@asmlift/core 0.4.0 → 0.5.0

package/src/structure/structure.ts

@@ -36,9 +36,11 @@
 // code): multi-latch headers, irreducible/overlapping loops, conditional `continue`, a `break`
 // whose exit copies would clobber, switch fall-through, and mixed-entry self-loops (a guarded
 // header also entered by a plain br).
+import { type GlobalCell, globalCellOf, mayWriteGlobal } from '../ir/alias';
 import { Block, Fn, Op, Value, defOpMap, successorsOf } from '../ir/core';
+import { EFFECTFUL_OPS } from '../ir/opcodes';
 import { type IrType, T, scalarTypeForAccess, typeEquals } from '../ir/types';
-import { BinOp, Expr, SFn, Stmt, SwitchCase, exprChildren, mapExprChildren, negateCond } from '../l3/ast';
+import { BinOp, Expr, SFn, Stmt, SwitchCase, exprChildren, gapReasonFor, mapExprChildren, negateCond } from '../l3/ast';
 import { exprCType, ptrElemBytes } from '../l3/typing';
 import { returnType } from '../raise/recover';
 import { collectStructs } from '../raise/structs';
@@ -585,6 +587,13 @@ interface WhileLoopInfo {
   body: Set<Block>; // the pure natural-loop body (for in-body vs exit classification)
 }
 
+// Opcodes whose NUMBER OF EXECUTIONS is observable. Moving one of these out of a loop changes what
+// the program does — a call that ran per iteration would run once. A `load`/`aload` is deliberately
+// NOT here: it is a pure read, so running it once instead of per-iteration is unobservable as long
+// as it reads the same memory, which is exactly what the existing def→render barrier scan
+// (structure/analysis.ts) already proves before it lets one inline at all.
+const REPEATED_EFFECT = new Set(['call', 'opaque']);
+
 // A bottom-tested `do { body } while(cond)`. The header is the body entry (entered before any
 // test); the LATCH holds the loop condition and the single exit. Body = header..latch structured, then
 // the latch's own ops + the loop-update; the latch test is the do-while condition. The condition is
@@ -629,6 +638,11 @@ export interface StructureOptions {
   // read recompiles at the DECLARATION's access width — where that diverges from the asm's load
   // width the honest shift spelling is the one that matches, and the differ referees.
   spellBitfieldMembers?: boolean;
+  // Let a read of a named global render at its use across writes that PROVABLY cannot reach it
+  // (a store to a different named global), instead of caching it in a local. Off by default;
+  // rank.ts enumerates the ON spelling as the `/reread-globals` axis — see analysis.ts
+  // AnalyzeOptions for why this is a differ-refereed lever and not a fix.
+  rereadGlobals?: boolean;
   // How an unresolvable VALUE degrades (a live `opaque`, an unlowered transient op, a dropped def):
   //   "strict"   (default) — the `"?"` sentinel, tripping assertResolved at the boundary (loud in
   //              the PROCESS);
@@ -652,6 +666,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     anchorConstCopies = false,
     littleEndian = true,
     spellBitfieldMembers = true,
+    rereadGlobals = false,
     onGap = 'strict',
     symbols,
   } = opts;
@@ -664,6 +679,15 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   const { useSitesOf, opIndex, opBlock, liveIn, materialize, reachFrom, emitPos, memWriteBetween } = analyze(
     fn,
     returnsVoid,
+    {
+      defs,
+      rereadGlobals,
+      // the map's own declaration truth: a volatile object's read may not be duplicated or moved
+      volatileGlobal: (n) => {
+        const si = symbols?.get(n);
+        return si?.volatile === true || (si?.layout ?? []).some((f) => f.volatile === true);
+      },
+    },
   );
 
   // SCALAR-vs-AGGREGATE globals: a `gaddr` symbol accessed EXCLUSIVELY at offset 0 is a scalar
@@ -676,13 +700,68 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   // widths is a union/type-pun, which the downstream struct-layout recovery rejects LOUD
   // ("overlapping fields ... unions not modelled") before this classification is consumed — so a
   // width collision at off-0 declines honestly rather than reaching a wrong bare-`gSym` emission.
+  // FRAME-LOCAL OBJECT NAMES (laddr). Minted HERE, not in the frontend, because identifiers live
+  // in this layer's namespace: params, locals, every gaddr symbol, and the project's symbol map —
+  // none of which the frontend can see. A frontend-chosen `sp0` silently shadowed a project global
+  // of the same name. `sp<off>` uniquified with underscores until free; one name per offset.
+  const laddrName = (() => {
+    const taken = new Set<string>();
+    if (symbols) {
+      for (const [n] of symbols) {
+        taken.add(n);
+      }
+    }
+    for (const b of fn.blocks) {
+      for (const op of b.ops) {
+        if (op.opcode === 'gaddr') {
+          taken.add(op.attrs.sym as string);
+        } else if (op.opcode === 'call') {
+          // a CALLEE's name is in this namespace too: a function really named sp0 would be
+          // shadowed by the minted local, and `sp0()` on a u16 object is a compile error
+          taken.add(op.attrs.target as string);
+        }
+      }
+    }
+    const byOff = new Map<number, string>();
+    const names = new Map<Op, string>();
+    for (const b of fn.blocks) {
+      for (const op of b.ops) {
+        if (op.opcode !== 'laddr') {
+          continue;
+        }
+        const off = op.attrs.off as number;
+        let n = byOff.get(off);
+        if (n === undefined) {
+          n = `sp${off}`;
+          while (taken.has(n)) {
+            n += '_';
+          }
+          taken.add(n);
+          byOff.set(off, n);
+        }
+        names.set(op, n);
+      }
+    }
+    return names;
+  })();
+
   const scalarGlobals = new Set<string>();
   {
     const offsets = new Map<string, Set<number>>();
     const bumpAgg = (sym: string) => offsets.set(sym, new Set([-1])); // -1 marks "variable index"
     for (const b of fn.blocks) {
       for (const op of b.ops) {
-        const gaddrSym = (v: Value) => (defs.get(v)?.opcode === 'gaddr' ? (defs.get(v)!.attrs.sym as string) : null);
+        const gaddrSym = (v: Value) => {
+          const dv = defs.get(v);
+          // laddr participates identically: `sp0` is scalar-spelled at off 0 and cast-spelled
+          // anywhere else, exactly as a global of its shape would be — by its MINTED name
+          // (laddrName): the op carries no name attr, that namespace is this layer's
+          return dv?.opcode === 'gaddr'
+            ? (dv.attrs.sym as string)
+            : dv?.opcode === 'laddr'
+              ? (laddrName.get(dv) ?? null)
+              : null;
+        };
         if (op.opcode === 'load' || op.opcode === 'store') {
           const s = gaddrSym(op.operands[0]);
           if (s) {
@@ -963,8 +1042,8 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
    *  computes the right address anyway. That leniency is not something to rely on: the Klonoa
    *  project's own build template treats these as fatal, so the row's emitted C does not build
    *  where its author would put it. The cast is the always-valid spelling — the same fallback
-   *  `bareArrayLead` documents for the indexed form — and it is byte-identical (measured on
-   *  kleod:UpdateHUDCounterDisplay: 81 with and without).
+   *  `bareArrayLead` documents for the indexed form — and it is byte-identical, so no benchmark row
+   *  moves either way and the rule that decides it is pinned in test/deref-typing.test.ts instead.
    *
    *  The test is whether `&gSym`'s rendered type PROVABLY equals the destination's, not whether the
    *  symbol looks like an aggregate. A shape enumeration got this wrong three ways, each a real
@@ -1351,43 +1430,14 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   const absorbedLoads = new Set<Op>();
   if (symCtx && littleEndian && spellBitfieldMembers) {
     // the (name, byte) of a load's address when it resolves through defs alone — `gaddr` or
-    // `add(gaddr, const)`; anything else (a materialized base, a variable index) declines
-    const loadTargets = new Map<Op, { name: string; byte: number }>();
-    const addrOf = (v: Value, off: number): { name: string; byte: number } | null => {
-      const d0 = defs.get(v);
-      if (d0?.opcode === 'gaddr') {
-        return { name: d0.attrs.sym as string, byte: off };
-      }
-      if (d0?.opcode === 'add' && d0.operands.length === 2) {
-        for (const [x, y] of [
-          [d0.operands[0], d0.operands[1]],
-          [d0.operands[1], d0.operands[0]],
-        ] as const) {
-          const g0 = defs.get(x);
-          const c0 = defs.get(y);
-          if (g0?.opcode === 'gaddr' && c0?.opcode === 'const') {
-            return { name: g0.attrs.sym as string, byte: (c0.attrs.value as number) + off };
-          }
-        }
-      }
-      return null;
-    };
+    // `add(gaddr, const)`; anything else (a materialized base, a variable index) declines. THE
+    // shared L2 disjointness query (ir/alias.ts), which the materialization model consults with
+    // the same rule, so the fold and the model cannot disagree about what a store can reach.
+    const loadTargets = new Map<Op, GlobalCell>();
+    const addrOf = (v: Value, off: number): GlobalCell | null => globalCellOf(defs, v, off);
     // A write for the fold's purposes: calls and opaques always; a store/astore unless its base
-    // resolves to a global PROVABLY different from the folded one. (Name comparison suffices:
-    // the pool promotion picks one canonical name per address, so one cell cannot appear under
-    // two names within a function.)
-    const mayWrite =
-      (sym: string) =>
-      (x: Op): boolean => {
-        if (x.opcode === 'call' || x.opcode === 'opaque') {
-          return true;
-        }
-        if (x.opcode !== 'store' && x.opcode !== 'astore') {
-          return false;
-        }
-        const t = addrOf(x.operands[0], 0);
-        return !(t && t.name !== sym);
-      };
+    // resolves to a global PROVABLY different from the folded one.
+    const mayWrite = (sym: string) => mayWriteGlobal(defs, sym);
     for (const blk of fn.blocks) {
       for (const op of blk.ops) {
         if ((op.opcode !== 'shr_u' && op.opcode !== 'shr_s') || op.operands.length !== 1) {
@@ -1648,6 +1698,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     if (d.opcode === 'call') {
       return { k: 'call', fn: d.attrs.target as string, args: d.operands.map(e) };
     }
+    if (d.opcode === 'laddr') {
+      // gaddr's local twin: the address of the frame-local object the Thumb frontend PROVED
+      // (frame-object audit — width/signed are stamped machine facts). The NAME is this layer's:
+      // see laddrName. Renders `&sp0`; the object itself is declared in `locals`.
+      return { k: 'addr', name: laddrName.get(d)! };
+    }
     if (d.opcode === 'gaddr') {
       // A promoted CODE symbol (frontend `code: true`) is a function pointer stored as an
       // integer: spelled `(u32)Name` — the source idiom — never `&Name` (defect G of the
@@ -1684,7 +1740,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
       );
     }
     return d.opcode === 'opaque'
-      ? mkGap(`unmodelled instruction '${(d.attrs.mnemonic as string) ?? '?'}'`, d.operands.map(e))
+      ? mkGap(gapReasonFor(d.attrs.mnemonic), d.operands.map(e))
       : mkGap(`no lowering for op '${d.opcode}'`, d.operands.map(e));
   };
 
@@ -1781,10 +1837,10 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     return succ ? argAssignsFor(pred, succ, sub) : [];
   };
 
-  // Side-effecting ops of a block, emitted as statements in program order: memory stores,
-  // calls whose return value nothing consumes (a void/discarded call), and MATERIALIZED defs
-  // — a call/load whose value cannot soundly render at its use is assigned to its named
-  // temp here, at its own program position.
+  // Side-effecting ops of a block, emitted as statements in program order: memory stores; any
+  // EFFECTFUL op whose result nothing consumes (a void/discarded call, and an `opaque` standing for
+  // an instruction asmlift could not model); and MATERIALIZED defs — a call/load whose value cannot
+  // soundly render at its use is assigned to its named temp here, at its own program position.
   const sideEffects = (b: Block): Stmt[] => {
     const out: Stmt[] = [];
     for (const op of b.ops) {
@@ -1827,7 +1883,17 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
           ),
           value: expr(op.operands[2]),
         });
-      } else if (op.opcode === 'call' && op.results.length && !useSitesOf.has(op.results[0])) {
+      } else if (EFFECTFUL_OPS.has(op.opcode) && op.results.length && !useSitesOf.has(op.results[0])) {
+        // An effectful op whose result nobody reads is still an execution. `store`/`astore` have no
+        // result and were handled above, so what reaches here is `call` and `opaque` — and an
+        // `opaque` missing from this walk is an instruction the frontend could not model
+        // disappearing with no diagnostic, which is the one thing this project refuses to do.
+        //
+        // Keyed on EFFECTFUL_OPS rather than the two opcode names: the deciding property is "has an
+        // effect the result does not account for", which is what the flag already means, so the next
+        // op to acquire it needs no edit here. Statement, not expression — `expr` on the result
+        // routes through `lowerDef`, already where `opaque` becomes the gap, so this reuses the SAME
+        // degradation a live opaque gets rather than inventing a second way to be loud.
         out.push({ k: 'exprstmt', value: expr(op.results[0]) });
       } else if (materialize.has(op) && !absorbedLoads.has(op)) {
         // (an absorbed load's every consumer spells a named bitfield read — emitting its temp
@@ -1888,7 +1954,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
 
   // ── Regime-A switch recovery (structure/switch-recover.ts): the recognizer's case bodies call
   // back into structureRegion, and Regime B (switch_br, below) shares its fall-through predicate.
-  const { recognizeSwitch, caseRegionReachesSibling } = makeSwitchRecovery({
+  const { recognizeSwitch, analyzeArmExit } = makeSwitchRecovery({
     fn,
     defs,
     dom,
@@ -1926,23 +1992,18 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     }
     // Regime B: a `switch_br` (jump-table dispatch) lowers directly to the `switch` node — scrutinee,
     // per-successor case value, last successor = default. Case bodies delegate to structureRegion (as in
-    // Regime A). Fall-through between jump-table cases is not yet handled: if a case body reaches another
-    // case/default block inside the region, fail LOUD rather than duplicate it.
+    // Regime A). Two table slots naming ONE block are one arm carrying both `case` labels; an arm whose
+    // region flows into the NEXT arm is C fall-through (no `break`). Any other shape needs a `goto` and
+    // fails LOUD rather than being duplicated or silently closed.
     if (term.opcode === 'switch_br') {
       const merge = ipdom.get(b) ?? stop;
       const succ = term.successors;
       const caseVals = term.attrs.cases as number[];
-      const targets = new Set<Block>(succ.map((s) => s.block));
-      if (caseRegionReachesSibling(targets, b, merge)) {
-        throw new StructureError(
-          `cannot structure '${fn.name}': fall-through between jump-table cases is not yet supported`,
-        );
-      }
       // Switch edges CARRY phi args (frontend/ssa.ts appends them terminator-generically) — each
       // case/default body must open with its edge's copies, exactly as cond_br edges do; dropping
       // them leaves the target's params uninitialized on the switch path. Two case values sharing
       // a target must agree on their args (else the copies are ambiguous → loud decline); the
-      // shared body is then structured per case entry.
+      // shared body is then emitted ONCE under both labels.
       const argsSeen = new Map<Block, Value[]>();
       for (const s of succ) {
         const prev = argsSeen.get(s.block);
@@ -1953,16 +2014,79 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         }
         argsSeen.set(s.block, s.args as Value[]);
       }
-      const outCases: SwitchCase[] = succ.slice(0, -1).map((s, i) => ({
-        values: [caseVals[i]],
-        body: [...argAssignsFor(b, s), ...structureRegion(s.block, merge)],
-        fallsThrough: false,
-      }));
+      // Group the case slots by target block, in TABLE order — `case 5: case 6:` is one arm with two
+      // labels, not two copies of one body. Emission order is the array order (load-bearing: see the
+      // l3/ast.ts fall-through note), so the adjacency check below is against this same order.
+      const defEdge = succ[succ.length - 1];
+      const arms: { entry: Block; edge: (typeof succ)[number]; values: number[] }[] = [];
+      const armOf = new Map<Block, (typeof arms)[number]>();
+      succ.slice(0, -1).forEach((s, i) => {
+        let a = armOf.get(s.block);
+        if (!a) {
+          a = { entry: s.block, edge: s, values: [] };
+          armOf.set(s.block, a);
+          arms.push(a);
+        }
+        a.values.push(caseVals[i]);
+      });
+      // The blocks an arm could fall INTO. The default block counts only when it is a block of its
+      // own: when it IS the merge, "the default" is just where the switch ends, and an arm reaching
+      // it is a plain `break`.
+      const siblings = new Set<Block>(arms.map((a) => a.entry));
+      if (defEdge.block !== merge) {
+        siblings.add(defEdge.block);
+      }
+      // ONE emission order for the whole statement: the case arms in table order, then the default —
+      // which is exactly where C puts it. Adjacency is read off this array, so "falls into the next
+      // arm" needs no separate rule for a case that falls into the default (it is the arm after the
+      // last case, and legal C).
+      const emitOrder = [...arms, { entry: defEdge.block, edge: defEdge, values: null as number[] | null }];
+      // Each arm's switch-edge copies, computed ONCE and in emission order: `argAssignsFor` mints
+      // swap-cycle temp names, so calling it twice for one edge burns a temp number and changes the
+      // output (the same reason emitDoWhile reuses its `updates`).
+      const edgeCopies = emitOrder.map((a) => argAssignsFor(b, a.edge));
+      const bodies = emitOrder.map((a, i) => {
+        const exit = analyzeArmExit(a.entry, b, merge, siblings);
+        if (exit.kind === 'unstructurable') {
+          throw new StructureError(`cannot structure '${fn.name}': ${exit.why}`);
+        }
+        const ft = exit.kind === 'fallthrough';
+        const next = emitOrder[i + 1];
+        if (ft && next?.entry !== exit.to) {
+          throw new StructureError(
+            `cannot structure '${fn.name}': ${a.values ? `case ${a.values.join('/')}` : 'the default arm'} falls ` +
+              `through into an arm that is not the next one emitted — C fall-through only reaches the arm below`,
+          );
+        }
+        // The arm fallen INTO opens with its own switch-edge copies, which are how the dispatch hands
+        // it its block parameters. On the fall-through path those copies would RE-RUN and overwrite
+        // what the falling arm just computed (`case 0: v=7; case 1: v=5;` — the case-0 path calling
+        // with 5). They cannot simply be dropped either: entering that arm by its own case value
+        // needs them. Hoisting them above the switch is possible but not always safe (another arm may
+        // read the same name first), so this shape declines LOUD; recovering it is future work.
+        if (ft && edgeCopies[i + 1].length) {
+          throw new StructureError(
+            `cannot structure '${fn.name}': the case fallen into takes a value from the switch edge, ` +
+              `which the fall-through path would re-run`,
+          );
+        }
+        return {
+          // A falling-through arm stops AT its successor arm, which then emits that body once under
+          // its own labels; a closed arm runs to the merge as before.
+          body: [...edgeCopies[i], ...structureRegion(a.entry, ft ? exit.to : merge)],
+          fallsThrough: ft,
+        };
+      });
+      const outCases: SwitchCase[] = arms.map((a, i) => ({ values: a.values, ...bodies[i] }));
+      // An EMPTY default arm is not a default at all: it is where the switch ends, which is where
+      // an unmatched scrutinee goes anyway. Emitting the label with nothing under it says nothing
+      // and is not even valid C89 (a label needs a statement).
+      const defBody = bodies[bodies.length - 1].body;
       const sw: Stmt = {
         k: 'switch',
         scrutinee: expr(term.operands[0]),
         cases: outCases,
-        default: [...argAssignsFor(b, succ[succ.length - 1]), ...structureRegion(succ[succ.length - 1].block, merge)],
+        ...(defBody.length ? { default: defBody } : {}),
       };
       out.push(sw);
       if (merge && merge !== stop) {
@@ -2218,6 +2342,26 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         `cannot structure '${fn.name}': do-while condition or a post-loop value reads a pre-update loop variable`,
       );
     }
+    // The exit copies render AFTER the `dowhile` statement, but the analysis judged where each
+    // value they carry may inline as if the copies sat on the latch's terminator — INSIDE the loop.
+    // For a pure def that is only a naming question (the pre-update guard above covers the rest);
+    // for an EFFECTFUL one it moves the effect out of the loop: a call that ran once per iteration
+    // would render once, after it. Nothing can re-place it here — `materialize` was decided before
+    // emission — so decline LOUD rather than emit a plausible loop that calls the wrong number of
+    // times.
+    const movedEffect = exitArgs.find((v) => {
+      const d = defs.get(v);
+      return (
+        d && REPEATED_EFFECT.has(d.opcode) && dw.body.has(opBlock.get(d)!) && !materialize.has(d) && !varName.has(v)
+      );
+    });
+    if (movedEffect) {
+      const d = defs.get(movedEffect)!;
+      throw new StructureError(
+        `cannot structure '${fn.name}': a post-loop value inlines a '${d.opcode}' from inside the loop, ` +
+          `which would move that effect out of it`,
+      );
+    }
     dwActive.add(dw.header);
     // structure the header's own block up to the latch. Call structureBlock DIRECTLY (not
     // structureRegion): the header is already on `onStack` from the caller's structureRegion, so
@@ -2264,7 +2408,28 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   return {
     name: fn.name,
     params: entry.params.map((p, i) => ({ name: `a${i}`, type: p.type })),
-    locals: localNames.map((n) => ({ name: n, type: varType.get(n)! })),
+    locals: [
+      ...localNames.map((n) => ({ name: n, type: varType.get(n)! })),
+      // frame-local objects (laddr): declared with EXACTLY the access type the machine used —
+      // the frontend's frame-object audit proved all accesses agree, so this is a fact, not a guess
+      ...[
+        ...new Map(
+          fn.blocks
+            .flatMap((b) => b.ops)
+            .filter((op) => op.opcode === 'laddr')
+            .map((op) => [
+              laddrName.get(op)!,
+              {
+                name: laddrName.get(op)!,
+                type: T.int((op.attrs.width as number) * 8, op.attrs.signed as boolean),
+                // an ESCAPED address makes every store observable (the DMA hardware reads it);
+                // without volatile, gcc-2.9 deletes a store to a local nothing in-function reads
+                ...(op.attrs.volatile === true ? { volatile: true as const } : {}),
+              },
+            ]),
+        ).values(),
+      ],
+    ],
     ...(shapedGlobalTypes.size
       ? {
           globals: [...shapedGlobalTypes]

package/src/structure/switch-recover.ts

@@ -28,10 +28,23 @@ export interface SwitchRecoverDeps {
   structureRegion: (b: Block, stop: Block | null) => Stmt[];
 }
 
+/** Where ONE switch arm's region leaves it — the fact that decides whether the arm can be spelled
+ *  as C at all, and with or without a `break`.
+ *
+ *   - `break`        every path out of the arm reaches the switch's merge (or returns / loops
+ *                    inside the arm). The ordinary closed arm.
+ *   - `fallthrough`  every path out leaves into exactly ONE sibling arm's entry: C's fall-through.
+ *                    Only spellable when that sibling is the arm emitted NEXT (the caller checks
+ *                    emission adjacency — see the l3/ast.ts non-neutrality note).
+ *   - `unstructurable`  anything else: two different siblings, or a mix of "into a sibling" and
+ *                    "out to the merge". C needs a `goto` for those, so callers decline LOUD. */
+export type ArmExit = { kind: 'break' } | { kind: 'fallthrough'; to: Block } | { kind: 'unstructurable'; why: string };
+
 export interface SwitchRecovery {
   recognizeSwitch: (b: Block, stop: Block | null) => Stmt[] | null;
-  /** shared with the Regime-B (`switch_br`) path in structure.ts, which throws where A declines */
-  caseRegionReachesSibling: (targets: Set<Block>, b: Block, merge: Block | null) => boolean;
+  /** shared with the Regime-B (`switch_br`) path in structure.ts, which recovers the fall-through
+   *  this returns; Regime A only accepts `break` arms and otherwise declines to if-recovery. */
+  analyzeArmExit: (entry: Block, b: Block, merge: Block | null, siblings: Set<Block>) => ArmExit;
 }
 
 export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
@@ -198,31 +211,83 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     }
   };
 
-  // Can any case/default entry's region reach a SIBLING entry (switch fall-through)? Region =
-  // blocks strictly dominated by `b`, short of `merge`. Shared by Regime A (declines to
-  // if-recovery) and Regime B (throws — a jump-table has no fallback).
-  const caseRegionReachesSibling = (targets: Set<Block>, b: Block, merge: Block | null): boolean => {
-    const inRegion = (blk: Block) => blk !== merge && dom.get(blk)!.has(b);
-    for (const entry of targets) {
-      const rseen = new Set<Block>([entry]);
-      const q = [entry];
-      while (q.length) {
-        const cur = q.pop()!;
-        for (const s of successorsOf(cur)) {
-          if (s === entry) {
+  // Where does one arm's region LEAVE? Walk it from `entry`, never stepping THROUGH the merge or a
+  // sibling arm's entry, and classify what it steps INTO. `siblings` is every OTHER arm entry the
+  // caller can emit a `case`/`default` label for — the merge is deliberately not among them, so a
+  // switch whose default block IS the merge (agbcc's usual "the default just leaves") reads as an
+  // ordinary `break`, not as falling into the default.
+  //
+  // Region membership is `dom(blk) ∋ b` as before: a block NOT dominated by the switch is outside
+  // this switch's region and is not walked. It IS recorded as an escape, because an arm that can
+  // leave sideways does not fall into the next case — but only the fall-through verdict consults
+  // that, so no arm that used to be accepted as closed becomes a decline.
+  //
+  // A CONSEQUENCE, not a hole: a sibling reachable only THROUGH such a block is never seen, so the
+  // arm reads as closed and `structureRegion` walks into the sibling's blocks and emits them again
+  // under this arm. That is duplication, not a wrong dispatch — the same duplication the structurer
+  // already does for any tail two arms share, and how the case bodies agbcc tail-merged are put
+  // back. Costly for matching, correct to run.
+  const analyzeArmExit = (entry: Block, b: Block, merge: Block | null, siblings: Set<Block>): ArmExit => {
+    if (entry === merge) {
+      return { kind: 'break' }; // an empty arm (a table slot pointing straight at the switch's end)
+    }
+    const into = new Set<Block>(); // sibling entries this arm flows into
+    let toMerge = false,
+      escapes = false;
+    const seen = new Set<Block>([entry]);
+    const q = [entry];
+    while (q.length) {
+      const cur = q.pop()!;
+      for (const s of successorsOf(cur)) {
+        if (s === merge) {
+          toMerge = true;
+        } else if (s !== entry && siblings.has(s)) {
+          into.add(s);
+        } else if (s !== entry && !seen.has(s)) {
+          if (!dom.get(s)!.has(b)) {
+            escapes = true;
             continue;
           }
-          if (targets.has(s)) {
-            return true;
-          }
-          if (inRegion(s) && !rseen.has(s)) {
-            rseen.add(s);
-            q.push(s);
-          }
+          seen.add(s);
+          q.push(s);
         }
       }
     }
-    return false;
+    if (into.size === 0) {
+      return { kind: 'break' };
+    }
+    if (into.size === 1 && !toMerge && !escapes) {
+      return { kind: 'fallthrough', to: [...into][0] };
+    }
+    // Name what is actually missing. These three are different facts, and only the first is a shape
+    // C has no spelling for — the other two are asmlift's own limits, so say so rather than blame C.
+    const names = () => [...into].map((x) => `#${fn.blocks.indexOf(x)}`).join(', ');
+    if (into.size > 1) {
+      return {
+        kind: 'unstructurable',
+        why: `a case body reaches several sibling cases (${names()}) — C fall-through reaches only one, so this needs a goto`,
+      };
+    }
+    if (escapes) {
+      return {
+        kind: 'unstructurable',
+        why: `a case body reaches sibling case ${names()} on one path and, on another, a block the switch does not dominate`,
+      };
+    }
+    return {
+      kind: 'unstructurable',
+      // `case 0: if (c) { …; break; } /* fall through */ case 1:` is the C for this, and the reason
+      // asmlift cannot write it is its own: `{k:'break'}` is emitted only for the innermost LOOP
+      // (l3/ast.ts), never switch-scoped. That is the capability this shape is waiting on.
+      why: `a case body reaches sibling case ${names()} on one path and the end of the switch on another — a switch-scoped \`break\` inside a case body is not emitted yet`,
+    };
+  };
+
+  /** Every arm closed (`break`)? The precondition Regime A needs — it has a behaviourally identical
+   *  fallback (if-recovery), so it declines on anything else instead of recovering fall-through. */
+  const allArmsClosed = (targets: Set<Block>, b: Block, merge: Block | null): boolean => {
+    const siblings = new Set([...targets].filter((t) => t !== merge));
+    return [...siblings].every((t) => analyzeArmExit(t, b, merge, siblings).kind === 'break');
   };
 
   const recognizeSwitch = (b: Block, stop: Block | null): Stmt[] | null => {
@@ -385,11 +450,12 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     }
 
     // PRE2 (fall-through): only NON-fall-through switches are handled — decline if any case body
-    // can reach ANOTHER case body (or the default) while staying inside the region. (The SAME
-    // predicate serves the Regime-B path, which throws instead.)
+    // can reach ANOTHER case body (or a default that has its own block) while staying inside the
+    // region. (The SAME analysis serves the Regime-B path, which RECOVERS the adjacent-sibling
+    // case as C fall-through instead of declining; A has if-recovery to fall back on, B does not.)
     const merge = ipdom.get(b) ?? stop;
     const targets = new Set<Block>([...caseBlocks, ...(defaultBlk ? [defaultBlk] : [])]);
-    if (caseRegionReachesSibling(targets, b, merge)) {
+    if (!allArmsClosed(targets, b, merge)) {
       return null;
     }
 
@@ -412,11 +478,14 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
       body: structureRegion(blk, merge),
       fallsThrough: false,
     }));
+    // An empty default arm is not a default (see the Regime-B note in structure.ts): the label
+    // would carry no statement, which says nothing and is not valid C89.
+    const defBody = defaultBlk ? structureRegion(defaultBlk, merge) : [];
     const sw: Stmt = {
       k: 'switch',
       scrutinee: scrutExpr,
       cases: outCases,
-      ...(defaultBlk ? { default: structureRegion(defaultBlk, merge) } : {}),
+      ...(defBody.length ? { default: defBody } : {}),
     };
     const out: Stmt[] = [sw];
     if (merge && merge !== stop) {
@@ -424,5 +493,5 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     }
     return out;
   };
-  return { recognizeSwitch, caseRegionReachesSibling };
+  return { recognizeSwitch, analyzeArmExit };
 }