a0,$v0,16 ; sra $a0,$a0,16 ; jal … ; sh $v0,0xDC($s0)
+
+**THE LAW, as a three-cell decision** (all measured on `func_801874C0`, ov_SC03_014, pinned triple):
+
+| spelling | result |
+|---|---|
+| **hoist to a block-head local** — `s16 ang = *(s16*)(a0+0xDC); if (ang<0x400) ang+=0x30; else ang+=0x50;` | 240 ins, **201 mismatched**. The `lh` now has no LOG_LINKS predecessor ⇒ `priority()` = 1 ⇒ under backward traversal it is picked LAST and **placed FIRST**; the `sw 0xC` then falls into the `beqz` delay slot the target leaves `nop`, and the whole block cascades. |
+| **fully in memory** — `*(s16*)(a0+0xDC) += 0x30;` + `f(*(s16*)(a0+0xDC))` | 241 ins, **12**. The load lands correctly, but the argument becomes `sh; lh` (store then re-load) where the target has `sll; sra` off the register — and the `sh` takes the `jal` delay slot. |
+| **HYBRID** — read the field in the condition **and** in each arm, assign the sum to a local, store the local | 241 ins, **8**. cse commons the three reads into the one `lh` at the FIRST read site (= the target's position), and the local keeps the argument a register sign-extension. |
+
+**DIAGNOSTIC TELL — two symptoms that pull in opposite directions.**
+* (a) A `nop` in a compare's delay slot that your draft fills, with a single narrow load at the **block head** that the target has **mid-block** ⇒ you hoisted the RMW's load into a local. Delete the local; re-read the field at each use site.
+* (b) `sh` in a `jal` delay slot followed by an `lh` of the same field, where the target has `sll; sra` ⇒ you left the result in memory. Bind it to a local (§49; at the lvalue's own width, §165-06).
+
+**This shape needs BOTH fixes at once**, which is exactly why the single-axis sweeps stall: §136g-15's hoist alone gives you (a), §165-06's operator table alone gives you (b).
+
+*(SHARPENS — sharpens §136g rule 15, §165-06/§164-XX, §49; evidence: byte-probed, three measured cells on one function (variants under `.run/wave4/func_801874C0/`); the 201/12 cells were **not** re-run at vet time; from `func_801874C0`)*
+
+*(SHARPENS — sharpens L1808-1815 register-resident `short` truthiness bullet (sll 16 + branch; contrasts s16 vs int ONLY — no u16 arm), §164-30 (L12507) `sll $aN,$aN,16` in place at a truthine; evidence: byte-probed; from `func_80187F2C`)*
+
+**§167-30 — Field a0+0xFE must be declared s16, not u16, even though the machine load is `lhu`: MIPS LOAD_EXTEND_OP==ZERO_**
+
+**§16?-NN — THE MEMORY-FIELD SIGNEDNESS ARM: `--field == 0` EMITS `sll 16` FOR `s16` AND `andi 0xffff` FOR `u16`, AND THE MISS ALSO PERMUTES THE LOAD SCHEDULE.** *(sharpens §165-11 / §136 type-form rule 12 (L8904), which state the signed/unsigned narrowing pair only on the RETURN axis; sharpens L1808's register-resident-`short` truthiness bullet, which contrasts `s16` against `int` and has no `u16` arm; sharpens §164-30, which owns the lone-`sll 16` shape for a PARAMETER; and BOUNDS §164z's `func_80180128` refutation — 'the byte gate is BLIND to the signedness of that field' — by naming the precondition under which it is NOT blind.)*
+
+**Target shape** — an in-place decrement of a narrow field, tested against zero:
+
+ lw $v1,0xC($s0)
+ lhu $a0,0xFE($s0) <- `lhu` EITHER WAY (§136g: LOAD_EXTEND_OP==ZERO_EXTEND, mips.h:1163)
+ addu $v1,$v1,$v0
+ addiu $a0,$a0,-1
+ sh $a0,0xFE($s0)
+ sll $a0,$a0,0x10 <- the ONLY signedness carrier. NO `sra`.
+ bnez $a0,…
+
+**THE LAW.** The load opcode carries **zero** signedness information for a HImode field — `lhu` is emitted for `s16` and `u16` alike. The whole declaration is readable at the surviving HImode→SImode use, and for a *zero-equality* test it is one instruction either way:
+
+ *(s16 *)(p+K) -> sll $r,$r,16 (`sra` deleted: `simplify_comparison` case ASHIFTRT, combine.c:7422-7433 —
+ "If this is an equality comparison with zero, we can do this as a logical shift")
+ *(u16 *)(p+K) -> andi $r,$r,0xffff (the high bits are load-bearing; nothing collapses it)
+
+**And the miss is not opcode-only.** The `u16` spelling also hoists the `lhu` above the neighbouring `lw` and swaps the two `addu`s with it — **~5 mismatched instructions at LENGTH-DRIFT 0**, which reads like a §135-4/§49 scheduling residual and is not one.
+
+**BYTE EVIDENCE** (`func_80187F2C`, ov_SC03_118, 56 ins, banked at `src/ov_SC03_118/ov_SC03_118_jr_801863CC.c:3937`). Target read off the SHA1-green object, `mipsel-linux-gnu-objdump -d build/ov_SC03_118/ov_SC03_118.elf` @ `0x80187F80-0x80187F98`. Controlled A/B on the pinned triple, the two files differing in exactly one character sequence (`.run/wave4/func_80187F2C/experiments/v4.c` = `--*(u16 *)(a0+0xFE)`, `v5.c` = `--*(s16 *)(a0+0xFE)`), 110 cc1 lines each:
+
+ v5 (s16, = target): lw $3,12($16) ; lhu $4,254($16) ; addu $3,$3,$2 ; addu $4,$4,-1 ; sh $4,254($16) ; sll $4,$4,16
+ v4 (u16): lhu $4,254($16) ; lw $3,12($16) ; addu $4,$4,-1 ; addu $3,$3,$2 ; sh $4,254($16) ; andi $4,$4,0xffff
+
+**DIAGNOSTIC TELL.** `lhu ; addiu -1 ; sh ; sll 16 ; beqz/bnez` on a FIELD ⇒ write the lvalue `*(s16 *)`. The same run ending `andi $x,$x,0xffff` ⇒ `*(u16 *)`. Do not read the `lhu` — it is the same in both. **Bound:** the missing `sra` is the *equality-with-zero* rule; a target that shows `sll 16 ; sra 16` before a signed relational compare is the same `s16` field with a non-equality test (§164-37/§163b), not a different width. And §164z's blindness result still holds for the shape it was measured on — a field that is only added to and stored back with `sh` has no surviving HImode→SImode use, so no spelling is observable.
+
+*(SHARPENS — sharpens §165-11 (L13956), §136 rule 12 (L8904), L1808, §164-30 (L12507); bounds §164z `func_80180128` (L13680); evidence: byte-probed by the vet (objdump + pinned cpp|cc1 A/B); from `func_80187F2C`)*
+
+*(SHARPENS — sharpens §164-56 (L13067-13086) — THE LAW's 'the subtract and compare happen in the OPERAND'S OWN MODE, so a `short` operand emits `andi 0xffff` + `sltiu` and an `int` operand emi; evidence: byte-probed; from `func_80188348`)*
+
+**§167-31 — THE `range_test` MASK IS A FUNCTION OF THE BIAS SIGN, NOT OF THE OPERAND'S WIDTH. A `short` OPERAND WITH `LO ≥ 0` FOLDS TO A BARE `addu −LO ; sltu HI−LO`, AND §164-56'S "COUNT THE `andi 0xffff`" TELL NEVER FIRES.**
+
+Target shape — a `short` counter that is BOTH range-tested and passed as a call argument:
+
+ lh $v1,0x70($s0) <- SIGNED load
+ slt $v0,$v1,8 ; bne $v0,$0,.Lskip
+ slt $v0,$v1,14 ; beq $v0,$0,.Lskip <- two independent signed `slt`; no bias, no mask
+
+Yours, from `if (cnt >= 8 && cnt < 14)`:
+
+ lhu $a1,0x70($s0) <- load flipped to UNSIGNED
+ addu $v0,$a1,-8 ; sltu $v0,$v0,6 <- the fold; NO `andi 0xffff` anywhere
+ beq $v0,$0,.L ; sll $a1,$a1,16
+ li $a0,0x1EA ; sra $a1,$a1,16 <- the sign-extension REMATERIALISED for the call arg
+
+**THE LAW (two halves; the first bounds §164-56).**
+1. **The mask is conditional on the sign of `LO`, not on the operand's mode.** `range_test` does rewrite `VAR >= LO && VAR < HI` to `(unsigned TYPEOF(VAR))(VAR − LO) < (HI − LO)` in the operand's own mode (§164-56) — but combine then DELETES the HImode truncation whenever it cannot change the answer. With **`LO < 0`** the bias is a positive `addu`: `x + |LO|` carries above 0xFFFF for `x` near 0xFFFF and the 32-bit result disagrees with the HImode one on the in-range side ⇒ the `andi 0xffff` is load-bearing and survives. With **`LO ≥ 0`** the bias is a negative `addu`: every `x < LO` wraps to a huge unsigned that is still ≥ `HI − LO` ⇒ the truncation is provably redundant and is removed. **A `short` operand with a non-negative low bound therefore emits exactly the same two instructions as an `int` operand.**
+2. **On a `short` operand the fold is visible in the LOAD and in a rematerialised extension instead.** The fold wants the value zero-extended, so `lh` becomes `lhu`; any OTHER use of the same value that needs it signed (a call argument, a narrow store) then pays a fresh `sll 16 ; sra 16` pair. That pair, not the `andi`, is the tell in this family, and it costs **+1 instruction** over the split form.
+
+**BYTE EVIDENCE** — six-way isolated A/B on the pinned triple (`-quiet -O2 -G0 -mips1 -mcpu=3000 -mgas -msoft-float`), same body both sides:
+
+| operand | bounds | spelling | compare region emitted |
+|---|---|---|---|
+| `short` local | `>= 8 && < 14` | `&&` | `lhu ; addu −8 ; sltu 6` — **no mask**, 21 ins |
+| `short` local | `>= 8 && < 14` | nested `if`s | `lh ; slt 8 ; slt 14` — **the target**, 20 ins |
+| `int` local | `>= 8 && < 14` | `&&` | `lh ; addu −8 ; sltu 6` — no mask, 19 ins |
+| `short` local | `>= −0x101 && < 0xF2` | `&&` | `lhu ; addu 257 ; **andi 0xffff** ; sltu 499` |
+| `short` local | `< −0x101 \|\| >= 0xF2` | `\|\|` | identical + `bne` — §164-56's own shape |
+| `int` local | `>= −0x101 && < 0xF2` | `&&` | `lh ; addu 257 ; sltu 499` — no mask |
+
+The mask tracks the **bias sign** in every row; the declared width tracks only `lh` vs `lhu`. §164-56's evidence (`func_80185EF8`, biases +0x101 / +0x4AA) sits entirely in the `LO < 0` half — that is why it read the mask as the mode's signature.
+
+**⚠ THE SPLIT FORM DOES NOT DECLARE THE WIDTH.** `short cnt` and `int cnt` compile byte-identically once the chain is split (20 ins, same instructions). The `lh`/`lhu` distinction exists ONLY in the folded form; do not read the target's `lh` as evidence for an `s16` local here.
+
+**THE DIAGNOSTIC TELL — use this one when `LO ≥ 0`; §164-56's does not apply.** You are **LENGTH-DRIFT +1**, the target has **two `slt`/`slti` on one register**, and you have **one `addu −K ; sltu M`**. There is no `andi` to count. Confirm on the LOAD: target `lh`, yours `lhu`, and yours grows an `sll 16 ; sra 16` pair on that same register straddling the branch. Fix is §164-56's — nested `if`s (§165-22's lever; reach for §164-19(b)'s `goto` ladder only if a 0/1 flag with a body is involved).
+
+**⚠ DO NOT CONFUSE WITH §164-37 / §163b.** Both shapes contain `addu −K`, `sll 16 ; sra 16` and an `slt*` on one register. **Position discriminates them absolutely:** the switch dispatch is `addiu −MINVAL ; sll 16 ; sra 16 ; sltiu` — extension **between** the subtract and the compare, one value with one use. The `range_test` residual is `addu −LO ; sltu HI−LO ; … sll 16 ; sra 16` — extension **after** the compare, because it belongs to a DIFFERENT use of the value. `sll/sra` after the `sltu` ⇒ this section, and no switch is involved.
+
+*Provenance:* `func_80188348` (ov_SC03_118, 52 ins, S48 wave-6 `confirmed`, draft `.run/wave6/func_80188348/func_80188348.c:21-29`, sha1 `8effd252f70f5d475300df0839e6db4b55e3e388`) supplied the shape; the six-row A/B was run at vetting time on the pinned cc1 and is reproducible from that body. §164-56's core law is unchanged — only its mask rule and its tell are bounded.
+
+*(SHARPENS — sharpens §164-02 (L11888) — states the precondition as 'every register loaded with `la sym`' but never says what happens one add downstream, §164-01 (L11871) — the pointer_int_sum; evidence: byte-probed; from `func_8018C3F8`)*
+
+**§167-32 — `qty_const` DECAYS AFTER ONE ADD: A SYMBOL ADDRESS THAT ALREADY CARRIES A RUNTIME TERM IS AN ORDINARY REGISTER, AND FIX A1 GOVERNS IT.** *(BOUNDS §164-02; supplies the discriminator against §164-01. Retires the 'a spill/reload kills the constant equivalence' story offered from `func_8018C3F8` — see below.)*
+
+Target shape — **two `addu`s off the same symbol in one function, with opposite operand orders**:
+
+ lhu $2, D_800B9A02($2) ; runtime index
+ la $3, D_800A6610 ; BARE symbol -> CONSTANT_P
+ sll $2, $2, 14
+ addu $2, $2, $3 <- INDEX first (cse swapped it; §164-02)
+ sw $2, 0x30($sp)
+ ...
+ lw $10, 0x30($sp) ; same value, ONE add downstream
+ sll $17, $17, 2
+ addu $17, $10, $17 <- BASE first (no swap; plain source order)
+
+**THE LAW.** §164-02's precondition is `qty_const`, and `insert` records it only from a class member whose `elt->is_const` is true — `CONSTANT_P (x) || (RTX_UNCHANGING_P (x) && REG && REGNO >= FIRST_PSEUDO_REGISTER) || FIXED_BASE_PLUS_P (x)` (`cse.c:1313-1319`; `FIXED_BASE_PLUS_P`, `cse.c:575-586`, is frame/arg-pointer only). A pseudo set from `(plus (reg ) (reg ))` has a class holding exactly that PLUS — none of the three. The second arm of `insert` (`cse.c:1383-1397`) scans the class for `p->is_const && GET_CODE (p->exp) != REG`, finds nothing, and leaves `qty_const` unset; `equiv_constant` (`cse.c:5699-5710`) then returns 0 and the commutative swap at `cse.c:5282-5289` never fires. **The equivalence dies at the first add.** `p = &SYM[i];` makes `p` an ordinary register, and the next `p + x` is §10-Residual-A territory: write the operand you want in `rs` FIRST.
+
+**IT IS NOT THE SPILL — and it can never be.** `cse_main` runs at `toplev.c:2865` (cse1) and `:2926` (cse2); `reload` runs inside `global_alloc` at `:3080`, with `reload_completed = 1` at `:3096`. `grep -rn reload_cse_regs tools/reference/gcc-2.7.2/` ⇒ **0 hits** — 2.7.2 has no post-reload cse. Operand order is frozen before a stack slot exists, so **no reload-time observation (`lw 0x30($sp)`, register pressure, 9 busy callee-saveds) can ever explain a cse-time operand swap.** If your story about an `addu`'s operand order mentions a spill, the story is wrong.
+
+**BYTE EVIDENCE — one function, one symbol, both outcomes.** `func_8018C3F8` (ov_SC06_018, 236 ins, MATCH, banked; `src/ov_SC06_018/ov_SC06_018_jr_80187AEC.c:4854`). In the shipped `build/ov_SC06_018/ov_SC06_018.elf`:
+* `8018c464: addu v0,v0,v1` — v0 = `sll` index, v1 = `la D_800A6610`. **Index first**, although the C at `:4877` is written pointer-first (`&D_800A6610[(*(u16*)&D_800B9A02) << 14]`, which `pointer_int_sum` also canonicalises pointer-first per §164-01). Both source-level orderings lose: this is §164-02 firing, in the shipped bytes.
+* `8018c554: addu s1,t2,s1` — t2 = `lw 0x30($sp)` (that same value), s1 = `z << 2`. **Base first**, matching the C at `:4897`, `(s32) ot + (z << 2)`. The drafter's A/B is the dial: `(z << 2) + (s32) ot` gave `addu $s1,$s1,$t2`, the one and only mismatch in a 236/236 body; swapping the addends made it MATCH. Two builds, one character.
+* Sibling control, same TU: `func_8018F694` (`:6776`) spells the second add the OTHER way, `(z << 2) + (s32) ot` (`:6810`), and gets `8018f7f0: addu s0,s0,a3` — index first — while **its `ot` is stack-resident too** (`8018f7d8: lw a3,0x38($sp)`). Both functions spilled, both obeying source order, opposite results. Spilling is not the variable.
+
+**THE DIAGNOSTIC TELL.** Before reaching for §164-02's self-set asm launder, ask **how the base got into the register**, not where it currently lives:
+* `la SYM` materialised in the same expression ⇒ §164-02. Source order and pins are inert; the `__asm__("" : "=r"(e) : "0"(e))` launder is the only lever.
+* A pointer local **assigned** a symbol-plus-runtime-index earlier ⇒ ordinary register. **Try Fix A1 first — it is one character and costs one build.**
+* And spell that second add in `s32`, not pointer, arithmetic. `(s32) base + off` keeps it a plain binop where source order reaches RTL; `ptr + off` funnels through `pointer_int_sum` and §164-01 pins the pointer to operand 0 before RTL, making Fix A1 inert for a second, unrelated reason.
+
+*(SHARPENS — bounds §164-02, discriminates against §164-01; evidence: byte-probed in the shipped object, 2 functions + a 2-build A/B; from `func_8018C3F8`)*
+
+*(SHARPENS — sharpens §164-08 (L12007) — the ASCENDING N-site form: `&SYM[k*STRIDE]` off one array symbol, tells `LENGTH-DRIFT/+2` (N symbols) and `-5` (walked pointer), §136 rule 5 (L8872) — ; evidence: byte-probed; from `func_8018D654`)*
+
+**§167-33 — `use_related_value` ALSO RUNS DESCENDING, AND AT TWO SITES THE MISTAKE IS LENGTH-NEUTRAL: §164-08's LENGTH-DRIFT TELL CANNOT FIRE.** *(BOUNDS §164-08 (L12007), whose law, both refutations and both tells are stated for N ASCENDING sites off one array symbol; and resolves its "Tension to know about" §136-5 note in the OPPOSITE direction — at two offsets the pointer local is REQUIRED, not refuted.)*
+
+**Target shape** — ONE `%hi/%lo` pair built for the FAR offset, a zero-displacement load off it, and the plain `&SYM` later reached by a single NEGATIVE bump:
+
+ 8018d698 lui $s2,%hi(D_80126B64) ; = D_80126B58 + 0xC
+ 8018d69c addiu $s2,$s2,%lo(D_80126B64)
+ 8018d6a4 lw $a0,0x0($s2) <- the far read: THREE instructions
+ ...
+ 8018d738 addiu $a0,$s2,-0xC <- &D_80126B58: ONE instruction
+
+**THE LAW.** `use_related_value` (`cse.c:1781`, called at `:6535`) is symmetric in the sign of the offset: with `SYM+K` already live in a pseudo, cse rewrites a later plain `SYM` as `reg − K`. Two preconditions, and both invert §164-08's ascending case:
+(a) **the FAR offset must go through a POINTER LOCAL** so the full address lands in a pseudo (§136-5, L8872). Spelled as a bare read of the higher symbol it is `(mem (const (plus SYM K)))`, which this MIPS port accepts as a legal address and folds to `lui/%lo` — the register never exists and cse has nothing to relate. (§162l, L11482, is the same fold read from the MEM side.)
+(b) **the near address must be spelled as the same symbol** (`&SYM`), or the related_value chain does not link.
+
+**WHY IT IS INVISIBLE — the drift cancels at N=2.** Spelling the far offset as its own extern (`extern s32 D_80126B64;` — exactly what splat's symbol map hands you) costs **−1** on the read (`lui/lw %lo` instead of `lui/addiu/lw 0(reg)`) and **+1** on the address (`lui/addiu` instead of one `addiu`). **Net 0.** §164-08's tells — `+2` for N separate symbols, `−5` for a walked pointer — are counts over N≥3 ascending sites; at two sites, one read and one address, they sum to zero. The gate reports the right length with a scattered OPCODE-MIXED residual and nothing that names the mistake.
+
+**BYTE EVIDENCE.** `func_8018D654` (ov_SC06_018 / `_jr_80187AEC`, 135 ins, banked MATCH 135/135; `src/ov_SC06_018/ov_SC06_018_jr_80187AEC.c:5411`). The target's own bytes settle it without an A/B — `8018d698-8018d6a4` spends three instructions reading `D_80126B64`, `8018d738` spends one on `&D_80126B58`; the bare-extern spelling cannot produce the first.
+
+**DIAGNOSTIC TELL.** A bare `addiu $rD,$rS,-K` feeding a call argument or an address, where `$rS` was built by a `lui/addiu` pair of a symbol exactly K bytes HIGHER and is read at displacement 0 ⇒ ONE symbol, the far offset in a pointer local, the near one as `&SYM`. **Do not read the length — this class has none.** Read the address-instruction COUNT instead: a symbol whose read costs three instructions lives in a pointer local; two means it is a bare global.
+
+*Companion, already law — do not re-derive:* each cse REGION needs its OWN pointer local. The target rematerialises the same base at `8018d77c` (`lui/addiu $a1`) because `.L8018D77C` carries four jump refs and starts a fresh cse table (§164-52, L12943); one shared C variable would stay live in `$s2` across the join. That is §44-Lever-3 (L3263) / §76 / §136-1 / §162b1's split-vs-share law applied to an address.
+
+*(SHARPENS — bounds §164-08; evidence: byte-probed (banked MATCH + target read); from `func_8018D654`.)*
+*Honest scope: the isolated single-variable A/B on the spelling was never run — the only bare-extern draft (`.run/wave6/func_8018D654/v1.c`) also carried the wrong struct layout, so its "135 ins, OPCODE-MIXED" number is confounded. The length-neutrality above is arithmetic plus the target read, not a gated pair. Two minutes to close it: respell the banked body's two `lim` locals as `extern s32 D_80126B64;` and gate.*
+
+*(SHARPENS — sharpens §49 (L3527) — THE LUID DIAL: materialise a temp to shift an insn's expand-stream position and split a `rank_for_schedule` tie (stated for a `sll/sra` sign-extension pair,; evidence: byte-probed; from `func_8018D654`)*
+
+**§167-34 — A NAMED TEMP IS A *LOAD-ORDER* DIAL: it moves the load out of the expression and ABOVE the operand it was subtracted from — and NO statement permutation substitutes.** *(sharpens §49 (L3527, the LUID dial — a temp shifts an insn's expand-stream position; stated for a `sll/sra` pair moving EARLIER) and §165-14 (L14021, "source order IS the schedule" for three mutually-independent STATEMENTS); **bounds §164-43** (L12771), whose law is that splitting an expression into named temps changes the pre-reload stream "with **zero** change to the final instruction stream" — the COUNT is unchanged, the ORDER is not.)*
+
+**Target shape** — a block whose leading load group is a pure PERMUTATION of yours, same registers, same count:
+
+ 8018d6e8 lh $a0,0x6($s1) <- self->f6
+ 8018d6ec lui $v0,%hi(D_80126B62)
+ 8018d6f0 lhu $v0,%lo(D_80126B62)($v0)
+ 8018d6f4 lui $v1,%hi(D_80126B5E)
+ 8018d6f8 lh $v1,%lo(D_80126B5E)($v1)
+
+**THE LAW.** The loads are mutually independent, so `rank_for_schedule` ties on priority and on every dependence class and falls through to `INSN_LUID (tmp) - INSN_LUID (tmp2)` (`sched.c:2425-2428` — the fallback §165-14 cites). LUID is expand-stream position, and **a global's load is expanded at its FIRST source mention.** Hoisting the global into a temp of its own moves that mention from inside the expression to a statement ABOVE it, carrying the load above the operand it was going to be subtracted from:
+
+ bx = *(s16*)&D_80126B5E; i = self->f6 - bx;
+ RTL lh B5E, lh f6, lhu B62 -> sched1 B5E, B62, f6 WRONG
+
+ i = self->f6 - *(s16*)&D_80126B5E; v[0] = *(s16*)&D_80126B5E;
+ RTL lh f6, lh B5E, lhu B62 -> sched1 f6, B62, B5E TARGET
+
+Both emit the same 135 instructions in the same registers. Inlining also merges the two reads into the single `lh` the target has — cse commons them.
+
+**THE NEGATIVE CONTROL IS THE POINT.** With the temp present, **every** legal statement order was gated: 240 permutations of the six statements (`.run/wave6/func_8018D654/perm/res.txt`), floor **closeness 3** (`BI1320`, `BI3120`), never 0; 144 more on a second source shape (`perm2/`, all 137 ins) and 72 on a third (`perm3/`). Statement order cannot reach it, because the temp's assignment must precede its use — **the dependence you are trying to break is the one the temp created.**
+
+**DIAGNOSTIC TELL.** The residual is confined to the first N instructions of one block, is a pure PERMUTATION (same opcodes, same registers, `nins` exact), and does not move under statement reordering ⇒ **delete the temp and inline the global into the expression** (or, in the other direction, hoist it into a temp to move its load UP). Do not open the permuter, a pin, an `asm` barrier or §47/§158's allocno sliders: those steer a schedule TIE, and this is upstream of the tie, in the RTL you handed sched1.
+
+**BYTE EVIDENCE.** `func_8018D654` (ov_SC06_018, 135 ins, banked MATCH; `src/ov_SC06_018/ov_SC06_018_jr_80187AEC.c:5411`). Ladder 116 → 11 → 5 → 3 → 2 → 0; the 3 → 0 step is exactly the temp deletion.
+
+*(SHARPENS — sharpens §49, §165-14; bounds §164-43's "zero change to the final instruction stream"; evidence: byte-probed, 456 gated variants + the banked MATCH, one function; from `func_8018D654`.)*
+*⚠ Wording corrected at vet time: the source note says "the post-reload schedule preserves the group order it receives", but **sched1 itself permutes** — RTL `f6,B5E,B62` comes out `f6,B62,B5E`. The sound statement is that the RTL order SEEDS the LUID tie-break, not that a pass preserves it. The `-fno-schedule-insns2` dumps quoted verify sched1's output only.*
+
+*(SHARPENS — sharpens §165-04 (L14622-14638), §165-02, §165z; evidence: single-instance; from `func_8017C294`)*
+
+**§167-35 — §165-04 ('a zero-emission =r/0 re-tie on a memory-loaded s16 buys +8 bytes of frame per site') does NOT replic**
+
+**⚠ §165-04 CONTESTED BY TWO LATER PROBES ON ITS OWN EXEMPLAR (P30 S48, waves 5 and 6).** §165-04's entire byte record is one A/B on `func_8017C294`'s pointer-walk body (`vars 240 → 256` for two re-tie sites on memory-loaded `s16`s). Two independent agents re-ran the instrument on that same function later the same day and measured the **opposite sign**: wave 5 got `vars 240 → 232 → 224` *with instructions added* (`.run/wave4/func_8017C294/var/r_a*.c`, `var/z3_retie.c`), and wave 6 independently reproduced the failure across **16** self-cast sites (`.run/wave6/func_8017C294/var/`). Neither ran §165-04's own prescribed 4-line reproducer, so the entry is **contested, not refuted** — but do not cite '+8 bytes of frame per re-tie site' as a dial, and do not spend a wave steering with it. The two laws it leans on are unaffected and both still stand: §165-02's memory precondition, and §165-YY's *post-`life_analysis` deletion* condition — which predicts that whether the re-tie buys a slot depends on **which pass** ends up deleting the widening, and therefore that its sign is body-dependent. **Retest is still the 4-line reproducer, ~2 minutes; do that before either banking or retiring it.**
+
+*(SHARPENS — sharpens §165-36 rule 1 (L14639-14646), §160g, §71; evidence: asserted; from `func_8017C294`)*
+
+**§167-36 — WAVE STEP 0, PART 3: INVENTORY YOUR OWN OUTPUT DIR *BEFORE* THE FIRST WRITE.** *(§165-36 rule 1 sends you to `find .run` for drafts in OTHER waves' trees; the collision that actually destroys work is inside the directory the harness just handed you. PROCESS, not a compiler law.)*
+
+`.run/waveN//` is not empty just because this wave is new — the harness re-uses the per-function path, so an earlier wave's entire variant tree, **including its best drafts**, can already be sitting in it. On `func_8017C294` the wave-5 agent opened by overwriting the top-level `func_8017C294.c` with the wave-3 draft and only found the pre-existing wave-4 tree's **three 2-diff drafts in `fin/`** by accident at the end of the run; the `prior_notes.json` it was handed described the wave-3 **11-diff** state and never mentioned them.
+
+**THE RULE.** Before writing anything: `ls -la` the assigned dir, and `match_one`-batch **every** pre-existing `.c` in it (they are cheap and local — §12/§19). Never overwrite the top-level `.c`; write your first draft under a new name. **The handed-down notes are a summary of ONE earlier wave, not an inventory — the directory is the inventory.**
+
+**Companion.** §165-36 rule 2 still applies to whatever you find: carry forward its reasoning, never its coordinates.
+
+*(SHARPENS — sharpens §21 wave-distilled idioms, L1872-1881 — 'store a call result AND test/reuse it in one expression → combined assignment *(T*)(p+k) = local = f();' (evidence func_80142DC4,; evidence: single-instance; from `func_80180450`)*
+
+**§167-37 — WHEN A CALL RESULT CROSSES *ZERO* CALLS AND ITS ONLY NON-STORE USE IS THE NEXT CALL'S SOLE ARGUMENT, NAME NOTHING: STORE IT TO THE FIELD AND RE-READ THE FIELD TWICE.** *(BOUNDS §21's `*(T*)(p+k) = local = f();` bullet (L1872-1881) — its own exemplar `func_80142DC4` has the result surviving a LATER call, the precondition it never states, and following it here costs +1. Adds a FOURTH row to §164-20's delay-slot discriminator table, which routes "copy missing from a `jal` delay slot" to §43 alone. Runs §164-82's re-read lever in the OPPOSITE SIGN. The MECHANISM is not new — it is §48-A4's ARG-register copy preference plus §50-D; cite those, do not re-derive.)*
+
+Target shape — one call's result stored, null-guarded, and handed straight to the next call:
+
+ jal func_8012C1B8
+ addu $s0,$a0,$zero
+ bnez $v0,.L288
+ sw $v0,0x20($s0) <- the STORE is in the GUARD's delay slot
+ …
+ .L288:
+ lui $a1,%hi(D_SYM) ; addiu $a1,$a1,%lo(D_SYM)
+ jal func_8001C214
+ addu $a0,$v0,$zero <- the ARG copy is in the CALL's OWN delay slot
+
+**THE LAW.** `$v0` reaching the `sw`, the `bnez` and the second call's `$a0` with no intervening copy means **the source named nothing.** Write it with no local at all —
+
+ *(s32 *)(p + 0x20) = f();
+ if (*(s32 *)(p + 0x20) == 0) { g(p); }
+ else { h(*(s32 *)(p + 0x20), (s32)D_SYM); … }
+
+— cse commons both re-reads onto the call's own pseudo, so each site is a bare register use, and dbr gets both slots (the store into the `bnez`'s, the argument copy into the `jal`'s). Bind the result to a local instead and that pseudo becomes a **cross-block global allocno whose one copy use is `(set (reg $a0) P)`**: `find_reg` checks copy preferences FIRST (§50-D, `global.c:1000-1030`), and because the pseudo is defined *after* one call and dead *before* the next it crosses **zero** calls, so `allocno_calls_crossed > 0` never fires to strip the caller-saved prefs (§48-A4, `global.c:906`). It takes `$a0` at its definition: the copy collapses into a `move $a0,$v0` **above** the guard, the guard tests `$a0`, and the `jal` loses its slot occupant. Measured **+1 (63 vs 62)**.
+
+**⚠ THIS IS THE PRECONDITION §21's BULLET NEVER STATES.** §21 (L1872) prescribes `*(T*)(p+k) = local = f();` for this *same* asm shape, and its evidence `func_80142DC4` is the *same callee* (`func_8012C1B8`) at the *same offset* (`0x20`) — but there the success arm reuses the value **across later calls**, which forces it callee-saved (`addu $sX,$v0,$zero`) and is exactly why naming it is free. **Read the arm before choosing: a later `jal` between the guard and the last use ⇒ §21's named combined assignment. No later `jal` ⇒ this entry, name nothing.**
+
+**AND NOTE THE SIGN INVERSION vs §164-20 / §164-82.** There the re-read *buys* an instruction (a copy that survives into a **branch** delay slot, curing a `-1`) and the guarded value is a plain field **LOAD**. Here the same source edit *deletes* one (curing a `+1`) and the guarded value is a **CALL RESULT already stored to memory**. Same three-line shape, opposite direction — the discriminator is what defines the value.
+
+**BYTE EVIDENCE.** `func_80180450` (ov_SC06_008, **62 ins**, banked, `src/ov_SC06_008/ov_SC06_008_jr_8017C294.c:4576-4621`; family ×7). Target read off the byte-identical sibling `asm/ov_SC06_018/nonmatchings/ov_SC06_018_jr_8017C24C/func_8018025C.s` — 62 ins, `sw $v0,0x20($s0)` in the `bnez` slot (`80180270`/`80180274`), `addu $a0,$v0,$zero` in the `jal func_8001C214` slot (`80180290`/`80180294`). Named-local spelling: **63 ins**, with `move $a0,$v0` above the guard.
+
+**THE DIAGNOSTIC TELL — the fourth row of §164-20's table.** An argument copy **missing from a `jal`'s own delay slot**, `LENGTH-DRIFT +1`, and that same `move $aN,$v0` sitting **above the guard branch** with the guard testing `$aN` instead of `$v0` ⇒ **you named the call result.** Not §43 (that row is a narrow prototyped `s16` param and shows no `+1`); not §164-20 (that row is a **branch** slot and a `-1`); not a pin (§164-22 — there is no copy insn to place). Delete the local: store and re-read.
+
+*Scope, honestly: **n = 1, one A/B, and the decisive control is missing.** The note reports the losing build only as "the named-local form was 63 ins" and never says whether that was the plain two-statement `v = f(); *(p+K) = v;` or §21's combined `*(p+K) = v = f();` — and only the latter decides the bound on §21. The losing build was not re-measured at vet time. **One probe settles it:** compile `*(s32 *)(p+0x20) = v = f(); if (v == 0) … else h(v, (s32)D_SYM);` on this body and count. Until then treat the §21 bound as a PREDICTION and "name nothing" as the byte-proven half. Related caution: §165z byte-REFUTED a similarly-worded "unname the call result" claim on `func_80181E18`; that refutation does not reach this shape (no null-guard, no argument-register consumer), but do not widen this entry past its four preconditions — call result, stored to a field, null-guarded, sole remaining use = the very next call's only argument.*
+
+*(SHARPENS — bounds §21 L1872, §164-20, §164-82; mechanism cited from §48-A4 / §50-D; evidence: single-instance; from `func_80180450`)*
+
+*(SHARPENS — sharpens §163c (L11793-11800), §162a1 (L11030-11056), §162a2/§161a (L10968-10989), §165-28 (L14450); evidence: single-instance; from `func_801810C8`)*
+
+**§167-38 — AN *INTERIOR* JTBL SLOT EQUAL TO THE DEFAULT/JOIN LABEL IS AN ABSENT CASE, NOT PROOF OF A WRITTEN `case k:`.** *(bounds §163c, whose "`jtbl[k] == the default label` is the fingerprint of a case label sharing the default body, and that empty label is LOAD-BEARING" reads as unconditional; and supplies the row §162a1's three-line edge table does not have — it rules on entry[0], on entry[N-1] and on "a real body", never on an interior slot.)*
+
+**Target shape** — a dense-looking 6-word table with one interior word pointing at the same address the range check's `beqz` targets:
+
+ 801810E4 sltiu $v0,$v1,0x6
+ 801810E8 beqz $v0,.L801812DC <- OUT-OF-RANGE goes to 801812DC
+ ...
+ jtbl_801B2BD4 = [80181108, 80181114, 8018113C, 80181168, **801812DC**, 801812A0]
+ ^ slot 4 == the default target
+
+**THE LAW.** `expand_end_case` emits one word for EVERY value in `[minval, maxval]` and fills any value that has no case node with `default_label`. An interior slot pointing at the default is therefore *the default*, and carries **no information** about whether the source wrote a label there. The label §163c calls load-bearing is load-bearing only through its two side effects on the table's SHAPE: the live-case **COUNT** (vs `case_values_threshold` = 5 — §163c, §55a, §165-28) and **minval/maxval** (§162a1/§162a2). When the count already clears the threshold and the gap is strictly interior, the source can simply omit the case — and here it does.
+
+**BYTE EVIDENCE.** `func_801810C8` (ov_SC02_016, 209 ins, **first-pass MATCH 209/209, closeness 0, zero iterations**; draft `.run/wave6/func_801810C8/func_801810C8.c`, sha1 `faaf37c3…`; target `asm/ov_SC02_016/nonmatchings/ov_SC02_016_jr_8017DC70/func_801810C8.s:11-18`; table `asm/ov_SC02_016/data/tail18.data.s:21-28`). The banked switch writes case nodes **{0,1,2,3,5} and no `case 4:`** — 5 nodes, minval 0, maxval 5 ⇒ `sltiu 6` + a 6-word table, first try. Slot 4 holds `.L801812DC`, which is both the join every arm `j`s to and the target of the range check's own `beqz`.
+
+**DIAGNOSTIC TELL.** Before adding an empty `case k:` on §163c's advice, ask two questions about k. **Interior gap AND you already have ≥5 live case nodes ⇒ write nothing** — the slot fills itself. Add the label only when (a) the node count is ≤4, where per §163c the extra label is the only thing that reaches a tablejump at all, or (b) k is an EDGE, where per §162a1/§162a2 the label moves `minval`/`maxval` and therefore the `sltiu` bound and the word count.
+
+**⚠ Bounds.** The converse A/B was not run: `case 4: break;` was never compiled against this target, so this entry proves the OMISSION matches — not that the label is byte-inert. (Mechanically both spellings should land slot 4 on the same join, but that is inference, not a measurement.) One function.
+
+*(SHARPENS — sharpens §1-I3 (L54-58), §1-I4 (L60-65), §28a div-by-constant bullet (L2349), §164-04 / §1-I5 (L11934-11942); evidence: single-instance; from `func_801810C8`)*
+
+**§167-39 — THE *SIGNED* DIV-BY-CONSTANT SHAPE IS `mult ; sra 31 ; mfhi ; sra k ; subu`, AND A BRANCH AGAINST THE RECONSTRUCTED PRODUCT IS `x == x / K * K`, NOT `x % K == 0`.** *(extends §1-I3, which gives only the UNSIGNED magic — `lui 0xcccc ; ori 0xcccd ; multu ; mfhi ; srl 3`; and promotes §28a's imported decomp.wiki bullet "0x66666667→/10" from a "worth trying" list to a byte-witnessed instruction shape with a C spelling.)*
+
+**Target shape** — six instructions of division, then the source's own multiply back, then an ordinary `bne`:
+
+ 80181168 lui $v0,0x6666 ; ┐ the SIGNED magic for /10
+ 8018116C lw $a0,0x1C($s0) ; │
+ 80181170 ori $v0,$v0,0x6667 ; │ 0x66666667
+ 80181174 mult $a0,$v0 ; │ `mult`, not `multu`
+ 80181178 sra $v0,$a0,31 ; │ the DIVIDEND's sign word
+ 8018117C mfhi $t0 ; │
+ 80181180 sra $v1,$t0,2 ; │ shift 2, not §1-I3's 3
+ 80181184 subu $v1,$v1,$v0 ; ┘ q = (hi>>2) - (x>>31)
+ 80181188 sll $v0,$v1,2 ; ┐ synth_mult's ×10 — the SOURCE's, not the division's
+ 8018118C addu $v0,$v0,$v1 ; │ ((q<<2)+q)<<1
+ 80181190 sll $v0,$v0,1 ; ┘
+ 80181194 bne $a0,$v0,.L801811B4 <- the ORIGINAL dividend against the product
+
+**THE LAW.** Two halves. (1) For a **signed** operand gcc picks `mult` with the signed magic and corrects by SUBTRACTING the dividend's sign word (`sra $x,31`); that trailing `subu` of an `sra 31` is the one-glance fingerprint separating the signed form from §1-I3's `multu`/`srl` unsigned form, and the `mfhi` shift differs too (2 here vs §1-I3's 3 for the same divisor). (2) Everything AFTER the `subu` is the source's own arithmetic. A `sll/addu/sll` chain reconstructing `q*K` followed by a branch comparing that product against the **dividend** is a literal transcription of `x == x / K * K`. Write it that way.
+
+**BYTE EVIDENCE.** `func_801810C8` (ov_SC02_016, 209 ins, **first-pass MATCH 209/209, zero iterations**; `asm/ov_SC02_016/nonmatchings/ov_SC02_016_jr_8017DC70/func_801810C8.s:45-56`; banked C `if (*(s32 *)(a0 + 0x1C) == *(s32 *)(a0 + 0x1C) / 10 * 10)`, draft `.run/wave6/func_801810C8/func_801810C8.c`, sha1 `faaf37c3…`).
+
+**DIAGNOSTIC TELL.** Magic multiply ⇒ reconstructed product ⇒ branch comparing the product to the **dividend** ⇒ write `x == x / K * K` and do not "clean up" Ghidra's spelling. A `%` would compute `x − q*K` and branch on zero: one extra `subu` and a compare against `$zero` instead of against `$a0`. Read the compare's operands before choosing the operator.
+
+**⚠ Bounds.** The `%` half is a **prediction** — no `x % 10 == 0` variant was compiled against this target, and the whole function landed first-pass, so nothing here was ablated. The signed-shape half is byte-witnessed once. §1-I4's `divu`/`mflo`/`mfhi` entry is a different regime (runtime divisor) and does not apply.
+
+*(SHARPENS — sharpens §164-04 / §1-I5 (L11934-11942), §1-I3 (L54); evidence: single-instance; from `func_801810C8`)*
+
+**§167-40 — THE SIGNED `/2^k` BIAS LEAVES `addiu`'s IMMEDIATE RANGE AT k = 16: LOOK FOR `ori (2^k−1) ; addu`, AND EXPECT THE `sra k` TWICE.** *(bounds §164-04/§1-I5, whose tell — "a `bgez` whose only job is to skip an `addiu` of `2^k − 1` immediately before an `sra k`" — structurally cannot fire for k ≥ 16, so an agent applying it as written mis-reads the block as a mask.)*
+
+**Target shape** — six instructions, no `addiu`, and the shift on both paths:
+
+ 80181258 bgez $v1,.L8018126C
+ 8018125C sra $v0,$v1,16 <- the UNBIASED shift, in the delay slot
+ 80181260 ori $v0,$zero,0xFFFF <- the bias 2^16 − 1, MATERIALISED
+ 80181264 addu $v1,$v1,$v0
+ 80181268 sra $v0,$v1,16 <- the BIASED shift, second copy
+ .L8018126C:
+ 8018126C negu $v0,$v0 <- the source's unary minus
+
+**THE LAW.** gcc's round-toward-zero correction for signed `x / 2^k` adds `2^k − 1` on the negative path. `addiu` carries a **signed** 16-bit immediate, so that constant fits inside the instruction only for **k ≤ 15** (2^15 − 1 = 32767). At **k = 16** it is 65535, out of range, and must be materialised — `ori $rD,$zero,0xFFFF ; addu` — after which dbr fills the `bgez`'s now-empty delay slot with the **unbiased** `sra k`, so the shift appears once in the slot and once on the biased fall-through. The block grows from §1-I5's 3 instructions to 5, and the `addiu` §1-I5 tells you to look for is absent. **The C does not change: write the division literally.**
+
+**BYTE EVIDENCE.** `func_801810C8` (ov_SC02_016, 209 ins, **first-pass MATCH 209/209, zero iterations**; `asm/ov_SC02_016/nonmatchings/ov_SC02_016_jr_8017DC70/func_801810C8.s:108-114`). Banked C: `*(s16 *)(a0 + 0xFE) = -(D_801B42D0 / 0x10000);` (`.run/wave6/func_801810C8/func_801810C8.c`, sha1 `faaf37c3…`), with `extern s32 D_801B42D0;`.
+
+**DIAGNOSTIC TELL.** A `bgez` whose fall-through is `ori $rD,$zero,M ; addu` with **M = 2^k − 1**, plus an `sra k` on BOTH paths (one of them in the `bgez`'s own delay slot) ⇒ a signed `/ 2^k` with k ≥ 16. Do not read the `ori 0xFFFF` as a mask, do not respell the division as `>> k` (which loses the entire block — §1-I5), and do not reach for an unsigned divide (a bare `srl`, no branch). A leading `negu` on the result is the source's unary minus, not part of the division.
+
+**⚠ Bounds.** k = 16 measured, on one function, first-pass (no ablation). k ≥ 17 is unmeasured — the bias would need `lui`+`ori`, so expect 6 instructions, not 5. The k ≤ 15 half is §1-I5's own byte evidence and is unchanged.
+
+*(SHARPENS — sharpens §165-43 (L14773), §88c (L6695), §162e (record_jump_equiv for a loop index), §164-52 (equivalence lifetime); evidence: single-instance; from `func_80181948`)*
+
+**§167-41 — cse's TAKEN-EQUALITY CLASS REACHES A STORE'S *SOURCE*, NOT ONLY A COMPARE: `sw $a0,%lo(sym)($at)` inside an arm guarded by `beq $a0,<1>` is `sym = 1;`.** *(sharpens §165-43 (L14773), which states the same `record_jump_equiv` class only for a register-to-register `bne` and whose tell — "an `==`/`!=` compare against a **callee-saved** register inside a guarded arm" — cannot fire on a store; and adds the ARGUMENT-register case, where the false reading is the incoming PARAMETER rather than a local.)*
+
+**Target shape** — a case arm reached by an equality test on the switch value:
+
+ beq $a0,$v0,.Lcase1 <- $v0 = 1; on this edge cse learns $a0 == 1
+ …
+ .Lcase1: …
+ sw $a0,%lo(D_801270C8)($at) <- reads as "store the parameter"; it is `= 1`
+
+**THE LAW.** `record_jump_cond` (`tools/reference/gcc-2.7.2/cse.c:5839`, via `record_jump_equiv` `:5791`) merges the two operands of a taken `EQ` into ONE equivalence class for the rest of the path, and cse then emits the CHEAPEST member of that class at **every** use — a use being any operand, the compare §165-43 documents **or the SET_SRC of a store**. `D_801270C8 = 1;` therefore materialises no `li` at all and stores whichever register the dispatch already proved equal to 1. Per §164-52 the class survives until a label with >=2 jump references resets the table.
+
+**BYTE EVIDENCE.** `func_80181948` (ov_SC01_077, 132 ins, `match_one` MATCH; draft `.run/wave6/func_80181948/func_80181948.c:42`): `case 1:` opens `if (*(s32*)(a0 + 0x1C) == 0x14) { D_801270C8 = 1; }` and emits the target's `sw $a0`. *(One sighting, one-sided: no counter-spelling was compiled.)*
+
+**⚠ It is BYTE-NEUTRAL inside the arm** — `D_801270C8 = state;` emits the same store, because cse proved them equal. What the reading buys is not writing `D_801270C8 = param;`, which `$a0` invites and which does not match once the parameter is anywhere else.
+
+**THE DIAGNOSTIC TELL.** A store whose source register is an **argument** register that this arm's own guard compared against a constant. Before transcribing it as a variable, ask what the guard proved on this path: §88c says a materialised constant proves nothing and §165-43 says its absence proves nothing — that now covers store sources, so let the guard, not the register name, decide.
+
+*(SHARPENS — sharpens §160d (L10936) — THE ASYMMETRIC INDEX RELOAD; the only store-then-reload entry, but its observable is an `lbu`/`sll` COUNT and its consumer is a table index, never a comp; evidence: single-instance; from `func_80183834`)*
+
+**§167-42 — A SATURATING `u16` DECREMENT-AND-TEST READS THE FIELD BACK, AND THE BRANCH'S DELAY SLOT IS THE TELL.** *(sharpens §160d, the only store-then-reload entry, whose observable is an `lbu`/`sll` COUNT for a table index and never a compare; and §164-20 / §164-82, whose re-read tells are both LOAD-guard-then-reload, the mirror construct. The ordering half is §164-29's register WAR fence, NOT §163d/§162j.)*
+
+Target shape — a timer field decremented and tested inside one arm:
+
+ lhu $v1,0x86($s0)
+ beqz $v1,.Lskip
+ …
+ addiu $v0,$v1,-1
+ sh $v0,0x86($s0)
+ andi $v0,$v0,0xFFFF <- the "reload", cse'd down to the STORED register, zero-extended IN PLACE
+ bnez $v0,.Lret
+ nop <- the slot stays EMPTY
+
+**THE LAW.** Write the second test against MEMORY, not against the local:
+
+ t = *(u16 *)(p + 0x86);
+ if (t != 0) {
+ *(u16 *)(p + 0x86) = t - 1;
+ if (*(u16 *)(p + 0x86) != 0) { return; }
+ }
+
+cse replaces the reload with the just-stored pseudo, and the HImode→SImode zero-extend the compare needs is done **in place on that same register**. The `andi` therefore re-SETs a register the `sh` READ, and `sched_analyze_1` (`sched.c:1714-1715`) emits a hard `REG_DEP_ANTI` for exactly that (§164-29) — so the `sh` can never be moved below the `andi`, which is precisely what `reorg` would have to do to put it in the `bnez`'s slot. Slot stays `nop`: **5 words.** The local-variable form `t = t - 1; *(u16 *)(p + 0x86) = t; if (t != 0)` decrements in place (`addiu $v1,$v1,-1`), masks into an INDEPENDENT register (`andi $v0,$v1,0xFFFF`), frees the `sh` of the anti-dependence, and `reorg` steals it into the delay slot: **4 words, `LENGTH-DRIFT −1`.**
+
+**THE DIAGNOSTIC TELL.** On the SECOND branch of a decrement-and-test: **a `nop` in the slot ⇒ the source re-read the field; a `sh` in the slot ⇒ the source tested a local.** Read the slot before touching anything else — like §164-82's class this presents as a whole-tail shift, not as one missing instruction.
+
+**Byte evidence, and its limit.** `func_80183834` (ov_SC01_077, 135 ins) banks with the read-back form (`src/ov_SC01_077/ov_SC01_077_jr_80183324.c:3393-3398`), as does its family twin `func_8018127C` (`src/ov_SC02_000/ov_SC02_000_jr_80180D6C.c:3044-3049`); a corpus grep finds **zero** instances of the local-variable form anywhere in `src/`.
+
+⚠ **The counter-arm has no surviving artifact.** Every preserved probe in `.run/wave6/func_80183834/` (`base.c`, `varA`–`varR`) carries the read-back spelling, so the −1 is a transient measurement from the crack's front-half iteration and is **not re-runnable**. The mechanism above is a reconstruction — the crack note's own wording ("the `sh` is a live-def of the compare register") is wrong: the `sh` is a USE, and the edge is ANTI, not true. **Re-run the A/B before leaning on the −1 number; the transcription rule and the slot tell are the durable halves.**
+
+*(SHARPENS — sharpens §165-15 (L14033-14057), §163a (L11764-11780), §8d (L487-510), §17a-1 (L1445-1470); evidence: single-instance; from `func_80183BC8`)*
+
+**§167-43 — THE BLOCK-SCOPE SOLVENT HAS A MOVABILITY PRECONDITION, AND A RETURN-TYPE-ONLY CALLEE CONFLICT WAS NEVER ITS JOB.** *(bounds §165-15's discriminator table (L14049-14057), whose `conflicting types for 'X'` row says "⇒ §163a's block-scope solvent is live (move BOTH the typedef and the extern into the block)" without stating the precondition; the cure that row should hand over is §17a-1 point 1, which already names this exact case.)*
+
+**Target situation.** Your body needs the callee's `$v0` — `v0 = f(a0); if (v0 != 0) …` — while the destination TU already carries `extern void f(s32 a0);` at FILE scope, ABOVE your insertion point, feeding a function that is ALREADY BANKED.
+
+**THE LAW.** §163a's solvent is a property of a PAIR of declarations: *both* at block scope warn, *either* at file scope is the hard-error cell (§8d byte-proved that direction: `FILE(void *) -> BLOCK(int) -> conflicting types for 'D_801812A4'` ERROR). **You can only reach the solvent when you own BOTH decls.** A file-scope callee extern that an already-banked function in the same TU compiles against is immovable — demoting it changes that function's declaration environment (§8d, the whole reason `scope_data_externs.py` exists) and buys an R22 blast radius for a one-function problem. **When the only term that differs is the RETURN TYPE, do not redeclare at ANY scope: leave the TU's decl exactly as it stands and cast at the use site** — `v0 = ((s32 (*)(s32))f)(a0);` — codegen-neutral, draft-only, no fleet edit. §17a-1 point 1 already states this as *"Call-site casts, NOT redeclaration (the #1 recurring miss)"* and names the form verbatim for a `void`-canonical callee whose `$v0` is used.
+
+**BYTE EVIDENCE.** `func_80183BC8` (ov_SC02_041, 108 ins), banked whole-binary at `src/ov_SC02_041/ov_SC02_041_jr_8017BEBC.c:6477`. The TU declares `extern void func_8012CBCC(s32 a0);` at file scope `:5732` — consumed two lines later by the banked `func_80182484` through `((s32 (*)(void))func_8012CBCC)()` — and repeats the identical spelling at `:6470`. The new body takes the return through `v0 = ((s32 (*)(s32))func_8012CBCC)(a0);` at `:6509`. The crack note's proposed fix (add `extern s32 func_8012CBCC(s32 a0);` at block scope inside the body, leaving `:5732` in place) was **never compiled** and lands in §163a's file-scope cell. Cross-TU confirmation of the true arity/return: `src/ov_SC02_011/ov_SC02_011_jr_8017AE2C.c:4933/4953`.
+
+**THE DIAGNOSTIC TELL.** `match_one` MATCHes standalone, the whole-binary build reports `conflicting types for 'func_X'`, and diffing the two spellings term by term (§73's two axes) shows **only the return type differs**. Route it: *return-only* ⇒ use-site cast, zero blast radius (this entry). *Params* ⇒ §73's param row, cast at each use. *Arity / `too many arguments`* ⇒ §165-15, no scope helps. *A decl you own at BOTH ends* ⇒ §163a, move the pair into the block. **Check who else compiles against the file-scope decl before you touch it — if the answer is a banked function, the solvent is off the table.**
+
+*(SHARPENS — sharpens §43 (L3195), §164-48 (L12866), §163b (L11781), §164-30 (L12507); evidence: single-instance; from `func_80184E4C`)*
+
+**§167-44 — THE `sll $aN,$sX,16 ; sra $aN,$aN,16` PAIR IN THE SLOTS BEFORE A `jal` CAN BE A *PARAMETER* WIDTH TELL — §43's TRIAGE HAS NO BUCKET FOR IT.** *(SHARPENS §43 (L3195), whose tell is binary — in-place on `$aN` ⇒ s16 param, into a `$v0/$v1` temp ⇒ cast-of-s32 — and §164-48 (L12866), which owns this exact shape but reads it for a LOCAL and forwards the PARAMETER reading to §163b, which is switch-dispatch only. The ANSI-vs-K&R half is already indexed (cookbook-index L29; §164-20's delay-slot discriminator, L12286); the SHAPE is not.)*
+
+Target shape — a narrow param whose live range crosses a `jal`, re-extended into the ARG register at the next call:
+
+ move $s1,$a2 ; move $s3,$a3 <- entry: the raw WORD is stashed, UNextended
+ jal
+ beqz $s0,
+ sll $a2,$s1,0x10 <- the extension READS the callee-saved copy…
+ sll $a3,$s3,0x10
+ move $a0,$s0 ; move $a1,$s4
+ sra $a2,$a2,0x10 <- …and WRITES the arg register
+ jal
+ sra $a3,$a3,0x10 <- second half rides the delay slot
+
+**THE LAW.** This is neither of §43's two buckets. The parameter is HImode; its live range crosses a call, so the raw word goes to a callee-saved pseudo at entry; the widening is the tree-level conversion of that HImode value to the callee's `s32` formal (`convert_arguments` → `convert_for_assignment`, `c-typeck.c:1623/1737`). **Declare the enclosing function's parameter `s16` in a plain ANSI prototype and pass it STRAIGHT THROUGH** — `f((u8 *)obj, a1, a2, a3)` against `extern void f(u8 *, s32, s32, s32);` — and ordinary integer promotion emits the pair for free. No `(s16)` cast on top (and a cast on an `s32` param cannot reach this shape, §43).
+
+**WHY THE PARAM STAYS NARROW INSIDE THE BODY (source-cited; §43 states this only as behaviour).** `config/mips/mips.h:1153` defines `PROMOTE_PROTOTYPES` but the port defines **no `PROMOTE_FUNCTION_ARGS`**, so `assign_parms` leaves `promoted_mode = passed_mode` (`function.c:3324-3329`) and an incoming `short` lives in HImode for the whole body — every SImode use pays its own extension, wherever it falls.
+
+**BYTE EVIDENCE.** `func_80184E4C` (ov_SC03_014, 50 ins, banked whole-binary, S48 wave 6). `src/ov_SC03_014/ov_SC03_014_jr_801848E4.c:2797` = `s32 func_80184E4C(s32 a0, s32 a1, s16 a2, s16 a3, s32 a4)`; the shipped `build/src/ov_SC03_014/ov_SC03_014_jr_801848E4.o` `0x568-0x62c` disassembles to the shape above (`move s1,a2` @0x588, `move s3,a3` @0x590, `sll a2,s1,0x10` @0x5a8, `sra a3,a3,0x10` in the `jal func_8001CB6C` delay slot @0x5c0). Both middle params flow untouched into `func_8001CB6C`'s `s32` formals; there is no cast in the body.
+
+*Scope, honestly: **n=1 and NO A/B was run** — the draft MATCHed first try, so the `s32` twin was never compiled. The direction is not in doubt (dropping to `s32` deletes both pairs by plain C semantics: LENGTH-DRIFT −4), and §164-48's one-character probe byte-proves the same width→extend-at-use coupling for a LOCAL. What is new here is the READING of the shape, not the coupling.*
+
+**THE DIAGNOSTIC TELL.** LENGTH-DRIFT −2 per narrow argument, the missing instructions a `sll 16`/`sra 16` pair straddling the call's `move $aN,…` arg setup, on a function that copies raw `$aN` into `$sX` at entry. **Ask whose value `$sX` holds before reaching for §164-48:** a call result or a computed local ⇒ §164-48 (and expect an `$s0/$s1` permutation with it); an incoming argument copied at entry with nothing done to it ⇒ **this entry — widen nothing, narrow the DECLARATION.** If the pair sits between a bias subtract and an `sltiu`, it is §164-37/§163b instead.
+
+*(SHARPENS — sharpens §20 scalar-global-RMW bullet (L1907-1918), §164-52 (L12943), §153 (L10463), §165-26 (L14399); evidence: single-instance; from `func_80188F60`)*
+
+**§167-45 — A GLOBAL THAT IS STORED TO *AND* HAS ITS ADDRESS PASSED TO A CALL IN THE SAME BLOCK NEEDS A POINTER LOCAL — AND AN `addiu $rD,$rB,-K` OFF THAT BASE NAMES WHICH SYMBOL THE SOURCE ANCHORED ON.**
+
+Target shape — one global's address held in a register serving BOTH a zero-displacement store and the call's pointer argument, while its neighbours in the same record stay plain symbol stores:
+
+ la $16,D_800A5E98
+ sw $2,0($16) <- the store goes through the BASE
+ ...
+ sw $2,D_800A5E9C <- the NEIGHBOUR keeps the plain %hi/%lo fold
+ sb $2,D_800A5EA4
+ move $5,$16 ; jal func_80028620
+
+**LAW 1 — THE ANCHOR.** `D_800A5E98 = -0x12; … f(1, &D_800A5E98);` emits the §18 single-store fold (`lui $at,%hi ; sw $v,%lo(SYM)($at)`) **plus a second, independent `la` into `$a1`** — two wrong instructions. `s32 *rec = (s32 *)&D_800A5E98; *rec = -0x12; … f(1, rec);` makes the store's address RTL the *same pseudo* the argument needs, cse ties them, and one `la` serves both. This is §20's scalar-global-RMW bullet with the READ replaced by a call argument: **the trigger is not "read and written", it is "the address is needed in a register for something else in the same block."** Check §153/§165-26 first — if the address is an argument to >=2 calls and there is no store, those apply instead and the declaration is what you DELETE.
+
+**LAW 1a — BOUNDS §164-52.** §164-52 says a pointer-to-global local evaporates into `lw SYM+k` unless a >=2-jump-ref label sits between its init and its uses. Here `rec` is init'd and used on ONE straight path with no join at all, and it survives — because §164-52's fold is `fold_rtx` rewriting `p[k]`, a **dereference**, into an absolute address. **A use of the pointer VALUE — a call argument, a compare, a store of the pointer itself — has no absolute form to fold into and keeps the base alive on any path.** Read §164-52's tell as scoped to all-dereference locals.
+
+**LAW 2 — THE READING HALF.** `la $rB,SYM ; addu/addiu $rD,$rB,-K`, with `$rD` a pointer argument and `$rB` a store base, means the source anchored the pointer local on the **LATER** symbol and subtracted:
+
+ s32 *rec2 = &D_800A5E9C; *rec2 = 0x18; … f(1, rec2 - 1);
+ => la $3,D_800A5E9C ; sw $2,0($3) ; addu $5,$3,-4
+
+Anchoring on the earlier symbol and writing `rec2[1]` instead gives `sw 0x4($base)` and a bare `la $a1` — 6 mismatched. **The STORE's displacement is the discriminator: `0(base)` means the anchor IS the stored symbol; `K(base)` means you anchored too low.**
+
+**PER-SITE, NOT PER-BLOCK.** Only the word the target routes through the base gets a pointer local; its neighbours (`D_800A5E9C` and the three `sb` bytes here) keep the plain symbol spelling. Converting the whole record to one struct-typed base is the failure mode — the same discipline as §162q1 and §165-27.
+
+**BYTE EVIDENCE.** `func_80188F60` (ov_SC02_000 + ov_SC02_003, `jr_8018173C`, MATCH, banked `commit:1713` at `src/ov_SC02_000/ov_SC02_000_jr_8018173C.c:3890`); asm at `.run/wave4/func_80188F60/t.s:90-94, 113-118, 308-309`. *Honest scope: the preserved rungs (`v1.c` 149-off -> `v2.c` 98-off) change FOUR things at once — this anchor, the branch polarity, the `rec2 - 1` anchoring and a counter merge — so the direction is established by the banked body and the losing spellings are prose, not preserved probes. Re-measure single-axis before quoting a magnitude.*
+
+*(SHARPENS — sharpens §164-80 Law 1 (L13566-13578), §20 cross-BB combine law (L2489), §165-06 (L13827), §164-24/§16x (L12405); evidence: single-instance; from `func_80188F60`)*
+
+**§167-46 — §164-80 LAW 1 EXTENDS TO `>>`/`+` ON A PLAIN REGISTER LOCAL, AND ITS SYMPTOM THERE IS A *LENGTH* DRIFT, NOT A REGISTER DRIFT.**
+
+§164-80 Law 1: `t = (t & M) | x;` evaluates the inner operation into an anonymous temp that takes a scratch, while `t &= M; t |= x;` expand in place on `t`'s own pseudo. Its evidence is one `and`/`or` pair on a memory-fed packed word, and its scope note says *"Re-measure before generalising Law 1 beyond `and`/`or`."*
+
+**It generalises, and it costs something different.** `i = (i >> 5) + 0x10;` on a register local mints a pseudo for `i >> 5` that lands in `$v0`. Two consequences, both LENGTH:
+
+1. the following `addiu` now carries a WAR dependence on `$v0`, so it can no longer sink into the branch delay slot; and
+2. `reorg` fills the *preceding* branch's slot by DUPLICATING the `sra` — the same insn then appears both in the delay slot and at the join. **Net +1.**
+
+`i >>= 5; i += 0x10;` — both destructive on `i` — restores the target's stream. What matters is that each statement's DESTINATION is the variable itself; the `op=` token is the shortest spelling of that, not the mechanism (§164-24).
+
+**THE DIAGNOSTIC TELL (the new half).** **An instruction that appears BOTH in a branch delay slot and again at that branch's join, on a LENGTH-DRIFT +1, means your intermediate value is living in a scratch register.** Make the statement destructive on the variable before touching scheduling pins, allocno sliders or the permuter. **Discriminate against the one other cause of that exact signature:** §20's cross-BB combine law (L2489) produces a duplicated `sll` at a loop preheader *plus* the loop-back delay slot when a narrow value crosses a BACKEDGE — that one is a fold-defeat you WANT, and its duplicate straddles a loop, not an if-join.
+
+**BYTE EVIDENCE.** `func_80188F60` (ov_SC02_000, MATCH, banked `commit:1713`): `.run/wave4/func_80188F60/v2.c:67` (compound, 98 off) vs `v4_MATCH.c:68-69` (destructive, MATCH). *Honest scope: that rung also splits a decrement/test and block-scopes a pointer local, so the +1 attribution is the agent's reading of an intermediate diff, not an isolated A/B. The underlying fact — an expression temp is a distinct pseudo at expand — is §164-80's and is source-read.*
+
+### §167z — REFUTED IN WAVES 5/6: do NOT re-derive
+* **`func_8017FE38`** — GENERALIZATION: when a long-latency load heads a dependency chain whose consumer is far away, the SOURCE STATEMENT BOUNDARY decides whether sched1 hoists it — an inline s
+ *Why:* Byte-refuted as worded. I built the banked body with `d = *(u16 *)&D_800B9A02;` as its OWN statement placed immediately above its consumer (`ot = (u32)&D_800A6610[d << 14];`): 12 mismatched at 239 ins — and the `.text` is BYTE-IDENTICAL to the fully-inline spelling (objdump diff is only the embedded filename). A statem
+* **`func_8017FE38`** — THE FORCED COPY MUST BE CONSUMED IN PLACE OR THE STORE SCHEDULES AWAY FROM IT — rewriting `x -= (tp & 0xF) << 6;` as `tp = tp & 0xF; x -= tp << 6;` shortens the forced co
+ *Why:* The EFFECT is real — I measured the in-place vs inline A/B on the banked body at 0 vs 10 mismatched (239 ins both), with the `sh $rX,0x16($a3)` moving four slots and a register cascade behind it. But the stated LAW is a coupling claim about the forced copy, and the coupling is byte-refuted: with the `+ zr` copy REMOVED
+* **`func_8018C3F8`** — BOUND ON §164-02: when the constant base reaches the addu via a SPILL RELOAD (`lw 0x30($sp)`) rather than a live `la` pseudo, "a round trip through memory kills the const
+ *Why:* The OBSERVATION is real and byte-confirmed by me in the shipped object (0x8018c554 `addu s1,t2,s1`, base first, source order won). The stated MECHANISM is impossible and must not be banked in this form.
+
+(1) PASS ORDER makes the spill story unreachable. §164-02's swap is a cse-time decision (`fold_rtx`, cse.c:5278-5304
+* **`func_8018C3F8`** — Corollary: "this ALSO explains why sibling func_8018F694 matched with the opposite spelling: there `ot` stays in a live register."
+ *Why:* BYTE-REFUTED from the shipped, matching binary. `func_8018F694` reloads its `ot` from the frame exactly like `func_8018C3F8` does: `8018f7d8 lw a3,0x38($sp)` / `8018f7dc sll s0,s0,0x2` / `8018f7f0 addu s0,s0,a3`. Its `ot` does NOT stay in a live register — it is stack-resident at the add, the same as the claimed "spill
+* **`func_8017F17C`** — Lever 3 — FRAME: MEASURE THE BASELINE BEFORE ADDING DEAD LOCALS. The 8-byte hole at sp+0x18..0x1F reads exactly like §162's unreferenced-local oracle but is not one: gcc
+ *Why:* THE THREE ABLATION NUMBERS ARE RIGHT; THE MECHANISM IS BYTE-REFUTED AND THE PRESCRIPTION IS ALREADY BANKED THREE TIMES OVER. It must not enter the file in this form.
+
+(1) MECHANISM REFUTED. "gcc already rounds the align-1 struct's slot" is false. I compiled 7 controlled spellings on the pinned cc1: `struct { u8 c[8]; }
+* **`func_801805D4`** — L8 — the accumulation must be ONE expression `f(x) + (f(y + K) >> 4)`, not two statements: gcc-2.7.2 evaluates the left operand first, parks it in $s0 across the second c
+ *Why:* The prescriptive half — 'ONE expression, not two statements' — is BYTE-REFUTED at vet time, twice. Splitting into two statements with per-site block-scope temps (`{ s32 x = f(..); s32 y = f(..); u = x + (y>>4); }`) -> MATCH 212. Splitting with a multi-set accumulator (`u = f(..); u = u + (f(..)>>4);`) -> MATCH 212. §16
+* **`func_80187F2C`** — The two field stores and the `func_8012E688(a0,0x98F,0)` call must be written call-LAST (`store; store; call;`). Interleaving (`store; call; store`) let gcc-2.7.2's delay
+ *Why:* THE TARGET DESCRIPTION IS FACTUALLY FALSE AND I BYTE-REFUTED IT. Disassembling the banked SHA1-green object at 0x80187FE0: `jal 8012e688` / `sh v0,254(a0)` — the 0xFE store IS the call's delay slot, not a `nop`. The whole claim is built on a target reading that does not exist, and the same TU's unbanked sibling `func_8
+* **`func_80187130`** — When EVERY arm of a 2-way branch ends in `return` (no single main-body arm), gcc-2.7.2's RTL-order-is-source-order places the arm written LAST adjacent to the shared epil
+ *Why:* BYTE-REFUTED — and refuted by the agent's own two builds, which are still on disk. I re-ran the pinned triple at vetting time (cpp / tools/bin/gcc-2.7.2-psx/cc1 -O2 -G0 -mips1 -mcpu=3000 / maspsx / as) on both surviving probes plus three new controls, and read cc1's own `.s`, not just the `.o`.
+
+(1) THE DIRECTION IS EX
+* **`func_80183BC8`** — The accumulate must be spelled as the full raw expression twice — `*(u16*)ptr = *(u16*)ptr + r;` — and NOT as a `+=` compound assignment.
+ *Why:* No A/B was run on the `+=` token; it is bundled into the same edit as the per-branch duplication and the fresh local, so it credits an untested variable — the precise failure mode §164z refuted twice in this campaign (func_80184944: 'the A/B moved TWO variables at once and credited the wrong one'; func_801823E8: 'the A
+* **`func_80183BC8`** — INTEGRATION PRESCRIPTION: because the destination TU already declares `extern void func_8012CBCC(s32 a0);` at file scope, bank the body by declaring `extern s32 func_8012
+ *Why:* Three independent problems. (1) MOOT AND CONTRADICTED BY THE SHIPPED BANK: func_80183BC8 is already banked at src/ov_SC02_041/ov_SC02_041_jr_8017BEBC.c:6477 and the resolution actually used is the §17a-1 use-site cast — the file-scope decl is left as `extern void func_8012CBCC(s32);` (:6470, an exact-text duplicate of
+* **`func_8017F3C8`** — FLAGGED CLAIM — 'a cross-block ternary-result allocno's global-alloc conflict is BLOCK-granularity, not instruction-precise': gcc-2.7.2 global-alloc records a conflict ag
+ *Why:* BYTE-REFUTED FROM THE PINNED SOURCE, and the cited evidence cannot support the claim it is offered for.
+
+(1) THE GRANULARITY HALF IS FALSE. `global_conflicts` (tools/reference/gcc-2.7.2/global.c:625-772) is an explicit per-INSN birth/death walk, not a block-granularity scan. Per block it (a) seeds `allocnos_live`/`hard
+* **`func_801832F8`** — FLAGGED: the §164-82 / §46-L2 'test-then-re-read' idiom transfers from memory LOADs to constant-division results — writing `pan + out1.x/20` again in every arm of an if/e
+ *Why:* BYTE-REFUTED on the pinned triple (cpp / cc1-2.7.2 -O2 -G0 -mips1 -mcpu=3000 / maspsx 2.56 / as). I built the minimal repro the claim describes — `register s16 pan __asm__("$17")`, the field `out1.x` loaded through a real call, the clamp result captured into `s32 panv`, `panv` consumed by the trailing call — in two spe
+* **`func_801832F8`** — Pinning `base` to ANY explicit hard register costs +2 instructions elsewhere in the SAME function — specifically it blocks fill_simple_delay_slots from duplicating the `a
+ *Why:* Byte-refuted, and already narrowed by the successor agent. In the shipped draft the pinned build emits the duplicated `addiu $a0,$sp,0x20` in BOTH positions (indices 62 and 64 of the mine-side stream, matching the target's pair at 801833F0/801833F8) at 111 ins — i.e. the pin does not suppress the duplication at all. Th
+* **`func_801832F8`** — A second, more novel use of the §5a barrier: as a pure SCHEDULING fence with no return statement attached — placed after `if (v<0) goto y_neg;` to block the `bltz`'s dela
+ *Why:* Byte-refuted in its own function. Deleting exactly that barrier from the shipped draft and re-running `match_one` gives a BYTE-IDENTICAL result — 111 ins, 40 mismatched, and the two diff reports are `diff`-clean against each other (`.../vet832F8/w6_base.diff` vs `w6_nofence.diff`). The barrier is doing nothing at the s
+* **`func_801832F8`** — (derived during this vet, from residual B) The target's pan-clamp `addu $v0,$s1,$v0 ; addu $s1,$v0,$zero` — sum into a scratch, then a copy into the callee-saved home — c
+ *Why:* Byte-refuted, and the cure is one deleted word. That copy is the deferred-truncation store an `s16` accumulator emits when it is ASSIGNED and then TESTED — and the `register __asm__("$17")` pin on `pan` is what deletes it. Minimal repro, same call skeleton, pinned triple:
+ pA `register s16 pan __asm__("$17"); pan = p
+* **`func_80184E4C`** — MECHANISM: 'MIPS o32 leaves the upper bits of narrow-typed register params unspecified, so gcc re-extends on first actual use, even though the parameter was register-copi
+ *Why:* The OBSERVABLE half — raw whole-word stash to a callee-saved pseudo at entry, extension deferred to the use — is already §43 word for word ('with the raw values stashed to callee-saved pseudos first (s3←a1 …) and re-extended per use after calls'), so it is COVERED, not new. The ABI ATTRIBUTION is wrong and must not be
+* **`func_8017EEEC`** — func_8017EEEC is a SECOND byte-verified instance of §163c's specific mechanism — an EMPTY `case 4:` glued onto `default:` is the load-bearing label that crossed the thres
+ *Why:* BYTE-REFUTED, and it matters: the draft is wrong and must not be banked. §163c's own diagnostic ('jtbl[k] == the default label is the fingerprint of a case label sharing the default body') falsifies the claim on sight. The target table is jtbl_801AA880 = [0x8017EFB0, 0x8017F074, 0x8017EFF0, 0x8017F074, 0x8017EF3C] (asm
+* **`func_8017F5D4`** — (wave-5) FAMILY REACH: the ×2 sibling should remap mechanically — the family template is the (Morph_8017DC1C*, SVECTOR2*, SVECTOR2*, t) quadruple list; only the 11 per-ov
+ *Why:* Byte-refuted, first by the wave-6 agent and then independently by me: the only other func_8017F5D4.s in the tree (ov_SC01_008) is an 18-instruction body with frame 0x18 and two jals — nothing to template. The wave-5 note asserted a mechanical ×2 remap without ever opening the sibling's .s, which is precisely the failur
+* **`func_80187D0C`** — Sub-claim of the same note: the oracle generalises to `<=` — "slti+bnez-to-label almost always means the source used >=/<= against the constant, with the label holding th
+ *Why:* BYTE-REFUTED, and it is the one part of the note that is not already on disk. The relational families split by polarity, not by strictness: the GREATER family (`>=`, `>`, and the operand-reversed `K <= x`) produces `slti`+`bnez`-to-else; the LESS family (`<`, `<=`) produces `slti`+`beqz`-to-else. I compiled all four on
+* **`func_8017F2D4`** — ROOT CAUSE of the seven prior gate refusals was the wrong destination-TU citation, not a codegen residual — 'a banker splicing into jr_8017C340.c gets a no-op or a bad sp
+ *Why:* Already byte-refuted inside the very entry this campaign banked from these notes. §166a's scope correction states it was measured: `corpus.stubs()` derives each stub's TU from the actual INCLUDE_ASM site and `gate_stage` splices via corpus, so the harness was always editing the right file — only the PROSE was wrong. Af
+* **`func_8017F2D4`** — NEW-1: gcc-2.7.2 cross-jumping keeps the FIRST copy while the target keeps the LAST, which is why the 14-arm shared tail must be hand-written ONCE at the last arm with `g
+ *Why:* The MECHANISM is on §165z's refuted list under this exact function, in these exact words. jump.c keeps the LAST on every path — `do_cross_jump` deletes the stream preceding `insn` and `jump_chain` is built push-front, so the earliest jump pairs with the latest copy (§162g, read out of jump.c:2537/219-221). The real rea
+* **`func_8017F2D4`** — NEW-5: the surviving redundant compare at 0x8017F460 needs TWO levers TOGETHER — (a) `__asm__ ("" : "=r"(t) : "0"(t))` tied to SELF (tying to a fresh temp costs a real `m
+ *Why:* Split verdict, and both riders the agent re-asserts are already byte-refuted. Lever (a) itself is SOUND and banked as §165-03 (cse's record_jump_cond carries EQUALITY across a branch, cse.c:5944-5990; barrier deleted -> 3 mismatched, BRANCH-POLARITY) — COVERED. But the rider 'tying to a FRESH temp costs a real move' is
+* **`func_8017F2D4`** — `s32 lt = mode < 0xA;` must be an explicit local because gcc-2.7.2 has no gcse and the single `slti` must precede the branch both arms need it after.
+ *Why:* On §165z's refuted list under this function, byte-refuted at vet time: deleting the local and inlining the compare at both use sites — `if ((mode < 0xA) || (D_8011515A == 0x100))` and `if (!(mode < 0xA))` — gives MATCH 279. The C form is byte-INERT here, so it is not a lever and must not be taught as one; the 'no gcse'