@asmlift/core 0.8.1 → 0.9.0

package/src/structure/structure.ts

@@ -29,21 +29,37 @@
 // coalescing (canTakeName + seeding) and emission (structureBlock + the loop emitters) — they
 // share varName/backArgName mutation and the activeSub/loopCtx dynamic state.
 //
-// Scope: reducible single-latch natural loops — GUARDED self-loop `while` (the guard-fusion
-// un-rotation), UNGUARDED self-loop `do-while` (single block, header === latch), test-at-top
-// `while`, bottom-test `do-while`, PROPERLY-nested loops, in-body `break`/early-`return`,
-// comparison-tree and jump-table `switch`, and a switch arm that FALLS THROUGH into the next one
-// (both regimes — see `ArmExit` in switch-recover.ts). Still DECLINED (loud StructureError, never
-// wrong code): multi-latch headers, irreducible/overlapping loops, conditional `continue`, a
-// `break` whose exit copies would clobber, and mixed-entry self-loops (a guarded header also
-// entered by a plain br). Fall-through carries two REFUSALS of its own rather than a decline: a
-// target language whose `case` cannot fall through (`spellSwitchFallthrough` false) sends Regime A
-// back to if-recovery, and arms that do not linearize into one chain — two arms falling into the
-// same sibling, or a fall into the `default:` — refuse in `chainArms`, which answers null.
-import { constAddressOf, globalCellOf } from '../ir/alias';
-import { Block, Fn, Op, Successor, Value, defOpMap, dominators, mergeClasses, successorsOf } from '../ir/core';
-import { CAST_WIDTHS, EFFECTFUL_OPS, SPELLED_WHEN_DEAD_OPS, opSig } from '../ir/opcodes';
-import { type IrType, T, scalarTypeForAccess, typeEquals } from '../ir/types';
+// Scope: reducible natural loops — GUARDED self-loop `while` (the guard-fusion un-rotation),
+// UNGUARDED self-loop `do-while` (single block, header === latch), test-at-top `while`,
+// bottom-test `do-while`, `while (1)` for any other latch set (a conditional `continue`, a
+// mid-tested header), PROPERLY-nested loops, in-body `break`/early-`return`, comparison-tree and
+// jump-table `switch`, and a switch arm that FALLS THROUGH into the next one (both regimes — see
+// `ArmExit` in switch-recover.ts). Still DECLINED (loud StructureError, never wrong code):
+// irreducible/overlapping loops, exits to more than one live merge, a `break` out of a nested loop's
+// body, a `break` whose exit copies would clobber, and mixed-entry self-loops (a guarded header also
+// entered by a plain br).
+// Fall-through carries two REFUSALS of its own rather than a decline: a target language whose
+// `case` cannot fall through (`spellSwitchFallthrough` false) sends Regime A back to if-recovery,
+// and arms that do not linearize into one chain — two arms falling into the same sibling, or a fall
+// into the `default:` — refuse in `chainArms`, which answers null.
+import { constAddressOf, globalBaseOf } from '../ir/alias';
+import {
+  Block,
+  Fn,
+  Op,
+  Successor,
+  Value,
+  callArgs,
+  calleeName,
+  calleeValue,
+  defOpMap,
+  dominators,
+  mergeClasses,
+  successorsOf,
+} from '../ir/core';
+import { effectful, placedAt, qualified, qualifiedBy, spelledWhenDead } from '../ir/discipline';
+import { CAST_WIDTHS, opSig } from '../ir/opcodes';
+import { type IrType, T, intWidth, scalarTypeForAccess, typeEquals, unionViewAt } from '../ir/types';
 import {
   BinOp,
   Expr,
@@ -53,15 +69,21 @@ import {
   exprChildren,
   exprHasEffect,
   gapReasonFor,
+  isLoop,
   mapExprChildren,
   mapStmtExprs,
+  mentionedName,
   negateCond,
   stmtChildren,
+  stmtExprs,
+  stmtsEqual,
   walkExprs,
 } from '../l3/ast';
 import { type Gate, firstRejection } from '../l3/gates';
-import { exprCType, provablyNonNegative, ptrElemBytes, renderedIntSignedness } from '../l3/typing';
+import { exprCType, exprIntWidth, provablyNonNegative, ptrElemBytes, renderedIntSignedness } from '../l3/typing';
+import { castOffDeclaration, qualifiedMemoryAccess } from '../l3/volstore';
 import { foldConstPair, isConstFoldOpcode } from '../raise/const';
+import { stampDeclaredVolatile } from '../raise/declared-volatile';
 import { returnType } from '../raise/recover';
 import { collectStructs } from '../raise/structs';
 import {
@@ -78,7 +100,7 @@ import {
   scalarCellType,
   structFieldInnerExtents,
 } from '../symbols';
-import { analyze } from './analysis';
+import { analyze, shortCircuitGuardedValues } from './analysis';
 import { makeBitfieldSpelling } from './bitfields';
 import {
   addOffset,
@@ -90,11 +112,20 @@ import {
   globalOf,
   subscriptsFromExtents,
 } from './globalaccess';
-import { makeLoopHazards, sunkCopyOverDroppedUndef, updateWriteSet } from './hazards';
+import {
+  PREUPDATE_SINK_GATES,
+  type SinkCandidate,
+  makeLoopHazards,
+  preUpdateCopyHome,
+  sunkCopyOverDroppedUndef,
+  updateWriteSet,
+} from './hazards';
+import { type StaticLayout, localStaticShapes, nameLocalStatics } from './local-statics';
 import { type NaturalLoop, analyzeLoops } from './loops';
 import { type NameMerge, coalesceNames } from './namecoalesce';
+import { testRereadsOnly } from './redundant-test';
 import { unspelledEpilogues } from './retspell';
-import { type ArmExit, makeSwitchRecovery } from './switch-recover';
+import { type ArmExit, type SwitchBoundCase, makeSwitchRecovery } from './switch-recover';
 
 // Lower a constant-offset memory access to its lvalue/rvalue Expr. If the base was recovered as a
 // struct pointer (raise/structs.ts), the byte offset resolves to a NAMED field (`base->field_<off>`);
@@ -229,6 +260,22 @@ function spellsAccessType(declared: boolean | undefined, width: number, signed:
   return typeEquals(T.int(width * 8, declared), scalarTypeForAccess(width, signed));
 }
 
+/** The declared type of a frame-local object, from the three facts its `laddr` carries: `count`
+ *  elements of `width` bytes, signed or not. ONE element is a SCALAR typed by the access every
+ *  access agreed on. More is STORAGE the frontend's frame-object audit sized without typing —
+ *  no access pins an element type there, so the audit stamps bytes and this declares the array
+ *  that spells them. Both arms are the audit's own facts; neither infers anything here. */
+function laddrType(op: Op): IrType {
+  // a call's struct-return storage: the audit typed its address as a pointer to that struct
+  const t = op.results[0].type;
+  if (op.attrs.aggregate === true && t.kind === 'ptr') {
+    return t.to;
+  }
+  const elem = T.int((op.attrs.width as number) * 8, op.attrs.signed as boolean);
+  const count = op.attrs.count as number;
+  return count === 1 ? elem : T.array(elem, count);
+}
+
 /** May a member be NAMED by an access of this direction, given the qualifiers on its declaration?
  *  The named spelling REPLACES a cast through `(u8 *)`, which carries no qualifier at all, so a
  *  qualifier the name reintroduces changes what the compiler emits:
@@ -636,6 +683,23 @@ function globalConstByte(baseExpr: Expr, off: number): { name: string; byte: num
   return null;
 }
 
+/** The whole-element subscript a constant byte displacement denotes at a given element width — the
+ *  `idxVal + off / width` fold every indexed spelling below shares, with the rule
+ *  structure/globalaccess.ts `elementIndex` applies to a VARIABLE residual applied to the constant
+ *  one. A displacement that is not a whole number of elements has no subscript spelling at all
+ *  (`[0.5]` is not C, and agbcc answers `array subscript is not an integer`), so it declines LOUD
+ *  here, where the fraction would be computed, rather than leaving the layer above to have refused
+ *  every base that can reach it. */
+function displacementIndex(off: number, width: number): number {
+  if (off % width !== 0) {
+    throw new StructureError(
+      `a ${width}-byte access at byte ${off} of its base is not a whole number of elements from it — ` +
+        `no subscript spells it`,
+    );
+  }
+  return off / width;
+}
+
 function memAccess(
   base: Value,
   baseExpr: Expr,
@@ -742,7 +806,7 @@ function memAccess(
     return {
       k: 'index',
       base: { k: 'var', name: gbb!.name },
-      idx: addOffset(multi.idx, off / width),
+      idx: addOffset(multi.idx, displacementIndex(off, width)),
       width,
       signed,
       lead: multi.lead,
@@ -761,7 +825,7 @@ function memAccess(
     if (off === 0 && idxVal.k === 'const' && idxVal.value === 0 && scalarGlobals.has(g.name)) {
       return { k: 'var', name: g.name };
     }
-    const idx = addOffset(idxVal, off / width);
+    const idx = addOffset(idxVal, displacementIndex(off, width));
     // ARRAY-declared global (symbol map): index the bare name — `gSym[i]`, the spelling the
     // dogfood proved agbcc needs for ROM tables — with the element type registered in the env
     // so the stride check passes and no cast is added. Element-width match only.
@@ -781,9 +845,33 @@ function memAccess(
     // the array-element form — wrong for a pointer). Anything else is cast to the recovered
     // struct pointer type; the cast node prints with `->`.
     const ok = rt?.kind === 'ptr' && rt.to.kind === 'struct' && rt.to.name === bt.to.name && baseExpr.k !== 'index';
-    return { k: 'field', base: ok ? baseExpr : { k: 'cast', to: bt, e: baseExpr }, name: `field_${off}` };
+    const structBase = ok ? baseExpr : { k: 'cast' as const, to: bt, e: baseExpr };
+    // A byte range recovered as a UNION member (raise/structs.ts) is read through the view of the
+    // access's own width and extension: `p->field_0.word`, `p->field_0.half[1]`, `p->field_0.shalf`.
+    const u = unionViewAt(bt.to, off, width, signed, isStore);
+    if (u === undefined) {
+      return { k: 'field', base: structBase, name: `field_${off}` };
+    }
+    // An internal invariant: the builder made a view for every width and narrow extension a union's
+    // own base accessed, and a value that inherits the type through recoverTypes carries a pointee
+    // of its own instead.
+    if (u.view === undefined) {
+      throw new StructureError(
+        `a ${width}-byte ${isStore ? 'store' : signed ? 'signed load' : 'unsigned load'} at byte ${off} has no view in the union member '${u.member.name}'`,
+      );
+    }
+    const cell: Expr = { k: 'field', base: structBase, name: u.member.name };
+    const view: Expr = { k: 'field', base: cell, name: u.view.name, dot: true };
+    return u.index === null ? view : { k: 'index', base: view, idx: { k: 'const', value: u.index }, width, signed };
   }
-  return { k: 'index', base: baseExpr, idx: { k: 'const', value: off / width }, width, signed, ...addressEvidence };
+  return {
+    k: 'index',
+    base: baseExpr,
+    idx: { k: 'const', value: displacementIndex(off, width) },
+    width,
+    signed,
+    ...addressEvidence,
+  };
 }
 
 // A variable-index array access `base[index]`; `base[index].field_K` when a `fieldOff` marks an
@@ -932,7 +1020,7 @@ const CMP_TO_BIN: Record<string, BinOp> = {
   icmp_eq: '==',
   icmp_ne: '!=',
 };
-const ARITH_TO_BIN: Record<string, BinOp> = {
+export const ARITH_TO_BIN: Record<string, BinOp> = {
   add: '+',
   sub: '-',
   mul: '*',
@@ -952,10 +1040,48 @@ const ARITH_TO_BIN: Record<string, BinOp> = {
   logic_or: '||', // short-circuit connectives (raise/shortcircuit.ts)
 };
 
+// The float ops (ir/opcodes.ts) and their L3 operators (l3/ast.ts BinOp). A table of their own and
+// not entries in ARITH_TO_BIN, because every rule that table's consumers apply — the pointer
+// stride, the integer legalizations, the constant fold, the commutative re-spelling — is an
+// integer rule.
+const FLOAT_TO_BIN: Record<string, BinOp> = { fadd: 'f+', fsub: 'f-', fmul: 'f*', fdiv: 'f/' };
+
 // The operators whose operand order the machine does not fix — candidates for the def-order
 // re-spelling in lowerDef. `&&`/`||` are excluded: short-circuit order IS semantics.
 const COMMUTATIVE_BIN: ReadonlySet<BinOp> = new Set(['+', '*', '&', '|', '^']);
 
+// Spell a loop update at the place the bottom test reads the variable: the one `name` leaf becomes
+// `name++`. Returns null unless the rendered test MENTIONS `name` exactly once, and that mention is
+// a readable leaf. `&v1` is a mention the `++` cannot be placed on and cannot be counted out of —
+// a callee reads the object through it — so a test holding one alongside a bare `v1` is refused
+// here rather than left to `assertPostIncrUnshared`, which would abort the lift instead.
+//
+// `preUpdateCondFold` decided that on the DEF TREE, and this asks the same question of what the
+// lowering actually produced. The two can disagree — an idiom fold spells a value its operands do
+// not show, a substitution stops the render short of a leaf the walk reached — and the two
+// disagreements are not equally bad: a test that named the variable twice would be C89-undefined,
+// and one that names it not at all would drop the update altogether. Both answer null, and the
+// caller declines.
+//
+// No input reaches either answer today, so it is pinned directly, on hand-built expressions
+// (test/loop-preupdate-cond.test.ts) — the discipline `sunkCopyOverDroppedUndef` is held to.
+export function spellUpdateInCond(cond: Expr, name: string, by: 1 | -1): Expr | null {
+  let found = 0;
+  let mentions = 0;
+  const rec = (e: Expr): Expr => {
+    if (mentionedName(e) === name) {
+      mentions++;
+    }
+    if (e.k === 'var' && e.name === name) {
+      found++;
+      return { k: 'postincr', name, by };
+    }
+    return mapExprChildren(e, rec);
+  };
+  const out = rec(cond);
+  return found === 1 && mentions === 1 ? out : null;
+}
+
 // Recovered info for a self-loop header: its exit block and the per-parameter back-edge
 // arg it feeds (the value on the header→header edge). The back-edge arg is the "next"
 // value of the phi; mapping it back to the phi turns the latch test into the while test.
@@ -980,6 +1106,18 @@ interface LoopArm {
   owned: Set<Block>;
 }
 
+// A loop with no test of its own, `while (1)`: its latches are conditional continues, and it leaves
+// by a `break` to `exit` or an early `return`.
+interface ForeverLoopInfo {
+  header: Block;
+  latches: Block[];
+  forwardPreds: Block[];
+  exit: Block;
+  body: Set<Block>;
+  arms: LoopArm[];
+  breaks: Set<Block>; // the body blocks whose edge to `exit` is a `break`
+}
+
 // A test-at-top multi-block `while`. The header is a pure test whose cond_br enters `bodyEntry`
 // (inside the loop) or leaves to `exit` (the single loop exit). Unlike LoopInfo the condition reads
 // the header's params directly (top-of-iteration values) — no back-edge substitution.
@@ -991,6 +1129,7 @@ interface WhileLoopInfo {
   forwardPreds: Block[]; // header preds outside the loop body (the entry/init side)
   body: Set<Block>; // the pure natural-loop body (for in-body vs exit classification)
   arms: LoopArm[]; // the early-`return` exits out of the body (`earlyReturnArm`)
+  breaks: Set<Block>; // the body blocks whose edge to `exit` itself is a `break`
 }
 
 // Opcodes whose NUMBER OF EXECUTIONS is observable. Moving one of these out of a loop changes what
@@ -1171,6 +1310,8 @@ function reHomesParamMerge(
 export interface CarrierName {
   /** the merge is a pure alias — every in-edge hands it the same value */
   readonly pureAlias: boolean;
+  /** the name offered is that value's OWN, not a loop variable's name offered through its back edge */
+  readonly ownName: boolean;
   /** the name's declaration and the parameter disagree about carrier width */
   readonly widthDiffers: boolean;
   /** …or, at a sub-word width, about signedness — which at that width is part of the width */
@@ -1185,6 +1326,9 @@ export interface CarrierName {
   readonly carrierWritten: boolean;
   /** a value with no name of its own re-derives the name at a use past the copy */
   readonly reDerivesName: boolean;
+  /** …or reads it through a loop's back-edge argument, which carries the loop variable's name
+   *  (`backArgName`) and renders as that name past its loop */
+  readonly backArgReadsName: boolean;
 }
 
 /** `canTakeName`'s admission: may this block parameter be SPELLED with a name that already exists,
@@ -1239,6 +1383,28 @@ export const CARRIER_NAME_GATES: readonly Gate<CarrierName>[] = [
     guardedBy: 'name-clobber.test.ts: the inlined difference keeps reading the value the asm computed it from',
     rejects: (c) => !c.pureAlias && c.reDerivesName,
   },
+  {
+    // A back-edge argument is in no `varName`: it takes the header's name unconditionally
+    // (`seedLoopParams`), and the exit region's substitution renders it as that name after the loop.
+    // So a merge there offered the same name overwrites it on every other in-edge. `int u; do { … u =
+    // …; } while (--d > 0); return (c != 1 ? u : u + t) * u;` at mwcc: the merge took `u`'s name, and
+    // its `else` copy overwrote the `u` the multiply still reads.
+    id: 'back-arg-live',
+    why: "a loop's back-edge value renders under the loop variable's name after the loop, and the copies would overwrite it",
+    sound: true,
+    guardedBy: 'name-clobber.test.ts: a back-edge argument live across a merge reads the name it carries',
+    rejects: (c) => !c.pureAlias && c.backArgReadsName,
+  },
+  {
+    // `carrier-live` and `re-derives` waive a pure alias because the alias and its value are equal on
+    // every path under the value's own name. A loop variable's name holds the value only once the back
+    // edge that carries it has run.
+    id: 'alias-under-its-own-name',
+    why: "a loop variable's name holds the value it is offered for only after the back edge that carries it",
+    sound: true,
+    guardedBy: 'carrier-name.test.ts: a redundant merge shares only its value’s own name, not a later loop variable’s',
+    rejects: (c) => c.pureAlias && !c.ownName && (c.carrierLive || c.reDerivesName),
+  },
 ];
 
 /** A nested loop's header parameter offered its ENCLOSING loop's name, as
@@ -1390,11 +1556,11 @@ export interface StructureOptions {
   // body). GCC freely uses `!=`; IDO prefers `==`/`<`. A compiler behavior, not an `arch ==`
   // branch — default true (permissive; the decline path keeps it sound either way).
   switchAllowsNeqCase?: boolean;
-  // Comparison-tree switch recovery: treat a relational test whose BRANCH admits exactly one
-  // scrutinee value as that case rather than as navigation. A compiler behavior declared in
-  // TargetDescription.compilerBehaviors — a compiler opts in on evidence that its dispatch jumps
-  // straight to a bounded subtree's body. Default false: absent, every relational edge navigates.
-  switchAllowsBoundCase?: boolean;
+  // Comparison-tree switch recovery: treat a relational test as a case where the values that can
+  // reach it leave exactly one on a side its compiler's dispatch lands a body on — the BRANCH
+  // (`'taken'`) or either side (`'either'`). A compiler behavior declared in
+  // TargetDescription.compilerBehaviors. Absent: every relational edge navigates.
+  switchBoundCase?: SwitchBoundCase;
   // Comparison-tree switch recovery: emit the case arms in the order the ASSEMBLY lays their
   // bodies out, rather than sorted by ascending case value. A compiler behavior declared in
   // TargetDescription.compilerBehaviors — a compiler opts in on evidence that it neither reorders
@@ -1440,6 +1606,13 @@ export interface StructureOptions {
   // spell "no" on a public option type. The translation happens once, in `structureOptionsFor`
   // (target.ts), which is where the target-to-structurer mapping lives.
   spillSlotOrder?: 'ascending' | 'descending';
+  // Each declared callee's parameter types, carried to the backend on `SFn.declaredArgs` (see
+  // there). Built by `structureOptionsFor` from the prototype table.
+  declaredArgs?: Readonly<Record<string, readonly (string | undefined)[]>>;
+  // Each declared callee's return type, carried on `SFn.declaredReturns` the same way.
+  declaredReturns?: Readonly<Record<string, string>>;
+  // The emitted C is compiled as C++ (`SFn.dialect`).
+  dialect?: 'c++';
   // Commutative load pairs re-spell in def (evaluation) order — see the swap in lowerDef. Default
   // true; verified byte-exact on agbcc and IDO. A compiler behavior declared in
   // TargetDescription.compilerBehaviors: the first compiler whose scheduler is shown re-ordering
@@ -1485,6 +1658,10 @@ export interface StructureOptions {
   // `deviceMemoryWriters`, which no structurer rule reads). Used as a REFUSAL: absent, a dead read
   // at a literal address is dropped.
   deviceRegisters?: readonly [number, number];
+  // Does the compiler extend a `volatile` narrow signed read in a register, never in the load? The
+  // `declared` stamp structuring re-derives reads it (TargetDescription.compilerBehaviors'
+  // `volatileReadsExtendInRegister`), so it leaves unplaced the read the lift's stamp did.
+  volatileReadsExtendInRegister?: boolean;
   // Spell `(x << a) >> b` extracts of a struct global as the map's named bitfield member. On by
   // default; rank.ts enumerates the OFF spelling as the `/no-bitfield` variation, because the named
   // read recompiles at the DECLARATION's access width — where that diverges from the asm's load
@@ -1552,11 +1729,24 @@ export interface StructureOptions {
   // computation. Off by default; rank.ts enumerates the ON spelling as the `/derived-home` variation —
   // see analysis.ts AnalyzeOptions.
   homeDerivedReads?: boolean;
+  // Can this compiler FUSE a float multiply into the add or subtract that reads it, when both are
+  // written in one expression? Then every such product is named (analysis.ts), so the spelling
+  // compiles to the unfused pair the object holds. A compiler opts in; the target says which
+  // (`compilerBehaviors.contractsFloatProducts`).
+  contractsFloatProducts?: boolean;
+  // How this compiler lays out a function-scope static (`compilerBehaviors.staticLayout`), which
+  // decides the definition that puts one where the target has it. Absent ⇒ unmeasured, and a
+  // function that defines a static declines.
+  staticLayout?: StaticLayout;
   // Materialize a pure value that one join's incoming edges render into the SAME parameter slot
   // from 2+ places — the value the source computed once above the branch and the copy machinery
   // sinks into every arm. Off by default; rank.ts enumerates the ON spelling as the `/merge-home`
   // variation — see analysis.ts AnalyzeOptions.
   homeMergeFeeds?: boolean;
+  // Materialize a `zext`/`sext` with 2+ consumers, none of them in its own block — the register the
+  // asm narrowed into once and every later block read. Off by default; rank.ts enumerates the ON
+  // spelling as the `/escape-home` variation — see analysis.ts AnalyzeOptions.
+  homeEscapingExtensions?: boolean;
   // Emit a memory read as a named temp in ITS OWN block when every place it renders sits in a
   // block that block strictly dominates. A compiler behavior (TargetDescription
   // .compilerBehaviors), not a differ-refereed variation: where the compiler has neither a scheduler
@@ -1621,6 +1811,12 @@ export interface StructureOptions {
    *  A SUPERSET of `inferredSymbols`' names, and its own field for exactly that reason: a struct
    *  element is licensed here and has no shape there. */
   orderLicensedGlobals?: ReadonlySet<string>;
+  /** The globals the project map declares POINTERS, handed to a structuring that runs without the
+   *  map (rank.ts `/raw-globals`). Spelling a global raw does not make it an integer: C still scales
+   *  arithmetic on its value by the declared pointee, so the byte-arithmetic rules read this where
+   *  they would read the map's `shape:'pointer'`. The operand-order rules do not read it: no element
+   *  or field spelling folds from a name with no pointee. */
+  pointerGlobals?: ReadonlySet<string>;
 }
 
 /** The named global an `index` node's base denotes DIRECTLY, or undefined: the bare `&gSym` an
@@ -1676,12 +1872,17 @@ export interface StructureHooks {
   /** `enclosingCarrierName`'s admission rules (`ENCLOSING_CARRIER_GATES`), ablatable the same way —
    *  and, wrapped in `tallying`, the census of which rule refuses a nest. */
   enclosingCarrierGates?: readonly Gate<EnclosingCarrier>[];
+  /** `sinkablePreUpdateSlots`'s per-slot rules (`PREUPDATE_SINK_GATES`), ablatable the same way. */
+  preUpdateSinkGates?: readonly Gate<SinkCandidate>[];
   /** Every branch-sense site this structuring reached, in emission order: the block index
    *  `StructureOptions.branchSenseFlipSites` names, whether the site is JOINED or divergent, and
    *  which sense it actually emitted. The enumeration domain — a site only exists once structuring
    *  has decided both arms are real, so it cannot be computed ahead of the pass. */
   onBranchSenseSite?: (site: { block: number; ordinal: number; joined: boolean; negated: boolean }) => void;
-  /** Every divergent `if` `followEarlyReturns` gave a follow: the `if`'s block and the follow's. */
+  /** Every branch `followOverReturns` gave a follow: the branch's block and the follow's. Both
+   *  callers fire it — a divergent `if` under `followEarlyReturns`, and EVERY jump table whose arms
+   *  all return, unconditionally — so the sites it reports are not the enumeration domain of the
+   *  shared-tail twins (that domain is `hasDivergentSharedRet`, which asks for a `cond_br`). */
   onEarlyReturnFollow?: (site: { block: number; follow: number }) => void;
 }
 
@@ -1709,6 +1910,7 @@ function assertDefaultAccepts(fn: Fn, opts: StructureOptions, hooks: StructureHo
       homeLoopExprs: false,
       homeDerivedReads: false,
       homeMergeFeeds: false,
+      homeEscapingExtensions: false,
       anchorConstCopies: false,
       anchorLoopEntryConsts: false,
       followEarlyReturns: false,
@@ -1727,22 +1929,37 @@ interface EarlyReturnArmDeps {
 function isRet(blk: Block): boolean {
   return blk.ops[blk.ops.length - 1]?.opcode === 'ret';
 }
-/** The `ret`s reachable from BOTH successors of `b` — the region `followEarlyReturns` keeps. Empty
- *  when there is none, and when `b` does not branch two ways. `reachFrom` is forward reachability,
- *  the start block excluded. */
+/** The `ret`s reachable from EVERY successor of `b` — the region `followOverReturns` keeps. Empty
+ *  when there is none, and when `b` does not branch at all. `reachFrom` is forward reachability,
+ *  the start block excluded.
+ *
+ *  THE QUESTION IS ABOUT A BRANCH, not about an `if`: "the arms all return, so post-dominance gives
+ *  this block no join — where does the construct end?" is asked by a jump table exactly as by a
+ *  two-way branch, and the answer is derived the same way. The `if`-shaped reading belongs to the
+ *  CALLER that wants it (`hasDivergentSharedRet`), not here.
+ *
+ *  THE DEDUP IS DEFENSIVE AND NO CALLER CAN REACH IT TODAY. It is what makes "two successors that
+ *  are the same block" answer `[]` rather than "a branch with a shared `ret`". Both callers ask
+ *  only when `ipdom.get(b)` is null, and a branch whose successors are all ONE block has that block
+ *  as its post-dominator, so they never ask it of that shape. It stays because the answer belongs
+ *  to this function rather than to its callers' guards, and dropping it is a no-op on the corpus:
+ *  the reader over every row of the committed artifact (`decompile` per row, no compiling) emits
+ *  byte-identical source with and without it. */
 function sharedRetsOf(b: Block, reachFrom: (x: Block) => ReadonlySet<Block>): Block[] {
-  const [s1, s2] = b.ops[b.ops.length - 1]?.opcode === 'cond_br' ? successorsOf(b) : [];
-  if (s1 === undefined || s2 === undefined || s1 === s2) {
+  const succs = [...new Set(successorsOf(b))];
+  if (succs.length < 2) {
     return [];
   }
   const retsFrom = (x: Block): Block[] => [x, ...reachFrom(x)].filter(isRet);
-  const fromS2 = new Set(retsFrom(s2));
-  return retsFrom(s1).filter((r) => fromS2.has(r));
+  return succs.map(retsFrom).reduce((shared, rets) => {
+    const here = new Set(rets);
+    return shared.filter((r) => here.has(r));
+  });
 }
 /** Is there an `if` whose arms reach no common block before EXIT but share a `ret` — the only shape
  *  `followEarlyReturns` changes? The enumeration gate of both shared-tail twins (rank.ts), asked of
  *  the fn as raised and again of the sunk fn; a superset, since it asks `sharedRetsOf` and none of
- *  the follow's three later refusals. */
+ *  the follow's three later refusals. An `if`, specifically: see the restriction at the `some`. */
 export function hasDivergentSharedRet(fn: Fn): boolean {
   const ipdom = postDominators(fn);
   const reach = new Map<Block, Set<Block>>();
@@ -1761,7 +1978,13 @@ export function hasDivergentSharedRet(fn: Fn): boolean {
     }
     return out;
   };
-  return fn.blocks.some((b) => ipdom.get(b) === null && sharedRetsOf(b, reachFrom).length > 0);
+  // `cond_br` HERE, not in `sharedRetsOf`: this is the enumeration gate of the shared-tail twins,
+  // and those twins are `if`-shaped variations. A jump table with a shared `ret` has the same
+  // no-join shape and no such twin, so asking for it would spend fan on a duplicate candidate.
+  return fn.blocks.some(
+    (b) =>
+      b.ops[b.ops.length - 1]?.opcode === 'cond_br' && ipdom.get(b) === null && sharedRetsOf(b, reachFrom).length > 0,
+  );
 }
 /** does a path from `from` reach `to` without passing through `avoid`? */
 function reachesAvoiding(from: Block, to: Block, avoid: Block): boolean {
@@ -1822,7 +2045,7 @@ function earlyReturnArm(
     } // re-enters the loop → not an exit
     if (entryOwned && dom.get(bb)!.has(to)) {
       owned.add(bb);
-    } else if (bb.ops.some((op) => EFFECTFUL_OPS.has(op.opcode))) {
+    } else if (bb.ops.some(effectful)) {
       return null;
     }
     const t = bb.ops[bb.ops.length - 1];
@@ -1860,11 +2083,14 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     orderArgCopiesByWriteOrder = true,
     preferDefPosCopyOrder = false,
     switchAllowsNeqCase = true,
-    switchAllowsBoundCase = false,
+    switchBoundCase,
     switchArmsFollowLayout = false,
     switchRequiresFrontLoadedTests = false,
     spellSwitchFallthrough = true,
     spillSlotOrder,
+    declaredArgs,
+    declaredReturns,
+    dialect,
     defOrderLoadPairs = true,
     anchorConstCopies = false,
     anchorLoopEntryConsts = false,
@@ -1878,7 +2104,10 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     homeLoopExprs = false,
     homeDerivedReads = false,
     homeMergeFeeds = false,
+    homeEscapingExtensions = false,
     readsStayWhereWritten = false,
+    contractsFloatProducts = false,
+    staticLayout,
     unsignedCompareSpelling = false,
     coalesceMergeNames = false,
     freshParamMerge = false,
@@ -1887,16 +2116,43 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     symbols: mapSymbols,
     inferredSymbols,
     orderLicensedGlobals,
+    pointerGlobals,
   } = opts;
+  // A read this stamp is the first to place was plain to every raising pass, and in a `&&`/`||`'s
+  // guarded operand a short-circuit fold may have lifted it out of the arm it ran in: which side of
+  // the branch the asm read it on is lost. The analysis names a counted op it finds there above the
+  // branch, which is right only for one no fold could move, so this read declines instead.
+  const stampedLate = stampDeclaredVolatile(fn, mapSymbols, opts);
+  if (stampedLate.length > 0) {
+    const defsNow = defOpMap(fn);
+    const guarded = shortCircuitGuardedValues(fn, defsNow);
+    const moved = stampedLate.find((op) => op.results.some((r) => guarded.has(r)));
+    if (moved !== undefined) {
+      throw new StructureError(
+        `cannot structure '${fn.name}': a '&&'/'||' would guard a read of the volatile object ` +
+          `'${globalBaseOf(defsNow, moved.operands[0]) ?? 'a volatile object'}', and which side of the branch the asm read it on is not recoverable`,
+      );
+    }
+  }
   // THE shape dictionary the rendering context asks, map-first. Built as a lookup rather than a
   // merged Map because the map is the PROJECT's and is asked by name for a whole project's worth
   // of symbols — copying it per structuring is work proportional to the project, and a ranked run
   // structures one function thousands of times (the same argument the `laddr` name minter makes).
+  //
+  // A function-scope static is asked by its linker name, which no map holds, and comes FIRST: its
+  // shape is its definition's, never the one raise/globalshape.ts infers from its accesses.
+  const localStatics = localStaticShapes(fn, staticLayout);
+  if ('refused' in localStatics) {
+    throw new StructureError(
+      `cannot structure '${fn.name}': names a function-scope static ('${localStatics.symbol}') ${localStatics.refused}`,
+    );
+  }
+  const staticInfo = localStatics.infos;
   const symbols: SymbolLookup | undefined =
-    mapSymbols !== undefined || (inferredSymbols !== undefined && inferredSymbols.size > 0)
+    mapSymbols !== undefined || (inferredSymbols !== undefined && inferredSymbols.size > 0) || staticInfo.size > 0
       ? {
-          get: (n) => mapSymbols?.get(n) ?? inferredSymbols?.get(n),
-          has: (n) => mapSymbols?.has(n) === true || inferredSymbols?.has(n) === true,
+          get: (n) => staticInfo.get(n) ?? mapSymbols?.get(n) ?? inferredSymbols?.get(n),
+          has: (n) => staticInfo.has(n) || mapSymbols?.has(n) === true || inferredSymbols?.has(n) === true,
         }
       : undefined;
   // Only the MAP makes the named bitfield spelling available, so with no map this is not a question.
@@ -1913,8 +2169,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // IS this target's compiler behaviors, so resetting one would probe a spelling asmlift never emits
   // here.
   //
-  // FOUR OF THE ELEVEN `STRUCTURE_VARIATIONS` ENTRIES (rank-variations.ts) ARE DELIBERATE NON-MEMBERS,
-  // each for its own reason, and the list here is the half of the split this side owns:
+  // THE STRUCTURE VARIATIONS `assertDefaultAccepts` DOES NOT RESET (rank-variations.ts) ARE
+  // DELIBERATE NON-MEMBERS, each for its own reason, and this is the whole of that list — the one
+  // place it is stated, derived from the guard's own reset list and held to it by
+  // test/variation-offers.test.ts. Every variation NOT named here is one the guard resets, so the
+  // invariant it protects — a candidate spelling never unlocks a function the default declines —
+  // rests on the guard for those and on the argument beside each name for these:
   //   - `/site-sense` (senseFromFoldEvidence) decides which way each folded branch is written. It
   //     negates a branch sense per site and touches no copy, like the per-function sense booleans;
   //   - `/reread-globals` (rereadGlobals) is an ANALYSIS option, and it only ever RELAXES: it
@@ -1934,6 +2194,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     homeLoopExprs ||
     homeDerivedReads ||
     homeMergeFeeds ||
+    homeEscapingExtensions ||
     anchorConstCopies ||
     followEarlyReturns
   ) {
@@ -1953,10 +2214,8 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   };
 
   // ── analysis phase (structure/analysis.ts): use registry, liveness, materialization ──
-  const { useSitesOf, opIndex, opBlock, liveIn, materialize, reachFrom, emitPos, memWriteBetween } = analyze(
-    fn,
-    returnsVoid,
-    {
+  const { useSitesOf, opIndex, opBlock, liveIn, materialize, preUpdateHomes, reachFrom, emitPos, memWriteBetween } =
+    analyze(fn, returnsVoid, {
       defs,
       dom,
       rereadGlobals,
@@ -1965,14 +2224,10 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       homeLoopExprs,
       homeDerivedReads,
       homeMergeFeeds,
+      homeEscapingExtensions,
       readsStayWhereWritten,
-      // the map's own declaration truth: a volatile object's read may not be duplicated or moved
-      volatileGlobal: (n) => {
-        const si = symbols?.get(n);
-        return si?.volatile === true || (si?.layout ?? []).some((f) => f.volatile === true);
-      },
-    },
-  );
+      contractsFloatProducts,
+    });
 
   // THE FOLLOW OF A DIVERGENT `if`, over the paths that do not return early. Post-dominance gives
   // such an `if` no join — its arms reach two different `ret`s, and EXIT is the only block on every
@@ -1983,21 +2238,36 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // rank.ts's `/shared-ret` twin, and as its `/shared-tail` twin after the store-tail sink: as a
   // default it costs rows, measured there.
   //
-  // WHICH REGION: the `ret`s reachable from BOTH successors. Every block that cannot reach one of
+  // WHICH REGION: the `ret`s reachable from EVERY successor. Every block that cannot reach one of
   // them is an early-return region and is deleted; the follow is `b`'s post-dominator over what is
   // left. Sound for the same reason an ordinary follow is: every kept path from `b` passes it, and a
   // deleted block reaches no kept `ret` and so never the follow, so each arm structures up to the
-  // follow or into a `return`. And no deleted region is reachable from both arms — its `ret` would
-  // then be one of the shared ones — so the rule duplicates nothing across the arms.
+  // follow or into a `return`.
+  //
+  // IT CAN DUPLICATE ACROSS THE ARMS, AND ABOVE TWO SUCCESSORS IT DOES. With two, it cannot: a
+  // deleted region both arms reach would have its `ret` in the intersection, and so would not have
+  // been deleted. With three or more that argument does not carry — a `ret` reachable from two of
+  // three arms is NOT in the intersection, so its region is deleted from `keep` and re-emitted in
+  // each arm that reaches it. The copies sit on mutually exclusive paths, so the program stays
+  // correct; the cost is bytes, which is the only currency here. The `switch_br` caller pays it
+  // knowingly: its alternative is not a shorter spelling but a decline (see that caller).
   //
   // PER `if`, never function-wide: the deletion set is a function of that `if`'s own shared `ret`s
   // (memoized on them), because a nested `if` shares a different set, or none.
   //
-  // REFUSES (keeping the divergent arms) when no `ret` is reachable from both successors, when the
+  // REFUSES (keeping the divergent arms) when no `ret` is reachable from every successor, when the
   // kept graph gives `b` no post-dominator but EXIT, and when the enclosing region's `stop` is
   // reachable from `b` without passing the follow — that path must reach `stop`, and structuring
-  // the arms towards a different follow would emit `stop`'s region inside an arm. The caller asks
-  // only outside a loop body.
+  // the arms towards a different follow would emit `stop`'s region inside an arm.
+  //
+  // THE TWO CALLERS DIFFER ON LOOPS AND ONLY ONE OF THEM GUARDS IT. The `if` caller asks outside a
+  // loop body only (`followEarlyReturns && loopCtx === null`, with `clampToLoop` as its second
+  // net), for the reason written there. The `switch_br` caller does not consult `loopCtx` at all,
+  // and no input has been found that reaches this from inside a loop body: every `ret` the arms of
+  // an in-loop branch reach is reachable from the latch too, so the intersection keeps the whole
+  // graph, `pd` is `ipdom` itself — and the caller only asks when `ipdom.get(b)` is already null,
+  // so the answer comes back null and the `?? stop` fallback stands. That is an observation about
+  // the shape rather than a check, which is why it is written down here.
   const followsByShared = new Map<string, Map<Block, Block | null>>();
   const followOverReturns = (b: Block, stop: Block | null): Block | null => {
     const shared = sharedRetsOf(b, reachFrom);
@@ -2028,10 +2298,21 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // `((T *)&gSym)[i]` address-cast form (a struct value does not decay, so casting the bare name is
   // invalid C; casting the address is valid and byte-exact). Computed once here.
   //
-  // Only the offset set is tracked, not width: a single symbol read at off-0 with two DIFFERENT
-  // widths is a union/type-pun, which the downstream struct-layout recovery rejects LOUD
-  // ("overlapping fields ... unions not modelled") before this classification is consumed — so a
-  // width collision at off-0 declines honestly rather than reaching a wrong bare-`gSym` emission.
+  // THE ACCESS SPELLING IS PART OF THE QUESTION, not only the offset set. The bare name is ONE
+  // declaration, so it spells one width and one signedness; a symbol read at off-0 two different
+  // ways has no bare spelling at all, and emitting one loses the second access entirely
+  // (`gState + gState` for a halfword plus a byte). Such a symbol is an AGGREGATE here, so every
+  // access takes the address-cast form at its OWN width — `*(u16 *)&gState + *(u8 *)&gState`,
+  // which is what the source wrote and what raise/structs.ts's constant-address sibling emits for
+  // the same shape at a literal address.
+  //
+  // TWO QUESTIONS, AND THEY ARE ASKED OF DIFFERENT ACCESSES. WIDTH is asked of every load and store: a
+  // `u16` declaration cannot carry a word store either. SIGNEDNESS is asked of LOADS ONLY — a store
+  // writes the same bytes through either declaration (`*(s16 *)&g = x` and `*(u16 *)&g = x` are one
+  // instruction), while a load does not: `lh` and `lhu` on one cell are two declarations, and
+  // spelling both `g` would lose the zero-extension. Unreachable in Thumb, where `ldrsh`/`ldrsb`
+  // need a register offset and the `add` that forms it already marks the symbol aggregate; live on
+  // MIPS, where `%hi/%lo` addressing carries no such `add`.
   // FRAME-LOCAL OBJECT NAMES (laddr). Minted HERE, not in the frontend, because identifiers live
   // in this layer's namespace: params, locals, every gaddr symbol, and the project's symbol map —
   // none of which the frontend can see. A frontend-chosen `sp0` silently shadowed a project global
@@ -2050,10 +2331,10 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       for (const op of b.ops) {
         if (op.opcode === 'gaddr') {
           taken.add(op.attrs.sym as string);
-        } else if (op.opcode === 'call') {
+        } else if (calleeName(op) !== undefined) {
           // a CALLEE's name is in this namespace too: a function really named sp0 would be
           // shadowed by the minted local, and `sp0()` on a u16 object is a compile error
-          taken.add(op.attrs.target as string);
+          taken.add(calleeName(op)!);
         }
       }
     }
@@ -2090,11 +2371,27 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   })();
 
   const scalarGlobals = new Set<string>();
+  /** The scalar GLOBALS (never a frame object) the IR loads as a pointer at least once: one load
+   *  typed a pointer is the value used as an address somewhere in the function, while its other
+   *  loads may type an integer only because they reach a call argument or a compare. */
+  const pointerLoadedGlobals = new Set<string>();
+  /** Every scalar GLOBAL (never a frame object) whose value the function loads as a word, the
+   *  only width a pointer has: a `u8`/`u16` global is an integer whatever it is added to. */
+  const wordLoadedGlobals = new Set<string>();
   {
     const offsets = new Map<string, Set<number>>();
+    const widths = new Map<string, Set<number>>();
+    const loadSigns = new Map<string, Set<boolean>>();
+    const loadsPointer = new Map<string, boolean>();
     const bumpAgg = (sym: string) => offsets.set(sym, new Set([-1])); // -1 marks "variable index"
     for (const b of fn.blocks) {
       for (const op of b.ops) {
+        // A frame object declared as an aggregate (`laddrType`) is one whatever its accesses agree
+        // on — the frame-side twin of the symbol map's declaration-shape override. Spelled
+        // scalar, a store assigns to the array and a load reads its address.
+        if (op.opcode === 'laddr' && laddrType(op).kind !== 'int') {
+          bumpAgg(laddrName.get(op)!);
+        }
         const gaddrSym = (v: Value) => {
           const dv = defs.get(v);
           // laddr participates identically: `sp0` is scalar-spelled at off 0 and cast-spelled
@@ -2110,6 +2407,13 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           const s = gaddrSym(op.operands[0]);
           if (s) {
             (offsets.get(s) ?? offsets.set(s, new Set()).get(s)!).add(op.attrs.off as number);
+            (widths.get(s) ?? widths.set(s, new Set()).get(s)!).add(op.attrs.width as number);
+            if (op.opcode === 'load') {
+              (loadSigns.get(s) ?? loadSigns.set(s, new Set()).get(s)!).add(op.attrs.signed as boolean);
+              if (defs.get(op.operands[0])?.opcode === 'gaddr') {
+                loadsPointer.set(s, loadsPointer.get(s) === true || op.results[0].type.kind === 'ptr');
+              }
+            }
           }
         } else if (op.opcode === 'add' || op.opcode === 'sub') {
           // ANY arithmetic on the symbol's address is interior addressing ⇒ aggregate — even when
@@ -2132,10 +2436,20 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       }
     }
     for (const [sym, offs] of offsets) {
-      if (offs.size === 1 && offs.has(0)) {
+      if (offs.size === 1 && offs.has(0) && widths.get(sym)?.size === 1 && (loadSigns.get(sym)?.size ?? 1) === 1) {
         scalarGlobals.add(sym);
       }
     }
+    for (const [sym, ptr] of loadsPointer) {
+      if (scalarGlobals.has(sym)) {
+        if (widths.get(sym)?.has(4)) {
+          wordLoadedGlobals.add(sym);
+        }
+        if (ptr) {
+          pointerLoadedGlobals.add(sym);
+        }
+      }
+    }
     // Declaration-shape OVERRIDE (symbol map): a project-declared array/struct global is an
     // AGGREGATE whatever the usage inference saw — a lone off-0 access to `extern u16 tbl[]`
     // must still spell through the aggregate/array forms, never the bare scalar `tbl`.
@@ -2179,15 +2493,128 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       }
     : undefined;
 
-  /** A value the MAP declares a pointer: a bare `gSym` naming a pointer global (the VALUE of a
-   *  pointer cell), or a named MEMBER whose declaration is a pointer (`gSym.pBuf`, `gPtr->pBuf`).
-   *  Load, store and compare of such a 4-byte cell are identical for any object-pointer type, so
-   *  the declared pointee never matters to THEM; arithmetic on the loaded value is the opposite
-   *  case, where the pointee's size scales what is added and every stride must therefore be made
-   *  explicit (`(u8 *)gPtr + K`). `ctype` cannot see any of this: it types only params/locals, so
-   *  both spellings render `undefined` there. */
-  const isPtrValue = (x: Expr): boolean =>
-    (x.k === 'var' && symCtx?.info(x.name)?.shape === 'pointer') || ptrMemberDecl(x, symCtx) !== null;
+  /** The declared shape of a global as the pointer-value rules below read it: the map's, or a
+   *  pointer the map declares to a structuring that does not spell from it (`pointerGlobals`). */
+  const declaredShape = (name: string): SymbolInfo['shape'] =>
+    symCtx?.info(name)?.shape ?? (pointerGlobals?.has(name) ? 'pointer' : undefined);
+  /** Whether no declaration a spelling folds from types the global: the map's is the only one.
+   *  The operand-order rules read this, not declaredShape: a declared pointer keeps `x + (u8 *)p`
+   *  for the element and field spellings to read, and a `pointerGlobals` name has no pointee for
+   *  them, so its sum is spelled in the asm's order like any other undeclared global's. */
+  const mapUndeclared = (name: string): boolean => symCtx?.info(name)?.shape === undefined;
+
+  /** A POINTER VALUE whose type the project's header owns: a bare `gSym` naming a pointer global
+   *  (the VALUE of a pointer cell), or a named MEMBER whose declaration is a pointer (`gSym.pBuf`,
+   *  `gPtr->pBuf`). Load, store and compare of such a 4-byte cell are identical for any
+   *  object-pointer type, so the declared pointee never matters to THEM; arithmetic on the loaded
+   *  value is the opposite case, where the pointee's size scales what is added and every stride
+   *  must therefore be made explicit (`(u8 *)gPtr + K`). `ctype` cannot see any of this: it types
+   *  only params/locals, so both spellings render `undefined` there.
+   *
+   *  A bare global is one when its declared shape is `'pointer'` (declaredShape), or when no
+   *  declaration this pass can read says anything (no map, a symtab-only name, entries that
+   *  disagree and were dropped to the bare name, a name the map lacks) and the IR loads it as a
+   *  pointer at least once. The project still declares it, typically `struct S *`. A map
+   *  `shape:'scalar'` is a declaration and is excluded; so is a global the IR never loads as a
+   *  pointer (`gCount + 1`, or the `u8` index in `gIdx + gItems`), where casting would make a
+   *  pointer of an integer the source added as one. */
+  const isPtrValue = (x: Expr): boolean => {
+    if (x.k !== 'var') {
+      return ptrMemberDecl(x, symCtx) !== null;
+    }
+    const shape = declaredShape(x.name);
+    return shape === 'pointer' || (shape === undefined && pointerLoadedGlobals.has(x.name));
+  };
+
+  /** A global's word VALUE that no declaration this pass can read types, whatever the IR loaded it
+   *  as. */
+  const isUndeclaredGlobalValue = (x: Expr): boolean =>
+    x.k === 'var' && wordLoadedGlobals.has(x.name) && declaredShape(x.name) === undefined;
+
+  /** A pointer value or a global's word as the integer the asm added. A global no declaration
+   *  types and the IR never loads as a pointer may be declared a float, whose value `(u32)g`
+   *  converts, so it goes through `(u8 *)` first: `(u32)(u8 *)g` is `(u32)g`'s bytes under every
+   *  integer and pointer declaration, and no C under a float one. KNOWN GAP: under an array or a
+   *  function declaration `g` decays to its address, which this spells with no diagnostic; only a
+   *  pun reads the word there, and intoDeclaredTemp's KNOWN GAP says why none is spelled. */
+  const globalWord = (x: Expr): Expr => ({
+    k: 'cast',
+    to: T.u(32),
+    e:
+      x.k === 'var' && declaredShape(x.name) === undefined && !pointerLoadedGlobals.has(x.name)
+        ? { k: 'cast', to: T.ptr(T.u(8)), e: x }
+        : x,
+  });
+
+  /** An integer operand with every undeclared global it adds or subtracts made a word as well:
+   *  bare, `a0 + g` is pointer arithmetic under a pointer declaration of g. Other operators reject
+   *  a pointer operand, and a load or a cast types its own value. */
+  const intWords = (x: Expr): Expr =>
+    isUndeclaredGlobalValue(x)
+      ? globalWord(x)
+      : x.k === 'bin' && (x.op === '+' || x.op === '-')
+        ? { ...x, l: intWords(x.l), r: intWords(x.r) }
+        : x;
+
+  /** A byte sum the pointer-value arithmetic rule below made of a global's value (`(u8 *)g + K`),
+   *  and the same sum as the integer it also is (`(u32)g + K`), which an integer added in front of
+   *  it takes. KNOWN GAP: an integer READER of the byte sum converts a pointer to an integer. The
+   *  backend casts it where the reader's type is known (an assignment, a store through a typed
+   *  slot, a return: cfamily `legalizePointerWrites`), and a compare against an integer compares
+   *  it as a `u32`. A call argument and a global no declaration types keep the pointer, which agbcc
+   *  and KMC gcc warn about and CodeWarrior rejects; only a pointer cell's sum passed to a parameter
+   *  the prototype declares an integer is converted (l3/ptrcell.ts). The integer sum is no fix: gcc
+   *  orders a pointer sum's operands and an integer sum's differently, so the bytes differ. */
+  const castGlobal = (x: Expr, undeclared = false): x is Extract<Expr, { k: 'cast' }> =>
+    x.k === 'cast' &&
+    typeEquals(x.to, T.ptr(T.u(8))) &&
+    x.e.k === 'var' &&
+    (isPtrValue(x.e) || isUndeclaredGlobalValue(x.e)) &&
+    (!undeclared || mapUndeclared(x.e.name));
+  /** The integer sum the rule spells in the asm's order instead (`(u32)g + x`), cast back to the
+   *  byte pointer it stands for: `(u8 *)((u32)g + x)`. A byte sum converted whole (byteSumAsInt's
+   *  `(u32)((u8 *)g + x - gB)`) is one of its words. */
+  const intGlobalWord = (x: Expr, undeclared: boolean): boolean =>
+    x.k === 'cast' &&
+    typeEquals(x.to, T.u(32)) &&
+    (castGlobal(x.e, undeclared) ||
+      (x.e.k === 'bin' && isByteGlobalSum(x.e, undeclared)) ||
+      (x.e.k === 'var' &&
+        (isPtrValue(x.e) || isUndeclaredGlobalValue(x.e)) &&
+        (!undeclared || mapUndeclared(x.e.name))));
+  const isIntGlobalSum = (x: Expr, undeclared: boolean): boolean =>
+    x.k === 'bin' &&
+    (x.op === '+' || x.op === '-') &&
+    (intGlobalWord(x.l, undeclared) ||
+      intGlobalWord(x.r, undeclared) ||
+      isIntGlobalSum(x.l, undeclared) ||
+      isIntGlobalSum(x.r, undeclared));
+  const restoredIntSum = (x: Expr, undeclared: boolean): Expr | undefined =>
+    x.k === 'cast' && typeEquals(x.to, T.ptr(T.u(8))) && isIntGlobalSum(x.e, undeclared) ? x.e : undefined;
+  const isByteGlobalSum = (x: Expr, undeclared = false): boolean =>
+    restoredIntSum(x, undeclared) !== undefined ||
+    (x.k === 'bin' &&
+      (x.op === '+' || x.op === '-') &&
+      (castGlobal(x.l, undeclared) ||
+        castGlobal(x.r, undeclared) ||
+        isByteGlobalSum(x.l, undeclared) ||
+        isByteGlobalSum(x.r, undeclared)));
+  /** The integer a byte sum is. Every global it adds bare goes a word with it. A lone global it
+   *  subtracts stays the pointer difference, `(u32)((u8 *)g + x - gB)`: the asm's integer under an
+   *  integer or a byte-pointer declaration of `gB`, and no C under a wider pointer or array, a
+   *  function or a float one, where the word `(u32)(u8 *)gB` would subtract an address. Under a byte
+   *  array it subtracts the array's address: globalWord's KNOWN GAP. A difference has one operand
+   *  order, so the asm's needs no integer sum. A sum of globals it subtracts goes words: bare,
+   *  `gB2 - gB3` is an element count under a wider pointer declaration. */
+  const byteSumAsInt = (x: Expr): Expr =>
+    restoredIntSum(x, false) ??
+    (castGlobal(x)
+      ? globalWord(x.e)
+      : x.k === 'bin' && isByteGlobalSum(x)
+        ? x.op === '-' && isUndeclaredGlobalValue(x.r)
+          ? { k: 'cast', to: T.u(32), e: x }
+          : { ...x, l: byteSumAsInt(x.l), r: byteSumAsInt(x.r) }
+        : intWords(x));
 
   /** Operands `-`/`~` cannot take as spelled: a rendered pointer, a bare `&gSym`, a pointer
    *  global's value. All three are ill-formed C under a unary arithmetic operator — the asm did
@@ -2244,7 +2671,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
               P !== b &&
               pt?.opcode === 'br' &&
               P.params.length === 0 &&
-              P.ops.every((o) => !EFFECTFUL_OPS.has(o.opcode) && !materialize.has(o)) &&
+              P.ops.every((o) => !effectful(o) && !materialize.has(o)) &&
               // at least one def the LOOP BODY reads — the loop-invariant-motion shape this claim
               // exists for. A block that only computes the init args is the do-while path's
               // ordinary entry chain, and that path's sink machinery handles it better.
@@ -2270,7 +2697,24 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // reducible single-entry body, and a SINGLE real (non-ret) exit — early returns (ret-terminated
   // targets) are allowed in-body. The shape then splits on WHERE the exit lives: the HEADER exits
   // (pure test-at-top) → `while`; the LATCH exits (body-first) → `do-while`. Anything that fails
-  // declines to plain if-recovery, which re-enters the header and fails loud via `onStack`.
+  // is left to `while (1)` (below), or declines to plain if-recovery, which re-enters the header and
+  // fails loud via `onStack`.
+  //
+  // What every loop form asks first (`admissible`): each inner loop whose header sits in this body
+  // is PROPERLY nested — its ENTIRE body is contained in ours (a forest descendant). Structuring
+  // then recurses naturally: when the outer body reaches the inner header, structureBlock
+  // dispatches to the inner's own emitter. An OVERLAPPING loop (shared blocks, neither containing
+  // the other → irreducible) DECLINES. If a contained inner is itself unstructurable, the outer's
+  // body structuring loud-fails at the inner back-edge (onStack) — a safe decline, not a
+  // miscompile. And the body is single-entry: every block but the header is entered ONLY from
+  // inside it — no jump into the loop interior. A `break` edge must also not leave from an inner
+  // loop's body (`innerBodyHas`), which would be a two-level exit.
+  const innerBodyHas = (nl: NaturalLoop, b: Block): boolean =>
+    [...forest.byHeader.values()].some((l2) => l2.header !== nl.header && nl.body.has(l2.header) && l2.body.has(b));
+  const admissible = (nl: NaturalLoop): boolean =>
+    [...forest.byHeader.values()].every(
+      (l2) => l2.header === nl.header || !nl.body.has(l2.header) || [...l2.body].every((b) => nl.body.has(b)),
+    ) && [...nl.body].every((bb) => bb === nl.header || (preds.get(bb) ?? []).every((p) => nl.body.has(p)));
   const whileLoops = new Map<Block, WhileLoopInfo>();
   const doWhileLoops = new Map<Block, DoWhileInfo>();
   for (const nl of forest.byHeader.values()) {
@@ -2282,32 +2726,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       continue;
     } // single latch only
     const latch = nl.selfLoop ? h : nl.latches[0];
-    // Nested loops: an inner loop whose header sits in this body is fine ONLY if it is PROPERLY
-    // nested — its ENTIRE body is contained in ours (a forest descendant). Structuring then recurses
-    // naturally: when the outer body reaches the inner header, structureBlock dispatches to the inner's
-    // own emitWhile/emitDoWhile. An OVERLAPPING loop (shared blocks, neither containing the other →
-    // irreducible) DECLINES. If a contained inner is itself unstructurable, the outer's body
-    // structuring loud-fails at the inner back-edge (onStack) — a safe decline, not a miscompile.
-    if (
-      [...forest.byHeader.keys()].some(
-        (h2) => h2 !== h && nl.body.has(h2) && ![...forest.byHeader.get(h2)!.body].every((b) => nl.body.has(b)),
-      )
-    ) {
-      continue;
-    }
-    // Reducible entry (single-entry): every body block except the header is entered ONLY from
-    // inside the body — no jump into the loop interior.
-    let reducible = true;
-    for (const bb of nl.body) {
-      if (bb === h) {
-        continue;
-      }
-      if ((preds.get(bb) ?? []).some((p) => !nl.body.has(p))) {
-        reducible = false;
-        break;
-      }
-    }
-    if (!reducible) {
+    if (!admissible(nl)) {
       continue;
     }
 
@@ -2326,7 +2745,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // whose result also feeds the body would be evaluated twice per iteration). A `load` is fine —
     // but NOT a materialized one: its temp assignment renders only via sideEffects(), which a
     // condition-only header never emits, so its uses would read an unassigned variable.
-    const headerPure = !h.ops.some((op) => EFFECTFUL_OPS.has(op.opcode) || materialize.has(op));
+    const headerPure = !h.ops.some((op) => effectful(op) || materialize.has(op));
 
     let exitFrom: Block,
       exit: Block,
@@ -2347,11 +2766,20 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       continue; // neither a clean pre-tested nor bottom-tested single-exit shape
     }
     // Single loop exit (ret-aware): the chosen exit is the ONE real exit; every OTHER edge leaving
-    // the body must be an early `return` (`earlyReturnArm`) or a ret-terminated target. A second exit
-    // that lands on a LIVE non-return merge is a genuine `break`/second structured exit → decline.
-    // The arms are kept: emission needs to know which edges out of the body end an iteration rather
-    // than continue it.
+    // the body must be an early `return` (`earlyReturnArm`), a ret-terminated target, or — for a
+    // `while` — a `break`: an edge landing on the header's own exit, which C spells by leaving the
+    // loop and running the exit region once, after it. A second exit that lands on any OTHER live
+    // merge has no single-level spelling → decline, as does a `break` edge out of a NESTED loop's
+    // body (a two-level exit). A `do-while` takes no break: an edge into its exit that no arm owns
+    // leaves the loop to `while (1)`, whose breaks carry their own copies, where the do-while's
+    // would fall into the latch's. An edge to the header's exit is a break whatever the exit holds:
+    // the asm runs ONE copy of the exit region for both edges, and agbcc and mwcc keep a
+    // source-duplicated return tail duplicated, so copying the tail into the arm spells another
+    // object. Where that exit ends in a return, the edge is also an arm or a ret target, and emission
+    // copies the tail where the break spelling refuses. The arms and breaks are kept: emission needs
+    // to know which edges out of the body end an iteration rather than continue it.
     const arms: LoopArm[] = [];
+    const breaks = new Set<Block>();
     let singleExit = true;
     for (const e of nl.exitEdges) {
       if (e.from === exitFrom && e.to === exit) {
@@ -2360,7 +2788,10 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       const owned = earlyReturnArm({ dom, reachFrom }, e.from, e.to, nl.body, exit);
       if (owned) {
         arms.push({ from: e.from, to: e.to, owned });
-      } else if (!isRet(e.to)) {
+      }
+      if (kind === 'while' && e.to === exit && !innerBodyHas(nl, e.from)) {
+        breaks.add(e.from);
+      } else if (!owned && (!isRet(e.to) || (kind === 'dowhile' && e.to === exit))) {
         singleExit = false;
         break;
       }
@@ -2378,12 +2809,67 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         forwardPreds: nl.forwardPreds,
         body: nl.body,
         arms,
+        breaks,
       });
     } else {
       doWhileLoops.set(h, { header: h, latch, exit, forwardPreds: nl.forwardPreds, body: nl.body, arms });
     }
   }
 
+  // A loop none of the shapes above spells — several latches with a conditional `continue` in
+  // mid-body beside the bottom one, or one latch under a header that computes before it tests (a
+  // mid-tested loop) — is `while (1)`: every edge back to the header is the
+  // implicit continue at the foot of its region, and every edge out is a `break` to the one exit
+  // chosen below or an early `return`. Same fail-closed preconditions as above: `admissible`, and
+  // no break out of an inner loop's body. The exit is the first target under which every other edge
+  // out is an early-return arm or lands on a `ret` block with no effect in it, trying first, in
+  // block order, the targets laid out after the loop's last body block: a compiler places the code
+  // after a loop there and an early `return` inside the loop's span, so block order alone would take
+  // that `return` for the break and the code after the loop for an early return.
+  const foreverLoops = new Map<Block, ForeverLoopInfo>();
+  const foreverShape = (nl: NaturalLoop): ForeverLoopInfo | null => {
+    const last = Math.max(...[...nl.body].map((b) => fn.blocks.indexOf(b)));
+    const rank = (x: Block) => fn.blocks.indexOf(x) + (fn.blocks.indexOf(x) > last ? 0 : fn.blocks.length);
+    const targets = [...new Set(nl.exitEdges.map((e) => e.to))].sort((x, y) => rank(x) - rank(y));
+    for (const exit of targets) {
+      const arms: LoopArm[] = [];
+      const breaks = new Set<Block>();
+      const fits = nl.exitEdges.every((e) => {
+        if (e.to === exit) {
+          breaks.add(e.from);
+          return !innerBodyHas(nl, e.from);
+        }
+        const owned = earlyReturnArm({ dom, reachFrom }, e.from, e.to, nl.body, exit);
+        if (owned) {
+          arms.push({ from: e.from, to: e.to, owned });
+        }
+        // a `ret` target the edge does not own is copied into the body where the edge leaves, so it
+        // must hold nothing a second copy would run twice in the source
+        return owned !== null || (isRet(e.to) && !e.to.ops.some(effectful));
+      });
+      if (fits) {
+        return {
+          header: nl.header,
+          latches: nl.latches,
+          forwardPreds: nl.forwardPreds,
+          exit,
+          body: nl.body,
+          arms,
+          breaks,
+        };
+      }
+    }
+    return null;
+  };
+  for (const nl of forest.byHeader.values()) {
+    const h = nl.header;
+    const shape =
+      !loops.has(h) && !whileLoops.has(h) && !doWhileLoops.has(h) && admissible(nl) ? foreverShape(nl) : null;
+    if (shape !== null) {
+      foreverLoops.set(h, shape);
+    }
+  }
+
   // --- coalesce SSA values to variable names ---
   const varName = new Map<Value, string>();
   const varType = new Map<string, IrType>();
@@ -2407,6 +2893,8 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
    *  which is the chain-rooted widening rather than this rule. */
   const paramSeededMerges = new Set<Value>();
   const backArgName = new Map<Value, string>();
+  /** The loop header each `backArgName` entry was seeded by. */
+  const backArgHeader = new Map<Value, Block>();
   // The C static type of a rendered expression, over the declared variable types — what decides
   // whether a memory access's base may be dereferenced as spelled (memAccess/arrayAccess).
   const vtEnv = (n: string): IrType | undefined => varType.get(n);
@@ -2442,18 +2930,34 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     if (t === undefined) {
       return value;
     }
-    // ── the MAP's pointer values, whose type this side of the program does not own ──────────────
+    // ── pointer values whose type this side of the program does not own ────────────────────────
     // A `gaddr` at least states a type the IR knows. `gSym.pBuf` and a pointer global's own value
-    // state one only the MAP knows, and `ctype` — which types params and locals — reads them as
-    // `undefined`, so the test above cannot see them at all. Assigning one bare declares that the
-    // temp's type and the project's declaration of that pointer are the same type, which nothing
-    // here established: the project's header says `struct Unk_03005284 *` where the recovered temp
-    // says `struct Struct0 *`, and `-Werror` makes the mismatch fatal in the tree the source is
-    // pasted into. The destination's type is the one this pass DID choose, so unlike the
-    // map-declared cells below it can be named exactly rather than defused through `void *`. That
-    // holds for an INTEGER temp too, and there the diagnostic is the mirror one, `assignment makes
-    // integer from pointer without a cast` — same site, same argument, same `(T)` answer.
-    if (isPtrValue(value)) {
+    // (isPtrValue) state one only the project's header knows, and `ctype` — which types params and
+    // locals — reads them as `undefined`, so the test above cannot see them at all. Assigning one
+    // bare declares that the temp's type and the project's declaration of that pointer are the
+    // same type, which nothing here established: the project's header says
+    // `struct Unk_03005284 *` where the recovered temp says `struct Struct0 *`, and `-Werror` makes
+    // the mismatch fatal in the tree the source is pasted into. The destination's type is the one
+    // this pass DID choose, so unlike the map-declared cells below it can be named exactly rather
+    // than defused through `void *`. That holds for an INTEGER temp too, and there the diagnostic
+    // is the mirror one, `assignment makes integer from pointer without a cast` — same site, same
+    // argument, same `(T)` answer.
+    //
+    // A value that RENDERS a pointer of another type is the same assignment with its type in plain
+    // sight: the byte arithmetic below spells `(u8 *)gPtr + 3544` and `(u8 *)a0 + 2` for the
+    // address alone, and a `u16 *` or `s32 *` temp takes neither without the cast.
+    //
+    // KNOWN GAP: a global no declaration types, read at offset 0 only, may be declared an ARRAY
+    // (`u16 *gArr[4]`, the asm reading `gArr[0]`). Its value spelling is then the array's address,
+    // and this cast compiles that wrong value with no diagnostic, where the bare value keeps
+    // agbcc's `incompatible pointer type`, fatal under -Werror. The cast is load-bearing all the
+    // same: a substitution variation (`/unmerge`) carries the temp's value into the arithmetic it
+    // feeds, and bare, that arithmetic scales by the declared pointee. A pun, `*(T *)&gArr`, is no
+    // fix: where the declaration is not exactly T it loses gcc's fold of the read (agbcc
+    // c-typeck.c), it drops a `volatile` declaration's qualifier, and agbcc's strict aliasing at
+    // -O2 moves it past a store through the declared type.
+    const vt = ctype(value);
+    if (isPtrValue(value) || (vt?.kind === 'ptr' && !typeEquals(vt, t))) {
       return { k: 'cast', to: t, e: value };
     }
     if (t.kind !== 'ptr' || value.k !== 'addr') {
@@ -2580,7 +3084,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     }
     return { carrierLive, carrierWritten };
   };
-  const canTakeName = (p: Value, B: Block, name: string, pureAlias = false): boolean => {
+  const canTakeName = (p: Value, B: Block, name: string, pureAlias = false, ownName = true): boolean => {
     const lin = liveIn.get(B)!;
     let scan: ReturnType<typeof carrierScan> | undefined;
     const scanned = (): ReturnType<typeof carrierScan> => (scan ??= carrierScan(p, B, name));
@@ -2593,24 +3097,67 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // computes 10 — agbcc emits exactly that asm, so this is not a generated-IR curiosity. The
     // walk stops at any value with a name of its own (it reads THAT name) and at a materialized
     // def (it is assigned at its own position, which the clause above already judges).
-    const reDerives = (w: Value, seen: Set<Value>): boolean => {
+    //
+    // `viaBackArg` asks the `back-arg-live` question instead: the walk is the same, and what it
+    // looks for is a loop's back-edge argument carrying `name` through `backArgName`, so that the two
+    // gates' evidence stays disjoint and each one's ablation is its own claim.
+    // The exit regions that render a back-edge argument AS its loop variable's name are the ones
+    // under the loop's substitution — a self-loop's and a do-while's (`withSub`). A test-at-top
+    // `while` installs none: past it the argument is re-derived from its operands, which the plain
+    // walk judges.
+    const rendersAsBackArgName = (w: Value): boolean => {
+      const h = backArgHeader.get(w);
+      return h !== undefined && (loops.has(h) || doWhileLoops.has(h));
+    };
+    const reDerives = (w: Value, seen: Set<Value>, viaBackArg: boolean): boolean => {
       if (w === p || seen.has(w)) {
         return false;
       }
       seen.add(w);
       const nm = varName.get(w);
       if (nm !== undefined) {
-        return nm === name;
+        return !viaBackArg && nm === name;
+      }
+      if (viaBackArg && backArgName.get(w) === name && rendersAsBackArgName(w)) {
+        return true;
       }
       const d = defs.get(w);
       if (!d || materialize.has(d)) {
         return false;
       }
-      return d.operands.some((o) => reDerives(o, seen));
+      return d.operands.some((o) => reDerives(o, seen, viaBackArg));
+    };
+    // `back-arg-live` looks where the in-edge copies LAND, which is more than `B`'s entry when the
+    // edge leaves a loop from its latch: the do-while and self-loop emitters sink that exit copy into
+    // the body, so what is live into that loop's header is live at the copy. A predecessor all of
+    // whose edges hand the slot a value already under `name` writes nothing. The sink gate
+    // (`dest-free-inside-loop`) refuses an unnamed value that renders the name through `varName`, but
+    // not one that renders it as an earlier loop's back-edge argument, so this rule is that case's
+    // only guard. `re-derives` is the sink gate's there, and reads `B`'s entry alone.
+    let landed: Set<Value> | undefined;
+    const landing = (): Set<Value> => {
+      if (landed) {
+        return landed;
+      }
+      landed = new Set(lin);
+      const slot = B.params.indexOf(p);
+      const writes = new Map<Block, boolean>();
+      for (const { pred, succ } of inEdgeRecords(preds, B)) {
+        writes.set(pred, (writes.get(pred) ?? false) || varName.get(succ.args[slot]) !== name);
+      }
+      for (const [pr, w] of writes) {
+        for (const s of w ? successorsOf(pr) : []) {
+          if (forest.byHeader.get(s)?.body.has(pr)) {
+            liveIn.get(s)!.forEach((v) => landed!.add(v));
+          }
+        }
+      }
+      return landed;
     };
     return (
       firstRejection(hooks.carrierNameGates ?? CARRIER_NAME_GATES, {
         pureAlias,
+        ownName,
         widthDiffers: carrierWidth(varType.get(name)) !== carrierWidth(p.type),
         signDiffers: carrierSign(varType.get(name)) !== carrierSign(p.type),
         siblingHolds: B.params.some((q) => q !== p && varName.get(q) === name),
@@ -2624,7 +3171,10 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           // NAMED live values are `carrier-live`'s, so the two rules stay disjoint and each one's
           // ablation is its own claim. The walk itself still crosses into a named OPERAND, which
           // is the whole point of it.
-          return [...lin].some((w) => !varName.has(w) && reDerives(w, new Set()));
+          return [...lin].some((w) => !varName.has(w) && reDerives(w, new Set(), false));
+        },
+        get backArgReadsName() {
+          return [...landing()].some((w) => !varName.has(w) && reDerives(w, new Set(), true));
         },
       }) === null
     );
@@ -2790,6 +3340,42 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     const nm = a === undefined ? undefined : varName.get(a);
     return refused === null && nm !== undefined && canTakeName(p, header, nm) ? nm : undefined;
   };
+  /** Where in `header` an op reading a loop variable RENDERS, for the in-place adoption below: at
+   *  its own index when it is a statement, at the consumer it inlines into otherwise (`emitPos`) —
+   *  `%t = v1 - v0` ahead of the adopted def, inlined into a call after it, reads the name after
+   *  the assignment has overwritten it. A tree the header's TERMINATOR carries renders there, at the
+   *  bottom, with one exception: a self-loop's EXIT arg renders at its ROOT's own index, which is
+   *  where a sunk exit copy is rebuilt (`preUpdateCopyHome`), while a kept one renders after the
+   *  loop, where the hazard checks already count the in-place write (`loopWriteSet`). A tree the
+   *  back edge also carries is an update copy, and renders at the bottom. So a read never renders
+   *  EARLIER than its SSA position says, and the rule only ever refuses more. Null — refuse — where
+   *  the read renders in several places or outside the header, or in an exit arg with no home. */
+  const readRenderIdx = (op: Op, header: Block): number | null => {
+    const pos = emitPos(op);
+    if (pos === null || pos.blk !== header) {
+      return null;
+    }
+    const term = header.ops[header.ops.length - 1];
+    if (pos.idx !== opIndex.get(term) || !term.successors.some((sc) => sc.block === header)) {
+      return pos.idx;
+    }
+    for (let cur = op; cur !== term;) {
+      const cons = [...new Set((useSitesOf.get(cur.results[0]) ?? []).map((u) => u.op))];
+      if (cons.length !== 1) {
+        return null;
+      }
+      if (cons[0] === term) {
+        const root = cur.results[0];
+        if (term.successors.some((sc) => sc.block === header && sc.args.includes(root))) {
+          return pos.idx;
+        }
+        const home = preUpdateCopyHome(defs, opBlock, root, header);
+        return home === null ? null : opIndex.get(home)!;
+      }
+      cur = cons[0];
+    }
+    return pos.idx;
+  };
   // ONE seeding routine for self-loop and structured-loop headers. On a coalesceLoopInit target,
   // keep the induction variable in its entry (forward-edge) value's register — reproducing a
   // compiler that mutates the arg register across the loop instead of copying to a fresh local,
@@ -2823,7 +3409,8 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         // param sits at-or-before the def in the header (the def's own operands included): the
         // assignment splits the iteration into old-value-before / new-value-after, and a later
         // read of the OLD value would silently get the new one — position-granular, because
-        // liveness is block-granular and the param is killed from its own block's liveIn.
+        // liveness is block-granular and the param is killed from its own block's liveIn. And the
+        // position is where the read RENDERS, not where SSA put it (`readRenderIdx`).
         if (name === undefined) {
           const ba = backArgs?.[i];
           const d = ba !== undefined ? defs.get(ba) : undefined;
@@ -2834,7 +3421,10 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
             d !== undefined &&
             materialize.has(d) &&
             opBlock.get(d) === header &&
-            (useSitesOf.get(p) ?? []).every((s) => s.blk === header && s.idx <= opIndex.get(d)!) &&
+            (useSitesOf.get(p) ?? []).every((s) => {
+              const at = s.op === d ? s.idx : readRenderIdx(s.op, header);
+              return at !== null && at <= opIndex.get(d)!;
+            }) &&
             canTakeName(p, header, nm)
           ) {
             name = nm;
@@ -2858,6 +3448,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       // agbcc compiles to an unconditional branch.
       if (backArgs) {
         backArgName.set(backArgs[i], varName.get(p)!);
+        backArgHeader.set(backArgs[i], header);
       }
     });
   };
@@ -2875,16 +3466,24 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // (agbcc copies the init to a new reg). Never reuse a name already taken by a SIMULTANEOUSLY-LIVE
   // sibling header param — two loop-carried values seeded from one source must not collapse (a silent
   // clobber). The latch's back-edge arg carries the param's name so the loop update assigns it.
+  // A `while (1)` is seeded the same way, and its back-edge args are its latches' when they all hand
+  // the header the same ones: latches that differ leave the param a name of its own, and each
+  // back edge a copy into it. Seeding is what keeps the merge naming below from handing the param a
+  // value the body computes while the param is still read.
+  const onlyBackArgs = (header: Block, latches: readonly Block[]): readonly Value[] | null => {
+    const [first, ...rest] = latches.map((l) => successorTo(l, header)?.args ?? null);
+    return first !== null && rest.every((a) => a !== null && a.every((v, k) => v === first[k])) ? first : null;
+  };
   const structuredLoops = [
-    ...[...whileLoops.values()].map((l) => ({
+    ...[...whileLoops.values(), ...doWhileLoops.values()].map((l) => ({
       header: l.header,
-      latch: l.latch,
+      backArgs: successorTo(l.latch, l.header)?.args ?? null,
       forwardPreds: l.forwardPreds,
       body: l.body,
     })),
-    ...[...doWhileLoops.values()].map((l) => ({
+    ...[...foreverLoops.values()].map((l) => ({
       header: l.header,
-      latch: l.latch,
+      backArgs: onlyBackArgs(l.header, l.latches),
       forwardPreds: l.forwardPreds,
       body: l.body,
     })),
@@ -2913,9 +3512,8 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     return names;
   };
   for (const l of structuredLoops) {
-    const back = successorTo(l.latch, l.header);
     // exclusion seeded with enclosing-loop names → never coalesce onto them
-    seedLoopParams(l.header, l.forwardPreds, back ? back.args : null, enclosingNames(l));
+    seedLoopParams(l.header, l.forwardPreds, l.backArgs, enclosingNames(l));
   }
   let changed = true;
   while (changed) {
@@ -2933,8 +3531,8 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           incoming.push({ v: succ.args[i], pr: pred });
         }
         // A redundant phi (every edge passes the SAME value) is a pure alias of it — sharing the
-        // name is sound even while the value stays live (they are equal on every path). This
-        // waives only the LIVENESS half of canTakeName; the sibling-param check always applies.
+        // value's own name is sound even while the value stays live (they are equal on every path).
+        // This waives `carrier-live` and `re-derives`; the sibling-param check always applies.
         const allSame = incoming.length > 0 && incoming.every((c) => c.v === incoming[0].v);
         // prefer a carrier that already has a name; then a loop var whose update this receives —
         // but only one whose name survives the C3 interference check (else the edge copies into
@@ -2949,7 +3547,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           ...incoming.filter((c) => backArgName.has(c.v)),
         ]) {
           const nm = varName.get(c.v) ?? backArgName.get(c.v)!;
-          if (carriesPreUpdate(c.v, c.pr, b) || !canTakeName(p, b, nm, allSame)) {
+          if (carriesPreUpdate(c.v, c.pr, b) || !canTakeName(p, b, nm, allSame, varName.has(c.v))) {
             continue;
           }
           // `freshParamMerge` (the `/fresh-merge` variation): this merge takes its own home rather
@@ -3288,6 +3886,26 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     return { k: 'var', name: '?' };
   };
 
+  // A qualified access is one the recompile must make where the machine did, so its spelling
+  // carries the qualifier or the function declines: a plain spelling is one agbcc may delete or
+  // hoist. It carries it where ir/discipline.ts `qualifiedBy` says: on its cast, or through the
+  // object's declaration and on its cast where it reaches the object through one, since a cast's
+  // pointee drops the declaration's qualifiers.
+  const pinnedAccess = (op: Op, access: Expr): Expr => {
+    const by = qualifiedBy(op);
+    if (by === null || (by === 'declaration' && !castOffDeclaration(access, ctype))) {
+      return access;
+    }
+    const q = qualifiedMemoryAccess(access, ctype);
+    if (q === null) {
+      throw new StructureError(
+        `cannot structure '${fn.name}': a ${placedAt(op)} ${op.opcode} that must stay volatile is reached through a ` +
+          'pointer with no type to put the qualifier on',
+      );
+    }
+    return q;
+  };
+
   // Lower ONE def's operation to an Expr, rendering operands through `e`. Shared between the
   // inline-at-use path (exprWith) and the materialized-temp path (sideEffects), so both spell a
   // given op identically.
@@ -3295,12 +3913,21 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     if (d.opcode === 'const') {
       return { k: 'const', value: d.attrs.value as number };
     }
+    if (d.opcode === 'fconst') {
+      return { k: 'fconst', bits: d.attrs.bits as string };
+    }
     // a bitfield extract recognized over the ops (see the precompute above): the member read,
     // not the shift pair
     const bf = bitfieldSpelling.get(d);
     if (bf) {
       return { k: 'field', base: { k: 'var', name: bf.global }, name: bf.field, dot: true };
     }
+    if (FLOAT_TO_BIN[d.opcode]) {
+      return { k: 'bin', op: FLOAT_TO_BIN[d.opcode], l: e(d.operands[0]), r: e(d.operands[1]) };
+    }
+    if (d.opcode === 'fneg') {
+      return { k: 'un', op: 'f-', e: e(d.operands[0]) };
+    }
     if (CMP_TO_BIN[d.opcode]) {
       // A bare global address `&gSym` as a COMPARISON operand is the same unspelled escape as the
       // arithmetic case below (see intifyAddr): its C type comes from the PROJECT's own
@@ -3347,10 +3974,13 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         !(provablyNonNegative(l, vtEnv) && provablyNonNegative(r, vtEnv))
       ) {
         const irUnsigned = (v: Value): boolean => v.type.kind === 'int' && !v.type.signed;
+        // AT THE OPERAND'S OWN RANK: `(u32)a` over a 64-bit `a` pins nothing, it truncates the
+        // compare to its low half. `exprIntWidth` is total and answers 64 only where it proves it.
+        const pinUnsigned = (x: Expr): Expr => ({ k: 'cast', to: T.u(exprIntWidth(x, vtEnv)), e: x });
         if (!irUnsigned(d.operands[0]) && irUnsigned(d.operands[1])) {
-          r = { k: 'cast', to: T.u(32), e: r };
+          r = pinUnsigned(r);
         } else {
-          l = { k: 'cast', to: T.u(32), e: l };
+          l = pinUnsigned(l);
         }
       }
       // The SIGNED direction of the same hole, and a DEFAULT rather than an alternative of that variation —
@@ -3369,14 +3999,26 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       //
       // `undefined` takes the cast exactly as a definite `false` does (see
       // renderedIntSignedness): a call's signedness is the project header's, not this function's.
-      // A POINTER-rendered side is the one operand left alone, and not out of caution — `p < q`
-      // is already the unsigned compare C gives two addresses, where `(s32)p < (s32)q` would
-      // compare them signed.
+      // A POINTER-rendered side takes it too. C compares an address unsigned (`p < q` is agbcc
+      // `bcc`, IDO `sltu`), so a signed opcode over one is a source that compared the address as
+      // an integer, and the byte arithmetic's `(u8 *)g + K` left bare against an `int` compiles
+      // `bcs` where the asm says `blt`.
       if (/^icmp_s/.test(d.opcode)) {
         const pinSigned = (x: Expr): Expr =>
-          renderedIntSignedness(x, vtEnv) === true || ptrSide(x) ? x : { k: 'cast', to: T.s(32), e: x };
+          renderedIntSignedness(x, vtEnv) === true ? x : { k: 'cast', to: T.s(exprIntWidth(x, vtEnv)), e: x };
         l = pinSigned(l);
         r = pinSigned(r);
+      } else {
+        // A pointer-rendered side against an INTEGER one (the byte arithmetic's `(u8 *)g + K`
+        // against an `int`) is a constraint violation IDO 7.1 and CodeWarrior reject and agbcc
+        // warns about. The asm compared two words, and unsigned, as C compares a pointer, so the
+        // pointer side is compared as the `u32` it is. A literal 0 is the null pointer constant.
+        const intSide = (x: Expr): boolean => ctype(x)?.kind === 'int' && !(x.k === 'const' && x.value === 0);
+        if (ptrSide(l) && intSide(r)) {
+          l = { k: 'cast', to: T.u(32), e: l };
+        } else if (ptrSide(r) && intSide(l)) {
+          r = { k: 'cast', to: T.u(32), e: r };
+        }
       }
       return { k: 'bin', op: CMP_TO_BIN[d.opcode], l, r };
     }
@@ -3393,7 +4035,13 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       // out of source order — an ldmia-fed add reads def-reordered; cross-block positions do not
       // order evaluation), neither stamped `listOrder` (an ldmia-expanded load's own position is
       // LIST order), both operand VALUES un-named (see below), no pointer side (load-bearing for
-      // the stride rules below), and no effect moves (call, marker).
+      // the stride rules below), and no effect moves (call, marker). A global's value that the
+      // pointer-value rule below spells as a base is a pointer side too, though `ctype` types no
+      // global: that rule keeps the add's operand order, which a swap here would undo.
+      const ptrGlobalSide = (x: Expr): boolean =>
+        x.k === 'var' &&
+        mapUndeclared(x.name) &&
+        (pointerLoadedGlobals.has(x.name) || (d.results[0]?.type.kind === 'ptr' && wordLoadedGlobals.has(x.name)));
       if (COMMUTATIVE_BIN.has(ARITH_TO_BIN[d.opcode]) && d.operands.length === 2) {
         const [da, db] = [defs.get(d.operands[0]), defs.get(d.operands[1])];
         if (
@@ -3416,6 +4064,8 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           activeSub?.has(d.operands[1]) !== true &&
           ctype(l)?.kind !== 'ptr' &&
           ctype(r)?.kind !== 'ptr' &&
+          !ptrGlobalSide(l) &&
+          !ptrGlobalSide(r) &&
           !exprHasEffect(l) &&
           !exprHasEffect(r) &&
           opBlock.get(da) === opBlock.get(db) &&
@@ -3470,17 +4120,14 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       // computed offset addresses TWICE the intended byte, and nothing downstream can see the
       // error — in the sa3 decomp that address is what a `CpuSet` call writes THROUGH.
       //
-      // KNOWN GAP: `ptr ± ptr` is excluded, and the intify rules below do not make it right
-      // either — `ptr + ptr` becomes `l + (s32)r`, which C scales, and a same-pointee `ptr - ptr`
-      // is C's ELEMENT difference where the asm subtracted bytes. Both want the same cast-then-add
-      // treatment; both are byte-identical to what this emitted before, and three functions in the
-      // agbcc corpus carry one.
+      // `ptr - ptr` is C's ELEMENT difference, where the asm subtracted bytes: agbcc compiles `(q -
+      // p) + m` on an `int *` to `sub; asr #2; add`, and spelled `(v0 - a0) >> 2` the lift divided
+      // by 4 twice. Both sides go byte pointers, `(u8 *)v0 - (u8 *)a0`, the byte count in every
+      // world — unless both already are.
       //
-      // KNOWN GAP: the inexact-CONSTANT branch above casts its base and does NOT cast the sum
-      // back, so `v1 = (u8 *)a0 + 2` still lands in an `s32 *` slot. Copying the restore up churns
-      // the common case, where the sum is consumed by a deref that supplies its own cast — the
-      // real predicate is the CONSUMER, and deciding it here at the producer is what these two
-      // branches would have to stop doing.
+      // The inexact-CONSTANT branch above casts its base and does not cast the sum back: a deref
+      // supplies its own cast, and a temp of another pointer type takes the sum through
+      // intoDeclaredTemp's cast.
       const walkVar = (x: Expr): IrType | undefined => {
         const t = ctype(x);
         return t?.kind === 'ptr' && ptrElemBytes(t.to) !== 1 ? t : undefined;
@@ -3495,7 +4142,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         // the shape from them.
         const lp = ctype(l)?.kind === 'ptr';
         const rp = d.operands.length === 2 && ctype(r)?.kind === 'ptr';
-        if (lp && !rp) {
+        if (lp && rp && d.opcode === 'sub') {
+          if (walkVar(l) || walkVar(r)) {
+            l = bytePtr(l);
+            r = bytePtr(r);
+          }
+        } else if (lp && !rp) {
           restoreTo = walkVar(l);
           l = restoreTo ? bytePtr(l) : l;
         } else if (rp && !lp && d.opcode === 'add') {
@@ -3509,14 +4161,27 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       // DEFINITELY-pointer rendering is cast (same conservative direction as memAccess); the
       // additive ops keep C's legal pointer arithmetic untouched.
       const op = ARITH_TO_BIN[d.opcode];
-      const intify = (x: Expr): Expr => (ctype(x)?.kind === 'ptr' ? { k: 'cast', to: T.s(32), e: x } : x);
+      const intify = (x: Expr): Expr =>
+        restoredIntSum(x, false) ?? (ctype(x)?.kind === 'ptr' ? { k: 'cast', to: T.s(32), e: x } : x);
       if (!['+', '-', '&&', '||'].includes(op)) {
         l = intify(l);
         r = intify(r);
       } else if (op === '+' && ctype(l)?.kind === 'ptr' && ctype(r)?.kind === 'ptr') {
-        r = intify(r); // ptr + ptr is not C; ptr + (s32)ptr is, with the same bytes
+        // ptr + ptr is not C; ptr + (s32)ptr is, and C scales it by the left pointee. So the left
+        // side is the base, and the sum goes back to its type as the walk's does.
+        r = intify(r);
+        if (!restoreTo) {
+          restoreTo = walkVar(l);
+          l = restoreTo ? bytePtr(l) : l;
+        }
       } else if (op === '-' && ctype(l)?.kind !== 'ptr' && ctype(r)?.kind === 'ptr') {
-        r = intify(r); // int - ptr is not C
+        // int - ptr is not C. A byte sum this rule made integer leaves a global it is taken from a
+        // pointer under a pointer declaration, which the integer would scale; a word, it is the
+        // asm's under any integer or pointer one.
+        if (restoredIntSum(r, false) !== undefined) {
+          l = intWords(l);
+        }
+        r = intify(r);
       }
       // A bare global address `&gSym` under ANY of these operators is never emitted as-is: its C
       // type comes from the PROJECT's own declaration (unknowable here — exprCType types `addr`
@@ -3530,10 +4195,10 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       const intifyAddr = (x: Expr): Expr => (x.k === 'addr' ? { k: 'cast', to: T.u(32), e: x } : x);
       l = intifyAddr(l);
       r = intifyAddr(r);
-      // The SAME hazard one level down, for a value the MAP declares a pointer (`gPtr`, `gSym.pBuf`
-      // — isPtrValue): C scales `gPtr + K` by sizeof(*gPtr) — 1 under the map's synthesized
-      // `void *`, but whatever the PROJECT's header declares (a `u16 *` member, a 0x5C-byte
-      // struct) in the world a user actually recompiles in. The asm added BYTES, so the honest
+      // The SAME hazard one level down, for a pointer VALUE (`gPtr`, `gSym.pBuf` — isPtrValue):
+      // C scales `gPtr + K` by sizeof(*gPtr) — 1 under the map's synthesized `void *`, but
+      // whatever the PROJECT's header declares (a `u16 *` member, a 0x5C-byte struct) in the
+      // world a user actually recompiles in. The asm added BYTES, so the honest
       // spelling makes the stride explicit: CAST-THEN-ADD, `(u8 *)gPtr + K`, the same address in
       // EVERY world. Add-then-cast (`(u8 *)(gPtr + K)`, what the backend's deref legalization
       // would otherwise produce) is byte-correct in exactly one of them — a silent wrongness, the
@@ -3544,17 +4209,97 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       // ACCESS width, a different address whenever that width is not 1.
       // Under the non-additive operators C rejects a pointer outright, so there the honest
       // spelling is integer math on the cell — exactly intifyAddr's `(u32)&gSym` rule.
-      const intifyPtrValue = (x: Expr): Expr => ({ k: 'cast', to: T.u(32), e: x });
+      const intifyPtrValue = globalWord;
       if (op === '+' || op === '-') {
         // `ptr ± int` and `ptr - ptr` are byte arithmetic once both sides are byte pointers;
-        // `ptr + ptr` and `int - ptr` are not C at all, so the second pointer goes integer.
-        const bothPtr = isPtrValue(l) && isPtrValue(r);
-        if (isPtrValue(l)) {
-          l = bytePtr(l);
+        // `ptr + ptr` and `int - ptr` are not C at all, so the second pointer goes integer. The
+        // other side is a pointer when it is a pointer value too or when it already renders one
+        // (a pointer temp, the walk's `(u8 *)v1`), and then the global's value is the side that
+        // goes integer.
+        //
+        // A global's value no declaration types, added to an integer, is a pointer value too
+        // when the IR types the SUM a pointer: `(u8 *)g + x` is the asm's address under every
+        // declaration of `g` once `x` renders an integer, whichever operand the source held as
+        // the pointer. An integer side that IS an address (`(u32)&gArr + gIdx`) says the address
+        // is the base and the global its index, so that sum stays as it is. An address under a
+        // load (`((u16 *)&gTbl)[a0]`) is a loaded value, and that side is an integer. A global
+        // that is no pointer value renders an integer too, though `ctype` types no global.
+        const isAddr = (x: Expr): boolean =>
+          x.k === 'addr' ||
+          (x.k === 'cast' && isAddr(x.e)) ||
+          (x.k === 'bin' && (x.op === '+' || x.op === '-') && (isAddr(x.l) || isAddr(x.r)));
+        const intSide = (x: Expr): boolean =>
+          !isAddr(x) && (ctype(x)?.kind === 'int' || (x.k === 'var' && ctype(x) === undefined && !isPtrValue(x)));
+        const sumBase =
+          d.results[0]?.type.kind === 'ptr' && !isPtrValue(l) && !isPtrValue(r)
+            ? isUndeclaredGlobalValue(l) && intSide(r)
+              ? l
+              : op === '+' && isUndeclaredGlobalValue(r) && intSide(l)
+                ? r
+                : undefined
+            : undefined;
+        const ptrValue = (x: Expr): boolean => isPtrValue(x) || x === sumBase;
+        // A global no declaration types in the base's partner is added as an integer, which it is
+        // under an integer declaration and a pointer one alike.
+        if (sumBase !== undefined) {
+          l = l !== sumBase ? intWords(l) : l;
+          r = r !== sumBase ? intWords(r) : r;
+        }
+        const rendersPtr = (x: Expr): boolean => ptrValue(x) || ctype(x)?.kind === 'ptr';
+        const bothPtr = rendersPtr(l) && rendersPtr(r);
+        // `x + (u8 *)g` is pointer arithmetic, and gcc makes the pointer the first operand of the
+        // add, which swaps the asm's. So under an integer left side, the value of a global no
+        // declaration types, or a byte sum this rule made of one, is added as an integer in the
+        // asm's order, and the cast keeps the sum the byte pointer it would have been. A declared
+        // pointer keeps `x + (u8 *)p`, the operand the element and field spellings read.
+        const undeclaredPtr = (x: Expr): boolean => x.k === 'var' && mapUndeclared(x.name);
+        // The same global LEFT of a runtime offset is added as an integer too: CodeWarrior at -O4
+        // puts the index first in every pointer sum, where an integer sum keeps the source's
+        // order, so `(u8 *)g + x` is the asm's order on agbcc, KMC gcc and IDO only. The partner
+        // goes integer with it, or a pointer partner would scale the sum. A constant offset folds
+        // into the access and keeps `(u8 *)g + K`.
+        const constValued = (x: Expr): boolean =>
+          x.k === 'const' ||
+          (x.k === 'cast' && constValued(x.e)) ||
+          (x.k === 'bin' && constValued(x.l) && constValued(x.r));
+        const intSum = op === '+' && !constValued(r) && ptrValue(l) && undeclaredPtr(l);
+        if (intSum) {
+          l = intifyPtrValue(l);
+          r = ptrValue(r)
+            ? intifyPtrValue(r)
+            : ctype(r)?.kind === 'ptr'
+              ? isByteGlobalSum(r)
+                ? byteSumAsInt(r)
+                : { k: 'cast', to: T.u(32), e: r }
+              : intWords(r);
+          restoreTo ??= T.ptr(T.u(8));
+        } else if (ptrValue(l)) {
+          l = op === '+' && bothPtr && !ptrValue(r) ? intifyPtrValue(l) : bytePtr(l);
         }
-        if (isPtrValue(r)) {
+        if (intSum) {
+          // both operands are integers now
+        } else if (
+          op === '+' &&
+          !bothPtr &&
+          !restoreTo &&
+          ((ptrValue(r) && undeclaredPtr(r)) || (ctype(r)?.kind === 'ptr' && isByteGlobalSum(r, true)))
+        ) {
+          r = ptrValue(r) ? intifyPtrValue(r) : byteSumAsInt(r);
+          // A left global no declaration types may be a pointer in the project's header, which
+          // would scale the integer sum; as an integer it is the asm's word under any declaration.
+          l = intWords(l);
+          restoreTo = T.ptr(T.u(8));
+        } else if (ptrValue(r)) {
           r = bothPtr && op === '-' ? bytePtr(r) : op === '+' && !bothPtr ? bytePtr(r) : intifyPtrValue(r);
         }
+        // A byte sum less an integer sum of globals no declaration types: bare, `gB2 - gB3` is an
+        // element count under a wider pointer declaration of them, where the asm subtracted bytes.
+        if (op === '-' && r.k === 'bin' && !rendersPtr(r) && isByteGlobalSum(l)) {
+          r = intWords(r);
+        }
+        if (op === '-' && ctype(l)?.kind === 'ptr' && ctype(r)?.kind === 'ptr') {
+          restoreTo = undefined; // a byte pointer less a byte pointer is the byte count, an integer
+        }
       } else if (op !== '&&' && op !== '||') {
         // (`&&`/`||` take a pointer operand legally — a truth test, no arithmetic.)
         l = isPtrValue(l) ? intifyPtrValue(l) : l;
@@ -3563,10 +4308,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       // (The signedness-carrying pairs stay DISTINCT ops here — `>>>`/`>>` and `/u` `%u`/`/` `%`.
       // Which token a language spells each with, and what cast pins the choice, is a BACKEND
       // decision; see l3/ast.ts BinOp and backend/cfamily.ts's C_SPELLING.)
-      // SCOPE: this and intifyAddr cover the ARITHMETIC escapes. A pointer global under a
-      // COMPARISON (`gPtr < K` — C compares unsigned whatever the asm's icmp_s* said) is the same
-      // class as intifyAddrCmp's `addr` rule and is deliberately left alone here: it is valid C
-      // today, so closing it would churn spellings for a signedness case no row exercises.
+      // SCOPE: this and intifyAddr cover the ARITHMETIC escapes. A pointer value under a
+      // COMPARISON (`gPtr < K`, `(u8 *)gPtr + K < a0`) needs nothing here: an icmp_s* pins every
+      // operand that does not provably render signed, a pointer included (pinSigned above).
       //
       // A `+`/`|` over two IR `const`s that both RENDER as literals is the literal it is. After
       // pre-recovery there is only one way such an op still exists: `raise/const.ts` refuses to fold
@@ -3666,13 +4410,122 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         ? { k: 'cast', to: T.int(w, d.opcode === 'sext'), e: e(d.operands[0]) }
         : mkGap(`no C type for a ${w}-bit '${d.opcode}'`, [e(d.operands[0])]);
     }
+    // The recovered integer type of a value, where it has one. `lo32`/`hi32`/`concat` all cast to
+    // one, and a value recovery left as anything else has no cast to spell.
+    const asInt = (t: IrType) => (t.kind === 'int' ? t : undefined);
+    // THE TWO HALVES OF A 64-BIT VALUE, which C spells exactly: the low half is a truncating cast,
+    // the high half a shift and then the same cast. The RESULT's own recovered type is what the
+    // cast is to, and the shift's kind comes from the 64-bit operand's — `>>` over a signed value
+    // and `>>>` over an unsigned one is what the machine did, and what the C backend's operand pin
+    // is spelled in terms of.
+    if (d.opcode === 'lo32' || d.opcode === 'hi32') {
+      const src = e(d.operands[0]);
+      const half = asInt(d.results[0].type) ?? T.u(32);
+      // The LOW half is a truncating cast and needs nothing of its operand's rank: `(u32)x` and
+      // `(u32)(s64)x` are the same value whatever `x` renders as.
+      if (d.opcode === 'lo32') {
+        return { k: 'cast', to: half, e: src };
+      }
+      // THE HIGH HALF SHIFTS BY 32, AND `x >> 32` IS UNDEFINED IN C WHERE `x` RENDERS 32 BITS
+      // WIDE — the shift count must be below the promoted left operand's width. The 64-bit VALUE
+      // is what this op projects, but the rendered EXPRESSION is a separate question and the two
+      // can part, so the operand is made to carry the rank the shift reads by a cast to the
+      // value's own recovered 64-bit type.
+      //
+      // THE SIGNEDNESS IS A SEPARATE PIN AND IS NOT MADE HERE. `>>` versus `>>>` is read off the
+      // 64-bit operand's recovered type, and what the printed operand renders as is decided one
+      // level down by backend/cfamily.ts `pinnedOperands` — which casts whenever the operand does
+      // not PROVABLY render as the operator needs, and a call never does. So the cast this arm may
+      // add carries the rank alone; claiming it carries both would be a claim about a decision
+      // this file does not make.
+      const whole = asInt(d.operands[0].type);
+      const wide: Expr | undefined =
+        exprIntWidth(src, vtEnv) === 64 ? src : whole === undefined ? undefined : { k: 'cast', to: whole, e: src };
+      // A 64-BIT VALUE WHOSE RECOVERY IS NOT AN INTEGER, AND WHOSE RENDERING DOES NOT ALREADY
+      // CARRY THE RANK, has no 64-bit type to cast to and no legal shift to spell, so it is a GAP
+      // rather than the undefined C it would otherwise print — the same loud floor the un-nameable
+      // `sext` width gets two arms above. The condition is the CONJUNCTION and the refusal states
+      // it as one: neither half alone is a reason. Nothing in the corpus reaches it: every `hi32`
+      // is built beside a `concat` or a pair return whose recovery is an integer, and a recovery
+      // that is not one stops at the `concat` gap below before a projection of it is rendered.
+      if (wide === undefined) {
+        // "UPPER HALF", NOT "HIGH HALF", for the reason the split-pair refusal in thumb.ts gives at
+        // its own throw: `apps/web`'s `reloc-halves` decline class holds `/high half/`, its list is
+        // ORDERED, and a 64-bit gap published as a relocation gap because one entry comes first is
+        // a classification nothing states. `wide-call-arg` claims this phrase BY NAME
+        // (`/no upper half to shift out/`) — a 64-bit gap with no class at all renders as
+        // "Other / unclassified", which is the same wrong answer arrived at from the other side.
+        return mkGap(
+          'a 64-bit value that neither renders 64 bits wide nor has an integer type has no upper half to shift out',
+          [src],
+        );
+      }
+      return {
+        k: 'cast',
+        to: half,
+        e: { k: 'bin', op: whole?.signed ? '>>' : '>>>', l: wide, r: { k: 'const', value: 32 } },
+      };
+    }
+    // …AND THE WIDEN THAT BUILDS ONE, which the machine spells as a PAIR rather than as a cast —
+    // `asr rN,rM,#31` for the signed extension of a word, `mov rN,#0` for the unsigned one. So the
+    // shape is what says HOW the half was widened, and the cast this renders is to whatever 64-bit
+    // type recovery gave the value.
+    //
+    // THE WORD'S OWN SIGNEDNESS IS WHAT THE WIDEN MEANS, and it is pinned the way every other
+    // signedness-carrying operand in this function is: cast only where the operand does not
+    // already render that way. Leaving the signed arm to whatever `x` happens to render as reads
+    // the widen off the DECLARATION rather than off the `asr` — under `/unsigned` the parameter is
+    // declared `u32` and `(s64)x` then says zero-extend, against an instruction that says
+    // otherwise.
+    //
+    // A `concat` of anything else is a 64-bit value this pipeline has no C spelling for, and it
+    // falls through to the loud gap at the bottom — which is the whole safety story for the
+    // representation. A pair that tried to cross a join matches nothing here.
+    if (d.opcode === 'concat') {
+      const [lo, hi] = d.operands;
+      const hiDef = defs.get(hi);
+      const whole = asInt(d.results[0].type);
+      const signedWiden = hiDef?.opcode === 'shr_s' && hiDef.operands[0] === lo && hiDef.attrs.imm === 31;
+      const unsignedWiden = hiDef?.opcode === 'const' && hiDef.attrs.value === 0;
+      if (whole && (signedWiden || unsignedWiden)) {
+        const word = e(lo);
+        const half =
+          renderedIntSignedness(word, vtEnv) === signedWiden
+            ? word
+            : { k: 'cast' as const, to: T.int(32, signedWiden), e: word };
+        return { k: 'cast', to: whole, e: half };
+      }
+    }
     if (d.opcode === 'call') {
-      return { k: 'call', fn: d.attrs.target as string, args: d.operands.map(e) };
+      // THE RANK THE RETURN RENDERS WITH TRAVELS ON THE NODE, because no later reader can recover
+      // it: the width is a fact the frontend was TOLD (a runtime helper's signature, or a project's
+      // `FnProto.returns`) and it is gone from the tree by the time the C backend pins an operand.
+      // Stamping it here — at the one place a call becomes an expression — is what keeps every
+      // reader of `exprIntWidth` agreeing. `grep -rn exprIntWidth packages/core/src` is the
+      // enumeration, and it lists SIX call sites in three files: the `hi32` shift and the two
+      // compare pins in this file, the shift rank and the divide rank in backend/cfamily.ts
+      // `pinnedOperands`, and `l3/initfirst.ts`'s `meaningPreserved`.
+      //
+      // THE LAST ONE IS A BEHAVIOUR CHANGE THE STAMP MAKES, and it is named because a reader who
+      // trusts an enumeration is owed a complete one: a `wide64` call answered 32 before the stamp
+      // and answers 64 now, so `meaningPreserved` refuses to fold such a result into a 32-bit
+      // local where it used to admit it. That is what its own reason asks for — a 64-bit value
+      // assigned to a 32-bit one truncates — but it is a pass this branch did not set out to move.
+      const wide64 = d.results[0] !== undefined && intWidth(d.results[0].type) === 64;
+      const through = calleeValue(d);
+      return {
+        k: 'call',
+        fn: through === undefined ? (d.attrs.target as string) : e(through),
+        args: callArgs(d).map(e),
+        ...(wide64 ? { wide64: true as const } : {}),
+        ...(d.attrs.sret === true ? { sret: d.results[0].type } : {}),
+      };
     }
     if (d.opcode === 'laddr') {
       // gaddr's local twin: the address of the frame-local object the Thumb frontend PROVED
       // (frame-object audit — width/signed are stamped machine facts). The NAME is this layer's:
-      // see laddrName. Renders `&sp0`; the object itself is declared in `locals`.
+      // see laddrName. Renders `&sp0`; the object itself is declared in `locals`, and an ARRAY
+      // one renders by decay, which the C printer reads off that declaration.
       return { k: 'addr', name: laddrName.get(d)! };
     }
     if (d.opcode === 'undef') {
@@ -3691,7 +4544,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       return { k: 'addr', name: d.attrs.sym as string };
     }
     if (d.opcode === 'load') {
-      return memAccess(
+      const access = memAccess(
         d.operands[0],
         e(d.operands[0]),
         d.attrs.off as number,
@@ -3703,11 +4556,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         false,
         advanceStepOf(d.operands[0]),
       );
+      return pinnedAccess(d, access);
     }
     // aload carries a runtime index operand (variable-index array access) — `base[index]`, or
     // `base[index].field_K` when it carries a `fieldOff` (array-of-STRUCT element access).
     if (d.opcode === 'aload') {
-      return arrayAccess(
+      const access = arrayAccess(
         d.operands[0],
         e(d.operands[0]),
         e(d.operands[1]),
@@ -3718,16 +4572,28 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         ctype,
         symCtx,
       );
+      return pinnedAccess(d, access);
     }
     return d.opcode === 'opaque'
-      ? mkGap(gapReasonFor(d.attrs.mnemonic), d.operands.map(e))
+      ? mkGap(gapReasonFor(d.attrs), d.operands.map(e))
       : mkGap(`no lowering for op '${d.opcode}'`, d.operands.map(e));
   };
 
+  // A map EXTENDS the ambient post-loop substitution (`activeSub`, below) and wins where both map a
+  // value: a loop's own reading is layered over the enclosing exit region's, which still holds
+  // inside it. Replacing the ambient one would re-derive a value a previous loop left in its
+  // variable's name from that name, which already holds it (`v1 + 1` for `v1`). `null` is no
+  // substitution at all.
   const exprWith = (sub: Map<Value, string> | null) => {
     const e = (v: Value): Expr => {
-      const subbed = sub?.get(v);
+      const subbed = sub === null ? undefined : (sub.get(v) ?? activeSub?.get(v));
       if (subbed) {
+        if (zeroTripStale?.get(v) === subbed) {
+          throw new StructureError(
+            `cannot structure '${fn.name}': a read after the loop spells a value computed before it by a ` +
+              `loop variable's name, which holds its initial value on a zero-trip run`,
+          );
+        }
         return { k: 'var', name: subbed };
       }
       if (varName.has(v)) {
@@ -3748,7 +4614,17 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // naming walk and the coalescing that follows it, and these checks only read it — so today the
   // two readings coincide; the reference is what keeps them coinciding if a write ever moves down
   // here.
-  const { readsClobbered, loopUpdateHazard, sinkablePreUpdateSlots, sameAtEntry, loopWriteSet } = makeLoopHazards({
+  const {
+    readsClobbered,
+    loopEscapeHazard,
+    loopUpdateHazard,
+    testSkipsAnEffect,
+    preUpdateCondFold,
+    sinkablePreUpdateSlots,
+    sameAtEntry,
+    loopWriteSet,
+    loopWriteSetAhead,
+  } = makeLoopHazards({
     defs,
     varName,
     useSitesOf,
@@ -3756,6 +4632,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     opBlock,
     materialize,
     respelledDefs: bitfieldSpelling,
+    emitPos,
   });
 
   // A POST-LOOP substitution active while structuring a loop's exit region: a loop-carried value (a
@@ -3763,6 +4640,11 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // read the name, not re-inline the computation (which would double-count, e.g. `(u8)(v1+1)` instead
   // of `v1`). `expr` consults it; `withSub` installs/merges it around the exit region. Null normally.
   let activeSub: Map<Value, string> | null = null;
+  // The entries of a guarded self-loop's substitution its exit region may not render (that site's
+  // `stale`), merged over every enclosing guarded loop's like `activeSub` is: consulted where ANY
+  // substitution hit renders in scope, so it judges what the region spells, dead copies included —
+  // which over-declines, the refusing direction.
+  let zeroTripStale: Map<Value, string> | null = null;
   const expr = (v: Value): Expr => exprWith(activeSub)(v);
   const withSub = <R>(sub: Map<Value, string>, run: () => R): R => {
     const prev = activeSub;
@@ -3802,9 +4684,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // stores whatever the arm left — the same substitution the parameter case makes, one step over.
   //
   // THE SECOND RELOCATION goes the other way, and this test cannot see it at all. A SUNK pre-update
-  // exit copy (preUpdateCopies) writes the loop EXIT's param at the top of the loop BODY, so the
-  // home this reads for it — `paramBlock`, the exit block — sits strictly LATER in the CFG than
-  // where the copy lands. What keeps the two apart is not this test but `dest-free-inside-loop`
+  // exit copy (preUpdateCopies) writes the loop EXIT's param INSIDE the loop BODY, so the home this
+  // reads for it — `paramBlock`, the exit block — sits strictly LATER in the CFG than where the copy
+  // lands. What keeps the two apart is not this test but `dest-free-inside-loop`
   // (hazards.ts): a merge inside the body under the exit param's name is a block param
   // `definedInBody` sees, so the slot is never sunk in the first place. That gate carries its own
   // KNOWN GAP, so the pair is a conjecture rather than a proof — `sunkCopyOverDroppedUndef` re-checks
@@ -3818,10 +4700,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   }
   /** Every copy `undefCarriesNothing` dropped, with the edge it was dropped from. */
   const droppedUndefCopies: { name: string; pred: Block }[] = [];
-  /** Every sunk pre-update exit copy, homed where it LANDS (the loop header whose body opens with
-   *  it) rather than where its destination param lives. These two lists are the postcondition's
-   *  whole input. */
+  /** Every sunk pre-update exit copy, homed where it LANDS (the loop header, which dominates every
+   *  point inside the body a copy is rebuilt at) rather than where its destination param lives.
+   *  These two lists are the postcondition's whole input. */
   const sunkCopyHomes: { name: string; home: Block }[] = [];
+  /** A loop's sunk pre-update exit copies: those rebuilt at the op that computed their value, and
+   *  those with no such op, which open the body. */
+  type SunkCopies = { leading: Stmt[]; atDef: Map<Op, Stmt[]> };
+  const NO_COPIES_AT_A_DEF: ReadonlyMap<Op, Stmt[]> = new Map();
+  /** The `atDef` copies `sideEffects` has spelled — `assertSunkCopiesPlaced`'s input. */
+  const sunkCopiesEmitted = new Set<Stmt>();
   const undefCarriesNothing = (arg: Value, name: string, pred: Block): boolean => {
     if (defs.get(arg)?.opcode !== 'undef') {
       return false;
@@ -4064,24 +4952,28 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // EFFECTFUL op whose result nothing consumes (a void/discarded call, and an `opaque` standing for
   // an instruction asmlift could not model); and MATERIALIZED defs — a call/load whose value cannot
   // soundly render at its use is assigned to its named temp here, at its own program position.
-  /** A pointer VALUE assigned into a map-declared pointer CELL, spelled so the assignment is legal
-   *  against ANY declaration of that cell. The byte-arithmetic guard renders such a right-hand
-   *  side `(u8 *)gS.pBuf + K` — the right ADDRESS in every world, which is the whole point of it,
-   *  and a `u8 *` where the declaration says `u16 *`. READING one is fine (C converts an object
-   *  pointer freely under a deref, a call argument or a compare); ASSIGNING one is `warning:
-   *  assignment from incompatible pointer type`, and this project's own `-Werror` compiler
-   *  template makes that FATAL — so a source that scores clean here fails to build in the tree a
-   *  user pastes it into, which no score gate can observe.
+  /** A pointer VALUE assigned into a pointer CELL (isPtrValue), spelled so the assignment is legal
+   *  against ANY pointer declaration of that cell. The byte-arithmetic guard renders such a
+   *  right-hand side `(u8 *)gS.pBuf + K` — the right ADDRESS in every world, which is the whole
+   *  point of it, and a `u8 *` where the declaration says `u16 *`. READING one is fine (C converts
+   *  an object pointer freely under a deref, a call argument or a compare); ASSIGNING one is
+   *  `warning: assignment from incompatible pointer type`, and this project's own `-Werror`
+   *  compiler template makes that FATAL — so a source that scores clean here fails to build in the
+   *  tree a user pastes it into, which no score gate can observe.
    *
    *  `void *`, NOT the map's declared pointee: it is the one target assignment-compatible with any
    *  object-pointer declaration, the same "same answer in every world" property the guard that
    *  made the `u8 *` exists for. Trusting the map's pointee would put the spelling back in one
    *  world. It costs nothing: agbcc compiles `p = (void *)((u8 *)p + 4)` and the warning-carrying
    *  `p = (u8 *)p + 4` to BYTE-IDENTICAL objects (`-mthumb-interwork -Wimplicit -O2 -fhex-asm
-   *  -fprologue-bugfix`), so the fix is invisible to the differ and visible to the compiler. */
+   *  -fprologue-bugfix`), so the fix is invisible to the differ and visible to the compiler.
+   *
+   *  A project may still declare a cell no map types an INTEGER (`u32 gSym;`), where `(void *)`
+   *  makes an integer from a pointer: agbcc warns, CodeWarrior rejects it. The candidate's own world
+   *  declares the cell `void *` (l3/symbol-refs.ts), and `/int-cell` (l3/intcell.ts) spells the
+   *  integer declaration's source, published only at a byte-exact score. */
   const intoPtrCell = (lval: Expr, value: Expr): Expr => {
-    const cell = lval.k === 'var' ? symCtx?.info(lval.name)?.shape === 'pointer' : ptrMemberDecl(lval, symCtx) !== null;
-    if (!cell) {
+    if (!isPtrValue(lval)) {
       return value;
     }
     const vt = ctype(value);
@@ -4093,80 +4985,49 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     return isPtr ? { k: 'cast', to: T.ptr(T.void()), e: value } : value;
   };
 
-  /** THE REFUSAL for the read half of `unreadResult`. TWO questions, and the statement is spelled
-   *  only where BOTH answer yes; the second is not implied by the first.
+  /** THE REFUSAL for the read half of `unreadResult`: can a `volatile` reach this dead read's
+   *  spelling, here or in some candidate enumerated from this tree?
+   *
+   *  A QUALIFIED read (ir/discipline.ts `qualified`) answers yes: `pinnedAccess` puts the qualifier
+   *  on its spelling, from the device pin or from the map's declaration of the object it reads. Every
+   *  other read is plain in this tree, and only a variation can qualify it, so the statement is
+   *  spelled only where both of these hold:
    *
    *   1. EVIDENCE — would a source plausibly have declared this access `volatile`? The answer has
    *      to come from DATA: the target's declared device-register window
-   *      (`capabilities.deviceRegisters`) or the symbol map's own `volatile` on the named global.
-   *      `volatile` is a CORRECTNESS claim about an address, not a spelling preference, and
-   *      asserting one about ordinary RAM is a wrong answer rather than a wrong spelling.
-   *   2. REACHABILITY — will the spelling this access gets CARRY a qualifier, here or in some
-   *      candidate enumerated from this tree? The payoff of spelling a dead read is that a
-   *      qualifier can land on it and the differ can referee the pair; where none can, the
-   *      statement is a permanent bare deref in the DEFAULT source, which is what the playground
-   *      pins and what a decomp author copies. This question refuses far less than question 1:
-   *      `/volatile` qualifies an EWRAM or ROM address quite happily.
+   *      (`capabilities.deviceRegisters`). `volatile` is a CORRECTNESS claim about an address, not a
+   *      spelling preference, and asserting one about ordinary RAM is a wrong answer rather than a
+   *      wrong spelling.
+   *   2. REACHABILITY — the base value has a use OTHER than this read: l3/volatileptr.ts qualifies a
+   *      pointer LOCAL, and l3/basecse.ts only mints that local for a base something else also
+   *      touches. A single-access read — `*(s32 *)0x04000200;`, the `REG_IF` acknowledge idiom, and
+   *      the shape a WRONG `returnsVoid` on a register accessor produces — has no local to qualify
+   *      and never will, however plainly its address is a device register. "Some other use" is
+   *      NECESSARY for that local, not sufficient; the gate states the necessary half. Where no
+   *      qualifier can land, the statement would be a permanent bare deref in the DEFAULT source,
+   *      which is what the playground pins and what a decomp author copies.
    *
-   *  THE MAP ARM needs the read spelled through the global's own NAME, which is where the map's
-   *  qualifier lands — memAccess's two name-carrying arms for a global, the bare scalar
-   *  (`gStatus;`) and the declared struct MEMBER (`gState.ctl;`). A CAST spelling
-   *  (`((s32 *)&REG_DMA3SAD)[2]`) has thrown the qualifier away in the spelling itself, whatever
-   *  the declaration says. The member arm asks the CONTAINER's qualifier and not the member's own
-   *  (`SymbolStructField.volatile`), which looks backwards and is not: `memberQualsAllow` above
-   *  refuses to NAME a volatile member at all, so a `vu16` member is spelled `((s32 *)&gSym)[k]`
-   *  with nothing in the spelling for a variation to hold, while `volatile struct S gSym;` qualifies
-   *  every member and `gSym.ctl;` really is an observable read. Every other map spelling refuses —
-   *  `gPtr->member`, a bare-name array element, a multidimensional subscript — because
-   *  over-refusing costs a SPELLING and admitting wrongly costs an ANSWER, this file's standing
-   *  asymmetry.
+   *  The address is a LITERAL, which inhabits only `/raw-globals`: with a symbol map the frontend
+   *  spells a pool word as `gaddr`, so `constAddressOf` returns null, and a read of a named object
+   *  is plain because the map does not declare it volatile.
    *
-   *  THE LITERAL ARM needs the base value to have a use OTHER than this read: l3/volatileptr.ts
-   *  qualifies a pointer LOCAL, and l3/basecse.ts only mints that local for a base something else
-   *  also touches. A single-access read — `*(s32 *)0x04000200;`, the `REG_IF` acknowledge idiom,
-   *  and the shape a WRONG `returnsVoid` on a register accessor produces — has no local to qualify
-   *  and never will, however plainly its address is a device register. "Some other use" is
-   *  NECESSARY for that local, not sufficient; the gate states the necessary half.
-   *
-   *  ONLY `load` REACHES EITHER ARM. `aload` carries its index in `operands[1]` and has no `off`
-   *  attr at all, so both address queries would answer for the BARE BASE — `globalCellOf` resolves
-   *  a base and discards the index by construction (ir/alias.ts), `constAddressOf` sees the literal
+   *  ONLY `load` REACHES THE ARM. `aload` carries its index in `operands[1]` and has no `off` attr at
+   *  all, so the address query would answer for the BARE BASE — `constAddressOf` sees the literal
    *  with `off` defaulted to 0 — which admits `volatile s32 *p0 = (s32 *)0x04000000; p0[a0];`, a
    *  qualified access at an address the declared window does not cover. The whitelist is by OPCODE
-   *  so a read op added later refuses until someone answers both questions for it.
-   *
-   *  THE ARMS DO NOT SHARE A POPULATION. With a symbol map the frontend spells a pool word as
-   *  `gaddr`, so `constAddressOf` returns null and the literal arm inhabits only `/raw-globals`,
-   *  which re-structures with NO map. The map arm is the default-source one, and a map-fed DMA
-   *  function spells no read at all — its wait-read is cast-spelled (see `BASECSE_GATES`'
-   *  `repeated-const-offset`, whose base local this refusal hands back). */
+   *  so a read op added later refuses until someone answers both questions for it. */
   const volatileQualifiable = (op: Op): boolean => {
+    if (qualified(op)) {
+      return true;
+    }
     if (op.opcode !== 'load') {
       return false;
     }
-    const off = typeof op.attrs.off === 'number' ? op.attrs.off : 0;
-    const width = op.attrs.width as number;
-    const cell = globalCellOf(defs, op.operands[0], off);
-    if (cell) {
-      const si = symbols?.get(cell.name);
-      if (si === undefined) {
-        return false;
-      }
-      if (si.shape === 'struct') {
-        // the SAME find memAccess's struct arm makes, so the two cannot disagree about which
-        // accesses reach the `gSym.field` spelling this arm's qualifier rides on
-        const fld = symCtx
-          ?.fieldsOf(cell.name)
-          ?.find((f) => f.offset === cell.byte && f.size === width && !isArrayField(f) && !isBitfieldField(f));
-        return fld !== undefined && memberQualsAllow(fld, si.const, false) && si.volatile === true;
-      }
-      return cell.byte === 0 && scalarGlobals.has(cell.name) && si.volatile === true;
-    }
     const window = opts.deviceRegisters;
     if (!window) {
       return false;
     }
-    const addr = constAddressOf(defs, op.operands[0], off);
+    const addr = constAddressOf(defs, op.operands[0], typeof op.attrs.off === 'number' ? op.attrs.off : 0);
     if (addr === null || addr < window[0] || addr >= window[1]) {
       return false;
     }
@@ -4174,11 +5035,11 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   };
 
   /** Ops the `sideEffects` walk must SPELL even though nothing consumes their result — the
-   *  registry's own derived set (`SPELLED_WHEN_DEAD_OPS`), so the next op to acquire the property
-   *  needs no edit here, plus the address refusal above for the memory-read half.
+   *  question ir/discipline.ts asks of every op (`spelledWhenDead`), so the next op to acquire the
+   *  property needs no edit here, plus the address refusal above for the memory-read half.
    *
-   *  A memory READ is not in `EFFECTFUL_OPS`, deliberately: ir/opcodes.ts calls a load deletable
-   *  when dead, because nothing observes a read nobody reads. That is the C claim. The COMPILER
+   *  A memory READ is not `effectful`, deliberately: ir/discipline.ts calls a load deletable when
+   *  dead, because nothing observes a read nobody reads. That is the C claim. The COMPILER
    *  claim points the other way — an optimizing compiler deletes every dead read it is allowed to
    *  delete, so one still in the target is evidence the source's access was `volatile`, and
    *  dropping it deletes an instruction the machine executed.
@@ -4203,9 +5064,8 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
    *     the other preimage is a function whose `returnsVoid` fact is WRONG, so its return value
    *     arrived here as a dead read. The second-use clause removes the common shape of that (a bare
    *     register accessor), leaving a function that both STORES to a device register and reads one
-   *     back — narrow, but not proven empty. The MAP arm has no such problem: `gStatus;` under
-   *     `extern volatile u32 gStatus;` compiles differently from its own absence, so the differ can
-   *     referee it. The clean fix — spell the read only in candidates that also qualify it, paired
+   *     back — narrow, but not proven empty. A qualified read has no such problem: `gStatus;` under
+   *     `extern volatile u32 gStatus;` compiles differently from its own absence. The clean fix — spell the read only in candidates that also qualify it, paired
    *     the way `/livebase/volatile` already pairs — moves every device row's fan shape and wants
    *     its own round and zero-flip gate over BOTH tiers.
    *  2. THE REFUSAL IS SILENT. When this returns false for a `load`, the machine performed a read
@@ -4268,7 +5128,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   const hasSpelledUse = (v: Value): boolean => (useSitesOf.get(v) ?? []).some((s) => isSpelled(s.op));
 
   const unreadResult = (op: Op): boolean =>
-    SPELLED_WHEN_DEAD_OPS.has(op.opcode) &&
+    spelledWhenDead(op) &&
     op.results.length > 0 &&
     // NO EXEMPTION FOR A MATERIALIZED DEF HERE, and it is not missing. Such a def already renders
     // at its own position, as `v = f(…)`, which spells the effect as surely as a bare statement
@@ -4281,7 +5141,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     !hasSpelledUse(op.results[0]) &&
     (opSig(op.opcode)?.reads !== true || volatileQualifiable(op));
 
-  const sideEffects = (b: Block): Stmt[] => {
+  const sideEffects = (b: Block, atDef: ReadonlyMap<Op, Stmt[]> = NO_COPIES_AT_A_DEF): Stmt[] => {
     const out: Stmt[] = [];
     for (const op of b.ops) {
       if (op.opcode === 'store') {
@@ -4320,24 +5180,26 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         }
         // signedness mirrors recoverTypes' store seed (word ⇒ signed, narrow ⇒ unsigned), so an
         // inserted cast declares the same scalar the recovered pointee would have.
-        out.push({ k: 'store', lval: lval0, value: intoPtrCell(lval0, expr(op.operands[1])) });
+        const lval = pinnedAccess(op, lval0);
+        out.push({ k: 'store', lval, value: intoPtrCell(lval, expr(op.operands[1])) });
       } else if (op.opcode === 'astore') {
         const elemSize = op.attrs.elemSize as number;
+        const lval = arrayAccess(
+          op.operands[0],
+          expr(op.operands[0]),
+          expr(op.operands[1]),
+          op.attrs.fieldOff as number | undefined,
+          op.attrs.memberOff as number | undefined,
+          elemSize,
+          // a member array's store spells through the member's OWN declaration, which the
+          // recognizer records; every other astore keeps the width===4 convention
+          (op.attrs.signed as boolean | undefined) ?? elemSize === 4,
+          ctype,
+          symCtx,
+        );
         out.push({
           k: 'store',
-          lval: arrayAccess(
-            op.operands[0],
-            expr(op.operands[0]),
-            expr(op.operands[1]),
-            op.attrs.fieldOff as number | undefined,
-            op.attrs.memberOff as number | undefined,
-            elemSize,
-            // a member array's store spells through the member's OWN declaration, which the
-            // recognizer records; every other astore keeps the width===4 convention
-            (op.attrs.signed as boolean | undefined) ?? elemSize === 4,
-            ctype,
-            symCtx,
-          ),
+          lval: pinnedAccess(op, lval),
           value: expr(op.operands[2]),
         });
       } else if (rendersAtOwnPosition(op)) {
@@ -4364,6 +5226,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         out.push({ k: 'assign', name: a.name, value: expr(a.arg) });
         anchorsEmitted.add(a);
       }
+      // a sunk pre-update exit copy, rebuilt at the op that computed its value (preUpdateCopies).
+      // Reached for the same reason the anchored copies are: every key is an op with a RESULT, so
+      // none of them is the `store`/`astore` this walk `continue`s out of above. A PARAMETER, where
+      // the anchored copies read a module-level map: a sunk copy belongs to ONE loop's body, and a
+      // map would let the generic `sideEffects(b)` calls emit it in an unrelated context — silently,
+      // because `assertSunkCopiesPlaced` would see it placed.
+      for (const st of atDef.get(op) ?? []) {
+        out.push(st);
+        sunkCopiesEmitted.add(st);
+      }
     }
     return out;
   };
@@ -4380,7 +5252,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // to `header` is a conditional continue; its other edge, when it leaves the loop, is an early exit
   // (a `break` to `exit`, or an early `return` through a trampoline). Null outside any loop body —
   // the early-exit branch in structureBlock is inert there.
-  type LoopFrame = { header: Block; exit: Block; body: Set<Block>; arms: LoopArm[] };
+  type LoopFrame = { header: Block; exit: Block; body: Set<Block>; arms: LoopArm[]; breaks: ReadonlySet<Block> };
   let loopCtx: LoopFrame | null = null;
   const withLoop = <R>(frame: LoopFrame, run: () => R): R => {
     const prev = loopCtx;
@@ -4392,6 +5264,88 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     }
   };
 
+  // THE IMPLICIT CONTINUE. A branch with one edge back to the loop header spells that edge as
+  // nothing at all: control falls to the bottom of the body and the loop goes round. That holds only
+  // where the region being structured ends at the loop bottom (`stop === frame.header`). An `if` in
+  // the body whose join lies outside it, at the loop's exit, hands its arms that exit as `stop` and
+  // renders the exit region after itself, still inside the body: an implicit continue there falls
+  // into that region and the loop runs at most once. Both spellings of a branch that leaves the loop
+  // beside such an edge consult this.
+  const continueFallsToBottom = (frame: LoopFrame, stop: Block | null): boolean => stop === frame.header;
+
+  // THE BREAK RULE, for a `break` from block `from` out of `frame`'s body wherever the edge sits. A
+  // `break` lands after the loop, where the header→exit copies render and then the exit region, raw.
+  // Refused:
+  //   • a `do-while`: its exit copies live post-loop too, but are judged differently;
+  //   • the header→exit edge has copies the break cannot share: the break path runs them too, and
+  //     they would overwrite what the break carried;
+  //   • the exit region reads a loop value under a loop variable's name that `writes` holds —
+  //     the names this iteration has rewritten by the time the break leaves.
+  //
+  // A BREAK THAT CARRIES WHAT THE HEADER CARRIES shares them. When every argument the break edge
+  // hands the exit is the very value the header's exit edge hands it, the break needs no copies of
+  // its own: it leaves `bare` and falls into the header's copies after the loop, which compute the
+  // same values. They compute them from the names they read, at the loop's end instead of at the
+  // header, so those names must still hold what the header read: none may be one `writes` holds.
+  // Without that clause a latch break spelled after its update runs the update twice —
+  // `v = v + 1; break;`, then the header's copy `x = v + 1` after the loop. The clause is judged
+  // over every argument the header hands the exit, at the value level, and not only over the copies
+  // that render: an exit parameter that takes its argument's own name renders no copy, yet the exit
+  // still reads that name, and a latch update that wrote it hands the exit the updated value.
+  const breakRule = (frame: LoopFrame, from: Block, writes: Set<string>): { refusal: string } | { bare: boolean } => {
+    // A `while (1)` has no copies of its own after the loop, so a break carries its own, computed
+    // where it leaves; what is left is the exit region's re-derivations. An inner loop's value the
+    // region reads under its name (`emitForever`) is no re-derivation.
+    const fl = foreverLoops.get(frame.header);
+    if (fl !== undefined) {
+      const exitRegion = new Set([frame.exit, ...reachFrom(frame.exit)].filter((x) => !frame.body.has(x)));
+      const { sub } = latchInnerSub(fl.header, fl.body, [...fl.breaks], exitRegion);
+      return loopEscapeHazard(frame.body, sub, writes, exitRegion)
+        ? { refusal: 'reaches an exit region that reads a loop value under a name this iteration already rewrote' }
+        : { bare: false };
+    }
+    if (!whileLoops.has(frame.header)) {
+      return { refusal: 'leaves a do-while' };
+    }
+    const headerCopies = argAssigns(frame.header, frame.exit);
+    let bare = false;
+    if (headerCopies.length !== 0) {
+      const headerArgs = successorTo(frame.header, frame.exit)!.args;
+      const breakArgs = successorTo(from, frame.exit)!.args;
+      const reads = new Set<string>();
+      for (const s of headerCopies) {
+        stmtExprs(s).forEach((e) => exprVars(e, reads));
+      }
+      bare =
+        breakArgs.every((v, k) => v === headerArgs[k]) &&
+        ![...reads].some((n) => writes.has(n)) &&
+        !headerArgs.some((a) => readsClobbered(a, new Map(), writes));
+      if (!bare) {
+        return { refusal: 'would run the copies the loop header hands its exit' };
+      }
+    }
+    const exitRegion = new Set([frame.exit, ...reachFrom(frame.exit)].filter((x) => !frame.body.has(x)));
+    if (loopEscapeHazard(frame.body, new Map(), writes, exitRegion)) {
+      return { refusal: 'reaches an exit region that reads a loop value under a name this iteration already rewrote' };
+    }
+    return { bare };
+  };
+  // The loop-variable names an iteration has written on its way from the header to `b`, before any
+  // update copy (`loopWriteSetAhead`).
+  const writtenAhead = (frame: LoopFrame, b: Block): Set<string> => {
+    const ahead = new Set<Block>([b]);
+    for (const stack = [b]; stack.length;) {
+      for (const p of preds.get(stack.pop()!) ?? []) {
+        if (p !== frame.header && frame.body.has(p) && !ahead.has(p)) {
+          ahead.add(p);
+          stack.push(p);
+        }
+      }
+    }
+    const incoming = (x: Block) => [...inEdgeRecords(preds, x)].map(({ succ }) => succ.args);
+    return loopWriteSetAhead(ahead, incoming, frame.header);
+  };
+
   // Branch-sense sites, numbered as the walk below first reaches them (`branchSenseFlipSites`).
   const senseOrdinal = new Map<number, number>();
 
@@ -4403,11 +5357,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     if (b === stop) {
       return [];
     }
+    // Back to a `while (1)` header from a region that ends short of the loop bottom: the edge's
+    // copies are already out, and `continue` is the jump.
+    if (loopCtx !== null && b === loopCtx.header && foreverLoops.has(b)) {
+      return [{ k: 'continue' }];
+    }
     if (onStack.has(b)) {
       throw new StructureError(
         `cannot structure '${fn.name}': unrecovered back-edge into block #${fn.blocks.indexOf(b)} ` +
-          `(loop-recovery declined this shape: multi-latch, irreducible/overlapping loops, ` +
-          `a conditional continue, or an unsafe break)`,
+          `(loop-recovery declined this shape: irreducible/overlapping loops, exits to more than one ` +
+          `live merge, a break out of a nested loop, or an unsafe break or continue)`,
       );
     }
     onStack.add(b);
@@ -4437,7 +5396,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     isNamed: (v) => varName.has(v),
     isCmpOpcode: (opcode) => !!CMP_TO_BIN[opcode],
     switchAllowsNeqCase,
-    switchAllowsBoundCase,
+    switchBoundCase: switchBoundCase ?? null,
     switchArmsFollowLayout,
     switchRequiresFrontLoadedTests,
     spellSwitchFallthrough,
@@ -4456,6 +5415,10 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     if (dw && !dwActive.has(b)) {
       return emitDoWhile(dw, stop);
     }
+    const forever = foreverLoops.get(b);
+    if (forever && !dwActive.has(b)) {
+      return emitForever(forever, stop);
+    }
 
     const out: Stmt[] = [...sideEffects(b)];
     const term = b.ops[b.ops.length - 1];
@@ -4480,7 +5443,34 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // region flows into the NEXT arm is C fall-through (no `break`). Any other shape needs a `goto` and
     // fails LOUD rather than being duplicated or silently closed.
     if (term.opcode === 'switch_br') {
-      const merge = ipdom.get(b) ?? stop;
+      // WHERE THE SWITCH ENDS. Post-dominance answers it whenever the arms reconverge. When they
+      // do not — some arm `return`s, so EXIT is the only block on every path — the answer is the
+      // one `followOverReturns` derives for a divergent `if`: keep the blocks that reach a `ret`
+      // EVERY successor reaches, and post-dominate on what is left.
+      //
+      // UNCONDITIONAL, where the `if` asks it behind `followEarlyReturns` — and NOT because a jump
+      // table has only one reading. It has the same two an `if` has, and `ipdom.get(b) ?? stop` is
+      // the other one: for a table whose arms reach a shared `ret` and also a shared tail, that
+      // reading structures each arm to its own end and emits legal, complete C with the tail
+      // duplicated into the arms. Both are legal C for one CFG, so the asm underdetermines the
+      // source — which is the definition of a ranked variation (docs/level-tower.md).
+      //
+      // WHAT MAKES THIS ONE THE DEFAULT is which of the two can decline. With a null merge the
+      // default edge's target joins `siblings`, so an arm's plain `break` classifies as a
+      // fall-through into it, and Regime B has no fallback recovery — `synthetic:sw_jtret` is that
+      // shape and declines outright. A variation could not rescue it, and the reason is an
+      // authoring rule rather than a blanket one: `assertDefaultAccepts` re-runs the default
+      // structuring, and lets its refusal stand, for the options it RESETS — which is every
+      // structure variation but the four named as non-members beside it. `followEarlyReturns`, the
+      // `if`-side twin of this very mechanism, is one it resets, because moving a merge point
+      // changes which edge copies elide as identities; a switch-side twin moves the same merge
+      // point and would be reset for the same reason. So the divergent reading cannot come back as
+      // a candidate that rescues `sw_jtret`. The reading that lifts strictly
+      // more functions therefore has to BE the default, and it is the DIVERGENT reading that a
+      // variation would have to offer back — a candidate nothing mints today, and the one thing
+      // this line costs. `?? stop` keeps the shape where no `ret` is reachable from every
+      // successor.
+      const merge = ipdom.get(b) ?? followOverReturns(b, stop) ?? stop;
       const succ = term.successors;
       const caseVals = term.attrs.cases as number[];
       // Switch edges CARRY phi args (frontend/ssa.ts appends them terminator-generically) — each
@@ -4724,14 +5714,24 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         // BEFORE the body ever ran — reading a temp uninitialized on the first test. The kept-guard
         // `do-while` tests after the body, so it carries no such restriction.
         const fused = guardProven && !li.header.ops.some((o) => materialize.has(o));
-        // A pre-update exit copy is repairable rather than fatal: emitted at the TOP of the body it
-        // captures the value one iteration before the update, which is what the exit edge carries.
+        // A pre-update exit copy is repairable rather than fatal: emitted INSIDE the body, ahead of
+        // the update, it captures the value the exit edge carries rather than the updated one.
         // Its post-loop copy is then dropped, so the ZERO-TRIP path needs the guard→exit edge as a
         // seed — the only edge holding the never-entered value. That is why the sink demands the
         // proof above: it makes the fused zero-trip path load-bearing.
         const sunk = guardProven
-          ? sinkablePreUpdateSlots(li.header, li.exit, hexitArgs, new Set([li.header]), sub, updateWrites)
-          : new Set<number>();
+          ? sinkablePreUpdateSlots(
+              li.header,
+              li.exit,
+              hexitArgs,
+              new Set([li.header]),
+              li.header,
+              sub,
+              updateWrites,
+              hooks.preUpdateSinkGates ?? PREUPDATE_SINK_GATES,
+              (j) => !sameAtEntry(hexitArgs[j], guardExit.args[j] as Value, entryVals),
+            )
+          : new Map<number, Op | null>();
         // (2) Every exit copy the fused form KEEPS renders after the loop, on the zero-trip path
         // too — where the loop variables still hold their init values. It must therefore produce
         // what the guard→exit edge carries, since that edge is dropped. A sunk slot is exempt: its
@@ -4757,6 +5757,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
             null,
           )
         ) {
+          // NO `n++` REPAIR HERE, and the SHAPE is why rather than an oversight. The fold
+          // (`preUpdateCondFold`) trades the update copy at the foot of the body for a `++` at the
+          // leaf, which is the same program only for a BOTTOM test: it runs once per iteration, in
+          // the position the copy stood. This test renders at the TOP, ahead of the body, and runs
+          // one more time than the body does — `while (n++ < k)` over a body with no update is a
+          // different loop. Reaching this site is a rotation, not a wider gate.
           throw new StructureError(
             `cannot structure '${fn.name}': loop condition or a post-loop value reads a pre-update loop variable`,
           );
@@ -4867,13 +5873,68 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           } // entering the loop must be `taken`
           out.push(mkIf(gcond, [loopStmt], []));
         }
+        // A POST-LOOP READ THAT HOLDS THE INIT INSTEAD. The exit copies and the exit region render
+        // under the un-rotation substitution, which spells a back-edge arg as its loop variable's
+        // name. Both run on the zero-trip path too, where that name still holds its init — so an arg
+        // computed BEFORE the loop reads right there only if the init is that very value (`sub` is
+        // last-wins over params sharing an arg, so the init is read off the last one). `staleExit`
+        // proves a copy through `sameAtEntry`, which answers true for one value on both exit edges
+        // without looking inside it — so such a copy is judged here through its inlined expression,
+        // and the region wherever its render hits such an entry (`zeroTripStale`).
+        //
+        // KNOWN GAP, wrong before this check existed too: two DIFFERENT exit values sharing a subtree
+        // that reaches a stale entry pass `staleExit` for the same reason, and so do two calls whose
+        // operands map to each other through the entry values.
+        const stale = new Map(
+          [...sub].filter(([x]) => {
+            const d = defs.get(x);
+            return (
+              !li.header.params.includes(x) &&
+              (d === undefined || opBlock.get(d) !== li.header) &&
+              initArgs[li.backArgOfParam.lastIndexOf(x)] !== x
+            );
+          }),
+        );
+        const holdsInitInstead = (root: Value): boolean => {
+          const seen = new Set<Value>();
+          const walk = (x: Value): boolean => {
+            if (seen.has(x)) {
+              return false;
+            }
+            seen.add(x);
+            if (sub.has(x)) {
+              return stale.has(x);
+            }
+            if (varName.has(x)) {
+              return false;
+            }
+            const d = defs.get(x);
+            return d !== undefined && d.operands.some(walk);
+          };
+          return walk(root);
+        };
+        if (hexitArgs.some((a, j) => keptSlot(j) && a === guardExit.args[j] && holdsInitInstead(a))) {
+          throw new StructureError(
+            `cannot structure '${fn.name}': a read after the loop spells a value computed before it by a ` +
+              `loop variable's name, which holds its initial value on a zero-trip run`,
+          );
+        }
         // The header→exit edge may carry non-identity phi args (the exit param merges the guard-false
         // value with the loop's final value). Emit those copies after the loop — dropping them returns
         // a stale value. Read under the un-rotation substitution (post-loop the params hold their
         // updated values), and structure the exit region under the same substitution so a post-loop
         // use of a loop value reads its name.
         out.push(
-          ...withSub(sub, () => [...argAssigns(li.header, li.exit, sub, keptSlot), ...structureRegion(li.exit, stop)]),
+          ...withSub(sub, () => {
+            const copies = argAssigns(li.header, li.exit, sub, keptSlot);
+            const prevStale = zeroTripStale;
+            zeroTripStale = prevStale ? new Map([...prevStale, ...stale]) : stale;
+            try {
+              return [...copies, ...structureRegion(li.exit, stop)];
+            } finally {
+              zeroTripStale = prevStale;
+            }
+          }),
         );
         return out;
       }
@@ -4892,19 +5953,13 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // back-edge arm is the implicit continue (control falls to the loop bottom). Guarded to leaving
     // edges only (`!body.has(exitB)` AND a break/return target); an in-body conditional continue still
     // declines (falls through → the header re-entry trips `onStack`, an honest loud fail).
-    if (loopCtx && (takenB === loopCtx.header || fallB === loopCtx.header)) {
+    //
+    // Taken only where the implicit continue holds (`continueFallsToBottom`). Where it does not, a
+    // break edge is refused by name below, and an arm re-enters the header and declines loud.
+    if (loopCtx && continueFallsToBottom(loopCtx, stop) && (takenB === loopCtx.header || fallB === loopCtx.header)) {
       const contIsTaken = takenB === loopCtx.header;
       const exitB = contIsTaken ? fallB : takenB;
       const isBreak = exitB === loopCtx.exit;
-      // SOUNDNESS (break-clobber): a structured `break` jumps to AFTER the loop, where the header→exit
-      // phi copies are emitted (emitTestAtTopWhile / emitDoWhile). If those copies are NON-identity, the
-      // break path would fall through them and CLOBBER the value the break carried into the exit param.
-      // Only emit `break` for a WHILE header whose header→exit copy is empty (the exit param already
-      // coalesces across both edges); otherwise decline (fall through → honest loud fail). A do-while
-      // `break` declines here (its exit copies live post-loop too, but the check differs) — the
-      // return-trampoline path below still serves both. Trampolines are immune (the `return` terminates
-      // the arm, so nothing falls through).
-      const breakSafe = whileLoops.has(loopCtx.header) && argAssigns(loopCtx.header, loopCtx.exit).length === 0;
       // The back-edge substitution: each header param's back-edge arg → the param's name, so a test that
       // reads a POST-update value (the value carried to the header) shows the header var name.
       const sub = subFor(loopCtx.header.params, successorTo(b, loopCtx.header)!.args);
@@ -4928,21 +5983,75 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       // `if (found) { *out = i; return; }` would store `i + 1`. Handing the arm's own region makes
       // the escape check judge exactly those reads.
       const exitRegion = new Set([exitB, ...reachFrom(exitB)].filter((x) => !loopCtx!.body.has(x)));
+      // A `break` is judged by the break rule, with the update among the writes ahead of it: the
+      // exit region renders raw after the loop, so a header value re-derived there from a name the
+      // update wrote is computed once more — `do { b = t / (b + t); if (c > 2) break; } while
+      // (--d > 0); return b;` renders `return t / (v + t)` after `v = t / (v + t)` already ran. An
+      // early `return` needs none of it: its `return` ends the arm, so nothing after the loop runs.
       const hazard = loopUpdateHazard(term.operands[0], exitArgs, loopCtx.body, sub, updateWrites, exitRegion);
-      if (!hazard && !loopCtx.body.has(exitB) && ((isBreak && breakSafe) || (!isBreak && isArm(exitB)))) {
+      const rule = isBreak ? breakRule(loopCtx, b, new Set([...updateWrites, ...writtenAhead(loopCtx, b)])) : null;
+      if (!hazard && !loopCtx.body.has(exitB) && (rule ? 'bare' in rule : isArm(exitB))) {
         out.push(...updateCopies); // the loop update, RAW (i++, p>>=1, …)
         let leaveCond = exprWith(sub)(term.operands[0]);
         if (contIsTaken) {
           leaveCond = negateCond(leaveCond);
         } // continue is `taken` → leave when NOT it
-        const exitArm = isBreak
-          ? [...argAssigns(b, loopCtx.exit, sub), { k: 'break' } as Stmt] // break to the loop exit
-          : withSub(sub, () => [...argAssigns(b, exitB, sub), ...structureRegion(exitB, stop)]); // early return
+        const exitArm =
+          rule && 'bare' in rule
+            ? [...(rule.bare ? [] : argAssigns(b, loopCtx.exit, sub)), { k: 'break' } as Stmt] // break to the loop exit
+            : withSub(sub, () => [...argAssigns(b, exitB, sub), ...structureRegion(exitB, stop)]); // early return
         out.push(mkIf(leaveCond, exitArm, []));
         return out;
       }
     }
 
+    // A `break` from INSIDE the body: one edge of this cond_br is an admitted break edge (it lands on
+    // the `while`'s own exit). Spelled `if (c) { <edge copies>; break; }` and then what the other edge
+    // runs, which is what the asm runs: the exit region renders once, after the loop, for the
+    // header's exit and this edge alike. The break leaves before any update copy on this path, so
+    // the loop variables still hold what the header read, unless a block between the header and here
+    // wrote one of their names.
+    //
+    // The other edge may be the BACK edge, where the latch path above refused (its update-first
+    // spelling would let the test or the exit read a value the update overwrites). The update copies
+    // then follow the `if`, where the break has already left — the same C as when the update sits in
+    // a block of its own, which is a layout accident.
+    //
+    // Refused: by the break rule over the names written ahead of this edge; where the other edge
+    // leaves the body too; and where the other edge is the back edge but the implicit continue does
+    // not hold (`continueFallsToBottom`) — every route to the header re-enters it, so that refusal is
+    // always loud. The others are loud, since the loop was admitted on the promise of this spelling,
+    // unless an arm owns the edge or the exit ends in a `ret`: then if-recovery below copies the
+    // exit's tail into the arm and returns.
+    // A `switch` case body never holds one: the exit is a block no switch in the body dominates,
+    // and both switch regimes refuse an arm that reaches such a block (`analyzeArmExit`).
+    if (loopCtx && loopCtx.breaks.has(b)) {
+      const frame = loopCtx;
+      const breakIsTaken = takenB === frame.exit;
+      const stayB = breakIsTaken ? fallB : takenB;
+      const continueRefused = stayB === frame.header && !continueFallsToBottom(frame, stop);
+      const rule = continueRefused
+        ? { refusal: 'would continue the loop from a region that ends past the loop bottom' }
+        : frame.body.has(stayB)
+          ? breakRule(frame, b, writtenAhead(frame, b))
+          : { refusal: 'has no edge beside it that stays in the loop' };
+      if ('bare' in rule) {
+        let leaveCond = expr(term.operands[0]);
+        if (!breakIsTaken) {
+          leaveCond = negateCond(leaveCond);
+        }
+        const [breakEdge, stayEdge] = breakIsTaken ? term.successors : [term.successors[1], term.successors[0]];
+        out.push(mkIf(leaveCond, [...(rule.bare ? [] : argAssignsFor(b, breakEdge)), { k: 'break' }], []));
+        out.push(...argAssignsFor(b, stayEdge), ...structureRegion(stayB, stop));
+        return out;
+      }
+      if (continueRefused || (!isArm(frame.exit) && !isRet(frame.exit))) {
+        throw new StructureError(
+          `cannot structure '${fn.name}': a break out of block #${fn.blocks.indexOf(b)} ${rule.refusal}`,
+        );
+      }
+    }
+
     // Regime-A switch: if this cond_br roots a comparison tree over a single scrutinee, emit a
     // `switch`. A pre-check here — mirroring the guard-fused-loop check above — so it sees the raw
     // tree before if-recovery claims the diamonds. Declines (null) fall through to plain if-recovery.
@@ -4979,7 +6088,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       !loopCtx.body.has(ipd) &&
       term.successors.some((sc) => isArm(sc.block) || sc.block === stop) &&
       term.successors.every((sc) => loopCtx!.body.has(sc.block) || isArm(sc.block));
-    const merge = clampToLoop ? stop : (ipd ?? stop);
+    // In a `while (1)` body the join is the body's own, which the CFG's post-dominance cannot see
+    // (`foreverJoin`): a branch whose one arm continues is post-dominated, in the CFG, by wherever
+    // the other arm leaves the loop from.
+    const inForever = loopCtx === null ? undefined : foreverLoops.get(loopCtx.header);
+    const bodyJoin = inForever === undefined ? undefined : foreverJoin(inForever, b);
+    const merge = bodyJoin !== undefined ? (bodyJoin ?? stop) : clampToLoop ? stop : (ipd ?? stop);
     // Per-successor records, NOT successorTo(b, block): a cond_br whose two edges reach the SAME
     // block with different args would otherwise give both arms the first edge's copies.
     const thenS = [...argAssignsFor(b, term.successors[0]), ...structureRegion(takenB, merge)];
@@ -5088,7 +6202,14 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       negateHere = branchSenseFlipSites?.has(ord) ? !siteDefault : siteDefault;
       hooks.onBranchSenseSite?.({ block: bi, ordinal: ord, joined: ipd !== null, negated: negateHere });
     }
-    out.push(negateHere ? { k: 'if', cond: negateCond(cond), then: elseS, else: thenS } : mkIf(cond, thenS, elseS));
+    if (
+      stmtsEqual(thenS, elseS) &&
+      testRereadsOnly(term, b, { defs, useSitesOf, dom, ipdom, loops: forest.byHeader.values() })
+    ) {
+      out.push(...thenS);
+    } else {
+      out.push(negateHere ? { k: 'if', cond: negateCond(cond), then: elseS, else: thenS } : mkIf(cond, thenS, elseS));
+    }
     if (merge && merge !== stop) {
       out.push(...structureRegion(merge, stop));
     }
@@ -5105,10 +6226,13 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   };
   const loopSub = (li: LoopInfo): Map<Value, string> => subFor(li.header.params, li.backArgOfParam);
 
-  // The sunk exit copies, as body statements: `dest = <the arg, rebuilt here>`. The sink's gates
-  // are stated against `exprWith(null)` — every name it stops at holds, at the top of the body,
-  // what it held where the edge read it — so the arg is spelled with no substitution. Slot order
-  // keeps it deterministic.
+  // The sunk exit copies, as body statements: `dest = <the arg, rebuilt here>`, SPLIT by where in
+  // the body each one belongs. WHERE is not recomputed here: `sinkablePreUpdateSlots` cleared each
+  // slot at one position and hands it back, so `atDef` keys the ones homed at a latch op by that op,
+  // for that block's `sideEffects` walk, and `leading` opens the body with the rest. The sink's gates
+  // are stated against `exprWith(null)` — every name the walk stops at holds, anywhere in the body
+  // ahead of the update, what it held where the edge read it — so the arg is spelled with no
+  // substitution. Slot order keeps it deterministic.
   //
   // NOT `expr`: an ambient `activeSub` is an ENCLOSING loop's post-loop naming, which the sink's
   // walk does not model, so a REBUILT tree here would be spelled under names that substitution has
@@ -5119,27 +6243,63 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // The destination name is read as an invariant, not checked: every block param carries one.
   // `assertResolved` is what catches a widening that breaks that.
   //
-  // `home` is the loop HEADER — the block whose body these copies open, and so the block from which
-  // the write is reachable. Recorded rather than inferred because `exit` says the opposite (see
-  // `sunkCopyHomes`).
-  const preUpdateCopies = (exit: Block, exitArgs: readonly Value[], sunk: Set<number>, home: Block): Stmt[] =>
-    [...sunk]
-      .sort((x, y) => x - y)
-      .map((j) => {
-        if (activeSub !== null && !varName.has(exitArgs[j])) {
-          throw new StructureError(
-            `cannot structure '${fn.name}': a pre-update exit copy would rebuild a computed value ` +
-              `inside a loop nested in another loop's post-loop naming`,
-          );
-        }
-        const name = varName.get(exit.params[j])!;
-        sunkCopyHomes.push({ name, home });
-        return {
-          k: 'assign' as const,
-          name,
-          value: exprWith(null)(exitArgs[j]),
-        };
-      });
+  // `home` is the loop HEADER, which dominates every point inside the body a copy is rebuilt at, and
+  // so the block from which every one of these writes is reachable. Recorded rather than inferred
+  // because `exit` says the opposite (see `sunkCopyHomes`).
+  const preUpdateCopies = (
+    exit: Block,
+    exitArgs: readonly Value[],
+    sunk: ReadonlyMap<number, Op | null>,
+    home: Block,
+  ): SunkCopies => {
+    const out: SunkCopies = { leading: [], atDef: new Map() };
+    for (const [j, at] of [...sunk].sort(([x], [y]) => x - y)) {
+      if (activeSub !== null && !varName.has(exitArgs[j])) {
+        throw new StructureError(
+          `cannot structure '${fn.name}': a pre-update exit copy would rebuild a computed value ` +
+            `inside a loop nested in another loop's post-loop naming`,
+        );
+      }
+      const name = varName.get(exit.params[j])!;
+      sunkCopyHomes.push({ name, home });
+      // A value the body already names under the destination writes it where it is computed, so
+      // its copy would be `dest = dest`: the slot needs only the seed and the dropped post-loop copy.
+      if (varName.get(exitArgs[j]) === name) {
+        continue;
+      }
+      const st = { k: 'assign' as const, name, value: exprWith(null)(exitArgs[j]) };
+      if (at === null) {
+        out.leading.push(st);
+      } else {
+        (out.atDef.get(at) ?? out.atDef.set(at, []).get(at)!).push(st);
+      }
+    }
+    return out;
+  };
+
+  /** Every copy `preUpdateCopies` placed at a def, once the body that was meant to hold it is
+   *  assembled. FORWARD DEFENCE WITH NO REACH TODAY: both emitters hand `atDef` to `sideEffects` on
+   *  the very block the gate homed those copies in, and that walk visits every op the block holds,
+   *  so no key can go unvisited. It is stated rather than assumed because what it names is silent —
+   *  a body assembled without that block's side effects, or handing the copies to another block's
+   *  walk, drops a copy, and a dropped copy is a wrong value rather than a gap.
+   *
+   *  STRICT, where the anchored-copy obligation below tests OBSERVABILITY instead, and the
+   *  difference is which position is guaranteed. An anchor's position is a const's def block, which
+   *  may legitimately render no statement at all — a loop preheader the guarded-loop emitter never
+   *  structures is one — so a copy that vanishes there can still leave a consistent program. A sunk
+   *  copy's position is in a block both emitters render whatever else they do, because that block's
+   *  side effects carry the loop's stores; a copy missing from it is a mistake in assembling the
+   *  body and has no second reading. */
+  const assertSunkCopiesPlaced = (copies: SunkCopies): void => {
+    for (const st of [...copies.atDef.values()].flat()) {
+      if (!sunkCopiesEmitted.has(st)) {
+        throw new StructureError(
+          `cannot structure '${fn.name}': a pre-update exit copy has no position in the loop body it belongs to`,
+        );
+      }
+    }
+  };
 
   // A guarded self-loop's body and latch test. The test reads the header's own params (back-edge
   // args substituted back), and the body is any sunk trailing copies, then the header's SIDE
@@ -5154,16 +6314,21 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // source spelling means.
   const emitWhile = (
     li: LoopInfo,
-    updates?: Stmt[],
-    sunkCopies: Stmt[] = [],
-    kind: 'while' | 'dowhile' = 'while',
+    updates: Stmt[] | undefined,
+    sunkCopies: SunkCopies,
+    kind: 'while' | 'dowhile',
   ): Stmt => {
     const term = li.header.ops[li.header.ops.length - 1];
     let cond = exprWith(loopSub(li))(term.operands[0]);
     if (term.successors[0].block !== li.header) {
       cond = negateCond(cond);
     } // loop-continue must be `taken`
-    const body = [...sunkCopies, ...sideEffects(li.header), ...(updates ?? argAssigns(li.header, li.header))];
+    const body = [
+      ...sunkCopies.leading,
+      ...sideEffects(li.header, sunkCopies.atDef),
+      ...(updates ?? argAssigns(li.header, li.header)),
+    ];
+    assertSunkCopiesPlaced(sunkCopies);
     return kind === 'while' ? { k: 'while', cond, body } : { k: 'dowhile', cond, body };
   };
 
@@ -5182,7 +6347,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // Mirror the br/cond_br cases: argAssigns then structureRegion. Structure the body under this
     // loop's frame so an in-body conditional exit (break / early return) is recognised instead of
     // tripping the header-re-entry `onStack` guard.
-    const body = withLoop({ header: wl.header, exit: wl.exit, body: wl.body, arms: wl.arms }, () => [
+    const body = withLoop({ header: wl.header, exit: wl.exit, body: wl.body, arms: wl.arms, breaks: wl.breaks }, () => [
       ...argAssigns(wl.header, wl.bodyEntry),
       ...structureRegion(wl.bodyEntry, wl.header),
     ]);
@@ -5192,6 +6357,105 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     return out;
   };
 
+  // THE JOIN OF A BRANCH IN A `while (1)` BODY, over the body with its back edges and exits deleted.
+  // A block that only jumps back to the header or out of the loop, rendering nothing but that edge's
+  // copies, ENDS its path — a `continue`, a `break` — so it constrains no join; the join of `b` is
+  // where the paths that go on meet: its nearest post-dominator over the rest. Null when none goes
+  // on, and the region's own `stop` ends it. Without the deletion, a branch whose one arm continues
+  // joins at the loop bottom, and whatever the other arm runs before its own continue is copied into
+  // both arms. A block that ends every path but TESTS first is still where its predecessors meet,
+  // and so is a latch two body paths reach: the foot of `for (…) { if (c) {…} }`, where deleting it
+  // moves the `if`'s join into one arm, which then copies the latch and adds a `continue` the
+  // source never wrote. A break block two paths share stays an end, each path its own `break`.
+  const foreverJoins = new Map<Block, Map<Block, Block | null>>();
+  const foreverJoin = (fl: ForeverLoopInfo, b: Block): Block | null => {
+    let ipdom = foreverJoins.get(fl.header);
+    if (ipdom === undefined) {
+      const inBody = (n: Block): Block[] =>
+        [...new Set(successorsOf(n))].filter((x) => fl.body.has(x) && x !== fl.header);
+      const ends = (n: Block): boolean =>
+        inBody(n).length === 0 &&
+        n.ops[n.ops.length - 1].opcode === 'br' &&
+        n.ops.every((op) => !effectful(op) && !materialize.has(op)) &&
+        !(successorsOf(n)[0] === fl.header && new Set(preds.get(n)?.filter((q) => fl.body.has(q))).size > 1);
+      ipdom = postDominators(fn, fl.body, (n) => inBody(n).filter((x) => !ends(x)));
+      foreverJoins.set(fl.header, ipdom);
+    }
+    return ipdom.get(b) ?? null;
+  };
+
+  // Does rendering `root` under `map` re-derive one of `targets`: reach it through the def tree
+  // without passing a mapped or a named value, either of which renders as a name?
+  const rendersThrough = (
+    root: Value,
+    map: ReadonlyMap<Value, string> | null,
+    targets: ReadonlySet<Value>,
+  ): boolean => {
+    const seen = new Set<Value>();
+    const walk = (x: Value): boolean => {
+      if (seen.has(x) || map?.has(x) === true || varName.has(x)) {
+        return false;
+      }
+      if (targets.has(x)) {
+        return true;
+      }
+      seen.add(x);
+      return defs.get(x)?.operands.some(walk) ?? false;
+    };
+    return walk(root);
+  };
+  // What a loop's exit region renders after the loop, before `stop`, and the values it reads.
+  const exitRegion = (exit: Block, loopBody: ReadonlySet<Block>, stop: Block | null): Set<Block> => {
+    const region = new Set<Block>();
+    for (const work = [exit]; work.length > 0;) {
+      const x = work.pop()!;
+      if (x !== stop && !loopBody.has(x) && !region.has(x)) {
+        region.add(x);
+        work.push(...successorsOf(x));
+      }
+    }
+    return region;
+  };
+  const rootsOf = (region: Iterable<Block>): Value[] =>
+    [...region].flatMap((x) => x.ops.flatMap((op) => [...op.operands, ...op.successors.flatMap((sc) => sc.args)]));
+
+  // A `break` of the loop whose body `ss` is — not of a loop or `switch` inside it.
+  const breaksOut = (ss: Stmt[]): boolean =>
+    ss.some((s) => s.k === 'break' || (!isLoop(s) && s.k !== 'switch' && breaksOut(stmtChildren(s))));
+  // `while (1) { body }`: the header structured as an ordinary block up to itself (its do-while-style
+  // hook masked via dwActive), under a frame whose breaks leave for `exit`, which renders after it.
+  // Where no edge out rendered as a `break` — each one an early `return`, the exit's tail copied
+  // into it — nothing reaches the end of the loop, and the exit rendered after it would be a dead
+  // second copy of that tail.
+  //
+  // The exit region runs after every break, so an inner loop that runs before each of them has left
+  // its last value in its variable's name, and the region reads it there (`latchInnerSub`, with the
+  // breaks as its readers). Read raw it would re-derive that value from the name that holds it. Where
+  // neither reading is the value, decline LOUD, as the do-while latch does.
+  const emitForever = (fl: ForeverLoopInfo, stop: Block | null): Stmt[] => {
+    dwActive.add(fl.header);
+    const body = withLoop({ header: fl.header, exit: fl.exit, body: fl.body, arms: fl.arms, breaks: fl.breaks }, () =>
+      structureBlock(fl.header, fl.header),
+    );
+    dwActive.delete(fl.header);
+    const loop: Stmt = { k: 'while', cond: { k: 'const', value: 1 }, body };
+    if (!breaksOut(body)) {
+      return [loop];
+    }
+    const region = exitRegion(fl.exit, fl.body, stop);
+    const { sub: innerSub, unreadable } = latchInnerSub(fl.header, fl.body, [...fl.breaks], region);
+    if (unreadable.size > 0 && rootsOf(region).some((r) => rendersThrough(r, innerSub, unreadable))) {
+      throw new StructureError(
+        `cannot structure '${fn.name}': the code after a while (1) reads an inner loop's value whose name was ` +
+          `rewritten after the inner loop, and re-deriving it reads a name the inner loop wrote`,
+      );
+    }
+    return [
+      loop,
+      ...(innerSub.size > 0 ? withSub(innerSub, () => structureRegion(fl.exit, stop)) : structureRegion(fl.exit, stop)),
+    ];
+  };
+
   // The latch back-edge substitution (do-while) — subFor over the latch's back-edge args.
   const latchSub = (dw: DoWhileInfo): Map<Value, string> =>
     subFor(dw.header.params, successorTo(dw.latch, dw.header)!.args);
@@ -5262,16 +6526,24 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     const ins = [...inEdgeRecords(preds, b)];
     return ins.length > 0 && ins.every(({ succ }) => aliasOf(succ.args[k], v, seen));
   };
+  // `readers` are the blocks the substitution is read after: the latch, or every block a `while (1)`
+  // breaks from, whose exit region renders after the loop. `after` adds the blocks of that region,
+  // whose writes land before some of its reads.
   const latchInnerSub = (
-    dw: DoWhileInfo,
+    header: Block,
+    loopBody: ReadonlySet<Block>,
+    readers: Block[],
+    after: ReadonlySet<Block> = new Set(),
   ): { sub: Map<Value, string>; unreadable: Set<Value>; writtenAfter: Map<Value, Set<string>> } => {
     const out = new Map<Value, string>();
     const refused = new Set<Value>();
     const writtenAfter = new Map<Value, Set<string>>();
-    const latchDoms = dom.get(dw.latch)!;
     const kids = [...forest.byHeader.values()]
       .filter(
-        (l) => l.header !== dw.header && dw.body.has(l.header) && !l.body.has(dw.latch) && latchDoms.has(l.header),
+        (l) =>
+          l.header !== header &&
+          loopBody.has(l.header) &&
+          readers.every((r) => !l.body.has(r) && dom.get(r)!.has(l.header)),
       )
       .sort((x, y) => dom.get(x.header)!.size - dom.get(y.header)!.size);
     for (const l of kids) {
@@ -5286,7 +6558,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       for (const [v, n] of varName) {
         const d = defs.get(v);
         const home = paramBlock.get(v) ?? (d !== undefined && materialize.has(d) ? opBlock.get(d) : undefined);
-        if (home === undefined || !dw.body.has(home) || home === dw.header) {
+        if (home === undefined || !(loopBody.has(home) || after.has(home)) || home === header) {
           continue;
         }
         written.add(n);
@@ -5332,30 +6604,28 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // then every line below spells what it did before the substitution existed — unless an unnamed
     // value an inner loop computed could reach the latch.
     //
-    // The update copies take it MERGED with `activeSub`, because a map passed to `argAssigns`
-    // replaces the ambient `expr` it would otherwise render with: without the merge, a copy reading
-    // an ENCLOSING loop's post-loop value would re-derive it (`ACTIVE_SUB` in
-    // `latch-inner-sub.test.ts`). One thing a map changes that `expr` does not: identity elision
-    // consults it, so a copy that `activeSub` spells `n = n` is dropped rather than written. The
-    // two programs are the same, and it is left conditional so an empty `innerSub` keeps the line
-    // exactly as it was (the corpus census is byte-identical either side of this commit's parent).
-    const { sub: innerSub, unreadable, writtenAfter } = latchInnerSub(dw);
+    // The update copies take it MERGED with `activeSub`. A map extends the ambient naming where it
+    // renders (`exprWith`), but identity elision consults the map alone, so the merge is what drops
+    // a copy that `activeSub` spells `n = n` rather than writing it. The two programs are the same,
+    // and it is left conditional so an empty `innerSub` takes the map-less path.
+    const { sub: innerSub, unreadable, writtenAfter } = latchInnerSub(dw.header, dw.body, [dw.latch]);
     const latchMap = innerSub.size > 0 ? new Map([...(activeSub ?? []), ...innerSub]) : null;
     const updates = argAssigns(dw.latch, dw.header, latchMap);
     const updateWrites = loopWriteSet(updates, dw.body, dw.header);
     const lterm = dw.latch.ops[dw.latch.ops.length - 1];
-    // KNOWN GAP, and the reason the sink stands down rather than repairing anything. A body
-    // block's param may adopt a LOOP VARIABLE's name (canTakeName waives the liveness half for a
-    // pure alias, an argument that does not carry when the name came from `backArgName` — it is
-    // then a different value's). The arm's copy into it is a real write partway through the body,
-    // and everything rendered after it reads the name RAW: the update, the bottom test, the
-    // header's own ops, the latch's side effects.
+    // A DEFENSIVE GUARD, and the reason the sink stands down rather than repairing anything. A body
+    // block's param that holds a LOOP VARIABLE's name makes the arm's copy into it a real write
+    // partway through the body, and everything rendered after it reads the name RAW: the update,
+    // the bottom test, the header's own ops, the latch's side effects. The pure-alias route to such
+    // a name is closed (`alias-under-its-own-name`); a param may still take it through `varName`
+    // once the header param is dead, and no fixture reaches that today, so this guard is defensive.
     //
     // The refusal is on the NAME, not on who reads it: the readers are every statement the loop
     // emits, which is not a set worth enumerating when the name alone is the whole signal.
     //
-    // The emitted C is wrong whenever this shape occurs, sink or no sink — it is a naming-pipeline
-    // defect, not this pass's, and repairing the exit copy does not touch it. What IS this pass's
+    // The emitted C can be wrong wherever this shape occurs, sink or no sink (the predicate is on
+    // names, so it also holds on loops that emit correctly) — a naming-pipeline defect, not this
+    // pass's, and repairing the exit copy does not touch it. What IS this pass's
     // is not to UNLOCK such a loop: with no sink these functions decline on the pre-update hazard,
     // so standing down keeps them loud rather than trading a decline for a silent wrong answer.
     const headerNames = new Set(dw.header.params.map((p) => varName.get(p)));
@@ -5380,12 +6650,22 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     }
     const rebindHazard = [...bodyRebinds].some((n) => headerNames.has(n));
     const exitArgs = (successorTo(dw.latch, dw.exit)?.args ?? []) as Value[];
-    // A pre-update exit copy moves to the TOP of the body, where the loop variables still hold
-    // their top-of-iteration values. No zero-trip seed here: a `do-while` always runs its body, so
-    // any other predecessor of the exit is an ordinary edge some enclosing `if` already emits.
+    // A pre-update exit copy moves INSIDE the body, ahead of the update, where the loop variables
+    // still hold their top-of-iteration values. No zero-trip seed here: a `do-while` always runs
+    // its body, so any other predecessor of the exit is an ordinary edge some enclosing `if`
+    // already emits.
     const sunk = rebindHazard
-      ? new Set<number>()
-      : sinkablePreUpdateSlots(dw.header, dw.exit, exitArgs, dw.body, sub, updateWrites);
+      ? new Map<number, Op | null>()
+      : sinkablePreUpdateSlots(
+          dw.header,
+          dw.exit,
+          exitArgs,
+          dw.body,
+          dw.latch,
+          sub,
+          updateWrites,
+          hooks.preUpdateSinkGates ?? PREUPDATE_SINK_GATES,
+        );
     // The post-loop region the escaped-value check judges: everything the loop does not emit itself.
     // An early-`return` arm the loop OWNS renders inside the body, ahead of the update, so a read of
     // a loop variable there is the pre-update value it wants — counting it as post-loop would decline
@@ -5393,7 +6673,48 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // post-loop where the other path really does read them after the update.
     const owned = new Set(dw.arms.flatMap((a) => [...a.owned]));
     const postLoop = new Set(fn.blocks.filter((bb) => !dw.body.has(bb) && !owned.has(bb)));
+    // AN EFFECT THE RENDERED TEST MAY SKIP. `movedEffect` below says this about the exit copies; the
+    // bottom test is the other place an effect can change how often it runs, and here it is the
+    // `&&`/`||` that moves it rather than a copy: the right operand is evaluated only where the left
+    // one let it be, while the asm's branch did not guard the op at all. Nothing can re-place it —
+    // the connective is what the test IS — so decline LOUD, the same answer for the same reason.
+    //
+    // Asked of every `do-while`, not only of a folded one: the arm holds the same call whichever way
+    // the counter is spelled.
+    if (testSkipsAnEffect(lterm.operands[0], sub)) {
+      throw new StructureError(
+        `cannot structure '${fn.name}': the bottom test may evaluate an effect behind a '&&'/'||' ` +
+          `that the asm ran on every iteration`,
+      );
+    }
+    // The test's OWN pre-update read has a spelling the other two disjuncts do not: `n++` at the
+    // leaf, with the update copy dropped from the foot of the body. Asked only where the test is
+    // already a hazard, so a loop that structures today enumerates exactly the candidates it did.
+    // The polarity is the one applied to `cond` below — the continue edge must be the taken one.
+    const condAnswer = readsClobbered(lterm.operands[0], sub, updateWrites)
+      ? preUpdateCondFold(
+          lterm.operands[0],
+          lterm.successors[1].block === dw.header,
+          dw.header,
+          successorTo(dw.latch, dw.header)?.args ?? [],
+          exitArgs,
+          dw.body,
+          sub,
+          updates,
+          updateWrites,
+        )
+      : null;
+    const condFold = condAnswer === null || 'refused' in condAnswer ? null : condAnswer;
+    // A PRE-UPDATE HOME DOES NOT UNLOCK A LOOP whose variable's NAME a block after it also holds.
+    // The exit region reads the loop's back-edge values under those names (`sub`), and such a
+    // param's copies write the same name first — the merge naming's `carrier-live` sees live NAMED
+    // values, not ones the substitution spells, so it does not refuse them. The spelling is wrong
+    // wherever it occurs; it is the home's to keep from unlocking one, which without the name would
+    // decline on this hazard.
+    const homed = [...dw.body].some((bb) => bb.ops.some((o) => preUpdateHomes.has(o)));
+    const sharesALoopName = homed && [...postLoop].some((bb) => bb.params.some((p) => headerNames.has(varName.get(p))));
     if (
+      sharesALoopName ||
       loopUpdateHazard(
         lterm.operands[0],
         exitArgs.filter((_, j) => !sunk.has(j)),
@@ -5401,10 +6722,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         sub,
         updateWrites,
         postLoop,
+        condFold !== null,
       )
     ) {
+      // Three reasons share this refusal — the test, an exit slot, an escaped body value — and the
+      // one that was asked in detail names the gate that answered.
       throw new StructureError(
-        `cannot structure '${fn.name}': do-while condition or a post-loop value reads a pre-update loop variable`,
+        `cannot structure '${fn.name}': do-while condition or a post-loop value reads a pre-update loop variable` +
+          (condAnswer !== null && 'refused' in condAnswer
+            ? ` (no '++' for the test's own read: ${condAnswer.refused})`
+            : ''),
       );
     }
     // The exit copies render AFTER the `dowhile` statement, but the analysis judged where each
@@ -5437,7 +6764,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     const inner =
       dw.header === dw.latch
         ? [] // single-block self-loop: the header IS the latch — its ops render via sideEffects below
-        : withLoop({ header: dw.header, exit: dw.exit, body: dw.body, arms: dw.arms }, () =>
+        : withLoop({ header: dw.header, exit: dw.exit, body: dw.body, arms: dw.arms, breaks: new Set() }, () =>
             structureBlock(dw.header, dw.latch),
           ); // header..latch (exclusive of latch)
     dwActive.delete(dw.header);
@@ -5446,17 +6773,27 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // already holds the next value, so the latch-computed test reads `v`, not `v - 1`). `updates`
     // reuses the hazard check's computation — a second argAssigns call would burn a spurious
     // swap-cycle temp number.
+    const sunkCopies = preUpdateCopies(dw.exit, exitArgs, sunk, dw.header);
+    const latchEffects = () => sideEffects(dw.latch, sunkCopies.atDef);
+    // The folded update is spelled by the test's own `n++`, so it leaves the foot of the body.
+    // `updates` itself is untouched: every hazard above, and `writtenByUpdate` below, ask what one
+    // iteration WRITES, and the fold moves that write without removing it.
+    const bodyUpdates =
+      condFold === null ? updates : updates.filter((st) => !(st.k === 'assign' && st.name === condFold.name));
     const body = [
-      ...preUpdateCopies(dw.exit, exitArgs, sunk, dw.header),
+      ...sunkCopies.leading,
       ...inner,
-      ...(innerSub.size > 0 ? withSub(innerSub, () => sideEffects(dw.latch)) : sideEffects(dw.latch)),
-      ...updates,
+      ...(innerSub.size > 0 ? withSub(innerSub, latchEffects) : latchEffects()),
+      ...bodyUpdates,
     ];
+    assertSunkCopiesPlaced(sunkCopies);
     // The test reads this loop's own update under `sub`, and anything else an inner loop left under
     // `innerSub` — the outer loop's own reading wins where a value is both. The test runs AFTER the
     // update copies, so an inner name one of them really writes no longer holds the inner value, and
     // that entry keeps the raw reading — the same refusal `latchInnerSub` makes for a name written
     // before the latch, with the update's writes added to what the re-derivation must not read.
+    // The exit copies and the exit region run after the test and read under the same map: an inner
+    // loop's value is still in its name there.
     const writtenByUpdate = innerSub.size > 0 ? updateWriteSet(updates) : new Set<string>();
     const condInner = [...innerSub].filter(([, n]) => !writtenByUpdate.has(n));
     const condMap = condInner.length > 0 ? new Map([...condInner, ...sub]) : sub;
@@ -5474,31 +6811,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       }
     }
     if (condUnreadable.size > 0) {
-      const needs = (root: Value, stop: ReadonlyMap<Value, string> | null, targets: ReadonlySet<Value>): boolean => {
-        const seen = new Set<Value>();
-        const walk = (x: Value): boolean => {
-          if (seen.has(x) || stop?.has(x) === true || varName.has(x)) {
-            return false;
-          }
-          if (targets.has(x)) {
-            return true;
-          }
-          seen.add(x);
-          return defs.get(x)?.operands.some(walk) ?? false;
-        };
-        return walk(root);
-      };
       const bodyMap = latchMap ?? activeSub;
       const effectRoots = dw.latch.ops
         .slice(0, -1)
-        .filter(
-          (op) => op.results.length === 0 || materialize.has(op) || EFFECTFUL_OPS.has(op.opcode) || unreadResult(op),
-        )
+        .filter((op) => op.results.length === 0 || materialize.has(op) || effectful(op) || unreadResult(op))
         .flatMap((op) => op.operands);
       const updateRoots = successorTo(dw.latch, dw.header)!.args;
+      const regionRoots = rootsOf(exitRegion(dw.exit, dw.body, stop));
       if (
-        [...effectRoots, ...updateRoots].some((r) => needs(r, bodyMap, unreadable)) ||
-        needs(lterm.operands[0], condMap, condUnreadable)
+        [...effectRoots, ...updateRoots].some((r) => rendersThrough(r, bodyMap, unreadable)) ||
+        [lterm.operands[0], ...exitArgs, ...regionRoots].some((r) => rendersThrough(r, condMap, condUnreadable))
       ) {
         throw new StructureError(
           `cannot structure '${fn.name}': a loop latch reads an inner loop's value whose name was rewritten ` +
@@ -5510,11 +6832,25 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     if (lterm.successors[1].block === dw.header) {
       cond = negateCond(cond);
     } // continue edge must be `taken`
+    if (condFold !== null) {
+      // AFTER the negation, so the leaf is placed in the tree that is emitted. `negateCond` rewrites
+      // the connectives by De Morgan, which moves the leaf between arms without duplicating it — and
+      // a rewrite that did duplicate it is exactly what `spellUpdateInCond` refuses.
+      const folded = spellUpdateInCond(cond, condFold.name, condFold.by);
+      if (folded === null) {
+        throw new StructureError(
+          `cannot structure '${fn.name}': the do-while test does not spell '${condFold.name}' exactly once, ` +
+            `so its update has no place inside the test`,
+        );
+      }
+      cond = folded;
+    }
     const out: Stmt[] = [{ k: 'dowhile', cond, body }];
-    // The exit region reads latch back-edge values under `sub` (post-loop they live in the loop vars).
+    // The exit region reads latch back-edge values under `sub` (post-loop they live in the loop vars),
+    // and inner loops' values as the test does.
     out.push(
-      ...withSub(sub, () => [
-        ...argAssigns(dw.latch, dw.exit, sub, (j) => !sunk.has(j)),
+      ...withSub(condMap, () => [
+        ...argAssigns(dw.latch, dw.exit, condMap, (j) => !sunk.has(j)),
         ...structureRegion(dw.exit, stop),
       ]),
     );
@@ -5544,8 +6880,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   if (owed.length > 0) {
     const mentioned = new Set<string>(globalNames);
     for (const e of walkExprs(body)) {
-      if (e.k === 'var' || e.k === 'addr') {
-        mentioned.add(e.name);
+      const n = mentionedName(e);
+      if (n !== undefined) {
+        mentioned.add(n);
       }
     }
     const assignTargets = (ss: Stmt[]): void => {
@@ -5673,7 +7010,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     lastLaddrOf.set(laddrName.get(op)!, op);
   }
   const structs = collectStructs(fn);
-  return {
+  const tree: SFn = {
     name: fn.name,
     params: entry.params.map((p, i) => ({ name: `a${i}`, type: p.type })),
     locals: [
@@ -5697,7 +7034,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       // spill, is the referee — stamp them then, and `l3/slotorder.ts` needs no change to use it.
       ...[...lastLaddrOf].map(([name, op]) => ({
         name,
-        type: T.int((op.attrs.width as number) * 8, op.attrs.signed as boolean),
+        type: laddrType(op),
         // the asm materialized this slot's address, and this is how many times it
         // loaded and stored through it — both asm facts, and the gate the
         // l3/volatileval.ts variation reads (see the SFn.locals doc)
@@ -5752,13 +7089,48 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
             .sort((a, b) => a.name.localeCompare(b.name)),
         }
       : {}),
+    ...(localStatics.statics.length ? { statics: localStatics.statics } : {}),
     retType: returnsVoid ? T.void() : returnType(fn),
     body,
     ...(structs.length ? { structs } : {}),
     // absent stays absent: the backend asks "is a direction known?", and there is no third state
     // at this boundary — `structureOptionsFor` dropped the target's `'unknown'` already.
     ...(spillSlotOrder !== undefined ? { slotOrder: spillSlotOrder } : {}),
+    ...calledOnly({ declaredArgs, declaredReturns }, body),
+    ...(dialect !== undefined ? { dialect } : {}),
   };
+  if (fn.localObjects === undefined) {
+    return tree;
+  }
+  const named = nameLocalStatics(tree, fn.localObjects);
+  if ('refused' in named) {
+    throw new StructureError(
+      `cannot structure '${fn.name}': names a function-scope static ('${named.symbol}') ${named.refused}`,
+    );
+  }
+  return named;
+}
+
+/** Of each table of declared callees, the entries this body calls — every tree the ranked pass
+ *  structures carries its own, and is keyed by its whole text. A table this body calls nothing in is
+ *  absent. */
+function calledOnly(
+  tables: Pick<StructureOptions, 'declaredArgs' | 'declaredReturns'>,
+  body: Stmt[],
+): Pick<StructureOptions, 'declaredArgs' | 'declaredReturns'> {
+  const callees = new Set<string>();
+  for (const e of walkExprs(body)) {
+    if (e.k === 'call' && typeof e.fn === 'string') {
+      callees.add(e.fn);
+    }
+  }
+  const of = <T>(table: Readonly<Record<string, T>> | undefined): Record<string, T> | undefined => {
+    const called = Object.fromEntries(Object.entries(table ?? {}).filter(([n]) => callees.has(n)));
+    return Object.keys(called).length > 0 ? called : undefined;
+  };
+  const declaredArgs = of(tables.declaredArgs);
+  const declaredReturns = of(tables.declaredReturns);
+  return { ...(declaredArgs ? { declaredArgs } : {}), ...(declaredReturns ? { declaredReturns } : {}) };
 }
 
 // Does any statement CONTINUE this loop (vs. a nested one)? A `continue` inside a nested while/dowhile/
@@ -5984,11 +7356,16 @@ function* inEdgeRecords(preds: Map<Block, Block[]>, b: Block): Generator<{ pred:
 }
 
 // Immediate post-dominators. EXIT is represented as `null`; ret-blocks post-lead to it. Over the
-// subgraph `keep` induces when given, every member of which must still reach a `ret` inside it.
-function postDominators(fn: Fn, keep?: ReadonlySet<Block>): Map<Block, Block | null> {
+// subgraph `keep` induces when given, every member of which must still reach a `ret` inside it — or,
+// with `onward`, over only the edges it names between members of `keep`: a block it names no edge
+// from ends its paths, post-dominated by nothing but itself.
+function postDominators(fn: Fn, keep?: ReadonlySet<Block>, onward?: (b: Block) => Block[]): Map<Block, Block | null> {
   const blocks = keep ? fn.blocks.filter((b) => keep.has(b)) : fn.blocks;
   const nodes: (Block | null)[] = [null, ...blocks];
   const succ = (b: Block): (Block | null)[] => {
+    if (onward !== undefined) {
+      return onward(b);
+    }
     const term = b.ops[b.ops.length - 1];
     return term.opcode === 'ret' ? [null] : successorsOf(b).filter((s) => keep === undefined || keep.has(s));
   };