@asmlift/core 0.3.0 → 0.5.0

package/src/structure/structure.ts

@@ -36,9 +36,11 @@
 // code): multi-latch headers, irreducible/overlapping loops, conditional `continue`, a `break`
 // whose exit copies would clobber, switch fall-through, and mixed-entry self-loops (a guarded
 // header also entered by a plain br).
+import { type GlobalCell, globalCellOf, mayWriteGlobal } from '../ir/alias';
 import { Block, Fn, Op, Value, defOpMap, successorsOf } from '../ir/core';
+import { EFFECTFUL_OPS } from '../ir/opcodes';
 import { type IrType, T, scalarTypeForAccess, typeEquals } from '../ir/types';
-import { BinOp, Expr, SFn, Stmt, SwitchCase, exprChildren, mapExprChildren } from '../l3/ast';
+import { BinOp, Expr, SFn, Stmt, SwitchCase, exprChildren, gapReasonFor, mapExprChildren, negateCond } from '../l3/ast';
 import { exprCType, ptrElemBytes } from '../l3/typing';
 import { returnType } from '../raise/recover';
 import { collectStructs } from '../raise/structs';
@@ -46,9 +48,13 @@ import {
   type DeclaredField,
   type SymbolInfo,
   type SymbolStructField,
+  arrayInnerExtents,
   declaredFields,
   isArrayField,
+  isBitfieldField,
+  isScalarCellSize,
   pointeeFields,
+  scalarCellType,
 } from '../symbols';
 import { analyze } from './analysis';
 import { makeLoopHazards, updateWriteSet } from './hazards';
@@ -108,6 +114,32 @@ function globalOf(e: Expr, width: number): { name: string; idx: Expr } | null {
   return null;
 }
 
+// THE one gate on the BARE-NAME array-global spelling (`gSym[i]` rather than `((T *)&gSym)[i]`),
+// shared by the constant-offset and variable-index access paths so the two cannot disagree.
+// Returns the `index` node's `lead` fragment when the bare form is spellable, or null to fall
+// through to the always-valid `&gSym` cast form.
+//
+// Two facts are required, not one. The element WIDTH must match, as it always has. And the RANK
+// must be SPELLABLE, because one subscript reaches an element only on a rank-1 array: on `u16
+// g[4][0x400]`, `g[i]` is a ROW. Against the project's own header that is usually a type error,
+// but where the row address flows into an integer context it is merely a warning and the emitted C
+// then addresses a different object than the asm did — silently.
+//
+// A rank > 1 pins the leading dimensions at 0 and puts the whole flat element index in the last
+// subscript (`g[0][i]`) — the same address arithmetic, and the idiom decomp sources themselves use
+// when the split is not observable in the asm either (`gBgTilemapBufs[0][…]` in kleod,
+// `gNatureStatTable[nature][…]` in pokeemerald). A rank the map states but cannot spell (an unknown
+// inner extent) gets no bare form at all; `((T *)&gSym)[i]` is byte-identical and valid under ANY
+// declaration, which is why it is the safe fallback. See symbols.ts arrayInnerExtents for why an
+// ABSENT rank is read as 1 rather than as unknown.
+function bareArrayLead(si: SymbolInfo, width: number): { lead?: number[] } | null {
+  if (si.shape !== 'array' || si.elemSize !== width) {
+    return null;
+  }
+  const inner = arrayInnerExtents(si);
+  return inner === null ? null : inner.length === 0 ? {} : { lead: new Array<number>(inner.length).fill(0) };
+}
+
 // A BYTE residual read as an ELEMENT index of `elemSize`-wide elements, or null when it is not one
 // — the residual then addresses mid-element and no whole-element spelling can express it, so the
 // caller falls through to the honest cast forms. THE one copy of the rule, indexing the
@@ -305,8 +337,10 @@ function pointeeAccess(
   // Constant offset: the member must match EXACTLY — offset, read width, and the SPELLED type
   // (spellsAccessType). An ARRAY member is excluded whatever its size: `u8 x[1]` would match a
   // byte access by (offset, size) and spell `->x`, which is not an lvalue of that width at all.
+  // A BITFIELD member likewise: its `size` is the byte span its bits touch, so a 7-bit field
+  // would match a plain u16 read and spell a 7-bit lvalue for a 16-bit access.
   const p = spellablePointee(pg.name, sym);
-  const f = p?.fields.find((m) => m.offset === total && m.size === width && !isArrayField(m));
+  const f = p?.fields.find((m) => m.offset === total && m.size === width && !isArrayField(m) && !isBitfieldField(m));
   return p && f && spellsAccessType(f.signed, width, signed) && memberQualsAllow(f, p.const, isStore)
     ? { k: 'field', base: { k: 'var', name: pg.name }, name: f.name }
     : null;
@@ -363,8 +397,12 @@ function memAccess(
       // declaration on: a layout it declines whole is a layout with no nameable members, and a
       // union alias it drops for the first view at that offset is a name no declaration carries.
       // An ARRAY member is excluded for the same reason as in pointeeAccess: `u8 x[1]` would match
-      // a byte access by (offset, size) and spell `.x`, which is not an lvalue of that width.
-      const fld = declaredFields(si.layout)?.find((f) => f.offset === gb.byte && f.size === width && !isArrayField(f));
+      // a byte access by (offset, size) and spell `.x`, which is not an lvalue of that width. A
+      // BITFIELD member likewise — a plain read of its bytes is not a read of its bits (the named
+      // bitfield spelling has its own recognizer, on the extract shape: see lowerDef).
+      const fld = declaredFields(si.layout)?.find(
+        (f) => f.offset === gb.byte && f.size === width && !isArrayField(f) && !isBitfieldField(f),
+      );
       if (fld && memberQualsAllow(fld, si.const, isStore)) {
         return { k: 'field', base: { k: 'var', name: gb.name }, name: fld.name, dot: true };
       }
@@ -402,9 +440,10 @@ function memAccess(
     // dogfood proved agbcc needs for ROM tables — with the element type registered in the env
     // so the stride check passes and no cast is added. Element-width match only.
     const siArr = sym?.info(g.name);
-    if (siArr?.shape === 'array' && siArr.elemSize === width) {
-      sym!.noteGlobal(g.name, T.ptr(T.int(width * 8, siArr.elemSigned ?? false)));
-      return { k: 'index', base: { k: 'var', name: g.name }, idx, width, signed };
+    const lead = siArr === undefined ? null : bareArrayLead(siArr, width);
+    if (lead !== null) {
+      sym!.noteGlobal(g.name, T.ptr(T.int(width * 8, siArr!.elemSigned ?? false)));
+      return { k: 'index', base: { k: 'var', name: g.name }, idx, width, signed, ...lead };
     }
     return { k: 'index', base: { k: 'addr', name: g.name }, idx, width, signed };
   }
@@ -447,9 +486,10 @@ function arrayAccess(
   if (baseExpr.k === 'addr' && fieldOff === undefined) {
     // ARRAY-declared global (symbol map): the bare-name spelling, same rule as memAccess.
     const si = sym?.info(baseExpr.name);
-    if (si?.shape === 'array' && si.elemSize === elemSize) {
-      sym!.noteGlobal(baseExpr.name, T.ptr(T.int(elemSize * 8, si.elemSigned ?? false)));
-      return { k: 'index', base: { k: 'var', name: baseExpr.name }, idx: idxExpr, width: elemSize, signed };
+    const lead = si === undefined ? null : bareArrayLead(si, elemSize);
+    if (lead !== null) {
+      sym!.noteGlobal(baseExpr.name, T.ptr(T.int(elemSize * 8, si!.elemSigned ?? false)));
+      return { k: 'index', base: { k: 'var', name: baseExpr.name }, idx: idxExpr, width: elemSize, signed, ...lead };
     }
     return { k: 'index', base: baseExpr, idx: idxExpr, width: elemSize, signed };
   }
@@ -520,12 +560,11 @@ const ARITH_TO_BIN: Record<string, BinOp> = {
   and: '&',
   xor: '^',
   shl: '<<',
-  shr_u: '>>',
+  shr_u: '>>>', // the LOGICAL right shift; the C backend spells it `>>` over an unsigned operand
   shr_s: '>>',
   logic_and: '&&',
   logic_or: '||', // short-circuit connectives (raise/shortcircuit.ts)
 };
-const NEGATE: Record<string, BinOp> = { '<': '>=', '>=': '<', '>': '<=', '<=': '>', '==': '!=', '!=': '==' };
 
 // Recovered info for a self-loop header: its exit block and the per-parameter back-edge
 // arg it feeds (the value on the header→header edge). The back-edge arg is the "next"
@@ -548,6 +587,13 @@ interface WhileLoopInfo {
   body: Set<Block>; // the pure natural-loop body (for in-body vs exit classification)
 }
 
+// Opcodes whose NUMBER OF EXECUTIONS is observable. Moving one of these out of a loop changes what
+// the program does — a call that ran per iteration would run once. A `load`/`aload` is deliberately
+// NOT here: it is a pure read, so running it once instead of per-iteration is unobservable as long
+// as it reads the same memory, which is exactly what the existing def→render barrier scan
+// (structure/analysis.ts) already proves before it lets one inline at all.
+const REPEATED_EFFECT = new Set(['call', 'opaque']);
+
 // A bottom-tested `do { body } while(cond)`. The header is the body entry (entered before any
 // test); the LATCH holds the loop condition and the single exit. Body = header..latch structured, then
 // the latch's own ops + the loop-update; the latch test is the do-while condition. The condition is
@@ -577,6 +623,26 @@ export interface StructureOptions {
   // body). GCC freely uses `!=`; IDO prefers `==`/`<`. A per-compiler DATA lever, not an `arch ==`
   // branch — default true (permissive; the decline path keeps it sound either way).
   switchAllowsNeqCase?: boolean;
+  // Anchor a constant merge copy at its const op's ORIGINAL position instead of at the CFG edge:
+  // `movs r9, #0` at entry ahead of a single-armed overwrite emits as a pre-initialization above
+  // the `if`, not as its else-arm. A differ-refereed candidate axis (rank.ts `/defsite`), never a
+  // default — see the refusal conditions where it is computed.
+  anchorConstCopies?: boolean;
+  // HARDWARE fact from TargetDescription.capabilities.endianness, threaded by structureOptionsFor:
+  // the bitfield extract recognizer solves an LSB-first equation, so it only runs on little-endian
+  // data. The provider already refuses to EMIT bitfield facts for a big-endian ELF; this is the
+  // same boundary enforced on core's side, against a hand-built map that never went through it.
+  littleEndian?: boolean;
+  // Spell `(x << a) >> b` extracts of a struct global as the map's named bitfield member. On by
+  // default; rank.ts enumerates the OFF spelling as the `/no-bitfield` axis, because the named
+  // read recompiles at the DECLARATION's access width — where that diverges from the asm's load
+  // width the honest shift spelling is the one that matches, and the differ referees.
+  spellBitfieldMembers?: boolean;
+  // Let a read of a named global render at its use across writes that PROVABLY cannot reach it
+  // (a store to a different named global), instead of caching it in a local. Off by default;
+  // rank.ts enumerates the ON spelling as the `/reread-globals` axis — see analysis.ts
+  // AnalyzeOptions for why this is a differ-refereed lever and not a fix.
+  rereadGlobals?: boolean;
   // How an unresolvable VALUE degrades (a live `opaque`, an unlowered transient op, a dropped def):
   //   "strict"   (default) — the `"?"` sentinel, tripping assertResolved at the boundary (loud in
   //              the PROCESS);
@@ -597,6 +663,10 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     preserveDivergentBranchSense = true,
     orderArgCopiesByComputation = true,
     switchAllowsNeqCase = true,
+    anchorConstCopies = false,
+    littleEndian = true,
+    spellBitfieldMembers = true,
+    rereadGlobals = false,
     onGap = 'strict',
     symbols,
   } = opts;
@@ -606,7 +676,19 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   const dom = dominators(fn);
 
   // ── analysis phase (structure/analysis.ts): use registry, liveness, materialization ──
-  const { useSitesOf, opIndex, opBlock, liveIn, materialize, reachFrom } = analyze(fn, returnsVoid);
+  const { useSitesOf, opIndex, opBlock, liveIn, materialize, reachFrom, emitPos, memWriteBetween } = analyze(
+    fn,
+    returnsVoid,
+    {
+      defs,
+      rereadGlobals,
+      // the map's own declaration truth: a volatile object's read may not be duplicated or moved
+      volatileGlobal: (n) => {
+        const si = symbols?.get(n);
+        return si?.volatile === true || (si?.layout ?? []).some((f) => f.volatile === true);
+      },
+    },
+  );
 
   // SCALAR-vs-AGGREGATE globals: a `gaddr` symbol accessed EXCLUSIVELY at offset 0 is a scalar
   // global → the bare name `gSym` (byte-exact, matches the source). A symbol accessed at any
@@ -618,13 +700,68 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   // widths is a union/type-pun, which the downstream struct-layout recovery rejects LOUD
   // ("overlapping fields ... unions not modelled") before this classification is consumed — so a
   // width collision at off-0 declines honestly rather than reaching a wrong bare-`gSym` emission.
+  // FRAME-LOCAL OBJECT NAMES (laddr). Minted HERE, not in the frontend, because identifiers live
+  // in this layer's namespace: params, locals, every gaddr symbol, and the project's symbol map —
+  // none of which the frontend can see. A frontend-chosen `sp0` silently shadowed a project global
+  // of the same name. `sp<off>` uniquified with underscores until free; one name per offset.
+  const laddrName = (() => {
+    const taken = new Set<string>();
+    if (symbols) {
+      for (const [n] of symbols) {
+        taken.add(n);
+      }
+    }
+    for (const b of fn.blocks) {
+      for (const op of b.ops) {
+        if (op.opcode === 'gaddr') {
+          taken.add(op.attrs.sym as string);
+        } else if (op.opcode === 'call') {
+          // a CALLEE's name is in this namespace too: a function really named sp0 would be
+          // shadowed by the minted local, and `sp0()` on a u16 object is a compile error
+          taken.add(op.attrs.target as string);
+        }
+      }
+    }
+    const byOff = new Map<number, string>();
+    const names = new Map<Op, string>();
+    for (const b of fn.blocks) {
+      for (const op of b.ops) {
+        if (op.opcode !== 'laddr') {
+          continue;
+        }
+        const off = op.attrs.off as number;
+        let n = byOff.get(off);
+        if (n === undefined) {
+          n = `sp${off}`;
+          while (taken.has(n)) {
+            n += '_';
+          }
+          taken.add(n);
+          byOff.set(off, n);
+        }
+        names.set(op, n);
+      }
+    }
+    return names;
+  })();
+
   const scalarGlobals = new Set<string>();
   {
     const offsets = new Map<string, Set<number>>();
     const bumpAgg = (sym: string) => offsets.set(sym, new Set([-1])); // -1 marks "variable index"
     for (const b of fn.blocks) {
       for (const op of b.ops) {
-        const gaddrSym = (v: Value) => (defs.get(v)?.opcode === 'gaddr' ? (defs.get(v)!.attrs.sym as string) : null);
+        const gaddrSym = (v: Value) => {
+          const dv = defs.get(v);
+          // laddr participates identically: `sp0` is scalar-spelled at off 0 and cast-spelled
+          // anywhere else, exactly as a global of its shape would be — by its MINTED name
+          // (laddrName): the op carries no name attr, that namespace is this layer's
+          return dv?.opcode === 'gaddr'
+            ? (dv.attrs.sym as string)
+            : dv?.opcode === 'laddr'
+              ? (laddrName.get(dv) ?? null)
+              : null;
+        };
         if (op.opcode === 'load' || op.opcode === 'store') {
           const s = gaddrSym(op.operands[0]);
           if (s) {
@@ -895,6 +1032,50 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   // The C static type of a rendered expression, over the declared variable types — what decides
   // whether a memory access's base may be dereferenced as spelled (memAccess/arrayAccess).
   const ctype = (e0: Expr): IrType | undefined => exprCType(e0, (n) => varType.get(n));
+
+  /** `&gSym` assigned to a `T *` local: the address of an AGGREGATE is not a pointer to its
+   *  element. `&gArr` is `T (*)[n]`, `&gStruct` is `struct S *`, and neither is assignable to
+   *  `T *` — yet the IR's `gaddr` value legitimately has type `T *`, because that is what the asm
+   *  loaded. The bare spelling therefore states a type the project's own header contradicts.
+   *
+   *  It survived because agbcc only WARNS ("assignment from incompatible pointer type") and
+   *  computes the right address anyway. That leniency is not something to rely on: the Klonoa
+   *  project's own build template treats these as fatal, so the row's emitted C does not build
+   *  where its author would put it. The cast is the always-valid spelling — the same fallback
+   *  `bareArrayLead` documents for the indexed form — and it is byte-identical, so no benchmark row
+   *  moves either way and the rule that decides it is pinned in test/deref-typing.test.ts instead.
+   *
+   *  The test is whether `&gSym`'s rendered type PROVABLY equals the destination's, not whether the
+   *  symbol looks like an aggregate. A shape enumeration got this wrong three ways, each a real
+   *  miss: `shape:'pointer'` declares a pointer cell (`void *gSym`, or `struct Tag *gSym` when the
+   *  pointee has a declarable layout), so `&gSym` is a pointer-to-pointer either way; a `shape:'scalar'`
+   *  whose width differs from the destination's pointee gives `s32 *` for a `u16 *` slot; and a
+   *  NAME-ONLY symbol is synthesized as `extern u32 gSym;` (declare.ts), which is `u32 *` — not the
+   *  `T *` the older comment here claimed. So the default is to CAST, and the cast is omitted only
+   *  where the declared cell type is known and matches exactly. Byte-identical either way, so the
+   *  cost of casting one time too many is a redundant `(T *)`, never a wrong address. */
+  const castAggregateAddr = (name: string, value: Expr): Expr => {
+    const t = varType.get(name);
+    if (t?.kind !== 'ptr' || value.k !== 'addr') {
+      return value;
+    }
+    // The only provably-redundant case: a NON-VOLATILE scalar cell whose DECLARED type is the
+    // destination's pointee, where `&gSym` already denotes exactly `T *`.
+    //
+    // `scalarCellType` and not `scalarTypeForAccess`: the latter answers what an ACCESS of that
+    // width reads and collapses every 4-byte access to `s32`, so it called a `u32` cell equal to an
+    // `s32 *` destination and let the incompatible assignment through. And a `volatile` cell makes
+    // `&gSym` a `volatile T *`, so omitting the cast would DISCARD the qualifier — the same class of
+    // fatal-under-a-strict-build defect this rule exists to remove.
+    const si = symCtx?.info(value.name);
+    if (si?.shape === 'scalar' && !si.volatile && isScalarCellSize(si.size)) {
+      if (typeEquals(scalarCellType(si.size, si.signed), t.to)) {
+        return value;
+      }
+    }
+    return { k: 'cast', to: t, e: value };
+  };
+
   let fresh = 0;
   // Materialized defs are named FIRST: the temp is the register the compiler held the
   // value in, so downstream coalescing (loop inits, merge params) may adopt it — subject to the
@@ -1101,6 +1282,227 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     }
   }
 
+  // ── def-site anchoring of constant merge copies (anchorConstCopies) ──────────────────────────
+  // An edge copy `v = K` places the constant where the EDGE is, but the asm often materialized K
+  // earlier: `movs r9, #0` at entry ahead of a single-armed overwrite, `movs r5, #1` at the top
+  // of an arm ahead of a nested if. Anchoring the copy at the const op's own program position
+  // reproduces that placement — the write is emitted as a statement there (sideEffects reads
+  // `anchoredAt`) and the edge copies it replaces are suppressed (argAssignsFor reads
+  // `suppressedArgs`). Where the surviving arm then empties, mkIf's empty-then peephole yields
+  // the single-armed positive `if` the source wrote.
+  //
+  // REFUSAL CONDITIONS — each keeps the edge placement, never producing a different write:
+  //   - the arg is not an UNNAMED `const` op (only a rematerializable constant carries
+  //     unambiguous placement evidence; a named value's position is its materialized def's);
+  //   - the merge is a loop header (loop copies have their own placement discipline);
+  //   - the const's block does not dominate every edge source passing it (the anchored write
+  //     must precede the edge on every path);
+  //   - the const's block or any edge source sits inside ANY loop. Block-level dominance does
+  //     not give per-ITERATION precedence — a path may pass the def in iteration 1 and take the
+  //     suppressed edge in iteration 2 with the variable overwritten in between, the /preinit
+  //     sticky-arm failure class (PR #13) — so in-loop shapes are declined outright;
+  //   - the merge variable names any OTHER SSA value (a shared name has readers and writers
+  //     between the def site and the edge that edge placement respects and anchoring would not);
+  //   - another anchored const of the same variable lies on a path from this one to this one's
+  //     edge (the later write would clobber this arg's value; both stay at their edges instead).
+  const anchoredAt = new Map<Op, { name: string; arg: Value }[]>();
+  const suppressedArgs = new Map<object, Set<number>>();
+  if (anchorConstCopies) {
+    const nameCount = new Map<string, number>();
+    for (const n of varName.values()) {
+      nameCount.set(n, (nameCount.get(n) ?? 0) + 1);
+    }
+    const inLoop = (b: Block): boolean => {
+      for (const nl of forest.byHeader.values()) {
+        if (nl.body.has(b)) {
+          return true;
+        }
+      }
+      return false;
+    };
+    // conservative "a write in `a` may execute between one in `b` and `b`'s terminator": same
+    // block counts (op order refined by the caller where it matters), else CFG reachability
+    const mayFollow = (a: Block, b: Block): boolean => a === b || reachFrom(a).has(b);
+    for (const M of fn.blocks) {
+      if (M === entry || M.params.length === 0 || forest.byHeader.has(M)) {
+        continue;
+      }
+      M.params.forEach((p, i) => {
+        const name = varName.get(p)!;
+        if (nameCount.get(name) !== 1) {
+          return;
+        }
+        // every in-edge record into M, grouped by the SSA value it passes for param i
+        const groups = new Map<Value, { rec: { block: Block; args: Value[] }; src: Block }[]>();
+        for (const pr of new Set(preds.get(M) ?? [])) {
+          for (const s of pr.ops[pr.ops.length - 1].successors) {
+            if (s.block === M) {
+              const g = groups.get(s.args[i]);
+              if (g) {
+                g.push({ rec: s, src: pr });
+              } else {
+                groups.set(s.args[i], [{ rec: s, src: pr }]);
+              }
+            }
+          }
+        }
+        const candidates: { arg: Value; def: Op; defBlock: Block; edges: { rec: object; src: Block }[] }[] = [];
+        for (const [arg, edges] of groups) {
+          const def = defs.get(arg);
+          if (!def || def.opcode !== 'const' || varName.has(arg)) {
+            continue;
+          }
+          const defBlock = opBlock.get(def)!;
+          if (inLoop(defBlock) || edges.some(({ src }) => inLoop(src))) {
+            continue;
+          }
+          if (edges.some(({ src }) => !dom.get(src)!.has(defBlock))) {
+            continue;
+          }
+          candidates.push({ arg, def, defBlock, edges });
+        }
+        // pairwise clobber check: candidate `c` is unsafe when another candidate's write can lie
+        // between c's def and one of c's edges (def_c → def_o → edge_c); both then keep their edges
+        const safe = candidates.filter((c) =>
+          candidates.every((o) => {
+            if (o === c) {
+              return true;
+            }
+            const oAfterC =
+              c.defBlock === o.defBlock ? opIndex.get(o.def)! > opIndex.get(c.def)! : mayFollow(c.defBlock, o.defBlock);
+            return !(oAfterC && c.edges.some(({ src }) => mayFollow(o.defBlock, src)));
+          }),
+        );
+        for (const c of safe) {
+          const at = anchoredAt.get(c.def);
+          if (at) {
+            at.push({ name, arg: c.arg });
+          } else {
+            anchoredAt.set(c.def, [{ name, arg: c.arg }]);
+          }
+          for (const { rec } of c.edges) {
+            const sup = suppressedArgs.get(rec);
+            if (sup) {
+              sup.add(i);
+            } else {
+              suppressedArgs.set(rec, new Set([i]));
+            }
+          }
+        }
+      });
+    }
+  }
+
+  // ── BITFIELD member reads (symbol map) ──────────────────────────────────────────────────────
+  // The `(x << a) >> b` extract of a struct global's loaded bytes IS a bitfield access when the
+  // map declares a bitfield at exactly those bits: spelled `gSym.field`, the source form, whose
+  // declared `u32 field : n` then makes C's own integer promotion reproduce the signedness every
+  // downstream operator compiled with (a 7-bit unsigned field promotes to signed int — sdiv
+  // renders `/` and recompiles to __divsi3, where the raw-shift spelling stays u32).
+  //
+  // Semantically EXACT, never approximate: the window must lie inside the loaded bytes (so the
+  // load's extension bits cannot reach it), the field's position, width and signedness must all
+  // match the extract (a logical shift is an unsigned read, an arithmetic one a signed read —
+  // a signless field never matches), and the member must be nameable at all (memberQualsAllow;
+  // the map only carries bitfield facts for little-endian ELFs — see SymbolStructField). Any
+  // mismatch keeps the honest shift spelling.
+  //
+  // Precomputed over the ops (not folded during rendering) for the load's sake: a load whose
+  // EVERY use is a spelled extract chain must not also emit its materialized `v = *(u16 *)&g;`
+  // temp — the compiler CSEs the repeated member reads back to one load, but the leftover temp
+  // would be a second one. A VOLATILE container refuses the whole fold: N member reads are N
+  // volatile accesses where the asm did one load. (Byte-level residual, differ-refereed: a load
+  // only PARTIALLY absorbed — one extract spelled, another use kept — emits both the temp and
+  // the named reads, one load more than the asm; semantics hold, the score decides.)
+  //
+  // ORDERING GATE (adversarial round, CRITICAL 1 — twice): the named spelling replaces a
+  // REGISTER value — the bits captured at the load's program position — with a fresh memory
+  // read at each render position. Every other memory read in this file goes through the
+  // materialization model (analysis.ts) for exactly that hazard, so the fold clears the SAME
+  // bar with the SAME machinery: `emitPos` resolves where each extract actually renders
+  // (transitively through its inlining consumers — an unresolvable position refuses), and
+  // `memWriteBetween` walks every def-avoiding load→render path for a call, an opaque, or a
+  // store not provably to a DIFFERENT named global. Path-based on purpose: the second audit
+  // pass broke the first fix's linear-position scan with a block laid out AFTER the render in
+  // address order but executing between load and render on the taken path — fn.blocks order is
+  // address order, not topological order.
+  const bitfieldSpelling = new Map<Op, { global: string; field: string }>();
+  const absorbedLoads = new Set<Op>();
+  if (symCtx && littleEndian && spellBitfieldMembers) {
+    // the (name, byte) of a load's address when it resolves through defs alone — `gaddr` or
+    // `add(gaddr, const)`; anything else (a materialized base, a variable index) declines. THE
+    // shared L2 disjointness query (ir/alias.ts), which the materialization model consults with
+    // the same rule, so the fold and the model cannot disagree about what a store can reach.
+    const loadTargets = new Map<Op, GlobalCell>();
+    const addrOf = (v: Value, off: number): GlobalCell | null => globalCellOf(defs, v, off);
+    // A write for the fold's purposes: calls and opaques always; a store/astore unless its base
+    // resolves to a global PROVABLY different from the folded one.
+    const mayWrite = (sym: string) => mayWriteGlobal(defs, sym);
+    for (const blk of fn.blocks) {
+      for (const op of blk.ops) {
+        if ((op.opcode !== 'shr_u' && op.opcode !== 'shr_s') || op.operands.length !== 1) {
+          continue;
+        }
+        const b = op.attrs.imm as number | undefined;
+        const inner = defs.get(op.operands[0]);
+        if (typeof b !== 'number' || b <= 0 || b >= 32 || inner?.opcode !== 'shl' || inner.operands.length !== 1) {
+          continue;
+        }
+        const a = inner.attrs.imm as number | undefined;
+        if (typeof a !== 'number' || a < 0 || b < a) {
+          continue;
+        }
+        const w = 32 - b; // extract width
+        const lo = b - a; // low bit within the loaded value
+        const load = defs.get(inner.operands[0]);
+        if (load?.opcode !== 'load' || lo + w > (load.attrs.width as number) * 8) {
+          continue;
+        }
+        // a materialized shl would still emit its `v = x << a` temp reading the load — the fold
+        // would then ADD member reads on top of it; rare, refuse
+        if (materialize.has(inner)) {
+          continue;
+        }
+        const gb = addrOf(load.operands[0], load.attrs.off as number);
+        const si = gb ? symCtx.info(gb.name) : undefined;
+        if (!gb || si?.shape !== 'struct' || si.volatile) {
+          continue;
+        }
+        // where does the member read RENDER? at the extract's own position when materialized,
+        // else wherever each of its consumers ultimately renders (emitPos, transitively —
+        // unresolvable refuses); every load→render path must be write-free
+        const renders = materialize.has(op)
+          ? [{ blk: opBlock.get(op)!, idx: opIndex.get(op)! }]
+          : [...new Set((useSitesOf.get(op.results[0]) ?? []).map((s) => s.op))].map((c) => emitPos(c));
+        const writes = mayWrite(gb.name);
+        if (renders.some((r) => r === null) || renders.some((r) => memWriteBetween(load, r!, writes))) {
+          continue;
+        }
+        const signedRead = op.opcode === 'shr_s';
+        const fld = declaredFields(si.layout)?.find(
+          (f) => f.bitWidth === w && f.offset * 8 + f.bitOffset! === gb.byte * 8 + lo && f.signed === signedRead,
+        );
+        if (fld && memberQualsAllow(fld, si.const, false)) {
+          bitfieldSpelling.set(op, { global: gb.name, field: fld.name });
+          loadTargets.set(load, gb);
+        }
+      }
+    }
+    // a load is ABSORBED when every use is an shl whose every use is a spelled extract
+    for (const load of loadTargets.keys()) {
+      const shls = useSitesOf.get(load.results[0]) ?? [];
+      const absorbed =
+        shls.length > 0 &&
+        shls.every(
+          (u) =>
+            u.op.opcode === 'shl' && (useSitesOf.get(u.op.results[0]) ?? []).every((v) => bitfieldSpelling.has(v.op)),
+        );
+      if (absorbed) {
+        absorbedLoads.add(load);
+      }
+    }
+  }
+
   // An unresolvable value: strict mode keeps the `"?"` sentinel AND records the reason — the
   // decline thrown below names the actual gaps ("unmodelled instruction 'adde'"), the same
   // reasons annotate mode's markers carry, instead of the anonymous `?` that assertResolved
@@ -1123,6 +1525,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     if (d.opcode === 'const') {
       return { k: 'const', value: d.attrs.value as number };
     }
+    // a bitfield extract recognized over the ops (see the precompute above): the member read,
+    // not the shift pair
+    const bf = bitfieldSpelling.get(d);
+    if (bf) {
+      return { k: 'field', base: { k: 'var', name: bf.global }, name: bf.field, dot: true };
+    }
     if (CMP_TO_BIN[d.opcode]) {
       // A bare global address `&gSym` as a COMPARISON operand is the same unspelled escape as the
       // arithmetic case below (see intifyAddr): its C type comes from the PROJECT's own
@@ -1231,6 +1639,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         l = isPtrGlobal(l) ? intifyPtrGlobal(l) : l;
         r = isPtrGlobal(r) ? intifyPtrGlobal(r) : r;
       }
+      // (The two right shifts stay DISTINCT ops here — `>>>` logical, `>>` arithmetic. Which token
+      // a language spells each with, and what cast pins the choice, is a BACKEND decision; see
+      // l3/ast.ts BinOp and backend/cfamily.ts's shift rule.)
       // SCOPE: this and intifyAddr cover the ARITHMETIC escapes. A pointer global under a
       // COMPARISON (`gPtr < K` — C compares unsigned whatever the asm's icmp_s* said) is the same
       // class as intifyAddrCmp's `addr` rule and is deliberately left alone here: it is valid C
@@ -1242,8 +1653,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
       // The C rotate idiom — `x >> n | x << (32 - n)` (mirrored for rotl). Byte-exact round-trip
       // on agbcc (thumb ror) and mwcc (rotlw/rotlwi), verified against both toolchains before the
       // ops landed. `x` and `n` render twice — both pure by construction (SSA values; the rotate's
-      // operands are register reads), and recovery seeds the rotated value unsigned so `>>`
-      // spells the logical shift the idiom requires.
+      // operands are register reads). The right half is the LOGICAL shift `>>>` — the idiom is
+      // wrong with an arithmetic one — stated on the node rather than left to the rotated value's
+      // recovered unsignedness, which is a property of recovery rather than of the idiom.
       //
       // (The PPC mirror fold — `rotl(x, 32 - m)` ⇒ rotr(x, m) — lives in the PATTERN layer,
       // engine.ts ROTL_MIRROR: it is a compiler-spelling idiom, mwcc-gated there, not a
@@ -1260,7 +1672,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         n.k === 'const'
           ? { k: 'const', value: 32 - n.value }
           : { k: 'bin', op: '-', l: { k: 'const', value: 32 }, r: n };
-      const [near, far] = dir === 'rotr' ? (['>>', '<<'] as const) : (['<<', '>>'] as const);
+      const [near, far] = dir === 'rotr' ? (['>>>', '<<'] as const) : (['<<', '>>>'] as const);
       return {
         k: 'bin',
         op: '|',
@@ -1286,6 +1698,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     if (d.opcode === 'call') {
       return { k: 'call', fn: d.attrs.target as string, args: d.operands.map(e) };
     }
+    if (d.opcode === 'laddr') {
+      // gaddr's local twin: the address of the frame-local object the Thumb frontend PROVED
+      // (frame-object audit — width/signed are stamped machine facts). The NAME is this layer's:
+      // see laddrName. Renders `&sp0`; the object itself is declared in `locals`.
+      return { k: 'addr', name: laddrName.get(d)! };
+    }
     if (d.opcode === 'gaddr') {
       // A promoted CODE symbol (frontend `code: true`) is a function pointer stored as an
       // integer: spelled `(u32)Name` — the source idiom — never `&Name` (defect G of the
@@ -1322,7 +1740,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
       );
     }
     return d.opcode === 'opaque'
-      ? mkGap(`unmodelled instruction '${(d.attrs.mnemonic as string) ?? '?'}'`, d.operands.map(e))
+      ? mkGap(gapReasonFor(d.attrs.mnemonic), d.operands.map(e))
       : mkGap(`no lowering for op '${d.opcode}'`, d.operands.map(e));
   };
 
@@ -1382,13 +1800,17 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     const target = succ.block;
     const argExpr = sub ? exprWith(sub) : expr;
     const copies: { name: string; value: Expr; arg: Value }[] = [];
+    const suppressed = suppressedArgs.get(succ);
     target.params.forEach((p, i) => {
+      if (suppressed?.has(i)) {
+        return;
+      } // anchored at its const's def site — the write already ran before this edge
       const name = varName.get(p)!;
       const arg = succ.args[i];
       if ((sub?.get(arg) ?? varName.get(arg)) === name) {
         return;
       } // identity copy — coalesced away
-      copies.push({ name, value: argExpr(arg), arg });
+      copies.push({ name, value: castAggregateAddr(name, argExpr(arg)), arg });
     });
     // Emit in the order the args are COMPUTED in `pred` — a compiler that lays the defining ops
     // (and thus the copies that read them) out in that order matches with no spurious arg-swap.
@@ -1415,10 +1837,10 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     return succ ? argAssignsFor(pred, succ, sub) : [];
   };
 
-  // Side-effecting ops of a block, emitted as statements in program order: memory stores,
-  // calls whose return value nothing consumes (a void/discarded call), and MATERIALIZED defs
-  // — a call/load whose value cannot soundly render at its use is assigned to its named
-  // temp here, at its own program position.
+  // Side-effecting ops of a block, emitted as statements in program order: memory stores; any
+  // EFFECTFUL op whose result nothing consumes (a void/discarded call, and an `opaque` standing for
+  // an instruction asmlift could not model); and MATERIALIZED defs — a call/load whose value cannot
+  // soundly render at its use is assigned to its named temp here, at its own program position.
   const sideEffects = (b: Block): Stmt[] => {
     const out: Stmt[] = [];
     for (const op of b.ops) {
@@ -1461,10 +1883,27 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
           ),
           value: expr(op.operands[2]),
         });
-      } else if (op.opcode === 'call' && op.results.length && !useSitesOf.has(op.results[0])) {
+      } else if (EFFECTFUL_OPS.has(op.opcode) && op.results.length && !useSitesOf.has(op.results[0])) {
+        // An effectful op whose result nobody reads is still an execution. `store`/`astore` have no
+        // result and were handled above, so what reaches here is `call` and `opaque` — and an
+        // `opaque` missing from this walk is an instruction the frontend could not model
+        // disappearing with no diagnostic, which is the one thing this project refuses to do.
+        //
+        // Keyed on EFFECTFUL_OPS rather than the two opcode names: the deciding property is "has an
+        // effect the result does not account for", which is what the flag already means, so the next
+        // op to acquire it needs no edit here. Statement, not expression — `expr` on the result
+        // routes through `lowerDef`, already where `opaque` becomes the gap, so this reuses the SAME
+        // degradation a live opaque gets rather than inventing a second way to be loud.
         out.push({ k: 'exprstmt', value: expr(op.results[0]) });
-      } else if (materialize.has(op)) {
-        out.push({ k: 'assign', name: varName.get(op.results[0])!, value: lowerDef(op, expr) });
+      } else if (materialize.has(op) && !absorbedLoads.has(op)) {
+        // (an absorbed load's every consumer spells a named bitfield read — emitting its temp
+        // here would recompile to a second load the asm does not have)
+        const nm = varName.get(op.results[0])!;
+        out.push({ k: 'assign', name: nm, value: castAggregateAddr(nm, lowerDef(op, expr)) });
+      }
+      // a merge copy anchored at this const's original position (anchorConstCopies, above)
+      for (const a of anchoredAt.get(op) ?? []) {
+        out.push({ k: 'assign', name: a.name, value: expr(a.arg) });
       }
     }
     return out;
@@ -1515,7 +1954,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
 
   // ── Regime-A switch recovery (structure/switch-recover.ts): the recognizer's case bodies call
   // back into structureRegion, and Regime B (switch_br, below) shares its fall-through predicate.
-  const { recognizeSwitch, caseRegionReachesSibling } = makeSwitchRecovery({
+  const { recognizeSwitch, analyzeArmExit } = makeSwitchRecovery({
     fn,
     defs,
     dom,
@@ -1524,6 +1963,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     isNamed: (v) => varName.has(v),
     isCmpOpcode: (opcode) => !!CMP_TO_BIN[opcode],
     switchAllowsNeqCase,
+    emitsAnchoredWrite: (blk) => blk.ops.some((o) => anchoredAt.has(o)),
     expr: (v) => expr(v),
     structureRegion: (b, stop) => structureRegion(b, stop),
   });
@@ -1552,23 +1992,18 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     }
     // Regime B: a `switch_br` (jump-table dispatch) lowers directly to the `switch` node — scrutinee,
     // per-successor case value, last successor = default. Case bodies delegate to structureRegion (as in
-    // Regime A). Fall-through between jump-table cases is not yet handled: if a case body reaches another
-    // case/default block inside the region, fail LOUD rather than duplicate it.
+    // Regime A). Two table slots naming ONE block are one arm carrying both `case` labels; an arm whose
+    // region flows into the NEXT arm is C fall-through (no `break`). Any other shape needs a `goto` and
+    // fails LOUD rather than being duplicated or silently closed.
     if (term.opcode === 'switch_br') {
       const merge = ipdom.get(b) ?? stop;
       const succ = term.successors;
       const caseVals = term.attrs.cases as number[];
-      const targets = new Set<Block>(succ.map((s) => s.block));
-      if (caseRegionReachesSibling(targets, b, merge)) {
-        throw new StructureError(
-          `cannot structure '${fn.name}': fall-through between jump-table cases is not yet supported`,
-        );
-      }
       // Switch edges CARRY phi args (frontend/ssa.ts appends them terminator-generically) — each
       // case/default body must open with its edge's copies, exactly as cond_br edges do; dropping
       // them leaves the target's params uninitialized on the switch path. Two case values sharing
       // a target must agree on their args (else the copies are ambiguous → loud decline); the
-      // shared body is then structured per case entry.
+      // shared body is then emitted ONCE under both labels.
       const argsSeen = new Map<Block, Value[]>();
       for (const s of succ) {
         const prev = argsSeen.get(s.block);
@@ -1579,16 +2014,79 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         }
         argsSeen.set(s.block, s.args as Value[]);
       }
-      const outCases: SwitchCase[] = succ.slice(0, -1).map((s, i) => ({
-        values: [caseVals[i]],
-        body: [...argAssignsFor(b, s), ...structureRegion(s.block, merge)],
-        fallsThrough: false,
-      }));
+      // Group the case slots by target block, in TABLE order — `case 5: case 6:` is one arm with two
+      // labels, not two copies of one body. Emission order is the array order (load-bearing: see the
+      // l3/ast.ts fall-through note), so the adjacency check below is against this same order.
+      const defEdge = succ[succ.length - 1];
+      const arms: { entry: Block; edge: (typeof succ)[number]; values: number[] }[] = [];
+      const armOf = new Map<Block, (typeof arms)[number]>();
+      succ.slice(0, -1).forEach((s, i) => {
+        let a = armOf.get(s.block);
+        if (!a) {
+          a = { entry: s.block, edge: s, values: [] };
+          armOf.set(s.block, a);
+          arms.push(a);
+        }
+        a.values.push(caseVals[i]);
+      });
+      // The blocks an arm could fall INTO. The default block counts only when it is a block of its
+      // own: when it IS the merge, "the default" is just where the switch ends, and an arm reaching
+      // it is a plain `break`.
+      const siblings = new Set<Block>(arms.map((a) => a.entry));
+      if (defEdge.block !== merge) {
+        siblings.add(defEdge.block);
+      }
+      // ONE emission order for the whole statement: the case arms in table order, then the default —
+      // which is exactly where C puts it. Adjacency is read off this array, so "falls into the next
+      // arm" needs no separate rule for a case that falls into the default (it is the arm after the
+      // last case, and legal C).
+      const emitOrder = [...arms, { entry: defEdge.block, edge: defEdge, values: null as number[] | null }];
+      // Each arm's switch-edge copies, computed ONCE and in emission order: `argAssignsFor` mints
+      // swap-cycle temp names, so calling it twice for one edge burns a temp number and changes the
+      // output (the same reason emitDoWhile reuses its `updates`).
+      const edgeCopies = emitOrder.map((a) => argAssignsFor(b, a.edge));
+      const bodies = emitOrder.map((a, i) => {
+        const exit = analyzeArmExit(a.entry, b, merge, siblings);
+        if (exit.kind === 'unstructurable') {
+          throw new StructureError(`cannot structure '${fn.name}': ${exit.why}`);
+        }
+        const ft = exit.kind === 'fallthrough';
+        const next = emitOrder[i + 1];
+        if (ft && next?.entry !== exit.to) {
+          throw new StructureError(
+            `cannot structure '${fn.name}': ${a.values ? `case ${a.values.join('/')}` : 'the default arm'} falls ` +
+              `through into an arm that is not the next one emitted — C fall-through only reaches the arm below`,
+          );
+        }
+        // The arm fallen INTO opens with its own switch-edge copies, which are how the dispatch hands
+        // it its block parameters. On the fall-through path those copies would RE-RUN and overwrite
+        // what the falling arm just computed (`case 0: v=7; case 1: v=5;` — the case-0 path calling
+        // with 5). They cannot simply be dropped either: entering that arm by its own case value
+        // needs them. Hoisting them above the switch is possible but not always safe (another arm may
+        // read the same name first), so this shape declines LOUD; recovering it is future work.
+        if (ft && edgeCopies[i + 1].length) {
+          throw new StructureError(
+            `cannot structure '${fn.name}': the case fallen into takes a value from the switch edge, ` +
+              `which the fall-through path would re-run`,
+          );
+        }
+        return {
+          // A falling-through arm stops AT its successor arm, which then emits that body once under
+          // its own labels; a closed arm runs to the merge as before.
+          body: [...edgeCopies[i], ...structureRegion(a.entry, ft ? exit.to : merge)],
+          fallsThrough: ft,
+        };
+      });
+      const outCases: SwitchCase[] = arms.map((a, i) => ({ values: a.values, ...bodies[i] }));
+      // An EMPTY default arm is not a default at all: it is where the switch ends, which is where
+      // an unmatched scrutinee goes anyway. Emitting the label with nothing under it says nothing
+      // and is not even valid C89 (a label needs a statement).
+      const defBody = bodies[bodies.length - 1].body;
       const sw: Stmt = {
         k: 'switch',
         scrutinee: expr(term.operands[0]),
         cases: outCases,
-        default: [...argAssignsFor(b, succ[succ.length - 1]), ...structureRegion(succ[succ.length - 1].block, merge)],
+        ...(defBody.length ? { default: defBody } : {}),
       };
       out.push(sw);
       if (merge && merge !== stop) {
@@ -1725,7 +2223,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         out.push(...updateCopies); // the loop update, RAW (i++, p>>=1, …)
         let leaveCond = exprWith(sub)(term.operands[0]);
         if (contIsTaken) {
-          leaveCond = negate(leaveCond);
+          leaveCond = negateCond(leaveCond);
         } // continue is `taken` → leave when NOT it
         const exitArm = isBreak
           ? [...argAssigns(b, loopCtx.exit, sub), { k: 'break' } as Stmt] // break to the loop exit
@@ -1759,7 +2257,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
       // IDO/MIPS; agbcc/GCC canonicalise either way, so it is safe there too. A compiler that
       // inverts branch canonicalization sets preserveDivergentBranchSense false and falls through
       // to the positive form below.
-      out.push({ k: 'if', cond: negate(cond), then: elseS, else: thenS });
+      out.push({ k: 'if', cond: negateCond(cond), then: elseS, else: thenS });
       return out;
     }
     out.push(mkIf(cond, thenS, elseS));
@@ -1788,7 +2286,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     const term = li.header.ops[li.header.ops.length - 1];
     let cond = exprWith(loopSub(li))(term.operands[0]);
     if (term.successors[0].block !== li.header) {
-      cond = negate(cond);
+      cond = negateCond(cond);
     } // loop-continue must be `taken`
     const body = [...sideEffects(li.header), ...(updates ?? argAssigns(li.header, li.header))];
     return { k: 'while', cond, body };
@@ -1802,7 +2300,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     const term = wl.header.ops[wl.header.ops.length - 1];
     let cond = expr(term.operands[0]);
     if (term.successors[1].block === wl.bodyEntry) {
-      cond = negate(cond);
+      cond = negateCond(cond);
     }
     // The header→bodyEntry edge may carry non-identity phi args (a value the header COMPUTED and passes
     // into the body). Those copies must open the body — dropping them reads an uninitialised local.
@@ -1844,6 +2342,26 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         `cannot structure '${fn.name}': do-while condition or a post-loop value reads a pre-update loop variable`,
       );
     }
+    // The exit copies render AFTER the `dowhile` statement, but the analysis judged where each
+    // value they carry may inline as if the copies sat on the latch's terminator — INSIDE the loop.
+    // For a pure def that is only a naming question (the pre-update guard above covers the rest);
+    // for an EFFECTFUL one it moves the effect out of the loop: a call that ran once per iteration
+    // would render once, after it. Nothing can re-place it here — `materialize` was decided before
+    // emission — so decline LOUD rather than emit a plausible loop that calls the wrong number of
+    // times.
+    const movedEffect = exitArgs.find((v) => {
+      const d = defs.get(v);
+      return (
+        d && REPEATED_EFFECT.has(d.opcode) && dw.body.has(opBlock.get(d)!) && !materialize.has(d) && !varName.has(v)
+      );
+    });
+    if (movedEffect) {
+      const d = defs.get(movedEffect)!;
+      throw new StructureError(
+        `cannot structure '${fn.name}': a post-loop value inlines a '${d.opcode}' from inside the loop, ` +
+          `which would move that effect out of it`,
+      );
+    }
     dwActive.add(dw.header);
     // structure the header's own block up to the latch. Call structureBlock DIRECTLY (not
     // structureRegion): the header is already on `onStack` from the caller's structureRegion, so
@@ -1864,7 +2382,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     const body = [...inner, ...sideEffects(dw.latch), ...updates];
     let cond = exprWith(sub)(lterm.operands[0]);
     if (lterm.successors[1].block === dw.header) {
-      cond = negate(cond);
+      cond = negateCond(cond);
     } // continue edge must be `taken`
     const out: Stmt[] = [{ k: 'dowhile', cond, body }];
     // The exit region reads latch back-edge values under `sub` (post-loop they live in the loop vars).
@@ -1890,7 +2408,28 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   return {
     name: fn.name,
     params: entry.params.map((p, i) => ({ name: `a${i}`, type: p.type })),
-    locals: localNames.map((n) => ({ name: n, type: varType.get(n)! })),
+    locals: [
+      ...localNames.map((n) => ({ name: n, type: varType.get(n)! })),
+      // frame-local objects (laddr): declared with EXACTLY the access type the machine used —
+      // the frontend's frame-object audit proved all accesses agree, so this is a fact, not a guess
+      ...[
+        ...new Map(
+          fn.blocks
+            .flatMap((b) => b.ops)
+            .filter((op) => op.opcode === 'laddr')
+            .map((op) => [
+              laddrName.get(op)!,
+              {
+                name: laddrName.get(op)!,
+                type: T.int((op.attrs.width as number) * 8, op.attrs.signed as boolean),
+                // an ESCAPED address makes every store observable (the DMA hardware reads it);
+                // without volatile, gcc-2.9 deletes a store to a local nothing in-function reads
+                ...(op.attrs.volatile === true ? { volatile: true as const } : {}),
+              },
+            ]),
+        ).values(),
+      ],
+    ],
     ...(shapedGlobalTypes.size
       ? {
           globals: [...shapedGlobalTypes]
@@ -2047,16 +2586,10 @@ function substVar(e: Expr, from: string, to: string): Expr {
 // empty-then peephole: `if (c) {} else { S }` → `if (!c) { S }`
 function mkIf(cond: Expr, thenS: Stmt[], elseS: Stmt[]): Stmt {
   if (thenS.length === 0 && elseS.length > 0) {
-    return { k: 'if', cond: negate(cond), then: elseS, else: [] };
+    return { k: 'if', cond: negateCond(cond), then: elseS, else: [] };
   }
   return { k: 'if', cond, then: thenS, else: elseS };
 }
-function negate(e: Expr): Expr {
-  if (e.k === 'bin' && NEGATE[e.op]) {
-    return { ...e, op: NEGATE[e.op] };
-  }
-  return { k: 'un', op: '!', e };
-}
 
 // --- CFG utilities ---
 function predecessorBlocks(fn: Fn): Map<Block, Block[]> {