@asmlift/core 0.9.0 → 0.11.0

package/src/structure/switch-recover.ts

@@ -4,8 +4,10 @@
 // factory takes its dependencies EXPLICITLY (`SwitchRecoverDeps`); `expr`/`structureRegion` are
 // late-bound callbacks into the emission phase, so case bodies reuse the ordinary structuring
 // machinery (loops/ifs inside cases, the onStack guard).
+import { constWord } from '../ir/bits';
 import { Block, Fn, Op, Value, forwardingTarget, isBodyless, successorsOf } from '../ir/core';
 import { orderSensitive } from '../ir/discipline';
+import { SWAPPED_ICMP } from '../ir/opcodes';
 import { Expr, Stmt, SwitchCase } from '../l3/ast';
 
 /** Which side of a relational test a compiler's dispatch lands a pinned case body on. */
@@ -48,6 +50,11 @@ export interface SwitchRecoverDeps {
    *  of "where is this defined" `defs` does not answer. Taken from `structure.ts`, which builds
    *  both halves for def-site anchoring, rather than indexing the parameters a second time. */
   blockOf: (v: Value) => Block | undefined;
+  /** The header and exit of the loop the switch is being structured in, or null outside any loop.
+   *  Read LIVE: the structurer's loop frame is the one current when the switch is met. An edge to
+   *  the exit from inside a case arm is a `break` of that loop, which C binds to the switch instead
+   *  (`analyzeArmExit`), save where the exit is the switch's own merge. */
+  enclosingLoop: () => { header: Block; exit: Block | null } | null;
   /** THE DISPATCH HOIST: the copies of every edge the tree walk collapsed, merged and re-emitted
    *  ONCE ahead of the `switch`. `structure.ts hoistedDispatchAssigns` owns the emission
    *  (suppression, identity elision, `undef`, the write-order sort, `sequentialize`), so this
@@ -60,6 +67,10 @@ export interface SwitchRecoverDeps {
   ) => Stmt[] | null;
   expr: (v: Value) => Expr;
   structureRegion: (b: Block, stop: Block | null) => Stmt[];
+  /** One arm's body, from `entry` to `stop`, inside the switch whose code resumes at `merge`. The
+   *  structurer owns what `break;` means there (structure.ts `structureArm`), so both regimes hand
+   *  it every arm and the exit verdict they read for it. */
+  structureArm: (entry: Block, stop: Block | null, merge: Block | null, exit: ArmExit | undefined) => Stmt[];
 }
 
 /** Where ONE switch arm's region leaves it — the fact that decides whether the arm can be spelled
@@ -70,18 +81,54 @@ export interface SwitchRecoverDeps {
  *   - `fallthrough`  every path out leaves into exactly ONE sibling arm's entry: C's fall-through.
  *                    Only spellable when that sibling is the arm emitted NEXT, which `chainArms`
  *                    below arranges and both regimes then re-read off the emission array (see the
- *                    l3/ast.ts non-neutrality note).
- *   - `unstructurable`  anything else: two different siblings, or a mix of "into a sibling" and
- *                    "out to the merge". C needs a `goto` for those. Regime A declines to
- *                    if-recovery on this verdict; Regime B, having no fallback, fails LOUD. */
-export type ArmExit = { kind: 'break' } | { kind: 'fallthrough'; to: Block } | { kind: 'unstructurable'; why: string };
+ *                    l3/ast.ts non-neutrality note). With `breaks`, some paths out reach the
+ *                    switch's merge instead: `case 1: if (c) break; case 2: …`, the arm's own
+ *                    `break;` on those paths.
+ *   - `goto`         a `fallthrough` exit whose sibling another arm already falls into: the same
+ *                    paths, ending in `goto` to that sibling's case label (l3/ast.ts) instead of
+ *                    running on into it. Only `jumpSharedFallTargets` below makes one, and only
+ *                    Regime B asks it.
+ *   - `unstructurable`  anything else: two different siblings, or a sibling beside a block the
+ *                    switch does not dominate. C needs a `goto` for those. Regime A declines to
+ *                    if-recovery on this verdict; Regime B, having no fallback, fails LOUD.
+ *
+ *  `region` is the arm's own blocks: every block the walk below reached, the entry included. It is
+ *  what the structurer needs to find the arm's own joins (`structure.ts` `armJoin`) and to spell a
+ *  path to the merge in the middle of the arm as `break;` (`switchBreakAt`), in a closed arm as in a
+ *  falling one: `case 1: if (a) { if (b) break; g(1); } h(2); break;`. A closed arm that leaves
+ *  sideways, into a block the switch does not dominate, has none: its paths through such a block
+ *  are not the arm's, and it structures to the CFG's joins. It names those blocks instead
+ *  (`escapedTo`, the first block outside the region on each such path), which decide whether its
+ *  body can still be copied into the arms that fall into it (`copySharedFallTargets`). An arm that
+ *  took such a copy carries the SIBLING's `escapedTo`, not its own first outside block: the blocks
+ *  where the copy steps sideways, which is all the copies read of it. */
+export type ArmExit =
+  | { kind: 'break'; region?: ReadonlySet<Block>; escapedTo?: ReadonlySet<Block> }
+  | { kind: 'fallthrough'; to: Block; breaks: boolean; region: ReadonlySet<Block> }
+  | { kind: 'goto'; to: Block; breaks: boolean; region: ReadonlySet<Block> }
+  | { kind: 'unstructurable'; why: string };
 
 export interface SwitchRecovery {
-  recognizeSwitch: (b: Block, stop: Block | null) => Stmt[] | null;
+  /** `mergeAt`, given the tree's case and default blocks, may name the switch's end ahead of the
+   *  CFG's (structure.ts's join past early returns); `undefined` keeps `ipdom ?? stop`. */
+  recognizeSwitch: (
+    b: Block,
+    stop: Block | null,
+    mergeAt?: (arms: readonly Block[]) => Block | undefined,
+  ) => Stmt[] | null;
   /** shared with the Regime-B (`switch_br`) path in structure.ts. Both regimes recover the
    *  fall-through this returns; on an `unstructurable` verdict Regime A declines to if-recovery and
    *  Regime B, which has no fallback, fails loud. */
-  analyzeArmExit: (entry: Block, b: Block, merge: Block | null, siblings: Set<Block>) => ArmExit;
+  analyzeArmExit: (
+    entry: Block,
+    b: Block,
+    merge: Block | null,
+    siblings: Set<Block>,
+    stopAtLoop?: boolean,
+    jumps?: ReadonlySet<Block>,
+  ) => ArmExit;
+  /** may the copies write out a sibling that leaves sideways into `s`? (`copySharedFallTargets`) */
+  forwardToMerge: (s: Block, b: Block, merge: Block | null, siblings: ReadonlySet<Block>) => boolean;
   /** a block's position in the ASSEMBLY — the arm-order evidence, shared with Regime B so the two
    *  regimes read it from one definition (and one statement of what it rests on). */
   layoutIndex: (blk: Block) => number;
@@ -158,18 +205,6 @@ const INT_MIN = -0x80000000;
 const INT_MAX = 0x7fffffff;
 const ALL: Ranges = [[INT_MIN, INT_MAX]];
 
-/** The same opcode with its operands swapped: `k < x` is `x > k`. */
-const MIRRORED: Record<string, string> = {
-  icmp_slt: 'icmp_sgt',
-  icmp_sgt: 'icmp_slt',
-  icmp_sle: 'icmp_sge',
-  icmp_sge: 'icmp_sle',
-  icmp_ult: 'icmp_ugt',
-  icmp_ugt: 'icmp_ult',
-  icmp_ule: 'icmp_uge',
-  icmp_uge: 'icmp_ule',
-};
-
 /** `[lo, hi]` of the UNSIGNED order as signed intervals: one, or two where it straddles 2^31. */
 function fromUnsigned(lo: number, hi: number): Ranges {
   if (lo > hi) {
@@ -214,7 +249,7 @@ function intersect(a: Ranges, b: Ranges): Ranges {
 
 /** The register values that take the test's BRANCH. */
 function takenBy(ti: TestInfo): Ranges {
-  const op = ti.xOnLeft ? ti.opcode : (MIRRORED[ti.opcode] ?? ti.opcode);
+  const op = ti.xOnLeft ? ti.opcode : (SWAPPED_ICMP[ti.opcode] ?? ti.opcode);
   if (op === 'icmp_eq' || op === 'icmp_ne') {
     const k = ti.k | 0;
     return op === 'icmp_eq' ? [[k, k]] : complement([[k, k]]);
@@ -254,6 +289,204 @@ function singleton(r: Ranges): number | null {
   return r.length === 1 && r[0][0] === r[0][1] ? r[0][0] : null;
 }
 
+/** TWO OR MORE ARMS ENTERING ONE SIBLING'S BODY, put back as copies of it. A compiler that
+ *  cross-jumps (agbcc's and gcc 2.7.2's `jump.c` cross-jumping, KMC's with it) finds two arms
+ *  ending in the same code as a sibling arm and keeps one copy, so `case 1: g(v); gOut = v;
+ *  break; case 2: gOut = v; break; case 3: h(v); gOut = v; break;` comes back with case 1 and
+ *  case 3 both entering case 2's `gOut = v`. C drops into an arm from above along one edge only,
+ *  so read as written that is two fall-throughs into one arm and `chainArms` refuses it — but the
+ *  source had one fall-through at most.
+ *
+ *  WHICH ENTRANT FALLS IS NOT IN THE ASM, so it is a ranked choice (`/tail-copies`,
+ *  rank-variations.ts), never a fixed default. The cross-jump keeps ONE copy of the tail and
+ *  says nothing about which arm the source wrote it under, and one compiler at one set of flags
+ *  answers both ways: KMC `-O2` and gcc 2.7.2 `-O1` lay arm bodies out in SOURCE order, and a
+ *  source whose fall-through arm is written directly above its target in case order recompiles
+ *  only with that arm falling, while one whose arms are written out of case order (`case 3`,
+ *  `case 2`, `case 1`) recompiles nearer with every entrant holding its own copy. Neither the
+ *  layout nor the case order decides it: the copy the cross-jump kept is not the source's
+ *  fall-through, so the arm that physically runs into the tail can be the wrong faller too.
+ *
+ *  - `faller` (the default): at most one entrant keeps its fall-through, the one the caller's
+ *    arm-order policy (`order`, before the chain moves anything) puts DIRECTLY ABOVE the sibling —
+ *    on `switchArmsFollowLayout` targets (agbcc) its layout neighbour, elsewhere the arm before it in
+ *    case order. Every other entrant copies; no entrant above it ⇒ every entrant copies.
+ *  - not `faller`: every entrant copies, whichever arm sits above the sibling.
+ *
+ *  Either way each copying entrant gets the sibling's region written out again under its own arm:
+ *  its exit becomes a closed `break` over the two regions.
+ *
+ *  A `default:` SIBLING takes the LAST arm of `order` as the arm above it: that is where `chainArms`
+ *  puts a default that an arm falls into, at the end. It is not always where the label is printed —
+ *  a target that prints `default:` at its layout position (`defaultLayoutPos`) can put it between two
+ *  cases, and then the arm the source wrote above it is not `order`'s last, and its entrants all copy
+ *  (a measured agbcc shape of that kind still recompiles to its target).
+ *
+ *  A `default:` SIBLING MAY BE CODE THE SOURCE WROTE AFTER THE SWITCH. Where the other arms
+ *  `return` from a void function they reach the same epilogue the default block does, so
+ *  post-dominance ends the switch there, and arms that `break` to the code after the switch read as
+ *  falling into the default block. The copies then write that code into each of them: the same
+ *  program, not the source's spelling (which would end the switch at the default block and spell
+ *  the other arms `return`, a reading nothing makes yet).
+ *
+ *  ONLY OVER A CLOSED SIBLING. The copy is the sibling's region walked again inside the entrant's
+ *  arm, so it is spelled only where that region ends the switch: the sibling's own exit a `break`
+ *  WITH a region — it reaches no sibling of its own and leaves through no block the switch does
+ *  not dominate. A sibling that falls on stays two-into-one for `chainArms` to refuse. PURE: the
+ *  closed exit is exactly what `analyzeArmExit` reads for the entrant once the sibling is no
+ *  longer a sibling — its walk reaches the sibling's blocks, and they reach the merge and nothing
+ *  else — so it is assembled here rather than walked again.
+ *
+ *  OR A SIBLING THAT LEAVES SIDEWAYS ONLY FORWARD. A closed sibling with no region stepped into
+ *  blocks the switch does not dominate (`escapedTo`). Its body is still the switch's end on every
+ *  path where each of those blocks runs only on to the merge or a `ret` — never back into the
+ *  dispatch, a sibling (the entrants among them) or round a cycle; a path out through the
+ *  enclosing loop's exit is one more path to a `ret`. `sidewaysEnds` answers that per block
+ *  (`forwardToMerge`, the caller's to hand in; absent, no such sibling is copied). Nothing in it is
+ *  particular to one compiler: it is asked of every jump table whose shared tail lost its region
+ *  because a block on the tail's way to the merge is also reached from outside the switch. Where it
+ *  shows:
+ *  - agbcc's gcse PRE puts the next switch's index in the dispatch block, which then no longer
+ *    dominates the default the bounds test reaches too, and the default's tail runs on through
+ *    blocks other arms cross-jumped into (`synthetic:jt_xjdefpre`, kleod EntityCreate);
+ *  - with no PRE at all (IDO 7.1 has no gcse), the tail runs on into a second jump table after the
+ *    switch that the other branch of an `if` around it reaches too, and from there to the switch's
+ *    end: in a `for` whose tail `continue`s (switch-arms.test.ts, the ido7.1 `jl_cont` fixture),
+ *    or where a `return` in the tail makes the epilogue the merge, and the copies then write that
+ *    whole second switch into each entrant.
+ *  Each copying entrant then has no region either: like every arm that leaves sideways, it
+ *  structures to the CFG's joins, which walks the sibling's blocks once inside it and stops at the
+ *  merge.
+ *
+ *  `onFallerKept` fires each time `faller` leaves an entrant its fall-through — exactly where the
+ *  two settings of `faller` return different exits. Where it never fires over a whole structuring,
+ *  the other setting builds the same tree, which is what rank.ts reads to skip `/tail-copies`.
+ *  `onCopied` fires with the sibling each time an entrant takes a copy of a CASE arm (not the
+ *  `default:` arm's), which is where `jumpSharedFallTargets` can read a `goto` instead: rank.ts's
+ *  witness for `/case-goto`, and the siblings that variation hands it. */
+export function copySharedFallTargets(
+  order: readonly Block[],
+  dflt: Block | null,
+  exitOf: ReadonlyMap<Block, ArmExit>,
+  faller: boolean,
+  onFallerKept?: () => void,
+  sidewaysEnds?: (s: Block) => boolean,
+  onCopied?: (to: Block) => void,
+): Map<Block, ArmExit> {
+  const out = new Map(exitOf);
+  for (const { to, movers } of sharedFallTargets(order, dflt, exitOf, faller)) {
+    const own = exitOf.get(to);
+    if (own?.kind !== 'break') {
+      continue;
+    }
+    const { region, escapedTo } = own;
+    if (
+      region === undefined &&
+      (escapedTo === undefined || sidewaysEnds === undefined || ![...escapedTo].every(sidewaysEnds))
+    ) {
+      continue;
+    }
+    for (const [e, x] of movers(onFallerKept)) {
+      if (to !== dflt) {
+        onCopied?.(to);
+      }
+      out.set(
+        e,
+        region === undefined
+          ? { kind: 'break', escapedTo: escapedTo! }
+          : { kind: 'break', region: new Set([...x.region, ...region]) },
+      );
+    }
+  }
+  return out;
+}
+
+/** TWO OR MORE ARMS ENTERING ONE SIBLING'S BODY, put back as one fall-through and `goto`s to the
+ *  sibling's case label — where the copies above do not take them (they are read first, and this
+ *  is read over what they leave). It is the source's own spelling of the shape: `case 1: if (c)
+ *  continue; goto L; case 2: if (d) continue; goto L; case 3: case 4: L: …` (kleod sub_0800D188's
+ *  `goto block_1643;`), which every compiler that does not cross-jump a copy into it compiles with
+ *  the sibling's code once. Unlike the copies it needs nothing of the sibling: the sibling's own exit
+ *  is read for itself and may fall on, break, or leave sideways, since the jump does not write it
+ *  out again.
+ *
+ *  WHO FALLS is read from the one place the copies ask it too (`sharedFallTargets`), but with no
+ *  choice in it: the entrant the caller's arm-order policy puts directly above the sibling always
+ *  keeps its fall-through, and every other entrant jumps. A `goto` from that arm would land on the
+ *  label directly below it, a path its plain fall-through already spells, so it is a jump goto-free
+ *  C does not need (asmlift-101 §2.7). `/tail-copies`' setting of `faller` asks which entrant the
+ *  SOURCE wrote the body under, a question a jump does not have: it writes no body.
+ *
+ *  ONLY INTO A CASE ARM: the sibling is in `order`, never `dflt`, since only a case arm carries a
+ *  label (l3/ast.ts `SwitchCase.label`) — and, given `only`, only into those siblings (`/case-goto`
+ *  hands it the case arms the copies wrote back).
+ *
+ *  WHAT MAKES THE JUMP THE SAME PROGRAM is the exit it replaces. A `goto` exit is a `fallthrough`
+ *  exit with its last edge spelled as a jump: the arm is structured to stop at the sibling's entry
+ *  exactly as a falling arm is (structure.ts `structureArm`), so every path that leaves the arm's
+ *  body at its end is a path into the sibling, with the edge's own copies already run, and the
+ *  `goto` is the arm's last top-level statement. The jump lands right after the sibling's case
+ *  labels, which is where a fall-through lands; the emission refuses a sibling that opens with
+ *  switch-edge copies, as it does for a fall-through: entering it by its own case value runs those,
+ *  and the jump, landing above them, would run them again. No loop stands between the jump and the
+ *  label: both are the switch's, in the loop the switch is in. */
+export function jumpSharedFallTargets(
+  order: readonly Block[],
+  dflt: Block | null,
+  exitOf: ReadonlyMap<Block, ArmExit>,
+  only?: ReadonlySet<Block>,
+): Map<Block, ArmExit> {
+  const out = new Map(exitOf);
+  for (const { to, movers } of sharedFallTargets(order, dflt, exitOf, true)) {
+    if (to === dflt || !order.includes(to) || (only !== undefined && !only.has(to))) {
+      continue;
+    }
+    for (const [e, x] of movers()) {
+      out.set(e, { kind: 'goto', to, breaks: x.breaks, region: x.region });
+    }
+  }
+  return out;
+}
+
+type Entrant = [Block, Extract<ArmExit, { kind: 'fallthrough' }>];
+
+/** WHO FALLS, the one answer both rewrites above read: each arm two or more arms fall into (`to`,
+ *  in the order its first entrant comes in `order` and then `dflt`), and `movers` — its entrants
+ *  other than the one that keeps its fall-through, with their exits, which each rewrite spells its
+ *  own way (a copy, a jump). The keeper is the arm the caller's arm-order policy puts directly
+ *  above `to`, where `faller` is set (`dflt` sits below the last of `order`); `movers` fires
+ *  `onFallerKept` when that arm is an entrant, which is where the two settings of `faller` differ.
+ *  It fires on the call, so a rewrite that refuses `to` before asking reports nothing. */
+function sharedFallTargets(
+  order: readonly Block[],
+  dflt: Block | null,
+  exitOf: ReadonlyMap<Block, ArmExit>,
+  faller: boolean,
+): { to: Block; movers: (onFallerKept?: () => void) => Entrant[] }[] {
+  const entrants = new Map<Block, Entrant[]>();
+  for (const e of [...order, ...(dflt ? [dflt] : [])]) {
+    const x = exitOf.get(e);
+    if (x?.kind === 'fallthrough') {
+      entrants.set(x.to, [...(entrants.get(x.to) ?? []), [e, x]]);
+    }
+  }
+  return [...entrants]
+    .filter(([, from]) => from.length >= 2)
+    .map(([to, from]) => {
+      const at = to === dflt ? order.length : order.indexOf(to);
+      const above = faller && at > 0 ? order[at - 1] : undefined;
+      return {
+        to,
+        movers: (onFallerKept?: () => void) => {
+          if (above !== undefined && from.some(([e]) => e === above)) {
+            onFallerKept?.();
+          }
+          return from.filter(([e]) => e !== above);
+        },
+      };
+    });
+}
+
 /** Re-thread `order` so every FALLING arm sits directly above the arm it falls into. Each
  *  fall-through chain is emitted contiguously and takes the position of its HEAD in `order`,
  *  which is the caller's own arm-order policy — so with no fall-through every chain is a
@@ -321,9 +554,11 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     spellSwitchFallthrough,
     emitsOwnStatement,
     blockOf,
+    enclosingLoop,
     hoistDispatchCopies,
     expr,
     structureRegion,
+    structureArm,
   } = deps;
 
   // A block's index in `fn.blocks` as its position in the ASSEMBLY — the warrant for every reading
@@ -333,8 +568,12 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
   //     the list for every conditional-return branch, wherever in the stream that branch sits. So
   //     its real blocks keep address order among themselves, and each synthetic one — a bare
   //     return, never a test — sorts after all of them;
-  //   - raising only ever REMOVES blocks from the list (raise/{divpow2,latch,retsink,shortcircuit}
-  //     .ts all `filter`), never inserts or reorders, so the frontend's order is what survives.
+  //   - raising mostly REMOVES blocks from the list (raise/{divpow2,latch,retsink,shortcircuit}.ts
+  //     all `filter`), but not only: raise/reroll.ts moves a rerolled loop's new head ahead of the
+  //     old one and inserts a block of its own before it. So this order is the frontend's only
+  //     where no reroll fired. A reader that needs the asm's own order wherever a pass rewrote the
+  //     list reads the frontend's record instead (ir/core.ts `AsmLayout`, which the return-tail
+  //     chooser reads); this one has not been moved onto it.
   // TWO READERS, both target-gated, and they need DIFFERENT strengths of the compiler half:
   //   - `switchArmsFollowLayout` (arm ORDER, the sort below) needs the full claim — no block moved
   //     at all — because it PLACES the arms from the layout;
@@ -427,75 +666,12 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
   // has declared that its layout answers it — which SPELLING the source wrote.
 
   // Fold a value that is a compile-time constant (a `const`, or a synthesized immediate like agbcc's
-  // `250 << 2` for a large sparse case) to a number — else null.
-  const evalConst = (v: Value): number | null => {
-    if (isNamed(v)) {
-      return null;
-    } // a named variable is not a constant
-    const d = defs.get(v);
-    if (!d) {
-      return null;
-    }
-    if (d.opcode === 'const') {
-      return (d.attrs.value as number) | 0;
-    }
-    // Resolve the two operands of a binary op to constants (2-operand → both; 1-operand → operand +
-    // `imm` attr, which MUST be present, else decline — a missing imm would wrongly fold `and x` to 0).
-    const operands2 = (): [number, number] | null => {
-      const a = evalConst(d.operands[0]);
-      if (a === null) {
-        return null;
-      }
-      let c: number | null;
-      if (d.operands.length === 2) {
-        c = evalConst(d.operands[1]);
-      } else if (typeof d.attrs.imm === 'number') {
-        c = d.attrs.imm | 0;
-      } else {
-        return null;
-      }
-      return c === null ? null : [a, c];
-    };
-    const bin = (f: (a: number, c: number) => number): number | null => {
-      const p = operands2();
-      return p === null ? null : f(p[0], p[1]) | 0;
-    };
-    const shift = (f: (a: number, c: number) => number): number | null => {
-      const p = operands2();
-      if (p === null || p[1] < 0 || p[1] >= 32) {
-        return null;
-      } // out-of-range shift amount → decline
-      return f(p[0], p[1]) | 0;
-    };
-    switch (d.opcode) {
-      case 'shl':
-        return shift((a, c) => a << c);
-      case 'shr_u':
-        return shift((a, c) => a >>> c);
-      case 'shr_s':
-        return shift((a, c) => a >> c);
-      case 'or':
-        return bin((a, c) => a | c);
-      case 'and':
-        return bin((a, c) => a & c);
-      case 'xor':
-        return bin((a, c) => a ^ c);
-      case 'add':
-        return bin((a, c) => a + c);
-      case 'sub':
-        return bin((a, c) => a - c);
-      case 'neg': {
-        const a = evalConst(d.operands[0]);
-        return a === null ? null : -a | 0;
-      }
-      case 'not': {
-        const a = evalConst(d.operands[0]);
-        return a === null ? null : ~a | 0;
-      }
-      default:
-        return null;
-    }
-  };
+  // `250 << 2` for a large sparse case) to a number — else null. The shared word evaluator
+  // (ir/bits.ts), which declines an opcode it has no rule for: a `neg_s` (Thumb `cmn` under a signed
+  // branch) is no word, so a guard against it is never read as a case bound. A named variable is
+  // not a constant, whatever set it.
+  const words = { defs, opaque: isNamed };
+  const evalConst = (v: Value): number | null => constWord(words, v);
 
   // TWO QUESTIONS about a block, asked separately because the answers diverge and the walk needs
   // both: WHAT does it test (`testInfo`), and may this recovery DISCARD it (`collapsible`)?
@@ -541,6 +717,191 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     return { x, k, cls, opcode: cmp.opcode, xOnLeft };
   };
 
+  // Does `blk` leave the enclosing loop for its exit, other than by the loop's own bottom test (a
+  // block that also edges back to the header, which spells as the loop's condition)?
+  const breaksLoop = (blk: Block): boolean => {
+    const loop = enclosingLoop();
+    const succ = successorsOf(blk);
+    return loop !== null && loop.exit !== null && succ.includes(loop.exit) && !succ.includes(loop.header);
+  };
+
+  // Does a block some arm structures edge to `target`? Walked as `structureArm` walks an arm: every
+  // block reached from the arm's entry without stepping through `merge` or back into `header`. That
+  // is wider than `analyzeArmExit`'s dominated region on purpose: when Regime A recognises a sub-tree
+  // of the comparison tree, an arm can run on into the code of a case the tree's root already took,
+  // which the dispatch does not dominate, and `structureArm` structures that code inside the arm.
+  // A block that also edges back to `header` is the loop's bottom test, which spells as the loop's
+  // condition, not as the arm's (`breaksLoop`) — save where `header` IS the merge (a top-tested
+  // loop): no bottom test is then reachable without passing the merge, and an arm's
+  // `if (c) goto out;` is a block that edges to the exit and straight back into the header.
+  const armsReach = (entries: Iterable<Block>, merge: Block | null, header: Block, target: Block): boolean => {
+    const seen = new Set<Block>(entries);
+    for (const q = [...seen]; q.length;) {
+      const succ = successorsOf(q.pop()!);
+      if (succ.includes(target) && (header === merge || !succ.includes(header))) {
+        return true;
+      }
+      for (const s of succ) {
+        if (s !== target && s !== merge && s !== header && !seen.has(s)) {
+          seen.add(s);
+          q.push(s);
+        }
+      }
+    }
+    return false;
+  };
+
+  // Can a path from `from` reach `to` without passing `through`? False when `to` is null (the end
+  // of the function) or is `through` itself.
+  const reachesAvoiding = (from: Block, to: Block | null, through: Block | null): boolean => {
+    if (to === null || to === through) {
+      return false;
+    }
+    const seen = new Set<Block>([from]);
+    for (const q = [from]; q.length;) {
+      for (const s of successorsOf(q.pop()!)) {
+        if (s === to) {
+          return true;
+        }
+        if (s !== through && !seen.has(s)) {
+          seen.add(s);
+          q.push(s);
+        }
+      }
+    }
+    return false;
+  };
+
+  // THE LOOP-EXIT MERGE, WHERE IT SPELLS. A switch whose merge is its enclosing loop's exit puts
+  // the exit region after the `switch`, INSIDE the loop body, and reaches the loop bottom only
+  // through the arms that do not break. That is the source's text on two conditions, both read off
+  // the CFG here, and on either failing the merge-past-stop gate below declines to if-recovery:
+  //   - the exit region RETURNS: no path from `merge` reaches a block that dominates it (other
+  //     than `merge` itself, a loop of the exit region's own) — the enclosing loop's header, or an
+  //     OUTER loop's, whose back edge the inner body cannot spell
+  //     (`for (j...) { for (;;) { switch ... } out: u += prev; }` runs on to the outer latch);
+  //   - every loop-bottom TEST the arms reach (a block that edges back to the header) leaves for
+  //     the merge itself, which the arm then spells as its `break;` (`latchexit`). One that leaves
+  //     for any other block outside the loop is past what an arm structured against `merge` can
+  //     say: the merge is then the loop's exit only because an early `return` made a shared
+  //     epilogue the dispatch's post-dominator, while the code the bottom test leaves for runs
+  //     before it (`for (w = 0; w < 4; w++) { if (c) return w; switch ... } r(t);` on
+  //     gcc2.7.2kmc).
+  // And the loop's HEADER must not leave for the merge itself. One that does makes the loop
+  // top-tested on it, with the merge as the loop's own exit, which the exit region rendered after
+  // the switch inside the body would leave nothing to reach
+  // (`for (k = 0; k < 3; k++) { if (gC == 7) goto out; switch ... }` becomes `while (gC != 7)`).
+  // A test lower in the body that leaves for the merge ahead of the dispatch spells as its own
+  // `goto` or `break`, and keeps the switch.
+  const exitMergeSpells = (from: Block, merge: Block | null): boolean => {
+    if (merge === null) {
+      return false;
+    }
+    const above = dom.get(merge)!;
+    const exitSeen = new Set<Block>([merge]);
+    for (const q = [merge]; q.length;) {
+      for (const s of successorsOf(q.pop()!)) {
+        if (s !== merge && above.has(s)) {
+          return false;
+        }
+        if (!exitSeen.has(s)) {
+          exitSeen.add(s);
+          q.push(s);
+        }
+      }
+    }
+    const header = enclosingLoop()?.header ?? null;
+    if (header !== null && successorsOf(header).includes(merge)) {
+      return false;
+    }
+    const seen = new Set<Block>([from]);
+    for (const q = [from]; q.length;) {
+      const succ = successorsOf(q.pop()!);
+      if (
+        header !== null &&
+        succ.includes(header) &&
+        succ.some((s) => s !== header && s !== merge && !reachesAvoiding(s, header, merge))
+      ) {
+        return false;
+      }
+      for (const s of succ) {
+        if (s !== header && s !== merge && !seen.has(s)) {
+          seen.add(s);
+          q.push(s);
+        }
+      }
+    }
+    return true;
+  };
+
+  // A SIDEWAYS PATH THAT ONLY RETURNS. An arm can step into a block the switch does not dominate
+  // and still go nowhere but the end of the function: every path from `s` runs forward to a `ret`,
+  // never back into the switch, its merge or a sibling, and never round a cycle. Such an arm spells
+  // the escaping path in place as its `return;` (`case 0: if (c) { k(a); return; } gOut = 1;`
+  // falling into `case 1:`), and a falling arm's join already reads that path as a jump
+  // (`regionJoins`, "a `return k` through a shared epilogue"). It is a property of the ARM, not of
+  // any loop, so it is asked of every jump-table switch (Regime B; `analyzeArmExit` says why not of
+  // Regime A's comparison trees). Where it shows:
+  // - in a loop body, where an arm `return`s into the one epilogue past the loop (agbcc and IDO
+  //   when the code after the loop returns early too, mwcc always) and the switch ends at the
+  //   body's own join (structure.ts, THE LOOP CLAMP);
+  // - outside any loop, where an arm `goto`s a returning tail it shares with code the switch does
+  //   not dominate: a guard above the switch cross-jumped into the same `k(7); return;`, a shared
+  //   `out:` label, the other branch of an `if` around the switch, or a switch with no merge.
+  // The cycle test is a walk of the paths themselves: a block met again while it is still on the
+  // path being walked is a cycle, reducible or not (an IDO `goto mid;` into a `while` body makes an
+  // irreducible one, which a dominance test does not see). An edge to a block that dominates its
+  // source is refused too, since that block may lie above `s` where the walk never put it.
+  //
+  // WITH `mergeEnds` it is the copies' question (`forwardToMerge`): a path may also END at the
+  // merge, and nothing more is admitted. A path out through the enclosing loop's exit is one more
+  // forward path to a `ret`, wherever it falls on the path: the copy writes the code past the loop
+  // and its `return;` inside the case arm. A step round the loop to its header needs no test of its
+  // own: the header dominates every block of the loop, so the dominance test refuses it from inside,
+  // and the cycle test from a path that entered at the header.
+  //
+  // There the SIBLING and CYCLE refusals are conservative, not needed for soundness: forced off, a
+  // tail that steps into a sibling (agbcc, the `jt_xjdefpre` shape with `if (v == 9) return;` in the
+  // tail, so the epilogue is the merge and the empty `case 4:` is a sibling) or round a cycle lifts
+  // correct, that sibling's body or the loop written out in each entrant. They spare that
+  // duplication; dropping one needs a differential over the shapes it then admits.
+  const onlyReturns = (
+    s: Block,
+    b: Block,
+    merge: Block | null,
+    siblings: ReadonlySet<Block>,
+    mergeEnds = false,
+  ): boolean => {
+    const done = new Set<Block>();
+    const onPath = new Set<Block>([s]);
+    const stack: { x: Block; next: number }[] = [{ x: s, next: 0 }];
+    while (stack.length) {
+      const top = stack[stack.length - 1];
+      const succ = successorsOf(top.x);
+      if (top.next === 0 && succ.length === 0 && top.x.ops[top.x.ops.length - 1]?.opcode !== 'ret') {
+        return false;
+      }
+      if (top.next === succ.length) {
+        stack.pop();
+        onPath.delete(top.x);
+        done.add(top.x);
+        continue;
+      }
+      const y = succ[top.next++];
+      if (mergeEnds && y === merge && merge !== null) {
+        continue; // a path that reaches the switch's end
+      }
+      if (y === b || y === merge || siblings.has(y) || onPath.has(y) || dom.get(top.x)!.has(y)) {
+        return false; // back into the switch, or a cycle
+      }
+      if (!done.has(y)) {
+        onPath.add(y);
+        stack.push({ x: y, next: 0 });
+      }
+    }
+    return true;
+  };
+
   // Where does one arm's region LEAVE? Walk it from `entry`, never stepping THROUGH the merge or a
   // sibling arm's entry, and classify what it steps INTO. `siblings` is every OTHER arm entry the
   // caller can emit a `case`/`default` label for — the merge is deliberately not among them, so a
@@ -552,30 +913,62 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
   // sideways does not fall into the next case — and only the FALL-THROUGH verdict consults that
   // record, so an arm that reaches no sibling still closes with a plain `break`.
   //
+  // With `stopAtLoop` (Regime A), a FALLING arm that also reaches the merge must not break the loop
+  // the switch sits in. When the dispatch IS the loop header (agbcc and IDO rotate
+  // `while (k < 4) { k++; switch … }` so), it dominates the loop's exit and all the code after the
+  // loop, and the merge is the header itself, so dominance cannot tell the arm's region from the
+  // code past the loop. Such an arm that falls into a sibling, reaches the merge by the back edge,
+  // and leaves for the loop's exit on a third path (a `goto out`, or a sibling that IS the exit, as
+  // a `default: goto out;` makes it) would read as falling with `breaks`, Regime A would commit,
+  // and the loop-exit refusal in `structure.ts` would fail the whole function where if-recovery
+  // spells it. So it is `unstructurable`. What counts is the block the refusal fires on
+  // (`breaksLoop`): the loop's own bottom test, reached after a `continue`, exits too but is the
+  // loop's condition, and a block that also edges to the merge is the switch's own end. Regime B,
+  // which has no fallback, does not ask: it lifts a jump table whose arms share the rotated latch
+  // and its exit (`do { … switch … t++; } while (t < 15)`).
+  //
   // A CONSEQUENCE, not a hole: a sibling reachable only THROUGH such a block is never seen, so the
   // arm reads as closed and `structureRegion` walks into the sibling's blocks and emits them again
   // under this arm. That is duplication, not a wrong dispatch — the same duplication the structurer
   // already does for any tail two arms share, and how the case bodies agbcc tail-merged are put
   // back. Costly for matching, correct to run.
-  const analyzeArmExit = (entry: Block, b: Block, merge: Block | null, siblings: Set<Block>): ArmExit => {
+  //
+  // `jumps` are blocks an edge into which is a jump that ends its path where it sits, whatever the
+  // switch: the latch of a loop spelled `for`, which the structurer writes as `continue;`. Such an
+  // edge is neither a fall into a sibling nor an escape, and an arm that IS one is a bare jump.
+  const analyzeArmExit = (
+    entry: Block,
+    b: Block,
+    merge: Block | null,
+    siblings: Set<Block>,
+    stopAtLoop = false,
+    jumps: ReadonlySet<Block> = new Set(),
+  ): ArmExit => {
     if (entry === merge) {
       return { kind: 'break' }; // an empty arm (a table slot pointing straight at the switch's end)
     }
+    if (jumps.has(entry)) {
+      return { kind: 'break', region: new Set([entry]) };
+    }
     const into = new Set<Block>(); // sibling entries this arm flows into
+    const escapedTo = new Set<Block>(); // the blocks outside the switch's region it steps into
     let toMerge = false,
-      escapes = false;
+      leavesLoop = false;
     const seen = new Set<Block>([entry]);
     const q = [entry];
     while (q.length) {
       const cur = q.pop()!;
+      leavesLoop ||= !successorsOf(cur).includes(merge as Block) && breaksLoop(cur);
       for (const s of successorsOf(cur)) {
         if (s === merge) {
           toMerge = true;
+        } else if (jumps.has(s)) {
+          continue;
         } else if (s !== entry && siblings.has(s)) {
           into.add(s);
         } else if (s !== entry && !seen.has(s)) {
           if (!dom.get(s)!.has(b)) {
-            escapes = true;
+            escapedTo.add(s);
             continue;
           }
           seen.add(s);
@@ -584,36 +977,50 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
       }
     }
     if (into.size === 0) {
-      return { kind: 'break' };
-    }
-    if (into.size === 1 && !toMerge && !escapes) {
-      return { kind: 'fallthrough', to: [...into][0] };
+      return escapedTo.size > 0 ? { kind: 'break', escapedTo } : { kind: 'break', region: seen };
     }
-    // Name what is actually missing. These three are different facts, and only the first is a shape
-    // C has no spelling for — the other two are asmlift's own limits, so say so rather than blame C.
-    const names = () => [...into].map((x) => `#${layoutIndex(x)}`).join(', ');
-    if (into.size > 1) {
+    // A path to the merge beside the fall-through is the arm's own `break;` — switch-scoped, so it
+    // spells only where nothing breakable sits between that edge and the arm, which the structurer
+    // checks where it emits it (`structure.ts` `switchBreakAt`) and refuses loud otherwise.
+    if (into.size === 1 && toMerge && leavesLoop && stopAtLoop) {
       return {
         kind: 'unstructurable',
-        why: `a case body reaches several sibling cases (${names()}) — C fall-through reaches only one, so this needs a goto`,
+        why: `a case body falls into sibling case ${[...into].map((x) => `#${layoutIndex(x)}`).join(', ')}, reaches the end of the switch, and leaves the loop the switch sits in`,
       };
     }
-    if (escapes) {
+    // A sideways path that only RETURNS does not stop the fall-through (`onlyReturns`): it is a
+    // jump that ends where it sits, as a `ret` inside the arm is. Regime B only. Regime A
+    // (`stopAtLoop`) commits to its `switch` on gates that read an arm's `breaks` alone, and has
+    // if-recovery to fall back on, so a falling arm beside an escape stays `unstructurable` there:
+    // admitted, it commits Regime A to switches whose emission then refuses the whole function (an
+    // escape to a `goto out` past a loop exit, or out of a nested switch) where if-recovery spells
+    // them.
+    if (
+      into.size === 1 &&
+      (escapedTo.size === 0 || (!stopAtLoop && [...escapedTo].every((s) => onlyReturns(s, b, merge, siblings))))
+    ) {
+      return { kind: 'fallthrough', to: [...into][0], breaks: toMerge, region: seen };
+    }
+    // Name what is actually missing. These are two different facts: the first is a shape C's
+    // fall-through cannot spell, the second leaves the switch's region sideways.
+    const names = () => [...into].map((x) => `#${layoutIndex(x)}`).join(', ');
+    if (into.size > 1) {
       return {
         kind: 'unstructurable',
-        why: `a case body reaches sibling case ${names()} on one path and, on another, a block the switch does not dominate`,
+        why: `a case body reaches several sibling cases (${names()}) — C fall-through reaches only one, so this needs a goto`,
       };
     }
     return {
       kind: 'unstructurable',
-      // `case 0: if (c) { …; break; } /* fall through */ case 1:` is the C for this, and the reason
-      // asmlift cannot write it is its own: `{k:'break'}` is emitted only for the innermost LOOP
-      // (l3/ast.ts), never switch-scoped. That is the capability this shape is waiting on.
-      why: `a case body reaches sibling case ${names()} on one path and the end of the switch on another — a switch-scoped \`break\` inside a case body is not emitted yet`,
+      why: `a case body reaches sibling case ${names()} on one path and, on another, a block the switch does not dominate`,
     };
   };
 
-  const recognizeSwitch = (b: Block, stop: Block | null): Stmt[] | null => {
+  const recognizeSwitch = (
+    b: Block,
+    stop: Block | null,
+    mergeAt?: (arms: readonly Block[]) => Block | undefined,
+  ): Stmt[] | null => {
     const root = testInfo(b);
     if (!root) {
       return null;
@@ -831,29 +1238,73 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     }
 
     // PRE2 (arm exits), per SITE. A `break` arm closes; a `fallthrough` arm runs on into the one
-    // sibling it reaches, which `chainArms` then places directly under it. `unstructurable` is a
-    // shape no single linear switch spells — a body reaching two siblings, or a sibling on one path
-    // and the switch's end on another — and Regime A declines to if-recovery, which spells every
-    // one of those edges. (Regime B reads the same verdicts and fails LOUD on either.)
-    const merge = ipdom.get(b) ?? stop;
+    // sibling it reaches, which `chainArms` then places directly under it — on every path, or on
+    // some while the others reach the switch's end, which the arm's own `break;` spells (`breaks`).
+    // `unstructurable` is a shape no single linear switch spells — a body reaching two siblings, or
+    // a sibling beside a block the switch does not dominate — and Regime A declines to if-recovery,
+    // which spells every one of those edges. (Regime B reads the same verdicts and fails LOUD on
+    // either.)
     const targets = new Set<Block>([...caseBlocks, ...(defaultBlk ? [defaultBlk] : [])]);
+    const merge = mergeAt?.([...targets]) ?? ipdom.get(b) ?? stop;
     const siblings = new Set([...targets].filter((t) => t !== merge));
     const exitOf = new Map<Block, ArmExit>();
     for (const t of siblings) {
-      exitOf.set(t, analyzeArmExit(t, b, merge, siblings));
+      exitOf.set(t, analyzeArmExit(t, b, merge, siblings, true));
     }
     // A language with no fall-through in its `case` (Pascal) cannot print a falling arm at all, so
     // for it a falling arm is exactly as unspellable as an `unstructurable` one — and takes the
     // same exit: if-recovery, which that backend prints fine. Asked HERE rather than left to the
     // backend because the backend's refusal is terminal (the whole function becomes a stub) while
     // this one costs nothing but the `switch` spelling.
+    //
+    // A falling arm that also breaks is admitted wherever it falls, the `default:` arm included:
+    // for `case 1: if (c) break; default: f(); break;` the ladder if-recovery writes copies `f()`
+    // into the arm and misses the object the `switch` reaches.
     if (
       [...exitOf.values()].some(
-        (e) => e.kind === 'unstructurable' || (!spellSwitchFallthrough && e.kind === 'fallthrough'),
+        (e) => e.kind === 'unstructurable' || (e.kind === 'fallthrough' && !spellSwitchFallthrough),
       )
     ) {
       return null;
     }
+    // AN ARM'S `break;` NEEDS THE MERGE TO BE THE SWITCH'S END IN THIS REGION. The code after the
+    // `switch` is `structureRegion(merge, stop)`, which reads as that only where every path from
+    // the dispatch reaches `stop` through the merge. A sub-tree whose post-dominator lies PAST the
+    // region's `stop` breaks that: inside a loop body whose dispatch reaches both the latch (`stop`)
+    // and an early `return` block, ipdom is the return, so an arm's path to it would read as a
+    // switch `break` while a sibling arm runs through the latch and back to the header, which
+    // fails the whole function loud. Declined here, to if-recovery, which spells each edge as the
+    // `return` or the fall to the loop bottom it is. A merge that is the enclosing loop's EXIT is
+    // the exception the structurer spells (`exitMergeSpells`): the code after the switch is then
+    // the exit region, and an arm's path to it is the arm's `break;` (`structure.ts`, the loop-exit
+    // rules).
+    if (
+      [...exitOf.values()].some((e) => e.kind === 'fallthrough' && e.breaks) &&
+      !(merge === enclosingLoop()?.exit && exitMergeSpells(b, merge)) &&
+      reachesAvoiding(b, stop, merge)
+    ) {
+      return null;
+    }
+    // AN ARM'S EDGE TO THE LOOP'S EXIT, WHEN THAT EXIT IS NOT THE MERGE. A switch admitted on a
+    // falling arm's `break;` hands every arm to `structureArm`, where an edge to the enclosing loop's
+    // exit can be spelled only as the switch's own end or as a copied returning tail; any other is
+    // refused there, loud, for the whole function (`structure.ts`, "leaves its switch for a loop
+    // exit"). With an early `return` above the dispatch, the merge is the loop bottom, and a sibling
+    // arm's `goto out` to an exit that runs on to an OUTER loop's latch is such an edge. Declined
+    // here to if-recovery, which spells that `goto` as the inner loop's `break`. The exemption is
+    // the exit that is itself a `ret`; the structurer's other one, an early-return arm owning the
+    // edge, is not asked here, which costs only the `switch` spelling.
+    const loop = enclosingLoop();
+    if (
+      [...exitOf.values()].some((e) => e.kind === 'fallthrough' && e.breaks) &&
+      loop !== null &&
+      loop.exit !== null &&
+      loop.exit !== merge &&
+      loop.exit.ops[loop.exit.ops.length - 1]?.opcode !== 'ret' &&
+      armsReach(siblings, merge, loop.header, loop.exit)
+    ) {
+      return null;
+    }
 
     // PRE3 (concrete interval consistency): a `case k` is only sound if the ORIGINAL tree
     // actually routes x==k to its recorded body. A relational guard can make an `x==k` test DEAD (e.g.
@@ -1006,6 +1457,13 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     // The `default:` arm is a chain member too — an arm may run on into it, and C prints it last.
     const dfltArm = defaultBlk !== null && defaultBlk !== merge ? defaultBlk : null;
     const preChain = [...armsByBlock.keys()];
+    // NO COPIES HERE. Arms a cross-jump sent into one sibling's body do not linearize, and Regime
+    // B reads them back as copies (structure.ts, THE COPIES) because its only alternative is a loud
+    // failure. Regime A's alternative is if-recovery, which LIFTS: a copy reading here would replace
+    // one lift with another, the choice between two legal spellings of one CFG that only a ranked
+    // variation may make (docs/level-tower.md). On comparison trees agbcc and KMC cross-jumped,
+    // the switch spelling measured nearer the target on some and further on others, and no corpus
+    // row reaches this point, so the refusal stands and if-recovery answers.
     const entries = chainArms(preChain, dfltArm, exitOf);
     if (entries === null) {
       return null;
@@ -1085,13 +1543,13 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
       // built, and no row asks for it (`sw_jtfall`/`sw_jtfalldesc` match today).
       outCases.push({
         values: armsByBlock.get(blk)!,
-        body: structureRegion(blk, to ?? merge),
+        body: structureArm(blk, to ?? merge, merge, exitOf.get(blk)),
         fallsThrough: to !== null,
       });
     }
     // An empty default arm is not a default (see the Regime-B note in structure.ts): the label
     // would carry no statement, which says nothing and is not valid C89.
-    const defBody = defaultBlk ? structureRegion(defaultBlk, merge) : [];
+    const defBody = defaultBlk ? structureArm(defaultBlk, merge, merge, exitOf.get(defaultBlk)) : [];
     // The `default:` arm is an ARM: where its block is laid out is read exactly as a case body's is
     // (`defaultLayoutPos`). The dispatch placed that block itself when the last test simply RAN OUT
     // into it and no other subtree jumps there — the two references the tree walk can count.
@@ -1135,7 +1593,12 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     }
     return out;
   };
-  return { recognizeSwitch, analyzeArmExit, layoutIndex, defaultLayoutPos, chainArms };
+  /** `copySharedFallTargets`' `sidewaysEnds`: does every path from `s`, a block outside the
+   *  switch's region, run only forward to `merge` or a `ret` (`onlyReturns` with the merge as an
+   *  end)? */
+  const forwardToMerge = (s: Block, b: Block, merge: Block | null, siblings: ReadonlySet<Block>): boolean =>
+    merge !== null && onlyReturns(s, b, merge, siblings, true);
+  return { recognizeSwitch, analyzeArmExit, forwardToMerge, layoutIndex, defaultLayoutPos, chainArms };
 }
 
 /** Internal surface for this module's own tests, and for nothing else: PRE3 reads each test