@asmlift/core 0.5.0 → 0.7.0

package/src/structure/switch-recover.ts

@@ -4,7 +4,8 @@
 // factory takes its dependencies EXPLICITLY (`SwitchRecoverDeps`); `expr`/`structureRegion` are
 // late-bound callbacks into the emission phase, so case bodies reuse the ordinary structuring
 // machinery (loops/ifs inside cases, the onStack guard).
-import { Block, Fn, Op, Value, successorsOf } from '../ir/core';
+import { Block, Fn, Op, Value, forwardingTarget, isBodyless, successorsOf } from '../ir/core';
+import { ORDER_SENSITIVE_OPS } from '../ir/opcodes';
 import { Expr, Stmt, SwitchCase } from '../l3/ast';
 
 export interface SwitchRecoverDeps {
@@ -18,12 +19,41 @@ export interface SwitchRecoverDeps {
   /** is this opcode an integer comparison? */
   isCmpOpcode: (opcode: string) => boolean;
   switchAllowsNeqCase: boolean;
-  /** does emitting this block's ops carry a statement beyond the ops themselves? A def-site
-   *  ANCHORED merge copy (structure.ts anchorConstCopies) is attached to a const op and emitted
-   *  with the block's side effects — a test block carrying one is not pure however pure its
-   *  opcodes look, because collapsing it into a `switch` discards the write while the edge copy
-   *  it replaced stays suppressed. */
-  emitsAnchoredWrite: (blk: Block) => boolean;
+  /** read a relational test whose BRANCH admits exactly one scrutinee value as that case */
+  switchAllowsBoundCase: boolean;
+  /** emit the case arms in the ASSEMBLY's block-layout order rather than by ascending case value */
+  switchArmsFollowLayout: boolean;
+  /** DECLINE a recovered tree whose own layout INTERLEAVES a test with a case body. A source
+   *  `switch` front-loads its whole dispatch ahead of every arm body; an if/else-if LADDER emits
+   *  each test directly above its own body. See StructureOptions for the compiled evidence, for
+   *  the frontend premise this shares with `switchArmsFollowLayout`, and for what the decline
+   *  costs when it is wrong. */
+  switchRequiresFrontLoadedTests: boolean;
+  /** may the emitted SOURCE say "this arm runs on into the next one"? False for a language whose
+   *  `case` cannot fall through (Pascal), and then Regime A declines a falling arm to if-recovery
+   *  — the behaviourally identical recovery that backend CAN print. See StructureOptions. */
+  spellSwitchFallthrough: boolean;
+  /** does emitting this block's ops carry a statement beyond the ops themselves? Collapsing a
+   *  test block into a `switch` re-renders its ops at their uses and emits no side effects for it,
+   *  so any op that renders as a STATEMENT of its own loses that statement. Two produce one: a
+   *  def-site ANCHORED merge copy (structure.ts anchorConstCopies), whose edge copy stays
+   *  suppressed, and a MATERIALIZED def, whose `v = …` assignment renders only here while its uses
+   *  read the bare name — leaving a local declared and never assigned. */
+  emitsOwnStatement: (blk: Block) => boolean;
+  /** Where a value is WRITTEN: its block for a parameter, its def op's block otherwise — the half
+   *  of "where is this defined" `defs` does not answer. Taken from `structure.ts`, which builds
+   *  both halves for def-site anchoring, rather than indexing the parameters a second time. */
+  blockOf: (v: Value) => Block | undefined;
+  /** THE DISPATCH HOIST: the copies of every edge the tree walk collapsed, merged and re-emitted
+   *  ONCE ahead of the `switch`. `structure.ts hoistedDispatchAssigns` owns the emission
+   *  (suppression, identity elision, `undef`, the write-order sort, `sequentialize`), so this
+   *  regime takes it as a dependency rather than implementing it a second time, exactly as Regime
+   *  B takes `argAssignsFor`. Null ⇒ no single hoisted statement spells them; the caller declines
+   *  to if-recovery. `liveAt` are the blocks whose live-in names the writes must not clobber. */
+  hoistDispatchCopies: (
+    edges: readonly { pred: Block; succ: { block: Block; args: Value[] } }[],
+    liveAt: readonly Block[],
+  ) => Stmt[] | null;
   expr: (v: Value) => Expr;
   structureRegion: (b: Block, stop: Block | null) => Stmt[];
 }
@@ -34,17 +64,181 @@ export interface SwitchRecoverDeps {
  *   - `break`        every path out of the arm reaches the switch's merge (or returns / loops
  *                    inside the arm). The ordinary closed arm.
  *   - `fallthrough`  every path out leaves into exactly ONE sibling arm's entry: C's fall-through.
- *                    Only spellable when that sibling is the arm emitted NEXT (the caller checks
- *                    emission adjacency — see the l3/ast.ts non-neutrality note).
+ *                    Only spellable when that sibling is the arm emitted NEXT, which `chainArms`
+ *                    below arranges and both regimes then re-read off the emission array (see the
+ *                    l3/ast.ts non-neutrality note).
  *   - `unstructurable`  anything else: two different siblings, or a mix of "into a sibling" and
- *                    "out to the merge". C needs a `goto` for those, so callers decline LOUD. */
+ *                    "out to the merge". C needs a `goto` for those. Regime A declines to
+ *                    if-recovery on this verdict; Regime B, having no fallback, fails LOUD. */
 export type ArmExit = { kind: 'break' } | { kind: 'fallthrough'; to: Block } | { kind: 'unstructurable'; why: string };
 
 export interface SwitchRecovery {
   recognizeSwitch: (b: Block, stop: Block | null) => Stmt[] | null;
-  /** shared with the Regime-B (`switch_br`) path in structure.ts, which recovers the fall-through
-   *  this returns; Regime A only accepts `break` arms and otherwise declines to if-recovery. */
+  /** shared with the Regime-B (`switch_br`) path in structure.ts. Both regimes recover the
+   *  fall-through this returns; on an `unstructurable` verdict Regime A declines to if-recovery and
+   *  Regime B, which has no fallback, fails loud. */
   analyzeArmExit: (entry: Block, b: Block, merge: Block | null, siblings: Set<Block>) => ArmExit;
+  /** a block's position in the ASSEMBLY — the arm-order evidence, shared with Regime B so the two
+   *  regimes read it from one definition (and one statement of what it rests on). */
+  layoutIndex: (blk: Block) => number;
+  /** where the `default:` label goes among the EMITTED arms, or `undefined` for C's last position —
+   *  shared with Regime B so both regimes state those refusals once. */
+  defaultLayoutPos: (
+    defaultBlk: Block,
+    arms: readonly { entry: Block; fallsThrough: boolean }[],
+    opts: { placedByDispatch: boolean; orderIntact: boolean },
+  ) => number | undefined;
+  /** ONE linear emission order for a set of arms, re-threaded so every falling arm sits directly
+   *  above the one it falls into — or null when no linear order spells them. Shared with Regime B,
+   *  so the chain, the adjacency it guarantees and the three refusals below it have one definition
+   *  (Regime A maps null to if-recovery, Regime B to a loud StructureError). */
+  chainArms: (order: Block[], dflt: Block | null, exitOf: Map<Block, ArmExit>) => Block[] | null;
+}
+
+/** A block with no body of its own: no params, and one op that only LEAVES. `ret` qualifies as
+ *  well as `br` because raise/retsink.ts rewrites the one into the other — a cross-jumped arm
+ *  body has two dispatch preds, which is exactly the shape that makes retsink sink the merge's
+ *  return into every leaf, the fall-out jumps included. */
+function isBareExit(blk: Block): boolean {
+  return isBodyless(blk) && (blk.ops[0].opcode === 'br' || blk.ops[0].opcode === 'ret');
+}
+
+/** Are these two blocks the SAME bare exit — the same jump with the same args, or the same return
+ *  of the same values? Neither has a body, so two of them are indistinguishable at emission. */
+function sameBareExit(a: Block, c: Block): boolean {
+  if (a === c) {
+    return true;
+  }
+  if (!isBareExit(a) || !isBareExit(c) || a.ops[0].opcode !== c.ops[0].opcode) {
+    return false;
+  }
+  const same = (x: readonly Value[], y: readonly Value[]) => x.length === y.length && x.every((v, i) => v === y[i]);
+  if (a.ops[0].opcode === 'ret') {
+    return same(a.ops[0].operands, c.ops[0].operands);
+  }
+  const [x, y] = [a, c].map((blk) => blk.ops[0].successors[0]);
+  return x.block === y.block && same(x.args, y.args);
+}
+
+export interface TestInfo {
+  x: Value;
+  k: number;
+  cls: 'eq' | 'ne' | 'rel';
+  opcode: string;
+  xOnLeft: boolean;
+}
+
+// Evaluate a test predicate for a CONCRETE scrutinee value — used to SIMULATE the decision tree and
+// verify recovered case values (below). Returns true iff the `taken` (successors[0]) edge is followed.
+// Signed/unsigned per the icmp opcode (PRE3, done concretely rather than via interval lattices).
+function evalCmp(opcode: string, xOnLeft: boolean, xv: number, k: number): boolean {
+  const uns = opcode.startsWith('icmp_u');
+  const [xn, kn] = uns ? [xv >>> 0, k >>> 0] : [xv | 0, k | 0];
+  const [l, r] = xOnLeft ? [xn, kn] : [kn, xn]; // put the scrutinee where it textually appears
+  switch (opcode) {
+    case 'icmp_eq':
+      return l === r;
+    case 'icmp_ne':
+      return l !== r;
+    case 'icmp_slt':
+    case 'icmp_ult':
+      return l < r;
+    case 'icmp_sle':
+    case 'icmp_ule':
+      return l <= r;
+    case 'icmp_sgt':
+    case 'icmp_ugt':
+      return l > r;
+    case 'icmp_sge':
+    case 'icmp_uge':
+      return l >= r;
+    default:
+      return false;
+  }
+}
+
+// Which single scrutinee value does this relational test's BRANCH admit, if exactly one? A
+// relational side is a HALF-LINE in the compare's own ordering, so it can hold one value only at
+// a domain endpoint — which is why testing the two endpoints and their neighbours decides it,
+// with no interval lattice. `x < 1` over an unsigned scrutinee admits `{0}` and is agbcc's
+// spelling of `case 0` in a balanced search: `emit_case_nodes` tests the subtree BOUND, not the
+// value, whenever the remaining range has collapsed to one. Read as navigation instead, that
+// arm's body becomes a second default candidate and the whole tree declines.
+//
+// THE BRANCH, never the fall-through. Every jump in `emit_case_nodes` that lands on a case body
+// is its test's BRANCH — for a single-valued node, LT to `node->left->code_label` and GT to
+// `node->right->code_label`, each guarded by `node_is_bounded` on that side — while the
+// fall-through always continues into more dispatch, so a fall-side reading has no producer in
+// this dispatch — and none turns up in 3176 generated agbcc dispatches.
+//
+// TWO PREMISES ABOUT THE DOMAIN. It is the 32-bit REGISTER's, not the scrutinee's recovered
+// type, so a narrower type has a nearer endpoint this misses — which costs a case and never
+// invents one. And it is the WHOLE of that domain, so an ancestor that already excluded the
+// value makes the reading wrong; PRE3 is what catches that, simulating the original tree for
+// every recovered case value and declining unless it lands on the recorded body, exactly as it
+// does for the `eq` cases. Null when the branch admits none, several, or the whole domain.
+function singletonTaken(ti: TestInfo): number | null {
+  const [min, max] = ti.opcode.startsWith('icmp_u') ? [0, -1] : [-0x80000000, 0x7fffffff];
+  for (const [v, next] of [
+    [min, min + 1],
+    [max, max - 1],
+  ]) {
+    if (evalCmp(ti.opcode, ti.xOnLeft, v, ti.k) && !evalCmp(ti.opcode, ti.xOnLeft, next, ti.k)) {
+      return v;
+    }
+  }
+  return null;
+}
+
+/** Re-thread `order` so every FALLING arm sits directly above the arm it falls into. Each
+ *  fall-through chain is emitted contiguously and takes the position of its HEAD in `order`,
+ *  which is the caller's own arm-order policy — so with no fall-through every chain is a
+ *  singleton and `order` comes back unchanged. `dflt` is the `default:` arm's block when it has
+ *  one, and it is pinned LAST because that is where C prints the label.
+ *
+ *  THREE REFUSALS (null ⇒ the caller declines), each a shape no single linear order spells:
+ *    - two arms falling into the SAME arm — C drops into an arm from above along one edge only;
+ *    - the `default:` arm falling into a case, since nothing is emitted below it;
+ *    - a fall-through CYCLE, whose members are all fallen-into and so are never a chain head. */
+export function chainArms(order: Block[], dflt: Block | null, exitOf: Map<Block, ArmExit>): Block[] | null {
+  const next = new Map<Block, Block>();
+  const fallenInto = new Set<Block>();
+  for (const e of [...order, ...(dflt ? [dflt] : [])]) {
+    const x = exitOf.get(e);
+    if (x?.kind !== 'fallthrough') {
+      continue;
+    }
+    if (e === dflt || fallenInto.has(x.to)) {
+      return null;
+    }
+    fallenInto.add(x.to);
+    next.set(e, x.to);
+  }
+  const chains: Block[][] = [];
+  const seen = new Set<Block>();
+  let intoDefault = -1;
+  for (const head of order) {
+    if (fallenInto.has(head)) {
+      continue;
+    }
+    const chain: Block[] = [];
+    for (let cur: Block | undefined = head; cur !== undefined && cur !== dflt && !seen.has(cur); cur = next.get(cur)) {
+      seen.add(cur);
+      chain.push(cur);
+    }
+    if (dflt !== null && next.get(chain[chain.length - 1]) === dflt) {
+      intoDefault = chains.length;
+    }
+    chains.push(chain);
+  }
+  // A cycle's every member is fallen-into, so none of them is a head and none is walked.
+  if (seen.size !== order.length) {
+    return null;
+  }
+  if (intoDefault >= 0) {
+    chains.push(...chains.splice(intoDefault, 1));
+  }
+  return chains.flat();
 }
 
 export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
@@ -57,14 +251,110 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     isNamed,
     isCmpOpcode,
     switchAllowsNeqCase,
-    emitsAnchoredWrite,
+    switchAllowsBoundCase,
+    switchArmsFollowLayout,
+    switchRequiresFrontLoadedTests,
+    spellSwitchFallthrough,
+    emitsOwnStatement,
+    blockOf,
+    hoistDispatchCopies,
     expr,
     structureRegion,
   } = deps;
 
+  // A block's index in `fn.blocks` as its position in the ASSEMBLY — the warrant for every reading
+  // of layout below, and true PER FRONTEND rather than of the IR:
+  //   - thumb.ts and mips.ts build the list by scanning the instruction stream in address order;
+  //   - ppc.ts does not. It APPENDS a synthetic return block (`synthReturn`) at the end of the list
+  //     for every conditional-return branch, wherever in the stream that branch sits, so its list
+  //     is not address order at all;
+  //   - raising only ever REMOVES blocks from the list (raise/{divpow2,latch,retsink,shortcircuit}
+  //     .ts all `filter`), never inserts or reorders, so the frontend's order is what survives.
+  // TWO READERS, both target-gated, and they need DIFFERENT strengths of the compiler half:
+  //   - `switchArmsFollowLayout` (arm ORDER, the sort below) needs the full claim — no block moved
+  //     at all — because it PLACES the arms from the layout;
+  //   - `switchRequiresFrontLoadedTests` (PRE5, whether to recover at all) needs only that no case
+  //     BODY was moved above a dispatch test, which a compiler with a scheduler can still satisfy;
+  //     `MIPS_GCC` declares `switchRequiresFrontLoadedTests` and NOT `switchArmsFollowLayout` for
+  //     exactly that reason — it has a scheduler and fills delay slots (target.ts).
+  // Both are therefore claims about a target's FRONTEND as much as about its compiler, and a target
+  // opts in on both halves — which is why PPC_MWCC, whose frontend fails the frontend half outright,
+  // declares neither. Anything added below that reads `layoutIndex` inherits the frontend half and
+  // owes a statement of which strength of the compiler half it needs.
+  const blockIndex = new Map(fn.blocks.map((blk, i) => [blk, i] as const));
+  const layoutIndex = (blk: Block): number => blockIndex.get(blk) ?? -1;
+
+  // Where the `default:` label goes among the arms, as a COUNT of the arms laid out before it — the
+  // same evidence the case bodies carry, read the same way. Compiled at every position of a 3- to
+  // 8-case switch, the default's block lands where the source wrote it. `undefined` ⇒ C's
+  // conventional last position, which is what every other producer of this node means.
+  //
+  // SEVEN WITHHOLDINGS, W1..W7, numbered in the order the code asks them so the prose and the code
+  // index ONE list, and stated here so both regimes state them once. W1 is the target's own opt-in;
+  // W2..W4 are about a block the DISPATCH placed rather than the arm; W5..W7 are about
+  // fall-through — W5 about the LIST the count would index, W6 and W7 about the POSITION it names.
+  //
+  //   W1 the target does not read arm order off the layout at all (`switchArmsFollowLayout`).
+  //   W2 a block with no body of its own is one the dispatch minted (`b .Ldefault`), and which of
+  //      several such the collapse below keeps is a walk-order accident.
+  //   W3 the walk already read that block as a CASE arm — a dense table sends every unwritten
+  //      value's slot to the default's block, so grouping the slots gives that block an arm of its
+  //      own and its index is where THAT arm sits.
+  //   W4 `emit_case_nodes` ends every exhausted subtree with `emit_jump_if_reachable
+  //      (default_label)` and `expand_end_case` reorders the whole dispatch, those jumps included,
+  //      ahead of the arm bodies — so a jump survives as a plain FALL-THROUGH exactly when the
+  //      default's body is the arm the source wrote FIRST. That reading holds only while a second
+  //      subtree still names the label: a two-case chain names it once, and agbcc then lays that
+  //      block right after the tests whatever the source wrote, both spellings compiling to
+  //      identical instructions.
+  //   W5 the chain RE-THREADED the arm order (`orderIntact` false), so the emitted list is no
+  //      longer the one the layout count describes and no position in it means what the count
+  //      says. This one is whole-switch because the re-threading is. A per-position reading —
+  //      bracket the label between the two arms that straddle it in LAYOUT, then map that into the
+  //      emitted list — is possible and unbuilt, and hard to need: a compiler that lays bodies out
+  //      in source order already writes a falling arm directly above its target, so the order it
+  //      declares is a chain order too.
+  //   W6 the LAST emitted arm falls through, which can only be into the default (the adjacency
+  //      check leaves no other target) — the label must then be last, which IS `undefined`.
+  //   W7 the position lands directly after a falling arm, where printing the label would divert
+  //      that arm into the default. cfamily.ts fails loud on exactly that, and this is the producer
+  //      side of the same rule.
+  //
+  // A switch with a chain elsewhere keeps its evidence: the reason to withhold is the position,
+  // never "some arm somewhere falls".
+  const defaultLayoutPos = (
+    defaultBlk: Block,
+    arms: readonly { entry: Block; fallsThrough: boolean }[],
+    opts: { placedByDispatch: boolean; orderIntact: boolean },
+  ): number | undefined => {
+    if (!switchArmsFollowLayout) {
+      return undefined; // W1 target does not read layout
+    }
+    if (isBareExit(defaultBlk)) {
+      return undefined; // W2 dispatch-minted bodyless block
+    }
+    if (arms.some((a) => a.entry === defaultBlk)) {
+      return undefined; // W3 already an emitted arm
+    }
+    if (opts.placedByDispatch) {
+      return undefined; // W4 dispatch ran out into it
+    }
+    if (!opts.orderIntact) {
+      return undefined; // W5 chain re-threaded the arms
+    }
+    if (arms[arms.length - 1]?.fallsThrough) {
+      return undefined; // W6 last arm falls through
+    }
+    const at = arms.filter((a) => layoutIndex(a.entry) < layoutIndex(defaultBlk)).length;
+    // W7 the label would land directly after a falling arm
+    return at > 0 && arms[at - 1].fallsThrough ? undefined : at;
+  };
+
   // --- Regime A: comparison-tree switch recovery ----------------------------------------------------
-  // Every ambiguity declines. Four preconditions are enforced below, annotated PRE1..PRE4:
-  // scrutinee identity/dominance, no fall-through, concrete interval consistency, test purity.
+  // Every ambiguity declines. Five preconditions are enforced below, annotated PRE1..PRE5:
+  // scrutinee identity/dominance, ARM EXITS (per site: `break`, `fallthrough` — which `chainArms`
+  // then places — or a decline), concrete interval consistency, test purity, and — where the target
+  // has declared that its layout answers it — which SPELLING the source wrote.
 
   // Fold a value that is a compile-time constant (a `const`, or a synthesized immediate like agbcc's
   // `250 << 2` for a large sparse case) to a number — else null.
@@ -137,20 +427,23 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     }
   };
 
-  // A "pure test block": its only computation is constants + one integer comparison feeding its
-  // cond_br terminator (no store/call/load/opaque — its body is DISCARDED when the tree collapses to a
-  // switch, so a side effect there would be lost). PRE4 (purity). The root block is exempt from the
-  // "only const/icmp" rule because its non-terminator ops are already emitted as sideEffects(b) before
-  // the switch; a non-root test block must be strictly pure.
-  const SIDE_EFFECTFUL = new Set(['store', 'astore', 'call', 'load', 'aload', 'opaque']);
-  interface TestInfo {
-    x: Value;
-    k: number;
-    cls: 'eq' | 'ne' | 'rel';
-    opcode: string;
-    xOnLeft: boolean;
-  }
-  const testInfo = (blk: Block, isRoot: boolean): TestInfo | null => {
+  // TWO QUESTIONS about a block, asked separately because the answers diverge and the walk needs
+  // both: WHAT does it test (`testInfo`), and may this recovery DISCARD it (`collapsible`)?
+  //
+  // PRE4 (purity) is the second. A collapsed test block's ops re-render at whichever use inlines
+  // them, at a point the switch decides — so the question is motion, not deletion, and
+  // `ORDER_SENSITIVE_OPS` is the set that asks it. NOT the trapping divides: a use is dominated by
+  // its def, so the re-rendered op runs on a subset of the paths it already ran on — nothing is
+  // speculated. `emitsOwnStatement` covers what motion cannot save: a statement belonging to the
+  // block rather than to a use. The root is exempt from all of it — its ops are already emitted as
+  // sideEffects(b) before the switch.
+  //
+  // A block that tests the scrutinee and is NOT collapsible is still dispatch, so the walk must
+  // read it as dispatch and decline, never re-read it as a case body — that would spell an arm
+  // whose guard the dispatch has already decided.
+  const collapsible = (blk: Block): boolean =>
+    !blk.ops.some((op) => ORDER_SENSITIVE_OPS.has(op.opcode)) && !emitsOwnStatement(blk);
+  const testInfo = (blk: Block): TestInfo | null => {
     const term = blk.ops[blk.ops.length - 1];
     if (term.opcode !== 'cond_br') {
       return null;
@@ -159,9 +452,6 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     if (!cmp || !isCmpOpcode(cmp.opcode)) {
       return null;
     }
-    if (!isRoot && (blk.ops.some((op) => SIDE_EFFECTFUL.has(op.opcode)) || emitsAnchoredWrite(blk))) {
-      return null;
-    } // PRE4 — anchored writes included: discarded with the block, while their edge copies stay suppressed
     // Which operand is the scrutinee, which is the constant?
     const [lo, ro] = cmp.operands;
     const lc = evalConst(lo),
@@ -182,45 +472,16 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     return { x, k, cls, opcode: cmp.opcode, xOnLeft };
   };
 
-  // Evaluate a test predicate for a CONCRETE scrutinee value — used to SIMULATE the decision tree and
-  // verify recovered case values (below). Returns true iff the `taken` (successors[0]) edge is followed.
-  // Signed/unsigned per the icmp opcode (PRE3, done concretely rather than via interval lattices).
-  const evalCmp = (opcode: string, xOnLeft: boolean, xv: number, k: number): boolean => {
-    const uns = opcode.startsWith('icmp_u');
-    const [xn, kn] = uns ? [xv >>> 0, k >>> 0] : [xv | 0, k | 0];
-    const [l, r] = xOnLeft ? [xn, kn] : [kn, xn]; // put the scrutinee where it textually appears
-    switch (opcode) {
-      case 'icmp_eq':
-        return l === r;
-      case 'icmp_ne':
-        return l !== r;
-      case 'icmp_slt':
-      case 'icmp_ult':
-        return l < r;
-      case 'icmp_sle':
-      case 'icmp_ule':
-        return l <= r;
-      case 'icmp_sgt':
-      case 'icmp_ugt':
-        return l > r;
-      case 'icmp_sge':
-      case 'icmp_uge':
-        return l >= r;
-      default:
-        return false;
-    }
-  };
-
   // Where does one arm's region LEAVE? Walk it from `entry`, never stepping THROUGH the merge or a
   // sibling arm's entry, and classify what it steps INTO. `siblings` is every OTHER arm entry the
   // caller can emit a `case`/`default` label for — the merge is deliberately not among them, so a
   // switch whose default block IS the merge (agbcc's usual "the default just leaves") reads as an
   // ordinary `break`, not as falling into the default.
   //
-  // Region membership is `dom(blk) ∋ b` as before: a block NOT dominated by the switch is outside
-  // this switch's region and is not walked. It IS recorded as an escape, because an arm that can
-  // leave sideways does not fall into the next case — but only the fall-through verdict consults
-  // that, so no arm that used to be accepted as closed becomes a decline.
+  // Region membership is `dom(blk) ∋ b`: a block NOT dominated by the switch is outside this
+  // switch's region and is not walked. It IS recorded as an escape, because an arm that can leave
+  // sideways does not fall into the next case — and only the FALL-THROUGH verdict consults that
+  // record, so an arm that reaches no sibling still closes with a plain `break`.
   //
   // A CONSEQUENCE, not a hole: a sibling reachable only THROUGH such a block is never seen, so the
   // arm reads as closed and `structureRegion` walks into the sibling's blocks and emits them again
@@ -261,7 +522,7 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     }
     // Name what is actually missing. These three are different facts, and only the first is a shape
     // C has no spelling for — the other two are asmlift's own limits, so say so rather than blame C.
-    const names = () => [...into].map((x) => `#${fn.blocks.indexOf(x)}`).join(', ');
+    const names = () => [...into].map((x) => `#${layoutIndex(x)}`).join(', ');
     if (into.size > 1) {
       return {
         kind: 'unstructurable',
@@ -283,15 +544,8 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     };
   };
 
-  /** Every arm closed (`break`)? The precondition Regime A needs — it has a behaviourally identical
-   *  fallback (if-recovery), so it declines on anything else instead of recovering fall-through. */
-  const allArmsClosed = (targets: Set<Block>, b: Block, merge: Block | null): boolean => {
-    const siblings = new Set([...targets].filter((t) => t !== merge));
-    return [...siblings].every((t) => analyzeArmExit(t, b, merge, siblings).kind === 'break');
-  };
-
   const recognizeSwitch = (b: Block, stop: Block | null): Stmt[] | null => {
-    const root = testInfo(b, true);
+    const root = testInfo(b);
     if (!root) {
       return null;
     }
@@ -314,27 +568,10 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     // Walk the test tree. `cases`: value → case-entry block. `defaultCands`: leaves reached without an
     // equality pin. A test-block DAG cycle, or a `!=` case when the compiler disallows it, declines.
     const cases = new Map<number, Block>();
+    // Reached through `forwardingTarget`: agbcc's binary-search layout branches to the shared default
+    // through empty `b .Ldef` blocks, and without resolving them each becomes a DISTINCT default
+    // candidate and the whole tree declines.
     const defaultCands = new Set<Block>();
-    // Skip pure forwarding blocks — a block whose only op is an unconditional `br` (no side effects, no
-    // params). agbcc's binary-search layout branches to the shared default through such empty `b .Ldef`
-    // blocks; without skipping them each becomes a DISTINCT default candidate and the whole tree declines.
-    const skipForward = (blk: Block): Block => {
-      let cur = blk;
-      const guard = new Set<Block>();
-      // Only skip a truly empty forwarding block: a lone `br` with no params AND no successor ARGS —
-      // an edge that carries a phi arg is NOT transparent (skipping it would drop that assignment).
-      while (
-        cur.ops.length === 1 &&
-        cur.ops[0].opcode === 'br' &&
-        cur.params.length === 0 &&
-        cur.ops[0].successors[0].args.length === 0 &&
-        !guard.has(cur)
-      ) {
-        guard.add(cur);
-        cur = cur.ops[0].successors[0].block;
-      }
-      return cur;
-    };
     // Concretely SIMULATE the decision tree for a scrutinee value `xv`, returning the leaf block it
     // reaches (or null on an unexpected cycle). This is PRE3 done concretely: it lets us verify each
     // recovered case value actually routes to its recorded body in the ORIGINAL tree.
@@ -342,7 +579,7 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
       let cur = b;
       const guard = new Set<Block>();
       for (;;) {
-        const ti = testInfo(cur, cur === b);
+        const ti = testInfo(cur);
         if (!ti || ti.x !== scrut) {
           return cur;
         } // reached a leaf (case body / default)
@@ -352,7 +589,7 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
         guard.add(cur);
         const term = cur.ops[cur.ops.length - 1];
         const taken = evalCmp(ti.opcode, ti.xOnLeft, xv, ti.k);
-        cur = skipForward(term.successors[taken ? 0 : 1].block);
+        cur = forwardingTarget(term.successors[taken ? 0 : 1].block);
       }
     };
     const seen = new Set<Block>();
@@ -363,59 +600,76 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
         return null;
       } // a test-block DAG cycle → decline
       seen.add(blk);
-      const ti = testInfo(blk, blk === b);
+      const ti = testInfo(blk);
       if (!ti || ti.x !== scrut) {
         return null;
       } // PRE1: every test is on the SAME Value
+      if (blk !== b && !collapsible(blk)) {
+        return null;
+      } // PRE4
       const term = blk.ops[blk.ops.length - 1];
-      const taken = skipForward(term.successors[0].block),
-        fall = skipForward(term.successors[1].block);
-      const asLeafOrTest = (child: Block, role: 'case' | 'nav', k?: number) => {
-        const isTest = !!testInfo(child, false) && testInfo(child, false)!.x === scrut;
-        if (role === 'case') {
-          if (isTest) {
-            return false;
-          } // a case target that's a test → decline
-          if (child.params.length) {
-            return false;
-          } // case entry with a phi → decline
-          if (cases.has(k!)) {
-            return false;
-          } // duplicate case value → decline
-          cases.set(k!, child);
-          return true;
-        }
-        // navigation edge
-        if (isTest) {
+      const taken = forwardingTarget(term.successors[0].block),
+        fall = forwardingTarget(term.successors[1].block);
+      const isTestOn = (child: Block) => {
+        const t = testInfo(child);
+        return !!t && t.x === scrut;
+      };
+      /** Read `child` as the BODY of case `k`. A case entry with a PHI is admitted: the dispatch
+       *  edge binds those parameters, and `hoistDispatchCopies` re-emits that binding once above
+       *  the `switch` (or declines the whole recovery). A fall-through chain's accumulator crosses
+       *  every arm as exactly such a parameter, so refusing it here refuses the whole family. */
+      const asCase = (child: Block, k: number): boolean => {
+        if (isTestOn(child)) {
+          return false;
+        } // a case target that's a test → decline
+        if (cases.has(k)) {
+          return false;
+        } // duplicate case value → decline
+        cases.set(k, child);
+        return true;
+      };
+      /** Read `child` as a NAVIGATION edge: more dispatch to walk, or a non-test leaf, which is a
+       *  default candidate. Never declines — the leaf's own reading is settled below. */
+      const asNav = (child: Block): boolean => {
+        if (isTestOn(child)) {
           work.push(child);
           return true;
         }
-        defaultCands.add(child); // a non-test leaf reached by nav = default
+        defaultCands.add(child);
         return true;
       };
       if (ti.cls === 'eq') {
-        if (!asLeafOrTest(taken, 'case', ti.k)) {
+        if (!asCase(taken, ti.k)) {
           return null;
         } // x==k → taken is case k
-        if (!asLeafOrTest(fall, 'nav')) {
+        if (!asNav(fall)) {
           return null;
         }
       } else if (ti.cls === 'ne') {
         if (!switchAllowsNeqCase) {
           return null;
         } // per-compiler gate
-        if (!asLeafOrTest(fall, 'case', ti.k)) {
+        if (!asCase(fall, ti.k)) {
           return null;
         } // x!=k → the EQUAL side (fall) is case k
-        if (!asLeafOrTest(taken, 'nav')) {
+        if (!asNav(taken)) {
           return null;
         }
       } else {
-        // relational → pure navigation
-        if (!asLeafOrTest(taken, 'nav')) {
+        // relational → navigation, except where the BRANCH has collapsed to a single value and
+        // lands on a BODY, on a compiler that declared the spelling. Two more refusals:
+        //   - a bound test at the ROOT. `emit_case_nodes` emits a single-valued node's own
+        //     `do_jump_if_equal` before either descent test, so a bound test always sits under
+        //     another test of the same tree; one that OPENS the region did not come from this
+        //     dispatch, and reading it as a case turns a comparison chain into a `switch`;
+        //   - a singleton branch onto another TEST of the scrutinee, which is the search
+        //     descending to pin the value. It is dispatch, so the walk reads it as dispatch —
+        //     recovering it, or declining at PRE4 if it is not collapsible.
+        const k = switchAllowsBoundCase && blk !== b && !isTestOn(taken) ? singletonTaken(ti) : null;
+        if (!(k === null ? asNav(taken) : asCase(taken, k))) {
           return null;
         }
-        if (!asLeafOrTest(fall, 'nav')) {
+        if (!asNav(fall)) {
           return null;
         }
       }
@@ -426,14 +680,64 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     } // not worth a switch (m2c: ≥2 cases)
     // The default is the single non-test leaf that is NOT a case body. 0 → no default; ≥2 distinct → decline.
     const caseBlocks = new Set(cases.values());
-    const defaults = [...defaultCands].filter((d) => !caseBlocks.has(d));
-    if (defaults.length > 1) {
+    const leaves = new Set([...defaultCands].filter((d) => !caseBlocks.has(d)));
+    // RESOLVE THROUGH a bare jump onto another candidate. `forwardingTarget` (ir/core.ts) stops at
+    // a `br` that carries block ARGUMENTS — skipping it would drop the values it supplies — so a
+    // leaf holding `b .Ldefault(v)` and `.Ldefault` itself arrive here as two distinct candidates
+    // even though one merely jumps to the other. They are not two defaults: the jumping leaf emits
+    // nothing of its own, and the values its `br` hands the other's parameters are the values the
+    // DISPATCH hands them. So this is `forwardingTarget`'s walk with the args-carrying step
+    // ADMITTED rather than refused, and it does not drop those values either — the step becomes one
+    // more dispatch edge, hoisted with the rest, where the hoist's disagreement rule decides
+    // whether the two paths can share one statement. (ir/core.ts lists the non-callers and why.)
+    //
+    // A cycle of such jumps has no target to resolve to and declines. Leaves that pass DIFFERENT
+    // values, or that have a body, are untouched and are still two defaults below. A SET so a leaf
+    // walked twice — L → X → D reaches X from L's walk and again from X's own turn in the loop —
+    // is recorded once.
+    const throughEdges = new Set<Block>();
+    const resolveDefault = (d: Block): Block | null => {
+      const walked = new Set<Block>();
+      let cur = d;
+      for (;;) {
+        if (walked.has(cur)) {
+          return null;
+        }
+        walked.add(cur);
+        const t = cur.ops[0];
+        if (!isBareExit(cur) || t.opcode !== 'br' || !leaves.has(t.successors[0].block)) {
+          return cur;
+        }
+        throughEdges.add(cur);
+        cur = t.successors[0].block;
+      }
+    };
+    const defaults: Block[] = [];
+    for (const d of leaves) {
+      const r = resolveDefault(d);
+      if (r === null) {
+        return null;
+      }
+      if (!defaults.includes(r)) {
+        defaults.push(r);
+      }
+    }
+    // ONE default reached by SEVERAL leaves. `balance_case_nodes`/`emit_case_nodes` give each
+    // subtree that runs out of case values its own jump to the default, so agbcc's four-case tree
+    // reaches it through two `b .Ldefault` blocks, which comparing candidates by BLOCK would count
+    // as two different defaults and decline. Two leaves are the same default when each is
+    // a bare EXIT to the same place carrying the same values: nothing about them can then differ,
+    // so the representative emits what either would. Anything else — a leaf with a body, two
+    // leaves passing different values — is still two defaults and still declines.
+    if (defaults.length > 1 && !defaults.every((d) => sameBareExit(defaults[0], d))) {
       return null;
     }
     const defaultBlk = defaults[0] ?? null;
-    if (defaultBlk && defaultBlk.params.length) {
-      return null;
-    } // default entry with a phi → decline
+    // A default entry that takes BLOCK PARAMETERS is admitted on the same terms a case entry is:
+    // the dispatch edge binds them and `hoistDispatchCopies` re-emits that binding above the
+    // `switch`. The hazard it stands over is silent — without that re-emission,
+    // `switch (x) { case 1: … case 2: … }` whose fall-out edge also carried `w = 0` drops the write
+    // and looks entirely ordinary doing it — so the admission is only as good as the hoist.
     // A default candidate that is ALSO a case body means a relational edge hit a case leaf → ambiguous.
     if ([...defaultCands].some((d) => caseBlocks.has(d))) {
       return null;
@@ -449,13 +753,28 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
       return null;
     }
 
-    // PRE2 (fall-through): only NON-fall-through switches are handled — decline if any case body
-    // can reach ANOTHER case body (or a default that has its own block) while staying inside the
-    // region. (The SAME analysis serves the Regime-B path, which RECOVERS the adjacent-sibling
-    // case as C fall-through instead of declining; A has if-recovery to fall back on, B does not.)
+    // PRE2 (arm exits), per SITE. A `break` arm closes; a `fallthrough` arm runs on into the one
+    // sibling it reaches, which `chainArms` then places directly under it. `unstructurable` is a
+    // shape no single linear switch spells — a body reaching two siblings, or a sibling on one path
+    // and the switch's end on another — and Regime A declines to if-recovery, which spells every
+    // one of those edges. (Regime B reads the same verdicts and fails LOUD on either.)
     const merge = ipdom.get(b) ?? stop;
     const targets = new Set<Block>([...caseBlocks, ...(defaultBlk ? [defaultBlk] : [])]);
-    if (!allArmsClosed(targets, b, merge)) {
+    const siblings = new Set([...targets].filter((t) => t !== merge));
+    const exitOf = new Map<Block, ArmExit>();
+    for (const t of siblings) {
+      exitOf.set(t, analyzeArmExit(t, b, merge, siblings));
+    }
+    // A language with no fall-through in its `case` (Pascal) cannot print a falling arm at all, so
+    // for it a falling arm is exactly as unspellable as an `unstructurable` one — and takes the
+    // same exit: if-recovery, which that backend prints fine. Asked HERE rather than left to the
+    // backend because the backend's refusal is terminal (the whole function becomes a stub) while
+    // this one costs nothing but the `switch` spelling.
+    if (
+      [...exitOf.values()].some(
+        (e) => e.kind === 'unstructurable' || (!spellSwitchFallthrough && e.kind === 'fallthrough'),
+      )
+    ) {
       return null;
     }
 
@@ -469,29 +788,275 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
       }
     }
 
-    // Build the switch. Cases sorted ascending (safe: no fall-through — PRE2). Bodies delegate to the
-    // existing structureRegion (loops/ifs inside cases, the onStack guard — all reused).
+    // PRE5 (WHICH SPELLING THE SOURCE WROTE), per SITE, and only where the caller has declared
+    // that the layout answers it. Everything above establishes that this tree CAN be spelled as a
+    // `switch`; this asks whether it WAS. The two spellings are different objects, not one object
+    // two ways: a source `switch` front-loads its whole dispatch ahead of every arm body (agbcc's
+    // `expand_end_case` closes with a `reorder_insns` that moves the dispatch in front of the
+    // bodies expanded before it — the same sources `switchArmsFollowLayout` is read off), while an
+    // if/else-if ladder emits each test directly above the body it guards. So a test block laid
+    // out AFTER a case body cannot have come from a source `switch`, and recovering one here spells
+    // a ladder as a `switch` with no dual anywhere in the fan for a differ to prefer.
+    //
+    // READ PER SITE, off THIS recovery's own blocks, never off the function. A function holding a
+    // ladder and a real `switch` must keep both readings, and a function-wide OR would collapse
+    // them into one boolean and be wrong on one site by construction.
+    //
+    // WHAT IT REFUSES TO DO. The reading runs BACKWARDS, from emission to spelling, so it inherits
+    // `layoutIndex`'s premise (above) at the weaker of the two strengths stated there. A frontend
+    // or compiler that breaks it can hand this a front-loaded layout for a ladder, and then the
+    // gate simply does not fire. The converse error, a real `switch` whose layout interleaves,
+    // costs only the `switch` SPELLING: the recovery declines to if-recovery, behaviourally
+    // identical (the file header) and scored by the differ. This gate can lose a match; it can
+    // never produce a wrong answer.
+    //
+    // WHAT THE DECLINE PRODUCES, AND IT IS NOT ALWAYS A CLEAN LADDER. Recovery is RECURSIVE:
+    // declining a tree here hands the tree back to if-recovery, which then runs recovery AGAIN on
+    // each sub-tree it structures. On a flat tree that is a ladder over every case value. On a
+    // NESTED tree it is not: `corpus/agbcc-swnested.s` (a source `switch` nested inside an
+    // if/else-if ladder) declines HERE on the outer tree — correctly, the ladder arm's body really
+    // does sit between the tests — and the sub-tree then re-recovers, so the emitted C is an `if`
+    // nest holding a `switch` over a STRICT SUBSET of the source's case labels. Still behaviourally
+    // identical, and no worse than the alternative (with the reading withdrawn that same function
+    // comes back as one `switch` merging two arms the source wrote apart), but it is a THIRD
+    // spelling that neither reading would give, and nothing in the output says a dispatch was
+    // half-declined: "the decline is a clean ladder" holds at the OUTERMOST tree only. Pinned by
+    // the test "PRE5 declines a tree RECURSIVELY" on the committed fixture.
+    //
+    // WHAT THE POSITIONS ARE READ THROUGH, which is the premise that lives inside asmlift rather
+    // than in the compiler. `caseBlocks` holds `forwardingTarget` results (`asCase` is called on the
+    // resolved block), so an arm whose body is a bare jump contributes ITS TARGET's position, not
+    // its own. A forwarding target laid out ABOVE the dispatch would then read as a body above a
+    // test and decline a real `switch`.
+    //
+    // WHY THAT HAS NO INHABITANT IS MEASURED, NOT ARGUED. Two arguments that look like proofs are
+    // not: "the block is reached by a back edge" needs the block to DOMINATE the dispatch, which an
+    // `if` arm ahead of the `switch` does not, and a cross-jumped arm tail reaches it on an
+    // ordinary forward edge; "this flag's targets reorder nothing" is false — `MIPS_GCC` declares
+    // it WITH a scheduler, on the half-premise stated at `layoutIndex` above. Measured: across 28
+    // compiled probes on agbcc, gcc2.7.2 -O1 and gcc2.7.2kmc -O2 — arms cross-jumped onto a shared
+    // tail ahead of the dispatch, `goto`s out of an arm to a label above it, shared early returns,
+    // `continue`/`break` out of a switch inside a loop — no toolchain placed an arm's forwarding
+    // target above its own dispatch: every firing came back with zero bodies above the first test.
+    // Safe because no compiler in the corpus emits that shape, not because none can; whoever makes
+    // one — a new frontend, a relaxed loop recovery, a scheduler that hoists a merged tail —
+    // inherits this reader.
+    //
+    // `bodyPos` covers the CASE bodies only. `defaultBlk` is left out deliberately: it can be the
+    // dispatch's own fall-out block rather than an arm the source wrote (the W2/W4 withholdings
+    // above), so its position is one the source never chose. Both omissions can only make the gate
+    // UNDER-fire, i.e. keep a `switch`, which is the safe direction.
+    //
+    // AND THE READING REFUSES ITSELF where it has nothing to read. `layoutIndex` answers `-1` for a
+    // block absent from `fn.blocks`, which is not a position — taken as one it sorts below every
+    // real body and declines the tree holding it. That state has no inhabitant and cannot get one
+    // without a bug upstream: `ir/verify.ts` rejects a successor that is not a block of the fn and
+    // the tower runs it after the lift and after every raising pass, and `predecessorBlocks` throws
+    // by name on the same state near the top of `structure()`. So this is belt-and-braces over a
+    // VERIFIER BUG, not over an expected shape — kept because standing down costs nothing. Its test
+    // pins the UNREACHABILITY (both throws fire first); the `placed` branch itself stays
+    // unexecuted, and cannot be covered without breaking one of those two invariants.
+    if (switchRequiresFrontLoadedTests) {
+      const testPos = [...seen].map(layoutIndex);
+      const bodyPos = [...caseBlocks].map(layoutIndex);
+      const placed = [...testPos, ...bodyPos].every((i) => i >= 0);
+      if (placed && Math.max(...testPos) > Math.min(...bodyPos)) {
+        return null;
+      }
+    }
+
+    // ARM ORDER. The case values are disjoint (PRE3), so where no arm falls through the order
+    // carries no meaning and is pure matching evidence: ascending case VALUE is the neutral
+    // spelling, and where a compiler has declared `switchArmsFollowLayout` the layout of the bodies
+    // is the SOURCE's arm order instead. A FALLING arm's position is not free, and `chainArms`
+    // below re-threads this order for those — reading it for the chain HEADS only.
+    //
+    // TWO arms the layout cannot order, both falling back rather than recovering:
+    //   - two case VALUES sharing one body block share its index, so the tie is one the merge (or
+    //     the source's own stacked labels) erased, and ascending value breaks it. They become ONE
+    //     arm below, so the tie only orders that arm against the others. ADJACENT stacked labels
+    //     never get here: `case 2: case 3:` compiles to a range test the walk reads as navigation
+    //     and declines, while `case 0: case 2:` compiles to the two equality tests it recovers —
+    //     both checked against agbcc;
+    //   - an arm with no body of its own (`case k: break;`) has its edge resolve to the MERGE, so it
+    //     inherits the merge's index and sorts after every arm that HAS a body.
+    //
+    // BOOKED, UNPAID: the grouping makes arm ORDER observable on a shape the ascending-value
+    // fallback did not have before, and IDO turns out to lay case bodies out in SOURCE order too —
+    // the same function with `case 1:` written first and last differ (.text md5 ec39af99 against
+    // 689f34ec, 144 bytes each), which is what `switchArmsFollowLayout` recovers. target.ts sets
+    // the bar for opting a compiler in at a SOURCE-level argument about its passes, not at two
+    // objects, and that argument is unpaid for IDO; nothing here changes while it is. What the
+    // grouping cannot do is make a non-agbcc row worse, because the ungrouped spelling is not a
+    // rival there: under IDO it compiles to two copies and a different ROM entirely.
     const scrutExpr = expr(scrut);
-    const sortedCases = [...cases.entries()].sort((a, c) => a[0] - c[0]);
-    const outCases: SwitchCase[] = sortedCases.map(([k, blk]) => ({
-      values: [k],
-      body: structureRegion(blk, merge),
-      fallsThrough: false,
-    }));
+    const sortedCases = [...cases.entries()].sort((a, c) =>
+      switchArmsFollowLayout ? layoutIndex(a[1]) - layoutIndex(c[1]) || a[0] - c[0] : a[0] - c[0],
+    );
+    // TWO VALUES ONE BODY IS ONE ARM. `SwitchCase.values` stacks labels for exactly this, and the
+    // jump-table regime groups the same way (structure.ts's `armOf`). Emitting the body once per
+    // label is `structureRegion` run twice over one block: a duplication, not a spelling choice.
+    //
+    // WHY BLOCK IDENTITY IS THE KEY, and not a body-equality one like `sameBareExit` above. agbcc
+    // MERGES two written-out copies into one block — target.ts's `switchArmsFollowLayout` note
+    // says so from agbcc's own sources, SRCS compiling jump.c — and compiling both directions at
+    // TOOLCHAIN.agbccFlags says WHERE the merged block lands: at the last copy's position. So
+    // `case 0: A break; case 1: … case 2: A break;` and the grouped arm placed THERE are one
+    // object (.text md5 555abb1a), while the grouped arm placed at the first value is not
+    // (fe4d7d35). That is why the grouped spelling round-trips rather than merely reading shorter:
+    // agbcc declares `switchArmsFollowLayout`, so the arm goes exactly where the merged block sits.
+    // IDO does not merge at all — 224 bytes against the grouped 144 — so on MIPS a shared block can
+    // only have come from stacked labels. Two DISTINCT blocks with equal bodies therefore mean one
+    // arm on neither compiler: under agbcc that ROM is unreachable, under IDO it is what two arms
+    // compile to. Sound also because two dispatch edges onto ONE body cannot bind one name two
+    // ways: `hoistDispatchCopies` merges every collapsed edge's copies into a single statement
+    // above the `switch` and refuses on disagreement (structure.ts `hoistedDispatchAssigns`), so
+    // an arm reached by two case values is reached with one set of parameter values or the whole
+    // recovery declines.
+    //
+    // An arm takes the position of its FIRST value, which keeps the sort above. `defaultLayoutPos`
+    // is handed the GROUPED entry list because what it returns is an INDEX INTO the arm array, so
+    // the list it counts and the list it indexes must be one list.
+    const armsByBlock = new Map<Block, number[]>();
+    for (const [k, blk] of sortedCases) {
+      const prev = armsByBlock.get(blk);
+      if (prev) {
+        prev.push(k);
+      } else {
+        armsByBlock.set(blk, [k]);
+      }
+    }
+    // The `default:` arm is a chain member too — an arm may run on into it, and C prints it last.
+    const dfltArm = defaultBlk !== null && defaultBlk !== merge ? defaultBlk : null;
+    const preChain = [...armsByBlock.keys()];
+    const entries = chainArms(preChain, dfltArm, exitOf);
+    if (entries === null) {
+      return null;
+    }
+    // Did the chain move anything? The arm-order POLICY above produced `preChain`; where the chain
+    // left it alone, every position still means what that policy said it meant.
+    const orderIntact = entries.every((e, i) => e === preChain[i]);
+    const fallsInto = (blk: Block): Block | null => {
+      const x = exitOf.get(blk);
+      return x?.kind === 'fallthrough' ? x.to : null;
+    };
+    // THE DISPATCH HOIST. Every edge the tree walk is about to COLLAPSE — from any test block, to
+    // a case entry, a default candidate, the merge, or another test block — carries the parallel
+    // copy that binds its target's parameters, and collapsing the tree is what would discard it.
+    // Merge those copies and emit them ONCE, above the `switch`. Placed FIRST because it is
+    // emitted first and `argAssignsFor` mints swap-cycle temp names as it goes.
+    //
+    // TWO CONDITIONS ARE THIS REGIME'S OWN, and both must hold before the emission is asked for:
+    //
+    //  - AVAILABILITY AT THE ROOT. A hoisted copy is evaluated at `b`, not on its edge, so every
+    //    argument it reads must be defined at a block that DOMINATES `b`. An argument computed
+    //    inside a collapsed test block is not: the tree reaches that block only on some paths,
+    //    while the hoist runs on all of them, and re-rendering it above the dispatch would
+    //    SPECULATE it. (That is the one invariant PRE4's "a use is dominated by its def, so a
+    //    collapsed op runs on a subset of the paths it already ran on" does not give the hoist,
+    //    which is why the hoist asks for it here rather than inheriting it.)
+    //  - The emission's own two refusals, stated at `hoistedDispatchAssigns`: edges disagreeing
+    //    about one name, and a hoisted name whose value is still live at the switch or into an arm.
+    //
+    // Either way the answer is a decline to if-recovery, which spells every copy the asm performs.
+    const availableAtRoot = (v: Value): boolean => {
+      const home = blockOf(v);
+      return home !== undefined && dom.get(b)!.has(home);
+    };
+    const dispatchEdges: { pred: Block; succ: { block: Block; args: Value[] } }[] = [];
+    for (const t of new Set([...seen, ...throughEdges])) {
+      for (const e of t.ops[t.ops.length - 1].successors) {
+        if (e.block.params.length === 0) {
+          continue;
+        }
+        if (!e.args.every(availableAtRoot)) {
+          return null;
+        }
+        dispatchEdges.push({ pred: t, succ: e });
+      }
+    }
+    const hoisted = hoistDispatchCopies(dispatchEdges, [
+      b,
+      ...caseBlocks,
+      ...(defaultBlk ? [defaultBlk] : []),
+      ...(merge ? [merge] : []),
+    ]);
+    if (hoisted === null) {
+      return null;
+    }
+    // Bodies are structured in EMISSION order — `argAssignsFor` mints swap-cycle temp names as it
+    // goes, so building them out of order changes the output — and each falling arm's target is
+    // re-read off that order rather than trusted from the ordering above: this is the seam where a
+    // POSITION acquires control-flow meaning (the l3/ast.ts non-neutrality note).
+    const outCases: SwitchCase[] = [];
+    for (const [i, blk] of entries.entries()) {
+      const to = fallsInto(blk);
+      if (to !== null && to !== (entries[i + 1] ?? dfltArm)) {
+        return null;
+      }
+      // The arm fallen INTO may take block parameters, and the TWO paths that reach it are spelled
+      // in two different places: entering by its own case value takes the hoisted copy above the
+      // `switch` (`hoistDispatchCopies`), while FALLING in takes the copies the falling arm's own
+      // `br` emits as its last statements (`structureRegion(blk, to)` walks that terminator, so
+      // they are already there). Getting this wrong is SILENT, which is why it rests on the hoist
+      // rather than on a local reading of the arm.
+      //
+      // Regime B refuses the same hazard LOUD at its own `switch_br` path, on the weaker predicate
+      // that fits it (the copies `argAssignsFor` actually produced): its arms take their edge
+      // copies PER ARM, so a fall-through path would re-run them over what the falling arm
+      // computed. Hoisting is what removes that hazard, and Regime B does not hoist — booked, not
+      // built, and no row asks for it (`sw_jtfall`/`sw_jtfalldesc` match today).
+      outCases.push({
+        values: armsByBlock.get(blk)!,
+        body: structureRegion(blk, to ?? merge),
+        fallsThrough: to !== null,
+      });
+    }
     // An empty default arm is not a default (see the Regime-B note in structure.ts): the label
     // would carry no statement, which says nothing and is not valid C89.
     const defBody = defaultBlk ? structureRegion(defaultBlk, merge) : [];
+    // The `default:` arm is an ARM: where its block is laid out is read exactly as a case body's is
+    // (`defaultLayoutPos`). The dispatch placed that block itself when the last test simply RAN OUT
+    // into it and no other subtree jumps there — the two references the tree walk can count.
+    const dispatchTargets = [...seen].flatMap((t) =>
+      t.ops[t.ops.length - 1].successors.map((e) => forwardingTarget(e.block)),
+    );
+    // THE TWO CONJUNCTS READ THE EDGES DIFFERENTLY, and deliberately. The first is asked RAW, of
+    // the terminator's own second successor, because a surviving `b .Ldefault` block is a jump
+    // that did NOT collapse into a fall-through — resolving it away would count the jump as the
+    // running-out it is not (see the `expand_end_case` paragraph on `defaultLayoutPos`). The
+    // second is asked FORWARDED, over `dispatchTargets`, because there a forwarder is transparent:
+    // two edges that arrive through one are two references to the same block, which is exactly
+    // what "named more than once" has to count.
+    const fellThroughIntoIt = (blk: Block) =>
+      [...seen].some((t) => {
+        const succ = t.ops[t.ops.length - 1].successors;
+        return succ.length > 1 && succ[1].block === blk;
+      });
+    const namedOnlyOnce = (blk: Block) => dispatchTargets.filter((e) => e === blk).length < 2;
+    const ranOutInto = (blk: Block) => fellThroughIntoIt(blk) && namedOnlyOnce(blk);
+    // `defaultLayoutPos` owns which POSITIONS a chain makes unreadable — see its fall-through
+    // withholdings W5..W7. A chain elsewhere in the switch does not delete the evidence for
+    // where the label goes, and reading it off the emitted arms is what lets a `default:` written
+    // between two closed arms keep its place while a chain runs beside it.
+    const defaultAt = defaultBlk
+      ? defaultLayoutPos(
+          defaultBlk,
+          entries.map((e, i) => ({ entry: e, fallsThrough: outCases[i].fallsThrough })),
+          { placedByDispatch: ranOutInto(defaultBlk), orderIntact },
+        )
+      : undefined;
     const sw: Stmt = {
       k: 'switch',
       scrutinee: scrutExpr,
       cases: outCases,
-      ...(defBody.length ? { default: defBody } : {}),
+      ...(defBody.length ? { default: defBody, ...(defaultAt !== undefined ? { defaultAt } : {}) } : {}),
     };
-    const out: Stmt[] = [sw];
+    const out: Stmt[] = [...hoisted, sw];
     if (merge && merge !== stop) {
       out.push(...structureRegion(merge, stop));
     }
     return out;
   };
-  return { recognizeSwitch, analyzeArmExit };
+  return { recognizeSwitch, analyzeArmExit, layoutIndex, defaultLayoutPos, chainArms };
 }