Reference counting cannot tell that a declaration is dead when its only references live inside itself or inside a cycle: function c() { d() } function d() { c() } never reaches zero references. Removing these needs reachability, not counts. This PR adds the analysis; the PR above consumes it at the removal sites. Output does not change here.

References in executing code are roots. References inside a candidate declaration's body only count once that candidate itself is live. A dead cycle is never reached, so there is no cycle detection. Candidacy is function declarations only — declarator and class candidacy were built, hardened, and then measured to contribute exactly zero output bytes on 17 real artifacts, so they were cut.

The analysis runs for ES modules only. In strict ESM the hard cases cannot occur: Annex B block-function aliases are sloppy-only, and module top-level bindings are module-local, not cross-script-observable globals. Sloppy sources (scripts, .cjs) skip the analysis entirely — the existing option-off fast path: zero allocation, and per node only the one disarmed-hook boolean check — and behave exactly as main, byte-for-byte. Enabling sloppy sources, with the script-global pins and conservative Annex B handling they need, is a planned follow-up; every piece of it exists verified in this branch's history.

There is no standalone analysis walk. The analysis is collected during the traversals the minifier already runs: Normalize seeds it, every peephole pass re-collects, every flush propagates and swaps in the fresh set. The set consumed by a pass is always exactly one pass stale.

Three kinds of declarations are pinned — counted live no matter what the numbers say — because removing a dead cycle discards the references it held, so a reference count of zero does not mean unobservable afterwards: export-wrapped declarations (importers observe the binding), for-in/of heads (no removal site handles them), and using declarators (removal always bails). The one rewrite the collection cannot see — a bound reference minted behind the traversal cursor (the typeof rewrite is the only minter today) — is logged and force-rooted at the flush. In debug builds every flushed set is checked against a standalone ground-truth walk, so the whole test and conformance corpus doubles as a checker.

Per-pass freshness is the load-bearing choice, and the cheaper cadences were each built and falsified rather than assumed away. A one-shot variant — collect during Normalize, publish once, consume in the first pass — was fully implemented: byte-identical on the minsize fixtures at roughly half the overhead, but real npm packages expose cycles mid-loop through rewrites no collection-time analysis can anticipate. In js_of_ocaml-compiled bundles (flow-parser, prettier's flow plugins, @vue/server-renderer), dropping t0 && B0(...) once B0 is proven pure removes a cycle's last live read; under one-shot the cycle then survives this minify and falls on a re-minify, and monitor-oxc's idempotency gate fails on exactly those files. A record-time dead-branch filter and a two-shot cadence were also built and falsified. Only per-pass re-collection passes the gate.

Cost, measured with paired interleaved runs against main (wall time, includes parse and codegen): antd.js (6.7 MB script) +1.4% (+1.0ms) — the analysis never constructs for scripts and the residue is one boolean check per node, down from +2.4% when scripts were analyzed; vue.runtime.esm-browser (385 kB module) +1.5% (+0.2ms) and a rolldown-built Vue chunk (197 kB module) +2.0% (+0.2ms) — module files of rolldown's per-module size sit at the sub-millisecond noise floor.

Output is byte-identical on every fixture, and iteration counts do not change. The minsize corpus parses as sloppy script, so it is untouched by construction; the size win lands with the consumer PR's module-shaped inputs and, for scripts, with the follow-up.

Review map: the mechanism is symbol_liveness/mod.rs below the module doc (read the doc's three rules first — everything else is their application); validate.rs is the debug-only mirror, mechanical by design; the hook blocks in normalize.rs/peephole/mod.rs are identical twins. The one paragraph to scrutinize is the pin rationale in the module doc: "removing a dead cycle deletes the references it held, so counts lie afterward."

Implemented with AI assistance (Claude Code); design, review, and verification driven by the author per the repo AI-usage policy.