Can Source Code Predict Its Own Branch Predictability?

Modern CPUs predict the outcome of a conditional branch dynamically, from the branch's runtime history — a 1-bit predictor, hardened into a 2-bit saturating counter, generalised into a history-indexed table, and refined into TAGE's multiple geometric history lengths. This note asks a narrower, static question: does a branch's misprediction rate leave any trace in its source code, before the program ever runs? We build a 25-program C corpus deliberately spanning the predictability spectrum, measure ground-truth per-line misprediction rates with Valgrind's Cachegrind branch simulator, and extract structural features (nesting depth, condition complexity, operator type, array-reference and constant-comparison structure) from each branch's abstract syntax tree via pycparser. Across 101 labelled branches, a random-forest classifier does not reliably beat a majority-class baseline (0.70 ± 0.06 vs. 0.77 ± 0.02 five-fold cross-validated accuracy) and out-of-fold regression R² is negative (−0.296), but the out-of-fold Spearman rank correlation between predicted and true rates is small, positive, and significant (ρ = 0.251, p = 0.011) — static features carry some real, rankable signal, just not enough at this sample size to classify or regress confidently. In parallel, four from-scratch predictor simulators (1-bit, 2-bit, an 8-bit history table, and a simplified TAGE) are evaluated on seven synthetic outcome patterns and on a real, instrumented bubble-sort trace, reproducing — from first principles rather than by citation — the textbook result that history-aware prediction dominates history-free prediction on structured but non-random sequences (TAGE-lite: 4.7% misprediction vs. 33.9% for 1-bit on the real trace) while every predictor converges to the 50% hard limit on a true coin flip. Finally, a four-condition structural heuristic — an if statement, comparing against a constant, gating an array access, and skewed-but-not-deterministic (0.1–15% mispredicted) — correctly and exclusively isolates the corpus's two purpose-built Spectre-variant-1 (bounds-check-bypass) gadgets out of 101 candidate branches, with one reasonable adjacent flag and zero unrelated false positives. We report all results, including the null and weak ones, as an honest, reproducible proof of concept, and outline a concrete scaling path — IBM's Project CodeNet and CodeBERT embeddings — for testing whether the weak-but-real static signal strengthens with two orders of magnitude more data.