@asmlift/core 0.4.0 → 0.5.0

package/src/frontend/thumb.ts

@@ -14,7 +14,7 @@
 // modelling is needed; they simply fall through the decode/fill switch. Because agbcc may
 // copy a callee-saved argument (e.g. into r4) before touching r0, entry parameters are
 // ordered by ABI register (r0, r1, …), not by the order they were first read.
-import { Fn, Successor, Value, mkOp, mkValue } from '../ir/core';
+import { Fn, Op, Successor, Value, mkOp, mkValue } from '../ir/core';
 import type { Opcode } from '../ir/opcodes';
 import { T } from '../ir/types';
 import { type Prototypes, protoArity } from '../proto';
@@ -27,7 +27,7 @@ import { FrontendUnsupportedError } from './errors';
 import { assertInputFormat } from './format';
 import type { Frontend } from './frontend';
 import { opaqueDest } from './opaque';
-import { abiSortEntryParams, fallbackArgc, makeSsaBuilder } from './ssa';
+import { abiSortEntryParams, fallbackArgc, makeSsaBuilder, stackSlotKey } from './ssa';
 
 interface Instr {
   /** the CANONICAL spelling — legacy names are normalised (see LEGACY_MNEMONICS) so that every
@@ -71,17 +71,16 @@ interface AsmBlock {
 // than in decode arms like MIPS's `move` or PPC's `slwi`. That distinction, and why there is no
 // shared alias helper across the three frontends, is written up once in ./opaque.ts.
 //
-// The LOAD aliases matter more than the store ones, and the asymmetry is worth knowing: an
-// unrecognised `stm*` matches `opaquePolicy.storeClass` and fails LOUD, but an unrecognised `ldm*`
-// does not — it reaches opaqueDest, which takes ops[0] (the BASE) as the destination, so the opaque
-// is dead, DCE removes it, and the load silently vanishes. Measured: `ldmfd r1, {r0}; bx lr` lifted
-// to `return a0;` where the answer is `return *a0;`. Every load spelling ARMv4T Thumb accepts is
-// therefore listed. (`ldmed`/`ldmea` are NOT: they mean IB/DB, which Thumb-1 does not have, and
-// `as` rejects them — so they cannot appear.)
+// This table is about COVERAGE, not soundness: a spelling missing from it declines loudly like any
+// other unmodelled instruction, and listing one buys that the function LIFTS instead. Every load
+// spelling ARMv4T Thumb accepts is listed, because declining a whole function over a synonym is a
+// poor trade. Note what may NOT justify an omission: "`as` rejects it, so it cannot appear". This
+// frontend parses TEXT — from luvdis/objdump/IDA/Ghidra and hand-written .s — so what some
+// assembler accepts says nothing about what it will be handed.
 //
-// `stmfd` is deliberately absent, and the asymmetry is real rather than an oversight: `stmfd` is
-// `stmdb`, and ARMv4T Thumb has neither — `as` rejects both with "selected processor does not
-// support ... in Thumb mode". There is nothing to normalise it TO.
+// `stmfd` is deliberately absent, and the asymmetry is real rather than an oversight: `stmfd` IS
+// `stmdb` (decrement-before), and ARMv4T Thumb has no decrement-before store — so there is nothing
+// to normalise it TO. A fact about the instruction set, not about an assembler. It declines.
 //
 // Null-prototype so that an inherited key (`constructor`, `toString`) cannot be mistaken for an
 // entry. Unreachable from real assembly, but the lookup should not depend on that.
@@ -94,6 +93,15 @@ const LEGACY_MNEMONICS: Readonly<Record<string, string>> = Object.assign(Object.
   stmea: 'stmia',
 });
 
+// An offset far above the frame cannot be an argument — agbcc passes at most a handful on the
+// stack, and an absurd index would mint a signature with hundreds of parameters from one bad
+// offset. 16 is well past any real agbcc call and still refuses nonsense loudly.
+//
+// It bounds TOTAL arity, register arguments included (12 stack slots on a 4-register ABI), because
+// that is the unit the index it is compared against is counted in. A refusal bound, not an ABI
+// fact: nothing may read it as a statement about how many arguments the convention allows.
+const MAX_RECOVERED_ARITY = 16;
+
 function canonicalMnemonic(mn: string): string {
   return LEGACY_MNEMONICS[mn] ?? mn;
 }
@@ -178,7 +186,11 @@ const imm = (s: string) => parseInt(s.replace(/^#/, ''), s.includes('0x') ? 16 :
 // ambiguous and left UNEXPANDED — but its endpoints ARE surfaced as separate tokens so pc/lr
 // detection sees them, and any consumer that needs the exact list rejects the leftover `-` token
 // loudly rather than treating the fused range as one phantom register.
-const REG_NUM: Record<string, number> = { sp: 13, lr: 14, pc: 15 };
+// Null-prototype for the same reason LEGACY_MNEMONICS has one: this table is consulted with `in`
+// to decide whether a reglist token is a DEFINITE register, and an inherited key (`constructor`,
+// `toString`) answering true would let a junk token pass that test instead of poisoning the frame
+// depth. Unreachable from real assembly; the guarantee should not depend on that.
+const REG_NUM: Record<string, number> = Object.assign(Object.create(null), { sp: 13, lr: 14, pc: 15 });
 
 // Thumb-1 data-processing mnemonics that write the condition flags when their destination is a LOW
 // register — which is all of them on this ISA, `s`-suffix or not (the assembler picks the encoding).
@@ -247,6 +259,29 @@ function expandRegList(tokens: string[]): string[] {
   return out;
 }
 
+// Expand a register list and vouch that every entry is a DEFINITE register, or return null.
+//
+// The two consumers tokenize differently (the ldm/stm arm has a base register to slice off, the
+// frame walk does not), so each keeps its own tokenizing — but the VALIDATION has to be one
+// function, because the two hand-rolled versions had drifted to unequal strength. The frame walk
+// required every token to be a real register; the ldm/stm arm only rejected a leftover `-`, so
+// `ldmia r1!, {foo}` lifted and emitted `s32 f(s32 a0, s32 a1) { return a0; }` — a parameter
+// fabricated from a token that names no register, which is the phantom this frontend's guards
+// exist to prevent.
+//
+// An unexpandable range leaves its raw `-` token (see expandRegList) and fails here; so does an
+// unknown alias, which a `Number.isNaN(regNum(t))` test would MISS, since regNum returns undefined
+// for one and `Number.isNaN(undefined)` is false. An empty list is a malformed list, not an empty
+// transfer. Lowercase-only is deliberate and free: an uppercase mnemonic declines as unmodelled
+// long before either consumer runs.
+function definiteRegList(tokens: string[]): string[] | null {
+  const list = expandRegList(tokens);
+  if (list.length === 0) {
+    return null;
+  }
+  return list.every((s) => /^r\d+$/.test(s) || s in REG_NUM) ? list : null;
+}
+
 // Split an operand list on commas that are NOT inside brackets, so a memory operand like
 // `[r0, #0x8]` (base + offset) stays a single token instead of being torn at its comma.
 function splitOperands(s: string): string[] {
@@ -841,7 +876,10 @@ function decode(name: string, asm: string): { blocks: AsmBlock[]; dataWords: Map
 // (they did — the drift fabricated phantom pointer params on symbol-pool loads).
 const POOL_LABEL = /^([A-Za-z_.$][\w.$]*)(?:\s*\+\s*(0x[0-9a-fA-F]+|\d+))?$/;
 
-type PoolRef = { kind: 'const'; value: number } | { kind: 'gaddr'; sym: string } | { kind: 'unmodelled'; why: string };
+type PoolRef =
+  | { kind: 'const'; value: number }
+  | { kind: 'gaddr'; sym: string; addend: number }
+  | { kind: 'unmodelled'; why: string };
 
 /** Classify a word-load operand `LABEL[+N]` against the captured literal pools. Returns null when
  *  the operand does NOT name a pool (a real register/memory base → the normal load path). When it
@@ -867,12 +905,21 @@ function poolRef(operand: string, dataWords: Map<string, string[]>): PoolRef | n
     const val = w.startsWith('-') ? -Number(w.slice(1)) : Number(w);
     return Number.isFinite(val) ? { kind: 'const', value: val } : { kind: 'unmodelled', why: `unparsable word '${w}'` };
   }
-  // A bare C identifier that is NOT a `.L` code label → the address of a named global. A `sym+N`
-  // offset, or a `.L` label (jump table / code address surviving to here), is unmodelled.
-  if (/^[A-Za-z_]\w*$/.test(w) && !w.startsWith('.L')) {
-    return { kind: 'gaddr', sym: w };
+  // A C identifier that is NOT a `.L` code label → the address of a named global, optionally with
+  // a byte ADDEND folded into the pool word (`gBgTilemapBufs+0x14a` — agbcc pre-computes a fixed
+  // element's address into the pool rather than emitting an add). The addend stays in VALUE space:
+  // the consumer emits `gaddr` then an explicit `add`, the exact spelling the register-materialised
+  // `ldr rN,=gSym; add rN,#k` shape already lowers to — so it renders through the same audited
+  // cast-based path (`((u8 *)&gSym) + k`), never through a typed-pointer scale that a
+  // rendered-vs-value addend could silently multiply (the DEREF-TYPING class).
+  const sm = w.match(/^([A-Za-z_]\w*)\s*(?:([+-])\s*(0x[0-9a-fA-F]+|\d+))?$/);
+  if (sm && !sm[1].startsWith('.L')) {
+    const mag = sm[3] ? Number(sm[3]) : 0;
+    if (Number.isFinite(mag)) {
+      return { kind: 'gaddr', sym: sm[1], addend: sm[2] === '-' ? -mag : mag };
+    }
   }
-  return { kind: 'unmodelled', why: `pool word '${w}' is a symbol offset or code label` };
+  return { kind: 'unmodelled', why: `pool word '${w}' is not a symbol, symbol±offset, or number` };
 }
 
 /** Does this function's literal pool name at least one EXTERNAL symbol?
@@ -895,10 +942,13 @@ function poolNamesASymbol(dataWords: Map<string, string[]>, blockLabels: Set<str
   for (const [, words] of dataWords) {
     for (const raw of words) {
       const w = raw.trim();
-      if (!/^[A-Za-z_]\w*$/.test(w) || w.startsWith('.L')) {
+      // `gSym+0x14a` names a symbol as surely as `gSym` does — the witness must count both, or an
+      // asm whose pools carry only addend words would wrongly permit numeric promotion.
+      const sym = w.match(/^([A-Za-z_]\w*)\s*(?:[+-]\s*(?:0x[0-9a-fA-F]+|\d+))?$/)?.[1];
+      if (sym === undefined || sym.startsWith('.L')) {
         continue;
       }
-      if (!dataWords.has(w) && !blockLabels.has(w)) {
+      if (!dataWords.has(sym) && !blockLabels.has(sym)) {
         return true;
       }
     }
@@ -923,6 +973,76 @@ interface JumpTable {
   caseLabels: string[];
   defaultLabel: string;
 }
+
+// Accept a data-processing mnemonic in either the pre-UAL (`lsl`, `add`) or UAL (`lsls`, `adds`)
+// spelling, WITHIN THE DISPATCH BLOCK ONLY.
+//
+// In Thumb-1 the trailing `s` is a DIALECT MARKER, not a modifier: `.syntax divided` spells the
+// flag-setting data-processing instructions without it, `.syntax unified` with it. For a LOW-register
+// destination each pair is one halfword — measured with this project's own assembler, one instruction
+// per file, both dialects, encoding read back with objdump:
+//
+//     add/adds 1888   sub/subs 1a88   lsl/lsls 0088   lsr/lsrs 0888   asr/asrs 1088   neg/negs 4248
+//
+// This is the dominant dialect of the input format asmlift advertises: every pret-style split wraps
+// its `INCLUDE_ASM` bodies in `.syntax unified`, where the non-suffixed spelling is a syntax ERROR,
+// and the split `.s` files carry no `.syntax` directive of their own — so this frontend cannot tell
+// from its input which dialect it is reading, and must accept both. Counted under
+// `asm/nonmatchings` of the Klonoa: Empire of Dreams tree: `lsls` 5795 against `lsl` 0, and `adds`
+// 8883 against `add` 600 — where **every one** of those 600 is an `sp`/high-register/pc form and not
+// one is the three-operand low-register `add rD, rN, rM` this idiom uses. Comparing the text alone
+// therefore declined every jump table in that corpus, on input that is not malformed in any way.
+// (agbcc's own output is the other dialect — 2957 `lsl` in this project's `build-gdwarf/src/*.s` —
+// which is why the benchmark, built from compiler `.s`, never exercised this.)
+//
+// Why LOCAL rather than an entry in LEGACY_MNEMONICS, which is where synonyms belong: normalising
+// the suffix away is safe for every input an ASSEMBLER ACCEPTS — the operands that distinguish `add`
+// from `adds` (the SP adjust `add sp, sp, #4` = b001, the high-register `add r8, r0` = 4480) have no
+// S-form at all, so `adds sp` and `adds r8, r0` are rejected in both dialects and cannot appear in
+// any assemblable file. But this frontend REFUSES those spellings loudly today, and a flat
+// `adds: 'add'` entry silently turns `adds sp` into ordinary frame bookkeeping instead: the entry
+// was written, and `decline-guards.test.ts` failed on exactly that case. So the reason to keep it
+// local is input VALIDATION, not semantics — a name-keyed table cannot say "only when the
+// destination is a low register", and giving up the refusal buys nothing, since no assembler emits
+// what it refuses.
+//
+// Known false declines, all loud, none with a corpus instance: a parenthesised immediate (`#(2)`,
+// which gas assembles), a two-operand `adds rA, rP` (the same add, but `addSrcs` has one source),
+// and `movs pc, rV` (which IS `mov pc, rV` — 4687 — under divided syntax, and which `classifyXfer`
+// accepts, so the frontend is internally inconsistent about it).
+//
+// Inside the dispatch block the distinction is additionally UNOBSERVABLE: the block computes
+// `table_base + index*4`, loads the target and writes `pc`. Nothing between the `lsl` and the
+// `mov pc` reads NZCV, no path leaves the block by falling through, and on a successful recovery the
+// block is ELIDED from the CFG entirely — the bounds test that does feed a conditional branch lives
+// in `bounds`, whose `cmp`/`bhi`/`bls` this function matches by exact name. Doubly moot in fact,
+// since `lsl rD, rS, #imm` is low-register-only, so the add here is always the low-register form.
+const isDataOp = (mn: string, base: 'lsl' | 'add'): boolean => mn === base || mn === `${base}s`;
+
+// A shift amount is a NUMBER, not a spelling. `#2`, `#0x2` and `#0x02` are the same shift; the
+// recogniser used to compare the operand text and so rejected the third.
+//
+// The operand must be a plain integer LITERAL, and that shape check is the whole point of this
+// helper rather than an incidental guard. `imm()` is `parseInt`, which stops at the first character
+// it cannot consume, so it reads `#2*2` as 2 — and `#2*2` is not malformed, it is an expression gas
+// accepts and assembles to `lsls r0, r1, #4`. Matching it as a shift by two would recover a switch
+// whose stride is wrong by a factor of four: the emitted C is entirely ordinary and dispatches to
+// the wrong BLOCK, with no marker. `#2+1`, `#2-1` and `#2<<1` are the same trap. An adversarial
+// probe found this after the first cut of this helper shipped with exactly that hole, and the test
+// that claimed to pin the property sampled only `#3`/`#0x3`/`#0x1`/`r2` and so passed anyway.
+//
+// Anything that is not a bare decimal or hex literal therefore DECLINES, which is the safe
+// direction: a real dispatch spells its shift as a literal. Known false declines, all loud and none
+// observed in any corpus: a binary literal (`#0b10`) and a signed one (`#+2`).
+//
+// One divergence is knowingly left in, and it is inert AT THE ONLY VALUE THIS IS USED WITH.
+// A leading zero means octal to gas and decimal to `Number`, so `#010` is 8 there and 10 here —
+// but both readings are compared against 2, both fail, and the dispatch declines either way; `#02`
+// is 2 under both. **If this helper is ever reused for a `want` other than 2, that has to be
+// revisited**, because for e.g. `want === 8` the two readings disagree about `#010`.
+const IMM_LITERAL = /^#\s*(?:0[xX][0-9a-fA-F]+|[0-9]+)$/;
+const immEq = (op: string | undefined, want: number): boolean =>
+  op !== undefined && IMM_LITERAL.test(op) && Number(op.slice(1).trim()) === want;
 function recoverJumpTable(
   bounds: AsmBlock,
   disp: AsmBlock,
@@ -976,7 +1096,7 @@ function recoverJumpTable(
     return null;
   }
   const [lsl, ldrP, add, ldrV, movpc] = d;
-  if (lsl.mnemonic !== 'lsl' || lsl.ops[1] !== scrutReg || (lsl.ops[2] !== '#0x2' && lsl.ops[2] !== '#2')) {
+  if (!isDataOp(lsl.mnemonic, 'lsl') || lsl.ops[1] !== scrutReg || !immEq(lsl.ops[2], 2)) {
     return null;
   }
   const idxReg = lsl.ops[0]; // rY = rX << 2  (index*4, identity guard)
@@ -985,19 +1105,40 @@ function recoverJumpTable(
   }
   const ptrReg = ldrP.ops[0],
     ptrLabel = ldrP.ops[1]; // rP = *(PTR literal)
-  if (add.mnemonic !== 'add' || add.ops[0] !== idxReg) {
+  if (!isDataOp(add.mnemonic, 'add') || add.ops[0] !== idxReg) {
     return null;
   }
   // add rY, rY, rP  (either operand order) — the address = table_base + index*4, nothing else.
+  //
+  // The two sources must be DISTINCT registers. Membership alone is satisfied by one register
+  // listed twice, and that is not a hypothetical shape: if the pointer load targets the index
+  // register (`lsl r0,r1,#2 ; ldr r0,=PTR ; add r0,r0,r0`) the index is overwritten before it is
+  // ever added, `idxReg === ptrReg`, and both `includes` tests pass on `r0`. The address formed is
+  // `2 * table_base` and the scrutinee is dead — yet the recogniser would emit `switch (a0)` and
+  // dispatch on a value the hardware never uses. Wrong block, no marker. Found by an adversarial
+  // probe; it predates the spelling fix this guard sits next to, and is fixed here because it is
+  // the same identity-or-decline rule.
   const addSrcs = [add.ops[1], add.ops[2]];
-  if (!(addSrcs.includes(idxReg) && addSrcs.includes(ptrReg))) {
+  if (idxReg === ptrReg || !(addSrcs.includes(idxReg) && addSrcs.includes(ptrReg))) {
     return null;
   }
   if (ldrV.mnemonic !== 'ldr') {
     return null;
   }
-  const { base } = parseAddr(ldrV.ops[1]); // rV = *(rY)
-  if (base !== idxReg || ldrV.ops[0] !== movpc.ops[1]) {
+  // rV = *(rY), and the address must be EXACTLY rY: no displacement, no register index.
+  //
+  // `parseAddr` surfaces `off` and `regOff` for precisely this reason — its own comment says
+  // "surfaced to the caller so load/store DECLINE loud: silently reading `[rB]` dropped the index
+  // — a silent miscompile" — and this caller used to destructure `base` alone and throw both away.
+  // `ldr rV, [rA, #4]` loads table[i+1]: the recovered switch says `case 0` while the hardware
+  // reaches case 1's block, and the last case reads a word past the table. `ldr rV, [rA, r2]` adds
+  // an unrelated register. Both used to recover an ordinary-looking `switch` — a wrong BLOCK, with
+  // no marker. The header of this function already claimed to refuse an "extra offset"; now it does.
+  //
+  // `#0` is the spelling the corpus actually uses (`ldr r0, [r0, #0x00]`), so the check is on the
+  // VALUE, not on the operand's absence.
+  const { base, off, regOff } = parseAddr(ldrV.ops[1]);
+  if (base !== idxReg || off !== 0 || regOff !== undefined || ldrV.ops[0] !== movpc.ops[1]) {
     return null;
   }
   if (movpc.mnemonic !== 'mov' || movpc.ops[0] !== 'pc') {
@@ -1198,16 +1339,73 @@ export function lift(
   };
   const reg = (s: string) => s.replace(/[[\]]/g, '');
 
+  // THE one test for "is this token the stack pointer". Case-insensitive because GNU as accepts
+  // uppercase register names, and a case-sensitive test here is a silent-wrong-answer hole rather
+  // than a cosmetic one: `add r0, SP, #4` is `&local`, and missing it fabricates a phantom
+  // parameter and emits confident arithmetic on it.
+  const isSpReg = (s: string | undefined): boolean => {
+    const r = reg(s ?? '').toLowerCase();
+    return r === 'sp' || r === 'r13';
+  };
+
+  // Writing sp is transparent frame bookkeeping ONLY in the one shape that cannot change anything
+  // observable: `sp = sp ± immediate`. Two producers feed this frontend and each emits exactly ONE
+  // spelling, which is why both must work and why handling only one silently halved the input:
+  //
+  //     producer                                    `add sp, #N`   `add sp, sp, #N`
+  //     agbcc's own .s (checkouts/*/build/src)            0                98
+  //     disassembly (klonoa asm/ · sa3 asm/)           203 · 1250           0
+  //
+  // So this is not "one tool with two spellings" — it is the compiler's convention against the
+  // disassembler's, and asmlift reads both kinds of file. (An earlier commit message on this branch
+  // claimed agbcc emitted both; it does not, and the counts above are the check that settles it.)
+  //
+  // Everything else that writes sp is a
+  // frame change this frontend cannot model: a register-sized adjustment (`add sp, r4`, agbcc's
+  // way of spelling a frame too large for the 7-bit immediate), a computed stack pointer
+  // (`add sp, r0, #4`), or `mov sp, rN`. Those must DECLINE, not vanish — dropping them deletes a
+  // frame change with no diagnostic, which is the exact
+  // loud-becomes-silent trade this frontend's guards exist to prevent.
+  //
+  // Flag-setting spellings (`adds`/`subs`) are excluded deliberately: ARMv4T's SP-adjust encoding
+  // does not set flags, so a flag-setting one can only come from hand-written asm, where dropping
+  // it would leave a stale compare for a following conditional branch to fold. There are 0 in the
+  // benchmark corpus and 0 across the klonoa and sa3 checkouts, so excluding them costs nothing.
+  // The decline names WHY the slot model is off when it is (slotsOffReason, assigned below —
+  // referenced through the closure, so this reads the final value at throw time). The gap
+  // histogram is the improvement loop's work-list, and "local stack frames not supported" was a
+  // false attribution for a function whose frame IS modelled but whose blocker is, say, an
+  // address-taken local or an outgoing stack argument — it sent the loop to build the wrong thing.
+  const spAsDataError = () =>
+    new FrontendUnsupportedError(
+      `cannot lift '${name}': stack pointer used as data — ` +
+        (slotsOffReason ?? 'not a modelled slot (address-taken local / frame arithmetic / above the local area)'),
+    );
+
+  const isFrameAdjust = (
+    mnemonic: string,
+    dest: string | undefined,
+    base: string | undefined,
+    off: string | undefined,
+  ): boolean =>
+    (mnemonic === 'add' || mnemonic === 'sub') &&
+    isSpReg(dest) &&
+    (base === undefined || isSpReg(base)) &&
+    (off?.startsWith('#') ?? false);
+
   // Reading sp as a DATA operand means an address-taken local (`add rD, sp, #N` = `&local`),
   // an sp-relative spill slot (`ldr/str …, [sp, #N]`), or frame-pointer arithmetic — none
-  // modellable without a stack abstraction. sp is never WRITTEN (sp-dest ops are transparent
-  // frame bookkeeping), so Braun SSA would materialize it as a fabricated PHANTOM parameter that
-  // scrambles the signature. Fail LOUD instead, mirroring MIPS (`isStackPtr`) and PPC (`r1`).
+  // modellable without a stack abstraction. Without this guard Braun SSA would materialize sp as a
+  // fabricated PHANTOM parameter that scrambles the signature. Fail LOUD instead, mirroring MIPS
+  // (`isStackPtr`) and PPC (`r1`).
+  //
+  // sp is never WRITTEN either — but by `writeData` declining, NOT because sp-dest ops are inert.
+  // That was this file's premise until the frame-adjust whitelist landed, and it was wrong: five
+  // decode arms wrote sp and dropped it silently. The single transparent shape is `sp = sp ± imm`,
+  // whitelisted in the add/sub arms. Read and write are now guarded symmetrically.
   const readData = (r: string, b: number): Value => {
-    if (r === 'sp' || r === 'r13') {
-      throw new FrontendUnsupportedError(
-        `cannot lift '${name}': stack pointer used as data (address-taken local / sp-relative slot / frame arithmetic) — local stack frames not supported`,
-      );
+    if (isSpReg(r)) {
+      throw spAsDataError();
     }
     if (r === 'pc' || r === 'r15') {
       // A pc-relative literal load is rewritten to a pool label before reaching here (decode's
@@ -1224,6 +1422,539 @@ export function lift(
     return readVar(r, b);
   };
 
+  // A virtual register key per incoming stack argument. Reading it goes through the ordinary Braun
+  // live-in path (frontend/ssa.ts), which turns a read with no reaching def into a function
+  // parameter — so this needs NO new representation, opcode or pass. The `@` cannot appear in a
+  // real register token, so the key cannot collide with one.
+  const stackArgKey = (index: number) => `@sarg${index}`;
+  // Defined beside its mint site on purpose: the format string and its parser drifted 650 lines
+  // apart in the first version, with the convention explained only at one end.
+  const stackArgIndex = (key: string): number | null => {
+    const m = /^@sarg(\d+)$/.exec(key);
+    return m ? +m[1] : null;
+  };
+
+  // INCOMING STACK ARGUMENTS (AAPCS). Args 1-4 arrive in r0-r3; args 5+ are pushed by the CALLER,
+  // so the callee reads them at `[sp, #N]` where N is at or above its own frame. Those are
+  // PARAMETERS, not locals — declining them as "sp used as data" refuses a calling convention.
+  //
+  // The frame depth is tracked by a linear walk of the ENTRY BLOCK only, which is
+  // why the gate is what it is: within one straight-line block the depth at each instruction is
+  // exact and needs no CFG reasoning. Every case that would need more declines.
+  //
+  // `push {a,b,c}` deepens by 4 per register; `sub sp, #N` and `add sp, sp, #-N` deepen by N.
+  //
+  // The walk, its two invariants and the predicate that reads them are ONE object on purpose. They
+  // were three loose pieces — a delta function, a pair of `let`s updated in the instruction loop,
+  // and a seven-parameter predicate taking the pair by value — and both bugs the second review pass
+  // found lived in the seams: an invariant the predicate's proof needed but only the loop could
+  // enforce, and a `0` returned for an unrecognised shape that only a guard in a third place made
+  // safe. Anything that changes how sp moves now has one place to change, and the proof it has to
+  // preserve is written next to the state it is about.
+  const makeFrameWalk = () => {
+    // Bytes the frame has grown since function entry, along this block's linear order only.
+    let depth = 0;
+    let depthKnown = true;
+
+    // Returns null whenever the depth cannot be computed exactly — including for any write to sp
+    // this does not model. The capability rests on the depth being EXACT, so an approximation is
+    // never acceptable: understate the frame and a local sits above the computed top and gets
+    // minted as a parameter reading uninitialised stack. A null poisons the depth for the rest of
+    // the block, which disables argument recovery and leaves every `[sp,#N]` to decline as before.
+    // Nothing here may return a NUMBER for a shape it merely failed to recognise.
+    const delta = (ins: { mnemonic: string; ops: string[] }): number | null => {
+      const m = ins.mnemonic;
+      if (m === 'push' || m === 'pop') {
+        // expandRegList, NOT a comma count: `push {r4-r7, lr}` is FIVE registers, and counting it as
+        // two makes the frame 12 bytes too shallow — which turns a genuine LOCAL into a fabricated
+        // parameter reading uninitialised stack. Caught by a probe, not by the corpus: agbcc emits no
+        // range pushes and 0 of the 743 benchmark rows contain one, but GNU as accepts them and the
+        // disassembly path can produce them.
+        // Counting comma tokens instead would undercount `{r4-lr}` as two registers, and an
+        // unexpandable range must poison the depth rather than be guessed at — definiteRegList owns
+        // both rules, and owns them for the ldm/stm arm too.
+        const list = definiteRegList(
+          ins.ops
+            .join(',')
+            .replace(/[{}]/g, '')
+            .split(',')
+            .map((r) => r.trim())
+            .filter(Boolean),
+        );
+        if (list === null) {
+          return null;
+        }
+        return (m === 'push' ? 1 : -1) * 4 * list.length;
+      }
+      if ((m === 'add' || m === 'sub') && isSpReg(ins.ops[0])) {
+        const off = ins.ops[2] ?? ins.ops[1];
+        if (off?.startsWith('#')) {
+          const v = imm(off);
+          return m === 'sub' ? v : -v;
+        }
+      }
+      // Any OTHER write to sp poisons the depth. This used to fall through to 0 — "no change" — for
+      // shapes it does not model (`add sp, r4`, `mov sp, rN`, `add sp, r0, #4`), which was safe only
+      // because writeData declines every one of them elsewhere. That is the same
+      // enumeration-of-arms mistake writeData itself exists to end, exported one function away: a
+      // number meaning "no change" is the wrong answer to "I do not understand this". Now the walk is
+      // self-sufficient — unknown ⇒ depth poisoned ⇒ decline — and writeData's refusal is an
+      // independent second guarantee instead of a load-bearing one.
+      if (isSpReg(ins.ops[0])) {
+        return null;
+      }
+      return 0;
+    };
+
+    return {
+      // Advance the walk over one instruction. Call for EVERY instruction, in order.
+      step(ins: { mnemonic: string; ops: string[] }): void {
+        const d = delta(ins);
+        if (d === null) {
+          depthKnown = false;
+        } else {
+          depth += d;
+        }
+        // sp ABOVE the incoming sp poisons the walk for the rest of the block, permanently — the
+        // premise argIndex's proof rests on. See the proof there for what it costs to omit.
+        if (depth < 0) {
+          depthKnown = false;
+        }
+      },
+
+      // Is `[sp, #off]` an incoming stack argument, and which one? `null` means NO — and every null is
+      // a DECLINE, because the caller falls through to readData's sp guard.
+      //
+      // Why a slot at or above the frame top cannot have been written by this function, which is the
+      // whole soundness argument: every sp-relative STORE declines (readData, via the str arm), and a
+      // `push` only ever writes strictly BELOW the current top. An argument slot is at or above the
+      // incoming sp, so no instruction here can have defined it — the value can only be the caller's.
+      //
+      // That second step needs sp to have stayed at or below where it came in — `depth >= 0` at every
+      // point of the walk — or a `push` reaches back up over the argument area and the conclusion is
+      // false:
+      //
+      //     add sp, sp, #8      ; sp = S+8
+      //     push {r4, r5, r6}   ; sp = S-4, and this WROTE r5 to S+0
+      //     ldr  r0, [sp, #4]   ; = S+0 — r5's slot, not the caller's argument
+      //
+      // The depth is back to a plausible +4 by the load, so nothing downstream can tell: it emitted
+      // `s32 f(s32 a0, …, s32 a4) { return a4; }`, the function's own incoming r5 handed back as
+      // argument 5. `pop {r4}; push {r4,r5}` gets there without an `add sp` at all, and a sliced
+      // fragment whose prologue was cut off is exactly this shape — which is the corpus this frontend
+      // reads. `step` enforces it, and never un-poisons: once sp has been above the line, a push during
+      // the excursion may have written the later slots too. This is a PREMISE, not a detail — leaving
+      // it unstated is what let the first version hand back a callee-saved register as an argument.
+      argIndex(addr: { base: string; off: number; regOff?: string }, width: number, bi: number): number | null {
+        const { base, off, regOff } = addr;
+        if (!isSpReg(base) || regOff !== undefined) {
+          return null; // not sp, or `[sp, rX]` — not a fixed argument slot
+        }
+        if (bi !== 0 || preds[0].length > 0) {
+          return null; // depth is exact only along the ENTRY block's linear order, and only when its
+          // params are parameters rather than phis
+        }
+        if (!depthKnown || depth <= 0) {
+          return null; // an unmeasurable frame, or none established: a headerless FRAGMENT whose
+          // prologue was sliced off looks identical to a frameless function, and there the slots are
+          // locals — minting one would be the silent-wrong trade this frontend refuses
+        }
+        if (width !== 4 || off < depth || (off - depth) % 4 !== 0) {
+          return null; // the argument area is word-granular; BELOW the top is a local, which is the
+          // separate slot-promotion capability
+        }
+        const index = target.argRegs.length + (off - depth) / 4;
+        return index < MAX_RECOVERED_ARITY ? index : null; // a wild offset must not mint a
+        // 400-parameter signature
+      },
+    };
+  };
+
+  // LOCAL STACK SLOTS. A spill or a local that never has its address taken is transparent to
+  // dataflow: `str rX,[sp,#k]` … `ldr rY,[sp,#k]` moves a value, it does not touch memory anyone
+  // else can see. Modelling it as an SSA variable keyed by the offset (the same `sp@<off>` spelling
+  // the MIPS frontend uses) makes it exactly that, and Braun's phi construction handles a slot that
+  // is read-modify-written across a loop with no extra machinery.
+  //
+  // What Thumb does NOT inherit from MIPS: keying by the RAW sp offset is only sound while sp holds
+  // the same value at every access, and MIPS gets that for free (IDO establishes sp with one
+  // `addiu` and never moves it). Thumb's `push` moves sp, so constancy has to be PROVEN here.
+  const slotKey = stackSlotKey; // shared spelling: frontend/ssa.ts
+  // Deliberately OVER-inclusive: a `cmp sp, rN` only reads sp but counts here too. Every false
+  // positive costs a decline, every false negative costs a wrong slot — so it errs loudly.
+  const modifiesSp = (ins: Instr): boolean =>
+    ins.mnemonic === 'push' || ins.mnemonic === 'pop' || isSpReg((ins.ops[0] ?? '').replace(/!$/, ''));
+  // A `mov rD, sp` CAPTURES the frame address; the captured value means "the frame base" only if
+  // sp still holds that base wherever the value is used — so a capture participates in the
+  // constancy proof exactly like a literal [sp,#k] access, and ends the prologue for localArea.
+  const capturesSp = (ins: Instr): boolean =>
+    /^movs?$/.test(ins.mnemonic) && !isSpReg(ins.ops[0] ?? '') && isSpReg(ins.ops[1] ?? '');
+  const touchesFrame = (ins: Instr): boolean => spMemAccess(ins) !== null || capturesSp(ins);
+  const spMemAccess = (ins: Instr): { off: number; width: number; regOff: boolean } | null => {
+    if (!/^(ldr|ldrb|ldrh|ldrsb|ldrsh|str|strb|strh)$/.test(ins.mnemonic)) {
+      return null;
+    }
+    const mem = ins.ops[1];
+    if (mem === undefined) {
+      return null;
+    }
+    const { base, off, regOff } = parseAddr(mem);
+    return isSpReg(base)
+      ? { off, width: /b$/.test(ins.mnemonic) ? 1 : /h$/.test(ins.mnemonic) ? 2 : 4, regOff: regOff !== undefined }
+      : null;
+  };
+  // Is the word-slot model safe for THIS function? Every disqualifier below leaves every `[sp,#k]`
+  // access on the old path, which declines — so the answer to "not sure" is the loud one.
+  // Returns null when the word-slot model is SAFE for this function, else the reason it is off —
+  // which the sp declines append, so a refused function names the capability actually missing
+  // instead of the generic "local stack frames". The gap histogram is the improvement loop's
+  // work-list; a misattributed refusal sends that loop to build the wrong thing.
+  const slotModelBlocker = (): string | null => {
+    for (const ab of asmBlocks) {
+      for (const ins of ab.instrs) {
+        const acc = spMemAccess(ins);
+        // A SUB-WORD access aliasing a word slot is the hazard MIPS paid for the hard way: routing
+        // the word store to an SSA slot while the byte reload stays on the memory path drops the
+        // store and reads uninitialised memory. One anywhere disables the model for the whole
+        // function. A register offset can alias any slot, so it disqualifies the same way.
+        if (acc && (acc.width !== 4 || acc.regOff)) {
+          return acc.regOff
+            ? 'a register-offset sp access can alias any slot'
+            : 'a sub-word sp access aliases the word-slot model';
+        }
+        // sp escaping into a register: a computed form (`add rD, sp, #k`) is still a refusal, but a
+        // plain COPY (`mov rD, sp`) is now the address-taken-local capability — the mov arm emits a
+        // `laddr` for it and the post-lift frame-object audit proves every use, so the model's
+        // remaining precondition is that the frame has a reserved local area for the object to
+        // live in. A frameless function taking sp's address has nothing to model and refuses.
+        if (ins.mnemonic === 'add' && !isSpReg(ins.ops[0] ?? '') && ins.ops.slice(1).some((o) => isSpReg(o))) {
+          return `the address of a stack local is computed (\`${ins.mnemonic} ${ins.ops.join(', ')}\`) — only a plain \`mov rD, sp\` capture is modelled`;
+        }
+      }
+    }
+    // sp must be CONSTANT wherever a slot is keyed, because the key IS the raw offset. Two shapes
+    // are legitimate and everything else refuses: a PROLOGUE (sp moves before the block touches the
+    // frame) and an EPILOGUE (sp moves after it has finished touching it, and the block returns, so
+    // nothing downstream can key a slot against the changed sp). A modification BETWEEN two
+    // accesses moves the frame under a slot already keyed, and only the entry block may deepen —
+    // elsewhere a pre-access modification would put the block at a different depth from the one the
+    // prologue established.
+    for (let bi = 0; bi < asmBlocks.length; bi++) {
+      const ins = asmBlocks[bi].instrs;
+      const mems = ins.map((x, i) => (touchesFrame(x) ? i : -1)).filter((i) => i >= 0);
+      const mods = ins.map((x, i) => (modifiesSp(x) ? i : -1)).filter((i) => i >= 0);
+      if (mods.length === 0) {
+        continue;
+      }
+      const last = ins[ins.length - 1];
+      const returns = last !== undefined && classifyXfer(last) === 'return';
+      if (mems.length === 0) {
+        // moves sp and never keys a slot itself: safe only if nothing downstream can key one
+        if (!returns && bi !== 0) {
+          return 'sp moves in a block that neither returns nor is the entry';
+        }
+        continue;
+      }
+      for (const m of mods) {
+        if (m < mems[0]) {
+          if (bi !== 0) {
+            return 'a non-entry block establishes its own frame depth'; // not the prologue's
+          }
+        } else if (m > mems[mems.length - 1]) {
+          if (!returns) {
+            return 'sp unwinds mid-function and execution continues';
+          }
+        } else {
+          return 'the frame moves between two accesses that keyed slots against it';
+        }
+      }
+    }
+    // OUTGOING ARGUMENTS. agbcc reserves the BOTTOM of the frame for arguments 5+ of the calls this
+    // function makes: `add sp,sp,#-8` … `str r2,[sp]` / `str r3,[sp,#4]` … `bl callee`. Those
+    // offsets are inside the frame and nothing this function does ever reloads them, so modelling
+    // them as locals makes them dead defs and DCE deletes them — the arguments vanish from the call
+    // with no diagnostic. Ground truth: sa3's CreateEntity_Platform_0_0 (platform.c:734) forwards
+    // SIX arguments and came out as `CreateEntity_Platform(0, 0, a0, (u16)a1)`. "Inside my frame"
+    // does not mean "private": the outgoing area belongs to the callee, which may even assign to a
+    // stack parameter.
+    //
+    // How big is that area? A declared arity bounds it from BELOW — `4 * max(0, arity - 4)` — and
+    // that is all the facts available here can support. It is used in exactly one direction: to
+    // REFUSE. A callee declared with five parameters proves this frame has an outgoing area, and
+    // consuming those stores as call operands is the dual capability, unbuilt, so the model
+    // declines. A callee declared with four proves NOTHING, because a declaration is a lower bound
+    // on the words a call actually pushes:
+    //
+    //   * a parameter may occupy more than one word (`double`, `long long`, a struct by value),
+    //   * a variadic callee's list is a prefix — `sprintf` truthfully declares two and is handed six,
+    //   * a large struct return adds a hidden pointer argument that appears in no parameter list.
+    //
+    // None of those is recorded by `FnProto` or `SymbolSignature`, so no arity here can license an
+    // ACCEPTANCE. An earlier cut treated `arity <= 4` as proof of an empty area and had all three
+    // holes: supplying a TRUE fact (`{ sprintf: { params: 2 } }`) turned a correct decline into
+    // `return sprintf(a0, a1)` with both stack arguments deleted, where supplying nothing declined.
+    // A fact must only ever move a function toward refusal — never toward an acceptance the facts
+    // do not entail. Refusing on a lower bound is monotone in exactly that way: a true arity larger
+    // than declared can only make the area bigger, and the answer is already "decline".
+    //
+    // Measured, this costs nothing it was buying: forcing the old acceptance path off changed 0
+    // lift/decline verdicts across 2686 corpus functions (sa3's vendored map carries no signatures
+    // at all), so the path that carried those holes was never load-bearing.
+    for (const ab of asmBlocks) {
+      for (const ins of ab.instrs) {
+        if (ins.mnemonic !== 'bl' && ins.mnemonic !== 'blx') {
+          continue;
+        }
+        const c = ins.ops[0] ?? '';
+        const arity = protoArity(prototypes[c]) ?? protoArity(RUNTIME_HELPERS[c]);
+        if (arity !== undefined && arity > target.argRegs.length) {
+          return `callee \`${c}\` is declared with ${arity} arguments, so this frame has an outgoing stack-argument area — consuming stack call arguments is not implemented`;
+        }
+      }
+    }
+    // Nothing above could prove the area empty, so fall back to reading the CODE. Two conditions,
+    // covering different escapes:
+    //   (a) every slot store must be reloaded somewhere reachable. An outgoing argument is read by
+    //       the CALLEE, never by the caller, so a store never read back is the signature of one.
+    //   (b) no slot store may reach a `bl` unread ALONG A PATH.
+    //
+    // Neither is sound alone and the pair is not either, so keep two things straight. (a)'s real
+    // theorem is not "the callee reads it, the caller does not" — it is that agbcc's
+    // ACCUMULATE_OUTGOING_ARGS puts the outgoing area at the BOTTOM of localArea, disjoint from the
+    // locals, so no local load can land on an argument offset. That disjointness is what a
+    // tail-merged call site breaks, and agbcc DOES tail-merge: `Task_BonusFlower_Spawn` (sa3
+    // bonus_game_enemies) stores argument 5 in both predecessors with the `bl` in the join.
+    //
+    // (b) is a forward may-analysis over the CFG, and it has been wrong twice in the other
+    // direction. Scanning per block let a LABEL decide accept versus refuse; scanning the flat
+    // listing let BLOCK ORDER decide, because a load in one arm of a branch cleared a store that
+    // reaches the call through the other arm — swap the arms in the listing, same CFG and same
+    // semantics, and the verdict flipped. Only the path-sensitive form is stable under layout.
+    //
+    // Only for a function that CALLS. With no call there is no outgoing area to mistake a local
+    // for, and a never-reloaded store there is an ordinary dead local — which PR #30 modelled and
+    // which must keep working.
+    if (asmBlocks.some((ab) => ab.instrs.some((i) => i.mnemonic === 'bl' || i.mnemonic === 'blx'))) {
+      const slotAcc = (ins: Instr) => {
+        const a = spMemAccess(ins);
+        return a && !a.regOff && a.width === 4 && a.off % 4 === 0 && a.off >= 0 && a.off < localArea ? a.off : null;
+      };
+      const isStore = (ins: Instr) => /^str/.test(ins.mnemonic);
+      // Entry-REACHABLE blocks only: a reload in dead code is not evidence that live code reads the
+      // slot back, and counting it lets an argument store satisfy (a) on the strength of an
+      // instruction that never executes.
+      const live = new Set<number>([0]);
+      for (let changed = true; changed;) {
+        changed = false;
+        for (let b = 0; b < asmBlocks.length; b++) {
+          if (live.has(b)) {
+            continue;
+          }
+          if (preds[b].some((q) => live.has(q))) {
+            live.add(b);
+            changed = true;
+          }
+        }
+      }
+      const reloaded = new Set<number>();
+      for (const b of live) {
+        for (const ins of asmBlocks[b].instrs) {
+          const off = slotAcc(ins);
+          if (off !== null && !isStore(ins)) {
+            reloaded.add(off);
+          }
+        }
+      }
+      // CONTIGUITY. AAPCS lays the outgoing stack arguments at [sp,#0] upward, one word each, so an
+      // argument block is CONTIGUOUS FROM ZERO: a store at [sp,#4] can be argument 6 of a call only
+      // if argument 5 at [sp,#0] is also supplied on a path to that same call. A pending store
+      // whose lower slots are nowhere supplied is therefore provably not an argument block, and
+      // refusing it is a false alarm — the exact false alarm that blocked the commonest real shape,
+      // a value spilled at [sp,#4] and kept live across calls (kleod's ProcessInputAndUpdateEntities
+      // stores its `sp4` local and calls m4aSongNumStart 80 lines later, with offset 0 never stored
+      // in the whole function).
+      //
+      // The calibration in this: a conforming caller stores EVERY argument slot of a call it makes,
+      // so "slot 0 unsupplied" rules out "slot 4 is an argument". Hand-written asm could skip
+      // storing an argument the callee never reads; agbcc cannot (no interprocedural dead-argument
+      // elimination). That is the same producer assumption the reload conditions above already
+      // make, stated once here.
+      const prefixStored = (k: number, st: Set<number>): boolean => {
+        for (let j = 0; j < k; j += 4) {
+          if (!st.has(j)) {
+            return false;
+          }
+        }
+        return true;
+      };
+      // (a), contiguity-filtered: a store never reloaded ANYWHERE is an argument's signature only
+      // if its lower slots are supplied somewhere too; otherwise it is an ordinary dead local.
+      const storedAnywhere = new Set<number>();
+      for (const b of live) {
+        for (const ins of asmBlocks[b].instrs) {
+          const off = slotAcc(ins);
+          if (off !== null && isStore(ins)) {
+            storedAnywhere.add(off);
+          }
+        }
+      }
+      for (const off of storedAnywhere) {
+        if (!reloaded.has(off) && prefixStored(off, storedAnywhere)) {
+          return `the store to [sp,#${off}] is never reloaded and its lower slots are supplied — it may be an outgoing stack argument of one of this function's calls`; // (a)
+        }
+      }
+      // (b): `pendingOut[b]` = offsets stored and not yet reloaded on SOME path through b;
+      // `storedOut[b]` = offsets stored on SOME path through b (a reload does not remove the value
+      // from memory, so it does not remove the offset from this set — the callee would still read
+      // what the store put there).
+      const pendingOut: Array<Set<number>> = asmBlocks.map(() => new Set<number>());
+      const storedOut: Array<Set<number>> = asmBlocks.map(() => new Set<number>());
+      for (let changed = true; changed;) {
+        changed = false;
+        for (let b = 0; b < asmBlocks.length; b++) {
+          if (!live.has(b)) {
+            continue;
+          }
+          const pend = new Set<number>();
+          const st = new Set<number>();
+          for (const q of preds[b]) {
+            for (const off of pendingOut[q]) {
+              pend.add(off);
+            }
+            for (const off of storedOut[q]) {
+              st.add(off);
+            }
+          }
+          for (const ins of asmBlocks[b].instrs) {
+            const off = slotAcc(ins);
+            if (off !== null) {
+              if (isStore(ins)) {
+                pend.add(off);
+                st.add(off);
+              } else {
+                pend.delete(off);
+              }
+            } else if (ins.mnemonic === 'bl' || ins.mnemonic === 'blx') {
+              for (const k of pend) {
+                if (prefixStored(k, st)) {
+                  // (b) — a plausible argument block reaches this call unread
+                  return `the store to [sp,#${k}] reaches \`bl ${ins.ops[0] ?? '?'}\` unread with its lower slots supplied — it may be that call's outgoing stack argument`;
+                }
+              }
+            }
+          }
+          const grow = (out: Array<Set<number>>, cur: Set<number>): void => {
+            if (cur.size !== out[b].size || [...cur].some((o) => !out[b].has(o))) {
+              out[b] = cur;
+              changed = true;
+            }
+          };
+          grow(pendingOut, pend);
+          grow(storedOut, st);
+        }
+      }
+    }
+    // A `pop`/`ldm` off sp READS frame memory, and push/pop are transparent to dataflow, so a pop
+    // taken while the local area is still reserved reads a slot this model has retargeted into SSA
+    // — the load simply disagrees with the store. A real epilogue releases the locals first
+    // (`add sp,#N; pop {…}`), which is what this requires; `pop {r1}` mid-frame does not.
+    for (const ab of asmBlocks) {
+      let released = 0;
+      for (const ins of ab.instrs) {
+        if ((ins.mnemonic === 'pop' || ins.mnemonic === 'ldmia') && released < localArea) {
+          const base = ins.mnemonic === 'pop' ? 'sp' : (ins.ops[0] ?? '').replace(/!$/, '');
+          if (isSpReg(base)) {
+            return 'a pop reads the frame while the local area is still reserved';
+          }
+        }
+        if ((ins.mnemonic === 'add' || ins.mnemonic === 'sub') && isSpReg(ins.ops[0])) {
+          const d = spAdjust(ins);
+          if (d !== null && d > 0) {
+            released += d;
+          }
+        }
+      }
+    }
+    return null;
+  };
+  // The frame the body sees: the entry block's PROLOGUE, i.e. everything up to the first
+  // instruction that touches the frame (or the whole block if it never does). Stepped through the
+  // same walk `argIndex` uses, so "what does this do to sp" has one implementation. A frame the
+  // walk cannot measure yields 0, which disables every slot (`off < localArea` is then false).
+  // How much sp moves for `add/sub sp, #imm`, positive = sp RISES (frame shrinks). null if not that
+  // shape. Only used to recognise a release; the authoritative depth arithmetic is makeFrameWalk's.
+  const spAdjust = (ins: Instr): number | null => {
+    if (!/^(add|sub)$/.test(ins.mnemonic) || !isSpReg(ins.ops[0])) {
+      return null;
+    }
+    const o = ins.ops[2] ?? ins.ops[1];
+    if (o === undefined || !o.startsWith('#')) {
+      return null;
+    }
+    const v = imm(o);
+    return ins.mnemonic === 'sub' ? -v : v;
+  };
+  // The EXPLICITLY reserved local area — the prologue's `add sp,sp,#-N`. A slot must live strictly
+  // inside this, not merely inside the whole frame: the rest of the frame is the callee-saved block
+  // the entry `push` wrote, which belongs to the epilogue's `pop`, so a `str` there is retargeted
+  // away from the memory the pop will read.
+  const localArea = ((): number => {
+    // The PROLOGUE only — everything before the entry block first touches the frame. Summing the
+    // whole block instead let a store made BEFORE the reservation fall inside `off < localArea`, so
+    // `str r0,[sp]; add sp,sp,#-4; …` claimed a write to the CALLER's frame as a private local and
+    // deleted it.
+    //
+    // NET, not the sum of the negatives. Counting only reservations and discarding releases leaves
+    // localArea larger than the region that is actually below the callee-saved block, and `off <
+    // localArea` then claims the SAVED REGISTERS as private locals — which the epilogue's `pop`
+    // reads back. `push {lr}; add sp,#-8; add sp,#8; str r0,[sp]; pop {r1}; bx r1` deleted the
+    // store and rendered a computed `bx` as an ordinary return, and it fooled the pop gate too
+    // (`released` is compared against this number). Not corpus-reachable — 0 of 2805 Thumb
+    // functions adjust sp upward before their first frame access — which is exactly why only a
+    // probe finds it.
+    //
+    // An sp write this cannot read poisons the whole thing to 0, disabling every slot, rather than
+    // being skipped as if it were no movement: the same rule spDelta follows.
+    const ins = asmBlocks[0].instrs;
+    const firstMem = ins.findIndex((x) => touchesFrame(x));
+    let reserved = 0;
+    for (const x of ins.slice(0, firstMem === -1 ? ins.length : firstMem)) {
+      const d = spAdjust(x);
+      if (d !== null) {
+        reserved -= d; // d > 0 = sp rises = the frame shrinks
+      } else if (x.mnemonic !== 'push' && x.mnemonic !== 'pop' && isSpReg((x.ops[0] ?? '').replace(/!$/, ''))) {
+        return 0; // an sp write of a shape this does not model
+      }
+    }
+    return Math.max(0, reserved);
+  })();
+
+  const slotsOffReason = slotModelBlocker();
+  const slotsOk = slotsOffReason === null;
+  // Every offset the body actually keys as an SSA slot — the frame-object audit checks the
+  // address-taken object cannot overlap one (two models for one byte is a silent disagreement).
+  const usedSlotOffsets = new Set<number>();
+
+  // The WRITE dual of readData, and the reason it exists is a lesson rather than a symmetry: the
+  // first version of this guard checked sp in three decode arms (mov/add/sub) and its commit message
+  // claimed "every write to sp declines". It did not — `lsl sp, r4, #2`, `neg sp, r4`, `mvn sp, r4`,
+  // `ldr sp, [r0,#4]` and `ldmia r0!, {sp}` all still lifted, dropping the sp write silently, because
+  // an enumeration of arms can only cover the arms someone thought of. Guarding the write ITSELF
+  // cannot be incomplete.
+  //
+  // sp is writable in exactly one shape — the frame adjust the add/sub arms `break` on before
+  // reaching here (see isFrameAdjust). Anything else that writes sp is a frame change this frontend
+  // cannot model, and dropping it silently deletes that change while the function keeps compiling.
+  //
+  // Known residual, zero inhabitants: `pop {sp}` never reaches here (push/pop are skipSafe in the
+  // opaque policy), so it stays silently transparent. ARMv4T Thumb cannot encode sp in a pop reglist.
+  const writeData = (r: string, b: number, v: Value): void => {
+    if (isSpReg(r)) {
+      throw spAsDataError();
+    }
+    writeVar(r, b, v);
+  };
+
   // Best-effort call arity via the shared helper (frontend/ssa.ts).
   const fallbackArgcHere = (b: number): number => fallbackArgc(ssa, target.argRegs, b);
 
@@ -1231,10 +1962,13 @@ export function lift(
   const fillBlock = (ab: AsmBlock, bi: number) => {
     const irb = irBlocks[bi];
     let pendingCmp: { lhs: Value; rhs: Value } | null = null;
+    // Tracks the frame through this block's linear instruction order. Meaningful for the entry
+    // block; elsewhere a `[sp,#N]` access declines.
+    const frame = makeFrameWalk();
 
     // TRUSTWORTHINESS GUARD (mirrors the MIPS/PPC frontends): an unmodelled instruction must not
-    // silently drop its destination register — emit an honest `opaque`: dead ⇒ it vanishes; live ⇒
-    // assertResolved fails LOUD (see frontend/opaque.ts for the policy). Push/pop and sp
+    // silently drop its destination register — emit an honest `opaque`, which fails LOUD at
+    // assertResolved whether or not anything reads that register (see frontend/opaque.ts). Push/pop and sp
     // adjustments have no low-register data destination, so they fall through harmlessly;
     // terminators are handled in the terminator section below.
     const isThumbReg = (s: string | undefined): s is string => /^r\d+$/.test(s ?? '');
@@ -1247,8 +1981,8 @@ export function lift(
       const od = opaqueDest(ins.mnemonic, ins.ops, {
         isReg: isThumbReg,
         normalize: reg,
-        storeClass: /^(str|stm)/,
-        skipSafe: /^(push|pop|nop)$/,
+        storeClass: /^(str|stm)/i,
+        skipSafe: /^(push|pop|nop)$/i,
         context: name,
         display: ins.asWritten,
       });
@@ -1259,7 +1993,7 @@ export function lift(
       const res = mkValue(T.unk(32));
       // carry the mnemonic so annotate mode can name the gap (`ASMLIFT_ERROR("unmodelled 'rsb'")`)
       irb.ops.push(mkOp('opaque', { operands, results: [res], attrs: { mnemonic: ins.asWritten ?? ins.mnemonic } }));
-      writeVar(od.dst, bi, res);
+      writeData(od.dst, bi, res);
     };
     // 2-operand ALU form `op rD, op2` (rD = rD ⟨op⟩ op2). `op2` is an immediate (`#N`) or a
     // register. A destination that is NOT a low data register (`add sp, #8` / `sub sp, #N` frame
@@ -1267,9 +2001,25 @@ export function lift(
     // harmlessly, matching the documented sp handling. A malformed operand (missing / non-register
     // non-immediate) degrades to a loud opaque rather than a crash or a silent data-dest drop.
     const emit2op = (opc: Opcode, dReg: string, op2: string | undefined, bi: number) => {
+      // The one sp guard writeData CANNOT supply: this path returns without ever producing a value
+      // to write, so a bad sp destination would never reach the write. It is only reachable from the
+      // add/sub arms, which have already let the whitelisted frame adjust `break` out — so an sp
+      // destination here is by construction NOT that shape (`add sp, r4`: a register-sized frame
+      // adjustment, how agbcc spells a frame too large for the 7-bit immediate).
+      //
+      // Honesty about what this is worth: the 4 real `add sp, rN` sites in the sa3 checkout all sit
+      // in functions that ALSO do `mov rN, sp` 70+ times, so they declined before this guard and
+      // decline after it. No wrong C was ever emitted by this shape. The guard is defence in depth
+      // for the day a stack capability makes those functions liftable — not a miscompile fixed.
+      //
+      // This looked dead during review and is not: it becomes reachable the moment the arm-local
+      // guards are removed, which is exactly what the test at 'add sp, r4' pins.
+      if (isSpReg(dReg)) {
+        throw spAsDataError();
+      }
       if (!isThumbReg(reg(dReg))) {
         return;
-      } // sp/pc frame adjustment: transparent
+      } // pc: claimed by classifyXfer first
       if (op2 === undefined) {
         emitOpaqueDest({ mnemonic: opc, ops: [dReg] });
         return;
@@ -1277,7 +2027,7 @@ export function lift(
       const rhs = op2.startsWith('#') ? constVal(imm(op2), bi) : readData(reg(op2), bi);
       const res = mkValue(T.unk(32));
       irb.ops.push(mkOp(opc, { operands: [readData(reg(dReg), bi), rhs], results: [res] }));
-      writeVar(reg(dReg), bi, res);
+      writeData(reg(dReg), bi, res);
     };
 
     for (const ins of ab.instrs) {
@@ -1303,23 +2053,45 @@ export function lift(
       if (FLAG_SETTING.has(ins.mnemonic) && /^r[0-7]$/.test(reg(ins.ops[0] ?? ''))) {
         pendingCmp = null;
       }
+      frame.step(ins);
       const [a, b, c] = ins.ops;
       switch (ins.mnemonic) {
         case 'mov':
         case 'movs': {
+          // `mov rD, sp` captures the address of the frame's local area — the DMA-fill idiom
+          // (`DmaFill16` expands to `vu16 tmp; DmaSet(…, &tmp, …)`) and any `&local` argument.
+          // Emitted as `laddr`, gaddr's local twin; every use is proven by the frame-object audit
+          // after the blocks are filled, and any use it cannot vouch for declines the function
+          // loudly there. Gated on the slot model (the frame must be private and immovable) and on
+          // a reserved local area for the object to live in.
+          if (!b?.startsWith('#') && isSpReg(b ?? '') && !isSpReg(a ?? '')) {
+            if (slotsOk && localArea > 0) {
+              const res = mkValue(T.unk(32));
+              irb.ops.push(mkOp('laddr', { results: [res], attrs: { off: 0 } }));
+              writeData(reg(a), bi, res);
+              break;
+            }
+            throw spAsDataError();
+          }
           const v = b?.startsWith('#') ? constVal(imm(b), bi) : readData(reg(b), bi);
-          writeVar(reg(a), bi, v);
+          writeData(reg(a), bi, v);
           break;
         }
         case 'add':
         case 'adds': {
+          // Frame bookkeeping first: it must outrank the `#0` copy idiom below, or `add sp, sp, #0`
+          // takes the copy path and declines while `add sp, #0` is transparent — the same
+          // two-spellings inconsistency one N lower down.
+          if (isFrameAdjust(ins.mnemonic, a, c === undefined ? undefined : b, c ?? b)) {
+            break;
+          }
           // `add rD, rS, #0` is agbcc's low-register copy idiom (Thumb `mov rD, rS` between
           // low regs isn't always available). Model it as a pure copy — same SSA value — not
           // an `x + 0` add. This keeps output clean and, crucially, makes a value copied to a
           // callee-saved register before a call read as still-live *after* the call, which is
           // how call-argument liveness tells a passed argument from a preserved one.
           if (c === '#0') {
-            writeVar(reg(a), bi, readData(reg(b), bi));
+            writeData(reg(a), bi, readData(reg(b), bi));
             break;
           }
           // 2-operand form `add rD, op2` (rD = rD + op2): op2 in `b`, no third operand.
@@ -1328,22 +2100,27 @@ export function lift(
             emit2op('add', a, b, bi);
             break;
           }
+
           const rhs = c?.startsWith('#') ? constVal(imm(c), bi) : readData(reg(c), bi);
           const res = mkValue(T.unk(32));
           irb.ops.push(mkOp('add', { operands: [readData(reg(b), bi), rhs], results: [res] }));
-          writeVar(reg(a), bi, res);
+          writeData(reg(a), bi, res);
           break;
         }
         case 'sub':
         case 'subs': {
+          if (isFrameAdjust(ins.mnemonic, a, c === undefined ? undefined : b, c ?? b)) {
+            break;
+          }
           if (c === undefined) {
             emit2op('sub', a, b, bi);
             break;
           } // `sub rD, op2` → rD = rD - op2
+
           const rhs = c?.startsWith('#') ? constVal(imm(c), bi) : readData(reg(c), bi);
           const res = mkValue(T.unk(32));
           irb.ops.push(mkOp('sub', { operands: [readData(reg(b), bi), rhs], results: [res] }));
-          writeVar(reg(a), bi, res);
+          writeData(reg(a), bi, res);
           break;
         }
         case 'lsr':
@@ -1370,7 +2147,7 @@ export function lift(
             // register form `lsl rD, rS, rN` → rD = rS << rN
             irb.ops.push(mkOp(opc, { operands: [readData(reg(b), bi), readData(reg(c), bi)], results: [res] }));
           }
-          writeVar(reg(a), bi, res);
+          writeData(reg(a), bi, res);
           break;
         }
         case 'neg':
@@ -1378,7 +2155,7 @@ export function lift(
           // `neg rD, rS` (and `rsb rD, rS, #0`) = arithmetic negation → -x
           const res = mkValue(T.unk(32));
           irb.ops.push(mkOp('neg', { operands: [readData(reg(b), bi)], results: [res] }));
-          writeVar(reg(a), bi, res);
+          writeData(reg(a), bi, res);
           break;
         }
         case 'rsb':
@@ -1389,7 +2166,7 @@ export function lift(
           if (c === '#0') {
             const res = mkValue(T.unk(32));
             irb.ops.push(mkOp('neg', { operands: [readData(reg(b), bi)], results: [res] }));
-            writeVar(reg(a), bi, res);
+            writeData(reg(a), bi, res);
           } else {
             emitOpaqueDest(ins);
           }
@@ -1400,7 +2177,7 @@ export function lift(
           // `mvn rD, rS` = bitwise NOT → ~x
           const res = mkValue(T.unk(32));
           irb.ops.push(mkOp('not', { operands: [readData(reg(b), bi)], results: [res] }));
-          writeVar(reg(a), bi, res);
+          writeData(reg(a), bi, res);
           break;
         }
         case 'bic':
@@ -1417,7 +2194,7 @@ export function lift(
           irb.ops.push(mkOp('not', { operands: [readData(mr, bi)], results: [inv] }));
           const res = mkValue(T.unk(32));
           irb.ops.push(mkOp('and', { operands: [readData(xr, bi), inv], results: [res] }));
-          writeVar(reg(a), bi, res);
+          writeData(reg(a), bi, res);
           break;
         }
         case 'ror':
@@ -1431,7 +2208,7 @@ export function lift(
           const [xr, nr] = c !== undefined ? [reg(b), reg(c)] : [reg(a), reg(b)];
           const res = mkValue(T.unk(32));
           irb.ops.push(mkOp('rotr', { operands: [readData(xr, bi), readData(nr, bi)], results: [res] }));
-          writeVar(reg(a), bi, res);
+          writeData(reg(a), bi, res);
           break;
         }
         case 'ldmia':
@@ -1461,7 +2238,11 @@ export function lift(
             break;
           }
           const baseReg = reg(writeback ? baseTok.slice(0, -1) : baseTok);
-          const list = expandRegList(
+          // Anything but a list of definite registers — an unexpandable range (alias endpoint,
+          // e.g. `r4-lr`), a token naming no register, an empty list — leaves the transfer set
+          // ambiguous, so degrade to the loud opaque rather than guess. Checking only for the
+          // leftover `-` let `{foo}` through and fabricated a parameter out of it.
+          const list = definiteRegList(
             ins.ops
               .slice(1)
               .join(',')
@@ -1470,13 +2251,7 @@ export function lift(
               .map((r) => r.trim())
               .filter(Boolean),
           );
-          // An unexpandable range (alias endpoint, e.g. `r4-lr`) leaves a raw `-` token — the
-          // exact transfer set is ambiguous, so degrade to the loud opaque rather than guess.
-          if (list.some((r) => r.includes('-'))) {
-            emitOpaqueDest(ins);
-            break;
-          }
-          if (list.length === 0) {
+          if (list === null) {
             emitOpaqueDest(ins);
             break;
           }
@@ -1515,7 +2290,7 @@ export function lift(
               irb.ops.push(
                 mkOp('load', { operands: [base0], results: [res], attrs: { off: 4 * i, signed: true, width: 4 } }),
               );
-              writeVar(reg(r), bi, res);
+              writeData(reg(r), bi, res);
             } else {
               irb.ops.push(mkOp('store', { operands: [base0, readData(reg(r), bi)], attrs: { off: 4 * i, width: 4 } }));
             }
@@ -1528,7 +2303,7 @@ export function lift(
           if (!wroteBase) {
             const adv = mkValue(T.unk(32));
             irb.ops.push(mkOp('add', { operands: [base0, constVal(4 * list.length, bi)], results: [adv] }));
-            writeVar(baseReg, bi, adv);
+            writeData(baseReg, bi, adv);
           }
           break;
         }
@@ -1564,7 +2339,7 @@ export function lift(
               : [readData(reg(a), bi), readData(reg(b), bi)];
           const res = mkValue(T.unk(32));
           irb.ops.push(mkOp(opc, { operands: [x, y], results: [res] }));
-          writeVar(reg(a), bi, res);
+          writeData(reg(a), bi, res);
           break;
         }
         case 'cmp': {
@@ -1616,7 +2391,7 @@ export function lift(
                     attrs: { sym: si.name, ...(si.kind === 'code' ? { code: true } : {}) },
                   }),
                 );
-                writeVar(reg(a), bi, res);
+                writeData(reg(a), bi, res);
                 break;
               }
               // INTERIOR attribution: a value strictly inside a sized data symbol becomes
@@ -1633,18 +2408,28 @@ export function lift(
                 irb.ops.push(mkOp('gaddr', { results: [g], attrs: { sym: interior.info.name } }));
                 irb.ops.push(mkOp('const', { results: [k], attrs: { value: interior.offset } }));
                 irb.ops.push(mkOp('add', { operands: [g, k], results: [res] }));
-                writeVar(reg(a), bi, res);
+                writeData(reg(a), bi, res);
                 break;
               }
               const res = mkValue(T.unk(32));
               irb.ops.push(mkOp('const', { results: [res], attrs: { value: pr.value } }));
-              writeVar(reg(a), bi, res);
+              writeData(reg(a), bi, res);
               break;
             }
             if (pr?.kind === 'gaddr') {
               const res = mkValue(T.unk(32));
               irb.ops.push(mkOp('gaddr', { results: [res], attrs: { sym: pr.sym } }));
-              writeVar(reg(a), bi, res);
+              if (pr.addend !== 0) {
+                // `.word gSym+N` = the machine loads gSym's address plus N. Emitted as an explicit
+                // add so the addend is a VALUE, not an attribute a renderer could re-scale.
+                const k = mkValue(T.unk(32));
+                irb.ops.push(mkOp('const', { results: [k], attrs: { value: pr.addend } }));
+                const sum = mkValue(T.unk(32));
+                irb.ops.push(mkOp('add', { operands: [res, k], results: [sum] }));
+                writeData(reg(a), bi, sum);
+                break;
+              }
+              writeData(reg(a), bi, res);
               break;
             }
             if (pr?.kind === 'unmodelled') {
@@ -1666,6 +2451,67 @@ export function lift(
           // the same address arithmetic the encoding performs. (parseAddr used to silently
           // read `[rB]`, dropping the index — a silent miscompile; ldrsh exists ONLY in this
           // form in Thumb-1, so every ldrsh went through here.)
+          // An incoming stack argument, read before its base becomes an sp decline. Every
+          // condition below is a refusal that keeps a LOCAL from being mistaken for a parameter:
+          //   • entry block only        — the depth is exact only along this block's linear order
+          //   • entry has no preds      — otherwise its params are phis, not parameters
+          //   • no register offset      — `[sp, rX]` is not a fixed argument slot
+          //   • word width, word-aligned — the argument area is word-granular
+          //   • off >= the frame depth — BELOW the frame top is a local/spill: still declines,
+          //                               that is the separate slot-promotion capability
+          //   • a sane arity bound      — a wild offset must not mint a 400-parameter signature
+          {
+            const index = frame.argIndex({ base, off, regOff }, width, bi);
+            if (index !== null) {
+              // Mint EVERY argument below this one — the register half included. Downstream naming
+              // is POSITIONAL (structure.ts), so any hole binds every later parameter to the wrong
+              // ABI slot, silently: `push {r4,r5,lr}; add r4,r3,#0; ldr r0,[sp,#0xc]` emitted a
+              // 2-parameter signature where the ABI proves 5, with both of them bound wrong.
+              //
+              // Reading slot k proves the caller passed arguments 0..k: the register arguments are
+              // filled before any stack argument exists, and the stack area is contiguous with slot
+              // 4 at the lowest offset. So this is entailed by the calling convention, not guessed —
+              // which is what separates it from inventing parameters a function might not have.
+              // (It assumes one word per argument, which is what this frontend assumes everywhere —
+              // it types every parameter s32. An 8-byte argument, which AAPCS may align into r1 or
+              // straddle across r3 and the stack, would break the index↔slot correspondence; no
+              // agbcc row in the corpus has one, and recovering them is its own capability.)
+              //
+              // ensureParam, NOT readVar: a register the entry block DEFINES before this point
+              // (`bl g` then a read of the frame, the commonest shape there is) answers readVar with
+              // that local definition and no parameter appears — reopening the very hole this loop
+              // closes. It emitted `s32 f(s32 a0, s32 a1, s32 a2, s32 a3) { return g() + a3; }`:
+              // arity 4 where the ABI proves 5, with the stack argument bound to r3's slot.
+              for (let j = 0; j < index; j++) {
+                ssa.ensureParam(j < target.argRegs.length ? target.argRegs[j] : stackArgKey(j), bi);
+              }
+              writeData(reg(a), bi, readVar(stackArgKey(index), bi));
+              break;
+            }
+          }
+          // A word reload from this function's own frame — the dual of the spill in the str arm.
+          //
+          // The reaching-def test is the whole soundness of it, and it mirrors the MIPS guard
+          // exactly: a slot that was never STORED holds nothing this function put there, so
+          // `readVar` would mint a phantom entry parameter for it and hand back a value the machine
+          // never had. Above the frame that reading is right and is the incoming-argument path
+          // above; INSIDE the frame it is an uninitialised local (or one whose address escaped
+          // through a path the model missed), and the honest answer is the decline this falls
+          // through to.
+          if (
+            slotsOk &&
+            isSpReg(base) &&
+            regOff === undefined &&
+            width === 4 &&
+            off % 4 === 0 &&
+            off >= 0 &&
+            off < localArea &&
+            ssa.hasReachingDef(slotKey(off), bi)
+          ) {
+            usedSlotOffsets.add(off);
+            writeData(reg(a), bi, readVar(slotKey(off), bi));
+            break;
+          }
           let baseVal = readData(base, bi);
           if (regOff !== undefined) {
             const sum = mkValue(T.unk(32));
@@ -1674,7 +2520,7 @@ export function lift(
           }
           const res = mkValue(T.unk(32));
           irb.ops.push(mkOp('load', { operands: [baseVal], results: [res], attrs: { off, width, signed } }));
-          writeVar(reg(a), bi, res);
+          writeData(reg(a), bi, res);
           break;
         }
         case 'str':
@@ -1687,6 +2533,27 @@ export function lift(
           }
           const width = /b/.test(ins.mnemonic) ? 1 : /h/.test(ins.mnemonic) ? 2 : 4;
           const { base, off, regOff } = parseAddr(b);
+          // A word spill into this function's own frame: record the slot's value in SSA rather than
+          // emitting a store through sp. `slotsOk` has already proven the frame is private and does
+          // not move; `off < localArea` keeps this strictly inside the EXPLICITLY reserved local
+          // area — not merely inside the frame, whose upper part is the callee-saved block the
+          // epilogue pops — so it can never
+          // collide with the incoming-argument area above it (which the load path recovers as
+          // parameters, and where a STORE is still a decline — writing a caller's slot is a
+          // different capability). A spill that is never reloaded becomes a dead def and drops.
+          if (
+            slotsOk &&
+            isSpReg(base) &&
+            regOff === undefined &&
+            width === 4 &&
+            off % 4 === 0 &&
+            off >= 0 &&
+            off < localArea
+          ) {
+            usedSlotOffsets.add(off);
+            writeVar(slotKey(off), bi, readData(reg(a), bi));
+            break;
+          }
           let storeBase = readData(base, bi);
           if (regOff !== undefined) {
             // register-offset store: same exact `rB + rX` lowering as the load path above
@@ -1705,15 +2572,23 @@ export function lift(
           const targetSym = a;
           // Caller-supplied prototype wins; otherwise a known runtime helper (`__divsi3` &c.)
           // supplies its arity so its arguments are recovered; only then fall back to guessing.
-          const argc =
-            protoArity(prototypes[targetSym]) ?? protoArity(RUNTIME_HELPERS[targetSym]) ?? fallbackArgcHere(bi);
+          const declared = protoArity(prototypes[targetSym]) ?? protoArity(RUNTIME_HELPERS[targetSym]);
+          const argc = declared ?? fallbackArgcHere(bi);
           const args: Value[] = [];
           for (let k = 0; k < argc; k++) {
             args.push(readVar(`r${k}`, bi));
           }
           const res = mkValue(T.unk(32));
-          irb.ops.push(mkOp('call', { operands: args, results: [res], attrs: { target: targetSym } }));
-          writeVar('r0', bi, res);
+          const callOp = mkOp('call', { operands: args, results: [res], attrs: { target: targetSym } });
+          irb.ops.push(callOp);
+          // A GUESSED arity is revisited in `finish()`: only once the whole function is lifted is it
+          // known whether every path to here passes through another call, which would have clobbered
+          // the argument registers this guess just read.
+          if (declared === undefined) {
+            ssa.recordGuessedCall(callOp, bi, target.argRegs);
+          }
+          ssa.noteCall(bi); // the callee clobbers r0..r3 …
+          writeData('r0', bi, res); // … and then defines r0, which IS fresh for the next call
           break;
         }
         default:
@@ -1790,15 +2665,150 @@ export function lift(
 
   ssa.finish();
 
+  // FRAME-OBJECT AUDIT. Every `laddr` the mov arm emitted is only a CLAIM that the captured
+  // address is used as "the address of one scalar local"; this proves it, over the finished
+  // function, the same boundary-total style as the slot-escape assert in finish(). The address may
+  // flow anywhere as a VALUE — into an MMIO register (the DMA-fill idiom), a call, a phi — but
+  // every MEMORY access through it must be at offset 0 with one agreed width, and any use the
+  // audit cannot vouch for declines the whole function loudly. Nothing here guesses: the object's
+  // declared type is exactly the access type the machine used.
+  {
+    const laddrs: Op[] = [];
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        if (op.opcode === 'laddr') {
+          laddrs.push(op);
+        }
+      }
+    }
+    if (laddrs.length > 0) {
+      const fail = (why: string): never => {
+        throw new FrontendUnsupportedError(`cannot lift '${name}': address-taken stack local — ${why}`);
+      };
+      // Taint = values that may hold the object's address, closed over phis: a tainted edge arg
+      // taints the receiving block param. (A phi mixing the address with a non-address would taint
+      // the param and then fail the use judgement below — mixing is not vouched for.)
+      for (const op of laddrs) {
+        if ((op.attrs.off as number) !== 0) {
+          // the audit's offset arithmetic, overlap window and naming all assume the frame base;
+          // if a computed capture ever mints off!==0, this line is what keeps it loud
+          fail(`a capture at frame offset ${op.attrs.off} — only the frame base is modelled`);
+        }
+      }
+      const taint = new Set<Value>(laddrs.flatMap((o) => o.results));
+      for (let changed = true; changed;) {
+        changed = false;
+        for (const blk of irBlocks) {
+          for (const op of blk.ops) {
+            for (const s of op.successors ?? []) {
+              s.args.forEach((arg, i) => {
+                const param = s.block.params[i];
+                if (taint.has(arg) && param !== undefined && !taint.has(param)) {
+                  taint.add(param);
+                  changed = true;
+                }
+              });
+            }
+          }
+        }
+      }
+      // Judge every use of a tainted value.
+      const accesses: { width: number; signed: boolean }[] = [];
+      let escapes = false;
+      for (const blk of irBlocks) {
+        for (const op of blk.ops) {
+          op.operands.forEach((v, idx) => {
+            if (!taint.has(v)) {
+              return;
+            }
+            if (op.opcode === 'load' && idx === 0) {
+              if ((op.attrs.off as number) !== 0) {
+                fail(
+                  `a load at [+${op.attrs.off}] through the captured address — only the scalar at offset 0 is modelled`,
+                );
+              }
+              accesses.push({ width: op.attrs.width as number, signed: (op.attrs.signed as boolean) ?? false });
+              return;
+            }
+            if (op.opcode === 'store' && idx === 0) {
+              if ((op.attrs.off as number) !== 0) {
+                fail(
+                  `a store at [+${op.attrs.off}] through the captured address — only the scalar at offset 0 is modelled`,
+                );
+              }
+              accesses.push({ width: op.attrs.width as number, signed: false });
+              return;
+            }
+            if ((op.opcode === 'store' && idx === 1) || op.opcode === 'call') {
+              escapes = true; // the address ESCAPES as a value — the point of the capability
+              return;
+            }
+            fail(`the captured address flows into \`${op.opcode}\` — not an access, an escape, or a phi`);
+          });
+        }
+      }
+      if (accesses.length === 0) {
+        // nothing in-function pins the object's type, and a guessed declaration is the
+        // plausible-but-wrong class — decline until an inhabitant needs this
+        fail('the captured address is never dereferenced in this function, so nothing pins the local object type');
+      }
+      const widths = new Set(accesses.map((a) => a.width));
+      if (widths.size > 1) {
+        fail(`the accesses through the captured address disagree on width (${[...widths].join(' vs ')})`);
+      }
+      const width = accesses[0].width;
+      const signed = accesses.some((a) => a.signed);
+      if (width > localArea) {
+        fail('the object extends past the reserved local area');
+      }
+      for (const off of usedSlotOffsets) {
+        if (off < width) {
+          fail(`the object at [0,${width}) overlaps the SSA slot at [sp,#${off}] — one byte, two models`);
+        }
+      }
+      // Proven. Stamp the MACHINE FACTS the audit established — width and signedness are what the
+      // accesses used, so the declaration downstream is a fact, not a guess. The C-level NAME is
+      // deliberately NOT chosen here: identifiers live in the structurer's namespace (params,
+      // locals, globals, the symbol map), which the frontend cannot see — a frontend-chosen `sp0`
+      // silently shadowed a project global of the same name.
+      // `volatile` iff the address escapes: gcc-2.9 DELETES a store to a non-volatile local nothing
+      // in-function reads — measured, the recompiled loop loaded the value and never stored it —
+      // and the reference idiom's own spelling is `vu16 tmp` for exactly that reason. An object
+      // whose address never leaves the function needs no volatile and must not pay its codegen.
+      for (const op of laddrs) {
+        op.attrs = { ...op.attrs, width, signed, ...(escapes ? { volatile: true } : {}) };
+      }
+    }
+  }
+
   // Order the entry block's parameters by ABI register (r0, r1, r2, …) so downstream
   // naming (`a0`, `a1`, …) matches the calling convention, not the read order. Safe only
   // for the true entry (no predecessors) — a loop header's params are phis whose position
   // is index-aligned with predecessor terminator args and must not be reordered.
   const entry = irBlocks[0];
   // non-ABI live-in ranks LAST (99) — deliberate Thumb tie-break; MIPS/PPC's is -1/first
+  //
+  // "Non-ABI" means NOT AN ARGUMENT REGISTER, and it has to be tested that way rather than by the
+  // shape of the name. A `/^r(\d+)$/` test ranked `r8` at 8 and `r4` at 4 while sending only `sl`
+  // and `sb` to 99 — harmless while nothing else occupied ranks >= 4, and a positional miscompile
+  // the moment incoming stack arguments started ranking there. `sub_80B6B3C` in sa3's
+  // `asm/code_x.s` — still undecompiled, so not a benchmark row — takes 10 arguments (its caller
+  // stores six words at [sp,#0]..[sp,#0x14] plus r0-r3) and saves r8 in its prologue;
+  // the `r8` live-in and `@sarg8` tied at 8, the sort is stable, the prologue reads r8 first — so
+  // ABI argument 8 was emitted as `a9` and every parameter after it was off by one.
+  //
+  // A callee-saved register read before it is written is not an argument in any case: it is a
+  // fragment artifact or an unmodelled effect, and the honest place for it is after everything the
+  // convention actually describes.
   abiSortEntryParams(entry, preds[0].length > 0, (v) => {
-    const m = /^r(\d+)$/.exec(paramReg.get(v) ?? '');
-    return m ? +m[1] : 99;
+    const key = paramReg.get(v) ?? '';
+    // an incoming STACK argument ranks by its ABI index, after every register argument
+    const s = stackArgIndex(key);
+    if (s !== null) {
+      return s;
+    }
+    const i = target.argRegs.indexOf(key);
+    return i >= 0 ? i : 99;
   });
   return fn;
 }