@asmlift/core 0.5.0 → 0.6.0

package/src/frontend/thumb.ts

@@ -8,13 +8,17 @@
 // filled. Trivial phis (one real operand) are removed afterwards so a loop-invariant
 // register does not leak a spurious block parameter.
 //
-// Callee-saved stack frames: `push`/`pop` (and the `pop {rN}; bx rN` return idiom) are
-// transparent to dataflow — the pushed registers are restored to the same values, and a
-// callee-saved register is always written in the body before it is read — so no explicit
-// modelling is needed; they simply fall through the decode/fill switch. Because agbcc may
+// Callee-saved stack frames: `push`/`pop` (and the `pop {rN}; bx rN` return idiom) emit nothing —
+// the pushed registers are restored to the same values, so they fall through the decode/fill
+// switch. They are not IGNORED, though, and two readers outside that switch depend on them.
+// `savedRegs` reads the prologue's save set explicitly and hands it to `LiveInModel.uninitRegs`,
+// which partitions a def-less read of a callee-saved register into an uninitialised LOCAL rather
+// than a parameter — asm that saves nothing follows no such convention and keeps its live-in. And
+// `makeFrameWalk` counts the pushed bytes (4 per register) as frame depth, which is what makes an
+// incoming stack argument at `[sp, #N]` locatable at all. Because agbcc may
 // copy a callee-saved argument (e.g. into r4) before touching r0, entry parameters are
 // ordered by ABI register (r0, r1, …), not by the order they were first read.
-import { Fn, Op, Successor, Value, mkOp, mkValue } from '../ir/core';
+import { Block, Fn, Op, Successor, Value, mkOp, mkValue } from '../ir/core';
 import type { Opcode } from '../ir/opcodes';
 import { T } from '../ir/types';
 import { type Prototypes, protoArity } from '../proto';
@@ -27,7 +31,7 @@ import { FrontendUnsupportedError } from './errors';
 import { assertInputFormat } from './format';
 import type { Frontend } from './frontend';
 import { opaqueDest } from './opaque';
-import { abiSortEntryParams, fallbackArgc, makeSsaBuilder, stackSlotKey } from './ssa';
+import { abiSortEntryParams, fallbackArgc, makeSsaBuilder, slotKeyOffset, stackSlotKey } from './ssa';
 
 interface Instr {
   /** the CANONICAL spelling — legacy names are normalised (see LEGACY_MNEMONICS) so that every
@@ -125,15 +129,74 @@ const COND_OPCODE: Record<string, Opcode> = {
   bhs: 'icmp_uge',
 };
 
-// Classify a block-terminating control transfer, or `null` for a non-transfer instruction (the block
-// falls through). The SINGLE source of truth for "what ends a Thumb block and how", used by decode
-// (block splitting), succLabels (CFG edges), the fill loop (skip transfers), and the terminator
-// emitter — so a transfer form can't be modelled in one place and missed in another. A return via a
-// restored link register is distinguished from a COMPUTED/loaded PC write (jump table / computed
-// goto / register tail call), which this frontend does not model and must LOUD-FAIL rather than
-// silently drop — mirroring the MIPS `jr` and PPC `bctr` guards. (agbcc dispatches a dense switch
-// via `mov pc, rN`.)
+// The halfword encodings that ARE alignment fill, and the instruction each one is. 0x0000 is
+// `lsls r0, r0, #0`; 0x46C0 is the ARM7TDMI Thumb NOP — what `nop` assembles to, and what objdump
+// prints as `nop @ (mov r8, r8)`. It is decoded as `nop`, NOT as `mov r8, r8`: the two spell the
+// same encoding, but `mov r8, r8` is modelled downstream as a READ of a callee-saved register,
+// which invents a parameter — the same two bytes would then carry a signature the object does not
+// have.
+//
+// ONE table, because this knowledge is spelled twice: here as encodings, and in `isPadInstr` below
+// as instruction shapes. A third encoding added to one and forgotten in the other would produce a
+// pad nothing ever prunes, silently and with no test failing — so a test walks this table through
+// that predicate.
+const PAD_ENCODINGS: { hw: number; mnemonic: string; ops: string[] }[] = [
+  { hw: 0x0000, mnemonic: 'lsls', ops: ['r0', 'r0', '#0x00'] },
+  { hw: 0x46c0, mnemonic: 'nop', ops: [] },
+];
+
+/** Is this instruction alignment fill, however a splitter spelled it? A block made ONLY of these
+ *  is pool/section padding when unreachable — pruned in `decode`. A REACHABLE pad block is a real
+ *  (degenerate) instruction and is kept. `lsl`/`lsls r0, r0, #0` is how 0x0000 is written; 0x46C0
+ *  is `nop`, and the `mov r8, r8` spelling of it is normalised to `nop` at parse — so there is no
+ *  r8 clause here, and this predicate judges exactly the shapes PAD_ENCODINGS can produce. */
+const isPadInstr = (i: Instr) =>
+  i.mnemonic === 'nop' ||
+  ((i.mnemonic === 'lsl' || i.mnemonic === 'lsls') &&
+    i.ops[0] === 'r0' &&
+    i.ops[1] === 'r0' &&
+    /^#0x?0*$/.test(i.ops[2] ?? ''));
+
+// A `.2byte`/`.hword`/`.short` operand this pass may read as an ENCODING: a complete 16-bit hex
+// literal and nothing else. `parseInt` stops at the first character it cannot use, so `0x0000+2`
+// parsed as 0x0000 and `0xD001+2` as 0xD001 — an expression, a relocation or a symbol would have
+// been rewritten into the instruction its PREFIX encodes, which is not the instruction the
+// assembler emits. Anything else returns null and falls through to the loud refusal.
+function halfwordLiteral(text: string): number | null {
+  return /^0[xX][0-9a-fA-F]{1,4}$/.test(text) ? parseInt(text, 16) : null;
+}
+
+// A splitter that writes the pad as data (`.2byte 0x0000`) and one that writes it as an
+// instruction are describing the SAME two bytes, so turning the halfword into the instruction it
+// encodes is a decode, not a fabrication — the same move the raw-BRANCH decoder below already
+// makes for `.2byte 0xD10E`. Everything that decides what padding MEANS (isPadInstr, the
+// reachability prune) then sees one representation instead of three spellings.
+// Returns a FRESH Instr per call: later passes rewrite operands in place.
+function padHalfword(v: number): Instr | null {
+  const e = PAD_ENCODINGS.find((p) => p.hw === v);
+  return e ? { mnemonic: e.mnemonic, ops: [...e.ops] } : null;
+}
+
 type XferKind = 'return' | 'uncond' | 'cond' | 'indirect';
+
+/** Does straight-line control continue past this instruction into the bytes that follow it? The ONE
+ *  definition of that question, so no caller can spell its own answer and drift from this one.
+ *  Only an open instruction or a conditional branch continues. A `return`, an `uncond` branch and
+ *  an `indirect` (computed/loaded PC write) all seal what follows: for `indirect` that is a
+ *  DELIBERATE conservatism, not an oversight — this frontend does not model where a computed jump
+ *  goes, so it cannot claim the next bytes are entered, and it declines on such a transfer
+ *  elsewhere rather than guessing here. */
+const controlContinuesPast = (ins: Instr) => {
+  const k = classifyXfer(ins);
+  return k === null || k === 'cond';
+};
+/** Classify a block-terminating control transfer, or `null` for a non-transfer instruction (the
+ *  block falls through). The SINGLE source of truth for "what ends a Thumb block and how", so a
+ *  transfer form cannot be modelled in one place and missed in another. A return via a restored
+ *  link register is distinguished from a COMPUTED/loaded PC write (jump table / computed goto /
+ *  register tail call), which this frontend does not model and must LOUD-FAIL rather than silently
+ *  drop — mirroring the MIPS `jr` and PPC `bctr` guards. (agbcc dispatches a dense switch via
+ *  `mov pc, rN`.) */
 function classifyXfer(ins: Instr): XferKind | null {
   const mn = ins.mnemonic;
   if (mn === 'b') {
@@ -150,9 +213,16 @@ function classifyXfer(ins: Instr): XferKind | null {
   }
   // A write to PC is a control transfer. `mov pc, lr` restores the link register → return; any other
   // computed/loaded PC write (`mov pc, rN` rN≠lr, `ldr pc, …`, `add/sub pc, …`) is an indirect jump.
+  //
+  // BY REGISTER, NOT BY ALIAS. `pc` and `r15` are one register, and `readData` already says so; here
+  // the alias decides CONTROL FLOW, so missing it does not degrade — the write is not a transfer at
+  // all, the terminator never forms, and execution runs on into the next block. `mov r15, lr` mid
+  // function deleted the early return outright AND minted a phantom parameter for the `lr` read that
+  // was left behind, with no diagnostic. `lr`/`r14` is the same question one operand over, and it is
+  // the safe half: missing it reads as an indirect jump, which declines loud.
   const dest = ins.ops[0]?.replace(/[[\]]/g, '');
-  if (dest === 'pc') {
-    if ((mn === 'mov' || mn === 'movs') && ins.ops[1] === 'lr') {
+  if (dest === 'pc' || dest === 'r15') {
+    if ((mn === 'mov' || mn === 'movs') && (ins.ops[1] === 'lr' || ins.ops[1] === 'r14')) {
       return 'return';
     }
     return 'indirect';
@@ -179,7 +249,49 @@ function classifyXfer(ins: Instr): XferKind | null {
   return null;
 }
 
-const imm = (s: string) => parseInt(s.replace(/^#/, ''), s.includes('0x') ? 16 : 10);
+// A raw immediate's value. Case-insensitive on the radix because gas accepts `0X` and `parseInt`
+// with the wrong one reads `#0X1` as 0 — see `immEq` below for why this stays loose about binary,
+// octal and expressions, and which callers therefore have to refuse rather than ask this.
+const imm = (s: string) => parseInt(s.replace(/^#/, ''), /0[xX]/.test(s) ? 16 : 10);
+
+// AN IMMEDIATE IS A NUMBER, NOT A SPELLING, and which spelling appears is the producer's choice
+// rather than the machine's. Counting the gated shapes (`add`/`rsb rD, rS, #0`) over the vendored
+// checkouts, every producer writes `#0` — sa3's split 11158, sa3's build 9837, klonoa's build 1072,
+// and `#0x0` not once between them — EXCEPT klonoa's own disassembly, which writes `#0x0` 3533
+// times against 36. So an idiom keyed on the token is off for one whole project in silence, which
+// is what this predicate exists to stop. `#2`, `#0x2` and `#0x02` are likewise one shift, and the
+// jump-table shift recogniser used to compare the operand text and so rejected the third.
+//
+// The operand must be a plain integer LITERAL, and that shape check is the whole point of this
+// helper rather than an incidental guard. `imm()` is `parseInt`, which stops at the first character
+// it cannot consume — `#0b1` and `#0.5` read as 0, `#010` as 10 where gas means 8 — and it reads
+// `#2*2` as 2, which is not malformed but an expression gas
+// accepts and assembles to `lsls r0, r1, #4`. Matching it as a shift by two would recover a switch
+// whose stride is wrong by a factor of four: the emitted C is entirely ordinary and dispatches to
+// the wrong BLOCK, with no marker. `#2+1`, `#2-1` and `#2<<1` are the same trap. An adversarial
+// probe found this after the first cut of this helper shipped with exactly that hole, and the test
+// that claimed to pin the property sampled only `#3`/`#0x3`/`#0x1`/`r2` and so passed anyway.
+//
+// Anything that is not a bare decimal or hex literal therefore fails this test — which is a
+// DECLINE only where the caller declines, and the three callers differ. The jump-table recogniser
+// returns null; the `add` and `rsb` copy/negate arms fall through to their own lowering, and for
+// `add`/`sub` that lowering is `constVal(imm(…))`, which is loose. So a non-match is a refusal at
+// two of the three sites and a possibly-wrong constant at the third; `#0b1` renders `+ 0` there.
+// The hole is `imm`'s rather than this predicate's, and a characterization test pins it.
+//
+// The refused class that DOES occur is the signed literal: 722 negative immediates across the
+// corpus (`#-0x4` ×287, `#-0x004`, …), all of them inert here because neither 0 nor 2 is negative —
+// but `imm` reads them correctly and this does not, so the two disagree on a populated class and a
+// future `want` has to know that.
+//
+// One divergence is knowingly left in, and it is inert at both values this is used with.
+// A leading zero means octal to gas and decimal to `Number`, so `#010` is 8 there and 10 here —
+// but for `want === 2` both readings fail and the dispatch declines either way, and for
+// `want === 0` every octal spelling of zero (`#0`, `#00`, `#000`) is zero under both. A `want`
+// other than those two has to revisit this, because for e.g. `want === 8` the readings disagree.
+const IMM_LITERAL = /^#\s*(?:0[xX][0-9a-fA-F]+|[0-9]+)$/;
+const immEq = (op: string | undefined, want: number): boolean =>
+  op !== undefined && IMM_LITERAL.test(op) && Number(op.slice(1).trim()) === want;
 
 // Expand fused register-range tokens (`r4-r7` → r4,r5,r6,r7) in a register list. Ranges are
 // numeric-endpoint only (`rN-rM`); a range whose endpoint is an ALIAS (`r4-pc`/`-lr`/`-sp`) is
@@ -192,6 +304,12 @@ const imm = (s: string) => parseInt(s.replace(/^#/, ''), s.includes('0x') ? 16 :
 // depth. Unreachable from real assembly; the guarantee should not depend on that.
 const REG_NUM: Record<string, number> = Object.assign(Object.create(null), { sp: 13, lr: 14, pc: 15 });
 
+// Registers Thumb-1's `push` cannot name, in every spelling this ISA's asm uses for them. Saving
+// one takes agbcc's `mov rLow, rHi; push {rLow}`, which is why the prologue's save set has to read
+// the `mov` as well as the list (see `savedRegs`). Spellings, not numbers: nothing here normalises
+// a register name, so `sl` and `r10` are separate keys everywhere the frontend uses one.
+const HIGH_REGS: ReadonlySet<string> = new Set(['r8', 'r9', 'r10', 'r11', 'r12', 'sb', 'sl', 'fp', 'ip']);
+
 // Thumb-1 data-processing mnemonics that write the condition flags when their destination is a LOW
 // register — which is all of them on this ISA, `s`-suffix or not (the assembler picks the encoding).
 // Used to invalidate a pending compare: see the decode loop. `cmp`/`cmn`/`tst` are absent on purpose
@@ -261,19 +379,28 @@ function expandRegList(tokens: string[]): string[] {
 
 // Expand a register list and vouch that every entry is a DEFINITE register, or return null.
 //
-// The two consumers tokenize differently (the ldm/stm arm has a base register to slice off, the
-// frame walk does not), so each keeps its own tokenizing — but the VALIDATION has to be one
-// function, because the two hand-rolled versions had drifted to unequal strength. The frame walk
-// required every token to be a real register; the ldm/stm arm only rejected a leftover `-`, so
-// `ldmia r1!, {foo}` lifted and emitted `s32 f(s32 a0, s32 a1) { return a0; }` — a parameter
-// fabricated from a token that names no register, which is the phantom this frontend's guards
-// exist to prevent.
+// ONE validation for every consumer, because the hand-rolled versions had drifted to unequal
+// strength. The frame walk required every token to be a real register; the ldm/stm arm only
+// rejected a leftover `-`, so `ldmia r1!, {foo}` lifted and emitted
+// `s32 f(s32 a0, s32 a1) { return a0; }` — a parameter fabricated from a token that names no
+// register, which is the phantom this frontend's guards exist to prevent.
 //
 // An unexpandable range leaves its raw `-` token (see expandRegList) and fails here; so does an
 // unknown alias, which a `Number.isNaN(regNum(t))` test would MISS, since regNum returns undefined
 // for one and `Number.isNaN(undefined)` is false. An empty list is a malformed list, not an empty
-// transfer. Lowercase-only is deliberate and free: an uppercase mnemonic declines as unmodelled
-// long before either consumer runs.
+// transfer.
+//
+// LOWERCASE-ONLY IS A HOLE, NOT A FREEBIE. GNU as accepts `PUSH {R4, LR}`, and the three consumers
+// of this predicate do not agree
+// about it. The ldm/stm arm degrades to a loud opaque and the frame walk poisons its depth, both of
+// which decline; `savedRegs` does neither. It `break`s out of the prologue scan on an unreadable
+// list, which yields a SMALLER save set rather than no answer, so the def-less `r4` it should have
+// partitioned into an uninitialised local becomes a parameter instead. Measured 2026-09-06 on
+// `push {r4,lr}; add r0,r4,#0; pop {r4}; bx lr`: lowercase gives `s32 f(void)` with `uninit_r4`,
+// while both `push {R4, LR}` and `PUSH {r4, lr}` give `s32 f(s32 a0) { return a0; }`. Nothing in
+// the corpus reaches it — 0 uppercase register tokens across the reference asm of the benchmark's
+// agbcc rows — but folding case belongs in `expandRegList`, where it also changes classifyXfer's
+// `popsPc`, i.e. block splitting. That is a measured change, not a free one.
 function definiteRegList(tokens: string[]): string[] | null {
   const list = expandRegList(tokens);
   if (list.length === 0) {
@@ -282,6 +409,24 @@ function definiteRegList(tokens: string[]): string[] | null {
   return list.every((s) => /^r\d+$/.test(s) || s in REG_NUM) ? list : null;
 }
 
+/** The braced register list of a `push`/`pop`/`ldmia`/`stmia`, as definite registers or null.
+ *
+ *  `splitOperands` has already torn `{r4, r5, lr}` at its commas, so the list arrives as several
+ *  operand tokens with the braces on the outer two; re-joining and re-splitting is what puts it
+ *  back together. Three consumers ask this — the frame walk's `delta`, `savedRegs`, and the ldm/stm
+ *  arm (which slices its base register off first) — and they get ONE tokenizer, because the
+ *  tokenizing is where the drift that {@link definiteRegList} documents started. */
+function regListOf(ops: string[]): string[] | null {
+  return definiteRegList(
+    ops
+      .join(',')
+      .replace(/[{}]/g, '')
+      .split(',')
+      .map((r) => r.trim())
+      .filter(Boolean),
+  );
+}
+
 // Split an operand list on commas that are NOT inside brackets, so a memory operand like
 // `[r0, #0x8]` (base + offset) stays a single token instead of being torn at its comma.
 function splitOperands(s: string): string[] {
@@ -307,15 +452,25 @@ function splitOperands(s: string): string[] {
   return out;
 }
 
-// Parse a Thumb memory addressing operand `[base]` or `[base, #off]` into base register +
-// constant byte offset. (Register-scaled indices like `[base, r1, lsl #2]` are not handled
-// yet — agbcc materialises those as explicit add/lsl before the load in the cases we target.)
+// Parse a Thumb memory addressing operand `[base]`, `[base, #off]` or `[base, rX]` into base
+// register + constant byte offset + optional register index.
+//
+// KNOWN HOLE: only the first TWO tokens are read. A third — the scale in `[rB, rX, lsl #2]`, or a
+// second index register — is dropped with no diagnostic, and the load arm then lowers the result as
+// a plain `rB + rX`. Measured 2026-09-06: `ldr r0, [r0, r1, lsl #2]` lifts to
+// `*(s32 *)(a0 + a1)`, silently wrong by a factor of four. ARMv4T Thumb has no scaled-index load
+// encoding, so nothing an agbcc-shaped input contains reaches it — but this frontend parses TEXT,
+// and the honest fix is a decline here rather than a comment. Adding one is a behaviour change and
+// has to be measured.
 function parseAddr(operand: string): { base: string; off: number; regOff?: string } {
   const inner = operand.replace(/[[\]]/g, '').trim();
   const parts = inner.split(',').map((s) => s.trim());
   const base = parts[0];
-  // `[rB, rX]` — REGISTER-offset addressing. Surfaced to the caller so load/store DECLINE
-  // loud: silently reading `[rB]` (the old behavior) dropped the index — a silent miscompile.
+  // `[rB, rX]` — REGISTER-offset addressing, surfaced rather than swallowed, for two different
+  // callers: the sp paths (argIndex, the slot arms, isFrameObjectAccess) all refuse a register
+  // index outright, and the ordinary load/store path lowers it as an explicit `rB + rX` add before
+  // a load at offset 0. Reading it as a bare `[rB]` drops the index, and `ldrsh` exists ONLY in
+  // this form in Thumb-1, so every `ldrsh` goes through this branch.
   if (parts[1] !== undefined && !parts[1].startsWith('#')) {
     return { base, off: 0, regOff: parts[1] };
   }
@@ -323,6 +478,227 @@ function parseAddr(operand: string): { base: string; off: number; regOff?: strin
   return { base, off };
 }
 
+// ── FRAME AND REGISTER PREDICATES ────────────────────────────────────────────────────────────
+// Capture-free helpers: pure functions of an instruction, an operand token or an explicit
+// dependency bag. Nothing here reads lift state, which is why they sit at module level — the size
+// of `lift` should reflect what it actually decides.
+
+const reg = (s: string) => s.replace(/[[\]]/g, '');
+
+// THE one test for "is this token the stack pointer". Case-insensitive because GNU as accepts
+// uppercase register names, and a case-sensitive test here is a silent-wrong-answer hole rather
+// than a cosmetic one: `add r0, SP, #4` is `&local`, and missing it fabricates a phantom
+// parameter and emits confident arithmetic on it.
+const isSpReg = (s: string | undefined): boolean => {
+  const r = reg(s ?? '').toLowerCase();
+  return r === 'sp' || r === 'r13';
+};
+
+const isFrameAdjust = (
+  mnemonic: string,
+  dest: string | undefined,
+  base: string | undefined,
+  off: string | undefined,
+): boolean =>
+  (mnemonic === 'add' || mnemonic === 'sub') &&
+  isSpReg(dest) &&
+  (base === undefined || isSpReg(base)) &&
+  (off?.startsWith('#') ?? false);
+
+// A virtual register key per incoming stack argument. Reading it goes through the ordinary Braun
+// live-in path (frontend/ssa.ts), which turns a read with no reaching def into a function
+// parameter — so this needs NO new representation, opcode or pass. The `@` cannot appear in a
+// real register token, so the key cannot collide with one.
+const stackArgKey = (index: number) => `@sarg${index}`;
+// Defined beside its mint site on purpose: the format string and its parser drifted 650 lines
+// apart in the first version, with the convention explained only at one end.
+const stackArgIndex = (key: string): number | null => {
+  const m = /^@sarg(\d+)$/.exec(key);
+  return m ? +m[1] : null;
+};
+
+// INCOMING STACK ARGUMENTS (AAPCS). Args 1-4 arrive in r0-r3; args 5+ are pushed by the CALLER,
+// so the callee reads them at `[sp, #N]` where N is at or above its own frame. Those are
+// PARAMETERS, not locals — declining them as "sp used as data" refuses a calling convention.
+//
+// The frame depth is tracked by a linear walk of the ENTRY BLOCK only, which is
+// why the gate is what it is: within one straight-line block the depth at each instruction is
+// exact and needs no CFG reasoning. Every case that would need more declines.
+//
+// `push {a,b,c}` deepens by 4 per register; `sub sp, #N` and `add sp, sp, #-N` deepen by N.
+//
+// The walk, its two invariants and the predicate that reads them are ONE object on purpose. They
+// were three loose pieces — a delta function, a pair of `let`s updated in the instruction loop,
+// and a seven-parameter predicate taking the pair by value — and both bugs the second review pass
+// found lived in the seams: an invariant the predicate's proof needed but only the loop could
+// enforce, and a `0` returned for an unrecognised shape that only a guard in a third place made
+// safe. Anything that changes how sp moves now has one place to change, and the proof it has to
+// preserve is written next to the state it is about.
+//
+// `deps` carries the only two things about the FUNCTION this needs — the ABI's argument-register
+// count, and whether the entry block has predecessors — so the walk itself reads nothing but the
+// instructions it is stepped over.
+const makeFrameWalk = (deps: { argRegs: readonly string[]; entryHasPreds: boolean }) => {
+  // Bytes the frame has grown since function entry, along this block's linear order only.
+  let depth = 0;
+  let depthKnown = true;
+
+  // Returns null whenever the depth cannot be computed exactly — including for any write to sp
+  // this does not model. The capability rests on the depth being EXACT, so an approximation is
+  // never acceptable: understate the frame and a local sits above the computed top and gets
+  // minted as a parameter reading uninitialised stack. A null poisons the depth for the rest of
+  // the block, which disables argument recovery and leaves every `[sp,#N]` to decline as before.
+  // Nothing here may return a NUMBER for a shape it merely failed to recognise.
+  const delta = (ins: { mnemonic: string; ops: string[] }): number | null => {
+    const m = ins.mnemonic;
+    if (m === 'push' || m === 'pop') {
+      // expandRegList, NOT a comma count: `push {r4-r7, lr}` is FIVE registers, and counting it as
+      // two makes the frame 12 bytes too shallow — which turns a genuine LOCAL into a fabricated
+      // parameter reading uninitialised stack. Caught by a probe, not by the corpus: agbcc emits no
+      // range pushes at all — re-counted 2026-09-06 over the 269 of the benchmark's 404 agbcc rows
+      // whose reference asm the local bench cache holds, where NO `push`/`pop` list carries a range
+      // — but GNU as accepts them and the disassembly path can produce them. (The population is the
+      // rows, not the cache's file count: a cache also holds entries for rows that no longer exist,
+      // so two checkouts of this commit disagree about how many files there are and agree about
+      // this.)
+      // Counting comma tokens instead would undercount `{r4-lr}` as two registers, and an
+      // unexpandable range must poison the depth rather than be guessed at — definiteRegList owns
+      // both rules, and owns them for the ldm/stm arm too.
+      const list = regListOf(ins.ops);
+      if (list === null) {
+        return null;
+      }
+      return (m === 'push' ? 1 : -1) * 4 * list.length;
+    }
+    if ((m === 'add' || m === 'sub') && isSpReg(ins.ops[0])) {
+      const off = ins.ops[2] ?? ins.ops[1];
+      if (off?.startsWith('#')) {
+        const v = imm(off);
+        return m === 'sub' ? v : -v;
+      }
+    }
+    // Any OTHER write to sp poisons the depth. This used to fall through to 0 — "no change" — for
+    // shapes it does not model (`add sp, r4`, `mov sp, rN`, `add sp, r0, #4`), which was safe only
+    // because writeData declines every one of them elsewhere. That is the same
+    // enumeration-of-arms mistake writeData itself exists to end, exported one function away: a
+    // number meaning "no change" is the wrong answer to "I do not understand this". Now the walk is
+    // self-sufficient — unknown ⇒ depth poisoned ⇒ decline — and writeData's refusal is an
+    // independent second guarantee instead of a load-bearing one.
+    if (isSpReg(ins.ops[0])) {
+      return null;
+    }
+    return 0;
+  };
+
+  return {
+    // Advance the walk over one instruction. Call for EVERY instruction, in order.
+    step(ins: { mnemonic: string; ops: string[] }): void {
+      const d = delta(ins);
+      if (d === null) {
+        depthKnown = false;
+      } else {
+        depth += d;
+      }
+      // sp ABOVE the incoming sp poisons the walk for the rest of the block, permanently — the
+      // premise argIndex's proof rests on. See the proof there for what it costs to omit.
+      if (depth < 0) {
+        depthKnown = false;
+      }
+    },
+
+    // Is `[sp, #off]` an incoming stack argument, and which one? `null` means NO — and every null is
+    // a DECLINE, because the caller falls through to readData's sp guard.
+    //
+    // Why a slot at or above the frame top cannot have been written by this function, which is the
+    // whole soundness argument: every sp-relative STORE declines (readData, via the str arm), and a
+    // `push` only ever writes strictly BELOW the current top. An argument slot is at or above the
+    // incoming sp, so no instruction here can have defined it — the value can only be the caller's.
+    //
+    // That second step needs sp to have stayed at or below where it came in — `depth >= 0` at every
+    // point of the walk — or a `push` reaches back up over the argument area and the conclusion is
+    // false:
+    //
+    //     add sp, sp, #8      ; sp = S+8
+    //     push {r4, r5, r6}   ; sp = S-4, and this WROTE r5 to S+0
+    //     ldr  r0, [sp, #4]   ; = S+0 — r5's slot, not the caller's argument
+    //
+    // The depth is back to a plausible +4 by the load, so nothing downstream can tell: it emitted
+    // `s32 f(s32 a0, …, s32 a4) { return a4; }`, the function's own incoming r5 handed back as
+    // argument 5. `pop {r4}; push {r4,r5}` gets there without an `add sp` at all, and a sliced
+    // fragment whose prologue was cut off is exactly this shape — which is the corpus this frontend
+    // reads. `step` enforces it, and never un-poisons: once sp has been above the line, a push during
+    // the excursion may have written the later slots too. This is a PREMISE, not a detail — leaving
+    // it unstated is what let the first version hand back a callee-saved register as an argument.
+    argIndex(addr: { base: string; off: number; regOff?: string }, width: number, bi: number): number | null {
+      const { base, off, regOff } = addr;
+      if (!isSpReg(base) || regOff !== undefined) {
+        return null; // not sp, or `[sp, rX]` — not a fixed argument slot
+      }
+      if (bi !== 0 || deps.entryHasPreds) {
+        return null; // depth is exact only along the ENTRY block's linear order, and only when its
+        // params are parameters rather than phis
+      }
+      if (!depthKnown || depth <= 0) {
+        return null; // an unmeasurable frame, or none established: a headerless FRAGMENT whose
+        // prologue was sliced off looks identical to a frameless function, and there the slots are
+        // locals — minting one would be the silent-wrong trade this frontend refuses
+      }
+      if (width !== 4 || off < depth || (off - depth) % 4 !== 0) {
+        return null; // the argument area is word-granular; BELOW the top is a local, which is the
+        // separate slot-promotion capability
+      }
+      const index = deps.argRegs.length + (off - depth) / 4;
+      return index < MAX_RECOVERED_ARITY ? index : null; // a wild offset must not mint a
+      // 400-parameter signature
+    },
+  };
+};
+
+// Deliberately OVER-inclusive: a `cmp sp, rN` only reads sp but counts here too. Every false
+// positive costs a decline, every false negative costs a wrong slot — so it errs loudly.
+const modifiesSp = (ins: Instr): boolean =>
+  ins.mnemonic === 'push' || ins.mnemonic === 'pop' || isSpReg((ins.ops[0] ?? '').replace(/!$/, ''));
+// A `mov rD, sp` CAPTURES the frame address; the captured value means "the frame base" only if
+// sp still holds that base wherever the value is used — so a capture participates in the
+// constancy proof exactly like a literal [sp,#k] access, and ends the prologue for localArea.
+const capturesSp = (ins: Instr): boolean =>
+  /^movs?$/.test(ins.mnemonic) && !isSpReg(ins.ops[0] ?? '') && isSpReg(ins.ops[1] ?? '');
+const touchesFrame = (ins: Instr): boolean => spMemAccess(ins) !== null || capturesSp(ins);
+const spMemAccess = (ins: Instr): { off: number; width: number; regOff: boolean } | null => {
+  if (!/^(ldr|ldrb|ldrh|ldrsb|ldrsh|str|strb|strh)$/.test(ins.mnemonic)) {
+    return null;
+  }
+  const mem = ins.ops[1];
+  if (mem === undefined) {
+    return null;
+  }
+  const { base, off, regOff } = parseAddr(mem);
+  return isSpReg(base)
+    ? { off, width: /b$/.test(ins.mnemonic) ? 1 : /h$/.test(ins.mnemonic) ? 2 : 4, regOff: regOff !== undefined }
+    : null;
+};
+
+// How much sp moves for `add/sub sp, #imm`, positive = sp RISES (frame shrinks). It models THAT
+// SHAPE AND NOTHING ELSE — a `push`, a register-sized adjust, a `mov sp, rN` all answer null,
+// which each of its three readers takes as "this is not a reservation or a release" and handles
+// for itself: `localArea` sums the prologue's reservations and poisons to 0 on an sp write it
+// cannot read, `savedRegs` ends the prologue run at the first instruction that is neither a save
+// nor an adjust, and the pop/release scan uses it to recognise the epilogue's release. The
+// authoritative depth arithmetic is `makeFrameWalk`'s `delta`, which counts pushes too.
+const spAdjust = (ins: Instr): number | null => {
+  if (!/^(add|sub)$/.test(ins.mnemonic) || !isSpReg(ins.ops[0])) {
+    return null;
+  }
+  const o = ins.ops[2] ?? ins.ops[1];
+  if (o === undefined || !o.startsWith('#')) {
+    return null;
+  }
+  const v = imm(o);
+  return ins.mnemonic === 'sub' ? -v : v;
+};
+
+const isThumbReg = (s: string | undefined): s is string => /^r\d+$/.test(s ?? '');
+
 /** Parse one function's GNU-as text into labelled basic blocks + the CFG, plus the inline `.word`
  *  data tables (label → the list of label operands under it) — the jump-table target arrays agbcc
  *  emits in `.text` (Regime B). Non-`.word` directives are skipped, EXCEPT sub-word data
@@ -339,9 +715,69 @@ interface FlatItem {
   instr?: Instr;
   /** a data directive's payload, kept in-stream so byte layout is computable */
   data?: { halfwords: boolean; values: string[]; inCode: boolean };
+  /** an alignment directive whose fill byte count depends on the function's base alignment —
+   *  resolved into pad instructions by the layout pass, which is the first place that knows it.
+   *  `fill` is the halfword encoding the assembler repeats: 0x0000 for an explicit `, 0`, 0x46C0
+   *  (the Thumb nop) for no fill operand. Both are PAD_ENCODINGS entries. */
+  align?: { pow: number; fill: number };
+}
+
+/** One hypothesis about a function's base alignment, laid out: the item stream with every
+ *  alignment directive replaced by the pad instructions its fill bytes ARE, each item's byte
+ *  offset, where each item came from in the unexpanded stream (-1 = an inserted fill), and the
+ *  fill sites themselves. Two of these — base 0 and base 2 — are built for every slice. */
+interface Candidate {
+  base: number;
+  items: FlatItem[];
+  offs: number[];
+  from: number[];
+  fills: { site: number; start: number; bytes: number }[];
 }
 
-function decode(name: string, asm: string): { blocks: AsmBlock[]; dataWords: Map<string, string[]> } {
+/** One fact a candidate layout decided, as DATA rather than as a sentence. Two candidates are
+ *  compared by these, so the comparison cannot depend on how a message happens to be worded — and
+ *  a fact that must distinguish two layouts cannot lose the thing that distinguishes them. The
+ *  branch target is an ITEM identity, never a byte offset: one layout's offsets mean nothing in
+ *  the other. A target inside alignment fill carries WHICH fill and how far in, because two
+ *  layouts that send the same branch into different fill sites disagree. */
+type LayoutFact =
+  | { kind: 'branch'; at: number; to: { item: number } | { fill: number; off: number } | { off: number } }
+  | { kind: 'load'; at: number; value: string }
+  | { kind: 'fill'; site: number; bytes: number };
+
+/** A candidate that survived resolution: the rewritten stream, the literal pools it discovered,
+ *  and the WITNESS — every fact this layout decided, so two candidates can be COMPARED rather
+ *  than merely counted. */
+interface Resolved {
+  base: number;
+  items: FlatItem[];
+  pools: Map<string, string[]>;
+  witness: LayoutFact[];
+}
+
+/** The canonical serialisation a witness is compared BY, and the prose it is reported AS. Keeping
+ *  them apart is the point: rewording `sayFact` changes a message, never a decision. */
+const factKey = (f: LayoutFact) => JSON.stringify(f);
+const sayFact = (f: LayoutFact): string => {
+  if (f.kind === 'load') {
+    return `pc-relative load at item ${f.at} → ${f.value}`;
+  }
+  if (f.kind === 'fill') {
+    return `alignment fill at item ${f.site} is ${f.bytes} bytes`;
+  }
+  const to =
+    'item' in f.to
+      ? `item ${f.to.item}`
+      : 'fill' in f.to
+        ? `alignment fill at item ${f.to.fill} (+${f.to.off} bytes)`
+        : `byte offset 0x${f.to.off.toString(16)}, which is no item`;
+  return `raw branch at item ${f.at} → ${to}`;
+};
+
+function decode(
+  name: string,
+  asm: string,
+): { blocks: AsmBlock[]; dataWords: Map<string, string[]>; funcLabels: Set<string> } {
   // Flatten to (label | instr | data) items, then split into blocks at labels / after branches.
   // `.word LABEL` directives are captured into dataWords keyed by the most recent label (the
   // jump table); ALL word/halfword data also stays in-stream as items, so the raw-halfword and
@@ -351,10 +787,22 @@ function decode(name: string, asm: string): { blocks: AsmBlock[]; dataWords: Map
   const funcLabels: string[] = []; // labels marked as function starts (.thumb_func / pret macros)
   const armLabels = new Set<string>(); // function starts declared ARM-mode (arm_func_start)
   const subwordData = new Map<string, string>(); // label → sub-word data directive under it
-  // Directives whose byte size we cannot know, recorded by allFlat POSITION so the layout check
+  // Directives this pass cannot read completely, recorded by allFlat POSITION so the layout check
   // is scoped to the SELECTED function's slice — a `.align` between two functions must not
-  // poison a sibling that needs byte-accurate layout.
-  const hazards: { at: number; what: string }[] = [];
+  // poison a sibling that needs byte-accurate layout. That scoping is what the `>= sliceStart`
+  // bound on the code-hazard scan below enforces; reaching one item lower admitted exactly the
+  // sibling this sentence forbids.
+  //
+  // `code` separates the two reasons an unreadable directive matters. An alignment directive emits its
+  // fill INTO THE INSTRUCTION STREAM, so when anything can execute those bytes the function
+  // cannot be lifted at all, whatever else the slice needs. A labelled data table's bytes are
+  // data: they can only shift the offsets of what follows, which matters only when something in
+  // the slice actually needs byte-accurate offsets.
+  //
+  // `why` says which question the directive left unanswered, so the refusal can state the fact it
+  // actually tested: 'size' (how many fill bytes) or 'fill' (which bytes they are). A data
+  // directive leaves only the first open.
+  const hazards: { at: number; what: string; code: boolean; why?: 'size' | 'fill' }[] = [];
   let dataLabel: string | null = null;
   let pendingFn = false;
   let pendingArm = false;
@@ -397,15 +845,33 @@ function decode(name: string, asm: string): { blocks: AsmBlock[]; dataWords: Map
       }
       const hw = rest.match(/^\.(2byte|hword|short)\s+(.+)$/);
       if (hw) {
+        const values = hw[2].split(',').map((w) => w.trim());
         // In the instruction stream these are raw undecoded instructions (luvdis emits branches
         // this way) — kept as items and DECODED (or declined) below. Under a label: a sub-word
         // data table — declines below iff the selected function references it.
-        if (dataLabel !== null) {
+        if (dataLabel === null) {
+          // …EXCEPT the halfwords that ENCODE alignment fill, decoded here to the instruction they
+          // are (see padHalfword), so the pad enters the stream as an `instr` item — the same item
+          // the `lsls r0, r0, #0` spelling of the same two bytes produces, and the same 2 bytes to
+          // the layout walk. That hands padding-versus-real-instruction to the ONE place that
+          // decides it: isPadInstr plus the unreachable-block prune below. Decoding it HERE rather
+          // than in the raw-branch pass matters: a function whose only in-code data was pad then
+          // needs no byte-accurate layout at all, exactly as it needs none under the instruction
+          // spelling.
+          const pads = values.map((v) => {
+            const hw = halfwordLiteral(v);
+            return hw === null ? null : padHalfword(hw);
+          });
+          if (pads.every((p) => p !== null)) {
+            for (const p of pads) {
+              flat.push({ instr: p! });
+            }
+            continue;
+          }
+        } else {
           subwordData.set(dataLabel, hw[1]);
         }
-        flat.push({
-          data: { halfwords: true, values: hw[2].split(',').map((w) => w.trim()), inCode: dataLabel === null },
-        });
+        flat.push({ data: { halfwords: true, values, inCode: dataLabel === null } });
         continue;
       }
       const raw = rest.match(
@@ -419,11 +885,77 @@ function decode(name: string, asm: string): { blocks: AsmBlock[]; dataWords: Map
           );
         }
         subwordData.set(dataLabel, raw[1]);
-        hazards.push({ at: flat.length - 1, what: `.${raw[1]}` }); // byte size unknown / non-word
+        hazards.push({ at: flat.length - 1, what: `.${raw[1]}`, code: false }); // size unknown / non-word
         continue;
       }
-      if (/^\.align\b/.test(rest)) {
-        hazards.push({ at: flat.length - 1, what: '.align' });
+      // `.align N[, fill]` emits (-address) mod 2^N bytes of `fill` — the pad, spelled as the
+      // directive that produces it. Kept as an item so the layout walk can size it (below); its
+      // byte count is not knowable here, which is why it was a hazard before.
+      //
+      // It asks TWO questions, and fusing them is what made the old refusal describe neither the
+      // code nor the assembler ("makes item sizes unknowable" for a form whose size is plain
+      // arithmetic). HOW MANY bytes is `-(base + at) mod 2^N` and does not depend on the fill at
+      // all; WHICH bytes those are is the fill operand. Only the second can make a sizable
+      // alignment unliftable, and only when something can execute the bytes.
+      //
+      //   size unknown  — a max-skip third operand (padding suppressed past a threshold this
+      //                   frontend does not model), a non-numeric N, or N above the 4-byte
+      //                   boundary the base is recovered to. This bound is load-bearing rather
+      //                   than cautious: the layout pass recovers the function's base address only
+      //                   MOD 4 (from 4-aligned pool words), so sizing `.align 3, 0` would mean
+      //                   picking one of four base residues the input says nothing about.
+      //   fill unknown  — an explicit fill this pass cannot map to a pad encoding (`.align 2, 0xFF`
+      //                   emits a real, undefined instruction, not padding).
+      //
+      // The two fills it CAN map are ground truth from `arm-none-eabi-as`, not inference: an
+      // explicit `, 0` gives 0x0000 (`lsls r0, r0, #0`), and NO fill operand in a Thumb code
+      // section gives 0x46C0 — `movs r0, #1` then `.align 2` assembles to `0120 c046`, the nop
+      // that is already PAD_ENCODINGS[1]. (gas pads to the next even offset with 0x00 first, but
+      // base ∈ {0, 2} and every item size is even, so the fill is always whole halfwords.) Both
+      // are pad encodings, so the fill enters the stream as the same `Instr` item the other two
+      // spellings produce and `isPadInstr` + the reachability prune decide it the same way.
+      //
+      // `.p2align` is `.align` with the power-of-two reading made explicit and `.balign` is the
+      // same directive counting BYTES; GNU as emits identical fill for all three. They are read
+      // here for the same reason the pad halfword is decoded above: a directive this pass does not
+      // recognise contributes ZERO bytes to the layout while emitting real ones, which silently
+      // retargets every branch and pool load after it.
+      //
+      // Which is why this matches the FAMILY, not three literal spellings. gas directives are
+      // case-insensitive (`.ALIGN 2, 0` assembles identically — measured), and `.balignw` /
+      // `.balignl` / `.p2alignw` / `.p2alignl` fill with a repeated halfword or word PATTERN
+      // rather than a byte. A three-word lowercase whitelist skipped all of those as "other
+      // directives", giving them ZERO bytes in the layout while gas emitted real ones: measured,
+      // `.balignw 4, 0x0000` between a raw branch and its target retargeted the branch two bytes
+      // early and lifted the wrong C. A pattern fill stays a loud refusal — the byte COUNT is
+      // computable, but the bytes are a pattern this pass does not decode into pad encodings.
+      const ad = rest.match(/^\.(align|balign|p2align)([wl]?)\b\s*(.*)$/i);
+      if (ad) {
+        const kind = ad[1].toLowerCase();
+        const patternFill = ad[2] !== ''; // the `w`/`l` variants
+        const am = ad[3].trim().match(/^(\d{1,3})(?:\s*,\s*([^,]*?))?\s*$/); // N [, fill]; max-skip → no match
+        const n = am ? Number(am[1]) : NaN;
+        const pow = kind === 'balign' ? Math.log2(n) : n;
+        // No fill operand → the assembler's own code-section fill; `, 0` → zeros. Anything else
+        // (including an empty `.align 2,`) is a fill this pass does not model.
+        const fillText = am?.[2]?.trim();
+        const fill = fillText === undefined ? 0x46c0 : /^0[xX]?0*$/.test(fillText) ? 0x0000 : null;
+        const what = `.${ad[1]}${ad[2]}`; // as written, so the refusal names the reader's own line
+        if (!(Number.isInteger(pow) && pow <= 2)) {
+          hazards.push({ at: flat.length - 1, what, code: true, why: 'size' });
+        } else if (patternFill || fill === null) {
+          hazards.push({ at: flat.length - 1, what, code: true, why: 'fill' });
+        } else {
+          flat.push({ align: { pow, fill } });
+        }
+        continue;
+      }
+      // Belt and braces for the next spelling nobody has thought of: an unrecognised directive
+      // whose NAME says alignment is loud rather than silently zero-sized. Skipping one is the
+      // failure above, and it leaves no marker behind.
+      const alignish = rest.match(/^\.([\w.$]*align[\w.$]*)\b/i);
+      if (alignish) {
+        hazards.push({ at: flat.length - 1, what: `.${alignish[1]}`, code: true, why: 'size' });
       }
       continue; // other directives skipped
     }
@@ -443,10 +975,22 @@ function decode(name: string, asm: string): { blocks: AsmBlock[]; dataWords: Map
     }
     dataLabel = null; // a real instruction ends a data run
     const canon = canonicalMnemonic(m[1]);
+    const ops = m[2] ? splitOperands(m[2]) : [];
+    // `mov r8, r8` is the OTHER way to write 0x46C0 — objdump prints those two bytes as
+    // `nop @ (mov r8, r8)`, and a splitter emits either. It is normalised here, at the same seam
+    // the `.2byte 0x46C0` decode uses (padHalfword), because further down it would be modelled as
+    // a live read of a callee-saved register and mint a parameter the object does not have: the
+    // three spellings of one encoding gave two different signatures. `isPadInstr` only governs the
+    // prune of UNREACHABLE all-pad blocks, so it could not see the divergence — a REACHABLE
+    // `mov r8, r8` is kept, and was kept as a register read.
+    if ((canon === 'mov' || canon === 'movs') && ops.length === 2 && ops[0] === 'r8' && ops[1] === 'r8') {
+      flat.push({ instr: { ...padHalfword(0x46c0)!, asWritten: m[1] } });
+      continue;
+    }
     flat.push({
       instr: {
         mnemonic: canon,
-        ops: m[2] ? splitOperands(m[2]) : [],
+        ops,
         ...(canon === m[1] ? {} : { asWritten: m[1] }),
       },
     });
@@ -541,161 +1085,414 @@ function decode(name: string, asm: string): { blocks: AsmBlock[]; dataWords: Map
     // frontend already models; anything the decoder cannot prove declines loud.
     const isPcRelLdr = (ins?: Instr) =>
       ins?.mnemonic === 'ldr' && /^\[pc,\s*#(0x[0-9a-fA-F]+|\d+)\]$/.test(ins.ops[1] ?? '');
-    const needsLayout = flat.some((f) => (f.data?.inCode ?? false) || isPcRelLdr(f.instr));
+    // An alignment directive's fill bytes are INSTRUCTIONS in the code stream, not decoration: on
+    // ARM7TDMI `.align 2, 0` emits the halfword 0x0000, which IS `lsls r0, r0, #0` and sets the
+    // flags. They are padding only when nothing can execute them. When something CAN, their count
+    // is part of the answer and the slice needs the byte-accurate layout below, exactly as a raw
+    // branch halfword does — so this predicate, not the accident of whether some other item needed
+    // offsets, is what decides. Scanning back from the align: an open or conditional instruction
+    // means control falls into the fill, a label something in the slice NAMES means a branch can
+    // land on it, and nothing at all means the fill sits at the function's entry. Only an
+    // unconditional transfer seals it off, and a label nothing names does not re-open it — agbcc
+    // writes a dead `.L10:` in front of every literal-pool alignment and never branches there, so
+    // reading every label as a way in sends every agbcc function through the base solver for a
+    // fill no instruction can execute (measured when the clause landed: 75 of the then-253 real-tier
+    // reference functions lost; the real tier holds 252 rows today, and the 75 has not been re-run).
+    //
+    // `named` is every operand token, which OVERSHOOTS: `ldr r0, _pool` names `_pool` without
+    // control ever going there. The bound that matters is the one the block builder already draws
+    // — a label heading DATA is not a code entry, so naming it is a load, not a way in. Without
+    // that clause an align between two words of a labelled literal pool read as executable fill
+    // and declined the function, over bytes in the data stream that nothing can execute.
+    const named = new Set<string>(); // labels an operand or a data word names
+    const labelShape = /^([A-Za-z_.$][\w.$]*)/;
+    for (const f of flat) {
+      for (const tok of [...(f.instr?.ops ?? []), ...(f.data?.values ?? [])]) {
+        const m = tok.match(labelShape);
+        if (m) {
+          named.add(m[1]);
+        }
+      }
+    }
+    const headsData = (l: string) => dataWords.has(l) || subwordData.has(l);
+    // A LINEAR, PRE-LAYOUT APPROXIMATION of the CFG walk forty lines below — not a second opinion
+    // about it. Ordering forces the approximation: the real walk needs blocks, blocks need the
+    // item stream, and the item stream needs the fill sizes this predicate is being asked about.
+    // So it answers "can control reach these bytes" by scanning backwards over `flat` instead of
+    // forwards over the CFG, which makes it CONSERVATIVE in one direction on purpose: it looks at
+    // the nearest preceding instruction and does not ask whether THAT instruction is itself
+    // reachable, so a pad in front of an unsizable `.align` reads as "control continues". Loud
+    // where the walk would be quiet, never the reverse. `controlContinuesPast` is shared with the
+    // block-level scan so the two cannot drift on what a transfer kind means.
+    const fillIsReachable = (upto: number) => {
+      for (let j = upto - 1; j >= 0; j--) {
+        const g = flat[j];
+        if (g.label !== undefined) {
+          if (named.has(g.label) && !headsData(g.label)) {
+            return true;
+          }
+          continue; // a label nothing names — or one naming data — cannot bring control here
+        }
+        if (g.instr) {
+          return controlContinuesPast(g.instr);
+        }
+        // data: not executed — keep looking for the instruction whose flow reaches this point
+      }
+      return true;
+    };
+    const sealedFill = flat.map((f, i) => f.align !== undefined && !fillIsReachable(i));
+    // An alignment directive this pass could not READ — its byte count unknown (a max-skip limit,
+    // an alignment wider than the base is known to) or its fill bytes unknown (a fill that is not
+    // a pad encoding) — records a hazard instead of an item,
+    // and its fill bytes are still in the instruction stream. If anything can execute them the
+    // function cannot be lifted, whether or not the slice needs byte offsets for another reason;
+    // reading the size question as a LAYOUT question only is what let a `.2byte 0x0000` pad, once
+    // decoded at parse time, carry a `.align 2` past this check into a silent lift.
+    //
+    // The hazard is recorded at the item BEFORE the directive (`flat.length - 1` at push time), so
+    // its fill occupies slice position `at - sliceStart + 1`. The lower bound is `sliceStart`, not
+    // `sliceStart - 1`: `allFlat[sliceStart]` is the function's OWN label, so an align inside the
+    // slice always records `at >= sliceStart` — and `at === sliceStart - 1` can only mean the
+    // directive sits between the previous function's last item and this function's entry label,
+    // i.e. its fill is emitted at addresses BELOW this function and belongs to the sibling.
+    // Admitting it declined every function that merely FOLLOWED an unsizable alignment, which is
+    // the poisoning the allFlat-position bookkeeping exists to prevent (see `hazards` above).
+    const liveHazard = hazards.find(
+      (h) => h.code && h.at >= sliceStart && h.at < boundaries[boundaryIdx] && fillIsReachable(h.at - sliceStart + 1),
+    );
+    if (liveHazard) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': '${liveHazard.what}' emits fill into the code stream and ` +
+          (liveHazard.why === 'fill'
+            ? `its fill bytes are not a pad encoding this frontend models — they are real instructions`
+            : `makes item sizes unknowable`),
+      );
+    }
+    const needsLayout = flat.some(
+      (f, i) => (f.data?.inCode ?? false) || isPcRelLdr(f.instr) || (f.align !== undefined && !sealedFill[i]),
+    );
+    // NO BENCHMARK REACH BELOW THIS LINE, and it is worth knowing which side of it you are on.
+    // Everything ABOVE — the pad decoding, `fillIsReachable`, `sealedFill`, the live-hazard refusal
+    // — runs on every agbcc function and is bench-load-bearing. The layout solver below runs on
+    // none of them: instrumented and re-measured 2026-09-06 over the 269 of the benchmark's 404
+    // agbcc rows whose reference asm the local bench cache holds, this branch was entered 0 times.
+    // agbcc emits no `[pc, #N]` load and no sub-word data in `.text`, and every `.align` it writes
+    // sits behind a dead `.L` label that the rule above seals. So a clean `bench diff` says NOTHING about any code inside this branch —
+    // `thumb-pad-directives.test.ts` is its only gate, and a change here has to be argued there.
     if (needsLayout) {
-      // Only a hazard WITHIN this function's slice makes its layout unknowable.
+      // Only a hazard WITHIN this function's slice makes its layout unknowable. A fill this pass
+      // cannot model keeps the directive out of the item stream entirely, so it contributes no
+      // size here even though its count is arithmetic — a different fact from an unknown count,
+      // and the message says which one it is.
       const sliceHazard = hazards.find((h) => h.at >= sliceStart && h.at < boundaries[boundaryIdx]);
       if (sliceHazard) {
         throw new FrontendUnsupportedError(
-          `cannot lift '${name}': raw-encoded input needs byte-accurate layout, but '${sliceHazard.what}' makes item sizes unknowable`,
+          `cannot lift '${name}': raw-encoded input needs byte-accurate layout, but '${sliceHazard.what}' ` +
+            (sliceHazard.why === 'fill'
+              ? `fills with bytes this frontend does not model, so it contributes no size to the layout`
+              : `makes item sizes unknowable`),
         );
       }
-      // Byte offset of every item (Thumb-1: 2 bytes per instruction, `bl` is the 4-byte pair).
-      const itemOff: number[] = [];
-      const labelOff = new Map<string, number>();
-      const codeStart = new Set<number>(); // offsets that begin an instruction or carry a label
-      let off = 0;
-      flat.forEach((f, i) => {
-        itemOff[i] = off;
-        if (f.label && !labelOff.has(f.label)) {
-          labelOff.set(f.label, off);
-          codeStart.add(off);
-        }
-        if (f.instr) {
-          codeStart.add(off);
-          off += f.instr.mnemonic === 'bl' ? 4 : 2;
-        }
-        if (f.data) {
-          off += f.data.values.length * (f.data.halfwords ? 2 : 4);
-        }
-      });
-      const labelAt = new Map<number, string>();
-      for (const [lab, lo] of labelOff) {
-        if (!labelAt.has(lo)) {
-          labelAt.set(lo, lab);
-        }
+      // ── the function's base alignment is SOLVED, not derived ─────────────────────────────────
+      // `.align N, 0` emits (-(base + off)) mod 2^N bytes, where `base` is the function's own
+      // address mod 4 — and `base` was until now recovered only AFTER this walk, from literal-pool
+      // positions that the align itself moves. That cycle is why `.align` had to be a hazard.
+      //
+      // Break it by treating `base` as the unknown it is. A Thumb function starts on a 2-byte
+      // boundary, so `base` is 0 or 2; lay the slice out BOTH ways and let the structural
+      // invariants this frontend already enforces on a single layout eliminate the wrong one — a
+      // pool word off a 4-byte boundary, a raw branch landing between instructions, a pc-relative
+      // load landing outside every pool. With nothing to size, the two layouts are identical and
+      // the first invariant alone picks the same base the old derivation did.
+      //
+      // What the input genuinely fails to determine STILL declines: if both bases survive every
+      // invariant and disagree, there is no honest answer to give.
+      const itemSize = (f: FlatItem) =>
+        f.instr ? (f.instr.mnemonic === 'bl' ? 4 : 2) : f.data ? f.data.values.length * (f.data.halfwords ? 2 : 4) : 0;
+      // Replace each `.align pow, 0` with the pad instructions its zero-fill bytes ARE — the same
+      // item the other two spellings of a pad produce. The fill is always a whole number of
+      // halfwords and cannot be otherwise: `base` is 0 or 2, every item size is even (2, 4, or a
+      // whole number of 2/4-byte values), and `pow` is at most 2 — so `-(base + at) & 3` is even.
+      // It was an assertion here; nothing could fail it, and being raised OUTSIDE the candidate
+      // try/catch below it would have bypassed the base machinery it appeared to belong to.
+      const expandAligns = (base: number): Candidate => {
+        const items: FlatItem[] = [];
+        const offs: number[] = [];
+        const from: number[] = []; // items[k] came from flat[from[k]]; -1 marks an inserted fill
+        const fills: { site: number; start: number; bytes: number }[] = [];
+        let at = 0;
+        flat.forEach((f, i) => {
+          if (f.align) {
+            const fill = -(base + at) & ((1 << f.align.pow) - 1);
+            fills.push({ site: i, start: at, bytes: fill });
+            for (let k = 0; k < fill; k += 2) {
+              offs.push(at + k);
+              from.push(-1);
+              items.push({ instr: padHalfword(f.align.fill)! });
+            }
+            at += fill;
+            return;
+          }
+          offs.push(at);
+          from.push(i);
+          items.push({ ...f }); // cloned: pass 2 replaces `instr` on the chosen candidate's items
+          at += itemSize(f);
+        });
+        return { base, items, offs, from, fills };
+      };
+      // The one invariant that costs nothing to check: every literal-pool word is 4-aligned in the
+      // ROM. This IS the old `basePar` derivation, read as a filter instead of an assignment.
+      const laid = [0, 2].map(expandAligns);
+      const viable = laid.filter(({ base, items, offs }) =>
+        items.every((f, i) => !f.data || f.data.halfwords || (base + offs[i]) % 4 === 0),
+      );
+      if (viable.length === 0) {
+        // With an align in the slice this is reachable with ONE pool word: the align's own size
+        // moves it, and neither base lands it on a 4-byte boundary. Nothing is inconsistent with
+        // anything, so the pre-existing multi-pool message would send a reader hunting for a
+        // second pool that does not exist.
+        throw new FrontendUnsupportedError(
+          flat.some((f) => f.align)
+            ? `cannot lift '${name}': no base alignment (0 or 2 mod 4) puts every literal pool word on a ` +
+                `4-byte boundary once alignment fill is accounted for`
+            : `cannot lift '${name}': literal pools at inconsistent alignments — cannot determine the function's base alignment`,
+        );
       }
-      // Thumb-1 branch encodings this frontend models (cond codes 4–7 = mi/pl/vs/vc have no
-      // lifted comparison semantics here; 14 is undefined, 15 is swi — all decline).
-      const COND_MN = ['beq', 'bne', 'bcs', 'bcc', '', '', '', '', 'bhi', 'bls', 'bge', 'blt', 'bgt', 'ble'];
-      const decodeHalfword = (v: number, at: number): { mnemonic: string; target: number } | null => {
-        if (v >= 0xd000 && v <= 0xddff) {
-          const mn = COND_MN[(v >> 8) & 0xf];
-          if (!mn) {
-            return null;
+      // Two viable bases that lay the slice out identically are one candidate: the base is then
+      // unobservable except through a pc-relative load, which declines for want of a pool below.
+      const candidates = viable.filter((c, i) => viable.findIndex((o) => o.offs.join() === c.offs.join()) === i);
+
+      // Everything from here down is the resolution of ONE candidate layout: byte offsets, raw
+      // branch decode, pc-relative pool loads. It reads the candidate and returns the rewritten
+      // stream; it must not touch anything shared, or a rejected candidate would leave its marks.
+      //
+      // It also returns a WITNESS: every fact about the input this layout decided — which pool
+      // word each pc-relative load reads, which item each raw branch targets, and how many fill
+      // bytes each align emits WHEN those bytes are observable. Two candidate bases are compared
+      // by their witnesses, so "they disagree" is something the code establishes rather than
+      // asserts. A sealed fill (nothing can execute it) that no branch targets is left out: those
+      // pad instructions form an all-pad block the unreachable-pad prune below deletes, so their
+      // count cannot reach the answer.
+      const resolveAt = (
+        { base, items, offs: itemOff, from, fills }: Candidate,
+        basePar: number | undefined,
+      ): Resolved => {
+        const pools = new Map<string, string[]>();
+        const observed: LayoutFact[] = [];
+        const fillEntered = new Set<number>(); // fill sites a raw branch lands inside
+        const labelOff = new Map<string, number>();
+        const codeStart = new Set<number>(); // offsets that begin an instruction or carry a label
+        items.forEach((f, i) => {
+          if (f.label && !labelOff.has(f.label)) {
+            labelOff.set(f.label, itemOff[i]);
+            codeStart.add(itemOff[i]);
+          }
+          if (f.instr) {
+            codeStart.add(itemOff[i]);
+          }
+        });
+        const labelAt = new Map<number, string>();
+        for (const [lab, lo] of labelOff) {
+          if (!labelAt.has(lo)) {
+            labelAt.set(lo, lab);
           }
-          const d = (v & 0xff) - (v & 0x80 ? 0x100 : 0);
-          return { mnemonic: mn, target: at + 4 + d * 2 };
-        }
-        if (v >= 0xe000 && v <= 0xe7ff) {
-          const d = (v & 0x7ff) - (v & 0x400 ? 0x800 : 0);
-          return { mnemonic: 'b', target: at + 4 + d * 2 };
         }
-        return null;
-      };
-      // Pass 1: decode every in-code halfword; collect synthesized labels for branch targets.
-      const synthLabels = new Map<number, string>(); // target offset → label to ensure there
-      const decoded = new Map<number, Instr>(); // flat index → replacement branch instr
-      flat.forEach((f, i) => {
-        if (!f.data?.inCode) {
-          return;
-        }
-        if (!f.data.halfwords) {
-          return; // unlabelled word pool — layout bytes only (reached via [pc, #off] below)
-        }
-        f.data.values.forEach((raw, k) => {
-          const at = itemOff[i] + k * 2;
-          const v = parseInt(raw, 16);
-          const br = Number.isFinite(v) ? decodeHalfword(v, at) : null;
-          if (!br) {
-            throw new FrontendUnsupportedError(
-              `cannot lift '${name}': raw halfword '${raw}' in the code stream is not a decodable branch — ` +
-                `skipping it would silently delete its effect`,
-            );
+        // Thumb-1 branch encodings this frontend models (cond codes 4–7 = mi/pl/vs/vc have no
+        // lifted comparison semantics here; 14 is undefined, 15 is swi — all decline).
+        const COND_MN = ['beq', 'bne', 'bcs', 'bcc', '', '', '', '', 'bhi', 'bls', 'bge', 'blt', 'bgt', 'ble'];
+        const decodeHalfword = (v: number, at: number): { mnemonic: string; target: number } | null => {
+          if (v >= 0xd000 && v <= 0xddff) {
+            const mn = COND_MN[(v >> 8) & 0xf];
+            if (!mn) {
+              return null;
+            }
+            const d = (v & 0xff) - (v & 0x80 ? 0x100 : 0);
+            return { mnemonic: mn, target: at + 4 + d * 2 };
           }
-          if (!codeStart.has(br.target)) {
-            throw new FrontendUnsupportedError(
-              `cannot lift '${name}': raw branch '${raw}' targets byte offset 0x${br.target.toString(16)}, which is not an instruction boundary`,
-            );
+          if (v >= 0xe000 && v <= 0xe7ff) {
+            const d = (v & 0x7ff) - (v & 0x400 ? 0x800 : 0);
+            return { mnemonic: 'b', target: at + 4 + d * 2 };
           }
-          if (f.data!.values.length > 1) {
-            throw new FrontendUnsupportedError(
-              `cannot lift '${name}': multi-value raw halfword directive mixing branches is not supported`,
-            );
+          return null;
+        };
+        // Pass 1: decode every in-code halfword; collect synthesized labels for branch targets.
+        const synthLabels = new Map<number, string>(); // target offset → label to ensure there
+        const decoded = new Map<number, Instr>(); // item index → replacement branch instr
+        items.forEach((f, i) => {
+          if (!f.data?.inCode) {
+            return;
+          }
+          if (!f.data.halfwords) {
+            return; // unlabelled word pool — layout bytes only (reached via [pc, #off] below)
           }
-          const lab = labelAt.get(br.target) ?? synthLabels.get(br.target) ?? `.Lraw_${br.target.toString(16)}`;
-          synthLabels.set(br.target, lab);
-          decoded.set(i, { mnemonic: br.mnemonic, ops: [lab] });
+          f.data.values.forEach((raw, k) => {
+            const at = itemOff[i] + k * 2;
+            const v = halfwordLiteral(raw);
+            const br = v === null ? null : decodeHalfword(v, at);
+            if (!br) {
+              throw new FrontendUnsupportedError(
+                `cannot lift '${name}': raw halfword '${raw}' in the code stream is not a decodable branch — ` +
+                  `skipping it would silently delete its effect`,
+              );
+            }
+            if (!codeStart.has(br.target)) {
+              throw new FrontendUnsupportedError(
+                `cannot lift '${name}': raw branch '${raw}' targets byte offset 0x${br.target.toString(16)}, which is not an instruction boundary`,
+              );
+            }
+            if (f.data!.values.length > 1) {
+              throw new FrontendUnsupportedError(
+                `cannot lift '${name}': multi-value raw halfword directive mixing branches is not supported`,
+              );
+            }
+            const lab = labelAt.get(br.target) ?? synthLabels.get(br.target) ?? `.Lraw_${br.target.toString(16)}`;
+            synthLabels.set(br.target, lab);
+            decoded.set(i, { mnemonic: br.mnemonic, ops: [lab] });
+            const inFill = fills.find((fl) => br.target >= fl.start && br.target < fl.start + fl.bytes);
+            if (inFill) {
+              fillEntered.add(inFill.site);
+            }
+            // The branch is witnessed by WHICH item it lands on, not by the byte offset: the
+            // offsets of one layout mean nothing in the other. A target inside fill names the fill
+            // SITE and the distance into it — rendering it as the bare words `alignment fill` made
+            // two layouts that send the same branch into DIFFERENT fill sites compare equal, which
+            // is precisely the disagreement this witness exists to establish.
+            const ti = items.findIndex((_g, j) => itemOff[j] === br.target);
+            observed.push({
+              kind: 'branch',
+              at: from[i],
+              to:
+                ti >= 0 && from[ti] >= 0
+                  ? { item: from[ti] }
+                  : inFill
+                    ? { fill: inFill.site, off: br.target - inFill.start }
+                    : { off: br.target },
+            });
+          });
         });
-      });
-      // Pass 2: pc-relative literal loads → rewrite to a synthesized pool label so the existing
-      // resolvePoolConst/resolvePoolSymbol machinery applies. `(pc & ~3) + off` depends on the
-      // function's absolute alignment (mod 4) — derived STRUCTURALLY: pool words are 4-aligned in
-      // the ROM, so the file-relative offset of any `.4byte` word fixes the base parity (the
-      // luvdis `@ address` comments are not trusted).
-      let basePar: number | undefined;
-      flat.forEach((g, j) => {
-        if (g.data && !g.data.halfwords) {
-          const p = (4 - (itemOff[j] % 4)) % 4;
+        // Pass 2: pc-relative literal loads → rewrite to a synthesized pool label so the existing
+        // `poolRef` machinery applies to it like any other pool operand. `(pc & ~3) + off` depends on the
+        // function's absolute alignment (mod 4) — `basePar`, the candidate base this layout was
+        // built at, which survived the pool-alignment filter above (the luvdis `@ address`
+        // comments are not trusted). It is `undefined` when the slice holds no pool word at all.
+        items.forEach((f, i) => {
+          if (!isPcRelLdr(f.instr)) {
+            return;
+          }
           if (basePar === undefined) {
-            basePar = p;
-          } else if (basePar !== p) {
             throw new FrontendUnsupportedError(
-              `cannot lift '${name}': literal pools at inconsistent alignments — cannot determine the function's base alignment`,
+              `cannot lift '${name}': pc-relative literal load with no literal pool in the function to resolve into`,
             );
           }
-        }
-      });
-      flat.forEach((f, i) => {
-        if (!isPcRelLdr(f.instr)) {
-          return;
-        }
-        if (basePar === undefined) {
-          throw new FrontendUnsupportedError(
-            `cannot lift '${name}': pc-relative literal load with no literal pool in the function to resolve into`,
+          const imm = parseInt(
+            f.instr!.ops[1].match(/#(0x[0-9a-fA-F]+|\d+)/)![1],
+            f.instr!.ops[1].includes('0x') ? 16 : 10,
           );
-        }
-        const imm = parseInt(
-          f.instr!.ops[1].match(/#(0x[0-9a-fA-F]+|\d+)/)![1],
-          f.instr!.ops[1].includes('0x') ? 16 : 10,
-        );
-        const wordOff = ((basePar + itemOff[i] + 4) & ~3) - basePar + imm;
-        // locate the word: a 4-byte data item covering [wordOff, wordOff+4)
-        let value: string | undefined;
-        flat.forEach((g, j) => {
-          if (!g.data || g.data.halfwords) {
-            return;
+          const wordOff = ((basePar + itemOff[i] + 4) & ~3) - basePar + imm;
+          // locate the word: a 4-byte data item covering [wordOff, wordOff+4)
+          let value: string | undefined;
+          items.forEach((g, j) => {
+            if (!g.data || g.data.halfwords) {
+              return;
+            }
+            const rel = wordOff - itemOff[j];
+            if (rel >= 0 && rel < g.data.values.length * 4 && rel % 4 === 0) {
+              value = g.data.values[rel / 4];
+            }
+          });
+          if (value === undefined) {
+            throw new FrontendUnsupportedError(
+              `cannot lift '${name}': pc-relative load at offset 0x${itemOff[i].toString(16)} resolves to byte offset ` +
+                `0x${wordOff.toString(16)}, which is not a word in a literal pool`,
+            );
           }
-          const rel = wordOff - itemOff[j];
-          if (rel >= 0 && rel < g.data.values.length * 4 && rel % 4 === 0) {
-            value = g.data.values[rel / 4];
+          const poolLab = `.Lpcpool_${wordOff.toString(16)}`;
+          pools.set(poolLab, [value]);
+          f.instr = { mnemonic: 'ldr', ops: [f.instr!.ops[0], poolLab] };
+          observed.push({ kind: 'load', at: from[i], value });
+        });
+        // Pass 3: rebuild the stream — insert synthesized target labels, replace decoded halfwords.
+        const next: FlatItem[] = [];
+        items.forEach((f, i) => {
+          const lab = synthLabels.get(itemOff[i]);
+          if (lab && f.label !== lab && !labelAt.has(itemOff[i])) {
+            next.push({ label: lab });
+          }
+          const br = decoded.get(i);
+          if (br) {
+            next.push({ instr: br });
+          } else {
+            next.push(f);
           }
         });
-        if (value === undefined) {
-          throw new FrontendUnsupportedError(
-            `cannot lift '${name}': pc-relative load at offset 0x${itemOff[i].toString(16)} resolves to byte offset ` +
-              `0x${wordOff.toString(16)}, which is not a word in a literal pool`,
-          );
+        for (const fl of fills) {
+          if (fl.bytes > 0 && (!sealedFill[fl.site] || fillEntered.has(fl.site))) {
+            observed.push({ kind: 'fill', site: fl.site, bytes: fl.bytes });
+          }
         }
-        const poolLab = `.Lpcpool_${wordOff.toString(16)}`;
-        dataWords.set(poolLab, [value]);
-        f.instr = { mnemonic: 'ldr', ops: [f.instr!.ops[0], poolLab] };
-      });
-      // Pass 3: rebuild flat — insert synthesized target labels, replace decoded halfwords.
-      const next: FlatItem[] = [];
-      flat.forEach((f, i) => {
-        const lab = synthLabels.get(itemOff[i]);
-        if (lab && f.label !== lab && !labelAt.has(itemOff[i])) {
-          next.push({ label: lab });
-        }
-        const br = decoded.get(i);
-        if (br) {
-          next.push({ instr: br });
-        } else {
-          next.push(f);
+        return { base, items: next, pools, witness: observed.sort((a, b) => (factKey(a) < factKey(b) ? -1 : 1)) };
+      };
+
+      const resolved: Resolved[] = [];
+      const refusals: Error[] = [];
+      for (const c of candidates) {
+        // A slice with no pool word leaves the base unobservable, exactly as before: `basePar`
+        // stays undefined and a pc-relative load declines for want of a pool to resolve into.
+        const hasPool = c.items.some((f) => f.data && !f.data.halfwords);
+        try {
+          resolved.push(resolveAt(c, hasPool ? c.base : undefined));
+        } catch (e) {
+          // ONLY a refusal is a vote against this base. Swallowing every exception would let a
+          // programming error inside resolveAt elect the other base, and the lift would then rest
+          // on a hypothesis chosen because the code threw.
+          if (!(e instanceof FrontendUnsupportedError)) {
+            throw e;
+          }
+          refusals.push(e);
         }
-      });
-      flat = next;
+      }
+      if (resolved.length === 0) {
+        // With one candidate the message is the single hypothesis's own, byte for byte as before.
+        // With two, reporting only candidate 0's message states one hypothesis as fact — including
+        // byte offsets computed in a layout that was never established, which `onGap: 'annotate'`
+        // writes into the emitted artifact.
+        if (candidates.length === 1) {
+          throw refusals[0];
+        }
+        const why = refusals.map(
+          (e, i) => `base ${candidates[i].base}: ${e.message.replace(/^cannot lift '[^']*': /, '')}`,
+        );
+        throw new FrontendUnsupportedError(`cannot lift '${name}': neither base alignment fits — ${why.join('; ')}`);
+      }
+      // More than one base can survive and still decide EVERY question the same way — an align
+      // whose fill is unreachable padding moves the two layouts apart without moving the answer,
+      // which is the ordinary shape, not a corner. Only a difference in what the layouts decided
+      // is a refusal, and the message quotes the difference it found.
+      const seal = (r: Resolved) => r.witness.map(factKey).join('\n');
+      const other = resolved.find((r) => seal(r) !== seal(resolved[0]));
+      if (other) {
+        const only = (a: Resolved, b: Resolved) => {
+          const bk = new Set(b.witness.map(factKey));
+          return a.witness.filter((w) => !bk.has(factKey(w)));
+        };
+        const say = (w: LayoutFact[]) => (w.length > 0 ? w.map(sayFact).join('; ') : 'nothing');
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': alignment padding depends on the function's base alignment, which this ` +
+            `input does not determine — base ${resolved[0].base} and base ${other.base} both decode ` +
+            `consistently but disagree: base ${resolved[0].base} has ${say(only(resolved[0], other))}, ` +
+            `base ${other.base} has ${say(only(other, resolved[0]))}`,
+        );
+      }
+      for (const [lab, words] of resolved[0].pools) {
+        dataWords.set(lab, words);
+      }
+      flat = resolved[0].items;
+    } else {
+      // Every align in this slice is sealed off by an unconditional transfer (see `sealedFill`),
+      // so its fill is pool padding no instruction can execute — the same verdict the prune below
+      // reaches for a pad block it finds unreachable, arrived at before the layout is needed. Its
+      // bytes cannot move any answer, so the item is dropped and no base is solved.
+      flat = flat.filter((f) => !f.align);
     }
 
     const blocks: AsmBlock[] = [];
@@ -723,11 +1520,8 @@ function decode(name: string, asm: string): { blocks: AsmBlock[]; dataWords: Map
             prev = blocks[j];
           }
         }
-        if (prev) {
-          const k = classifyXfer(prev.instrs[prev.instrs.length - 1]);
-          if (k === null || k === 'cond') {
-            fallsIntoData.add(prev.label);
-          }
+        if (prev && controlContinuesPast(prev.instrs[prev.instrs.length - 1])) {
+          fallsIntoData.add(prev.label);
         }
         cur = null;
         continue;
@@ -788,17 +1582,21 @@ function decode(name: string, asm: string): { blocks: AsmBlock[]; dataWords: Map
       }
     }
     let live = blocks.filter((b) => b.instrs.length > 0);
-    // Alignment-pad NOPs a splitter emits around returns and literal pools: `lsls r0, r0, #0`
-    // is the 0x0000 halfword, `mov r8, r8` is 0x46C0, plus a literal `nop`. A block made ONLY
-    // of these is pool/section padding when unreachable — pruned below. A REACHABLE pad block
-    // is a real (degenerate) instruction and is kept.
-    const isPadInstr = (i: Instr) =>
-      i.mnemonic === 'nop' ||
-      ((i.mnemonic === 'lsl' || i.mnemonic === 'lsls') &&
-        i.ops[0] === 'r0' &&
-        i.ops[1] === 'r0' &&
-        /^#0x?0*$/.test(i.ops[2] ?? '')) ||
-      ((i.mnemonic === 'mov' || i.mnemonic === 'movs') && i.ops[0] === 'r8' && i.ops[1] === 'r8');
+    // Alignment fill a splitter emits around returns and literal pools (isPadInstr, above, is the
+    // single definition of which instructions those are). This is the ONE place padding-versus-real
+    // -instruction is decided, for all three ways the same two bytes get spelled: as the
+    // instruction itself (including the `mov r8, r8` spelling of the nop, normalised at parse), as
+    // `.2byte 0x0000` (decoded at parse — padHalfword), or as an alignment directive (expanded
+    // into these very instructions by the layout pass above whenever anything can execute the
+    // fill; when nothing can, that pass reached the SAME verdict — padding — and dropped the
+    // item). None of them arrives here as its own kind of thing, so none can be judged by a
+    // different rule.
+    //
+    // That claim is about the PRUNE, and the prune only ever sees UNREACHABLE all-pad blocks: a
+    // reachable pad is kept and modelled as the instruction it is. So a spelling that reaches this
+    // point unnormalised is not caught here — `mov r8, r8` was kept as a live read of a
+    // callee-saved register and minted a parameter, invisible to this predicate. Normalisation
+    // belongs at parse, and that is where it now is.
     const padBlocks = new Set(live.filter((b) => b.instrs.every(isPadInstr)).map((b) => b.label));
     if (fallsIntoData.size > 0 || padBlocks.size > 0) {
       // Targeted reachability: a block that falls into data is either luvdis's unreachable
@@ -819,7 +1617,7 @@ function decode(name: string, asm: string): { blocks: AsmBlock[]; dataWords: Map
         if (kind === 'cond' || kind === 'uncond') {
           targets.push(last.ops[0]);
         }
-        if (kind === null || kind === 'cond') {
+        if (last && controlContinuesPast(last)) {
           const fall = live[i + 1]?.label;
           if (fall !== undefined && !fallsIntoData.has(b.label)) {
             targets.push(fall);
@@ -836,7 +1634,7 @@ function decode(name: string, asm: string): { blocks: AsmBlock[]; dataWords: Map
       for (const b of live) {
         if (fallsIntoData.has(b.label) && reach.has(idx.get(b.label)!)) {
           const last = b.instrs[b.instrs.length - 1];
-          if (!last || classifyXfer(last) === null || classifyXfer(last) === 'cond') {
+          if (!last || controlContinuesPast(last)) {
             throw new FrontendUnsupportedError(
               `cannot lift '${name}': reachable code in block '${b.label}' falls through into data bytes`,
             );
@@ -861,16 +1659,10 @@ function decode(name: string, asm: string): { blocks: AsmBlock[]; dataWords: Map
       boundaryIdx++;
       continue;
     }
-    return { blocks: live, dataWords };
+    return { blocks: live, dataWords, funcLabels: new Set(funcLabels) };
   }
 }
 
-// Resolve an agbcc/Thumb literal-pool reference (`ldr rD, .Lpool` / `.Lpool+byteOff`) to the NUMERIC
-// 32-bit word it loads — the `ldr rD, =const` idiom. Returns null when the operand is NOT a numeric
-// pool constant: a register/`[base]` memory operand, an unknown label, a misaligned offset, or a
-// word that is a SYMBOL (an address / jump-table pointer — left for recoverJumpTable or the normal
-// load path). The byte offset selects the word (index = off/4). This keeps a real literal constant
-// (`.word 0x8408`) from being lifted as a phantom pointer parameter and dereferenced (`*a2`).
 // The label-operand shape shared by BOTH pool paths: agbcc `.Lpool`, pret `_08012358`, with an
 // optional `+N` byte offset. Kept in one place so the const and symbol resolvers cannot drift
 // (they did — the drift fabricated phantom pointer params on symbol-pool loads).
@@ -885,8 +1677,12 @@ type PoolRef =
  *  the operand does NOT name a pool (a real register/memory base → the normal load path). When it
  *  DOES name a pool the outcome is const | gaddr | unmodelled — NEVER a fall-through to the load
  *  path, which would materialise the pool label as a phantom pointer parameter (a silent
- *  miscompile). `unmodelled` (a `sym+N` offset, a misaligned/out-of-range index, a `.L` code
- *  label) is the caller's cue to decline loud. */
+ *  miscompile). `unmodelled` is the caller's cue to decline loud, and it has exactly three
+ *  inhabitants, all of them below: an offset that does not select a whole word of the pool
+ *  (misaligned, or past its end); a word that matched the numeric shape but does not parse to a
+ *  finite value; and a word that is neither a number nor `symbol±offset` — a `.L` code label is
+ *  here, since the symbol pattern admits no leading dot. A `sym+N` word is NOT unmodelled: it is
+ *  the gaddr-plus-addend path and lifts cleanly. */
 function poolRef(operand: string, dataWords: Map<string, string[]>): PoolRef | null {
   const m = operand.match(POOL_LABEL);
   if (!m) {
@@ -1019,30 +1815,6 @@ interface JumpTable {
 // since `lsl rD, rS, #imm` is low-register-only, so the add here is always the low-register form.
 const isDataOp = (mn: string, base: 'lsl' | 'add'): boolean => mn === base || mn === `${base}s`;
 
-// A shift amount is a NUMBER, not a spelling. `#2`, `#0x2` and `#0x02` are the same shift; the
-// recogniser used to compare the operand text and so rejected the third.
-//
-// The operand must be a plain integer LITERAL, and that shape check is the whole point of this
-// helper rather than an incidental guard. `imm()` is `parseInt`, which stops at the first character
-// it cannot consume, so it reads `#2*2` as 2 — and `#2*2` is not malformed, it is an expression gas
-// accepts and assembles to `lsls r0, r1, #4`. Matching it as a shift by two would recover a switch
-// whose stride is wrong by a factor of four: the emitted C is entirely ordinary and dispatches to
-// the wrong BLOCK, with no marker. `#2+1`, `#2-1` and `#2<<1` are the same trap. An adversarial
-// probe found this after the first cut of this helper shipped with exactly that hole, and the test
-// that claimed to pin the property sampled only `#3`/`#0x3`/`#0x1`/`r2` and so passed anyway.
-//
-// Anything that is not a bare decimal or hex literal therefore DECLINES, which is the safe
-// direction: a real dispatch spells its shift as a literal. Known false declines, all loud and none
-// observed in any corpus: a binary literal (`#0b10`) and a signed one (`#+2`).
-//
-// One divergence is knowingly left in, and it is inert AT THE ONLY VALUE THIS IS USED WITH.
-// A leading zero means octal to gas and decimal to `Number`, so `#010` is 8 there and 10 here —
-// but both readings are compared against 2, both fail, and the dispatch declines either way; `#02`
-// is 2 under both. **If this helper is ever reused for a `want` other than 2, that has to be
-// revisited**, because for e.g. `want === 8` the two readings disagree about `#010`.
-const IMM_LITERAL = /^#\s*(?:0[xX][0-9a-fA-F]+|[0-9]+)$/;
-const immEq = (op: string | undefined, want: number): boolean =>
-  op !== undefined && IMM_LITERAL.test(op) && Number(op.slice(1).trim()) === want;
 function recoverJumpTable(
   bounds: AsmBlock,
   disp: AsmBlock,
@@ -1055,11 +1827,13 @@ function recoverJumpTable(
   //   direct    cmp rX,#M ; bhi DEF                 → fall through to the dispatch
   //   long jump cmp rX,#M ; bls DISP ; b DEF        → branch TO the dispatch, long-branch the default
   //
-  // The second is what agbcc emits whenever the default is out of a conditional branch's reach —
+  // The second is what agbcc emits whenever the default is out of a conditional branch's reach:
   // Thumb-1 `B<cond>` carries a signed 8-bit HALFWORD offset, so ±256 BYTES, about 128
-  // instructions — which on a real switch it usually is: five of the six benchmark
-  // functions with a table use it, and only the sixth uses the direct form. `longDefault` is the
-  // target of that trailing `b`, read by the caller from the block after `bounds`.
+  // instructions. Both forms occur and both must be read, and no census says which DOMINATES:
+  // re-counted 2026-09-06 over the 269 of the benchmark's 404 agbcc rows whose reference asm the
+  // local bench cache holds, six carry a table and all six take the DIRECT form. That is a proper
+  // subset of the corpus, so a claim about which form dominates needs a full run to make. `longDefault` is the target of the trailing `b`, read by the caller from the
+  // block after `bounds`.
   const bi = bounds.instrs;
   const guard = bi[bi.length - 1],
     cmp = bi[bi.length - 2];
@@ -1145,38 +1919,671 @@ function recoverJumpTable(
     return null;
   }
 
-  // Read the table: the ldr loads a POINTER word (PTR: .word TABLE); the table is TABLE: .word C0…
-  // Note the case labels are matched against `blockLabels` as WRITTEN: the adjacent-label aliasing in
-  // `decode` rewrites branch operands, not `.word` entries, so a table naming an aliased label would
-  // decline here rather than dispatch anywhere. Loud, and no corpus instance — left as a known edge
-  // rather than fixed speculatively.
-  //
-  // The pointer word is addressed the same way every other pool load in this frontend is —
-  // `LABEL[+N]`, selecting word N/4 — because a literal pool is a POOL: agbcc packs the dispatch
-  // pointer in beside whatever else the function needed, and which slot it lands in is an artifact
-  // of emission order. Reading only a bare label whose pool held exactly ONE word declined six real
-  // benchmark functions whose table pointer merely sat later in the pool. Same fix m2c made in
-  // `a7c5c2d`, and the same shared POOL_LABEL grammar the const/gaddr resolvers use, so the three
-  // cannot disagree about what `.L21+0x4` addresses.
-  const pm = ptrLabel.match(POOL_LABEL);
-  const ptrWords = pm ? dataWords.get(pm[1]) : undefined;
-  if (!pm || !ptrWords) {
-    return null;
-  }
-  const ptrOff = pm[2] ? Number(pm[2]) : 0;
-  if (ptrOff % 4 !== 0 || ptrOff / 4 >= ptrWords.length) {
-    return null; // misaligned or past the end of the pool — not a word this pool holds
-  }
-  const caseLabels = dataWords.get(ptrWords[ptrOff / 4].trim());
-  if (!caseLabels || caseLabels.length !== n) {
-    return null;
-  } // table length must equal the bound
-  // Every case target and the default must resolve to a real decoded block; a label that is an
-  // expression (`.L4+4`) or points outside the function would otherwise crash later — decline cleanly.
-  if (!blockLabels.has(defaultLabel) || caseLabels.some((l) => !blockLabels.has(l))) {
-    return null;
+  // Read the table: the ldr loads a POINTER word (PTR: .word TABLE); the table is TABLE: .word C0…
+  // Note the case labels are matched against `blockLabels` as WRITTEN: the adjacent-label aliasing in
+  // `decode` rewrites branch operands, not `.word` entries, so a table naming an aliased label would
+  // decline here rather than dispatch anywhere. Loud, and no corpus instance — left as a known edge
+  // rather than fixed speculatively.
+  //
+  // The pointer word is addressed the same way every other pool load in this frontend is —
+  // `LABEL[+N]`, selecting word N/4 — because a literal pool is a POOL: agbcc packs the dispatch
+  // pointer in beside whatever else the function needed, and which slot it lands in is an artifact
+  // of emission order. Reading only a bare label whose pool held exactly ONE word declined six real
+  // benchmark functions whose table pointer merely sat later in the pool. Same fix m2c made in
+  // `a7c5c2d`, and the same shared POOL_LABEL grammar the const/gaddr resolvers use, so the three
+  // cannot disagree about what `.L21+0x4` addresses.
+  const pm = ptrLabel.match(POOL_LABEL);
+  const ptrWords = pm ? dataWords.get(pm[1]) : undefined;
+  if (!pm || !ptrWords) {
+    return null;
+  }
+  const ptrOff = pm[2] ? Number(pm[2]) : 0;
+  if (ptrOff % 4 !== 0 || ptrOff / 4 >= ptrWords.length) {
+    return null; // misaligned or past the end of the pool — not a word this pool holds
+  }
+  const caseLabels = dataWords.get(ptrWords[ptrOff / 4].trim());
+  if (!caseLabels || caseLabels.length !== n) {
+    return null;
+  } // table length must equal the bound
+  // Every case target and the default must resolve to a real decoded block; a label that is an
+  // expression (`.L4+4`) or points outside the function would otherwise crash later — decline cleanly.
+  if (!blockLabels.has(defaultLabel) || caseLabels.some((l) => !blockLabels.has(l))) {
+    return null;
+  }
+  return { scrutReg, caseLabels, defaultLabel };
+}
+
+interface FrameObjectAudit {
+  name: string;
+  irBlocks: Block[];
+  localArea: number;
+  usedSlotOffsets: ReadonlySet<number>;
+  capturedObjectIsTheWholeFrame: boolean;
+  prototypes: Prototypes;
+  symbols: SymbolMap | undefined;
+  target: TargetDescription;
+}
+
+/** FRAME-OBJECT AUDIT. Every `laddr` the frontend emitted is only a CLAIM that the address it
+ *  names is used as "the address of one scalar local"; this proves it, over the finished function,
+ *  the same boundary-total style as the slot-escape assert in finish(). The address may flow
+ *  anywhere as a VALUE — into an MMIO register (the DMA-fill idiom), a call, a phi — but every
+ *  MEMORY access through it must be at offset 0, with one agreed width and one agreed extension,
+ *  its bytes must belong to nothing else in the frame, and any use the audit cannot vouch for declines the whole function
+ *  loudly. Nothing here guesses: the object's declared type is exactly the access type the machine
+ *  used.
+ *
+ *  Takes its inputs explicitly rather than closing over `lift`. All eight are READ, none is
+ *  reassigned, and the only mutation is to the ops reachable through `irBlocks` — the widths,
+ *  signedness and `volatile` this stamps onto each surviving `laddr`. */
+function auditFrameObjects({
+  name,
+  irBlocks,
+  localArea,
+  usedSlotOffsets,
+  capturedObjectIsTheWholeFrame,
+  prototypes,
+  symbols,
+  target,
+}: FrameObjectAudit): void {
+  let laddrs: Op[] = [];
+  for (const blk of irBlocks) {
+    for (const op of blk.ops) {
+      if (op.opcode === 'laddr') {
+        laddrs.push(op);
+      }
+    }
+  }
+  // …and it runs for a licensed acceptance with no object at all, so the premise re-check below
+  // is total rather than resting on "the capture always survives into the IR".
+  if (laddrs.length > 0 || capturedObjectIsTheWholeFrame) {
+    const readOnlySinks = new Set(target.capabilities.readOnlyAddressSinks ?? []);
+    const defOf = new Map<Value, Op>();
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        for (const res of op.results) {
+          defOf.set(res, op);
+        }
+      }
+    }
+    // A NAME IS NOT AN ADDRESS. The same symbol name can sit at two addresses — a symbol map is
+    // free to carry one — and a `gaddr`'s `sym` can also come straight from the assembly text
+    // (`.word REG_DMA3SAD`), where nothing looked it up at all. So names resolve to an address
+    // here or they resolve to nothing: a name at more than one address vouches for neither.
+    const addrOfName = new Map<string, number | null>();
+    for (const [addr, infos] of symbols ?? []) {
+      for (const si of infos) {
+        addrOfName.set(si.name, addrOfName.has(si.name) ? null : addr);
+      }
+    }
+    // The literal address a value denotes, or undefined when this cannot say. `const` is the
+    // bare pool word, `gaddr` is the same word after the symbol map named it, and `add` is the
+    // base+displacement form an interior attribution produces — three spellings of one address,
+    // which is the point: the answer must not turn on which one the assembly happened to use.
+    const literalAddrOf = (v: Value, depth = 0): number | undefined => {
+      const d = defOf.get(v);
+      if (d === undefined || depth > 2) {
+        return undefined;
+      }
+      if (d.opcode === 'const') {
+        return d.attrs.value as number;
+      }
+      if (d.opcode === 'gaddr') {
+        return addrOfName.get(d.attrs.sym as string) ?? undefined;
+      }
+      if (d.opcode === 'add' && d.operands.length === 2) {
+        const base = literalAddrOf(d.operands[0], depth + 1);
+        const disp = defOf.get(d.operands[1]);
+        if (base !== undefined && disp?.opcode === 'const') {
+          return base + (disp.attrs.value as number);
+        }
+      }
+      return undefined;
+    };
+    // Does this store hand the WHOLE address to something that only reads through it? Word stores
+    // only: a `strh` to a source register hands over half an address, so the device's source is
+    // not this object. A base this cannot resolve — computed, register-offset, merged by a phi —
+    // is the conservative answer.
+    const readsThrough = (op: Op): boolean => {
+      if (readOnlySinks.size === 0 || (op.attrs.width as number) !== 4) {
+        return false;
+      }
+      const base = literalAddrOf(op.operands[0]);
+      return base !== undefined && readOnlySinks.has(base + (op.attrs.off as number));
+    };
+    const fail = (why: string): never => {
+      throw new FrontendUnsupportedError(`cannot lift '${name}': address-taken stack local — ${why}`);
+    };
+    // A FRAME BASE ADDRESSED THROUGH IS NOT A CAPTURE. Thumb-1 gives `ldr`/`str` an `[sp,#imm]`
+    // encoding and gives the sub-word forms none, so a byte or halfword spill can only be spelled
+    // by copying sp into a register and addressing through the copy:
+    //
+    //     mov  r2, sp
+    //     strh r3, [r2, #0x30]
+    //
+    // That is an ADDRESSING MODE. The copy never becomes a value, and the access is the
+    // `[sp,#0x30]` the instruction set cannot spell — so what the machine named is one object at
+    // frame offset 48, not a `[+48]` reach through the frame base.
+    //
+    // A captured address whose every use is a fixed-offset sub-word ACCESS is that shape, and
+    // each of its accesses names its own object: re-root them onto a `laddr` at their own offset,
+    // read at 0, and the rest of this audit judges the objects. A capture with ANY other use is a
+    // real capture and keeps the frame base.
+    //
+    // What makes that judgement total is that the walk below enumerates every ROLE a value can
+    // appear in — every operand of every op, and every edge argument — instead of asking what an
+    // instruction looks like. One instruction can hold two roles: `str rD, [rD, #k]` stores the
+    // frame address through itself, a base use AND an escape, and the escape is what stops the
+    // split.
+    // Why a capture was NOT split, when the reason is one no later message carries — the
+    // `slotsOffReason` idiom: a refusal reported as the wrong capability sends the improvement
+    // loop to build the wrong thing.
+    let splitRefusal: string | null = null;
+    {
+      const uses = new Map<Value, { op: Op; idx: number; blk: Block }[]>();
+      const record = (v: Value, op: Op, idx: number, blk: Block) =>
+        (uses.get(v) ?? uses.set(v, []).get(v)!).push({ op, idx, blk });
+      for (const blk of irBlocks) {
+        for (const op of blk.ops) {
+          op.operands.forEach((v, idx) => record(v, op, idx, blk));
+          // An EDGE ARGUMENT is a use role too, and never an access: a capture that reaches a
+          // block parameter is live past this block, so the taint closure below is what judges
+          // it. Recorded at index -1 so it can never be counted as an access — a split there
+          // would delete a capture the successor argument still names.
+          for (const succ of op.successors ?? []) {
+            for (const a of succ.args) {
+              record(a, op, -1, blk);
+            }
+          }
+        }
+      }
+      const minted: Op[] = [];
+      const consumed = new Set<Op>();
+      for (const capture of laddrs) {
+        const at = uses.get(capture.results[0]) ?? [];
+        const accesses = at.filter((u) => (u.op.opcode === 'load' || u.op.opcode === 'store') && u.idx === 0);
+        // SUB-WORD ONLY, because that is the whole of what the encoding gap forces: `ldr`/`str` DO
+        // have an `[sp,#imm]` form, so a WORD access through a copy is some other shape and must
+        // not be read as this one. It is also what keeps the outgoing-argument area safe — that
+        // guard reads `[sp,#k]` accesses (spMemAccess), which an access through a copy is not, and
+        // agbcc stages arguments 5+ there with `str`.
+        const subWord = accesses.every((u) => (u.op.attrs.width as number) < 4);
+        // A use that is not an access leaves the capture naming the frame base, and the judgement
+        // below reports that use itself — an escape, a phi, arithmetic — so it needs no reason
+        // here. The WIDTH does: nothing downstream mentions it, so a refused word access would be
+        // reported as "a store at [+4]" and the histogram would be asked for the wrong capability.
+        if (at.length === 0 || accesses.length !== at.length) {
+          continue;
+        }
+        if (!subWord) {
+          splitRefusal ??= 'a WORD access through the copy, and `ldr`/`str` have an `[sp,#imm]` form';
+          continue;
+        }
+        // Nothing to split when the capture already names ONE object: every access at offset 0 is
+        // the frame base itself, which is what the DMA-fill idiom captures.
+        if (accesses.every((u) => u.op.attrs.off === 0)) {
+          continue;
+        }
+        for (const u of accesses) {
+          const res = mkValue(T.unk(32));
+          const object = mkOp('laddr', { results: [res], attrs: { off: u.op.attrs.off as number } });
+          u.blk.ops.splice(u.blk.ops.indexOf(u.op), 0, object);
+          minted.push(object);
+          // The ADDRESS operand only — the stored value (operand 1) is passed through
+          // untouched, so no slot home moves (ir/core.ts `SlotHomes`). These accesses go through
+          // a COPY of `sp` rather than the `[sp,#k]` keys the stamp reads, so none of them
+          // carried one to begin with.
+          u.op.operands = [res, ...u.op.operands.slice(1)];
+          u.op.attrs = { ...u.op.attrs, off: 0 };
+        }
+        consumed.add(capture);
+      }
+      if (consumed.size > 0) {
+        for (const blk of irBlocks) {
+          blk.ops = blk.ops.filter((op) => !consumed.has(op));
+        }
+        laddrs = [...laddrs.filter((op) => !consumed.has(op)), ...minted];
+      }
+    }
+    // ONE OBJECT PER FRAME OFFSET. Two `laddr` at the same offset name the same storage; two at
+    // different offsets are different objects, so width, signedness, escape and the overlap
+    // window are decided per offset — one width shared by every capture in the function would
+    // declare a halfword spill and a word spill as one object.
+    const objects = new Map<number, Op[]>();
+    for (const op of laddrs) {
+      const off = op.attrs.off as number;
+      (objects.get(off) ?? objects.set(off, []).get(off)!).push(op);
+    }
+    // Taint maps a value to the OBJECT whose address it may hold, closed over phis: a tainted
+    // edge arg taints the receiving block param. A phi that merges two objects has no single
+    // answer, and picking one would put an access on the wrong storage. Nothing builds one today,
+    // and the reason is worth knowing before changing the split: an object at a nonzero offset
+    // exists only where the split ran, the split refuses any capture with an edge-argument use,
+    // and every frame-base object is the same object.
+    const taint = new Map<Value, number>();
+    for (const [off, ops] of objects) {
+      for (const op of ops) {
+        taint.set(op.results[0], off);
+      }
+    }
+    for (let changed = true; changed;) {
+      changed = false;
+      for (const blk of irBlocks) {
+        for (const op of blk.ops) {
+          for (const s of op.successors ?? []) {
+            s.args.forEach((arg, i) => {
+              const from = taint.get(arg);
+              const param = s.block.params[i];
+              if (from === undefined || param === undefined) {
+                return;
+              }
+              const had = taint.get(param);
+              if (had === from) {
+                return;
+              }
+              if (had !== undefined) {
+                fail(`a phi merges the frame objects at [sp,#${had}] and [sp,#${from}] — one value, two objects`);
+              }
+              taint.set(param, from);
+              changed = true;
+            });
+          }
+        }
+      }
+    }
+    // Judge every use of a tainted value, against the object it names.
+    const accesses = new Map<number, { width: number; signed: boolean; isLoad: boolean }[]>();
+    const escaped = new Set<number>();
+    // TWO QUESTIONS, not one. `escaped` asks whether the address LEFT the function, which is what
+    // decides `volatile`. `mayWrite` asks whether it reached something that could write the frame
+    // BACK, which is what every "a callee may write any frame offset" refusal below rests on. A
+    // store into a device's SOURCE register answers yes to the first and no to the second: the
+    // hardware reads the object, and the DMA-fill idiom this capability was built for
+    // (`vu16 tmp; DmaSet(n, &tmp, …)`) is exactly that shape.
+    const mayWrite = new Set<number>();
+    // …and the two escapes SPLIT, because each decides something the other does not.
+    // `passedToCallee` is the address handed to a callee as an argument — the one escape whose
+    // writer this frontend can name, which is what the struct-return premise re-check below rests
+    // on, and what tells a refusal message which escape it is talking about. `published` is the
+    // address WRITTEN TO MEMORY, how the DMA idiom hands the object to hardware, and what
+    // `volatile` at the stamp keys on. Reading either off `escaped` gets the other one wrong.
+    const passedToCallee = new Set<number>();
+    const published = new Set<number>();
+    // …and WHICH ARGUMENT it was passed as, because argument 0 is the one position a hidden
+    // struct-return pointer can occupy. A `call`'s operand index IS the argument index here (the
+    // `bl` arm reads r0..r<argc-1> in order), so an address handed over at r1 or above is an
+    // argument the source wrote.
+    const passedAboveArg0 = new Set<number>();
+    // …and WHICH CALLEE took it at argument 0, because that callee's declared RETURN TYPE is the
+    // one fact that tells an out-parameter from a hidden struct return. `null` is the narrowing of
+    // an unstamped `target` attr — the `bl`/`blx` lowering always stamps one — and reads as a
+    // callee nothing can be declared about, so it refuses.
+    const arg0Callees = new Map<number, Set<string | null>>();
+    for (const off of objects.keys()) {
+      accesses.set(off, []);
+    }
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        op.operands.forEach((v, idx) => {
+          const off = taint.get(v);
+          if (off === undefined) {
+            return;
+          }
+          const scalar = (kind: string) => {
+            if ((op.attrs.off as number) !== 0) {
+              fail(
+                `a ${kind} at [+${op.attrs.off}] through the captured address — ` +
+                  (splitRefusal ?? 'only a scalar at the captured address is modelled'),
+              );
+            }
+          };
+          if (op.opcode === 'load' && idx === 0) {
+            scalar('load');
+            accesses.get(off)!.push({
+              width: op.attrs.width as number,
+              signed: (op.attrs.signed as boolean) ?? false,
+              isLoad: true,
+            });
+            return;
+          }
+          if (op.opcode === 'store' && idx === 0) {
+            scalar('store');
+            accesses.get(off)!.push({ width: op.attrs.width as number, signed: false, isLoad: false });
+            return;
+          }
+          if ((op.opcode === 'store' && idx === 1) || op.opcode === 'call') {
+            escaped.add(off); // the address ESCAPES as a value — the point of the capability
+            if (!(op.opcode === 'store' && readsThrough(op))) {
+              mayWrite.add(off);
+            }
+            if (op.opcode === 'call') {
+              passedToCallee.add(off);
+              if (idx > 0) {
+                passedAboveArg0.add(off);
+              } else {
+                const t = op.attrs.target;
+                const cs = arg0Callees.get(off) ?? new Set<string | null>();
+                cs.add(typeof t === 'string' ? t : null);
+                arg0Callees.set(off, cs);
+              }
+            } else {
+              published.add(off); // written to memory — the DMA idiom's `*dmaReg = &tmp`
+            }
+            return;
+          }
+          fail(`the captured address flows into \`${op.opcode}\` — not an access, an escape, or a phi`);
+        });
+      }
+    }
+
+    // THE ACCEPTANCE'S PREMISE, RE-ASKED OF THE IR. `capturedObjectIsTheWholeFrame` is a reading
+    // of the TEXT and it is the one thing in this file that switches a refusal OFF, so the two
+    // facts it claims are re-proven here, where they are exact, rather than left to the
+    // approximation that licensed them. Neither is a second opinion on the same evidence: the
+    // scan asks what a REGISTER holds at a `bl`; this asks what the finished function does with
+    // the OBJECT.
+    //
+    // PASSED TO A CALLEE. The whole licence is "a callee is holding the address of this frame",
+    // and the pre-lift scan can say that of a register whose value never reaches a call operand —
+    // a declared arity trims it away, or the register is dead by the time the call is built. When
+    // it does, [sp,#0] has been re-modelled as an addressable object on no evidence at all, and
+    // the outgoing argument that really lived there is gone from the call.
+    //
+    // NOT A STRUCT-RETURN TEMP. A one-word frame rules out agbcc's block-copy bases (each needs
+    // two words) but NOT the hidden return pointer of a <=4-byte non-integer-like struct, which is
+    // exactly one word: `struct S4 { char a,b,c,d; }; struct S4 s = mk(x);` compiles to `add
+    // sp,#-4 / mov r0,sp / bl mk / ldr r0,[sp]`, instruction for instruction an out-parameter
+    // call. Left alone that lifted as `mk(&sp0, a0)` — a call the real prototype rejects.
+    //
+    // THREE facts rule it out and any one will do, because a return temp is storage the CALLEE
+    // owns outright: it is written only by the callee, its pointer is argument 0, always
+    // (compiled — `struct S4 mk3(int,int,int)` puts sp in r0 and shifts all three real arguments
+    // up), and the callee RETURNS the struct. So a store of our own says the object is one this
+    // function fills; an address handed over at r1 or above says the same by position; and a
+    // callee the project declares `void` says it by the ABI — a function that returns nothing has
+    // no hidden return pointer to be given, whatever sits in r0.
+    //
+    // THE THIRD IS A DECLARATION, NOT AN INFERENCE, and it is the ONLY refusal this frontend
+    // switches off on something other than the instruction stream. `FnProto.returnsVoid` is the
+    // project's own header fact, arriving through the same table whose `params` this file already
+    // trusts to decide a call's arity. It is asked of EVERY callee that took the address at
+    // argument 0, because the object gets one decision: one callee undeclared or declared
+    // non-void leaves the ambiguity standing and the refusal fires.
+    //
+    // WHAT IT COSTS WHEN THE DECLARATION IS WRONG, measured rather than compared. On the `sret`
+    // shape above, with `mk` (which really returns `struct S4`) declared `params: 1,
+    // returnsVoid: true`, the lift succeeds and emits `s32 sret(s32 a0) { s32 sp0; mk(&sp0);
+    // return (u8)sp0; }` — a compiling, plausible, WRONG program with the real argument dropped,
+    // where a loud decline stood. Not a smaller cost than a wrong ARITY, either: the same entry
+    // supplies both facts, so a wrong `returnsVoid` drops the argument too, and the frame re-model
+    // is the silent half. The trade is accepted because there IS no other discriminator: compiled
+    // through
+    // the benchmark's own agbcc command, the hidden struct return and the out-parameter emit the
+    // same instructions in the same order, the slot is read back at a scalar width in both, and
+    // in both the value read back is what the function returns — so an asm-side corroboration
+    // would be a rule with no discriminating input. The mitigation is that under-declaring is the
+    // safe direction (an undeclared or non-void callee still declines) and that `FnProto` says
+    // so at the field.
+    //
+    // The residual cost is stated rather than hidden: an OUTPUT-only parameter taken at argument
+    // 0 of a callee the project has NOT declared is still byte-for-byte a struct return, and
+    // still declines with it.
+    const arg0AllDeclaredVoid = (off: number): boolean => {
+      const cs = arg0Callees.get(off);
+      return cs !== undefined && cs.size > 0 && [...cs].every((c) => c !== null && prototypes[c]?.returnsVoid === true);
+    };
+    if (capturedObjectIsTheWholeFrame) {
+      if (!passedToCallee.has(0)) {
+        fail(
+          'the one-word-frame proof licensed this lift on the frame base reaching a callee, and ' +
+            'no call in the lifted function takes it — so nothing rules out an outgoing stack argument at [sp,#0]',
+        );
+      }
+      if (!accesses.get(0)?.some((a) => !a.isLoad) && !passedAboveArg0.has(0) && !arg0AllDeclaredVoid(0)) {
+        fail(
+          'the one-word frame is handed to a callee as argument 0 and never written here, which ' +
+            'is how a hidden struct-return pointer looks — and the callee is not declared `void`, so ' +
+            'nothing says it does not own the storage',
+        );
+      }
+    }
+
+    // The declared type of each object, and then that its bytes belong to nothing else.
+    const extent = new Map<number, number>();
+    for (const [off, acc] of accesses) {
+      if (acc.length === 0) {
+        // nothing in-function pins the object's type, and a guessed declaration is the
+        // plausible-but-wrong class — decline until an inhabitant needs this
+        fail('the captured address is never dereferenced in this function, so nothing pins the local object type');
+      }
+      const widths = new Set(acc.map((a) => a.width));
+      if (widths.size > 1) {
+        fail(`the accesses through the captured address disagree on width (${[...widths].join(' vs ')})`);
+      }
+      // …and on SIGNEDNESS, over the loads, for the same reason: one declared type extends one
+      // way, so an object read by both `ldrsb` and `ldrb` has no faithful declaration —
+      // `sp4 - sp4` would fold to 0 where the machine computes sext(b) - zext(b). Loads only: a
+      // store extends nothing, and `strb` beside `ldrsb` is not a disagreement.
+      const signs = new Set(acc.filter((a) => a.isLoad).map((a) => a.signed));
+      if (signs.size > 1) {
+        fail('the loads through the captured address disagree on signedness — one declared type extends one way');
+      }
+      extent.set(off, acc[0].width);
+    }
+    // TWO MODELS FOR ONE BYTE is a silent disagreement, so each object must own its bytes
+    // outright: inside the reserved local area, clear of every SSA slot (which the slot model
+    // keeps in registers, so a store through the object would not be seen there), and clear of
+    // every other object.
+    const overlaps = (a: number, aw: number, b: number, bw: number) => a < b + bw && b < a + aw;
+    const objs = [...extent].sort((x, y) => x[0] - y[0]);
+    for (const [off, width] of objs) {
+      if (off < 0 || off + width > localArea) {
+        fail(`the object at [sp,#${off}) of width ${width} lies outside the reserved local area`);
+      }
+      for (const slot of usedSlotOffsets) {
+        if (overlaps(off, width, slot, 4)) {
+          fail(`the object at [sp,#${off}) overlaps the SSA slot at [sp,#${slot}] — one byte, two models`);
+        }
+      }
+    }
+    for (let i = 1; i < objs.length; i++) {
+      const [off, width] = objs[i];
+      const [prev, prevWidth] = objs[i - 1];
+      if (overlaps(prev, prevWidth, off, width)) {
+        fail(`the objects at [sp,#${prev}) and [sp,#${off}) overlap — one byte, two models`);
+      }
+    }
+    // WHAT AN ESCAPE COSTS. The audit bounds what WE access through an object, never what a callee
+    // does with the address it was handed — and a callee may write any offset from it. So an
+    // escape retracts two claims, both of them function-wide because one address reaches the
+    // whole frame.
+    //
+    // The first is that the other ADDRESS-TAKEN objects are private, and it keys on ANY escape —
+    // this is the rule `mayWrite` does NOT narrow. Its argument is about LAYOUT, and layout is
+    // symmetric: two objects are two separate C locals with no guaranteed adjacency, so a device
+    // that READS past the one it was given is as wrong as a callee that writes past it. `DmaCopy`
+    // with a count of two halfwords off `&sp0` transfers `[sp,#2]` too, and the emitted source
+    // transfers whatever the recompiler put after `sp0`, and the second object's own store is
+    // whatever the recompiler made of it. Marking both volatile would not repair that: the locals
+    // are still placed independently.
+    //
+    // ACCEPTED RESIDUE, so the rule is not read as wider than it is: it counts `laddr` objects,
+    // so a neighbour that is merely SPILLED to an SSA slot is over-read just the same and nothing
+    // refuses, and the audit never reads the transfer's control word, so an incrementing source
+    // is vouched for exactly as a fixed one is. Both are reads, so the `undef` argument holds
+    // either way, and both predate this rule.
+    if (escaped.size > 0 && objects.size > 1) {
+      fail(
+        'the captured address escapes, so something outside this function reaches the whole ' +
+          'frame — including another object',
+      );
+    }
+    // The second is `undef`, which rests on this function's own stores being the ONLY writer of
+    // its frame. A wider real object (`struct P p; g(&p);` where only `p.x` is read here) has its
+    // later words written by `g` and read back at a slot no store of ours reaches — declaring
+    // those uninitialised spells the callee's value as garbage. The extents here are inferred
+    // from OUR accesses, which is the number that is too small in this shape.
+    //
+    // On an escape and not on "a laddr exists": an address dereferenced only in-function cannot
+    // be written by anyone else, and the overlap checks above cover its aliasing.
+    //
+    // FRAME undefs only. A register-keyed one says a local lives in a register the ABI does not
+    // pass arguments in, and no address reaches a register — the escape this retraction is about
+    // cannot touch it, and counting it would refuse the whole function for an unrelated escape.
+    const undefSlots = irBlocks.some((blk) =>
+      blk.ops.some((op) => op.opcode === 'undef' && slotKeyOffset(op.attrs.key as string) !== null),
+    );
+    if (mayWrite.size > 0 && undefSlots) {
+      fail(
+        'the captured address escapes, so a callee may write any frame offset and an unstored slot is not provably uninitialised',
+      );
+    }
+
+    // …and the SLOT MODEL is the third claim an escape retracts — the undef rule's argument
+    // taken one step further. The extents above are inferred from OUR accesses, so an object
+    // wider in the SOURCE than the bytes this function touches has its later words written by
+    // the callee — and any of those modelled as an SSA slot is a value the slot model forwards
+    // ACROSS the call that overwrote it.
+    //
+    // Not a hypothetical, and not new with the outgoing-argument gate above either: this shape
+    // reached the old capture path and lifted wrongly. The object has to be reached ONLY through
+    // the captured pointer (an `[sp,#0]` access of its own collides with the slot model and
+    // declines at the overlap check), which is what four corpus functions do:
+    //
+    //     mov r2, sp / str r0, [r2]   @ the object, written through the captured address
+    //     str r1, [sp, #0x4]          @ a word the slot model keys
+    //     mov r0, r2 / bl g           @ the base escapes; `g` may write [sp,#4]
+    //     ldr r0, [sp, #0x4]          @ …and the machine RELOADS it after the call
+    //
+    // and the lift emitted `use2(a1)` — the reload replaced by the value from BEFORE the call,
+    // the callee's write dropped, no diagnostic. Exactly the silent-wrong-answer trade the sp
+    // guards exist to prevent, so it refuses.
+    //
+    // WHAT IT COSTS, stated because the benchmark cannot see it: it refuses every word slot above
+    // a `mayWrite` object, which is blunter than the hazard it names — four corpus functions
+    // decline on it (sa3 `sub_809C274`, `UpdateAnimations`, `sub_801C4A0`, `sub_8062CFC`), none
+    // of them a benchmark row. Narrowing it needs the object's real extent, and this model does
+    // not carry one: `extent` is a single width from a single access. The asm sometimes cannot
+    // supply it either — the compiled twin at `capturedObjectIsTheWholeFrame` is exactly this
+    // rule's shape, a slot THIS FUNCTION stores and reloads, undecidable between a spill and a
+    // member.
+    //
+    // ABOVE the object only: a C object extends upward from its base, so a slot BELOW it cannot
+    // be part of it, and the overlap checks above already own the bytes it does cover.
+    //
+    // `mayWrite`, the same predicate the undef rule takes, because the two rules rest on one
+    // argument and a callee is not the only writer. `struct M { u8 b; u8 pad[3]; s32 t; };
+    // gp = &m; g2(); use2(m.t);` PUBLISHES the base to an ordinary global and the machine reloads
+    // [sp,#4] after `bl g2` — `g2` writes through `gp`, which points here. Keyed on
+    // `passedToCallee` that lifted as `use2(v0)`, the reload replaced by the value from before
+    // the call, no diagnostic: the same silent wrong answer as the call shape, one escape over.
+    //
+    // Not `escaped`, which is the strictly wider set and the one that costs: the DMA-fill idiom
+    // publishes to a device SOURCE register, which reads the object and never writes it, and
+    // `readsThrough` is exactly the exemption that keeps `mayWrite` off those rows. What stays
+    // residue is a base stored through a pointer this cannot resolve: unresolvable is the
+    // conservative answer there, so such a store IS in `mayWrite` and such a frame declines.
+    for (const off of mayWrite) {
+      for (const slot of usedSlotOffsets) {
+        if (slot > off) {
+          const how = passedToCallee.has(off) ? 'is passed to a callee' : 'is stored to memory';
+          fail(
+            `the captured address at [sp,#${off}) ${how}, which may write the ` +
+              `slot at [sp,#${slot}] — this function's own store there would be forwarded past the write`,
+          );
+        }
+      }
+    }
+    // …and the FOURTH claim an escape retracts is the object's TOP, which the three rules above
+    // leave to whatever this function happened to touch. `extent` is one width from one access,
+    // so an object wider in the SOURCE than those bytes is declared too small — and a callee
+    // holding its address writes frame bytes the emitted C never allocated. Compiled:
+    //
+    //     u8 buf[12]; buf[0] = x; garr(buf); use2(buf[0]);
+    //       → add sp,sp,#-0xc / mov r1,sp / strb r0,[r1] / mov r0,sp / bl garr
+    //
+    // lifted as `u8 sp0; garr(&sp0); use2(sp0)` — a 12-byte object declared one byte, in a frame
+    // the recompile makes 4 bytes wide, with `garr` writing the other 8 into the caller's. The
+    // three rules above all pass it: one object, no `undef` op, no slot above it.
+    //
+    // What licenses an answer is the frame being ACCOUNTED FOR, word by word. Every word of the
+    // reserved local area has to be an object this audit modelled or a slot the slot model keys;
+    // a word that is neither is storage nothing here describes, so the emitted C reserves less
+    // than the machine did and the writer reaches past what it allocated. Whole local area and
+    // not only the words above the object: a word BELOW cannot be part of the object, but it is
+    // still frame the declaration has to account for. Word granularity, not byte — the stack is
+    // word-aligned, so a halfword object owns its word and the padding beside it is not a second
+    // local.
+    //
+    // `mayWrite`, the predicate the two rules above take, and for the same reason: a device
+    // SOURCE register reads through the address and cannot write the frame back.
+    //
+    // WHAT IT LEAVES, since this is the extent question the gate comment above is about: a
+    // `mayWrite` escape is accepted only where the modelled objects and the keyed slots tile the
+    // reserved area between them — a word above the object is a slot (refused above), a second
+    // object (refused above), or unaccounted (refused here). That is not a wider extent model; it
+    // is the same one-scalar `extent`, made to say when it does not fit. An object of two words
+    // cannot be built here at all — the second access that would reach it is a `[+4]` the
+    // `scalar()` guard refuses — so no widening of the frame licence admits a shape this rule
+    // would then have to judge.
+    if (mayWrite.size > 0) {
+      const accountedWords = new Set<number>();
+      for (const [off, width] of extent) {
+        for (let w = off - (off % 4); w < off + width; w += 4) {
+          accountedWords.add(w);
+        }
+      }
+      for (const slot of usedSlotOffsets) {
+        accountedWords.add(slot - (slot % 4));
+      }
+      for (let w = 0; w < localArea; w += 4) {
+        if (!accountedWords.has(w)) {
+          fail(
+            `the word at [sp,#${w}] is neither an object this lift models nor a slot it keys, ` +
+              `and the captured address reaches something that may write it — nothing accounts for the ` +
+              `rest of the frame, so nothing bounds the captured object's extent`,
+          );
+        }
+      }
+    }
+    // Proven. Stamp the MACHINE FACTS the audit established — width and signedness are what the
+    // accesses used, so the declaration downstream is a fact, not a guess. The C-level NAME is
+    // deliberately NOT chosen here: identifiers live in the structurer's namespace (params,
+    // locals, globals, the symbol map), which the frontend cannot see — a frontend-chosen `sp0`
+    // silently shadowed a project global of the same name.
+    // `volatile` iff the address is PUBLISHED — written to memory, rather than handed to a
+    // callee. That is the DMA idiom this rule was written for and it IS the source's own
+    // spelling there: klonoa's `DMA_FILL` writes `vu##bit tmp` outright, sa3's does under
+    // `PLATFORM_GBA`, pokeemerald's inside `DMA_FILL_UNCHECKED`, and the address goes to a device
+    // register through a store. Reproducing that source means reproducing the qualifier.
+    //
+    // NOT on an ordinary `&local` ARGUMENT, where no source in the corpus writes one and the
+    // qualifier is not free. `void f(u32 i){ s32 w; w = gEnts[i].h; use(&w); four(w,w,w,w); }`
+    // compiles to one `ldr` reloaded into four registers by copies; the structurer emits one C
+    // read per USE rather than per machine load, so `volatile` forbids the CSE and makes it four
+    // `ldr`s — a byte-exact candidate turned into a four-instruction nonmatch (compiled, agbcc
+    // 2.9-arm-000512, `-O2 -mthumb-interwork -Wimplicit -fhex-asm -fprologue-bugfix`). It is free
+    // only where the object is read at most once, which is all the rows that first shipped it
+    // did. agbcc also warns `discards qualifiers` at every such call.
+    //
+    // NOT because gcc would otherwise delete the store. That claim was here for several releases
+    // and does not reproduce: taking `&tmp` makes the local addressable, so gcc-2.9 keeps the
+    // store with or without the qualifier, measured on store-then-escape, publish-then-fill, and
+    // a loop that stores and escapes each iteration. What the qualifier does change is register
+    // ALLOCATION — the same function compiled `vu16` and `u16` is 98 instructions either way and
+    // differs in three register assignments — which is why it still has to be right. asmlift's
+    // OWN dead-store pass used to key on it; it keys on address-taken now (l3/dce.ts), so
+    // dropping the qualifier here cannot cost a store.
+    //
+    // An object whose address never leaves the function needs no volatile and must not pay it.
+    for (const [off, ops] of objects) {
+      const width = extent.get(off)!;
+      const signed = accesses.get(off)!.some((a) => a.signed);
+      for (const op of ops) {
+        op.attrs = { ...op.attrs, width, signed, ...(published.has(off) ? { volatile: true } : {}) };
+      }
+    }
   }
-  return { scrutReg, caseLabels, defaultLabel };
 }
 
 /** Lift decoded asm → an L1 Fn with block-argument SSA. `prototypes` supplies each callee's
@@ -1191,7 +2598,7 @@ export function lift(
   symbols?: SymbolMap,
 ): Fn {
   assertInputFormat('thumb', 'gnu-as', asm);
-  const { blocks: rawBlocks, dataWords } = decode(name, asm);
+  const { blocks: rawBlocks, dataWords, funcLabels } = decode(name, asm);
 
   // Regime B: recover agbcc jump tables. A dispatch block (`mov pc, rN`) plus its bounds
   // predecessor (`cmp; bhi DEF`) collapse into a `switch_br` emitted from the BOUNDS block; the
@@ -1257,6 +2664,25 @@ export function lift(
   // ends the block at it, but it has no static successor, so it must be a catchable "out of scope"
   // signal, not a vanished branch. Mirrors MIPS `jr`/PPC `bctr`. (A RECOGNISED jump table's
   // dispatch block is already elided above, so it is not scanned here.)
+  //
+  // The same rule for a `bl` whose target is inside this function's own text. agbcc relays a
+  // conditional branch past Thumb's ±256-byte reach through an unconditional one, and past THAT
+  // branch's own ±2 KB reach the relay becomes `bl .Lfar @far jump` — an intra-function long
+  // branch wearing the call mnemonic. The decode switch reads it as a call, so without this the
+  // lift emits a call to a block label (`.L3(a0, a1, a2)`): not a branch that vanished but a
+  // transfer turned into something that RETURNS, and syntactically not C.
+  //
+  // The refusal is wider than that one shape because the asm does not separate it from a
+  // locally-defined call thunk — `call_r3: bx r3`, ARMv4T's stand-in for the `blx rN` it has no
+  // encoding for, which pokeemerald's m4a_1.s calls four times from inside MPlayMain's own slice.
+  // Both are a `bl` to a bare label the slice defines, both sit under a conditional branch that
+  // skips them, and both leave `lr` clobbered, so no liveness or layout fact tells them apart.
+  // Lifting the relay as a `br` is the other half of the gap and needs the same distinction plus a
+  // proof that `lr` is dead there, since `bl` overwrites it and a branch must not.
+  //
+  // DECLARED function starts are excluded: a `.thumb_func`/`thumb_func_start` label is a function
+  // by declaration, so `bl` to one is a call however the slice came to contain it — the entry
+  // itself (recursion), or a sibling a shared-tail slice extends through.
   for (const ab of asmBlocks) {
     for (const ins of ab.instrs) {
       if (classifyXfer(ins) === 'indirect') {
@@ -1265,6 +2691,14 @@ export function lift(
             `— jump tables / computed gotos / register tail calls not supported`,
         );
       }
+      const callee = (ins.mnemonic === 'bl' || ins.mnemonic === 'blx') && ins.ops.length === 1 ? ins.ops[0] : undefined;
+      if (callee !== undefined && !funcLabels.has(callee) && blockLabels.has(callee)) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': '${ins.mnemonic} ${callee}' targets a label inside this function ` +
+            `and not a declared function — an intra-function long branch and a locally-defined call ` +
+            `thunk are the same shape here, so this declines rather than guessing which`,
+        );
+      }
     }
   }
 
@@ -1328,8 +2762,69 @@ export function lift(
     ({ labelIndex, preds } = buildCfg(asmBlocks));
   }
 
+  // ENTRY-REACHABLE BLOCKS. Dead code is not evidence about anything: a reload in a block that
+  // never executes is not a read of the slot, and an instruction there is not a fact about the
+  // frame this function actually builds. Two analyses below rest on that, so it is computed once
+  // rather than once each — the second one was written without it and a single unreachable
+  // `mov r0, sp; bl use` appended to a five-argument forwarder was enough to turn a loud decline
+  // into a call with every argument dropped.
+  const entryReachable = ((): Set<number> => {
+    const live = new Set<number>([0]);
+    for (let changed = true; changed;) {
+      changed = false;
+      for (let b = 0; b < asmBlocks.length; b++) {
+        if (!live.has(b) && preds[b].some((q) => live.has(q))) {
+          live.add(b);
+          changed = true;
+        }
+      }
+    }
+    return live;
+  })();
+
+  // A `scratchRegs` entry outside `nonArgRegs` is inert, and inert is how a partition rots: the
+  // list would go on reading as if it exempted something. Refused as a target bug, like the
+  // argRegs/uninitRegs contradiction, rather than declined as a property of the input.
+  const scratchRegs: ReadonlySet<string> = new Set(target.scratchRegs ?? []);
+  for (const r of scratchRegs) {
+    if (!(target.nonArgRegs ?? []).includes(r)) {
+      throw new Error(`target '${target.id}': scratch register ${r} is not among the non-argument registers`);
+    }
+  }
+
   // --- ISA-neutral SSA construction (shared Braun builder) ---
-  const ssa = makeSsaBuilder(name, asmBlocks.length, preds);
+  // THE LIVE-IN PARTITION (frontend/ssa.ts, LiveInModel). `[0, localArea)` is the whole of what this
+  // function owns: an incoming stack argument is keyed `@sarg<k>` rather than `sp@<off>` precisely
+  // because it sits at or above this frame, so `callerParams` is empty. `localArea` is 0 whenever
+  // the prologue walk cannot measure the frame, and the empty range then refuses every slot —
+  // `slotOff` applies the same bound when minting keys, so this is the independent check.
+  //
+  // The register half needs both of its facts, and they come from different places. The target says
+  // which registers no caller can hand a value over in; `savedRegs` says which ones THIS function
+  // saved, and so could have homed a local in. A register in only the first is one the ABI does not
+  // describe — hand-written asm with a private convention, or a mid-function fragment — and it keeps
+  // the treatment a target claiming no partition gets. The save is asked only of the registers the
+  // ABI requires preserving: `target.scratchRegs` need none, so demanding one there would refuse a
+  // local the compiler was entitled to put in place with no prologue at all.
+  const ssa = makeSsaBuilder(name, asmBlocks.length, preds, () => ({
+    ownedLocals: { from: 0, to: localArea },
+    // THE SAME RANGE, AND NOT THE SAME CLAIM. `ownedLocals` answers "is a def-less read here an
+    // uninitialised local?"; `declaredLocals` answers "is a spill here a DECLARATION RANK?", which
+    // `ir/core.ts` `SlotHomes` and `l3/slotorder.ts` consume. Under agbcc's
+    // ACCUMULATE_OUTGOING_ARGS the outgoing stack-argument area sits at the BOTTOM of `localArea`
+    // (see the decline below), so this range would be WRONG for the second question on any
+    // function that has one — and it is written as the same range only because `prefixStored`
+    // declines every such function before it gets here. Lifting that decline obliges narrowing
+    // THIS range above the argument block; the two fields exist apart so that obligation is
+    // visible where it is created rather than inferred from a guard in another module.
+    declaredLocals: { from: 0, to: localArea },
+    ...(target.nonArgRegs
+      ? {
+          uninitRegs: target.nonArgRegs.filter((r) => scratchRegs.has(r) || savedRegs.has(r)),
+          argRegs: target.argRegs,
+        }
+      : {}),
+  }));
   const { fn, irBlocks, readVar, writeVar, paramReg } = ssa;
 
   const constVal = (n: number, b: number): Value => {
@@ -1337,16 +2832,6 @@ export function lift(
     irBlocks[b].ops.push(mkOp('const', { results: [v], attrs: { value: n } }));
     return v;
   };
-  const reg = (s: string) => s.replace(/[[\]]/g, '');
-
-  // THE one test for "is this token the stack pointer". Case-insensitive because GNU as accepts
-  // uppercase register names, and a case-sensitive test here is a silent-wrong-answer hole rather
-  // than a cosmetic one: `add r0, SP, #4` is `&local`, and missing it fabricates a phantom
-  // parameter and emits confident arithmetic on it.
-  const isSpReg = (s: string | undefined): boolean => {
-    const r = reg(s ?? '').toLowerCase();
-    return r === 'sp' || r === 'r13';
-  };
 
   // Writing sp is transparent frame bookkeeping ONLY in the one shape that cannot change anything
   // observable: `sp = sp ± immediate`. Two producers feed this frontend and each emits exactly ONE
@@ -1357,8 +2842,7 @@ export function lift(
   //     disassembly (klonoa asm/ · sa3 asm/)           203 · 1250           0
   //
   // So this is not "one tool with two spellings" — it is the compiler's convention against the
-  // disassembler's, and asmlift reads both kinds of file. (An earlier commit message on this branch
-  // claimed agbcc emitted both; it does not, and the counts above are the check that settles it.)
+  // disassembler's, and asmlift reads both kinds of file.
   //
   // Everything else that writes sp is a
   // frame change this frontend cannot model: a register-sized adjustment (`add sp, r4`, agbcc's
@@ -1382,17 +2866,6 @@ export function lift(
         (slotsOffReason ?? 'not a modelled slot (address-taken local / frame arithmetic / above the local area)'),
     );
 
-  const isFrameAdjust = (
-    mnemonic: string,
-    dest: string | undefined,
-    base: string | undefined,
-    off: string | undefined,
-  ): boolean =>
-    (mnemonic === 'add' || mnemonic === 'sub') &&
-    isSpReg(dest) &&
-    (base === undefined || isSpReg(base)) &&
-    (off?.startsWith('#') ?? false);
-
   // Reading sp as a DATA operand means an address-taken local (`add rD, sp, #N` = `&local`),
   // an sp-relative spill slot (`ldr/str …, [sp, #N]`), or frame-pointer arithmetic — none
   // modellable without a stack abstraction. Without this guard Braun SSA would materialize sp as a
@@ -1400,9 +2873,10 @@ export function lift(
   // (`isStackPtr`) and PPC (`r1`).
   //
   // sp is never WRITTEN either — but by `writeData` declining, NOT because sp-dest ops are inert.
-  // That was this file's premise until the frame-adjust whitelist landed, and it was wrong: five
-  // decode arms wrote sp and dropped it silently. The single transparent shape is `sp = sp ± imm`,
-  // whitelisted in the add/sub arms. Read and write are now guarded symmetrically.
+  // Five decode arms (`lsl`/`neg`/`mvn` with an sp destination, `ldr sp`, `ldmia` with sp in the
+  // list) reach a write with no arm-local sp check of their own, so the guard has to sit on the
+  // write itself. The single transparent shape is `sp = sp ± imm`, whitelisted in the add/sub arms.
+  // Read and write are guarded symmetrically.
   const readData = (r: string, b: number): Value => {
     if (isSpReg(r)) {
       throw spAsDataError();
@@ -1422,154 +2896,6 @@ export function lift(
     return readVar(r, b);
   };
 
-  // A virtual register key per incoming stack argument. Reading it goes through the ordinary Braun
-  // live-in path (frontend/ssa.ts), which turns a read with no reaching def into a function
-  // parameter — so this needs NO new representation, opcode or pass. The `@` cannot appear in a
-  // real register token, so the key cannot collide with one.
-  const stackArgKey = (index: number) => `@sarg${index}`;
-  // Defined beside its mint site on purpose: the format string and its parser drifted 650 lines
-  // apart in the first version, with the convention explained only at one end.
-  const stackArgIndex = (key: string): number | null => {
-    const m = /^@sarg(\d+)$/.exec(key);
-    return m ? +m[1] : null;
-  };
-
-  // INCOMING STACK ARGUMENTS (AAPCS). Args 1-4 arrive in r0-r3; args 5+ are pushed by the CALLER,
-  // so the callee reads them at `[sp, #N]` where N is at or above its own frame. Those are
-  // PARAMETERS, not locals — declining them as "sp used as data" refuses a calling convention.
-  //
-  // The frame depth is tracked by a linear walk of the ENTRY BLOCK only, which is
-  // why the gate is what it is: within one straight-line block the depth at each instruction is
-  // exact and needs no CFG reasoning. Every case that would need more declines.
-  //
-  // `push {a,b,c}` deepens by 4 per register; `sub sp, #N` and `add sp, sp, #-N` deepen by N.
-  //
-  // The walk, its two invariants and the predicate that reads them are ONE object on purpose. They
-  // were three loose pieces — a delta function, a pair of `let`s updated in the instruction loop,
-  // and a seven-parameter predicate taking the pair by value — and both bugs the second review pass
-  // found lived in the seams: an invariant the predicate's proof needed but only the loop could
-  // enforce, and a `0` returned for an unrecognised shape that only a guard in a third place made
-  // safe. Anything that changes how sp moves now has one place to change, and the proof it has to
-  // preserve is written next to the state it is about.
-  const makeFrameWalk = () => {
-    // Bytes the frame has grown since function entry, along this block's linear order only.
-    let depth = 0;
-    let depthKnown = true;
-
-    // Returns null whenever the depth cannot be computed exactly — including for any write to sp
-    // this does not model. The capability rests on the depth being EXACT, so an approximation is
-    // never acceptable: understate the frame and a local sits above the computed top and gets
-    // minted as a parameter reading uninitialised stack. A null poisons the depth for the rest of
-    // the block, which disables argument recovery and leaves every `[sp,#N]` to decline as before.
-    // Nothing here may return a NUMBER for a shape it merely failed to recognise.
-    const delta = (ins: { mnemonic: string; ops: string[] }): number | null => {
-      const m = ins.mnemonic;
-      if (m === 'push' || m === 'pop') {
-        // expandRegList, NOT a comma count: `push {r4-r7, lr}` is FIVE registers, and counting it as
-        // two makes the frame 12 bytes too shallow — which turns a genuine LOCAL into a fabricated
-        // parameter reading uninitialised stack. Caught by a probe, not by the corpus: agbcc emits no
-        // range pushes and 0 of the 743 benchmark rows contain one, but GNU as accepts them and the
-        // disassembly path can produce them.
-        // Counting comma tokens instead would undercount `{r4-lr}` as two registers, and an
-        // unexpandable range must poison the depth rather than be guessed at — definiteRegList owns
-        // both rules, and owns them for the ldm/stm arm too.
-        const list = definiteRegList(
-          ins.ops
-            .join(',')
-            .replace(/[{}]/g, '')
-            .split(',')
-            .map((r) => r.trim())
-            .filter(Boolean),
-        );
-        if (list === null) {
-          return null;
-        }
-        return (m === 'push' ? 1 : -1) * 4 * list.length;
-      }
-      if ((m === 'add' || m === 'sub') && isSpReg(ins.ops[0])) {
-        const off = ins.ops[2] ?? ins.ops[1];
-        if (off?.startsWith('#')) {
-          const v = imm(off);
-          return m === 'sub' ? v : -v;
-        }
-      }
-      // Any OTHER write to sp poisons the depth. This used to fall through to 0 — "no change" — for
-      // shapes it does not model (`add sp, r4`, `mov sp, rN`, `add sp, r0, #4`), which was safe only
-      // because writeData declines every one of them elsewhere. That is the same
-      // enumeration-of-arms mistake writeData itself exists to end, exported one function away: a
-      // number meaning "no change" is the wrong answer to "I do not understand this". Now the walk is
-      // self-sufficient — unknown ⇒ depth poisoned ⇒ decline — and writeData's refusal is an
-      // independent second guarantee instead of a load-bearing one.
-      if (isSpReg(ins.ops[0])) {
-        return null;
-      }
-      return 0;
-    };
-
-    return {
-      // Advance the walk over one instruction. Call for EVERY instruction, in order.
-      step(ins: { mnemonic: string; ops: string[] }): void {
-        const d = delta(ins);
-        if (d === null) {
-          depthKnown = false;
-        } else {
-          depth += d;
-        }
-        // sp ABOVE the incoming sp poisons the walk for the rest of the block, permanently — the
-        // premise argIndex's proof rests on. See the proof there for what it costs to omit.
-        if (depth < 0) {
-          depthKnown = false;
-        }
-      },
-
-      // Is `[sp, #off]` an incoming stack argument, and which one? `null` means NO — and every null is
-      // a DECLINE, because the caller falls through to readData's sp guard.
-      //
-      // Why a slot at or above the frame top cannot have been written by this function, which is the
-      // whole soundness argument: every sp-relative STORE declines (readData, via the str arm), and a
-      // `push` only ever writes strictly BELOW the current top. An argument slot is at or above the
-      // incoming sp, so no instruction here can have defined it — the value can only be the caller's.
-      //
-      // That second step needs sp to have stayed at or below where it came in — `depth >= 0` at every
-      // point of the walk — or a `push` reaches back up over the argument area and the conclusion is
-      // false:
-      //
-      //     add sp, sp, #8      ; sp = S+8
-      //     push {r4, r5, r6}   ; sp = S-4, and this WROTE r5 to S+0
-      //     ldr  r0, [sp, #4]   ; = S+0 — r5's slot, not the caller's argument
-      //
-      // The depth is back to a plausible +4 by the load, so nothing downstream can tell: it emitted
-      // `s32 f(s32 a0, …, s32 a4) { return a4; }`, the function's own incoming r5 handed back as
-      // argument 5. `pop {r4}; push {r4,r5}` gets there without an `add sp` at all, and a sliced
-      // fragment whose prologue was cut off is exactly this shape — which is the corpus this frontend
-      // reads. `step` enforces it, and never un-poisons: once sp has been above the line, a push during
-      // the excursion may have written the later slots too. This is a PREMISE, not a detail — leaving
-      // it unstated is what let the first version hand back a callee-saved register as an argument.
-      argIndex(addr: { base: string; off: number; regOff?: string }, width: number, bi: number): number | null {
-        const { base, off, regOff } = addr;
-        if (!isSpReg(base) || regOff !== undefined) {
-          return null; // not sp, or `[sp, rX]` — not a fixed argument slot
-        }
-        if (bi !== 0 || preds[0].length > 0) {
-          return null; // depth is exact only along the ENTRY block's linear order, and only when its
-          // params are parameters rather than phis
-        }
-        if (!depthKnown || depth <= 0) {
-          return null; // an unmeasurable frame, or none established: a headerless FRAGMENT whose
-          // prologue was sliced off looks identical to a frameless function, and there the slots are
-          // locals — minting one would be the silent-wrong trade this frontend refuses
-        }
-        if (width !== 4 || off < depth || (off - depth) % 4 !== 0) {
-          return null; // the argument area is word-granular; BELOW the top is a local, which is the
-          // separate slot-promotion capability
-        }
-        const index = target.argRegs.length + (off - depth) / 4;
-        return index < MAX_RECOVERED_ARITY ? index : null; // a wild offset must not mint a
-        // 400-parameter signature
-      },
-    };
-  };
-
   // LOCAL STACK SLOTS. A spill or a local that never has its address taken is transparent to
   // dataflow: `str rX,[sp,#k]` … `ldr rY,[sp,#k]` moves a value, it does not touch memory anyone
   // else can see. Modelling it as an SSA variable keyed by the offset (the same `sp@<off>` spelling
@@ -1580,29 +2906,76 @@ export function lift(
   // the same value at every access, and MIPS gets that for free (IDO establishes sp with one
   // `addiu` and never moves it). Thumb's `push` moves sp, so constancy has to be PROVEN here.
   const slotKey = stackSlotKey; // shared spelling: frontend/ssa.ts
-  // Deliberately OVER-inclusive: a `cmp sp, rN` only reads sp but counts here too. Every false
-  // positive costs a decline, every false negative costs a wrong slot — so it errs loudly.
-  const modifiesSp = (ins: Instr): boolean =>
-    ins.mnemonic === 'push' || ins.mnemonic === 'pop' || isSpReg((ins.ops[0] ?? '').replace(/!$/, ''));
-  // A `mov rD, sp` CAPTURES the frame address; the captured value means "the frame base" only if
-  // sp still holds that base wherever the value is used — so a capture participates in the
-  // constancy proof exactly like a literal [sp,#k] access, and ends the prologue for localArea.
-  const capturesSp = (ins: Instr): boolean =>
-    /^movs?$/.test(ins.mnemonic) && !isSpReg(ins.ops[0] ?? '') && isSpReg(ins.ops[1] ?? '');
-  const touchesFrame = (ins: Instr): boolean => spMemAccess(ins) !== null || capturesSp(ins);
-  const spMemAccess = (ins: Instr): { off: number; width: number; regOff: boolean } | null => {
-    if (!/^(ldr|ldrb|ldrh|ldrsb|ldrsh|str|strb|strh)$/.test(ins.mnemonic)) {
-      return null;
-    }
-    const mem = ins.ops[1];
-    if (mem === undefined) {
-      return null;
+
+  // THE FRAME BASE PASSED TO A CALLEE. What this computes is exactly what its name says and nothing
+  // more: somewhere in entry-reachable code a bare `mov rD, sp` copies the frame base into a
+  // register that is still an ARGUMENT register at a `bl`. It is a fact about a REGISTER, not about
+  // the frame's layout — an earlier cut of this treated it as proof that "[sp,#0] is an addressable
+  // local", and agbcc falsified that outright. The layout question is settled by the gate this
+  // feeds (`capturedObjectIsTheWholeFrame`, below `localArea`), not here.
+  //
+  // ENTRY-REACHABLE, BLOCK-LOCAL AND KILL-ON-MENTION, because this feeds an ACCEPTANCE and so may
+  // never over-approximate. Unreachable blocks are skipped for the same reason (a)'s reload scan
+  // skips them — an instruction that never executes is not a fact about the frame, and one appended
+  // `mov r0, sp; bl use` after the return was enough to license a whole function. A block is
+  // straight-line, so a capture that is still held when the `bl` is decoded is held on every
+  // execution that reaches it; and a register is dropped the moment ANY other instruction so much
+  // as MENTIONS it, since a write cannot happen without the token appearing. That over-kills (a
+  // `cmp` on the register between the capture and the call ends it) and over-killing only costs a
+  // decline. ARGUMENT registers only: the frame base merely live across a call is not evidence that
+  // it was passed to one, and for `blx rN` the TARGET register is not an argument either.
+  const frameBasePassedToCallee = ((): boolean => {
+    for (const b of entryReachable) {
+      const ab = asmBlocks[b];
+      const held = new Set<string>();
+      for (const ins of ab.instrs) {
+        if (ins.mnemonic === 'bl' || ins.mnemonic === 'blx') {
+          // `blx rN` names its TARGET in the operand slot, so exclude it: `mov r3, sp; blx r3`
+          // branches THROUGH the frame base, it does not pass it.
+          const targetReg = ins.mnemonic === 'blx' ? reg(ins.ops[0] ?? '') : null;
+          if ([...held].some((r) => target.argRegs.includes(r) && r !== targetReg)) {
+            return true;
+          }
+          held.clear(); // the callee clobbers the argument registers
+          continue;
+        }
+        // The two shapes that can carry the base forward: the capture itself, and a bare register
+        // copy of a value already held. Everything else only kills.
+        const carried = capturesSp(ins)
+          ? reg(ins.ops[0] ?? '')
+          : /^movs?$/.test(ins.mnemonic) && held.has(reg(ins.ops[1] ?? ''))
+            ? reg(ins.ops[0] ?? '')
+            : null;
+        // The OPERAND TOKENS, not the mnemonic: `asWritten` carries only the normalised mnemonic,
+        // so the operands are the only place a written register can appear — and they are
+        // RANGE-EXPANDED first, because a range spells none of the registers it writes. `pop
+        // {r0-r3}` writes r2 with the string `r2` nowhere in the instruction, so the bare `\bR\b`
+        // test let a dead capture survive the `pop` that destroyed it, the acceptance fired on a
+        // frame that really did stage an outgoing argument, and the lift dropped all five of that
+        // call's arguments. Two spellings of one instruction must not give two verdicts, and CASE
+        // is a third spelling of the same one — `expandRegList` is lowercase-only, so `{R0-R3}`
+        // leaked through the expansion exactly as the range leaked through the regex.
+        const mentions = expandRegList(
+          ins.ops
+            .join(' ')
+            .toLowerCase()
+            .replace(/[[\]{}!#]/g, ' ')
+            .split(/[,\s]+/)
+            .filter(Boolean),
+        );
+        for (const r of [...held]) {
+          if (mentions.includes(r) || ins.ops.some((o) => new RegExp(`\\b${r}\\b`, 'i').test(o))) {
+            held.delete(r);
+          }
+        }
+        if (carried !== null) {
+          held.add(carried);
+        }
+      }
     }
-    const { base, off, regOff } = parseAddr(mem);
-    return isSpReg(base)
-      ? { off, width: /b$/.test(ins.mnemonic) ? 1 : /h$/.test(ins.mnemonic) ? 2 : 4, regOff: regOff !== undefined }
-      : null;
-  };
+    return false;
+  })();
+
   // Is the word-slot model safe for THIS function? Every disqualifier below leaves every `[sp,#k]`
   // access on the old path, which declines — so the answer to "not sure" is the loud one.
   // Returns null when the word-slot model is SAFE for this function, else the reason it is off —
@@ -1699,7 +3072,9 @@ export function lift(
     //
     // Measured, this costs nothing it was buying: forcing the old acceptance path off changed 0
     // lift/decline verdicts across 2686 corpus functions (sa3's vendored map carries no signatures
-    // at all), so the path that carried those holes was never load-bearing.
+    // at all), so the path that carried those holes was never load-bearing. That sweep was run over
+    // the sa3/klonoa CHECKOUTS, which this repo does not vendor — it is not the benchmark's 404
+    // agbcc rows, and it has not been re-run since it was taken.
     for (const ab of asmBlocks) {
       for (const ins of ab.instrs) {
         if (ins.mnemonic !== 'bl' && ins.mnemonic !== 'blx') {
@@ -1725,6 +3100,18 @@ export function lift(
     // tail-merged call site breaks, and agbcc DOES tail-merge: `Task_BonusFlower_Spawn` (sa3
     // bonus_game_enemies) stores argument 5 in both predecessors with the `bl` in the join.
     //
+    // A SECOND THING NOW DEPENDS ON THIS DECLINE, and it is not in this file. `SlotHomes`
+    // (ir/core.ts) reads a `[sp,#k]` spill as a DECLARATION RANK and `l3/slotorder.ts` orders the
+    // declaration list by it. The partition that admits an offset is `LiveInModel.declaredLocals`,
+    // which this frontend sets to `[0, localArea)` — a range that CONTAINS the outgoing area. The
+    // only thing keeping an argument slot from becoming a declaration rank is that this decline
+    // removes such functions from the population first. So lifting or narrowing this guard is not
+    // a local change: it must come with a narrowed `declaredLocals`, or the ordering starts
+    // ranking argument positions with no diagnostic. The class is populated — of 2,001 lifted real
+    // agbcc functions, 12 carry an L1 slot home AND call, and 11 of those home offset 0. "Real
+    // agbcc functions" there means a CHECKOUT sweep this repo does not vendor, not benchmark rows
+    // (the benchmark has 126 real agbcc rows in total), and it has not been re-run since.
+    //
     // (b) is a forward may-analysis over the CFG, and it has been wrong twice in the other
     // direction. Scanning per block let a LABEL decide accept versus refuse; scanning the flat
     // listing let BLOCK ORDER decide, because a load in one arm of a branch cleared a store that
@@ -1734,28 +3121,37 @@ export function lift(
     // Only for a function that CALLS. With no call there is no outgoing area to mistake a local
     // for, and a never-reloaded store there is an ordinary dead local — which PR #30 modelled and
     // which must keep working.
-    if (asmBlocks.some((ab) => ab.instrs.some((i) => i.mnemonic === 'bl' || i.mnemonic === 'blx'))) {
+    //
+    // …and not when the WHOLE FRAME is an object whose address a callee holds
+    // (`capturedObjectIsTheWholeFrame` — a one-word frame, passed by a bare `mov rD, sp`). Both
+    // conditions hunt for an argument block; every argument block starts at [sp,#0] (that is what
+    // `prefixStored` encodes); and a one-word frame that is entirely an addressable local has no
+    // room for one. So there is no argument block to find and both conditions can only fire as
+    // FALSE ALARMS — which is what they did: the three address-taken rows in the synthetic tier
+    // declined at (a) on a store that is never reloaded for the ordinary reason, that the CALLEE
+    // reads it through the pointer.
+    //
+    // This is the only acceptance in this function, so keep straight what licenses it. NOT arity: a
+    // callee declared with four arguments proves nothing (see above), and the layout gate is
+    // deliberately independent of the declarations. The arity refusal still runs FIRST and still
+    // wins — in a one-word frame a declared fifth argument and an addressable local at offset 0 are
+    // contradictory claims about the same word, so the honest answer there is the decline, not a
+    // guess about which one to believe.
+    if (
+      !capturedObjectIsTheWholeFrame &&
+      asmBlocks.some((ab) => ab.instrs.some((i) => i.mnemonic === 'bl' || i.mnemonic === 'blx'))
+    ) {
       const slotAcc = (ins: Instr) => {
         const a = spMemAccess(ins);
-        return a && !a.regOff && a.width === 4 && a.off % 4 === 0 && a.off >= 0 && a.off < localArea ? a.off : null;
+        return a && !a.regOff && a.width === 4 && a.off % 4 === 0 && a.off >= 0 && a.off + 4 <= localArea
+          ? a.off
+          : null;
       };
       const isStore = (ins: Instr) => /^str/.test(ins.mnemonic);
       // Entry-REACHABLE blocks only: a reload in dead code is not evidence that live code reads the
       // slot back, and counting it lets an argument store satisfy (a) on the strength of an
       // instruction that never executes.
-      const live = new Set<number>([0]);
-      for (let changed = true; changed;) {
-        changed = false;
-        for (let b = 0; b < asmBlocks.length; b++) {
-          if (live.has(b)) {
-            continue;
-          }
-          if (preds[b].some((q) => live.has(q))) {
-            live.add(b);
-            changed = true;
-          }
-        }
-      }
+      const live = entryReachable;
       const reloaded = new Set<number>();
       for (const b of live) {
         for (const ins of asmBlocks[b].instrs) {
@@ -1877,30 +3273,20 @@ export function lift(
     }
     return null;
   };
-  // The frame the body sees: the entry block's PROLOGUE, i.e. everything up to the first
-  // instruction that touches the frame (or the whole block if it never does). Stepped through the
-  // same walk `argIndex` uses, so "what does this do to sp" has one implementation. A frame the
-  // walk cannot measure yields 0, which disables every slot (`off < localArea` is then false).
-  // How much sp moves for `add/sub sp, #imm`, positive = sp RISES (frame shrinks). null if not that
-  // shape. Only used to recognise a release; the authoritative depth arithmetic is makeFrameWalk's.
-  const spAdjust = (ins: Instr): number | null => {
-    if (!/^(add|sub)$/.test(ins.mnemonic) || !isSpReg(ins.ops[0])) {
-      return null;
-    }
-    const o = ins.ops[2] ?? ins.ops[1];
-    if (o === undefined || !o.startsWith('#')) {
-      return null;
-    }
-    const v = imm(o);
-    return ins.mnemonic === 'sub' ? -v : v;
-  };
-  // The EXPLICITLY reserved local area — the prologue's `add sp,sp,#-N`. A slot must live strictly
-  // inside this, not merely inside the whole frame: the rest of the frame is the callee-saved block
-  // the entry `push` wrote, which belongs to the epilogue's `pop`, so a `str` there is retargeted
-  // away from the memory the pop will read.
+  // THE EXPLICITLY RESERVED LOCAL AREA — the prologue's `add sp,sp,#-N`, and the frame the body
+  // sees. "Prologue" is everything before the entry block first touches the frame (or the whole
+  // block if it never does). A frame this cannot measure yields 0, which disables every slot
+  // (`off + 4 <= localArea` is then false).
+  //
+  // A slot must live strictly inside this, not merely inside the whole frame: the rest of the frame
+  // is the callee-saved block the entry `push` wrote, which belongs to the epilogue's `pop`, so a
+  // `str` there is retargeted away from the memory the pop will read. Which is also why this is NOT
+  // the walk `argIndex` uses — `makeFrameWalk`'s `delta` counts a `push` at 4 bytes per register and
+  // this skips it, because the callee-saved block sits ABOVE the local area. The cost of that
+  // difference is the push/pop arm below.
   const localArea = ((): number => {
     // The PROLOGUE only — everything before the entry block first touches the frame. Summing the
-    // whole block instead let a store made BEFORE the reservation fall inside `off < localArea`, so
+    // whole block instead let a store made BEFORE the reservation fall inside the window, so
     // `str r0,[sp]; add sp,sp,#-4; …` claimed a write to the CALLER's frame as a private local and
     // deleted it.
     //
@@ -1911,35 +3297,230 @@ export function lift(
     // store and rendered a computed `bx` as an ordinary return, and it fooled the pop gate too
     // (`released` is compared against this number). Not corpus-reachable — 0 of 2805 Thumb
     // functions adjust sp upward before their first frame access — which is exactly why only a
-    // probe finds it.
+    // probe finds it. That 2805 is a CHECKOUT sweep this repo does not vendor, not a benchmark
+    // count, and it has not been re-run since.
     //
     // An sp write this cannot read poisons the whole thing to 0, disabling every slot, rather than
-    // being skipped as if it were no movement: the same rule spDelta follows.
+    // being skipped as if it were no movement: the same rule `makeFrameWalk`'s `delta` follows.
     const ins = asmBlocks[0].instrs;
     const firstMem = ins.findIndex((x) => touchesFrame(x));
     let reserved = 0;
+    let reservedYet = false;
     for (const x of ins.slice(0, firstMem === -1 ? ins.length : firstMem)) {
       const d = spAdjust(x);
       if (d !== null) {
         reserved -= d; // d > 0 = sp rises = the frame shrinks
-      } else if (x.mnemonic !== 'push' && x.mnemonic !== 'pop' && isSpReg((x.ops[0] ?? '').replace(/!$/, ''))) {
+        reservedYet ||= reserved > 0;
+      } else if (x.mnemonic === 'push' || x.mnemonic === 'pop') {
+        // BEFORE any reservation this is the callee-saved block, measured from below — the
+        // ordinary agbcc prologue, and why push/pop are skipped at all. AFTER one it slides sp
+        // under the window just measured, so `[0, localArea)` stops naming the reserved area and
+        // starts naming the pushed words. Those words ARE written, by an instruction that is
+        // dataflow-transparent, so nothing downstream can tell:
+        // `push {r4,lr}; add sp,#-8; push {r0}; … ldr r1,[sp]` reads back the pushed `r0` on every
+        // path and the def-less shape renders it as an uninitialised local — 0 from the machine,
+        // garbage from the C. Poisoned to 0 rather than corrected by subtracting the push bytes,
+        // the same rule the sp-write arm follows. Not corpus-reachable — agbcc pushes before it
+        // reserves in all 2343 Thumb functions of the same un-vendored CHECKOUT sweep as the 2805
+        // above, not re-run since — which is why only a probe finds it.
+        if (reservedYet) {
+          return 0;
+        }
+      } else if (isSpReg((x.ops[0] ?? '').replace(/!$/, ''))) {
         return 0; // an sp write of a shape this does not model
       }
     }
     return Math.max(0, reserved);
   })();
 
+  // WHAT THE PROLOGUE SAVED — the second half of the register partition (frontend/ssa.ts,
+  // LiveInModel.uninitRegs), in operand spellings. "The ABI does not pass arguments here" is a fact
+  // about the CALLER and cannot on its own make a def-less read an uninitialised local; what does is
+  // that the compiler homed a local in the register, which it may only do after saving it. Asm that
+  // saves nothing follows no such convention, and some of it really is handed live values there:
+  // the MP2K engine's hand-written `ChnVolSetAsm`, vendored in klonoa, sa3 and pokeemerald alike,
+  // takes two pointers in r4/r5 and has no prologue at all — classified by the ABI alone it lost its
+  // signature and stored through reads of registers nothing ever wrote.
+  //
+  // PER REGISTER, because saving r5 says nothing about r4 — a mid-function fragment reached by
+  // agbcc's `bl`-as-a-long-branch saves what it uses and is handed the rest.
+  //
+  // The prologue is the LEADING run of saves and reservations, so a `push` in the body cannot join
+  // the set. `HIGH_REGS` have no `push` encoding, so agbcc saves them as `mov rLow, rHi; push
+  // {rLow}` and the source of such a `mov` joins the set when its low register is pushed — every
+  // high-register inhabitant in the corpus goes through that idiom.
+  const savedRegs = ((): ReadonlySet<string> => {
+    const saved = new Set<string>();
+    const carries = new Map<string, string>(); // low register ← the high one moved into it
+    for (const x of asmBlocks[0].instrs) {
+      if (x.mnemonic === 'push') {
+        const list = regListOf(x.ops);
+        if (list === null) {
+          break; // a list this cannot read is a save set this cannot vouch for
+        }
+        for (const r of list) {
+          saved.add(r);
+          const hi = carries.get(r);
+          if (hi !== undefined) {
+            saved.add(hi);
+          }
+        }
+      } else if (/^movs?$/.test(x.mnemonic) && HIGH_REGS.has(x.ops[1] ?? '') && !HIGH_REGS.has(x.ops[0] ?? '')) {
+        carries.set(x.ops[0], x.ops[1]);
+      } else if (spAdjust(x) === null) {
+        break;
+      }
+    }
+    return saved;
+  })();
+
+  // …AND THE FRAME IS THAT OBJECT. `frameBasePassedToCallee` is a fact about a register; this is
+  // the layout fact, and it is the one that licenses turning the outgoing-argument refusals off.
+  //
+  // The reason it is needed at all: a bare `mov rD, sp` names frame offset 0, but agbcc emits one
+  // for TWO different things, and only one of them is an addressable local. The other is a
+  // BLOCK-COPY BASE — the destination of a by-value struct argument (which IS the outgoing argument
+  // area) and the hidden return pointer of a struct-returning call. Both compiled, agbcc
+  // 2.9-arm-000512, `-O2 -mthumb-interwork -Wimplicit -fhex-asm -fprologue-bugfix`:
+  //
+  //   by-value struct argument, `void f(struct S *p){ take(*p); }`, by stack words beyond r0-r3:
+  //     1 word  → `ldr r0,[r3,#0x10]; str r0,[sp]`  — no capture at all, frame 4
+  //     2 words → `mov r1, sp; ldmia r0!,{…}; stmia r1!,{…}` — frame 8
+  //     13+     → `mov r0, sp; mov r2,#0x44; bl memcpy` — frame 0x44 and up
+  //   struct return, `void f(int x){ struct R r = mk(x); use2(r.a[0]); }`:
+  //     1 word, INTEGER-LIKE (`{int a;}`, `{int a[1];}`, `{float f;}`) → r0, no frame temp
+  //     1 word, otherwise (`{char a,b,c,d;}`, `{short a,b;}`) → `mov r0, sp; bl mk` — frame 4
+  //     2 words → `mov r0, sp; bl mk` — frame 8
+  //
+  // Left unguarded that cost an argument: `void g3(struct Huge *p, int x){ takesH(*p);
+  // five(1,2,3,4,x); }` puts `str r5,[sp]` — argument 5 of `five` — in a frame whose offset 0 the
+  // memcpy also names, and the lift emitted `five(1, 2, 3, 4)` with the fifth argument written into
+  // a fabricated 4-byte local, in a frame declared 4 bytes where the machine reserves 0x90. Order
+  // is not the discriminator either: with the five-argument call FIRST the same thing happens.
+  //
+  // So the gate is the MODEL'S OWN EXTENT. This frontend models the captured object as the single
+  // word at [sp,#0] (`isFrameObjectAccess` below), and a one-word model is a description of the
+  // frame only when the frame IS that word. `localArea === 4` says exactly that. It excludes every
+  // block-copy base — each needs two frame words before agbcc names its base with a register at
+  // all — and the two-word struct returns with them. Any larger frame has bytes this model does not
+  // describe, and they are either the rest of a wider object the callee writes or another call's
+  // argument slots; neither is provable here, so the answer stays the decline.
+  //
+  // What the frame size does NOT exclude is the one-word struct return in the table above, which is
+  // instruction-for-instruction an out-parameter call. That one is settled after the lift, by the
+  // premise re-check in the frame-object audit — which is also where the licence's other half is
+  // re-proven.
+  //
+  // WHAT THIS GATE IS NOT. It switches the outgoing-argument refusals off, and nothing else. The
+  // object model runs on ANY frame — the `laddrs` path in the audit below — so a `u8 buf[12]`
+  // handed to a callee arrives there through a frame this conjunct never looks at, and what bounds
+  // its extent is the audit's frame-accounting rule rather than anything here.
+  //
+  // WHY IT IS NOT WIDENED anyway, since a wider frame is the obvious next lever. Three shapes,
+  // each compiled with agbcc 2.9-arm-000512, `-O2 -mthumb-interwork -Wimplicit -fhex-asm
+  // -fprologue-bugfix`, and only the first is about extent at all:
+  //
+  // UNDECIDABLE — a slot THIS FUNCTION stores and reloads. Two sources that disagree about who
+  // owns [sp,#4] compile to one instruction stream, byte for byte, with eight values live across
+  // the calls so one of them spills:
+  //
+  //   s32 loc; s32 t0..t7;                   loc = x;  t0 = h(0); … g(&loc); k(loc + t0 + …);
+  //   struct P { s32 a, b; } p; s32 t1..t7;  p.a = x;  p.b = h(0); … g(&p);   k(p.a + p.b + …);
+  //
+  // The first says a callee may not touch [sp,#4]; the second says it may, and the reload after the
+  // call must read what it wrote. Nothing distinguishes them, so a licence over THAT slot would be
+  // a guess — which is why the slot rule in the audit refuses the shape rather than deciding it.
+  //
+  // PINNED, and refused by the MODEL — sub-word members. Thumb has no sp-relative `strb`, so a
+  // byte or halfword member is reached through a copy of sp, and the access at +4 witnesses that
+  // the object reaches past its first word: `struct Q { u8 a; u8 pad[3]; u8 b; }` filled and then
+  // handed over compiles to `mov r1, sp / strb r0, [r1] / strb r0, [r1, #0x4] / mov r0, sp / bl g`.
+  // The escape is a use that is not an access, so the capture cannot be split per offset, and the
+  // audit judges the [+4] access against the one object it does model — "only a scalar at the
+  // captured address is modelled", and the SAME message when this conjunct is widened to
+  // `localArea >= 4` (measured).
+  //
+  // PINNED, and ambiguous in its ROLE — a frame-covering block copy. `struct Big { s32 a[17]; };
+  // b = gK; g(&b);` compiles to `add sp,#-0x44 / mov r0,sp / mov r2,#0x44 / bl memcpy`: the copy
+  // bounds the object from below and the reservation from above, so the extent is exact. What is
+  // NOT pinned is what the object IS — the producer table above records those same instructions
+  // for a by-value struct ARGUMENT block and for a struct-return temp. Widening this conjunct
+  // moves it exactly there: it then declines at "which is how a hidden struct-return pointer
+  // looks" (measured), never at anything about extent.
+  //
+  // So a wider frame licence admits nothing this model can describe. `extent` is one scalar width
+  // from one access, and the second access that would build a wider object is a `[+k]` the audit
+  // refuses first: widened, the sub-word shape declines on the very same message and the
+  // block-copy one moves onto the struct-return refusal (both measured).
+  //
+  // RESIDUE: the producer table is agbcc's, so hand-written asm that reserves one word, stages it
+  // as a call's fifth argument and ALSO puts sp in an argument register defeats this — the same
+  // producer assumption the contiguity filter below makes. The producer is named in the gate
+  // rather than left to the prose: `armv4t` has one compiler entry today, and a second one free to
+  // overlay a dead one-word local with a one-word outgoing area would inherit an acceptance whose
+  // only evidence is an agbcc compile table.
+  //
+  // WHICH CONJUNCT REFUSES WHAT, for a reader arriving with a wide frame in hand. klonoa's
+  // `LoadBGTilemapData` (a checkout function, not a benchmark row) reserves 0x3C and fails the
+  // OTHER conjunct: its `mov r5, sp` is the DMA-fill PUBLISH (`strh r7, [r5]` / `mov r0, sp` /
+  // `str r0, [r2]`, r2 = 0x040000D4), not a base live in an argument register at a `bl`.
+  // Instrumented, it arrives with localArea=60 and frameBasePassedToCallee=false, lifts today with
+  // the object modelled as `volatile u16 sp0`, and its lift is byte-identical with this conjunct
+  // widened to `localArea >= 4` (measured). No answer to the frame size moves it.
+  const capturedObjectIsTheWholeFrame = target.compiler === 'agbcc' && frameBasePassedToCallee && localArea === 4;
+
   const slotsOffReason = slotModelBlocker();
   const slotsOk = slotsOffReason === null;
   // Every offset the body actually keys as an SSA slot — the frame-object audit checks the
   // address-taken object cannot overlap one (two models for one byte is a silent disagreement).
   const usedSlotOffsets = new Set<number>();
 
-  // The WRITE dual of readData, and the reason it exists is a lesson rather than a symmetry: the
-  // first version of this guard checked sp in three decode arms (mov/add/sub) and its commit message
-  // claimed "every write to sp declines". It did not — `lsl sp, r4, #2`, `neg sp, r4`, `mvn sp, r4`,
-  // `ldr sp, [r0,#4]` and `ldmia r0!, {sp}` all still lifted, dropping the sp write silently, because
-  // an enumeration of arms can only cover the arms someone thought of. Guarding the write ITSELF
+  // …AND THE ONE OFFSET THAT MUST NOT BE A SLOT. When `capturedObjectIsTheWholeFrame` holds, the
+  // frame is one word and a callee is being handed its address, so an `[sp,#0]` access is an access
+  // to THAT OBJECT — provisionally, since the audit is what proves the object is a local at all. Keying it as an SSA slot instead moves the value into a
+  // register and deletes the store from memory — and the callee reading it through the pointer is
+  // invisible to every check the slot model makes, so the deletion would be silent.
+  //
+  // The frame-object audit does catch the collision today ("one byte, two models"), as a DECLINE.
+  // Routing the access through an `laddr` here is what turns that decline into the lift, and it
+  // hands the audit the same object it would have judged anyway — offset, width and escape all
+  // come from the machine.
+  //
+  // Word accesses only, and only while the slot model is on: a sub-word or register-offset
+  // `[sp,#k]` anywhere turns the whole model off (slotModelBlocker), and the `mov rD, sp` arm then
+  // declines the capture rather than reaching this.
+  const isFrameObjectAccess = (base: string, off: number, regOff: string | undefined, width: number): boolean =>
+    slotsOk && capturedObjectIsTheWholeFrame && isSpReg(base) && regOff === undefined && off === 0 && width === 4;
+
+  // A WHOLE WORD OF THIS FUNCTION'S OWN RESERVED LOCAL AREA — the shape the ldr and str arms model
+  // as an SSA slot (`sp@<off>`) instead of memory. The two arms spelled these seven terms out
+  // twice — the ldr arm with the reaching-def test as an eighth — which is one edit away from
+  // disagreeing about which bytes are private.
+  //
+  // Each term is a refusal:
+  //   * `slotsOk`      — the frame must be proven private and immovable (slotModelBlocker)
+  //   * sp base, no register index — `[sp, rX]` names no fixed slot
+  //   * word width, word-aligned, non-negative — the model keys whole aligned words and nothing else
+  //   * `off + 4 <= localArea` — strictly inside the EXPLICITLY reserved area. Not merely inside the
+  //     frame: above it sits the callee-saved block the epilogue pops, and above THAT the incoming
+  //     argument area, so a slot straying up there would either fight the `pop` or claim the
+  //     caller's word.
+  //
+  // What is NOT here, deliberately: the load side's reaching-def test. That one is impure (it asks
+  // the SSA builder) and one-sided — a store needs no reaching def — so it stays at the ldr arm.
+  const isOwnFrameWordSlot = (base: string, off: number, regOff: string | undefined, width: number): boolean =>
+    slotsOk &&
+    isSpReg(base) &&
+    regOff === undefined &&
+    width === 4 &&
+    off % 4 === 0 &&
+    off >= 0 &&
+    off + 4 <= localArea;
+
+  // The WRITE dual of readData, and it guards the WRITE rather than the arms that perform one,
+  // because an enumeration of arms can only cover the arms someone thought of. Checking sp in the
+  // mov/add/sub arms alone leaves `lsl sp, r4, #2`, `neg sp, r4`, `mvn sp, r4`, `ldr sp, [r0,#4]`
+  // and `ldmia r0!, {sp}` lifting, each dropping the sp write silently. Guarding the write ITSELF
   // cannot be incomplete.
   //
   // sp is writable in exactly one shape — the frame adjust the add/sub arms `break` on before
@@ -1963,15 +3544,17 @@ export function lift(
     const irb = irBlocks[bi];
     let pendingCmp: { lhs: Value; rhs: Value } | null = null;
     // Tracks the frame through this block's linear instruction order. Meaningful for the entry
-    // block; elsewhere a `[sp,#N]` access declines.
-    const frame = makeFrameWalk();
+    // block; elsewhere a `[sp,#N]` access declines. Both dependencies are read HERE rather than
+    // closed over: `preds` is final long before the first `fillBlock` runs, so the boolean is the
+    // same for every block, and passing it in makes that a property of this line instead of a
+    // property of wherever the walk happens to be declared.
+    const frame = makeFrameWalk({ argRegs: target.argRegs, entryHasPreds: preds[0].length > 0 });
 
     // TRUSTWORTHINESS GUARD (mirrors the MIPS/PPC frontends): an unmodelled instruction must not
     // silently drop its destination register — emit an honest `opaque`, which fails LOUD at
     // assertResolved whether or not anything reads that register (see frontend/opaque.ts). Push/pop and sp
     // adjustments have no low-register data destination, so they fall through harmlessly;
     // terminators are handled in the terminator section below.
-    const isThumbReg = (s: string | undefined): s is string => /^r\d+$/.test(s ?? '');
     const emitOpaqueDest = (ins: { mnemonic: string; ops: string[]; asWritten?: string }) => {
       // storeClass: unmodelled Thumb stores are str*/stm* — `stmia rN!, {…}`'s dest token `r0!`
       // fails isReg, so without this it would be skipped as "no reg dest", silently deleting the
@@ -2007,13 +3590,14 @@ export function lift(
       // destination here is by construction NOT that shape (`add sp, r4`: a register-sized frame
       // adjustment, how agbcc spells a frame too large for the 7-bit immediate).
       //
-      // Honesty about what this is worth: the 4 real `add sp, rN` sites in the sa3 checkout all sit
-      // in functions that ALSO do `mov rN, sp` 70+ times, so they declined before this guard and
-      // decline after it. No wrong C was ever emitted by this shape. The guard is defence in depth
-      // for the day a stack capability makes those functions liftable — not a miscompile fixed.
+      // This IS the site that declines `add sp, r4` today — traced 2026-09-06, the throw comes from
+      // here, not from `writeData` and not from an arm. The add/sub arms let only the whitelisted
+      // `sp = sp ± imm` break out, so everything else with an sp destination and no third operand
+      // arrives here.
       //
-      // This looked dead during review and is not: it becomes reachable the moment the arm-local
-      // guards are removed, which is exactly what the test at 'add sp, r4' pins.
+      // Honesty about what that is worth on real input: the 4 `add sp, rN` sites in the sa3
+      // checkout all sit in functions that ALSO do `mov rN, sp` 70+ times, so they declined before
+      // this guard existed and decline after it. No wrong C was ever emitted by this shape.
       if (isSpReg(dReg)) {
         throw spAsDataError();
       }
@@ -2086,11 +3670,19 @@ export function lift(
             break;
           }
           // `add rD, rS, #0` is agbcc's low-register copy idiom (Thumb `mov rD, rS` between
-          // low regs isn't always available). Model it as a pure copy — same SSA value — not
-          // an `x + 0` add. This keeps output clean and, crucially, makes a value copied to a
-          // callee-saved register before a call read as still-live *after* the call, which is
-          // how call-argument liveness tells a passed argument from a preserved one.
-          if (c === '#0') {
+          // low regs isn't always available). Model it as a pure copy — the SAME SSA VALUE — not
+          // an `x + 0` add. Value identity is what it buys: the pattern engine matches on it
+          // (`{same:'X'}`), and the structurer's pre-update loop test compares a back-edge argument
+          // against an exit argument by identity, so an `x + 0` between them reads as a different
+          // value and declines a loop that is perfectly ordinary.
+          //
+          // NOT call-argument liveness, which this comment claimed for several releases: both arms
+          // end in `writeData(reg(a), …)`, and the arity machinery (`fallbackArgc`,
+          // `trimClobberedCallArgs`) is keyed on the register, never on the value — measured, zero
+          // arity changes across 3337 corpus functions even with this idiom ablated entirely. That
+          // 3337 is a CHECKOUT sweep this repo does not vendor, not a benchmark count, and it has
+          // not been re-run since.
+          if (immEq(c, 0)) {
             writeData(reg(a), bi, readData(reg(b), bi));
             break;
           }
@@ -2163,7 +3755,7 @@ export function lift(
           // Reverse subtract. `rsb rD, rS, #0` is the negate idiom (0 - rS) → -x. Any other form
           // (`rsb rD, rS, #N`, N≠0 — not a Thumb-1 encoding, but be safe) is NOT modelled: degrade
           // to a loud `opaque` rather than silently leaving rD unwritten (a silent miscompile).
-          if (c === '#0') {
+          if (immEq(c, 0)) {
             const res = mkValue(T.unk(32));
             irb.ops.push(mkOp('neg', { operands: [readData(reg(b), bi)], results: [res] }));
             writeData(reg(a), bi, res);
@@ -2242,15 +3834,7 @@ export function lift(
           // e.g. `r4-lr`), a token naming no register, an empty list — leaves the transfer set
           // ambiguous, so degrade to the loud opaque rather than guess. Checking only for the
           // leftover `-` let `{foo}` through and fabricated a parameter out of it.
-          const list = definiteRegList(
-            ins.ops
-              .slice(1)
-              .join(',')
-              .replace(/[{}]/g, '')
-              .split(',')
-              .map((r) => r.trim())
-              .filter(Boolean),
-          );
+          const list = regListOf(ins.ops.slice(1));
           if (list === null) {
             emitOpaqueDest(ins);
             break;
@@ -2288,7 +3872,15 @@ export function lift(
             if (ins.mnemonic === 'ldmia') {
               const res = mkValue(T.unk(32));
               irb.ops.push(
-                mkOp('load', { operands: [base0], results: [res], attrs: { off: 4 * i, signed: true, width: 4 } }),
+                // `listOrder: true` — this load's stream position is the LIST position, not the
+                // order the source evaluated it (structure.ts's def-order re-spelling must not
+                // trust it; the aload rebuilds in raise/arrays.ts and raise/struct-arrays.ts
+                // must carry it forward)
+                mkOp('load', {
+                  operands: [base0],
+                  results: [res],
+                  attrs: { off: 4 * i, signed: true, width: 4, listOrder: true },
+                }),
               );
               writeData(reg(r), bi, res);
             } else {
@@ -2451,15 +4043,9 @@ export function lift(
           // the same address arithmetic the encoding performs. (parseAddr used to silently
           // read `[rB]`, dropping the index — a silent miscompile; ldrsh exists ONLY in this
           // form in Thumb-1, so every ldrsh went through here.)
-          // An incoming stack argument, read before its base becomes an sp decline. Every
-          // condition below is a refusal that keeps a LOCAL from being mistaken for a parameter:
-          //   • entry block only        — the depth is exact only along this block's linear order
-          //   • entry has no preds      — otherwise its params are phis, not parameters
-          //   • no register offset      — `[sp, rX]` is not a fixed argument slot
-          //   • word width, word-aligned — the argument area is word-granular
-          //   • off >= the frame depth — BELOW the frame top is a local/spill: still declines,
-          //                               that is the separate slot-promotion capability
-          //   • a sane arity bound      — a wild offset must not mint a 400-parameter signature
+          // An incoming stack argument, read before its base becomes an sp decline. Every refusal
+          // `argIndex` can make, and the soundness proof that each one is needed for, lives on the
+          // predicate itself — restating them here is how the two copies drifted.
           {
             const index = frame.argIndex({ base, off, regOff }, width, bi);
             if (index !== null) {
@@ -2489,6 +4075,18 @@ export function lift(
               break;
             }
           }
+          // The address-taken object at offset 0 comes FIRST: it is memory, not a slot, so it is
+          // read with a real `load` through its `laddr` (see isFrameObjectAccess). No
+          // reaching-def test — the callee holding the address is a writer this function cannot
+          // see, so "never stored here" is not "holds nothing".
+          if (isFrameObjectAccess(base, off, regOff, width)) {
+            const addr = mkValue(T.unk(32));
+            irb.ops.push(mkOp('laddr', { results: [addr], attrs: { off: 0 } }));
+            const res = mkValue(T.unk(32));
+            irb.ops.push(mkOp('load', { operands: [addr], results: [res], attrs: { off: 0, width, signed } }));
+            writeData(reg(a), bi, res);
+            break;
+          }
           // A word reload from this function's own frame — the dual of the spill in the str arm.
           //
           // The reaching-def test is the whole soundness of it, and it mirrors the MIPS guard
@@ -2498,16 +4096,7 @@ export function lift(
           // above; INSIDE the frame it is an uninitialised local (or one whose address escaped
           // through a path the model missed), and the honest answer is the decline this falls
           // through to.
-          if (
-            slotsOk &&
-            isSpReg(base) &&
-            regOff === undefined &&
-            width === 4 &&
-            off % 4 === 0 &&
-            off >= 0 &&
-            off < localArea &&
-            ssa.hasReachingDef(slotKey(off), bi)
-          ) {
+          if (isOwnFrameWordSlot(base, off, regOff, width) && ssa.hasReachingDef(slotKey(off), bi)) {
             usedSlotOffsets.add(off);
             writeData(reg(a), bi, readVar(slotKey(off), bi));
             break;
@@ -2534,22 +4123,17 @@ export function lift(
           const width = /b/.test(ins.mnemonic) ? 1 : /h/.test(ins.mnemonic) ? 2 : 4;
           const { base, off, regOff } = parseAddr(b);
           // A word spill into this function's own frame: record the slot's value in SSA rather than
-          // emitting a store through sp. `slotsOk` has already proven the frame is private and does
-          // not move; `off < localArea` keeps this strictly inside the EXPLICITLY reserved local
-          // area — not merely inside the frame, whose upper part is the callee-saved block the
-          // epilogue pops — so it can never
-          // collide with the incoming-argument area above it (which the load path recovers as
-          // parameters, and where a STORE is still a decline — writing a caller's slot is a
-          // different capability). A spill that is never reloaded becomes a dead def and drops.
-          if (
-            slotsOk &&
-            isSpReg(base) &&
-            regOff === undefined &&
-            width === 4 &&
-            off % 4 === 0 &&
-            off >= 0 &&
-            off < localArea
-          ) {
+          // emitting a store through sp (which bytes qualify: see isOwnFrameWordSlot). A spill that
+          // is never reloaded becomes a dead def and drops.
+          // …unless offset 0 is the address-taken object (see isFrameObjectAccess), where the
+          // store is a real write to memory that the callee holding the address reads back.
+          if (isFrameObjectAccess(base, off, regOff, width)) {
+            const addr = mkValue(T.unk(32));
+            irb.ops.push(mkOp('laddr', { results: [addr], attrs: { off: 0 } }));
+            irb.ops.push(mkOp('store', { operands: [addr, readData(reg(a), bi)], attrs: { off: 0, width } }));
+            break;
+          }
+          if (isOwnFrameWordSlot(base, off, regOff, width)) {
             usedSlotOffsets.add(off);
             writeVar(slotKey(off), bi, readData(reg(a), bi));
             break;
@@ -2585,10 +4169,10 @@ export function lift(
           // known whether every path to here passes through another call, which would have clobbered
           // the argument registers this guess just read.
           if (declared === undefined) {
-            ssa.recordGuessedCall(callOp, bi, target.argRegs);
+            ssa.recordGuessedCall(callOp, bi, target);
           }
-          ssa.noteCall(bi); // the callee clobbers r0..r3 …
-          writeData('r0', bi, res); // … and then defines r0, which IS fresh for the next call
+          writeData('r0', bi, res); // the callee defines r0 …
+          ssa.noteCall(bi); // … and the clobber is recorded after it, so that def is the CALLEE's
           break;
         }
         default:
@@ -2665,121 +4249,18 @@ export function lift(
 
   ssa.finish();
 
-  // FRAME-OBJECT AUDIT. Every `laddr` the mov arm emitted is only a CLAIM that the captured
-  // address is used as "the address of one scalar local"; this proves it, over the finished
-  // function, the same boundary-total style as the slot-escape assert in finish(). The address may
-  // flow anywhere as a VALUE — into an MMIO register (the DMA-fill idiom), a call, a phi — but
-  // every MEMORY access through it must be at offset 0 with one agreed width, and any use the
-  // audit cannot vouch for declines the whole function loudly. Nothing here guesses: the object's
-  // declared type is exactly the access type the machine used.
-  {
-    const laddrs: Op[] = [];
-    for (const blk of irBlocks) {
-      for (const op of blk.ops) {
-        if (op.opcode === 'laddr') {
-          laddrs.push(op);
-        }
-      }
-    }
-    if (laddrs.length > 0) {
-      const fail = (why: string): never => {
-        throw new FrontendUnsupportedError(`cannot lift '${name}': address-taken stack local — ${why}`);
-      };
-      // Taint = values that may hold the object's address, closed over phis: a tainted edge arg
-      // taints the receiving block param. (A phi mixing the address with a non-address would taint
-      // the param and then fail the use judgement below — mixing is not vouched for.)
-      for (const op of laddrs) {
-        if ((op.attrs.off as number) !== 0) {
-          // the audit's offset arithmetic, overlap window and naming all assume the frame base;
-          // if a computed capture ever mints off!==0, this line is what keeps it loud
-          fail(`a capture at frame offset ${op.attrs.off} — only the frame base is modelled`);
-        }
-      }
-      const taint = new Set<Value>(laddrs.flatMap((o) => o.results));
-      for (let changed = true; changed;) {
-        changed = false;
-        for (const blk of irBlocks) {
-          for (const op of blk.ops) {
-            for (const s of op.successors ?? []) {
-              s.args.forEach((arg, i) => {
-                const param = s.block.params[i];
-                if (taint.has(arg) && param !== undefined && !taint.has(param)) {
-                  taint.add(param);
-                  changed = true;
-                }
-              });
-            }
-          }
-        }
-      }
-      // Judge every use of a tainted value.
-      const accesses: { width: number; signed: boolean }[] = [];
-      let escapes = false;
-      for (const blk of irBlocks) {
-        for (const op of blk.ops) {
-          op.operands.forEach((v, idx) => {
-            if (!taint.has(v)) {
-              return;
-            }
-            if (op.opcode === 'load' && idx === 0) {
-              if ((op.attrs.off as number) !== 0) {
-                fail(
-                  `a load at [+${op.attrs.off}] through the captured address — only the scalar at offset 0 is modelled`,
-                );
-              }
-              accesses.push({ width: op.attrs.width as number, signed: (op.attrs.signed as boolean) ?? false });
-              return;
-            }
-            if (op.opcode === 'store' && idx === 0) {
-              if ((op.attrs.off as number) !== 0) {
-                fail(
-                  `a store at [+${op.attrs.off}] through the captured address — only the scalar at offset 0 is modelled`,
-                );
-              }
-              accesses.push({ width: op.attrs.width as number, signed: false });
-              return;
-            }
-            if ((op.opcode === 'store' && idx === 1) || op.opcode === 'call') {
-              escapes = true; // the address ESCAPES as a value — the point of the capability
-              return;
-            }
-            fail(`the captured address flows into \`${op.opcode}\` — not an access, an escape, or a phi`);
-          });
-        }
-      }
-      if (accesses.length === 0) {
-        // nothing in-function pins the object's type, and a guessed declaration is the
-        // plausible-but-wrong class — decline until an inhabitant needs this
-        fail('the captured address is never dereferenced in this function, so nothing pins the local object type');
-      }
-      const widths = new Set(accesses.map((a) => a.width));
-      if (widths.size > 1) {
-        fail(`the accesses through the captured address disagree on width (${[...widths].join(' vs ')})`);
-      }
-      const width = accesses[0].width;
-      const signed = accesses.some((a) => a.signed);
-      if (width > localArea) {
-        fail('the object extends past the reserved local area');
-      }
-      for (const off of usedSlotOffsets) {
-        if (off < width) {
-          fail(`the object at [0,${width}) overlaps the SSA slot at [sp,#${off}] — one byte, two models`);
-        }
-      }
-      // Proven. Stamp the MACHINE FACTS the audit established — width and signedness are what the
-      // accesses used, so the declaration downstream is a fact, not a guess. The C-level NAME is
-      // deliberately NOT chosen here: identifiers live in the structurer's namespace (params,
-      // locals, globals, the symbol map), which the frontend cannot see — a frontend-chosen `sp0`
-      // silently shadowed a project global of the same name.
-      // `volatile` iff the address escapes: gcc-2.9 DELETES a store to a non-volatile local nothing
-      // in-function reads — measured, the recompiled loop loaded the value and never stored it —
-      // and the reference idiom's own spelling is `vu16 tmp` for exactly that reason. An object
-      // whose address never leaves the function needs no volatile and must not pay its codegen.
-      for (const op of laddrs) {
-        op.attrs = { ...op.attrs, width, signed, ...(escapes ? { volatile: true } : {}) };
-      }
-    }
-  }
+  // Prove every `laddr` this function emitted really does name one scalar local, or decline
+  // (auditFrameObjects).
+  auditFrameObjects({
+    name,
+    irBlocks,
+    localArea,
+    usedSlotOffsets,
+    capturedObjectIsTheWholeFrame,
+    prototypes,
+    symbols,
+    target,
+  });
 
   // Order the entry block's parameters by ABI register (r0, r1, r2, …) so downstream
   // naming (`a0`, `a1`, …) matches the calling convention, not the read order. Safe only
@@ -2797,9 +4278,11 @@ export function lift(
   // the `r8` live-in and `@sarg8` tied at 8, the sort is stable, the prologue reads r8 first — so
   // ABI argument 8 was emitted as `a9` and every parameter after it was off by one.
   //
-  // A callee-saved register read before it is written is not an argument in any case: it is a
-  // fragment artifact or an unmodelled effect, and the honest place for it is after everything the
-  // convention actually describes.
+  // The register partition (LiveInModel.uninitRegs) takes most of r4-sl before they reach here — one
+  // the ABI does not pass arguments in and this function saved is an uninitialised local, not a
+  // parameter. What still ranks 99 is `lr`/`pc`, which the partition does not list, and an r4-sl the
+  // prologue did not save. Not an argument either way, and the honest place for one is after
+  // everything the convention actually describes.
   abiSortEntryParams(entry, preds[0].length > 0, (v) => {
     const key = paramReg.get(v) ?? '';
     // an incoming STACK argument ranks by its ABI index, after every register argument
@@ -2815,3 +4298,10 @@ export function lift(
 
 /** The ARMv4T / Thumb (agbcc) frontend, registered for the `armv4t` target. */
 export const thumbFrontend: Frontend = { id: 'thumb', inputFormat: 'gnu-as', lift };
+
+/** Internal surface for this module's own tests, and for nothing else. `@asmlift/core` exports
+ *  every source path under `./*`, so a plain `export` here would put the pad table, the pad
+ *  predicate and the witness serialisation into the package's public API — three things no
+ *  consumer should be able to depend on, exported only so a cross-check test could reach them.
+ *  The name says what it is; nothing in `src` reads it. */
+export const __testing = { PAD_ENCODINGS, isPadInstr, factKey, sayFact };