@asmlift/core 0.6.0 → 0.8.0

package/src/structure/structure.ts

@@ -7,7 +7,7 @@
 //     the clamp0 diamond becomes `if (x < 0) x = 0; return x;` rather than a temp copy).
 //     NOTE the coupled INVERSE: l3/regspell.ts re-derives the UN-coalesced copy-carrying
 //     spelling as a ranked candidate — its R1 template matches THIS pass's diamond output
-//     shape, so a change to coalescing here can silently stop that lever firing (the
+//     shape, so a change to coalescing here can silently stop that respell variation firing (the
 //     matching-suite regspell gate is what makes the coupling loud).
 //     Coalescing is INTERFERENCE-CHECKED against per-block value liveness, and
 //     inline-at-use rendering carries an effect-ordering model: a call/load that cannot
@@ -40,8 +40,9 @@
 // target language whose `case` cannot fall through (`spellSwitchFallthrough` false) sends Regime A
 // back to if-recovery, and arms that do not linearize into one chain — two arms falling into the
 // same sibling, or a fall into the `default:` — refuse in `chainArms`, which answers null.
+import { constAddressOf, globalCellOf } from '../ir/alias';
 import { Block, Fn, Op, Successor, Value, defOpMap, dominators, mergeClasses, successorsOf } from '../ir/core';
-import { CAST_WIDTHS, EFFECTFUL_OPS } from '../ir/opcodes';
+import { CAST_WIDTHS, EFFECTFUL_OPS, SPELLED_WHEN_DEAD_OPS, opSig } from '../ir/opcodes';
 import { type IrType, T, scalarTypeForAccess, typeEquals } from '../ir/types';
 import {
   BinOp,
@@ -60,12 +61,14 @@ import {
 } from '../l3/ast';
 import { type Gate, firstRejection } from '../l3/gates';
 import { exprCType, provablyNonNegative, ptrElemBytes, renderedIntSignedness } from '../l3/typing';
+import { foldConstPair, isConstFoldOpcode } from '../raise/const';
 import { returnType } from '../raise/recover';
 import { collectStructs } from '../raise/structs';
 import {
   type DeclaredField,
   type SymbolInfo,
   type SymbolStructField,
+  declaredArrayShape,
   declaredFields,
   isArrayField,
   isBitfieldField,
@@ -73,6 +76,7 @@ import {
   isScalarCellSize,
   pointeeFields,
   scalarCellType,
+  structFieldInnerExtents,
 } from '../symbols';
 import { analyze } from './analysis';
 import { makeBitfieldSpelling } from './bitfields';
@@ -84,10 +88,12 @@ import {
   elementIndex,
   globalByteBase,
   globalOf,
+  subscriptsFromExtents,
 } from './globalaccess';
 import { makeLoopHazards, sunkCopyOverDroppedUndef, updateWriteSet } from './hazards';
 import { type NaturalLoop, analyzeLoops } from './loops';
 import { type NameMerge, coalesceNames } from './namecoalesce';
+import { unspelledEpilogues } from './retspell';
 import { type ArmExit, makeSwitchRecovery } from './switch-recover';
 
 // Lower a constant-offset memory access to its lvalue/rvalue Expr. If the base was recovered as a
@@ -162,7 +168,7 @@ function ptrGlobalValueName(x: Expr): string | null {
   return null;
 }
 
-/** A pointer global's value, the constant bytes added to it, and the at-most-one variable term. */
+/** A pointer global's value, the constant bytes added to it, and the variable byte residual. */
 interface PtrGlobalBase {
   name: string;
   byte: number;
@@ -170,18 +176,23 @@ interface PtrGlobalBase {
 }
 
 /** Decompose an access base into "the VALUE of a map-declared POINTER global + a constant byte
- *  offset + at most ONE variable term": `gPtr`, `gPtr + K`, `(u8 *)gPtr + i`, `(u8 *)gPtr + (i <<
- *  2) + K`. Null for anything else — two variable terms, no such global, a non-`+` operator —
- *  because only a single residual can be read as one member's index. */
+ *  offset + the variable residual": `gPtr`, `gPtr + K`, `(u8 *)gPtr + i`, `(u8 *)gPtr + (i << 2)
+ *  + K`, `(u8 *)gPtr + K + j + (i << 3)`. Null for anything else — no such global, a non-`+`
+ *  operator.
+ *
+ *  SEVERAL variable terms re-associate into ONE residual rather than refusing the decomposition,
+ *  because a rank-2 member's index is two of them (`->x[i][j]` computes `j + i*8`) and the caller
+ *  that splits them back apart ({@link pointeeElement}) needs to see both. The `+` tree's own
+ *  LEFT-TO-RIGHT visit order is preserved and never sorted: `j + (i * 8)` and `(i * 8) + j` are
+ *  different agbcc objects, so the order is part of the answer.
+ *
+ *  Every consumer still decides for itself what a residual it cannot explain means: the
+ *  constant-offset member spelling ({@link pointeeAccess}) refuses any residual at all. */
 function ptrGlobalBase(e: Expr, isPtrGlobal: (n: string) => boolean): PtrGlobalBase | null {
   let name: string | null = null;
   let byte = 0;
-  let idx: Expr | null = null;
-  let ok = true;
+  const terms: Expr[] = [];
   const visit = (x: Expr): void => {
-    if (!ok) {
-      return;
-    }
     if (x.k === 'bin' && x.op === '+') {
       visit(x.l);
       visit(x.r);
@@ -196,14 +207,11 @@ function ptrGlobalBase(e: Expr, isPtrGlobal: (n: string) => boolean): PtrGlobalB
       byte += x.value;
       return;
     }
-    if (idx !== null) {
-      ok = false;
-      return;
-    }
-    idx = x;
+    terms.push(x);
   };
   visit(e);
-  return ok && name !== null ? { name, byte, idx } : null;
+  const idx = terms.length === 0 ? null : terms.reduce((l, r): Expr => ({ k: 'bin', op: '+', l, r }));
+  return name !== null ? { name, byte, idx } : null;
 }
 
 /** Does a member declared at signedness `declared` read as EXACTLY the type the cast spelling this
@@ -358,7 +366,7 @@ function ptrMemberBase(e: Expr, sym: SymRenderCtx): PtrMemberBase | null {
  *  rather than widened, because this rule is not byte-neutral (see `spellPtrMemberElements`) and
  *  widening a non-neutral spelling's reach is a separate question a row has to ask.
  *
- *  And the whole rule refuses when `/no-ptr-elem` turns it off — the axis, not a preference. */
+ *  And the whole rule refuses when `/no-ptr-elem` turns it off — the variation, not a preference. */
 function ptrMemberElement(
   baseExpr: Expr,
   carried: Expr | null,
@@ -429,9 +437,159 @@ function spellablePointee(
   return { fields, const: pointee!.const };
 }
 
+/** `gPtr->arr[i]` — a VARIABLE-index access into an ARRAY member of a pointer global's pointee.
+ *
+ *  Unlike the constant-offset member spelling below, this one is NOT byte-neutral. The member form
+ *  materialises the member's own base (`add r1, r1, #0x8` then `ldrb r0, [r1]`) where the cast form
+ *  folds the constant into the load (`add r0, r0, r1` then `ldrb r0, [r0, #0x8]`), so the constant
+ *  reaches this rule down two distinguishable channels: the base tree (`pg.byte`, a separate add)
+ *  or the instruction's own displacement (`off`). The gate is `off === 0` — the constant was
+ *  materialised — and where the displacement carries it the cast spelling stands.
+ *
+ *  THAT CHANNEL DOES NOT SAY THE SOURCE NAMED THE MEMBER: a HOISTED BASE LOCAL materialises the
+ *  same constant. Compiled at agbcc's canonical flags against `u8 unk8[6][8]`, all three of
+ *  `gBlob->unk8[0][i]`, `u8 *p = (u8 *)gBlob->unk8; p[i]` and `u8 *p = (u8 *)gBlob + 8; p[i]` emit
+ *  the identical `add r1, #0x8` · `add r1, r1, r0` · `ldrb r0, [r1]`, while `*((u8 *)gBlob + 8 + i)`
+ *  and `((u8 *)gBlob + i)[8]` take the displacement — and the base-local form is a spelling three
+ *  shipped passes exist to emit (basecse/nearbase/scopebase). It is a per-site DEFAULT and not a
+ *  ranked variation for the OTHER reason of the two docs/level-tower.md gives: those two forms TIE in
+ *  bytes, so a variation would enumerate a candidate that can never win. Contrast the GLOBAL rank
+ *  recovery one indirection up (`cli/test/matching/array-rank-variation.test.ts`, `/flat-rank`), which
+ *  IS a variation because its two spellings do not tie. Do not read this gate as "the asm decided" and
+ *  carry that reading to a case where the alternatives differ in bytes.
+ *
+ *  THE RANK IS PART OF THE SPELLING, not a later fidelity polish. The declaration this access has
+ *  to type-check against belongs to the PROJECT, not to asmlift, and `->x[k]` on a `u8 x[6][8]`
+ *  is a ROW: agbcc strides it a second time and truncates the resulting pointer to `u8`, which is
+ *  a different program that happens to compile. So a member whose map states no rank is REFUSED
+ *  (absence means "the map could not say" — see SymbolStructField.dims), and a stated rank is
+ *  spelled out in full (`->x[i][j]`, or `->x[0][i]` where the asm merged the row into one flat
+ *  counter, which is the same address).
+ *
+ *  `->x[0][i]` TYPE-CHECKS AND IS OUT OF BOUNDS, and both halves of that are meant: `i` runs the
+ *  member's whole element count through a declared row of `8`. There is no in-bounds alternative —
+ *  the flat `->x[i]` is a different program (above) and the cast form is what this rule replaces —
+ *  so it is the only spelling that both type-checks and keeps the bytes, which is a narrower claim
+ *  than "the only spelling that type-checks". The `pmarrrow` synthetic row referees it (pass
+ *  `subscriptsFromExtents` a `needRecovered` of true, as the global path does, and the row takes
+ *  the cast form: MATCH → diff:5); `kleod:CheckWorldCompletion:agbcc` was its real-tier inhabitant
+ *  until kleod's rows were retired (2026-09-13);
+ *  at rank 3 the same merge spells `->x[0][0][k]`.
+ *
+ *  A VARIABLE SUBSCRIPT IS NEVER BOUNDED, here or anywhere. The member lookup bounds only the
+ *  CONSTANT part (`pg.byte` inside `[offset, offset+size)`), so `->grid[i]` can address the member
+ *  after `grid` exactly as `->x[0][i]` can run past a row. Not this rule's defect to fix: the cast
+ *  form it replaces is unbounded in the same way, the asm supplies no bound, and refusing every
+ *  unbounded index would refuse the capability whole (`pmarr1`'s `gBlob->unk8[i]` included). It is
+ *  recorded so the constant-side check is not mistaken for a bounds check on the access.
+ *
+ *  REFUSES, and each one keeps the honest cast form rather than guessing. Named with the test that
+ *  fails when it is removed (`packages/core/test/symbols.test.ts`), because a refusal nothing
+ *  ablates is a claim rather than a rule:
+ *    • any load/store displacement at all (`off !== 0`)   — "named only where the member BASE was
+ *      materialised"
+ *    • a pointee nothing may be named through, a qualifier the name would reintroduce, a width
+ *      mismatch, an element signedness the access contradicts (an s8 read is ldrb+lsl+asr where u8
+ *      is ldrb alone)   — "honours every gate the constant-offset one does", "a WIDER indexed
+ *      member is not named either", "a WIDTH mismatch falls back to the cast spelling"
+ *    • no array member of exactly this element width covering the accessed byte   — same three
+ *    • a member with NO stated rank   — "absence is not read as rank 1"
+ *    • a rank the DECLARATION does not spell: `dims` and `length` are independent map facts, and
+ *      symbolFieldType declares the flat byte array whenever the bound is missing   — "a rank with
+ *      NO `length` DECLARES flat, so the access may not subscript it — as a pair"
+ *    • a rank whose subscripts cannot be split out of the residual   — "a rank the residual cannot
+ *      be split along still spells every subscript, never a row"
+ *    • a byte offset into the member that does not land on an element boundary
+ *
+ *  NOT a `Gate` table (l3/gates.ts), unlike `FRESH_MERGE_GATES` and `CARRIER_NAME_GATES` in this
+ *  same file: those refusals are predicates over ONE prepared context, while these interleave with
+ *  the computations that produce the values the later ones test (the member `find`,
+ *  `structFieldInnerExtents`, `declaredArrayShape`, `subscriptsFromExtents`), so building that Ctx
+ *  would run all of it on inputs the earlier gates reject.
+ *
+ *  A THIRD ROUTE TO THE SAME LEGALIZATION, deliberately not taken: peel `lead.length` array levels
+ *  off the WALKED base type before the stride check, needing neither `baseElem` nor the global
+ *  path's env lie (`noteGlobal(name, T.ptr(elem))`) — both of which exist only because
+ *  `derefStrideOk` asks a SINGLE-subscript question of a node carrying `lead.length + 1`
+ *  subscripts. It needs `gPtr` typed in the print env, a bigger change than this gap should
+ *  carry. */
+function pointeeElement(
+  pg: PtrGlobalBase,
+  off: number,
+  width: number,
+  signed: boolean,
+  isStore: boolean,
+  sym: SymRenderCtx,
+): Expr | null {
+  // `pg.idx === null` narrows the type; the sole caller reaches here only for a variable index.
+  if (off !== 0 || pg.idx === null) {
+    return null;
+  }
+  const p = spellablePointee(pg.name, sym);
+  const f = p?.fields.find(
+    (m) => isArrayField(m) && m.elemSize === width && m.offset <= pg.byte && pg.byte < m.offset + m.size,
+  );
+  if (!p || !f || !spellsAccessType(f.elemSigned, width, signed) || !memberQualsAllow(f, p.const, isStore)) {
+    return null;
+  }
+  // The map must have STATED the rank. Absence is not rank 1 here: every vendored map predates the
+  // provider reading a member's rank, and each one flattens a member its project's header declares
+  // multidimensional (SymbolStructField.dims).
+  if (f.dims === undefined) {
+    return null;
+  }
+  const inner = structFieldInnerExtents(f);
+  const rel = pg.byte - f.offset;
+  if (inner === null || rel % width !== 0) {
+    return null;
+  }
+  // …AND THE DECLARATION HAS TO SPELL THAT SAME RANK. `dims` is not the declaration: symbolFieldType
+  // needs facts `dims` does not supply (a `length`, a base-type `elemSigned`) and declares the FLAT
+  // byte array without them, while `dims` and `length` are independent — a member whose outermost
+  // subrange is unbounded (`u8 data[][8]`, legal C; @gba-kit/debug-info reports `length` absent and
+  // `dims` regardless) carries `dims: [null, 8]` and no `length`. Reading the rank off `dims` alone
+  // therefore emitted `gPtr->grid[0][a0];` against `struct Save { u8 grid[48]; };` — the exact
+  // decl-vs-access divergence declaredFields' header calls non-compiling C. Asked of
+  // declaredArrayShape, which reads the answer back OUT of the declaration, so no gate that
+  // function grows later can reopen it. The element test is the one `baseElem` below asserts: the
+  // declaration must really give this base the element type the node is about to state for it.
+  const decl = declaredArrayShape(f);
+  if (decl.extents.length !== inner.length + 1 || !typeEquals(decl.elem, T.int(width * 8, f.elemSigned!))) {
+    return null;
+  }
+  // The residual is BYTES from the member's start — the accessed byte's own offset into it plus
+  // whatever the asm computed. `subscriptsFromExtents` splits the declared rows back out of it,
+  // and answers zero leading subscripts for a rank-1 member.
+  const residual: Expr = rel === 0 ? pg.idx : { k: 'bin', op: '+', l: pg.idx, r: { k: 'const', value: rel } };
+  const split =
+    inner.length === 0
+      ? (() => {
+          const i = elementIndex(residual, width);
+          return i === null ? null : { lead: [] as Expr[], idx: i };
+        })()
+      : subscriptsFromExtents(inner, residual, width, false);
+  if (split === null) {
+    return null;
+  }
+  return {
+    k: 'index',
+    base: { k: 'field', base: { k: 'var', name: pg.name }, name: f.name },
+    idx: split.idx,
+    width,
+    signed,
+    ...(split.lead.length ? { lead: split.lead } : {}),
+    // The element type the MAP declares for this member — the base is a `field` node off an
+    // untyped `var`, which the C type walk types `undefined`, and without this the backend would
+    // legalize the base through `((u8 *)gPtr->arr)[i]`, which is the cast form's object again.
+    // Stated from the same two facts the member gate above just checked (see l3/ast.ts baseElem).
+    baseElem: T.int(width * 8, f.elemSigned!),
+  };
+}
+
 /** `gPtr->member` for an access through a pointer global's value, or null when the offset is not
- *  provably ONE member's (see the block comment above). A VARIABLE index declines whatever it
- *  lands on — the indexed form is not byte-neutral and has no spelling here. */
+ *  provably ONE member's (see the block comment above). A VARIABLE index is not this rule's
+ *  constant-offset question at all and is handed to {@link pointeeElement}, which decides it on
+ *  its own terms. */
 function pointeeAccess(
   pg: PtrGlobalBase,
   off: number,
@@ -441,7 +599,7 @@ function pointeeAccess(
   sym: SymRenderCtx,
 ): Expr | null {
   if (pg.idx !== null) {
-    return null;
+    return pointeeElement(pg, off, width, signed, isStore, sym);
   }
   const total = pg.byte + off;
   // Constant offset: the member must match EXACTLY — offset, read width, and the SPELLED type
@@ -488,6 +646,7 @@ function memAccess(
   scalarGlobals: Set<string>,
   sym?: SymRenderCtx,
   isStore = false,
+  advancedBy?: number,
 ): Expr {
   // A deref of a global's address collapses to the bare global: `*(&gSym)` at off 0 is `gSym`;
   // at off N the global is an array — `gSym[N/width]` (a C global name decays to a pointer, so
@@ -504,7 +663,38 @@ function memAccess(
   // carried is already inside `baseExpr` — and folding them into one subscript below
   // (`idxVal + off / width`) is what makes the two indistinguishable at L3, so the displacement
   // is recorded before the fold destroys it (see the `operandOff` note in l3/ast.ts).
-  const fromOperand = off !== 0 ? ({ operandOff: off } as const) : {};
+  // …and the second evidence field this function carries: the byte step by which the machine advanced
+  // an address register to reach this access (raise/const.ts `advancedBy`, recorded before its own
+  // fold destroyed it). It rides beside `operandOff` because both are facts about how the address
+  // was computed rather than about which cell it names, and both are lost at L3 otherwise.
+  //
+  // `off === 0` IS A NARROWING, AND ONE SIDE OF IT IS WHAT THE ASM SHOWS. That side is a base
+  // value used as an address at TWO offsets — `ldr r3,=X; strh [r3]; adds r3,#2;
+  // strh [r3]; strh [r3,#2]`, where the third access carries `{adv 2, off 2}`. Stamping that one
+  // makes `l3/advance.ts` spell a second `p = p + 1;` where the target performed no second `add`:
+  // the distance still lands (the displacement was folded into the cell address, so
+  // `prev.addr + step` matches), so nothing downstream can refuse it, and the byte-exact spelling
+  // — one advance and then a subscript — is not in the fan at all. Pinned on that three-access
+  // shape in test/advance.test.ts, a COMPILED repro and not a row.
+  //
+  // WHAT IT IS NOT is "a non-zero `off` says this access was reached by a displacement RATHER THAN
+  // by the advance", which is false wherever ONE displacement rides EVERY member —
+  // `ldr r3,=X; strh [r3,#4]; adds r3,#2; strh [r3,#4]` is a real chain at X+4 and X+6, and this
+  // term refuses it — both index nodes arrive `{off 4, adv undefined}` and `advancedBases`
+  // declines, pinned by test/advance.test.ts's `one displacement on BOTH members is a real chain,
+  // and the stamp rule declines it`. The discriminating fact is the same base VALUE used at more
+  // than one `off`, where only the smallest is the link — not `off` alone, and reaching it takes a
+  // per-value census of address offsets this seam does not have.
+  //
+  // PRICED AT 0 ROWS EITHER WAY, which is why the narrow term ships: instrumenting this seam over
+  // `bench sweep --fan --map-modes harness,nomap` (2,126 records, 1,063 rows) counts 4,361 `advancedBy`
+  // stamps, ALL of them at `off === 0` and none at `off !== 0`, over ten producing functions. So
+  // the shape above has no corpus inhabitant to pay for the census, and the capability it costs is
+  // recorded here rather than spent.
+  const addressEvidence = {
+    ...(off !== 0 ? ({ operandOff: off } as const) : {}),
+    ...(advancedBy !== undefined && off === 0 ? ({ baseAdvanced: advancedBy } as const) : {}),
+  };
   if (sym) {
     const gb = globalConstByte(baseExpr, off);
     const si = gb ? sym.info(gb.name) : undefined;
@@ -537,7 +727,7 @@ function memAccess(
     // buffer that member points AT (see ptrMemberElement).
     const elem = ptrMemberElement(baseExpr, null, off, width, signed, sym);
     if (elem) {
-      return { ...elem, ...fromOperand };
+      return { ...elem, ...addressEvidence };
     }
   }
   // …and the MULTIDIMENSIONAL bare-name spelling, which needs the byte terms globalOf's division
@@ -556,7 +746,7 @@ function memAccess(
       width,
       signed,
       lead: multi.lead,
-      ...fromOperand,
+      ...addressEvidence,
     };
   }
   const g = globalOf(baseExpr, width);
@@ -579,9 +769,9 @@ function memAccess(
     const lead = siArr === undefined ? null : bareArrayLead(siArr, width, signed);
     if (lead !== null) {
       sym!.noteGlobal(g.name, T.ptr(T.int(width * 8, siArr!.elemSigned ?? false)));
-      return { k: 'index', base: { k: 'var', name: g.name }, idx, width, signed, ...lead, ...fromOperand };
+      return { k: 'index', base: { k: 'var', name: g.name }, idx, width, signed, ...lead, ...addressEvidence };
     }
-    return { k: 'index', base: { k: 'addr', name: g.name }, idx, width, signed, ...fromOperand };
+    return { k: 'index', base: { k: 'addr', name: g.name }, idx, width, signed, ...addressEvidence };
   }
   const bt = base.type;
   if (bt.kind === 'ptr' && bt.to.kind === 'struct') {
@@ -593,7 +783,7 @@ function memAccess(
     const ok = rt?.kind === 'ptr' && rt.to.kind === 'struct' && rt.to.name === bt.to.name && baseExpr.k !== 'index';
     return { k: 'field', base: ok ? baseExpr : { k: 'cast', to: bt, e: baseExpr }, name: `field_${off}` };
   }
-  return { k: 'index', base: baseExpr, idx: { k: 'const', value: off / width }, width, signed, ...fromOperand };
+  return { k: 'index', base: baseExpr, idx: { k: 'const', value: off / width }, width, signed, ...addressEvidence };
 }
 
 // A variable-index array access `base[index]`; `base[index].field_K` when a `fieldOff` marks an
@@ -650,11 +840,11 @@ function arrayAccess(
     //     input asm.
     //   u32 g[6][9] — a NON-power-of-two row stride: `g[a][b]` and `g[0][a*9+b]` are BYTE-
     //     IDENTICAL, because agbcc reassociates `(a*36)+(b*4)` into `((a*9)+b)*4` itself. Nothing
-    //     referees the choice, which is the same reason `scaledBy` refuses a CONSTANT row term.
+    //     referees the question, which is the same reason `scaledBy` refuses a CONSTANT row term.
     //
     // Both cases say decline: in the first the evidence points the other way, in the second there
     // is none. The recovery therefore lives on the byte residual alone (memAccess), where the two
-    // spellings are still distinguishable. Pinned by matching/array-rank-axis.test.ts.
+    // spellings are still distinguishable. Pinned by matching/array-rank-variation.test.ts.
     const lead = si === undefined ? null : bareArrayLead(si, elemSize, signed);
     if (lead !== null) {
       sym!.noteGlobal(baseExpr.name, T.ptr(T.int(elemSize * 8, si!.elemSigned ?? false)));
@@ -824,8 +1014,8 @@ const NO_WRITTEN_DESTINATIONS: ReadonlyMap<Value, number> = new Map<Value, numbe
  *  same tree and the fan does not grow.
  *
  *  A SUPERSET of the real sort, on purpose and in the safe direction — and the direction only
- *  holds because rank asks this of the SAME fn it then structures (a `variantGate`, evaluated on
- *  the variant's own fully-raised fn). Two gaps remain, both of which only say YES where the sort
+ *  holds because rank asks this of the SAME fn it then structures (a `perLiftGate`, evaluated on
+ *  that lift's own fully-raised fn). Two gaps remain, both of which only say YES where the sort
  *  says nothing: `keepSlot`/`suppressedArgs` drop copies this still counts, and this asks of every
  *  edge where `preferDefPosCopyOrder` reorders only the acyclic ones (`copySetIsCyclic` needs the
  *  built copy list, which is not available here). So it can answer true for a pair that later
@@ -841,7 +1031,7 @@ const NO_WRITTEN_DESTINATIONS: ReadonlyMap<Value, number> = new Map<Value, numbe
  *  A SECOND, HAND-WRITTEN SPELLING of `edgeCopyRecords`' two comparators — including the stability
  *  that decides ties — not a call into them, and nothing forces the two to agree. A change to that
  *  sort has to be mirrored here BY HAND, or this gate keeps answering about an ordering the pass no
- *  longer produces. Unified deliberately not: this is `/copy-defpos`'s variantGate, so it decides
+ *  longer produces. Unified deliberately not: this is `/copy-defpos`'s perLiftGate, so it decides
  *  which candidates are ENUMERATED and its predicate cannot move without moving rows. */
 export function edgeCopyOrdersDiffer(fn: Fn): boolean {
   const order = fn.writeOrder;
@@ -912,12 +1102,12 @@ export interface FreshMergeCarrier {
  *  `max3` (agbcc -O2, scored against its own target) only the SECOND of the two chained merges is
  *  load-bearing: re-homing just the first is byte-identical to re-homing neither (score 5), and
  *  re-homing just the second is byte-identical to re-homing both (score 0, MATCH). Splitting the
- *  choice per slot would be a fan of 2^slots, so the axis offers the whole-function spelling.
+ *  decision per slot would be a fan of 2^slots, so the variation offers the whole-function spelling.
  *
  *  `param-rooted` is a SCOPE, not a derivation. A chain rooted in an ordinary merge home is left
- *  alone, and widening to one is a different, unmeasured axis: 293 of 721 map-less corpus rows
+ *  alone, and widening to one is a different, unmeasured variation: 293 of 721 map-less corpus rows
  *  carry at least one conditional merge slot (925 slots), of which the param rooting admits 109 —
- *  `LoadBGTilemapData` is one of the other 184, which is why the axis has no reach there — a RECORD
+ *  `LoadBGTilemapData` is one of the other 184, which is why the variation has no reach there — a RECORD
  *  of a measurement, not a live check: that function is in no corpus row and no fixture here (its
  *  attribution evidence is docs/lbg-attribution.md), so it cannot be re-run from this repo.
  *
@@ -929,14 +1119,14 @@ export interface FreshMergeCarrier {
 export const FRESH_MERGE_GATES: readonly Gate<FreshMergeCarrier>[] = [
   {
     id: 'redundant-phi',
-    why: 'a merge every edge feeds the same value overwrites nothing, so its own home buys a copy',
+    why: 'a merge every edge feeds the same value overwrites nothing, so a local of its own only adds a copy',
     sound: false,
     guardedBy: 'fresh-merge.test.ts: a redundant phi over one parameter keeps the parameter',
     rejects: (c) => c.allSame,
   },
   {
     id: 'param-rooted',
-    why: "the rule's scope — a chain rooted in an ordinary merge home is a separate, unmeasured axis",
+    why: 'a merge fed by a chain that does not start at a parameter keeps its ordinary local',
     sound: false,
     guardedBy: 'fresh-merge.test.ts: a merge over ordinary locals is untouched',
     rejects: (c) => !c.paramRooted,
@@ -970,7 +1160,154 @@ function reHomesParamMerge(
   return firstRejection(gates, c) === null;
 }
 
-// Structuring levers, threaded as DATA so a new one is a field here + its consumer, not a new
+/** One name offered to one block parameter, as `CARRIER_NAME_GATES` judges it.
+ *
+ *  THE FIELDS ARE LAZY, and that is a cost decision rather than a style one. `canTakeName` runs per
+ *  merge slot per carrier over every named value in the function, and `NAME_COALESCE_GATES`' eager
+ *  record is affordable only because its pass is an opt-in variation. Laziness changes nothing about
+ *  BLAME: `firstRejection` reports the first gate in TABLE order that rejects, whichever fields
+ *  were computed to get there. What it does mean is that the table's order also decides what runs,
+ *  so the two whole-function walks sit at the bottom. */
+export interface CarrierName {
+  /** the merge is a pure alias — every in-edge hands it the same value */
+  readonly pureAlias: boolean;
+  /** the name's declaration and the parameter disagree about carrier width */
+  readonly widthDiffers: boolean;
+  /** …or, at a sub-word width, about signedness — which at that width is part of the width */
+  readonly signDiffers: boolean;
+  /** another parameter of the SAME block already holds the name */
+  readonly siblingHolds: boolean;
+  /** a value under the name is still live where the parameter's in-edge copies land */
+  readonly carrierLive: boolean;
+  /** the name is written somewhere the parameter is still live — at a materialized definition
+   *  under it, or at any block a predecessor of another parameter's block reaches, which is that
+   *  block itself plus wherever a loop emitter could move the copy to */
+  readonly carrierWritten: boolean;
+  /** a value with no name of its own re-derives the name at a use past the copy */
+  readonly reDerivesName: boolean;
+}
+
+/** `canTakeName`'s admission: may this block parameter be SPELLED with a name that already exists,
+ *  so the in-edge copies into it disappear? EVERY rule here is sound — a refusal costs one copy in
+ *  the emitted C, and an admission this table gets wrong is a program that computes something else.
+ *  The argument for each is in the block comment above `canTakeName`, which has room for it.
+ *
+ *  `carrier-write` carries the one approximation in the table. A loop emitter rotates the header's
+ *  update copy to the BOTTOM of the body, where it also runs on the exiting iteration, so a write
+ *  nominally on a back edge lands on the exit path too. Liveness cannot see a placement, so the
+ *  rule takes the conservative union over every block the writing edge's predecessor reaches. */
+export const CARRIER_NAME_GATES: readonly Gate<CarrierName>[] = [
+  {
+    id: 'carrier-width',
+    why: 'the copies into the name are assignments through its declaration, which would truncate',
+    sound: true,
+    guardedBy: 'fresh-merge.test.ts: a merge WIDER than its parameter carrier takes a fresh home',
+    rejects: (c) => c.widthDiffers,
+  },
+  {
+    id: 'carrier-sign',
+    why: 'a narrow declaration IS the extension it replaced, and u8 re-applies a different one',
+    sound: true,
+    guardedBy: 'carrier-name.test.ts: ablating carrier-sign reads an s8 carrier through a u8 name',
+    rejects: (c) => c.signDiffers,
+  },
+  {
+    id: 'sibling-param',
+    why: 'two parameters of one block share every in-edge, so one edge would write the name twice',
+    sound: true,
+    guardedBy: 'carrier-name-fuzz.test.ts: every SOUND gate of CARRIER_NAME_GATES is load-bearing',
+    rejects: (c) => c.siblingHolds,
+  },
+  {
+    id: 'carrier-live',
+    why: 'a value under the name still live here is what the in-edge copies would overwrite',
+    sound: true,
+    guardedBy: 'carrier-name-fuzz.test.ts: every SOUND gate of CARRIER_NAME_GATES is load-bearing',
+    rejects: (c) => !c.pureAlias && c.carrierLive,
+  },
+  {
+    id: 'carrier-write',
+    why: 'the converse — the name must not be written anywhere the parameter is still live',
+    sound: true,
+    guardedBy: 'carrier-name.test.ts: ablating carrier-write reads a loop variable past its sunk update',
+    rejects: (c) => c.carrierWritten,
+  },
+  {
+    id: 're-derives',
+    why: 'an unnamed live value is re-rendered at its use, and would read the name written here',
+    sound: true,
+    guardedBy: 'name-clobber.test.ts: the inlined difference keeps reading the value the asm computed it from',
+    rejects: (c) => !c.pureAlias && c.reDerivesName,
+  },
+];
+
+/** A nested loop's header parameter offered its ENCLOSING loop's name, as
+ *  `ENCLOSING_CARRIER_GATES` judges it — the admission `enclosingCarrierName` makes before
+ *  `canTakeName` (`CARRIER_NAME_GATES`) is asked. `E` is the inner header's first forward
+ *  predecessor and `a` the argument `E` hands the parameter.
+ *
+ *  Lazy for the same reason `CarrierName` is: `carriedByBoth` walks the in-edges of both headers,
+ *  so it sits last and runs only when every cheaper rule admits. Every field is TOTAL — false when
+ *  `E` or `a` does not exist — so a test can drop any one gate and the rest still answer. */
+export interface EnclosingCarrier {
+  /** every forward predecessor of the inner header is the one block `E`, and `E` is not the header */
+  readonly oneForwardEntry: boolean;
+  /** `E` heads a loop whose body holds the inner header */
+  readonly entryEncloses: boolean;
+  /** `a` is one of `E`'s own parameters — `E`'s loop-carried value, which `E` does not compute */
+  readonly argIsEnclosingParam: boolean;
+  /** the frontend measured `E`, and `E` wrote nothing into the parameter's key */
+  readonly keyUnwritten: boolean;
+  /** the value is carried by BOTH loops (`carriedByBothLoops`). False whenever `entryEncloses` or
+   *  `argIsEnclosingParam` is, since it needs `E`'s loop and `a`'s slot in `E` — which is why no
+   *  fixture can separate those two from this one. Independent of `keyUnwritten`, which no part of
+   *  the walk consults */
+  readonly carriedByBoth: boolean;
+}
+
+/** `enclosingCarrierName`'s own admission. The argument for each rule is the block comment above
+ *  `enclosingCarrierName`; the ids are here so a refusal can be named and a rule dropped by a test.
+ *
+ *  ONE rule is sound, and it is the last. The four before it bound what the write-order record can
+ *  be EVIDENCE for — a refusal keeps the two-variable spelling, which is correct by construction —
+ *  so each is `sound: false`: dropping one spells a different, still-correct program (the fixtures
+ *  in `nested-carrier.test.ts` show what each keeps). `carried-by-one-loop` is the collision
+ *  `canTakeName` cannot see, and dropping it emits another program. */
+export const ENCLOSING_CARRIER_GATES: readonly Gate<EnclosingCarrier>[] = [
+  {
+    id: 'one-forward-entry',
+    why: 'the record is per predecessor, so it cannot vouch for a second edge into the inner header',
+    sound: false,
+    rejects: (c) => !c.oneForwardEntry,
+  },
+  {
+    id: 'enclosing-header',
+    why: 'only the enclosing header itself has a record that can say the entry copy was not made',
+    sound: false,
+    rejects: (c) => !c.entryEncloses,
+  },
+  {
+    id: 'enclosing-param',
+    why: 'only a value the enclosing header did not compute can have reached the inner loop uncopied',
+    sound: false,
+    rejects: (c) => !c.argIsEnclosingParam,
+  },
+  {
+    id: 'key-written',
+    why: 'the enclosing header wrote the key (or was not measured): the source spelled the copy',
+    sound: false,
+    rejects: (c) => !c.keyUnwritten,
+  },
+  {
+    id: 'carried-by-one-loop',
+    why: 'a value the outer back edge replaces would be overwritten under a name the inner loop reads',
+    sound: true,
+    guardedBy: 'nested-carrier.test.ts: ablating carried-by-one-loop lets the outer update clobber the inner value',
+    rejects: (c) => !c.carriedByBoth,
+  },
+];
+
+// Structuring options, threaded as DATA so a new one is a field here + its consumer, not a new
 // positional boolean widened across every call site:
 //   returnsVoid                    — from the function's own prototype (suppress phantom r0 return);
 //   coalesceLoopInit               — keep the induction var in its arg register;
@@ -981,9 +1318,9 @@ function reHomesParamMerge(
 // booleans, never a compiler name.
 //
 // WHAT A FIELD DOC BELOW HOLDS, narrowly: what the option MEANS to `structure()`, and the suffix of
-// the axis that enumerates it. An AXIS's rationale, and any figure pricing its marginal value, live
-// ONCE at its `STRUCTURING_AXES` entry in rank.ts — restated here the two copies rot separately,
-// and only the rank.ts one sits next to the enumeration that could refute it. Figures pricing a
+// the variation that enumerates it. A VARIATION's rationale, and any figure pricing its marginal value, live
+// ONCE at its `STRUCTURE_VARIATIONS` entry in rank-variations.ts — restated here the two copies rot
+// separately, and only that one is the entry the enumeration reads. Figures pricing a
 // DEFAULT this pass owns (the edge-copy ordering, `spellDeclaredSubscripts`) do belong here.
 export interface StructureOptions {
   returnsVoid?: boolean;
@@ -996,9 +1333,9 @@ export interface StructureOptions {
   // both arms reconverge. Defaults to preserveDivergentBranchSense rather than to a constant, so a
   // target that opts out of the divergent claim opts out of this one; target.ts says how.
   //
-  // This is the ZERO POINT of rank.ts's `/flip-join` axis, not a per-compiler fact that closes
+  // This is the ZERO POINT of rank.ts's `/flip-join` variation, not a per-compiler fact that closes
   // the question — docs/level-tower.md wants a default only where the mapping is a FUNCTION, and
-  // benchmark rows still reach their winning spelling through the axis rather than through this
+  // benchmark rows still reach their winning spelling through the variation rather than through this
   // default. Read it forward only: it says which sense to emit ABSENT evidence of an inversion,
   // never that the asm's layout WAS the source's sense. What agbcc contributes is the refusals —
   // its gcc Makefile SRCS compiles neither sched.c nor reorg.c and toplev.c never sets
@@ -1006,14 +1343,41 @@ export interface StructureOptions {
   // toplev.c sets for -Os alone — so no scheduler and no hoister moves an arm's body across the
   // branch after stmt.c laid the arms out in source order.
   //
-  // Three mechanisms DO invert the sense, and each is per-SITE where this lever is per-function,
+  // Three mechanisms DO invert the sense, and each is per-SITE where this option is per-function,
   // so no value here is right in every `if` of a function that holds several: a short-circuit
   // fold picks which successor is `taken` from the asm's branch polarity, which on Thumb the
   // branch RANGE decides (raise/shortcircuit.ts); a relay past a branch's reach inverts to jump
   // around the long form; and a rotated loop's zero-trip guard is an `if` no source wrote at all
   // (`synthetic:fib`, `for(i=0;i<n;i++)`, emits `if (0 >= a0) … else do{…}while`), so there no
-  // spelling is the faithful one and only the differ can choose.
+  // spelling is the faithful one and only the differ can choose. `senseFromFoldEvidence` below
+  // answers the FIRST of the three per site, off the fold's own record.
   negateJoinedBranchSense?: boolean;
+  /** Spell a branch-sense site from the SHORT-CIRCUIT FOLD'S own orientation evidence, where the
+   *  fold left some, instead of from the two booleans above. `raise/shortcircuit.ts` stamps the
+   *  fused branch with three facts: `scSharedOnFall` — whether the arm both tests reach was FALLEN
+   *  INTO rather than branched to, and so, since gcc lays a condition's arms out in source order,
+   *  whether it is the source's `then` — `scSharedIsTaken`, which successor slot that arm landed in
+   *  here, and `scEdgeRelayed`, whether a long-branch trampoline sat on either edge, which is the
+   *  layout where the source-order premise is inverted and therefore must not be consulted. The
+   *  site NEGATES in one cell only: the shared arm in the TAKEN slot, branched to, no relay — the
+   *  taken slot holding the source's `else`. Per SITE, which is the point: the booleans are per
+   *  function, and a function whose `if`s were written in opposite senses has no right value for
+   *  either.
+   *
+   *  A site the fold did not touch carries no stamp and keeps its boolean, so this changes nothing
+   *  on a function with no short-circuit chain. rank.ts's `/site-sense` variation; it is a VARIATION and not
+   *  a default because the source-order premise under `scSharedOnFall` is a claim about gcc's
+   *  layout that the differ referees per row — and because one cell of the table is genuinely
+   *  undecided by these three facts (see the census at the read). */
+  senseFromFoldEvidence?: boolean;
+  /** PER-SITE override of whatever decided a site's sense — the boolean, or `senseFromFoldEvidence`
+   *  where that is on: the ORDINALS of the branch-sense sites to spell the OTHER way round. A
+   *  site's ordinal is its
+   *  position among the distinct blocks that turn out to BE sense sites, in first-visit order —
+   *  a numbering only this pass can hand out, since a site exists only once structuring has
+   *  decided both of its arms are real. Absent ⇒ the booleans alone decide, which is every caller
+   *  but the enumerating one; an ordinal past the last site is inert. */
+  branchSenseFlipSites?: ReadonlySet<number>;
   orderArgCopiesByWriteOrder?: boolean;
   /** Order a measured edge's ACYCLIC copy set by the def-position proxy instead — the
    *  `/copy-defpos` ranked sibling of the write-order spelling (rank.ts). A CYCLIC set keeps the
@@ -1023,20 +1387,40 @@ export interface StructureOptions {
    *  on an unmeasured pred, where the proxy is already what runs. */
   preferDefPosCopyOrder?: boolean;
   // Comparison-tree switch recovery: treat an `x != K` test as a case (the EQUAL side is a case
-  // body). GCC freely uses `!=`; IDO prefers `==`/`<`. A per-compiler DATA lever, not an `arch ==`
+  // body). GCC freely uses `!=`; IDO prefers `==`/`<`. A compiler behavior, not an `arch ==`
   // branch — default true (permissive; the decline path keeps it sound either way).
   switchAllowsNeqCase?: boolean;
   // Comparison-tree switch recovery: treat a relational test whose BRANCH admits exactly one
-  // scrutinee value as that case rather than as navigation. A per-compiler DATA lever declared in
+  // scrutinee value as that case rather than as navigation. A compiler behavior declared in
   // TargetDescription.compilerBehaviors — a compiler opts in on evidence that its dispatch jumps
   // straight to a bounded subtree's body. Default false: absent, every relational edge navigates.
   switchAllowsBoundCase?: boolean;
   // Comparison-tree switch recovery: emit the case arms in the order the ASSEMBLY lays their
-  // bodies out, rather than sorted by ascending case value. A per-compiler DATA lever declared in
+  // bodies out, rather than sorted by ascending case value. A compiler behavior declared in
   // TargetDescription.compilerBehaviors — a compiler opts in on evidence that it neither reorders
   // basic blocks nor schedules across them, so the layout it produced IS the order the source
   // wrote. Default false: absent, the arms keep the ascending spelling.
   switchArmsFollowLayout?: boolean;
+  // Comparison-tree switch recovery: DECLINE a tree whose own layout interleaves a test block with
+  // a case body, on the reading that the source wrote an if/else-if LADDER there and not a
+  // `switch`. Regime A otherwise recovers a `switch` from any comparison tree it can, so a ladder
+  // and a `switch` over the same values produce the SAME candidate and the differ never sees the
+  // ladder — there is nothing in the fan for it to prefer.
+  //
+  // The two spellings are different objects. Compiled at agbcc's canonical flags the same two-case
+  // body is 20 bytes either way (0x14, ten Thumb instructions — the pair is committed as
+  // `corpus/agbcc-sw{frontload,ladder}.s`) and disagrees instruction for instruction: the `switch` emits
+  // `cmp #0x1e; beq` then `cmp #0x64; bne` — both tests ahead of both bodies, and sorted ASCENDING,
+  // which is the reverse of the order the source writes them in — while the ladder emits
+  // `cmp #0x64; bne` directly above its own body and reaches `cmp #0x1e` only after it.
+  //
+  // Read PER SITE off the recovery's own blocks — a function may hold one of each — and it
+  // inherits `layoutIndex`'s frontend premise (see switch-recover.ts PRE5, which also states what
+  // the gate costs when the premise fails: the `switch` spelling, never correctness — and what a
+  // lost spelling actually looks like, which on a NESTED tree is an `if` nest around a `switch`
+  // over some of the arms, not a clean ladder).
+  // Default false: absent, every recoverable tree is still spelled as a `switch`.
+  switchRequiresFrontLoadedTests?: boolean;
   // Does the TARGET LANGUAGE spell a `switch` arm that runs on into the next one? Set from the
   // caller's LanguageBackend (`spellsSwitchFallthrough`), not from the compiler target: it is a
   // property of what the emitted source may say, and the only reason the structurer needs it is
@@ -1044,7 +1428,7 @@ export interface StructureOptions {
   // to if-recovery when it is false; Regime B, having no fallback, fails loud. Default true.
   spellSwitchFallthrough?: boolean;
   // Which way this compiler hands out frame slots against DECLARATION RANK: `ascending` = the
-  // earlier-declared spilled local takes the LOWER `[sp,#k]`. A per-compiler DATA lever declared
+  // earlier-declared spilled local takes the LOWER `[sp,#k]`. A compiler behavior declared
   // in TargetDescription.compilerBehaviors, carried to the backend on `SFn.slotOrder` and applied
   // by `l3/slotorder.ts` at emit time. ABSENT means the ordering refuses — there is no default
   // direction, because a wrong one reorders declarations for no reason.
@@ -1057,26 +1441,26 @@ export interface StructureOptions {
   // (target.ts), which is where the target-to-structurer mapping lives.
   spillSlotOrder?: 'ascending' | 'descending';
   // Commutative load pairs re-spell in def (evaluation) order — see the swap in lowerDef. Default
-  // true; verified byte-exact on agbcc and IDO. A per-compiler DATA lever declared in
+  // true; verified byte-exact on agbcc and IDO. A compiler behavior declared in
   // TargetDescription.compilerBehaviors: the first compiler whose scheduler is shown re-ordering
   // independent loads flips it there, not in a code branch. A per-FUNCTION machine-order fallback
   // candidate is deliberately deferred until a row demands it.
   defOrderLoadPairs?: boolean;
   // Anchor a constant merge copy at its const op's ORIGINAL position instead of at the CFG edge:
   // `movs r9, #0` at entry ahead of a single-armed overwrite emits as a pre-initialization above
-  // the `if`, not as its else-arm. A differ-refereed candidate axis (rank.ts `/defsite`), never a
+  // the `if`, not as its else-arm. A differ-refereed candidate variation (rank.ts `/defsite`), never a
   // default — see the refusal conditions where it is computed.
   anchorConstCopies?: boolean;
   // WIDEN `anchorConstCopies` to a LOOP HEADER's entry constant — `int s = 0;` hoisted above the
   // `if` that guards the loop, rather than written on the edge into it. A second placement
-  // decision, so a second axis point (rank.ts `/defsite/loop-entry`) rather than a widening of
+  // decision, so a second structure setting (rank.ts `/defsite/loop-entry`) rather than a widening of
   // the first: on a function carrying both kinds of anchorable const, folding them into one flag
   // would make "anchor the plain ones, leave the loop's at its edge" — a spelling `/defsite`
   // emits today — unreachable. Inert unless `anchorConstCopies` is also on.
   //
-  // AN AXIS RATHER THAN AN EXTENSION OF `l3/initfirst.ts`, whose header opens on the same rewrite
+  // A VARIATION RATHER THAN AN EXTENSION OF `l3/initfirst.ts`, whose header opens on the same rewrite
   // (`if (0 < n) { v = 0; … }` → `v = 0; if (v < n) { … }`) at a fraction of the price: a
-  // re-spelling adds candidates only where it fires, while this multiplies every candidate below
+  // respell variation adds candidates only where it fires, while this multiplies every candidate below
   // it. The fork is REACH, and it is a hard one. `initfirst` MOVES A STATEMENT, and an edge copy
   // is not a statement — structuring mints it, choosing between the edge and the const op's own
   // position, and the IR that holds those positions is gone by the time L3 runs. So the shapes
@@ -1084,26 +1468,34 @@ export interface StructureOptions {
   // re-spelling wants an ELSE-LESS `if` and rewrites the condition to read the hoisted variable
   // (`if (v < n)`), where anchoring leaves the condition alone, so the two emit different sources.
   // Measured, not argued: `/initfirst` rides every spelling rank.ts enumerates, so it is scored on
-  // every benchmark row already, and on each row this axis wins its `/initfirst`-only sibling is
+  // every benchmark row already, and on each row this variation wins its `/initfirst`-only sibling is
   // either not enumerated at all or not byte-identical to the anchored source — the substitution
-  // reaches none of them. Take the axis only while rows demand that; the price is in rank.ts.
+  // reaches none of them. Take the variation only while rows demand that; the price is in rank.ts.
   anchorLoopEntryConsts?: boolean;
   // HARDWARE fact from TargetDescription.capabilities.endianness, threaded by structureOptionsFor:
   // the bitfield extract recognizer solves an LSB-first equation, so it only runs on little-endian
   // data. The provider already refuses to EMIT bitfield facts for a big-endian ELF; this is the
   // same boundary enforced on core's side, against a hand-built map that never went through it.
   littleEndian?: boolean;
+  // HARDWARE fact from TargetDescription.capabilities.deviceRegisters, threaded by
+  // `structureOptionsFor` like `littleEndian` above: the half-open byte window whose cells are
+  // hardware registers rather than objects a source declares. The structurer asks it the same
+  // question its four other readers ask — "would a source have spelled this address `volatile`" —
+  // so it may be approximate: it decides a SPELLING, not a memory model (that is
+  // `deviceMemoryWriters`, which no structurer rule reads). Used as a REFUSAL: absent, a dead read
+  // at a literal address is dropped.
+  deviceRegisters?: readonly [number, number];
   // Spell `(x << a) >> b` extracts of a struct global as the map's named bitfield member. On by
-  // default; rank.ts enumerates the OFF spelling as the `/no-bitfield` axis, because the named
+  // default; rank.ts enumerates the OFF spelling as the `/no-bitfield` variation, because the named
   // read recompiles at the DECLARATION's access width — where that diverges from the asm's load
   // width the honest shift spelling is the one that matches, and the differ referees. Only the map
   // carries the names, so with no `symbols` this is normalized to false whatever a caller passes.
   spellBitfieldMembers?: boolean;
   // Spell an element-scaled offset through a map-declared POINTER MEMBER as a whole-element
   // subscript of it (`gBg.pMap[i + 157]`) rather than as the byte arithmetic it replaces. On by
-  // default; rank.ts enumerates the OFF spelling as the `/no-ptr-elem` axis.
+  // default; rank.ts enumerates the OFF spelling as the `/no-ptr-elem` variation.
   //
-  // IT IS AN AXIS AND NOT A DEFAULT BECAUSE IT IS NOT BYTE-NEUTRAL — the bar the block comment
+  // IT IS A VARIATION AND NOT A DEFAULT BECAUSE IT IS NOT BYTE-NEUTRAL — the bar the block comment
   // above `spellablePointee` sets for a member spelling. Compiled against agbcc (`-mthumb-interwork -Wimplicit -O2 -fhex-asm
   // -fprologue-bugfix`), `((u16 *)gB.pMap)[i + K]` and `*(u16 *)((i << 1) + (u8 *)gB.pMap + 2K)`
   // are the same address and the same instruction COUNT at K = 0, 1 and 157 — and different
@@ -1114,9 +1506,9 @@ export interface StructureOptions {
   // Recover a multidimensional array global's DECLARED subscripts (`g[r][i]`) from a byte residual
   // carrying a term at the declared ROW stride, rather than spelling the whole residual as the
   // `*(T *)(… + (u32)&g)` cast it replaces. On by default; rank.ts enumerates the OFF spelling as
-  // the `/flat-rank` axis.
+  // the `/flat-rank` variation.
   //
-  // IT IS AN AXIS AND NOT A DEFAULT BECAUSE THE ASM DOES NOT DETERMINE IT, and the evidence that
+  // IT IS A VARIATION AND NOT A DEFAULT BECAUSE THE ASM DOES NOT DETERMINE IT, and the evidence that
   // it does not is the same compile the recovery's own premise rests on, read against the spelling
   // the recovery DISPLACES rather than against the flat one it refuses. For `u16 g[4][0x400]`:
   //
@@ -1131,7 +1523,7 @@ export interface StructureOptions {
   //                   own premise is false and the flat spelling reaches it too.
   //
   // WHICH ROW OF THAT TABLE IS PINNED: the agbcc pair, by
-  // packages/cli/test/matching/array-rank-axis.test.ts, which compiles both spellings through the
+  // packages/cli/test/matching/array-rank-variation.test.ts, which compiles both spellings through the
   // klonoa checkout's own template. The other three were measured by hand and nothing re-runs
   // them, so treat them as the record of a measurement rather than as a live check.
   //
@@ -1140,34 +1532,34 @@ export interface StructureOptions {
   spellDeclaredSubscripts?: boolean;
   // Let a read of a named global render at its use across writes that PROVABLY cannot reach it
   // (a store to a different named global), instead of caching it in a local. Off by default;
-  // rank.ts enumerates the ON spelling as the `/reread-globals` axis — see analysis.ts
-  // AnalyzeOptions for why this is a differ-refereed lever and not a fix.
+  // rank.ts enumerates the ON spelling as the `/reread-globals` variation — see analysis.ts
+  // AnalyzeOptions for why this is a differ-refereed variation and not a fix.
   rereadGlobals?: boolean;
   // Materialize a load that feeds a `cond_br` join arg, so the naming walk can home the join in
   // it and the identity arm elides to a one-sided in-place `if`. Off by default; rank.ts
-  // enumerates the ON spelling as the `/inplace` axis — see analysis.ts AnalyzeOptions.
+  // enumerates the ON spelling as the `/inplace` variation — see analysis.ts AnalyzeOptions.
   materializeJoinFeeds?: boolean;
   // Materialize a pure computed address shared by 2+ memory accesses, and the multi-render loads
   // through it, reproducing the source's pointer-local + scalar-temp spelling. Off by default;
-  // rank.ts enumerates the ON spelling as the `/addr-home` axis — see analysis.ts AnalyzeOptions.
+  // rank.ts enumerates the ON spelling as the `/addr-home` variation — see analysis.ts AnalyzeOptions.
   homeSharedAddresses?: boolean;
   // Materialize a pure value with 2+ distinct consumers, at least one of them inside a loop the
   // def sits outside — the register the compiler holds across the iterations. Off by default;
-  // rank.ts enumerates the ON spelling as the `/expr-home` axis — see analysis.ts AnalyzeOptions.
+  // rank.ts enumerates the ON spelling as the `/expr-home` variation — see analysis.ts AnalyzeOptions.
   homeLoopExprs?: boolean;
   // Materialize a pure value with 2+ consumers standing on a memory read — the register the asm
   // carried the DERIVED value in, where the read's own home is a register that died at the
-  // computation. Off by default; rank.ts enumerates the ON spelling as the `/derived-home` axis —
+  // computation. Off by default; rank.ts enumerates the ON spelling as the `/derived-home` variation —
   // see analysis.ts AnalyzeOptions.
   homeDerivedReads?: boolean;
   // Materialize a pure value that one join's incoming edges render into the SAME parameter slot
   // from 2+ places — the value the source computed once above the branch and the copy machinery
   // sinks into every arm. Off by default; rank.ts enumerates the ON spelling as the `/merge-home`
-  // axis — see analysis.ts AnalyzeOptions.
+  // variation — see analysis.ts AnalyzeOptions.
   homeMergeFeeds?: boolean;
   // Emit a memory read as a named temp in ITS OWN block when every place it renders sits in a
-  // block that block strictly dominates. A per-compiler DATA lever (TargetDescription
-  // .compilerBehaviors), not a differ-refereed axis: where the compiler has neither a scheduler
+  // block that block strictly dominates. A compiler behavior (TargetDescription
+  // .compilerBehaviors), not a differ-refereed variation: where the compiler has neither a scheduler
   // nor a code hoister, the sunk spelling is one it could not have emitted from this asm, so there
   // is nothing to referee. Absent ⇒ off — the target field carries the evidence a compiler owes,
   // analysis.ts AnalyzeOptions the refusals.
@@ -1177,23 +1569,27 @@ export interface StructureOptions {
   // needs signed. Off by default: a signed spelling that byte-matched was PROVED non-negative by
   // the compiler (it emits the unsigned branch from signed compares only then), so which spelling
   // the source used is genuinely ambiguous at emission — rank.ts enumerates the ON spelling as
-  // the `/uns-cmp` axis and the differ referees.
+  // the `/uns-cmp` variation and the differ referees.
   unsignedCompareSpelling?: boolean;
   // Merge two variables that a merge copy would join, when the values under them never interfere
   // (structure/namecoalesce.ts). Off by default; rank.ts enumerates the ON spelling as the
-  // `/merge-names` axis. Which variables the compiler's own coalescer shared is not derivable from
+  // `/merge-names` variation. Which variables the compiler's own coalescer shared is not derivable from
   // the naming, and removing a copy is worth less than it looks — the compiler coalesces most of
   // them itself. What moves the score is which values share a register, and that splits per
   // function.
   coalesceMergeNames?: boolean;
   // Give a merge whose carrier is a FUNCTION PARAMETER its own local, instead of assigning back
   // into the parameter's name. Off by default; rank.ts enumerates the ON spelling as the
-  // `/fresh-merge` axis, and `FRESH_MERGE_GATES` holds the admission and the argument for it.
+  // `/fresh-merge` variation, and `FRESH_MERGE_GATES` holds the admission and the argument for it.
   //
-  // NOT `materializeJoinFeeds` widened to parameters. That axis reaches its shape by giving the
+  // NOT `materializeJoinFeeds` widened to parameters. That variation reaches its shape by giving the
   // join's feed a NAME to adopt, and materialization is keyed on the defining `Op` — a parameter
   // has none, so there is nothing to key.
   freshParamMerge?: boolean;
+  // Give a DIVERGENT `if` — one whose arms reach no common block before EXIT — the follow its
+  // non-returning paths share: `followOverReturns` below. Absent, such an `if` keeps its arms
+  // divergent and a region both of them reach is emitted in each.
+  followEarlyReturns?: boolean;
   // How an unresolvable VALUE degrades (a live `opaque`, an unlowered transient op, a dropped def):
   //   "strict"   (default) — the `"?"` sentinel, tripping assertResolved at the boundary (loud in
   //              the PROCESS);
@@ -1213,7 +1609,7 @@ export interface StructureOptions {
    *  A SEPARATE FIELD rather than a pre-merged map, and the separation is load-bearing twice.
    *  `spellBitfieldMembers` is normalized against `symbols` alone, so a derived shape can never
    *  switch the named-bitfield spelling on for a map-less row (which would silently delete the
-   *  `/no-bitfield` axis's decline — see bitfield-members.test.ts). And it keeps the derivation
+   *  `/no-bitfield` variation's decline — see bitfield-members.test.ts). And it keeps the derivation
    *  ATTRIBUTABLE: everything the map does stays keyed on the map. */
   inferredSymbols?: Map<string, SymbolInfo>;
   /** THE ORDER HALF of the same derivation (raise/globalshape.ts `orderLicensedGlobals`): the
@@ -1273,13 +1669,27 @@ export interface StructureHooks {
   nameCoalesceGates?: readonly Gate<NameMerge>[];
   /** `freshParamMerge`'s admission rules, ablatable the same way. */
   freshMergeGates?: readonly Gate<FreshMergeCarrier>[];
+  /** `canTakeName`'s admission rules — which name a block parameter may be spelled with. Every
+   *  entry is sound, so this exists for the differential test that drops one and watches the
+   *  emitted program change, never for a shipped ablation. */
+  carrierNameGates?: readonly Gate<CarrierName>[];
+  /** `enclosingCarrierName`'s admission rules (`ENCLOSING_CARRIER_GATES`), ablatable the same way —
+   *  and, wrapped in `tallying`, the census of which rule refuses a nest. */
+  enclosingCarrierGates?: readonly Gate<EnclosingCarrier>[];
+  /** Every branch-sense site this structuring reached, in emission order: the block index
+   *  `StructureOptions.branchSenseFlipSites` names, whether the site is JOINED or divergent, and
+   *  which sense it actually emitted. The enumeration domain — a site only exists once structuring
+   *  has decided both arms are real, so it cannot be computed ahead of the pass. */
+  onBranchSenseSite?: (site: { block: number; ordinal: number; joined: boolean; negated: boolean }) => void;
+  /** Every divergent `if` `followEarlyReturns` gave a follow: the `if`'s block and the follow's. */
+  onEarlyReturnFollow?: (site: { block: number; follow: number }) => void;
 }
 
 /** A CANDIDATE SPELLING MUST NEVER UNLOCK A FUNCTION THE PRIMARY DECLINES. `varName` is not only
  *  how values are spelled — the loop emitters' hazard predicates read it, and several ask "does
  *  this edge copy survive identity elision", which merging two names quietly answers `no`. A pass
  *  that made a hazard invisible would trade a loud decline for a silent wrong answer, so the
- *  lever-less structuring runs first and its refusal stands. That is the whole invariant, rather
+ *  structuring with no variation on runs first and its refusal stands. That is the whole invariant, rather
  *  than a list of individually patched guards, and it costs one extra structuring — nothing next to
  *  the compile the candidate exists to feed.
  *
@@ -1287,7 +1697,7 @@ export interface StructureHooks {
  *
  *  SCOPE: refusals thrown by `structure()` itself. A decline can also come from `structureChecked`'s
  *  boundary contracts, which run OUTSIDE it — `rank.ts` closes that half, where the contracts are. */
-function assertPrimaryAccepts(fn: Fn, opts: StructureOptions, hooks: StructureHooks): void {
+function assertDefaultAccepts(fn: Fn, opts: StructureOptions, hooks: StructureHooks): void {
   structure(
     fn,
     {
@@ -1301,6 +1711,7 @@ function assertPrimaryAccepts(fn: Fn, opts: StructureOptions, hooks: StructureHo
       homeMergeFeeds: false,
       anchorConstCopies: false,
       anchorLoopEntryConsts: false,
+      followEarlyReturns: false,
     },
     hooks,
   );
@@ -1316,6 +1727,58 @@ interface EarlyReturnArmDeps {
 function isRet(blk: Block): boolean {
   return blk.ops[blk.ops.length - 1]?.opcode === 'ret';
 }
+/** The `ret`s reachable from BOTH successors of `b` — the region `followEarlyReturns` keeps. Empty
+ *  when there is none, and when `b` does not branch two ways. `reachFrom` is forward reachability,
+ *  the start block excluded. */
+function sharedRetsOf(b: Block, reachFrom: (x: Block) => ReadonlySet<Block>): Block[] {
+  const [s1, s2] = b.ops[b.ops.length - 1]?.opcode === 'cond_br' ? successorsOf(b) : [];
+  if (s1 === undefined || s2 === undefined || s1 === s2) {
+    return [];
+  }
+  const retsFrom = (x: Block): Block[] => [x, ...reachFrom(x)].filter(isRet);
+  const fromS2 = new Set(retsFrom(s2));
+  return retsFrom(s1).filter((r) => fromS2.has(r));
+}
+/** Is there an `if` whose arms reach no common block before EXIT but share a `ret` — the only shape
+ *  `followEarlyReturns` changes? The enumeration gate of both shared-tail twins (rank.ts), asked of
+ *  the fn as raised and again of the sunk fn; a superset, since it asks `sharedRetsOf` and none of
+ *  the follow's three later refusals. */
+export function hasDivergentSharedRet(fn: Fn): boolean {
+  const ipdom = postDominators(fn);
+  const reach = new Map<Block, Set<Block>>();
+  const reachFrom = (b: Block): Set<Block> => {
+    let out = reach.get(b);
+    if (out === undefined) {
+      out = new Set<Block>();
+      for (const stack = successorsOf(b); stack.length;) {
+        const x = stack.pop()!;
+        if (!out.has(x)) {
+          out.add(x);
+          stack.push(...successorsOf(x));
+        }
+      }
+      reach.set(b, out);
+    }
+    return out;
+  };
+  return fn.blocks.some((b) => ipdom.get(b) === null && sharedRetsOf(b, reachFrom).length > 0);
+}
+/** does a path from `from` reach `to` without passing through `avoid`? */
+function reachesAvoiding(from: Block, to: Block, avoid: Block): boolean {
+  const seen = new Set<Block>([avoid]);
+  const stack = successorsOf(from);
+  while (stack.length) {
+    const x = stack.pop()!;
+    if (x === to) {
+      return true;
+    }
+    if (!seen.has(x)) {
+      seen.add(x);
+      stack.push(...successorsOf(x));
+    }
+  }
+  return false;
+}
 // An early `return` out of the loop: forward-walking from `to` WITHOUT re-entering the loop `body`,
 // every path terminates in a `ret`. agbcc/gcc merge every `return` into ONE epilogue block and each
 // return site just sets the return register and branches there, so a second body exit that lands on
@@ -1392,11 +1855,14 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     coalesceLoopInit = false,
     preserveDivergentBranchSense = true,
     negateJoinedBranchSense = preserveDivergentBranchSense,
+    branchSenseFlipSites,
+    senseFromFoldEvidence = false,
     orderArgCopiesByWriteOrder = true,
     preferDefPosCopyOrder = false,
     switchAllowsNeqCase = true,
     switchAllowsBoundCase = false,
     switchArmsFollowLayout = false,
+    switchRequiresFrontLoadedTests = false,
     spellSwitchFallthrough = true,
     spillSlotOrder,
     defOrderLoadPairs = true,
@@ -1416,6 +1882,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     unsignedCompareSpelling = false,
     coalesceMergeNames = false,
     freshParamMerge = false,
+    followEarlyReturns = false,
     onGap = 'strict',
     symbols: mapSymbols,
     inferredSymbols,
@@ -1432,29 +1899,32 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           has: (n) => mapSymbols?.has(n) === true || inferredSymbols?.has(n) === true,
         }
       : undefined;
-  // Only the MAP makes the named bitfield spelling available, so with no map this is not a choice.
+  // Only the MAP makes the named bitfield spelling available, so with no map this is not a question.
   // Normalized once here rather than left to each reader's own `symCtx &&` guard, because rank.ts's
   // `/no-bitfield` decline rests on both arms structuring the IDENTICAL tree without a map — a
   // second reader added outside that guard would otherwise delete a candidate silently, and nothing
   // reports a candidate that was never enumerated (bitfield-members.test.ts).
   // Against the PROJECT MAP alone, never the derived shapes: only a map carries bitfield members,
-  // and keying this on the union would flip the `/no-bitfield` axis's zero point on a map-less row.
+  // and keying this on the union would flip the `/no-bitfield` variation's zero point on a map-less row.
   const spellBitfieldMembers = mapSymbols !== undefined && bitfieldSpellingWanted;
-  // These levers all change which edge copies elide as identities (extra materialization does
+  // These options all change which edge copies elide as identities (extra materialization does
   // too), which the loop emitters' hazard predicates read — so the invariant above covers each.
-  // A per-compiler DEFAULT is not among them, however much it materializes: the primary IS this
-  // target's defaults, so resetting one would probe a spelling asmlift never emits here.
+  // A compiler behavior is not among them, however much it materializes: the default structuring
+  // IS this target's compiler behaviors, so resetting one would probe a spelling asmlift never emits
+  // here.
   //
-  // THREE OF rank.ts's TEN `STRUCTURING_AXES` ARE DELIBERATE NON-MEMBERS, each for its own reason,
-  // and the list here is the half of the split this side owns:
+  // FOUR OF THE ELEVEN `STRUCTURE_VARIATIONS` ENTRIES (rank-variations.ts) ARE DELIBERATE NON-MEMBERS,
+  // each for its own reason, and the list here is the half of the split this side owns:
+  //   - `/site-sense` (senseFromFoldEvidence) decides which way each folded branch is written. It
+  //     negates a branch sense per site and touches no copy, like the per-function sense booleans;
   //   - `/reread-globals` (rereadGlobals) is an ANALYSIS option, and it only ever RELAXES: it
   //     widens a load's render positions and narrows the write set that bars it, so it removes
   //     materializations rather than minting them. Extra materialization is what this guard is
-  //     about (see above), and this axis adds none;
+  //     about (see above), and this variation adds none;
   //   - `/uns-cmp` (unsignedCompareSpelling) writes `varType` and inserts casts at compares. It
   //     touches no name and no copy, so no edge copy changes its elision under it;
   //   - `/copy-defpos` (preferDefPosCopyOrder) REORDERS the copies of one edge and adds or drops
-  //     none. rank.ts states the same thing from the axis side, in the terms that matter there: a
+  //     none. rank.ts states the same thing from the variation side, in the terms that matter there: a
   //     reordering cannot rescue a spelling whose OFF sibling failed the boundary contracts.
   if (
     coalesceMergeNames ||
@@ -1464,15 +1934,24 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     homeLoopExprs ||
     homeDerivedReads ||
     homeMergeFeeds ||
-    anchorConstCopies
+    anchorConstCopies ||
+    followEarlyReturns
   ) {
-    assertPrimaryAccepts(fn, opts, hooks);
+    assertDefaultAccepts(fn, opts, hooks);
   }
   const defs = defOpMap(fn);
   const preds = predecessorBlocks(fn);
   const ipdom = postDominators(fn);
   const dom = dominators(fn);
 
+  /** The byte step `raise/const.ts` recorded on the literal that feeds this access's address, or
+   *  `undefined` where the address was not reached by advancing a register. Read at the two
+   *  `memAccess` call sites, which are where an IR value becomes an L3 access node. */
+  const advanceStepOf = (base: Value): number | undefined => {
+    const step = defs.get(base)?.attrs.advancedBy;
+    return typeof step === 'number' ? step : undefined;
+  };
+
   // ── analysis phase (structure/analysis.ts): use registry, liveness, materialization ──
   const { useSitesOf, opIndex, opBlock, liveIn, materialize, reachFrom, emitPos, memWriteBetween } = analyze(
     fn,
@@ -1495,6 +1974,54 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     },
   );
 
+  // THE FOLLOW OF A DIVERGENT `if`, over the paths that do not return early. Post-dominance gives
+  // such an `if` no join — its arms reach two different `ret`s, and EXIT is the only block on every
+  // path — so each arm is structured to its end and a region both arms reach is emitted in both.
+  // When the compiler emitted that region ONCE, the source can have written it once, after the
+  // `if`, with every other path into a `ret` an early `return;` — `synthetic:gcseinner`, where
+  // agbcc keeps the `fnA` arm's own `ret` and stores the default once. An option, enumerated as
+  // rank.ts's `/shared-ret` twin, and as its `/shared-tail` twin after the store-tail sink: as a
+  // default it costs rows, measured there.
+  //
+  // WHICH REGION: the `ret`s reachable from BOTH successors. Every block that cannot reach one of
+  // them is an early-return region and is deleted; the follow is `b`'s post-dominator over what is
+  // left. Sound for the same reason an ordinary follow is: every kept path from `b` passes it, and a
+  // deleted block reaches no kept `ret` and so never the follow, so each arm structures up to the
+  // follow or into a `return`. And no deleted region is reachable from both arms — its `ret` would
+  // then be one of the shared ones — so the rule duplicates nothing across the arms.
+  //
+  // PER `if`, never function-wide: the deletion set is a function of that `if`'s own shared `ret`s
+  // (memoized on them), because a nested `if` shares a different set, or none.
+  //
+  // REFUSES (keeping the divergent arms) when no `ret` is reachable from both successors, when the
+  // kept graph gives `b` no post-dominator but EXIT, and when the enclosing region's `stop` is
+  // reachable from `b` without passing the follow — that path must reach `stop`, and structuring
+  // the arms towards a different follow would emit `stop`'s region inside an arm. The caller asks
+  // only outside a loop body.
+  const followsByShared = new Map<string, Map<Block, Block | null>>();
+  const followOverReturns = (b: Block, stop: Block | null): Block | null => {
+    const shared = sharedRetsOf(b, reachFrom);
+    if (shared.length === 0) {
+      return null;
+    }
+    const key = shared
+      .map((r) => fn.blocks.indexOf(r))
+      .sort((x, y) => x - y)
+      .join(',');
+    let pd = followsByShared.get(key);
+    if (pd === undefined) {
+      const keep = new Set(fn.blocks.filter((x) => shared.some((r) => r === x || reachFrom(x).has(r))));
+      pd = postDominators(fn, keep);
+      followsByShared.set(key, pd);
+    }
+    const follow = pd.get(b) ?? null;
+    if (follow === null || (stop !== null && follow !== stop && reachesAvoiding(b, stop, follow))) {
+      return null;
+    }
+    hooks.onEarlyReturnFollow?.({ block: fn.blocks.indexOf(b), follow: fn.blocks.indexOf(follow) });
+    return follow;
+  };
+
   // SCALAR-vs-AGGREGATE globals: a `gaddr` symbol accessed EXCLUSIVELY at offset 0 is a scalar
   // global → the bare name `gSym` (byte-exact, matches the source). A symbol accessed at any
   // non-zero offset (or via a variable index) is an array/struct global → EVERY access uses the
@@ -1972,12 +2499,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // AND THE CONVERSE: the name must not be WRITTEN anywhere `p` itself is live. Every other
   // block param under the name is such a write — its in-edge copies execute at each
   // predecessor's end, and a LOOP header's update copy is emitted inside the loop body, where it
-  // also runs on the final (exiting) iteration — so the test is `p` live into the writer's block
-  // OR live out of any of its predecessors (the conservative union covers that placement). A
-  // materialized def under the name writes at its own block. This applies even to a
-  // redundant-phi alias (`pureAlias` waives only the value-at-B check: aliasing is sound at B's
-  // entry, but a later write to the shared name still splits them — e.g. a saved pre-increment
-  // `i` read post-loop).
+  // also runs on the final (exiting) iteration — so the test is `p` live out of any of the writing
+  // block's predecessors, the conservative union that covers that placement. A materialized def
+  // under the name writes at its own block. This applies even to a redundant-phi alias
+  // (`pureAlias` waives only the value-at-B check: aliasing is sound at B's entry, but a later
+  // write to the shared name still splits them — e.g. a saved pre-increment `i` read post-loop).
+  //
+  // EXCEPT WHERE THE WRITE STORES `p`. A predecessor all of whose edges hand that slot `p` itself
+  // writes `name = name` once the two share the name, so it stores nothing to clobber and
+  // relocating it reaches nowhere. That predecessor is a loop's own accumulator update, and
+  // without the exception the rule calls a value a clobber of itself.
   const paramBlock = new Map<Value, Block>();
   for (const blk of fn.blocks) {
     for (const pv of blk.params) {
@@ -2006,44 +2537,54 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // admitted it — a silent wrong answer, not a worse score. At 32 bits the two spellings ARE the
   // same bytes at a read, which is the mismatch `structure/namecoalesce.ts`'s header names and this
   // rule deliberately still tolerates.
-  const canTakeName = (p: Value, B: Block, name: string, pureAlias = false): boolean => {
-    if (carrierWidth(varType.get(name)) !== carrierWidth(p.type)) {
-      return false;
-    }
-    if (carrierSign(varType.get(name)) !== carrierSign(p.type)) {
-      return false;
-    }
-    if (B.params.some((q) => q !== p && varName.get(q) === name)) {
-      return false;
-    }
+  //
+  // THE RULES ARE A TABLE (`CARRIER_NAME_GATES`), so each one can be dropped and the pass re-run on
+  // real input — see docs/level-tower.md. What is computed here is the EVIDENCE; which evidence
+  // refuses is the table's to say.
+  const carrierScan = (p: Value, B: Block, name: string): { carrierLive: boolean; carrierWritten: boolean } => {
     const lin = liveIn.get(B)!;
+    let carrierLive = false;
+    let carrierWritten = false;
     for (const [v, n] of varName) {
       if (n !== name || v === p) {
         continue;
       }
-      if (!pureAlias && lin.has(v)) {
-        return false;
-      } // v still live at B → p's copies clobber it
+      carrierLive ||= lin.has(v); // v still live at B → p's copies clobber it
       const wblk = paramBlock.get(v);
       if (wblk && wblk !== entry) {
-        // v is a param → `name` written at wblk's edges
-        if (liveIn.get(wblk)!.has(p)) {
-          return false;
+        // v is a param → `name` is written by the in-edge copies into wblk, and by any relocation
+        // of one of them. AN EDGE THAT HANDS THIS SLOT `p` ITSELF IS NOT A WRITE: once the two
+        // share the name the copy reads `name = name`, so it stores nothing to clobber and
+        // relocating it reaches nowhere. Per PREDECESSOR rather than per edge, because the
+        // relocation is a property of the predecessor's placement — a terminator with two edges
+        // into wblk is exempt only if BOTH hand it `p`.
+        const slot = wblk.params.indexOf(v);
+        const storesOther = new Map<Block, boolean>();
+        for (const { pred, succ } of inEdgeRecords(preds, wblk)) {
+          storesOther.set(pred, (storesOther.get(pred) ?? false) || succ.args[slot] !== p);
         }
-        for (const pr of preds.get(wblk) ?? []) {
+        for (const [pr, other] of storesOther) {
+          if (!other) {
+            continue;
+          }
           for (const s of successorsOf(pr)) {
-            if (liveIn.get(s)!.has(p)) {
-              return false;
-            }
+            carrierWritten ||= liveIn.get(s)!.has(p);
           }
         }
       }
       const d = defs.get(v);
-      if (d && materialize.has(d) && liveIn.get(opBlock.get(d)!)!.has(p)) {
-        return false;
+      carrierWritten ||= !!d && materialize.has(d) && liveIn.get(opBlock.get(d)!)!.has(p);
+      if (carrierLive && carrierWritten) {
+        break;
       }
     }
-    // AND A VALUE NOBODY NAMED IS STILL A READER OF THIS NAME. The loop above asks which NAMED
+    return { carrierLive, carrierWritten };
+  };
+  const canTakeName = (p: Value, B: Block, name: string, pureAlias = false): boolean => {
+    const lin = liveIn.get(B)!;
+    let scan: ReturnType<typeof carrierScan> | undefined;
+    const scanned = (): ReturnType<typeof carrierScan> => (scan ??= carrierScan(p, B, name));
+    // AND A VALUE NOBODY NAMED IS STILL A READER OF THIS NAME. `carrier-live` asks which NAMED
     // values are live at `B`; an unnamed one is not stored anywhere, it is RE-DERIVED at its use
     // from whatever its operands are called then — so a value live into `B` whose inlined
     // expression mentions `name` reads the merge's assignment instead of what it was defined from.
@@ -2052,29 +2593,41 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // computes 10 — agbcc emits exactly that asm, so this is not a generated-IR curiosity. The
     // walk stops at any value with a name of its own (it reads THAT name) and at a materialized
     // def (it is assigned at its own position, which the clause above already judges).
-    if (!pureAlias) {
-      const reDerives = (w: Value, seen: Set<Value>): boolean => {
-        if (w === p || seen.has(w)) {
-          return false;
-        }
-        seen.add(w);
-        const nm = varName.get(w);
-        if (nm !== undefined) {
-          return nm === name;
-        }
-        const d = defs.get(w);
-        if (!d || materialize.has(d)) {
-          return false;
-        }
-        return d.operands.some((o) => reDerives(o, seen));
-      };
-      for (const w of lin) {
-        if (reDerives(w, new Set())) {
-          return false;
-        }
+    const reDerives = (w: Value, seen: Set<Value>): boolean => {
+      if (w === p || seen.has(w)) {
+        return false;
       }
-    }
-    return true;
+      seen.add(w);
+      const nm = varName.get(w);
+      if (nm !== undefined) {
+        return nm === name;
+      }
+      const d = defs.get(w);
+      if (!d || materialize.has(d)) {
+        return false;
+      }
+      return d.operands.some((o) => reDerives(o, seen));
+    };
+    return (
+      firstRejection(hooks.carrierNameGates ?? CARRIER_NAME_GATES, {
+        pureAlias,
+        widthDiffers: carrierWidth(varType.get(name)) !== carrierWidth(p.type),
+        signDiffers: carrierSign(varType.get(name)) !== carrierSign(p.type),
+        siblingHolds: B.params.some((q) => q !== p && varName.get(q) === name),
+        get carrierLive() {
+          return scanned().carrierLive;
+        },
+        get carrierWritten() {
+          return scanned().carrierWritten;
+        },
+        get reDerivesName() {
+          // NAMED live values are `carrier-live`'s, so the two rules stay disjoint and each one's
+          // ablation is its own claim. The walk itself still crosses into a named OPERAND, which
+          // is the whole point of it.
+          return [...lin].some((w) => !varName.has(w) && reDerives(w, new Set()));
+        },
+      }) === null
+    );
   };
   // Does the edge `pr -> b` hand `c` over as a loop variable's PRE-update value? True when `c` is a
   // loop header's own param and the edge leaves the loop from a latch of an emitter that places
@@ -2105,13 +2658,146 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     const k = header!.params.indexOf(c);
     return !!back && k >= 0 && back.args[k] !== c && !back.args.includes(c);
   };
+  // A NESTED LOOP'S CARRIED VALUE KEEPS THE NAME ITS ENCLOSING LOOP GAVE IT. `p`, a param of the
+  // inner header, is entered straight from the enclosing loop's header `E` with `E`'s own param —
+  // an accumulator (or any loop-carried value) crossing into the inner loop. Minting `p` a fresh
+  // name spells `v3 = v1; do { … v3 … } while (…); v1 = v3;`, and on agbcc that pair is two `mov`s
+  // the target does not contain. Whether the source had ONE variable or TWO is what the frontend's
+  // write-order record answers: `E` wrote nothing into `p`'s key, so the machine carried the value
+  // into the inner loop in the register it already had — there is no copy to reproduce.
+  //
+  // THE NARROW FORM OF A PROXY THAT WAS MEASURED AND LOST. `target.ts`'s MIPS_GCC note records the
+  // wide form — adopt the entry value's name whenever the forward predecessor did not write the
+  // param's key — moving 36 of 736 synthetic rows for four matches lost net, because a predecessor
+  // that COMPUTES the initial value into the param's own register writes the key and still
+  // coalesces. Here the argument is `E`'s own parameter, which `E` does not compute: `E` can write
+  // `p`'s key only by moving that value into it, which is the copy the two-variable spelling spells.
+  // So in this scope the record answers the question exactly, and the measured reach is 4 rows over
+  // the 1,036 of the corpus, all four moved toward the target.
+  //
+  // The argument above is an agbcc one (two `mov`s). The rule has no compiler gate, and it reaches
+  // no corpus row on any other toolchain (0 of the MIPS and PPC rows change), so for those the claim
+  // is UNMEASURED rather than established.
+  //
+  // THE REFUSALS ARE A TABLE (`ENCLOSING_CARRIER_GATES`, in table order), and then `canTakeName`'s.
+  // `p` keeps the seeding below when:
+  //   • `one-forward-entry` / `enclosing-header`: `p` has more than one forward predecessor, or its
+  //     one forward predecessor is not the header of a loop that strictly encloses `p`'s header.
+  //     That is a limit of the DATUM, not of the hazard: the record is keyed by successor params,
+  //     and a single-predecessor block has none, so it cannot say whether a block between `E` and
+  //     the inner header made the copy. It is also what holds the rule to the unguarded,
+  //     constant-trip nest: nestacc1 with its inner bound `j < 7` made `j < n` is entered through
+  //     its guard and keeps both copies (measured, agbcc). The register-key identity the MIPS_GCC
+  //     note names (`frontend/ssa.ts` `phiKey`) is the datum that would lift it;
+  //   • `enclosing-param`: the argument is not one of `E`'s own params (it is not `E`'s
+  //     loop-carried value);
+  //   • `key-written`: the frontend did not measure `E`, or measured it WRITING `p`'s key — the
+  //     copy the source spelled, which the fresh name reproduces;
+  //   • `carried-by-one-loop`: the value is not carried by BOTH loops (`carriedByBothLoops`, below).
+  //     The one SOUND rule of the five; the four above bound the evidence, and dropping one spells
+  //     a different program that is still correct;
+  //   • `canTakeName` refuses. With the clause above, these are the guards against the collision
+  //     `enclosingNames` excludes wholesale: a value of `E` still read after the inner loop is
+  //     `carrier-live`, and an unnamed one re-derived from it there (the outer update
+  //     `(u8)(v0 + 1)`) is `re-derives`. `canTakeName` alone is NOT enough — it reads `varName`
+  //     only, and sharing the name reaches two readers that are not in it.
+  //
+  // THE VALUE MUST BE CARRIED BY BOTH LOOPS — the per-site form of `structure/namecoalesce.ts`'s
+  // `loop-escape` premise. Sharing the name hands it to more values than `p`: the inner back edge's
+  // argument takes it through `backArgName` (unconditionally, in `seedLoopParams`), and `E`'s own
+  // back-edge argument for `a`'s slot takes it as the outer loop's un-rotation alias. If the outer
+  // back edge hands `a`'s slot something the inner loop did not produce, the outer update copy
+  // overwrites the name the inner loop's value is read under, and a merge after the loop that
+  // adopts that value's `backArgName` reads the outer value instead. That is the frozen
+  // `INNER_CLOBBERS_OUTER` pair (`fz5104`, `fz6437`, in `test/loop-escape-witnesses.ts`, replayed
+  // against this rule by `nested-carrier.test.ts`): given ONE realistic record fact — `E`
+  // did not write `p`'s key, nestacc1's own shape — the rule without this clause emits both as a
+  // different program, and nothing throws. So every in-edge of `E` from inside its loop must hand
+  // `a`'s slot either `a` (then `a` is live across the inner loop, and `carrier-live` refuses), `p`
+  // (what the name holds when a test-at-top `while` exits from its header; after a bottom-tested
+  // loop it is a pre-update read, the inner emitter's own hazard and the same one whichever name
+  // `p` has), an inner back-edge argument for `p`, or a merge every in-edge of which hands it one of
+  // those. One level of merge, not a closure: a deeper chain refuses, which costs reach and never
+  // soundness.
+  const carriedByBothLoops = (p: Value, i: number, header: Block, E: Block, a: Value): boolean => {
+    const outer = forest.byHeader.get(E);
+    const inner = forest.byHeader.get(header);
+    if (!outer || !inner) {
+      return false;
+    }
+    const carried = new Set<Value>([a, p]);
+    for (const { pred, succ } of inEdgeRecords(preds, header)) {
+      if (inner.body.has(pred)) {
+        carried.add(succ.args[i]);
+      }
+    }
+    const k = E.params.indexOf(a);
+    if (k < 0) {
+      return false; // not `E`'s loop-carried value — `enclosing-param`'s question, asked again
+    }
+    let backEdges = 0;
+    for (const { pred, succ } of inEdgeRecords(preds, E)) {
+      if (!outer.body.has(pred)) {
+        continue;
+      }
+      backEdges++;
+      const r = succ.args[k];
+      if (carried.has(r)) {
+        continue;
+      }
+      const rb = paramBlock.get(r);
+      if (rb === undefined || rb === entry) {
+        return false;
+      }
+      const j = rb.params.indexOf(r);
+      let ins = 0;
+      for (const { succ: s } of inEdgeRecords(preds, rb)) {
+        ins++;
+        if (!carried.has(s.args[j])) {
+          return false;
+        }
+      }
+      if (ins === 0) {
+        return false;
+      }
+    }
+    return backEdges > 0;
+  };
+  const enclosingCarrierName = (
+    p: Value,
+    i: number,
+    header: Block,
+    forwardPreds: readonly Block[],
+  ): string | undefined => {
+    const [E] = forwardPreds;
+    const a = E === undefined ? undefined : successorTo(E, header)?.args[i];
+    const order = fn.writeOrder;
+    const refused = firstRejection(hooks.enclosingCarrierGates ?? ENCLOSING_CARRIER_GATES, {
+      oneForwardEntry: E !== undefined && E !== header && forwardPreds.every((fp) => fp === E),
+      get entryEncloses() {
+        return E !== undefined && forest.byHeader.get(E)?.body.has(header) === true;
+      },
+      get argIsEnclosingParam() {
+        return a !== undefined && E!.params.includes(a);
+      },
+      get keyUnwritten() {
+        return E !== undefined && order?.writes.has(E) === true && order.lastWrite.get(E)?.has(p) !== true;
+      },
+      get carriedByBoth() {
+        return E !== undefined && a !== undefined && carriedByBothLoops(p, i, header, E, a);
+      },
+    });
+    const nm = a === undefined ? undefined : varName.get(a);
+    return refused === null && nm !== undefined && canTakeName(p, header, nm) ? nm : undefined;
+  };
   // ONE seeding routine for self-loop and structured-loop headers. On a coalesceLoopInit target,
   // keep the induction variable in its entry (forward-edge) value's register — reproducing a
   // compiler that mutates the arg register across the loop instead of copying to a fresh local,
   // so the init copy vanishes. The loop mutates the adopted name every iteration — canTakeName
   // declines it when any value under it is still live at the header. `exclude` are names never to
-  // adopt (enclosing loops' induction vars — the cross-level collision below); every seeded
-  // param's name is ADDED to it, so sibling params can't collapse.
+  // adopt (enclosing loops' induction vars — the cross-level collision below) except through
+  // `enclosingCarrierName`, which measures the collision instead; every seeded param's name is
+  // ADDED to it, so sibling params can't collapse.
   const seedLoopParams = (
     header: Block,
     forwardPreds: Block[],
@@ -2130,6 +2816,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
             }
           }
         }
+        name ??= enclosingCarrierName(p, i, header, forwardPreds);
         // A MATERIALIZED back-edge arg is this variable's in-place update (`add r4, r4, r0`
         // mutates the same register the param lives in) — adopt its name so the def assigns the
         // loop variable directly and the update copy elides. Sound only when every read of the
@@ -2206,7 +2893,8 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // loop (the outer latch reads it after). If the inner var is coalesced onto the outer var's name
   // (its init reads the outer var), the inner loop would MUTATE the outer variable — a silent
   // miscompile. Process OUTERMOST-first (so an enclosing loop is named first) and, per loop, exclude
-  // the names of every enclosing loop's header params from the coalescing candidates.
+  // the names of every enclosing loop's header params from the coalescing candidates — all but the
+  // one `enclosingCarrierName` hands over with the evidence and the `canTakeName` check above.
   // `enclosingNames(l)` = names of params of headers whose natural body strictly contains `l.header`.
   structuredLoops.sort((a, b) => b.body.size - a.body.size); // outermost first
   const enclosingNames = (l: { header: Block; body: Set<Block> }): Set<string> => {
@@ -2264,7 +2952,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           if (carriesPreUpdate(c.v, c.pr, b) || !canTakeName(p, b, nm, allSame)) {
             continue;
           }
-          // `freshParamMerge` (the `/fresh-merge` axis): this merge takes its own home rather
+          // `freshParamMerge` (the `/fresh-merge` variation): this merge takes its own home rather
           // than the carrier's name — `FRESH_MERGE_GATES` above holds the admission and the
           // argument for it. Absent the option nothing changes.
           if (
@@ -2382,7 +3070,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     }
     // Params never reconcile: their declarations come from p.type, not varType, so a flip here
     // would only desync the cast site's view from the emitted declaration — and param signedness
-    // is the sign-pin axis's dimension.
+    // is the signedness variation's dimension.
     const paramNames = new Set(entry.params.map((_, i) => `a${i}`));
     const claimants = new Map<string, Value[]>();
     for (const [v, n] of [...varName, ...backArgName]) {
@@ -2665,13 +3353,13 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           l = { k: 'cast', to: T.u(32), e: l };
         }
       }
-      // The SIGNED direction of the same hole, and a DEFAULT rather than an arm of that axis —
+      // The SIGNED direction of the same hole, and a DEFAULT rather than an alternative of that variation —
       // not because nothing underdetermines, but because the underdetermination is INERT. An
       // unsigned source compare can reach a signed opcode when the compiler proves the test is
       // the sign bit (`u32 a; a < 0x80000000` compiles to `cmp r0, #0; bge`; kmc-gcc and gcc
       // 2.7.2 fold it to `slti`), so an icmp_s* has more than one source — but the pinned
       // spelling reproduces that branch too (`(s32)a >= 0` is the same `cmp r0, #0; bge`), so
-      // both sources reach ONE candidate and an axis would have doubled the fan to referee a
+      // both sources reach ONE candidate and a variation would have doubled the fan to referee a
       // question with one answer. Where the spellings genuinely diverge they diverge the way the
       // opcode says, on every toolchain: an operand that renders unsigned makes C compare
       // unsigned (agbcc `bls`, IDO/kmc-gcc/gcc 2.7.2 `sltu`/`sltiu` against `slt`/`slti`, mwcc
@@ -2879,6 +3567,50 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       // COMPARISON (`gPtr < K` — C compares unsigned whatever the asm's icmp_s* said) is the same
       // class as intifyAddrCmp's `addr` rule and is deliberately left alone here: it is valid C
       // today, so closing it would churn spellings for a signedness case no row exercises.
+      //
+      // A `+`/`|` over two IR `const`s that both RENDER as literals is the literal it is. After
+      // pre-recovery there is only one way such an op still exists: `raise/const.ts` refuses to fold
+      // one shape — a register the compiler held live across a branch, whose value on this path is a
+      // constant — so that `/merge-home` can enumerate the hoisted init (`v = 0; if (c) v = v + 1;`).
+      // A candidate that does NOT home the register inlines both operands and would ship
+      // `v = 0 + 1;`: `synthetic:fib:gcc2.7.2kmc` emits exactly that without this fold and scores
+      // diff:12 either way, because the target compiler folds the constant expression and no score
+      // gate can see the difference. The artifact a decomp author pastes into a repo is what is at
+      // stake, so `const-fold.test.ts` pins this on the emitted STRING. Re-folding HERE rather than
+      // back in the IR is the point: the pair must survive pre-recovery for the enumeration gate to
+      // see the merge feed, and only at rendering is it settled that this candidate named neither
+      // half.
+      //
+      // `foldsFromIrConsts` keeps the reach honest and is not redundant with `l`/`r` being `const`
+      // Exprs: a BLOCK PARAMETER resolved to a constant on this arm also renders as a literal, and
+      // folding those is a different and unmeasured decision. Instrumented over the real pipeline it
+      // fires on `synthetic:sinkacc:agbcc` and on ZERO renders of the 16 MATCH rows whose emitted
+      // source carries a literal pair today — theirs are address trees whose IR defs are not consts.
+      // It reads through the fold's OWN opcodes, and recursively, because the residue is not flat:
+      // `add(add(const 0, const 1), const 2)` would otherwise ship `1 + 2`. That cannot widen the
+      // reach past the refusal's residue — any other const/const `add`/`or` `raise/const.ts` already
+      // folded, and nothing outside `frontend/` constructs one afterwards. The fold itself is
+      // `foldConstPair`, not a copy: which opcodes fold and how the result is normalised to int32 is
+      // ONE decision, and a third `FOLD` entry must not silently leave its residue unrepaired here.
+      const foldsFromIrConsts = (v: Value): boolean => {
+        const dv = defs.get(v);
+        if (!dv) {
+          return false; // a block parameter: not this refusal's residue
+        }
+        if (dv.opcode === 'const') {
+          return true;
+        }
+        return (
+          isConstFoldOpcode(dv.opcode) && dv.operands.length === 2 && dv.operands.every((o) => foldsFromIrConsts(o))
+        );
+      };
+      if (l.k === 'const' && r.k === 'const' && d.operands.every((o) => foldsFromIrConsts(o))) {
+        const value = foldConstPair(d.opcode, l.value, r.value);
+        if (value !== null) {
+          const folded: Expr = { k: 'const', value };
+          return restoreTo ? { k: 'cast', to: restoreTo, e: folded } : folded;
+        }
+      }
       const sum: Expr = { k: 'bin', op, l, r };
       return restoreTo ? { k: 'cast', to: restoreTo, e: sum } : sum;
     }
@@ -2968,6 +3700,8 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         ctype,
         scalarGlobals,
         symCtx,
+        false,
+        advanceStepOf(d.operands[0]),
       );
     }
     // aload carries a runtime index operand (variable-index array access) — `base[index]`, or
@@ -3065,7 +3799,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // written at the const's own def site instead of on the edges (anchorConstCopies, above), and
   // that site dominates them. Its block is a write site for the name like any other, and without it
   // `v0 = 0; if (c) { } store v0;` drops the undefined arm's copy and stores 0 where the machine
-  // stores whatever the arm left — the same substitution the parameter case makes, one axis over.
+  // stores whatever the arm left — the same substitution the parameter case makes, one step over.
   //
   // THE SECOND RELOCATION goes the other way, and this test cannot see it at all. A SUNK pre-update
   // exit copy (preUpdateCopies) writes the loop EXIT's param at the top of the loop BODY, so the
@@ -3221,7 +3955,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
    *  PER NAME the dispatch binds — which is not once per machine write: `sw_fall`'s three arms
    *  each take the accumulator under a name of their own, so this tree emits `v0 = 0; v1 = 0;
    *  v2 = 0;` where agbcc has a single `mov r1, #0`, and the one-local spelling that byte-matches
-   *  comes from the `/merge-home` ranked axis, not from here. What the position is for is the
+   *  comes from the `/merge-home` ranked variation, not from here. What the position is for is the
    *  fall-through chain: per-arm copies RE-RUN on the fall path and overwrite what the falling arm
    *  computed, the hazard Regime B states at its own `switch_br` refusal.
    *
@@ -3359,6 +4093,194 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     return isPtr ? { k: 'cast', to: T.ptr(T.void()), e: value } : value;
   };
 
+  /** THE REFUSAL for the read half of `unreadResult`. TWO questions, and the statement is spelled
+   *  only where BOTH answer yes; the second is not implied by the first.
+   *
+   *   1. EVIDENCE — would a source plausibly have declared this access `volatile`? The answer has
+   *      to come from DATA: the target's declared device-register window
+   *      (`capabilities.deviceRegisters`) or the symbol map's own `volatile` on the named global.
+   *      `volatile` is a CORRECTNESS claim about an address, not a spelling preference, and
+   *      asserting one about ordinary RAM is a wrong answer rather than a wrong spelling.
+   *   2. REACHABILITY — will the spelling this access gets CARRY a qualifier, here or in some
+   *      candidate enumerated from this tree? The payoff of spelling a dead read is that a
+   *      qualifier can land on it and the differ can referee the pair; where none can, the
+   *      statement is a permanent bare deref in the DEFAULT source, which is what the playground
+   *      pins and what a decomp author copies. This question refuses far less than question 1:
+   *      `/volatile` qualifies an EWRAM or ROM address quite happily.
+   *
+   *  THE MAP ARM needs the read spelled through the global's own NAME, which is where the map's
+   *  qualifier lands — memAccess's two name-carrying arms for a global, the bare scalar
+   *  (`gStatus;`) and the declared struct MEMBER (`gState.ctl;`). A CAST spelling
+   *  (`((s32 *)&REG_DMA3SAD)[2]`) has thrown the qualifier away in the spelling itself, whatever
+   *  the declaration says. The member arm asks the CONTAINER's qualifier and not the member's own
+   *  (`SymbolStructField.volatile`), which looks backwards and is not: `memberQualsAllow` above
+   *  refuses to NAME a volatile member at all, so a `vu16` member is spelled `((s32 *)&gSym)[k]`
+   *  with nothing in the spelling for a variation to hold, while `volatile struct S gSym;` qualifies
+   *  every member and `gSym.ctl;` really is an observable read. Every other map spelling refuses —
+   *  `gPtr->member`, a bare-name array element, a multidimensional subscript — because
+   *  over-refusing costs a SPELLING and admitting wrongly costs an ANSWER, this file's standing
+   *  asymmetry.
+   *
+   *  THE LITERAL ARM needs the base value to have a use OTHER than this read: l3/volatileptr.ts
+   *  qualifies a pointer LOCAL, and l3/basecse.ts only mints that local for a base something else
+   *  also touches. A single-access read — `*(s32 *)0x04000200;`, the `REG_IF` acknowledge idiom,
+   *  and the shape a WRONG `returnsVoid` on a register accessor produces — has no local to qualify
+   *  and never will, however plainly its address is a device register. "Some other use" is
+   *  NECESSARY for that local, not sufficient; the gate states the necessary half.
+   *
+   *  ONLY `load` REACHES EITHER ARM. `aload` carries its index in `operands[1]` and has no `off`
+   *  attr at all, so both address queries would answer for the BARE BASE — `globalCellOf` resolves
+   *  a base and discards the index by construction (ir/alias.ts), `constAddressOf` sees the literal
+   *  with `off` defaulted to 0 — which admits `volatile s32 *p0 = (s32 *)0x04000000; p0[a0];`, a
+   *  qualified access at an address the declared window does not cover. The whitelist is by OPCODE
+   *  so a read op added later refuses until someone answers both questions for it.
+   *
+   *  THE ARMS DO NOT SHARE A POPULATION. With a symbol map the frontend spells a pool word as
+   *  `gaddr`, so `constAddressOf` returns null and the literal arm inhabits only `/raw-globals`,
+   *  which re-structures with NO map. The map arm is the default-source one, and a map-fed DMA
+   *  function spells no read at all — its wait-read is cast-spelled (see `BASECSE_GATES`'
+   *  `repeated-const-offset`, whose base local this refusal hands back). */
+  const volatileQualifiable = (op: Op): boolean => {
+    if (op.opcode !== 'load') {
+      return false;
+    }
+    const off = typeof op.attrs.off === 'number' ? op.attrs.off : 0;
+    const width = op.attrs.width as number;
+    const cell = globalCellOf(defs, op.operands[0], off);
+    if (cell) {
+      const si = symbols?.get(cell.name);
+      if (si === undefined) {
+        return false;
+      }
+      if (si.shape === 'struct') {
+        // the SAME find memAccess's struct arm makes, so the two cannot disagree about which
+        // accesses reach the `gSym.field` spelling this arm's qualifier rides on
+        const fld = symCtx
+          ?.fieldsOf(cell.name)
+          ?.find((f) => f.offset === cell.byte && f.size === width && !isArrayField(f) && !isBitfieldField(f));
+        return fld !== undefined && memberQualsAllow(fld, si.const, false) && si.volatile === true;
+      }
+      return cell.byte === 0 && scalarGlobals.has(cell.name) && si.volatile === true;
+    }
+    const window = opts.deviceRegisters;
+    if (!window) {
+      return false;
+    }
+    const addr = constAddressOf(defs, op.operands[0], off);
+    if (addr === null || addr < window[0] || addr >= window[1]) {
+      return false;
+    }
+    return (useSitesOf.get(op.operands[0]) ?? []).some((s) => s.op !== op);
+  };
+
+  /** Ops the `sideEffects` walk must SPELL even though nothing consumes their result — the
+   *  registry's own derived set (`SPELLED_WHEN_DEAD_OPS`), so the next op to acquire the property
+   *  needs no edit here, plus the address refusal above for the memory-read half.
+   *
+   *  A memory READ is not in `EFFECTFUL_OPS`, deliberately: ir/opcodes.ts calls a load deletable
+   *  when dead, because nothing observes a read nobody reads. That is the C claim. The COMPILER
+   *  claim points the other way — an optimizing compiler deletes every dead read it is allowed to
+   *  delete, so one still in the target is evidence the source's access was `volatile`, and
+   *  dropping it deletes an instruction the machine executed.
+   *
+   *  The statement earns nothing by itself: an unqualified `p[2];` compiles to the same bytes as
+   *  no statement at all (measured on agbcc, IDO and mwcc). What it does is put the access where a
+   *  qualifier can reach it — and `volatileQualifiable` is the condition under which one can.
+   *
+   *  WHICH VARIATION REACHES IT, because "a qualifier" is two variations and only one of them does:
+   *  l3/volatileptr.ts's `/volatile` qualifies the pointer LOCAL the read is spelled through, and
+   *  that is the arm every match here rides. l3/volstore.ts's `/vol-store` mints `volatile` at an
+   *  inline cast STORE and never visits an `exprstmt`, so on a tree with no base local it emits the
+   *  cell qualified for its writes and plain for this read — a candidate that cannot reproduce the
+   *  surviving `ldr`. Wasted rather than wrong (the differ refuses it); teaching that variation the
+   *  read is a widening with its own window census to pay for, priced in its header.
+   *
+   *  TWO THINGS DELIBERATELY NOT DONE HERE, priced rather than left for a reader to rediscover.
+   *
+   *  1. THE LITERAL ARM IS A BACKWARDS DEFAULT AND ITS PREIMAGE IS NOT EMPTY. docs/level-tower.md
+   *     admits a default that reads the map backwards only when the backwards mapping is ITSELF a
+   *     function, and "a surviving dead read implies the source said `volatile`" is not quite one:
+   *     the other preimage is a function whose `returnsVoid` fact is WRONG, so its return value
+   *     arrived here as a dead read. The second-use clause removes the common shape of that (a bare
+   *     register accessor), leaving a function that both STORES to a device register and reads one
+   *     back — narrow, but not proven empty. The MAP arm has no such problem: `gStatus;` under
+   *     `extern volatile u32 gStatus;` compiles differently from its own absence, so the differ can
+   *     referee it. The clean fix — spell the read only in candidates that also qualify it, paired
+   *     the way `/livebase/volatile` already pairs — moves every device row's fan shape and wants
+   *     its own round and zero-flip gate over BOTH tiers.
+   *  2. THE REFUSAL IS SILENT. When this returns false for a `load`, the machine performed a read
+   *     that no statement stands for and nothing records the decision — against this project's own
+   *     "instrument the refusal" rule; `structure()` has no diagnostic sink to write into. What
+   *     exists instead is the ADMISSION side's zero point, `synthetic:dmareadback`, which fails
+   *     loudly if the rule stops firing. */
+  /** Does `op` render AT ITS OWN POSITION, as `v = f(…)`?
+   *
+   *  ONE DEFINITION, TWO READERS, on purpose: `isSpelled`'s base case is a MODEL of what
+   *  `sideEffects` emits, and a predictor and an emitter that disagree spell a call zero times or
+   *  twice. There is no third copy in `unreadResult`, and none is needed — it falls out of position
+   *  instead, because `sideEffects` tests the assign branch BEFORE the `unreadResult` branch and
+   *  `isSpelled` returns at its base case without ever asking `unreadResult`. */
+  const rendersAtOwnPosition = (op: Op): boolean => materialize.has(op) && !absorbedLoads.has(op);
+  const spelledMemo = new Map<Op, boolean>();
+  /** Will the tree SPELL `op` anywhere — as a statement of its own, or inlined into one?
+   *
+   *  `useSitesOf` is SYNTACTIC, and that is not the question `unreadResult` is asking. An op whose
+   *  result feeds one pure op that is itself never rendered HAS a use site, so the syntactic test
+   *  reads it as consumed; nothing then renders the consumer either, and an effectful op the
+   *  machine executed disappears with no statement and no diagnostic — the one outcome the
+   *  `sideEffects` walk exists to prevent. The analysis registry carries a HAND-WRITTEN instance of
+   *  the same correction one level up (a void function's `ret` operand is left out of the registry,
+   *  so a call feeding only the suppressed return reads as dead); this is its transitive form, which
+   *  the registry cannot express because "is it rendered" is a question about the TREE. Measured by
+   *  the IR oracle rather than by a reader: without this walk `irTraceOf` disagrees with the emitted
+   *  tree on 433 of `generateSsaFn`'s 4,000 acyclic seeds, every one a call the IR performed and the
+   *  tree did not, and both naming fuzzes' REFERENCE spellings share the defect exactly.
+   *
+   *  A TERMINATOR, a `store`/`astore`/`ret` and a materialized def each render at their own
+   *  position, so they are the base cases (the first three have no results and fall out of the
+   *  same test). Everything else is spelled iff something spelled reads it — or iff it is effectful
+   *  and nothing does, which is this walk. No cycle is reachable: op→op edges follow SSA def-use,
+   *  and a cycle can only close through a block PARAM, which is not an op result. The memo is still
+   *  seeded `true` before recursing, so a malformed function degrades to the over-admitting answer
+   *  rather than recursing forever.
+   *
+   *  WHAT THIS DELIBERATELY DOES NOT MODEL: an edge argument into a block param NOTHING READS is
+   *  also spelled nowhere, so in principle the walk should stop at a dead param rather than at the
+   *  terminator. That clause moves the residual by ZERO — d0 48/4,000, d1 31/2,508, d2 6/1,556 with
+   *  it and the identical counts without — because `argAssigns` writes a copy into every NAMED param
+   *  whether or not the param is read, and the naming walk names the params of these shapes. Holding
+   *  that draw takes two further clauses (skip the copy test for a named param, or `fz735`'s call is
+   *  spelled twice), so it is three rules that buy nothing and it is not here. */
+  const isSpelled = (op: Op): boolean => {
+    const memo = spelledMemo.get(op);
+    if (memo !== undefined) {
+      return memo;
+    }
+    if (op.results.length === 0 || rendersAtOwnPosition(op)) {
+      return true;
+    }
+    spelledMemo.set(op, true);
+    const r = hasSpelledUse(op.results[0]) || unreadResult(op);
+    spelledMemo.set(op, r);
+    return r;
+  };
+  /** Does any op the tree spells READ `v`? */
+  const hasSpelledUse = (v: Value): boolean => (useSitesOf.get(v) ?? []).some((s) => isSpelled(s.op));
+
+  const unreadResult = (op: Op): boolean =>
+    SPELLED_WHEN_DEAD_OPS.has(op.opcode) &&
+    op.results.length > 0 &&
+    // NO EXEMPTION FOR A MATERIALIZED DEF HERE, and it is not missing. Such a def already renders
+    // at its own position, as `v = f(…)`, which spells the effect as surely as a bare statement
+    // does; taking the `exprstmt` branch for one instead emits `expr(result)` — the NAME, so `v3;`
+    // replaces `v3 = f0(…)` and the call is gone. Both callers rule that out BEFORE asking:
+    // `isSpelled` returns at its `rendersAtOwnPosition` base case, and `sideEffects` tests the
+    // assign branch first. Under a transitive use test the two sets overlap constantly — a
+    // materialized def's name is often read by nothing spelled — so that ordering is load-bearing,
+    // and `dead-effect.test.ts`'s `MATERIALIZED` pins it.
+    !hasSpelledUse(op.results[0]) &&
+    (opSig(op.opcode)?.reads !== true || volatileQualifiable(op));
+
   const sideEffects = (b: Block): Stmt[] => {
     const out: Stmt[] = [];
     for (const op of b.ops) {
@@ -3370,7 +4292,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           out.push({
             k: 'store',
             lval: { k: 'field', base: { k: 'var', name: bfs.global }, name: bfs.field, dot: true },
-            value: expr(bfs.value),
+            // `zero` is the ALL-ZERO form: the asm carries no value at all, because agbcc emits
+            // only the clearing `and` when the assigned value is 0 (structure/bitfields.ts).
+            value: bfs.value.k === 'zero' ? { k: 'const', value: 0 } : expr(bfs.value.v),
           });
           continue;
         }
@@ -3387,6 +4311,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           scalarGlobals,
           symCtx,
           true, // an lvalue: a member whose declaration is const cannot be NAMED as the target
+          advanceStepOf(op.operands[0]),
         );
         if (lval0.k === 'var') {
           globalNames.add(lval0.name);
@@ -3415,23 +4340,24 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           ),
           value: expr(op.operands[2]),
         });
-      } else if (EFFECTFUL_OPS.has(op.opcode) && op.results.length && !useSitesOf.has(op.results[0])) {
-        // An effectful op whose result nobody reads is still an execution. `store`/`astore` have no
-        // result and were handled above, so what reaches here is `call` and `opaque` — and an
-        // `opaque` missing from this walk is an instruction the frontend could not model
-        // disappearing with no diagnostic, which is the one thing this project refuses to do.
-        //
-        // Keyed on EFFECTFUL_OPS rather than the two opcode names: the deciding property is "has an
-        // effect the result does not account for", which is what the flag already means, so the next
-        // op to acquire it needs no edit here. Statement, not expression — `expr` on the result
-        // routes through `lowerDef`, already where `opaque` becomes the gap, so this reuses the SAME
-        // degradation a live opaque gets rather than inventing a second way to be loud.
-        out.push({ k: 'exprstmt', value: expr(op.results[0]) });
-      } else if (materialize.has(op) && !absorbedLoads.has(op)) {
+      } else if (rendersAtOwnPosition(op)) {
+        // FIRST, and that order is the rule rather than a restatement of it: this branch is what
+        // "renders at its own position" MEANS, so an op it claims can never reach the `exprstmt`
+        // branch below and be spelled as a bare `v3;` with the call dropped.
         // (an absorbed load's every consumer spells a named bitfield read — emitting its temp
         // here would recompile to a second load the asm does not have)
         const nm = varName.get(op.results[0])!;
         out.push({ k: 'assign', name: nm, value: intoDeclaredTemp(nm, lowerDef(op, expr)) });
+      } else if (unreadResult(op)) {
+        // An op whose result nobody reads is still an execution. `store`/`astore` have no result and
+        // were handled above, so what reaches here is `call`, `opaque` and a memory READ — and an
+        // `opaque` missing from this walk is an instruction the frontend could not model
+        // disappearing with no diagnostic, which is the one thing this project refuses to do.
+        //
+        // Statement, not expression — `expr` on the result routes through `lowerDef`, already where
+        // `opaque` becomes the gap, so this reuses the SAME degradation a live opaque gets rather
+        // than inventing a second way to be loud.
+        out.push({ k: 'exprstmt', value: expr(op.results[0]) });
       }
       // a merge copy anchored at this const's original position (anchorConstCopies, above)
       for (const a of anchoredAt.get(op) ?? []) {
@@ -3466,6 +4392,13 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     }
   };
 
+  // Branch-sense sites, numbered as the walk below first reaches them (`branchSenseFlipSites`).
+  const senseOrdinal = new Map<number, number>();
+
+  // Which `return;` statements the SOURCE wrote — the reading, and why it is decidable, live in
+  // `structure/retspell.ts`. `l3/tailret.ts` owns whether a marked return is safe to delete.
+  const unspelledRets = unspelledEpilogues(fn);
+
   const structureRegion = (b: Block, stop: Block | null): Stmt[] => {
     if (b === stop) {
       return [];
@@ -3506,6 +4439,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     switchAllowsNeqCase,
     switchAllowsBoundCase,
     switchArmsFollowLayout,
+    switchRequiresFrontLoadedTests,
     spellSwitchFallthrough,
     emitsOwnStatement: (blk) => blk.ops.some((o) => anchoredAt.has(o) || materialize.has(o)),
     blockOf,
@@ -3527,7 +4461,11 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     const term = b.ops[b.ops.length - 1];
     if (term.opcode === 'ret') {
       // A void function's `bx lr` leaves whatever in r0; suppress that phantom return value.
-      out.push({ k: 'return', value: returnsVoid || !term.operands.length ? undefined : expr(term.operands[0]) });
+      const value = returnsVoid || !term.operands.length ? undefined : expr(term.operands[0]);
+      // The `value === undefined` half is a GUARD: `l3/tailret.ts` re-checks it before deleting
+      // anything, so marking a value-carrying return would change no output. The mark claims the asm
+      // shows no `return;` STATEMENT here, which is a claim about a VOID return only.
+      out.push({ k: 'return', value, ...(value === undefined && unspelledRets.has(b) ? { unspelled: true } : {}) });
       return out;
     }
     if (term.opcode === 'br') {
@@ -4015,7 +4953,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     }
 
     const cond = expr(term.operands[0]);
-    const ipd = ipdom.get(b) ?? null; // null ⇒ the arms diverge (both reach EXIT), no join
+    // null ⇒ the arms diverge (both reach EXIT) and no follow over early returns applies. Asked
+    // outside loop bodies only: inside one, `clampToLoop` below owns the question. DEFENSIVE — no
+    // input it changes: ablated, the follow fires on no more of 40,000 generated functions (random
+    // structuring options, sunk and unsunk), and every row of both tiers enumerates a byte-identical
+    // variations-and-source set (810 synthetic, 251 real, `ProcessInputAndUpdateEntities` excepted).
+    const ipd = ipdom.get(b) ?? (followEarlyReturns && loopCtx === null ? followOverReturns(b, stop) : null);
     // Inside a loop body, a join OUTSIDE that body is not this `if`'s join: an arm that leaves the
     // loop `return`s and never comes back, so what is left reconverges at the loop's own
     // continuation. Post-dominance cannot see that — agbcc/gcc merge every `return` into one
@@ -4041,29 +4984,111 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // block with different args would otherwise give both arms the first edge's copies.
     const thenS = [...argAssignsFor(b, term.successors[0]), ...structureRegion(takenB, merge)];
     const elseS = [...argAssignsFor(b, term.successors[1]), ...structureRegion(fallB, merge)];
-    if (ipd === null && thenS.length && elseS.length && preserveDivergentBranchSense) {
-      // Divergent arms (both terminate — no reconvergence). The asm branched forward to the
-      // `taken` block and fell through to `fall`; a compiler that PRESERVES source branch direction
-      // re-emits that as a forward branch on the NEGATED condition to the else-arm, so putting the
-      // taken arm as `else` (and negating) reproduces the original branch sense. Byte-exact on
-      // IDO/MIPS; agbcc/GCC canonicalise either way, so it is safe there too. A compiler that
-      // inverts branch canonicalization sets preserveDivergentBranchSense false and falls through
-      // to the positive form below.
-      out.push({ k: 'if', cond: negateCond(cond), then: elseS, else: thenS });
-      return out;
-    }
-    if (negateJoinedBranchSense && ipd !== null && thenS.length && elseS.length) {
-      // JOINED arms only (`ipd !== null` — a divergent if belongs to preserveDivergentBranchSense
-      // above, and without the check a /flip-branch variant would fall through here and get
-      // flipped BACK, collapsing the {divergent flipped × joined flipped} combination), and both
-      // arms real: the flipped spelling is a genuine sibling, not noise on a one-armed if
-      out.push({ k: 'if', cond: negateCond(cond), then: elseS, else: thenS });
-      if (merge && merge !== stop) {
-        out.push(...structureRegion(merge, stop));
+    // A BRANCH-SENSE SITE: both arms real, so the swapped-and-negated spelling is a genuine
+    // sibling rather than noise on a one-armed if. Which boolean owns it is `ipd`: divergent arms
+    // (both terminate, no reconvergence) belong to preserveDivergentBranchSense, a reconverging
+    // pair to negateJoinedBranchSense — and the split has to stay, or a /flip-branch candidate would
+    // fall into the joined case and get flipped BACK, collapsing the {divergent × joined}
+    // combination. Sense TRUE = the asm branched forward to the `taken` block and fell through to
+    // `fall`, so a compiler that PRESERVES source branch direction saw the FALL-THROUGH arm as
+    // `then`: putting the taken arm as `else` (and negating) reproduces the original. Byte-exact
+    // on IDO/MIPS; agbcc/GCC canonicalise either way, so it is safe there too. A compiler that
+    // inverts branch canonicalization sets the boolean false and gets the positive form.
+    const senseSite = thenS.length > 0 && elseS.length > 0;
+    // The fold's evidence where there is any, the function-wide boolean where there is not
+    // (`senseFromFoldEvidence`). THREE stamps, and exactly ONE of the eight cells negates.
+    //
+    //   onFall  isTaken  relayed  spelling   inhabitant (each measured from its own asm)
+    //   ------  -------  -------  --------   --------------------------------------------------
+    //   false   true     false    NEGATE     `synthetic:ifand_near` — the short-branch `&&`
+    //   true    true     false    positive   `synthetic:ifor_near`  — the short-branch `||`
+    //   true    false    true     positive   `synthetic:ifand_far`  — the long-branch `&&`
+    //   false   true     TRUE     positive   `synthetic:ifor_far`   — the long-branch `||`
+    //   false   false    false    positive   `synthetic:chainsense`, the chained fold
+    //   (the other three cells are uninhabited over the committed corpus at both settings)
+    //
+    // `scSharedIsTaken` says where the shared arm went — TRUE, the arm both tests reach is this
+    // branch's TAKEN successor, is the `||` fold. `scSharedOnFall` says which source arm it is:
+    // true = the last test FELL INTO it, so under gcc's source-order layout it is the source's
+    // `then`. A shared arm in the FALL slot leaves the source's `then` in the taken slot whatever
+    // the layout — an `&&`'s shared arm is where its FAILING tests go — so the `&&` half is
+    // positive at both values of `scSharedOnFall` and the premise is only consulted where it
+    // decides something. That is what admits the CHAINED fold, `scSharedOnFall` false, whose inner
+    // fold left the head's taken edge pointing at the next test: reading the source arm alone
+    // NEGATES it, `synthetic:chainsense` is 4/44 that way and MATCH this way, and the inner-loop
+    // site of `kleod:CountCollectedGems:agbcc` is the real-row inhabitant (39/352 → 18/344).
+    //
+    // `scEdgeRelayed` is the LONG BRANCH, and it is the stamp that keeps the premise honest rather
+    // than absorbing it. agbcc inverts a conditional it cannot reach in ±256 bytes, so the layout
+    // claim `scSharedOnFall` rests on is simply false there — and the inversion moves the shared arm
+    // to the OTHER successor slot, which is why it is not confined to one quadrant. Measured: the
+    // long `||` (`ifor_far`) stamps the IDENTICAL pair as the short `&&` (`ifand_near`), false/true,
+    // and wants the opposite spelling. Two booleans cannot separate them; without this one the
+    // reading spells `ifor_far` as its own dual. Both long rows are pinned by test/site-sense.test.ts
+    // and by nothing else: each MATCHes on `/flip-join` whatever the fold spelled (0/140 and 0/139).
+    //
+    // WHAT IS STILL UNDECIDED, and it is a cell of this table rather than a hole beside it: at
+    // `(onFall=true, isTaken=false)` the corpus holds a function with TWO sites of OPPOSITE source
+    // sense — `kleod:CheckWorldCompletion:agbcc`, whose own `refSource` wants the positive spelling
+    // at one and the negated one at the other. No CONSTANT is right for that cell; this table's
+    // `positive` is right at one of the two and wrong at the other, and the row scores 45/191 with
+    // the same winner either way because `/site-sense` is not its winner. If the cell is ever to be
+    // decided it needs a SITE fact the fold does not carry yet; if it cannot be, the honest shape is
+    // `rank.ts`'s per-site mask (`branchSenseFlipSites`, the `/sense-N` probe), which enumerates a
+    // site both ways instead of picking. Do not read the table above as the mapping being a function.
+    //
+    // CENSUS over the 1037 rows of the committed artifact — which predates `synthetic:ifor_far` and
+    // `synthetic:chainsense`, the two rows added for the cells below. Each row's own `targetAsm`
+    // lifted at both `/connective` settings: stamped `cond_br`s at the PRODUCER, then this
+    // consumer's own reads at real two-armed sense sites, each summed over the two settings:
+    //
+    //   stamped sites     `/connective` off: 82 taken-slot,  4 long-branch, 0 chained
+    //                     `/connective` on:  85 taken-slot,  4 long-branch, 2 chained
+    //   consumer reads    99 taken-slot, 8 long-branch, 2 chained
+    //
+    // The chained cell has ZERO inhabitants with `/connective` off, so that half of the capability
+    // is reachable only through the `/connective` lift variation — both real inhabitants and
+    // `chainsense` carry it in their winner. And `scEdgeRelayed`'s own cell `(false,true,true)`
+    // carries 9 stamped sites at each setting and **0 consumer reads** there: all 9 are MIPS rows
+    // (`ido7.1`/`gcc2.7.2kmc`, where no ±256 range exists and a relay means something else), and
+    // none is a two-armed sense site, so those rows emit byte-identical C with the stamp and
+    // without it — the cell's one reader is `synthetic:ifor_far`, measured from its own asm. That
+    // MIPS firing is this stamp's known over-reach — a PROXY firing where the structure it proxies
+    // is absent — priced at 0 today and worth re-censusing whenever a MIPS row starts reading it.
+    //
+    // REFUSES unless ALL THREE stamps are present. DEFENSIVE — no input reaches it: the one producer
+    // (raise/shortcircuit.ts) writes all three in a single object literal, and instrumenting this
+    // read over that same corpus counts 0 partially-stamped sites. A site the fold never touched
+    // carries none and keeps its function-wide boolean.
+    const foldEvidence = term.attrs.scSharedOnFall;
+    const sharedIsTaken = term.attrs.scSharedIsTaken;
+    const edgeRelayed = term.attrs.scEdgeRelayed;
+    const siteDefault =
+      senseFromFoldEvidence &&
+      typeof foldEvidence === 'boolean' &&
+      typeof sharedIsTaken === 'boolean' &&
+      typeof edgeRelayed === 'boolean'
+        ? sharedIsTaken && !foldEvidence && !edgeRelayed
+        : ipd === null
+          ? preserveDivergentBranchSense
+          : negateJoinedBranchSense;
+    let negateHere = false;
+    if (senseSite) {
+      // Keyed by BLOCK, numbered by first visit. Both halves matter: a region the structurer
+      // emits twice (a tail duplicated into two arms) reaches the same block twice and must get
+      // the SAME sense both times, and the ordinal has to mean the same site under every mask —
+      // which it does because both arms are structured ABOVE, before any sense is chosen, so the
+      // visit order does not depend on the choice.
+      const bi = fn.blocks.indexOf(b);
+      let ord = senseOrdinal.get(bi);
+      if (ord === undefined) {
+        ord = senseOrdinal.size;
+        senseOrdinal.set(bi, ord);
       }
-      return out;
+      negateHere = branchSenseFlipSites?.has(ord) ? !siteDefault : siteDefault;
+      hooks.onBranchSenseSite?.({ block: bi, ordinal: ord, joined: ipd !== null, negated: negateHere });
     }
-    out.push(mkIf(cond, thenS, elseS));
+    out.push(negateHere ? { k: 'if', cond: negateCond(cond), then: elseS, else: thenS } : mkIf(cond, thenS, elseS));
     if (merge && merge !== stop) {
       out.push(...structureRegion(merge, stop));
     }
@@ -4171,6 +5196,126 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   const latchSub = (dw: DoWhileInfo): Map<Value, string> =>
     subFor(dw.header.params, successorTo(dw.latch, dw.header)!.args);
 
+  // THE LATCH IS POST-LOOP FOR EVERY INNER LOOP THAT RUNS BEFORE IT. A bottom-tested loop renders
+  // its latch — side effects, update copies, test — HERE, outside the body region, so none of it is
+  // under the substitution an inner loop's exit region installs (`withSub` in the self-loop and
+  // do-while emitters). Yet the latch runs after those inner loops exactly as the rest of their exit
+  // region does, and the inner do-while's own hazard check judged it that way (its `postLoop` holds
+  // every block outside the inner body). Read raw, an inner back-edge value is RE-DERIVED from the inner
+  // variable's name — which by then already holds that value — so the latch counts the last
+  // iteration twice: `a += gT[i][j] * 2` over a nest whose inner loop is one block emits
+  // `do { … v4 = v4 + (v0 << 1); … } while (…); v2 = v4 + (v0 << 1);` — a silent wrong answer that
+  // main's default candidate reaches on agbcc's own output (the `acc += a[i][j]` nest).
+  //
+  // So the latch reads such a value under the name its inner loop left it in: the back-edge
+  // substitution of every loop INSIDE this one that dominates the latch and does not contain it.
+  // Every depth, not only children: a grandchild's value reaches the latch raw whenever the loop
+  // between them does not carry it (`for i { for j { s = j; for k { s += …; } } gO[i] = s; }` —
+  // `latch-inner-sub.test.ts`'s `GRANDCHILD`, 64 of 64 inputs wrong when only children counted).
+  // Where that middle loop DOES carry it, both loops map the value to the one name the carrying
+  // shares, and the inner one wins. Dominating loops apply outermost first, so a later one wins, as
+  // the nested `withSub`s do. A test-at-top `while` installs no substitution (its latch-computed
+  // values never reach past its header exit), so it contributes nothing. Dominance is not a
+  // soundness term — a value of a loop that does not dominate the latch cannot be read there — it
+  // is what keeps the map EMPTY when no loop can hand the latch a value, and `emitDoWhile` then
+  // spells every line as it did before the map existed.
+  //
+  // NARROWER THAN THE EXIT REGION'S `withSub`, in two ways:
+  //   • only an UNNAMED value DEFINED INSIDE the inner loop. A named value renders under its own
+  //     name, and one defined outside the loop (an entry value handed round the back edge
+  //     unchanged) re-derives from operands the loop never wrote. The IR oracle found the second
+  //     (generated seed 16501, `fz16501`): substituting an entry value `a1 - a1` by its inner name
+  //     after the exit copy `v2 = v1` had rewritten it. That witness is held by EITHER narrowing
+  //     (measured, dropping one at a time); this one also keeps the refusal below from judging
+  //     values whose re-derivation the loop cannot have made stale;
+  //   • only while the name still HOLDS it. A name written between the inner loop and the latch —
+  //     a block param of the exit region, of an enclosing loop's header or of the latch itself, or
+  //     a materialized def there — no longer holds the loop's last value, unless what it wrote IS
+  //     that value (`aliasOf`: a merge every arm of which hands it the inner value,
+  //     `IDENTITY_MERGE`). This loop's own header is exempt: its params are written by the update
+  //     copies below, which read under this very substitution, and `enclosingCarrierName` hands
+  //     an inner value exactly that name (`LATCH_SUM`, measured).
+  //     Such an entry is not substituted, and then the latch re-derives it, which is right only if
+  //     the re-derivation reads no name written after the value was computed — the inner loop's own
+  //     and that stretch's. `unreadable` holds the ones for which it does: no spelling at the latch
+  //     is that value, and `emitDoWhile` declines LOUD if a latch reader needs one. `T2_MERGE` and
+  //     `T2_INVARIANT` in `latch-inner-sub.test.ts` are the two sides: a merge after the inner loop
+  //     that took the inner name, with an inner value the raw reading re-derives wrong (neither
+  //     reading is right) and right (the raw reading is). The refusal is per VALUE and per
+  //     stretch, not per name: an entry another loop's substitution still covers (a middle loop
+  //     that carries the grandchild's value under the name they share) is read through that one.
+  //
+  // `writtenAfter` is that set of names per entry, for the test's own refusal in `emitDoWhile`.
+  // Does `w` hold `v` — `v` itself, or a block param every in-edge of which hands it `v` (or such a
+  // param)? The write of a param like that stores what the name already held. A cycle of such
+  // params is `v` too, which is why a revisit answers yes.
+  const aliasOf = (w: Value, v: Value, seen: Set<Value>): boolean => {
+    if (w === v || seen.has(w)) {
+      return true;
+    }
+    seen.add(w);
+    const b = paramBlock.get(w);
+    if (b === undefined || b === entry) {
+      return false;
+    }
+    const k = b.params.indexOf(w);
+    const ins = [...inEdgeRecords(preds, b)];
+    return ins.length > 0 && ins.every(({ succ }) => aliasOf(succ.args[k], v, seen));
+  };
+  const latchInnerSub = (
+    dw: DoWhileInfo,
+  ): { sub: Map<Value, string>; unreadable: Set<Value>; writtenAfter: Map<Value, Set<string>> } => {
+    const out = new Map<Value, string>();
+    const refused = new Set<Value>();
+    const writtenAfter = new Map<Value, Set<string>>();
+    const latchDoms = dom.get(dw.latch)!;
+    const kids = [...forest.byHeader.values()]
+      .filter(
+        (l) => l.header !== dw.header && dw.body.has(l.header) && !l.body.has(dw.latch) && latchDoms.has(l.header),
+      )
+      .sort((x, y) => dom.get(x.header)!.size - dom.get(y.header)!.size);
+    for (const l of kids) {
+      const self = loops.get(l.header);
+      const nested = doWhileLoops.get(l.header);
+      const s = self ? loopSub(self) : nested ? latchSub(nested) : null;
+      if (s === null) {
+        continue;
+      }
+      const rewrittenBy = new Map<string, Value[]>();
+      const written = new Set<string>();
+      for (const [v, n] of varName) {
+        const d = defs.get(v);
+        const home = paramBlock.get(v) ?? (d !== undefined && materialize.has(d) ? opBlock.get(d) : undefined);
+        if (home === undefined || !dw.body.has(home) || home === dw.header) {
+          continue;
+        }
+        written.add(n);
+        if (!l.body.has(home)) {
+          rewrittenBy.set(n, [...(rewrittenBy.get(n) ?? []), v]);
+        }
+      }
+      for (const [v, n] of s) {
+        const d = defs.get(v);
+        if (varName.has(v) || d === undefined || !l.body.has(opBlock.get(d)!)) {
+          continue;
+        }
+        writtenAfter.set(v, written);
+        if (rewrittenBy.get(n)?.some((w) => !aliasOf(w, v, new Set())) === true) {
+          refused.add(v);
+        } else {
+          out.set(v, n);
+        }
+      }
+    }
+    const unreadable = new Set<Value>();
+    for (const v of refused) {
+      if (!out.has(v) && readsClobbered(v, out, writtenAfter.get(v)!)) {
+        unreadable.add(v);
+      }
+    }
+    return { sub: out, unreadable, writtenAfter };
+  };
+
   // Bottom-test `do-while`: the body runs header..latch (structured, with `b`'s do-while hook masked
   // via dwActive), then the latch's own side-effects + the loop update; the latch's cond_br test is the
   // do-while condition, read under `latchSub` (post-update the params hold their next value). Polarity:
@@ -4183,7 +5328,20 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // post-update name — one iteration off, silently. Same readsClobbered guard the early-exit
     // path applies; on a hazard, decline LOUD.
     const sub = latchSub(dw);
-    const updates = argAssigns(dw.latch, dw.header);
+    // The inner loops' post-loop substitution the latch reads under (`latchInnerSub`). Empty — and
+    // then every line below spells what it did before the substitution existed — unless an unnamed
+    // value an inner loop computed could reach the latch.
+    //
+    // The update copies take it MERGED with `activeSub`, because a map passed to `argAssigns`
+    // replaces the ambient `expr` it would otherwise render with: without the merge, a copy reading
+    // an ENCLOSING loop's post-loop value would re-derive it (`ACTIVE_SUB` in
+    // `latch-inner-sub.test.ts`). One thing a map changes that `expr` does not: identity elision
+    // consults it, so a copy that `activeSub` spells `n = n` is dropped rather than written. The
+    // two programs are the same, and it is left conditional so an empty `innerSub` keeps the line
+    // exactly as it was (the corpus census is byte-identical either side of this commit's parent).
+    const { sub: innerSub, unreadable, writtenAfter } = latchInnerSub(dw);
+    const latchMap = innerSub.size > 0 ? new Map([...(activeSub ?? []), ...innerSub]) : null;
+    const updates = argAssigns(dw.latch, dw.header, latchMap);
     const updateWrites = loopWriteSet(updates, dw.body, dw.header);
     const lterm = dw.latch.ops[dw.latch.ops.length - 1];
     // KNOWN GAP, and the reason the sink stands down rather than repairing anything. A body
@@ -4291,10 +5449,64 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     const body = [
       ...preUpdateCopies(dw.exit, exitArgs, sunk, dw.header),
       ...inner,
-      ...sideEffects(dw.latch),
+      ...(innerSub.size > 0 ? withSub(innerSub, () => sideEffects(dw.latch)) : sideEffects(dw.latch)),
       ...updates,
     ];
-    let cond = exprWith(sub)(lterm.operands[0]);
+    // The test reads this loop's own update under `sub`, and anything else an inner loop left under
+    // `innerSub` — the outer loop's own reading wins where a value is both. The test runs AFTER the
+    // update copies, so an inner name one of them really writes no longer holds the inner value, and
+    // that entry keeps the raw reading — the same refusal `latchInnerSub` makes for a name written
+    // before the latch, with the update's writes added to what the re-derivation must not read.
+    const writtenByUpdate = innerSub.size > 0 ? updateWriteSet(updates) : new Set<string>();
+    const condInner = [...innerSub].filter(([, n]) => !writtenByUpdate.has(n));
+    const condMap = condInner.length > 0 ? new Map([...condInner, ...sub]) : sub;
+    // NEITHER READING IS THE VALUE — decline LOUD. An inner value whose name was rewritten before a
+    // latch reader runs is not substituted, and its re-derivation reads a name written after it
+    // was computed: the name holds something else and the re-derivation computes something else.
+    // Which readers these are is exactly what the lines above render under each map: the latch's
+    // side effects and update copies under `latchMap` (or the ambient `activeSub`), the test under
+    // `condMap`. Materialized and effectful ops are the side effects' roots; a pure op renders at
+    // its use, which is one of the other two roots or outside the latch.
+    const condUnreadable = new Set(unreadable);
+    for (const [v] of innerSub) {
+      if (!condMap.has(v) && readsClobbered(v, condMap, new Set([...writtenAfter.get(v)!, ...writtenByUpdate]))) {
+        condUnreadable.add(v);
+      }
+    }
+    if (condUnreadable.size > 0) {
+      const needs = (root: Value, stop: ReadonlyMap<Value, string> | null, targets: ReadonlySet<Value>): boolean => {
+        const seen = new Set<Value>();
+        const walk = (x: Value): boolean => {
+          if (seen.has(x) || stop?.has(x) === true || varName.has(x)) {
+            return false;
+          }
+          if (targets.has(x)) {
+            return true;
+          }
+          seen.add(x);
+          return defs.get(x)?.operands.some(walk) ?? false;
+        };
+        return walk(root);
+      };
+      const bodyMap = latchMap ?? activeSub;
+      const effectRoots = dw.latch.ops
+        .slice(0, -1)
+        .filter(
+          (op) => op.results.length === 0 || materialize.has(op) || EFFECTFUL_OPS.has(op.opcode) || unreadResult(op),
+        )
+        .flatMap((op) => op.operands);
+      const updateRoots = successorTo(dw.latch, dw.header)!.args;
+      if (
+        [...effectRoots, ...updateRoots].some((r) => needs(r, bodyMap, unreadable)) ||
+        needs(lterm.operands[0], condMap, condUnreadable)
+      ) {
+        throw new StructureError(
+          `cannot structure '${fn.name}': a loop latch reads an inner loop's value whose name was rewritten ` +
+            `after the inner loop, and re-deriving it reads a name the inner loop wrote`,
+        );
+      }
+    }
+    let cond = exprWith(condMap)(lterm.operands[0]);
     if (lterm.successors[1].block === dw.header) {
       cond = negateCond(cond);
     } // continue edge must be `taken`
@@ -4415,8 +5627,8 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // computation, a call. The count is then a floor rather than the access set, and it is read as
   // the access set (the l3/volatileval.ts gate), so it refuses instead of reporting a number that
   // undercounts. Reached rather than theoretical: an address-escaped frame scratch takes it —
-  // `synthetic:dma_fill_uninit` and `kleod:ProcessInputAndUpdateEntities` both lose their record
-  // here.
+  // `synthetic:dma_fill_uninit` loses its record here, and so did `kleod:ProcessInputAndUpdateEntities`
+  // before that row was retired (2026-09-13).
   const frameRecord = (at: Op): { frame?: { loads: number; stores: number } } => {
     const off = at.attrs.off as number;
     const roots = new Set<Value>();
@@ -4488,7 +5700,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         type: T.int((op.attrs.width as number) * 8, op.attrs.signed as boolean),
         // the asm materialized this slot's address, and this is how many times it
         // loaded and stored through it — both asm facts, and the gate the
-        // l3/volatileval.ts lever reads (see the SFn.locals doc)
+        // l3/volatileval.ts variation reads (see the SFn.locals doc)
         ...frameRecord(op),
         // an ESCAPED address makes every store observable (the DMA hardware reads it), and
         // the source spells the scratch volatile for that reason — see the stamp site in
@@ -4718,14 +5930,24 @@ function mkIf(cond: Expr, thenS: Stmt[], elseS: Stmt[]): Stmt {
 }
 
 // --- CFG utilities ---
+/** Every block's in-edges. THROWS BY NAME on a successor that is not a block of `fn` — the one
+ *  state that makes this map lie, and the one the whole structurer reads positions and dominance
+ *  out of. `ir/verify.ts` already rejects that state with a name and the tower runs it after the
+ *  lift and after every raising pass, so reaching HERE means a pass built it after the last verify:
+ *  exactly when a named error beats a `TypeError` from a CFG utility 3000 lines from anything the
+ *  reader recognises. switch-recover.ts PRE5 and its test cite this throw as a loud invariant. */
 function predecessorBlocks(fn: Fn): Map<Block, Block[]> {
   const m = new Map<Block, Block[]>();
   for (const b of fn.blocks) {
     m.set(b, []);
   }
-  for (const b of fn.blocks) {
+  for (const [i, b] of fn.blocks.entries()) {
     for (const s of successorsOf(b)) {
-      m.get(s)!.push(b);
+      const preds = m.get(s);
+      if (!preds) {
+        throw new Error(`successor of block ${i} is not a block of this fn (fn '${fn.name}', predecessorBlocks)`);
+      }
+      preds.push(b);
     }
   }
   return m;
@@ -4761,22 +5983,24 @@ function* inEdgeRecords(preds: Map<Block, Block[]>, b: Block): Generator<{ pred:
   }
 }
 
-// Immediate post-dominators. EXIT is represented as `null`; ret-blocks post-lead to it.
-function postDominators(fn: Fn): Map<Block, Block | null> {
-  const nodes: (Block | null)[] = [null, ...fn.blocks];
+// Immediate post-dominators. EXIT is represented as `null`; ret-blocks post-lead to it. Over the
+// subgraph `keep` induces when given, every member of which must still reach a `ret` inside it.
+function postDominators(fn: Fn, keep?: ReadonlySet<Block>): Map<Block, Block | null> {
+  const blocks = keep ? fn.blocks.filter((b) => keep.has(b)) : fn.blocks;
+  const nodes: (Block | null)[] = [null, ...blocks];
   const succ = (b: Block): (Block | null)[] => {
     const term = b.ops[b.ops.length - 1];
-    return term.opcode === 'ret' ? [null] : successorsOf(b);
+    return term.opcode === 'ret' ? [null] : successorsOf(b).filter((s) => keep === undefined || keep.has(s));
   };
   const pdom = new Map<Block | null, Set<Block | null>>();
   pdom.set(null, new Set([null]));
-  for (const b of fn.blocks) {
+  for (const b of blocks) {
     pdom.set(b, new Set(nodes));
   }
   let changed = true;
   while (changed) {
     changed = false;
-    for (const b of fn.blocks) {
+    for (const b of blocks) {
       const ss = succ(b);
       let inter: Set<Block | null> | null = null;
       for (const s of ss) {
@@ -4801,7 +6025,7 @@ function postDominators(fn: Fn): Map<Block, Block | null> {
   }
   // ipdom(b) = the strict post-dom c with (strictPostDoms(b) \ {c}) ⊆ pdom(c)
   const ipdom = new Map<Block, Block | null>();
-  for (const b of fn.blocks) {
+  for (const b of blocks) {
     const strict = [...pdom.get(b)!].filter((c) => c !== b);
     let chosen: Block | null = null;
     for (const c of strict) {