@asmlift/core 0.5.0 → 0.6.0

package/src/structure/structure.ts

@@ -4,11 +4,11 @@
 //  1. SSA destruction WITH COALESCING — a merge block-argument that already carries a
 //     variable's value on one path is coalesced to that variable, so only the
 //     non-identity paths emit an assignment (reproducing agbcc's register allocation:
+//     the clamp0 diamond becomes `if (x < 0) x = 0; return x;` rather than a temp copy).
 //     NOTE the coupled INVERSE: l3/regspell.ts re-derives the UN-coalesced copy-carrying
 //     spelling as a ranked candidate — its R1 template matches THIS pass's diamond output
 //     shape, so a change to coalescing here can silently stop that lever firing (the
 //     matching-suite regspell gate is what makes the coupling loud).
-//     the clamp0 diamond becomes `if (x < 0) x = 0; return x;` rather than a temp copy).
 //     Coalescing is INTERFERENCE-CHECKED against per-block value liveness, and
 //     inline-at-use rendering carries an effect-ordering model: a call/load that cannot
 //     soundly render at its use is MATERIALIZED as a named temp at its own program
@@ -32,34 +32,63 @@
 // Scope: reducible single-latch natural loops — GUARDED self-loop `while` (the guard-fusion
 // un-rotation), UNGUARDED self-loop `do-while` (single block, header === latch), test-at-top
 // `while`, bottom-test `do-while`, PROPERLY-nested loops, in-body `break`/early-`return`,
-// comparison-tree and jump-table `switch`. Still DECLINED (loud StructureError, never wrong
-// code): multi-latch headers, irreducible/overlapping loops, conditional `continue`, a `break`
-// whose exit copies would clobber, switch fall-through, and mixed-entry self-loops (a guarded
-// header also entered by a plain br).
-import { type GlobalCell, globalCellOf, mayWriteGlobal } from '../ir/alias';
-import { Block, Fn, Op, Value, defOpMap, successorsOf } from '../ir/core';
-import { EFFECTFUL_OPS } from '../ir/opcodes';
+// comparison-tree and jump-table `switch`, and a switch arm that FALLS THROUGH into the next one
+// (both regimes — see `ArmExit` in switch-recover.ts). Still DECLINED (loud StructureError, never
+// wrong code): multi-latch headers, irreducible/overlapping loops, conditional `continue`, a
+// `break` whose exit copies would clobber, and mixed-entry self-loops (a guarded header also
+// entered by a plain br). Fall-through carries two REFUSALS of its own rather than a decline: a
+// target language whose `case` cannot fall through (`spellSwitchFallthrough` false) sends Regime A
+// back to if-recovery, and arms that do not linearize into one chain — two arms falling into the
+// same sibling, or a fall into the `default:` — refuse in `chainArms`, which answers null.
+import { Block, Fn, Op, Successor, Value, defOpMap, dominators, mergeClasses, successorsOf } from '../ir/core';
+import { CAST_WIDTHS, EFFECTFUL_OPS } from '../ir/opcodes';
 import { type IrType, T, scalarTypeForAccess, typeEquals } from '../ir/types';
-import { BinOp, Expr, SFn, Stmt, SwitchCase, exprChildren, gapReasonFor, mapExprChildren, negateCond } from '../l3/ast';
-import { exprCType, ptrElemBytes } from '../l3/typing';
+import {
+  BinOp,
+  Expr,
+  SFn,
+  Stmt,
+  SwitchCase,
+  exprChildren,
+  exprHasEffect,
+  gapReasonFor,
+  mapExprChildren,
+  mapStmtExprs,
+  negateCond,
+  stmtChildren,
+  walkExprs,
+} from '../l3/ast';
+import { type Gate, firstRejection } from '../l3/gates';
+import { exprCType, provablyNonNegative, ptrElemBytes, renderedIntSignedness } from '../l3/typing';
 import { returnType } from '../raise/recover';
 import { collectStructs } from '../raise/structs';
 import {
   type DeclaredField,
   type SymbolInfo,
   type SymbolStructField,
-  arrayInnerExtents,
   declaredFields,
   isArrayField,
   isBitfieldField,
+  isPtrField,
   isScalarCellSize,
   pointeeFields,
   scalarCellType,
 } from '../symbols';
 import { analyze } from './analysis';
-import { makeLoopHazards, updateWriteSet } from './hazards';
-import { analyzeLoops, dominators } from './loops';
-import { makeSwitchRecovery } from './switch-recover';
+import { makeBitfieldSpelling } from './bitfields';
+import {
+  addOffset,
+  addrIn,
+  bareArrayLead,
+  declaredSubscripts,
+  elementIndex,
+  globalByteBase,
+  globalOf,
+} from './globalaccess';
+import { makeLoopHazards, sunkCopyOverDroppedUndef, updateWriteSet } from './hazards';
+import { type NaturalLoop, analyzeLoops } from './loops';
+import { type NameMerge, coalesceNames } from './namecoalesce';
+import { type ArmExit, makeSwitchRecovery } from './switch-recover';
 
 // Lower a constant-offset memory access to its lvalue/rvalue Expr. If the base was recovered as a
 // struct pointer (raise/structs.ts), the byte offset resolves to a NAMED field (`base->field_<off>`);
@@ -73,101 +102,14 @@ import { makeSwitchRecovery } from './switch-recover';
 // TODAY — carrying the struct name (resolved against SFn.structs) is the same move as width and
 // the named follow-up; until then no backend pays a tax for the tree cast (Pascal loud-fails
 // `field` regardless, C++ falls through its leaf hook to the shared C spelling).
-// `&gSym`, possibly wearing the value-context integer cast the additive lowering adds
-// (`(u32)&gSym` — see lowerDef's addr-intify): both spell the same link-time constant, so the
-// fold rules match through the cast and every access that CAN spell a named element still does.
-// WIDTH 32 ONLY — a NARROWING cast (`(u8)&gSym`, from a zext/sext lowering) is a different
-// VALUE (`addr & 0xFF`), and folding through it would read the named global at a wrong address
-// (the adversarial round's probe: `*(u8*)(u8)&gSym` must keep its truncation, never become
-// `*(u8*)&gSym` — let alone a confidently-named `gSym.field`).
-function addrIn(e: Expr): Extract<Expr, { k: 'addr' }> | null {
-  if (e.k === 'addr') {
-    return e;
-  }
-  if (e.k === 'cast' && e.to.kind === 'int' && e.to.width === 32 && e.e.k === 'addr') {
-    return e.e;
-  }
-  return null;
-}
 
-// If `e` is a global address `&gSym` (optionally `+ index`), return the global name and the
-// element index (byte residual divided by the access width). `&gSym` alone → idx const 0;
-// `&gSym + i` → idx `i / width` (exact division only — a non-multiple residual is a mid-element
-// access this whole-global spelling can't express, so it declines to null and the caller casts).
-function globalOf(e: Expr, width: number): { name: string; idx: Expr } | null {
-  const top = addrIn(e);
-  if (top) {
-    return { name: top.name, idx: { k: 'const', value: 0 } };
-  }
-  if (e.k === 'bin' && e.op === '+') {
-    for (const [side, other] of [
-      [e.l, e.r],
-      [e.r, e.l],
-    ] as const) {
-      const addrSide = addrIn(side);
-      if (addrSide) {
-        const idx = elementIndex(other, width);
-        return idx ? { name: addrSide.name, idx } : null;
-      }
-    }
-  }
-  return null;
-}
-
-// THE one gate on the BARE-NAME array-global spelling (`gSym[i]` rather than `((T *)&gSym)[i]`),
-// shared by the constant-offset and variable-index access paths so the two cannot disagree.
-// Returns the `index` node's `lead` fragment when the bare form is spellable, or null to fall
-// through to the always-valid `&gSym` cast form.
-//
-// Two facts are required, not one. The element WIDTH must match, as it always has. And the RANK
-// must be SPELLABLE, because one subscript reaches an element only on a rank-1 array: on `u16
-// g[4][0x400]`, `g[i]` is a ROW. Against the project's own header that is usually a type error,
-// but where the row address flows into an integer context it is merely a warning and the emitted C
-// then addresses a different object than the asm did — silently.
-//
-// A rank > 1 pins the leading dimensions at 0 and puts the whole flat element index in the last
-// subscript (`g[0][i]`) — the same address arithmetic, and the idiom decomp sources themselves use
-// when the split is not observable in the asm either (`gBgTilemapBufs[0][…]` in kleod,
-// `gNatureStatTable[nature][…]` in pokeemerald). A rank the map states but cannot spell (an unknown
-// inner extent) gets no bare form at all; `((T *)&gSym)[i]` is byte-identical and valid under ANY
-// declaration, which is why it is the safe fallback. See symbols.ts arrayInnerExtents for why an
-// ABSENT rank is read as 1 rather than as unknown.
-function bareArrayLead(si: SymbolInfo, width: number): { lead?: number[] } | null {
-  if (si.shape !== 'array' || si.elemSize !== width) {
-    return null;
-  }
-  const inner = arrayInnerExtents(si);
-  return inner === null ? null : inner.length === 0 ? {} : { lead: new Array<number>(inner.length).fill(0) };
-}
-
-// A BYTE residual read as an ELEMENT index of `elemSize`-wide elements, or null when it is not one
-// — the residual then addresses mid-element and no whole-element spelling can express it, so the
-// caller falls through to the honest cast forms. THE one copy of the rule, indexing the
-// `&gSym`-based array spelling: width 1 → the byte residual IS the index; wider → a constant
-// residual must divide exactly, and a non-constant one must already be element-scaled
-// (`i * elemSize` / `i << log2(elemSize)`), which is exactly what the asm's own index scaling
-// produced.
-function elementIndex(residual: Expr, elemSize: number): Expr | null {
-  if (elemSize === 1) {
-    return residual;
-  }
-  if (residual.k === 'const') {
-    return residual.value % elemSize === 0 ? { k: 'const', value: residual.value / elemSize } : null;
-  }
-  if (residual.k === 'bin' && (residual.op === '*' || residual.op === '<<')) {
-    const factor =
-      residual.op === '<<'
-        ? residual.r.k === 'const'
-          ? 1 << residual.r.value
-          : 0
-        : residual.r.k === 'const'
-          ? residual.r.value
-          : 0;
-    if (factor === elemSize) {
-      return residual.l;
-    }
-  }
-  return null;
+/** "What does this project know about the global named `n`" — the union of the project's own
+ *  symbol map and the array shapes derived from this function's assembly, asked map-first. Only
+ *  ever probed by name (never iterated or copied), which is what lets the union be a lookup rather
+ *  than a merged Map. */
+interface SymbolLookup {
+  get(name: string): SymbolInfo | undefined;
+  has(name: string): boolean;
 }
 
 /** The symbol-map rendering context threaded into memAccess/arrayAccess: shape facts per
@@ -176,6 +118,19 @@ function elementIndex(residual: Expr, elemSize: number): Expr | null {
 interface SymRenderCtx {
   info(name: string): SymbolInfo | undefined;
   noteGlobal(name: string, type: IrType): void;
+  /** may {@link ptrMemberElement} spell a whole-element subscript through a pointer member — the
+   *  `/no-ptr-elem` arm's OFF switch, off the `spellPtrMemberElements` structure option. */
+  ptrElements: boolean;
+  /** may {@link declaredSubscripts} recover a multidimensional global's declared subscripts out of
+   *  the byte residual — the `/flat-rank` arm's OFF switch, off the `spellDeclaredSubscripts`
+   *  structure option. */
+  declRank: boolean;
+  /** The members a symbol's declaration seats — a struct global's own, or a pointer global's
+   *  pointee's — MEMOIZED per symbol. `declaredFields` validates every member and returns a fresh
+   *  sorted copy on every call, and `isPtrValue` asks it for both operands of every binary node
+   *  lowered, so an uncached lookup is an O(n log n) allocation on a hot path — inside a
+   *  `structure()` a ranked run repeats once per candidate, 17,856 times on the largest fan. */
+  fieldsOf(name: string): DeclaredField[] | null;
 }
 
 // ── interior spelling through a POINTER-shaped global ────────────────────────────────────────
@@ -280,6 +235,161 @@ function memberQualsAllow(f: SymbolStructField, containerConst: boolean | undefi
   return !(isStore && (f.const || containerConst));
 }
 
+/** The map member a `field` node NAMES, or null when it names none — THE one resolver for "what
+ *  does the declaration say about this member", for rules that must reason about a member's type
+ *  after the access rules have already spelled it. Both named spellings resolve, through the same
+ *  shared gate their spelling passed: `gSym.member` off a struct global's {@link declaredFields},
+ *  `gPtr->member` off the pointee's ({@link pointeeFields}). A synthesized `field_K` — the
+ *  recovered-struct spelling, which no map declares — resolves to null, and so does any base that
+ *  is not a map-shaped global, which is what makes every caller refuse rather than guess.
+ *
+ *  The pointee arm reaches only what the MAP lets it: `pointeeAccess` gates every `gPtr->member`
+ *  spelling on `spellsAccessType(f.signed, …)`, so a pointer field declaring no signedness — which
+ *  is every one in the corpus's vendored maps — is never named, and a pointer read one indirection
+ *  down spells `((s32 *)gQ)[1]`. That is a fact about those maps, not about this code: `SymbolMap`
+ *  is a caller-supplied input, and one field flips it (`signed: true` on a 4-byte pointer member
+ *  of a pointee yields `(u8 *)gQ->pInner`, cast and all, pinned in pointer-members.test.ts). So
+ *  the arm is live and tested, and the byte-arithmetic rule that reads this answer is correct for
+ *  it — where resolving a pointee member to null would reopen the double-scaling hole silently. */
+function declaredMemberOf(x: Expr, sym: SymRenderCtx | undefined): DeclaredField | null {
+  if (x.k !== 'field' || x.base.k !== 'var' || sym === undefined) {
+    return null;
+  }
+  return sym.fieldsOf(x.base.name)?.find((f) => f.name === x.name) ?? null;
+}
+
+/** The map member a `field` node names when the declaration makes it a POINTER — {@link
+ *  isPtrField} being the shared two-fact test, so this and the synthesized declaration cannot
+ *  disagree about what a member is. */
+function ptrMemberDecl(x: Expr, sym: SymRenderCtx | undefined): DeclaredField | null {
+  const f = declaredMemberOf(x, sym);
+  return f !== null && isPtrField(f) ? f : null;
+}
+
+/** A map-declared POINTER MEMBER as the additive lowering renders its VALUE: the bare `gSym.pBuf`,
+ *  or that member wearing the byte-pointer / u32 cast the arithmetic guard adds. Both denote the
+ *  same address and add BYTES to it, so both fold here; a cast to any OTHER pointer type is not
+ *  looked through — it would re-scale everything added after it. */
+function ptrMemberValue(x: Expr, sym: SymRenderCtx): { expr: Expr; field: DeclaredField } | null {
+  let bare = x;
+  if (x.k === 'cast') {
+    const t = x.to;
+    const isBytePtr = t.kind === 'ptr' && t.to.kind === 'int' && t.to.width === 8;
+    if (!isBytePtr && !(t.kind === 'int' && t.width === 32)) {
+      return null;
+    }
+    bare = x.e;
+  }
+  const f = ptrMemberDecl(bare, sym);
+  return f !== null ? { expr: bare, field: f } : null;
+}
+
+/** Decompose an access base into "the VALUE of a map-declared POINTER MEMBER + a constant byte
+ *  offset + at most ONE variable term" — the same decomposition {@link ptrGlobalBase} makes one
+ *  indirection up, declining on the same conditions (two variable terms, no such member, a
+ *  non-`+` operator), because only a single residual can be read as one element index. */
+interface PtrMemberBase {
+  value: Expr;
+  field: DeclaredField;
+  byte: number;
+  idx: Expr | null;
+}
+function ptrMemberBase(e: Expr, sym: SymRenderCtx): PtrMemberBase | null {
+  const hits: { expr: Expr; field: DeclaredField }[] = [];
+  let byte = 0;
+  let idx: Expr | null = null;
+  let ok = true;
+  const visit = (x: Expr): void => {
+    if (!ok) {
+      return;
+    }
+    if (x.k === 'bin' && x.op === '+') {
+      visit(x.l);
+      visit(x.r);
+      return;
+    }
+    const m = hits.length === 0 ? ptrMemberValue(x, sym) : null;
+    if (m !== null) {
+      hits.push(m);
+      return;
+    }
+    if (x.k === 'const') {
+      byte += x.value;
+      return;
+    }
+    if (idx !== null) {
+      ok = false;
+      return;
+    }
+    idx = x;
+  };
+  visit(e);
+  return ok && hits.length === 1 ? { value: hits[0].expr, field: hits[0].field, byte, idx } : null;
+}
+
+/** `gSym.pBuf[i]` for an access through a POINTER MEMBER's VALUE — the spelling the project's own
+ *  header makes available, where the byte arithmetic it replaces is the same address written the
+ *  machine's way. The DECLARATION is what licenses it: `pointeeSize` says how wide an element is,
+ *  so an access of exactly that width at a whole multiple of it IS the i-th element, and the
+ *  reinterpret cast the backend adds strides by the same amount under any header.
+ *
+ *  `carried` is an ELEMENT index the access already holds (an `aload`'s own index); everything
+ *  else — a byte residual inside the base, the instruction's displacement `off` — is converted and
+ *  summed into the one subscript, which is where the source put it.
+ *
+ *  REFUSALS, and they are of TWO kinds.
+ *
+ *  ADDRESS refusals — no whole-element spelling expresses the address at all: a variable residual
+ *  that is not element-scaled, and a constant the element width does not divide. Both address
+ *  MID-ELEMENT, so they fall through to the honest byte forms and must.
+ *
+ *  REACH refusals — the address IS expressible and this rule declines anyway: an access of a
+ *  DIFFERENT width than the declared element, and a sub-word access whose signedness the declared
+ *  pointee does not carry. Neither is soundness. `exprCType` types a `field` node `undefined` (it
+ *  types params and locals), so `derefStrideOk` is false for every base this rule produces and the
+ *  backend ALWAYS emits the reinterpret cast — `((u16 *)gB.pMap)[i + 157]`, cast included, is what
+ *  the accepted case spells. `((s32 *)gB.pMap)[i + K]` would be the same address and the same fill
+ *  as the byte form those two clauses fall back to, and the byte form the width clause produces
+ *  already spells `((s32 *)…)[157]` itself. What these two clauses encode is a REACH judgement — the
+ *  map says this pointer addresses an array of THESE, so the source probably wrote a subscript of
+ *  them — and a declaration-shaped access is where that judgement is most likely right. On a
+ *  STORE the signedness clause has no premise at all (a store extends nothing), so it withholds
+ *  the spelling from every `s8 *` / `s16 *` member store; that is left in place deliberately
+ *  rather than widened, because this rule is not byte-neutral (see `spellPtrMemberElements`) and
+ *  widening a non-neutral spelling's reach is a separate question a row has to ask.
+ *
+ *  And the whole rule refuses when `/no-ptr-elem` turns it off — the axis, not a preference. */
+function ptrMemberElement(
+  baseExpr: Expr,
+  carried: Expr | null,
+  off: number,
+  width: number,
+  signed: boolean,
+  sym: SymRenderCtx,
+): Extract<Expr, { k: 'index' }> | null {
+  if (!sym.ptrElements) {
+    return null;
+  }
+  const pm = ptrMemberBase(baseExpr, sym);
+  if (!pm || pm.field.pointeeSize !== width || (width < 4 && (pm.field.pointeeSigned ?? false) !== signed)) {
+    return null;
+  }
+  const varIdx = pm.idx === null ? null : elementIndex(pm.idx, width); // THE one copy of that rule
+  const total = pm.byte + off;
+  if ((pm.idx !== null && varIdx === null) || total % width !== 0) {
+    return null;
+  }
+  // Variable terms first, constant last — the `idxVal + off / width` order every other indexed
+  // spelling in this file uses, and the one the source's own subscript is written in.
+  const terms = [varIdx, carried].filter((t): t is Expr => t !== null);
+  const k = total / width;
+  if (k !== 0 || terms.length === 0) {
+    terms.push({ k: 'const', value: k });
+  }
+  const idx = terms.reduce((l, r) => ({ k: 'bin', op: '+', l, r }));
+  return { k: 'index', base: pm.value, idx, width, signed };
+}
+
 // WHY THERE IS NO INDEXED `gPtr->arr[i]` SPELLING.
 //
 // Naming a member is only allowed where it is byte-identical to the cast form it replaces, and
@@ -389,6 +499,12 @@ function memAccess(
   // named field (`gSym.field` — the source spelling a folded literal can never match); an ARRAY
   // global indexes its BARE name (`gSym[i]`, see below). Exact field match only (offset AND
   // width) — anything else falls through to the honest cast forms, never a guessed field.
+  // The constant offset this access reached through the instruction's MEMORY OPERAND. The two
+  // facts are separate at L2 — `off` is the load/store's own immediate, any addend the address
+  // carried is already inside `baseExpr` — and folding them into one subscript below
+  // (`idxVal + off / width`) is what makes the two indistinguishable at L3, so the displacement
+  // is recorded before the fold destroys it (see the `operandOff` note in l3/ast.ts).
+  const fromOperand = off !== 0 ? ({ operandOff: off } as const) : {};
   if (sym) {
     const gb = globalConstByte(baseExpr, off);
     const si = gb ? sym.info(gb.name) : undefined;
@@ -417,6 +533,31 @@ function memAccess(
         return spelled;
       }
     }
+    // …and one step further out: an access through a POINTER MEMBER's value is an ELEMENT of the
+    // buffer that member points AT (see ptrMemberElement).
+    const elem = ptrMemberElement(baseExpr, null, off, width, signed, sym);
+    if (elem) {
+      return { ...elem, ...fromOperand };
+    }
+  }
+  // …and the MULTIDIMENSIONAL bare-name spelling, which needs the byte terms globalOf's division
+  // into elements has already merged: `g[r][i]`, where a term at the declared ROW stride is `r`.
+  // Tried before the flat spellings because those cannot express a recovered row at all — and off
+  // under `/flat-rank`, which is what puts those flat spellings back in the fan for the differ.
+  const gbb = sym?.declRank ? globalByteBase(baseExpr) : null;
+  const siMulti = gbb ? sym!.info(gbb.name) : undefined;
+  const multi = siMulti ? declaredSubscripts(siMulti, gbb!.residual, width, signed) : null;
+  if (multi) {
+    sym!.noteGlobal(gbb!.name, T.ptr(T.int(width * 8, siMulti!.elemSigned ?? false)));
+    return {
+      k: 'index',
+      base: { k: 'var', name: gbb!.name },
+      idx: addOffset(multi.idx, off / width),
+      width,
+      signed,
+      lead: multi.lead,
+      ...fromOperand,
+    };
   }
   const g = globalOf(baseExpr, width);
   if (g) {
@@ -430,22 +571,17 @@ function memAccess(
     if (off === 0 && idxVal.k === 'const' && idxVal.value === 0 && scalarGlobals.has(g.name)) {
       return { k: 'var', name: g.name };
     }
-    const idx: Expr =
-      off === 0
-        ? idxVal
-        : idxVal.k === 'const'
-          ? { k: 'const', value: idxVal.value + off / width }
-          : { k: 'bin', op: '+', l: idxVal, r: { k: 'const', value: off / width } };
+    const idx = addOffset(idxVal, off / width);
     // ARRAY-declared global (symbol map): index the bare name — `gSym[i]`, the spelling the
     // dogfood proved agbcc needs for ROM tables — with the element type registered in the env
     // so the stride check passes and no cast is added. Element-width match only.
     const siArr = sym?.info(g.name);
-    const lead = siArr === undefined ? null : bareArrayLead(siArr, width);
+    const lead = siArr === undefined ? null : bareArrayLead(siArr, width, signed);
     if (lead !== null) {
       sym!.noteGlobal(g.name, T.ptr(T.int(width * 8, siArr!.elemSigned ?? false)));
-      return { k: 'index', base: { k: 'var', name: g.name }, idx, width, signed, ...lead };
+      return { k: 'index', base: { k: 'var', name: g.name }, idx, width, signed, ...lead, ...fromOperand };
     }
-    return { k: 'index', base: { k: 'addr', name: g.name }, idx, width, signed };
+    return { k: 'index', base: { k: 'addr', name: g.name }, idx, width, signed, ...fromOperand };
   }
   const bt = base.type;
   if (bt.kind === 'ptr' && bt.to.kind === 'struct') {
@@ -457,12 +593,14 @@ function memAccess(
     const ok = rt?.kind === 'ptr' && rt.to.kind === 'struct' && rt.to.name === bt.to.name && baseExpr.k !== 'index';
     return { k: 'field', base: ok ? baseExpr : { k: 'cast', to: bt, e: baseExpr }, name: `field_${off}` };
   }
-  return { k: 'index', base: baseExpr, idx: { k: 'const', value: off / width }, width, signed };
+  return { k: 'index', base: baseExpr, idx: { k: 'const', value: off / width }, width, signed, ...fromOperand };
 }
 
-// A variable-index array access `base[index]`, or `base[index].field_K` when a `fieldOff` marks an
-// array-of-STRUCT element (raise/struct-arrays.ts). The `.field` on an array element prints
-// with `.` (the printer decides dot-vs-arrow from the base being an `index` node).
+// A variable-index array access `base[index]`; `base[index].field_K` when a `fieldOff` marks an
+// array-of-STRUCT element (raise/struct-arrays.ts); `base->field_K[index]` when a `memberOff` marks
+// an array MEMBER of a struct (raise/memberarrays.ts). The `.field` on an array element prints
+// with `.` (the printer decides dot-vs-arrow from the base being an `index` node); a member array's
+// own `field` base is a pointer, so it prints with `->`.
 //
 // Scalar path: a width-carrying `index` node, no cast — the backend legalizes (see memAccess).
 // Struct-array path: like memAccess's struct path, the recovered struct pointer type is an L2
@@ -475,18 +613,49 @@ function arrayAccess(
   baseExpr: Expr,
   idxExpr: Expr,
   fieldOff: number | undefined,
+  memberOff: number | undefined,
   elemSize: number,
   signed: boolean,
   ctype: (e: Expr) => IrType | undefined,
   sym?: SymRenderCtx,
 ): Expr {
+  // An indexed access through a POINTER MEMBER's value is an ELEMENT of what it points at, exactly
+  // as in memAccess — the index the aload already carries is the subscript, and any byte residual
+  // in the base is converted and summed into it. A fieldOff/memberOff access selects an interior
+  // of a STRUCT element instead, which this spelling has no place to put, so it is left alone.
+  if (sym && fieldOff === undefined && memberOff === undefined) {
+    const elem = ptrMemberElement(baseExpr, idxExpr, 0, elemSize, signed, sym);
+    if (elem) {
+      return elem;
+    }
+  }
   // A variable-index access off a global's address indexes the ADDRESS `&gSym` (the cast form
   // `((T *)&gSym)[i]` — valid for a struct global too, unlike casting the bare value). A
-  // struct-array-of-globals (fieldOff) through `&gSym` is out of scope — fall through.
-  if (baseExpr.k === 'addr' && fieldOff === undefined) {
+  // struct-array-of-globals (fieldOff) or a member array (memberOff) through `&gSym` falls through:
+  // this spelling has no place to put the constant offset, so taking it would DROP the member and
+  // address the wrong bytes.
+  if (baseExpr.k === 'addr' && fieldOff === undefined && memberOff === undefined) {
     // ARRAY-declared global (symbol map): the bare-name spelling, same rule as memAccess.
     const si = sym?.info(baseExpr.name);
-    const lead = si === undefined ? null : bareArrayLead(si, elemSize);
+    // NO declared-subscript recovery here, and the reason is the evidence, not the shape. The
+    // index reaching this spelling is already in ELEMENTS — the asm scaled the whole sum ONCE, at
+    // the end — and that single scale is what both candidate sources reduce to, so the term at the
+    // row's stride in elements is no longer evidence that the source named the row. Compiled, with
+    // the klonoa checkout's own agbcc command line:
+    //
+    //   u16 g[4][0x400] — a POWER-OF-TWO row stride: `g[a][b]` is `lsl #0xb` + `lsl #0x1` added
+    //     (the SEPARATE terms memAccess reads), `g[0][(a<<10)+b]` is `lsl #0xa; add; lsl #0x1`.
+    //     DIFFERENT bytes — so the single-scale shape that arrives here is the FLAT spelling's own
+    //     codegen, and recovering `g[a][b]` out of it emits a source that does not reproduce the
+    //     input asm.
+    //   u32 g[6][9] — a NON-power-of-two row stride: `g[a][b]` and `g[0][a*9+b]` are BYTE-
+    //     IDENTICAL, because agbcc reassociates `(a*36)+(b*4)` into `((a*9)+b)*4` itself. Nothing
+    //     referees the choice, which is the same reason `scaledBy` refuses a CONSTANT row term.
+    //
+    // Both cases say decline: in the first the evidence points the other way, in the second there
+    // is none. The recovery therefore lives on the byte residual alone (memAccess), where the two
+    // spellings are still distinguishable. Pinned by matching/array-rank-axis.test.ts.
+    const lead = si === undefined ? null : bareArrayLead(si, elemSize, signed);
     if (lead !== null) {
       sym!.noteGlobal(baseExpr.name, T.ptr(T.int(elemSize * 8, si!.elemSigned ?? false)));
       return { k: 'index', base: { k: 'var', name: baseExpr.name }, idx: idxExpr, width: elemSize, signed, ...lead };
@@ -494,6 +663,31 @@ function arrayAccess(
     return { k: 'index', base: baseExpr, idx: idxExpr, width: elemSize, signed };
   }
   const bt = base.type;
+  // The member-array spelling: the constant offset selects a MEMBER and the index strides inside
+  // it. Same cast rule as memAccess's struct path — the recovered struct-pointer type is an L2 fact
+  // the AST cannot carry, so a base that does not render as THAT struct pointer is cast here.
+  if (memberOff !== undefined) {
+    // Both offsets on one access is `b->field_K[i].field_J` — an array of STRUCTS at a member
+    // offset, which raise/memberarrays.ts declares as an array of scalars and its `claimed-access`
+    // gate refuses. Spelling it through either offset alone addresses the wrong bytes, so the
+    // unreachable case declines loudly rather than dropping one.
+    if (fieldOff !== undefined) {
+      throw new StructureError(
+        `an array access carries both a member offset (${memberOff}) and a field offset (${fieldOff})`,
+      );
+    }
+    const structTo = bt.kind === 'ptr' && bt.to.kind === 'struct' ? bt.to : null;
+    const rt = ctype(baseExpr);
+    const ok = rt?.kind === 'ptr' && rt.to.kind === 'struct' && rt.to.name === structTo?.name && baseExpr.k !== 'index';
+    const b = ok || structTo === null ? baseExpr : { k: 'cast' as const, to: T.ptr(structTo), e: baseExpr };
+    return {
+      k: 'index',
+      base: { k: 'field', base: b, name: `field_${memberOff}` },
+      idx: idxExpr,
+      width: elemSize,
+      signed,
+    };
+  }
   if (fieldOff !== undefined) {
     const structTo = bt.kind === 'ptr' && bt.to.kind === 'struct' ? bt.to : null;
     const rt = ctype(baseExpr);
@@ -553,9 +747,11 @@ const ARITH_TO_BIN: Record<string, BinOp> = {
   sub: '-',
   mul: '*',
   sdiv: '/',
-  udiv: '/',
+  // the UNSIGNED quotient/remainder — the C backend spells them `/`/`%` over an operand it casts
+  // unsigned (l3/ast.ts BinOp, backend/cfamily.ts C_SPELLING)
+  udiv: '/u',
   smod: '%',
-  umod: '%',
+  umod: '%u',
   or: '|',
   and: '&',
   xor: '^',
@@ -566,6 +762,10 @@ const ARITH_TO_BIN: Record<string, BinOp> = {
   logic_or: '||', // short-circuit connectives (raise/shortcircuit.ts)
 };
 
+// The operators whose operand order the machine does not fix — candidates for the def-order
+// re-spelling in lowerDef. `&&`/`||` are excluded: short-circuit order IS semantics.
+const COMMUTATIVE_BIN: ReadonlySet<BinOp> = new Set(['+', '*', '&', '|', '^']);
+
 // Recovered info for a self-loop header: its exit block and the per-parameter back-edge
 // arg it feeds (the value on the header→header edge). The back-edge arg is the "next"
 // value of the phi; mapping it back to the phi turns the latch test into the while test.
@@ -573,6 +773,21 @@ interface LoopInfo {
   header: Block;
   exit: Block;
   backArgOfParam: Value[]; // index-aligned with header.params
+  /** The PURE forwarding block between the guard and the header, when the compiler's own
+   *  loop-invariant motion parked computations there (`mov r3,#0x80; lsl r3,#24` feeding the
+   *  latch test). Its defs render inline wherever the loop reads them; the block itself is never
+   *  structured — the guard's inits come from ITS edge into the header instead. */
+  preheader?: Block;
+}
+
+// One early-`return` exit out of a loop body, and the blocks of it the loop emits inside its body
+// (`earlyReturnArm` decides which). Per-EDGE rather than flattened into per-loop sets: ownership is
+// decided against `from`, so a second edge into the same target is a separate question. `owned` has
+// one reader, `emitDoWhile` — a `while` hoists no update, so it has no pre-update reads to exempt.
+interface LoopArm {
+  from: Block;
+  to: Block;
+  owned: Set<Block>;
 }
 
 // A test-at-top multi-block `while`. The header is a pure test whose cond_br enters `bodyEntry`
@@ -585,6 +800,7 @@ interface WhileLoopInfo {
   latch: Block; // the single block with the back-edge to header (its args = the update)
   forwardPreds: Block[]; // header preds outside the loop body (the entry/init side)
   body: Set<Block>; // the pure natural-loop body (for in-body vs exit classification)
+  arms: LoopArm[]; // the early-`return` exits out of the body (`earlyReturnArm`)
 }
 
 // Opcodes whose NUMBER OF EXECUTIONS is observable. Moving one of these out of a loop changes what
@@ -594,6 +810,74 @@ interface WhileLoopInfo {
 // (structure/analysis.ts) already proves before it lets one inline at all.
 const REPEATED_EFFECT = new Set(['call', 'opaque']);
 
+/** No evidence about where this copy goes — NOT "written before everything". A destination the
+ *  predecessor never wrote is an argument passing through, and both orders put those first, so the
+ *  record answers no question the assembly put to it. Priced where the sort runs. */
+const NO_RECORD = -1;
+/** A MEASURED predecessor that recorded no destination of this edge — it wrote registers, none of
+ *  them a key this edge copies. Distinct from an UNMEASURED pred, which has no record at all and
+ *  falls back to the def-position proxy. */
+const NO_WRITTEN_DESTINATIONS: ReadonlyMap<Value, number> = new Map<Value, number>();
+
+/** Does the write-order record order some edge's copies differently from the def-position proxy?
+ *  rank.ts's enumeration gate for `/copy-defpos`: where the two orders agree, the sibling is the
+ *  same tree and the fan does not grow.
+ *
+ *  A SUPERSET of the real sort, on purpose and in the safe direction — and the direction only
+ *  holds because rank asks this of the SAME fn it then structures (a `variantGate`, evaluated on
+ *  the variant's own fully-raised fn). Two gaps remain, both of which only say YES where the sort
+ *  says nothing: `keepSlot`/`suppressedArgs` drop copies this still counts, and this asks of every
+ *  edge where `preferDefPosCopyOrder` reorders only the acyclic ones (`copySetIsCyclic` needs the
+ *  built copy list, which is not available here). So it can answer true for a pair that later
+ *  collapses — the tree dedup then eats it — but never false for one that does not.
+ *
+ *  ASKED ANY EARLIER THE CLAIM FAILS, in both directions. The answer moves with the SYMBOL MAP
+ *  (klonoa's `UpdateHUDCollectibleCount` answers false under the map and true without it, off one
+ *  asm — test/corpus/agbcc-hudcount.s) and with the STAGE, because `raise/latch.ts` rewrites the
+ *  record this reads (klonoa's `EntityGravityAndFloorCheck`: false after `recoverTypes`, true
+ *  after `foldEmptyLatches` — a RECORD of a measurement, not a live check: that function is in no
+ *  corpus row and no fixture here, so the claim cannot be re-run from this repo).
+ *
+ *  A SECOND, HAND-WRITTEN SPELLING of `edgeCopyRecords`' two comparators — including the stability
+ *  that decides ties — not a call into them, and nothing forces the two to agree. A change to that
+ *  sort has to be mirrored here BY HAND, or this gate keeps answering about an ordering the pass no
+ *  longer produces. Unified deliberately not: this is `/copy-defpos`'s variantGate, so it decides
+ *  which candidates are ENUMERATED and its predicate cannot move without moving rows. */
+export function edgeCopyOrdersDiffer(fn: Fn): boolean {
+  const order = fn.writeOrder;
+  if (order === undefined) {
+    return false;
+  }
+  const defs = defOpMap(fn);
+  for (const pred of fn.blocks) {
+    if (!order.writes.has(pred)) {
+      continue;
+    }
+    const rec = order.lastWrite.get(pred) ?? NO_WRITTEN_DESTINATIONS;
+    const opAt = new Map(pred.ops.map((o, i) => [o, i] as const));
+    for (const op of pred.ops) {
+      for (const succ of op.successors) {
+        if (succ.args.length < 2) {
+          continue;
+        }
+        const slots = succ.args.map((_, i) => i);
+        const proxyPos = (i: number) => {
+          const d = defs.get(succ.args[i]);
+          return d !== undefined && opAt.has(d) ? opAt.get(d)! : NO_RECORD;
+        };
+        const byRecord = [...slots].sort(
+          (a, b) => (rec.get(succ.block.params[a]) ?? NO_RECORD) - (rec.get(succ.block.params[b]) ?? NO_RECORD),
+        );
+        const byProxy = [...slots].sort((a, b) => proxyPos(a) - proxyPos(b));
+        if (byRecord.some((v, i) => v !== byProxy[i])) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+
 // A bottom-tested `do { body } while(cond)`. The header is the body entry (entered before any
 // test); the LATCH holds the loop condition and the single exit. Body = header..latch structured, then
 // the latch's own ops + the loop-update; the latch test is the do-while condition. The condition is
@@ -604,6 +888,86 @@ interface DoWhileInfo {
   exit: Block;
   forwardPreds: Block[];
   body: Set<Block>; // the pure natural-loop body (for in-body vs exit classification)
+  arms: LoopArm[];
+}
+
+/** One carrier offered to one merge slot, as `FRESH_MERGE_GATES` judges it. */
+export interface FreshMergeCarrier {
+  /** every in-edge passes the SAME value, so the merge is a pure alias of the carrier */
+  readonly allSame: boolean;
+  /** the carrier is an entry parameter, or a merge home this rule itself minted */
+  readonly paramRooted: boolean;
+}
+
+/** `freshParamMerge`'s admission: may this merge take its OWN home instead of the carrier's name?
+ *  Nothing here is `sound` — both spellings are ordinary C over the same values, so `rank.ts`
+ *  enumerates the ON one as `/fresh-merge` and the differ referees it. What keeps them two
+ *  SPELLINGS rather than two PROGRAMS is `canTakeName`'s carrier width/sign check, which runs on
+ *  the same carrier one step earlier.
+ *
+ *  WHAT THE SPELLING BUYS: a parameter is live from entry, so its name pins the value to the
+ *  register the ABI handed it; a fresh local is dead until its first arm, so the compiler may place
+ *  the copy where the asm has it. Which merges actually needed a register of their own is not
+ *  recoverable from the C, and the rule is ALL-OR-NOTHING over a function's param-rooted slots. On
+ *  `max3` (agbcc -O2, scored against its own target) only the SECOND of the two chained merges is
+ *  load-bearing: re-homing just the first is byte-identical to re-homing neither (score 5), and
+ *  re-homing just the second is byte-identical to re-homing both (score 0, MATCH). Splitting the
+ *  choice per slot would be a fan of 2^slots, so the axis offers the whole-function spelling.
+ *
+ *  `param-rooted` is a SCOPE, not a derivation. A chain rooted in an ordinary merge home is left
+ *  alone, and widening to one is a different, unmeasured axis: 293 of 721 map-less corpus rows
+ *  carry at least one conditional merge slot (925 slots), of which the param rooting admits 109 —
+ *  `LoadBGTilemapData` is one of the other 184, which is why the axis has no reach there — a RECORD
+ *  of a measurement, not a live check: that function is in no corpus row and no fixture here (its
+ *  attribution evidence is docs/lbg-attribution.md), so it cannot be re-run from this repo.
+ *
+ *  The rooting is over carrier VALUES, and two shapes carry a parameter's value past it under
+ *  another name, both reach-only: a redundant phi keeps the parameter's own name (`redundant-phi`)
+ *  and its result is then an ordinary carrier, which fires on 0 of 721 lifted corpus rows; and the
+ *  minted-home set records only merges that ended up FRESH, so a merge that refuses a parameter and
+ *  then adopts an ordinary local is not recorded — 336 firings over 6 rows. */
+export const FRESH_MERGE_GATES: readonly Gate<FreshMergeCarrier>[] = [
+  {
+    id: 'redundant-phi',
+    why: 'a merge every edge feeds the same value overwrites nothing, so its own home buys a copy',
+    sound: false,
+    guardedBy: 'fresh-merge.test.ts: a redundant phi over one parameter keeps the parameter',
+    rejects: (c) => c.allSame,
+  },
+  {
+    id: 'param-rooted',
+    why: "the rule's scope — a chain rooted in an ordinary merge home is a separate, unmeasured axis",
+    sound: false,
+    guardedBy: 'fresh-merge.test.ts: a merge over ordinary locals is untouched',
+    rejects: (c) => !c.paramRooted,
+  },
+];
+
+/** Whether any merge slot could reach `FRESH_MERGE_GATES` at all: an in-edge argument list that
+ *  differs and includes an entry parameter — what `rank.ts` gates enumeration of `/fresh-merge` on.
+ *  An OVER-approximation, which is the safe direction for a gate that only decides whether to
+ *  enumerate: the walk can still refuse
+ *  the carrier (`carriesPreUpdate`, `canTakeName`), and a slot whose carrier is a home this rule
+ *  mints is not visible here at all. */
+export function hasParamRootedMerge(fn: Fn): boolean {
+  const entryParams = new Set<Value>(fn.blocks[0].params);
+  return fn.blocks.slice(1).some((b) =>
+    b.params.some((_, i) => {
+      const args = fn.blocks.flatMap((pr) =>
+        pr.ops[pr.ops.length - 1].successors.filter((sx) => sx.block === b).map((sx) => sx.args[i]),
+      );
+      return args.some((a) => a !== args[0]) && args.some((a) => entryParams.has(a));
+    }),
+  );
+}
+
+/** True when the merge takes its own home. The table is a parameter so a test can drop one gate and
+ *  re-run the real pass (`StructureHooks.freshMergeGates`). */
+function reHomesParamMerge(
+  c: FreshMergeCarrier,
+  gates: readonly Gate<FreshMergeCarrier>[] = FRESH_MERGE_GATES,
+): boolean {
+  return firstRejection(gates, c) === null;
 }
 
 // Structuring levers, threaded as DATA so a new one is a field here + its consumer, not a new
@@ -611,23 +975,119 @@ interface DoWhileInfo {
 //   returnsVoid                    — from the function's own prototype (suppress phantom r0 return);
 //   coalesceLoopInit               — keep the induction var in its arg register;
 //   preserveDivergentBranchSense   — reproduce source branch direction on divergent ifs;
-//   orderArgCopiesByComputation    — order edge copies by computation order in the predecessor.
+//   orderArgCopiesByWriteOrder     — order edge copies by the order the pred WROTE their
+//                                    destinations.
 // The last three are `compilerBehaviors` (target.ts) — this pass stays target-AGNOSTIC: it reads
 // booleans, never a compiler name.
+//
+// WHAT A FIELD DOC BELOW HOLDS, narrowly: what the option MEANS to `structure()`, and the suffix of
+// the axis that enumerates it. An AXIS's rationale, and any figure pricing its marginal value, live
+// ONCE at its `STRUCTURING_AXES` entry in rank.ts — restated here the two copies rot separately,
+// and only the rank.ts one sits next to the enumeration that could refute it. Figures pricing a
+// DEFAULT this pass owns (the edge-copy ordering, `spellDeclaredSubscripts`) do belong here.
 export interface StructureOptions {
   returnsVoid?: boolean;
   coalesceLoopInit?: boolean;
   preserveDivergentBranchSense?: boolean;
-  orderArgCopiesByComputation?: boolean;
+  // Spell a JOINED two-armed if with the negated condition and swapped arms: the asm branched
+  // forward to the taken block and fell through to the other, so a compiler that preserves
+  // source branch direction saw the FALL-THROUGH arm as `then` — the same layout evidence the
+  // divergent case reads (preserveDivergentBranchSense), which post-dominance hides here because
+  // both arms reconverge. Defaults to preserveDivergentBranchSense rather than to a constant, so a
+  // target that opts out of the divergent claim opts out of this one; target.ts says how.
+  //
+  // This is the ZERO POINT of rank.ts's `/flip-join` axis, not a per-compiler fact that closes
+  // the question — docs/level-tower.md wants a default only where the mapping is a FUNCTION, and
+  // benchmark rows still reach their winning spelling through the axis rather than through this
+  // default. Read it forward only: it says which sense to emit ABSENT evidence of an inversion,
+  // never that the asm's layout WAS the source's sense. What agbcc contributes is the refusals —
+  // its gcc Makefile SRCS compiles neither sched.c nor reorg.c and toplev.c never sets
+  // flag_schedule_insns, and gcse.c runs one_code_hoisting_pass only `if (optimize_size)`, which
+  // toplev.c sets for -Os alone — so no scheduler and no hoister moves an arm's body across the
+  // branch after stmt.c laid the arms out in source order.
+  //
+  // Three mechanisms DO invert the sense, and each is per-SITE where this lever is per-function,
+  // so no value here is right in every `if` of a function that holds several: a short-circuit
+  // fold picks which successor is `taken` from the asm's branch polarity, which on Thumb the
+  // branch RANGE decides (raise/shortcircuit.ts); a relay past a branch's reach inverts to jump
+  // around the long form; and a rotated loop's zero-trip guard is an `if` no source wrote at all
+  // (`synthetic:fib`, `for(i=0;i<n;i++)`, emits `if (0 >= a0) … else do{…}while`), so there no
+  // spelling is the faithful one and only the differ can choose.
+  negateJoinedBranchSense?: boolean;
+  orderArgCopiesByWriteOrder?: boolean;
+  /** Order a measured edge's ACYCLIC copy set by the def-position proxy instead — the
+   *  `/copy-defpos` ranked sibling of the write-order spelling (rank.ts). A CYCLIC set keeps the
+   *  record either way: there an instruction names the compiler's temp, and no arm of the fan may
+   *  contradict it (`copySetIsCyclic`). Not a target field and deliberately not one: which order a
+   *  compiler laid out is two-sided inside one compiler, so the differ referees it per row. Inert
+   *  on an unmeasured pred, where the proxy is already what runs. */
+  preferDefPosCopyOrder?: boolean;
   // Comparison-tree switch recovery: treat an `x != K` test as a case (the EQUAL side is a case
   // body). GCC freely uses `!=`; IDO prefers `==`/`<`. A per-compiler DATA lever, not an `arch ==`
   // branch — default true (permissive; the decline path keeps it sound either way).
   switchAllowsNeqCase?: boolean;
+  // Comparison-tree switch recovery: treat a relational test whose BRANCH admits exactly one
+  // scrutinee value as that case rather than as navigation. A per-compiler DATA lever declared in
+  // TargetDescription.compilerBehaviors — a compiler opts in on evidence that its dispatch jumps
+  // straight to a bounded subtree's body. Default false: absent, every relational edge navigates.
+  switchAllowsBoundCase?: boolean;
+  // Comparison-tree switch recovery: emit the case arms in the order the ASSEMBLY lays their
+  // bodies out, rather than sorted by ascending case value. A per-compiler DATA lever declared in
+  // TargetDescription.compilerBehaviors — a compiler opts in on evidence that it neither reorders
+  // basic blocks nor schedules across them, so the layout it produced IS the order the source
+  // wrote. Default false: absent, the arms keep the ascending spelling.
+  switchArmsFollowLayout?: boolean;
+  // Does the TARGET LANGUAGE spell a `switch` arm that runs on into the next one? Set from the
+  // caller's LanguageBackend (`spellsSwitchFallthrough`), not from the compiler target: it is a
+  // property of what the emitted source may say, and the only reason the structurer needs it is
+  // that a fall-through switch has a SECOND, behaviourally identical recovery. Regime A declines
+  // to if-recovery when it is false; Regime B, having no fallback, fails loud. Default true.
+  spellSwitchFallthrough?: boolean;
+  // Which way this compiler hands out frame slots against DECLARATION RANK: `ascending` = the
+  // earlier-declared spilled local takes the LOWER `[sp,#k]`. A per-compiler DATA lever declared
+  // in TargetDescription.compilerBehaviors, carried to the backend on `SFn.slotOrder` and applied
+  // by `l3/slotorder.ts` at emit time. ABSENT means the ordering refuses — there is no default
+  // direction, because a wrong one reorders declarations for no reason.
+  //
+  // TWO STATES, NOT THREE. `TargetDescription` spells a third, `'unknown'`, and it earns its place
+  // there: it separates a direction that was measured and deliberately not shipped from one nobody
+  // ever asked about, which is a fact about the target worth writing down. Nobody reads a
+  // STRUCTURER option to learn what was measured, so carrying it here would be a second way to
+  // spell "no" on a public option type. The translation happens once, in `structureOptionsFor`
+  // (target.ts), which is where the target-to-structurer mapping lives.
+  spillSlotOrder?: 'ascending' | 'descending';
+  // Commutative load pairs re-spell in def (evaluation) order — see the swap in lowerDef. Default
+  // true; verified byte-exact on agbcc and IDO. A per-compiler DATA lever declared in
+  // TargetDescription.compilerBehaviors: the first compiler whose scheduler is shown re-ordering
+  // independent loads flips it there, not in a code branch. A per-FUNCTION machine-order fallback
+  // candidate is deliberately deferred until a row demands it.
+  defOrderLoadPairs?: boolean;
   // Anchor a constant merge copy at its const op's ORIGINAL position instead of at the CFG edge:
   // `movs r9, #0` at entry ahead of a single-armed overwrite emits as a pre-initialization above
   // the `if`, not as its else-arm. A differ-refereed candidate axis (rank.ts `/defsite`), never a
   // default — see the refusal conditions where it is computed.
   anchorConstCopies?: boolean;
+  // WIDEN `anchorConstCopies` to a LOOP HEADER's entry constant — `int s = 0;` hoisted above the
+  // `if` that guards the loop, rather than written on the edge into it. A second placement
+  // decision, so a second axis point (rank.ts `/defsite/loop-entry`) rather than a widening of
+  // the first: on a function carrying both kinds of anchorable const, folding them into one flag
+  // would make "anchor the plain ones, leave the loop's at its edge" — a spelling `/defsite`
+  // emits today — unreachable. Inert unless `anchorConstCopies` is also on.
+  //
+  // AN AXIS RATHER THAN AN EXTENSION OF `l3/initfirst.ts`, whose header opens on the same rewrite
+  // (`if (0 < n) { v = 0; … }` → `v = 0; if (v < n) { … }`) at a fraction of the price: a
+  // re-spelling adds candidates only where it fires, while this multiplies every candidate below
+  // it. The fork is REACH, and it is a hard one. `initfirst` MOVES A STATEMENT, and an edge copy
+  // is not a statement — structuring mints it, choosing between the edge and the const op's own
+  // position, and the IR that holds those positions is gone by the time L3 runs. So the shapes
+  // where the two coincide are initfirst's for free — except that they never do: its guard
+  // re-spelling wants an ELSE-LESS `if` and rewrites the condition to read the hoisted variable
+  // (`if (v < n)`), where anchoring leaves the condition alone, so the two emit different sources.
+  // Measured, not argued: `/initfirst` rides every spelling rank.ts enumerates, so it is scored on
+  // every benchmark row already, and on each row this axis wins its `/initfirst`-only sibling is
+  // either not enumerated at all or not byte-identical to the anchored source — the substitution
+  // reaches none of them. Take the axis only while rows demand that; the price is in rank.ts.
+  anchorLoopEntryConsts?: boolean;
   // HARDWARE fact from TargetDescription.capabilities.endianness, threaded by structureOptionsFor:
   // the bitfield extract recognizer solves an LSB-first equation, so it only runs on little-endian
   // data. The provider already refuses to EMIT bitfield facts for a big-endian ELF; this is the
@@ -636,13 +1096,104 @@ export interface StructureOptions {
   // Spell `(x << a) >> b` extracts of a struct global as the map's named bitfield member. On by
   // default; rank.ts enumerates the OFF spelling as the `/no-bitfield` axis, because the named
   // read recompiles at the DECLARATION's access width — where that diverges from the asm's load
-  // width the honest shift spelling is the one that matches, and the differ referees.
+  // width the honest shift spelling is the one that matches, and the differ referees. Only the map
+  // carries the names, so with no `symbols` this is normalized to false whatever a caller passes.
   spellBitfieldMembers?: boolean;
+  // Spell an element-scaled offset through a map-declared POINTER MEMBER as a whole-element
+  // subscript of it (`gBg.pMap[i + 157]`) rather than as the byte arithmetic it replaces. On by
+  // default; rank.ts enumerates the OFF spelling as the `/no-ptr-elem` axis.
+  //
+  // IT IS AN AXIS AND NOT A DEFAULT BECAUSE IT IS NOT BYTE-NEUTRAL — the bar the block comment
+  // above `spellablePointee` sets for a member spelling. Compiled against agbcc (`-mthumb-interwork -Wimplicit -O2 -fhex-asm
+  // -fprologue-bugfix`), `((u16 *)gB.pMap)[i + K]` and `*(u16 *)((i << 1) + (u8 *)gB.pMap + 2K)`
+  // are the same address and the same instruction COUNT at K = 0, 1 and 157 — and different
+  // objects at all three, differing in which register the `add` targets. Which side matches is
+  // per-function knowledge the asm does not carry, so both are emitted and the differ referees.
+  // Only the map declares a pointee width, so with no `symbols` this is normalized to false.
+  spellPtrMemberElements?: boolean;
+  // Recover a multidimensional array global's DECLARED subscripts (`g[r][i]`) from a byte residual
+  // carrying a term at the declared ROW stride, rather than spelling the whole residual as the
+  // `*(T *)(… + (u32)&g)` cast it replaces. On by default; rank.ts enumerates the OFF spelling as
+  // the `/flat-rank` axis.
+  //
+  // IT IS AN AXIS AND NOT A DEFAULT BECAUSE THE ASM DOES NOT DETERMINE IT, and the evidence that
+  // it does not is the same compile the recovery's own premise rests on, read against the spelling
+  // the recovery DISPLACES rather than against the flat one it refuses. For `u16 g[4][0x400]`:
+  //
+  //   agbcc  g[a][b]  lsl #0xb ; lsl #0x1 ; add ; add   |  *(u16 *)((a<<11)+(b<<1)+(u32)&g)
+  //                   md5 f58a694f…                     |  md5 051bf506…   DIFFERENT, and the
+  //                   difference is WHERE THE POOL LOAD SITS — the shift structure the recovery
+  //                   reads is IDENTICAL in both, so the residual is evidence about the row and
+  //                   NOT about which of these two spellings wrote it.
+  //   kmc / mwcc      the same: separate scales both sides, differing only in scheduling.
+  //   IDO             the two are BYTE-IDENTICAL (md5 2b55b493…) — and IDO also distributes the
+  //                   FLAT sum into the same separate scales, so on that compiler the recovery's
+  //                   own premise is false and the flat spelling reaches it too.
+  //
+  // WHICH ROW OF THAT TABLE IS PINNED: the agbcc pair, by
+  // packages/cli/test/matching/array-rank-axis.test.ts, which compiles both spellings through the
+  // klonoa checkout's own template. The other three were measured by hand and nothing re-runs
+  // them, so treat them as the record of a measurement rather than as a live check.
+  //
+  // So both are emitted and the differ referees, exactly as for `/no-ptr-elem`. Only the map
+  // declares a rank, so with no `symbols` this is normalized to false.
+  spellDeclaredSubscripts?: boolean;
   // Let a read of a named global render at its use across writes that PROVABLY cannot reach it
   // (a store to a different named global), instead of caching it in a local. Off by default;
   // rank.ts enumerates the ON spelling as the `/reread-globals` axis — see analysis.ts
   // AnalyzeOptions for why this is a differ-refereed lever and not a fix.
   rereadGlobals?: boolean;
+  // Materialize a load that feeds a `cond_br` join arg, so the naming walk can home the join in
+  // it and the identity arm elides to a one-sided in-place `if`. Off by default; rank.ts
+  // enumerates the ON spelling as the `/inplace` axis — see analysis.ts AnalyzeOptions.
+  materializeJoinFeeds?: boolean;
+  // Materialize a pure computed address shared by 2+ memory accesses, and the multi-render loads
+  // through it, reproducing the source's pointer-local + scalar-temp spelling. Off by default;
+  // rank.ts enumerates the ON spelling as the `/addr-home` axis — see analysis.ts AnalyzeOptions.
+  homeSharedAddresses?: boolean;
+  // Materialize a pure value with 2+ distinct consumers, at least one of them inside a loop the
+  // def sits outside — the register the compiler holds across the iterations. Off by default;
+  // rank.ts enumerates the ON spelling as the `/expr-home` axis — see analysis.ts AnalyzeOptions.
+  homeLoopExprs?: boolean;
+  // Materialize a pure value with 2+ consumers standing on a memory read — the register the asm
+  // carried the DERIVED value in, where the read's own home is a register that died at the
+  // computation. Off by default; rank.ts enumerates the ON spelling as the `/derived-home` axis —
+  // see analysis.ts AnalyzeOptions.
+  homeDerivedReads?: boolean;
+  // Materialize a pure value that one join's incoming edges render into the SAME parameter slot
+  // from 2+ places — the value the source computed once above the branch and the copy machinery
+  // sinks into every arm. Off by default; rank.ts enumerates the ON spelling as the `/merge-home`
+  // axis — see analysis.ts AnalyzeOptions.
+  homeMergeFeeds?: boolean;
+  // Emit a memory read as a named temp in ITS OWN block when every place it renders sits in a
+  // block that block strictly dominates. A per-compiler DATA lever (TargetDescription
+  // .compilerBehaviors), not a differ-refereed axis: where the compiler has neither a scheduler
+  // nor a code hoister, the sunk spelling is one it could not have emitted from this asm, so there
+  // is nothing to referee. Absent ⇒ off — the target field carries the evidence a compiler owes,
+  // analysis.ts AnalyzeOptions the refusals.
+  readsStayWhereWritten?: boolean;
+  // Spell unsigned compares unsigned: cast an icmp_u* operand where the rendered operands do not
+  // guarantee it, and reconcile a mixed-claimant declaration to u32 when nothing under the name
+  // needs signed. Off by default: a signed spelling that byte-matched was PROVED non-negative by
+  // the compiler (it emits the unsigned branch from signed compares only then), so which spelling
+  // the source used is genuinely ambiguous at emission — rank.ts enumerates the ON spelling as
+  // the `/uns-cmp` axis and the differ referees.
+  unsignedCompareSpelling?: boolean;
+  // Merge two variables that a merge copy would join, when the values under them never interfere
+  // (structure/namecoalesce.ts). Off by default; rank.ts enumerates the ON spelling as the
+  // `/merge-names` axis. Which variables the compiler's own coalescer shared is not derivable from
+  // the naming, and removing a copy is worth less than it looks — the compiler coalesces most of
+  // them itself. What moves the score is which values share a register, and that splits per
+  // function.
+  coalesceMergeNames?: boolean;
+  // Give a merge whose carrier is a FUNCTION PARAMETER its own local, instead of assigning back
+  // into the parameter's name. Off by default; rank.ts enumerates the ON spelling as the
+  // `/fresh-merge` axis, and `FRESH_MERGE_GATES` holds the admission and the argument for it.
+  //
+  // NOT `materializeJoinFeeds` widened to parameters. That axis reaches its shape by giving the
+  // join's feed a NAME to adopt, and materialization is keyed on the defining `Op` — a parameter
+  // has none, so there is nothing to key.
+  freshParamMerge?: boolean;
   // How an unresolvable VALUE degrades (a live `opaque`, an unlowered transient op, a dropped def):
   //   "strict"   (default) — the `"?"` sentinel, tripping assertResolved at the boundary (loud in
   //              the PROCESS);
@@ -654,22 +1205,269 @@ export interface StructureOptions {
    *  bare `gSym[i]` form; `shape:'struct'`+layout spells interiors as `gSym.field`. Absent (or
    *  a symbol not in the map) ⇒ today's usage-inferred behavior, byte-identical. */
   symbols?: Map<string, SymbolInfo>;
+  /** ARRAY SHAPES DERIVED FROM THE INPUT ASSEMBLY (raise/globalshape.ts) for globals the project
+   *  map does not describe — same `SymbolInfo` shape, same readers, LOWER precedence: `symbols`
+   *  wins every name it knows, because a project declaration knows more than an inference off one
+   *  function's strides.
+   *
+   *  A SEPARATE FIELD rather than a pre-merged map, and the separation is load-bearing twice.
+   *  `spellBitfieldMembers` is normalized against `symbols` alone, so a derived shape can never
+   *  switch the named-bitfield spelling on for a map-less row (which would silently delete the
+   *  `/no-bitfield` axis's decline — see bitfield-members.test.ts). And it keeps the derivation
+   *  ATTRIBUTABLE: everything the map does stays keyed on the map. */
+  inferredSymbols?: Map<string, SymbolInfo>;
+  /** THE ORDER HALF of the same derivation (raise/globalshape.ts `orderLicensedGlobals`): the
+   *  globals whose address the assembly materialized BEFORE it scaled the index. Not a shape and
+   *  not a declaration — nothing is spelled from it here — it is stamped onto every `index` node it
+   *  reaches (`Expr.baseOrdered`, l3/ast.ts) for the L3 pass that decides whether a base gets a
+   *  HOME.
+   *
+   *  A SUPERSET of `inferredSymbols`' names, and its own field for exactly that reason: a struct
+   *  element is licensed here and has no shape there. */
+  orderLicensedGlobals?: ReadonlySet<string>;
+}
+
+/** The named global an `index` node's base denotes DIRECTLY, or undefined: the bare `&gSym` an
+ *  ordinary element access indexes, and the `(struct S *)&gSym` an array-of-struct element indexes
+ *  — the reinterpret cast is the base's spelling, not a different base.
+ *
+ *  Deliberately not a search. A symbol buried inside a base's arithmetic is a base this licence has
+ *  nothing to say about — the order fact is about the address the pool word materialized, and what
+ *  a home would bind there is the sum, not the symbol — so it goes unstamped, which costs a
+ *  candidate and never a wrong one. The same two shapes are what `l3/basecse.ts` can hoist. */
+function indexBaseSymbol(e: Expr): string | undefined {
+  if (e.k === 'addr') {
+    return e.name;
+  }
+  return e.k === 'cast' && e.e.k === 'addr' ? e.e.name : undefined;
+}
+
+/** Stamp `baseOrdered` on every `index` whose base names an order-licensed global — the ONE place
+ *  the L1 order fact enters the L3 tree.
+ *
+ *  A post-pass over the finished body rather than a `...fromOrder` at each construction site: the
+ *  index node is built across `ptrMemberElement`, `memAccess` and `arrayAccess` at more sites than
+ *  `operandOff` itself reaches, the licence is per SYMBOL rather than per site, and a walk is
+ *  exhaustive by construction where a new site would silently carry no evidence. */
+function stampOrderedBases(body: Stmt[], licensed: ReadonlySet<string> | undefined): Stmt[] {
+  if (licensed === undefined || licensed.size === 0) {
+    return body;
+  }
+  const stamp = (e: Expr): Expr => {
+    const mapped = mapExprChildren(e, stamp);
+    if (mapped.k !== 'index') {
+      return mapped;
+    }
+    const sym = indexBaseSymbol(mapped.base);
+    return sym !== undefined && licensed.has(sym) ? { ...mapped, baseOrdered: true as const } : mapped;
+  };
+  return body.map((s) => mapStmtExprs(s, stamp));
+}
+
+/** Test-only seams. SEPARATE from `StructureOptions` on purpose: `structureOptionsFor` builds that
+ *  one by spreading a target's `compilerBehaviors`, whose fields map 1:1 onto it, so a hook living
+ *  there would be settable from a TargetDescription. */
+export interface StructureHooks {
+  /** `coalesceMergeNames`'s admission rules, so a test can run the pass with one gate DROPPED —
+   *  the ablation as a value rather than as a flag compiled into the shipped path. */
+  nameCoalesceGates?: readonly Gate<NameMerge>[];
+  /** `freshParamMerge`'s admission rules, ablatable the same way. */
+  freshMergeGates?: readonly Gate<FreshMergeCarrier>[];
+}
+
+/** A CANDIDATE SPELLING MUST NEVER UNLOCK A FUNCTION THE PRIMARY DECLINES. `varName` is not only
+ *  how values are spelled — the loop emitters' hazard predicates read it, and several ask "does
+ *  this edge copy survive identity elision", which merging two names quietly answers `no`. A pass
+ *  that made a hazard invisible would trade a loud decline for a silent wrong answer, so the
+ *  lever-less structuring runs first and its refusal stands. That is the whole invariant, rather
+ *  than a list of individually patched guards, and it costs one extra structuring — nothing next to
+ *  the compile the candidate exists to feed.
+ *
+ *  It rests on `structure()` not mutating `fn`, which `structure-purity.test.ts` pins.
+ *
+ *  SCOPE: refusals thrown by `structure()` itself. A decline can also come from `structureChecked`'s
+ *  boundary contracts, which run OUTSIDE it — `rank.ts` closes that half, where the contracts are. */
+function assertPrimaryAccepts(fn: Fn, opts: StructureOptions, hooks: StructureHooks): void {
+  structure(
+    fn,
+    {
+      ...opts,
+      coalesceMergeNames: false,
+      freshParamMerge: false,
+      materializeJoinFeeds: false,
+      homeSharedAddresses: false,
+      homeLoopExprs: false,
+      homeDerivedReads: false,
+      homeMergeFeeds: false,
+      anchorConstCopies: false,
+      anchorLoopEntryConsts: false,
+    },
+    hooks,
+  );
+}
+
+/** What {@link earlyReturnArm} reads beyond its arguments: block dominance and forward
+ *  reachability, both of them whole-function facts computed once per `structure()`. */
+interface EarlyReturnArmDeps {
+  dom: Map<Block, Set<Block>>;
+  reachFrom: (b: Block) => Set<Block>;
+}
+
+function isRet(blk: Block): boolean {
+  return blk.ops[blk.ops.length - 1]?.opcode === 'ret';
+}
+// An early `return` out of the loop: forward-walking from `to` WITHOUT re-entering the loop `body`,
+// every path terminates in a `ret`. agbcc/gcc merge every `return` into ONE epilogue block and each
+// return site just sets the return register and branches there, so a second body exit that lands on
+// such a chain is an early RETURN, not a break to a live merge — which is what lets two returns
+// merged through a shared `bx lr` recover as a `while` with an in-body early `return` instead of
+// declining as "multi-exit".
+//
+// The arm is structured AT the edge, so any block in it that a second path also reaches is emitted
+// twice. A duplicated `return v` is harmless — both copies sit on mutually exclusive paths, so this
+// is a FIDELITY rule, not a soundness one: a store or call written twice is source no compiler
+// would have produced from this asm, and the region it drags along is unbounded. A block escapes
+// that on two counts. `from` dominates `to` and `to` dominates the block, so every path reaching it
+// runs this edge's predecessor and then this region — and only one edge into `to` can satisfy the
+// first half, since two predecessors cannot both dominate it. And the region must not be reachable
+// from the loop's own exit, which dominance does NOT rule out: an arm landing straight on the
+// post-loop join dominates itself, and claiming it would emit the epilogue on both paths. Testing
+// `to` covers the whole region — a block dominated by `to` that the exit reached would mean the
+// exit reached `to`. The shared epilogue an arm branches to still has to be pure.
+//
+// Returns the blocks the arm OWNS — its exclusive part, which the loop emits inside its body, ahead
+// of the update — or null when this is not an early-`return` arm.
+function earlyReturnArm(
+  { dom, reachFrom }: EarlyReturnArmDeps,
+  from: Block,
+  to: Block,
+  body: Set<Block>,
+  exit: Block,
+): Set<Block> | null {
+  const entryOwned = dom.get(to)!.has(from) && to !== exit && !reachFrom(exit).has(to);
+  const owned = new Set<Block>();
+  const seen = new Set<Block>();
+  const stack = [to];
+  while (stack.length) {
+    const bb = stack.pop()!;
+    if (seen.has(bb)) {
+      continue;
+    }
+    seen.add(bb);
+    if (body.has(bb)) {
+      return null;
+    } // re-enters the loop → not an exit
+    if (entryOwned && dom.get(bb)!.has(to)) {
+      owned.add(bb);
+    } else if (bb.ops.some((op) => EFFECTFUL_OPS.has(op.opcode))) {
+      return null;
+    }
+    const t = bb.ops[bb.ops.length - 1];
+    if (t.opcode === 'ret') {
+      continue;
+    }
+    if (t.opcode === 'br' || t.opcode === 'cond_br') {
+      for (const s of t.successors) {
+        stack.push(s.block);
+      }
+      continue;
+    }
+    return null; // switch_br / unknown terminator → decline
+  }
+  return owned;
+}
+
+/** The two facts a merge carrier's declared type contributes to `canTakeName` — see the rule's own
+ *  comment there for why the signedness half is part of the width at sub-word sizes. */
+function carrierWidth(t: IrType | undefined): number {
+  return t?.kind === 'int' ? t.width : 32;
+}
+function carrierSign(t: IrType | undefined): boolean | undefined {
+  return t?.kind === 'int' && t.width < 32 ? t.signed : undefined;
 }
 
-export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
+export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureHooks = {}): SFn {
   const {
     returnsVoid = false,
     coalesceLoopInit = false,
     preserveDivergentBranchSense = true,
-    orderArgCopiesByComputation = true,
+    negateJoinedBranchSense = preserveDivergentBranchSense,
+    orderArgCopiesByWriteOrder = true,
+    preferDefPosCopyOrder = false,
     switchAllowsNeqCase = true,
+    switchAllowsBoundCase = false,
+    switchArmsFollowLayout = false,
+    spellSwitchFallthrough = true,
+    spillSlotOrder,
+    defOrderLoadPairs = true,
     anchorConstCopies = false,
+    anchorLoopEntryConsts = false,
     littleEndian = true,
-    spellBitfieldMembers = true,
+    spellBitfieldMembers: bitfieldSpellingWanted = true,
+    spellPtrMemberElements: ptrElementSpellingWanted = true,
+    spellDeclaredSubscripts: declRankSpellingWanted = true,
     rereadGlobals = false,
+    materializeJoinFeeds = false,
+    homeSharedAddresses = false,
+    homeLoopExprs = false,
+    homeDerivedReads = false,
+    homeMergeFeeds = false,
+    readsStayWhereWritten = false,
+    unsignedCompareSpelling = false,
+    coalesceMergeNames = false,
+    freshParamMerge = false,
     onGap = 'strict',
-    symbols,
+    symbols: mapSymbols,
+    inferredSymbols,
+    orderLicensedGlobals,
   } = opts;
+  // THE shape dictionary the rendering context asks, map-first. Built as a lookup rather than a
+  // merged Map because the map is the PROJECT's and is asked by name for a whole project's worth
+  // of symbols — copying it per structuring is work proportional to the project, and a ranked run
+  // structures one function thousands of times (the same argument the `laddr` name minter makes).
+  const symbols: SymbolLookup | undefined =
+    mapSymbols !== undefined || (inferredSymbols !== undefined && inferredSymbols.size > 0)
+      ? {
+          get: (n) => mapSymbols?.get(n) ?? inferredSymbols?.get(n),
+          has: (n) => mapSymbols?.has(n) === true || inferredSymbols?.has(n) === true,
+        }
+      : undefined;
+  // Only the MAP makes the named bitfield spelling available, so with no map this is not a choice.
+  // Normalized once here rather than left to each reader's own `symCtx &&` guard, because rank.ts's
+  // `/no-bitfield` decline rests on both arms structuring the IDENTICAL tree without a map — a
+  // second reader added outside that guard would otherwise delete a candidate silently, and nothing
+  // reports a candidate that was never enumerated (bitfield-members.test.ts).
+  // Against the PROJECT MAP alone, never the derived shapes: only a map carries bitfield members,
+  // and keying this on the union would flip the `/no-bitfield` axis's zero point on a map-less row.
+  const spellBitfieldMembers = mapSymbols !== undefined && bitfieldSpellingWanted;
+  // These levers all change which edge copies elide as identities (extra materialization does
+  // too), which the loop emitters' hazard predicates read — so the invariant above covers each.
+  // A per-compiler DEFAULT is not among them, however much it materializes: the primary IS this
+  // target's defaults, so resetting one would probe a spelling asmlift never emits here.
+  //
+  // THREE OF rank.ts's TEN `STRUCTURING_AXES` ARE DELIBERATE NON-MEMBERS, each for its own reason,
+  // and the list here is the half of the split this side owns:
+  //   - `/reread-globals` (rereadGlobals) is an ANALYSIS option, and it only ever RELAXES: it
+  //     widens a load's render positions and narrows the write set that bars it, so it removes
+  //     materializations rather than minting them. Extra materialization is what this guard is
+  //     about (see above), and this axis adds none;
+  //   - `/uns-cmp` (unsignedCompareSpelling) writes `varType` and inserts casts at compares. It
+  //     touches no name and no copy, so no edge copy changes its elision under it;
+  //   - `/copy-defpos` (preferDefPosCopyOrder) REORDERS the copies of one edge and adds or drops
+  //     none. rank.ts states the same thing from the axis side, in the terms that matter there: a
+  //     reordering cannot rescue a spelling whose OFF sibling failed the boundary contracts.
+  if (
+    coalesceMergeNames ||
+    freshParamMerge ||
+    materializeJoinFeeds ||
+    homeSharedAddresses ||
+    homeLoopExprs ||
+    homeDerivedReads ||
+    homeMergeFeeds ||
+    anchorConstCopies
+  ) {
+    assertPrimaryAccepts(fn, opts, hooks);
+  }
   const defs = defOpMap(fn);
   const preds = predecessorBlocks(fn);
   const ipdom = postDominators(fn);
@@ -681,7 +1479,14 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     returnsVoid,
     {
       defs,
+      dom,
       rereadGlobals,
+      materializeJoinFeeds,
+      homeSharedAddresses,
+      homeLoopExprs,
+      homeDerivedReads,
+      homeMergeFeeds,
+      readsStayWhereWritten,
       // the map's own declaration truth: a volatile object's read may not be duplicated or moved
       volatileGlobal: (n) => {
         const si = symbols?.get(n);
@@ -704,13 +1509,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   // in this layer's namespace: params, locals, every gaddr symbol, and the project's symbol map —
   // none of which the frontend can see. A frontend-chosen `sp0` silently shadowed a project global
   // of the same name. `sp<off>` uniquified with underscores until free; one name per offset.
-  const laddrName = (() => {
+  // `undef` locals are minted in the same pass off the same `taken` set — they need the same
+  // protection from the symbol map, gaddr symbols and callee names that `laddr` names do.
+  //
+  // The map is CONSULTED, never copied in: `taken` is only probed and added to, so asking the
+  // name-keyed map answers the same question for every name in it. Copying it is work
+  // proportional to the whole PROJECT's symbol count on every structuring, and a ranked run
+  // structures one function thousands of times.
+  const { laddr: laddrName, undef: undefName } = (() => {
     const taken = new Set<string>();
-    if (symbols) {
-      for (const [n] of symbols) {
-        taken.add(n);
-      }
-    }
+    const isTaken = (n: string): boolean => taken.has(n) || symbols?.has(n) === true;
     for (const b of fn.blocks) {
       for (const op of b.ops) {
         if (op.opcode === 'gaddr') {
@@ -722,27 +1530,36 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         }
       }
     }
+    const mint = (base: string): string => {
+      let n = base;
+      while (isTaken(n)) {
+        n += '_';
+      }
+      taken.add(n);
+      return n;
+    };
     const byOff = new Map<number, string>();
     const names = new Map<Op, string>();
+    const undefNames = new Map<Op, string>();
     for (const b of fn.blocks) {
       for (const op of b.ops) {
-        if (op.opcode !== 'laddr') {
-          continue;
-        }
-        const off = op.attrs.off as number;
-        let n = byOff.get(off);
-        if (n === undefined) {
-          n = `sp${off}`;
-          while (taken.has(n)) {
-            n += '_';
+        if (op.opcode === 'laddr') {
+          const off = op.attrs.off as number;
+          let n = byOff.get(off);
+          if (n === undefined) {
+            n = mint(`sp${off}`);
+            byOff.set(off, n);
           }
-          taken.add(n);
-          byOff.set(off, n);
+          names.set(op, n);
+        } else if (op.opcode === 'undef') {
+          // Named from the key, like laddr's `sp<off>`: `uninit_sp8` says which frame slot to look
+          // at in the assembly, and it stays put where a running counter would renumber every local
+          // when an unrelated edit changed the order ops are minted in.
+          undefNames.set(op, mint(`uninit_${String(op.attrs.key).replace('@', '')}`));
         }
-        names.set(op, n);
       }
     }
-    return names;
+    return { laddr: names, undef: undefNames };
   })();
 
   const scalarGlobals = new Set<string>();
@@ -795,9 +1612,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     // Declaration-shape OVERRIDE (symbol map): a project-declared array/struct global is an
     // AGGREGATE whatever the usage inference saw — a lone off-0 access to `extern u16 tbl[]`
     // must still spell through the aggregate/array forms, never the bare scalar `tbl`.
+    // Driven from the FUNCTION's own globals, for the same reason the name minter above consults
+    // the map instead of copying it: a name outside `scalarGlobals` has nothing to override.
     if (symbols) {
-      for (const [n, si] of symbols) {
-        if (si.shape === 'array' || si.shape === 'struct') {
+      for (const n of [...scalarGlobals]) {
+        const shape = symbols.get(n)?.shape;
+        if (shape === 'array' || shape === 'struct') {
           scalarGlobals.delete(n);
         }
       }
@@ -807,22 +1627,45 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   // Symbol-map rendering context (memAccess/arrayAccess): shape lookups + the env registry for
   // array-shaped globals actually referenced (they surface as SFn.globals — typed, undeclared).
   const shapedGlobalTypes = new Map<string, IrType>();
+  const declaredFieldCache = new Map<string, DeclaredField[] | null>();
   const symCtx: SymRenderCtx | undefined = symbols
-    ? { info: (n) => symbols.get(n), noteGlobal: (n, t) => shapedGlobalTypes.set(n, t) }
+    ? {
+        info: (n) => symbols.get(n),
+        noteGlobal: (n, t) => shapedGlobalTypes.set(n, t),
+        ptrElements: ptrElementSpellingWanted,
+        declRank: declRankSpellingWanted,
+        fieldsOf: (n) => {
+          const hit = declaredFieldCache.get(n);
+          if (hit !== undefined) {
+            return hit;
+          }
+          const si = symbols.get(n);
+          const fields =
+            si?.shape === 'struct'
+              ? declaredFields(si.layout)
+              : si?.shape === 'pointer'
+                ? pointeeFields(si.pointee)
+                : null;
+          declaredFieldCache.set(n, fields);
+          return fields;
+        },
+      }
     : undefined;
 
-  /** A bare `gSym` naming a map-declared POINTER global — the VALUE of a pointer cell. Load,
-   *  store and compare of that 4-byte cell are identical for any object-pointer type, so the
-   *  declared pointee never matters to THEM; arithmetic on the loaded value is the opposite case,
-   *  where the pointee's size scales what is added and every stride must therefore be made
+  /** A value the MAP declares a pointer: a bare `gSym` naming a pointer global (the VALUE of a
+   *  pointer cell), or a named MEMBER whose declaration is a pointer (`gSym.pBuf`, `gPtr->pBuf`).
+   *  Load, store and compare of such a 4-byte cell are identical for any object-pointer type, so
+   *  the declared pointee never matters to THEM; arithmetic on the loaded value is the opposite
+   *  case, where the pointee's size scales what is added and every stride must therefore be made
    *  explicit (`(u8 *)gPtr + K`). `ctype` cannot see any of this: it types only params/locals, so
-   *  a pointer global renders `undefined` there. */
-  const isPtrGlobal = (x: Expr): boolean => x.k === 'var' && symCtx?.info(x.name)?.shape === 'pointer';
+   *  both spellings render `undefined` there. */
+  const isPtrValue = (x: Expr): boolean =>
+    (x.k === 'var' && symCtx?.info(x.name)?.shape === 'pointer') || ptrMemberDecl(x, symCtx) !== null;
 
   /** Operands `-`/`~` cannot take as spelled: a rendered pointer, a bare `&gSym`, a pointer
    *  global's value. All three are ill-formed C under a unary arithmetic operator — the asm did
    *  32-bit integer math on the address, so that is what gets spelled. */
-  const needsIntSpelling = (x: Expr): boolean => ctype(x)?.kind === 'ptr' || x.k === 'addr' || isPtrGlobal(x);
+  const needsIntSpelling = (x: Expr): boolean => ctype(x)?.kind === 'ptr' || x.k === 'addr' || isPtrValue(x);
 
   // --- loop discovery (loops.ts): natural loops via dominator back-edges + the nesting forest ---
   const forest = analyzeLoops(fn, dom);
@@ -853,11 +1696,46 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     // (entered by a plain br / fall-through) is a bottom-tested loop whose body always runs
     // once — a single-block do-while — and is claimed by the structured-loop discovery below
     // instead (each header lives in exactly ONE map, so seeding stays single-pass).
-    if (!(preds.get(b) ?? []).some((pr) => isGuardShapedPred(pr, b, exit))) {
+    const direct = (preds.get(b) ?? []).some((pr) => isGuardShapedPred(pr, b, exit));
+    // Or THROUGH a pure preheader: the compiler's loop-invariant motion parks computations in a
+    // forwarding block between the guard and the header (the mask re-materialization of a busy
+    // poll). The block must be PURE and unmaterialized — its defs then render inline wherever
+    // the loop reads them and nothing about it needs a statement position of its own — with a
+    // single in-edge and a plain `br` into the header, so the guard's branch is still the only
+    // decision. Anything else keeps the unguarded do-while recovery.
+    // The preheader claim is limited to loops whose header→exit edge carries NO args: with
+    // nothing riding the exit, the fusion site's exit-copy obligations (staleExit, the sink) are
+    // vacuous. The condition and zero-trip hazards stay live there, so redirecting a loop from
+    // the do-while path yields the new shape or a LOUD decline — never silent wrong C.
+    const exitCarriesNothing = (successorTo(b, exit)?.args ?? []).length === 0;
+    const preheader =
+      direct || !exitCarriesNothing
+        ? undefined
+        : (preds.get(b) ?? []).find((P) => {
+            const pt = P.ops[P.ops.length - 1];
+            return (
+              P !== b &&
+              pt?.opcode === 'br' &&
+              P.params.length === 0 &&
+              P.ops.every((o) => !EFFECTFUL_OPS.has(o.opcode) && !materialize.has(o)) &&
+              // at least one def the LOOP BODY reads — the loop-invariant-motion shape this claim
+              // exists for. A block that only computes the init args is the do-while path's
+              // ordinary entry chain, and that path's sink machinery handles it better.
+              P.ops.some((o) => o.results.some((r) => (useSitesOf.get(r) ?? []).some((site) => site.blk === b))) &&
+              (preds.get(P) ?? []).length === 1 &&
+              isGuardShapedPred(preds.get(P)![0], P, exit)
+            );
+          });
+    if (!direct && !preheader) {
       continue;
     }
     const back = successorTo(b, b)!;
-    loops.set(b, { header: b, exit, backArgOfParam: b.params.map((_, i) => back.args[i]) });
+    loops.set(b, {
+      header: b,
+      exit,
+      backArgOfParam: b.params.map((_, i) => back.args[i]),
+      ...(preheader ? { preheader } : {}),
+    });
   }
 
   // --- structured natural loops (test-at-top `while` / bottom-test `do-while`) ---
@@ -866,48 +1744,6 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   // targets) are allowed in-body. The shape then splits on WHERE the exit lives: the HEADER exits
   // (pure test-at-top) → `while`; the LATCH exits (body-first) → `do-while`. Anything that fails
   // declines to plain if-recovery, which re-enters the header and fails loud via `onStack`.
-  const isRet = (blk: Block) => blk.ops[blk.ops.length - 1]?.opcode === 'ret';
-  // A pure "return trampoline" out of the loop: forward-walking from `start` WITHOUT re-entering the
-  // loop `body`, every path terminates in a `ret` and no block on the way carries an OBSERVABLE side
-  // effect (store/astore/call/opaque). agbcc/gcc merge every `return` into ONE epilogue block and each
-  // return site just sets the return register and branches there — so a second body exit that lands on
-  // such a chain is an early RETURN, not a break to a live merge. Structuring it on more than one exit
-  // path is sound precisely because it is side-effect-free (a duplicated `return v` is harmless).
-  // This lets two returns merged through a shared `bx lr` recover as a `while` with an in-body early
-  // `return` instead of declining as "multi-exit".
-  const leadsToReturnOnly = (start: Block, body: Set<Block>): boolean => {
-    const seen = new Set<Block>();
-    const stack = [start];
-    while (stack.length) {
-      const bb = stack.pop()!;
-      if (seen.has(bb)) {
-        continue;
-      }
-      seen.add(bb);
-      if (body.has(bb)) {
-        return false;
-      } // re-enters the loop → not a pure exit
-      if (
-        bb.ops.some(
-          (op) => op.opcode === 'store' || op.opcode === 'astore' || op.opcode === 'call' || op.opcode === 'opaque',
-        )
-      ) {
-        return false;
-      }
-      const t = bb.ops[bb.ops.length - 1];
-      if (t.opcode === 'ret') {
-        continue;
-      }
-      if (t.opcode === 'br' || t.opcode === 'cond_br') {
-        for (const s of t.successors) {
-          stack.push(s.block);
-        }
-        continue;
-      }
-      return false; // switch_br / unknown terminator → decline
-    }
-    return true;
-  };
   const whileLoops = new Map<Block, WhileLoopInfo>();
   const doWhileLoops = new Map<Block, DoWhileInfo>();
   for (const nl of forest.byHeader.values()) {
@@ -963,14 +1799,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     // whose result also feeds the body would be evaluated twice per iteration). A `load` is fine —
     // but NOT a materialized one: its temp assignment renders only via sideEffects(), which a
     // condition-only header never emits, so its uses would read an unassigned variable.
-    const headerPure = !h.ops.some(
-      (op) =>
-        op.opcode === 'store' ||
-        op.opcode === 'astore' ||
-        op.opcode === 'opaque' ||
-        op.opcode === 'call' ||
-        materialize.has(op),
-    );
+    const headerPure = !h.ops.some((op) => EFFECTFUL_OPS.has(op.opcode) || materialize.has(op));
 
     let exitFrom: Block,
       exit: Block,
@@ -991,14 +1820,25 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
       continue; // neither a clean pre-tested nor bottom-tested single-exit shape
     }
     // Single loop exit (ret-aware): the chosen exit is the ONE real exit; every OTHER edge leaving
-    // the body must be an early `return` — a ret-terminated target OR a pure return-trampoline chain
-    // (agbcc's merged epilogue; `leadsToReturnOnly`). A second exit that lands on a LIVE non-return
-    // merge is a genuine `break`/second structured exit → decline.
-    if (
-      nl.exitEdges.some(
-        (e) => !(e.from === exitFrom && e.to === exit) && !isRet(e.to) && !leadsToReturnOnly(e.to, nl.body),
-      )
-    ) {
+    // the body must be an early `return` (`earlyReturnArm`) or a ret-terminated target. A second exit
+    // that lands on a LIVE non-return merge is a genuine `break`/second structured exit → decline.
+    // The arms are kept: emission needs to know which edges out of the body end an iteration rather
+    // than continue it.
+    const arms: LoopArm[] = [];
+    let singleExit = true;
+    for (const e of nl.exitEdges) {
+      if (e.from === exitFrom && e.to === exit) {
+        continue;
+      }
+      const owned = earlyReturnArm({ dom, reachFrom }, e.from, e.to, nl.body, exit);
+      if (owned) {
+        arms.push({ from: e.from, to: e.to, owned });
+      } else if (!isRet(e.to)) {
+        singleExit = false;
+        break;
+      }
+    }
+    if (!singleExit) {
       continue;
     }
 
@@ -1010,9 +1850,10 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         latch,
         forwardPreds: nl.forwardPreds,
         body: nl.body,
+        arms,
       });
     } else {
-      doWhileLoops.set(h, { header: h, latch, exit, forwardPreds: nl.forwardPreds, body: nl.body });
+      doWhileLoops.set(h, { header: h, latch, exit, forwardPreds: nl.forwardPreds, body: nl.body, arms });
     }
   }
 
@@ -1028,12 +1869,27 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     varName.set(p, `a${i}`);
     varType.set(`a${i}`, p.type);
   });
+  /** The function's own parameters, as VALUES — `FRESH_MERGE_GATES`' `param-rooted` half. A name
+   *  test would not do: a loop variable that adopted `a0` carries the name without being the
+   *  parameter. */
+  const entryParams = new Set<Value>(entry.params);
+  /** Merge params that took a fresh home because `param-rooted` refused their parameter carrier —
+   *  the set's other half, so a further merge carrying one of them is refused too. It records the
+   *  merges that ended up FRESH and no others: one that refuses a parameter and then adopts an
+   *  ordinary local passes the value on under that local's name (336 firings over 6 corpus rows),
+   *  which is the chain-rooted widening rather than this rule. */
+  const paramSeededMerges = new Set<Value>();
   const backArgName = new Map<Value, string>();
   // The C static type of a rendered expression, over the declared variable types — what decides
   // whether a memory access's base may be dereferenced as spelled (memAccess/arrayAccess).
-  const ctype = (e0: Expr): IrType | undefined => exprCType(e0, (n) => varType.get(n));
+  const vtEnv = (n: string): IrType | undefined => varType.get(n);
+  const ctype = (e0: Expr): IrType | undefined => exprCType(e0, vtEnv);
 
-  /** `&gSym` assigned to a `T *` local: the address of an AGGREGATE is not a pointer to its
+  /** A value assigned into a TEMP THIS PASS DECLARES, spelled so the assignment is legal against
+   *  that declaration. Two inhabitants, one argument: the value's type comes from somewhere this
+   *  pass does not control, and the temp's comes from here.
+   *
+   *  `&gSym` assigned to a `T *` local: the address of an AGGREGATE is not a pointer to its
    *  element. `&gArr` is `T (*)[n]`, `&gStruct` is `struct S *`, and neither is assignable to
    *  `T *` — yet the IR's `gaddr` value legitimately has type `T *`, because that is what the asm
    *  loaded. The bare spelling therefore states a type the project's own header contradicts.
@@ -1046,17 +1902,34 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
    *  moves either way and the rule that decides it is pinned in test/deref-typing.test.ts instead.
    *
    *  The test is whether `&gSym`'s rendered type PROVABLY equals the destination's, not whether the
-   *  symbol looks like an aggregate. A shape enumeration got this wrong three ways, each a real
-   *  miss: `shape:'pointer'` declares a pointer cell (`void *gSym`, or `struct Tag *gSym` when the
-   *  pointee has a declarable layout), so `&gSym` is a pointer-to-pointer either way; a `shape:'scalar'`
+   *  symbol looks like an aggregate. A SHAPE ENUMERATION MISSES THREE WAYS, each real:
+   *  `shape:'pointer'` declares a pointer cell (`void *gSym`, or `struct Tag *gSym` when the pointee
+   *  has a declarable layout), so `&gSym` is a pointer-to-pointer either way; a `shape:'scalar'`
    *  whose width differs from the destination's pointee gives `s32 *` for a `u16 *` slot; and a
-   *  NAME-ONLY symbol is synthesized as `extern u32 gSym;` (declare.ts), which is `u32 *` — not the
-   *  `T *` the older comment here claimed. So the default is to CAST, and the cast is omitted only
+   *  NAME-ONLY symbol is synthesized as `extern u32 gSym;` (declare.ts), which is `u32 *`. So the
+   *  default is to CAST, and the cast is omitted only
    *  where the declared cell type is known and matches exactly. Byte-identical either way, so the
    *  cost of casting one time too many is a redundant `(T *)`, never a wrong address. */
-  const castAggregateAddr = (name: string, value: Expr): Expr => {
+  const intoDeclaredTemp = (name: string, value: Expr): Expr => {
     const t = varType.get(name);
-    if (t?.kind !== 'ptr' || value.k !== 'addr') {
+    if (t === undefined) {
+      return value;
+    }
+    // ── the MAP's pointer values, whose type this side of the program does not own ──────────────
+    // A `gaddr` at least states a type the IR knows. `gSym.pBuf` and a pointer global's own value
+    // state one only the MAP knows, and `ctype` — which types params and locals — reads them as
+    // `undefined`, so the test above cannot see them at all. Assigning one bare declares that the
+    // temp's type and the project's declaration of that pointer are the same type, which nothing
+    // here established: the project's header says `struct Unk_03005284 *` where the recovered temp
+    // says `struct Struct0 *`, and `-Werror` makes the mismatch fatal in the tree the source is
+    // pasted into. The destination's type is the one this pass DID choose, so unlike the
+    // map-declared cells below it can be named exactly rather than defused through `void *`. That
+    // holds for an INTEGER temp too, and there the diagnostic is the mirror one, `assignment makes
+    // integer from pointer without a cast` — same site, same argument, same `(T)` answer.
+    if (isPtrValue(value)) {
+      return { k: 'cast', to: t, e: value };
+    }
+    if (t.kind !== 'ptr' || value.k !== 'addr') {
       return value;
     }
     // The only provably-redundant case: a NON-VOLATILE scalar cell whose DECLARED type is the
@@ -1111,7 +1984,35 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
       paramBlock.set(pv, blk);
     }
   }
+  // AND THE NAME MUST BE EXACTLY AS WIDE AS `p`. Every edge into `B` copies its argument into
+  // `name`, which is a C assignment through `name`'s declaration, and the name's type is fixed by
+  // its FIRST claimant — so a width mismatch loses a truncation in one direction or the other:
+  //   • name NARROWER than the merged value truncates it. `u8 a0` (raise/paramwidth.ts) adopted by
+  //     a merge of `a0` with `0x1234` emits `a0 = 4660`, which agbcc compiles to 52.
+  //   • name WIDER than a narrow carrier drops the extension the carrier's declaration WAS. A
+  //     narrow block parameter (raise/narrowlocal.ts) has had its one reading extension deleted
+  //     against the promise that reading the local re-applies it, so adopting an `s32` name emits
+  //     `*out = a0` where the graph says `*out = (s16)a0` — a silent wrong answer, not a worse one.
+  // Register-width carriers are unaffected — a pointer or an `unknown` is a full word, so the two
+  // narrow-typing passes are the only producers either half can see.
+  //
+  // AND AT A SUB-WORD WIDTH, THE SIGNEDNESS IS PART OF THE WIDTH. A narrow declaration is where
+  // the extension went, and `u8` re-applies a DIFFERENT extension than `s8` — same bytes in the
+  // variable, different value at every read. `sa3`'s `sub_80B4654` (the IR is built in
+  // test/narrow-local.test.ts) merges a `zext8` arm with its own `u8` parameter and reads the merge
+  // through `lsls #24 / asrs #24`: the carrier is `s8`, and
+  // letting it adopt the `u8` parameter's name emits `sub_80B4FA8(a0, a1, …)`, which passes 144
+  // where the target passes -112 for every byte with bit 7 set. Width alone said 8 === 8 and
+  // admitted it — a silent wrong answer, not a worse score. At 32 bits the two spellings ARE the
+  // same bytes at a read, which is the mismatch `structure/namecoalesce.ts`'s header names and this
+  // rule deliberately still tolerates.
   const canTakeName = (p: Value, B: Block, name: string, pureAlias = false): boolean => {
+    if (carrierWidth(varType.get(name)) !== carrierWidth(p.type)) {
+      return false;
+    }
+    if (carrierSign(varType.get(name)) !== carrierSign(p.type)) {
+      return false;
+    }
     if (B.params.some((q) => q !== p && varName.get(q) === name)) {
       return false;
     }
@@ -1142,8 +2043,68 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         return false;
       }
     }
+    // AND A VALUE NOBODY NAMED IS STILL A READER OF THIS NAME. The loop above asks which NAMED
+    // values are live at `B`; an unnamed one is not stored anywhere, it is RE-DERIVED at its use
+    // from whatever its operands are called then — so a value live into `B` whose inlined
+    // expression mentions `name` reads the merge's assignment instead of what it was defined from.
+    // `s32 t = a - b; if (a > 0) { a = a + b; } return a + t;` is the whole shape: `t` is inlined,
+    // the merge takes `a0`, and the emitted `return a0 + (a0 - a1)` computes 13 where the asm
+    // computes 10 — agbcc emits exactly that asm, so this is not a generated-IR curiosity. The
+    // walk stops at any value with a name of its own (it reads THAT name) and at a materialized
+    // def (it is assigned at its own position, which the clause above already judges).
+    if (!pureAlias) {
+      const reDerives = (w: Value, seen: Set<Value>): boolean => {
+        if (w === p || seen.has(w)) {
+          return false;
+        }
+        seen.add(w);
+        const nm = varName.get(w);
+        if (nm !== undefined) {
+          return nm === name;
+        }
+        const d = defs.get(w);
+        if (!d || materialize.has(d)) {
+          return false;
+        }
+        return d.operands.some((o) => reDerives(o, seen));
+      };
+      for (const w of lin) {
+        if (reDerives(w, new Set())) {
+          return false;
+        }
+      }
+    }
     return true;
   };
+  // Does the edge `pr -> b` hand `c` over as a loop variable's PRE-update value? True when `c` is a
+  // loop header's own param and the edge leaves the loop from a latch of an emitter that places
+  // the update at the BOTTOM of the body — the self-loop `while` and the `do-while`. `c` there
+  // means the value the variable held at the top of the exiting iteration, so a merge param
+  // sharing its name would read one iteration on, silently. Keeping the names apart is also what
+  // lets those emitters sink the copy into the body; sharing them would make it a self-assignment.
+  //
+  // Four shapes are NOT this, and must keep coalescing:
+  //   - the loop is emitted by neither of those two. A test-at-top `while` puts its exit copies in
+  //     the sibling arm of the latch's `cond_br`, AHEAD of the update, so the name is still the
+  //     top-of-iteration value there (`while (p) { if (p->key == k) return p; p = p->next; }`);
+  //   - the edge leaves from the HEADER rather than a latch — same reason;
+  //   - the back-edge arg for `c`'s own slot is `c`: that slot is never rewritten;
+  //   - `c` is itself a back-edge arg — the compiler already carries the trailing value in a
+  //     second loop variable, so the un-rotation substitution reads it under that one's name.
+  //     Same exemption `readsClobbered` makes for a `sub`-mapped value.
+  const carriesPreUpdate = (c: Value, pr: Block, b: Block): boolean => {
+    const header = paramBlock.get(c);
+    const nl = header && forest.byHeader.get(header);
+    if (!nl || nl.body.has(b) || !nl.body.has(pr)) {
+      return false;
+    }
+    if (!loops.has(header!) && doWhileLoops.get(header!)?.latch !== pr) {
+      return false;
+    }
+    const back = successorTo(pr, header!);
+    const k = header!.params.indexOf(c);
+    return !!back && k >= 0 && back.args[k] !== c && !back.args.includes(c);
+  };
   // ONE seeding routine for self-loop and structured-loop headers. On a coalesceLoopInit target,
   // keep the induction variable in its entry (forward-edge) value's register — reproducing a
   // compiler that mutates the arg register across the loop instead of copying to a fresh local,
@@ -1169,6 +2130,29 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
             }
           }
         }
+        // A MATERIALIZED back-edge arg is this variable's in-place update (`add r4, r4, r0`
+        // mutates the same register the param lives in) — adopt its name so the def assigns the
+        // loop variable directly and the update copy elides. Sound only when every read of the
+        // param sits at-or-before the def in the header (the def's own operands included): the
+        // assignment splits the iteration into old-value-before / new-value-after, and a later
+        // read of the OLD value would silently get the new one — position-granular, because
+        // liveness is block-granular and the param is killed from its own block's liveIn.
+        if (name === undefined) {
+          const ba = backArgs?.[i];
+          const d = ba !== undefined ? defs.get(ba) : undefined;
+          const nm = ba !== undefined ? varName.get(ba) : undefined;
+          if (
+            nm !== undefined &&
+            !exclude.has(nm) &&
+            d !== undefined &&
+            materialize.has(d) &&
+            opBlock.get(d) === header &&
+            (useSitesOf.get(p) ?? []).every((s) => s.blk === header && s.idx <= opIndex.get(d)!) &&
+            canTakeName(p, header, nm)
+          ) {
+            name = nm;
+          }
+        }
         name ??= `v${fresh++}`;
         varName.set(p, name);
         if (!varType.has(name)) {
@@ -1176,6 +2160,15 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         }
       }
       exclude.add(varName.get(p)!);
+      // THE BACK-EDGE ARGUMENT TAKES THE HEADER'S NAME, UNCONDITIONALLY — so if `p` is declared
+      // NARROW, every other reader of that argument reads it through the truncation. This site
+      // does not check that, and deliberately: the promise is a precondition of producing a narrow
+      // block parameter at all, held by `raise/narrowlocal.ts`'s `edge-reader` gate (every in-edge
+      // value is read nowhere but through an extension no wider than the declaration keeps). A
+      // width test HERE would be the wrong shape — it would refuse the loop's own update copy and
+      // silently un-coalesce it. Any future producer of a sub-word block parameter owes the same
+      // gate; without it this line emits `s16 v; do { … v = v + 1; } while (v < 32768);`, which
+      // agbcc compiles to an unconditional branch.
       if (backArgs) {
         backArgName.set(backArgs[i], varName.get(p)!);
       }
@@ -1247,32 +2240,52 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         if (varName.has(p)) {
           return;
         }
-        // EVERY in-edge record, not successorTo (which returns only the FIRST record to `b` — a
-        // terminator with two edges to the same block would hide the second edge's args here).
-        const incoming: Value[] = [];
-        for (const pr of new Set(preds.get(b) ?? [])) {
-          for (const s of pr.ops[pr.ops.length - 1].successors) {
-            if (s.block === b) {
-              incoming.push(s.args[i]);
-            }
-          }
+        const incoming: { v: Value; pr: Block }[] = [];
+        for (const { pred, succ } of inEdgeRecords(preds, b)) {
+          incoming.push({ v: succ.args[i], pr: pred });
         }
         // A redundant phi (every edge passes the SAME value) is a pure alias of it — sharing the
         // name is sound even while the value stays live (they are equal on every path). This
         // waives only the LIVENESS half of canTakeName; the sibling-param check always applies.
-        const allSame = incoming.length > 0 && incoming.every((v) => v === incoming[0]);
+        const allSame = incoming.length > 0 && incoming.every((c) => c.v === incoming[0].v);
         // prefer a carrier that already has a name; then a loop var whose update this receives —
         // but only one whose name survives the C3 interference check (else the edge copies into
         // the name would clobber a still-live value).
         let name: string | undefined;
-        for (const c of [...incoming.filter((v) => varName.has(v)), ...incoming.filter((v) => backArgName.has(v))]) {
-          const nm = varName.get(c) ?? backArgName.get(c)!;
-          if (canTakeName(p, b, nm, allSame)) {
-            name = nm;
-            break;
+        /** Set when `FRESH_MERGE_GATES` refused a carrier here — not "the one reason this merge
+         *  went unnamed", since the rejections above it `continue` without recording. Over-marking
+         *  costs one downstream merge an extra fresh home, a spelling the differ referees. */
+        let refusedParamCarrier = false;
+        for (const c of [
+          ...incoming.filter((c) => varName.has(c.v)),
+          ...incoming.filter((c) => backArgName.has(c.v)),
+        ]) {
+          const nm = varName.get(c.v) ?? backArgName.get(c.v)!;
+          if (carriesPreUpdate(c.v, c.pr, b) || !canTakeName(p, b, nm, allSame)) {
+            continue;
+          }
+          // `freshParamMerge` (the `/fresh-merge` axis): this merge takes its own home rather
+          // than the carrier's name — `FRESH_MERGE_GATES` above holds the admission and the
+          // argument for it. Absent the option nothing changes.
+          if (
+            freshParamMerge &&
+            reHomesParamMerge(
+              { allSame, paramRooted: entryParams.has(c.v) || paramSeededMerges.has(c.v) },
+              hooks.freshMergeGates,
+            )
+          ) {
+            refusedParamCarrier = true;
+            continue;
+          }
+          name = nm;
+          break;
+        }
+        if (name === undefined) {
+          name = `v${fresh++}`;
+          if (refusedParamCarrier) {
+            paramSeededMerges.add(p);
           }
         }
-        name ??= `v${fresh++}`;
         varName.set(p, name);
         if (!varType.has(name)) {
           varType.set(name, p.type);
@@ -1282,6 +2295,113 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     }
   }
 
+  // ── copy coalescing over the interference graph (namecoalesce.ts) ────────────────────────────
+  // The walk above adopts a name only BACKWARD along an edge, once, in address order — so a merge
+  // parameter whose arguments were still unnamed took a fresh one and kept it. With every name now
+  // settled, `coalesceNames` asks which two of them a would-be copy joins and whether the values
+  // under them ever interfere. Applied here, before anything reads the names: `anchorConstCopies`
+  // below counts the values under a name, and emission spells them.
+  if (coalesceMergeNames) {
+    const { renames } = coalesceNames(
+      {
+        blocks: fn.blocks,
+        entry,
+        preds,
+        liveIn,
+        opBlock,
+        opIndex,
+        useSitesOf,
+        defs,
+        materialize,
+        varName,
+        varType,
+        loops: [...forest.byHeader.values()].map((nl) => ({ header: nl.header, body: nl.body })),
+      },
+      hooks.nameCoalesceGates,
+    );
+    for (const [v, n] of varName) {
+      const r = renames.get(n);
+      if (r !== undefined) {
+        varName.set(v, r);
+      }
+    }
+    for (const [v, n] of backArgName) {
+      const r = renames.get(n);
+      if (r !== undefined) {
+        backArgName.set(v, r);
+      }
+    }
+  }
+
+  // ── declaration-signedness reconciliation ──────────────────────────────────────────────────
+  // A name's declared type is its FIRST claimant's, and the first claimant of a u32 loop counter
+  // is often an s32-typed sibling (the pre-increment value, a const's copy) — so the counter
+  // declares s32, every compare through it renders signed, and an unsigned icmp silently
+  // compiles to the compare the machine never did (the compare-cast at CMP_TO_BIN patches the
+  // sites it can see, but a later re-spell can substitute the var into a compare that needed no
+  // cast at emission — the initfirst guard swap). The declaration is the honest fix: a name
+  // flips to u32 when SOME value under it is u32-typed and NO value under it carries signed-use
+  // evidence (the transitive input cone of any icmp_s* / sdiv / smod / shr_s). Only int32
+  // declarations reconcile; the flip is byte-invariant everywhere but the unsigned compares it
+  // corrects (+/-/*/&/|/^/<< are sign-blind; the signedness-carrying pairs — `>>`/`>>>` and
+  // `/`/`%` against `/u`/`%u` — say which they are through the backend's operand pin, so no
+  // declaration can change what they render; and SIGNED division is evidence-blocked).
+  if (unsignedCompareSpelling) {
+    // Signed-use evidence is the TRANSITIVE INPUT CONE of every signed op — a claimant can feed
+    // an icmp_slt through an inline `sub` and the flip would still render that compare unsigned
+    // (`v - 5 >= 0`, always true in C), so direct operands are not enough. The cone also crosses
+    // edge arg↔param identities in BOTH directions: a kept-guard's substitution (gsub) renders an
+    // init ARG under the loop variable's name, so a signed guard over the arg is evidence against
+    // the name even though the arg claims it in neither naming map. Over-tainting only blocks
+    // flips: conservative-safe.
+    const SIGNED_USE = new Set(['icmp_slt', 'icmp_sle', 'icmp_sgt', 'icmp_sge', 'sdiv', 'smod', 'shr_s']);
+    // The arg↔param identity is `ir/core.ts`'s `mergeClasses` — a CFG/SSA fact rather than a rule
+    // of this pass, and a hand-rolled copy here is one more thing free to drift from it. The walk
+    // below is transitive, so seeding it with the whole CLASS is the same closure as seeding it
+    // with the direct peers.
+    const edgePeers = mergeClasses(fn);
+    const signedEvidence = new Set<Value>();
+    const work: Value[] = [];
+    for (const b of fn.blocks) {
+      for (const op of b.ops) {
+        if (SIGNED_USE.has(op.opcode)) {
+          work.push(...op.operands);
+        }
+      }
+    }
+    while (work.length) {
+      const v = work.pop()!;
+      if (!signedEvidence.has(v)) {
+        signedEvidence.add(v);
+        const d = defs.get(v);
+        if (d) {
+          work.push(...d.operands);
+        }
+        work.push(...(edgePeers.get(v) ?? []));
+      }
+    }
+    // Params never reconcile: their declarations come from p.type, not varType, so a flip here
+    // would only desync the cast site's view from the emitted declaration — and param signedness
+    // is the sign-pin axis's dimension.
+    const paramNames = new Set(entry.params.map((_, i) => `a${i}`));
+    const claimants = new Map<string, Value[]>();
+    for (const [v, n] of [...varName, ...backArgName]) {
+      (claimants.get(n) ?? claimants.set(n, []).get(n)!).push(v);
+    }
+    for (const [n, vs] of claimants) {
+      const t = varType.get(n);
+      if (paramNames.has(n) || t?.kind !== 'int' || t.width !== 32 || !t.signed) {
+        continue;
+      }
+      if (
+        vs.some((v) => v.type.kind === 'int' && v.type.width === 32 && !v.type.signed) &&
+        vs.every((v) => !signedEvidence.has(v))
+      ) {
+        varType.set(n, T.u(32));
+      }
+    }
+  }
+
   // ── def-site anchoring of constant merge copies (anchorConstCopies) ──────────────────────────
   // An edge copy `v = K` places the constant where the EDGE is, but the asm often materialized K
   // earlier: `movs r9, #0` at entry ahead of a single-armed overwrite, `movs r5, #1` at the top
@@ -1294,7 +2414,15 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   // REFUSAL CONDITIONS — each keeps the edge placement, never producing a different write:
   //   - the arg is not an UNNAMED `const` op (only a rematerializable constant carries
   //     unambiguous placement evidence; a named value's position is its materialized def's);
-  //   - the merge is a loop header (loop copies have their own placement discipline);
+  //   - the merge is a LOOP HEADER, unless `anchorLoopEntryConsts` is also on and the loop is
+  //     entered through ONE preheader with no value living outside the body under the same name.
+  //     A loop header's entry arg is the one merge arg whose def sits legitimately far above its
+  //     edge — `int s = 0;` ahead of a `for` accumulating into it — and the carried values that
+  //     share its name are what the name rule below would refuse it on. Anchoring holds exactly
+  //     when the name is written nowhere outside the loop but at the anchored site: the entry
+  //     copy runs once, before the body, and every other write to it is a back-edge copy strictly
+  //     after. Its own flag because it is a SECOND placement decision, and one boolean covering
+  //     both would delete a spelling rather than add one (see the option's doc);
   //   - the const's block does not dominate every edge source passing it (the anchored write
   //     must precede the edge on every path);
   //   - the const's block or any edge source sits inside ANY loop. Block-level dominance does
@@ -1302,11 +2430,31 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   //     suppressed edge in iteration 2 with the variable overwritten in between, the /preinit
   //     sticky-arm failure class (PR #13) — so in-loop shapes are declined outright;
   //   - the merge variable names any OTHER SSA value (a shared name has readers and writers
-  //     between the def site and the edge that edge placement respects and anchoring would not);
+  //     between the def site and the edge that edge placement respects and anchoring would not).
+  //     A loop header's carried value is the exception above: its other claimants all live in
+  //     the body. `freshParamMerge` WIDENS what this admits — a minted home is sole by
+  //     construction — which is the pairing `/fresh-merge` and `/defsite` match `clampu8` on;
   //   - another anchored const of the same variable lies on a path from this one to this one's
   //     edge (the later write would clobber this arg's value; both stay at their edges instead).
-  const anchoredAt = new Map<Op, { name: string; arg: Value }[]>();
+  //
+  // What the list does NOT cover is whether the def site is RENDERED at all; an anchor that lands
+  // in an elided block declines the whole function instead, at the postcondition after the render.
+  /** Where a value is WRITTEN: its block for a param, its def op's block otherwise — the two
+   *  halves of "where is this defined" asked as one question. Used by def-site anchoring below to
+   *  order a write against an edge, and by Regime-A switch recovery (through `SwitchRecoverDeps`)
+   *  to ask whether a hoisted argument is available at the dispatch root; passed there rather than
+   *  rebuilt, since `paramBlock` and `opBlock` are this scope's own. */
+  const blockOf = (v: Value): Block | undefined => {
+    const d = defs.get(v);
+    return paramBlock.get(v) ?? (d === undefined ? undefined : opBlock.get(d));
+  };
+  type AnchoredWrite = { name: string; arg: Value };
+  const anchoredAt = new Map<Op, AnchoredWrite[]>();
   const suppressedArgs = new Map<object, Set<number>>();
+  /** Every anchored write `sideEffects` actually rendered. The other half of the postcondition
+   *  below: suppressing an edge copy is a PROMISE that the def site emits the write instead, and
+   *  only the render can report that the promise was kept. */
+  const anchorsEmitted = new Set<AnchoredWrite>();
   if (anchorConstCopies) {
     const nameCount = new Map<string, number>();
     for (const n of varName.values()) {
@@ -1323,27 +2471,47 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     // conservative "a write in `a` may execute between one in `b` and `b`'s terminator": same
     // block counts (op order refined by the caller where it matters), else CFG reachability
     const mayFollow = (a: Block, b: Block): boolean => a === b || reachFrom(a).has(b);
+    // A loop entered from ONE preheader — what makes "every write to the name outside the anchored
+    // one is a back-edge copy" statable: the premise is over ONE entry edge. CONSERVATIVE: two
+    // entry consts anchored at their own def sites would still order correctly, and this refuses
+    // the shape rather than reasoning about it. The other half of "entered only through its
+    // header" needs no test — `analyzeLoops` builds the body as the backward closure from the
+    // latches with the header already in it (loops.ts), so a body block's predecessors are all in
+    // the body by construction.
+    const singleEntry = (nl: NaturalLoop): boolean => nl.forwardPreds.length === 1;
     for (const M of fn.blocks) {
-      if (M === entry || M.params.length === 0 || forest.byHeader.has(M)) {
+      if (M === entry || M.params.length === 0) {
+        continue;
+      }
+      const loop = anchorLoopEntryConsts ? forest.byHeader.get(M) : undefined;
+      if (forest.byHeader.has(M) && (loop === undefined || !singleEntry(loop))) {
         continue;
       }
       M.params.forEach((p, i) => {
         const name = varName.get(p)!;
-        if (nameCount.get(name) !== 1) {
+        // the name belongs to this merge alone — or, at a loop header, to this merge and the
+        // body's own carried values, which are written only on the back edge
+        const soleClaimant =
+          nameCount.get(name) === 1 ||
+          (loop !== undefined &&
+            [...varName].every(([v, n]) => {
+              if (n !== name || v === p) {
+                return true;
+              }
+              const b = blockOf(v);
+              return b !== undefined && loop.body.has(b);
+            }));
+        if (!soleClaimant) {
           return;
         }
         // every in-edge record into M, grouped by the SSA value it passes for param i
         const groups = new Map<Value, { rec: { block: Block; args: Value[] }; src: Block }[]>();
-        for (const pr of new Set(preds.get(M) ?? [])) {
-          for (const s of pr.ops[pr.ops.length - 1].successors) {
-            if (s.block === M) {
-              const g = groups.get(s.args[i]);
-              if (g) {
-                g.push({ rec: s, src: pr });
-              } else {
-                groups.set(s.args[i], [{ rec: s, src: pr }]);
-              }
-            }
+        for (const { pred, succ } of inEdgeRecords(preds, M)) {
+          const g = groups.get(succ.args[i]);
+          if (g) {
+            g.push({ rec: succ, src: pred });
+          } else {
+            groups.set(succ.args[i], [{ rec: succ, src: pred }]);
           }
         }
         const candidates: { arg: Value; def: Op; defBlock: Block; edges: { rec: object; src: Block }[] }[] = [];
@@ -1393,115 +2561,29 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     }
   }
 
-  // ── BITFIELD member reads (symbol map) ──────────────────────────────────────────────────────
-  // The `(x << a) >> b` extract of a struct global's loaded bytes IS a bitfield access when the
-  // map declares a bitfield at exactly those bits: spelled `gSym.field`, the source form, whose
-  // declared `u32 field : n` then makes C's own integer promotion reproduce the signedness every
-  // downstream operator compiled with (a 7-bit unsigned field promotes to signed int — sdiv
-  // renders `/` and recompiles to __divsi3, where the raw-shift spelling stays u32).
-  //
-  // Semantically EXACT, never approximate: the window must lie inside the loaded bytes (so the
-  // load's extension bits cannot reach it), the field's position, width and signedness must all
-  // match the extract (a logical shift is an unsigned read, an arithmetic one a signed read —
-  // a signless field never matches), and the member must be nameable at all (memberQualsAllow;
-  // the map only carries bitfield facts for little-endian ELFs — see SymbolStructField). Any
-  // mismatch keeps the honest shift spelling.
-  //
-  // Precomputed over the ops (not folded during rendering) for the load's sake: a load whose
-  // EVERY use is a spelled extract chain must not also emit its materialized `v = *(u16 *)&g;`
-  // temp — the compiler CSEs the repeated member reads back to one load, but the leftover temp
-  // would be a second one. A VOLATILE container refuses the whole fold: N member reads are N
-  // volatile accesses where the asm did one load. (Byte-level residual, differ-refereed: a load
-  // only PARTIALLY absorbed — one extract spelled, another use kept — emits both the temp and
-  // the named reads, one load more than the asm; semantics hold, the score decides.)
-  //
-  // ORDERING GATE (adversarial round, CRITICAL 1 — twice): the named spelling replaces a
-  // REGISTER value — the bits captured at the load's program position — with a fresh memory
-  // read at each render position. Every other memory read in this file goes through the
-  // materialization model (analysis.ts) for exactly that hazard, so the fold clears the SAME
-  // bar with the SAME machinery: `emitPos` resolves where each extract actually renders
-  // (transitively through its inlining consumers — an unresolvable position refuses), and
-  // `memWriteBetween` walks every def-avoiding load→render path for a call, an opaque, or a
-  // store not provably to a DIFFERENT named global. Path-based on purpose: the second audit
-  // pass broke the first fix's linear-position scan with a block laid out AFTER the render in
-  // address order but executing between load and render on the taken path — fn.blocks order is
-  // address order, not topological order.
-  const bitfieldSpelling = new Map<Op, { global: string; field: string }>();
-  const absorbedLoads = new Set<Op>();
-  if (symCtx && littleEndian && spellBitfieldMembers) {
-    // the (name, byte) of a load's address when it resolves through defs alone — `gaddr` or
-    // `add(gaddr, const)`; anything else (a materialized base, a variable index) declines. THE
-    // shared L2 disjointness query (ir/alias.ts), which the materialization model consults with
-    // the same rule, so the fold and the model cannot disagree about what a store can reach.
-    const loadTargets = new Map<Op, GlobalCell>();
-    const addrOf = (v: Value, off: number): GlobalCell | null => globalCellOf(defs, v, off);
-    // A write for the fold's purposes: calls and opaques always; a store/astore unless its base
-    // resolves to a global PROVABLY different from the folded one.
-    const mayWrite = (sym: string) => mayWriteGlobal(defs, sym);
-    for (const blk of fn.blocks) {
-      for (const op of blk.ops) {
-        if ((op.opcode !== 'shr_u' && op.opcode !== 'shr_s') || op.operands.length !== 1) {
-          continue;
-        }
-        const b = op.attrs.imm as number | undefined;
-        const inner = defs.get(op.operands[0]);
-        if (typeof b !== 'number' || b <= 0 || b >= 32 || inner?.opcode !== 'shl' || inner.operands.length !== 1) {
-          continue;
-        }
-        const a = inner.attrs.imm as number | undefined;
-        if (typeof a !== 'number' || a < 0 || b < a) {
-          continue;
-        }
-        const w = 32 - b; // extract width
-        const lo = b - a; // low bit within the loaded value
-        const load = defs.get(inner.operands[0]);
-        if (load?.opcode !== 'load' || lo + w > (load.attrs.width as number) * 8) {
-          continue;
-        }
-        // a materialized shl would still emit its `v = x << a` temp reading the load — the fold
-        // would then ADD member reads on top of it; rare, refuse
-        if (materialize.has(inner)) {
-          continue;
-        }
-        const gb = addrOf(load.operands[0], load.attrs.off as number);
-        const si = gb ? symCtx.info(gb.name) : undefined;
-        if (!gb || si?.shape !== 'struct' || si.volatile) {
-          continue;
-        }
-        // where does the member read RENDER? at the extract's own position when materialized,
-        // else wherever each of its consumers ultimately renders (emitPos, transitively —
-        // unresolvable refuses); every load→render path must be write-free
-        const renders = materialize.has(op)
-          ? [{ blk: opBlock.get(op)!, idx: opIndex.get(op)! }]
-          : [...new Set((useSitesOf.get(op.results[0]) ?? []).map((s) => s.op))].map((c) => emitPos(c));
-        const writes = mayWrite(gb.name);
-        if (renders.some((r) => r === null) || renders.some((r) => memWriteBetween(load, r!, writes))) {
-          continue;
-        }
-        const signedRead = op.opcode === 'shr_s';
-        const fld = declaredFields(si.layout)?.find(
-          (f) => f.bitWidth === w && f.offset * 8 + f.bitOffset! === gb.byte * 8 + lo && f.signed === signedRead,
-        );
-        if (fld && memberQualsAllow(fld, si.const, false)) {
-          bitfieldSpelling.set(op, { global: gb.name, field: fld.name });
-          loadTargets.set(load, gb);
-        }
-      }
-    }
-    // a load is ABSORBED when every use is an shl whose every use is a spelled extract
-    for (const load of loadTargets.keys()) {
-      const shls = useSitesOf.get(load.results[0]) ?? [];
-      const absorbed =
-        shls.length > 0 &&
-        shls.every(
-          (u) =>
-            u.op.opcode === 'shl' && (useSitesOf.get(u.op.results[0]) ?? []).every((v) => bitfieldSpelling.has(v.op)),
-        );
-      if (absorbed) {
-        absorbedLoads.add(load);
-      }
-    }
-  }
+  // ── BITFIELD member spelling (structure/bitfields.ts) ───────────────────────────────────────
+  // The read fold, the mask-and-insert WRITE fold and the absorbed-load set, precomputed over the
+  // ops before any rendering. Extracted behind an explicit-deps factory: every dependency below is
+  // READ-only, so this cannot participate in the naming pipeline this file's remainder is built
+  // around. The module header states what each fold recognizes and every refusal it carries.
+  const {
+    spelling: bitfieldSpelling,
+    stores: bitfieldStore,
+    absorbed: absorbedLoads,
+  } = makeBitfieldSpelling({
+    fn,
+    defs,
+    materialize,
+    useSitesOf,
+    opBlock,
+    opIndex,
+    emitPos,
+    memWriteBetween,
+    sym: symCtx,
+    littleEndian,
+    enabled: spellBitfieldMembers,
+    memberQualsAllow,
+  });
 
   // An unresolvable value: strict mode keeps the `"?"` sentinel AND records the reason — the
   // decline thrown below names the actual gaps ("unmodelled instruction 'adde'"), the same
@@ -1542,24 +2624,118 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
       // sign-agnostic ==/!=) spell `(u32)&gSym`, signed compares `(s32)&gSym` — exactly the
       // compare the asm did. The deref folds never see a compare operand, so no named spelling is
       // lost; a NARROWING cast (`(u8)&gSym`) is not a bare `addr` and keeps its truncation.
-      // SCOPE (adversarial review): this closes the hole for BARE addr operands only. An
-      // addr-carrying arithmetic tree (`(u32)&gSym + 4`, spelled by intifyAddr below) under an
-      // icmp_s* still compares unsigned in C (u32 wins the usual-arithmetic-conversions) — the
-      // same pre-existing wrongness the old ptr-vs-int spelling had, surfacing as a scoring
-      // nonmatch, never a silent regression of a formerly-correct compare. Rare shape; an outer
-      // signed cast on addr-carrying trees is the follow-up if it ever costs a row.
+      // SCOPE: this handles BARE addr operands. An addr-carrying arithmetic tree
+      // (`(u32)&gSym + 4`, spelled by intifyAddr below) renders unsigned and would compare
+      // unsigned under an icmp_s*; the signed operand pin at the end of this block catches it as
+      // one case of the general rule, needing no addr-specific reasoning.
       const t = /^icmp_s/.test(d.opcode) ? T.s(32) : T.u(32);
       const intifyAddrCmp = (x: Expr): Expr => (x.k === 'addr' ? { k: 'cast', to: t, e: x } : x);
-      return {
-        k: 'bin',
-        op: CMP_TO_BIN[d.opcode],
-        l: intifyAddrCmp(e(d.operands[0])),
-        r: intifyAddrCmp(e(d.operands[1])),
+      let l = intifyAddrCmp(e(d.operands[0]));
+      let r = intifyAddrCmp(e(d.operands[1]));
+      // The same signedness hole for ORDINARY operands: an icmp_u* whose operands both render
+      // as signed-promoting C (an s32-declared var carrying a u32 value — declarations take the
+      // FIRST claimant's type; an inline `16 << t`, whose C type is the left operand's `int`)
+      // compiles to the SIGNED compare the machine did not do. When neither side provably
+      // promotes unsigned, one operand takes a (u32) cast — the side whose recovered VALUE type
+      // is unsigned, the honest one — and the usual arithmetic conversions make the compare
+      // unsigned exactly as the opcode says. A provably-unsigned operand leaves the spelling
+      // alone, so correctly-typed compares never churn — as does a compare whose operands both
+      // provably sit in [0, 2^31) (a `(u8)x > 4` byte test): there the signed spelling is
+      // value-faithful and the compiler already picks the unsigned branch itself, and so does a
+      // pointer-rendered side: `p < end` already compares unsigned, and `(u32)p` against a
+      // pointer is the int-vs-ptr constraint violation the strict backends reject. ==/!= are
+      // sign-agnostic; the icmp_s* direction is pinned below.
+      const ptrSide = (x: Expr): boolean => {
+        const t2 = ctype(x);
+        return t2?.kind === 'ptr' || t2?.kind === 'array';
       };
+      if (
+        unsignedCompareSpelling &&
+        /^icmp_u/.test(d.opcode) &&
+        !ptrSide(l) &&
+        !ptrSide(r) &&
+        renderedIntSignedness(l, vtEnv) !== false &&
+        renderedIntSignedness(r, vtEnv) !== false &&
+        !(provablyNonNegative(l, vtEnv) && provablyNonNegative(r, vtEnv))
+      ) {
+        const irUnsigned = (v: Value): boolean => v.type.kind === 'int' && !v.type.signed;
+        if (!irUnsigned(d.operands[0]) && irUnsigned(d.operands[1])) {
+          r = { k: 'cast', to: T.u(32), e: r };
+        } else {
+          l = { k: 'cast', to: T.u(32), e: l };
+        }
+      }
+      // The SIGNED direction of the same hole, and a DEFAULT rather than an arm of that axis —
+      // not because nothing underdetermines, but because the underdetermination is INERT. An
+      // unsigned source compare can reach a signed opcode when the compiler proves the test is
+      // the sign bit (`u32 a; a < 0x80000000` compiles to `cmp r0, #0; bge`; kmc-gcc and gcc
+      // 2.7.2 fold it to `slti`), so an icmp_s* has more than one source — but the pinned
+      // spelling reproduces that branch too (`(s32)a >= 0` is the same `cmp r0, #0; bge`), so
+      // both sources reach ONE candidate and an axis would have doubled the fan to referee a
+      // question with one answer. Where the spellings genuinely diverge they diverge the way the
+      // opcode says, on every toolchain: an operand that renders unsigned makes C compare
+      // unsigned (agbcc `bls`, IDO/kmc-gcc/gcc 2.7.2 `sltu`/`sltiu` against `slt`/`slti`, mwcc
+      // `neg;or` against `neg;andc` in its branchless form), and against a constant the test
+      // folds away entirely and takes the surrounding computation with it — `(u32)a / b < 0`
+      // becomes `mov r0, #0`, deleting the `__udivsi3` call.
+      //
+      // `undefined` takes the cast exactly as a definite `false` does (see
+      // renderedIntSignedness): a call's signedness is the project header's, not this function's.
+      // A POINTER-rendered side is the one operand left alone, and not out of caution — `p < q`
+      // is already the unsigned compare C gives two addresses, where `(s32)p < (s32)q` would
+      // compare them signed.
+      if (/^icmp_s/.test(d.opcode)) {
+        const pinSigned = (x: Expr): Expr =>
+          renderedIntSignedness(x, vtEnv) === true || ptrSide(x) ? x : { k: 'cast', to: T.s(32), e: x };
+        l = pinSigned(l);
+        r = pinSigned(r);
+      }
+      return { k: 'bin', op: CMP_TO_BIN[d.opcode], l, r };
     }
     if (ARITH_TO_BIN[d.opcode]) {
       let l = e(d.operands[0]);
       let r = d.operands.length === 2 ? e(d.operands[1]) : ({ k: 'const', value: d.attrs.imm as number } as Expr);
+      // Commutative LOAD-PAIR operands re-spell in EVALUATION order. A commutative instruction's
+      // operand order is an allocator artifact (`mul r0, r0, r2` reads dst-first, so the lift's
+      // l/r is whichever load landed in the dst), but the order the compiler EVALUATED the
+      // operands is still visible: their defs' order in the instruction stream. gcc 2.9 and IDO
+      // both emit `w * h`'s loads w-first, so def order IS source order — verified byte-identical
+      // on both (the bg_area rows). Scope, one gate per way the signal fails: BOTH root defs must
+      // be same-block memory reads (a const already has its side; arithmetic defs get combined
+      // out of source order — an ldmia-fed add reads def-reordered; cross-block positions do not
+      // order evaluation), neither stamped `listOrder` (an ldmia-expanded load's own position is
+      // LIST order), both operand VALUES un-named (see below), no pointer side (load-bearing for
+      // the stride rules below), and no effect moves (call, marker).
+      if (COMMUTATIVE_BIN.has(ARITH_TO_BIN[d.opcode]) && d.operands.length === 2) {
+        const [da, db] = [defs.get(d.operands[0]), defs.get(d.operands[1])];
+        if (
+          defOrderLoadPairs &&
+          da &&
+          db &&
+          (da.opcode === 'load' || da.opcode === 'aload') &&
+          (db.opcode === 'load' || db.opcode === 'aload') &&
+          da.attrs.listOrder !== true &&
+          db.attrs.listOrder !== true &&
+          // NAMED values decline: a value that renders as a name here — a materialized def
+          // (varName), a loop-carried value in a post-loop region (activeSub) — was evaluated at
+          // its def statement, so re-ordering the reference re-orders nothing and only churns the
+          // spelling away from the machine order the allocator saw. An inlined def — a deref, a
+          // field, a bare scalar global (whose `var` node lowerDef itself mints) — evaluates at
+          // THIS site, wherever recovery spells it.
+          !varName.has(d.operands[0]) &&
+          !varName.has(d.operands[1]) &&
+          activeSub?.has(d.operands[0]) !== true &&
+          activeSub?.has(d.operands[1]) !== true &&
+          ctype(l)?.kind !== 'ptr' &&
+          ctype(r)?.kind !== 'ptr' &&
+          !exprHasEffect(l) &&
+          !exprHasEffect(r) &&
+          opBlock.get(da) === opBlock.get(db) &&
+          opIndex.get(da)! > opIndex.get(db)!
+        ) {
+          [l, r] = [r, l];
+        }
+      }
       // Pointer stride: C pointer arithmetic is ELEMENT-scaled, but the asm added a BYTE
       // constant — `addi p,4` on an `s32*` walks 1 element, yet C `p + 4` walks 4. Divide the byte
       // constant by the pointee size so the walk recompiles to the same address math.
@@ -1568,21 +2744,76 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
       // the type of the expression it actually sees, and the two diverge exactly like memAccess's
       // deref bases (a value recovered `s32*` can render as an int-typed tree — C then does NO
       // element scaling, so pre-dividing the constant would bake in a WRONG address that the
-      // deref cast downstream turns into silently-wrong bytes; found by the adversarial round).
+      // deref cast downstream turns into silently-wrong bytes).
       // An int-rendered walk keeps its raw byte constant and derefs through the access-width cast.
       // Fires only for a rendered pointer whose element size (>1) DIVIDES the constant exactly;
       // otherwise raw (a misaligned/struct-array stride is left as-is; a `u8*` is size 1 so
       // unchanged). Since C `(K/es) + p == p + (K/es)`, scaling the const on whichever side it
       // sits fixes the bytes: `add` is commutative so the pointer may be either operand; `sub` is
       // not, so only operand[0] (the minuend) may be the pointer.
-      const scale = (t: IrType | undefined, c: Extract<Expr, { k: 'const' }>): Expr => {
-        const es = t?.kind === 'ptr' ? ptrElemBytes(t.to) : 0;
-        return es > 1 && c.value % es === 0 ? { k: 'const', value: c.value / es } : c;
+      // A rendered pointer that CANNOT express the byte constant as a whole number of elements —
+      // an inexact residual, or a pointee whose size is not knowable here (a struct) — has no
+      // scaled spelling at all, and leaving the raw byte count is the silent wrongness the
+      // pointer-global rule below refuses in the same words: C multiplies it back, so `p + 62` on
+      // an `s32 *` addresses byte 248 and `p + 38` on a `struct S *` addresses byte 38 * sizeof(S).
+      // Same answer as there — CAST THEN ADD, `(u8 *)p + 62`, the same address in every world.
+      const bytePtr = (x: Expr): Expr => ({ k: 'cast', to: T.ptr(T.u(8)), e: x });
+      // Set when a byte-pointer cast was applied for the ADDRESS math alone: the sum is cast back
+      // to the pointer type it started as, so the walk changes the arithmetic and nothing else. A
+      // bare `u8 *` sum would be a different C type from the slot it lands in (`v4 = (u8 *)a0 +
+      // (v1 << 2)` into an `s32 *` — an mwcc error) and from the bases the deref rules read.
+      let restoreTo: IrType | undefined;
+      const walk = (base: Expr, c: Extract<Expr, { k: 'const' }>): { base: Expr; off: Expr } => {
+        const t = ctype(base);
+        if (t?.kind !== 'ptr') {
+          return { base, off: c }; // an int-rendered walk: C scales nothing, the bytes are right
+        }
+        const es = ptrElemBytes(t.to);
+        if (es === 1) {
+          return { base, off: c }; // already a byte pointer
+        }
+        return es > 1 && c.value % es === 0
+          ? { base, off: { k: 'const', value: c.value / es } }
+          : { base: bytePtr(base), off: c };
+      };
+      // A RUNTIME byte offset has no element spelling at all — not even an inexact one to reject,
+      // since the residual is unknown until the program runs. The asm added bytes, so the same
+      // answer as the inexact constant above: cast then add. Without it a `u16 *` walked by a
+      // computed offset addresses TWICE the intended byte, and nothing downstream can see the
+      // error — in the sa3 decomp that address is what a `CpuSet` call writes THROUGH.
+      //
+      // KNOWN GAP: `ptr ± ptr` is excluded, and the intify rules below do not make it right
+      // either — `ptr + ptr` becomes `l + (s32)r`, which C scales, and a same-pointee `ptr - ptr`
+      // is C's ELEMENT difference where the asm subtracted bytes. Both want the same cast-then-add
+      // treatment; both are byte-identical to what this emitted before, and three functions in the
+      // agbcc corpus carry one.
+      //
+      // KNOWN GAP: the inexact-CONSTANT branch above casts its base and does NOT cast the sum
+      // back, so `v1 = (u8 *)a0 + 2` still lands in an `s32 *` slot. Copying the restore up churns
+      // the common case, where the sum is consumed by a deref that supplies its own cast — the
+      // real predicate is the CONSUMER, and deciding it here at the producer is what these two
+      // branches would have to stop doing.
+      const walkVar = (x: Expr): IrType | undefined => {
+        const t = ctype(x);
+        return t?.kind === 'ptr' && ptrElemBytes(t.to) !== 1 ? t : undefined;
       };
       if ((d.opcode === 'add' || d.opcode === 'sub') && r.k === 'const') {
-        r = scale(ctype(l), r);
+        ({ base: l, off: r } = walk(l, r));
       } else if (d.opcode === 'add' && d.operands.length === 2 && l.k === 'const') {
-        l = scale(ctype(r), l); // commuted `const + ptr`
+        ({ base: r, off: l } = walk(r, l)); // commuted `const + ptr`
+      } else if (d.opcode === 'add' || d.opcode === 'sub') {
+        // ONE side only. `ptr - ptr` is C's element difference and `ptr + ptr` is not C at all;
+        // both are the intify rules' business below, and casting both operands here would hide
+        // the shape from them.
+        const lp = ctype(l)?.kind === 'ptr';
+        const rp = d.operands.length === 2 && ctype(r)?.kind === 'ptr';
+        if (lp && !rp) {
+          restoreTo = walkVar(l);
+          l = restoreTo ? bytePtr(l) : l;
+        } else if (rp && !lp && d.opcode === 'add') {
+          restoreTo = walkVar(r);
+          r = restoreTo ? bytePtr(r) : r;
+        }
       }
       // C rejects a pointer operand outright under the non-additive operators (& | ^ << >> * / %),
       // under `ptr + ptr`, and as the subtrahend of `int - ptr` — the asm just does 32-bit integer
@@ -1611,42 +2842,45 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
       const intifyAddr = (x: Expr): Expr => (x.k === 'addr' ? { k: 'cast', to: T.u(32), e: x } : x);
       l = intifyAddr(l);
       r = intifyAddr(r);
-      // The SAME hazard one level down, for a POINTER-shaped global's VALUE (`gPtr`, isPtrGlobal):
-      // C scales `gPtr + K` by sizeof(*gPtr) — 1 under the map's synthesized `void *`, but
-      // whatever the PROJECT's header declares (a 0x5C-byte struct, say) in the world a user
-      // actually recompiles in. The asm added BYTES, so the honest spelling makes the stride
-      // explicit: CAST-THEN-ADD, `(u8 *)gPtr + K`, the same address in EVERY world. Add-then-cast
-      // (`(u8 *)(gPtr + K)`, what the backend's deref legalization would otherwise produce) is
-      // byte-correct in exactly one of them — a silent wrongness, the class this project refuses.
+      // The SAME hazard one level down, for a value the MAP declares a pointer (`gPtr`, `gSym.pBuf`
+      // — isPtrValue): C scales `gPtr + K` by sizeof(*gPtr) — 1 under the map's synthesized
+      // `void *`, but whatever the PROJECT's header declares (a `u16 *` member, a 0x5C-byte
+      // struct) in the world a user actually recompiles in. The asm added BYTES, so the honest
+      // spelling makes the stride explicit: CAST-THEN-ADD, `(u8 *)gPtr + K`, the same address in
+      // EVERY world. Add-then-cast (`(u8 *)(gPtr + K)`, what the backend's deref legalization
+      // would otherwise produce) is byte-correct in exactly one of them — a silent wrongness, the
+      // class this project refuses. A MEMBER is the case with no world in which the raw spelling
+      // is right: the map declares the pointee width, so `bytes + gSym.pBuf` on a `u16 *` scales
+      // the residual a SECOND time and addresses twice the byte the asm did.
       // NOT foldable into the deref index either: `((u8 *)gPtr)[K + off]` re-scales K by the
       // ACCESS width, a different address whenever that width is not 1.
       // Under the non-additive operators C rejects a pointer outright, so there the honest
       // spelling is integer math on the cell — exactly intifyAddr's `(u32)&gSym` rule.
-      const bytePtr = (x: Expr): Expr => ({ k: 'cast', to: T.ptr(T.u(8)), e: x });
-      const intifyPtrGlobal = (x: Expr): Expr => ({ k: 'cast', to: T.u(32), e: x });
+      const intifyPtrValue = (x: Expr): Expr => ({ k: 'cast', to: T.u(32), e: x });
       if (op === '+' || op === '-') {
         // `ptr ± int` and `ptr - ptr` are byte arithmetic once both sides are byte pointers;
         // `ptr + ptr` and `int - ptr` are not C at all, so the second pointer goes integer.
-        const bothPtr = isPtrGlobal(l) && isPtrGlobal(r);
-        if (isPtrGlobal(l)) {
+        const bothPtr = isPtrValue(l) && isPtrValue(r);
+        if (isPtrValue(l)) {
           l = bytePtr(l);
         }
-        if (isPtrGlobal(r)) {
-          r = bothPtr && op === '-' ? bytePtr(r) : op === '+' && !bothPtr ? bytePtr(r) : intifyPtrGlobal(r);
+        if (isPtrValue(r)) {
+          r = bothPtr && op === '-' ? bytePtr(r) : op === '+' && !bothPtr ? bytePtr(r) : intifyPtrValue(r);
         }
       } else if (op !== '&&' && op !== '||') {
         // (`&&`/`||` take a pointer operand legally — a truth test, no arithmetic.)
-        l = isPtrGlobal(l) ? intifyPtrGlobal(l) : l;
-        r = isPtrGlobal(r) ? intifyPtrGlobal(r) : r;
+        l = isPtrValue(l) ? intifyPtrValue(l) : l;
+        r = isPtrValue(r) ? intifyPtrValue(r) : r;
       }
-      // (The two right shifts stay DISTINCT ops here — `>>>` logical, `>>` arithmetic. Which token
-      // a language spells each with, and what cast pins the choice, is a BACKEND decision; see
-      // l3/ast.ts BinOp and backend/cfamily.ts's shift rule.)
+      // (The signedness-carrying pairs stay DISTINCT ops here — `>>>`/`>>` and `/u` `%u`/`/` `%`.
+      // Which token a language spells each with, and what cast pins the choice, is a BACKEND
+      // decision; see l3/ast.ts BinOp and backend/cfamily.ts's C_SPELLING.)
       // SCOPE: this and intifyAddr cover the ARITHMETIC escapes. A pointer global under a
       // COMPARISON (`gPtr < K` — C compares unsigned whatever the asm's icmp_s* said) is the same
       // class as intifyAddrCmp's `addr` rule and is deliberately left alone here: it is valid C
       // today, so closing it would churn spellings for a signedness case no row exercises.
-      return { k: 'bin', op, l, r };
+      const sum: Expr = { k: 'bin', op, l, r };
+      return restoreTo ? { k: 'cast', to: restoreTo, e: sum } : sum;
     }
     // `-`/`~` on a pointer rendering is equally not C — same honest integer cast as above.
     if (d.opcode === 'rotr' || d.opcode === 'rotl') {
@@ -1689,11 +2923,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
       return { k: 'un', op: '~', e: needsIntSpelling(x) ? { k: 'cast', to: T.s(32), e: x } : x };
     }
     // Width-narrowing casts: `zext`/`sext` widen a `width`-bit value back to 32 → C `(u8)e`/`(s8)e`.
-    if (d.opcode === 'zext') {
-      return { k: 'cast', to: T.int(d.attrs.width as number, false), e: e(d.operands[0]) };
-    }
-    if (d.opcode === 'sext') {
-      return { k: 'cast', to: T.int(d.attrs.width as number, true), e: e(d.operands[0]) };
+    // The width is in BITS, and outside `CAST_WIDTHS` there is no C type to cast to — a GAP, not
+    // the `(u2)` the backend would otherwise print and no compiler accept. No frontend produces
+    // one (the cast idioms and PPC's `extsb`/`extsh` emit 8 and 16), so this is the loud floor
+    // under hand-written IR; `raise/narrowlocal.ts` and `raise/paramwidth.ts` refuse to NARROW on
+    // such a width, which is a different decision from spelling one.
+    if (d.opcode === 'zext' || d.opcode === 'sext') {
+      const w = d.attrs.width as number;
+      return CAST_WIDTHS.has(w)
+        ? { k: 'cast', to: T.int(w, d.opcode === 'sext'), e: e(d.operands[0]) }
+        : mkGap(`no C type for a ${w}-bit '${d.opcode}'`, [e(d.operands[0])]);
     }
     if (d.opcode === 'call') {
       return { k: 'call', fn: d.attrs.target as string, args: d.operands.map(e) };
@@ -1704,10 +2943,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
       // see laddrName. Renders `&sp0`; the object itself is declared in `locals`.
       return { k: 'addr', name: laddrName.get(d)! };
     }
+    if (d.opcode === 'undef') {
+      // An uninitialised local. NEVER emit a definition for it: the declaration in `locals` is the
+      // entire recovery, and `sideEffects` skips an `undef` (neither effectful nor materialized),
+      // which is what leaves it bare.
+      return { k: 'var', name: undefName.get(d)! };
+    }
     if (d.opcode === 'gaddr') {
       // A promoted CODE symbol (frontend `code: true`) is a function pointer stored as an
-      // integer: spelled `(u32)Name` — the source idiom — never `&Name` (defect G of the
-      // dogfood report; the & form compiles but is a different, non-matching spelling).
+      // integer: spelled `(u32)Name` — the source idiom — never `&Name` (the & form compiles,
+      // but it is a different and non-matching spelling).
       if (d.attrs.code === true) {
         return { k: 'cast', to: T.int(32, false), e: { k: 'var', name: d.attrs.sym as string } };
       }
@@ -1733,6 +2978,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         e(d.operands[0]),
         e(d.operands[1]),
         d.attrs.fieldOff as number | undefined,
+        d.attrs.memberOff as number | undefined,
         d.attrs.elemSize as number,
         (d.attrs.signed as boolean) ?? false,
         ctype,
@@ -1763,9 +3009,20 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   };
   // The loop-emission hazard checks (readsClobbered / loopEscapeHazard / loopUpdateHazard) —
   // pure decline-or-emit predicates, extracted to hazards.ts behind the explicit-deps factory.
-  // `varName` is captured as a live reference: it is still being populated here in the naming
-  // pipeline, and each check reads the names that exist when EMISSION calls it.
-  const { loopUpdateHazard } = makeLoopHazards({ defs, varName, useSitesOf });
+  // `varName` is captured as a live REFERENCE rather than copied, so each check reads the names
+  // EMISSION sees. The map is already FINAL at this point — every write to it sits above, in the
+  // naming walk and the coalescing that follows it, and these checks only read it — so today the
+  // two readings coincide; the reference is what keeps them coinciding if a write ever moves down
+  // here.
+  const { readsClobbered, loopUpdateHazard, sinkablePreUpdateSlots, sameAtEntry, loopWriteSet } = makeLoopHazards({
+    defs,
+    varName,
+    useSitesOf,
+    liveIn,
+    opBlock,
+    materialize,
+    respelledDefs: bitfieldSpelling,
+  });
 
   // A POST-LOOP substitution active while structuring a loop's exit region: a loop-carried value (a
   // latch back-edge arg) is held in its loop-variable NAME after the loop, so any post-loop use must
@@ -1788,63 +3045,335 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   // value. `sub` (used for the emitWhile un-rotation's exit copies) substitutes back-edge args to
   // their header-param NAMES — post-loop the params already hold their updated values, so a merged
   // exit value is read as `v` not `v-1`.
+  //
+  // AN UNDEFINED ARGUMENT CARRIES NOTHING, so it gets no copy — WHERE THE DESTINATION IS ITSELF
+  // UNDEFINED THERE. `undef` is storage nothing wrote on this path (ir/opcodes.ts), so
+  // `w = uninit_sp0;` spells a read of storage that was never written: a statement the asm has no
+  // instruction for, whose cost is the register the undefined value then occupies across the merge.
+  // Dropping it leaves the variable holding whatever it held — the same thing exactly when nothing
+  // ever wrote it before this edge, and a DIFFERENT FUNCTION otherwise. That second case is real:
+  // a merge that adopted an incoming parameter's name emits `if (a0 == 0) a0 = uninit_sp0;`, where
+  // dropping the copy would substitute the parameter's defined value for the undefined one.
+  //
+  // So the test is over the destination's whole name class: no value spelled with that name may
+  // have a definition able to execute before this edge — its home block being this predecessor, or
+  // reaching it, which through a back edge is also how an earlier iteration's write is caught.
+  // Unsure keeps the copy. Edge copies only: a `store` or a `ret` of an undef value is a real
+  // instruction and emits.
+  //
+  // A value's home is where the copies into it run, and anchoring MOVES one: an anchored const is
+  // written at the const's own def site instead of on the edges (anchorConstCopies, above), and
+  // that site dominates them. Its block is a write site for the name like any other, and without it
+  // `v0 = 0; if (c) { } store v0;` drops the undefined arm's copy and stores 0 where the machine
+  // stores whatever the arm left — the same substitution the parameter case makes, one axis over.
+  //
+  // THE SECOND RELOCATION goes the other way, and this test cannot see it at all. A SUNK pre-update
+  // exit copy (preUpdateCopies) writes the loop EXIT's param at the top of the loop BODY, so the
+  // home this reads for it — `paramBlock`, the exit block — sits strictly LATER in the CFG than
+  // where the copy lands. What keeps the two apart is not this test but `dest-free-inside-loop`
+  // (hazards.ts): a merge inside the body under the exit param's name is a block param
+  // `definedInBody` sees, so the slot is never sunk in the first place. That gate carries its own
+  // KNOWN GAP, so the pair is a conjecture rather than a proof — `sunkCopyOverDroppedUndef` re-checks
+  // it per function once both records below are complete, which is the only point at which they can
+  // be: the do-while path structures its body BEFORE it mints its sunk copies.
+  const anchoredHome = new Map<string, Block[]>();
+  for (const [def, entries] of anchoredAt) {
+    for (const { name } of entries) {
+      (anchoredHome.get(name) ?? anchoredHome.set(name, []).get(name)!).push(opBlock.get(def)!);
+    }
+  }
+  /** Every copy `undefCarriesNothing` dropped, with the edge it was dropped from. */
+  const droppedUndefCopies: { name: string; pred: Block }[] = [];
+  /** Every sunk pre-update exit copy, homed where it LANDS (the loop header whose body opens with
+   *  it) rather than where its destination param lives. These two lists are the postcondition's
+   *  whole input. */
+  const sunkCopyHomes: { name: string; home: Block }[] = [];
+  const undefCarriesNothing = (arg: Value, name: string, pred: Block): boolean => {
+    if (defs.get(arg)?.opcode !== 'undef') {
+      return false;
+    }
+    const writesBefore = (home: Block | undefined): boolean =>
+      home === undefined || home === pred || reachFrom(home).has(pred);
+    for (const [v, n] of varName) {
+      if (n === name && writesBefore(paramBlock.get(v) ?? opBlock.get(defs.get(v)!))) {
+        return false;
+      }
+    }
+    return !(anchoredHome.get(name) ?? []).some(writesBefore);
+  };
   const tempCounter = { n: 0 }; // per-function swap-cycle temp names (sequentialize)
-  // The copies for ONE specific successor record — the workhorse behind argAssigns, taken
-  // directly by the switch_br path, whose duplicate case targets successorTo cannot
-  // disambiguate.
-  const argAssignsFor = (
+  /** One record per parameter slot an edge ACTUALLY carries, in the order the copies are to be
+   *  laid out — everything `argAssignsFor` does except `sequentialize`. Split out because Regime-A
+   *  switch recovery merges the records of a whole DISPATCH's edges and sequentializes the union
+   *  ONCE (`hoistedDispatchAssigns` below); sequentializing per edge and then deduping would mint
+   *  a swap-cycle temp per edge and spell a different program. */
+  const edgeCopyRecords = (
     pred: Block,
     succ: { block: Block; args: Value[] },
     sub: Map<Value, string> | null = null,
-  ): Stmt[] => {
+    keepSlot: (i: number) => boolean = () => true,
+  ): { name: string; value: Expr; arg: Value; param: Value }[] => {
     const target = succ.block;
     const argExpr = sub ? exprWith(sub) : expr;
-    const copies: { name: string; value: Expr; arg: Value }[] = [];
+    const copies: { name: string; value: Expr; arg: Value; param: Value }[] = [];
     const suppressed = suppressedArgs.get(succ);
     target.params.forEach((p, i) => {
-      if (suppressed?.has(i)) {
+      if (suppressed?.has(i) || !keepSlot(i)) {
         return;
-      } // anchored at its const's def site — the write already ran before this edge
+      } // anchored at its const's def site (or emitted elsewhere) — this edge does not carry it
       const name = varName.get(p)!;
       const arg = succ.args[i];
       if ((sub?.get(arg) ?? varName.get(arg)) === name) {
         return;
       } // identity copy — coalesced away
-      copies.push({ name, value: castAggregateAddr(name, argExpr(arg)), arg });
+      if (undefCarriesNothing(arg, name, pred)) {
+        droppedUndefCopies.push({ name, pred });
+        return;
+      }
+      copies.push({ name, value: intoDeclaredTemp(name, argExpr(arg)), arg, param: p });
     });
-    // Emit in the order the args are COMPUTED in `pred` — a compiler that lays the defining ops
-    // (and thus the copies that read them) out in that order matches with no spurious arg-swap.
-    // This is a per-compiler behavior (orderArgCopiesByComputation), not a universal: a compiler
-    // that emits copies in source/param order sets it false. Dependency ordering (sequentialize)
-    // still has the final say regardless.
-    if (orderArgCopiesByComputation) {
-      // opIndex is only valid for a def IN this block; a def elsewhere keeps indexOf's -1 (sorts first).
-      const pos = (v: Value) => {
-        const d = defs.get(v);
-        return d && opBlock.get(d) === pred ? opIndex.get(d)! : -1;
-      };
-      copies.sort((a, b) => pos(a.arg) - pos(b.arg));
+    // Emit in the order the pred WROTE the destinations (ir/core.ts `WriteOrder` — the frontend's
+    // measurement; the value graph cannot show it, because a copy is the same SSA value under a new
+    // key). This is a per-compiler behavior (orderArgCopiesByWriteOrder), not a universal: a
+    // compiler that emits copies in source/param order sets it false and no sort runs at all.
+    //
+    // THE RULE IS TWO CLAIMS, and only the first is licensed by an instruction:
+    //
+    //  1. CYCLIC copy sets. `sequentialize` spills the FIRST pending destination, and the record
+    //     names the destination whose FINAL value the compiler established earliest — the one whose
+    //     old value had to be saved elsewhere, since every later reader of that old value reads it
+    //     after the register stopped holding it. That is the compiler's own temp.
+    //     READ THE QUANTITY AS THE LAST WRITE, not the first overwrite: a pred commonly writes a
+    //     key several times (1,867 of 5,283 edge-destination records over klonoa, marioparty3 and
+    //     af, in 312 of the 464 functions that record anything). Both alternatives cost matches
+    //     over the 736 synthetic rows and gain none: recording the FIRST write loses `bgsplit`,
+    //     `bgswitch`, `bgswsplit` and `hipress` (all agbcc, 482 → 478); REFUSING the record for a
+    //     key written more than once loses those four plus `dmascope2` and `swmulti` (482 → 476).
+    //  2. ACYCLIC copy sets — a SECOND, separately-licensed claim: that the compiler LAID THE
+    //     COPIES OUT in the order it wrote them. No instruction states it, and it is two-sided, so
+    //     the def-position spelling is enumerated beside the record's as a ranked candidate
+    //     (`/copy-defpos`, rank.ts) instead of being declared here. Restricting the record to
+    //     cyclic sets as the DEFAULT was measured over the 736 synthetic rows: it takes
+    //     `armfall:agbcc` 11 → 8, `memcpy1:mwcc` 23 → 19 and `memset1:mwcc` 21 → 19 — and LOSES
+    //     `gcd:agbcc` (the cyclic row's own entry edge is acyclic) and `structarr:agbcc` to
+    //     nonmatch. The CANDIDATE spans that second claim only (`preferDefPosCopyOrder`: the proxy
+    //     on acyclic sets, the record on cyclic ones), so no arm of the fan spells a cycle against
+    //     the instruction that licenses it, and the pair differs exactly where the evidence runs
+    //     out — which is what lets one function take the record on its back edge and the proxy on
+    //     its entry edge, as `gcd:agbcc` does.
+    //
+    // IT REACHES FURTHER THAN `sequentialize`, because it decides which copy is an arm's LAST
+    // statement: `l3/tailmerge.ts` peels only a common last statement, so an arm-varying copy
+    // ordered last hides an agreeing one behind it (measured there, on klonoa
+    // `CountCollectedGems`); and `recognizeForLoops` recovers a `for` only when the induction
+    // update is last, so this sort also decides `for` vs `while` (goldens in
+    // `structure-goldens.test.ts`). That is why `synthetic:gcd:agbcc` is a `while` — agbcc wrote
+    // the dividend's register last, so the modulo update is not last.
+    //
+    // A destination with NO RECORD keeps `NO_RECORD`, sorting first, which is where the proxy also
+    // puts an argument the pred did not compute: on those copies the two orders AGREE rather than
+    // one replacing the other. Pinning unwritten destinations at their param-order slot instead
+    // loses `armdef:agbcc`, `loopfall:agbcc`, `loopset:agbcc` and `structarr:agbcc` over the same
+    // 736 rows, and buys back only `armfall` 11 → 7 and `ucmp:kmc` 15 → 14.
+    if (orderArgCopiesByWriteOrder) {
+      // UNMEASURED (undefined) is not "wrote nothing": a parsed or hand-built fn carries no record
+      // at all and its edges keep the def-position proxy, while a MEASURED pred that recorded no
+      // destination of this edge gets an empty record. The two cannot meet inside one fn —
+      // measurement is all-or-nothing per function and `ir/verify.ts` enforces it — so this asks
+      // per block only to spell the wholly unmeasured fn.
+      const predIsMeasured = fn.writeOrder?.writes.has(pred) ?? false;
+      // The `/copy-defpos` candidate asking for the proxy on an edge the frontend DID measure —
+      // the one place the two questions ("is there a record" and "use it") come apart.
+      const record =
+        predIsMeasured && (!preferDefPosCopyOrder || copySetIsCyclic(copies))
+          ? (fn.writeOrder!.lastWrite.get(pred) ?? NO_WRITTEN_DESTINATIONS)
+          : undefined;
+      const rank =
+        record !== undefined
+          ? (c: (typeof copies)[number]) => record.get(c.param) ?? NO_RECORD
+          : // opIndex is only valid for a def IN this block; a def elsewhere gets NO_RECORD too.
+            (c: (typeof copies)[number]) => {
+              const d = defs.get(c.arg);
+              return d && opBlock.get(d) === pred ? opIndex.get(d)! : NO_RECORD;
+            };
+      copies.sort((a, b) => rank(a) - rank(b));
+    }
+    return copies;
+  };
+  // The copies for ONE specific successor record — the workhorse behind argAssigns, taken
+  // directly by the switch_br path, whose duplicate case targets successorTo cannot
+  // disambiguate.
+  const argAssignsFor = (
+    pred: Block,
+    succ: { block: Block; args: Value[] },
+    sub: Map<Value, string> | null = null,
+    keepSlot: (i: number) => boolean = () => true,
+  ): Stmt[] =>
+    sequentialize(
+      edgeCopyRecords(pred, succ, sub, keepSlot).map(({ name, value }) => ({ name, value })),
+      varType,
+      tempCounter,
+      fn.name,
+    );
+  /** THE DISPATCH HOIST (Regime-A switch recovery). Recovering a comparison tree COLLAPSES its
+   *  test blocks, and an edge's only emission is its parallel copy — so every copy the dispatch's
+   *  edges carried would be discarded with the tree. This re-emits them above the `switch`, ONCE
+   *  PER NAME the dispatch binds — which is not once per machine write: `sw_fall`'s three arms
+   *  each take the accumulator under a name of their own, so this tree emits `v0 = 0; v1 = 0;
+   *  v2 = 0;` where agbcc has a single `mov r1, #0`, and the one-local spelling that byte-matches
+   *  comes from the `/merge-home` ranked axis, not from here. What the position is for is the
+   *  fall-through chain: per-arm copies RE-RUN on the fall path and overwrite what the falling arm
+   *  computed, the hazard Regime B states at its own `switch_br` refusal.
+   *
+   *  Null (⇒ the caller declines to if-recovery, which spells every copy the asm performs) on the
+   *  two things one hoisted statement cannot say. Both are stated over NAMES, because the name is
+   *  what the statement writes. NEITHER FIRES ON A CORPUS ROW: over the synthetic tier the only
+   *  functions offering the hoist a param-carrying dispatch edge are the `sw_fall*` family (four
+   *  of them, 13 edges under 10 names), it emits on all four, and what refuses is the caller's own
+   *  `availableAtRoot`. Both refusals below are pinned by hand-written `.s` in
+   *  `test/switch-arms.test.ts` and by nothing else — read them as invariants, not as evidence:
+   *
+   *    - DISAGREEING EDGES. Two edges binding one name to different values: which one runs depends
+   *      on which test fell through, and a single statement above the tree cannot depend on that.
+   *      Order-independent, so no emission order hides it.
+   *    - A CLOBBERED LIVE NAME. The hoisted write runs on EVERY path through the dispatch,
+   *      including into arms whose own edge did not carry it. If any value under that name is
+   *      live where the switch begins, or into one of its arms, the hoist would overwrite a value
+   *      those readers still want. THE SCAN REACHES values read at or after the listed blocks'
+   *      entries, and by construction NOT: the parameters of those blocks (`analysis.ts` kills a
+   *      block's params at its own entry), a value defined in the root whose only use is a
+   *      dispatch edge arg, or a binding elided upstream (identity copy, `undefCarriesNothing`, a
+   *      suppressed anchored slot), which contribute no name to compare. Binding an arm's
+   *      parameters is what the hoist is FOR, so that blindness is wanted; the other three are
+   *      gaps nobody has turned into a wrong answer.
+   *
+   *  `anchorConstCopies` (above) relocates an edge copy too, and states two clauses this does not;
+   *  neither absence is an oversight. Its LOOP clause does not transfer: anchoring moves a write to
+   *  the const's DEF site, which may sit outside the loop the edge is in (block dominance is not
+   *  per-iteration precedence — see that clause's own statement above), while the hoist moves a
+   *  write from a dispatch's edges to the head of that same dispatch, same iteration every time
+   *  (`switch-arms.test.ts` pins a param-carrying dispatch inside a `do`-`while`). Its NAME-COUNT
+   *  clause — refuse a name several SSA values carry — cannot be adopted, because that is this
+   *  mechanism's whole subject: one name per arm taking the accumulator. As a refusal it declines
+   *  the empty-arm fall-through switch of `retsink.test.ts` outright, for no row's benefit.
+   *
+   *  ORDER ACROSS EDGES IS UNLICENSED. Within one edge, `edgeCopyRecords` sorts by the pred's
+   *  measured `WriteOrder`; the union below keeps the first record per name in TREE-WALK order,
+   *  which no compiler measured — there is no per-pred record spanning writes that different preds
+   *  performed. It is deterministic, and `switch-arms.test.ts` pins the three-name order `sw_fall`
+   *  emits so that a change to the walk fails loudly rather than silently re-spelling a match.
+   *
+   *  What it does NOT re-check is that evaluating an arg AT THE ROOT rather than on its edge is
+   *  value-preserving. That rests on the collapsed blocks being pure (switch-recover.ts's PRE4)
+   *  and on every hoisted arg being available at the root, which the caller establishes before
+   *  calling — the hoist depends on those rules, it does not weaken them. */
+  const hoistedDispatchAssigns = (
+    edges: readonly { pred: Block; succ: { block: Block; args: Value[] } }[],
+    liveAt: readonly Block[],
+  ): Stmt[] | null => {
+    // `edgeCopyRecords` is not a pure query: an `undef` arg whose copy it drops is APPENDED to
+    // `droppedUndefCopies`, which a loud postcondition below reads. This caller is SPECULATIVE — it
+    // asks every dispatch edge and may still decline — so the records are rolled back on the
+    // refusal paths, leaving the audit trail describing the program actually emitted (the caller
+    // then declines to if-recovery, which re-walks the same edges through `argAssignsFor` and
+    // records them there). `undefCarriesNothing` judges PER PRED, against what that predecessor
+    // wrote, while the hoist emits at the ROOT — so the record belongs to the edge walk that
+    // survives, not to this one. The rollback covers the refusals THIS function owns: a hoist that
+    // succeeds and is declined further down (an arm refusal in switch-recover.ts) still leaves its
+    // records, as it leaves any swap-cycle temp name `sequentialize` minted.
+    const auditMark = droppedUndefCopies.length;
+    const rollBack = (): null => {
+      droppedUndefCopies.length = auditMark;
+      return null;
+    };
+    const merged = new Map<string, { name: string; value: Expr; arg: Value; param: Value }>();
+    for (const { pred, succ } of edges) {
+      for (const c of edgeCopyRecords(pred, succ)) {
+        const prev = merged.get(c.name);
+        if (prev === undefined) {
+          merged.set(c.name, c);
+        } else if (prev.arg !== c.arg) {
+          return rollBack(); // disagreeing edges
+        }
+      }
+    }
+    if (merged.size === 0) {
+      return [];
+    }
+    const bound = new Set([...merged.values()].map((c) => c.param));
+    for (const blk of liveAt) {
+      for (const v of liveIn.get(blk) ?? []) {
+        const nm = varName.get(v);
+        if (nm !== undefined && merged.has(nm) && !bound.has(v)) {
+          return rollBack(); // a clobbered live name
+        }
+      }
     }
     return sequentialize(
-      copies.map(({ name, value }) => ({ name, value })),
+      [...merged.values()].map(({ name, value }) => ({ name, value })),
       varType,
       tempCounter,
       fn.name,
     );
   };
-  const argAssigns = (pred: Block, target: Block, sub: Map<Value, string> | null = null): Stmt[] => {
+  const argAssigns = (
+    pred: Block,
+    target: Block,
+    sub: Map<Value, string> | null = null,
+    keepSlot?: (i: number) => boolean,
+  ): Stmt[] => {
     const succ = successorTo(pred, target);
-    return succ ? argAssignsFor(pred, succ, sub) : [];
+    return succ ? argAssignsFor(pred, succ, sub, keepSlot) : [];
   };
 
   // Side-effecting ops of a block, emitted as statements in program order: memory stores; any
   // EFFECTFUL op whose result nothing consumes (a void/discarded call, and an `opaque` standing for
   // an instruction asmlift could not model); and MATERIALIZED defs — a call/load whose value cannot
   // soundly render at its use is assigned to its named temp here, at its own program position.
+  /** A pointer VALUE assigned into a map-declared pointer CELL, spelled so the assignment is legal
+   *  against ANY declaration of that cell. The byte-arithmetic guard renders such a right-hand
+   *  side `(u8 *)gS.pBuf + K` — the right ADDRESS in every world, which is the whole point of it,
+   *  and a `u8 *` where the declaration says `u16 *`. READING one is fine (C converts an object
+   *  pointer freely under a deref, a call argument or a compare); ASSIGNING one is `warning:
+   *  assignment from incompatible pointer type`, and this project's own `-Werror` compiler
+   *  template makes that FATAL — so a source that scores clean here fails to build in the tree a
+   *  user pastes it into, which no score gate can observe.
+   *
+   *  `void *`, NOT the map's declared pointee: it is the one target assignment-compatible with any
+   *  object-pointer declaration, the same "same answer in every world" property the guard that
+   *  made the `u8 *` exists for. Trusting the map's pointee would put the spelling back in one
+   *  world. It costs nothing: agbcc compiles `p = (void *)((u8 *)p + 4)` and the warning-carrying
+   *  `p = (u8 *)p + 4` to BYTE-IDENTICAL objects (`-mthumb-interwork -Wimplicit -O2 -fhex-asm
+   *  -fprologue-bugfix`), so the fix is invisible to the differ and visible to the compiler. */
+  const intoPtrCell = (lval: Expr, value: Expr): Expr => {
+    const cell = lval.k === 'var' ? symCtx?.info(lval.name)?.shape === 'pointer' : ptrMemberDecl(lval, symCtx) !== null;
+    if (!cell) {
+      return value;
+    }
+    const vt = ctype(value);
+    // BOTH ways a pointer value reaches here. `ctype` types params and locals, so it sees the
+    // guard's own `(u8 *)…` and nothing else: a bare `gSym.pBuf` or a pointer global's value —
+    // the population this rule exists for — reads `undefined` there. An already-`void *` value is
+    // assignable as it stands.
+    const isPtr = isPtrValue(value) || (vt?.kind === 'ptr' && vt.to.kind !== 'void');
+    return isPtr ? { k: 'cast', to: T.ptr(T.void()), e: value } : value;
+  };
+
   const sideEffects = (b: Block): Stmt[] => {
     const out: Stmt[] = [];
     for (const op of b.ops) {
       if (op.opcode === 'store') {
+        // a mask-and-insert recognized over the ops (see the precompute above): the member
+        // assignment, not the read-mask-or-store chain
+        const bfs = bitfieldStore.get(op);
+        if (bfs) {
+          out.push({
+            k: 'store',
+            lval: { k: 'field', base: { k: 'var', name: bfs.global }, name: bfs.field, dot: true },
+            value: expr(bfs.value),
+          });
+          continue;
+        }
         // A store whose lvalue is a bare global (`gSym = v`, from an `&gSym` base at off 0) emits
         // as an ASSIGN, not a store — memAccess returns a `var` node for that case.
         const width = op.attrs.width as number;
@@ -1861,12 +3390,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         );
         if (lval0.k === 'var') {
           globalNames.add(lval0.name);
-          out.push({ k: 'assign', name: lval0.name, value: expr(op.operands[1]) });
+          out.push({ k: 'assign', name: lval0.name, value: intoPtrCell(lval0, expr(op.operands[1])) });
           continue;
         }
         // signedness mirrors recoverTypes' store seed (word ⇒ signed, narrow ⇒ unsigned), so an
         // inserted cast declares the same scalar the recovered pointee would have.
-        out.push({ k: 'store', lval: lval0, value: expr(op.operands[1]) });
+        out.push({ k: 'store', lval: lval0, value: intoPtrCell(lval0, expr(op.operands[1])) });
       } else if (op.opcode === 'astore') {
         const elemSize = op.attrs.elemSize as number;
         out.push({
@@ -1876,8 +3405,11 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
             expr(op.operands[0]),
             expr(op.operands[1]),
             op.attrs.fieldOff as number | undefined,
+            op.attrs.memberOff as number | undefined,
             elemSize,
-            elemSize === 4,
+            // a member array's store spells through the member's OWN declaration, which the
+            // recognizer records; every other astore keeps the width===4 convention
+            (op.attrs.signed as boolean | undefined) ?? elemSize === 4,
             ctype,
             symCtx,
           ),
@@ -1899,11 +3431,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         // (an absorbed load's every consumer spells a named bitfield read — emitting its temp
         // here would recompile to a second load the asm does not have)
         const nm = varName.get(op.results[0])!;
-        out.push({ k: 'assign', name: nm, value: castAggregateAddr(nm, lowerDef(op, expr)) });
+        out.push({ k: 'assign', name: nm, value: intoDeclaredTemp(nm, lowerDef(op, expr)) });
       }
       // a merge copy anchored at this const's original position (anchorConstCopies, above)
       for (const a of anchoredAt.get(op) ?? []) {
         out.push({ k: 'assign', name: a.name, value: expr(a.arg) });
+        anchorsEmitted.add(a);
       }
     }
     return out;
@@ -1921,7 +3454,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   // to `header` is a conditional continue; its other edge, when it leaves the loop, is an early exit
   // (a `break` to `exit`, or an early `return` through a trampoline). Null outside any loop body —
   // the early-exit branch in structureBlock is inert there.
-  type LoopFrame = { header: Block; exit: Block; body: Set<Block> };
+  type LoopFrame = { header: Block; exit: Block; body: Set<Block>; arms: LoopArm[] };
   let loopCtx: LoopFrame | null = null;
   const withLoop = <R>(frame: LoopFrame, run: () => R): R => {
     const prev = loopCtx;
@@ -1953,8 +3486,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   };
 
   // ── Regime-A switch recovery (structure/switch-recover.ts): the recognizer's case bodies call
-  // back into structureRegion, and Regime B (switch_br, below) shares its fall-through predicate.
-  const { recognizeSwitch, analyzeArmExit } = makeSwitchRecovery({
+  // back into structureRegion, and Regime B (switch_br, below) reads FOUR things from it — the
+  // per-arm exit, the layout index, the chain linearization and where the `default:` label goes —
+  // so neither regime states any of those four facts twice.
+  //
+  // `isNamed` reads `varName` LIVE, and by here THE NAMING WALK IS COMPLETE: every write to
+  // `varName` and `backArgName` sits above, in the walk and the coalescing that follows it, and the
+  // two places the map is handed to (`coalesceNames`, `makeLoopHazards`) only read it. So the
+  // recognizer sees one settled naming however late a case body calls back into `structureRegion`,
+  // and nothing here has to be rebuilt against a naming that moves underneath it.
+  const { recognizeSwitch, analyzeArmExit, layoutIndex, defaultLayoutPos, chainArms } = makeSwitchRecovery({
     fn,
     defs,
     dom,
@@ -1963,7 +3504,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     isNamed: (v) => varName.has(v),
     isCmpOpcode: (opcode) => !!CMP_TO_BIN[opcode],
     switchAllowsNeqCase,
-    emitsAnchoredWrite: (blk) => blk.ops.some((o) => anchoredAt.has(o)),
+    switchAllowsBoundCase,
+    switchArmsFollowLayout,
+    spellSwitchFallthrough,
+    emitsOwnStatement: (blk) => blk.ops.some((o) => anchoredAt.has(o) || materialize.has(o)),
+    blockOf,
+    hoistDispatchCopies: (edges, liveAt) => hoistedDispatchAssigns(edges, liveAt),
     expr: (v) => expr(v),
     structureRegion: (b, stop) => structureRegion(b, stop),
   });
@@ -2036,22 +3582,89 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
       if (defEdge.block !== merge) {
         siblings.add(defEdge.block);
       }
-      // ONE emission order for the whole statement: the case arms in table order, then the default —
-      // which is exactly where C puts it. Adjacency is read off this array, so "falls into the next
-      // arm" needs no separate rule for a case that falls into the default (it is the arm after the
-      // last case, and legal C).
-      const emitOrder = [...arms, { entry: defEdge.block, edge: defEdge, values: null as number[] | null }];
+      // ARM ORDER. Grouping the table's slots by target walks them in TABLE order, which for a dense
+      // table is ascending case value — the neutral spelling, and the source's order only by
+      // accident. Where the compiler has declared that its block layout IS the order the arms were
+      // written (TargetDescription.switchArmsFollowLayout — the same fact and the same evidence
+      // Regime A reads, and agbcc's jump tables carry it too: 8 dense arms written 5,2,0,4,1,3,6,7
+      // lay their bodies out in that order under an ascending table), the bodies' layout is the
+      // evidence and the arms take it.
+      //
+      // The policy orders the chain HEADS. A FALLING arm's position is not free — emission order is
+      // load-bearing for correctness (the l3/ast.ts non-neutrality note), so it must sit directly
+      // above the arm it falls into — and `chainArms` below re-threads it for exactly those, which
+      // is the same per-SITE reading Regime A makes of the same declaration. `analyzeArmExit` does
+      // not depend on emission order, so the exits can be settled first and reused below. Grouping
+      // by target already gives every arm a DISTINCT entry block, so no two sort keys can be equal
+      // and the tie-break Regime A needs on shared bodies has nothing to decide here.
+      const exitOf = new Map<Block, ArmExit>();
+      for (const entry of [...arms.map((a) => a.entry), defEdge.block]) {
+        if (!exitOf.has(entry)) {
+          exitOf.set(entry, analyzeArmExit(entry, b, merge, siblings));
+        }
+      }
+      // A language whose `case` cannot fall through (Pascal) has no spelling for this shape, and
+      // Regime B has no second recovery to fall back on — so it fails LOUD, as it does for every
+      // other unspellable jump table. (Regime A, which does have a fallback, declines to
+      // if-recovery instead: switch-recover.ts's PRE2.)
+      if (!spellSwitchFallthrough && [...exitOf.values()].some((e) => e.kind === 'fallthrough')) {
+        throw new StructureError(
+          `cannot structure '${fn.name}': a jump-table case runs on into the next case, and the target ` +
+            `language has no fall-through in its case statement`,
+        );
+      }
+      if (switchArmsFollowLayout) {
+        arms.sort((x, y) => layoutIndex(x.entry) - layoutIndex(y.entry));
+      }
+      // …and then the CHAIN re-threads that order for the falling arms, exactly as it does for the
+      // comparison tree: ONE definition (`chainArms`) for the linearization, the adjacency it
+      // guarantees, and the three shapes no linear order spells. The arm-order policy above is read
+      // for the chain HEADS only — the same per-SITE reading Regime A makes of the same
+      // declaration, rather than a whole-switch gate on every arm being closed.
+      const preChain = arms.map((a) => a.entry);
+      // A table whose default block is ALSO a case target is that case's arm, not a separate one:
+      // it is already in `preChain`, and `defaultLayoutPos` withholds the label's position for it.
+      const dfltArm = defEdge.block !== merge && !armOf.has(defEdge.block) ? defEdge.block : null;
+      const chained = chainArms(preChain, dfltArm, exitOf);
+      if (chained === null) {
+        throw new StructureError(
+          `cannot structure '${fn.name}': the jump table's case arms do not linearize — two arms fall ` +
+            `into one, the default arm falls into a case, or the fall-through is a cycle`,
+        );
+      }
+      const armByEntry = new Map(arms.map((a) => [a.entry, a]));
+      const ordered = chained.map((e) => armByEntry.get(e)!);
+      const orderIntact = chained.every((e, i) => e === preChain[i]);
+      // The `default:` arm carries that evidence too, and a table hands it over the same way: the
+      // range check BRANCHES to the default (`bhi .Ldefault`), so its block is never one the
+      // dispatch ran into — measured, a 5-arm table lays the default's body at each of the six
+      // positions the source can write it in exactly there. `defaultLayoutPos` states the refusals.
+      const defaultAt =
+        defEdge.block !== merge
+          ? defaultLayoutPos(
+              defEdge.block,
+              ordered.map((a) => ({ entry: a.entry, fallsThrough: exitOf.get(a.entry)!.kind === 'fallthrough' })),
+              { placedByDispatch: false, orderIntact },
+            )
+          : undefined;
+      // ONE emission order for the whole statement: the case arms, then the default. Adjacency is
+      // read off this array, so "falls into the next arm" needs no separate rule for a case that
+      // falls into the default (it is the arm after the last case, and legal C). Where the LABEL is
+      // printed is `defaultAt`, which the emission order does not follow.
+      const emitOrder = [...ordered, { entry: defEdge.block, edge: defEdge, values: null as number[] | null }];
       // Each arm's switch-edge copies, computed ONCE and in emission order: `argAssignsFor` mints
       // swap-cycle temp names, so calling it twice for one edge burns a temp number and changes the
       // output (the same reason emitDoWhile reuses its `updates`).
       const edgeCopies = emitOrder.map((a) => argAssignsFor(b, a.edge));
       const bodies = emitOrder.map((a, i) => {
-        const exit = analyzeArmExit(a.entry, b, merge, siblings);
+        const exit = exitOf.get(a.entry)!;
         if (exit.kind === 'unstructurable') {
           throw new StructureError(`cannot structure '${fn.name}': ${exit.why}`);
         }
         const ft = exit.kind === 'fallthrough';
         const next = emitOrder[i + 1];
+        // Re-read off the EMISSION array rather than trusted from `chainArms` — the seam where a
+        // position acquires control-flow meaning, checked on the same side of it as Regime A's.
         if (ft && next?.entry !== exit.to) {
           throw new StructureError(
             `cannot structure '${fn.name}': ${a.values ? `case ${a.values.join('/')}` : 'the default arm'} falls ` +
@@ -2077,7 +3690,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
           fallsThrough: ft,
         };
       });
-      const outCases: SwitchCase[] = arms.map((a, i) => ({ values: a.values, ...bodies[i] }));
+      const outCases: SwitchCase[] = ordered.map((a, i) => ({ values: a.values, ...bodies[i] }));
       // An EMPTY default arm is not a default at all: it is where the switch ends, which is where
       // an unmatched scrutinee goes anyway. Emitting the label with nothing under it says nothing
       // and is not even valid C89 (a label needs a statement).
@@ -2086,7 +3699,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         k: 'switch',
         scrutinee: expr(term.operands[0]),
         cases: outCases,
-        ...(defBody.length ? { default: defBody } : {}),
+        ...(defBody.length ? { default: defBody, ...(defaultAt !== undefined ? { defaultAt } : {}) } : {}),
       };
       out.push(sw);
       if (merge && merge !== stop) {
@@ -2116,21 +3729,17 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
       return out;
     }
 
-    // guard-fused loop: this cond_br decides "enter loop header h vs its exit". Emit the
-    // inits unconditionally, then a while whose own test subsumes this guard. Never fuse when `b`
-    // is itself the header (a guard-LESS single-block do-while would emit the update once before a
+    // guarded self-loop: this cond_br decides "enter loop header h vs its exit". Emit the inits
+    // unconditionally, then either a `while` whose own test subsumes this guard (fused — only under
+    // the guard proof below), or the guard kept as its own `if` around a bottom-tested `do-while`
+    // (gcc's "guard + do-while" shape, emitted as itself). Never claim when `b` is itself the
+    // header (a guard-LESS single-block do-while would emit the update once before a
     // wrongly-`while` loop) — require a DISTINCT dominating guard block.
     for (const h of [takenB, fallB]) {
-      const li = loops.get(h);
-      if (li && h !== b && (takenB === li.exit || fallB === li.exit)) {
-        // A MATERIALIZED header op's temp is assigned only inside the body (sideEffects), but the
-        // un-rotated `while` condition renders BEFORE the body ever ran — reading the temp
-        // uninitialized on the first test. Mirror of the headerPure gate: decline loud.
-        if (li.header.ops.some((o) => materialize.has(o))) {
-          throw new StructureError(
-            `cannot structure '${fn.name}': loop header holds a materialized def its condition would read uninitialized`,
-          );
-        }
+      // `h` may be the header itself or its PURE PREHEADER (the LoopInfo records which): the
+      // guard's branch enters the loop either way, and the preheader's defs render inline.
+      const li = loops.get(h) ?? [...loops.values()].find((l) => l.preheader === h);
+      if (li && h !== b && li.header !== b && (takenB === li.exit || fallB === li.exit)) {
         // Self-loop emitter hazards: the while condition, the header→exit args, and every
         // post-loop use of a header-computed value render under the un-rotation sub — sound only
         // when their loop-variable reads go through sub-mapped back-edge args (post-update). A
@@ -2138,36 +3747,206 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
         // holds → decline LOUD, never emit wrong code.
         const sub = loopSub(li);
         const updates = argAssigns(li.header, li.header);
-        const updateWrites = updateWriteSet(updates);
+        const updateWrites = loopWriteSet(updates, [li.header], li.header);
         const hterm = li.header.ops[li.header.ops.length - 1];
         const hexitArgs = (successorTo(li.header, li.exit)?.args ?? []) as Value[];
+        // FUSION IS ONLY SOUND WHEN EVERYTHING IT DROPS IS REDUNDANT. `isGuardShapedPred` asks about
+        // the SHAPE alone — branches to the header, branches to the exit — and an `if` on something
+        // else entirely has that shape too. `entryVals` maps each header param and back-edge arg to
+        // the arg the guard passes into the loop, so reading through it models the first iteration:
+        // the state the guard tested. Two claims are checked against it, both LOUD on failure.
+        const guardExit = successorTo(b, li.exit)!; // the fusion condition above guarantees this edge
+        // The loop's init edge: the guard's own edge into the header, or the preheader's `br`
+        // when one stands between — its args are what the first iteration actually receives.
+        const initFrom = li.preheader ?? b;
+        const initArgs = (successorTo(initFrom, li.header)?.args ?? []) as Value[];
+        // Params first, BACK-EDGE ARGS SECOND: one value can be both — param `i+1` of a shifting
+        // pair is also the back-edge arg of param `i` — and the emitted expression renders it
+        // under the un-rotation substitution, so that reading is the one that must win.
+        const entryVals = new Map<Value, Value>();
+        li.header.params.forEach((p, i) => initArgs[i] !== undefined && entryVals.set(p, initArgs[i]));
+        li.header.params.forEach(
+          (_, i) => initArgs[i] !== undefined && entryVals.set(li.backArgOfParam[i], initArgs[i]),
+        );
+        // (1) Is the guard PROVABLY the loop's own test? Fusing DELETES it and lets the `while`
+        // re-test, so an unproven fuse would lose the `if` outright and run a loop the source
+        // skipped. Structural equality is a sufficient proof, never a necessary one: `str[0]` and
+        // `str[i]` at `i = 0`, or a signed `e <= 0` beside an unsigned `e != 0`, are the same test
+        // spelled differently, and normalising those needs a canonical form this pass does not
+        // have. An unproven guard therefore KEEPS its `if`, with the loop as a `do-while` inside it
+        // — every test the asm performs is emitted as itself. The proof still gates the SINK below:
+        // a sunk copy runs once per iteration, and only the proof (fused form) or the kept `if`
+        // makes the zero-trip path skip it. The kept `if` would widen the sink's key to unproven
+        // guards too; no row needs that yet, so it stays keyed on the proof.
+        const enterIsTaken = takenB === h;
+        const contIsTaken = hterm.successors[0].block === li.header;
+        const guardProven = sameAtEntry(hterm.operands[0], term.operands[0], entryVals, enterIsTaken !== contIsTaken);
+        // Fused `while` additionally requires a header free of MATERIALIZED defs: their temps are
+        // assigned only inside the body (sideEffects), and an un-rotated `while` condition renders
+        // BEFORE the body ever ran — reading a temp uninitialized on the first test. The kept-guard
+        // `do-while` tests after the body, so it carries no such restriction.
+        const fused = guardProven && !li.header.ops.some((o) => materialize.has(o));
+        // A pre-update exit copy is repairable rather than fatal: emitted at the TOP of the body it
+        // captures the value one iteration before the update, which is what the exit edge carries.
+        // Its post-loop copy is then dropped, so the ZERO-TRIP path needs the guard→exit edge as a
+        // seed — the only edge holding the never-entered value. That is why the sink demands the
+        // proof above: it makes the fused zero-trip path load-bearing.
+        const sunk = guardProven
+          ? sinkablePreUpdateSlots(li.header, li.exit, hexitArgs, new Set([li.header]), sub, updateWrites)
+          : new Set<number>();
+        // (2) Every exit copy the fused form KEEPS renders after the loop, on the zero-trip path
+        // too — where the loop variables still hold their init values. It must therefore produce
+        // what the guard→exit edge carries, since that edge is dropped. A sunk slot is exempt: its
+        // seed and its body copy cover the two paths separately.
+        const staleExit = hexitArgs.findIndex(
+          (a, j) => !sunk.has(j) && !sameAtEntry(a, guardExit.args[j] as Value, entryVals),
+        );
+        if (staleExit >= 0) {
+          throw new StructureError(
+            `cannot structure '${fn.name}': the fused guard's exit edge carries a value the post-loop ` +
+              `copies do not reproduce on a zero-trip run`,
+          );
+        }
+        const sunkSlot = (j: number) => sunk.has(j);
+        const keptSlot = (j: number) => !sunk.has(j);
         if (
           loopUpdateHazard(
             hterm.operands[0],
-            hexitArgs,
+            hexitArgs.filter((_, j) => keptSlot(j)),
             new Set([li.header]),
             sub,
             updateWrites,
             null,
-            new Set(li.header.params),
           )
         ) {
           throw new StructureError(
             `cannot structure '${fn.name}': loop condition or a post-loop value reads a pre-update loop variable`,
           );
         }
-        out.push(...argAssigns(b, h)); // loop-variable initialisation
-        out.push(emitWhile(li, updates));
+        // The seed and the loop init are two copy groups from the SAME block, emitted back to back,
+        // and nothing sequentializes them against each other: a seed that writes a name the init
+        // then reads hands the loop the wrong starting value. Computed once — a second
+        // `argAssigns` for one edge burns a swap-cycle temp number and changes the output.
+        const seed = argAssigns(b, li.exit, null, sunkSlot);
+        const seedWrites = new Set(seed.filter((st) => st.k === 'assign').map((st) => st.name));
+        if (initArgs.some((a) => readsClobbered(a, new Map(), seedWrites))) {
+          throw new StructureError(
+            `cannot structure '${fn.name}': seeding the zero-trip value would overwrite a value the ` +
+              `loop initialisation reads`,
+          );
+        }
+        // ZERO-TRIP reads (kept-guard form only): the body sits inside `if (guard)`, so a
+        // materialized header def's temp is assigned only when the guard held. A kept exit arg or
+        // a post-loop read reaching such a temp — by its NAME, which is how a materialized def
+        // renders — reads it uninitialized on the guard-false path, silently. Loop-variable names
+        // are exempt (the inits write them unconditionally, and staleExit already proved their
+        // zero-trip values); so is anything named outside the header. Decline loud.
+        if (!fused) {
+          const paramNames = new Set(li.header.params.map((q) => varName.get(q)));
+          const bodyTemp = (v: Value): boolean => {
+            const d = defs.get(v);
+            return (
+              d !== undefined &&
+              materialize.has(d) &&
+              opBlock.get(d) === li.header &&
+              varName.has(v) &&
+              !paramNames.has(varName.get(v))
+            );
+          };
+          const reachesBodyTemp = (root: Value): boolean => {
+            const stack = [root];
+            const seen = new Set<Value>();
+            while (stack.length) {
+              const v = stack.pop()!;
+              if (seen.has(v)) {
+                continue;
+              }
+              seen.add(v);
+              if (sub.has(v)) {
+                continue; // renders as its loop variable's name — unconditionally initialized
+              }
+              if (bodyTemp(v)) {
+                return true;
+              }
+              if (varName.has(v)) {
+                continue; // named outside the guarded body — assigned on both paths
+              }
+              const d = defs.get(v);
+              if (d) {
+                stack.push(...d.operands);
+              }
+            }
+            return false;
+          };
+          if (
+            hexitArgs.some((a, j) => !sunk.has(j) && reachesBodyTemp(a)) ||
+            [...(liveIn.get(li.exit) ?? [])].some(bodyTemp)
+          ) {
+            throw new StructureError(
+              `cannot structure '${fn.name}': a post-loop read reaches a temp the guarded body may never assign`,
+            );
+          }
+        }
+        const inits = argAssigns(initFrom, li.header);
+        const loopStmt = emitWhile(
+          li,
+          updates,
+          preUpdateCopies(li.exit, hexitArgs, sunk, li.header),
+          fused ? 'while' : 'dowhile',
+        );
+        // The guard-read substitution: an init arg reads as its loop variable's NAME. The inits
+        // just assigned them (value-identical), and that is the source spelling — `if (n > 0)`
+        // tests the loop variable, which is also the parked register the target's guard reads.
+        // Not an UNMATERIALIZED const: the guard compared an immediate (`cmp rX, #0`), and an
+        // immediate is what re-spelling it as the counter's name would un-spell.
+        const gsub = new Map<Value, string>();
+        li.header.params.forEach((p, i) => {
+          const a = initArgs[i];
+          const ad = a !== undefined ? defs.get(a) : undefined;
+          if (a !== undefined && !(ad?.opcode === 'const' && !materialize.has(ad))) {
+            gsub.set(a, varName.get(p)!);
+          }
+        });
+        if (!fused) {
+          // The kept guard's condition renders AFTER the seed and the inits, but tests the state
+          // BEFORE them — a read of a just-(non-identity-)written name is sound only through
+          // `gsub`, whose mapped values the inits deliberately hold.
+          const writes = new Set([...seedWrites, ...updateWriteSet(inits)]);
+          if (readsClobbered(term.operands[0], gsub, writes)) {
+            throw new StructureError(
+              `cannot structure '${fn.name}': the kept guard's condition reads a name the loop initialisation overwrites`,
+            );
+          }
+        }
+        out.push(...seed); // zero-trip value for the sunk copies
+        out.push(...inits); // loop-variable initialisation
+        if (fused) {
+          out.push(loopStmt);
+        } else {
+          let gcond = exprWith(gsub)(term.operands[0]);
+          if (!enterIsTaken) {
+            gcond = negateCond(gcond);
+          } // entering the loop must be `taken`
+          out.push(mkIf(gcond, [loopStmt], []));
+        }
         // The header→exit edge may carry non-identity phi args (the exit param merges the guard-false
         // value with the loop's final value). Emit those copies after the loop — dropping them returns
         // a stale value. Read under the un-rotation substitution (post-loop the params hold their
         // updated values), and structure the exit region under the same substitution so a post-loop
         // use of a loop value reads its name.
-        out.push(...withSub(sub, () => [...argAssigns(li.header, li.exit, sub), ...structureRegion(li.exit, stop)]));
+        out.push(
+          ...withSub(sub, () => [...argAssigns(li.header, li.exit, sub, keptSlot), ...structureRegion(li.exit, stop)]),
+        );
         return out;
       }
     }
 
+    // Is THIS edge one of the enclosing loop's admitted early-`return` arms? Keyed on the edge
+    // because ownership is: a second edge into the same block is a separate question. No shape today
+    // separates it from keying on the target alone — this holds the invariant, it does not fix an
+    // observed bug.
+    const isArm = (t: Block) => !!loopCtx && loopCtx.arms.some((a) => a.from === b && a.to === t);
+
     // Conditional latch / in-body early exit: one edge of this cond_br is the loop back-edge (a
     // continue to `loopCtx.header`); the other LEAVES the loop. When the leaving edge lands on the
     // loop's own exit block it is a `break`; when it trampolines to a `return` it is an early `return`.
@@ -2200,26 +3979,19 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
       // `readsClobbered` distinguishes the two at the VALUE level; on a hazard, decline (fall
       // through → honest loud fail) rather than emit wrong code.
       const updateCopies = argAssigns(b, loopCtx.header);
-      const updateWrites = updateWriteSet(updateCopies);
+      const updateWrites = loopWriteSet(updateCopies, loopCtx.body, loopCtx.header);
       const exitArgs = (successorTo(b, exitB)?.args ?? []) as Value[];
       // The exit ARM may also read loop-body-computed values directly (an exitB dominated by `b`
       // — e.g. its `ret` operand), not just through edge args: apply the same escape test to the
       // arm's region (blocks reachable from exitB outside the loop body).
+      //
+      // WHAT THE REGION IS FOR: this arm renders INSTEAD of the next iteration, behind an update
+      // already emitted, so a read of a loop variable here wanted the value it had before that —
+      // `if (found) { *out = i; return; }` would store `i + 1`. Handing the arm's own region makes
+      // the escape check judge exactly those reads.
       const exitRegion = new Set([exitB, ...reachFrom(exitB)].filter((x) => !loopCtx!.body.has(x)));
-      const hazard = loopUpdateHazard(
-        term.operands[0],
-        exitArgs,
-        loopCtx.body,
-        sub,
-        updateWrites,
-        exitRegion,
-        new Set(loopCtx.header.params),
-      );
-      if (
-        !hazard &&
-        !loopCtx.body.has(exitB) &&
-        ((isBreak && breakSafe) || (!isBreak && leadsToReturnOnly(exitB, loopCtx.body)))
-      ) {
+      const hazard = loopUpdateHazard(term.operands[0], exitArgs, loopCtx.body, sub, updateWrites, exitRegion);
+      if (!hazard && !loopCtx.body.has(exitB) && ((isBreak && breakSafe) || (!isBreak && isArm(exitB)))) {
         out.push(...updateCopies); // the loop update, RAW (i++, p>>=1, …)
         let leaveCond = exprWith(sub)(term.operands[0]);
         if (contIsTaken) {
@@ -2244,7 +4016,27 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
 
     const cond = expr(term.operands[0]);
     const ipd = ipdom.get(b) ?? null; // null ⇒ the arms diverge (both reach EXIT), no join
-    const merge = ipd ?? stop;
+    // Inside a loop body, a join OUTSIDE that body is not this `if`'s join: an arm that leaves the
+    // loop `return`s and never comes back, so what is left reconverges at the loop's own
+    // continuation. Post-dominance cannot see that — agbcc/gcc merge every `return` into one
+    // epilogue, which the early return and the post-loop path both reach — and structuring the
+    // in-loop arm towards it walks through the latch and back into the header (a loud `onStack`
+    // decline).
+    //
+    // `stop` stands in for the real join, so it has to BE the real join: one side must already end
+    // this region — an admitted arm (its `return` terminates that path) or `stop` itself. Two sides
+    // meeting somewhere further down instead would each re-emit everything from there to the bottom,
+    // doubling per nesting level; those keep the CFG join and the old loud decline. Lifting that
+    // needs a post-dominator computed over the body alone with the arms DELETED — treating them as
+    // exits does not work, since post-dominance cannot express "where the paths that did not
+    // return meet".
+    const clampToLoop =
+      loopCtx !== null &&
+      ipd !== null &&
+      !loopCtx.body.has(ipd) &&
+      term.successors.some((sc) => isArm(sc.block) || sc.block === stop) &&
+      term.successors.every((sc) => loopCtx!.body.has(sc.block) || isArm(sc.block));
+    const merge = clampToLoop ? stop : (ipd ?? stop);
     // Per-successor records, NOT successorTo(b, block): a cond_br whose two edges reach the SAME
     // block with different args would otherwise give both arms the first edge's copies.
     const thenS = [...argAssignsFor(b, term.successors[0]), ...structureRegion(takenB, merge)];
@@ -2260,6 +4052,17 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
       out.push({ k: 'if', cond: negateCond(cond), then: elseS, else: thenS });
       return out;
     }
+    if (negateJoinedBranchSense && ipd !== null && thenS.length && elseS.length) {
+      // JOINED arms only (`ipd !== null` — a divergent if belongs to preserveDivergentBranchSense
+      // above, and without the check a /flip-branch variant would fall through here and get
+      // flipped BACK, collapsing the {divergent flipped × joined flipped} combination), and both
+      // arms real: the flipped spelling is a genuine sibling, not noise on a one-armed if
+      out.push({ k: 'if', cond: negateCond(cond), then: elseS, else: thenS });
+      if (merge && merge !== stop) {
+        out.push(...structureRegion(merge, stop));
+      }
+      return out;
+    }
     out.push(mkIf(cond, thenS, elseS));
     if (merge && merge !== stop) {
       out.push(...structureRegion(merge, stop));
@@ -2277,19 +4080,66 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   };
   const loopSub = (li: LoopInfo): Map<Value, string> => subFor(li.header.params, li.backArgOfParam);
 
-  // Un-rotate a header's do-while latch into a `while`: the test reads the header's own
-  // params (back-edge args substituted back), and the body is the header's SIDE EFFECTS in
-  // program order followed by its parallel update. The side effects are required — a copies-only
-  // body would silently delete every store/discarded call in the header. Effect order is right by
-  // construction: statements read pre-update names, the updates land after.
-  const emitWhile = (li: LoopInfo, updates?: Stmt[]): Stmt => {
+  // The sunk exit copies, as body statements: `dest = <the arg, rebuilt here>`. The sink's gates
+  // are stated against `exprWith(null)` — every name it stops at holds, at the top of the body,
+  // what it held where the edge read it — so the arg is spelled with no substitution. Slot order
+  // keeps it deterministic.
+  //
+  // NOT `expr`: an ambient `activeSub` is an ENCLOSING loop's post-loop naming, which the sink's
+  // walk does not model, so a REBUILT tree here would be spelled under names that substitution has
+  // redefined. DEFENSIVE — no input reaches it: instrumenting this line across the whole suite,
+  // `activeSub` is null at every call. It stays because the failure it names is silent (a wrong
+  // value, not a gap) and the cost of keeping it is one branch.
+  //
+  // The destination name is read as an invariant, not checked: every block param carries one.
+  // `assertResolved` is what catches a widening that breaks that.
+  //
+  // `home` is the loop HEADER — the block whose body these copies open, and so the block from which
+  // the write is reachable. Recorded rather than inferred because `exit` says the opposite (see
+  // `sunkCopyHomes`).
+  const preUpdateCopies = (exit: Block, exitArgs: readonly Value[], sunk: Set<number>, home: Block): Stmt[] =>
+    [...sunk]
+      .sort((x, y) => x - y)
+      .map((j) => {
+        if (activeSub !== null && !varName.has(exitArgs[j])) {
+          throw new StructureError(
+            `cannot structure '${fn.name}': a pre-update exit copy would rebuild a computed value ` +
+              `inside a loop nested in another loop's post-loop naming`,
+          );
+        }
+        const name = varName.get(exit.params[j])!;
+        sunkCopyHomes.push({ name, home });
+        return {
+          k: 'assign' as const,
+          name,
+          value: exprWith(null)(exitArgs[j]),
+        };
+      });
+
+  // A guarded self-loop's body and latch test. The test reads the header's own params (back-edge
+  // args substituted back), and the body is any sunk trailing copies, then the header's SIDE
+  // EFFECTS in program order, then its parallel update. The side effects are required — a
+  // copies-only body would silently delete every store/discarded call in the header. Effect order
+  // is right by construction: statements read pre-update names, the updates land after, and a sunk
+  // copy reads the top-of-iteration value it is there to capture.
+  //
+  // The SAME cond/body serve both forms: as a `while` (guard fused away — the un-rotation), the
+  // first test reads the just-emitted init values; as a `dowhile` (guard kept as its own `if`),
+  // every test runs after the update wrote the params' next values. Both are what that form's
+  // source spelling means.
+  const emitWhile = (
+    li: LoopInfo,
+    updates?: Stmt[],
+    sunkCopies: Stmt[] = [],
+    kind: 'while' | 'dowhile' = 'while',
+  ): Stmt => {
     const term = li.header.ops[li.header.ops.length - 1];
     let cond = exprWith(loopSub(li))(term.operands[0]);
     if (term.successors[0].block !== li.header) {
       cond = negateCond(cond);
     } // loop-continue must be `taken`
-    const body = [...sideEffects(li.header), ...(updates ?? argAssigns(li.header, li.header))];
-    return { k: 'while', cond, body };
+    const body = [...sunkCopies, ...sideEffects(li.header), ...(updates ?? argAssigns(li.header, li.header))];
+    return kind === 'while' ? { k: 'while', cond, body } : { k: 'dowhile', cond, body };
   };
 
   // Test-at-top `while`: the header's cond_br is the loop condition. The body is a region that stops
@@ -2307,7 +4157,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     // Mirror the br/cond_br cases: argAssigns then structureRegion. Structure the body under this
     // loop's frame so an in-body conditional exit (break / early return) is recognised instead of
     // tripping the header-re-entry `onStack` guard.
-    const body = withLoop({ header: wl.header, exit: wl.exit, body: wl.body }, () => [
+    const body = withLoop({ header: wl.header, exit: wl.exit, body: wl.body, arms: wl.arms }, () => [
       ...argAssigns(wl.header, wl.bodyEntry),
       ...structureRegion(wl.bodyEntry, wl.header),
     ]);
@@ -2334,10 +4184,67 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     // path applies; on a hazard, decline LOUD.
     const sub = latchSub(dw);
     const updates = argAssigns(dw.latch, dw.header);
-    const updateWrites = updateWriteSet(updates);
+    const updateWrites = loopWriteSet(updates, dw.body, dw.header);
     const lterm = dw.latch.ops[dw.latch.ops.length - 1];
+    // KNOWN GAP, and the reason the sink stands down rather than repairing anything. A body
+    // block's param may adopt a LOOP VARIABLE's name (canTakeName waives the liveness half for a
+    // pure alias, an argument that does not carry when the name came from `backArgName` — it is
+    // then a different value's). The arm's copy into it is a real write partway through the body,
+    // and everything rendered after it reads the name RAW: the update, the bottom test, the
+    // header's own ops, the latch's side effects.
+    //
+    // The refusal is on the NAME, not on who reads it: the readers are every statement the loop
+    // emits, which is not a set worth enumerating when the name alone is the whole signal.
+    //
+    // The emitted C is wrong whenever this shape occurs, sink or no sink — it is a naming-pipeline
+    // defect, not this pass's, and repairing the exit copy does not touch it. What IS this pass's
+    // is not to UNLOCK such a loop: with no sink these functions decline on the pre-update hazard,
+    // so standing down keeps them loud rather than trading a decline for a silent wrong answer.
+    const headerNames = new Set(dw.header.params.map((p) => varName.get(p)));
+    const bodyRebinds = new Set<string>();
+    for (const bb of dw.body) {
+      if (bb === dw.header) {
+        continue;
+      }
+      bb.params.forEach((pv, i) => {
+        const n = varName.get(pv);
+        if (n === undefined) {
+          return;
+        }
+        // Only a copy that SURVIVES argAssigns' identity elision writes anything, so an edge whose
+        // arg already carries the name does not count.
+        for (const { succ } of inEdgeRecords(preds, bb)) {
+          if (varName.get(succ.args[i]) !== n) {
+            bodyRebinds.add(n);
+          }
+        }
+      });
+    }
+    const rebindHazard = [...bodyRebinds].some((n) => headerNames.has(n));
     const exitArgs = (successorTo(dw.latch, dw.exit)?.args ?? []) as Value[];
-    if (loopUpdateHazard(lterm.operands[0], exitArgs, dw.body, sub, updateWrites, null, new Set(dw.header.params))) {
+    // A pre-update exit copy moves to the TOP of the body, where the loop variables still hold
+    // their top-of-iteration values. No zero-trip seed here: a `do-while` always runs its body, so
+    // any other predecessor of the exit is an ordinary edge some enclosing `if` already emits.
+    const sunk = rebindHazard
+      ? new Set<number>()
+      : sinkablePreUpdateSlots(dw.header, dw.exit, exitArgs, dw.body, sub, updateWrites);
+    // The post-loop region the escaped-value check judges: everything the loop does not emit itself.
+    // An early-`return` arm the loop OWNS renders inside the body, ahead of the update, so a read of
+    // a loop variable there is the pre-update value it wants — counting it as post-loop would decline
+    // the loop for a hazard that cannot happen. Blocks the arm merely reaches are not `owned`, and stay
+    // post-loop where the other path really does read them after the update.
+    const owned = new Set(dw.arms.flatMap((a) => [...a.owned]));
+    const postLoop = new Set(fn.blocks.filter((bb) => !dw.body.has(bb) && !owned.has(bb)));
+    if (
+      loopUpdateHazard(
+        lterm.operands[0],
+        exitArgs.filter((_, j) => !sunk.has(j)),
+        dw.body,
+        sub,
+        updateWrites,
+        postLoop,
+      )
+    ) {
       throw new StructureError(
         `cannot structure '${fn.name}': do-while condition or a post-loop value reads a pre-update loop variable`,
       );
@@ -2372,25 +4279,95 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     const inner =
       dw.header === dw.latch
         ? [] // single-block self-loop: the header IS the latch — its ops render via sideEffects below
-        : withLoop({ header: dw.header, exit: dw.exit, body: dw.body }, () => structureBlock(dw.header, dw.latch)); // header..latch (exclusive of latch)
+        : withLoop({ header: dw.header, exit: dw.exit, body: dw.body, arms: dw.arms }, () =>
+            structureBlock(dw.header, dw.latch),
+          ); // header..latch (exclusive of latch)
     dwActive.delete(dw.header);
     // The UPDATE is RAW (`v = v - 1`) — it IS the decrement; applying `sub` would make it look like the
     // identity `v = v` and drop it. Only the CONDITION and EXIT copies use `sub` (post-update the param
     // already holds the next value, so the latch-computed test reads `v`, not `v - 1`). `updates`
     // reuses the hazard check's computation — a second argAssigns call would burn a spurious
     // swap-cycle temp number.
-    const body = [...inner, ...sideEffects(dw.latch), ...updates];
+    const body = [
+      ...preUpdateCopies(dw.exit, exitArgs, sunk, dw.header),
+      ...inner,
+      ...sideEffects(dw.latch),
+      ...updates,
+    ];
     let cond = exprWith(sub)(lterm.operands[0]);
     if (lterm.successors[1].block === dw.header) {
       cond = negateCond(cond);
     } // continue edge must be `taken`
     const out: Stmt[] = [{ k: 'dowhile', cond, body }];
     // The exit region reads latch back-edge values under `sub` (post-loop they live in the loop vars).
-    out.push(...withSub(sub, () => [...argAssigns(dw.latch, dw.exit, sub), ...structureRegion(dw.exit, stop)]));
+    out.push(
+      ...withSub(sub, () => [
+        ...argAssigns(dw.latch, dw.exit, sub, (j) => !sunk.has(j)),
+        ...structureRegion(dw.exit, stop),
+      ]),
+    );
     return out;
   };
 
-  const body = recognizeForLoops(structureRegion(entry, null));
+  const body = stampOrderedBases(recognizeForLoops(structureRegion(entry, null)), orderLicensedGlobals);
+  // THE OBLIGATION `anchorConstCopies` CANNOT DISCHARGE ON ITS OWN, checked now that the render is
+  // complete. Anchoring is two edits that must both land: `suppressedArgs` DELETES a write from its
+  // edge, and `anchoredAt` owes it back at the const's def site. Its refusal conditions establish
+  // that the def block DOMINATES every suppressed edge — but dominating a block is not being
+  // rendered, and a block whose every op renders inline gets no statement position at all. A loop's
+  // claimed pure preheader is one (LoopInfo.preheader: the guarded-loop emitter takes its EDGE args
+  // and never structures it), and there is no reason to believe it is the last. A promise half-kept
+  // leaves the merge variable read where nothing wrote it — the one wrongness the byte differ
+  // rewards rather than catches, since the candidate compiles, scores, and can win.
+  //
+  // OBSERVABLE is the test, not "emitted". A merge name the rendered body never mentions has no
+  // reader to see the missing write and no second writer to disagree with it, and its declaration
+  // goes with it (l3/dce.ts prunes a local nothing references) — so the copy and the value it
+  // carried are gone together, which is a program the edge spelling can also produce. Only a name
+  // the body still uses is a broken promise, or a GLOBAL, whose store is observed outside this
+  // function whatever this body does with it. klonoa's `MPlayContinue` is the live inhabitant: its
+  // `/defsite` spelling is correct and main enumerates it — a RECORD of a measurement, not a live
+  // check, since that function is in no corpus row and no fixture here.
+  const owed = [...anchoredAt.values()].flat().filter((w) => !anchorsEmitted.has(w));
+  if (owed.length > 0) {
+    const mentioned = new Set<string>(globalNames);
+    for (const e of walkExprs(body)) {
+      if (e.k === 'var' || e.k === 'addr') {
+        mentioned.add(e.name);
+      }
+    }
+    const assignTargets = (ss: Stmt[]): void => {
+      for (const st of ss) {
+        if (st.k === 'assign') {
+          mentioned.add(st.name);
+        }
+        assignTargets(stmtChildren(st));
+      }
+    };
+    assignTargets(body);
+    const broken = owed.find((w) => mentioned.has(w.name));
+    if (broken !== undefined) {
+      throw new StructureError(
+        `cannot structure '${fn.name}': the merge copy into '${broken.name}' was suppressed from ` +
+          `its edge for a def-site anchor that no rendered position emitted`,
+      );
+    }
+  }
+  // THE OBLIGATION `undefCarriesNothing` CANNOT DISCHARGE ON ITS OWN, checked now that both records
+  // are complete. That test reads each write site off `paramBlock`/`opBlock`, and a sunk pre-update
+  // exit copy is written somewhere else than either map says. What keeps them apart today is
+  // `dest-free-inside-loop`, a gate stated about something else entirely and carrying its own KNOWN
+  // GAP — so the day a widening lets the two meet, the emitted C substitutes a DEFINED value for the
+  // undefined one the machine leaves in place. Loud, because that failure has no other symptom.
+  const collided = sunkCopyOverDroppedUndef(droppedUndefCopies, sunkCopyHomes, (home, pred) =>
+    reachFrom(home).has(pred),
+  );
+  if (collided !== null) {
+    throw new StructureError(
+      `cannot structure '${fn.name}': a pre-update exit copy sunk into a loop body writes '${collided}' ` +
+        `ahead of an edge whose undefined argument's copy was dropped as carrying nothing`,
+    );
+  }
   // Strict-mode gaps decline HERE, naming the reasons — the same text annotate's markers
   // carry, so the two mode surfaces report the same decline (the reproduction scripts run
   // strict; the benchmark rows store annotate markers — fidelity holds them against each
@@ -2404,31 +4381,157 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
   const localNames = [...new Set([...varName.values(), ...[...varType.keys()].filter((n) => /^t\d+$/.test(n))])].filter(
     (n) => /^[vt]\d+$/.test(n) && !globalNames.has(n),
   );
+  // THE FRAME COORDINATES OF EACH DECLARED LOCAL (ir/core.ts `SlotHomes`, stamped by the SSA
+  // builder). The naming walk is what makes it a per-DECLARATION fact: several spilled values can
+  // land under one name, and the local the source declared is the name, not the value. Where a
+  // name covers several homes it takes the UNION and picks NOTHING — which offset is the earlier
+  // declaration rank depends on the frame's direction, and `l3/slotorder.ts` is the one place that
+  // holds it. Sorted, so the list is deterministic rather than insertion-ordered.
+  //
+  // A NAME COVERING NO HOMED VALUE GETS NO ENTRY, so `slots` is absent rather than `[]` on the
+  // locals the asm kept in registers. Values named `a<n>` (parameters) never reach here:
+  // `localNames` is the `v*`/`t*` set, and a parameter's storage is the caller's question.
+  const slotsOfName = new Map<string, Set<number>>();
+  const isLocalName = new Set(localNames);
+  for (const [v, offs] of fn.slotHomes ?? []) {
+    const n = varName.get(v);
+    if (n === undefined || !isLocalName.has(n)) {
+      continue;
+    }
+    const prev = slotsOfName.get(n);
+    if (prev === undefined) {
+      slotsOfName.set(n, new Set(offs));
+    } else {
+      offs.forEach((off) => prev.add(off));
+    }
+  }
+  // The machine's static access counts for one frame object: every `load`/`store` rooted on an
+  // `laddr` at the same offset. Counted over the L2 blocks, so it is the access set the asm had,
+  // before any L3 readability pass could drop or duplicate one. Summed across the offset's
+  // `laddr` ops — the frontend's frame-object audit re-roots accesses onto per-offset captures
+  // and holds one object per offset, so several ops can name the same storage.
+  //
+  // NO record at all when the address reaches ANYTHING ELSE — a block argument, an offset
+  // computation, a call. The count is then a floor rather than the access set, and it is read as
+  // the access set (the l3/volatileval.ts gate), so it refuses instead of reporting a number that
+  // undercounts. Reached rather than theoretical: an address-escaped frame scratch takes it —
+  // `synthetic:dma_fill_uninit` and `kleod:ProcessInputAndUpdateEntities` both lose their record
+  // here.
+  const frameRecord = (at: Op): { frame?: { loads: number; stores: number } } => {
+    const off = at.attrs.off as number;
+    const roots = new Set<Value>();
+    for (const b of fn.blocks) {
+      for (const op of b.ops) {
+        if (op.opcode === 'laddr' && (op.attrs.off as number) === off) {
+          roots.add(op.results[0]);
+        }
+      }
+    }
+    let loads = 0;
+    let stores = 0;
+    for (const b of fn.blocks) {
+      for (const op of b.ops) {
+        const access = op.opcode === 'load' || op.opcode === 'store';
+        if (access && roots.has(op.operands[0])) {
+          if (op.opcode === 'load') {
+            loads++;
+          } else {
+            stores++;
+          }
+        }
+        // every OTHER mention of the address, operands and branch arguments alike
+        const elsewhere = op.operands.some((v, i) => roots.has(v) && !(access && i === 0));
+        if (elsewhere || op.successors.some((sx) => sx.args.some((v) => roots.has(v)))) {
+          return {};
+        }
+      }
+    }
+    return { frame: { loads, stores } };
+  };
+  // ONE `laddr` op per minted NAME, last one wins. Same answer as feeding every op's finished entry
+  // to `new Map` — each entry was a pure function of its own op, and the Map kept the LAST value
+  // under a key at its FIRST key's position — but stated rather than left to be read off `new Map`'s
+  // semantics, and `frameRecord` (which walks every op of the function) then runs once per name
+  // instead of once per op. NOT a measured speedup: over `packages/core/test` every one of the
+  // 1,057 structurings that reach here has ops === names, so the dedup fires zero times there. It
+  // is a bound, not a win: `laddrName` mints one name per OFFSET, and the frontend's frame-object
+  // audit can re-root several ops onto one offset (see `frameRecord`'s own note).
+  const lastLaddrOf = new Map<string, Op>();
+  for (const op of fn.blocks.flatMap((b) => b.ops).filter((op) => op.opcode === 'laddr')) {
+    lastLaddrOf.set(laddrName.get(op)!, op);
+  }
   const structs = collectStructs(fn);
   return {
     name: fn.name,
     params: entry.params.map((p, i) => ({ name: `a${i}`, type: p.type })),
     locals: [
-      ...localNames.map((n) => ({ name: n, type: varType.get(n)! })),
+      ...localNames.map((n) => ({
+        name: n,
+        type: varType.get(n)!,
+        ...(slotsOfName.has(n) ? { slots: [...slotsOfName.get(n)!].sort((x, y) => x - y) } : {}),
+      })),
       // frame-local objects (laddr): declared with EXACTLY the access type the machine used —
       // the frontend's frame-object audit proved all accesses agree, so this is a fact, not a guess
-      ...[
-        ...new Map(
-          fn.blocks
-            .flatMap((b) => b.ops)
-            .filter((op) => op.opcode === 'laddr')
-            .map((op) => [
-              laddrName.get(op)!,
-              {
-                name: laddrName.get(op)!,
-                type: T.int((op.attrs.width as number) * 8, op.attrs.signed as boolean),
-                // an ESCAPED address makes every store observable (the DMA hardware reads it);
-                // without volatile, gcc-2.9 deletes a store to a local nothing in-function reads
-                ...(op.attrs.volatile === true ? { volatile: true as const } : {}),
-              },
-            ]),
-        ).values(),
-      ],
+      //
+      // NO `slots` IS STAMPED HERE, and the offset is in hand (`op.attrs.off`), so this is a
+      // refusal and not an oversight. An RTL-time frame object is allocated at its declaration
+      // and sits BELOW every spill slot, so its offset is not evidence of its rank among the
+      // spilled locals — and the one row in the corpus that carries such an object next to real
+      // spills (`synthetic:dma_fill_uninit`, a `volatile` scratch at offset 0) compiles to the
+      // same object whether that local is sorted with the spills or left where the naming walk
+      // put it, measured both ways. So no row can refute an ordering over these, and an ordering
+      // no row can refute does not earn its place. THE FLIP CONDITION: the first row whose object
+      // is decided by the declaration order of two `laddr` locals, or of an `laddr` against a
+      // spill, is the referee — stamp them then, and `l3/slotorder.ts` needs no change to use it.
+      ...[...lastLaddrOf].map(([name, op]) => ({
+        name,
+        type: T.int((op.attrs.width as number) * 8, op.attrs.signed as boolean),
+        // the asm materialized this slot's address, and this is how many times it
+        // loaded and stored through it — both asm facts, and the gate the
+        // l3/volatileval.ts lever reads (see the SFn.locals doc)
+        ...frameRecord(op),
+        // an ESCAPED address makes every store observable (the DMA hardware reads it), and
+        // the source spells the scratch volatile for that reason — see the stamp site in
+        // frontend/thumb.ts for why it is the SPELLING that matters and not dead-store
+        // elimination, which keeps the store either way
+        ...(op.attrs.volatile === true ? { volatile: true as const } : {}),
+      })),
+      // uninitialised locals (undef): declared, never assigned, typed by whatever recovery settled
+      // on for the value. NO `slots` either, on the same footing as the frame objects above.
+      //
+      // THE REASON IS UNDECIDABILITY, not absence. One frame slot then yields TWO declarations:
+      // the `undef` read of the storage and the value stored into it. They are one object in the
+      // source, and the asm does not say which of the two took the rank — so ranking one of the
+      // pair while leaving the other pinned would invent an answer. Refusing the undef half keeps
+      // the stored half's rank, which is the one the spill evidence is about.
+      //
+      // AND IT IS PRECAUTIONARY: NO ROW REACHES IT. The co-existence is real in the tree this
+      // function returns — `uninit_spill` declares `uninit_sp0/sp4/sp8` beside the slotted `v4@0
+      // v5@4 v6@8`, `dma_fill_uninit` declares `uninit_sp4/sp8/sp12` beside `v4@4 v6@8 v8@12` —
+      // but that tree is never emitted: `structure()` has exactly one caller, `structureChecked`
+      // (pipeline.ts), and `l3/slotorder.ts` runs inside `emit`, downstream of it on every emit
+      // path. On the tree `structureChecked` returns neither row has an `uninit` local left —
+      // `eliminateDeadStores` (l3/dce.ts, whose last line keeps only locals the body still
+      // references) removes all eight on `uninit_spill` and all seven on `dma_fill_uninit`,
+      // leaving the slot-carrying locals untouched. Instrumented one spine stage at a time, not
+      // inferred: raw 8 → mergeCommonTails 8 → eliminateDeadStores 0.
+      //
+      // The refusal stays HERE rather than at the ordering because this is where the stamp is
+      // decided, and an `undef` local that survived DCE — address-taken, `volatile`, or genuinely
+      // read — would otherwise carry it into `emit`. FLIP CONDITION, and it is not "the first
+      // uninit local", since four rows already have them in `structure()`'s tree and none in
+      // `structureChecked`'s: it is the first row where a slot-keyed `undef` local SURVIVES
+      // dead-store elimination beside a slotted local at the same offset, and compile shows the
+      // two to be two source declarations rather than one. `spill-slot-order.test.ts` pins both
+      // halves, so a change to either fails there.
+      ...fn.blocks
+        .flatMap((b) => b.ops)
+        .filter((op) => op.opcode === 'undef')
+        .map((op) => ({
+          name: undefName.get(op)!,
+          type: varType.get(undefName.get(op)!) ?? op.results[0].type,
+          uninit: true as const,
+        })),
     ],
     ...(shapedGlobalTypes.size
       ? {
@@ -2440,6 +4543,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}): SFn {
     retType: returnsVoid ? T.void() : returnType(fn),
     body,
     ...(structs.length ? { structs } : {}),
+    // absent stays absent: the backend asks "is a direction known?", and there is no third state
+    // at this boundary — `structureOptionsFor` dropped the target's `'unknown'` already.
+    ...(spillSlotOrder !== undefined ? { slotOrder: spillSlotOrder } : {}),
   };
 }
 
@@ -2525,6 +4631,26 @@ function recognizeForLoops(stmts: Stmt[]): Stmt[] {
 // still-pending assignment reads; break a cycle by spilling one destination to a temp.
 // `tmp` is the per-FUNCTION temp counter (threaded from structure()) so two independent
 // parallel copies never reuse a temp name against conflicting types.
+/** Does this edge's copy set contain a CYCLE — no copy emittable without overwriting a destination
+ *  another still reads, so `sequentialize` has to spill one into a temp? `sequentialize`'s own
+ *  emittability loop, run without emitting, so the two can never disagree about which sets are
+ *  which.
+ *
+ *  It is the LICENCE BOUNDARY the edge-copy sort draws: on a cyclic set an instruction names the
+ *  compiler's temp and the write-order record reproduces it, while on an acyclic one the record is
+ *  only an assumption about layout order. `preferDefPosCopyOrder` asks for the proxy on the second
+ *  kind only. */
+function copySetIsCyclic(copies: { name: string; value: Expr }[]): boolean {
+  const pending = copies.map((c) => ({ name: c.name, reads: exprVars(c.value) }));
+  for (;;) {
+    const i = pending.findIndex((a) => !pending.some((b) => b !== a && b.reads.has(a.name)));
+    if (i < 0) {
+      return pending.length > 0;
+    }
+    pending.splice(i, 1);
+  }
+}
+
 function sequentialize(
   copies: { name: string; value: Expr }[],
   varType: Map<string, IrType>,
@@ -2608,6 +4734,32 @@ function successorTo(pred: Block, target: Block) {
   const term = pred.ops[pred.ops.length - 1];
   return term.successors.find((s) => s.block === target);
 }
+/** EVERY in-edge record into `b` — which is what {@link successorTo} cannot give: it returns only
+ *  the FIRST record to a block, so a terminator with two edges to the same block hides the second
+ *  edge's args. Callers that ask "what does every path pass for param i" need all of them.
+ *
+ *  ORDER IS LOAD-BEARING and is `preds` insertion order, then terminator-successor order: the
+ *  naming walk takes the FIRST admissible carrier, so a different order is a different spelling.
+ *
+ *  AND IT IS GUARDED, not merely warned about — measured, not reasoned: rewriting this walk to call
+ *  `successorTo` turns 12 tests across 5 files of `packages/core/test` red. The path it would lose
+ *  is reached constantly, 326,305 times over that suite on a `cond_br` whose two arms land on one
+ *  block and 6 more on a `switch_br`.
+ *
+ *  The terminator is read UNGUARDED (`ops[ops.length - 1]`) on purpose: every block of a verified
+ *  Fn has one, and a guard would turn a malformed Fn's throw into a silent missing edge.
+ *
+ *  `hasParamRootedMerge` does not go through this, deliberately: it is a pre-structuring query over
+ *  a raw Fn and walks `fn.blocks` rather than a predecessor map it would first have to build. */
+function* inEdgeRecords(preds: Map<Block, Block[]>, b: Block): Generator<{ pred: Block; succ: Successor }> {
+  for (const pred of new Set(preds.get(b) ?? [])) {
+    for (const succ of pred.ops[pred.ops.length - 1].successors) {
+      if (succ.block === b) {
+        yield { pred, succ };
+      }
+    }
+  }
+}
 
 // Immediate post-dominators. EXIT is represented as `null`; ret-blocks post-lead to it.
 function postDominators(fn: Fn): Map<Block, Block | null> {