@asmlift/core 0.7.0 → 0.8.0

package/src/l3/advance.ts

@@ -81,7 +81,7 @@
 //     the promoted form.
 import { type IrType, scalarTypeForAccess } from '../ir/types';
 import { cellAddress } from './address';
-import { type Expr, type SFn, type Stmt, mapExprChildren, mapStmtExprs, stmtChildren, stmtExprs } from './ast';
+import { type Expr, type SFn, type Stmt, isLoop, mapExprChildren, mapStmtExprs, stmtChildren, stmtExprs } from './ast';
 import { type Gate, firstRejection } from './gates';
 import type { BaseInit } from './hoist';
 import { nameAllocator, placeBaseLocals } from './hoist';
@@ -230,7 +230,7 @@ function collectSites(body: readonly Stmt[]): { sites: Site[]; nestedAddrs: Set<
   };
   const walk = (stmts: readonly Stmt[], stmt: number, nested: boolean): void => {
     for (const s of stmts) {
-      const repeats = s.k === 'while' || s.k === 'dowhile' || s.k === 'for';
+      const repeats = isLoop(s);
       for (const e of stmtExprs(s)) {
         visit(e, stmt, nested || repeats);
       }

package/src/l3/argbase.ts

@@ -39,7 +39,7 @@
 // leaves the diff at 2; both together take it to 0.)
 import { type IrType, T, scalarTypeForAccess } from '../ir/types';
 import type { Expr, SFn, Stmt } from './ast';
-import { mapExprChildren, stmtExprs } from './ast';
+import { isLoop, mapExprChildren, stmtExprs } from './ast';
 import { nameAllocator } from './hoist';
 import { declaredGlobals } from './storage';
 
@@ -133,7 +133,7 @@ export function materializeArgBases(sfn: SFn): SFn | null {
     // had. That is the register-pressure failure basecse.ts's `inLoop` gate exists to refuse, and
     // it would contradict this pass's own placement rule two comments down. So a loop's condition
     // is left alone; only its body (via the recursion) is eligible.
-    const ownExprs = s.k === 'while' || s.k === 'dowhile' || s.k === 'for' ? [] : stmtExprs(s);
+    const ownExprs = isLoop(s) ? [] : stmtExprs(s);
     for (const e of ownExprs) {
       const scan = (x: Expr): void => {
         if (x.k === 'call') {

package/src/l3/argcopy.ts

@@ -0,0 +1,269 @@
+// L3 respell variation: copy a pointer PARAMETER into a local for ONE REGION.
+//
+// A pointer parameter that a whole function reads pins its incoming register for the whole body.
+// A source that instead copies it into a local — `u8 *b = a0;` at the head of the block that uses
+// it — hands the allocator a SECOND name for the same address, which it may home in a different
+// register, freeing the parameter's for something else. On
+// pokeemerald:SetMauvilleOldManLanguage:agbcc that something else is the arm's loop counter: the
+// target copies the base with `adds r6, r5, #0` and then counts in r5.
+//
+// WHY THIS IS NOT ANY OF ITS NEIGHBOURS. `l3/scopebase.ts` hoists one base per region too, but the
+// value it hoists is the ADDRESS OF A GLOBAL (`(T *)&gSym`) and its `shadowed-or-nonarray-base`
+// rule refuses a `var` base precisely because `&local` names a different object; a parameter
+// already HOLDS the pointer, so nothing is addressed and that rule's argument does not reach here.
+// `l3/argbase.ts` names a call argument's fixed addresses, `l3/inlinebase.ts` DELETES a
+// constant-address local, and `l3/parkfirst.ts` only reorders a copy the tree already has. None of
+// them mints `b = a0`.
+//
+// THE COPY IS A PLAIN LOCAL, NOT A SCOPED DECLARATION. Both spellings — a braced region
+// declaration, and a function-top local assigned at the head of the region — were taken through
+// this row's own agbcc and produce the same bytes, so this pass emits the one L3 already spells
+// and adds no block-scope representation to carry a distinction no object shows.
+//
+// WHAT IT GIVES UP, NAMED. A pointer parameter read only inside a loop that sits at FUNCTION TOP
+// LEVEL gets no candidate at all: `regions()` does not offer the function's own list, so the only
+// region over those reads is the loop body, and `loop-region` refuses it. That population — a base
+// live across a top-level loop — is `/livebase` and `/hipress`'s, and the decline is deliberate.
+// The spelling that shape wants is a copy placed BEFORE the loop with only the loop's reads
+// repointed: a copy SITE separate from its region, which nothing here represents. Relaxing
+// `loop-region` does not reach it — it mints the per-iteration copy that rule exists to refuse.
+//
+// WHAT IS ENUMERATED, AND WHY. Which region the source copied in is not derivable from the tree,
+// so every legal region is offered as its own candidate and the differ referees — the `/regcopy`
+// idiom this file shares with `l3/coalesce.ts`. Uses OUTSIDE the chosen region keep naming the
+// parameter, which is the point: the copy is what makes the two live ranges separable.
+//
+// IT KEEPS ITS OWN REGION WALK, AND THAT IS A SECOND REGION MODEL. `l3/scopebase.ts` ships one
+// already, and this is a narrower duplicate; merging them is the right end state. What blocks that
+// is the SAFETY OBLIGATION, not the region question. scopebase hoists a pure ADDRESS and
+// discharges its obligation by PLACEMENT — `assertHoistsDominate` re-walks the emitted tree to
+// check the hoist dominates every use it repointed. This pass hoists a VALUE the caller passed:
+// its obligation is a whole-function invariance fact (`assigned`, `addressed`) that no placement
+// check can see, and it needs no dominance check at all, because uses outside the region are not
+// repointed. One table over both would need scopebase's `collect()` to admit a plain `var` read
+// as a site and `AccessCtx`/`keyOf` to key a parameter — a widening of a file four shipped
+// variations rest on. Until then every walk HERE goes through `ast.ts`'s shared ones, so the two
+// models at least cannot disagree about what a statement contains.
+import type { Expr, SFn, Stmt } from './ast';
+import { isLoop, mapExprChildren, mapStmtExprs, mapStmtLists, stmtChildren, stmtLists, walkExprs } from './ast';
+import { type Gate, firstRejection } from './gates';
+import { nameAllocator } from './hoist';
+
+/** One candidate copy, as the gates see it. */
+export interface ArgCopyCtx {
+  /** the parameter being copied */
+  readonly param: string;
+  /** the parameter's declared type is a pointer — the register this variation is about is a base */
+  readonly isPointer: boolean;
+  /** the function assigns the parameter somewhere, so a copy taken earlier can go stale */
+  readonly assigned: boolean;
+  /** `&param` occurs, so the copy is a DIFFERENT object and any write through the address misses it */
+  readonly addressed: boolean;
+}
+
+/** The admission rules. The two SOUND ones are the whole soundness argument: with the parameter
+ *  never assigned and never addressed, the copy holds the parameter's value at every point the
+ *  region can reach, so repointing the region's reads at it renames a value rather than changing
+ *  one. Drop either and the rewrite names different memory — C that compiles and scores.
+ *
+ *  Both are decided over the WHOLE tree — see `countReads` on why every walk in this file goes
+ *  through `stmtChildren`/`walkExprs`. A gate that called itself sound while judging a subset of the
+ *  statements `repoint` rewrites would be sound about a function nobody compiles. */
+export const ARGCOPY_GATES: readonly Gate<ArgCopyCtx>[] = [
+  {
+    id: 'non-pointer',
+    why: 'the freed register is a base register, and a scalar parameter does not hold one',
+    sound: false,
+    rejects: (c) => !c.isPointer,
+  },
+  {
+    id: 'assigned',
+    why: 'the function assigns the parameter, so the copy would hold a value the parameter no longer has',
+    sound: true,
+    guardedBy: 'argcopy.test.ts: a parameter a `for` header ADVANCES is never copied',
+    rejects: (c) => c.assigned,
+  },
+  {
+    id: 'addressed',
+    why: 'taking the parameter’s address names its own cell, and the copy is a different cell',
+    sound: true,
+    guardedBy: 'argcopy.test.ts: a parameter whose ADDRESS is taken in a `for` header is never copied',
+    rejects: (c) => c.addressed,
+  },
+];
+
+/** One candidate REGION, as the region rules see it. Separate from {@link ARGCOPY_GATES} for the
+ *  reason `scopebase` keeps two tables: those rules judge the PARAMETER once, these judge each
+ *  place it could be copied, and a refusal tally that mixed the two would count a parameter's
+ *  single verdict once per region. */
+export interface ArgCopyRegionCtx {
+  /** reads of the parameter inside this region */
+  readonly reads: number;
+  /** a loop encloses the region — its own body, or any list nested below one */
+  readonly underLoop: boolean;
+}
+
+/** Which regions are worth offering. NEITHER is sound — each refuses a spelling that is correct
+ *  but models nothing, and what they buy is the candidate count: every one of these is a COMPILE,
+ *  and this variation multiplies with `/coalesce`. */
+export const ARGCOPY_REGION_GATES: readonly Gate<ArgCopyRegionCtx>[] = [
+  {
+    id: 'single-read',
+    why: 'a region reading the parameter once gives the allocator no live range to shorten, so the copy buys nothing',
+    sound: false,
+    rejects: (c) => c.reads < 2,
+  },
+  {
+    id: 'loop-region',
+    why: 'a copy anywhere inside a loop re-runs every iteration, so it belongs to a region that holds the loop instead — and no region does when the loop is at function top level, where this variation offers nothing at all',
+    sound: false,
+    // the second clause has its own test, which `guardedBy` cannot also name (one title per gate):
+    // `argcopy.test.ts: a TOP-LEVEL loop is offered NOTHING`
+    guardedBy: 'argcopy.test.ts: an arm NESTED inside a loop body is refused too',
+    rejects: (c) => c.underLoop,
+  },
+];
+
+/** How many `var n` leaves the region holds, nested statements included — the region rules'
+ *  yardstick for whether a copy has a range to shorten.
+ *
+ *  `walkExprs` (ast.ts) is the whole-tree walk, which descends through `stmtChildren` and so sees a
+ *  `for`'s `init` and `inc`. That is the walk this file must use everywhere: `repoint` rewrites
+ *  those two statements (`mapStmtExprs` recurses into them), so a count taken with `stmtLists` —
+ *  which deliberately omits them, being a walk over the SCOPES a statement opens — would report
+ *  fewer reads than the rewrite touches. */
+function countReads(list: Stmt[], n: string): number {
+  let reads = 0;
+  for (const e of walkExprs(list)) {
+    if (e.k === 'var' && e.name === n) {
+      reads++;
+    }
+  }
+  return reads;
+}
+
+/** Every nested statement list in `body`, each with the path that reaches it — a REGION is any
+ *  list a statement contains, which is what a `case` body, an `if` arm and a loop body all are.
+ *  The function's own top-level list is NOT among them: repointing it renames the parameter over
+ *  the whole function, which is a PARK — the shape `l3/parkfirst.ts` reorders — and not the two
+ *  separable live ranges this variation is about. */
+function regions(body: Stmt[]): { at: number[]; list: Stmt[]; underLoop: boolean }[] {
+  const out: { at: number[]; list: Stmt[]; underLoop: boolean }[] = [];
+  // carried DOWN rather than read off the immediate parent: an `if` arm two levels inside a loop
+  // body re-runs every iteration exactly as the body does, which is what `loop-region` refuses
+  const walk = (list: Stmt[], path: number[], underLoop: boolean): void => {
+    list.forEach((st, i) => {
+      const inside = underLoop || isLoop(st);
+      stmtLists(st).forEach((inner, j) => {
+        const here = [...path, i, j];
+        out.push({ at: here, list: inner, underLoop: inside });
+        walk(inner, here, inside);
+      });
+    });
+  };
+  walk(body, [], false);
+  return out;
+}
+
+/** `list` with every `var n` leaf rewritten to `var to`, nested statements included. Both kind
+ *  switches are ast.ts's, so a new statement or expression kind is that file's problem, not this
+ *  one's.
+ *
+ *  ONE walk: `mapStmtExprs` already recurses into every nested statement — a `for`'s `init`/`inc`
+ *  included, which is what makes this symmetric with `countReads` — so a single `map` over the list
+ *  reaches the whole subtree. Driving it through `mapStmtLists` as well would visit a statement at
+ *  depth d once per level above it: 40 expression visits against 13 on a five-level tree (switch >
+ *  for > do-while > if > store). This runs once per region per parameter per candidate, and each
+ *  candidate is a compile. */
+function repoint(list: Stmt[], n: string, to: string): Stmt[] {
+  const inExpr = (e: Expr): Expr => (e.k === 'var' && e.name === n ? { ...e, name: to } : mapExprChildren(e, inExpr));
+  return list.map((s) => mapStmtExprs(s, inExpr));
+}
+
+/** Replace the region at `at` with `next`. */
+function replaceRegion(body: Stmt[], at: number[], next: Stmt[]): Stmt[] {
+  const [i, j, ...rest] = at;
+  return body.map((st, k) => {
+    if (k !== i) {
+      return st;
+    }
+    let seen = -1;
+    return mapStmtLists(st, (inner) => {
+      seen++;
+      if (seen !== j) {
+        return inner;
+      }
+      return rest.length ? replaceRegion(inner, rest, next) : next;
+    });
+  });
+}
+
+/** `argCopyCandidates` with the gate table supplied plus which gate refused each parameter — the
+ *  same ablation-as-a-value seam the coalescer provides. */
+export function argCopyUnder(
+  gates: readonly Gate<ArgCopyCtx>[],
+  sfn: SFn,
+  regionGates: readonly Gate<ArgCopyRegionCtx>[] = ARGCOPY_REGION_GATES,
+): { candidates: { merged: string; sfn: SFn }[]; refusals: Map<string, number> } {
+  const refusals = new Map<string, number>();
+  const out: { merged: string; sfn: SFn }[] = [];
+  /** `&n` anywhere in the function — every expression node, `for` header included. */
+  const addressed = (n: string): boolean => {
+    for (const e of walkExprs(sfn.body)) {
+      if (e.k === 'addr' && e.name === n) {
+        return true;
+      }
+    }
+    return false;
+  };
+  /** The function assigns `n` anywhere. `stmtChildren`, never `stmtLists`: a `for`'s `init` and
+   *  `inc` are STATEMENTS rather than lists, and an induction step that advances the parameter is
+   *  exactly one of them — the shape `structure/structure.ts`'s `recognizeForLoops` mints. */
+  const assignsTo = (n: string, list: Stmt[] = sfn.body): boolean =>
+    list.some((st) => (st.k === 'assign' && st.name === n) || assignsTo(n, stmtChildren(st)));
+  for (const p of sfn.params) {
+    const refused = firstRejection(gates, {
+      param: p.name,
+      isPointer: p.type.kind === 'ptr',
+      assigned: assignsTo(p.name),
+      addressed: addressed(p.name),
+    });
+    if (refused !== null) {
+      refusals.set(refused, (refusals.get(refused) ?? 0) + 1);
+      continue;
+    }
+    for (const r of regions(sfn.body)) {
+      // not a gate: a region with no read of the parameter has nothing to repoint
+      const reads = countReads(r.list, p.name);
+      if (reads === 0) {
+        continue;
+      }
+      const regionRefused = firstRejection(regionGates, { reads, underLoop: r.underLoop });
+      if (regionRefused !== null) {
+        refusals.set(regionRefused, (refusals.get(regionRefused) ?? 0) + 1);
+        continue;
+      }
+      // allocated against the ORIGINAL function, so every candidate names its copy identically —
+      // each is a separate tree and none of them ever meets another
+      const name = nameAllocator(sfn)();
+      const copied = [
+        { k: 'assign', name, value: { k: 'var', name: p.name } } as Stmt,
+        ...repoint(r.list, p.name, name),
+      ];
+      out.push({
+        merged: `${p.name}@${r.at.join('.')}`,
+        sfn: {
+          ...sfn,
+          body: replaceRegion(sfn.body, r.at, copied),
+          locals: [...sfn.locals, { name, type: p.type }],
+        },
+      });
+    }
+  }
+  return { candidates: out, refusals };
+}
+
+/** Every legal region copy, each as its own tree. */
+export function argCopyCandidates(sfn: SFn): { merged: string; sfn: SFn }[] {
+  return argCopyUnder(ARGCOPY_GATES, sfn).candidates;
+}

package/src/l3/ast.ts

@@ -266,7 +266,13 @@ export type Stmt =
   // by instrumenting the printer. Both regimes produce them: the jump table spells `case 4:` of
   // `kleod:UpdateWorldMapNodeAnim`, the comparison tree `synthetic:sw_fallmem:agbcc`.
   | { k: 'switch'; scrutinee: Expr; cases: SwitchCase[]; default?: Stmt[]; defaultAt?: number }
-  | { k: 'return'; value?: Expr };
+  // `unspelled` — the assembly shows no `return` STATEMENT behind this node: the machine reached
+  // the epilogue here by falling into it, or on a conditional branch's own edge, never by the
+  // `b <epilogue>` a source `return;` compiles to (structure.ts sets it; the reading is stated
+  // there). A void return is then a no-op wherever nothing follows it, and `l3/tailret.ts` drops
+  // it — which is not cosmetic: unoptimised code gives every source `return;` a branch of its own,
+  // so the redundant spelling costs bytes. Advice about SPELLING; nothing may read it as semantics.
+  | { k: 'return'; value?: Expr; unspelled?: true };
 
 /** One arm of a `switch`. `values` stacks multiple `case K:` labels onto one body (`case 1: case 2:`).
  *  `fallsThrough` true ⇒ the body flows into the NEXT arm (no `break;`); see the non-neutrality note. */
@@ -725,6 +731,44 @@ export function stmtChildren(s: Stmt): Stmt[] {
   }
 }
 
+/** A statement that REPEATS what it contains — what {@link isLoop} narrows to.
+ *
+ *  Derived STRUCTURALLY, not from a second list of kinds: a repeating statement is exactly one that
+ *  carries both a `cond` and a `body`, and no other `Stmt` carries both (`if` has `cond` without
+ *  `body`, `switch` has neither). A new repeating kind therefore joins this type by construction,
+ *  where a hand-written kind list falls out of step SILENTLY — TypeScript does not check a
+ *  predicate's body against the type it asserts. */
+export type Loop = Extract<Stmt, { cond: Expr; body: Stmt[] }>;
+
+/** Does this statement REPEAT what it contains? Its body and its own condition run once per
+ *  iteration, which is the fact half of `l3/` asks about: a hoist out of one is loop-invariant
+ *  code motion, a copy inside one re-runs, and a live range that crosses one is under pressure.
+ *
+ *  It lives here, exhaustive and with no `default`, for the reason {@link stmtLists} does: a new
+ *  `Stmt` kind that repeats is then a compile error at ONE site rather than a silent `false` in
+ *  each caller's own hand-spelled kind test. It NARROWS to {@link Loop} rather than returning
+ *  `boolean`, because a caller that reaches `body` afterwards cannot use a `boolean` one and spells
+ *  the kind test out again instead. `backend/pascal.ts` is where that costs correctness: its
+ *  `hasReturn` walk decides a LOUD failure — Pascal's `case-of` cannot spell an early `return` — so
+ *  a repeating kind read as a non-loop turns the refusal into an emitted miscompile. */
+export function isLoop(s: Stmt): s is Loop {
+  switch (s.k) {
+    case 'while':
+    case 'dowhile':
+    case 'for':
+      return true;
+    case 'if':
+    case 'switch':
+    case 'assign':
+    case 'store':
+    case 'exprstmt':
+    case 'return':
+    case 'break':
+    case 'continue':
+      return false;
+  }
+}
+
 /** The nested statement LISTS of a statement — the SCOPES it opens.
  *
  *  Deliberately not `stmtChildren`, which flattens a `for`'s `init`/`inc` in with its body: those

package/src/l3/basecse.ts

@@ -108,7 +108,7 @@
 import { assertHoistsDominate } from '../contracts';
 import { type IrType, T, scalarTypeForAccess, typeToString } from '../ir/types';
 import type { Expr, SFn, Stmt } from './ast';
-import { exprChildren, mapExprChildren, mapStmtExprs, stmtChildren, stmtExprs } from './ast';
+import { exprChildren, isLoop, mapExprChildren, mapStmtExprs, stmtChildren, stmtExprs } from './ast';
 import { type Gate, ablateHeuristic, firstRejection } from './gates';
 import { type BaseInit, type HoistPlacement, nameAllocator, placeBaseLocals } from './hoist';
 
@@ -240,7 +240,7 @@ function collect(stmts: Stmt[], c: Collected, loop: boolean): void {
   for (const s of stmts) {
     // A loop's OWN condition (`stmtExprs` of a while/do-while/for) runs every iteration, so a base
     // there is loop-invariant just like a body use — visit it with `nested`, not the outer flag.
-    const nested = loop || s.k === 'while' || s.k === 'dowhile' || s.k === 'for';
+    const nested = loop || isLoop(s);
     for (const e of stmtExprs(s)) {
       visitExpr(e, nested);
     }

package/src/l3/coalesce.ts

@@ -6,18 +6,15 @@
 // TWO admission paths live here, each with its own gate table and its own reading of loops. The
 // SPAN path (COALESCE_GATES) proves disjoint liveness from preorder position, so it asks which
 // loops RE-RUN a mention of each local and refuses a pair only when one loop holds both. The
-// ARM-DISJOINT path (ARM_DISJOINT_GATES) proves the two never coexist because one `if` picks
-// between them, so it asks only whether ANY loop encloses that `if` — a second entry breaks the
-// argument however the arms' own loops relate. `coalesceCandidates` offers both.
+// ARM-DISJOINT path (ARM_DISJOINT_GATES) proves the two never coexist because one BRANCH picks
+// between them — an `if`'s two arms or a `switch`'s case bodies alike — so it asks only whether ANY
+// loop encloses that branch (a second entry breaks the argument however the arms' own loops relate)
+// and whether fall-through joins the two arms onto one path. `coalesceCandidates` offers both.
 import { typeToString } from '../ir/types';
 import type { Expr, SFn, Stmt } from './ast';
-import { exprChildren, mapExprChildren, stmtChildren, stmtExprs } from './ast';
+import { exprChildren, isLoop, mapExprChildren, stmtChildren, stmtExprs } from './ast';
 import { type Gate, firstRejection } from './gates';
 
-/** THE loop-kind test, shared by both admission paths in this file — the span model's enclosure
- *  walk and the arm path's `visit`. */
-const isLoop = (s: Stmt): boolean => s.k === 'while' || s.k === 'dowhile' || s.k === 'for';
-
 function namesIn(e: Expr, out: Set<string>): void {
   // `addr` names a GLOBAL (`&gSym`) or a LOCAL — the structurer renders an `laddr` frame object
   // as `&sp0`, an addr node over a name that IS in `sfn.locals`. Both are collected, because a
@@ -325,8 +322,11 @@ function localsAfterMerge(locals: SFn['locals'], gone: string, kept: string): SF
 export interface ArmPair {
   a: string;
   b: string;
-  /** the confining `if` has a loop ancestor, so it can run more than once */
+  /** the confining branch has a loop ancestor, so it can run more than once */
   ifInLoop: boolean;
+  /** control can run from one of the two arms INTO the other — `switch` fall-through, the one
+   *  way two arms of a branch land on a single path. Always false for an `if`. */
+  armsJoined: boolean;
   sameType: boolean;
   /** either local is object-volatile or carries a pointee-volatile qualifier (see MergePair) */
   eitherIsVolatile: boolean;
@@ -341,12 +341,13 @@ export interface ArmPair {
  *  different reason: `arm-init` is a FIRST-MENTION rule where `const-fed` is an every-assign one,
  *  so arms that open with a const write and then compute (`x = 0; x = x + 1;`) merge here and not
  *  there. Two locals confined to
- *  OPPOSITE arms of one `if` never coexist at runtime: the `if` picks one arm, so no read of either
- *  can observe the other's write — no liveness reasoning needed. That argument is exactly what the
- *  `loop` gate here protects: a loop ancestor re-enters the `if`, later entries can take the other
- *  arm, and a value written on one visit becomes readable on the next. Note this gate wants ANY
- *  enclosing loop, not the span model's shared-loop rule: never-coexisting is a claim about one
- *  entry, so a second entry breaks it however the two arms' loops relate. */
+ *  DIFFERENT arms of one branch never coexist at runtime: the branch picks one arm, so no read of
+ *  either can observe the other's write — no liveness reasoning needed. `branchArms` says what an
+ *  arm is, and the argument holds for a `switch`'s case bodies exactly as it does for an `if`'s two.
+ *
+ *  Two gates protect it, one per way it fails. `loop` covers a SECOND ENTRY, which is why it wants
+ *  ANY enclosing loop rather than the span model's shared-loop rule: never-coexisting is a claim
+ *  about one entry. `fall-through` covers the failure WITHIN one entry. */
 export const ARM_DISJOINT_GATES: readonly Gate<ArmPair>[] = [
   {
     id: 'type',
@@ -363,11 +364,18 @@ export const ARM_DISJOINT_GATES: readonly Gate<ArmPair>[] = [
   },
   {
     id: 'loop',
-    why: 'a loop ancestor re-enters the if, so opposite arms both run and a value could cross',
+    why: 'a loop ancestor re-enters the branch, so different arms both run and a value could cross',
     sound: true,
-    guardedBy: 'coalesce.test.ts: an in-loop if never admits its arm pair',
+    guardedBy: 'coalesce.test.ts: never admits its arm pair',
     rejects: (c) => c.ifInLoop,
   },
+  {
+    id: 'fall-through',
+    why: 'a case that runs on into the other arm puts both locals on one path, so they coexist',
+    sound: true,
+    guardedBy: 'coalesce.test.ts: two arms joined by fall-through never merge',
+    rejects: (c) => c.armsJoined,
+  },
   {
     id: 'arm-init',
     why: 'a local its arm does not first set to a constant is one the compiler had a reason to keep apart',
@@ -477,6 +485,44 @@ function mentionIndex(): {
   return { mentionsOf, mentionsUnder, firstMention };
 }
 
+/** The MUTUALLY EXCLUSIVE arms of a branching statement, and which pairs of them control can
+ *  nevertheless run through together — the one shape both admission sites read, so `if` and
+ *  `switch` are one rule here rather than two walkers.
+ *
+ *  An `if` has exactly two arms and no way to reach one from the other. A `switch`'s arms are its
+ *  `case` bodies, and FALL-THROUGH is the one way two of them land on a single path: arm `i` runs
+ *  into arm `j` exactly when every arm from `i` up to `j` falls through, so the reach is the
+ *  TRANSITIVE chain and not merely the adjacent pair.
+ *
+ *  ITS REACH, MEASURED, because a soundness argument with no corpus witness should say so. Counted
+ *  2026-09-19 with a throwaway counter in this walk, over `pnpm bench sweep --fan --map-modes
+ *  harness,nomap` — 2,396 records over the 1,198-row corpus: the switch half ADMITS 192 pairs, all
+ *  on `pokeemerald:SetMauvilleOldManLanguage:agbcc` and none on any other function. Across all five
+ *  gates, `arm-init` refuses 4,024 and `type` 1,346, while `volatile`, `loop` and `fall-through`
+ *  refuse **zero** — so what bounds this extension corpus-wide is a COST gate, while both SOUND
+ *  rules are witnessed only by the fixtures in `coalesce.test.ts`. Re-take the count rather than
+ *  quoting it: a corpus that grows falsifies the number, not the argument.
+ *
+ *  A `switch`'s `default` body is deliberately NOT an arm. `defaultAt` may place the label between
+ *  case labels, where the body is reachable both by dispatch and by running on into the arm below
+ *  it — a path `fallsThrough` does not describe, because the flag indexes the `cases` array the
+ *  label does not sit in. Rather than reason about a position this file cannot see, no pair
+ *  involving the default is offered: a merge withheld is a candidate missed, a merge admitted on a
+ *  path that exists is a wrong answer. */
+const branchArms = (st: Stmt): { arms: Stmt[][]; joined: (i: number, j: number) => boolean } | null => {
+  if (st.k === 'if' && st.then.length && st.else.length) {
+    return { arms: [st.then, st.else], joined: () => false };
+  }
+  if (st.k === 'switch') {
+    const { cases } = st;
+    return {
+      arms: cases.map((c) => c.body),
+      joined: (i, j) => cases.slice(Math.min(i, j), Math.max(i, j)).every((c) => c.fallsThrough),
+    };
+  }
+  return null;
+};
+
 /** `armDisjointCandidates` with the gate table supplied plus which gate refused each pair — the
  *  same ablation-as-a-value seam `coalesceUnder` provides for the span table. */
 export function armDisjointUnder(
@@ -498,44 +544,55 @@ export function armDisjointUnder(
     const l = locals.get(n);
     return l !== undefined && isVolatileLocal(l);
   };
+  // locals only, and never a name that is ALSO a param — the span path holds the same belief as a
+  // gate, and a local shadowing a param would let rename() rewrite the param's own mentions
+  const confined = (m: Map<string, number>): string[] =>
+    [...m.entries()].filter(([n, k]) => locals.has(n) && !params.has(n) && total.get(n) === k).map(([n]) => n);
   const visit = (stmts: Stmt[], inLoop: boolean): void => {
     for (const st of stmts) {
-      if (st.k === 'if' && st.then.length && st.else.length) {
-        const thenM = mentionsOf(st.then);
-        const elseM = mentionsOf(st.else);
-        // locals only, and never a name that is ALSO a param — the span path holds the same
-        // belief as a gate, and a local shadowing a param would let rename() rewrite the param's
-        // own mentions
-        const confined = (m: Map<string, number>): string[] =>
-          [...m.entries()].filter(([n, k]) => locals.has(n) && !params.has(n) && total.get(n) === k).map(([n]) => n);
-        for (const a of confined(thenM)) {
-          for (const b of confined(elseM)) {
-            // the survivor is the earlier declaration, matching how a shared source local reads.
-            //
-            // THIS READS THE STRUCTURER'S ORDER, AND MUST. The declaration list is put into the
-            // target's frame order at EMIT time (l3/slotorder.ts), after this pass, so `declIdx`
-            // is the naming walk's order and the choice means "the earlier declaration in the
-            // source asmlift recovered". Ordering the list any earlier would silently change which
-            // local survives every arm-disjoint merge on a function whose frame order disagrees
-            // with its declaration order — exactly the population the ordering exists for.
-            const [gone, kept] = (declIdx.get(a) ?? 0) <= (declIdx.get(b) ?? 0) ? [b, a] : [a, b];
-            const refused = firstRejection(gates, {
-              a: gone,
-              b: kept,
-              ifInLoop: inLoop,
-              sameType: typeOf.get(a) === typeOf.get(b),
-              eitherIsVolatile: isVolatile(a) || isVolatile(b),
-              bothArmConstInit:
-                firstMention(st.then, a) === 'const-write' && firstMention(st.else, b) === 'const-write',
-            });
-            if (refused !== null) {
-              refusals.set(refused, (refusals.get(refused) ?? 0) + 1);
-              continue;
+      const branch = branchArms(st);
+      if (branch !== null) {
+        const { arms, joined } = branch;
+        const confinedIn = arms.map((body) => confined(mentionsOf(body)));
+        for (let i = 0; i < arms.length; i++) {
+          for (let j = i + 1; j < arms.length; j++) {
+            for (const a of confinedIn[i]) {
+              for (const b of confinedIn[j]) {
+                // the survivor is the earlier declaration, matching how a shared source local
+                // reads.
+                //
+                // THIS READS THE STRUCTURER'S ORDER, AND MUST. The declaration list is put into
+                // the target's frame order at EMIT time (l3/slotorder.ts), after this pass, so
+                // `declIdx` is the naming walk's order and the choice means "the earlier
+                // declaration in the source asmlift recovered". Ordering the list any earlier
+                // would silently change which local survives every arm-disjoint merge on a
+                // function whose frame order disagrees with its declaration order — exactly the
+                // population the ordering exists for.
+                const [gone, kept] = (declIdx.get(a) ?? 0) <= (declIdx.get(b) ?? 0) ? [b, a] : [a, b];
+                const refused = firstRejection(gates, {
+                  a: gone,
+                  b: kept,
+                  ifInLoop: inLoop,
+                  armsJoined: joined(i, j),
+                  sameType: typeOf.get(a) === typeOf.get(b),
+                  eitherIsVolatile: isVolatile(a) || isVolatile(b),
+                  bothArmConstInit:
+                    firstMention(arms[i], a) === 'const-write' && firstMention(arms[j], b) === 'const-write',
+                });
+                if (refused !== null) {
+                  refusals.set(refused, (refusals.get(refused) ?? 0) + 1);
+                  continue;
+                }
+                out.push({
+                  merged: `${gone}-${kept}`,
+                  sfn: {
+                    ...sfn,
+                    body: rename(sfn.body, gone, kept),
+                    locals: localsAfterMerge(sfn.locals, gone, kept),
+                  },
+                });
+              }
             }
-            out.push({
-              merged: `${gone}-${kept}`,
-              sfn: { ...sfn, body: rename(sfn.body, gone, kept), locals: localsAfterMerge(sfn.locals, gone, kept) },
-            });
           }
         }
       }

package/src/l3/scopebase.ts

@@ -69,7 +69,7 @@
 import { assertHoistsDominate } from '../contracts';
 import { type IrType, T, scalarTypeForAccess } from '../ir/types';
 import type { Expr, SFn, Stmt } from './ast';
-import { mapExprChildren, stmtExprs, stmtLists } from './ast';
+import { isLoop, mapExprChildren, stmtExprs, stmtLists } from './ast';
 import { type Gate, ablateHeuristic, firstRejection } from './gates';
 import { nameAllocator, takenNames } from './hoist';
 import { addressableGlobals } from './storage';
@@ -227,7 +227,7 @@ function collect(body: Stmt[], path: Stmt[][], loop: boolean[], idxPath: number[
   };
   for (const [i, s] of body.entries()) {
     at = i;
-    const isLoop = s.k === 'while' || s.k === 'dowhile' || s.k === 'for';
+    const repeats = isLoop(s);
     // A loop's OWN condition runs every iteration — a base there is loop-invariant exactly as a
     // body use is, and it lives at THIS list, which does not. basecse.ts and argbase.ts treat the
     // CONDITION the same way. They do NOT agree about a `for`'s `init`: basecse counts it in-loop
@@ -235,7 +235,7 @@ function collect(body: Stmt[], path: Stmt[][], loop: boolean[], idxPath: number[
     // it at the enclosing cadence, which is the truthful reading — it runs once. Recorded because
     // the divergence is real and an extraction has to pick one; both readings are pinned in
     // test/addr-placement.test.ts so the pick is deliberate rather than whichever survives.
-    stmtExprs(s).forEach((e) => visit(e, isLoop));
+    stmtExprs(s).forEach((e) => visit(e, repeats));
     if (s.k === 'for') {
       // `init`/`inc` are typed as the full Stmt union, so a COMPOUND one is type-legal. `stmtExprs`
       // reaches only its own expressions while `rewriteStmt` descends into any nested list — the
@@ -257,7 +257,7 @@ function collect(body: Stmt[], path: Stmt[][], loop: boolean[], idxPath: number[
       stmtExprs(s.inc).forEach((e) => visit(e, true));
     }
     for (const child of stmtLists(s)) {
-      collect(child, [...path, child], [...loop, isLoop], [...idxPath, i], st);
+      collect(child, [...path, child], [...loop, repeats], [...idxPath, i], st);
     }
   }
 }