@asmlift/core 0.6.0 → 0.8.0

package/src/l3/basecse.ts

@@ -13,14 +13,14 @@
 // question the source answered per BASE — one register file spelled as a pointer local beside
 // scalar cells spelled as bare derefs. The `single-cell` gate is what makes the narrower answer
 // reachable: under `LIVEBASE_BLOCK_GATES` a base every access of which is ONE fixed offset stays
-// inline, and rank's LIVEBASE_ADMISSIONS roster emits each table's hoist — and every product of
+// inline, and rank's LIVEBASE_HOISTS roster emits each table's hoist — and every composition onto
 // it — as its own candidate family, for the differ to referee between them. The unit is
 // the (base, width, signedness) KEY, not the base — a base read at two widths is two keys, and the
 // gate can leave one of them inline while the other binds.
 //
 // COVERAGE: the roster (rank.ts) is SEVEN rows over FIVE gate tables — two PAIRS share a table and
 // differ only in placement, `/basefold` with `/basefold/sinkinit` and `/orderbase` with
-// `/orderbase/scoped` — and it is a set of hand-picked SUBSETS rather than a narrowness ranking;
+// `/orderbase-scoped` — and it is a set of hand-picked SUBSETS rather than a narrowness ranking;
 // only `/livebase` ⊇ `/livebase-block` are ordered by inclusion. A table
 // whose predicate cuts across the others therefore carves out a PARTIAL answer, which is what
 // `UNFOLDED_GATES` does. Measured at ONE stated scope, `decompile()`'s default structuring,
@@ -61,7 +61,7 @@
 // and `ldrb r0, [r4, #0x3]` — agbcc CSEs the symbol reference where it re-materializes the integer
 // — so the inline subscript spelling produces exactly the shape this rule reads as evidence
 // against it. asmlift lifts that asm back to the correct `((u8 *)&gS)[3]` and then offers the
-// named-base respelling anyway. Measured reach: of the 21 keys the symbol half newly admits over
+// spelling through a named base anyway. Measured reach: of the 21 keys the symbol half newly admits over
 // the artifact's agbcc rows in both symbol-map configurations, 4 are on a base whose address the
 // tree also uses as a value (2 distinct keys, on `kleod:ProcessInputAndUpdateEntities` and
 // `pokeemerald:TrySetCantSelectMoveBattleScript`).
@@ -74,14 +74,14 @@
 // `synthetic:foldhead` its match — which is why `index.operandOff` is carried from the lift
 // instead of re-derived, and why a committed pass that can drop it is worth a test
 // (test/basecse.test.ts, the "`operandOff` is provenance" describe). WHAT EACH ROW IS WORTH is
-// measured in rank.ts's note on `BASEFOLD_ADMISSIONS`, not here, and the two rows are not worth
+// measured in rank.ts's note on `BASEFOLD_HOISTS`, not here, and the two rows are not worth
 // the same thing. Promoting the hint to a default would need this paragraph to say something it
 // does not.
 //
-// It is EVIDENCE and not proof, which is why `BASEFOLD_GATES` below is a lever rather than a
+// It is EVIDENCE and not proof, which is why `BASEFOLD_GATES` below backs a variation rather than a
 // relaxation of the default table. agbcc folds a subscript but keeps an aggregate MEMBER offset in
 // the memory operand: `((struct S *)0x3001100)->b` emits `.word 0x3001100` + `ldr [r0, #0x4]`,
-// byte-identical to the named-base spelling, and the same holds for a union member and for a
+// byte-identical to the spelling through a named base, and the same holds for a union member and for a
 // store. So the shape has two sources and asmlift can spell only one of them; rank.ts offers both
 // and the differ referees.
 //
@@ -97,7 +97,7 @@
 // AGGREGATE base (F9 spells a SCALAR global as a bare `var`, which is never an `index`-of-leaf, so
 // scalar recovery is untouched). Non-leaf bases (a local, a struct-element `p[a0]`,
 // arithmetic) are excluded: agbcc may re-derive those, so hoisting them can
-// MISMATCH (empirically confirmed) — the differ-refereed `/addr-home` axis
+// MISMATCH (empirically confirmed) — the differ-refereed `/addr-home` variation
 // (structure/analysis.ts homeSharedAddresses) serves the shared gaddr-free ARITHMETIC bases
 // instead.
 // The hoisted local carries the access's pointer type, so the
@@ -108,7 +108,7 @@
 import { assertHoistsDominate } from '../contracts';
 import { type IrType, T, scalarTypeForAccess, typeToString } from '../ir/types';
 import type { Expr, SFn, Stmt } from './ast';
-import { exprChildren, mapExprChildren, mapStmtExprs, stmtChildren, stmtExprs } from './ast';
+import { exprChildren, isLoop, mapExprChildren, mapStmtExprs, stmtChildren, stmtExprs } from './ast';
 import { type Gate, ablateHeuristic, firstRejection } from './gates';
 import { type BaseInit, type HoistPlacement, nameAllocator, placeBaseLocals } from './hoist';
 
@@ -149,8 +149,8 @@ const keyOf = (base: HoistableBase, width: number, signed: boolean): string => `
 /** The key's own grammar, read back — `<leafId>[ <type>] <width> <signed>`.
  *
  *  IT LIVES BESIDE `keyOf` BECAUSE THAT IS THE ONLY THING THAT MAKES IT SAFE. The key is a string
- *  and its readers are elsewhere — `l3/homesplit.ts` builds a candidate LABEL out of it, and a
- *  label is a candidate's identity — so a second file knowing this grammar is a collision waiting
+ *  and its readers are elsewhere — `l3/homesplit.ts` builds a candidate's VARIATION out of it, and a
+ *  candidate's variations are its identity — so a second file knowing this grammar is a collision waiting
  *  for the next base kind (`homeSplitTag` states the one the cast form causes).
  *
  *  The one space inside a cast's base id is this grammar's own separator, not the type's: every
@@ -240,7 +240,7 @@ function collect(stmts: Stmt[], c: Collected, loop: boolean): void {
   for (const s of stmts) {
     // A loop's OWN condition (`stmtExprs` of a while/do-while/for) runs every iteration, so a base
     // there is loop-invariant just like a body use — visit it with `nested`, not the outer flag.
-    const nested = loop || s.k === 'while' || s.k === 'dowhile' || s.k === 'for';
+    const nested = loop || isLoop(s);
     for (const e of stmtExprs(s)) {
       visitExpr(e, nested);
     }
@@ -357,7 +357,7 @@ export interface BaseKey {
    *  what a pointer local's own initializer STATEMENT produces (see raise/globalshape.ts's header
    *  for the compile that separates the two), while the inline cast produces the other order — so
    *  it is evidence a home is what the source wrote. Read only by `ORDERBASE_GATES` (rank.ts);
-   *  false for every base a compiler that has not opted in produced, which is what keeps the axis
+   *  false for every base a compiler that has not opted in produced, which is what keeps the variation
    *  off those targets. */
   orderLicensed: boolean;
 }
@@ -380,13 +380,13 @@ export const BASECSE_GATES: readonly Gate<BaseKey>[] = [
     // Censused at `decompile()`'s default structuring, map-less, one tree per row over the
     // artifact's 404 agbcc rows: `ORDERBASE_GATES` admits 12 keys on 10 rows, 11 of them cast keys.
     id: 'cast-base',
-    why: 'a struct element’s reinterpret cast is the inline spelling unless the assembly says the base had a home',
+    why: 'a struct element’s reinterpret cast is the inline spelling unless the assembly says the base was held in a local',
     sound: false,
     rejects: (c) => c.castBase,
   },
   {
     id: 'single-use',
-    why: 'one access re-materializes as cheaply as a named local',
+    why: 'a base accessed once is as cheap to load again as to hold in a named local',
     sound: false,
     rejects: reachedOnce,
   },
@@ -397,8 +397,27 @@ export const BASECSE_GATES: readonly Gate<BaseKey>[] = [
     rejects: (c) => c.inLoop,
   },
   {
+    // A KNOWN COUNTEREXAMPLE, recorded here rather than fixed. `LIVEBASE_GATES` already names it —
+    // an MMIO wait or poll stores and re-reads ONE fixed offset through ONE register the whole
+    // time — so this gate rejects a base the target demonstrably held in a register, and the row
+    // it costs is carried by `/livebase`, which is this table minus the placement gates.
+    //
+    // NOT FIXED BY EXCLUDING A VALUELESS READ FROM THE CENSUS: that hides a real access to make
+    // the gate right for the wrong reason — the premise is falsified by the function's assembly,
+    // not by how the access is spelled. NOT FIXED BY EXEMPTING DEVICE-REGISTER BASES EITHER: that
+    // is the sound rule, and its blast radius is every MMIO row in the corpus against a gate this
+    // comment records was bought with a real match. It wants its own round and its own zero-flip
+    // gate.
+    //
+    // THE STRUCTURER'S DEAD-READ SPELLING (structure.ts `unreadResult`) INTERACTS, but not on the
+    // map-fed default: that spelling requires a qualifier to reach the access, a CAST spelling
+    // (`((s32 *)&REG_DMA3SAD)[2]`) carries none, and a map-fed DMA tree spells it exactly that
+    // way — so no statement is emitted there, offset 8 is touched once, and the base local
+    // survives. The inhabitant is the `/raw-globals` subtree, where the read IS spelled and this
+    // gate DOES demote; that subtree's own winner is a `/livebase` candidate, so nothing on the
+    // ranked path loses by it. Stated because the demotion is invisible from either file alone.
     id: 'repeated-const-offset',
-    why: 'a fixed offset touched twice is a scalar RMW, which the compiler re-materializes',
+    why: 'a fixed offset read and then written is one scalar update, and the compiler loads its address again for it',
     sound: false,
     rejects: (c) => c.repeatedConstOffset,
   },
@@ -427,14 +446,14 @@ export const BASECSE_GATES: readonly Gate<BaseKey>[] = [
 export const BASEFOLD_GATES: readonly Gate<BaseKey>[] = [
   {
     id: 'single-use-unfolded',
-    why: 'one access re-materializes as cheaply as a named local, unless its offset survived the fold',
+    why: 'a base accessed once is as cheap to load again as to hold in a named local, unless its offset survived the fold',
     sound: false,
     rejects: (c) => reachedOnce(c) && !c.unfoldedOffset,
   },
   ...ablateHeuristic(BASECSE_GATES, 'single-use'),
 ];
 
-/** The `/livebase` lever's admission (rank.ts): the default rules with both PLACEMENT heuristics
+/** The `/livebase` variation's admission (rank.ts): the default rules with both PLACEMENT heuristics
  *  ablated, keeping only `single-use`. `loop` and `repeated-const-offset` predict which spelling
  *  the compiler chose, and both predictions have a counterexample — an MMIO poll (`p[2] = go;
  *  while (p[2] & BUSY) {}`) stores and re-reads a fixed offset through ONE register the whole
@@ -447,7 +466,7 @@ export const LIVEBASE_GATES: readonly Gate<BaseKey>[] = ablateHeuristic(
 
 /** `/livebase-block`'s admission (rank.ts): `/livebase` plus `single-cell`. The two tables differ
  *  by exactly one gate, so `without(LIVEBASE_BLOCK_GATES, 'single-cell')` is `/livebase`'s own
- *  admission and this selectivity axis prices by ablation like every other.
+ *  admission and this selectivity rule prices by ablation like every other.
  *
  *  `single-cell` GENERATES a narrower candidate; it does not classify, and taking it for a compiler
  *  fact is the way to misuse it. Its counterexample is in this corpus: `synthetic:sizebound`'s
@@ -470,13 +489,13 @@ export const LIVEBASE_GATES: readonly Gate<BaseKey>[] = ablateHeuristic(
  *  whenever an admission is added to or removed from the roster.
  *  HOW: prefer the edit-free form — import this array and `splice` the gate out of it before the
  *  first `enumerateCandidates` call, since the roster holds a reference to this very object. The
- *  env-read recipe on BASEFOLD_ADMISSIONS edits files instead, and a tap reverted underneath a
+ *  env-read recipe on BASEFOLD_HOISTS edits files instead, and a tap reverted underneath a
  *  running process reports ZEROES rather than crashing, which reads exactly like "the rule never
  *  fires"; if you use it, hash the tree either side of the window and quote both hashes.
  *
- *  A CENSUS OVER WINNING LABELS CANNOT STAND IN FOR THAT — "only a row whose winner carries
+ *  A CENSUS OVER WINNERS' VARIATIONS CANNOT STAND IN FOR THAT — "only a row whose winner carries
  *  `/livebase-block` can move" is unsound for the reason rank.ts's `seen` dedup spells out. This
- *  table's own winning-label census reads 5 rows and read 7 before `/unfolded` shipped, and the
+ *  table's own census over winners' variations reads 5 rows and read 7 before `/unfolded` shipped, and the
  *  two that left differ: `synthetic:foldpark` by RENAME (byte-identical source, MATCH either
  *  side), `synthetic:unfoldpark` because its winning SPELLING changed, 402 bytes at diff:9 to 397
  *  at MATCH.
@@ -597,7 +616,8 @@ export const UNFOLDED_GATES: readonly Gate<BaseKey>[] = [
  *  reading the population: where `raise/globalshape.ts` shapes a name the structurer usually spells
  *  it bare and no key exists here at all — but a shape is ONE element type for the whole name, so an
  *  access that strides something else keeps its cast and its key. `kleod:SetupBG3WindowOverlay`'s
- *  `gBgInfo` derives `elemSize 4` and still reaches this table at stride 28, in both arms.
+ *  `gBgInfo` (a row retired 2026-09-13) derived `elemSize 4` and still reached this table at stride
+ *  28, in both arms.
  *
  *  What this table admits, censused over the artifact's 370 agbcc rows: map-less 8 rows / 10 keys,
  *  map-ful 10 rows / 12 keys. TWO shapes, and the arms differ:
@@ -624,8 +644,8 @@ export const UNFOLDED_GATES: readonly Gate<BaseKey>[] = [
  *  exemption cannot have.
  *
  *  `loop` and `repeated-const-offset` STAY. Neither is about the base's identity and both are fan
- *  control; ablating them is `/livebase`'s axis, already on the roster, and a row that wants the
- *  product is one roster line. THE PRICE OF THAT IS A HOLE, and it is named rather than left for a
+ *  control; ablating them is `/livebase`'s variation, already on the roster, and a row that wants the
+ *  pairing is one hoist. THE PRICE OF THAT IS A HOLE, and it is named rather than left for a
  *  reader to find: a licensed base with a use inside a loop is admitted by NO table on the roster —
  *  this one refuses it on `loop`, and every table that ablates `loop` refuses it on `cast-base` or
  *  `single-use` — which is the "a base set that is no row's stays unreachable" debt
@@ -652,7 +672,7 @@ export const ORDERBASE_GATES: readonly Gate<BaseKey>[] = [
   ...ablateHeuristic(ablateHeuristic(BASECSE_GATES, 'cast-base'), 'single-use'),
   {
     id: 'order-licensed',
-    why: 'nothing in the assembly says this base had a home: the index was scaled first, or the order says nothing',
+    why: 'nothing in the assembly says this base was held in a local: the index was scaled first, or the order says nothing',
     sound: false,
     rejects: (c) => !c.orderLicensed,
   },
@@ -718,13 +738,13 @@ function admit(sfn: SFn, gates: readonly Gate<BaseKey>[]): { c: Collected; keys:
  *  `scope` DECLINES, and the overload is how a caller is told: `null` means the placement had
  *  nothing to say about this function, because no init landed inside a nested list. That tree is
  *  byte-for-byte the `first-use` spelling (l3/hoist.ts's `nested`), and the roster withholds the
- *  `first-use` row for this table deliberately (rank.ts, ORDERBASE_ADMISSIONS) — so returning it
+ *  `first-use` row for this table deliberately (rank.ts, ORDERBASE_HOISTS) — so returning it
  *  ships the withheld candidate under the scoped row's name.
  *
  *  IT WITHDRAWS A SPELLING RATHER THAN COLLAPSING A DUPLICATE, which is what the decline costs.
- *  `ORDERBASE_ADMISSIONS` holds exactly two rows, `head` and `scope`, so nothing is ever enumerated
+ *  `ORDERBASE_HOISTS` holds exactly two rows, `head` and `scope`, so nothing is ever enumerated
  *  at `first-use` for this table and the refused tree has no twin to fold into — its shape and
- *  `/volatile` products go with it. Over each project's whole `asm` tree, map-ful: of the 48
+ *  `/volatile` compositions go with it. Over each project's whole `asm` tree, map-ful: of the 48
  *  functions `ORDERBASE_GATES` admits, 7 place an init inside a nested list and 41 do not, and for
  *  29 of the 41 the refused spelling is one the `head` row does not already produce. Instrumented
  *  on two of those, both map-ful — the `kleod:StreamCmd_SetBGScroll` row (fan 11), and
@@ -785,13 +805,13 @@ export function hoistBaseLocals(
   }
   const out = { ...sfn, body, locals };
   // The two FLAT placements can only put the run in the top-level list, above every use of it by
-  // construction. `scope` puts an init inside a nested list, which is where a placing lever can ship
+  // construction. `scope` puts an init inside a nested list, which is where a placing variation can ship
   // the one failure the byte differ rewards — a read of a local whose assignment does not reach it —
   // so the tree it emits is checked rather than argued (contracts.ts).
   //
   // THE POPULATION IS THE MOTION, and `moved` is what the placer says it moved rather than what this
   // function minted. The leading run this pass inherits is the DEFAULT hoist's, committed by
-  // `structureChecked` before rank's levers see the tree (pipeline.ts), and `scope` moves those
+  // `structureChecked` before rank's variations see the tree (pipeline.ts), and `scope` moves those
   // inits too — so `newLocals` names less than half of what has to be judged. Real inhabitants, in the
   // CHECKOUTS rather than in a benchmark row — `DecompressAndLoadLevel` in klonoa and `sub_8052474`
   // in sa3, both map-ful — each sink one inherited `p0` beside the minted `p1`.

package/src/l3/coalesce.ts

@@ -6,18 +6,15 @@
 // TWO admission paths live here, each with its own gate table and its own reading of loops. The
 // SPAN path (COALESCE_GATES) proves disjoint liveness from preorder position, so it asks which
 // loops RE-RUN a mention of each local and refuses a pair only when one loop holds both. The
-// ARM-DISJOINT path (ARM_DISJOINT_GATES) proves the two never coexist because one `if` picks
-// between them, so it asks only whether ANY loop encloses that `if` — a second entry breaks the
-// argument however the arms' own loops relate. `coalesceCandidates` offers both.
+// ARM-DISJOINT path (ARM_DISJOINT_GATES) proves the two never coexist because one BRANCH picks
+// between them — an `if`'s two arms or a `switch`'s case bodies alike — so it asks only whether ANY
+// loop encloses that branch (a second entry breaks the argument however the arms' own loops relate)
+// and whether fall-through joins the two arms onto one path. `coalesceCandidates` offers both.
 import { typeToString } from '../ir/types';
 import type { Expr, SFn, Stmt } from './ast';
-import { exprChildren, mapExprChildren, stmtChildren, stmtExprs } from './ast';
+import { exprChildren, isLoop, mapExprChildren, stmtChildren, stmtExprs } from './ast';
 import { type Gate, firstRejection } from './gates';
 
-/** THE loop-kind test, shared by both admission paths in this file — the span model's enclosure
- *  walk and the arm path's `visit`. */
-const isLoop = (s: Stmt): boolean => s.k === 'while' || s.k === 'dowhile' || s.k === 'for';
-
 function namesIn(e: Expr, out: Set<string>): void {
   // `addr` names a GLOBAL (`&gSym`) or a LOCAL — the structurer renders an `laddr` frame object
   // as `&sp0`, an addr node over a name that IS in `sfn.locals`. Both are collected, because a
@@ -217,7 +214,7 @@ export interface MergePair {
  *  `const-fed` is what keeps three of them (ablate it and the span path offers 273). A rule
  *  refusing every in-loop local would make that bound redundant; this one does not, so any further
  *  relaxation of `const-fed` is a multiplier, and two call sites pay it (`/coalesce` and
- *  `/scopebase-coalesce`; the `/livebase` pairings enumerate the ARM path and pay
+ *  `/scopebase/coalesce`; the `/livebase` pairings enumerate the ARM path and pay
  *  ARM_DISJOINT_GATES' `arm-init` instead). */
 export const COALESCE_GATES: readonly Gate<MergePair>[] = [
   {
@@ -234,7 +231,7 @@ export const COALESCE_GATES: readonly Gate<MergePair>[] = [
   },
   {
     id: 'volatile',
-    why: 'a volatile qualifier (object or pointee) is observable and typeToString does not spell it — merging strips or adds it',
+    why: 'a `volatile` qualifier, on the variable or on what it points to, is observable, and merging would drop or add it',
     sound: true,
     guardedBy: 'coalesce.test.ts: a volatile pair never merges',
     rejects: (c) => c.eitherIsVolatile,
@@ -252,7 +249,7 @@ export const COALESCE_GATES: readonly Gate<MergePair>[] = [
   },
   {
     id: 'const-fed',
-    why: 'a load-fed local — other than a for induction variable, whose feeds are its own — is one the compiler had a reason to keep where it was',
+    why: 'a local set from a memory load, other than a `for` loop counter, is one the compiler had a reason to keep where it was',
     sound: false,
     rejects: (c) => !c.x.constFed || !c.y.constFed,
   },
@@ -265,20 +262,20 @@ export const COALESCE_GATES: readonly Gate<MergePair>[] = [
   },
   {
     id: 'first-is-write',
-    why: 'a survivor first MENTIONED by a read would see the absorbed value there',
+    why: 'a survivor whose first mention is a read would see the absorbed value there',
     sound: false,
     rejects: (c) => !c.y.firstIsWrite,
   },
 ];
 
-/** Every legal single merge, each as its own tree — NOT one committed choice.
+/** Every legal single merge, each as its own tree — NOT one committed decision.
  *
  *  Which pair a register allocator coalesced is not derivable from the L3 tree, and first-fit gets
  *  it wrong. Run kleod:UpdateHUDCounterDisplay's published repro script (results.json carries it)
  *  and read the candidate table: of its two legal merges, one scores WORSE than not merging at all
  *  and declaration order is the one that picks it. Emitting no merges at all costs that row its
  *  match, which is what guards this file. `rank.ts` already has the idiom for exactly this —
- *  `/regcopy`'s "the tail choice is allocator-ambiguous, so both are ranked" — so every candidate is
+ *  `/regcopy`'s "the tail decision is allocator-ambiguous, so both are ranked" — so every candidate is
  *  emitted and the differ referees.
  *
  *  ACCEPTED, NOT FIXED: a survivor assigned only on SOME paths still absorbs the other's value on
@@ -325,8 +322,11 @@ function localsAfterMerge(locals: SFn['locals'], gone: string, kept: string): SF
 export interface ArmPair {
   a: string;
   b: string;
-  /** the confining `if` has a loop ancestor, so it can run more than once */
+  /** the confining branch has a loop ancestor, so it can run more than once */
   ifInLoop: boolean;
+  /** control can run from one of the two arms INTO the other — `switch` fall-through, the one
+   *  way two arms of a branch land on a single path. Always false for an `if`. */
+  armsJoined: boolean;
   sameType: boolean;
   /** either local is object-volatile or carries a pointee-volatile qualifier (see MergePair) */
   eitherIsVolatile: boolean;
@@ -341,12 +341,13 @@ export interface ArmPair {
  *  different reason: `arm-init` is a FIRST-MENTION rule where `const-fed` is an every-assign one,
  *  so arms that open with a const write and then compute (`x = 0; x = x + 1;`) merge here and not
  *  there. Two locals confined to
- *  OPPOSITE arms of one `if` never coexist at runtime: the `if` picks one arm, so no read of either
- *  can observe the other's write — no liveness reasoning needed. That argument is exactly what the
- *  `loop` gate here protects: a loop ancestor re-enters the `if`, later entries can take the other
- *  arm, and a value written on one visit becomes readable on the next. Note this gate wants ANY
- *  enclosing loop, not the span model's shared-loop rule: never-coexisting is a claim about one
- *  entry, so a second entry breaks it however the two arms' loops relate. */
+ *  DIFFERENT arms of one branch never coexist at runtime: the branch picks one arm, so no read of
+ *  either can observe the other's write — no liveness reasoning needed. `branchArms` says what an
+ *  arm is, and the argument holds for a `switch`'s case bodies exactly as it does for an `if`'s two.
+ *
+ *  Two gates protect it, one per way it fails. `loop` covers a SECOND ENTRY, which is why it wants
+ *  ANY enclosing loop rather than the span model's shared-loop rule: never-coexisting is a claim
+ *  about one entry. `fall-through` covers the failure WITHIN one entry. */
 export const ARM_DISJOINT_GATES: readonly Gate<ArmPair>[] = [
   {
     id: 'type',
@@ -356,21 +357,28 @@ export const ARM_DISJOINT_GATES: readonly Gate<ArmPair>[] = [
   },
   {
     id: 'volatile',
-    why: 'a volatile qualifier (object or pointee) is observable — merging strips or adds it',
+    why: 'a `volatile` qualifier, on the variable or on what it points to, is observable, and merging would drop or add it',
     sound: true,
     guardedBy: 'coalesce.test.ts: a volatile pair never merges',
     rejects: (c) => c.eitherIsVolatile,
   },
   {
     id: 'loop',
-    why: 'a loop ancestor re-enters the if, so opposite arms both run and a value could cross',
+    why: 'a loop ancestor re-enters the branch, so different arms both run and a value could cross',
     sound: true,
-    guardedBy: 'coalesce.test.ts: an in-loop if never admits its arm pair',
+    guardedBy: 'coalesce.test.ts: never admits its arm pair',
     rejects: (c) => c.ifInLoop,
   },
+  {
+    id: 'fall-through',
+    why: 'a case that runs on into the other arm puts both locals on one path, so they coexist',
+    sound: true,
+    guardedBy: 'coalesce.test.ts: two arms joined by fall-through never merge',
+    rejects: (c) => c.armsJoined,
+  },
   {
     id: 'arm-init',
-    why: 'a local not const-initialized at its arm’s first mention is one the compiler had a reason to keep — the growth bound const-fed gives the span table',
+    why: 'a local its arm does not first set to a constant is one the compiler had a reason to keep apart',
     sound: false,
     rejects: (c) => !c.bothArmConstInit,
   },
@@ -378,7 +386,7 @@ export const ARM_DISJOINT_GATES: readonly Gate<ArmPair>[] = [
 
 /** The arm-disjoint merges alone — the class the livebase pairings enumerate (rank.ts): the
  *  demanding row's shared counter is arm-disjoint, and the span-model merges already ride the
- *  plain /coalesce label, so pairing them too would multiply candidates with no row behind it. */
+ *  plain /coalesce variation, so pairing them too would multiply candidates with no row behind it. */
 export function armDisjointCandidates(sfn: SFn): { merged: string; sfn: SFn }[] {
   return armDisjointUnder(ARM_DISJOINT_GATES, sfn).candidates;
 }
@@ -477,6 +485,44 @@ function mentionIndex(): {
   return { mentionsOf, mentionsUnder, firstMention };
 }
 
+/** The MUTUALLY EXCLUSIVE arms of a branching statement, and which pairs of them control can
+ *  nevertheless run through together — the one shape both admission sites read, so `if` and
+ *  `switch` are one rule here rather than two walkers.
+ *
+ *  An `if` has exactly two arms and no way to reach one from the other. A `switch`'s arms are its
+ *  `case` bodies, and FALL-THROUGH is the one way two of them land on a single path: arm `i` runs
+ *  into arm `j` exactly when every arm from `i` up to `j` falls through, so the reach is the
+ *  TRANSITIVE chain and not merely the adjacent pair.
+ *
+ *  ITS REACH, MEASURED, because a soundness argument with no corpus witness should say so. Counted
+ *  2026-09-19 with a throwaway counter in this walk, over `pnpm bench sweep --fan --map-modes
+ *  harness,nomap` — 2,396 records over the 1,198-row corpus: the switch half ADMITS 192 pairs, all
+ *  on `pokeemerald:SetMauvilleOldManLanguage:agbcc` and none on any other function. Across all five
+ *  gates, `arm-init` refuses 4,024 and `type` 1,346, while `volatile`, `loop` and `fall-through`
+ *  refuse **zero** — so what bounds this extension corpus-wide is a COST gate, while both SOUND
+ *  rules are witnessed only by the fixtures in `coalesce.test.ts`. Re-take the count rather than
+ *  quoting it: a corpus that grows falsifies the number, not the argument.
+ *
+ *  A `switch`'s `default` body is deliberately NOT an arm. `defaultAt` may place the label between
+ *  case labels, where the body is reachable both by dispatch and by running on into the arm below
+ *  it — a path `fallsThrough` does not describe, because the flag indexes the `cases` array the
+ *  label does not sit in. Rather than reason about a position this file cannot see, no pair
+ *  involving the default is offered: a merge withheld is a candidate missed, a merge admitted on a
+ *  path that exists is a wrong answer. */
+const branchArms = (st: Stmt): { arms: Stmt[][]; joined: (i: number, j: number) => boolean } | null => {
+  if (st.k === 'if' && st.then.length && st.else.length) {
+    return { arms: [st.then, st.else], joined: () => false };
+  }
+  if (st.k === 'switch') {
+    const { cases } = st;
+    return {
+      arms: cases.map((c) => c.body),
+      joined: (i, j) => cases.slice(Math.min(i, j), Math.max(i, j)).every((c) => c.fallsThrough),
+    };
+  }
+  return null;
+};
+
 /** `armDisjointCandidates` with the gate table supplied plus which gate refused each pair — the
  *  same ablation-as-a-value seam `coalesceUnder` provides for the span table. */
 export function armDisjointUnder(
@@ -498,44 +544,55 @@ export function armDisjointUnder(
     const l = locals.get(n);
     return l !== undefined && isVolatileLocal(l);
   };
+  // locals only, and never a name that is ALSO a param — the span path holds the same belief as a
+  // gate, and a local shadowing a param would let rename() rewrite the param's own mentions
+  const confined = (m: Map<string, number>): string[] =>
+    [...m.entries()].filter(([n, k]) => locals.has(n) && !params.has(n) && total.get(n) === k).map(([n]) => n);
   const visit = (stmts: Stmt[], inLoop: boolean): void => {
     for (const st of stmts) {
-      if (st.k === 'if' && st.then.length && st.else.length) {
-        const thenM = mentionsOf(st.then);
-        const elseM = mentionsOf(st.else);
-        // locals only, and never a name that is ALSO a param — the span path holds the same
-        // belief as a gate, and a local shadowing a param would let rename() rewrite the param's
-        // own mentions
-        const confined = (m: Map<string, number>): string[] =>
-          [...m.entries()].filter(([n, k]) => locals.has(n) && !params.has(n) && total.get(n) === k).map(([n]) => n);
-        for (const a of confined(thenM)) {
-          for (const b of confined(elseM)) {
-            // the survivor is the earlier declaration, matching how a shared source local reads.
-            //
-            // THIS READS THE STRUCTURER'S ORDER, AND MUST. The declaration list is put into the
-            // target's frame order at EMIT time (l3/slotorder.ts), after this pass, so `declIdx`
-            // is the naming walk's order and the choice means "the earlier declaration in the
-            // source asmlift recovered". Ordering the list any earlier would silently change which
-            // local survives every arm-disjoint merge on a function whose frame order disagrees
-            // with its declaration order — exactly the population the ordering exists for.
-            const [gone, kept] = (declIdx.get(a) ?? 0) <= (declIdx.get(b) ?? 0) ? [b, a] : [a, b];
-            const refused = firstRejection(gates, {
-              a: gone,
-              b: kept,
-              ifInLoop: inLoop,
-              sameType: typeOf.get(a) === typeOf.get(b),
-              eitherIsVolatile: isVolatile(a) || isVolatile(b),
-              bothArmConstInit:
-                firstMention(st.then, a) === 'const-write' && firstMention(st.else, b) === 'const-write',
-            });
-            if (refused !== null) {
-              refusals.set(refused, (refusals.get(refused) ?? 0) + 1);
-              continue;
+      const branch = branchArms(st);
+      if (branch !== null) {
+        const { arms, joined } = branch;
+        const confinedIn = arms.map((body) => confined(mentionsOf(body)));
+        for (let i = 0; i < arms.length; i++) {
+          for (let j = i + 1; j < arms.length; j++) {
+            for (const a of confinedIn[i]) {
+              for (const b of confinedIn[j]) {
+                // the survivor is the earlier declaration, matching how a shared source local
+                // reads.
+                //
+                // THIS READS THE STRUCTURER'S ORDER, AND MUST. The declaration list is put into
+                // the target's frame order at EMIT time (l3/slotorder.ts), after this pass, so
+                // `declIdx` is the naming walk's order and the choice means "the earlier
+                // declaration in the source asmlift recovered". Ordering the list any earlier
+                // would silently change which local survives every arm-disjoint merge on a
+                // function whose frame order disagrees with its declaration order — exactly the
+                // population the ordering exists for.
+                const [gone, kept] = (declIdx.get(a) ?? 0) <= (declIdx.get(b) ?? 0) ? [b, a] : [a, b];
+                const refused = firstRejection(gates, {
+                  a: gone,
+                  b: kept,
+                  ifInLoop: inLoop,
+                  armsJoined: joined(i, j),
+                  sameType: typeOf.get(a) === typeOf.get(b),
+                  eitherIsVolatile: isVolatile(a) || isVolatile(b),
+                  bothArmConstInit:
+                    firstMention(arms[i], a) === 'const-write' && firstMention(arms[j], b) === 'const-write',
+                });
+                if (refused !== null) {
+                  refusals.set(refused, (refusals.get(refused) ?? 0) + 1);
+                  continue;
+                }
+                out.push({
+                  merged: `${gone}-${kept}`,
+                  sfn: {
+                    ...sfn,
+                    body: rename(sfn.body, gone, kept),
+                    locals: localsAfterMerge(sfn.locals, gone, kept),
+                  },
+                });
+              }
             }
-            out.push({
-              merged: `${gone}-${kept}`,
-              sfn: { ...sfn, body: rename(sfn.body, gone, kept), locals: localsAfterMerge(sfn.locals, gone, kept) },
-            });
           }
         }
       }

package/src/l3/gates.ts

@@ -7,10 +7,14 @@
 //
 // `why` is a LABEL, one line. The argument for why the rule is correct belongs in the file header,
 // which has room; duplicating it here is how a table stops paying for itself.
+//
+// A table a variation's definition names (`variation-gates.ts`) shows its `why` to a reader, in the
+// webapp's variation drawer, so there the label is plain prose: no tag, file or function name, or
+// shouted word. `variation-offers.test.ts` holds it to that.
 export interface Gate<Ctx> {
   /** stable, kebab-case; appears in test names and in the contract report */
   readonly id: string;
-  /** one line: the reason the rule exists */
+  /** one line: the reason the rule exists, readable without the code */
   readonly why: string;
   /** Remove it and some candidate is WRONG, not merely worse. Everything else is a codegen
    *  heuristic the differ still referees. This flag is what makes `guardedBy` mandatory. */
@@ -86,3 +90,73 @@ export function gateTableDefects<Ctx>(gates: readonly Gate<Ctx>[]): string[] {
   }
   return out;
 }
+
+/** A gate table that counts its own refusals — {@link tallying}'s return. */
+export interface Tallied<Ctx> {
+  /** Hand this to the pass, in place of the table it wraps. */
+  readonly gates: readonly Gate<Ctx>[];
+  /** The census so far, most-refused first, ties in table order. A snapshot: counts keep
+   *  accumulating across every later call, which is what a corpus-wide census wants.
+   *
+   *  THERE IS NO RESET, deliberately — a per-row census is two snapshots DIFFED, not a fresh
+   *  wrapper per row, because a wrapper is a new table IDENTITY and a reader that keys on one
+   *  (`rank.ts`'s `censuses` memo) sees a fresh key every row. Counting is keyed by `g.id`, so a
+   *  table COMPOSED from several should be run past `gateTableDefects` first: two rules sharing an
+   *  id sum into one number, and the contract test only checks the tables on its own roster. */
+  readonly refusals: () => readonly (readonly [string, number])[];
+}
+
+/** The same table, wrapping each `rejects` in a counter — so a caller OUTSIDE core can obtain the
+ *  per-id census that `l3/coalesce.ts` and `structure/namecoalesce.ts` hand-roll into their return
+ *  type (`l3/scopebase.ts` reports the same attribution per KEY), from any pass that takes its
+ *  table as a parameter:
+ *
+ *      const t = tallying(UNMERGE_SITE_GATES);
+ *      unmergeJoins(sfn, { site: t.gates });
+ *      console.log(t.refusals());   // [['empty-arm', 168], ['no-merge-name', 80]]
+ *
+ *  THAT IS THE API AND NOT YET A CENSUS: nothing exports a corpus of trees to loop over, and a
+ *  tabled pass's only shipped caller is normally inside core. Taking the census off a REAL
+ *  enumeration is `pnpm bench gates --pass <id>`, whose header
+ *  (`apps/benchmark/src/run/gate-census.ts`) holds the measured reasons it is a subcommand rather
+ *  than a script to copy, and what a SECOND censusable pass costs.
+ *
+ *  WHAT IT COUNTS IS AN EVALUATION THAT ANSWERED TRUE, not a site. Under `firstRejection` — which
+ *  short-circuits — that is the FIRST rejecter, so this produces the same census the hand-rolled
+ *  maps do, with the same reading: an id absent from it is starved OR REDUNDANT WITH an earlier
+ *  rule, and telling the two apart takes the same rule run with the rest of the table empty
+ *  (`grep -n "ON ITS OWN" packages/core/src/raise/globalshape.ts`, whose dated table ships three
+ *  rules of the second kind). A consumer that asks the table something else — `.some`, `.filter` —
+ *  gets one count per evaluation instead, which is a different question and rarely the one wanted.
+ *
+ *  AND IT COUNTS REFUSALS, WHICH IS NOT REACH. A rule can refuse hundreds of times and still change
+ *  no output, because a later rule or a narrowing outside the table would have refused the same
+ *  sites: that is the MOVED column, it costs an ablation rather than a census, and `l3/unmerge.ts`'s
+ *  header carries the worked example of the two disagreeing.
+ *
+ *  IT CHANGES NO BEHAVIOUR: each wrapper's predicate IS the original's, `id`/`why`/`sound`/
+ *  `guardedBy` are carried, so `without`, `ablateHeuristic` and `gateTableDefects` all still hold
+ *  over the result. What it does change is the table's IDENTITY, and some readers key on that —
+ *  `rank.ts`'s `censuses` memo is a `Map` over `Gate<BaseKey>[]` instances — so wrap once and reuse
+ *  `gates`, rather than per call. */
+export function tallying<Ctx>(gates: readonly Gate<Ctx>[]): Tallied<Ctx> {
+  const counts = new Map<string, number>();
+  const order = new Map(gates.map((g, i) => [g.id, i]));
+  return {
+    gates: gates.map((g) => ({
+      ...g,
+      rejects: (c: Ctx) => {
+        const r = g.rejects(c);
+        if (r) {
+          counts.set(g.id, (counts.get(g.id) ?? 0) + 1);
+        }
+        return r;
+      },
+    })),
+    refusals: () =>
+      [...counts].sort((a, b) => b[1] - a[1] || (order.get(a[0]) ?? 0) - (order.get(b[0]) ?? 0)) as readonly (readonly [
+        string,
+        number,
+      ])[],
+  };
+}

package/src/l3/hoist.ts

@@ -208,7 +208,7 @@ function scopeSite(list: Stmt[], name: string): { list: Stmt[]; at: number } | n
  *  different bytes. Where no nested list holds every mention this IS `first-use`, which is what
  *  makes it a placement rather than a second policy.
  *
- *  These three are the axis a roster admission may state (rank.ts) and the only values
+ *  These three are the positions a hoist may state (rank.ts) and the only values
  *  `hoistBaseLocals` accepts. */
 export type HoistPlacement = 'head' | 'first-use' | 'scope';