@asmlift/core 0.9.0 → 0.10.0

package/src/structure/structure.ts

@@ -23,8 +23,8 @@
 //     parallel block-argument update, sequentialised so an assignment never clobbers a
 //     value a later one still needs.
 //
-// Module layout: loop DISCOVERY is loops.ts; the pure ANALYSIS phase (use registry, liveness,
-// materialization) is analysis.ts; comparison-tree switch recovery is switch-recover.ts
+// Module layout: loop DISCOVERY is ../ir/loops.ts (raise/ reads it too); the pure ANALYSIS phase
+// (use registry, liveness, materialization) is analysis.ts; comparison-tree switch recovery is switch-recover.ts
 // (explicit-deps factory). THIS file keeps the mutually-entangled remainder: SSA-destruction
 // coalescing (canTakeName + seeding) and emission (structureBlock + the loop emitters) — they
 // share varName/backArgName mutation and the activeSub/loopCtx dynamic state.
@@ -34,7 +34,8 @@
 // bottom-test `do-while`, `while (1)` for any other latch set (a conditional `continue`, a
 // mid-tested header), PROPERLY-nested loops, in-body `break`/early-`return`, comparison-tree and
 // jump-table `switch`, and a switch arm that FALLS THROUGH into the next one (both regimes — see
-// `ArmExit` in switch-recover.ts). Still DECLINED (loud StructureError, never wrong code):
+// `ArmExit` in switch-recover.ts), on some paths only, leaving the switch by a `break;` on the
+// others (`switchFrames`). Still DECLINED (loud StructureError, never wrong code):
 // irreducible/overlapping loops, exits to more than one live merge, a `break` out of a nested loop's
 // body, a `break` whose exit copies would clobber, and mixed-entry self-loops (a guarded header also
 // entered by a plain br).
@@ -42,24 +43,44 @@
 // `case` cannot fall through (`spellSwitchFallthrough` false) sends Regime A back to if-recovery,
 // and arms that do not linearize into one chain — two arms falling into the same sibling, or a fall
 // into the `default:` — refuse in `chainArms`, which answers null.
-import { constAddressOf, globalBaseOf } from '../ir/alias';
+import { globalBaseOf } from '../ir/alias';
+import { type WordCtx, incomingArgs, mayAlwaysHold, overwrittenReads, storeForwards } from '../ir/bits';
 import {
   Block,
+  CALL_RETURN_OBJECT,
   Fn,
+  OWN_RETURN_OBJECT,
   Op,
+  RETURNS_OBJECT,
   Successor,
   Value,
+  byValueOperands,
   callArgs,
   calleeName,
   calleeValue,
   defOpMap,
   dominators,
   mergeClasses,
+  reachForward,
   successorsOf,
 } from '../ir/core';
-import { effectful, placedAt, qualified, qualifiedBy, spelledWhenDead } from '../ir/discipline';
-import { CAST_WIDTHS, opSig } from '../ir/opcodes';
-import { type IrType, T, intWidth, scalarTypeForAccess, typeEquals, unionViewAt } from '../ir/types';
+import { effectful, orderSensitive, placedAt, qualified, qualifiedBy, spelledWhenDead } from '../ir/discipline';
+import { type NaturalLoop, analyzeLoops } from '../ir/loops';
+import { CAST_WIDTHS, FLOAT_RESIZE, FLOAT_TO_INT, INT_TO_FLOAT, NEGATED_FCMP, WIDE_BITS, opSig } from '../ir/opcodes';
+import {
+  type IrType,
+  type StructField,
+  T,
+  UNION_VIEW_NAMES,
+  intWidth,
+  isCastView,
+  scalarTypeForAccess,
+  spellsAccessType,
+  structSpelling,
+  typeEquals,
+  unionView,
+  unionViewAt,
+} from '../ir/types';
 import {
   BinOp,
   Expr,
@@ -70,37 +91,46 @@ import {
   exprHasEffect,
   gapReasonFor,
   isLoop,
+  keepsHelperRel,
   mapExprChildren,
   mapStmtExprs,
   mentionedName,
   negateCond,
+  regainsHelperRel,
+  splitHelperBreak,
   stmtChildren,
   stmtExprs,
   stmtsEqual,
+  unionStmtsEvidence,
   walkExprs,
 } from '../l3/ast';
+import { constantImageRefusal } from '../l3/constinit';
 import { type Gate, firstRejection } from '../l3/gates';
-import { exprCType, exprIntWidth, provablyNonNegative, ptrElemBytes, renderedIntSignedness } from '../l3/typing';
+import {
+  exprCType,
+  exprIntWidth,
+  renderedIntSignedness,
+  rendersSignedOverUnsigned,
+  spelledNonNegative,
+} from '../l3/typing';
 import { castOffDeclaration, qualifiedMemoryAccess } from '../l3/volstore';
+import type { ContextGlobals } from '../proto-context';
 import { foldConstPair, isConstFoldOpcode } from '../raise/const';
 import { stampDeclaredVolatile } from '../raise/declared-volatile';
 import { returnType } from '../raise/recover';
+import { storeSigned } from '../raise/storesign';
 import { collectStructs } from '../raise/structs';
 import {
   type DeclaredField,
   type SymbolInfo,
-  type SymbolStructField,
   declaredArrayShape,
-  declaredFields,
   isArrayField,
   isBitfieldField,
-  isPtrField,
-  isScalarCellSize,
   pointeeFields,
-  scalarCellType,
   structFieldInnerExtents,
 } from '../symbols';
 import { analyze, shortCircuitGuardedValues } from './analysis';
+import { ARITH_TO_BIN } from './arith-ops';
 import { makeBitfieldSpelling } from './bitfields';
 import {
   addOffset,
@@ -110,6 +140,10 @@ import {
   elementIndex,
   globalByteBase,
   globalOf,
+  memberQualsAllow,
+  memoFieldsOf,
+  ptrMemberDecl,
+  structMemberAt,
   subscriptsFromExtents,
 } from './globalaccess';
 import {
@@ -121,8 +155,8 @@ import {
   updateWriteSet,
 } from './hazards';
 import { type StaticLayout, localStaticShapes, nameLocalStatics } from './local-statics';
-import { type NaturalLoop, analyzeLoops } from './loops';
 import { type NameMerge, coalesceNames } from './namecoalesce';
+import { type ArithCompilerFacts, declaresBytePointer, makePointerSpelling } from './pointer-spelling';
 import { testRereadsOnly } from './redundant-test';
 import { unspelledEpilogues } from './retspell';
 import { type ArmExit, type SwitchBoundCase, makeSwitchRecovery } from './switch-recover';
@@ -162,11 +196,7 @@ interface SymRenderCtx {
    *  the byte residual — the `/flat-rank` arm's OFF switch, off the `spellDeclaredSubscripts`
    *  structure option. */
   declRank: boolean;
-  /** The members a symbol's declaration seats — a struct global's own, or a pointer global's
-   *  pointee's — MEMOIZED per symbol. `declaredFields` validates every member and returns a fresh
-   *  sorted copy on every call, and `isPtrValue` asks it for both operands of every binary node
-   *  lowered, so an uncached lookup is an O(n log n) allocation on a hot path — inside a
-   *  `structure()` a ranked run repeats once per candidate, 17,856 times on the largest fan. */
+  /** {@link memoFieldsOf} over `info`. */
   fieldsOf(name: string): DeclaredField[] | null;
 }
 
@@ -184,9 +214,9 @@ interface SymRenderCtx {
 
 /** The global named by a pointer global's VALUE as the additive lowering spells it: the bare
  *  `gPtr`, or that value wearing the byte-pointer / u32 cast that lowering adds (cast-then-add,
- *  see the `needsIntSpelling` / pointer-global arithmetic rules below). Both denote the same
- *  address and add BYTES to it, so both fold here; a cast to any other pointer type is NOT looked
- *  through — a `(u16 *)` base would re-scale everything added after it. */
+ *  see the `needsIntSpelling` / pointer-global arithmetic rules in pointer-spelling.ts). Both
+ *  denote the same address and add BYTES to it, so both fold here; a cast to any other pointer
+ *  type is NOT looked through — a `(u16 *)` base would re-scale everything added after it. */
 function ptrGlobalValueName(x: Expr): string | null {
   if (x.k === 'var') {
     return x.name;
@@ -245,82 +275,40 @@ function ptrGlobalBase(e: Expr, isPtrGlobal: (n: string) => boolean): PtrGlobalB
   return name !== null ? { name, byte, idx } : null;
 }
 
-/** Does a member declared at signedness `declared` read as EXACTLY the type the cast spelling this
- *  replaces would have produced — `scalarTypeForAccess(width, signed)`? That is the whole
- *  byte-exactness argument for naming a member instead of casting: same address, same read width,
- *  same C type, so every operator downstream compiles identically. A 4-byte access renders s32
- *  whatever the load said (the ISA has one word load), so only a SIGNED member may take its place;
- *  narrower accesses carry their own signedness and must match it. An undeclared signedness (the
- *  member is not a base type — a nested struct, an enum, a pointer) is never assumed to match.
- *  Compared against THE one copy of that rule (ir/types.ts) rather than restating it. */
-function spellsAccessType(declared: boolean | undefined, width: number, signed: boolean): boolean {
-  if (declared === undefined) {
-    return false;
-  }
-  return typeEquals(T.int(width * 8, declared), scalarTypeForAccess(width, signed));
-}
-
 /** The declared type of a frame-local object, from the three facts its `laddr` carries: `count`
  *  elements of `width` bytes, signed or not. ONE element is a SCALAR typed by the access every
  *  access agreed on. More is STORAGE the frontend's frame-object audit sized without typing —
  *  no access pins an element type there, so the audit stamps bytes and this declares the array
- *  that spells them. Both arms are the audit's own facts; neither infers anything here. */
+ *  that spells them. Both arms are the audit's own facts; neither infers anything here.
+ *
+ *  …and storage the audit found accessed at two widths over one byte carries the VIEWS those
+ *  accesses use (`views`, frame-objects.ts `unionViews`), and is declared the union of them —
+ *  each view an array tiling the whole storage, `union { s32 word[3]; u16 half[6]; u8 byte[12]; }`
+ *  — because a union member access is the one spelling of two widths agbcc never reads stale. */
 function laddrType(op: Op): IrType {
   // a call's struct-return storage: the audit typed its address as a pointer to that struct
   const t = op.results[0].type;
   if (op.attrs.aggregate === true && t.kind === 'ptr') {
     return t.to;
   }
+  const views = op.attrs.views as number[] | undefined;
+  if (views !== undefined) {
+    const count = op.attrs.count as number;
+    const widths = views.map(Math.abs);
+    const members = views.map((v): StructField => {
+      const w = Math.abs(v);
+      const elem = scalarTypeForAccess(w, v < 0);
+      const name =
+        widths.filter((x) => x === w).length > 1 ? `${v < 0 ? 's' : 'u'}${UNION_VIEW_NAMES[w]}` : UNION_VIEW_NAMES[w];
+      return { off: 0, type: count === w ? elem : T.array(elem, count / w), name };
+    });
+    return { kind: 'union', members, size: count };
+  }
   const elem = T.int((op.attrs.width as number) * 8, op.attrs.signed as boolean);
   const count = op.attrs.count as number;
   return count === 1 ? elem : T.array(elem, count);
 }
 
-/** May a member be NAMED by an access of this direction, given the qualifiers on its declaration?
- *  The named spelling REPLACES a cast through `(u8 *)`, which carries no qualifier at all, so a
- *  qualifier the name reintroduces changes what the compiler emits:
- *    • `volatile` makes the access observable — the load may no longer be folded or reordered,
- *      which is a different instruction sequence (measured: 6 insns where the cast form was 5);
- *    • `const` under a STORE is a hard error, where the cast form merely cast the qualifier away.
- *  Either way the honest spelling is the cast form, so the member simply is not nameable here. */
-function memberQualsAllow(f: SymbolStructField, containerConst: boolean | undefined, isStore: boolean): boolean {
-  if (f.volatile) {
-    return false;
-  }
-  return !(isStore && (f.const || containerConst));
-}
-
-/** The map member a `field` node NAMES, or null when it names none — THE one resolver for "what
- *  does the declaration say about this member", for rules that must reason about a member's type
- *  after the access rules have already spelled it. Both named spellings resolve, through the same
- *  shared gate their spelling passed: `gSym.member` off a struct global's {@link declaredFields},
- *  `gPtr->member` off the pointee's ({@link pointeeFields}). A synthesized `field_K` — the
- *  recovered-struct spelling, which no map declares — resolves to null, and so does any base that
- *  is not a map-shaped global, which is what makes every caller refuse rather than guess.
- *
- *  The pointee arm reaches only what the MAP lets it: `pointeeAccess` gates every `gPtr->member`
- *  spelling on `spellsAccessType(f.signed, …)`, so a pointer field declaring no signedness — which
- *  is every one in the corpus's vendored maps — is never named, and a pointer read one indirection
- *  down spells `((s32 *)gQ)[1]`. That is a fact about those maps, not about this code: `SymbolMap`
- *  is a caller-supplied input, and one field flips it (`signed: true` on a 4-byte pointer member
- *  of a pointee yields `(u8 *)gQ->pInner`, cast and all, pinned in pointer-members.test.ts). So
- *  the arm is live and tested, and the byte-arithmetic rule that reads this answer is correct for
- *  it — where resolving a pointee member to null would reopen the double-scaling hole silently. */
-function declaredMemberOf(x: Expr, sym: SymRenderCtx | undefined): DeclaredField | null {
-  if (x.k !== 'field' || x.base.k !== 'var' || sym === undefined) {
-    return null;
-  }
-  return sym.fieldsOf(x.base.name)?.find((f) => f.name === x.name) ?? null;
-}
-
-/** The map member a `field` node names when the declaration makes it a POINTER — {@link
- *  isPtrField} being the shared two-fact test, so this and the synthesized declaration cannot
- *  disagree about what a member is. */
-function ptrMemberDecl(x: Expr, sym: SymRenderCtx | undefined): DeclaredField | null {
-  const f = declaredMemberOf(x, sym);
-  return f !== null && isPtrField(f) ? f : null;
-}
-
 /** A map-declared POINTER MEMBER as the additive lowering renders its VALUE: the bare `gSym.pBuf`,
  *  or that member wearing the byte-pointer / u32 cast the arithmetic guard adds. Both denote the
  *  same address and add BYTES to it, so both fold here; a cast to any OTHER pointer type is not
@@ -465,6 +453,23 @@ function ptrMemberElement(
 // 4096 — including offsets past Thumb's immediate range, and under multi-member, across-a-call
 // and in-a-loop shapes. It is one load whose member offset becomes the same immediate the cast
 // form used, and unlike the indexed form it composes.
+//
+// ONE SHAPE IS NOT IDENTICAL: on agbcc, a STORE to an offset past Thumb's
+// immediate range. expand_assignment (gcc/expr.c) expands only the base of a COMPONENT_REF target
+// (:2535) and evaluates the right-hand side first in store_field (:2624), while it expands a cast
+// (INDIRECT_REF) target whole (:2689) before the right-hand side (:2747). So the member form loads
+// a loaded value before it materialises `base + K` and the cast form after it, and with a constant
+// or a parameter on the right the two still allocate registers differently. Neither spelling is
+// the source's by default: a hoisted `u8 *d = &p->f38; *d = v;` builds the cast's object, and the
+// order in which the address and the value are computed is the evidence between them. The member
+// is emitted here; raise/structs.ts `foldDisplacedAccesses` folds such a store into its struct by
+// default and the `/far-cast` lift keeps it on its address, so the differ referees the two
+// (`synthetic:sfar_b` pins the member). A LOAD's member and cast forms compile alike, but agbcc
+// gives each member access its own `base + K`, so one materialised base read at two offsets is a
+// held pointer, and the fold leaves it on its address (`held-pointer-offsets`, `synthetic:sfar_held`
+// pins it); so does ido past its `addiu` reach (target.ts `farMemberBasePerAccess`). On ido, KMC,
+// GCC 2.7.2 and mwcc one access's two forms compile alike past a 16-bit displacement, a loaded
+// value included, and `/far-cast` is offered there for the neighbours a folded store respells.
 
 /** The pointee a global's value may be spelled through: the members the declaration synthesis
  *  DECLARES. Null when nothing may be named through it — THE shared gate (symbols.ts
@@ -700,6 +705,39 @@ function displacementIndex(off: number, width: number): number {
   return off / width;
 }
 
+/** A stamped narrow store (raise/storesign.ts) spelled through a MEMBER — a struct field, a union
+ *  member's view, a struct-array element's field — is converted by the compiler to the member's
+ *  DECLARED type, so a declaration whose sign is not the stamp's loses it: `a0->field_6 = -104`
+ *  under `u16 field_6` recompiles to `li 0xff98`. Such a store is spelled instead as the flat cell
+ *  at the same address, `((s16 *)a0)[3] = -104`, or `((s16 *)(a0 + a1))[1] = -104` for an
+ *  element. The member's type is read off the spelled lvalue (`ctype`), so a member declared by a
+ *  load, a stamp or a union's view is judged alike.
+ *
+ *  `storeWidth` is `undefined` for an `astore`, which does not carry it: raise/struct-arrays.ts
+ *  declares each field at the one width its accesses share, so the member's width is the store's.
+ *
+ *  `lval` comes back unchanged for an unstamped store, an lvalue that is not a member, no
+ *  `flatBase`, a member that is not a narrow integer of the store's width or agrees with the stamp,
+ *  and an offset that is not a whole number of cells (no flat subscript spells it). */
+function stampedStoreLval(
+  lval: Expr,
+  stamp: boolean | undefined,
+  storeWidth: number | undefined,
+  flatBase: Expr | null,
+  off: number,
+  ctype: (e: Expr) => IrType | undefined,
+): Expr {
+  if (stamp === undefined || lval.k !== 'field' || flatBase === null) {
+    return lval;
+  }
+  const t = ctype(lval);
+  const width = storeWidth ?? (t?.kind === 'int' ? t.width / 8 : 0);
+  if (t?.kind !== 'int' || (width !== 1 && width !== 2) || t.width !== width * 8 || t.signed === stamp || off % width) {
+    return lval;
+  }
+  return { k: 'index', base: flatBase, idx: { k: 'const', value: off / width }, width, signed: stamp };
+}
+
 function memAccess(
   base: Value,
   baseExpr: Expr,
@@ -711,6 +749,7 @@ function memAccess(
   sym?: SymRenderCtx,
   isStore = false,
   advancedBy?: number,
+  castQualified = false,
 ): Expr {
   // A deref of a global's address collapses to the bare global: `*(&gSym)` at off 0 is `gSym`;
   // at off N the global is an array — `gSym[N/width]` (a C global name decays to a pointer, so
@@ -762,18 +801,18 @@ function memAccess(
   if (sym) {
     const gb = globalConstByte(baseExpr, off);
     const si = gb ? sym.info(gb.name) : undefined;
-    if (gb && si?.shape === 'struct') {
+    // NOT FOR AN ACCESS THE LIFT QUALIFIED BY A CAST (`castQualified`, ir/discipline.ts `qualifiedBy`):
+    // a member's name reaches the object through its declaration, which the map states plain — had
+    // it qualified the object the access would be placed `declared` — so `gState.ctl;` would compile
+    // to no read at all. The access falls to the cast forms below, where `pinnedAccess` puts the
+    // qualifier: `((volatile s32 *)&gState)[2];`.
+    if (gb && si?.shape === 'struct' && !castQualified) {
       // THE shared spellability predicate (symbols.ts), the same call declare.ts gates its struct
       // declaration on: a layout it declines whole is a layout with no nameable members, and a
       // union alias it drops for the first view at that offset is a name no declaration carries.
-      // An ARRAY member is excluded for the same reason as in pointeeAccess: `u8 x[1]` would match
-      // a byte access by (offset, size) and spell `.x`, which is not an lvalue of that width. A
-      // BITFIELD member likewise — a plain read of its bytes is not a read of its bits (the named
-      // bitfield spelling has its own recognizer, on the extract shape: see lowerDef).
-      const fld = declaredFields(si.layout)?.find(
-        (f) => f.offset === gb.byte && f.size === width && !isArrayField(f) && !isBitfieldField(f),
-      );
-      if (fld && memberQualsAllow(fld, si.const, isStore)) {
+      // The named bitfield spelling has its own recognizer, on the extract shape: see lowerDef.
+      const fld = structMemberAt(si, gb.byte, width, isStore);
+      if (fld) {
         return { k: 'field', base: { k: 'var', name: gb.name }, name: fld.name, dot: true };
       }
     }
@@ -838,7 +877,10 @@ function memAccess(
     return { k: 'index', base: { k: 'addr', name: g.name }, idx, width, signed, ...addressEvidence };
   }
   const bt = base.type;
-  if (bt.kind === 'ptr' && bt.to.kind === 'struct') {
+  // A field declared at its cell's widest view (raise/structs.ts `castViewCell`) is read at any
+  // other view as the flat cell at the same address, `((u8 *)p)[1]`: the cast the union it stands
+  // for would have spelled as a member.
+  if (bt.kind === 'ptr' && bt.to.kind === 'struct' && !isCastView(bt.to, off, width, signed, isStore)) {
     const rt = ctype(baseExpr);
     // `->` requires the base to render as a pointer to THIS struct (field names resolve against
     // its declaration) AND as a non-`index` node (the printer spells an index-node base with `.`,
@@ -1020,32 +1062,25 @@ const CMP_TO_BIN: Record<string, BinOp> = {
   icmp_eq: '==',
   icmp_ne: '!=',
 };
-export const ARITH_TO_BIN: Record<string, BinOp> = {
-  add: '+',
-  sub: '-',
-  mul: '*',
-  sdiv: '/',
-  // the UNSIGNED quotient/remainder — the C backend spells them `/`/`%` over an operand it casts
-  // unsigned (l3/ast.ts BinOp, backend/cfamily.ts C_SPELLING)
-  udiv: '/u',
-  smod: '%',
-  umod: '%u',
-  or: '|',
-  and: '&',
-  xor: '^',
-  shl: '<<',
-  shr_u: '>>>', // the LOGICAL right shift; the C backend spells it `>>` over an unsigned operand
-  shr_s: '>>',
-  logic_and: '&&',
-  logic_or: '||', // short-circuit connectives (raise/shortcircuit.ts)
-};
 
 // The float ops (ir/opcodes.ts) and their L3 operators (l3/ast.ts BinOp). A table of their own and
-// not entries in ARITH_TO_BIN, because every rule that table's consumers apply — the pointer
-// stride, the integer legalizations, the constant fold, the commutative re-spelling — is an
-// integer rule.
+// not entries in ARITH_TO_BIN (arith-ops.ts), because every rule that table's consumers apply —
+// the pointer stride, the integer legalizations, the constant fold, the commutative re-spelling —
+// is an integer rule.
 const FLOAT_TO_BIN: Record<string, BinOp> = { fadd: 'f+', fsub: 'f-', fmul: 'f*', fdiv: 'f/' };
 
+// The float compares (ir/opcodes.ts) and their L3 operators. An ORDERED compare and `fcmp_une` are
+// C's relation; an unordered one is the logical NOT of the ordered relation it negates
+// (`NEGATED_FCMP`), and is spelled as that `!`, never as the integer negation of the relation.
+const FCMP_TO_BIN: Record<string, BinOp> = {
+  fcmp_olt: 'f<',
+  fcmp_ole: 'f<=',
+  fcmp_ogt: 'f>',
+  fcmp_oge: 'f>=',
+  fcmp_oeq: 'f==',
+  fcmp_une: 'f!=',
+};
+
 // The operators whose operand order the machine does not fix — candidates for the def-order
 // re-spelling in lowerDef. `&&`/`||` are excluded: short-circuit order IS semantics.
 const COMMUTATIVE_BIN: ReadonlySet<BinOp> = new Set(['+', '*', '&', '|', '^']);
@@ -1098,24 +1133,39 @@ interface LoopInfo {
 
 // One early-`return` exit out of a loop body, and the blocks of it the loop emits inside its body
 // (`earlyReturnArm` decides which). Per-EDGE rather than flattened into per-loop sets: ownership is
-// decided against `from`, so a second edge into the same target is a separate question. `owned` has
-// one reader, `emitDoWhile` — a `while` hoists no update, so it has no pre-update reads to exempt.
+// decided against `from`, so a second edge into the same target is a separate question. Two arms'
+// `owned` sets may OVERLAP: an effectful tail only the loop's exit arms run (`armsOnly`, the
+// cross-jumped `h(i); return;` two arms end in) is owned by every arm that reaches it, and written
+// once in each. `owned` has one reader, `emitDoWhile`, which unions the arms' sets for its
+// pre-update hazard check — an overlap only repeats a block in that union — and a `while` hoists no
+// update, so it has no pre-update reads to exempt.
 interface LoopArm {
   from: Block;
   to: Block;
   owned: Set<Block>;
 }
 
+// A `break` whose arm RUNS CODE first: `if (t[i] == 7) { gHit = 1; break; }`. The arm's blocks never
+// reach the latch, so they sit outside the natural loop as a second exit target; `codeBreakArm`
+// says when they are one exit with code on the way.
+interface BreakArm {
+  from: Block;
+  to: Block;
+  region: Set<Block>;
+}
+
 // A loop with no test of its own, `while (1)`: its latches are conditional continues, and it leaves
-// by a `break` to `exit` or an early `return`.
+// by a `break` to `exit` or an early `return`. `exit` is null for a loop no edge leaves at all — the
+// main loop that never returns — which has no break, no arm, and nothing after it.
 interface ForeverLoopInfo {
   header: Block;
   latches: Block[];
   forwardPreds: Block[];
-  exit: Block;
+  exit: Block | null;
   body: Set<Block>;
   arms: LoopArm[];
-  breaks: Set<Block>; // the body blocks whose edge to `exit` is a `break`
+  breaks: Set<Block>; // the body blocks whose edge to `exit` is a `break`, or whose edge enters a `breakArms` arm
+  breakArms: BreakArm[];
 }
 
 // A test-at-top multi-block `while`. The header is a pure test whose cond_br enters `bodyEntry`
@@ -1129,7 +1179,8 @@ interface WhileLoopInfo {
   forwardPreds: Block[]; // header preds outside the loop body (the entry/init side)
   body: Set<Block>; // the pure natural-loop body (for in-body vs exit classification)
   arms: LoopArm[]; // the early-`return` exits out of the body (`earlyReturnArm`)
-  breaks: Set<Block>; // the body blocks whose edge to `exit` itself is a `break`
+  breaks: Set<Block>; // the body blocks whose edge to `exit` itself is a `break`, or enters a `breakArms` arm
+  breakArms: BreakArm[];
 }
 
 // Opcodes whose NUMBER OF EXECUTIONS is observable. Moving one of these out of a loop changes what
@@ -1481,14 +1532,16 @@ export const ENCLOSING_CARRIER_GATES: readonly Gate<EnclosingCarrier>[] = [
 //   orderArgCopiesByWriteOrder     — order edge copies by the order the pred WROTE their
 //                                    destinations.
 // The last three are `compilerBehaviors` (target.ts) — this pass stays target-AGNOSTIC: it reads
-// booleans, never a compiler name.
+// booleans, never a compiler name. So are the arithmetic table's (`ArithCompilerFacts`), which this
+// type extends and hands to `makePointerSpelling` whole; the byte-pointer temp step below reads
+// `keepsPointerSumAddend` from it too.
 //
 // WHAT A FIELD DOC BELOW HOLDS, narrowly: what the option MEANS to `structure()`, and the suffix of
 // the variation that enumerates it. A VARIATION's rationale, and any figure pricing its marginal value, live
 // ONCE at its `STRUCTURE_VARIATIONS` entry in rank-variations.ts — restated here the two copies rot
 // separately, and only that one is the entry the enumeration reads. Figures pricing a
 // DEFAULT this pass owns (the edge-copy ordering, `spellDeclaredSubscripts`) do belong here.
-export interface StructureOptions {
+export interface StructureOptions extends ArithCompilerFacts {
   returnsVoid?: boolean;
   coalesceLoopInit?: boolean;
   preserveDivergentBranchSense?: boolean;
@@ -1593,6 +1646,13 @@ export interface StructureOptions {
   // that a fall-through switch has a SECOND, behaviourally identical recovery. Regime A declines
   // to if-recovery when it is false; Regime B, having no fallback, fails loud. Default true.
   spellSwitchFallthrough?: boolean;
+  // Does the TARGET LANGUAGE spell a `break` that leaves a `switch` arm before its end? Set from
+  // the caller's LanguageBackend (`spellsSwitchBreak`), for the same reason as the line above. When
+  // false, a CLOSED arm gets no region (`structureArm`), so `switchBreakAt` never mints the
+  // statement and the arm structures to the CFG's joins, copying the tail its early exit skips into
+  // each path. A FALLING arm needs no gate of its own: a language without a mid-arm `break` has no
+  // fall-through either (Pascal), and `spellSwitchFallthrough` keeps those out. Default true.
+  spellSwitchBreak?: boolean;
   // Which way this compiler hands out frame slots against DECLARATION RANK: `ascending` = the
   // earlier-declared spilled local takes the LOWER `[sp,#k]`. A compiler behavior declared
   // in TargetDescription.compilerBehaviors, carried to the backend on `SFn.slotOrder` and applied
@@ -1613,6 +1673,12 @@ export interface StructureOptions {
   declaredReturns?: Readonly<Record<string, string>>;
   // The emitted C is compiled as C++ (`SFn.dialect`).
   dialect?: 'c++';
+  // The compiler parses a designated initializer element (`SFn.designators`; the compiler behavior
+  // of the same name says which do).
+  designatedInitializers?: boolean;
+  // The compiler's C refuses C's implicit pointer conversions (`SFn.strictConversions`; the compiler
+  // behavior `strictPointerConversions` says which does).
+  strictPointerConversions?: boolean;
   // Commutative load pairs re-spell in def (evaluation) order — see the swap in lowerDef. Default
   // true; verified byte-exact on agbcc and IDO. A compiler behavior declared in
   // TargetDescription.compilerBehaviors: the first compiler whose scheduler is shown re-ordering
@@ -1650,14 +1716,6 @@ export interface StructureOptions {
   // data. The provider already refuses to EMIT bitfield facts for a big-endian ELF; this is the
   // same boundary enforced on core's side, against a hand-built map that never went through it.
   littleEndian?: boolean;
-  // HARDWARE fact from TargetDescription.capabilities.deviceRegisters, threaded by
-  // `structureOptionsFor` like `littleEndian` above: the half-open byte window whose cells are
-  // hardware registers rather than objects a source declares. The structurer asks it the same
-  // question its four other readers ask — "would a source have spelled this address `volatile`" —
-  // so it may be approximate: it decides a SPELLING, not a memory model (that is
-  // `deviceMemoryWriters`, which no structurer rule reads). Used as a REFUSAL: absent, a dead read
-  // at a literal address is dropped.
-  deviceRegisters?: readonly [number, number];
   // Does the compiler extend a `volatile` narrow signed read in a register, never in the load? The
   // `declared` stamp structuring re-derives reads it (TargetDescription.compilerBehaviors'
   // `volatileReadsExtendInRegister`), so it leaves unplaced the read the lift's stamp did.
@@ -1756,10 +1814,13 @@ export interface StructureOptions {
   readsStayWhereWritten?: boolean;
   // Spell unsigned compares unsigned: cast an icmp_u* operand where the rendered operands do not
   // guarantee it, and reconcile a mixed-claimant declaration to u32 when nothing under the name
-  // needs signed. Off by default: a signed spelling that byte-matched was PROVED non-negative by
-  // the compiler (it emits the unsigned branch from signed compares only then), so which spelling
-  // the source used is genuinely ambiguous at emission — rank.ts enumerates the ON spelling as
-  // the `/uns-cmp` variation and the differ referees.
+  // needs signed. ON by default, because it is the only spelling that is value-faithful without a
+  // proof: an unsigned compare spelled over two signed-rendering operands compiles to a SIGNED
+  // compare, which differs from the machine's wherever an operand's top bit is set. The OFF spelling
+  // is still a real source: a signed spelling that byte-matched was PROVED non-negative by the
+  // compiler (it emits the unsigned branch from signed compares only then), and emission's provable
+  // set is smaller than the compiler's. So rank.ts enumerates it as the `/signed-cmp` variation and
+  // publishes it only on a byte-exact score (`Candidate.matchOnly`).
   unsignedCompareSpelling?: boolean;
   // Merge two variables that a merge copy would join, when the values under them never interfere
   // (structure/namecoalesce.ts). Off by default; rank.ts enumerates the ON spelling as the
@@ -1817,6 +1878,11 @@ export interface StructureOptions {
    *  they would read the map's `shape:'pointer'`. The operand-order rules do not read it: no element
    *  or field spelling folds from a name with no pointee. */
   pointerGlobals?: ReadonlySet<string>;
+  /** What the declaration context states about its globals (proto-context.ts `globalsFromContext`):
+   *  which are structs, unions or arrays, and which are volatile, read by the stamp this structuring
+   *  re-derives. Read with the map setting and without it: a context declaration is what every
+   *  candidate compiles against, whichever names it spells. */
+  contextGlobals?: ContextGlobals;
 }
 
 /** The named global an `index` node's base denotes DIRECTLY, or undefined: the bare `&gSym` an
@@ -1880,9 +1946,11 @@ export interface StructureHooks {
    *  has decided both arms are real, so it cannot be computed ahead of the pass. */
   onBranchSenseSite?: (site: { block: number; ordinal: number; joined: boolean; negated: boolean }) => void;
   /** Every branch `followOverReturns` gave a follow: the branch's block and the follow's. Both
-   *  callers fire it — a divergent `if` under `followEarlyReturns`, and EVERY jump table whose arms
-   *  all return, unconditionally — so the sites it reports are not the enumeration domain of the
-   *  shared-tail twins (that domain is `hasDivergentSharedRet`, which asks for a `cond_br`). */
+   *  callers fire it — a divergent `if` under `followEarlyReturns`, EVERY jump table whose arms all
+   *  return, unconditionally, and a jump table whose default-anchored RETRY is adopted (some arms
+   *  return, the rest reach the code after it) — so the sites it reports are not the enumeration
+   *  domain of the shared-tail twins (that domain is `hasDivergentSharedRet`, which asks for a
+   *  `cond_br`). */
   onEarlyReturnFollow?: (site: { block: number; follow: number }) => void;
 }
 
@@ -1897,26 +1965,181 @@ export interface StructureHooks {
  *  It rests on `structure()` not mutating `fn`, which `structure-purity.test.ts` pins.
  *
  *  SCOPE: refusals thrown by `structure()` itself. A decline can also come from `structureChecked`'s
- *  boundary contracts, which run OUTSIDE it — `rank.ts` closes that half, where the contracts are. */
-function assertDefaultAccepts(fn: Fn, opts: StructureOptions, hooks: StructureHooks): void {
-  structure(
-    fn,
-    {
-      ...opts,
-      coalesceMergeNames: false,
-      freshParamMerge: false,
-      materializeJoinFeeds: false,
-      homeSharedAddresses: false,
-      homeLoopExprs: false,
-      homeDerivedReads: false,
-      homeMergeFeeds: false,
-      homeEscapingExtensions: false,
-      anchorConstCopies: false,
-      anchorLoopEntryConsts: false,
-      followEarlyReturns: false,
-    },
-    hooks,
-  );
+ *  boundary contracts, which run OUTSIDE it — `rank.ts` closes that half, where the contracts are.
+ *
+ *  With a `memo`, a reset already structured for this fn is answered from the memo. */
+function assertDefaultAccepts(
+  fn: Fn,
+  opts: StructureOptions,
+  hooks: StructureHooks,
+  memo: DefaultAcceptsMemo | undefined,
+): void {
+  const reset: StructureOptions = {
+    ...opts,
+    coalesceMergeNames: false,
+    freshParamMerge: false,
+    materializeJoinFeeds: false,
+    homeSharedAddresses: false,
+    homeLoopExprs: false,
+    homeDerivedReads: false,
+    homeMergeFeeds: false,
+    homeEscapingExtensions: false,
+    anchorConstCopies: false,
+    anchorLoopEntryConsts: false,
+    followEarlyReturns: false,
+  };
+  if (memo === undefined) {
+    structure(fn, reset, hooks);
+  } else {
+    memo.check(fn, hooks, reset, () => structure(fn, reset, hooks));
+  }
+}
+
+/** A {@link DefaultAcceptsMemo} asked a question it cannot answer. */
+export class DefaultAcceptsMemoMisuse extends Error {
+  constructor(message: string) {
+    super(`DefaultAcceptsMemo: ${message}`);
+    this.name = 'DefaultAcceptsMemoMisuse';
+  }
+}
+
+/** Every block, block parameter, op, opcode, operand, result, successor and edge argument of `fn`,
+ *  in order and by identity, each list after its length. A pass that rewrites the graph in place
+ *  changes it; attributes and side tables are not in it. */
+function graphShape(fn: Fn): unknown[] {
+  const shape: unknown[] = [fn.blocks.length];
+  for (const b of fn.blocks) {
+    shape.push(b, b.params.length, ...b.params, b.ops.length);
+    for (const op of b.ops) {
+      shape.push(op, op.opcode, op.operands.length, ...op.operands, op.results.length, ...op.results);
+      shape.push(op.successors.length);
+      for (const s of op.successors) {
+        shape.push(s.block, s.args.length, ...s.args);
+      }
+    }
+  }
+  return shape;
+}
+
+/** A set or array of at most this many primitives is keyed by its members. Keying costs a pass over
+ *  the members on every structuring, and the maps and sets a project hands every function (`symbols`,
+ *  `pointerGlobals`) are as large as the project, so a bigger one is keyed by identity. */
+const MEMO_CONTENT_KEY_LIMIT = 64;
+
+/** What `assertDefaultAccepts` learned about ONE fn: for each reset it structured, whether
+ *  `structure()` accepted it or the error it threw. Settings that differ only in the flags the
+ *  guard resets share one reset, so an enumeration that structures a fn under many settings asks
+ *  the same question of it many times.
+ *
+ *  VALID WHILE THE FN AND THE OPTIONS' CONTAINERS ARE UNCHANGED. A fn rewritten in place
+ *  (`sinkStoreTails`) needs a new memo, and a `Map`, an object, or a set or array over
+ *  `MEMO_CONTENT_KEY_LIMIT` members is keyed by identity, so one mutated between two calls would
+ *  share a key with its old contents. The `declared` stamps are not a change: `structure()`
+ *  re-derives them from the options' map before it reaches the guard, so the reset run finds them as
+ *  the first run of the same key did.
+ *
+ *  Asked about another fn, or about its own fn once a block, op or value of it was added, removed,
+ *  replaced or reordered (`graphShape`), it throws {@link DefaultAcceptsMemoMisuse} rather than
+ *  answer. That is a wiring defect, not a decline, so `rank.ts` lets it end the enumeration.
+ *
+ *  Only a call with no hooks is answered: a hook can change the outcome, or must observe the run.
+ *  An option holding a function or a symbol has no key, and its reset always runs. */
+export class DefaultAcceptsMemo {
+  readonly #outcomes = new Map<string, { error: unknown } | 'accepted'>();
+  readonly #ids = new WeakMap<object, number>();
+  readonly #shape: readonly unknown[];
+  #nextId = 0;
+
+  constructor(readonly fn: Fn) {
+    this.#shape = graphShape(fn);
+  }
+
+  /** Returns or throws what `run` did for this reset, running it only when the memo has no
+   *  outcome for it yet. */
+  check(fn: Fn, hooks: StructureHooks, reset: StructureOptions, run: () => void): void {
+    if (fn !== this.fn) {
+      throw new DefaultAcceptsMemoMisuse('asked about a fn it was not made for');
+    }
+    const shape = graphShape(fn);
+    if (shape.length !== this.#shape.length || shape.some((x, i) => !Object.is(x, this.#shape[i]))) {
+      throw new DefaultAcceptsMemoMisuse(`asked about ${fn.name} after its graph was rewritten`);
+    }
+    const key = Object.values(hooks).every((h) => h === undefined) ? this.#keyOf(reset) : undefined;
+    if (key === undefined) {
+      run();
+      return;
+    }
+    const known = this.#outcomes.get(key);
+    if (known === 'accepted') {
+      return;
+    }
+    if (known !== undefined) {
+      throw known.error;
+    }
+    try {
+      run();
+    } catch (error) {
+      this.#outcomes.set(key, { error });
+      throw error;
+    }
+    this.#outcomes.set(key, 'accepted');
+  }
+
+  /** Every option that is set, by name and value; `undefined` when one has no key. */
+  #keyOf(opts: StructureOptions): string | undefined {
+    const parts: string[] = [];
+    for (const name of Object.keys(opts).sort()) {
+      const value: unknown = (opts as Record<string, unknown>)[name];
+      if (value === undefined) {
+        continue;
+      }
+      const part = this.#valueKey(value);
+      if (part === undefined) {
+        return undefined;
+      }
+      parts.push(`${name}=${part}`);
+    }
+    return parts.join(';');
+  }
+
+  /** A prefix-free spelling of one value, so two option sets share a key only when every value
+   *  agrees. */
+  #valueKey(value: unknown): string | undefined {
+    switch (typeof value) {
+      case 'undefined':
+        return 'u';
+      case 'boolean':
+        return value ? 't' : 'f';
+      case 'number':
+        return Object.is(value, -0) ? 'n-0' : `n${value}`;
+      case 'bigint':
+        return `b${value}`;
+      case 'string':
+        return JSON.stringify(value);
+      case 'function':
+      case 'symbol':
+        return undefined;
+    }
+    if (value === null) {
+      return 'null';
+    }
+    const members = value instanceof Set ? [...value] : Array.isArray(value) ? value : undefined;
+    if (
+      members !== undefined &&
+      members.length <= MEMO_CONTENT_KEY_LIMIT &&
+      members.every((m) => m === null || typeof m !== 'object')
+    ) {
+      const keys = members.map((m) => this.#valueKey(m));
+      return keys.every((k) => k !== undefined) ? `${value instanceof Set ? 'S' : 'A'}[${keys.join(',')}]` : undefined;
+    }
+    const container = value as object;
+    let id = this.#ids.get(container);
+    if (id === undefined) {
+      id = this.#nextId++;
+      this.#ids.set(container, id);
+    }
+    return `#${id}`;
+  }
 }
 
 /** What {@link earlyReturnArm} reads beyond its arguments: block dominance and forward
@@ -1924,20 +2147,33 @@ function assertDefaultAccepts(fn: Fn, opts: StructureOptions, hooks: StructureHo
 interface EarlyReturnArmDeps {
   dom: Map<Block, Set<Block>>;
   reachFrom: (b: Block) => Set<Block>;
+  preds: ReadonlyMap<Block, Block[]>;
 }
 
 function isRet(blk: Block): boolean {
   return blk.ops[blk.ops.length - 1]?.opcode === 'ret';
 }
-/** The `ret`s reachable from EVERY successor of `b` — the region `followOverReturns` keeps. Empty
- *  when there is none, and when `b` does not branch at all. `reachFrom` is forward reachability,
- *  the start block excluded.
+/** The `ret`s reachable from EVERY successor of `b` — the region `followOverReturns` keeps — or,
+ *  given an `anchor`, from every successor that shares a `ret` with the anchor. Empty when there
+ *  is none, and when `b` does not branch at all. `reachFrom` is forward reachability, the start
+ *  block excluded.
  *
  *  THE QUESTION IS ABOUT A BRANCH, not about an `if`: "the arms all return, so post-dominance gives
  *  this block no join — where does the construct end?" is asked by a jump table exactly as by a
  *  two-way branch, and the answer is derived the same way. The `if`-shaped reading belongs to the
  *  CALLER that wants it (`hasDivergentSharedRet`), not here.
  *
+ *  THE ANCHOR names a successor taken to reach the end the question is about, and leaves out
+ *  every successor that shares no `ret` with it (`leftOutOf`). The `switch_br` caller anchors on
+ *  the dispatch's DEFAULT edge, whose target is the `default:` arm or the code after the switch: a
+ *  `case` that `return`s on its own, or falls into one that does, then no longer empties the
+ *  intersection for the arms that `break`. Leaving those successors out is sound for the follow the
+ *  caller derives from the answer: the answer is a subset of the anchor's `ret`s, so a successor
+ *  left out reaches none of them, hence no block that reaches one — in particular not the follow —
+ *  and it is structured to its own `return`. It is a candidate and not evidence that the source
+ *  ended the construct there: a `default:` that `return`s on its own is an anchor too, and the
+ *  caller states what it reads to tell the two apart. The `if` caller never anchors.
+ *
  *  THE DEDUP IS DEFENSIVE AND NO CALLER CAN REACH IT TODAY. It is what makes "two successors that
  *  are the same block" answer `[]` rather than "a branch with a shared `ret`". Both callers ask
  *  only when `ipdom.get(b)` is null, and a branch whose successors are all ONE block has that block
@@ -1945,23 +2181,33 @@ function isRet(blk: Block): boolean {
  *  to this function rather than to its callers' guards, and dropping it is a no-op on the corpus:
  *  the reader over every row of the committed artifact (`decompile` per row, no compiling) emits
  *  byte-identical source with and without it. */
-function sharedRetsOf(b: Block, reachFrom: (x: Block) => ReadonlySet<Block>): Block[] {
-  const succs = [...new Set(successorsOf(b))];
+function sharedRetsOf(b: Block, reachFrom: (x: Block) => ReadonlySet<Block>, anchor: Block | null = null): Block[] {
+  const left = anchor === null ? [] : leftOutOf(b, reachFrom, anchor);
+  const succs = [...new Set(successorsOf(b))].filter((x) => !left.includes(x));
   if (succs.length < 2) {
     return [];
   }
-  const retsFrom = (x: Block): Block[] => [x, ...reachFrom(x)].filter(isRet);
-  return succs.map(retsFrom).reduce((shared, rets) => {
-    const here = new Set(rets);
-    return shared.filter((r) => here.has(r));
-  });
+  return succs
+    .map((x) => retsFrom(x, reachFrom))
+    .reduce((shared, rets) => {
+      const here = new Set(rets);
+      return shared.filter((r) => here.has(r));
+    });
+}
+function retsFrom(x: Block, reachFrom: (x: Block) => ReadonlySet<Block>): Block[] {
+  return [x, ...reachFrom(x)].filter(isRet);
+}
+/** The successors of `b` that share no `ret` with `anchor` — the ones `sharedRetsOf` leaves out. */
+function leftOutOf(b: Block, reachFrom: (x: Block) => ReadonlySet<Block>, anchor: Block): Block[] {
+  const anchored = new Set(retsFrom(anchor, reachFrom));
+  return [...new Set(successorsOf(b))].filter((x) => !retsFrom(x, reachFrom).some((r) => anchored.has(r)));
 }
 /** Is there an `if` whose arms reach no common block before EXIT but share a `ret` — the only shape
  *  `followEarlyReturns` changes? The enumeration gate of both shared-tail twins (rank.ts), asked of
  *  the fn as raised and again of the sunk fn; a superset, since it asks `sharedRetsOf` and none of
  *  the follow's three later refusals. An `if`, specifically: see the restriction at the `some`. */
 export function hasDivergentSharedRet(fn: Fn): boolean {
-  const ipdom = postDominators(fn);
+  const ipdom = functionPostDominators(fn);
   const reach = new Map<Block, Set<Block>>();
   const reachFrom = (b: Block): Set<Block> => {
     let out = reach.get(b);
@@ -2002,6 +2248,141 @@ function reachesAvoiding(from: Block, to: Block, avoid: Block): boolean {
   }
   return false;
 }
+/** The arm `from -> to` breaks to `exit` after running code: the region `to` heads re-enters no
+ *  `body` block and leaves only for `exit` or by a `ret` of its own. Returns that region, or null.
+ *  The region is written inside the loop, ahead of the `break` — a `ret` among it as the `return` it
+ *  is: `if (t[i] == 7) { if (k) return; gHit = 1; break; }`.
+ *
+ *  UNSHARED (the default, and the header-exit caller), `to` is entered by that edge alone and the
+ *  region admits no edge from outside itself, so each region block is written once and the region
+ *  owns its `ret`s: the `return` is written where the asm holds its one copy.
+ *
+ *  A TAIL SEVERAL BREAKS SHARE, with `shared` (what `exitArmOf` passes for every in-body code arm):
+ *  `if (a) f |= 1; else if (b) f |= 2; else continue; gHit = i; break;` compiles to two arms that
+ *  each run their own code and jump to one `gHit = i` block on the way out (agbcc and gcc2.7.2
+ *  cross-jump arms written with a tail each into that same shape, jump.c). The region is then
+ *  admitted when the arm's head is entered only from the body (a body block, or a block every path
+ *  into which comes from the body without passing `exit`: the other arm's own blocks, whose exit
+ *  edge the classifier must admit as an arm of its own, or the loop declines), every other block an
+ *  edge from outside enters is one the loop's own exit path does not run (`offExitPath`), and the
+ *  region holds no cycle. Each arm writes the shared blocks again ahead of its own `break`, a shared
+ *  `ret` as one `return` per arm, and a path from outside the loop (an `else` before it) structures
+ *  its own copy where the block sits. Those paths are exclusive — a path that left the body by an arm
+ *  reaches a region block again only through `exit`, and the exit does not reach it — so every path
+ *  runs the tail once, as the asm does, whatever the tail does; where the compiler cross-jumps, the
+ *  copies are the same code (gcc2.7.2kmc byte-identical, agbcc up to register allocation).
+ *
+ *  THE COST where it does not: ido keeps one tail, and only the source's single copy at the arms'
+ *  join recompiles to it. `synthetic:brmerge:ido7.1`'s row source is byte-identical to its target;
+ *  the per-arm spelling compiles to 52 instructions against 50 (an extra `lui` and `sb`), so that
+ *  row cannot MATCH this way. The single copy needs a `continue` that runs the latch's update — a
+ *  `for` whose `inc` is that update, or a `do`/`while` whose test the `continue` reaches — and
+ *  structure writes `continue` only to a `while (1)` header, while the L3 `for` respell refuses a
+ *  body holding one (l3/ast.ts, the `for` node). */
+function codeBreakArm(
+  preds: ReadonlyMap<Block, Block[]>,
+  dom: ReadonlyMap<Block, ReadonlySet<Block>>,
+  from: Block,
+  to: Block,
+  body: ReadonlySet<Block>,
+  exit: Block,
+  shared = false,
+): Set<Block> | null {
+  if (to === exit || body.has(to)) {
+    return null;
+  }
+  const region = new Set<Block>();
+  let leaves = false;
+  for (const stack = [to]; stack.length > 0;) {
+    const x = stack.pop()!;
+    if (x === exit) {
+      leaves = true;
+      continue;
+    }
+    if (region.has(x)) {
+      continue;
+    }
+    const t = x.ops[x.ops.length - 1];
+    if (body.has(x) || (t.opcode !== 'br' && t.opcode !== 'cond_br' && t.opcode !== 'ret')) {
+      return null; // re-enters the loop, or dispatches
+    }
+    region.add(x);
+    stack.push(...successorsOf(x));
+  }
+  // Shared: the arm's head is entered from another arm when every path into the entering block
+  // comes from the body without passing `exit` — the body block itself, or the other arm's own
+  // blocks. Never from outside the loop: an edge straight from the body into a block others enter
+  // too is a `break` to it, which `while (1)` writes once, after the loop.
+  const armOfBody = onlyFromBody(preds, body, exit);
+  // Shared, past the head: a block may be entered from anywhere — another arm, or outside the loop —
+  // when the loop's own exit path does not run it (`offExitPathOf`). agbcc cross-jumps a `break`
+  // that assigns a `u8` with an `else` before the loop that assigns the same `u8` into one `lsr`
+  // truncation block, and a `gLast = id;` both write into one `strb` (jump.c); gcc2.7.2kmc keeps one
+  // `jal note` the arm's `beql` and the `else` both enter. The per-arm copy is the source's spelling.
+  const offExitPath = offExitPathOf(exit, dom);
+  let entersShared = false;
+  const entered = (x: Block) =>
+    (preds.get(x) ?? []).every(
+      (p) =>
+        region.has(p) ||
+        (x === to && p === from) ||
+        (shared && (x === to ? armOfBody(p) : offExitPath(x)) && (entersShared = true)),
+    );
+  if (!leaves || ![...region].every(entered)) {
+    return null;
+  }
+  // a region another arm enters is written once per arm, so it must be one a walk writes once: no
+  // cycle. One only its own edge enters is written once wherever it sits.
+  return !entersShared || [...region].every((x) => acyclicThrough(x, region)) ? region : null;
+}
+/** The duplication policy's admission (written at `earlyReturnArm`): is a block one the loop's own
+ *  exit path does not run? Forward only (`reachForward`): round an enclosing loop's back-edge the exit
+ *  reaches the inner loop again, which is the next iteration running the block again in the asm too,
+ *  not the fall-through path running it after the loop. Computed on first use. */
+function offExitPathOf(exit: Block, dom: ReadonlyMap<Block, ReadonlySet<Block>>): (b: Block) => boolean {
+  let fromExit: Set<Block> | undefined;
+  return (b) => !(fromExit ??= reachForward(exit, dom)).has(b);
+}
+/** Does every path into a block come from `body` without passing `exit`? True of a body block, and
+ *  of a block outside whose every predecessor is one — a loop exit arm's own blocks, and a tail only
+ *  those arms enter. Memoised per call; a cycle back to a block is no path from the body. */
+function onlyFromBody(
+  preds: ReadonlyMap<Block, Block[]>,
+  body: ReadonlySet<Block>,
+  exit: Block,
+): (b: Block) => boolean {
+  const fromBody = new Map<Block, boolean>();
+  const armOfBody = (p: Block): boolean => {
+    if (body.has(p)) {
+      return true;
+    }
+    const known = fromBody.get(p);
+    if (known !== undefined) {
+      return known;
+    }
+    fromBody.set(p, false);
+    const into = preds.get(p) ?? [];
+    const ok = p !== exit && into.length > 0 && into.every(armOfBody);
+    fromBody.set(p, ok);
+    return ok;
+  };
+  return armOfBody;
+}
+/** Does no path inside `region` lead from `x` back to `x`? */
+function acyclicThrough(x: Block, region: ReadonlySet<Block>): boolean {
+  const seen = new Set<Block>();
+  for (const stack = successorsOf(x); stack.length > 0;) {
+    const y = stack.pop()!;
+    if (y === x) {
+      return false;
+    }
+    if (region.has(y) && !seen.has(y)) {
+      seen.add(y);
+      stack.push(...successorsOf(y));
+    }
+  }
+  return true;
+}
 // An early `return` out of the loop: forward-walking from `to` WITHOUT re-entering the loop `body`,
 // every path terminates in a `ret`. agbcc/gcc merge every `return` into ONE epilogue block and each
 // return site just sets the return register and branches there, so a second body exit that lands on
@@ -2011,26 +2392,67 @@ function reachesAvoiding(from: Block, to: Block, avoid: Block): boolean {
 //
 // The arm is structured AT the edge, so any block in it that a second path also reaches is emitted
 // twice. A duplicated `return v` is harmless — both copies sit on mutually exclusive paths, so this
-// is a FIDELITY rule, not a soundness one: a store or call written twice is source no compiler
-// would have produced from this asm, and the region it drags along is unbounded. A block escapes
-// that on two counts. `from` dominates `to` and `to` dominates the block, so every path reaching it
+// is a FIDELITY rule, not a soundness one.
+//
+// ONE DUPLICATION POLICY for loop exit arms, here and in `codeBreakArm`'s shared mode. A block with
+// effects may be written once per arm when the loop's own exit path does not run it
+// (`offExitPathOf`) and it holds no cycle, whoever else enters it — another arm, or a path from
+// before the loop (an `else` beside it). A path that left the body by an arm reaches the block only
+// through that arm, because the exit does not reach it; a path from before the loop never ran an arm.
+// The paths are exclusive, so each runs one copy once, the arm's or the one written where the block
+// sits; on a compiler that cross-jumps (agbcc, gcc2.7.2: jump.c) those copies are the source the one
+// block came from. Whether the block has an effect does not enter into it. A block the loop's own
+// exit path also runs is written once, after the loop: copying it into an arm writes a store or call
+// twice where the asm holds it once on the fall-through path, and drags the rest of the function
+// along. `codeBreakArm`'s shared region stops at `exit`, so the loop's own arms bound it and it
+// takes no size limit. This walk applies the same policy to a tail that ends in its own `return`:
+// an effectful block is admitted only on one of the two counts below, and refused otherwise.
+//
+// THE EDGE OWNS IT. `from` dominates `to` and `to` dominates the block, so every path reaching it
 // runs this edge's predecessor and then this region — and only one edge into `to` can satisfy the
 // first half, since two predecessors cannot both dominate it. And the region must not be reachable
-// from the loop's own exit, which dominance does NOT rule out: an arm landing straight on the
-// post-loop join dominates itself, and claiming it would emit the epilogue on both paths. Testing
-// `to` covers the whole region — a block dominated by `to` that the exit reached would mean the
-// exit reached `to`. The shared epilogue an arm branches to still has to be pure.
+// forward from the loop's own exit (`offExitPathOf`), which dominance does NOT rule out: an arm
+// landing straight on the post-loop join dominates itself, and claiming it would emit the epilogue
+// on both paths. Testing `to` covers the whole region — a block dominated by `to` that the exit
+// reached would mean the exit reached `to`.
+//
+// ONLY THE LOOP'S EXIT ARMS RUN IT (`armsOnly`): the policy's count, plus every path into it comes
+// from the body without passing `exit` (`onlyFromBody`). Two arms ending in the same `h(i); return;`,
+// which agbcc and gcc2.7.2kmc cross-jump into one block no edge dominates, write it once each: the
+// arms run on exclusive paths, so each path still runs it once. The `while` reading that takes one
+// such arm for the exit stays refused — the other arm's tail is then reachable from it — so the loop
+// falls to the reading whose exit runs nothing of the tail. A shared epilogue the exit also reaches
+// still has to be pure.
 //
-// Returns the blocks the arm OWNS — its exclusive part, which the loop emits inside its body, ahead
-// of the update — or null when this is not an early-`return` arm.
+// WHY A RETURN TAIL ASKS MORE THAN THE POLICY. An entry from before the loop is sound to copy past —
+// the paths are exclusive — but into a tail that returns it is, in the common shape, the loop's own
+// zero-trip guard landing on the post-loop epilogue: `for (i = 0; i < n; i++) { if (t[i] == 7) {
+// ping(i); return; } } out(0);`. Admitting it lets the `while` reading take the early-return arm for
+// the exit and copy `out(0); return;` into the body, where the asm holds it once after the loop
+// (ido7.1 and mwcc_242_81 re-spell `while (1)` that way, equivalent but not the source's shape).
+// What it would buy is an `else` before the loop that cross-jumps into the arms' tail (agbcc's
+// `else { pong(9); hit(a); return; }`), and that lifts only through the same re-spelling.
+//
+// Returns the blocks the arm OWNS — the ones the loop emits inside its body for this arm, ahead of
+// the update — or null when this is not an early-`return` arm. Not exclusive to the arm: a block the
+// `armsOnly` count admits is owned by every arm that reaches it, so two arms' sets can share it.
 function earlyReturnArm(
-  { dom, reachFrom }: EarlyReturnArmDeps,
+  { dom, reachFrom, preds }: EarlyReturnArmDeps,
   from: Block,
   to: Block,
   body: Set<Block>,
   exit: Block,
 ): Set<Block> | null {
-  const entryOwned = dom.get(to)!.has(from) && to !== exit && !reachFrom(exit).has(to);
+  // does the loop's own exit path run it? forward only (`offExitPathOf`)
+  const offExitPath = offExitPathOf(exit, dom);
+  const entryOwned = dom.get(to)!.has(from) && to !== exit && offExitPath(to);
+  // the duplication policy's admission: the loop's own exit path does not run it, and no cycle holds
+  // it — and, for a tail that returns, only the loop's exit arms enter it (`armsOnly`, below). Never
+  // the arm's own head: an edge straight from the body into a block others enter too is a `break` to
+  // it, which `while (1)` writes once, after the loop.
+  const armOfBody = onlyFromBody(preds, body, exit);
+  const armsOnly = (bb: Block) =>
+    bb !== to && bb !== exit && armOfBody(bb) && offExitPath(bb) && !reachFrom(bb).has(bb);
   const owned = new Set<Block>();
   const seen = new Set<Block>();
   const stack = [to];
@@ -2043,7 +2465,7 @@ function earlyReturnArm(
     if (body.has(bb)) {
       return null;
     } // re-enters the loop → not an exit
-    if (entryOwned && dom.get(bb)!.has(to)) {
+    if ((entryOwned && dom.get(bb)!.has(to)) || (bb.ops.some(effectful) && armsOnly(bb))) {
       owned.add(bb);
     } else if (bb.ops.some(effectful)) {
       return null;
@@ -2072,7 +2494,12 @@ function carrierSign(t: IrType | undefined): boolean | undefined {
   return t?.kind === 'int' && t.width < 32 ? t.signed : undefined;
 }
 
-export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureHooks = {}): SFn {
+export function structure(
+  fn: Fn,
+  opts: StructureOptions = {},
+  hooks: StructureHooks = {},
+  memo?: DefaultAcceptsMemo,
+): SFn {
   const {
     returnsVoid = false,
     coalesceLoopInit = false,
@@ -2087,10 +2514,13 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     switchArmsFollowLayout = false,
     switchRequiresFrontLoadedTests = false,
     spellSwitchFallthrough = true,
+    spellSwitchBreak = true,
     spillSlotOrder,
     declaredArgs,
     declaredReturns,
     dialect,
+    designatedInitializers = false,
+    strictPointerConversions = false,
     defOrderLoadPairs = true,
     anchorConstCopies = false,
     anchorLoopEntryConsts = false,
@@ -2107,8 +2537,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     homeEscapingExtensions = false,
     readsStayWhereWritten = false,
     contractsFloatProducts = false,
+    keepsPointerSumAddend = false,
     staticLayout,
-    unsignedCompareSpelling = false,
+    unsignedCompareSpelling = true,
     coalesceMergeNames = false,
     freshParamMerge = false,
     followEarlyReturns = false,
@@ -2117,12 +2548,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     inferredSymbols,
     orderLicensedGlobals,
     pointerGlobals,
+    contextGlobals,
   } = opts;
   // A read this stamp is the first to place was plain to every raising pass, and in a `&&`/`||`'s
   // guarded operand a short-circuit fold may have lifted it out of the arm it ran in: which side of
   // the branch the asm read it on is lost. The analysis names a counted op it finds there above the
   // branch, which is right only for one no fold could move, so this read declines instead.
-  const stampedLate = stampDeclaredVolatile(fn, mapSymbols, opts);
+  const stampedLate = stampDeclaredVolatile(fn, mapSymbols, {
+    volatileReadsExtendInRegister: opts.volatileReadsExtendInRegister,
+    contextGlobals,
+  });
   if (stampedLate.length > 0) {
     const defsNow = defOpMap(fn);
     const guarded = shortCircuitGuardedValues(fn, defsNow);
@@ -2143,6 +2578,11 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // shape is its definition's, never the one raise/globalshape.ts infers from its accesses.
   const localStatics = localStaticShapes(fn, staticLayout);
   if ('refused' in localStatics) {
+    if (fn.localObjects?.get(localStatics.symbol)?.anonymous) {
+      throw new StructureError(
+        `cannot structure '${fn.name}': reads the compiler's anonymous constant ('${localStatics.symbol}') ${localStatics.refused}`,
+      );
+    }
     throw new StructureError(
       `cannot structure '${fn.name}': names a function-scope static ('${localStatics.symbol}') ${localStatics.refused}`,
     );
@@ -2181,8 +2621,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   //     widens a load's render positions and narrows the write set that bars it, so it removes
   //     materializations rather than minting them. Extra materialization is what this guard is
   //     about (see above), and this variation adds none;
-  //   - `/uns-cmp` (unsignedCompareSpelling) writes `varType` and inserts casts at compares. It
-  //     touches no name and no copy, so no edge copy changes its elision under it;
+  //   - `/signed-cmp` (unsignedCompareSpelling OFF) drops the casts at compares and the u32
+  //     reconciliation of `varType`. It touches no name and no copy, so no edge copy changes its
+  //     elision under it;
   //   - `/copy-defpos` (preferDefPosCopyOrder) REORDERS the copies of one edge and adds or drops
   //     none. rank.ts states the same thing from the variation side, in the terms that matter there: a
   //     reordering cannot rescue a spelling whose OFF sibling failed the boundary contracts.
@@ -2198,12 +2639,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     anchorConstCopies ||
     followEarlyReturns
   ) {
-    assertDefaultAccepts(fn, opts, hooks);
+    assertDefaultAccepts(fn, opts, hooks, memo);
   }
   const defs = defOpMap(fn);
+  // The word evaluator's view of `fn`, built at the first `neg_s` (no other rule asks it).
+  let wordCtx: WordCtx | undefined;
   const preds = predecessorBlocks(fn);
-  const ipdom = postDominators(fn);
   const dom = dominators(fn);
+  // --- loop discovery (ir/loops.ts): natural loops via dominator back-edges + the nesting forest ---
+  const forest = analyzeLoops(fn, dom);
+  const ipdom = functionPostDominators(fn, forest);
 
   /** The byte step `raise/const.ts` recorded on the literal that feeds this access's address, or
    *  `undefined` where the address was not reached by advancing a register. Read at the two
@@ -2213,6 +2658,20 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     return typeof step === 'number' ? step : undefined;
   };
 
+  /** THE view a `store` (`width` bytes) or `astore` (`elemSize`) lvalue is spelled through, for
+   *  both branches below: `storeSigned`, the scalar the recovered pointee was seeded at, so an
+   *  inserted cast declares the same type. An UNSTAMPED narrow store of a constant both views store
+   *  alike (narrow sign bit clear) takes its base's own int pointee instead and asks for no cast,
+   *  since nothing witnessed either type. */
+  const storeView = (op: Op, width: number): boolean => {
+    const t = op.operands[0].type;
+    const own = t.kind === 'ptr' && t.to.kind === 'int' && t.to.width === width * 8 ? t.to.signed : undefined;
+    const v = defs.get(op.operands[op.opcode === 'astore' ? 2 : 1]);
+    const k = v?.opcode === 'const' ? v.attrs.value : undefined;
+    const neutral = typeof k === 'number' && Number.isInteger(k) && k >= 0 && k < 2 ** (width * 8 - 1) && width < 4;
+    return op.attrs.signed === undefined && neutral && own !== undefined ? own : storeSigned(op, width);
+  };
+
   // ── analysis phase (structure/analysis.ts): use registry, liveness, materialization ──
   const { useSitesOf, opIndex, opBlock, liveIn, materialize, preUpdateHomes, reachFrom, emitPos, memWriteBetween } =
     analyze(fn, returnsVoid, {
@@ -2238,7 +2697,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // rank.ts's `/shared-ret` twin, and as its `/shared-tail` twin after the store-tail sink: as a
   // default it costs rows, measured there.
   //
-  // WHICH REGION: the `ret`s reachable from EVERY successor. Every block that cannot reach one of
+  // WHICH REGION: the `ret`s reachable from EVERY successor — or, given an `anchor`, from every
+  // successor that shares a `ret` with the anchor (`sharedRetsOf`; only the `switch_br` caller's
+  // retry passes one, the dispatch's default edge). Every block that cannot reach one of
   // them is an early-return region and is deleted; the follow is `b`'s post-dominator over what is
   // left. Sound for the same reason an ordinary follow is: every kept path from `b` passes it, and a
   // deleted block reaches no kept `ret` and so never the follow, so each arm structures up to the
@@ -2255,7 +2716,8 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // PER `if`, never function-wide: the deletion set is a function of that `if`'s own shared `ret`s
   // (memoized on them), because a nested `if` shares a different set, or none.
   //
-  // REFUSES (keeping the divergent arms) when no `ret` is reachable from every successor, when the
+  // REFUSES (keeping the divergent arms) when that reading leaves no `ret` — none reachable from
+  // every successor, or from every successor the anchor keeps — when the
   // kept graph gives `b` no post-dominator but EXIT, and when the enclosing region's `stop` is
   // reachable from `b` without passing the follow — that path must reach `stop`, and structuring
   // the arms towards a different follow would emit `stop`'s region inside an arm.
@@ -2267,10 +2729,14 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // an in-loop branch reach is reachable from the latch too, so the intersection keeps the whole
   // graph, `pd` is `ipdom` itself — and the caller only asks when `ipdom.get(b)` is already null,
   // so the answer comes back null and the `?? stop` fallback stands. That is an observation about
-  // the shape rather than a check, which is why it is written down here.
+  // the shape rather than a check, which is why it is written down here. The anchored RETRY that
+  // caller adds is no exception in practice: inside a loop the latch carries every arm to every
+  // `ret`, so the arm that returns shares one with the default edge and is kept, and nothing is
+  // left out (measured on five in-loop switches with one returning arm, compiled with agbcc and
+  // IDO: every one declines). That is a reach this does not have, not a guard.
   const followsByShared = new Map<string, Map<Block, Block | null>>();
-  const followOverReturns = (b: Block, stop: Block | null): Block | null => {
-    const shared = sharedRetsOf(b, reachFrom);
+  const followOverReturns = (b: Block, stop: Block | null, anchor: Block | null = null): Block | null => {
+    const shared = sharedRetsOf(b, reachFrom, anchor);
     if (shared.length === 0) {
       return null;
     }
@@ -2288,7 +2754,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     if (follow === null || (stop !== null && follow !== stop && reachesAvoiding(b, stop, follow))) {
       return null;
     }
-    hooks.onEarlyReturnFollow?.({ block: fn.blocks.indexOf(b), follow: fn.blocks.indexOf(follow) });
+    if (anchor === null) {
+      hooks.onEarlyReturnFollow?.({ block: fn.blocks.indexOf(b), follow: fn.blocks.indexOf(follow) });
+    }
     return follow;
   };
 
@@ -2349,9 +2817,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     const byOff = new Map<number, string>();
     const names = new Map<Op, string>();
     const undefNames = new Map<Op, string>();
+    const undefByKey = new Map<string, string>();
     for (const b of fn.blocks) {
       for (const op of b.ops) {
-        if (op.opcode === 'laddr') {
+        if (op.opcode === 'laddr' && op.attrs[OWN_RETURN_OBJECT] === true) {
+          // the function's own return object, which no frame offset names
+          names.set(op, mint('ret'));
+        } else if (op.opcode === 'laddr' && typeof op.attrs[CALL_RETURN_OBJECT] === 'string') {
+          // the struct a call returned in a register, which no frame offset names either
+          names.set(op, mint(`${op.attrs[CALL_RETURN_OBJECT]}_ret`));
+        } else if (op.opcode === 'laddr') {
           const off = op.attrs.off as number;
           let n = byOff.get(off);
           if (n === undefined) {
@@ -2363,7 +2838,23 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           // Named from the key, like laddr's `sp<off>`: `uninit_sp8` says which frame slot to look
           // at in the assembly, and it stays put where a running counter would renumber every local
           // when an unrelated edit changed the order ops are minted in.
-          undefNames.set(op, mint(`uninit_${String(op.attrs.key).replace('@', '')}`));
+          // A `copied` undef is the same storage's content as the undef its key names, so it
+          // shares that one's name (and declaration) once both are minted, below.
+          if (op.attrs.copied !== true) {
+            const n = mint(`uninit_${String(op.attrs.key).replace('@', '')}`);
+            undefNames.set(op, n);
+            undefByKey.set(String(op.attrs.key), n);
+          }
+        }
+      }
+    }
+    for (const b of fn.blocks) {
+      for (const op of b.ops) {
+        if (op.opcode === 'undef' && op.attrs.copied === true) {
+          const key = String(op.attrs.key);
+          const n = undefByKey.get(key) ?? mint(`uninit_${key.replace('@', '')}`);
+          undefByKey.set(key, n);
+          undefNames.set(op, n);
         }
       }
     }
@@ -2450,17 +2941,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         }
       }
     }
-    // Declaration-shape OVERRIDE (symbol map): a project-declared array/struct global is an
-    // AGGREGATE whatever the usage inference saw — a lone off-0 access to `extern u16 tbl[]`
-    // must still spell through the aggregate/array forms, never the bare scalar `tbl`.
+    // Declaration-shape OVERRIDE (symbol map, or the declaration context for a global the map does
+    // not describe): a project-declared array/struct global is an AGGREGATE whatever the usage
+    // inference saw — a lone off-0 access to `extern u16 tbl[]` must still spell through the
+    // aggregate/array forms, never the bare scalar `tbl`.
     // Driven from the FUNCTION's own globals, for the same reason the name minter above consults
     // the map instead of copying it: a name outside `scalarGlobals` has nothing to override.
-    if (symbols) {
-      for (const n of [...scalarGlobals]) {
-        const shape = symbols.get(n)?.shape;
-        if (shape === 'array' || shape === 'struct') {
-          scalarGlobals.delete(n);
-        }
+    for (const n of [...scalarGlobals]) {
+      const shape = symbols?.get(n)?.shape;
+      if (shape === 'array' || shape === 'struct' || contextGlobals?.aggregates.has(n) === true) {
+        scalarGlobals.delete(n);
       }
     }
   }
@@ -2468,162 +2958,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // Symbol-map rendering context (memAccess/arrayAccess): shape lookups + the env registry for
   // array-shaped globals actually referenced (they surface as SFn.globals — typed, undeclared).
   const shapedGlobalTypes = new Map<string, IrType>();
-  const declaredFieldCache = new Map<string, DeclaredField[] | null>();
   const symCtx: SymRenderCtx | undefined = symbols
     ? {
         info: (n) => symbols.get(n),
         noteGlobal: (n, t) => shapedGlobalTypes.set(n, t),
         ptrElements: ptrElementSpellingWanted,
         declRank: declRankSpellingWanted,
-        fieldsOf: (n) => {
-          const hit = declaredFieldCache.get(n);
-          if (hit !== undefined) {
-            return hit;
-          }
-          const si = symbols.get(n);
-          const fields =
-            si?.shape === 'struct'
-              ? declaredFields(si.layout)
-              : si?.shape === 'pointer'
-                ? pointeeFields(si.pointee)
-                : null;
-          declaredFieldCache.set(n, fields);
-          return fields;
-        },
+        fieldsOf: memoFieldsOf((n) => symbols.get(n)),
       }
     : undefined;
 
-  /** The declared shape of a global as the pointer-value rules below read it: the map's, or a
-   *  pointer the map declares to a structuring that does not spell from it (`pointerGlobals`). */
-  const declaredShape = (name: string): SymbolInfo['shape'] =>
-    symCtx?.info(name)?.shape ?? (pointerGlobals?.has(name) ? 'pointer' : undefined);
-  /** Whether no declaration a spelling folds from types the global: the map's is the only one.
-   *  The operand-order rules read this, not declaredShape: a declared pointer keeps `x + (u8 *)p`
-   *  for the element and field spellings to read, and a `pointerGlobals` name has no pointee for
-   *  them, so its sum is spelled in the asm's order like any other undeclared global's. */
-  const mapUndeclared = (name: string): boolean => symCtx?.info(name)?.shape === undefined;
-
-  /** A POINTER VALUE whose type the project's header owns: a bare `gSym` naming a pointer global
-   *  (the VALUE of a pointer cell), or a named MEMBER whose declaration is a pointer (`gSym.pBuf`,
-   *  `gPtr->pBuf`). Load, store and compare of such a 4-byte cell are identical for any
-   *  object-pointer type, so the declared pointee never matters to THEM; arithmetic on the loaded
-   *  value is the opposite case, where the pointee's size scales what is added and every stride
-   *  must therefore be made explicit (`(u8 *)gPtr + K`). `ctype` cannot see any of this: it types
-   *  only params/locals, so both spellings render `undefined` there.
-   *
-   *  A bare global is one when its declared shape is `'pointer'` (declaredShape), or when no
-   *  declaration this pass can read says anything (no map, a symtab-only name, entries that
-   *  disagree and were dropped to the bare name, a name the map lacks) and the IR loads it as a
-   *  pointer at least once. The project still declares it, typically `struct S *`. A map
-   *  `shape:'scalar'` is a declaration and is excluded; so is a global the IR never loads as a
-   *  pointer (`gCount + 1`, or the `u8` index in `gIdx + gItems`), where casting would make a
-   *  pointer of an integer the source added as one. */
-  const isPtrValue = (x: Expr): boolean => {
-    if (x.k !== 'var') {
-      return ptrMemberDecl(x, symCtx) !== null;
-    }
-    const shape = declaredShape(x.name);
-    return shape === 'pointer' || (shape === undefined && pointerLoadedGlobals.has(x.name));
-  };
-
-  /** A global's word VALUE that no declaration this pass can read types, whatever the IR loaded it
-   *  as. */
-  const isUndeclaredGlobalValue = (x: Expr): boolean =>
-    x.k === 'var' && wordLoadedGlobals.has(x.name) && declaredShape(x.name) === undefined;
-
-  /** A pointer value or a global's word as the integer the asm added. A global no declaration
-   *  types and the IR never loads as a pointer may be declared a float, whose value `(u32)g`
-   *  converts, so it goes through `(u8 *)` first: `(u32)(u8 *)g` is `(u32)g`'s bytes under every
-   *  integer and pointer declaration, and no C under a float one. KNOWN GAP: under an array or a
-   *  function declaration `g` decays to its address, which this spells with no diagnostic; only a
-   *  pun reads the word there, and intoDeclaredTemp's KNOWN GAP says why none is spelled. */
-  const globalWord = (x: Expr): Expr => ({
-    k: 'cast',
-    to: T.u(32),
-    e:
-      x.k === 'var' && declaredShape(x.name) === undefined && !pointerLoadedGlobals.has(x.name)
-        ? { k: 'cast', to: T.ptr(T.u(8)), e: x }
-        : x,
-  });
-
-  /** An integer operand with every undeclared global it adds or subtracts made a word as well:
-   *  bare, `a0 + g` is pointer arithmetic under a pointer declaration of g. Other operators reject
-   *  a pointer operand, and a load or a cast types its own value. */
-  const intWords = (x: Expr): Expr =>
-    isUndeclaredGlobalValue(x)
-      ? globalWord(x)
-      : x.k === 'bin' && (x.op === '+' || x.op === '-')
-        ? { ...x, l: intWords(x.l), r: intWords(x.r) }
-        : x;
-
-  /** A byte sum the pointer-value arithmetic rule below made of a global's value (`(u8 *)g + K`),
-   *  and the same sum as the integer it also is (`(u32)g + K`), which an integer added in front of
-   *  it takes. KNOWN GAP: an integer READER of the byte sum converts a pointer to an integer. The
-   *  backend casts it where the reader's type is known (an assignment, a store through a typed
-   *  slot, a return: cfamily `legalizePointerWrites`), and a compare against an integer compares
-   *  it as a `u32`. A call argument and a global no declaration types keep the pointer, which agbcc
-   *  and KMC gcc warn about and CodeWarrior rejects; only a pointer cell's sum passed to a parameter
-   *  the prototype declares an integer is converted (l3/ptrcell.ts). The integer sum is no fix: gcc
-   *  orders a pointer sum's operands and an integer sum's differently, so the bytes differ. */
-  const castGlobal = (x: Expr, undeclared = false): x is Extract<Expr, { k: 'cast' }> =>
-    x.k === 'cast' &&
-    typeEquals(x.to, T.ptr(T.u(8))) &&
-    x.e.k === 'var' &&
-    (isPtrValue(x.e) || isUndeclaredGlobalValue(x.e)) &&
-    (!undeclared || mapUndeclared(x.e.name));
-  /** The integer sum the rule spells in the asm's order instead (`(u32)g + x`), cast back to the
-   *  byte pointer it stands for: `(u8 *)((u32)g + x)`. A byte sum converted whole (byteSumAsInt's
-   *  `(u32)((u8 *)g + x - gB)`) is one of its words. */
-  const intGlobalWord = (x: Expr, undeclared: boolean): boolean =>
-    x.k === 'cast' &&
-    typeEquals(x.to, T.u(32)) &&
-    (castGlobal(x.e, undeclared) ||
-      (x.e.k === 'bin' && isByteGlobalSum(x.e, undeclared)) ||
-      (x.e.k === 'var' &&
-        (isPtrValue(x.e) || isUndeclaredGlobalValue(x.e)) &&
-        (!undeclared || mapUndeclared(x.e.name))));
-  const isIntGlobalSum = (x: Expr, undeclared: boolean): boolean =>
-    x.k === 'bin' &&
-    (x.op === '+' || x.op === '-') &&
-    (intGlobalWord(x.l, undeclared) ||
-      intGlobalWord(x.r, undeclared) ||
-      isIntGlobalSum(x.l, undeclared) ||
-      isIntGlobalSum(x.r, undeclared));
-  const restoredIntSum = (x: Expr, undeclared: boolean): Expr | undefined =>
-    x.k === 'cast' && typeEquals(x.to, T.ptr(T.u(8))) && isIntGlobalSum(x.e, undeclared) ? x.e : undefined;
-  const isByteGlobalSum = (x: Expr, undeclared = false): boolean =>
-    restoredIntSum(x, undeclared) !== undefined ||
-    (x.k === 'bin' &&
-      (x.op === '+' || x.op === '-') &&
-      (castGlobal(x.l, undeclared) ||
-        castGlobal(x.r, undeclared) ||
-        isByteGlobalSum(x.l, undeclared) ||
-        isByteGlobalSum(x.r, undeclared)));
-  /** The integer a byte sum is. Every global it adds bare goes a word with it. A lone global it
-   *  subtracts stays the pointer difference, `(u32)((u8 *)g + x - gB)`: the asm's integer under an
-   *  integer or a byte-pointer declaration of `gB`, and no C under a wider pointer or array, a
-   *  function or a float one, where the word `(u32)(u8 *)gB` would subtract an address. Under a byte
-   *  array it subtracts the array's address: globalWord's KNOWN GAP. A difference has one operand
-   *  order, so the asm's needs no integer sum. A sum of globals it subtracts goes words: bare,
-   *  `gB2 - gB3` is an element count under a wider pointer declaration. */
-  const byteSumAsInt = (x: Expr): Expr =>
-    restoredIntSum(x, false) ??
-    (castGlobal(x)
-      ? globalWord(x.e)
-      : x.k === 'bin' && isByteGlobalSum(x)
-        ? x.op === '-' && isUndeclaredGlobalValue(x.r)
-          ? { k: 'cast', to: T.u(32), e: x }
-          : { ...x, l: byteSumAsInt(x.l), r: byteSumAsInt(x.r) }
-        : intWords(x));
-
-  /** Operands `-`/`~` cannot take as spelled: a rendered pointer, a bare `&gSym`, a pointer
-   *  global's value. All three are ill-formed C under a unary arithmetic operator — the asm did
-   *  32-bit integer math on the address, so that is what gets spelled. */
-  const needsIntSpelling = (x: Expr): boolean => ctype(x)?.kind === 'ptr' || x.k === 'addr' || isPtrValue(x);
-
-  // --- loop discovery (loops.ts): natural loops via dominator back-edges + the nesting forest ---
-  const forest = analyzeLoops(fn, dom);
-
   // GUARDED self-loop headers (a block that is its own successor, entered through a guard-shaped
   // cond_br) — recovered by the guard-fusion + emitWhile un-rotation path below (the gcc "guard +
   // do-while" → `while` shape; countdown/shifts). UNGUARDED self-loops register as single-block
@@ -2715,13 +3059,29 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     [...forest.byHeader.values()].every(
       (l2) => l2.header === nl.header || !nl.body.has(l2.header) || [...l2.body].every((b) => nl.body.has(b)),
     ) && [...nl.body].every((bb) => bb === nl.header || (preds.get(bb) ?? []).every((p) => nl.body.has(p)));
+  // An edge out of `nl` that does not land on `exit` itself, read the one way both the `while` and the
+  // `while (1)` classifiers read it: a `break` that runs `region` first, or an early return whose
+  // tail the loop emits (`owned`). The break arm is asked first: where the code past `exit` is a pure
+  // `return`, `earlyReturnArm` would also take the arm and copy that post-loop `return` into it, where
+  // the asm holds one copy after the loop (two code arms ahead of `return 3;` would lift as `gHit = i;
+  // return 3;` twice, not a `break` each and one `return 3`). The break arm copies nothing past
+  // `exit` — the duplication policy written at `earlyReturnArm`.
+  // `codeArms` is the classifier's own admission of a code-running break; never out of an inner body.
+  const exitArmOf = (nl: NaturalLoop, e: { from: Block; to: Block }, exit: Block, codeArms: boolean) => {
+    const region =
+      codeArms && !innerBodyHas(nl, e.from) ? codeBreakArm(preds, dom, e.from, e.to, nl.body, exit, true) : null;
+    const owned = region === null ? earlyReturnArm({ dom, reachFrom, preds }, e.from, e.to, nl.body, exit) : null;
+    return { region, owned };
+  };
   const whileLoops = new Map<Block, WhileLoopInfo>();
   const doWhileLoops = new Map<Block, DoWhileInfo>();
+  const keptGuardDoWhiles = new Map<Block, DoWhileInfo>();
   for (const nl of forest.byHeader.values()) {
     const h = nl.header;
-    if (nl.selfLoop && loops.has(h)) {
-      continue;
-    } // guarded self-loops use emitWhile (above); UNGUARDED ones are single-block do-whiles
+    // Guarded self-loops use emitWhile (above); UNGUARDED ones are single-block do-whiles. A
+    // guarded one's do-while reading is kept aside all the same (`keptGuardDoWhiles`), for the
+    // guard that emitWhile cannot fuse and then declines.
+    const guarded = nl.selfLoop && loops.has(h);
     if (!nl.selfLoop && nl.latches.length !== 1) {
       continue;
     } // single latch only
@@ -2751,7 +3111,36 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       exit: Block,
       kind: 'while' | 'dowhile',
       bodyEntry: Block | null = null;
-    if (!nl.selfLoop && hTerm.opcode === 'cond_br' && hInBody.length === 1 && hOut.length === 1 && headerPure) {
+    // The header's way out is not the loop's exit when it enters an arm that runs code and then
+    // joins another exit edge (`codeBreakArm`) whose tail has an effect: that arm is a `break`, and
+    // the loop a `while (1)`. Where the tail only returns, the `while` reading copies it into the
+    // other edge as an early `return`, and keeps that spelling — unless the tail is a bare `return`
+    // and the arm itself runs code. gcc2.7.2's `for (i = 0; i < n; i++) { if (t[i] == 7) { gHit = 1;
+    // break; } }` keeps the arm inside a guarded bottom-tested loop, so the arm is the one in the
+    // loop, and a bare `return` copies no code: `while (t[i] != 7) { ...; if (i >= n) return; }
+    // gHit = 1;` is the spelling the bytes do not hold (breaknend_code 21/26 against 4/18).
+    // The arm is asked in shared mode, as `exitArmOf` asks it for `while (1)`: a break whose tail
+    // another arm or an `else` before the loop also enters is a break all the same, and the `while`
+    // reading that took it for the exit would leave the other exit edge with no spelling.
+    const runsEffect = (x: Block) => [x, ...reachFrom(x)].some((y) => !nl.body.has(y) && y.ops.some(effectful));
+    const hOutIsBreakArm =
+      hOut.length === 1 &&
+      nl.exitEdges.some((e) => {
+        if (e.to === hOut[0].block) {
+          return false;
+        }
+        const region = codeBreakArm(preds, dom, h, hOut[0].block, nl.body, e.to, true);
+        const bareReturn = e.to.ops.length === 1 && e.to.ops[0].opcode === 'ret' && e.to.ops[0].operands.length === 0;
+        return region !== null && (runsEffect(e.to) || (bareReturn && [...region].some((y) => y.ops.some(effectful))));
+      });
+    if (
+      !nl.selfLoop &&
+      hTerm.opcode === 'cond_br' &&
+      hInBody.length === 1 &&
+      hOut.length === 1 &&
+      headerPure &&
+      !hOutIsBreakArm
+    ) {
       kind = 'while';
       exitFrom = h;
       exit = hOut[0].block;
@@ -2780,17 +3169,23 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // to know which edges out of the body end an iteration rather than continue it.
     const arms: LoopArm[] = [];
     const breaks = new Set<Block>();
+    const breakArms: BreakArm[] = [];
     let singleExit = true;
     for (const e of nl.exitEdges) {
       if (e.from === exitFrom && e.to === exit) {
         continue;
       }
-      const owned = earlyReturnArm({ dom, reachFrom }, e.from, e.to, nl.body, exit);
+      // a `while` takes a code-running break only into an exit that takes no copies: the header's exit
+      // copies are what `breakRule` shares with a break, and an arm's edge into the exit is not one
+      const { region, owned } = exitArmOf(nl, e, exit, kind === 'while' && exit.params.length === 0);
       if (owned) {
         arms.push({ from: e.from, to: e.to, owned });
       }
       if (kind === 'while' && e.to === exit && !innerBodyHas(nl, e.from)) {
         breaks.add(e.from);
+      } else if (region !== null) {
+        breaks.add(e.from);
+        breakArms.push({ from: e.from, to: e.to, region });
       } else if (!owned && (!isRet(e.to) || (kind === 'dowhile' && e.to === exit))) {
         singleExit = false;
         break;
@@ -2810,9 +3205,17 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         body: nl.body,
         arms,
         breaks,
+        breakArms,
       });
     } else {
-      doWhileLoops.set(h, { header: h, latch, exit, forwardPreds: nl.forwardPreds, body: nl.body, arms });
+      (guarded ? keptGuardDoWhiles : doWhileLoops).set(h, {
+        header: h,
+        latch,
+        exit,
+        forwardPreds: nl.forwardPreds,
+        body: nl.body,
+        arms,
+      });
     }
   }
 
@@ -2828,21 +3231,42 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // that `return` for the break and the code after the loop for an early return.
   const foreverLoops = new Map<Block, ForeverLoopInfo>();
   const foreverShape = (nl: NaturalLoop): ForeverLoopInfo | null => {
+    // NO EDGE LEAVES: the loop never ends, and C spells that `while (1)` with no `break` and nothing
+    // after it. A block laid out past the loop is reached from elsewhere or not at all, and the
+    // region holding the loop ends at the loop either way (`emitForever`).
+    if (nl.exitEdges.length === 0) {
+      return {
+        header: nl.header,
+        latches: nl.latches,
+        forwardPreds: nl.forwardPreds,
+        exit: null,
+        body: nl.body,
+        arms: [],
+        breaks: new Set(),
+        breakArms: [],
+      };
+    }
     const last = Math.max(...[...nl.body].map((b) => fn.blocks.indexOf(b)));
     const rank = (x: Block) => fn.blocks.indexOf(x) + (fn.blocks.indexOf(x) > last ? 0 : fn.blocks.length);
     const targets = [...new Set(nl.exitEdges.map((e) => e.to))].sort((x, y) => rank(x) - rank(y));
     for (const exit of targets) {
       const arms: LoopArm[] = [];
       const breaks = new Set<Block>();
+      const breakArms: BreakArm[] = [];
       const fits = nl.exitEdges.every((e) => {
         if (e.to === exit) {
           breaks.add(e.from);
           return !innerBodyHas(nl, e.from);
         }
-        const owned = earlyReturnArm({ dom, reachFrom }, e.from, e.to, nl.body, exit);
+        const { region, owned } = exitArmOf(nl, e, exit, true);
         if (owned) {
           arms.push({ from: e.from, to: e.to, owned });
         }
+        if (region !== null) {
+          breaks.add(e.from);
+          breakArms.push({ from: e.from, to: e.to, region });
+          return true;
+        }
         // a `ret` target the edge does not own is copied into the body where the edge leaves, so it
         // must hold nothing a second copy would run twice in the source
         return owned !== null || (isRet(e.to) && !e.to.ops.some(effectful));
@@ -2856,6 +3280,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           body: nl.body,
           arms,
           breaks,
+          breakArms,
         };
       }
     }
@@ -2900,85 +3325,33 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   const vtEnv = (n: string): IrType | undefined => varType.get(n);
   const ctype = (e0: Expr): IrType | undefined => exprCType(e0, vtEnv);
 
-  /** A value assigned into a TEMP THIS PASS DECLARES, spelled so the assignment is legal against
-   *  that declaration. Two inhabitants, one argument: the value's type comes from somewhere this
-   *  pass does not control, and the temp's comes from here.
-   *
-   *  `&gSym` assigned to a `T *` local: the address of an AGGREGATE is not a pointer to its
-   *  element. `&gArr` is `T (*)[n]`, `&gStruct` is `struct S *`, and neither is assignable to
-   *  `T *` — yet the IR's `gaddr` value legitimately has type `T *`, because that is what the asm
-   *  loaded. The bare spelling therefore states a type the project's own header contradicts.
-   *
-   *  It survived because agbcc only WARNS ("assignment from incompatible pointer type") and
-   *  computes the right address anyway. That leniency is not something to rely on: the Klonoa
-   *  project's own build template treats these as fatal, so the row's emitted C does not build
-   *  where its author would put it. The cast is the always-valid spelling — the same fallback
-   *  `bareArrayLead` documents for the indexed form — and it is byte-identical, so no benchmark row
-   *  moves either way and the rule that decides it is pinned in test/deref-typing.test.ts instead.
-   *
-   *  The test is whether `&gSym`'s rendered type PROVABLY equals the destination's, not whether the
-   *  symbol looks like an aggregate. A SHAPE ENUMERATION MISSES THREE WAYS, each real:
-   *  `shape:'pointer'` declares a pointer cell (`void *gSym`, or `struct Tag *gSym` when the pointee
-   *  has a declarable layout), so `&gSym` is a pointer-to-pointer either way; a `shape:'scalar'`
-   *  whose width differs from the destination's pointee gives `s32 *` for a `u16 *` slot; and a
-   *  NAME-ONLY symbol is synthesized as `extern u32 gSym;` (declare.ts), which is `u32 *`. So the
-   *  default is to CAST, and the cast is omitted only
-   *  where the declared cell type is known and matches exactly. Byte-identical either way, so the
-   *  cost of casting one time too many is a redundant `(T *)`, never a wrong address. */
-  const intoDeclaredTemp = (name: string, value: Expr): Expr => {
-    const t = varType.get(name);
-    if (t === undefined) {
-      return value;
-    }
-    // ── pointer values whose type this side of the program does not own ────────────────────────
-    // A `gaddr` at least states a type the IR knows. `gSym.pBuf` and a pointer global's own value
-    // (isPtrValue) state one only the project's header knows, and `ctype` — which types params and
-    // locals — reads them as `undefined`, so the test above cannot see them at all. Assigning one
-    // bare declares that the temp's type and the project's declaration of that pointer are the
-    // same type, which nothing here established: the project's header says
-    // `struct Unk_03005284 *` where the recovered temp says `struct Struct0 *`, and `-Werror` makes
-    // the mismatch fatal in the tree the source is pasted into. The destination's type is the one
-    // this pass DID choose, so unlike the map-declared cells below it can be named exactly rather
-    // than defused through `void *`. That holds for an INTEGER temp too, and there the diagnostic
-    // is the mirror one, `assignment makes integer from pointer without a cast` — same site, same
-    // argument, same `(T)` answer.
-    //
-    // A value that RENDERS a pointer of another type is the same assignment with its type in plain
-    // sight: the byte arithmetic below spells `(u8 *)gPtr + 3544` and `(u8 *)a0 + 2` for the
-    // address alone, and a `u16 *` or `s32 *` temp takes neither without the cast.
-    //
-    // KNOWN GAP: a global no declaration types, read at offset 0 only, may be declared an ARRAY
-    // (`u16 *gArr[4]`, the asm reading `gArr[0]`). Its value spelling is then the array's address,
-    // and this cast compiles that wrong value with no diagnostic, where the bare value keeps
-    // agbcc's `incompatible pointer type`, fatal under -Werror. The cast is load-bearing all the
-    // same: a substitution variation (`/unmerge`) carries the temp's value into the arithmetic it
-    // feeds, and bare, that arithmetic scales by the declared pointee. A pun, `*(T *)&gArr`, is no
-    // fix: where the declaration is not exactly T it loses gcc's fold of the read (agbcc
-    // c-typeck.c), it drops a `volatile` declaration's qualifier, and agbcc's strict aliasing at
-    // -O2 moves it past a store through the declared type.
-    const vt = ctype(value);
-    if (isPtrValue(value) || (vt?.kind === 'ptr' && !typeEquals(vt, t))) {
-      return { k: 'cast', to: t, e: value };
-    }
-    if (t.kind !== 'ptr' || value.k !== 'addr') {
-      return value;
-    }
-    // The only provably-redundant case: a NON-VOLATILE scalar cell whose DECLARED type is the
-    // destination's pointee, where `&gSym` already denotes exactly `T *`.
-    //
-    // `scalarCellType` and not `scalarTypeForAccess`: the latter answers what an ACCESS of that
-    // width reads and collapses every 4-byte access to `s32`, so it called a `u32` cell equal to an
-    // `s32 *` destination and let the incompatible assignment through. And a `volatile` cell makes
-    // `&gSym` a `volatile T *`, so omitting the cast would DISCARD the qualifier — the same class of
-    // fatal-under-a-strict-build defect this rule exists to remove.
-    const si = symCtx?.info(value.name);
-    if (si?.shape === 'scalar' && !si.volatile && isScalarCellSize(si.size)) {
-      if (typeEquals(scalarCellType(si.size, si.signed), t.to)) {
-        return value;
-      }
-    }
-    return { k: 'cast', to: t, e: value };
-  };
+  // ── POINTER/INTEGER spelling (structure/pointer-spelling.ts) ────────────────────────────────
+  // Whether an operand, a temp's value or a pointer cell's value is written as a pointer or as an
+  // integer, and through which cast. `varType` and `varName` are read live: the naming below is
+  // still declaring temps.
+  const {
+    pointerGlobal,
+    castsIntoGlobal,
+    needsIntSpelling,
+    intoDeclaredTemp,
+    intoPtrCell,
+    arith: spellArith,
+  } = makePointerSpelling({
+    sym: symCtx,
+    pointerGlobals,
+    pointerLoadedGlobals,
+    wordLoadedGlobals,
+    scalarGlobals,
+    varType,
+    compiler: opts,
+    strictPointerConversions,
+    ...(dialect !== undefined ? { dialect } : {}),
+    refuse: (why) => {
+      throw new StructureError(`cannot structure '${fn.name}': ${why}`);
+    },
+    useSitesOf,
+    isNamed: (v) => varName.has(v),
+  });
 
   let fresh = 0;
   // Materialized defs are named FIRST: the temp is the register the compiler held the
@@ -3688,6 +4061,36 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     }
   }
 
+  // ── a temp holding a pointer global's value, summed with `x + K`, is a byte pointer ──────────
+  // (pointer-spelling.ts `declaresBytePointer` says when.) Decided over every value under the name
+  // once the names are settled, so a name that also holds anything else keeps its integer.
+  if (keepsPointerSumAddend) {
+    const inArgs = (v: Value): Value[] | undefined => {
+      const b = paramBlock.get(v);
+      if (b === undefined || entryParams.has(v)) {
+        return undefined;
+      }
+      const i = b.params.indexOf(v);
+      return [...inEdgeRecords(preds, b)].map(({ succ }) => succ.args[i]);
+    };
+    const ir = {
+      defOf: (v: Value) => defs.get(v),
+      inArgs,
+      usesOf: (v: Value) => (useSitesOf.get(v) ?? []).map((u) => u.op),
+      isNamed: (v: Value) => varName.has(v),
+    };
+    const holders = new Map<string, Value[]>();
+    for (const [v, n] of [...varName, ...backArgName]) {
+      (holders.get(n) ?? holders.set(n, []).get(n)!).push(v);
+    }
+    for (const [n, vs] of holders) {
+      const t = varType.get(n);
+      if (t?.kind === 'int' && t.width === 32 && declaresBytePointer(vs, ir, { pointerGlobal, castsIntoGlobal })) {
+        varType.set(n, T.ptr(T.u(8)));
+      }
+    }
+  }
+
   // ── def-site anchoring of constant merge copies (anchorConstCopies) ──────────────────────────
   // An edge copy `v = K` places the constant where the EDGE is, but the asm often materialized K
   // earlier: `movs r9, #0` at entry ahead of a single-armed overwrite, `movs r5, #1` at the top
@@ -3762,7 +4165,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // entry consts anchored at their own def sites would still order correctly, and this refuses
     // the shape rather than reasoning about it. The other half of "entered only through its
     // header" needs no test — `analyzeLoops` builds the body as the backward closure from the
-    // latches with the header already in it (loops.ts), so a body block's predecessors are all in
+    // latches with the header already in it (ir/loops.ts), so a body block's predecessors are all in
     // the body by construction.
     const singleEntry = (nl: NaturalLoop): boolean => nl.forwardPreds.length === 1;
     for (const M of fn.blocks) {
@@ -3891,12 +4294,70 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // hoist. It carries it where ir/discipline.ts `qualifiedBy` says: on its cast, or through the
   // object's declaration and on its cast where it reaches the object through one, since a cast's
   // pointee drops the declaration's qualifiers.
+  //
+  // Whether a cast stands between the access and the object is the PRINTER's question
+  // (backend/cfamily.ts `legalizedIndexBase`), so it is asked of the env the printer judges by:
+  // the declared variables over the globals this structuring typed for the tree (`SFn.globals`,
+  // l3/typing.ts `declaredTypes`). Asked of the variables alone, a global subscript the printer
+  // spells through its own name (`gVA[i]`, already volatile by its declaration) reads as one it
+  // casts, and the qualified cast agbcc compiles differently is put on a name that needed none.
+  const printedType = (n: string): IrType | undefined => varType.get(n) ?? shapedGlobalTypes.get(n);
+  const printedCType = (e0: Expr): IrType | undefined => exprCType(e0, printedType);
+  // A declared access reaches its object through the declaration only where its address is spelled
+  // from the object's own name. Through a local or a parameter — a pointer one of two addresses of
+  // the object joined into, or one a loop steps through it — the declaration qualifies nothing, and
+  // the qualifier goes on a cast.
+  const throughLocal = (access: Expr): boolean => {
+    let b: Expr | undefined = access.k === 'index' || access.k === 'field' ? access.base : undefined;
+    while (b !== undefined) {
+      if (b.k === 'var') {
+        return varType.has(b.name);
+      }
+      if (b.k === 'index' || b.k === 'field') {
+        b = b.base;
+      } else if (b.k === 'cast') {
+        b = b.e;
+      } else if (b.k === 'bin' && (b.op === '+' || b.op === '-')) {
+        b = b.l.k === 'const' ? b.r : b.l;
+      } else {
+        return false;
+      }
+    }
+    return false;
+  };
   const pinnedAccess = (op: Op, access: Expr): Expr => {
     const by = qualifiedBy(op);
-    if (by === null || (by === 'declaration' && !castOffDeclaration(access, ctype))) {
+    if (by === null || (by === 'declaration' && !castOffDeclaration(access, printedCType) && !throughLocal(access))) {
       return access;
     }
-    const q = qualifiedMemoryAccess(access, ctype);
+    // A bare global's declaration owns its qualifiers. Where the project declares the name — the map
+    // knows it, or a declaration context is in play — a declaration that qualified it would have
+    // placed the access `declared`, so one the lift qualified by a CAST (`device`:
+    // frontend/dead-reads.ts, frontend/device-pins.ts) is declared plain there, and `gR;` compiles
+    // to no read at all: the cast goes on the object's address. A name nothing declares gets the
+    // synthesized declaration, which carries the qualifier (rank-declare.ts `bareGlobalSymbols`),
+    // and keeps the bare spelling — on gcc 2.7.2 the cast compiles to another address sequence.
+    if (
+      by === 'cast' &&
+      access.k === 'var' &&
+      (mapSymbols?.has(access.name) === true || contextGlobals !== undefined)
+    ) {
+      const width = op.attrs.width as number;
+      const signed = op.attrs.signed === true;
+      return {
+        k: 'index',
+        base: {
+          k: 'cast',
+          to: T.ptr(scalarTypeForAccess(width, signed)),
+          volatile: true,
+          e: { k: 'addr', name: access.name },
+        },
+        idx: { k: 'const', value: 0 },
+        width,
+        signed,
+      };
+    }
+    const q = qualifiedMemoryAccess(access, printedCType);
     if (q === null) {
       throw new StructureError(
         `cannot structure '${fn.name}': a ${placedAt(op)} ${op.opcode} that must stay volatile is reached through a ` +
@@ -3906,46 +4367,248 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     return q;
   };
 
-  // Lower ONE def's operation to an Expr, rendering operands through `e`. Shared between the
-  // inline-at-use path (exprWith) and the materialized-temp path (sideEffects), so both spell a
-  // given op identically.
-  const lowerDef = (d: Op, e: (v: Value) => Expr): Expr => {
-    if (d.opcode === 'const') {
-      return { k: 'const', value: d.attrs.value as number };
+  // A FRAME OBJECT DECLARED AS A UNION (`laddrType`) is read and written through the view of each
+  // access's own width and extension — `sp0.half[1]`, `sp0.word[0]` — on the object itself, never
+  // through a cast on its storage: a cast there is the spelling agbcc may read stale, and the
+  // union is declared because it does not. The audit admitted only accesses at a fixed offset on
+  // the object and aligned to their own width (frame-objects.ts `unionRefusal`), so a view names
+  // each one; an access with none is an internal error, not a decline to fall back from.
+  const frameUnionAccess = (base: Value, off: number, width: number, signed: boolean, isStore: boolean) => {
+    const d = defs.get(base);
+    if (d?.opcode !== 'laddr' || d.attrs.views === undefined) {
+      return null;
     }
-    if (d.opcode === 'fconst') {
-      return { k: 'fconst', bits: d.attrs.bits as string };
+    const u = laddrType(d);
+    const { view, index } =
+      u.kind === 'union' ? unionView(u, off, width, signed, isStore) : { view: undefined, index: null };
+    if (view === undefined || off % width !== 0) {
+      throw new Error(
+        `internal: a ${width}-byte ${isStore ? 'store' : 'load'} at byte ${off} of the frame union '${laddrName.get(d)}' has no view`,
+      );
     }
-    // a bitfield extract recognized over the ops (see the precompute above): the member read,
-    // not the shift pair
-    const bf = bitfieldSpelling.get(d);
-    if (bf) {
-      return { k: 'field', base: { k: 'var', name: bf.global }, name: bf.field, dot: true };
+    const cell: Expr = { k: 'field', base: { k: 'var', name: laddrName.get(d)! }, name: view.name, dot: true };
+    return index === null
+      ? cell
+      : ({ k: 'index', base: cell, idx: { k: 'const', value: index }, width, signed, subscript: true } as const);
+  };
+  // A FRAME OBJECT DECLARED AS A STRUCT (a call's return storage or a struct passed by value,
+  // `laddrType`) is read and written through the member an access names exactly — its offset, its
+  // width, and the type the cast it replaces would spell (`spellsAccessType`, a load's alone: a
+  // store truncates to the member's bytes whatever their type); any other access keeps the cast.
+  // Unqualified only: a qualified access keeps the cast its qualifier goes on.
+  const frameStructMember = (op: Op, off: number, width: number, signed: boolean | null): Expr | null => {
+    const d = defs.get(op.operands[0]);
+    const t = d?.results[0].type;
+    if (d?.opcode !== 'laddr' || d.attrs.aggregate !== true || t?.kind !== 'ptr' || t.to.kind !== 'struct') {
+      return null;
     }
-    if (FLOAT_TO_BIN[d.opcode]) {
-      return { k: 'bin', op: FLOAT_TO_BIN[d.opcode], l: e(d.operands[0]), r: e(d.operands[1]) };
+    const f = t.to.fields.find((m) => m.off === off);
+    if (f === undefined || f.type.kind !== 'int' || f.type.width !== width * 8 || qualifiedBy(op) !== null) {
+      return null;
     }
-    if (d.opcode === 'fneg') {
-      return { k: 'un', op: 'f-', e: e(d.operands[0]) };
+    return signed === null || spellsAccessType(f.type.signed, width, signed)
+      ? { k: 'field', base: { k: 'var', name: laddrName.get(d)! }, name: f.name, dot: true }
+      : null;
+  };
+  // A PART OF THE ONE FRAME OBJECT a copy proved one object of the source's (frame-objects.ts
+  // `provenParts`, stamped `part`) is read and written through the element an access names exactly
+  // — at a whole element, inside the array, of the element's width, and of the type the cast it
+  // replaces would spell (a load's alone, as for a struct member) — `sp16[5]`, not
+  // `((u8 *)sp16)[5]`. The two are one C value, and not one compile: with a second array at sp+16
+  // whose address agbcc already holds for its `memcpy`, `b[5]` reads `ldrb [r4, #0x5]` through it
+  // while the cast re-forms `sp + 0x15`. Only a part: the one object's bytes are members and spills
+  // of any type, which the cast spells honestly, and a lone array at sp+0 compiles the same either
+  // way. Unqualified only, like the member.
+  const frameArrayElement = (op: Op, off: number, width: number, signed: boolean | null): Expr | null => {
+    const d = defs.get(op.operands[0]);
+    if (d?.opcode !== 'laddr' || d.attrs.part !== true || d.attrs.views !== undefined) {
+      return null;
     }
-    if (CMP_TO_BIN[d.opcode]) {
-      // A bare global address `&gSym` as a COMPARISON operand is the same unspelled escape as the
-      // arithmetic case below (see intifyAddr): its C type comes from the PROJECT's own
-      // declaration, unknowable here. Worse, the compare's SIGNEDNESS lives in the operand types
-      // (CMP_TO_BIN maps icmp_ult and icmp_slt to the same '<'), so leaving `&gSym` untyped lets
-      // the project's declaration pick the compare the compiler emits — silently byte-inexact
-      // whenever it disagrees with the asm. The honest spelling is integer math on the address
-      // with the cast AGREEING with the opcode's signedness: unsigned compares (and the
-      // sign-agnostic ==/!=) spell `(u32)&gSym`, signed compares `(s32)&gSym` — exactly the
-      // compare the asm did. The deref folds never see a compare operand, so no named spelling is
-      // lost; a NARROWING cast (`(u8)&gSym`) is not a bare `addr` and keeps its truncation.
-      // SCOPE: this handles BARE addr operands. An addr-carrying arithmetic tree
-      // (`(u32)&gSym + 4`, spelled by intifyAddr below) renders unsigned and would compare
-      // unsigned under an icmp_s*; the signed operand pin at the end of this block catches it as
-      // one case of the general rule, needing no addr-specific reasoning.
-      const t = /^icmp_s/.test(d.opcode) ? T.s(32) : T.u(32);
-      const intifyAddrCmp = (x: Expr): Expr => (x.k === 'addr' ? { k: 'cast', to: t, e: x } : x);
-      let l = intifyAddrCmp(e(d.operands[0]));
+    const t = laddrType(d);
+    if (t.kind !== 'array' || t.elem.kind !== 'int' || t.elem.width !== width * 8 || qualifiedBy(op) !== null) {
+      return null;
+    }
+    if (off < 0 || off % width !== 0 || off / width >= (d.attrs.count as number)) {
+      return null;
+    }
+    return signed === null || spellsAccessType(t.elem.signed, width, signed)
+      ? {
+          k: 'index',
+          base: { k: 'var', name: laddrName.get(d)! },
+          idx: { k: 'const', value: off / width },
+          width,
+          signed: t.elem.signed,
+          subscript: true,
+        }
+      : null;
+  };
+  // A FLOATING MEMBER READ AS ITS INTEGER BITS is spelled `*(s32 *)&s`, which C converts wherever
+  // a float is what the reader takes (`gF = *(s32 *)&s;` against `float gF` is `bl __floatsisf` on
+  // agbcc, a `cvt` on MIPS), which the bytes never did. So such a read is spelled only where every
+  // reader is a store into an lvalue whose integer type this lift states (`floatBitsStoreTarget`):
+  // a whole-struct copy lowered to words, `((s32 *)&gV3)[1] = ((s32 *)&s)[1];`, passes the bits
+  // through. Any other reader (a named global, a declared member, a call, a return, a join)
+  // declines. A store of bits into such a member is the bits, and keeps the cast.
+  const floatMemberBits = (op: Op): { name: string; width: number } | null => {
+    if (op.opcode !== 'load') {
+      return null;
+    }
+    const width = op.attrs.width as number;
+    const t = defs.get(op.operands[0])?.results[0].type;
+    const f = t?.kind === 'ptr' && t.to.kind === 'struct' ? t.to.fields.find((m) => m.off === op.attrs.off) : undefined;
+    return f?.type.kind === 'float' && f.type.width === width * 8 ? { name: f.name, width } : null;
+  };
+  const refuseFloatBits = (m: { name: string; width: number }): never => {
+    throw new StructureError(
+      `a ${m.width}-byte read of the floating member '${m.name}' of a struct local is an integer here, and C ` +
+        'would convert it where a float is read — not modelled',
+    );
+  };
+  const refuseFloatMemberRead = (op: Op): void => {
+    const m = floatMemberBits(op);
+    const v = op.results[0];
+    const storedOnly = (useSitesOf.get(v) ?? []).every(
+      ({ op: u }) =>
+        (u.opcode === 'store' && u.operands[1] === v && u.operands[0] !== v) ||
+        (u.opcode === 'astore' && u.operands[2] === v && u.operands[0] !== v && u.operands[1] !== v),
+    );
+    if (m !== null && !storedOnly) {
+      refuseFloatBits(m);
+    }
+  };
+  // …and the store side: the lvalue must be one whose type the lift spells, an integer of the
+  // read's width: a cast cell (`((s32 *)&g)[1]`), or a local's or a parameter's cell. A bare global
+  // (`gF = …`, `gA[i] = …`) has the project's type, whatever that is.
+  const floatBitsStoreTarget = (value: Value, lval: Expr): void => {
+    const d = defs.get(value);
+    const m = d === undefined ? null : floatMemberBits(d);
+    if (m === null) {
+      return;
+    }
+    let root: Expr = lval;
+    while (root.k === 'index' || root.k === 'field') {
+      root = root.base;
+    }
+    const t = ctype(lval);
+    const own = root.k !== 'var' || varType.has(root.name);
+    if (!own || (lval.k !== 'index' && lval.k !== 'field') || t?.kind !== 'int' || t.width !== m.width * 8) {
+      refuseFloatBits(m);
+    }
+  };
+  // A STRUCT LOCAL'S BYTES STORED INTO A BARE ARRAY ELEMENT keep the cast cell. The bare `gA[i]`
+  // (globalaccess.ts `bareArrayLead`) checks the element's width, not its kind, and the bytes of
+  // `gA[i] = mk(x);` over `struct S gA[4]` are the bytes of a scalar array's store: `gA[a1] =
+  // *(s32 *)&mk_ret;` assigns an int to the struct element (agbcc: incompatible types in
+  // assignment). `((s32 *)&gA)[a1]` addresses the same bytes under any declaration. A recovered row
+  // subscript (`gA[r][i]`) has no flat index here to put in the cell, so it declines.
+  // ONLY an array-declared symbol: a store through a POINTER global's value (`gIP[i] = s.x`) has
+  // the same `var` base, and `&gIP` would address the pointer variable, not its pointee.
+  const structBytesCell = (value: Value, lval: Expr): Expr => {
+    const d = defs.get(value);
+    const local = d?.opcode === 'load' ? defs.get(d.operands[0]) : undefined;
+    const t = local?.results[0].type;
+    const fromStruct = local?.opcode === 'laddr' && t?.kind === 'ptr' && t.to.kind === 'struct';
+    if (
+      !fromStruct ||
+      lval.k !== 'index' ||
+      lval.base.k !== 'var' ||
+      varType.has(lval.base.name) ||
+      symCtx?.info(lval.base.name)?.shape !== 'array'
+    ) {
+      return lval;
+    }
+    if (lval.lead?.some((l) => l.k !== 'const' || l.value !== 0)) {
+      throw new StructureError(
+        `a struct local's bytes stored into an element of '${lval.base.name}' by a row subscript have no cast cell to spell`,
+      );
+    }
+    const { lead: _lead, ...cell } = lval;
+    return { ...cell, base: { k: 'addr', name: lval.base.name } };
+  };
+  // …and with no qualifier: `pinnedAccess` would put one on through a cast, the very spelling, and
+  // the audit refuses the union where its accesses would need one (`unionRefusal`)
+  const unqualifiedView = (op: Op, viewed: Expr): Expr => {
+    if (qualifiedBy(op) !== null) {
+      throw new Error(
+        `internal: '${fn.name}': a ${placedAt(op)} ${op.opcode} on a frame union must stay volatile, ` +
+          'which no view of the union carries',
+      );
+    }
+    return viewed;
+  };
+
+  // Lower ONE def's operation to an Expr, rendering operands through `e`. Shared between the
+  // inline-at-use path (exprWith) and the materialized-temp path (sideEffects), so both spell a
+  // given op identically.
+  const lowerDef = (d: Op, e: (v: Value) => Expr): Expr => {
+    if (d.opcode === 'const') {
+      return { k: 'const', value: d.attrs.value as number };
+    }
+    if (d.opcode === 'fconst') {
+      return { k: 'fconst', bits: d.attrs.bits as string };
+    }
+    // a bitfield extract recognized over the ops (see the precompute above): the member read,
+    // not the shift pair
+    const bf = bitfieldSpelling.get(d);
+    if (bf) {
+      return { k: 'field', base: { k: 'var', name: bf.global }, name: bf.field, dot: true };
+    }
+    if (FLOAT_TO_BIN[d.opcode]) {
+      return { k: 'bin', op: FLOAT_TO_BIN[d.opcode], l: e(d.operands[0]), r: e(d.operands[1]) };
+    }
+    if (d.opcode === 'fneg') {
+      return { k: 'un', op: 'f-', e: e(d.operands[0]) };
+    }
+    if (FCMP_TO_BIN[d.opcode] || FCMP_TO_BIN[NEGATED_FCMP[d.opcode] ?? '']) {
+      const op = FCMP_TO_BIN[d.opcode] ?? FCMP_TO_BIN[NEGATED_FCMP[d.opcode]];
+      const spelled = typeof d.attrs.relation === 'string' ? FCMP_TO_BIN[d.attrs.relation] : undefined;
+      const rel: Expr = {
+        k: 'bin',
+        op,
+        l: e(d.operands[0]),
+        r: e(d.operands[1]),
+        ...(spelled !== undefined ? { helperRel: spelled } : {}),
+      };
+      return FCMP_TO_BIN[d.opcode] ? rel : { k: 'un', op: '!', e: rel };
+    }
+    // A conversion is C's cast to the type it converts to. Converting an integer, the cast's
+    // operand must BE signed, because C converts an unsigned one with the unsigned conversion,
+    // which agbcc open-codes and an FPU computes differently: the pin `icmp_s*` takes below. A cast
+    // does not promote its operand, so a `u8` or `u16` name is unsigned here, where it would
+    // promote to `int` in arithmetic: agbcc compiles `(float)c` over an `unsigned char` as the
+    // unsigned conversion and `(float)(s32)c` as `__floatsisf`.
+    if (FLOAT_TO_INT.has(d.opcode)) {
+      const w = intWidth(d.results[0].type) === WIDE_BITS ? WIDE_BITS : 32;
+      return { k: 'cast', to: T.int(w, d.opcode === 'fptosi'), e: e(d.operands[0]) };
+    }
+    if (INT_TO_FLOAT.has(d.opcode)) {
+      const x = e(d.operands[0]);
+      const own = ['var', 'postincr', 'cast', 'index', 'field'].includes(x.k) ? exprCType(x, vtEnv) : undefined;
+      const isSigned = own?.kind === 'int' && own.width < 32 ? own.signed : renderedIntSignedness(x, vtEnv) === true;
+      const signed: Expr = isSigned ? x : { k: 'cast', to: T.s(exprIntWidth(x, vtEnv)), e: x };
+      return { k: 'cast', to: d.results[0].type, e: signed };
+    }
+    if (FLOAT_RESIZE[d.opcode]) {
+      return { k: 'cast', to: d.results[0].type, e: e(d.operands[0]) };
+    }
+    if (CMP_TO_BIN[d.opcode]) {
+      // A bare global address `&gSym` as a COMPARISON operand is the same unspelled escape as the
+      // arithmetic case (pointer-spelling.ts ARITH_ROWS): its C type comes from the PROJECT's own
+      // declaration, unknowable here. Worse, the compare's SIGNEDNESS lives in the operand types
+      // (CMP_TO_BIN maps icmp_ult and icmp_slt to the same '<'), so leaving `&gSym` untyped lets
+      // the project's declaration pick the compare the compiler emits — silently byte-inexact
+      // whenever it disagrees with the asm. The honest spelling is integer math on the address
+      // with the cast AGREEING with the opcode's signedness: unsigned compares (and the
+      // sign-agnostic ==/!=) spell `(u32)&gSym`, signed compares `(s32)&gSym` — exactly the
+      // compare the asm did. The deref folds never see a compare operand, so no named spelling is
+      // lost; a NARROWING cast (`(u8)&gSym`) is not a bare `addr` and keeps its truncation.
+      // SCOPE: this handles BARE addr operands. An addr-carrying arithmetic tree
+      // (`(u32)&gSym + 4`, spelled by the arithmetic table) renders unsigned and would compare
+      // unsigned under an icmp_s*; the signed operand pin at the end of this block catches it as
+      // one case of the general rule, needing no addr-specific reasoning.
+      const t = /^icmp_s/.test(d.opcode) ? T.s(32) : T.u(32);
+      const intifyAddrCmp = (x: Expr): Expr => (x.k === 'addr' ? { k: 'cast', to: t, e: x } : x);
+      let l = intifyAddrCmp(e(d.operands[0]));
       let r = intifyAddrCmp(e(d.operands[1]));
       // The same signedness hole for ORDINARY operands: an icmp_u* whose operands both render
       // as signed-promoting C (an s32-declared var carrying a u32 value — declarations take the
@@ -3964,15 +4627,14 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         const t2 = ctype(x);
         return t2?.kind === 'ptr' || t2?.kind === 'array';
       };
-      if (
-        unsignedCompareSpelling &&
-        /^icmp_u/.test(d.opcode) &&
-        !ptrSide(l) &&
-        !ptrSide(r) &&
-        renderedIntSignedness(l, vtEnv) !== false &&
-        renderedIntSignedness(r, vtEnv) !== false &&
-        !(provablyNonNegative(l, vtEnv) && provablyNonNegative(r, vtEnv))
-      ) {
+      // `pinned` places the cast (l3/typing.ts `spelledNonNegative`). Whether an uncast spelling
+      // compares different values is not decided here: the compare carries `unsignedCmp` evidence,
+      // and rank.ts asks `signedOverUnsignedCompare` of the finished tree, after every pass that
+      // could substitute into it. The two differ on an `|`/`^` of non-negative sides, which stays
+      // pinned (the pin is codegen-visible) and owes no proof uncast.
+      const unsignedOrdering = /^icmp_u(lt|le|gt|ge)$/.test(d.opcode);
+      const pinned = /^icmp_u/.test(d.opcode) && rendersSignedOverUnsigned(l, r, vtEnv, spelledNonNegative);
+      if (pinned && unsignedCompareSpelling) {
         const irUnsigned = (v: Value): boolean => v.type.kind === 'int' && !v.type.signed;
         // AT THE OPERAND'S OWN RANK: `(u32)a` over a 64-bit `a` pins nothing, it truncates the
         // compare to its low half. `exprIntWidth` is total and answers 64 only where it proves it.
@@ -4020,298 +4682,11 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           r = { k: 'cast', to: T.u(32), e: r };
         }
       }
-      return { k: 'bin', op: CMP_TO_BIN[d.opcode], l, r };
+      return { k: 'bin', op: CMP_TO_BIN[d.opcode], l, r, ...(unsignedOrdering ? { unsignedCmp: true as const } : {}) };
     }
     if (ARITH_TO_BIN[d.opcode]) {
-      let l = e(d.operands[0]);
-      let r = d.operands.length === 2 ? e(d.operands[1]) : ({ k: 'const', value: d.attrs.imm as number } as Expr);
-      // Commutative LOAD-PAIR operands re-spell in EVALUATION order. A commutative instruction's
-      // operand order is an allocator artifact (`mul r0, r0, r2` reads dst-first, so the lift's
-      // l/r is whichever load landed in the dst), but the order the compiler EVALUATED the
-      // operands is still visible: their defs' order in the instruction stream. gcc 2.9 and IDO
-      // both emit `w * h`'s loads w-first, so def order IS source order — verified byte-identical
-      // on both (the bg_area rows). Scope, one gate per way the signal fails: BOTH root defs must
-      // be same-block memory reads (a const already has its side; arithmetic defs get combined
-      // out of source order — an ldmia-fed add reads def-reordered; cross-block positions do not
-      // order evaluation), neither stamped `listOrder` (an ldmia-expanded load's own position is
-      // LIST order), both operand VALUES un-named (see below), no pointer side (load-bearing for
-      // the stride rules below), and no effect moves (call, marker). A global's value that the
-      // pointer-value rule below spells as a base is a pointer side too, though `ctype` types no
-      // global: that rule keeps the add's operand order, which a swap here would undo.
-      const ptrGlobalSide = (x: Expr): boolean =>
-        x.k === 'var' &&
-        mapUndeclared(x.name) &&
-        (pointerLoadedGlobals.has(x.name) || (d.results[0]?.type.kind === 'ptr' && wordLoadedGlobals.has(x.name)));
-      if (COMMUTATIVE_BIN.has(ARITH_TO_BIN[d.opcode]) && d.operands.length === 2) {
-        const [da, db] = [defs.get(d.operands[0]), defs.get(d.operands[1])];
-        if (
-          defOrderLoadPairs &&
-          da &&
-          db &&
-          (da.opcode === 'load' || da.opcode === 'aload') &&
-          (db.opcode === 'load' || db.opcode === 'aload') &&
-          da.attrs.listOrder !== true &&
-          db.attrs.listOrder !== true &&
-          // NAMED values decline: a value that renders as a name here — a materialized def
-          // (varName), a loop-carried value in a post-loop region (activeSub) — was evaluated at
-          // its def statement, so re-ordering the reference re-orders nothing and only churns the
-          // spelling away from the machine order the allocator saw. An inlined def — a deref, a
-          // field, a bare scalar global (whose `var` node lowerDef itself mints) — evaluates at
-          // THIS site, wherever recovery spells it.
-          !varName.has(d.operands[0]) &&
-          !varName.has(d.operands[1]) &&
-          activeSub?.has(d.operands[0]) !== true &&
-          activeSub?.has(d.operands[1]) !== true &&
-          ctype(l)?.kind !== 'ptr' &&
-          ctype(r)?.kind !== 'ptr' &&
-          !ptrGlobalSide(l) &&
-          !ptrGlobalSide(r) &&
-          !exprHasEffect(l) &&
-          !exprHasEffect(r) &&
-          opBlock.get(da) === opBlock.get(db) &&
-          opIndex.get(da)! > opIndex.get(db)!
-        ) {
-          [l, r] = [r, l];
-        }
-      }
-      // Pointer stride: C pointer arithmetic is ELEMENT-scaled, but the asm added a BYTE
-      // constant — `addi p,4` on an `s32*` walks 1 element, yet C `p + 4` walks 4. Divide the byte
-      // constant by the pointee size so the walk recompiles to the same address math.
-      //
-      // Keyed on the operand's RENDERED C type, never the IR value's recovered type: C scales by
-      // the type of the expression it actually sees, and the two diverge exactly like memAccess's
-      // deref bases (a value recovered `s32*` can render as an int-typed tree — C then does NO
-      // element scaling, so pre-dividing the constant would bake in a WRONG address that the
-      // deref cast downstream turns into silently-wrong bytes).
-      // An int-rendered walk keeps its raw byte constant and derefs through the access-width cast.
-      // Fires only for a rendered pointer whose element size (>1) DIVIDES the constant exactly;
-      // otherwise raw (a misaligned/struct-array stride is left as-is; a `u8*` is size 1 so
-      // unchanged). Since C `(K/es) + p == p + (K/es)`, scaling the const on whichever side it
-      // sits fixes the bytes: `add` is commutative so the pointer may be either operand; `sub` is
-      // not, so only operand[0] (the minuend) may be the pointer.
-      // A rendered pointer that CANNOT express the byte constant as a whole number of elements —
-      // an inexact residual, or a pointee whose size is not knowable here (a struct) — has no
-      // scaled spelling at all, and leaving the raw byte count is the silent wrongness the
-      // pointer-global rule below refuses in the same words: C multiplies it back, so `p + 62` on
-      // an `s32 *` addresses byte 248 and `p + 38` on a `struct S *` addresses byte 38 * sizeof(S).
-      // Same answer as there — CAST THEN ADD, `(u8 *)p + 62`, the same address in every world.
-      const bytePtr = (x: Expr): Expr => ({ k: 'cast', to: T.ptr(T.u(8)), e: x });
-      // Set when a byte-pointer cast was applied for the ADDRESS math alone: the sum is cast back
-      // to the pointer type it started as, so the walk changes the arithmetic and nothing else. A
-      // bare `u8 *` sum would be a different C type from the slot it lands in (`v4 = (u8 *)a0 +
-      // (v1 << 2)` into an `s32 *` — an mwcc error) and from the bases the deref rules read.
-      let restoreTo: IrType | undefined;
-      const walk = (base: Expr, c: Extract<Expr, { k: 'const' }>): { base: Expr; off: Expr } => {
-        const t = ctype(base);
-        if (t?.kind !== 'ptr') {
-          return { base, off: c }; // an int-rendered walk: C scales nothing, the bytes are right
-        }
-        const es = ptrElemBytes(t.to);
-        if (es === 1) {
-          return { base, off: c }; // already a byte pointer
-        }
-        return es > 1 && c.value % es === 0
-          ? { base, off: { k: 'const', value: c.value / es } }
-          : { base: bytePtr(base), off: c };
-      };
-      // A RUNTIME byte offset has no element spelling at all — not even an inexact one to reject,
-      // since the residual is unknown until the program runs. The asm added bytes, so the same
-      // answer as the inexact constant above: cast then add. Without it a `u16 *` walked by a
-      // computed offset addresses TWICE the intended byte, and nothing downstream can see the
-      // error — in the sa3 decomp that address is what a `CpuSet` call writes THROUGH.
-      //
-      // `ptr - ptr` is C's ELEMENT difference, where the asm subtracted bytes: agbcc compiles `(q -
-      // p) + m` on an `int *` to `sub; asr #2; add`, and spelled `(v0 - a0) >> 2` the lift divided
-      // by 4 twice. Both sides go byte pointers, `(u8 *)v0 - (u8 *)a0`, the byte count in every
-      // world — unless both already are.
-      //
-      // The inexact-CONSTANT branch above casts its base and does not cast the sum back: a deref
-      // supplies its own cast, and a temp of another pointer type takes the sum through
-      // intoDeclaredTemp's cast.
-      const walkVar = (x: Expr): IrType | undefined => {
-        const t = ctype(x);
-        return t?.kind === 'ptr' && ptrElemBytes(t.to) !== 1 ? t : undefined;
-      };
-      if ((d.opcode === 'add' || d.opcode === 'sub') && r.k === 'const') {
-        ({ base: l, off: r } = walk(l, r));
-      } else if (d.opcode === 'add' && d.operands.length === 2 && l.k === 'const') {
-        ({ base: r, off: l } = walk(r, l)); // commuted `const + ptr`
-      } else if (d.opcode === 'add' || d.opcode === 'sub') {
-        // ONE side only. `ptr - ptr` is C's element difference and `ptr + ptr` is not C at all;
-        // both are the intify rules' business below, and casting both operands here would hide
-        // the shape from them.
-        const lp = ctype(l)?.kind === 'ptr';
-        const rp = d.operands.length === 2 && ctype(r)?.kind === 'ptr';
-        if (lp && rp && d.opcode === 'sub') {
-          if (walkVar(l) || walkVar(r)) {
-            l = bytePtr(l);
-            r = bytePtr(r);
-          }
-        } else if (lp && !rp) {
-          restoreTo = walkVar(l);
-          l = restoreTo ? bytePtr(l) : l;
-        } else if (rp && !lp && d.opcode === 'add') {
-          restoreTo = walkVar(r);
-          r = restoreTo ? bytePtr(r) : r;
-        }
-      }
-      // C rejects a pointer operand outright under the non-additive operators (& | ^ << >> * / %),
-      // under `ptr + ptr`, and as the subtrahend of `int - ptr` — the asm just does 32-bit integer
-      // math on the address, so the honest spelling is the value cast to its integer self. Only a
-      // DEFINITELY-pointer rendering is cast (same conservative direction as memAccess); the
-      // additive ops keep C's legal pointer arithmetic untouched.
-      const op = ARITH_TO_BIN[d.opcode];
-      const intify = (x: Expr): Expr =>
-        restoredIntSum(x, false) ?? (ctype(x)?.kind === 'ptr' ? { k: 'cast', to: T.s(32), e: x } : x);
-      if (!['+', '-', '&&', '||'].includes(op)) {
-        l = intify(l);
-        r = intify(r);
-      } else if (op === '+' && ctype(l)?.kind === 'ptr' && ctype(r)?.kind === 'ptr') {
-        // ptr + ptr is not C; ptr + (s32)ptr is, and C scales it by the left pointee. So the left
-        // side is the base, and the sum goes back to its type as the walk's does.
-        r = intify(r);
-        if (!restoreTo) {
-          restoreTo = walkVar(l);
-          l = restoreTo ? bytePtr(l) : l;
-        }
-      } else if (op === '-' && ctype(l)?.kind !== 'ptr' && ctype(r)?.kind === 'ptr') {
-        // int - ptr is not C. A byte sum this rule made integer leaves a global it is taken from a
-        // pointer under a pointer declaration, which the integer would scale; a word, it is the
-        // asm's under any integer or pointer one.
-        if (restoredIntSum(r, false) !== undefined) {
-          l = intWords(l);
-        }
-        r = intify(r);
-      }
-      // A bare global address `&gSym` under ANY of these operators is never emitted as-is: its C
-      // type comes from the PROJECT's own declaration (unknowable here — exprCType types `addr`
-      // undefined, so the ptr-keyed intify above never fires on it), which makes `&gSym + K`
-      // byte-INEXACT (C scales K by sizeof(gSym)) and `&gSym & K` ill-formed. The honest spelling
-      // is integer math on the address — `(u32)&gSym + K`, exactly the arithmetic the asm did.
-      // The deref folds (globalOf / globalConstByte, via addrIn) look through this cast, so every
-      // access that CAN spell a named element/field still does; only a genuine value-context
-      // escape (a call argument, a stored address, a compare) keeps it — previously such an
-      // escape tripped assertDerefsTyped's interior-pointer rule and declined the whole function.
-      const intifyAddr = (x: Expr): Expr => (x.k === 'addr' ? { k: 'cast', to: T.u(32), e: x } : x);
-      l = intifyAddr(l);
-      r = intifyAddr(r);
-      // The SAME hazard one level down, for a pointer VALUE (`gPtr`, `gSym.pBuf` — isPtrValue):
-      // C scales `gPtr + K` by sizeof(*gPtr) — 1 under the map's synthesized `void *`, but
-      // whatever the PROJECT's header declares (a `u16 *` member, a 0x5C-byte struct) in the
-      // world a user actually recompiles in. The asm added BYTES, so the honest
-      // spelling makes the stride explicit: CAST-THEN-ADD, `(u8 *)gPtr + K`, the same address in
-      // EVERY world. Add-then-cast (`(u8 *)(gPtr + K)`, what the backend's deref legalization
-      // would otherwise produce) is byte-correct in exactly one of them — a silent wrongness, the
-      // class this project refuses. A MEMBER is the case with no world in which the raw spelling
-      // is right: the map declares the pointee width, so `bytes + gSym.pBuf` on a `u16 *` scales
-      // the residual a SECOND time and addresses twice the byte the asm did.
-      // NOT foldable into the deref index either: `((u8 *)gPtr)[K + off]` re-scales K by the
-      // ACCESS width, a different address whenever that width is not 1.
-      // Under the non-additive operators C rejects a pointer outright, so there the honest
-      // spelling is integer math on the cell — exactly intifyAddr's `(u32)&gSym` rule.
-      const intifyPtrValue = globalWord;
-      if (op === '+' || op === '-') {
-        // `ptr ± int` and `ptr - ptr` are byte arithmetic once both sides are byte pointers;
-        // `ptr + ptr` and `int - ptr` are not C at all, so the second pointer goes integer. The
-        // other side is a pointer when it is a pointer value too or when it already renders one
-        // (a pointer temp, the walk's `(u8 *)v1`), and then the global's value is the side that
-        // goes integer.
-        //
-        // A global's value no declaration types, added to an integer, is a pointer value too
-        // when the IR types the SUM a pointer: `(u8 *)g + x` is the asm's address under every
-        // declaration of `g` once `x` renders an integer, whichever operand the source held as
-        // the pointer. An integer side that IS an address (`(u32)&gArr + gIdx`) says the address
-        // is the base and the global its index, so that sum stays as it is. An address under a
-        // load (`((u16 *)&gTbl)[a0]`) is a loaded value, and that side is an integer. A global
-        // that is no pointer value renders an integer too, though `ctype` types no global.
-        const isAddr = (x: Expr): boolean =>
-          x.k === 'addr' ||
-          (x.k === 'cast' && isAddr(x.e)) ||
-          (x.k === 'bin' && (x.op === '+' || x.op === '-') && (isAddr(x.l) || isAddr(x.r)));
-        const intSide = (x: Expr): boolean =>
-          !isAddr(x) && (ctype(x)?.kind === 'int' || (x.k === 'var' && ctype(x) === undefined && !isPtrValue(x)));
-        const sumBase =
-          d.results[0]?.type.kind === 'ptr' && !isPtrValue(l) && !isPtrValue(r)
-            ? isUndeclaredGlobalValue(l) && intSide(r)
-              ? l
-              : op === '+' && isUndeclaredGlobalValue(r) && intSide(l)
-                ? r
-                : undefined
-            : undefined;
-        const ptrValue = (x: Expr): boolean => isPtrValue(x) || x === sumBase;
-        // A global no declaration types in the base's partner is added as an integer, which it is
-        // under an integer declaration and a pointer one alike.
-        if (sumBase !== undefined) {
-          l = l !== sumBase ? intWords(l) : l;
-          r = r !== sumBase ? intWords(r) : r;
-        }
-        const rendersPtr = (x: Expr): boolean => ptrValue(x) || ctype(x)?.kind === 'ptr';
-        const bothPtr = rendersPtr(l) && rendersPtr(r);
-        // `x + (u8 *)g` is pointer arithmetic, and gcc makes the pointer the first operand of the
-        // add, which swaps the asm's. So under an integer left side, the value of a global no
-        // declaration types, or a byte sum this rule made of one, is added as an integer in the
-        // asm's order, and the cast keeps the sum the byte pointer it would have been. A declared
-        // pointer keeps `x + (u8 *)p`, the operand the element and field spellings read.
-        const undeclaredPtr = (x: Expr): boolean => x.k === 'var' && mapUndeclared(x.name);
-        // The same global LEFT of a runtime offset is added as an integer too: CodeWarrior at -O4
-        // puts the index first in every pointer sum, where an integer sum keeps the source's
-        // order, so `(u8 *)g + x` is the asm's order on agbcc, KMC gcc and IDO only. The partner
-        // goes integer with it, or a pointer partner would scale the sum. A constant offset folds
-        // into the access and keeps `(u8 *)g + K`.
-        const constValued = (x: Expr): boolean =>
-          x.k === 'const' ||
-          (x.k === 'cast' && constValued(x.e)) ||
-          (x.k === 'bin' && constValued(x.l) && constValued(x.r));
-        const intSum = op === '+' && !constValued(r) && ptrValue(l) && undeclaredPtr(l);
-        if (intSum) {
-          l = intifyPtrValue(l);
-          r = ptrValue(r)
-            ? intifyPtrValue(r)
-            : ctype(r)?.kind === 'ptr'
-              ? isByteGlobalSum(r)
-                ? byteSumAsInt(r)
-                : { k: 'cast', to: T.u(32), e: r }
-              : intWords(r);
-          restoreTo ??= T.ptr(T.u(8));
-        } else if (ptrValue(l)) {
-          l = op === '+' && bothPtr && !ptrValue(r) ? intifyPtrValue(l) : bytePtr(l);
-        }
-        if (intSum) {
-          // both operands are integers now
-        } else if (
-          op === '+' &&
-          !bothPtr &&
-          !restoreTo &&
-          ((ptrValue(r) && undeclaredPtr(r)) || (ctype(r)?.kind === 'ptr' && isByteGlobalSum(r, true)))
-        ) {
-          r = ptrValue(r) ? intifyPtrValue(r) : byteSumAsInt(r);
-          // A left global no declaration types may be a pointer in the project's header, which
-          // would scale the integer sum; as an integer it is the asm's word under any declaration.
-          l = intWords(l);
-          restoreTo = T.ptr(T.u(8));
-        } else if (ptrValue(r)) {
-          r = bothPtr && op === '-' ? bytePtr(r) : op === '+' && !bothPtr ? bytePtr(r) : intifyPtrValue(r);
-        }
-        // A byte sum less an integer sum of globals no declaration types: bare, `gB2 - gB3` is an
-        // element count under a wider pointer declaration of them, where the asm subtracted bytes.
-        if (op === '-' && r.k === 'bin' && !rendersPtr(r) && isByteGlobalSum(l)) {
-          r = intWords(r);
-        }
-        if (op === '-' && ctype(l)?.kind === 'ptr' && ctype(r)?.kind === 'ptr') {
-          restoreTo = undefined; // a byte pointer less a byte pointer is the byte count, an integer
-        }
-      } else if (op !== '&&' && op !== '||') {
-        // (`&&`/`||` take a pointer operand legally — a truth test, no arithmetic.)
-        l = isPtrValue(l) ? intifyPtrValue(l) : l;
-        r = isPtrValue(r) ? intifyPtrValue(r) : r;
-      }
-      // (The signedness-carrying pairs stay DISTINCT ops here — `>>>`/`>>` and `/u` `%u`/`/` `%`.
-      // Which token a language spells each with, and what cast pins the choice, is a BACKEND
-      // decision; see l3/ast.ts BinOp and backend/cfamily.ts's C_SPELLING.)
-      // SCOPE: this and intifyAddr cover the ARITHMETIC escapes. A pointer value under a
-      // COMPARISON (`gPtr < K`, `(u8 *)gPtr + K < a0`) needs nothing here: an icmp_s* pins every
-      // operand that does not provably render signed, a pointer included (pinSigned above).
-      //
+      const l = e(d.operands[0]);
+      const r = d.operands.length === 2 ? e(d.operands[1]) : ({ k: 'const', value: d.attrs.imm as number } as Expr);
       // A `+`/`|` over two IR `const`s that both RENDER as literals is the literal it is. After
       // pre-recovery there is only one way such an op still exists: `raise/const.ts` refuses to fold
       // one shape — a register the compiler held live across a branch, whose value on this path is a
@@ -4323,7 +4698,8 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       // stake, so `const-fold.test.ts` pins this on the emitted STRING. Re-folding HERE rather than
       // back in the IR is the point: the pair must survive pre-recovery for the enumeration gate to
       // see the merge feed, and only at rendering is it settled that this candidate named neither
-      // half.
+      // half. Two literals are spelled as they are by the arithmetic table, so the fold reads them
+      // before it.
       //
       // `foldsFromIrConsts` keeps the reach honest and is not redundant with `l`/`r` being `const`
       // Exprs: a BLOCK PARAMETER resolved to a constant on this arm also renders as a literal, and
@@ -4351,12 +4727,52 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       if (l.k === 'const' && r.k === 'const' && d.operands.every((o) => foldsFromIrConsts(o))) {
         const value = foldConstPair(d.opcode, l.value, r.value);
         if (value !== null) {
-          const folded: Expr = { k: 'const', value };
-          return restoreTo ? { k: 'cast', to: restoreTo, e: folded } : folded;
+          return { k: 'const', value };
         }
       }
-      const sum: Expr = { k: 'bin', op, l, r };
-      return restoreTo ? { k: 'cast', to: restoreTo, e: sum } : sum;
+      // Commutative LOAD-PAIR operands re-spell in EVALUATION order. A commutative instruction's
+      // operand order is an allocator artifact (`mul r0, r0, r2` reads dst-first, so the lift's
+      // l/r is whichever load landed in the dst), but the order the compiler EVALUATED the
+      // operands is still visible: their defs' order in the instruction stream. gcc 2.9 and IDO
+      // both emit `w * h`'s loads w-first, so def order IS source order — verified byte-identical
+      // on both (the bg_area rows). Scope, one gate per way the signal fails: BOTH root defs must
+      // be same-block memory reads (a const already has its side; arithmetic defs get combined
+      // out of source order — an ldmia-fed add reads def-reordered; cross-block positions do not
+      // order evaluation), neither stamped `listOrder` (an ldmia-expanded load's own position is
+      // LIST order), both operand VALUES un-named (see below), and no effect moves (call, marker).
+      // Which sides may move is the arithmetic's own decision (structure/pointer-spelling.ts
+      // `pointerSide`, load-bearing for the stride rules), so the pair is handed to it.
+      const [da, db] = [defs.get(d.operands[0]), defs.get(d.operands[1])];
+      const loadPairReversed =
+        COMMUTATIVE_BIN.has(ARITH_TO_BIN[d.opcode]) &&
+        d.operands.length === 2 &&
+        defOrderLoadPairs &&
+        da !== undefined &&
+        db !== undefined &&
+        (da.opcode === 'load' || da.opcode === 'aload') &&
+        (db.opcode === 'load' || db.opcode === 'aload') &&
+        da.attrs.listOrder !== true &&
+        db.attrs.listOrder !== true &&
+        // NAMED values decline: a value that renders as a name here — a materialized def
+        // (varName), a loop-carried value in a post-loop region (activeSub) — was evaluated at
+        // its def statement, so re-ordering the reference re-orders nothing and only churns the
+        // spelling away from the machine order the allocator saw. An inlined def — a deref, a
+        // field, a bare scalar global (whose `var` node lowerDef itself mints) — evaluates at
+        // THIS site, wherever recovery spells it.
+        !varName.has(d.operands[0]) &&
+        !varName.has(d.operands[1]) &&
+        activeSub?.has(d.operands[0]) !== true &&
+        activeSub?.has(d.operands[1]) !== true &&
+        !exprHasEffect(l) &&
+        !exprHasEffect(r) &&
+        opBlock.get(da) === opBlock.get(db) &&
+        opIndex.get(da)! > opIndex.get(db)!;
+      // The operand order, the pointer stride, the integer legalizations and the pointer-value
+      // byte arithmetic: structure/pointer-spelling.ts `arith`. (The signedness-carrying pairs
+      // stay DISTINCT ops — `>>>`/`>>` and `/u` `%u`/`/` `%`. Which token a language spells each
+      // with, and what cast pins the choice, is a BACKEND decision; see l3/ast.ts BinOp and
+      // backend/cfamily.ts's C_SPELLING.)
+      return spellArith(d, l, r, loadPairReversed);
     }
     // `-`/`~` on a pointer rendering is equally not C — same honest integer cast as above.
     if (d.opcode === 'rotr' || d.opcode === 'rotl') {
@@ -4390,6 +4806,37 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         r: { k: 'bin', op: far, l: x, r: w },
       };
     }
+    if (d.opcode === 'neg_s') {
+      // The MATHEMATICAL negation (ir/opcodes.ts), so it must not be spelled over an unsigned 32-bit
+      // operand: `-(u32)b` wraps, and at b == 0x80000000 a signed compare reads `(s32)-b` as INT_MIN
+      // where the machine's sum was +2^31. Negating the operand as s32 instead is exact wherever C
+      // defines it — it is undefined at exactly that one input. The operand keeps its own spelling
+      // where it already renders signed (`renderedIntSignedness`, the rule the icmp_s* operand
+      // pin uses); a cast it did not need costs no byte.
+      //
+      // That one input is a value the operand MIGHT hold. An operand that ALWAYS holds it is a
+      // different thing: every call then lands on the undefined input, and the C a compiler makes
+      // of `-(s32)0x80000000` (INT_MIN again) is not the machine's +2^31. Whether it always does is
+      // what the compiler can FOLD, not which opcodes built it — a pool word, `1 << 31`, a
+      // `sub`/`orr`/`eor` of constants, a param both arms of a diamond set, a reload of a store
+      // nothing can have overwritten, a reload of memory this function wrote on every path through
+      // an address it cannot match — so the question goes to the shared word evaluator, and fails
+      // closed: a constant it cannot compute refuses too.
+      // An operand that is INT_MIN on some paths only still lifts; that is the "might hold" case.
+      // Only hand-written asm reaches the refusal — agbcc folds the negation of a constant.
+      const x = e(d.operands[0]);
+      wordCtx ??= {
+        defs,
+        incoming: incomingArgs(fn.blocks),
+        forwarded: storeForwards(fn.blocks),
+        overwritten: overwrittenReads(fn.blocks),
+      };
+      if (mayAlwaysHold(wordCtx, d.operands[0], 0x80000000)) {
+        return mkGap('the mathematical negation of the constant 0x80000000 has no int spelling', [x]);
+      }
+      const cast = needsIntSpelling(x) || renderedIntSignedness(x, vtEnv) !== true;
+      return { k: 'un', op: '-', e: cast ? { k: 'cast', to: T.s(32), e: x } : x };
+    }
     if (d.opcode === 'neg') {
       const x = e(d.operands[0]);
       return { k: 'un', op: '-', e: needsIntSpelling(x) ? { k: 'cast', to: T.s(32), e: x } : x };
@@ -4513,12 +4960,36 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       // assigned to a 32-bit one truncates — but it is a pass this branch did not set out to move.
       const wide64 = d.results[0] !== undefined && intWidth(d.results[0].type) === 64;
       const through = calleeValue(d);
+      // a struct passed by value is the object its operand addresses — a frame object stamped as
+      // that struct, or a global — spelled bare (frontend/call-plan.ts `foldByValueArgs`)
+      const byValue = byValueOperands(d).map(({ at, param }) => {
+        const o = defs.get(d.operands[at]);
+        const t = d.operands[at].type;
+        const type = t.kind === 'ptr' && t.to.kind === 'struct' ? t.to : undefined;
+        const object =
+          type !== undefined &&
+          (o?.opcode === 'laddr'
+            ? o.attrs.aggregate === true
+            : o?.opcode === 'gaddr' && o.attrs.passedAs === structSpelling(type));
+        if (!object) {
+          throw new Error(
+            `internal: a by-value argument of '${d.attrs.target}' is not the address of an object of the struct it passes`,
+          );
+        }
+        return { at, param, type };
+      });
+      const args = callArgs(d).map((v, i): Expr => {
+        const x = e(v);
+        return byValue.some((b) => b.at === i) && x.k === 'addr' ? { k: 'var', name: x.name } : x;
+      });
       return {
         k: 'call',
         fn: through === undefined ? (d.attrs.target as string) : e(through),
-        args: callArgs(d).map(e),
+        args,
         ...(wide64 ? { wide64: true as const } : {}),
         ...(d.attrs.sret === true ? { sret: d.results[0].type } : {}),
+        ...(d.attrs.sret !== true && d.results[0]?.type.kind === 'struct' ? { returns: d.results[0].type } : {}),
+        ...(byValue.length > 0 ? { byValue } : {}),
       };
     }
     if (d.opcode === 'laddr') {
@@ -4544,6 +5015,35 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       return { k: 'addr', name: d.attrs.sym as string };
     }
     if (d.opcode === 'load') {
+      const viewed = frameUnionAccess(
+        d.operands[0],
+        d.attrs.off as number,
+        d.attrs.width as number,
+        (d.attrs.signed as boolean) ?? false,
+        false,
+      );
+      if (viewed !== null) {
+        return unqualifiedView(d, viewed);
+      }
+      const member = frameStructMember(
+        d,
+        d.attrs.off as number,
+        d.attrs.width as number,
+        (d.attrs.signed as boolean) ?? false,
+      );
+      if (member !== null) {
+        return member;
+      }
+      const element = frameArrayElement(
+        d,
+        d.attrs.off as number,
+        d.attrs.width as number,
+        (d.attrs.signed as boolean) ?? false,
+      );
+      if (element !== null) {
+        return element;
+      }
+      refuseFloatMemberRead(d);
       const access = memAccess(
         d.operands[0],
         e(d.operands[0]),
@@ -4555,6 +5055,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         symCtx,
         false,
         advanceStepOf(d.operands[0]),
+        qualifiedBy(d) === 'cast',
       );
       return pinnedAccess(d, access);
     }
@@ -4646,6 +5147,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // which over-declines, the refusing direction.
   let zeroTripStale: Map<Value, string> | null = null;
   const expr = (v: Value): Expr => exprWith(activeSub)(v);
+  // A return that hands back the function's own struct return object (frontend/own-struct-return.ts)
+  // returns that local by value, `return ret;`, where its address would print `&ret`.
+  const returnedValue = (term: Op): Expr => {
+    const value = expr(term.operands[0]);
+    return term.attrs[RETURNS_OBJECT] === true && value.k === 'addr' ? { k: 'var', name: value.name } : value;
+  };
   const withSub = <R>(sub: Map<Value, string>, run: () => R): R => {
     const prev = activeSub;
     activeSub = prev ? new Map([...prev, ...sub]) : sub;
@@ -4710,10 +5217,32 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   const NO_COPIES_AT_A_DEF: ReadonlyMap<Op, Stmt[]> = new Map();
   /** The `atDef` copies `sideEffects` has spelled — `assertSunkCopiesPlaced`'s input. */
   const sunkCopiesEmitted = new Set<Stmt>();
-  const undefCarriesNothing = (arg: Value, name: string, pred: Block): boolean => {
-    if (defs.get(arg)?.opcode !== 'undef') {
+  const undefCarriesNothing = (arg: Value, name: string, pred: Block, coalescing = false): boolean => {
+    // A `copied` undef is another storage's content moved into this one (`x = y` of two
+    // uninitialised locals): the machine ran that move, so the copy is spelled.
+    if (defs.get(arg)?.opcode !== 'undef' || defs.get(arg)!.attrs.copied === true) {
       return false;
     }
+    // AN UNDEFINED VALUE READ UNDER ANOTHER NAME IS A RELATION. Dropping the copy leaves `name`
+    // holding whatever it held, which equals the undefined value only where nothing else reads that
+    // value: `int x, z; z = x; if (c) x = 5; return x * 2 + z;` at gcc 2.7.2 keeps x in v0 and
+    // reads it as z too, so on `c == 0` the join's local IS z, and an unassigned `v0` beside
+    // `uninit_v0` loses that. So the copy is dropped only where every other read of the value goes
+    // through `name` itself: the coalesced undef below (which the coalescing test asks before it
+    // has renamed it), or edge copies into joins of the same name.
+    if (!coalescing) {
+      const op = defs.get(arg)!;
+      for (const site of useSitesOf.get(arg) ?? []) {
+        if (site.op.operands.includes(arg) && undefName.get(op) !== name) {
+          return false;
+        }
+        for (const s of site.op.successors) {
+          if (s.args.some((a, i) => a === arg && varName.get(s.block.params[i]) !== name)) {
+            return false;
+          }
+        }
+      }
+    }
     const writesBefore = (home: Block | undefined): boolean =>
       home === undefined || home === pred || reachFrom(home).has(pred);
     for (const [v, n] of varName) {
@@ -4723,6 +5252,67 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     }
     return !(anchoredHome.get(name) ?? []).some(writesBefore);
   };
+  // AN UNDEF ONE JOIN TAKES IS THAT JOIN'S LOCAL, READ BEFORE ITS ASSIGNMENT. `int t; if (k > 5)
+  // g = t; switch (k) { case 0: t = …; } … t …` reads one source variable on both sides of the
+  // switch, and the asm reads one register: the entry value directly, and again through the join
+  // the arms assign. Named from its key it would be two declarations, `uninit_t7` beside the join's
+  // `v9`, which the compiler allocates as two. So the undef takes the join's name when that name is
+  // never written where any of its reads happen: every edge copy into the join is one
+  // `undefCarriesNothing` drops, and every block that reads it — through the ops rendered inline
+  // over it — passes the same test, so each read sees the name before anything assigned it.
+  // A merge that adopted a parameter's name is never one (`v<n>` only). The reads are recorded with
+  // the dropped copies, for the sunk-copy postcondition below to check them the same way.
+  const coalescedUndefs = new Set<Op>();
+  for (const op of fn.blocks.flatMap((b) => b.ops)) {
+    if (op.opcode !== 'undef') {
+      continue;
+    }
+    const u = op.results[0];
+    const joins = new Set<string>();
+    const intoJoin: Block[] = [];
+    const readIn = new Set<Block>();
+    let unnamed = false;
+    for (const site of useSitesOf.get(u) ?? []) {
+      for (const s of site.op.successors) {
+        s.args.forEach((a, i) => {
+          if (a === u) {
+            const n = varName.get(s.block.params[i]);
+            if (n === undefined) {
+              unnamed = true;
+            } else {
+              joins.add(n);
+            }
+            intoJoin.push(site.blk);
+          }
+        });
+      }
+      if (site.op.operands.includes(u)) {
+        const work = [site];
+        for (let w = work.pop(); w !== undefined; w = work.pop()) {
+          readIn.add(w.blk);
+          if (!materialize.has(w.op)) {
+            work.push(...w.op.results.flatMap((r) => useSitesOf.get(r) ?? []));
+          }
+        }
+      }
+    }
+    const [name] = joins;
+    if (
+      unnamed ||
+      joins.size !== 1 ||
+      readIn.size === 0 ||
+      !/^v\d+$/.test(name) ||
+      globalNames.has(name) ||
+      ![...intoJoin, ...readIn].every((b) => undefCarriesNothing(u, name, b, true))
+    ) {
+      continue;
+    }
+    undefName.set(op, name);
+    coalescedUndefs.add(op);
+    for (const b of readIn) {
+      droppedUndefCopies.push({ name, pred: b });
+    }
+  }
   const tempCounter = { n: 0 }; // per-function swap-cycle temp names (sequentialize)
   /** One record per parameter slot an edge ACTUALLY carries, in the order the copies are to be
    *  laid out — everything `argAssignsFor` does except `sequentialize`. Split out because Regime-A
@@ -4952,127 +5542,32 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // EFFECTFUL op whose result nothing consumes (a void/discarded call, and an `opaque` standing for
   // an instruction asmlift could not model); and MATERIALIZED defs — a call/load whose value cannot
   // soundly render at its use is assigned to its named temp here, at its own program position.
-  /** A pointer VALUE assigned into a pointer CELL (isPtrValue), spelled so the assignment is legal
-   *  against ANY pointer declaration of that cell. The byte-arithmetic guard renders such a
-   *  right-hand side `(u8 *)gS.pBuf + K` — the right ADDRESS in every world, which is the whole
-   *  point of it, and a `u8 *` where the declaration says `u16 *`. READING one is fine (C converts
-   *  an object pointer freely under a deref, a call argument or a compare); ASSIGNING one is
-   *  `warning: assignment from incompatible pointer type`, and this project's own `-Werror`
-   *  compiler template makes that FATAL — so a source that scores clean here fails to build in the
-   *  tree a user pastes it into, which no score gate can observe.
-   *
-   *  `void *`, NOT the map's declared pointee: it is the one target assignment-compatible with any
-   *  object-pointer declaration, the same "same answer in every world" property the guard that
-   *  made the `u8 *` exists for. Trusting the map's pointee would put the spelling back in one
-   *  world. It costs nothing: agbcc compiles `p = (void *)((u8 *)p + 4)` and the warning-carrying
-   *  `p = (u8 *)p + 4` to BYTE-IDENTICAL objects (`-mthumb-interwork -Wimplicit -O2 -fhex-asm
-   *  -fprologue-bugfix`), so the fix is invisible to the differ and visible to the compiler.
-   *
-   *  A project may still declare a cell no map types an INTEGER (`u32 gSym;`), where `(void *)`
-   *  makes an integer from a pointer: agbcc warns, CodeWarrior rejects it. The candidate's own world
-   *  declares the cell `void *` (l3/symbol-refs.ts), and `/int-cell` (l3/intcell.ts) spells the
-   *  integer declaration's source, published only at a byte-exact score. */
-  const intoPtrCell = (lval: Expr, value: Expr): Expr => {
-    if (!isPtrValue(lval)) {
-      return value;
-    }
-    const vt = ctype(value);
-    // BOTH ways a pointer value reaches here. `ctype` types params and locals, so it sees the
-    // guard's own `(u8 *)…` and nothing else: a bare `gSym.pBuf` or a pointer global's value —
-    // the population this rule exists for — reads `undefined` there. An already-`void *` value is
-    // assignable as it stands.
-    const isPtr = isPtrValue(value) || (vt?.kind === 'ptr' && vt.to.kind !== 'void');
-    return isPtr ? { k: 'cast', to: T.ptr(T.void()), e: value } : value;
-  };
 
-  /** THE REFUSAL for the read half of `unreadResult`: can a `volatile` reach this dead read's
-   *  spelling, here or in some candidate enumerated from this tree?
-   *
-   *  A QUALIFIED read (ir/discipline.ts `qualified`) answers yes: `pinnedAccess` puts the qualifier
-   *  on its spelling, from the device pin or from the map's declaration of the object it reads. Every
-   *  other read is plain in this tree, and only a variation can qualify it, so the statement is
-   *  spelled only where both of these hold:
-   *
-   *   1. EVIDENCE — would a source plausibly have declared this access `volatile`? The answer has
-   *      to come from DATA: the target's declared device-register window
-   *      (`capabilities.deviceRegisters`). `volatile` is a CORRECTNESS claim about an address, not a
-   *      spelling preference, and asserting one about ordinary RAM is a wrong answer rather than a
-   *      wrong spelling.
-   *   2. REACHABILITY — the base value has a use OTHER than this read: l3/volatileptr.ts qualifies a
-   *      pointer LOCAL, and l3/basecse.ts only mints that local for a base something else also
-   *      touches. A single-access read — `*(s32 *)0x04000200;`, the `REG_IF` acknowledge idiom, and
-   *      the shape a WRONG `returnsVoid` on a register accessor produces — has no local to qualify
-   *      and never will, however plainly its address is a device register. "Some other use" is
-   *      NECESSARY for that local, not sufficient; the gate states the necessary half. Where no
-   *      qualifier can land, the statement would be a permanent bare deref in the DEFAULT source,
-   *      which is what the playground pins and what a decomp author copies.
-   *
-   *  The address is a LITERAL, which inhabits only `/raw-globals`: with a symbol map the frontend
-   *  spells a pool word as `gaddr`, so `constAddressOf` returns null, and a read of a named object
-   *  is plain because the map does not declare it volatile.
+  /** THE REFUSAL for the read half of `unreadResult`: is this dead read QUALIFIED (ir/discipline.ts
+   *  `qualified`)? `pinnedAccess` then puts the qualifier on its spelling, from the dead-read pin
+   *  (frontend/dead-reads.ts), the device pin, or the map's declaration of the object it reads, and
+   *  `gStatus;` under `extern volatile u32 gStatus;` compiles differently from its own absence. A
+   *  plain read is dropped: an unqualified `p[2];` compiles to the same bytes as no statement at all
+   *  (measured on agbcc, IDO and mwcc), so spelling it claims an access no candidate makes.
    *
-   *  ONLY `load` REACHES THE ARM. `aload` carries its index in `operands[1]` and has no `off` attr at
-   *  all, so the address query would answer for the BARE BASE — `constAddressOf` sees the literal
-   *  with `off` defaulted to 0 — which admits `volatile s32 *p0 = (s32 *)0x04000000; p0[a0];`, a
-   *  qualified access at an address the declared window does not cover. The whitelist is by OPCODE
-   *  so a read op added later refuses until someone answers both questions for it. */
-  const volatileQualifiable = (op: Op): boolean => {
-    if (qualified(op)) {
-      return true;
-    }
-    if (op.opcode !== 'load') {
-      return false;
-    }
-    const window = opts.deviceRegisters;
-    if (!window) {
-      return false;
-    }
-    const addr = constAddressOf(defs, op.operands[0], typeof op.attrs.off === 'number' ? op.attrs.off : 0);
-    if (addr === null || addr < window[0] || addr >= window[1]) {
-      return false;
-    }
-    return (useSitesOf.get(op.operands[0]) ?? []).some((s) => s.op !== op);
-  };
+   *  ONE DECIDER. Whether a read nobody uses was `volatile` is the dead-read pin's question, asked
+   *  once of the raw lift, at any address, with its refusals tabled and reported. The read that
+   *  reaches this walk unused because a DECLARED void return suppressed the `ret` operand is the
+   *  same question, and the pin answers it too: it does not count that operand as a use. So no
+   *  address window, base-local or second-access rule is asked here; a read the pin refused is
+   *  plain, and dropped. */
+  const volatileQualifiable = (op: Op): boolean => qualified(op);
 
   /** Ops the `sideEffects` walk must SPELL even though nothing consumes their result — the
    *  question ir/discipline.ts asks of every op (`spelledWhenDead`), so the next op to acquire the
-   *  property needs no edit here, plus the address refusal above for the memory-read half.
+   *  property needs no edit here, plus the qualifier refusal above for the memory-read half.
    *
    *  A memory READ is not `effectful`, deliberately: ir/discipline.ts calls a load deletable when
    *  dead, because nothing observes a read nobody reads. That is the C claim. The COMPILER
    *  claim points the other way — an optimizing compiler deletes every dead read it is allowed to
    *  delete, so one still in the target is evidence the source's access was `volatile`, and
-   *  dropping it deletes an instruction the machine executed.
-   *
-   *  The statement earns nothing by itself: an unqualified `p[2];` compiles to the same bytes as
-   *  no statement at all (measured on agbcc, IDO and mwcc). What it does is put the access where a
-   *  qualifier can reach it — and `volatileQualifiable` is the condition under which one can.
-   *
-   *  WHICH VARIATION REACHES IT, because "a qualifier" is two variations and only one of them does:
-   *  l3/volatileptr.ts's `/volatile` qualifies the pointer LOCAL the read is spelled through, and
-   *  that is the arm every match here rides. l3/volstore.ts's `/vol-store` mints `volatile` at an
-   *  inline cast STORE and never visits an `exprstmt`, so on a tree with no base local it emits the
-   *  cell qualified for its writes and plain for this read — a candidate that cannot reproduce the
-   *  surviving `ldr`. Wasted rather than wrong (the differ refuses it); teaching that variation the
-   *  read is a widening with its own window census to pay for, priced in its header.
-   *
-   *  TWO THINGS DELIBERATELY NOT DONE HERE, priced rather than left for a reader to rediscover.
-   *
-   *  1. THE LITERAL ARM IS A BACKWARDS DEFAULT AND ITS PREIMAGE IS NOT EMPTY. docs/level-tower.md
-   *     admits a default that reads the map backwards only when the backwards mapping is ITSELF a
-   *     function, and "a surviving dead read implies the source said `volatile`" is not quite one:
-   *     the other preimage is a function whose `returnsVoid` fact is WRONG, so its return value
-   *     arrived here as a dead read. The second-use clause removes the common shape of that (a bare
-   *     register accessor), leaving a function that both STORES to a device register and reads one
-   *     back — narrow, but not proven empty. A qualified read has no such problem: `gStatus;` under
-   *     `extern volatile u32 gStatus;` compiles differently from its own absence. The clean fix — spell the read only in candidates that also qualify it, paired
-   *     the way `/livebase/volatile` already pairs — moves every device row's fan shape and wants
-   *     its own round and zero-flip gate over BOTH tiers.
-   *  2. THE REFUSAL IS SILENT. When this returns false for a `load`, the machine performed a read
-   *     that no statement stands for and nothing records the decision — against this project's own
-   *     "instrument the refusal" rule; `structure()` has no diagnostic sink to write into. What
-   *     exists instead is the ADMISSION side's zero point, `synthetic:dmareadback`, which fails
-   *     loudly if the rule stops firing. */
+   *  dropping it deletes an instruction the machine executed. The pin makes that claim; this walk
+   *  spells what it stamped. */
   /** Does `op` render AT ITS OWN POSITION, as `v = f(…)`?
    *
    *  ONE DEFINITION, TWO READERS, on purpose: `isSpelled`'s base case is a MODEL of what
@@ -5161,42 +5656,84 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         // A store whose lvalue is a bare global (`gSym = v`, from an `&gSym` base at off 0) emits
         // as an ASSIGN, not a store — memAccess returns a `var` node for that case.
         const width = op.attrs.width as number;
-        const lval0 = memAccess(
-          op.operands[0],
-          expr(op.operands[0]),
-          op.attrs.off as number,
-          width,
-          width === 4,
-          ctype,
-          scalarGlobals,
-          symCtx,
-          true, // an lvalue: a member whose declaration is const cannot be NAMED as the target
-          advanceStepOf(op.operands[0]),
+        const off = op.attrs.off as number;
+        const stamp = op.attrs.signed as boolean | undefined;
+        const viewed = frameUnionAccess(op.operands[0], off, width, storeView(op, width), true);
+        if (viewed !== null) {
+          const lval = unqualifiedView(op, viewed);
+          floatBitsStoreTarget(op.operands[1], lval);
+          out.push({ k: 'store', lval, value: intoPtrCell(lval, expr(op.operands[1])) });
+          continue;
+        }
+        const member = frameStructMember(op, off, width, null) ?? frameArrayElement(op, off, width, null);
+        if (member !== null) {
+          floatBitsStoreTarget(op.operands[1], member);
+          out.push({ k: 'store', lval: member, value: intoPtrCell(member, expr(op.operands[1])) });
+          continue;
+        }
+        const baseExpr = expr(op.operands[0]);
+        const lval0 = structBytesCell(
+          op.operands[1],
+          memAccess(
+            op.operands[0],
+            baseExpr,
+            off,
+            width,
+            storeView(op, width),
+            ctype,
+            scalarGlobals,
+            symCtx,
+            true, // an lvalue: a member whose declaration is const cannot be NAMED as the target
+            advanceStepOf(op.operands[0]),
+            qualifiedBy(op) === 'cast',
+          ),
         );
+        floatBitsStoreTarget(op.operands[1], lval0);
         if (lval0.k === 'var') {
           globalNames.add(lval0.name);
           out.push({ k: 'assign', name: lval0.name, value: intoPtrCell(lval0, expr(op.operands[1])) });
           continue;
         }
-        // signedness mirrors recoverTypes' store seed (word ⇒ signed, narrow ⇒ unsigned), so an
-        // inserted cast declares the same scalar the recovered pointee would have.
-        const lval = pinnedAccess(op, lval0);
+        // a member whose declared sign is not the stamp's is spelled as the flat cell (stampedStoreLval)
+        const bt = op.operands[0].type;
+        const lval = pinnedAccess(
+          op,
+          stampedStoreLval(
+            lval0,
+            stamp,
+            width,
+            bt.kind === 'ptr' && bt.to.kind === 'struct' ? baseExpr : null,
+            off,
+            ctype,
+          ),
+        );
         out.push({ k: 'store', lval, value: intoPtrCell(lval, expr(op.operands[1])) });
       } else if (op.opcode === 'astore') {
         const elemSize = op.attrs.elemSize as number;
-        const lval = arrayAccess(
-          op.operands[0],
-          expr(op.operands[0]),
-          expr(op.operands[1]),
-          op.attrs.fieldOff as number | undefined,
-          op.attrs.memberOff as number | undefined,
-          elemSize,
-          // a member array's store spells through the member's OWN declaration, which the
-          // recognizer records; every other astore keeps the width===4 convention
-          (op.attrs.signed as boolean | undefined) ?? elemSize === 4,
-          ctype,
-          symCtx,
+        const fieldOff = op.attrs.fieldOff as number | undefined;
+        const stamp = op.attrs.signed as boolean | undefined;
+        const lval0 = structBytesCell(
+          op.operands[2],
+          arrayAccess(
+            op.operands[0],
+            expr(op.operands[0]),
+            expr(op.operands[1]),
+            fieldOff,
+            op.attrs.memberOff as number | undefined,
+            elemSize,
+            storeView(op, elemSize),
+            ctype,
+            symCtx,
+          ),
         );
+        // a struct-array element's field: `base[i].field_K`, whose flat cell is
+        // `(base + i)[K / width]` — C scales `base + i` by the element, exactly as `base[i]` does
+        const el = lval0.k === 'field' && lval0.base.k === 'index' ? lval0.base : null;
+        const lval =
+          el === null || fieldOff === undefined
+            ? lval0
+            : stampedStoreLval(lval0, stamp, undefined, { k: 'bin', op: '+', l: el.base, r: el.idx }, fieldOff, ctype);
+        floatBitsStoreTarget(op.operands[2], lval);
         out.push({
           k: 'store',
           lval: pinnedAccess(op, lval),
@@ -5252,7 +5789,14 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // to `header` is a conditional continue; its other edge, when it leaves the loop, is an early exit
   // (a `break` to `exit`, or an early `return` through a trampoline). Null outside any loop body —
   // the early-exit branch in structureBlock is inert there.
-  type LoopFrame = { header: Block; exit: Block; body: Set<Block>; arms: LoopArm[]; breaks: ReadonlySet<Block> };
+  type LoopFrame = {
+    header: Block;
+    exit: Block | null;
+    body: Set<Block>;
+    arms: LoopArm[];
+    breaks: ReadonlySet<Block>;
+    breakArms?: readonly BreakArm[];
+  };
   let loopCtx: LoopFrame | null = null;
   const withLoop = <R>(frame: LoopFrame, run: () => R): R => {
     const prev = loopCtx;
@@ -5264,6 +5808,87 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     }
   };
 
+  // THE SWITCH ARMS being structured, innermost last — one frame per arm, in both regimes, so a
+  // `break;` can be checked against what C binds it to. A C `break` leaves the innermost enclosing
+  // loop OR switch, so a switch-scoped one is only spelled where this arm's frame is the innermost
+  // switch frame AND no loop was entered since the arm began (`loop` is the loop frame the arm sits
+  // in). `region` is the arm's own blocks (`ArmExit`), closed or falling; null on an arm the exit
+  // analysis gave none (one that leaves sideways), which structures to the CFG's joins and stops AT
+  // the merge without the statement. A frame with no region still matters: it is what tells a
+  // `break;` reached inside a nested switch that it would bind the inner one, and the loop-exit
+  // rules that a loop's `break` cannot be minted here. `fallsTo` is the sibling a falling arm runs
+  // into (`armJoin` reads it).
+  type SwitchFrame = {
+    merge: Block | null;
+    loop: LoopFrame | null;
+    region: ReadonlySet<Block> | null;
+    fallsTo: Block | null;
+  };
+  const switchFrames: SwitchFrame[] = [];
+  // Is `b` the merge of an arm with a region, reached before that arm's end, and may `break;` say so
+  // from here? Undefined when no such arm ends at `b`. (At an arm's own end, `stop` is the merge and
+  // `structureRegion` returns before asking.) Throws when one does but a nested loop or switch would
+  // capture the statement.
+  const switchBreakAt = (b: Block): Stmt[] | undefined => {
+    let i = switchFrames.length - 1;
+    while (i >= 0 && (switchFrames[i].region === null || switchFrames[i].merge !== b)) {
+      i--;
+    }
+    if (i < 0) {
+      return undefined;
+    }
+    if (i !== switchFrames.length - 1 || switchFrames[i].loop !== loopCtx) {
+      throw new StructureError(
+        `cannot structure '${fn.name}': a case body leaves its switch from inside a nested ` +
+          `${i !== switchFrames.length - 1 ? 'switch' : 'loop'}, where \`break\` would leave that instead`,
+      );
+    }
+    return [{ k: 'break', ofSwitch: true }];
+  };
+  // THE JOIN OF A BRANCH INSIDE AN ARM. The CFG's join for `if (c) break;` lies past the switch —
+  // in a falling arm the fall-through path reaches the merge too, through the next arm, and in a
+  // closed arm the merge IS the join — so structuring to it would copy the next arm, or the rest of
+  // this one, into both sides. Inside the arm, an edge to the merge is a `break;` and a `ret` a
+  // `return`: jumps, which end their path wherever they sit, so those edges are DELETED, as
+  // `loopJoin` deletes a loop body's exits (`regionJoins`). The edge into the sibling the arm falls
+  // into is no jump: its path runs to the arm's END, so it goes to EXIT, the caller's `stop`. Sent
+  // to EXIT too, a guard whose one side breaks would be post-dominated by EXIT alone and every
+  // statement after it would nest in its `else`; deleted, a guard whose one side falls would join
+  // on the other side's path, which the falling path cannot jump over. Null ⇒ the paths meet only
+  // at the arm's end. Asked only in the innermost arm frame and outside any loop entered since,
+  // which is where `switchBreakAt` would spell the `break;`.
+  const armJoins = new Map<ReadonlySet<Block>, Map<Block, Block | null>>();
+  const armJoin = (b: Block, stop: Block | null): Block | null | undefined => {
+    const f = switchFrames[switchFrames.length - 1];
+    if (f === undefined || f.region === null || !f.region.has(b) || f.loop !== loopCtx) {
+      return undefined;
+    }
+    const region = f.region;
+    let pd = armJoins.get(region);
+    if (pd === undefined) {
+      pd = regionJoins(region, null, false, f.fallsTo);
+      armJoins.set(region, pd);
+    }
+    const join = pd.get(b) ?? null;
+    // IN A CLOSED ARM, AN EDGE TO THE MERGE IS USUALLY THE ARM'S OWN END, not a `break;`: in
+    // `case 7: s *= 2; if (s > 100) s = 1; break;` the guard's edge past `s = 1` is where the arm
+    // runs off, and deleting it makes `s = 1` the join and spells `if (!(s > 100)) break; s = 1;`.
+    // What the deletion is for is a TAIL two of the arm's paths share behind a mid-arm `break;`
+    // (`if (a) { if (b) break; g(1); } h(2); break;`, where `h(2)` is the join). So a closed arm
+    // takes its own join only where the join is such a meeting point, two of the arm's blocks
+    // entering it, or where the region being structured already ends INSIDE the arm (`stop` is one
+    // of its blocks: an enclosing guard found such a tail, and a path to the merge from here jumps
+    // over it). Otherwise it reads the CFG.
+    if (
+      f.fallsTo === null &&
+      !(stop !== null && region.has(stop)) &&
+      (join === null || new Set(preds.get(join)?.filter((p) => region.has(p))).size < 2)
+    ) {
+      return undefined;
+    }
+    return join;
+  };
+
   // THE IMPLICIT CONTINUE. A branch with one edge back to the loop header spells that edge as
   // nothing at all: control falls to the bottom of the body and the loop goes round. That holds only
   // where the region being structured ends at the loop bottom (`stop === frame.header`). An `if` in
@@ -5293,12 +5918,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // that render: an exit parameter that takes its argument's own name renders no copy, yet the exit
   // still reads that name, and a latch update that wrote it hands the exit the updated value.
   const breakRule = (frame: LoopFrame, from: Block, writes: Set<string>): { refusal: string } | { bare: boolean } => {
+    const exit = frame.exit;
+    if (exit === null) {
+      return { refusal: 'leaves a loop that has no exit' }; // DEFENSIVE: no edge leaves such a loop
+    }
     // A `while (1)` has no copies of its own after the loop, so a break carries its own, computed
     // where it leaves; what is left is the exit region's re-derivations. An inner loop's value the
     // region reads under its name (`emitForever`) is no re-derivation.
     const fl = foreverLoops.get(frame.header);
     if (fl !== undefined) {
-      const exitRegion = new Set([frame.exit, ...reachFrom(frame.exit)].filter((x) => !frame.body.has(x)));
+      const exitRegion = new Set([exit, ...reachFrom(exit)].filter((x) => !frame.body.has(x)));
       const { sub } = latchInnerSub(fl.header, fl.body, [...fl.breaks], exitRegion);
       return loopEscapeHazard(frame.body, sub, writes, exitRegion)
         ? { refusal: 'reaches an exit region that reads a loop value under a name this iteration already rewrote' }
@@ -5307,11 +5936,11 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     if (!whileLoops.has(frame.header)) {
       return { refusal: 'leaves a do-while' };
     }
-    const headerCopies = argAssigns(frame.header, frame.exit);
+    const headerCopies = argAssigns(frame.header, exit);
     let bare = false;
     if (headerCopies.length !== 0) {
-      const headerArgs = successorTo(frame.header, frame.exit)!.args;
-      const breakArgs = successorTo(from, frame.exit)!.args;
+      const headerArgs = successorTo(frame.header, exit)!.args;
+      const breakArgs = successorTo(from, exit)!.args;
       const reads = new Set<string>();
       for (const s of headerCopies) {
         stmtExprs(s).forEach((e) => exprVars(e, reads));
@@ -5324,7 +5953,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         return { refusal: 'would run the copies the loop header hands its exit' };
       }
     }
-    const exitRegion = new Set([frame.exit, ...reachFrom(frame.exit)].filter((x) => !frame.body.has(x)));
+    const exitRegion = new Set([exit, ...reachFrom(exit)].filter((x) => !frame.body.has(x)));
     if (loopEscapeHazard(frame.body, new Map(), writes, exitRegion)) {
       return { refusal: 'reaches an exit region that reads a loop value under a name this iteration already rewrote' };
     }
@@ -5357,6 +5986,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     if (b === stop) {
       return [];
     }
+    // The merge of the switch a falling arm also leaves: the edge copies are already out, and
+    // `break;` is the jump.
+    const brk = switchBreakAt(b);
+    if (brk !== undefined) {
+      return brk;
+    }
     // Back to a `while (1)` header from a region that ends short of the loop bottom: the edge's
     // copies are already out, and `continue` is the jump.
     if (loopCtx !== null && b === loopCtx.header && foreverLoops.has(b)) {
@@ -5387,6 +6022,21 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // two places the map is handed to (`coalesceNames`, `makeLoopHazards`) only read it. So the
   // recognizer sees one settled naming however late a case body calls back into `structureRegion`,
   // and nothing here has to be rebuilt against a naming that moves underneath it.
+  // One switch arm, from `entry` to `stop`, under its frame (`switchFrames`).
+  const structureArm = (entry: Block, stop: Block | null, merge: Block | null, exit: ArmExit | undefined): Stmt[] => {
+    // A backend with no mid-arm `break` (`spellSwitchBreak`) gets no region for a closed arm, and
+    // so no `break;` from `switchBreakAt` and no arm-local join: it structures to the CFG's.
+    const region =
+      exit === undefined || exit.kind === 'unstructurable' || (exit.kind === 'break' && !spellSwitchBreak)
+        ? null
+        : (exit.region ?? null);
+    switchFrames.push({ merge, loop: loopCtx, region, fallsTo: exit?.kind === 'fallthrough' ? exit.to : null });
+    try {
+      return structureRegion(entry, stop);
+    } finally {
+      switchFrames.pop();
+    }
+  };
   const { recognizeSwitch, analyzeArmExit, layoutIndex, defaultLayoutPos, chainArms } = makeSwitchRecovery({
     fn,
     defs,
@@ -5402,16 +6052,20 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     spellSwitchFallthrough,
     emitsOwnStatement: (blk) => blk.ops.some((o) => anchoredAt.has(o) || materialize.has(o)),
     blockOf,
+    enclosingLoop: () => loopCtx,
     hoistDispatchCopies: (edges, liveAt) => hoistedDispatchAssigns(edges, liveAt),
     expr: (v) => expr(v),
     structureRegion: (b, stop) => structureRegion(b, stop),
+    structureArm,
   });
 
   const structureBlock = (b: Block, stop: Block | null): Stmt[] => {
     // Bottom-test `do-while`: this block is a do-while header (the body-first loop entry). Emit the
     // do-while — its body includes `b`'s own ops (structured via structureRegion with the hook masked),
     // so do NOT emit sideEffects(b) here. The init was already emitted by the predecessor's argAssigns.
-    const dw = doWhileLoops.get(b);
+    // A guarded self-loop its guard did not claim (`keptGuardDoWhiles`) is a do-while like any
+    // other: read as a plain block, its back edge would re-enter it and decline.
+    const dw = doWhileLoops.get(b) ?? keptGuardDoWhiles.get(b);
     if (dw && !dwActive.has(b)) {
       return emitDoWhile(dw, stop);
     }
@@ -5424,7 +6078,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     const term = b.ops[b.ops.length - 1];
     if (term.opcode === 'ret') {
       // A void function's `bx lr` leaves whatever in r0; suppress that phantom return value.
-      const value = returnsVoid || !term.operands.length ? undefined : expr(term.operands[0]);
+      const value = returnsVoid || !term.operands.length ? undefined : returnedValue(term);
       // The `value === undefined` half is a GUARD: `l3/tailret.ts` re-checks it before deleting
       // anything, so marking a value-carrying return would change no output. The mark claims the asm
       // shows no `return;` STATEMENT here, which is a claim about a VOID return only.
@@ -5469,8 +6123,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       // more functions therefore has to BE the default, and it is the DIVERGENT reading that a
       // variation would have to offer back — a candidate nothing mints today, and the one thing
       // this line costs. `?? stop` keeps the shape where no `ret` is reachable from every
-      // successor.
-      const merge = ipdom.get(b) ?? followOverReturns(b, stop) ?? stop;
+      // successor — and where that reading declines, the default-anchored RETRY below gets one try.
+      const joined = ipdom.get(b) ?? followOverReturns(b, stop);
+      let merge = joined ?? stop;
       const succ = term.successors;
       const caseVals = term.attrs.cases as number[];
       // Switch edges CARRY phi args (frontend/ssa.ts appends them terminator-generically) — each
@@ -5503,13 +6158,6 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         }
         a.values.push(caseVals[i]);
       });
-      // The blocks an arm could fall INTO. The default block counts only when it is a block of its
-      // own: when it IS the merge, "the default" is just where the switch ends, and an arm reaching
-      // it is a plain `break`.
-      const siblings = new Set<Block>(arms.map((a) => a.entry));
-      if (defEdge.block !== merge) {
-        siblings.add(defEdge.block);
-      }
       // ARM ORDER. Grouping the table's slots by target walks them in TABLE order, which for a dense
       // table is ascending case value — the neutral spelling, and the source's order only by
       // accident. Where the compiler has declared that its block layout IS the order the arms were
@@ -5521,39 +6169,208 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       // The policy orders the chain HEADS. A FALLING arm's position is not free — emission order is
       // load-bearing for correctness (the l3/ast.ts non-neutrality note), so it must sit directly
       // above the arm it falls into — and `chainArms` below re-threads it for exactly those, which
-      // is the same per-SITE reading Regime A makes of the same declaration. `analyzeArmExit` does
-      // not depend on emission order, so the exits can be settled first and reused below. Grouping
-      // by target already gives every arm a DISTINCT entry block, so no two sort keys can be equal
-      // and the tie-break Regime A needs on shared bodies has nothing to decide here.
-      const exitOf = new Map<Block, ArmExit>();
-      for (const entry of [...arms.map((a) => a.entry), defEdge.block]) {
-        if (!exitOf.has(entry)) {
-          exitOf.set(entry, analyzeArmExit(entry, b, merge, siblings));
+      // is the same per-SITE reading Regime A makes of the same declaration.
+      if (switchArmsFollowLayout) {
+        arms.sort((x, y) => layoutIndex(x.entry) - layoutIndex(y.entry));
+      }
+      // …and then the CHAIN re-threads that order for the falling arms, exactly as it does for the
+      // comparison tree: ONE definition (`chainArms`) for the linearization, the adjacency it
+      // guarantees, and the three shapes no linear order spells. The arm-order policy above is read
+      // for the chain HEADS only — the same per-SITE reading Regime A makes of the same
+      // declaration, rather than a whole-switch gate on every arm being closed.
+      const preChain = arms.map((a) => a.entry);
+      // Everything below that depends on WHERE THE SWITCH ENDS, read for one candidate merge: the
+      // arms' exits, their linearization, and whether the emission below would decline them. Read
+      // twice at most — see the retry after it.
+      // A default edge the dispatch never takes: a frontend whose dispatch is entered only past a
+      // bounds test that already sent every other value elsewhere says so with `exhaustive`.
+      const deadDefaultEdge = term.attrs.exhaustive === true;
+      const readArms = (at: Block | null) => {
+        // The blocks an arm could fall INTO. The default block counts only when it is a block of
+        // its own: when it IS the merge, "the default" is just where the switch ends, and an arm
+        // reaching it is a plain `break`.
+        const siblings = new Set<Block>(arms.map((a) => a.entry));
+        if (defEdge.block !== at) {
+          siblings.add(defEdge.block);
+        }
+        // `analyzeArmExit` does not depend on emission order, so the exits can be settled before
+        // the chain and reused below. Grouping by target already gives every arm a DISTINCT entry
+        // block, so no two sort keys can be equal and the tie-break Regime A needs on shared bodies
+        // has nothing to decide here.
+        const exits = new Map<Block, ArmExit>();
+        for (const entry of [...arms.map((a) => a.entry), defEdge.block]) {
+          if (!exits.has(entry)) {
+            exits.set(entry, analyzeArmExit(entry, b, at, siblings));
+          }
+        }
+        const falls = [...exits.values()].some((e) => e.kind === 'fallthrough');
+        // A table whose default block is ALSO a case target is that case's arm, not a separate
+        // one: it is already in `preChain`, and `defaultLayoutPos` withholds the label's position.
+        const dflt = defEdge.block !== at && !armOf.has(defEdge.block) ? defEdge.block : null;
+        const chain = !spellSwitchFallthrough && falls ? null : chainArms(preChain, dflt, exits);
+        const refusal = chain === null ? null : armRefusal(exits, chain);
+        return { exits, falls, chain, refusal, declines: chain === null || refusal !== null };
+      };
+      // THE EMISSION'S PER-ARM REFUSALS, the one definition of them. Every refusal the emission
+      // below throws is a null chain (which a fall-through in a language without one forces too —
+      // `readArms` reads that one) or one of three asked here per arm, in emission order, without
+      // emitting anything: an arm whose exit is unstructurable, a fall-through into an arm that is
+      // not the next one emitted, and a fall-through into an arm that opens with switch-edge
+      // copies. The answer is the arm it refuses at and a `raise` that throws the refusal, and the
+      // emission calls exactly the one `readArms` carries for the reading it adopted — so the
+      // retry's gate and the emission cannot disagree about what declines, and a reading that
+      // declines fails with the message it always did. Each refusal stays a literal
+      // `throw new StructureError(…)` so the decline-message harvest (apps/web declines.test.ts)
+      // still reads it.
+      //
+      // `edgeCopyRecords` stands in for `argAssignsFor` because it mints no swap-cycle temp — a
+      // name minted here would change the output of every arm emitted after it — and it answers
+      // the same question: `sequentialize` emits at least one statement per record and none for
+      // none. It is not a pure query either: an `undef` copy it drops is recorded in
+      // `droppedUndefCopies`, which a postcondition reads. So the records this question leaves are
+      // rolled back, as the speculative dispatch hoist does with its own.
+      const armRefusal = (exits: Map<Block, ArmExit>, chain: Block[]): { at: number; raise: () => never } | null => {
+        const order: { entry: Block; edge: (typeof succ)[number]; values: number[] | null }[] = [
+          ...chain.map((e) => armOf.get(e)!),
+          { entry: defEdge.block, edge: defEdge, values: null },
+        ];
+        const auditMark = droppedUndefCopies.length;
+        try {
+          for (const [i, a] of order.entries()) {
+            const exit = exits.get(a.entry)!;
+            if (exit.kind === 'unstructurable') {
+              const { why } = exit;
+              return {
+                at: i,
+                raise: () => {
+                  throw new StructureError(`cannot structure '${fn.name}': ${why}`);
+                },
+              };
+            }
+            if (exit.kind !== 'fallthrough') {
+              continue;
+            }
+            const next = order[i + 1];
+            if (next?.entry !== exit.to) {
+              const { values } = a;
+              return {
+                at: i,
+                raise: () => {
+                  throw new StructureError(
+                    `cannot structure '${fn.name}': ${values ? `case ${values.join('/')}` : 'the default arm'} falls ` +
+                      `through into an arm that is not the next one emitted — C fall-through only reaches the arm below`,
+                  );
+                },
+              };
+            }
+            // The arm fallen INTO opens with its own switch-edge copies, which are how the dispatch
+            // hands it its block parameters. On the fall-through path those copies would RE-RUN and
+            // overwrite what the falling arm just computed (`case 0: v=7; case 1: v=5;` — the case-0
+            // path calling with 5). They cannot simply be dropped either: entering that arm by its
+            // own case value needs them. Hoisting them above the switch is possible but not always
+            // safe (another arm may read the same name first), so this shape declines LOUD;
+            // recovering it is future work. The one edge that needs no copies is a default edge the
+            // dispatch never takes (the op's `exhaustive` attr): nothing enters the default by it,
+            // so its copies are not emitted (`edgeCopies` below) and cannot re-run.
+            if (!(deadDefaultEdge && next.edge === defEdge) && edgeCopyRecords(b, next.edge).length > 0) {
+              return {
+                at: i,
+                raise: () => {
+                  throw new StructureError(
+                    `cannot structure '${fn.name}': the case fallen into takes a value from the switch edge, ` +
+                      `which the fall-through path would re-run`,
+                  );
+                },
+              };
+            }
+          }
+          return null;
+        } finally {
+          droppedUndefCopies.length = auditMark;
+        }
+      };
+      let read = readArms(merge);
+      // THE RETRY: A SWITCH WHOSE ARMS DO NOT ALL REACH THE CODE AFTER IT. When neither
+      // post-dominance nor the every-successor reading gives the table an end, the `?? stop`
+      // reading above puts the default block among the siblings, so every plain `break` reads as
+      // falling INTO it — and the function declines wherever that does not spell. One arm that
+      // `return`s on its own is enough to cause it (`case 4: …; return TRUE;` beside four `break`s
+      // and a `return FALSE;` after the switch): its `ret` is reached by no other successor, so
+      // the every-successor intersection is empty although the rest plainly share an end. So is a
+      // `case 1:` that falls into a returning `case 2:`, and so are four returning arms beside one
+      // `break` that carries a value to the code after the switch.
+      //
+      // The DEFAULT-ANCHORED reading (`sharedRetsOf`) names that end by the dispatch's DEFAULT
+      // edge, which goes to the `default:` arm or, where the source wrote none, straight to the
+      // code after the switch. It keeps the successors that share a `ret` with the default edge's
+      // target, and derives the follow from them alone. That is a candidate, not evidence: a
+      // `default:` that `return`s on its own has a `ret` of its own, and the follow it derives
+      // then sits inside that arm, with every `break` spelled as a `return` — the same program,
+      // and not the one the source wrote (KMC and gcc 2.7.2 recompile it to different code).
+      //
+      // THE LAYOUT TELLS THEM APART, and nothing in the graph does: `case 0: …; break;` beside
+      // returning arms and a returning `default:` is the same CFG as returning arms beside one
+      // arm that carries a value past the switch to a store the default edge shares. What
+      // differs is where the code the anchor leaves out sits. The code after a switch is laid
+      // out after every arm, so an arm the anchor leaves out — one that returns on its own, or
+      // reaches the switch's real end — sits above that end only if the candidate is the real
+      // end. Where any block a left-out successor reaches is laid out past the candidate, the
+      // candidate is inside an arm and the retry is refused.
+      //
+      // That reads `layoutIndex` at a strength of its own: only that no block of an arm was moved
+      // past the code after the switch — not the arm order `switchArmsFollowLayout` places, so it
+      // is not behind that declaration. Where it fails — PPC's synthetic return blocks sort after
+      // every real one — it can only refuse, so its cost is a decline the `stop` reading already
+      // made, never a spelling.
+      //
+      // A RETRY, NOT A THIRD LINK IN THE `??` CHAIN. Where the `stop` reading spells, it is legal
+      // C already, and asking the anchored reading first re-spells three shapes whose `stop`
+      // spelling is published (a real fall-through moved after the switch, a value-carrying
+      // fall-through edge lifted where it declined, a Pascal decline re-worded) with no row asking
+      // for it. So it is read only where the `stop` reading DECLINES — any refusal `readArms`
+      // reports, which is every refusal the emission below throws — and adopted only where it
+      // declines nothing, so it can turn a decline into a lift and never one lift into another,
+      // nor one decline's stated reason into another's.
+      //
+      // NEVER AT A CASE ARM. Where the arms that return on their own are the many and the arms that
+      // share an end are one arm and the arm it falls into (`case 0: …` running on into `case 1:`,
+      // every other arm its own `return`), the follow the anchored reading can derive is that
+      // second arm's ENTRY. Ending the switch there spells `case 1:` as an empty arm and moves its
+      // body after the switch — the same program, but a spelling no source writes and the one the
+      // `stop` reading's own refusal is the honest answer for. So the retry ends the switch only
+      // at the default block or past every arm.
+      //
+      // THE DEFAULT BLOCK STAYS ELIGIBLE WHEN THE TABLE'S HOLES MAKE IT AN ARM. A slot no `case`
+      // names holds the default edge's target, so on a table with a hole that block is an arm by
+      // construction, but not one with a body: a hole runs what an unmatched value runs, and ending
+      // the switch there spells it `case 1: break;`. The rule above refuses an arm that is NOT the
+      // default edge's target, whose body would move after the switch, and only that arm.
+      if (joined === null && read.declines) {
+        const found = followOverReturns(b, stop, defEdge.block);
+        const pastEnd = (end: Block): boolean =>
+          leftOutOf(b, reachFrom, defEdge.block).some((s) =>
+            [s, ...reachFrom(s)].some((x) => x !== b && layoutIndex(x) > layoutIndex(end)),
+          );
+        const over = found !== null && (found === defEdge.block || !armOf.has(found)) && !pastEnd(found) ? found : null;
+        const retry = over === null ? null : readArms(over);
+        if (retry !== null && !retry.declines) {
+          hooks.onEarlyReturnFollow?.({ block: fn.blocks.indexOf(b), follow: fn.blocks.indexOf(over!) });
+          merge = over;
+          read = retry;
         }
       }
+      const exitOf = read.exits;
       // A language whose `case` cannot fall through (Pascal) has no spelling for this shape, and
       // Regime B has no second recovery to fall back on — so it fails LOUD, as it does for every
       // other unspellable jump table. (Regime A, which does have a fallback, declines to
       // if-recovery instead: switch-recover.ts's PRE2.)
-      if (!spellSwitchFallthrough && [...exitOf.values()].some((e) => e.kind === 'fallthrough')) {
+      if (!spellSwitchFallthrough && read.falls) {
         throw new StructureError(
           `cannot structure '${fn.name}': a jump-table case runs on into the next case, and the target ` +
             `language has no fall-through in its case statement`,
         );
       }
-      if (switchArmsFollowLayout) {
-        arms.sort((x, y) => layoutIndex(x.entry) - layoutIndex(y.entry));
-      }
-      // …and then the CHAIN re-threads that order for the falling arms, exactly as it does for the
-      // comparison tree: ONE definition (`chainArms`) for the linearization, the adjacency it
-      // guarantees, and the three shapes no linear order spells. The arm-order policy above is read
-      // for the chain HEADS only — the same per-SITE reading Regime A makes of the same
-      // declaration, rather than a whole-switch gate on every arm being closed.
-      const preChain = arms.map((a) => a.entry);
-      // A table whose default block is ALSO a case target is that case's arm, not a separate one:
-      // it is already in `preChain`, and `defaultLayoutPos` withholds the label's position for it.
-      const dfltArm = defEdge.block !== merge && !armOf.has(defEdge.block) ? defEdge.block : null;
-      const chained = chainArms(preChain, dfltArm, exitOf);
+      const chained = read.chain;
       if (chained === null) {
         throw new StructureError(
           `cannot structure '${fn.name}': the jump table's case arms do not linearize — two arms fall ` +
@@ -5583,38 +6400,34 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       // Each arm's switch-edge copies, computed ONCE and in emission order: `argAssignsFor` mints
       // swap-cycle temp names, so calling it twice for one edge burns a temp number and changes the
       // output (the same reason emitDoWhile reuses its `updates`).
-      const edgeCopies = emitOrder.map((a) => argAssignsFor(b, a.edge));
+      // A dead default edge carries none: the default runs only when a case falls into it, and that
+      // case's own edge copies hand it its values.
+      const edgeCopies = emitOrder.map((a) => (deadDefaultEdge && a.edge === defEdge ? [] : argAssignsFor(b, a.edge)));
+      // A default edge the dispatch never takes (the op's `exhaustive` attr) gets no arm: its block
+      // runs under whatever the dispatch path left in the registers, a state the machine never gives
+      // it there. Unless a case runs on into that block — then the label is where that case goes.
+      // A table whose hole names that block already gives it a case arm (`dflt` is null in
+      // `readArms`), and a fall into the block lands under that arm's labels, never the default's.
+      const deadDefault =
+        deadDefaultEdge &&
+        (armOf.has(defEdge.block) ||
+          ![...exitOf.values()].some((e) => e.kind === 'fallthrough' && e.to === defEdge.block));
       const bodies = emitOrder.map((a, i) => {
-        const exit = exitOf.get(a.entry)!;
-        if (exit.kind === 'unstructurable') {
-          throw new StructureError(`cannot structure '${fn.name}': ${exit.why}`);
-        }
-        const ft = exit.kind === 'fallthrough';
-        const next = emitOrder[i + 1];
-        // Re-read off the EMISSION array rather than trusted from `chainArms` — the seam where a
-        // position acquires control-flow meaning, checked on the same side of it as Regime A's.
-        if (ft && next?.entry !== exit.to) {
-          throw new StructureError(
-            `cannot structure '${fn.name}': ${a.values ? `case ${a.values.join('/')}` : 'the default arm'} falls ` +
-              `through into an arm that is not the next one emitted — C fall-through only reaches the arm below`,
-          );
+        // The refusal `armRefusal` found for this reading, thrown at the arm it names, so an
+        // earlier arm's own refusal speaks first. Its order is this emission array, so "the next
+        // arm" is read off the seam where a position acquires control-flow meaning, as Regime A's is.
+        if (read.refusal !== null && read.refusal.at === i) {
+          read.refusal.raise();
         }
-        // The arm fallen INTO opens with its own switch-edge copies, which are how the dispatch hands
-        // it its block parameters. On the fall-through path those copies would RE-RUN and overwrite
-        // what the falling arm just computed (`case 0: v=7; case 1: v=5;` — the case-0 path calling
-        // with 5). They cannot simply be dropped either: entering that arm by its own case value
-        // needs them. Hoisting them above the switch is possible but not always safe (another arm may
-        // read the same name first), so this shape declines LOUD; recovering it is future work.
-        if (ft && edgeCopies[i + 1].length) {
-          throw new StructureError(
-            `cannot structure '${fn.name}': the case fallen into takes a value from the switch edge, ` +
-              `which the fall-through path would re-run`,
-          );
+        if (deadDefault && i === emitOrder.length - 1) {
+          return { body: [], fallsThrough: false };
         }
+        const exit = exitOf.get(a.entry)!;
+        const ft = exit.kind === 'fallthrough';
         return {
           // A falling-through arm stops AT its successor arm, which then emits that body once under
           // its own labels; a closed arm runs to the merge as before.
-          body: [...edgeCopies[i], ...structureRegion(a.entry, ft ? exit.to : merge)],
+          body: [...edgeCopies[i], ...structureArm(a.entry, ft ? exit.to : merge, merge, exit)],
           fallsThrough: ft,
         };
       });
@@ -5696,24 +6509,64 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         li.header.params.forEach(
           (_, i) => initArgs[i] !== undefined && entryVals.set(li.backArgOfParam[i], initArgs[i]),
         );
+        // A CALL OR A LOAD IS ONE EVALUATION, AT ONE POINT. Read through, it equals another of one
+        // callee or one address on the same operands only where each runs at its own test. The
+        // guard's runs there when it sits in the guard block with no effect after it. The loop's
+        // runs there when it sits in the header or its pure preheader: the fused `while` renders the
+        // header's test at its top, so its first evaluation runs right after the guard's, and the
+        // `while`'s first test is the evaluation that replaces the guard's — a store or call ahead
+        // of it in the header is the previous iteration's body, at the top of this one. Read through
+        // anywhere else, a cached result would equal a fresh one: a call the function made once
+        // ahead of both (`if (v < f(a)) do {} while (v < v)` would lose the `f(a)`), or a load ahead
+        // of a call or store that changes what it reads (`v = *p; g(); if (i < *p) do {} while
+        // (i < v)` would lose the guard and its reload).
+        const evaluatedAtTest = (v: Value): boolean => {
+          const d = defs.get(v);
+          if (d === undefined || !orderSensitive(d)) {
+            return true;
+          }
+          const at = opBlock.get(d);
+          if (at === b) {
+            return !b.ops.slice(opIndex.get(d)! + 1).some(effectful);
+          }
+          return at !== undefined && (at === li.header || at === li.preheader);
+        };
         // (1) Is the guard PROVABLY the loop's own test? Fusing DELETES it and lets the `while`
         // re-test, so an unproven fuse would lose the `if` outright and run a loop the source
         // skipped. Structural equality is a sufficient proof, never a necessary one: `str[0]` and
         // `str[i]` at `i = 0`, or a signed `e <= 0` beside an unsigned `e != 0`, are the same test
-        // spelled differently, and normalising those needs a canonical form this pass does not
-        // have. An unproven guard therefore KEEPS its `if`, with the loop as a `do-while` inside it
-        // — every test the asm performs is emitted as itself. The proof still gates the SINK below:
-        // a sunk copy runs once per iteration, and only the proof (fused form) or the kept `if`
-        // makes the zero-trip path skip it. The kept `if` would widen the sink's key to unproven
-        // guards too; no row needs that yet, so it stays keyed on the proof.
+        // spelled differently. The first is one of the identities `sameAtEntry` (ir/entry.ts) reads
+        // under `normalize`, which the raise re-roll turns on; this caller keeps it off, since it
+        // re-spells rows (agbcc `while (s[i]) i++` fuses into a `for`). The second has no reading.
+        // An unproven guard KEEPS its `if`, with the loop as a `do-while` inside it — every test
+        // the asm performs is emitted as itself. The proof still gates the SINK below: a sunk copy
+        // runs once per iteration, and only the proof (fused form) or the kept `if` makes the
+        // zero-trip path skip it. The kept `if` would widen the sink's key to unproven guards too;
+        // no row needs that yet, so it stays keyed on the proof.
         const enterIsTaken = takenB === h;
         const contIsTaken = hterm.successors[0].block === li.header;
-        const guardProven = sameAtEntry(hterm.operands[0], term.operands[0], entryVals, enterIsTaken !== contIsTaken);
+        const guardProven = sameAtEntry(
+          hterm.operands[0],
+          term.operands[0],
+          entryVals,
+          enterIsTaken !== contIsTaken,
+          evaluatedAtTest,
+        );
         // Fused `while` additionally requires a header free of MATERIALIZED defs: their temps are
         // assigned only inside the body (sideEffects), and an un-rotated `while` condition renders
         // BEFORE the body ever ran — reading a temp uninitialized on the first test. The kept-guard
         // `do-while` tests after the body, so it carries no such restriction.
         const fused = guardProven && !li.header.ops.some((o) => materialize.has(o));
+        // A KEPT GUARD IS AN ORDINARY `if` AROUND AN ORDINARY `do-while`, and emitWhile's hazards
+        // below are the price of merging the guard's exit edge into the loop's post-loop copies,
+        // which only the fused `while` needs, since it drops that edge. So where a kept guard meets
+        // one of them, it is not claimed here: the `if` recovery below takes the guard, carrying each
+        // exit edge's copies on that edge, and the loop reaches `structureBlock` as the do-while it
+        // is (`keptGuardDoWhiles`), with the do-while's repairs — a `++` for the test's own
+        // pre-update read, the exit-copy sink, the pre-update homes. Asked only where emitWhile
+        // declines, so a guarded loop that structures here keeps its spelling. IDO's stolen-slot
+        // latch reaches it (`strlen1`: `if (*s) do { t = s[1]; n++; s++; } while (t);`).
+        const handBack = (): boolean => !fused && keptGuardDoWhiles.has(li.header);
         // A pre-update exit copy is repairable rather than fatal: emitted INSIDE the body, ahead of
         // the update, it captures the value the exit edge carries rather than the updated one.
         // Its post-loop copy is then dropped, so the ZERO-TRIP path needs the guard→exit edge as a
@@ -5729,7 +6582,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
               sub,
               updateWrites,
               hooks.preUpdateSinkGates ?? PREUPDATE_SINK_GATES,
-              (j) => !sameAtEntry(hexitArgs[j], guardExit.args[j] as Value, entryVals),
+              (j) => !sameAtEntry(hexitArgs[j], guardExit.args[j] as Value, entryVals, false, evaluatedAtTest),
             )
           : new Map<number, Op | null>();
         // (2) Every exit copy the fused form KEEPS renders after the loop, on the zero-trip path
@@ -5737,9 +6590,12 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         // what the guard→exit edge carries, since that edge is dropped. A sunk slot is exempt: its
         // seed and its body copy cover the two paths separately.
         const staleExit = hexitArgs.findIndex(
-          (a, j) => !sunk.has(j) && !sameAtEntry(a, guardExit.args[j] as Value, entryVals),
+          (a, j) => !sunk.has(j) && !sameAtEntry(a, guardExit.args[j] as Value, entryVals, false, evaluatedAtTest),
         );
         if (staleExit >= 0) {
+          if (handBack()) {
+            break;
+          }
           throw new StructureError(
             `cannot structure '${fn.name}': the fused guard's exit edge carries a value the post-loop ` +
               `copies do not reproduce on a zero-trip run`,
@@ -5757,6 +6613,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
             null,
           )
         ) {
+          if (handBack()) {
+            break;
+          }
           // NO `n++` REPAIR HERE, and the SHAPE is why rather than an oversight. The fold
           // (`preUpdateCondFold`) trades the update copy at the foot of the body for a `++` at the
           // leaf, which is the same program only for a BOTTOM test: it runs once per iteration, in
@@ -5774,6 +6633,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         const seed = argAssigns(b, li.exit, null, sunkSlot);
         const seedWrites = new Set(seed.filter((st) => st.k === 'assign').map((st) => st.name));
         if (initArgs.some((a) => readsClobbered(a, new Map(), seedWrites))) {
+          if (handBack()) {
+            break;
+          }
           throw new StructureError(
             `cannot structure '${fn.name}': seeding the zero-trip value would overwrite a value the ` +
               `loop initialisation reads`,
@@ -5826,6 +6688,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
             hexitArgs.some((a, j) => !sunk.has(j) && reachesBodyTemp(a)) ||
             [...(liveIn.get(li.exit) ?? [])].some(bodyTemp)
           ) {
+            if (handBack()) {
+              break;
+            }
             throw new StructureError(
               `cannot structure '${fn.name}': a post-loop read reaches a temp the guarded body may never assign`,
             );
@@ -5857,6 +6722,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           // `gsub`, whose mapped values the inits deliberately hold.
           const writes = new Set([...seedWrites, ...updateWriteSet(inits)]);
           if (readsClobbered(term.operands[0], gsub, writes)) {
+            if (handBack()) {
+              break;
+            }
             throw new StructureError(
               `cannot structure '${fn.name}': the kept guard's condition reads a name the loop initialisation overwrites`,
             );
@@ -5956,7 +6824,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     //
     // Taken only where the implicit continue holds (`continueFallsToBottom`). Where it does not, a
     // break edge is refused by name below, and an arm re-enters the header and declines loud.
-    if (loopCtx && continueFallsToBottom(loopCtx, stop) && (takenB === loopCtx.header || fallB === loopCtx.header)) {
+    // A switch arm opened in this loop, with no loop entered since: C binds a `break;` here to the
+    // switch, so neither rule below may mint the loop's (see the second).
+    const armFrame = switchFrames.length > 0 ? switchFrames[switchFrames.length - 1] : undefined;
+    const armCapturesBreak = loopCtx !== null && armFrame !== undefined && armFrame.loop === loopCtx;
+    if (
+      loopCtx &&
+      continueFallsToBottom(loopCtx, stop) &&
+      (takenB === loopCtx.header || fallB === loopCtx.header) &&
+      !(armCapturesBreak && (takenB === loopCtx.exit || fallB === loopCtx.exit))
+    ) {
       const contIsTaken = takenB === loopCtx.header;
       const exitB = contIsTaken ? fallB : takenB;
       const isBreak = exitB === loopCtx.exit;
@@ -5998,7 +6875,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         } // continue is `taken` → leave when NOT it
         const exitArm =
           rule && 'bare' in rule
-            ? [...(rule.bare ? [] : argAssigns(b, loopCtx.exit, sub)), { k: 'break' } as Stmt] // break to the loop exit
+            ? [...(rule.bare ? [] : argAssigns(b, exitB, sub)), { k: 'break' } as Stmt] // break to the loop exit
             : withSub(sub, () => [...argAssigns(b, exitB, sub), ...structureRegion(exitB, stop)]); // early return
         out.push(mkIf(leaveCond, exitArm, []));
         return out;
@@ -6023,11 +6900,29 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // always loud. The others are loud, since the loop was admitted on the promise of this spelling,
     // unless an arm owns the edge or the exit ends in a `ret`: then if-recovery below copies the
     // exit's tail into the arm and returns.
-    // A `switch` case body never holds one: the exit is a block no switch in the body dominates,
-    // and both switch regimes refuse an arm that reaches such a block (`analyzeArmExit`).
-    if (loopCtx && loopCtx.breaks.has(b)) {
+    // Inside a switch arm opened in THIS loop (no loop entered since), C binds `break;` to the
+    // switch, so the loop's `break` cannot be spelled here. An arm spells an edge to the loop's exit
+    // only where that exit is the switch's own merge: the code after the switch then IS the exit
+    // region, and the edge structures as any other edge to the merge — the arm's `break;`
+    // (`switchBreakAt`), or nothing in a closed arm, which stops there. An exit whose tail returns
+    // (or that an early-return arm owns) needs no `break`: if-recovery below copies the tail into the
+    // arm, as it does outside a switch when the break rule refuses. Any other exit is refused here,
+    // loud, rather than handed to the printer as a `break` it would rebind.
+    if (loopCtx && loopCtx.breaks.has(b) && armCapturesBreak) {
+      const exit = loopCtx.exit;
+      const tailReturns = exit !== null && (isArm(exit) || isRet(exit));
+      if ((exit === null || armFrame!.merge !== exit) && !tailReturns) {
+        throw new StructureError(
+          `cannot structure '${fn.name}': a case body leaves its switch for a loop exit past the ` +
+            `switch's end (block #${fn.blocks.indexOf(b)}), where \`break\` would leave only the switch`,
+        );
+      }
+    } else if (loopCtx && loopCtx.breaks.has(b)) {
       const frame = loopCtx;
-      const breakIsTaken = takenB === frame.exit;
+      // An arm that runs code before it breaks (`codeBreakArm`) is rendered inside the `if`, ahead of
+      // the `break`, and its last block's copies into the exit are the break's.
+      const arm = frame.breakArms?.find((a) => a.from === b && (a.to === takenB || a.to === fallB));
+      const breakIsTaken = takenB === (arm?.to ?? frame.exit);
       const stayB = breakIsTaken ? fallB : takenB;
       const continueRefused = stayB === frame.header && !continueFallsToBottom(frame, stop);
       const rule = continueRefused
@@ -6041,11 +6936,21 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
           leaveCond = negateCond(leaveCond);
         }
         const [breakEdge, stayEdge] = breakIsTaken ? term.successors : [term.successors[1], term.successors[0]];
-        out.push(mkIf(leaveCond, [...(rule.bare ? [] : argAssignsFor(b, breakEdge)), { k: 'break' }], []));
+        out.push(
+          mkIf(
+            leaveCond,
+            [
+              ...(rule.bare ? [] : argAssignsFor(b, breakEdge)),
+              ...(arm !== undefined ? structureRegion(arm.to, frame.exit) : []),
+              { k: 'break' },
+            ],
+            [],
+          ),
+        );
         out.push(...argAssignsFor(b, stayEdge), ...structureRegion(stayB, stop));
         return out;
       }
-      if (continueRefused || (!isArm(frame.exit) && !isRet(frame.exit))) {
+      if (continueRefused || frame.exit === null || (!isArm(frame.exit) && !isRet(frame.exit))) {
         throw new StructureError(
           `cannot structure '${fn.name}': a break out of block #${fn.blocks.indexOf(b)} ${rule.refusal}`,
         );
@@ -6078,10 +6983,9 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // `stop` stands in for the real join, so it has to BE the real join: one side must already end
     // this region — an admitted arm (its `return` terminates that path) or `stop` itself. Two sides
     // meeting somewhere further down instead would each re-emit everything from there to the bottom,
-    // doubling per nesting level; those keep the CFG join and the old loud decline. Lifting that
-    // needs a post-dominator computed over the body alone with the arms DELETED — treating them as
-    // exits does not work, since post-dominance cannot express "where the paths that did not
-    // return meet".
+    // doubling per nesting level; those take the post-dominator computed over the body alone with
+    // the back edges and the arms DELETED (`loopJoin`, below) — treating the arms as exits does
+    // not work, since post-dominance cannot express "where the paths that did not return meet".
     const clampToLoop =
       loopCtx !== null &&
       ipd !== null &&
@@ -6089,11 +6993,44 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       term.successors.some((sc) => isArm(sc.block) || sc.block === stop) &&
       term.successors.every((sc) => loopCtx!.body.has(sc.block) || isArm(sc.block));
     // In a `while (1)` body the join is the body's own, which the CFG's post-dominance cannot see
-    // (`foreverJoin`): a branch whose one arm continues is post-dominated, in the CFG, by wherever
+    // (`loopJoin`): a branch whose one arm continues is post-dominated, in the CFG, by wherever
     // the other arm leaves the loop from.
     const inForever = loopCtx === null ? undefined : foreverLoops.get(loopCtx.header);
-    const bodyJoin = inForever === undefined ? undefined : foreverJoin(inForever, b);
-    const merge = bodyJoin !== undefined ? (bodyJoin ?? stop) : clampToLoop ? stop : (ipd ?? stop);
+    // A break arm's own blocks join as any code outside the loop does: they are not the body's.
+    const inArm = loopCtx?.breakArms?.some((a) => a.region.has(b)) === true;
+    const bodyJoin = inForever === undefined || inArm ? undefined : loopJoin(inForever, b, true);
+    // THE SAME QUESTION IN A TESTED LOOP. A branch whose one way leads out of the body by a `break` —
+    // the `else break;` of an if/else-if chain — has the loop's exit as its CFG join, and its in-body
+    // arm walked from there through the latch back into the header (`onStack`). Its join is where its
+    // paths that stay in the body meet: the post-dominator over the body with the back edges and the
+    // exits deleted (`loopJoin`). Asked only where the CFG join leaves the body, no clamp applies,
+    // one successor stays in the body, and every way out of the body from here is one the loop
+    // renders in place (`leavesByOwnedEdges`).
+    const tested =
+      loopCtx !== null &&
+      inForever === undefined &&
+      !inArm &&
+      ipd !== null &&
+      !loopCtx.body.has(ipd) &&
+      !clampToLoop &&
+      loopCtx.body.has(b) &&
+      term.successors.some((sc) => loopCtx!.body.has(sc.block) && sc.block !== loopCtx!.header) &&
+      leavesByOwnedEdges(loopCtx, b)
+        ? loopJoin(loopCtx, b, false)
+        : undefined;
+    // Inside a switch arm, the arm's own join wins over every reading above: each of them reads the
+    // CFG, where the arm's paths meet past the switch.
+    const inArmJoin = armJoin(b, stop);
+    const merge =
+      inArmJoin !== undefined
+        ? (inArmJoin ?? stop)
+        : bodyJoin !== undefined
+          ? (bodyJoin ?? stop)
+          : tested !== undefined
+            ? (tested ?? stop)
+            : clampToLoop
+              ? stop
+              : (ipd ?? stop);
     // Per-successor records, NOT successorTo(b, block): a cond_br whose two edges reach the SAME
     // block with different args would otherwise give both arms the first edge's copies.
     const thenS = [...argAssignsFor(b, term.successors[0]), ...structureRegion(takenB, merge)];
@@ -6206,9 +7143,21 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       stmtsEqual(thenS, elseS) &&
       testRereadsOnly(term, b, { defs, useSitesOf, dom, ipdom, loops: forest.byHeader.values() })
     ) {
-      out.push(...thenS);
+      out.push(...unionStmtsEvidence(thenS, elseS));
     } else {
-      out.push(negateHere ? { k: 'if', cond: negateCond(cond), then: elseS, else: thenS } : mkIf(cond, thenS, elseS));
+      // A compare whose runtime helper names the relation the source spelled DECIDES its own sense,
+      // one-armed or two: the arm order is the one that spells that relation, because no spelling
+      // of its negation calls the same helper (l3/ast.ts `keepsHelperRel`). `if (a == b) {} else`
+      // is how the source wrote agbcc's `bl __eqsf2; cmp r0, #0; beq` over the arm.
+      const helperSense = keepsHelperRel(cond) ? false : regainsHelperRel(cond) ? true : undefined;
+      const negate = helperSense ?? negateHere;
+      out.push(
+        negate
+          ? { k: 'if', cond: negateCond(cond), then: elseS, else: thenS }
+          : helperSense === false
+            ? { k: 'if', cond, then: thenS, else: elseS }
+            : mkIf(cond, thenS, elseS),
+      );
     }
     if (merge && merge !== stop) {
       out.push(...structureRegion(merge, stop));
@@ -6347,42 +7296,139 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     // Mirror the br/cond_br cases: argAssigns then structureRegion. Structure the body under this
     // loop's frame so an in-body conditional exit (break / early return) is recognised instead of
     // tripping the header-re-entry `onStack` guard.
-    const body = withLoop({ header: wl.header, exit: wl.exit, body: wl.body, arms: wl.arms, breaks: wl.breaks }, () => [
-      ...argAssigns(wl.header, wl.bodyEntry),
-      ...structureRegion(wl.bodyEntry, wl.header),
-    ]);
+    const body = withLoop(
+      { header: wl.header, exit: wl.exit, body: wl.body, arms: wl.arms, breaks: wl.breaks, breakArms: wl.breakArms },
+      () => [...argAssigns(wl.header, wl.bodyEntry), ...structureRegion(wl.bodyEntry, wl.header)],
+    );
+    // A test whose tail is a float compare the stay sense moves off its runtime helper's relation
+    // (l3/ast.ts `splitHelperBreak`) leaves through a break guard, ahead of the edge's copies: the
+    // header evaluated it before them.
+    const split = splitHelperBreak(cond);
+    if (split !== null) {
+      cond = split.head;
+      body.unshift({ k: 'if', cond: split.guard, then: [{ k: 'break' }], else: [] });
+    }
     const out: Stmt[] = [{ k: 'while', cond, body }];
     out.push(...argAssigns(wl.header, wl.exit)); // phi args carried on the header→exit edge, if any
     out.push(...structureRegion(wl.exit, stop));
     return out;
   };
 
-  // THE JOIN OF A BRANCH IN A `while (1)` BODY, over the body with its back edges and exits deleted.
-  // A block that only jumps back to the header or out of the loop, rendering nothing but that edge's
-  // copies, ENDS its path — a `continue`, a `break` — so it constrains no join; the join of `b` is
-  // where the paths that go on meet: its nearest post-dominator over the rest. Null when none goes
-  // on, and the region's own `stop` ends it. Without the deletion, a branch whose one arm continues
-  // joins at the loop bottom, and whatever the other arm runs before its own continue is copied into
-  // both arms. A block that ends every path but TESTS first is still where its predecessors meet,
-  // and so is a latch two body paths reach: the foot of `for (…) { if (c) {…} }`, where deleting it
-  // moves the `if`'s join into one arm, which then copies the latch and adds a `continue` the
-  // source never wrote. A break block two paths share stays an end, each path its own `break`.
-  const foreverJoins = new Map<Block, Map<Block, Block | null>>();
-  const foreverJoin = (fl: ForeverLoopInfo, b: Block): Block | null => {
-    let ipdom = foreverJoins.get(fl.header);
+  // MAY A BRANCH IN A TESTED LOOP JOIN INSIDE THE BODY? Only where every way out of the body from `b`
+  // is one the loop's own spelling renders in place: a `break` (an edge of `breaks`, or the edge the
+  // loop tests at its header or latch) or an early-`return` arm the loop owns. Any other edge out
+  // leaves for code that is copied wherever it is reached, and a join inside the body would write
+  // that tail into the arm as well.
+  const leavesByOwnedEdges = (frame: LoopFrame, b: Block): boolean => {
+    const exitFrom = whileLoops.get(frame.header)?.header ?? doWhileLoops.get(frame.header)?.latch;
+    const seen = new Set<Block>();
+    for (const stack = [b]; stack.length > 0;) {
+      const x = stack.pop()!;
+      if (x === frame.header || seen.has(x)) {
+        continue;
+      }
+      seen.add(x);
+      for (const sx of successorsOf(x)) {
+        if (frame.body.has(sx)) {
+          stack.push(sx);
+        } else if (
+          !frame.arms.some((a) => a.from === x && a.to === sx) &&
+          !(sx === frame.exit && (frame.breaks.has(x) || x === exitFrom))
+        ) {
+          return false;
+        }
+      }
+    }
+    return true;
+  };
+  // THE JOIN OF A BRANCH IN A LOOP BODY, over the body with its back edges and exits deleted: where
+  // the paths from `b` that stay in the body meet, its nearest post-dominator over the rest. Null
+  // when none goes on, and the region's own `stop` ends it. Without the deletion, a branch whose one
+  // arm continues joins at the loop bottom, and whatever the other arm runs before its own continue
+  // is copied into both arms; in a tested loop, the `else break;` of an if/else-if chain joins at
+  // the loop's exit.
+  //
+  // `endsCut` is the `while (1)` rule, and only `emitForever`'s frames take it: a block that only
+  // jumps back to the header or out of the loop, rendering nothing but that edge's copies, ENDS its
+  // path — a `continue`, a `break` — so it constrains no join either. A block that ends every path
+  // but TESTS first is still where its predecessors meet, and so is a latch two body paths reach: the
+  // foot of `for (…) { if (c) {…} }`, where deleting it moves the `if`'s join into one arm, which then
+  // copies the latch and adds a `continue` the source never wrote. A break block two paths share
+  // stays an end, each path its own `break`. A tested loop's latch is where its test renders, so
+  // there it constrains the join like any block.
+  /** per header, one cache for each value of `endsCut` */
+  const loopJoins = [new Map<Block, Map<Block, Block | null>>(), new Map<Block, Map<Block, Block | null>>()];
+  const loopJoin = (loop: { header: Block; body: Set<Block> }, b: Block, endsCut: boolean): Block | null => {
+    const cache = loopJoins[endsCut ? 1 : 0];
+    let ipdom = cache.get(loop.header);
     if (ipdom === undefined) {
-      const inBody = (n: Block): Block[] =>
-        [...new Set(successorsOf(n))].filter((x) => fl.body.has(x) && x !== fl.header);
-      const ends = (n: Block): boolean =>
-        inBody(n).length === 0 &&
-        n.ops[n.ops.length - 1].opcode === 'br' &&
-        n.ops.every((op) => !effectful(op) && !materialize.has(op)) &&
-        !(successorsOf(n)[0] === fl.header && new Set(preds.get(n)?.filter((q) => fl.body.has(q))).size > 1);
-      ipdom = postDominators(fn, fl.body, (n) => inBody(n).filter((x) => !ends(x)));
-      foreverJoins.set(fl.header, ipdom);
+      ipdom = regionJoins(loop.body, loop.header, endsCut);
+      cache.set(loop.header, ipdom);
     }
     return ipdom.get(b) ?? null;
   };
+  // The post-dominators `loopJoin` reads, over `body` with every edge out of it and every edge back
+  // to `header` (when there is one) deleted — save an edge to `toExit`, which goes to EXIT. Also
+  // the join inside a switch arm (`armJoin`), whose `toExit` is the sibling a falling arm runs into
+  // and null for a closed one.
+  function regionJoins(
+    body: ReadonlySet<Block>,
+    header: Block | null,
+    endsCut: boolean,
+    toExit: Block | null = null,
+  ): Map<Block, Block | null> {
+    const inBody = (n: Block): Block[] => [...new Set(successorsOf(n))].filter((x) => body.has(x) && x !== header);
+    const ends = (n: Block): boolean =>
+      endsCut &&
+      inBody(n).length === 0 &&
+      n.ops[n.ops.length - 1].opcode === 'br' &&
+      n.ops.every((op) => !effectful(op) && !materialize.has(op)) &&
+      !(successorsOf(n)[0] === header && new Set(preds.get(n)?.filter((q) => body.has(q))).size > 1);
+    const exits = (n: Block): boolean => toExit !== null && successorsOf(n).includes(toExit);
+    // IN A FALLING ARM, A PATH THAT CANNOT FALL ENDS WHERE IT LEAVES THE FALLING PATHS. Deleting the
+    // edge to the merge or a `ret` covers only a jump straight off the branch (`if (b) break;`).
+    // When the leaving path runs code first — `if (b) { g(7); break; }`, or a `return k` through a
+    // shared epilogue — its block keeps no edge on, and a block with none is post-dominated only by
+    // itself, so the guard above it would find no join and copy the rest of the arm into both sides.
+    // Such a block is a jump all the same: an edge into a block that can no longer reach the
+    // fall-through is deleted too.
+    let falls: Set<Block> | null = null;
+    if (toExit !== null) {
+      const live = new Set<Block>();
+      for (let grew = true; grew;) {
+        grew = false;
+        for (const n of body) {
+          if (!live.has(n) && (exits(n) || inBody(n).some((x) => live.has(x) && !ends(x)))) {
+            live.add(n);
+            grew = true;
+          }
+        }
+      }
+      falls = live;
+    }
+    const onward = (n: Block): Block[] => inBody(n).filter((x) => !ends(x) && (falls === null || falls.has(x)));
+    // A CYCLE NO PATH LEAVES. An inner loop at the foot of the body — the vblank wait closing a
+    // `while (1)` main loop, `while (q() == 3);` — keeps only its own back edge once the edges
+    // to the header and to the ends are deleted, so its paths never end and post-dominance
+    // over it is undefined: no branch above it would find a join, and each would re-emit the rest
+    // of the body, doubling per `if`. Such a block ends its path at the edge it leaves the cycle
+    // by. A block that reaches an end keeps its edges as they are, so no defined join moves.
+    const reachesEnd = new Set<Block>();
+    for (let grew = true; grew;) {
+      grew = false;
+      for (const n of body) {
+        if (!reachesEnd.has(n) && (onward(n).length === 0 || exits(n) || onward(n).some((x) => reachesEnd.has(x)))) {
+          reachesEnd.add(n);
+          grew = true;
+        }
+      }
+    }
+    return postDominators(fn, body, (n) =>
+      !exits(n) && (reachesEnd.has(n) || successorsOf(n).every((x) => onward(n).includes(x)))
+        ? onward(n)
+        : [...onward(n), null],
+    );
+  }
 
   // Does rendering `root` under `map` re-derive one of `targets`: reach it through the def tree
   // without passing a mapped or a named value, either of which renders as a name?
@@ -6434,15 +7480,22 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // neither reading is the value, decline LOUD, as the do-while latch does.
   const emitForever = (fl: ForeverLoopInfo, stop: Block | null): Stmt[] => {
     dwActive.add(fl.header);
-    const body = withLoop({ header: fl.header, exit: fl.exit, body: fl.body, arms: fl.arms, breaks: fl.breaks }, () =>
-      structureBlock(fl.header, fl.header),
-    );
+    const frame = {
+      header: fl.header,
+      exit: fl.exit,
+      body: fl.body,
+      arms: fl.arms,
+      breaks: fl.breaks,
+      breakArms: fl.breakArms,
+    };
+    const body = withLoop(frame, () => structureBlock(fl.header, fl.header));
     dwActive.delete(fl.header);
     const loop: Stmt = { k: 'while', cond: { k: 'const', value: 1 }, body };
-    if (!breaksOut(body)) {
+    const exit = fl.exit;
+    if (exit === null || !breaksOut(body)) {
       return [loop];
     }
-    const region = exitRegion(fl.exit, fl.body, stop);
+    const region = exitRegion(exit, fl.body, stop);
     const { sub: innerSub, unreadable } = latchInnerSub(fl.header, fl.body, [...fl.breaks], region);
     if (unreadable.size > 0 && rootsOf(region).some((r) => rendersThrough(r, innerSub, unreadable))) {
       throw new StructureError(
@@ -6452,7 +7505,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     }
     return [
       loop,
-      ...(innerSub.size > 0 ? withSub(innerSub, () => structureRegion(fl.exit, stop)) : structureRegion(fl.exit, stop)),
+      ...(innerSub.size > 0 ? withSub(innerSub, () => structureRegion(exit, stop)) : structureRegion(exit, stop)),
     ];
   };
 
@@ -6967,11 +8020,19 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
   // `synthetic:dma_fill_uninit` loses its record here, and so did `kleod:ProcessInputAndUpdateEntities`
   // before that row was retired (2026-09-13).
   const frameRecord = (at: Op): { frame?: { loads: number; stores: number } } => {
+    if (at.attrs[OWN_RETURN_OBJECT] === true || at.attrs[CALL_RETURN_OBJECT] !== undefined) {
+      return {};
+    }
     const off = at.attrs.off as number;
     const roots = new Set<Value>();
     for (const b of fn.blocks) {
       for (const op of b.ops) {
-        if (op.opcode === 'laddr' && (op.attrs.off as number) === off) {
+        if (
+          op.opcode === 'laddr' &&
+          (op.attrs.off as number) === off &&
+          op.attrs[OWN_RETURN_OBJECT] !== true &&
+          op.attrs[CALL_RETURN_OBJECT] === undefined
+        ) {
           roots.add(op.results[0]);
         }
       }
@@ -6988,8 +8049,16 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
             stores++;
           }
         }
+        // a struct passed by value is read whole at the call: the word loads the asm made of it
+        const passed = byValueOperands(op)
+          .map((b) => b.at)
+          .filter((at) => roots.has(op.operands[at]));
+        passed.forEach((at) => {
+          const t = op.operands[at].type;
+          loads += t.kind === 'ptr' && t.to.kind === 'struct' ? Math.ceil((t.to.size ?? 4) / 4) : 1;
+        });
         // every OTHER mention of the address, operands and branch arguments alike
-        const elsewhere = op.operands.some((v, i) => roots.has(v) && !(access && i === 0));
+        const elsewhere = op.operands.some((v, i) => roots.has(v) && !(access && i === 0) && !passed.includes(i));
         if (elsewhere || op.successors.some((sx) => sx.args.some((v) => roots.has(v)))) {
           return {};
         }
@@ -7075,7 +8144,8 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       // halves, so a change to either fails there.
       ...fn.blocks
         .flatMap((b) => b.ops)
-        .filter((op) => op.opcode === 'undef')
+        .filter((op) => op.opcode === 'undef' && !coalescedUndefs.has(op))
+        .filter((op, i, all) => all.findIndex((o) => undefName.get(o) === undefName.get(op)) === i)
         .map((op) => ({
           name: undefName.get(op)!,
           type: varType.get(undefName.get(op)!) ?? op.results[0].type,
@@ -7090,6 +8160,7 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
         }
       : {}),
     ...(localStatics.statics.length ? { statics: localStatics.statics } : {}),
+    ...(localStatics.images.length ? { images: localStatics.images } : {}),
     retType: returnsVoid ? T.void() : returnType(fn),
     body,
     ...(structs.length ? { structs } : {}),
@@ -7098,6 +8169,8 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
     ...(spillSlotOrder !== undefined ? { slotOrder: spillSlotOrder } : {}),
     ...calledOnly({ declaredArgs, declaredReturns }, body),
     ...(dialect !== undefined ? { dialect } : {}),
+    ...(designatedInitializers ? { designators: true as const } : {}),
+    ...(strictPointerConversions ? { strictConversions: true as const } : {}),
   };
   if (fn.localObjects === undefined) {
     return tree;
@@ -7108,9 +8181,30 @@ export function structure(fn: Fn, opts: StructureOptions = {}, hooks: StructureH
       `cannot structure '${fn.name}': names a function-scope static ('${named.symbol}') ${named.refused}`,
     );
   }
+  // The compiler's anonymous constant is spelled only as the initializer of the locals its copies
+  // fill, which the emitter folds (l3/constinit.ts says why there). Asked here, so a function
+  // whose image cannot fold declines loudly rather than reaching an emitter that cannot print it.
+  const image = constantImageRefusal(named);
+  if (image !== null) {
+    throw new StructureError(
+      `cannot structure '${fn.name}': reads the compiler's anonymous constant ('${image.image}') ${image.refused}`,
+    );
+  }
   return named;
 }
 
+/** Each declared-callee table's own key order, name → position, computed once per table object: the
+ *  ranked pass structures every candidate against the same tables. */
+const keyOrders = new WeakMap<object, ReadonlyMap<string, number>>();
+function keyOrder(table: object): ReadonlyMap<string, number> {
+  let order = keyOrders.get(table);
+  if (order === undefined) {
+    order = new Map(Object.keys(table).map((n, i) => [n, i]));
+    keyOrders.set(table, order);
+  }
+  return order;
+}
+
 /** Of each table of declared callees, the entries this body calls — every tree the ranked pass
  *  structures carries its own, and is keyed by its whole text. A table this body calls nothing in is
  *  absent. */
@@ -7124,9 +8218,17 @@ function calledOnly(
       callees.add(e.fn);
     }
   }
+  // Look up the few names this body calls, not every entry of the table: a project's table holds
+  // every function its ELF declares (thousands for pokeemerald), and this runs on each structuring
+  // of each candidate. The result keeps the TABLE's key order, as a whole-table filter would,
+  // because the tree is keyed by its whole text.
   const of = <T>(table: Readonly<Record<string, T>> | undefined): Record<string, T> | undefined => {
-    const called = Object.fromEntries(Object.entries(table ?? {}).filter(([n]) => callees.has(n)));
-    return Object.keys(called).length > 0 ? called : undefined;
+    if (table === undefined || callees.size === 0) {
+      return undefined;
+    }
+    const order = keyOrder(table);
+    const names = [...callees].filter((n) => order.has(n)).sort((a, b) => order.get(a)! - order.get(b)!);
+    return names.length > 0 ? Object.fromEntries(names.map((n) => [n, table[n]])) : undefined;
   };
   const declaredArgs = of(tables.declaredArgs);
   const declaredReturns = of(tables.declaredReturns);
@@ -7295,7 +8397,7 @@ function substVar(e: Expr, from: string, to: string): Expr {
 
 // empty-then peephole: `if (c) {} else { S }` → `if (!c) { S }`
 function mkIf(cond: Expr, thenS: Stmt[], elseS: Stmt[]): Stmt {
-  if (thenS.length === 0 && elseS.length > 0) {
+  if (thenS.length === 0 && elseS.length > 0 && !keepsHelperRel(cond)) {
     return { k: 'if', cond: negateCond(cond), then: elseS, else: [] };
   }
   return { k: 'if', cond, then: thenS, else: elseS };
@@ -7355,11 +8457,31 @@ function* inEdgeRecords(preds: Map<Block, Block[]>, b: Block): Generator<{ pred:
   }
 }
 
-// Immediate post-dominators. EXIT is represented as `null`; ret-blocks post-lead to it. Over the
-// subgraph `keep` induces when given, every member of which must still reach a `ret` inside it — or,
-// with `onward`, over only the edges it names between members of `keep`: a block it names no edge
+/** THE function-level immediate post-dominators, the one definition `structure()` and its
+ *  enumeration gate `hasDivergentSharedRet` both read, so the gate's join for an `if` is the join
+ *  the follow sees. A loop no edge leaves reaches no `ret`, so plain post-dominance would hand
+ *  every block before it every block as a post-dominator, and an `if` ahead of it an arbitrary
+ *  join. Its header ENDS paths as a `ret` does: the region holding the loop ends there
+ *  (`emitForever`). `forest` is the caller's, when it already has one. */
+export function functionPostDominators(
+  fn: Fn,
+  forest: { byHeader: ReadonlyMap<Block, NaturalLoop> } = analyzeLoops(fn, dominators(fn)),
+): Map<Block, Block | null> {
+  const exitless = [...forest.byHeader.values()].filter((nl) => nl.exitEdges.length === 0).map((nl) => nl.header);
+  return postDominators(fn, undefined, undefined, new Set(exitless));
+}
+
+// Immediate post-dominators. EXIT is represented as `null`; ret-blocks post-lead to it, and so do
+// the blocks of `ends` besides their own successors. Over the subgraph `keep` induces when given,
+// every member of which must still reach a `ret` inside it — or, with `onward`, over only the edges
+// it names between members of `keep` (and to EXIT, where it names `null`): a block it names no edge
 // from ends its paths, post-dominated by nothing but itself.
-function postDominators(fn: Fn, keep?: ReadonlySet<Block>, onward?: (b: Block) => Block[]): Map<Block, Block | null> {
+function postDominators(
+  fn: Fn,
+  keep?: ReadonlySet<Block>,
+  onward?: (b: Block) => (Block | null)[],
+  ends?: ReadonlySet<Block>,
+): Map<Block, Block | null> {
   const blocks = keep ? fn.blocks.filter((b) => keep.has(b)) : fn.blocks;
   const nodes: (Block | null)[] = [null, ...blocks];
   const succ = (b: Block): (Block | null)[] => {
@@ -7367,7 +8489,11 @@ function postDominators(fn: Fn, keep?: ReadonlySet<Block>, onward?: (b: Block) =
       return onward(b);
     }
     const term = b.ops[b.ops.length - 1];
-    return term.opcode === 'ret' ? [null] : successorsOf(b).filter((s) => keep === undefined || keep.has(s));
+    if (term.opcode === 'ret') {
+      return [null];
+    }
+    const onwards = successorsOf(b).filter((s) => keep === undefined || keep.has(s));
+    return ends?.has(b) === true ? [...onwards, null] : onwards;
   };
   const pdom = new Map<Block | null, Set<Block | null>>();
   pdom.set(null, new Set([null]));