@asmlift/core 0.10.0 → 0.11.0

package/src/structure/switch-recover.ts

@@ -7,6 +7,7 @@
 import { constWord } from '../ir/bits';
 import { Block, Fn, Op, Value, forwardingTarget, isBodyless, successorsOf } from '../ir/core';
 import { orderSensitive } from '../ir/discipline';
+import { SWAPPED_ICMP } from '../ir/opcodes';
 import { Expr, Stmt, SwitchCase } from '../l3/ast';
 
 /** Which side of a relational test a compiler's dispatch lands a pinned case body on. */
@@ -83,6 +84,10 @@ export interface SwitchRecoverDeps {
  *                    l3/ast.ts non-neutrality note). With `breaks`, some paths out reach the
  *                    switch's merge instead: `case 1: if (c) break; case 2: …`, the arm's own
  *                    `break;` on those paths.
+ *   - `goto`         a `fallthrough` exit whose sibling another arm already falls into: the same
+ *                    paths, ending in `goto` to that sibling's case label (l3/ast.ts) instead of
+ *                    running on into it. Only `jumpSharedFallTargets` below makes one, and only
+ *                    Regime B asks it.
  *   - `unstructurable`  anything else: two different siblings, or a sibling beside a block the
  *                    switch does not dominate. C needs a `goto` for those. Regime A declines to
  *                    if-recovery on this verdict; Regime B, having no fallback, fails LOUD.
@@ -92,18 +97,38 @@ export interface SwitchRecoverDeps {
  *  path to the merge in the middle of the arm as `break;` (`switchBreakAt`), in a closed arm as in a
  *  falling one: `case 1: if (a) { if (b) break; g(1); } h(2); break;`. A closed arm that leaves
  *  sideways, into a block the switch does not dominate, has none: its paths through such a block
- *  are not the arm's, and it structures to the CFG's joins. */
+ *  are not the arm's, and it structures to the CFG's joins. It names those blocks instead
+ *  (`escapedTo`, the first block outside the region on each such path), which decide whether its
+ *  body can still be copied into the arms that fall into it (`copySharedFallTargets`). An arm that
+ *  took such a copy carries the SIBLING's `escapedTo`, not its own first outside block: the blocks
+ *  where the copy steps sideways, which is all the copies read of it. */
 export type ArmExit =
-  | { kind: 'break'; region?: ReadonlySet<Block> }
+  | { kind: 'break'; region?: ReadonlySet<Block>; escapedTo?: ReadonlySet<Block> }
   | { kind: 'fallthrough'; to: Block; breaks: boolean; region: ReadonlySet<Block> }
+  | { kind: 'goto'; to: Block; breaks: boolean; region: ReadonlySet<Block> }
   | { kind: 'unstructurable'; why: string };
 
 export interface SwitchRecovery {
-  recognizeSwitch: (b: Block, stop: Block | null) => Stmt[] | null;
+  /** `mergeAt`, given the tree's case and default blocks, may name the switch's end ahead of the
+   *  CFG's (structure.ts's join past early returns); `undefined` keeps `ipdom ?? stop`. */
+  recognizeSwitch: (
+    b: Block,
+    stop: Block | null,
+    mergeAt?: (arms: readonly Block[]) => Block | undefined,
+  ) => Stmt[] | null;
   /** shared with the Regime-B (`switch_br`) path in structure.ts. Both regimes recover the
    *  fall-through this returns; on an `unstructurable` verdict Regime A declines to if-recovery and
    *  Regime B, which has no fallback, fails loud. */
-  analyzeArmExit: (entry: Block, b: Block, merge: Block | null, siblings: Set<Block>, stopAtLoop?: boolean) => ArmExit;
+  analyzeArmExit: (
+    entry: Block,
+    b: Block,
+    merge: Block | null,
+    siblings: Set<Block>,
+    stopAtLoop?: boolean,
+    jumps?: ReadonlySet<Block>,
+  ) => ArmExit;
+  /** may the copies write out a sibling that leaves sideways into `s`? (`copySharedFallTargets`) */
+  forwardToMerge: (s: Block, b: Block, merge: Block | null, siblings: ReadonlySet<Block>) => boolean;
   /** a block's position in the ASSEMBLY — the arm-order evidence, shared with Regime B so the two
    *  regimes read it from one definition (and one statement of what it rests on). */
   layoutIndex: (blk: Block) => number;
@@ -180,18 +205,6 @@ const INT_MIN = -0x80000000;
 const INT_MAX = 0x7fffffff;
 const ALL: Ranges = [[INT_MIN, INT_MAX]];
 
-/** The same opcode with its operands swapped: `k < x` is `x > k`. */
-const MIRRORED: Record<string, string> = {
-  icmp_slt: 'icmp_sgt',
-  icmp_sgt: 'icmp_slt',
-  icmp_sle: 'icmp_sge',
-  icmp_sge: 'icmp_sle',
-  icmp_ult: 'icmp_ugt',
-  icmp_ugt: 'icmp_ult',
-  icmp_ule: 'icmp_uge',
-  icmp_uge: 'icmp_ule',
-};
-
 /** `[lo, hi]` of the UNSIGNED order as signed intervals: one, or two where it straddles 2^31. */
 function fromUnsigned(lo: number, hi: number): Ranges {
   if (lo > hi) {
@@ -236,7 +249,7 @@ function intersect(a: Ranges, b: Ranges): Ranges {
 
 /** The register values that take the test's BRANCH. */
 function takenBy(ti: TestInfo): Ranges {
-  const op = ti.xOnLeft ? ti.opcode : (MIRRORED[ti.opcode] ?? ti.opcode);
+  const op = ti.xOnLeft ? ti.opcode : (SWAPPED_ICMP[ti.opcode] ?? ti.opcode);
   if (op === 'icmp_eq' || op === 'icmp_ne') {
     const k = ti.k | 0;
     return op === 'icmp_eq' ? [[k, k]] : complement([[k, k]]);
@@ -276,6 +289,204 @@ function singleton(r: Ranges): number | null {
   return r.length === 1 && r[0][0] === r[0][1] ? r[0][0] : null;
 }
 
+/** TWO OR MORE ARMS ENTERING ONE SIBLING'S BODY, put back as copies of it. A compiler that
+ *  cross-jumps (agbcc's and gcc 2.7.2's `jump.c` cross-jumping, KMC's with it) finds two arms
+ *  ending in the same code as a sibling arm and keeps one copy, so `case 1: g(v); gOut = v;
+ *  break; case 2: gOut = v; break; case 3: h(v); gOut = v; break;` comes back with case 1 and
+ *  case 3 both entering case 2's `gOut = v`. C drops into an arm from above along one edge only,
+ *  so read as written that is two fall-throughs into one arm and `chainArms` refuses it — but the
+ *  source had one fall-through at most.
+ *
+ *  WHICH ENTRANT FALLS IS NOT IN THE ASM, so it is a ranked choice (`/tail-copies`,
+ *  rank-variations.ts), never a fixed default. The cross-jump keeps ONE copy of the tail and
+ *  says nothing about which arm the source wrote it under, and one compiler at one set of flags
+ *  answers both ways: KMC `-O2` and gcc 2.7.2 `-O1` lay arm bodies out in SOURCE order, and a
+ *  source whose fall-through arm is written directly above its target in case order recompiles
+ *  only with that arm falling, while one whose arms are written out of case order (`case 3`,
+ *  `case 2`, `case 1`) recompiles nearer with every entrant holding its own copy. Neither the
+ *  layout nor the case order decides it: the copy the cross-jump kept is not the source's
+ *  fall-through, so the arm that physically runs into the tail can be the wrong faller too.
+ *
+ *  - `faller` (the default): at most one entrant keeps its fall-through, the one the caller's
+ *    arm-order policy (`order`, before the chain moves anything) puts DIRECTLY ABOVE the sibling —
+ *    on `switchArmsFollowLayout` targets (agbcc) its layout neighbour, elsewhere the arm before it in
+ *    case order. Every other entrant copies; no entrant above it ⇒ every entrant copies.
+ *  - not `faller`: every entrant copies, whichever arm sits above the sibling.
+ *
+ *  Either way each copying entrant gets the sibling's region written out again under its own arm:
+ *  its exit becomes a closed `break` over the two regions.
+ *
+ *  A `default:` SIBLING takes the LAST arm of `order` as the arm above it: that is where `chainArms`
+ *  puts a default that an arm falls into, at the end. It is not always where the label is printed —
+ *  a target that prints `default:` at its layout position (`defaultLayoutPos`) can put it between two
+ *  cases, and then the arm the source wrote above it is not `order`'s last, and its entrants all copy
+ *  (a measured agbcc shape of that kind still recompiles to its target).
+ *
+ *  A `default:` SIBLING MAY BE CODE THE SOURCE WROTE AFTER THE SWITCH. Where the other arms
+ *  `return` from a void function they reach the same epilogue the default block does, so
+ *  post-dominance ends the switch there, and arms that `break` to the code after the switch read as
+ *  falling into the default block. The copies then write that code into each of them: the same
+ *  program, not the source's spelling (which would end the switch at the default block and spell
+ *  the other arms `return`, a reading nothing makes yet).
+ *
+ *  ONLY OVER A CLOSED SIBLING. The copy is the sibling's region walked again inside the entrant's
+ *  arm, so it is spelled only where that region ends the switch: the sibling's own exit a `break`
+ *  WITH a region — it reaches no sibling of its own and leaves through no block the switch does
+ *  not dominate. A sibling that falls on stays two-into-one for `chainArms` to refuse. PURE: the
+ *  closed exit is exactly what `analyzeArmExit` reads for the entrant once the sibling is no
+ *  longer a sibling — its walk reaches the sibling's blocks, and they reach the merge and nothing
+ *  else — so it is assembled here rather than walked again.
+ *
+ *  OR A SIBLING THAT LEAVES SIDEWAYS ONLY FORWARD. A closed sibling with no region stepped into
+ *  blocks the switch does not dominate (`escapedTo`). Its body is still the switch's end on every
+ *  path where each of those blocks runs only on to the merge or a `ret` — never back into the
+ *  dispatch, a sibling (the entrants among them) or round a cycle; a path out through the
+ *  enclosing loop's exit is one more path to a `ret`. `sidewaysEnds` answers that per block
+ *  (`forwardToMerge`, the caller's to hand in; absent, no such sibling is copied). Nothing in it is
+ *  particular to one compiler: it is asked of every jump table whose shared tail lost its region
+ *  because a block on the tail's way to the merge is also reached from outside the switch. Where it
+ *  shows:
+ *  - agbcc's gcse PRE puts the next switch's index in the dispatch block, which then no longer
+ *    dominates the default the bounds test reaches too, and the default's tail runs on through
+ *    blocks other arms cross-jumped into (`synthetic:jt_xjdefpre`, kleod EntityCreate);
+ *  - with no PRE at all (IDO 7.1 has no gcse), the tail runs on into a second jump table after the
+ *    switch that the other branch of an `if` around it reaches too, and from there to the switch's
+ *    end: in a `for` whose tail `continue`s (switch-arms.test.ts, the ido7.1 `jl_cont` fixture),
+ *    or where a `return` in the tail makes the epilogue the merge, and the copies then write that
+ *    whole second switch into each entrant.
+ *  Each copying entrant then has no region either: like every arm that leaves sideways, it
+ *  structures to the CFG's joins, which walks the sibling's blocks once inside it and stops at the
+ *  merge.
+ *
+ *  `onFallerKept` fires each time `faller` leaves an entrant its fall-through — exactly where the
+ *  two settings of `faller` return different exits. Where it never fires over a whole structuring,
+ *  the other setting builds the same tree, which is what rank.ts reads to skip `/tail-copies`.
+ *  `onCopied` fires with the sibling each time an entrant takes a copy of a CASE arm (not the
+ *  `default:` arm's), which is where `jumpSharedFallTargets` can read a `goto` instead: rank.ts's
+ *  witness for `/case-goto`, and the siblings that variation hands it. */
+export function copySharedFallTargets(
+  order: readonly Block[],
+  dflt: Block | null,
+  exitOf: ReadonlyMap<Block, ArmExit>,
+  faller: boolean,
+  onFallerKept?: () => void,
+  sidewaysEnds?: (s: Block) => boolean,
+  onCopied?: (to: Block) => void,
+): Map<Block, ArmExit> {
+  const out = new Map(exitOf);
+  for (const { to, movers } of sharedFallTargets(order, dflt, exitOf, faller)) {
+    const own = exitOf.get(to);
+    if (own?.kind !== 'break') {
+      continue;
+    }
+    const { region, escapedTo } = own;
+    if (
+      region === undefined &&
+      (escapedTo === undefined || sidewaysEnds === undefined || ![...escapedTo].every(sidewaysEnds))
+    ) {
+      continue;
+    }
+    for (const [e, x] of movers(onFallerKept)) {
+      if (to !== dflt) {
+        onCopied?.(to);
+      }
+      out.set(
+        e,
+        region === undefined
+          ? { kind: 'break', escapedTo: escapedTo! }
+          : { kind: 'break', region: new Set([...x.region, ...region]) },
+      );
+    }
+  }
+  return out;
+}
+
+/** TWO OR MORE ARMS ENTERING ONE SIBLING'S BODY, put back as one fall-through and `goto`s to the
+ *  sibling's case label — where the copies above do not take them (they are read first, and this
+ *  is read over what they leave). It is the source's own spelling of the shape: `case 1: if (c)
+ *  continue; goto L; case 2: if (d) continue; goto L; case 3: case 4: L: …` (kleod sub_0800D188's
+ *  `goto block_1643;`), which every compiler that does not cross-jump a copy into it compiles with
+ *  the sibling's code once. Unlike the copies it needs nothing of the sibling: the sibling's own exit
+ *  is read for itself and may fall on, break, or leave sideways, since the jump does not write it
+ *  out again.
+ *
+ *  WHO FALLS is read from the one place the copies ask it too (`sharedFallTargets`), but with no
+ *  choice in it: the entrant the caller's arm-order policy puts directly above the sibling always
+ *  keeps its fall-through, and every other entrant jumps. A `goto` from that arm would land on the
+ *  label directly below it, a path its plain fall-through already spells, so it is a jump goto-free
+ *  C does not need (asmlift-101 §2.7). `/tail-copies`' setting of `faller` asks which entrant the
+ *  SOURCE wrote the body under, a question a jump does not have: it writes no body.
+ *
+ *  ONLY INTO A CASE ARM: the sibling is in `order`, never `dflt`, since only a case arm carries a
+ *  label (l3/ast.ts `SwitchCase.label`) — and, given `only`, only into those siblings (`/case-goto`
+ *  hands it the case arms the copies wrote back).
+ *
+ *  WHAT MAKES THE JUMP THE SAME PROGRAM is the exit it replaces. A `goto` exit is a `fallthrough`
+ *  exit with its last edge spelled as a jump: the arm is structured to stop at the sibling's entry
+ *  exactly as a falling arm is (structure.ts `structureArm`), so every path that leaves the arm's
+ *  body at its end is a path into the sibling, with the edge's own copies already run, and the
+ *  `goto` is the arm's last top-level statement. The jump lands right after the sibling's case
+ *  labels, which is where a fall-through lands; the emission refuses a sibling that opens with
+ *  switch-edge copies, as it does for a fall-through: entering it by its own case value runs those,
+ *  and the jump, landing above them, would run them again. No loop stands between the jump and the
+ *  label: both are the switch's, in the loop the switch is in. */
+export function jumpSharedFallTargets(
+  order: readonly Block[],
+  dflt: Block | null,
+  exitOf: ReadonlyMap<Block, ArmExit>,
+  only?: ReadonlySet<Block>,
+): Map<Block, ArmExit> {
+  const out = new Map(exitOf);
+  for (const { to, movers } of sharedFallTargets(order, dflt, exitOf, true)) {
+    if (to === dflt || !order.includes(to) || (only !== undefined && !only.has(to))) {
+      continue;
+    }
+    for (const [e, x] of movers()) {
+      out.set(e, { kind: 'goto', to, breaks: x.breaks, region: x.region });
+    }
+  }
+  return out;
+}
+
+type Entrant = [Block, Extract<ArmExit, { kind: 'fallthrough' }>];
+
+/** WHO FALLS, the one answer both rewrites above read: each arm two or more arms fall into (`to`,
+ *  in the order its first entrant comes in `order` and then `dflt`), and `movers` — its entrants
+ *  other than the one that keeps its fall-through, with their exits, which each rewrite spells its
+ *  own way (a copy, a jump). The keeper is the arm the caller's arm-order policy puts directly
+ *  above `to`, where `faller` is set (`dflt` sits below the last of `order`); `movers` fires
+ *  `onFallerKept` when that arm is an entrant, which is where the two settings of `faller` differ.
+ *  It fires on the call, so a rewrite that refuses `to` before asking reports nothing. */
+function sharedFallTargets(
+  order: readonly Block[],
+  dflt: Block | null,
+  exitOf: ReadonlyMap<Block, ArmExit>,
+  faller: boolean,
+): { to: Block; movers: (onFallerKept?: () => void) => Entrant[] }[] {
+  const entrants = new Map<Block, Entrant[]>();
+  for (const e of [...order, ...(dflt ? [dflt] : [])]) {
+    const x = exitOf.get(e);
+    if (x?.kind === 'fallthrough') {
+      entrants.set(x.to, [...(entrants.get(x.to) ?? []), [e, x]]);
+    }
+  }
+  return [...entrants]
+    .filter(([, from]) => from.length >= 2)
+    .map(([to, from]) => {
+      const at = to === dflt ? order.length : order.indexOf(to);
+      const above = faller && at > 0 ? order[at - 1] : undefined;
+      return {
+        to,
+        movers: (onFallerKept?: () => void) => {
+          if (above !== undefined && from.some(([e]) => e === above)) {
+            onFallerKept?.();
+          }
+          return from.filter(([e]) => e !== above);
+        },
+      };
+    });
+}
+
 /** Re-thread `order` so every FALLING arm sits directly above the arm it falls into. Each
  *  fall-through chain is emitted contiguously and takes the position of its HEAD in `order`,
  *  which is the caller's own arm-order policy — so with no fall-through every chain is a
@@ -357,8 +568,12 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
   //     the list for every conditional-return branch, wherever in the stream that branch sits. So
   //     its real blocks keep address order among themselves, and each synthetic one — a bare
   //     return, never a test — sorts after all of them;
-  //   - raising only ever REMOVES blocks from the list (raise/{divpow2,latch,retsink,shortcircuit}
-  //     .ts all `filter`), never inserts or reorders, so the frontend's order is what survives.
+  //   - raising mostly REMOVES blocks from the list (raise/{divpow2,latch,retsink,shortcircuit}.ts
+  //     all `filter`), but not only: raise/reroll.ts moves a rerolled loop's new head ahead of the
+  //     old one and inserts a block of its own before it. So this order is the frontend's only
+  //     where no reroll fired. A reader that needs the asm's own order wherever a pass rewrote the
+  //     list reads the frontend's record instead (ir/core.ts `AsmLayout`, which the return-tail
+  //     chooser reads); this one has not been moved onto it.
   // TWO READERS, both target-gated, and they need DIFFERENT strengths of the compiler half:
   //   - `switchArmsFollowLayout` (arm ORDER, the sort below) needs the full claim — no block moved
   //     at all — because it PLACES the arms from the layout;
@@ -619,6 +834,74 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     return true;
   };
 
+  // A SIDEWAYS PATH THAT ONLY RETURNS. An arm can step into a block the switch does not dominate
+  // and still go nowhere but the end of the function: every path from `s` runs forward to a `ret`,
+  // never back into the switch, its merge or a sibling, and never round a cycle. Such an arm spells
+  // the escaping path in place as its `return;` (`case 0: if (c) { k(a); return; } gOut = 1;`
+  // falling into `case 1:`), and a falling arm's join already reads that path as a jump
+  // (`regionJoins`, "a `return k` through a shared epilogue"). It is a property of the ARM, not of
+  // any loop, so it is asked of every jump-table switch (Regime B; `analyzeArmExit` says why not of
+  // Regime A's comparison trees). Where it shows:
+  // - in a loop body, where an arm `return`s into the one epilogue past the loop (agbcc and IDO
+  //   when the code after the loop returns early too, mwcc always) and the switch ends at the
+  //   body's own join (structure.ts, THE LOOP CLAMP);
+  // - outside any loop, where an arm `goto`s a returning tail it shares with code the switch does
+  //   not dominate: a guard above the switch cross-jumped into the same `k(7); return;`, a shared
+  //   `out:` label, the other branch of an `if` around the switch, or a switch with no merge.
+  // The cycle test is a walk of the paths themselves: a block met again while it is still on the
+  // path being walked is a cycle, reducible or not (an IDO `goto mid;` into a `while` body makes an
+  // irreducible one, which a dominance test does not see). An edge to a block that dominates its
+  // source is refused too, since that block may lie above `s` where the walk never put it.
+  //
+  // WITH `mergeEnds` it is the copies' question (`forwardToMerge`): a path may also END at the
+  // merge, and nothing more is admitted. A path out through the enclosing loop's exit is one more
+  // forward path to a `ret`, wherever it falls on the path: the copy writes the code past the loop
+  // and its `return;` inside the case arm. A step round the loop to its header needs no test of its
+  // own: the header dominates every block of the loop, so the dominance test refuses it from inside,
+  // and the cycle test from a path that entered at the header.
+  //
+  // There the SIBLING and CYCLE refusals are conservative, not needed for soundness: forced off, a
+  // tail that steps into a sibling (agbcc, the `jt_xjdefpre` shape with `if (v == 9) return;` in the
+  // tail, so the epilogue is the merge and the empty `case 4:` is a sibling) or round a cycle lifts
+  // correct, that sibling's body or the loop written out in each entrant. They spare that
+  // duplication; dropping one needs a differential over the shapes it then admits.
+  const onlyReturns = (
+    s: Block,
+    b: Block,
+    merge: Block | null,
+    siblings: ReadonlySet<Block>,
+    mergeEnds = false,
+  ): boolean => {
+    const done = new Set<Block>();
+    const onPath = new Set<Block>([s]);
+    const stack: { x: Block; next: number }[] = [{ x: s, next: 0 }];
+    while (stack.length) {
+      const top = stack[stack.length - 1];
+      const succ = successorsOf(top.x);
+      if (top.next === 0 && succ.length === 0 && top.x.ops[top.x.ops.length - 1]?.opcode !== 'ret') {
+        return false;
+      }
+      if (top.next === succ.length) {
+        stack.pop();
+        onPath.delete(top.x);
+        done.add(top.x);
+        continue;
+      }
+      const y = succ[top.next++];
+      if (mergeEnds && y === merge && merge !== null) {
+        continue; // a path that reaches the switch's end
+      }
+      if (y === b || y === merge || siblings.has(y) || onPath.has(y) || dom.get(top.x)!.has(y)) {
+        return false; // back into the switch, or a cycle
+      }
+      if (!done.has(y)) {
+        onPath.add(y);
+        stack.push({ x: y, next: 0 });
+      }
+    }
+    return true;
+  };
+
   // Where does one arm's region LEAVE? Walk it from `entry`, never stepping THROUGH the merge or a
   // sibling arm's entry, and classify what it steps INTO. `siblings` is every OTHER arm entry the
   // caller can emit a `case`/`default` label for — the merge is deliberately not among them, so a
@@ -649,19 +932,27 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
   // under this arm. That is duplication, not a wrong dispatch — the same duplication the structurer
   // already does for any tail two arms share, and how the case bodies agbcc tail-merged are put
   // back. Costly for matching, correct to run.
+  //
+  // `jumps` are blocks an edge into which is a jump that ends its path where it sits, whatever the
+  // switch: the latch of a loop spelled `for`, which the structurer writes as `continue;`. Such an
+  // edge is neither a fall into a sibling nor an escape, and an arm that IS one is a bare jump.
   const analyzeArmExit = (
     entry: Block,
     b: Block,
     merge: Block | null,
     siblings: Set<Block>,
     stopAtLoop = false,
+    jumps: ReadonlySet<Block> = new Set(),
   ): ArmExit => {
     if (entry === merge) {
       return { kind: 'break' }; // an empty arm (a table slot pointing straight at the switch's end)
     }
+    if (jumps.has(entry)) {
+      return { kind: 'break', region: new Set([entry]) };
+    }
     const into = new Set<Block>(); // sibling entries this arm flows into
+    const escapedTo = new Set<Block>(); // the blocks outside the switch's region it steps into
     let toMerge = false,
-      escapes = false,
       leavesLoop = false;
     const seen = new Set<Block>([entry]);
     const q = [entry];
@@ -671,11 +962,13 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
       for (const s of successorsOf(cur)) {
         if (s === merge) {
           toMerge = true;
+        } else if (jumps.has(s)) {
+          continue;
         } else if (s !== entry && siblings.has(s)) {
           into.add(s);
         } else if (s !== entry && !seen.has(s)) {
           if (!dom.get(s)!.has(b)) {
-            escapes = true;
+            escapedTo.add(s);
             continue;
           }
           seen.add(s);
@@ -684,7 +977,7 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
       }
     }
     if (into.size === 0) {
-      return escapes ? { kind: 'break' } : { kind: 'break', region: seen };
+      return escapedTo.size > 0 ? { kind: 'break', escapedTo } : { kind: 'break', region: seen };
     }
     // A path to the merge beside the fall-through is the arm's own `break;` — switch-scoped, so it
     // spells only where nothing breakable sits between that edge and the arm, which the structurer
@@ -695,7 +988,17 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
         why: `a case body falls into sibling case ${[...into].map((x) => `#${layoutIndex(x)}`).join(', ')}, reaches the end of the switch, and leaves the loop the switch sits in`,
       };
     }
-    if (into.size === 1 && !escapes) {
+    // A sideways path that only RETURNS does not stop the fall-through (`onlyReturns`): it is a
+    // jump that ends where it sits, as a `ret` inside the arm is. Regime B only. Regime A
+    // (`stopAtLoop`) commits to its `switch` on gates that read an arm's `breaks` alone, and has
+    // if-recovery to fall back on, so a falling arm beside an escape stays `unstructurable` there:
+    // admitted, it commits Regime A to switches whose emission then refuses the whole function (an
+    // escape to a `goto out` past a loop exit, or out of a nested switch) where if-recovery spells
+    // them.
+    if (
+      into.size === 1 &&
+      (escapedTo.size === 0 || (!stopAtLoop && [...escapedTo].every((s) => onlyReturns(s, b, merge, siblings))))
+    ) {
       return { kind: 'fallthrough', to: [...into][0], breaks: toMerge, region: seen };
     }
     // Name what is actually missing. These are two different facts: the first is a shape C's
@@ -713,7 +1016,11 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     };
   };
 
-  const recognizeSwitch = (b: Block, stop: Block | null): Stmt[] | null => {
+  const recognizeSwitch = (
+    b: Block,
+    stop: Block | null,
+    mergeAt?: (arms: readonly Block[]) => Block | undefined,
+  ): Stmt[] | null => {
     const root = testInfo(b);
     if (!root) {
       return null;
@@ -937,8 +1244,8 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     // a sibling beside a block the switch does not dominate — and Regime A declines to if-recovery,
     // which spells every one of those edges. (Regime B reads the same verdicts and fails LOUD on
     // either.)
-    const merge = ipdom.get(b) ?? stop;
     const targets = new Set<Block>([...caseBlocks, ...(defaultBlk ? [defaultBlk] : [])]);
+    const merge = mergeAt?.([...targets]) ?? ipdom.get(b) ?? stop;
     const siblings = new Set([...targets].filter((t) => t !== merge));
     const exitOf = new Map<Block, ArmExit>();
     for (const t of siblings) {
@@ -1150,6 +1457,13 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     // The `default:` arm is a chain member too — an arm may run on into it, and C prints it last.
     const dfltArm = defaultBlk !== null && defaultBlk !== merge ? defaultBlk : null;
     const preChain = [...armsByBlock.keys()];
+    // NO COPIES HERE. Arms a cross-jump sent into one sibling's body do not linearize, and Regime
+    // B reads them back as copies (structure.ts, THE COPIES) because its only alternative is a loud
+    // failure. Regime A's alternative is if-recovery, which LIFTS: a copy reading here would replace
+    // one lift with another, the choice between two legal spellings of one CFG that only a ranked
+    // variation may make (docs/level-tower.md). On comparison trees agbcc and KMC cross-jumped,
+    // the switch spelling measured nearer the target on some and further on others, and no corpus
+    // row reaches this point, so the refusal stands and if-recovery answers.
     const entries = chainArms(preChain, dfltArm, exitOf);
     if (entries === null) {
       return null;
@@ -1279,7 +1593,12 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     }
     return out;
   };
-  return { recognizeSwitch, analyzeArmExit, layoutIndex, defaultLayoutPos, chainArms };
+  /** `copySharedFallTargets`' `sidewaysEnds`: does every path from `s`, a block outside the
+   *  switch's region, run only forward to `merge` or a `ret` (`onlyReturns` with the merge as an
+   *  end)? */
+  const forwardToMerge = (s: Block, b: Block, merge: Block | null, siblings: ReadonlySet<Block>): boolean =>
+    merge !== null && onlyReturns(s, b, merge, siblings, true);
+  return { recognizeSwitch, analyzeArmExit, forwardToMerge, layoutIndex, defaultLayoutPos, chainArms };
 }
 
 /** Internal surface for this module's own tests, and for nothing else: PRE3 reads each test

package/src/structure/unfolded-branch-constant.ts

@@ -0,0 +1,90 @@
+// AN EARLY RETURN THAT THE JOIN PAST EARLY RETURNS CANNOT SPELL: a return of the value its branch
+// tested equal to a constant, where the object still returns the value and not the constant.
+//
+// On a compiler whose cse folds a branch-proven constant only into the branch's FALL-THROUGH arm
+// (target.ts `foldsBranchConstantOnTakenEdge` false: gcc 2.x at -O1), `if (x == 0) return x;`
+// compiles to `return 0`, and so does the same test spelled `if (x != 0) ; else return x;`. The join
+// writes the early return one of those two ways. A return of `x` the object left unfolded was
+// therefore the jump-target arm of its branch in the source: the `else` of `if (x != 0) { ...tail }
+// else { return x; }`, which is the copies' spelling. So this mark publishes the copies.
+//
+// THE CONSTANT IS NOT REMATERIALISED ON THE EDGE. Read off the lifted IR: the return block's value
+// is the very SSA value the comparison reads, not a constant. A delay slot that set the return
+// register to the constant (`beqz v0,L; move v0,zero`) lifts as a `const` returned on that edge, and
+// is no mark.
+//
+// MEASURED on the probe pair `corpus/probe-rettail-pg-{copies,join}.c` (unfolded-branch-constant.test.ts)
+// and on Mario Party 3's `func_8010BD28_472F98_mgmode`, which it is the shape of: gcc2.7.2 -O1, the
+// copies `nop` in the `beqz`'s slot and the join `move v0,zero`. There the join loses the copies'
+// match (0 -> 1 line off, really compiled, 2026-11-06).
+//
+// AN `if` SITE ONLY. The premise is an `if`'s two arms, one of them the fall-through. A switch's case
+// arms, read as a switch (`tree`) or a jump table (`switch`), are each a jump target, a case label,
+// so no return in one folds the switch value at -O1 whatever the source wrote, and an unfolded one
+// says nothing. Compiled at gcc2.7.2 -O1: `switch (x) { case 0: return x; case 5: p[1] = 2; break; }`
+// followed by its tail, written with the join, keeps `move v0,a0` in the case-0 jump's slot, and
+// the join and the copies both compile byte-exact. A switch the structurer reads as `if`s (three
+// cases of that function) is still read, the residue of the rule: no reading of it is exact.
+//
+// A MARK IS EVIDENCE, NOT PROOF, as structure/cross-jumped-tail.ts says of its own: it moves which
+// verified reading is the default, never what is lifted. Read only where the target says its cse
+// leaves the taken edge unfolded; elsewhere (`true`, or absent) an unfolded return says nothing.
+import type { Block, Fn, Op, Value } from '../ir/core';
+import type { JoinPastReturnsSite } from './structure';
+
+const succsOf = (b: Block): Block[] => [...new Set(b.ops[b.ops.length - 1]?.successors.map((s) => s.block) ?? [])];
+
+/** Does an early return of the `if` site `site` give back, unfolded, the value its own branch tested
+ *  equal to a constant? The return block holds only its `ret`, has one predecessor, and that
+ *  predecessor's `cond_br` takes it on the equal side of an `icmp_eq`/`icmp_ne` of that value against
+ *  a `const`. */
+export function unfoldedBranchConstant(fn: Fn, site: JoinPastReturnsSite): boolean {
+  if (site.kind !== 'if') {
+    return false;
+  }
+  const def = new Map<Value, Op>();
+  const preds = new Map<Block, Block[]>(fn.blocks.map((b) => [b, []]));
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      for (const r of op.results) {
+        def.set(r, op);
+      }
+    }
+    for (const s of succsOf(b)) {
+      preds.get(s)?.push(b);
+    }
+  }
+  const seen = new Set<Block>();
+  const stack = [site.branch];
+  while (stack.length) {
+    const x = stack.pop()!;
+    if (x === site.join || seen.has(x)) {
+      continue;
+    }
+    seen.add(x);
+    stack.push(...succsOf(x));
+  }
+  for (const r of seen) {
+    const ret = r.ops.length === 1 ? r.ops[0] : undefined;
+    const value = ret?.opcode === 'ret' && ret.operands.length === 1 ? ret.operands[0] : undefined;
+    const from = preds.get(r) ?? [];
+    if (value === undefined || from.length !== 1 || fn.asmLayout?.get(r) === undefined) {
+      continue;
+    }
+    const br = from[0].ops[from[0].ops.length - 1];
+    const cmp = br?.opcode === 'cond_br' ? def.get(br.operands[0]) : undefined;
+    if (cmp === undefined || br.successors.length !== 2 || br.successors[0].block === br.successors[1].block) {
+      continue;
+    }
+    const equalSide = cmp.opcode === 'icmp_eq' ? 0 : cmp.opcode === 'icmp_ne' ? 1 : -1;
+    if (equalSide < 0 || br.successors[equalSide].block !== r || cmp.operands.length !== 2) {
+      continue;
+    }
+    const [a, b] = cmp.operands;
+    const isConst = (v: Value) => def.get(v)?.opcode === 'const';
+    if ((a === value && isConst(b)) || (b === value && isConst(a))) {
+      return true;
+    }
+  }
+  return false;
+}