@asmlift/core 0.8.0 → 0.9.0

package/src/frontend/ssa.ts

@@ -23,19 +23,46 @@ import {
   type SlotHomes,
   Value,
   type WriteOrder,
+  callArgs,
   defOpMap,
   mkOp,
   mkValue,
+  terminator,
+  truncateCallArgs,
 } from '../ir/core';
 import { pruneDeadParams, simplifyTrivialPhis } from '../ir/simplify';
-import { T } from '../ir/types';
-import { FrontendUnsupportedError } from './errors';
+import { type IrType, T } from '../ir/types';
+import { type FrontendRefusal, FrontendUnsupportedError } from './errors';
 
 export interface SsaBuilder {
   fn: Fn;
   irBlocks: Block[];
   /** Current SSA value of `reg` on entry to block `b` (creating phis/params as needed). */
   readVar(reg: string, b: number): Value;
+  /** Read `reg` as an argument register of a call whose arity was GUESSED — otherwise identical to
+   *  {@link readVar}, and used INSTEAD of it so the read carries no claim.
+   *
+   *  `fallbackArgc` counts argument registers by reaching definition, so a read here is a QUESTION
+   *  ("did the caller set this up?") rather than an assertion, and {@link trimClobberedCallArgs} is
+   *  what answers it. That answer already covers a register a call destroyed, and it covers it
+   *  EXHAUSTIVELY: destroyed on any path means not written-since-the-call on that path, so the
+   *  must-analysis drops it from the run and the operand goes — bar an argument register the ABI
+   *  ALIASES onto the return register, which a call that writes its result there does not list as
+   *  destroyed; one that writes none there does, and the trim reads that too. So none of these
+   *  reads can leave a destroyed value in the graph, and refusing the function over one would cost
+   *  a row the trim has already made correct.
+   *
+   *  THAT ALIASING IS A PER-TARGET FACT AND TWO TARGETS HERE DO NOT HAVE IT. ARM and PowerPC both
+   *  pass argument 0 in the return register (r0/r0, r3/r3), so on them the exemption is the whole
+   *  of the gap. MIPS returns in `v0` and passes in `a0`, so `clobberedByCall` lists `a0` for both
+   *  MIPS targets and there is no exemption to reason about — which is the sound direction, not a
+   *  hole.
+   *
+   *  A DECLARED arity uses `readVar`, and must: there the callee says the argument exists, so
+   *  reading a destroyed register for it is a wrong value with nothing to retract it.
+   *
+   *  One of the three call verbs `CallDeclarations.lower` owns ({@link noteCall}). */
+  readGuessedArg(reg: string, b: number): Value;
   /** Record that `reg` now holds `v` within block `b`. */
   writeVar(reg: string, b: number, v: Value): void;
   /** Mark block `b` fully emitted (terminator pushed); seals any now-ready successors. */
@@ -63,15 +90,47 @@ export interface SsaBuilder {
    *  "a def reaches here" and "a value reaches here" are the same question only when every def is
    *  a value. */
   hasReachingDef(reg: string, b: number, accept?: (v: Value) => boolean): boolean;
+  /** {@link hasReachingDef}, with a path ending where a call destroyed `reg` (`noteCall`): whether a
+   *  value this function named reaches it here on some path. A path that brings the destroyed bytes
+   *  and one that brings a value still answer yes, and the read that follows refuses at `finish`. */
+  holdsValue(reg: string, b: number, accept?: (v: Value) => boolean): boolean;
+  /** The entry parameter `reg` still holds at this point of block `b`, taken WITHOUT a read. A read
+   *  leaves a definition behind, and `hasReachingDef` counts it as argument setup, so a frontend that
+   *  only moves the argument somewhere (a frame store) would raise the guessed arity of every later
+   *  prototype-less call. `undefined` where "still the entry value" is not shown: a definition or a
+   *  call reaches from some path, or a block on the way is not filled yet. */
+  entryValue(reg: string, b: number): Value | undefined;
+  /** Whether `reg` still holds its entry value at this point of block `b`, in {@link entryValue}'s
+   *  sense, answered without the entry parameter that one hands back. A callee-saved register stored
+   *  to its save slot holds the caller's value, which is no parameter, so asking must not mint one. */
+  holdsEntryValue(reg: string, b: number): boolean;
   /** Record that block `b` makes a call HERE: the ABI's caller-saved registers stop being ones the
-   *  caller set up. Call it AFTER `recordGuessedCall` for the same instruction, and after writing
-   *  the call's own result — the result is the CALLEE's, so it must not count as caller-side
-   *  argument setup for whatever call comes next. */
-  noteCall(b: number): void;
+   *  caller set up.
+   *
+   *  THE CALL VERBS ARE `CallDeclarations.lower`'s (frontend/call-plan.ts): a frontend lowers a
+   *  call through it, and it alone calls this, {@link recordGuessedCall} and {@link readGuessedArg},
+   *  in one order — `recordGuessedCall`, then the call's own result, then this. The result is the
+   *  CALLEE's, so it must not count as caller-side argument setup for whatever call comes next.
+   *
+   *  `clobbers` are the registers the callee DESTROYS and leaves holding nothing this function can
+   *  name — {@link clobberedByCall} spells it, and it is the ABI's caller-saved set minus the
+   *  return register precisely because of the ordering above: the callee's own result is already
+   *  written there, so that one register does have a name. A callee that hands a STRUCT back in
+   *  that register writes no value a caller may read as a word, so none is written and the
+   *  register is listed here too. Required rather than optional: a call lowered without it would
+   *  keep resolving a destroyed register to its pre-call value, silently. */
+  noteCall(b: number, clobbers: readonly string[]): void;
   /** Register a `call` op whose arity was GUESSED (no prototype), so `finish` can cut it back to the
    *  argument registers that were actually set up on every path (see {@link trimClobberedCallArgs}).
-   *  `abi` is the target's argument-register order and its return register. */
-  recordGuessedCall(op: Op, b: number, abi: { argRegs: string[]; returnReg: string }): void;
+   *  `abi` is the target's argument-register order and its return register. It snapshots what the
+   *  caller wrote, so it comes before the call's result is written ({@link noteCall}).
+   *  `passesCalleeResult`: see {@link GuessedCallSite}. */
+  recordGuessedCall(
+    op: Op,
+    b: number,
+    abi: { argRegs: string[]; returnReg: string },
+    passesCalleeResult?: (result: Value) => boolean,
+  ): void;
   /** Remove trivial phis and enforce the frontend's postconditions; call once every block is
    *  filled. Throws FrontendUnsupportedError if a stack slot escaped as an entry parameter. */
   finish(): void;
@@ -95,7 +154,7 @@ export interface LiveInModel {
    *
    *  Asserts more than ownership: that this function's own stores are the ONLY writer. An address
    *  into the frame that escapes to anything which could write it stops that holding, and the
-   *  retraction is the frontend's obligation (frontend/thumb.ts, after the frame-object audit). */
+   *  retraction is the frontend's obligation (the frame-object audit, frontend/frame-objects.ts). */
   ownedLocals?: { from: number; to: number };
   /** Storage this function DECLARES as locals ⇒ a `[sp,#k]` spill here is a DECLARATION RANK
    *  (`ir/core.ts` `SlotHomes`, ordered by `l3/slotorder.ts`). `[from, to)`.
@@ -194,15 +253,56 @@ function checkedLiveInModel(fnName: string, m: LiveInModel): LiveInModel {
   return m;
 }
 
+/** A read whose register may be holding a callee's leftover — see `refuseStaleCallerSavedReads`. */
+interface StaleRead {
+  reg: string;
+  value: Value;
+  block: number;
+  /** the block's op count when the read happened. The uses this read answers for start here: an op
+   *  before it consumed a value read while the register was still this function's own, and the same
+   *  register really can be read on both sides of a call without its value changing. */
+  fromOp: number;
+  /** a call in this very block destroyed it, so the predecessors have nothing to add. */
+  local: boolean;
+}
+
+/** The registers a call leaves holding nothing the CALLER can name — what {@link SsaBuilder.noteCall}
+ *  wants. The ABI's caller-saved set minus the return register: `CallDeclarations.lower` writes the
+ *  callee's own result there before recording the clobber, so that one register does have a name
+ *  and the rest do not.
+ *
+ *  CHECKED rather than trusted, the way `checkedLiveInModel` checks the register partition: a
+ *  register the caller passes arguments in is by construction one the callee may destroy, so
+ *  `argRegs` must be a subset of `callerSaved`. A target spelling one of them differently in the two
+ *  lists would silently stop refusing reads of it. */
+export function clobberedByCall(target: {
+  callerSaved: readonly string[];
+  argRegs: readonly string[];
+  returnReg: string;
+}): readonly string[] {
+  const missing = target.argRegs.filter((r) => !target.callerSaved.includes(r));
+  if (missing.length > 0) {
+    throw new Error(
+      `this target passes arguments in ${missing.join(', ')} but does not list ${missing.length > 1 ? 'them' : 'it'} ` +
+        `as caller-saved, so a read of one past a call cannot be refused`,
+    );
+  }
+  return target.callerSaved.filter((r) => r !== target.returnReg);
+}
+
 export function makeSsaBuilder(
   name: string,
   blockCount: number,
   preds: number[][],
-  /** A supplier because half the partition is MEASURED rather than declared: Thumb's local area
-   *  comes from a prologue walk that runs after this call. Evaluated once, on first use. Omitted ⇒
+  /** Evaluated once, at its first use, which is where `checkedLiveInModel` checks it. Omitted ⇒
    *  no partition is claimed, so every slot refuses and every register is a parameter. */
   liveInOf: () => LiveInModel = () => ({}),
+  /** The type of a value that stands for `key` before any instruction defines it — a parameter, a
+   *  phi. A register FILE, not a register: the FPU's keys are floats wherever they arrive, and every
+   *  other key is `unknown` for type recovery to settle. */
+  keyType: (key: string) => IrType | undefined = () => undefined,
 ): SsaBuilder {
+  const unset = (key: string): IrType => keyType(key) ?? T.unk(32);
   let modelMemo: LiveInModel | null = null;
   // Checked ONCE, where the model is materialised — every function with a parameter reads a
   // register def-lessly, so this runs on effectively every lift rather than only on the rare
@@ -213,7 +313,14 @@ export function makeSsaBuilder(
   const inRange = (off: number, r?: { from: number; to: number }) => r !== undefined && off >= r.from && off < r.to;
   const irBlocks: Block[] = Array.from({ length: blockCount }, () => ({ params: [] as Value[], ops: [] }));
   // `writeOrder` and `slotHomes` are filled in below, where the builder's counters live.
-  const fn: Fn = { name, blocks: irBlocks, writeOrder: undefined, slotHomes: undefined, paramEvidence: undefined };
+  const fn: Fn = {
+    name,
+    blocks: irBlocks,
+    writeOrder: undefined,
+    slotHomes: undefined,
+    paramEvidence: undefined,
+    localObjects: undefined,
+  };
 
   const defs: Array<Map<string, Value>> = irBlocks.map(() => new Map());
   const sealed: boolean[] = irBlocks.map(() => false);
@@ -243,6 +350,25 @@ export function makeSsaBuilder(
   // wrapper, and a MISSED write under-counts an arity — which drops a real argument silently.
   const writtenSinceCall: Array<Set<string>> = irBlocks.map(() => new Set());
   const callsIn = new Set<number>();
+  // WHAT A CALL DESTROYED, which is a DIFFERENT question from the one above and not its complement.
+  // `writtenSinceCall` asks "did the CALLER set this register up" — a MUST question, whose answer
+  // for the return register is deliberately no, because `CallDeclarations.lower` writes the
+  // callee's result there before recording the clobber. This asks "does this register still hold a
+  // value anyone can name" — a MAY question, whose answer for that same register is yes. One
+  // analysis serving both would have to be wrong about one of them, so they are two, and each names
+  // the other.
+  //
+  // `clobberedLocal[b]`: destroyed by a call in `b` with nothing written since. `decidedLocal[b]`:
+  // registers `b` has settled either way, so a register in neither inherits its fate from the
+  // predecessors.
+  const clobberedLocal: Array<Set<string>> = irBlocks.map(() => new Set());
+  const decidedLocal: Array<Set<string>> = irBlocks.map(() => new Set());
+  const staleCandidates: StaleRead[] = [];
+  // `readVar` runs once per operand, so a memo per (register, verdict) keeps the record list
+  // proportional to what a block READS rather than to how many times it reads it. The value a key
+  // holds only changes at a write, and the verdict only flips at a call, so a run of identical
+  // reads collapses to the earliest — which is the one whose uses cover the rest.
+  const staleSeen: Array<Map<string, Value>> = irBlocks.map(() => new Map());
   const guessedCalls: GuessedCallSite[] = [];
   let abiSeen: { argRegs: string[]; returnReg: string } = { argRegs: [], returnReg: '' };
 
@@ -256,10 +382,11 @@ export function makeSsaBuilder(
   fn.writeOrder = writeOrder;
 
   // SLOT HOMES (ir/core.ts `SlotHomes`). Measured HERE, in the shared builder, for the same
-  // reason the clobber set and the write order are: BOTH frontends already spell a word spill as
-  // a write to the key `sp@k` (`stackSlotKey`, below), so the frontend supplies the coordinate
-  // and one rule applies it — a per-frontend stamp would be right only while each remembered to
-  // route every slot write past a wrapper, and a missed write is a local with no frame order.
+  // reason the clobber set and the write order are: every slot-modelling frontend (MIPS, Thumb,
+  // PowerPC) spells a word spill as a write to the key `sp@k` (`stackSlotKey`, below), so the
+  // frontend supplies the coordinate and one rule applies it — a per-frontend stamp would be right
+  // only while each remembered to route every slot write past a wrapper, and a missed write is a
+  // local with no frame order.
   // Empty rather than absent on a function that spills nothing: this builder measured it.
   const slotHomes: SlotHomes = new Map();
   fn.slotHomes = slotHomes;
@@ -270,7 +397,7 @@ export function makeSsaBuilder(
     }
     // THE KEY SPELLING CANNOT DECIDE THIS, exactly as `readRecursive` says below of a def-less
     // read: `sp@40` is a local on one ABI and the caller's fifth argument on another. So the stamp
-    // asks the frontend for a partition and refuses where no answer exists. The two frontends
+    // asks the frontend for a partition and refuses where no answer exists. The frontends
     // differ here and the refusal is what makes that safe: Thumb declares a range; MIPS declares NO
     // partition (frontend/mips.ts: `addiu sp,sp,±N` is transparent, so its slot keys span O32's
     // caller-owned register-parameter home area `[0,16)` and the incoming stack arguments above
@@ -306,6 +433,16 @@ export function makeSsaBuilder(
     // separately declared SCALARS; intra-aggregate offsets are fixed by the aggregate's layout at
     // expand time.
     //
+    // A FORM OF THAT RECOVERY EXISTS, and what keeps the condition unmet is two guards, this
+    // function's and one in another file. The frame-object audit declares an untyped frame object
+    // as `u8 name[N]` over the DECLARED range (`notTheWholeArea`, frontend/frame-objects.ts) and
+    // refuses it where the slot model keys any byte of that range (`overSlot`, refused by
+    // `failIfSlotKeysIt`). The slots it does share a frame with lie below `declaredLocals` — the
+    // licensed outgoing argument words — and the `declaredLocals` test above stamps none of them.
+    // So no slot home sits beside one of those arrays and nothing here is ever asked to order the
+    // two. Letting a keyed slot into the declared range beside the array is what meets the
+    // condition, and it has to bring `l3/slotorder.ts` with it.
+    //
     // UNION, not a choice (ir/core.ts `SlotHomes`): whether the earlier declaration rank is the
     // lower or the higher offset is a per-COMPILER fact, and this builder is handed a name, a
     // block count, a predecessor list and a live-in model — no target. `l3/slotorder.ts` reduces.
@@ -320,7 +457,7 @@ export function makeSsaBuilder(
   };
   // PARAMETER EVIDENCE (ir/core.ts `ParamEvidence`), measured HERE for the same reason the clobber
   // set, the write order and the slot homes are: a slot write is a `writeVar` and a slot read is a
-  // `readVar` in BOTH slot-modelling frontends, so one rule covers them and no frontend can forget
+  // `readVar` in every slot-modelling frontend, so one rule covers them and no frontend can forget
   // to route a store past a wrapper. The two directions are NOT symmetric: raise/paramwidth.ts reads
   // an absent observation as proof the declaration was wide, so a missed one costs a narrowing while
   // a spurious one retypes a parameter the machine never declared narrow.
@@ -369,16 +506,42 @@ export function makeSsaBuilder(
       firstEntryWrite.set(reg, v);
     }
     writtenSinceCall[b].add(reg);
+    clobberedLocal[b].delete(reg);
+    decidedLocal[b].add(reg);
     defs[b].set(reg, v);
     lastWriteAt[b].set(reg, writeCount[b]++);
   };
   const readVar = (reg: string, b: number): Value => {
+    const v = readAny(reg, b);
+    noteStaleCandidate(reg, b, v);
+    return v;
+  };
+  /** The lookup, with no claim attached. The FRONTEND's read is what asserts "this register holds
+   *  this value here"; the lookups this construction makes on its own — a single predecessor's
+   *  definition, a phi's operand at each in-edge — are how that one read is answered, not further
+   *  reads to be judged. Recording them would blame a use in one block on a read in another. */
+  const readAny = (reg: string, b: number): Value => {
     noteSlotTraffic(reg, null);
     return defs[b].get(reg) ?? readRecursive(reg, b);
   };
+  /** Record a read whose register MIGHT be holding a callee's leftover, for `finish` to judge. A
+   *  register this block has already settled answers here and needs no record; one it has not takes
+   *  its answer from the predecessors, which are not all filled yet. */
+  const noteStaleCandidate = (reg: string, b: number, v: Value) => {
+    const local = clobberedLocal[b].has(reg);
+    if (decidedLocal[b].has(reg) && !local) {
+      return; // this function wrote it after the last call in this block: it is its own value
+    }
+    const key = `${reg}|${local ? 1 : 0}`;
+    if (staleSeen[b].get(key) === v) {
+      return;
+    }
+    staleSeen[b].set(key, v);
+    staleCandidates.push({ reg, value: v, block: b, fromOp: irBlocks[b].ops.length, local });
+  };
 
   const newPhi = (reg: string, b: number): Value => {
-    const phi = mkValue(T.unk(32));
+    const phi = mkValue(unset(reg));
     irBlocks[b].params.push(phi);
     phiBlock.set(phi, b);
     phiKey.set(phi, reg);
@@ -389,6 +552,9 @@ export function makeSsaBuilder(
     defs[b].set(reg, phi); // set before wiring operands to break cycles
     return phi;
   };
+  // The single-predecessor blocks the current read is walking up through. A join ends the walk:
+  // its phi is in `defs` before its operands are read, so a cycle through it is already cut there.
+  let singlePredWalk = new Set<string>();
   const readRecursive = (reg: string, b: number): Value => {
     if (!sealed[b]) {
       // predecessors not all filled yet (e.g. a loop back-edge): defer operand wiring.
@@ -432,16 +598,38 @@ export function makeSsaBuilder(
         defs[b].set(reg, obliged);
         return obliged;
       }
-      const p = mkValue(T.unk(32));
+      const p = mkValue(unset(reg));
       irBlocks[b].params.push(p);
       defs[b].set(reg, p);
       paramReg.set(p, reg);
       return p;
     }
     if (ps.length === 1) {
-      const v = readVar(reg, ps[0]);
-      defs[b].set(reg, v);
-      return v;
+      // A walk up single predecessors that comes back to where it started has gone round a cycle
+      // no edge enters from outside, so no path from the entry reaches it — unless the entry is on
+      // it. agbcc leaves such a cycle behind a loop it proved never runs. No execution reads the
+      // key there, which is the uninitialised read's answer. Through the entry, the value is a
+      // live-in joined with the cycle's, which a single-predecessor block has no phi for.
+      const at = `${b}|${reg}`;
+      if (singlePredWalk.has(at)) {
+        if (singlePredWalk.has(`0|${reg}`)) {
+          throw new FrontendUnsupportedError(
+            `cannot lift '${name}': ${reg} is read in a cycle through the entry block with no join to meet at`,
+          );
+        }
+        const op = mkOp('undef', { results: [mkValue(T.unk(32))], attrs: { key: reg } });
+        irBlocks[b].ops.unshift(op);
+        defs[b].set(reg, op.results[0]);
+        return op.results[0];
+      }
+      singlePredWalk.add(at);
+      try {
+        const v = readAny(reg, ps[0]);
+        defs[b].set(reg, v);
+        return v;
+      } finally {
+        singlePredWalk.delete(at);
+      }
     }
     // sealed join: create the phi and wire every predecessor's terminator arg now.
     const phi = newPhi(reg, b);
@@ -452,8 +640,17 @@ export function makeSsaBuilder(
   // write-order record is keyed by. `phi` is passed rather than looked up: by the time a deferred
   // phi is wired the block may have written its key again, so `defs[b]` no longer names it.
   const addPhiOperands = (reg: string, b: number, phi: Value) => {
+    const walk = singlePredWalk;
+    singlePredWalk = new Set();
+    try {
+      addEachPhiOperand(reg, b, phi);
+    } finally {
+      singlePredWalk = walk;
+    }
+  };
+  const addEachPhiOperand = (reg: string, b: number, phi: Value) => {
     for (const p of distinctPreds(b)) {
-      appendSuccessorArg(p, b, readVar(reg, p));
+      appendSuccessorArg(p, b, readAny(reg, p));
       const at = lastWriteAt[p].get(reg);
       if (at !== undefined) {
         const rec = writeOrder.lastWrite.get(irBlocks[p]) ?? new Map<Value, number>();
@@ -510,14 +707,17 @@ export function makeSsaBuilder(
         return; // already a parameter, however it got there
       }
     }
-    const p = mkValue(T.unk(32));
+    const p = mkValue(unset(key));
     irBlocks[b].params.push(p);
     paramReg.set(p, key); // ranked by the ABI sort like any other parameter
     obligedParams[b].set(key, p);
   };
 
-  const hasReachingDef = (reg: string, b: number, accept: (v: Value) => boolean = () => true): boolean => {
+  const reaches = (reg: string, b: number, accept: (v: Value) => boolean, throughCalls: boolean): boolean => {
     const walk = (at: number, seen: Set<number>): boolean => {
+      if (!throughCalls && clobberedLocal[at].has(reg)) {
+        return false;
+      }
       const own = defs[at].get(reg);
       // A def `accept` rejects does not fall through to the predecessors: it is still a def, and
       // nothing older than it reaches past it.
@@ -532,28 +732,153 @@ export function makeSsaBuilder(
     };
     return walk(b, new Set<number>());
   };
+  const hasReachingDef = (reg: string, b: number, accept: (v: Value) => boolean = () => true): boolean =>
+    reaches(reg, b, accept, true);
+  const holdsValue = (reg: string, b: number, accept: (v: Value) => boolean = () => true): boolean =>
+    reaches(reg, b, accept, false);
+
+  const holdsEntryValue = (reg: string, b: number): boolean => {
+    // A predecessor is known only once filled, and `b` itself only up to here — so a path that comes
+    // back round to `b` carries writes this walk has not seen.
+    const untouched = (at: number, seen: Set<number>): boolean => {
+      if (at === b || !filled[at]) {
+        return false;
+      }
+      if (seen.has(at)) {
+        return true;
+      }
+      seen.add(at);
+      return clean(at, seen);
+    };
+    // `decidedLocal` holds a register a call destroyed as well as one this block wrote.
+    const clean = (at: number, seen: Set<number>): boolean => {
+      if (defs[at].has(reg) || decidedLocal[at].has(reg)) {
+        return false;
+      }
+      const ps = distinctPreds(at);
+      return ps.length === 0 ? at === 0 : ps.every((p) => untouched(p, seen));
+    };
+    return clean(b, new Set());
+  };
+  const entryValue = (reg: string, b: number): Value | undefined => {
+    if (!holdsEntryValue(reg, b)) {
+      return undefined;
+    }
+    ensureParam(reg, 0);
+    return irBlocks[0].params.find((p) => paramReg.get(p) === reg);
+  };
+
+  /** REFUSE a value the ABI destroyed. The builder is RIGHT that a caller-saved register has a
+   *  reaching definition after a call; what it cannot see is that the call destroyed the bytes, so
+   *  that definition names something the callee overwrote. Resolving the read to it is a silently
+   *  wrong VALUE at exit 0 — `mov r3,#0x2a; bl f; add r4,r3,#0` reading as `return 42` — which is
+   *  the one failure a frontend may not produce.
+   *
+   *  It fires on a USE rather than on the read, and after two things in `finish` that legitimately
+   *  retract one: `trimClobberedCallArgs`, which drops a read that fed a guessed call's argument
+   *  list — the sound answer for those, and not a reason to refuse the function as well — and
+   *  `pruneDeadParams`, which drops one that fed a join nothing reads. A destroyed value nothing is
+   *  left holding is a dead register, not a wrong answer.
+   *
+   *  TWO-SIDED, so both sides are stated. TOO STRICT costs a row and nothing else: a register the
+   *  compiler rematerialised in a way no `writeVar` saw reads as destroyed and the function
+   *  declines. TOO LOOSE is the wrong value, and the MAY direction below is what rules it out — a
+   *  register destroyed on ANY path into a block is destroyed there, so a join cannot launder one. */
+  /** Per block, the registers a call destroyed on SOME path into it with nothing written since:
+   *  the UNION, against `trimClobberedCallArgs`'s intersection, and for the opposite reason. That
+   *  one proves the caller set a register up, which needs every path to agree; this one proves
+   *  nobody can name it, which one path is enough for. Meaningful once every block is filled. */
+  const destroyedOnEntry = (): Array<Set<string>> => {
+    const destroyedIn: Array<Set<string>> = irBlocks.map(() => new Set());
+    const outOf = (b: number): Set<string> => {
+      const out = new Set(clobberedLocal[b]);
+      for (const r of destroyedIn[b]) {
+        if (!decidedLocal[b].has(r)) {
+          out.add(r);
+        }
+      }
+      return out;
+    };
+    for (let changed = true; changed;) {
+      changed = false;
+      for (let b = 0; b < irBlocks.length; b++) {
+        for (const p of distinctPreds(b)) {
+          for (const r of outOf(p)) {
+            if (!destroyedIn[b].has(r)) {
+              destroyedIn[b].add(r);
+              changed = true;
+            }
+          }
+        }
+      }
+    }
+    return destroyedIn;
+  };
+  const refuseStaleCallerSavedReads = () => {
+    if (staleCandidates.length === 0) {
+      return;
+    }
+    const destroyedIn = destroyedOnEntry();
+    for (const c of staleCandidates) {
+      if (!c.local && !destroyedIn[c.block].has(c.reg)) {
+        continue;
+      }
+      const ops = irBlocks[c.block].ops;
+      if (ops.slice(c.fromOp).some((op) => op.operands.includes(c.value))) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': ${c.reg} is read on a path where a call has destroyed it, so what ` +
+            `it holds is the callee's and not a value this function named — not modelled`,
+        );
+      }
+    }
+  };
+
+  const dropPhiRecord = (p: Value) => {
+    phiBlock.delete(p);
+    phiKey.delete(p);
+    forgetOrder(p);
+  };
 
   return {
     fn,
     irBlocks,
     readVar,
+    readGuessedArg: readAny, // see the interface: the trim is this read's answer, not a refusal
     writeVar,
     paramReg,
     ensureParam,
     hasReachingDef,
-    noteCall: (b: number) => {
+    holdsValue,
+    entryValue,
+    holdsEntryValue,
+    noteCall: (b: number, clobbers: readonly string[]) => {
       callsIn.add(b);
       // the callee clobbers the caller-saved registers, its own result register included — see
       // the ordering contract on the interface
       writtenSinceCall[b] = new Set();
+      for (const r of clobbers) {
+        clobberedLocal[b].add(r);
+        decidedLocal[b].add(r);
+      }
     },
-    recordGuessedCall: (op: Op, b: number, abi: { argRegs: string[]; returnReg: string }) => {
+    recordGuessedCall: (
+      op: Op,
+      b: number,
+      abi: { argRegs: string[]; returnReg: string },
+      passesCalleeResult?: (result: Value) => boolean,
+    ) => {
       abiSeen = abi;
       guessedCalls.push({
         block: b,
         op,
+        passesCalleeResult,
         freshBefore: new Set(writtenSinceCall[b]),
         afterCallInBlock: callsIn.has(b), // `noteCall` runs after this, so this means an EARLIER call
+        returnRegBefore: clobberedLocal[b].has(abi.returnReg)
+          ? 'destroyed'
+          : decidedLocal[b].has(abi.returnReg)
+            ? 'written'
+            : 'inherited',
       });
     },
     markFilled: (b: number) => {
@@ -575,31 +900,35 @@ export function makeSsaBuilder(
           }
         }
         trimClobberedCallArgs({
+          name,
           argRegs: abiSeen.argRegs,
           returnReg: abiSeen.returnReg,
           calleeResults,
+          destroyedIn: destroyedOnEntry(),
           preds,
+          blocks: irBlocks,
           freshAtEnd: writtenSinceCall,
           callsIn,
           sites: guessedCalls,
         });
       }
       irBlocks.forEach((blk, i) => writeOrder.writes.set(blk, writeCount[i]));
-      simplifyTrivialPhis(fn, (p) => {
-        phiBlock.delete(p);
-        phiKey.delete(p);
-        forgetOrder(p);
-      });
-      // Then the phis nothing reads at all — a register two paths leave holding different junk
-      // (a loop counter after its last use, a scratch the epilogue overwrites) still joins as a
-      // phi, and a dead phi is not junk downstream: its edge args become post-loop copies in the
-      // emitted C and block gates keyed on "this exit carries nothing". Order matters only for
-      // economy: trivial-phi removal can orphan a phi's last reader, never the reverse.
-      pruneDeadParams(fn, (p) => {
-        phiBlock.delete(p);
-        phiKey.delete(p);
-        forgetOrder(p);
-      });
+      // The phis nothing reads at all — a register two paths leave holding different junk (a loop
+      // counter after its last use, a scratch the epilogue overwrites) still joins as a phi, and a
+      // dead phi is not junk downstream: its edge args become post-loop copies in the emitted C and
+      // block gates keyed on "this exit carries nothing".
+      //
+      // DEAD-PHI PRUNING RUNS FIRST, and `refuseStaleCallerSavedReads` is why. That check asks
+      // whether a destroyed value still reaches a use, and a dead phi's edge arg is not one. The
+      // trivial-phi
+      // pass must not run before it for the opposite reason: that one REPLACES the phi's uses with
+      // the arg and splices the arg away, which takes the last visible use of a destroyed value out
+      // of sight. Running it twice is what keeps both true — trivial-phi removal can orphan a phi's
+      // last reader, never the reverse, so the second sweep is the one that pays for the first.
+      pruneDeadParams(fn, dropPhiRecord);
+      refuseStaleCallerSavedReads();
+      simplifyTrivialPhis(fn, dropPhiRecord);
+      pruneDeadParams(fn, dropPhiRecord);
       // SEAL THE PARAMETER EVIDENCE (ir/core.ts `ParamEvidence`). Here and not at the store or the
       // write, because `pruneDeadParams` above is the last thing that can retire an entry
       // parameter, and an observation about a value no longer in the signature is one the reader
@@ -667,21 +996,58 @@ export function makeSsaBuilder(
   };
 }
 
-// ── shared frontend tail helpers ──
+// ── a guessed call arity: counted by `CallDeclarations.lower`, trimmed by `finish` ──
 
 /** Best-effort call arity when a callee has no prototype: the count of contiguous argument
  *  registers with a value reaching the call's block. Correct when the arguments are set up in
  *  the calling block; it can under-count pass-through parameters — which is why a prototype's
- *  declared `params` is authoritative when available. */
+ *  declared `params` is authoritative when available.
+ *
+ *  `accept` says which definitions are values (`SsaBuilder.hasReachingDef`). A pending high half
+ *  is a def but not a value, and counted it raises the arity: a `lis` hoisted into the prologue
+ *  leaves its half in r4 across an intervening call and makes `strlen(s)` into
+ *  `strlen(s, <half>)`, which then refuses at the read.
+ *
+ *  `gap` MAKES A GAP REFUSE. The count is contiguous, so an argument register with nothing reaching
+ *  it ends it — and one is empty for two opposite reasons. Either the call really takes that few
+ *  arguments, or the register still holds this function's own untouched incoming argument, a value
+ *  the machine passes on that SSA has no definition for because nothing ever wrote it. When a
+ *  LATER argument register does hold a value the second reading is the only one left, and taking
+ *  the first drops that argument and every one after it: `ac-decomp:evw_anime_colreg_manual` sets
+ *  up seven registers for `evw_color_set` and, with r4 at its incoming value, lifts to
+ *  `evw_color_set(a0);` — its divide, its multiply and five arguments gone. Which reading it is
+ *  cannot be decided here — the function's own arity is exactly what is missing — so this refuses
+ *  and names the gap rather than guessing. A declaration answers it, and this scan is never
+ *  weighed against one: it is a guess, and a guess that cannot fail cannot witness a width a
+ *  declaration left open. */
 export function fallbackArgc(
-  ssa: { hasReachingDef(reg: string, b: number): boolean },
-  argRegs: string[],
+  ssa: { hasReachingDef(reg: string, b: number, accept?: (v: Value) => boolean): boolean },
+  argRegs: readonly string[],
   bi: number,
+  opts: {
+    accept?: (v: Value) => boolean;
+    /** the call's function and address, and the frontend's own refusal */
+    gap?: { name: string; at: number; fail: FrontendRefusal };
+  } = {},
 ): number {
+  // whether the caller set argument register k up: a definition reaches it, through a call too
+  const setUp = (k: number) => ssa.hasReachingDef(argRegs[k], bi, opts.accept);
   let n = 0;
-  while (n < argRegs.length && ssa.hasReachingDef(argRegs[n], bi)) {
+  while (n < argRegs.length && setUp(n)) {
     n++;
   }
+  if (opts.gap !== undefined) {
+    const { name, at, fail } = opts.gap;
+    for (let k = n + 1; k < argRegs.length; k++) {
+      if (setUp(k)) {
+        fail(
+          `cannot lift '${name}': the call at 0x${at.toString(16)} has no prototype, ${argRegs[k]} holds a ` +
+            `value and ${argRegs[n]} holds none — an argument register left at its incoming value and one ` +
+            `the call does not pass look the same here, so the argument count is not decidable`,
+        );
+      }
+    }
+  }
   return n;
 }
 
@@ -689,15 +1055,24 @@ export function fallbackArgc(
  *  of its own block up to that instruction. */
 export interface GuessedCallSite {
   block: number;
-  /** the `call` op — its operands are the guessed arguments, in argument-register order */
+  /** the `call` op — its arguments (`callArgs`) are the guessed ones, in argument-register order */
   op: Op;
   /** argument registers written between the last call in this block (or the block's start) and here */
   freshBefore: Set<string>;
   /** did this block already make a call before this one? */
   afterCallInBlock: boolean;
+  /** what this block did to the return register before this call: a call here left it holding
+   *  nothing (`destroyed`), the block wrote it since (`written`), or neither, so the predecessors
+   *  decide (`inherited`) */
+  returnRegBefore: 'destroyed' | 'written' | 'inherited';
+  /** which earlier callee's result in the return register is an argument here, not a leftover:
+   *  the site's lowering says so ({@link SsaBuilder.recordGuessedCall}). Absent where none is. */
+  passesCalleeResult?: (result: Value) => boolean;
 }
 
 export interface CallArgTrim {
+  /** the function being lifted, for a refusal */
+  name: string;
   argRegs: string[];
   /** the ABI return register. Load-bearing only where it IS `argRegs[0]` (ARM r0, PPC r3) — that
    *  aliasing is what makes a callee's result indistinguishable from caller-side argument setup. */
@@ -705,8 +1080,14 @@ export interface CallArgTrim {
   /** every value a `call` op produced. Tells a callee's own return apart from a join that merely
    *  PASSES THROUGH one, which the register file cannot: both leave argument 0 unfresh. */
   calleeResults: ReadonlySet<Value>;
+  /** per block, the registers a call destroyed on SOME path into it with nothing written since. A
+   *  call lists the return register there only when it leaves it holding nothing the caller can
+   *  name — a struct handed back in it ({@link SsaBuilder.noteCall}). */
+  destroyedIn: ReadonlyArray<ReadonlySet<string>>;
   /** one entry per CFG edge, as passed to {@link makeSsaBuilder} */
   preds: number[][];
+  /** the blocks `preds` indexes, terminators included — the edges a guard proves a value on */
+  blocks: readonly Block[];
   /** per block: the keys written since its LAST call (since its start if it makes none). Indexed by
    *  block, and it holds every key the builder saw, not only argument registers. */
   freshAtEnd: Array<Set<string>>;
@@ -736,12 +1117,13 @@ export interface CallArgTrim {
  *  real argument CAN go with them: a fresh register above a hole stops the run (a 64-bit return
  *  occupies two registers and the frontend cannot express one, so the caller's r2 goes with the
  *  unfillable r1), and a callee's return read as the callee's own drops an argument a `g(f())`
- *  source did pass. A declared prototype is what closes either.
+ *  source did pass. A declared prototype is what closes either for a named callee; a call through a
+ *  register has none, so it keeps that return instead (`GuessedCallSite.passesCalleeResult`).
  *
  *  Frontend-agnostic: the caller supplies what its own lifting scan observed, so nothing here
  *  re-derives which instruction writes which register. */
 export function trimClobberedCallArgs(inp: CallArgTrim): void {
-  const { argRegs, returnReg, calleeResults, preds, freshAtEnd, callsIn, sites } = inp;
+  const { argRegs, returnReg, calleeResults, destroyedIn, preds, blocks, freshAtEnd, callsIn, sites } = inp;
   const blockCount = freshAtEnd.length;
   const all = () => new Set(argRegs);
   const localEnd = (b: number) => freshAtEnd[b] ?? new Set<string>();
@@ -792,7 +1174,7 @@ export function trimClobberedCallArgs(inp: CallArgTrim): void {
   // (`bl __mulsf3; add r1,r4,#0; bl __addsf3` is `__addsf3(__mulsf3(a, b), c)`).
   const setsUpLater = (fresh: Set<string>): boolean => argRegs.some((r, i) => i > 0 && fresh.has(r));
   // THE RETURN REGISTER IS NOT ARGUMENT SETUP. Where the ABI aliases it onto argument 0, the
-  // frontends record a call's clobber AFTER its own result, so the result leaves the register
+  // call lowering records a call's clobber AFTER its own result, so the result leaves the register
   // UNfresh here. That disproves caller setup only where the callee's return is BOTH what the
   // register still holds and all the site has to go on: with a later register set up (above), or
   // with a value no call produced — a join of one path's return with another path's caller-computed
@@ -804,20 +1186,136 @@ export function trimClobberedCallArgs(inp: CallArgTrim): void {
   // `f` to return a value and `g` to accept one — a spelling the project's own header rejects
   // outright when it does not. A declared prototype never reaches here, and stays the way `g(f())`
   // is recovered.
-  const argcAt = (fresh: Set<string>, op: Op): number => {
-    if (argRegs[0] !== returnReg || fresh.has(argRegs[0])) {
+  //
+  // A SITE THAT PASSES THE RESULT ON keeps it (`GuessedCallSite.passesCalleeResult`).
+  //
+  // THE EXEMPTION NEEDS A RESULT IN THE REGISTER. A call that hands a struct back in it (`struct W1
+  // mkw(s32)`) writes no value there — its bytes are a struct, not a word — so the register still
+  // names what it held BEFORE that call, and neither clause above can tell: that value is no callee
+  // result, which is the join clause's sign of a real argument. Destroyed on any path is no setup on
+  // that path, so the register is an ordinary unfresh one there, and the run stops below it —
+  // unless a later register is set up, which puts argument 0 below a proven one: that argument is
+  // then the struct itself (`other(mv(a), b)`), a value no register here names, and it declines.
+  //
+  // WHETHER AN EDGE PROVES `v` CONSTANT EVERYWHERE `b` IS REACHED: up the chain of blocks with one
+  // predecessor, a conditional branch on `v == K` arriving by its true edge, or on `v != K` by its
+  // false one. K is any value arithmetic builds out of literals: agbcc compares with 1000 as
+  // `mov r1,#250; lsl r1,#2; cmp r0,r1`. `v` holds every name the value goes by: compared past a join
+  // the trivial-phi pass has yet to fold, a callee's result is that join's parameter.
+  let defs: Map<Value, Op> | undefined;
+  const defOf = (v: Value): Op | undefined => {
+    defs ??= new Map(blocks.flatMap((blk) => blk.ops.flatMap((op) => op.results.map((r) => [r, op] as const))));
+    return defs.get(v);
+  };
+  const isLiteral = (v: Value): boolean => {
+    const d = defOf(v);
+    return (
+      d?.opcode === 'const' ||
+      (d !== undefined && LITERAL_ARITHMETIC.has(d.opcode) && d.operands.length > 0 && d.operands.every(isLiteral))
+    );
+  };
+  const provenConstant = (v: ReadonlySet<Value>, b: number): boolean => {
+    for (let at = b, seen = new Set<number>(); !seen.has(at);) {
+      seen.add(at);
+      const ps = [...new Set(preds[at] ?? [])];
+      if (ps.length !== 1) {
+        return false;
+      }
+      const term = terminator(blocks[ps[0]]);
+      const arrives = term?.successors.map((e) => e.block === blocks[at]) ?? [];
+      const cmp = term?.opcode === 'cond_br' && arrives[0] !== arrives[1] ? defOf(term.operands[0]) : undefined;
+      const equalEdge = cmp?.opcode === 'icmp_eq' ? 0 : cmp?.opcode === 'icmp_ne' ? 1 : -1;
+      if (
+        equalEdge >= 0 &&
+        arrives[equalEdge] &&
+        cmp!.operands.some((o) => v.has(o)) &&
+        cmp!.operands.some((o) => !v.has(o) && isLiteral(o))
+      ) {
+        return true;
+      }
+      at = ps[0];
+    }
+    return false;
+  };
+  // THE RESULT A SITE PASSES ON is looked for through the joins the trivial-phi pass has yet to
+  // fold: this trim runs before it, so a result r0 carries untouched across a loop reaches the call
+  // as the loop header's parameter, not as the callee's own value. The site passes one where every
+  // path brings it an earlier callee's result it passes (`GuessedCallSite.passesCalleeResult`) —
+  // that value, or the join itself where the paths bring different ones (`v = x ? g() : h(); p(v);`).
+  let joinArgs: Map<Value, Value[]> | undefined;
+  const joinedInto = (v: Value): Value[] | undefined => {
+    if (joinArgs === undefined) {
+      joinArgs = new Map();
+      for (const blk of blocks) {
+        for (const op of blk.ops) {
+          for (const e of op.successors) {
+            // the entry block's parameters are the function's own, whatever a back edge brings
+            if (e.block === blocks[0]) {
+              continue;
+            }
+            e.block.params.forEach((param, i) => {
+              const into = joinArgs!.get(param);
+              if (into) {
+                into.push(e.args[i]);
+              } else {
+                joinArgs!.set(param, [e.args[i]]);
+              }
+            });
+          }
+        }
+      }
+    }
+    return joinArgs.get(v);
+  };
+  const passedResult = (s: GuessedCallSite): Value | undefined => {
+    const arg = callArgs(s.op)[0];
+    const passes = s.passesCalleeResult;
+    if (arg === undefined || passes === undefined) {
+      return undefined;
+    }
+    const results = new Set<Value>();
+    const seen = new Set<Value>();
+    for (const work = [arg]; work.length > 0;) {
+      const v = work.pop()!;
+      if (seen.has(v)) {
+        continue;
+      }
+      seen.add(v);
+      const into = joinedInto(v);
+      if (into !== undefined) {
+        work.push(...into);
+      } else if (calleeResults.has(v) && passes(v)) {
+        results.add(v);
+      } else {
+        return undefined;
+      }
+    }
+    return results.size === 0 ? undefined : results.size === 1 ? [...results][0] : arg;
+  };
+  const argcAt = (s: GuessedCallSite, fresh: Set<string>): number => {
+    const destroyed =
+      s.returnRegBefore === 'destroyed' || (s.returnRegBefore === 'inherited' && destroyedIn[s.block].has(returnReg));
+    if (argRegs[0] === returnReg && !fresh.has(argRegs[0]) && destroyed && setsUpLater(fresh)) {
+      const callee = s.op.attrs.target;
+      throw new FrontendUnsupportedError(
+        `cannot lift '${inp.name}': argument 1 of the call to ${typeof callee === 'string' ? `'${callee}'` : 'a callee'} ` +
+          `is a struct an earlier call handed back in ${returnReg}, and nothing here passes one on as an argument — not modelled`,
+      );
+    }
+    if (argRegs[0] !== returnReg || fresh.has(argRegs[0]) || destroyed) {
       return runOfFresh(fresh, 0);
     }
-    if (setsUpLater(fresh) || !calleeResults.has(op.operands[0])) {
+    const op = s.op;
+    if (setsUpLater(fresh) || !calleeResults.has(callArgs(op)[0]) || passedResult(s) !== undefined) {
       return runOfFresh(new Set([argRegs[0], ...fresh]), 0);
     }
     return 0;
   };
   for (const s of sites) {
     const fresh = s.afterCallInBlock ? s.freshBefore : new Set([...freshIn[s.block], ...s.freshBefore]);
-    const n = argcAt(fresh, s.op);
-    if (n < s.op.operands.length) {
-      s.op.operands.length = n;
+    const n = argcAt(s, fresh);
+    if (n < callArgs(s.op).length) {
+      truncateCallArgs(s.op, n);
     }
     // The SHORTER arity the same evidence also allows, recorded for {@link narrowToSetupArgs}: the
     // run over what THIS BLOCK wrote, dropping the registers that are fresh only because no call
@@ -825,20 +1323,60 @@ export function trimClobberedCallArgs(inp: CallArgTrim): void {
     // is recorded rather than applied. A survivor is what it drops, so the join clause above has no
     // place here — but `setsUpLater` still does: a register this block set up two instructions
     // before the call is not something the narrower reading may call dead.
-    const localFresh = setsUpLater(s.freshBefore) ? new Set([argRegs[0], ...s.freshBefore]) : s.freshBefore;
-    const local = Math.min(runOfFresh(localFresh, 0), s.op.operands.length);
-    if (local < s.op.operands.length) {
+    //
+    // A SITE THAT PASSES AN EARLIER CALLEE'S RESULT ON keeps it in this reading too, except where an
+    // edge proves that result equal to a constant on the way here (`if (g() == 0) p();`): a source
+    // that passed it there makes the compiler load the constant it proved (`mov r0,#0`), so an asm
+    // with no such load passed nothing. Per site, because this reading cuts every site at once, and a
+    // drop that one site needs would otherwise drop a value another site passes.
+    const result = n > 0 ? passedResult(s) : undefined;
+    const passed = result !== undefined;
+    const dropsPassed = passed && provenConstant(new Set([result, callArgs(s.op)[0]]), s.block);
+    const localFresh =
+      setsUpLater(s.freshBefore) || (passed && !dropsPassed) ? new Set([argRegs[0], ...s.freshBefore]) : s.freshBefore;
+    const local = Math.min(runOfFresh(localFresh, 0), callArgs(s.op).length);
+    if (local < callArgs(s.op).length) {
       setupArgc.set(s.op, local);
+      if (local === 0 && dropsPassed) {
+        discardsPassedResult.add(s.op);
+      }
     }
   }
 }
 
+/** The opcodes whose result is a literal when every operand is one ({@link trimClobberedCallArgs}). */
+const LITERAL_ARITHMETIC: ReadonlySet<string> = new Set([
+  'add',
+  'sub',
+  'mul',
+  'and',
+  'or',
+  'xor',
+  'shl',
+  'shr_u',
+  'shr_s',
+  'not',
+  'neg',
+]);
+
 /** The narrower arity {@link narrowToSetupArgs} would cut each guessed call to. A SIDE table and
  *  not an attr: this is a fact about one LIFT, not part of the IR the rest of the pipeline compares
  *  and prints — `structure/hazards.ts` decides two ops equal by comparing their attrs verbatim, so
  *  an attr only one of an otherwise-matching pair carries would cost a recovery. */
 const setupArgc = new WeakMap<Op, number>();
 
+/** The calls whose narrower arity drops an earlier callee's result that the site passes on
+ *  (`GuessedCallSite.passesCalleeResult`): only where an edge proves that result constant on the way
+ *  to the call ({@link trimClobberedCallArgs}). Read by {@link setupArgsDiscardsPassedResult}. */
+const discardsPassedResult = new WeakSet<Op>();
+
+/** Whether {@link narrowToSetupArgs} drops, somewhere in `fn`, an earlier callee's result that a
+ *  call through a register is passed — the fact that makes the narrowed lift's candidates lose a
+ *  score tie (`Candidate.discardsPassedResult`). */
+export function setupArgsDiscardsPassedResult(fn: Fn): boolean {
+  return fn.blocks.some((b) => b.ops.some((op) => discardsPassedResult.has(op)));
+}
+
 /** Whether anything in `fn` HAS the narrower reading — the variation's gate, so the ~99% of functions
  *  with no narrowable call cost no re-lift. Read it off the lift itself: a later pipeline stage may
  *  replace a `call` op (softdiv rewrites one to a division), and the table is keyed by op. */
@@ -864,8 +1402,8 @@ export function narrowToSetupArgs(fn: Fn): boolean {
   for (const b of fn.blocks) {
     for (const op of b.ops) {
       const setup = setupArgc.get(op);
-      if (setup !== undefined && setup < op.operands.length) {
-        op.operands.length = setup;
+      if (setup !== undefined && setup < callArgs(op).length) {
+        truncateCallArgs(op, setup);
         changed = true;
       }
     }
@@ -879,9 +1417,11 @@ export function narrowToSetupArgs(fn: Fn): boolean {
   return changed;
 }
 
-/** The stack-slot key both the MIPS and Thumb frontends use for a word-sized local in the
- *  function's own frame. Shared so the two spell it identically and the frame-partition rule can
- *  recognise either frontend's slots. See the virtual-key note in the module header. */
+// ── shared frontend tail helpers ──
+
+/** The stack-slot key the MIPS, Thumb and PowerPC frontends use for a word-sized local in the
+ *  function's own frame. Shared so they spell it identically and the frame-partition rule can
+ *  recognise any frontend's slots. See the virtual-key note in the module header. */
 const SLOT_PREFIX = 'sp@';
 export const stackSlotKey = (off: number): string => `${SLOT_PREFIX}${off}`;
 /** The byte offset a slot key names, or null if `key` is not a slot key at all (an ordinary
@@ -890,20 +1430,73 @@ export const stackSlotKey = (off: number): string => `${SLOT_PREFIX}${off}`;
 export const slotKeyOffset = (key: string): number | null =>
   key.startsWith(SLOT_PREFIX) ? Number(key.slice(SLOT_PREFIX.length)) : null;
 
-/** Order the TRUE entry block's parameters by ABI argument register, so downstream naming
- *  (`a0`, `a1`, …) matches the calling convention, not first-read order (a callee-saved copy can
- *  read a later argument register first). No-op when the entry has predecessors — a loop
- *  header's params are phis position-aligned with predecessor terminator args and must not be
- *  reordered. `rank` is per-ISA: the tie-break for a non-ABI live-in deliberately differs
- *  (Thumb sorts it LAST via 99, MIPS/PPC FIRST via indexOf's -1) to keep each frontend's
- *  output byte-exact. */
+/** Where a live-in of the entry block sits in the calling convention: `slotOf` gives its ABI
+ *  argument rank (a register or an incoming stack word), or null for a live-in no argument arrives
+ *  in — an uninitialised register the body reads; `holes` gives the keys of the argument slots the
+ *  convention proves precede the ones read (`readKeys`), whether or not the body reads them. One per
+ *  frontend, read by both halves of the entry-parameter rule: {@link mintArgSlotHoles} and
+ *  {@link abiSortEntryParams}.
+ *
+ *  `holes` is a function of everything read, not a slot-to-key table, because where two register
+ *  files share one slot sequence (MIPS o32's floats) the file a hole comes from depends on what the
+ *  function reads — `frontend/fpu.ts` `fpuArgSlots`.
+ *
+ *  Both halves need an entry block with NO predecessors, whose parameters are the function's own.
+ *  A loop header's are phis, index-aligned with its predecessors' edge arguments, and neither
+ *  minting one nor reordering them is legal there — so a frontend whose first block is a branch
+ *  target inserts an empty preheader ahead of it (each frontend's `preheader` note). */
+export interface ArgSlots {
+  slotOf(key: string): number | null;
+  holes(readKeys: readonly string[]): string[];
+}
+
+/** The slots of a convention that passes arguments in `argRegs` only: every register below the
+ *  highest one read. */
+export const registerArgSlots = (argRegs: readonly string[]): ArgSlots => ({
+  slotOf: (key) => (argRegs.includes(key) ? argRegs.indexOf(key) : null),
+  holes: (readKeys) => argRegs.slice(0, Math.max(0, ...readKeys.map((k) => argRegs.indexOf(k)))),
+});
+
+/** A rank past every argument slot, for a live-in that is not one. */
+const NOT_AN_ARGUMENT = Number.MAX_SAFE_INTEGER;
+
+/** Give the entry block a parameter for every argument slot below the highest one it takes. Naming
+ *  is POSITIONAL (`a0`, `a1`, … in {@link abiSortEntryParams} order), so a slot the body never reads
+ *  drops out of the signature and binds every later argument one slot low, silently: `int f(int a,
+ *  int b, int c) { return a + c; }` reads r3 and r5, and lifted as `f(a0, a1)` with r5 in r4's slot.
+ *  Arguments take their slots in order, registers first and then the stack words, so reading slot
+ *  k proves slots 0..k-1 precede it — an obligation on the signature, which is what `ensureParam`
+ *  is for. A live-in that is no slot proves nothing about that sequence. Call it before `finish()`,
+ *  which records evidence for every entry parameter. */
+export function mintArgSlotHoles(
+  ssa: Pick<SsaBuilder, 'irBlocks' | 'paramReg' | 'ensureParam'>,
+  entryHasPreds: boolean,
+  slots: ArgSlots,
+): void {
+  assertTrueEntry(entryHasPreds);
+  const read = ssa.irBlocks[0].params.map((p) => ssa.paramReg.get(p)).filter((k): k is string => k !== undefined);
+  for (const k of slots.holes(read)) {
+    ssa.ensureParam(k, 0);
+  }
+}
+
+/** Order the entry block's parameters by ABI argument slot, so downstream naming (`a0`, `a1`, …)
+ *  matches the calling convention, not first-read order (a callee-saved copy can read a later
+ *  argument register first). A live-in that is no slot goes after every one that is: ranked
+ *  first, it takes `a0` and binds every real argument one slot high. */
 export function abiSortEntryParams(
   entry: { params: Value[] },
   entryHasPreds: boolean,
-  rank: (v: Value) => number,
+  paramReg: ReadonlyMap<Value, string>,
+  slots: ArgSlots,
 ): void {
+  assertTrueEntry(entryHasPreds);
+  const rank = (v: Value): number => slots.slotOf(paramReg.get(v) ?? '') ?? NOT_AN_ARGUMENT;
+  entry.params.sort((x, y) => rank(x) - rank(y));
+}
+
+function assertTrueEntry(entryHasPreds: boolean): void {
   if (entryHasPreds) {
-    return;
+    throw new Error('internal: the entry-parameter rule needs an entry block with no predecessors');
   }
-  entry.params.sort((x, y) => rank(x) - rank(y));
 }