BFM-decomp/cookbook/C0422.md

§381 — THE insn_count HOIST THRESHOLD IS A DIAL YOU CAN READ WITH cc1 -dL (P31 S69; four independent uses in one wave)

move_movables' willingness to hoist scales with the loop's insn_count, and the edge is sharp enough to sit on. Read the count from the -dL (loop) dump, then move ONE statement across it:

• func_80040DE8 — insn_count 232 hoisted (s16)param_1 at the exact 58×2×2 = 232 edge; a key = param_1; copy inside the loop lifted it to 233 and un-hoisted it.
• func_80023BF0 — loop 2's insn_count is 39 and needs ≥41: below the threshold gcc admits one constant hoist too many (li 0xFFFF at threshold 40), which costs a fourth callee-saved register and shifts the whole register file. Still open at 269 for exactly this reason.
• func_8001DA34 — 29×1×9 ≥ 203 hoisted the 0xFF000000 OT mask and spilled ot (frame 0xB8→0xC8); fixed with $a1/$a2 pins. BANKED, 408 ins.

Read the dump before you theorise. Three of these four were found by reading -dL, not by guessing, and the fourth is documented as an open threshold miss rather than a mystery.