@asmlift/core 0.8.1 → 0.10.0

package/src/frontend/frame-objects.ts

@@ -0,0 +1,3171 @@
+/** THE FRAME-OBJECT AUDIT, over finished IR and the frame partition a frontend measured.
+ *
+ *  NOTHING HERE DECODES. A frontend lowers each address it can name as a frame offset to an
+ *  `laddr` (Thumb: `mov rD, sp`, `add rD, sp, #k`, a capture moved by a constant) and hands over
+ *  what only it can measure — the frame partition, as the same two ranges its `LiveInModel`
+ *  carries, the offsets its slot model keyed, the one licence it grants on the text
+ *  (`capturedObjectIsTheWholeFrame`), and the captures it moved. The rules that decide whether
+ *  those `laddr`s are objects the emitted C can declare are asked of the IR here, the same for
+ *  every ISA — the level-tower split for this frame model: the frontend supplies the PARTITION,
+ *  the shared pass applies the rule. Messages name the frame base `sp`.
+ *
+ *  Three frontends call it: Thumb; MIPS, which lowers `addiu rD,sp,k` and `addu rD,sp,rX` to an
+ *  `laddr` and hands over the O32 local area as both ranges (`frontend/mips.ts` `measureO32Frame`);
+ *  and PPC, which lowers `addi rD,r1,k` and every r1 access inside mwcc's local area the same way
+ *  (`frontend/ppc.ts` `measurePpcFrame`).
+ *  The worked examples below are agbcc's, because agbcc is the compiler every rule was first
+ *  measured against; IDO, gcc 2.7.2 and mwcc reload past every store of another type (strict
+ *  aliasing does not reorder there), so the cast and union refusals below are only more cautious on
+ *  MIPS and PPC. */
+import { linearFactor } from '../ir/bits';
+import { type Block, type Op, type Value, byValueOperands, calleeName, mkOp, mkValue, successorsOf } from '../ir/core';
+import { type IrType, T, structSpelling, typeEquals, typeToString, unionViewSigns } from '../ir/types';
+import type { Gate } from '../l3/gates';
+import { blockCopyRoles } from '../proto';
+import type { SymbolMap } from '../symbols';
+import { type TargetDescription, blockTransferRead, sourceControlRead, sourceReach } from '../target';
+import type { CallDeclarations } from './call-plan';
+import { type DevicePins, type LiteralAddresses, literalAddresses } from './device-pins';
+import { FrontendUnsupportedError } from './errors';
+import { type LiveInModel, slotKeyOffset } from './ssa';
+
+export interface FrameObjectAudit {
+  name: string;
+  irBlocks: Block[];
+  /** the frame this function owns (`LiveInModel.ownedLocals`): every local lies inside it, and
+   *  every word of it is an object, a slot, or storage nothing here describes */
+  ownedLocals: NonNullable<LiveInModel['ownedLocals']>;
+  /** where its locals are declared (`LiveInModel.declaredLocals`): `ownedLocals` less the outgoing
+   *  stack-argument block staged at its bottom, which is where an untyped object claims to start */
+  declaredLocals: NonNullable<LiveInModel['declaredLocals']>;
+  usedSlotOffsets: ReadonlySet<number>;
+  /** THE FRONTEND'S LOADED-WORD BOUND, present where the target states `outgoingAreaNeverLoadedFrom`:
+   *  `from` is that offset and `bound` the lowest frame word, in this audit's offsets, the frontend
+   *  saw the function load from `from` up, or `Infinity`. The frontend reads it ONCE off its
+   *  instructions — slot reloads, the epilogue's restores and plain loads alike, which the IR does
+   *  not all show — and its own stack-argument refusals take the same number, so one lift answers
+   *  the premise once (`storedNeverRead` adds only the loads it alone sees, through a captured
+   *  address). Absent where the target states no such offset. */
+  loadedWords?: { readonly from: number; readonly bound: number };
+  capturedObjectIsTheWholeFrame: boolean;
+  /** the frame offsets whose escape the frontend's outgoing-argument verdict leans on — each one
+   *  re-proven here (`recheckEscapesReliedOn`). Absent or empty where it leans on none. */
+  escapesReliedOn?: ReadonlySet<number>;
+  /** every capture the add arm re-minted at a constant offset from it */
+  movedCaptures: ReadonlySet<Value>;
+  /** whether a callee's declaration rules out a struct returned through a hidden pointer at
+   *  argument 0 (aggregate.ts `returnsWithoutHiddenPointer`), asked of the frontend's call
+   *  declarations */
+  returnsWithoutHiddenPointer: CallDeclarations['returnsWithoutHiddenPointer'];
+  symbols: SymbolMap | undefined;
+  target: TargetDescription;
+  /** the retraction rules an escape is judged by; `FRAME_ESCAPE_GATES` when absent, and a
+   *  census or an ablation hands in its own (`FRAME_OBJECT_AUDIT`) */
+  gates?: readonly Gate<FrameEscape>[];
+  /** the bytes a first audit asked to have kept as ONE object in memory (`FrameObjectRelift`):
+   *  the frontend routes every access inside them through an `laddr`, and the audit declares
+   *  them one object rather than judging each offset on its own */
+  oneObject?: FrameRange;
+}
+
+export interface FrameRange {
+  readonly from: number;
+  readonly to: number;
+}
+
+/** THE LOCAL AREA ABOVE A FRAME'S OUTGOING AREA, `[from, to)` in post-push stack-pointer offsets:
+ *  from where the outgoing words end (`outgoingEnd`, rounded up to `align`) to the lowest register
+ *  save at or above that, or the frame's top. The rule O32's `above-outgoing-area` compilers
+ *  (frontend/mips.ts `o32LocalArea`) and mwcc (frontend/ppc.ts, `compilerBehaviors.linkageLocalArea`)
+ *  both keep; each frontend measures the numbers it is applied to. Null where nothing is left. */
+export function areaAboveOutgoing({
+  frameSize,
+  outgoingEnd,
+  saves,
+  align,
+}: {
+  frameSize: number;
+  outgoingEnd: number;
+  saves: readonly number[];
+  align: number;
+}): FrameRange | null {
+  const from = Math.ceil(outgoingEnd / align) * align;
+  const area = { from, to: Math.min(frameSize, ...saves.filter((o) => o >= from)) };
+  return area.from < area.to ? area : null;
+}
+
+/** Whether a `width`-byte frame access at post-push offset `at` lands on a byte of `area`. A
+ *  frontend that routes accesses into the area by their post-push offset asks it of every access
+ *  made at ANOTHER depth, which that routing would misname, and draws no area where one does. */
+export const landsOnArea = (area: FrameRange, at: number, width: number): boolean =>
+  at < area.to && at + width > area.from;
+
+/** What an audit answers instead of a refusal when a device may read the frame, or a callee write
+ *  it, without bound: lift again with `oneObject` set to these bytes. */
+export interface FrameObjectRelift {
+  readonly oneObject: FrameRange;
+}
+
+/** THE RELIFT PROTOCOL, AT MOST TWICE, the one copy every frontend that runs the audit calls: lift,
+ *  and where the audit answers with bytes to keep as one object (`FrameObjectRelift`), lift once
+ *  more with them routed through an `laddr`. The second audit judges them as one object and refuses
+ *  rather than asking again, so a second request is an internal error, not a third lift. */
+export function liftWithRelift<F>(
+  name: string,
+  liftOnce: (oneObject: FrameRange | undefined) => F | FrameObjectRelift,
+): F {
+  const first = liftOnce(undefined);
+  if (!isRelift(first)) {
+    return first;
+  }
+  const again = liftOnce(first.oneObject);
+  if (isRelift(again)) {
+    throw new Error(`internal: the frame-object audit of '${name}' asked for a second relift`);
+  }
+  return again;
+}
+
+const isRelift = <F>(x: F | FrameObjectRelift): x is FrameObjectRelift =>
+  typeof x === 'object' && x !== null && 'oneObject' in x;
+
+/** What an audit answers: lift again (`FrameObjectRelift`), the device pin the accepted function
+ *  owes (`DevicePins`, applied by `pinDeviceAccesses`), or nothing, when no frame address was
+ *  taken. */
+export type FrameObjectVerdict = FrameObjectRelift | DevicePins | undefined;
+
+/** One escaped object, as the rules an escape retracts read it: what it may reach, `[lo, hi)`
+ *  from its own offset, whether it may write, and the first other object, keyed slot and
+ *  unaccounted frame word inside that reach — so a refusal names the fact its gate tested. */
+export interface FrameEscape {
+  readonly off: number;
+  readonly lo: number;
+  readonly hi: number;
+  readonly writes: boolean;
+  /** how the address left, as the refusal words it */
+  readonly how: string;
+  readonly objectReached: number | undefined;
+  readonly slotReached: { readonly slot: number; readonly above: boolean } | undefined;
+  /** the lowest frame slot inside that reach the function holds an `undef` of */
+  readonly undefReached: number | undefined;
+  /** the lowest owned word inside that reach that no object and no slot accounts for */
+  readonly unaccountedWord: number | undefined;
+}
+
+// WHAT AN ESCAPE COSTS. The audit bounds what WE access through an object, never what a callee
+// does with the address it was handed — and a callee may write any offset from it. So an escape
+// retracts four claims, each over the bytes it may reach (`readWindow`): the whole frame for a
+// writer nothing bounds. They are
+// a table (`l3/gates.ts`), taken as `FrameObjectAudit.gates` so a census or an ablation can reach
+// them; the rest of the audit — the split, the use classification, the premise re-check, the
+// shape and overlap checks — decides what the objects ARE, in the stages `auditFrameObjects` runs.
+export const FRAME_ESCAPE_GATES: readonly Gate<FrameEscape>[] = [
+  // The first is that the other ADDRESS-TAKEN objects are private, and it keys on the REACH, not
+  // on `mayWrite`. Its argument is about LAYOUT, and layout is symmetric: two objects are two
+  // separate C locals with no guaranteed adjacency, so a device that READS past the one it was
+  // given is as wrong as a callee that writes past it. `DmaCopy` with a count of two halfwords
+  // off `&sp0` transfers `[sp,#2]` too, and the emitted source transfers whatever the recompiler
+  // put after `sp0`, and the second object's own store is whatever the recompiler made of it.
+  // Marking both volatile would not repair that: the locals are still placed independently. A
+  // read the control word bounds to the object's own bytes reaches no neighbour, whatever its
+  // placement: two fixed-source DMA fills in one function, each off its own `volatile` local.
+  //
+  // It counts `laddr` objects. A neighbour SPILLED to an SSA slot is the slot rule's below.
+  {
+    id: 'reaches-another-object',
+    why: 'two locals have no guaranteed adjacency, so a reach past one lands on whatever the recompile put there',
+    sound: true,
+    guardedBy: 'thumb-frontend.test.ts: an incrementing fill reads the object above its own',
+    rejects: (e) => e.objectReached !== undefined,
+  },
+  // The second is `undef`, which rests on this function's own stores being the ONLY writer of
+  // its frame. A wider real object (`struct P p; g(&p);` where only `p.x` is read here) has its
+  // later words written by `g` and read back at a slot no store of ours reaches — declaring
+  // those uninitialised spells the callee's value as garbage. The extents here are inferred
+  // from OUR accesses, which is the number that is too small in this shape.
+  //
+  // On an escape and not on "a laddr exists": an address dereferenced only in-function cannot
+  // be written by anyone else, and the audit's overlap checks cover its aliasing.
+  //
+  // FRAME undefs only. A register-keyed one says a local lives in a register the ABI does not
+  // pass arguments in, and no address reaches a register — the escape this retraction is about
+  // cannot touch it, and counting it would refuse the whole function for an unrelated escape.
+  //
+  // …and only the frame slots inside the writer's reach. A callee handed only its own return
+  // storage writes the struct it returns and nothing else, so a slot outside that struct has no
+  // writer but this function: `if (a) x = gF(h); r = mk8(b); g4(i, j, x, a);` spills `x` beside
+  // `r`'s temp, unstored on one path, and that slot is still uninitialised there.
+  {
+    id: 'writer-over-undef',
+    why: 'an unstored frame slot is uninitialised only while this function is its sole writer',
+    sound: true,
+    guardedBy: 'thumb-frontend.test.ts: an ESCAPED frame address retracts the undef argument',
+    rejects: (e) => e.writes && e.undefReached !== undefined,
+  },
+  // …and the SLOT MODEL is the third claim an escape retracts — the undef rule's argument
+  // taken one step further. The audit's extents are inferred from OUR accesses, so an object
+  // wider in the SOURCE than the bytes this function touches has its later words written by
+  // the callee — and any of those modelled as an SSA slot is a value the slot model forwards
+  // ACROSS the call that overwrote it.
+  //
+  // The object has to be reached ONLY through the captured pointer (an `[sp,#0]` access of its own collides with the slot model and
+  // declines at the overlap check), which is what four corpus functions do:
+  //
+  //     mov r2, sp / str r0, [r2]   @ the object, written through the captured address
+  //     str r1, [sp, #0x4]          @ a word the slot model keys
+  //     mov r0, r2 / bl g           @ the base escapes; `g` may write [sp,#4]
+  //     ldr r0, [sp, #0x4]          @ …and the machine RELOADS it after the call
+  //
+  // and lifted, the reload is the value from BEFORE the call, the callee's write dropped, no
+  // diagnostic. Exactly the silent-wrong-answer trade the sp guards exist to prevent, so it refuses.
+  //
+  // WHAT IT COSTS: it refuses every word slot the escape may reach, which is blunter than the
+  // hazard it names. Narrowing it needs the object's real extent, and this model does not carry
+  // one: `extent` is a single width from a single access. The asm sometimes cannot
+  // supply it either — the compiled twin at `capturedObjectIsTheWholeFrame` is exactly this
+  // rule's shape, a slot THIS FUNCTION stores and reloads, undecidable between a spill and a
+  // member.
+  //
+  // A callee is not the only writer. `struct M { u8 b; u8 pad[3]; s32 t; }; gp = &m; g2();
+  // use2(m.t);` PUBLISHES the base to an ordinary global and the machine reloads [sp,#4] after
+  // `bl g2` — `g2` writes through `gp`, which points here: the same hazard as the call shape, one
+  // escape over.
+  //
+  // …and a writer is not the only hazard, so the rule keys on `escaped`, not `mayWrite`. A
+  // device that only READS through the address reads the slot's bytes from memory, where the
+  // slot model never put them: `struct P { u32 a, b; } s; s.a = x; s.b = y; REG_DMA3SAD =
+  // (u32)&s;` above an outgoing block is `str r4, [sp, #0x4] / str r5, [sp, #0x8] / add r1, sp,
+  // #0x4 / str r1, [DMA3SAD]`, where the slot model would keep `s.b` in a register and drop its
+  // store as dead while the DMA reads that word. The asm cannot tell that second word from a
+  // neighbour spilled beside the object, so what bounds the read is the transfer's own control
+  // word, `readWindow`.
+  //
+  // …and BELOW the object as well as above it. A C object extends upward from its base, but a
+  // captured address need not BE a base: `add r0, sp, #0x4` is `&buf[1]` as readily as `&b`, and
+  // `buf[0]` at [sp,#0] is then read or written through `p[-1]`. Only down to the outgoing
+  // block, whose words are the callee's arguments and never part of a local.
+  {
+    id: 'reaches-a-slot',
+    why: 'the slot model keeps a slot in a register, so a write or read through the frame misses it',
+    sound: true,
+    guardedBy: 'thumb-frontend.test.ts: above: a word a device may read past the object',
+    rejects: (e) => e.slotReached !== undefined,
+  },
+  // …and the FOURTH claim an escape retracts is the object's TOP, which the three rules above
+  // leave to whatever this function happened to touch. `extent` is one width from one access,
+  // so an object wider in the SOURCE than those bytes is declared too small — and a callee
+  // holding its address writes frame bytes the emitted C never allocated. Compiled:
+  //
+  //     u8 buf[12]; buf[0] = x; garr(buf); use2(buf[0]);
+  //       → add sp,sp,#-0xc / mov r1,sp / strb r0,[r1] / mov r0,sp / bl garr
+  //
+  // lifted as `u8 sp0; garr(&sp0); use2(sp0)` — a 12-byte object declared one byte, in a frame
+  // the recompile makes 4 bytes wide, with `garr` writing the other 8 into the caller's. The
+  // three rules above all pass it: one object, no `undef` op, no slot above it.
+  //
+  // What licenses an answer is the frame being ACCOUNTED FOR, word by word. Every word of the
+  // reserved local area the escape reaches has to be an object this audit modelled or a slot the
+  // slot model keys; a word that is neither is storage nothing here describes, so the emitted C
+  // reserves less than the machine did and the writer reaches past what it allocated. A writer
+  // that may write anywhere through the address reaches the whole local area, below the object as
+  // well as above it; a callee handed only its own return storage writes the struct it returns
+  // and nothing else (`readWindow`), so a word outside that struct is one it never reaches. Word
+  // granularity, not byte — the stack is word-aligned, so a halfword object owns its word and the
+  // padding beside it is not a second local.
+  //
+  // …and on a READER as far as it reads, since a read past the object copies frame bytes the
+  // source reserved and the recompile does not. `u16 buf[8]; buf[0] = x; CpuSet(buf, gDst, 8);`
+  // reads the sixteen bytes its control word names, and a DMA copy incrementing from `buf` reads
+  // every word above it; lifted as `u16 sp0`, the recompile's frame is four bytes wide and the
+  // transfer copies the saved `lr` and the caller's frame out with it. A read unbounded both ways,
+  // and a callee's write, meet this rule only beside a writer the one-object answer cannot hold
+  // (`writerNotKept`): otherwise the audit keeps the local area as one object instead.
+  //
+  // WHAT IT LEAVES, since this is the extent question the gate comment above is about: an escape
+  // is accepted only where the modelled objects and the keyed slots tile the reserved area it
+  // reaches — a word above the object is a slot (refused above), a second object (refused above),
+  // or unaccounted (refused here). That is not a wider extent model; it is the same one-scalar
+  // `extent`, made to say when it does not fit. An object of two words cannot be built here at
+  // all — the second access that would reach it is a `[+4]` the `scalar()` guard refuses — so no
+  // widening of the frame licence admits a shape this rule would then have to judge.
+  //
+  // AND IT IS THE SCALAR ARM THIS BOUNDS. An UNTYPED object is the whole DECLARED area by
+  // construction — `notTheWholeArea` accepts nothing else — and every word below the declared
+  // area is the licensed outgoing block, whose argument words the slot model keys. The object and
+  // those slots together account for every word this walk asks about, so no input makes the rule
+  // fire on that path; `accountedWords` needs its slot term for that as much as its object term.
+  // What bounds THAT path is `notTheWholeArea`'s own live clauses — a second object, an object
+  // that does not start at the bottom of the declared area, an address that reaches memory rather
+  // than a callee, and the callee's declared return — and `overSlot`, which refuses a slot keyed
+  // inside the declared area.
+  {
+    id: 'reaches-an-unaccounted-word',
+    why: 'an escape reaching a frame word no declaration covers reaches past what the recompile allocates',
+    sound: true,
+    guardedBy: [
+      'thumb-frontend.test.ts: an array whose top nothing bounds declines rather than shrinking the frame',
+      'thumb-frontend.test.ts: a copy that reads past its object into a word nothing accounts for declines',
+    ],
+    rejects: (e) => e.unaccountedWord !== undefined,
+  },
+];
+
+/** FRAME-OBJECT AUDIT. Every `laddr` the frontend emitted is only a CLAIM that the address it
+ *  names is used as "the address of one local object"; this proves it, over the finished function,
+ *  the same boundary-total style as the slot-escape assert in finish(). The address may flow
+ *  anywhere as a VALUE — into an MMIO register (the DMA-fill idiom), a call, a phi — and it is
+ *  judged in one of two models, chosen before any shape is:
+ *   - PER OBJECT, the default: every MEMORY access through it must be at offset 0, with one agreed
+ *     width and one agreed extension, or a read or write through a runtime index into storage
+ *     nothing else types — bytes, or ONE wider width, read through a cast on the bytes
+ *     (`indexedWidth`) — and its bytes must belong to nothing else in the frame;
+ *   - ONE OBJECT, where a device reads or a callee writes without bound and every writer is one
+ *     that answer can hold (`writerNotKept`), or where no address escapes at all and the
+ *     per-object model refuses (`oneObject`, which this answers and the frontend lifts again
+ *     with): the local area is one `u8` array in memory, every fixed-offset access in it is a
+ *     member at its own offset, a runtime index may reach it at a byte or at ONE wider
+ *     width (`indexedWidth`), and two widths at one byte are the views of one union
+ *     (`unionViews`), or refuse where no view names them (`unionRefusal`).
+ *  In either model, a store through a capture that reaches a call unread on every path, beneath
+ *  every word a load proves a local's, declines: it may be that call's stack argument
+ *  (`storedNeverRead`). Which load proves it is the compiler's premise: one after a call under
+ *  `localsAboveOutgoingArea`, and any load from the offset up under `outgoingAreaNeverLoadedFrom`.
+ *  Any use the audit cannot vouch for declines the whole function loudly. Nothing here guesses: a
+ *  scalar's declared type is exactly the access type the machine used, and an object NO access
+ *  reaches is sized by the frame reservation and left untyped.
+ *
+ *  Takes its inputs explicitly rather than closing over `lift`. Every one of them is READ, none is
+ *  reassigned, and the only mutations are to the ops reachable through `irBlocks`: an `add` of a
+ *  capture and a constant is re-minted as the `laddr` it names, a moved-from capture nothing reads
+ *  is dropped, a capture addressed through at fixed offsets is split into the objects its accesses
+ *  name, and each surviving `laddr` is stamped with its width, signedness, count and `volatile`.
+ *  One object mutates more: every access through a member is re-based onto one minted `laddr`,
+ *  and the member `laddr`s are deleted or re-minted as that one moved by a `const`. An accepted
+ *  function is answered with the device pin it owes, under the model it was accepted in
+ *  (frontend/device-pins.ts).
+ *
+ *  STAGED, and the order the stages run in is the refusal order: the first stage to refuse names
+ *  the decline. Three things cross stages besides their returned records: `irBlocks`, rewritten by
+ *  the fold, the split, the one-object answer and the stamp; `foldedHere`, which the split adds to
+ *  and the slot-overlap refusal reads; and `ModelChoice.refused`, which the model choice and the
+ *  shape stage set and the relift test reads. */
+export function auditFrameObjects({
+  name,
+  irBlocks,
+  ownedLocals: owned,
+  declaredLocals: declared,
+  usedSlotOffsets,
+  loadedWords,
+  capturedObjectIsTheWholeFrame,
+  escapesReliedOn = new Set(),
+  movedCaptures,
+  returnsWithoutHiddenPointer,
+  symbols,
+  target,
+  gates = FRAME_ESCAPE_GATES,
+  oneObject,
+}: FrameObjectAudit): FrameObjectVerdict {
+  const { laddrs: captures, foldedHere } = foldMovedCaptures(irBlocks, movedCaptures);
+  // …and the audit runs for a licensed acceptance with no object at all, so the premise re-check
+  // is total rather than resting on "the capture always survives into the IR".
+  if (captures.length === 0 && !capturedObjectIsTheWholeFrame && escapesReliedOn.size === 0) {
+    return undefined;
+  }
+  const fail = frameRefusal(name);
+  if (captures.length === 0 && escapesReliedOn.size > 0) {
+    recheckEscapesReliedOn(escapesReliedOn, undefined, fail);
+  }
+  const facts = frameAddressFacts(irBlocks, symbols, target);
+  const { laddrs, splitRefusal } = splitAddressingCopies(irBlocks, captures, foldedHere, declaredStructs(irBlocks));
+  const objects = frameObjects(laddrs, owned, fail);
+  const flow = addressFlow(irBlocks, objects, facts, fail);
+  const uses = classifyFrameUses({
+    irBlocks,
+    objects,
+    flow,
+    facts,
+    splitRefusal,
+    oneObject,
+    target,
+    fail,
+  });
+  const windows = escapeWindows(irBlocks, uses, flow, facts, target);
+  const model = chooseFrameModel({ oneObject, uses, windows, returnsWithoutHiddenPointer, fail });
+  if (capturedObjectIsTheWholeFrame) {
+    recheckWholeFramePremise({ uses, returnsWithoutHiddenPointer, fail });
+  }
+  recheckEscapesReliedOn(escapesReliedOn, uses, fail);
+  storedNeverRead(irBlocks, uses, loadedWords, target, fail);
+  // The device pin's trigger: the `readOnlyAddressSinks` registers a frame address was stored to.
+  const sinks = [...new Set([...uses.sourceStores.values()].flat().map((s) => s.sink))];
+  if (oneObject !== undefined) {
+    keepAsOneObject({
+      oneObject,
+      irBlocks,
+      objects,
+      uses,
+      usedSlotOffsets,
+      returnsWithoutHiddenPointer,
+      arrayOrder: target.compilerBehaviors.addressTakenArrayOrder,
+      arrayAlignment: target.compilerBehaviors.addressTakenArrayAlignment,
+      fail,
+    });
+    return { policy: 'one-object', sinks };
+  }
+  const shapes = objectShapes({
+    objects,
+    uses,
+    owned,
+    declared,
+    usedSlotOffsets,
+    returnsWithoutHiddenPointer,
+    model,
+    fail,
+  });
+  const escapes = frameEscapes({ irBlocks, uses, windows, shapes, owned, declared, usedSlotOffsets });
+  // THE ONE-OBJECT ANSWER, where it is on offer (`chooseFrameModel`: one escape reaches without
+  // bound and every writer is one it can hold, or no address escapes at all) and the per-object
+  // model does not describe the frame: it refused a shape, an object sits over a slot, or the
+  // unbounded reach meets another object, a slot or a word nothing accounts for. Then what the
+  // device may read or the callee may write — or, with no escape, only this function's own
+  // accesses — is kept rather than refused: lift again with the local area as one object in memory
+  // (`keepAsOneObject`). Below the local area are the outgoing arguments and above it the saved
+  // registers, neither of them an object. Where the per-object model does describe the frame —
+  // one object and nothing else in reach — it stands, and the object keeps its own type.
+  // An escape `misses` bounded is asked as the unbounded read it was without that proof
+  // (`ModelChoice.unboundedAt`): the proof may add a per-object lift, never take the one-object one.
+  const answered = (e: FrameEscape): boolean =>
+    model.unboundedAt.has(e.off) &&
+    (e.objectReached !== undefined || e.slotReached !== undefined || e.unaccountedWord !== undefined);
+  if (model.onOffer && (model.refused || shapes.overSlot.length > 0 || escapes.some(answered))) {
+    return { oneObject: { from: declared.from, to: declared.to } };
+  }
+  const failWithheld: Refuse = (why) => fail(model.withheld(why));
+  for (const [off, width] of shapes.overSlot) {
+    failIfSlotKeysIt(off, width, { usedSlotOffsets, objects, foldedHere, fail: failWithheld });
+  }
+  // RULE-MAJOR, not escape-major: every escape is asked a rule before any is asked the next, so
+  // the refusal a function reports does not turn on the order its escapes were found in.
+  for (const gate of gates) {
+    const hit = escapes.find((e) => gate.rejects(e));
+    if (hit !== undefined) {
+      (answered(hit) ? failWithheld : fail)(escapeRefusal(gate.id, hit));
+    }
+  }
+  stampObjects(objects, shapes, uses);
+  return { policy: 'per-object', sinks };
+}
+
+/** Refuses the whole function, naming the address-taken local as what it cannot lift. */
+type Refuse = (why: string) => never;
+
+function frameRefusal(name: string): Refuse {
+  return (why) => {
+    throw new FrontendUnsupportedError(`cannot lift '${name}': address-taken stack local — ${why}`);
+  };
+}
+
+/** THE FRAME BYTES A DECLARATION TYPES AS ONE STRUCT: a call's return storage (`sret`) and a
+ *  struct passed by value (`byValue`, call-plan.ts `foldByValueArgs`), where the operand is an
+ *  `laddr`. */
+function declaredStructs(irBlocks: readonly Block[]): FrameRange[] {
+  const laddrOff = new Map<Value, number>();
+  for (const b of irBlocks) {
+    for (const op of b.ops) {
+      if (op.opcode === 'laddr') {
+        laddrOff.set(op.results[0], op.attrs.off as number);
+      }
+    }
+  }
+  const out: FrameRange[] = [];
+  for (const b of irBlocks) {
+    for (const op of b.ops) {
+      if (op.opcode !== 'call') {
+        continue;
+      }
+      const t = op.results[0]?.type;
+      const from = laddrOff.get(op.operands[0]);
+      if (op.attrs.sret === true && from !== undefined && t?.kind === 'struct' && t.size !== undefined) {
+        out.push({ from, to: from + t.size });
+      }
+      for (const { at } of byValueOperands(op)) {
+        const v = op.operands[at];
+        const off = laddrOff.get(v);
+        const t = v?.type.kind === 'ptr' ? v.type.to : undefined;
+        if (off !== undefined && t?.kind === 'struct' && t.size !== undefined) {
+          out.push({ from: off, to: off + t.size });
+        }
+      }
+    }
+  }
+  return out;
+}
+
+/** A CAPTURE MOVED BY A CONSTANT IS THE CAPTURE AT THE SUM, and here the constant is exact: an
+ *  `add` of a `laddr` and a `const` — a register the lift could not see through, `mov r0, sp /
+ *  movs r2, #0 / ldrsh r1, [r0, r2]`, or a move the pre-lift walk does not follow — is re-minted
+ *  as the `laddr` it names. The walk still decides which `[sp,#k]` words are routed to an object
+ *  rather than keyed as slots, so a fold it did not make is remembered (`foldedHere`): an object it
+ *  lands on a keyed slot is refused as the move, the capability that is missing
+ *  (`failIfSlotKeysIt`).
+ *
+ *  AN INDEX INTO A CAPTURE, MOVED BY A NONZERO CONSTANT, IS THE SAME INDEX INTO THE CAPTURE AT THE
+ *  SUM. agbcc spells `a[i]` on a local at [sp,#k) as the frame base plus the index, moved after:
+ *  `mov r0, sp / add r0, r0, r4 / add r0, #0x4` or `add r0, r0, sp / add r0, #0x4` — the bytes
+ *  `add r0, sp, #0x4 / add r0, r0, r4` reach, so `add(add(laddr@a, i), k)` is re-minted as
+ *  `add(laddr@(a+k), i)`, and the inner sum and capture are dropped when nothing else reads them.
+ *  The object at [sp,#a) is often the outgoing-argument word (a 5-argument call beside
+ *  the array), which the index never touches. Zero is left alone: `add(sum, 0)` is agbcc's
+ *  `mov r1, #0x0 / ldrsb r0, [r0, r1]`, which `indexedAccess` judges where the register put it.
+ *  The rebased object is held to every rule an object at a+k is held to, so a displaced FIELD of a
+ *  struct element — no object of its own at a+k, the struct's other bytes at a — lands as a second
+ *  object beside the first and is refused or lifted as one object by the same rules. A load or
+ *  store's own nonzero displacement on the sum is the same move: `ldrb r0, [r0, #0x1]` (the field
+ *  agbcc reads unsigned) and `mov r1, #0x1 / ldrsb r0, [r0, r1]` (signed) reach the same byte, so
+ *  the access is re-pointed at `add(laddr@(a+d), i)` with displacement 0, and the verdict does not
+ *  depend on where the literal sits.
+ *
+ *  Returns every `laddr` that survives, in block order. */
+function foldMovedCaptures(
+  irBlocks: Block[],
+  movedCaptures: ReadonlySet<Value>,
+): { laddrs: Op[]; foldedHere: Set<Op> } {
+  const moved = new Set<Value>(movedCaptures);
+  const foldedHere = new Set<Op>();
+  const constOf = new Map<Value, number>();
+  const laddrOf = new Map<Value, Op>();
+  for (const blk of irBlocks) {
+    for (const op of blk.ops) {
+      if (op.opcode === 'const') {
+        constOf.set(op.results[0], op.attrs.value as number);
+      } else if (op.opcode === 'laddr') {
+        laddrOf.set(op.results[0], op);
+      }
+    }
+  }
+  // the `add` of a capture and a runtime value that defines each value, for the index rebase
+  const indexOf = new Map<Value, { base: Op; index: Value; sum: Op }>();
+  const rebased = new Set<Op>();
+  for (let changed = true; changed;) {
+    changed = false;
+    for (const blk of irBlocks) {
+      blk.ops = blk.ops.flatMap((op) => {
+        const [x, y] = op.operands;
+        const sum0 = (op.opcode === 'load' || op.opcode === 'store') && x !== undefined ? indexOf.get(x) : undefined;
+        const disp = (op.attrs.off as number | undefined) ?? 0;
+        if (sum0 !== undefined && disp !== 0) {
+          const object = mkOp('laddr', {
+            results: [mkValue(sum0.base.results[0].type)],
+            attrs: { off: ((sum0.base.attrs.off as number) + disp) | 0 },
+          });
+          const moves = mkOp('add', {
+            results: [mkValue(x.type)],
+            operands: [object.results[0], sum0.index],
+            attrs: sum0.sum.attrs,
+          });
+          laddrOf.set(object.results[0], object);
+          indexOf.set(moves.results[0], { base: object, index: sum0.index, sum: moves });
+          moved.add(sum0.base.results[0]);
+          foldedHere.add(object);
+          rebased.add(sum0.sum);
+          op.operands[0] = moves.results[0];
+          op.attrs = { ...op.attrs, off: 0 };
+          changed = true;
+          return [object, moves, op];
+        }
+        if (op.opcode !== 'add' || op.operands.length !== 2) {
+          return [op];
+        }
+        const base = laddrOf.get(x) ?? laddrOf.get(y);
+        const by = constOf.get(laddrOf.has(x) ? y : x);
+        if (base !== undefined && by !== undefined) {
+          const off = ((base.attrs.off as number) + by) | 0;
+          const object = mkOp('laddr', { results: op.results, attrs: { off } });
+          laddrOf.set(op.results[0], object);
+          moved.add(base.results[0]);
+          foldedHere.add(object);
+          changed = true;
+          return [object];
+        }
+        const index = base === undefined ? undefined : laddrOf.has(x) ? y : x;
+        if (base !== undefined && index !== undefined && !laddrOf.has(index)) {
+          // a sum first seen here takes another pass: a use laid out in an EARLIER block was
+          // visited before the sum was known, and is moved only on the next one
+          if (!indexOf.has(op.results[0])) {
+            indexOf.set(op.results[0], { base, index, sum: op });
+            changed = true;
+          }
+          return [op];
+        }
+        const sum = indexOf.get(x) ?? indexOf.get(y);
+        const k = constOf.get(indexOf.has(x) ? y : x);
+        if (sum === undefined || k === undefined || k === 0) {
+          return [op];
+        }
+        const object = mkOp('laddr', {
+          results: [mkValue(sum.base.results[0].type)],
+          attrs: { off: ((sum.base.attrs.off as number) + k) | 0 },
+        });
+        const moves = mkOp('add', { results: op.results, operands: [object.results[0], sum.index], attrs: op.attrs });
+        laddrOf.set(object.results[0], object);
+        indexOf.set(op.results[0], { base: object, index: sum.index, sum: moves });
+        moved.add(sum.base.results[0]);
+        foldedHere.add(object);
+        rebased.add(sum.sum);
+        changed = true;
+        return [object, moves];
+      });
+    }
+  }
+  // A capture MOVED by a constant and nothing else reads names no object — the moved one does —
+  // so it is dropped rather than judged as an object with no use, and so is a fold nothing reads:
+  // the write-back of `stmia r1!, {r2, r3, r4}` through a capture is `add r1, r1, #12`, a pointer
+  // to the end of what was copied that the machine never uses. Only those: an unused `mov rD, sp`
+  // of the machine's own is still a capture, and is judged.
+  const readNow = (): Set<Value> => {
+    const read = new Set<Value>();
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        op.operands.forEach((v) => read.add(v));
+        (op.successors ?? []).forEach((s) => s.args.forEach((v) => read.add(v)));
+      }
+    }
+    return read;
+  };
+  // …and an index sum a rebase moved off, once nothing reads it, goes the same way first
+  if (rebased.size > 0) {
+    const before = readNow();
+    for (const blk of irBlocks) {
+      blk.ops = blk.ops.filter((op) => !rebased.has(op) || before.has(op.results[0]));
+    }
+  }
+  const read = readNow();
+  const laddrs: Op[] = [];
+  for (const blk of irBlocks) {
+    blk.ops = blk.ops.filter(
+      (op) => op.opcode !== 'laddr' || read.has(op.results[0]) || !(moved.has(op.results[0]) || foldedHere.has(op)),
+    );
+    for (const op of blk.ops) {
+      if (op.opcode === 'laddr') {
+        laddrs.push(op);
+      }
+    }
+  }
+  return { laddrs, foldedHere };
+}
+
+/** What the audit reads a value as: its defining op, its constant, the literal address it denotes,
+ *  and the read-only device registers a store hands it to. Read off the IR as the fold left it, so
+ *  `defOf` names no `laddr` the split mints after. */
+interface FrameAddressFacts extends LiteralAddresses {
+  /** the registers this store hands the WHOLE address to, when each is one a device only reads
+   *  through, else none */
+  readsThrough(op: Op): readonly number[];
+}
+
+function frameAddressFacts(
+  irBlocks: readonly Block[],
+  symbols: SymbolMap | undefined,
+  target: TargetDescription,
+): FrameAddressFacts {
+  const readOnlySinks = new Set(target.capabilities.readOnlyAddressSinks ?? []);
+  const addresses = literalAddresses(irBlocks, symbols);
+  const { defOf, literalAddrOf } = addresses;
+  // The spacing of the read-only registers: a runtime index that is a multiple of it, from one
+  // of them, names one of them and never a register between — the channel stride.
+  const sinkSpacing = [...readOnlySinks].reduce((g, s, _, all) => gcd(g, s - all[0]), 0);
+  // Word stores only: a `strh` to a source register hands over half an address, so the device's
+  // source is not this object. A literal base names one register; a literal plus a runtime index —
+  // `(vu32 *)(0x40000B0 + ch * 12)`, a channel chosen at run time — names every read-only register
+  // its stride reaches, and only when that stride is a multiple of their spacing, so no index lands
+  // between them. A base this cannot resolve — computed, register-offset, merged by a phi — is the
+  // conservative answer.
+  const readsThrough = (op: Op): readonly number[] => {
+    if (readOnlySinks.size === 0 || (op.attrs.width as number) !== 4) {
+      return [];
+    }
+    const off = op.attrs.off as number;
+    const base = literalAddrOf(op.operands[0]);
+    if (base !== undefined) {
+      return readOnlySinks.has(base + off) ? [base + off] : [];
+    }
+    const d = defOf.get(op.operands[0]);
+    if (d?.opcode !== 'add' || d.operands.length !== 2 || sinkSpacing === 0) {
+      return [];
+    }
+    for (const [lit, index] of [d.operands, [...d.operands].reverse()]) {
+      const from = literalAddrOf(lit);
+      const stride = from === undefined ? 0 : linearFactor({ defs: defOf, constOf: addresses.constOf }, index);
+      if (from !== undefined && readOnlySinks.has(from + off) && stride > 0 && stride % sinkSpacing === 0) {
+        return [...readOnlySinks].filter((s) => (s - (from + off)) % stride === 0);
+      }
+    }
+    return [];
+  };
+  return { ...addresses, readsThrough };
+}
+
+/** A FRAME BASE ADDRESSED THROUGH IS NOT A CAPTURE. Thumb-1 gives `ldr`/`str` an `[sp,#imm]`
+ *  encoding and gives the sub-word forms none, so a byte or halfword spill can only be spelled
+ *  by copying sp into a register and addressing through the copy:
+ *
+ *      mov  r2, sp
+ *      strh r3, [r2, #0x30]
+ *
+ *  That is an ADDRESSING MODE. The copy never becomes a value, and the access is the
+ *  `[sp,#0x30]` the instruction set cannot spell — so what the machine named is one object at
+ *  frame offset 48, not a `[+48]` reach through the frame base.
+ *
+ *  A captured address whose every use is a fixed-offset sub-word ACCESS is that shape, and
+ *  each of its accesses names its own object: re-root them onto a `laddr` at their own offset,
+ *  read at 0, and the rest of this audit judges the objects. A capture with ANY other use is a
+ *  real capture and keeps the frame base.
+ *
+ *  What makes that judgement total is that the walk below enumerates every ROLE a value can
+ *  appear in — every operand of every op, and every edge argument — instead of asking what an
+ *  instruction looks like. One instruction can hold two roles: `str rD, [rD, #k]` stores the
+ *  frame address through itself, a base use AND an escape, and the escape is what stops the
+ *  split.
+ *
+ *  Returns the `laddr`s left to judge, and why a capture was NOT split, when the reason is one no
+ *  later message carries — the `slotsOffReason` idiom: a refusal reported as the wrong capability
+ *  sends the improvement loop to build the wrong thing. Per CAPTURE and not per offset: every
+ *  direct `[sp,#k]` word access is a capture of its own at k, refused here for its width, and a
+ *  different capture at k whose access is refused for another reason must not be handed that one. */
+function splitAddressingCopies(
+  irBlocks: Block[],
+  laddrs: Op[],
+  foldedHere: Set<Op>,
+  structs: readonly FrameRange[] = [],
+): { laddrs: Op[]; splitRefusal: Map<Value, string> } {
+  const splitRefusal = new Map<Value, string>();
+  const uses = new Map<Value, { op: Op; idx: number; blk: Block }[]>();
+  const record = (v: Value, op: Op, idx: number, blk: Block) =>
+    (uses.get(v) ?? uses.set(v, []).get(v)!).push({ op, idx, blk });
+  for (const blk of irBlocks) {
+    for (const op of blk.ops) {
+      op.operands.forEach((v, idx) => record(v, op, idx, blk));
+      // An EDGE ARGUMENT is a use role too, and never an access: a capture that reaches a
+      // block parameter is live past this block, so the taint closure (`addressFlow`) is what
+      // judges it. Recorded at index -1 so it can never be counted as an access — a split there
+      // would delete a capture the successor argument still names.
+      for (const succ of op.successors ?? []) {
+        for (const a of succ.args) {
+          record(a, op, -1, blk);
+        }
+      }
+    }
+  }
+  const minted: Op[] = [];
+  const consumed = new Set<Op>();
+  for (const capture of laddrs) {
+    const at = uses.get(capture.results[0]) ?? [];
+    const accesses = at.filter((u) => (u.op.opcode === 'load' || u.op.opcode === 'store') && u.idx === 0);
+    // SUB-WORD ONLY, because that is the whole of what the encoding gap forces: `ldr`/`str` DO
+    // have an `[sp,#imm]` form, so a WORD access through a copy is some other shape and must
+    // not be read as this one. It is also what keeps the outgoing-argument area safe — that
+    // guard reads `[sp,#k]` accesses (spMemAccess), which an access through a copy is not, and
+    // agbcc stages arguments 5+ there with `str`.
+    const subWord = accesses.every((u) => (u.op.attrs.width as number) < 4);
+    // A use that is not an access leaves the capture naming the frame base, and the judgement
+    // after reports that use itself — an escape, a phi, arithmetic — so it needs no reason
+    // here. The WIDTH does: nothing downstream mentions it, so a refused word access would be
+    // reported as "a store at [+4]" and the histogram would be asked for the wrong capability.
+    if (at.length === 0 || accesses.length !== at.length) {
+      continue;
+    }
+    // AN ADDRESS STRICTLY INSIDE A DECLARED STRUCT, ONLY ACCESSED, IS A MEMBER ACCESS OF THAT
+    // STRUCT. A word store into a struct passed by value goes straight to `[sp,#k]` — `x.c = w` is
+    // `str r1, [sp, #0x4]` over `struct F {u16 a,b; u32 c; s8 e,f;}` at [sp,#0) — and the frontend
+    // mints that access its own `laddr` at k. The declaration says those bytes are the struct's,
+    // so the address is re-rooted on the struct's base with the displacement on the access, and
+    // the audit judges one object rather than two that overlap. Any use that is not an access —
+    // `&x.c` handed on — is an interior pointer, which is not this shape and is left to refuse.
+    const off = capture.attrs.off as number;
+    const holders = structs.filter((r) => r.from < off && off < r.to);
+    const holder = holders[0];
+    const inHolder = (u: { op: Op }): boolean =>
+      off + (u.op.attrs.off as number) >= holder!.from &&
+      off + (u.op.attrs.off as number) + (u.op.attrs.width as number) <= holder!.to;
+    if (
+      holder !== undefined &&
+      holders.every((r) => r.from === holder.from && r.to === holder.to) &&
+      accesses.every(inHolder)
+    ) {
+      for (const u of accesses) {
+        u.op.attrs = { ...u.op.attrs, off: off - holder.from + (u.op.attrs.off as number) };
+      }
+      capture.attrs = { ...capture.attrs, off: holder.from };
+      continue;
+    }
+    if (!subWord) {
+      splitRefusal.set(capture.results[0], 'a WORD access through the copy, and `ldr`/`str` have an `[sp,#imm]` form');
+      continue;
+    }
+    // Nothing to split when the capture already names ONE object: every access at offset 0 is
+    // the frame base itself, which is what the DMA-fill idiom captures — or every access lands in
+    // the declared struct the capture is the start of (`declaredStructs`), whose members they are.
+    const base = capture.attrs.off as number;
+    const into = (r: FrameRange): boolean =>
+      base === r.from &&
+      accesses.every((u) => base + (u.op.attrs.off as number) + (u.op.attrs.width as number) <= r.to);
+    if (accesses.every((u) => u.op.attrs.off === 0) || structs.some(into)) {
+      continue;
+    }
+    for (const u of accesses) {
+      const res = mkValue(T.unk(32));
+      const at = (capture.attrs.off as number) + (u.op.attrs.off as number);
+      const object = mkOp('laddr', { results: [res], attrs: { off: at } });
+      u.blk.ops.splice(u.blk.ops.indexOf(u.op), 0, object);
+      minted.push(object);
+      if (foldedHere.has(capture)) {
+        foldedHere.add(object);
+      }
+      // The ADDRESS operand only — the stored value (operand 1) is passed through
+      // untouched, so no slot home moves (ir/core.ts `SlotHomes`). These accesses go through
+      // a COPY of `sp` rather than the `[sp,#k]` keys the stamp reads, so none of them
+      // carried one to begin with.
+      u.op.operands = [res, ...u.op.operands.slice(1)];
+      u.op.attrs = { ...u.op.attrs, off: 0 };
+    }
+    consumed.add(capture);
+  }
+  if (consumed.size === 0) {
+    return { laddrs, splitRefusal };
+  }
+  for (const blk of irBlocks) {
+    blk.ops = blk.ops.filter((op) => !consumed.has(op));
+  }
+  return { laddrs: [...laddrs.filter((op) => !consumed.has(op)), ...minted], splitRefusal };
+}
+
+/** ONE OBJECT PER FRAME OFFSET. Two `laddr` at the same offset name the same storage; two at
+ *  different offsets are different objects, so width, signedness, escape and the overlap
+ *  window are decided per offset — one width shared by every capture in the function would
+ *  declare a halfword spill and a word spill as one object. */
+function frameObjects(laddrs: readonly Op[], owned: FrameRange, fail: Refuse): Map<number, Op[]> {
+  const objects = new Map<number, Op[]>();
+  for (const op of laddrs) {
+    const off = op.attrs.off as number;
+    (objects.get(off) ?? objects.set(off, []).get(off)!).push(op);
+  }
+  // A LOCAL STARTS INSIDE THE RESERVED AREA. Above it are the registers the prologue saved and
+  // then the caller's outgoing block, so an address there is an incoming stack argument's or a
+  // saved register's — `g(&e)` for a fifth parameter `e` is `add r0, sp, #0x8` over a one-word
+  // local area — and no other rule of the audit is about that gap. The TOP itself is also C's
+  // one-past-the-end pointer, `g(buf, buf + 8)` over an 8-byte array, and the refusal names both
+  // readings. BELOW IT is the outgoing block a call's stack words are staged in, and on O32 also
+  // the saves IDO keeps under its locals: an address there is no local's either. Every object's
+  // extent is held to the area again below; this says why, for the frontend that supplied it.
+  for (const off of objects.keys()) {
+    if (off < owned.from) {
+      fail(
+        `the captured address at [sp,#${off}) is below the reserved local area, which starts at [sp,#${owned.from}) — ` +
+          'an outgoing stack argument word or a saved register, whose address is not modelled',
+      );
+    }
+    if (off === owned.to) {
+      fail(
+        `the captured address at [sp,#${off}) is the top of the reserved local area of ${owned.to - owned.from} bytes — ` +
+          'one past the end of a local array, or an incoming stack argument, neither of which is modelled',
+      );
+    }
+    if (off > owned.to) {
+      fail(
+        `the captured address at [sp,#${off}) is above the reserved local area of ${owned.to - owned.from} bytes — ` +
+          'an incoming stack argument or a saved register, whose address is not modelled',
+      );
+    }
+  }
+  return objects;
+}
+
+/** Where each frame address may flow: `taint`, the object a value may hold the address of on SOME
+ *  path, and `frameOnEveryPath`, the values that hold a frame address on EVERY path. */
+interface AddressFlow {
+  readonly taint: ReadonlyMap<Value, number>;
+  readonly frameOnEveryPath: ReadonlySet<Value>;
+}
+
+function addressFlow(
+  irBlocks: readonly Block[],
+  objects: ReadonlyMap<number, readonly Op[]>,
+  facts: LiteralAddresses,
+  fail: Refuse,
+): AddressFlow {
+  const { defOf, constOf } = facts;
+  // Taint maps a value to the OBJECT whose address it may hold, closed over phis: a tainted
+  // edge arg taints the receiving block param. A phi that merges two objects has no single
+  // answer, and picking one would put an access on the wrong storage: `get(c ? &a : &b)` is
+  // `add r0, sp, #0x4 / beq / add r0, sp, #0x8 / bl get`, and refuses here.
+  const taint = new Map<Value, number>();
+  for (const [off, ops] of objects) {
+    for (const op of ops) {
+      taint.set(op.results[0], off);
+    }
+  }
+  for (let changed = true; changed;) {
+    changed = false;
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        for (const s of op.successors ?? []) {
+          s.args.forEach((arg, i) => {
+            const from = taint.get(arg);
+            const param = s.block.params[i];
+            if (from === undefined || param === undefined) {
+              return;
+            }
+            const had = taint.get(param);
+            if (had === from) {
+              return;
+            }
+            if (had !== undefined) {
+              fail(`a phi merges the frame objects at [sp,#${had}] and [sp,#${from}] — one value, two objects`);
+            }
+            taint.set(param, from);
+            changed = true;
+          });
+        }
+      }
+    }
+  }
+  // …and the values that hold a frame address on EVERY path, where `taint` answers "on some
+  // path": a `laddr`, a phi whose every incoming value is one, or one of those moved by a
+  // constant. `p = cnt ? cnt : &o` is tainted and not in here: it may be `cnt`, which may be
+  // anything, and reading it as this frame is how a store through it goes unseen.
+  const frameOnEveryPath = new Set<Value>(taint.keys());
+  const incoming = new Map<Value, Value[]>();
+  for (const blk of irBlocks) {
+    for (const op of blk.ops) {
+      if (op.opcode === 'add' && op.operands.length === 2 && op.operands.some((v) => constOf(v) !== undefined)) {
+        frameOnEveryPath.add(op.results[0]);
+      }
+      for (const s of op.successors ?? []) {
+        s.args.forEach((arg, i) => {
+          const param = s.block.params[i];
+          if (param !== undefined) {
+            (incoming.get(param) ?? incoming.set(param, []).get(param)!).push(arg);
+          }
+        });
+      }
+    }
+  }
+  const objectValues = new Set([...objects.values()].flat().map((op) => op.results[0]));
+  const holdsFrame = (v: Value): boolean => {
+    const d = defOf.get(v);
+    if (objectValues.has(v)) {
+      return true;
+    }
+    if (d?.opcode === 'add') {
+      return d.operands.some((x) => constOf(x) === undefined && frameOnEveryPath.has(x));
+    }
+    const ins = incoming.get(v);
+    return d === undefined && ins !== undefined && ins.every((a) => frameOnEveryPath.has(a));
+  };
+  for (let changed = true; changed;) {
+    changed = false;
+    for (const v of frameOnEveryPath) {
+      if (!holdsFrame(v)) {
+        frameOnEveryPath.delete(v);
+        changed = true;
+      }
+    }
+  }
+  return { taint, frameOnEveryPath };
+}
+
+/** One fixed-offset access at an object's own address. */
+interface FrameAccess {
+  readonly width: number;
+  readonly signed: boolean;
+  readonly isLoad: boolean;
+}
+
+/** A load or store judged an access to the object at `off`, and the address value it reaches the
+ *  object through: a capture, or a phi that carries one — for a runtime index, the indexed one. */
+interface FrameAccessOp {
+  readonly off: number;
+  readonly through: Value;
+}
+
+/** Every use of every frame object, by offset — what each later stage reads. Each field is
+ *  declared, with the question it answers, where `classifyFrameUses` builds it. */
+interface FrameUses {
+  readonly accesses: ReadonlyMap<number, readonly FrameAccess[]>;
+  readonly accessOps: ReadonlyMap<Op, FrameAccessOp>;
+  readonly escaped: ReadonlySet<number>;
+  readonly sourceStores: ReadonlyMap<number, readonly { readonly op: Op; readonly sink: number }[]>;
+  readonly calleeReads: ReadonlyMap<number, { readonly lo: number; readonly hi: number }>;
+  readonly filledFrom: ReadonlySet<number>;
+  readonly passedToCallee: ReadonlySet<number>;
+  readonly passedToWriter: ReadonlySet<number>;
+  readonly published: ReadonlySet<number>;
+  readonly publishedOutward: ReadonlySet<number>;
+  readonly publishedToWriter: ReadonlySet<number>;
+  readonly arg0Callees: ReadonlyMap<number, ReadonlySet<string | null>>;
+  readonly returnTemps: ReadonlyMap<number, readonly Op[]>;
+  /** the calls each object is passed to BY VALUE (`foldByValueArgs`), with the struct each passes */
+  readonly byValueReads: ReadonlyMap<number, readonly { readonly op: Op; readonly type: IrType }[]>;
+  readonly useCount: ReadonlyMap<number, number>;
+  readonly indexed: ReadonlyMap<number, readonly { readonly width: number; readonly signed: boolean }[]>;
+  readonly members: readonly { readonly at: number; readonly width: number }[];
+  readonly memberRefusal: string | undefined;
+  /** every escape of each object's address, as the frame bytes it may reach: `[lo, hi)` where a
+   *  literal-count block copy proves them (`boundedCopy`), `null` where nothing does, and `into`
+   *  where the copy WRITES them (the address is its destination, not its source). Only the split
+   *  of the one object reads this (`provenParts`); the escape windows keep the copy as an
+   *  unbounded writer, which is what puts that one object on offer at all (`chooseFrameModel`). */
+  readonly escapeExtents: ReadonlyMap<
+    number,
+    readonly ({ readonly lo: number; readonly hi: number; readonly into: boolean } | null)[]
+  >;
+  readonly fixed: readonly {
+    readonly op: Op;
+    readonly at: number;
+    readonly width: number;
+    readonly isLoad: boolean;
+    readonly frameOnly: boolean;
+  }[];
+}
+
+/** Did the address at `off` reach something that may write the frame back: a callee that is not a
+ *  bounded block transfer reading through it, or memory a writer may hold. */
+function mayWrite(uses: FrameUses, off: number): boolean {
+  return uses.passedToWriter.has(off) || uses.publishedToWriter.has(off);
+}
+
+/** Judges every use of a tainted value, against the object it names. */
+function classifyFrameUses({
+  irBlocks,
+  objects,
+  flow: { taint, frameOnEveryPath },
+  facts,
+  splitRefusal,
+  oneObject,
+  target,
+  fail,
+}: {
+  irBlocks: readonly Block[];
+  objects: ReadonlyMap<number, readonly Op[]>;
+  flow: AddressFlow;
+  facts: FrameAddressFacts;
+  splitRefusal: ReadonlyMap<Value, string>;
+  oneObject: FrameRange | undefined;
+  target: TargetDescription;
+  fail: Refuse;
+}): FrameUses {
+  const { defOf } = facts;
+  const accesses = new Map<number, FrameAccess[]>();
+  // …and every load and store judged an access, by the object it reaches: through a capture, a
+  // phi that carries one, or a runtime index into one. A later stage that rewrites or qualifies
+  // "the accesses to the object" reads this list rather than recognizing them again, since a
+  // narrower recognizer misses exactly the phi-carried ones `taint` admits.
+  const accessOps = new Map<Op, FrameAccessOp>();
+  // TWO QUESTIONS, not one. `escaped` asks whether the address LEFT the function, in the order the
+  // escapes were found — the order windows and refusals are read in. Whether it reached something
+  // that could write the frame BACK — what every "a callee may write any frame offset" refusal
+  // rests on — is `mayWrite`, read off the splits below. A store into a device's SOURCE register
+  // answers yes to the first and no to the second: the hardware reads the object, and the
+  // DMA-fill idiom this capability was built for (`vu16 tmp; DmaSet(n, &tmp, …)`) is exactly
+  // that shape.
+  const escaped = new Set<number>();
+  // …and for the others, the stores that handed the address to a source register, which is
+  // where `readWindow` reads how far the device reads
+  const sourceStores = new Map<number, { op: Op; sink: number }[]>();
+  // …and a CALL that only reads is the same answer: the address handed to a block transfer
+  // (`blockTransferCalls`) as its source, with a literal control word, is read `[lo, hi)` from
+  // the object and written by nobody. `CPU_FILL`'s `vu32 tmp = v; CpuSet(&tmp, dest, …)` is the
+  // shape. A control word this cannot read, or any other argument position, is a callee that
+  // may write.
+  const calleeReads = new Map<number, { lo: number; hi: number }>();
+  // …and of those, the objects a transfer FILLS from — a fixed source, the `tmp` of every fill
+  // macro — which the `volatile` stamp keys on beside `published`
+  const filledFrom = new Set<number>();
+  // …and the two escapes SPLIT, because each decides something the other does not.
+  // `passedToCallee` is the address handed to a callee as an argument — the one escape whose
+  // writer this frontend can name, which is what the struct-return premise re-check rests on, and
+  // what tells a refusal message which escape it is talking about. `published` is the address
+  // WRITTEN TO MEMORY, how the DMA idiom hands the object to hardware, and what `volatile` at the
+  // stamp keys on. Reading either off `escaped` gets the other one wrong.
+  const passedToCallee = new Set<number>();
+  // …and of those, the callees that may WRITE through it: every one but a bounded block transfer
+  // reading its source (`calleeReads`), which names no writer
+  const passedToWriter = new Set<number>();
+  const published = new Set<number>();
+  // …and `published` SPLITS AGAIN, because it answers two questions of different strengths and
+  // the weaker one may not be read as the stronger. "Did the address reach memory at all" is
+  // what `volatile` keys on: a halfword of it written anywhere is still a write this function
+  // does not own, and the qualifier has to survive it. "Did the address reach memory OUTSIDE
+  // this frame, whole" is what the licence is re-proven against (`recheckWholeFramePremise`), and
+  // it is strictly narrower — a store back into the object's own bytes publishes the address to
+  // nobody, and half an address is not the address. The pre-lift scan that grants the licence
+  // (`frameBasePublishedToMemory`) admits exactly the narrow one, so the re-proof must too: an
+  // audit that re-proves a WEAKER premise than the licence it audits is not a containment, it
+  // is a second, wider door into the same acceptance.
+  const publishedOutward = new Set<number>();
+  // …and the third question `published` answers, of what HOLDS the address it wrote: anything but
+  // a device's read-only source register (`facts.readsThrough`) may write through it — an
+  // interrupt reading a global, a device writing its destination — at any point in this function,
+  // so a re-read of the object is a read the recompile must make too.
+  const publishedToWriter = new Set<number>();
+  // …and WHICH CALLEE took it at ARGUMENT 0, because that is the one position a hidden
+  // struct-return pointer can occupy and that callee's declared RETURN TYPE is the one fact that
+  // tells an out-parameter from one. A `call`'s operand index IS the argument index here (the
+  // `bl` arm reads r0..r<argc-1> in order), so an address that appears in no entry of this map
+  // was handed over at r1 or above every time — an argument the source wrote. `null` is the
+  // narrowing of an unstamped `target` attr — the `bl`/`blx` lowering always stamps one — and
+  // reads as a callee nothing can be declared about, so it refuses.
+  const arg0Callees = new Map<number, Set<string | null>>();
+  // …except where the call's own declaration says argument 0 IS the hidden pointer (the frontend
+  // stamps `sret` on a call to a callee declared to return a struct through memory): that object
+  // is the callee's return storage, a local of the declared type. `useCount` counts every use of
+  // each object, so a return temp this function does anything else with is told apart.
+  const returnTemps = new Map<number, Op[]>();
+  // …and a call's operand its lowering passes BY VALUE (`foldByValueArgs`) is no escape: the
+  // callee receives a copy of the whole struct, so it is a read of the object's bytes at the call
+  const byValueReads = new Map<number, { op: Op; type: IrType }[]>();
+  const useCount = new Map<number, number>();
+  // The accesses through a runtime-indexed address, per object — kept apart from `accesses`,
+  // which types the object at its own offset: `a[i]` says what one ELEMENT is, not what sits at
+  // `a`.
+  const indexed = new Map<number, { width: number; signed: boolean }[]>();
+  for (const off of objects.keys()) {
+    accesses.set(off, []);
+  }
+  // …and with `oneObject`, every fixed-offset access as the frame bytes it touches, since then an
+  // access at [+k] through a capture is a member of the one object rather than a second object
+  const members: { at: number; width: number }[] = [];
+  // …and without it, the first such access, which the per-object model refuses once the model is
+  // chosen (`chooseFrameModel`) — save one of a call's return storage or of a struct passed by
+  // value, whose members are the struct's declared ones (`objectShapes`)
+  const memberRefusals: [number, string][] = [];
+  const escapeExtents = new Map<number, ({ lo: number; hi: number; into: boolean } | null)[]>();
+  // …and every value something reads, since a copy whose returned destination is read hands the
+  // address on to a use nothing here follows
+  const readValues = new Set<Value>(
+    irBlocks.flatMap((b) => b.ops.flatMap((op) => [...op.operands, ...(op.successors ?? []).flatMap((sx) => sx.args)])),
+  );
+  // …and in either model, every fixed-offset access as the op that makes it, the frame bytes it
+  // touches, whether it reads them, and whether its address is this frame's on every path — what
+  // `storedNeverRead` asks of a frame that makes a call
+  const fixed: { op: Op; at: number; width: number; isLoad: boolean; frameOnly: boolean }[] = [];
+  const scalar = (kind: string, op: Op, off: number, v: Value): void => {
+    fixed.push({
+      op,
+      at: off + (op.attrs.off as number),
+      width: op.attrs.width as number,
+      isLoad: kind === 'load',
+      frameOnly: frameOnEveryPath.has(v),
+    });
+    if (oneObject !== undefined) {
+      members.push({ at: off + (op.attrs.off as number), width: op.attrs.width as number });
+      return;
+    }
+    if ((op.attrs.off as number) !== 0) {
+      memberRefusals.push([
+        off,
+        `a ${kind} at [+${op.attrs.off}] through the captured address — ` +
+          (splitRefusal.get(v) ?? 'only a scalar at the captured address is modelled'),
+      ]);
+    }
+  };
+  for (const blk of irBlocks) {
+    for (const op of blk.ops) {
+      for (const [idx, v] of op.operands.entries()) {
+        const off = taint.get(v);
+        if (off === undefined) {
+          continue;
+        }
+        useCount.set(off, (useCount.get(off) ?? 0) + 1);
+        if (op.opcode === 'load' && idx === 0) {
+          scalar('load', op, off, v);
+          accessOps.set(op, { off, through: v });
+          accesses.get(off)!.push({
+            width: op.attrs.width as number,
+            signed: (op.attrs.signed as boolean) ?? false,
+            isLoad: true,
+          });
+          continue;
+        }
+        if (op.opcode === 'store' && idx === 0) {
+          scalar('store', op, off, v);
+          accessOps.set(op, { off, through: v });
+          accesses.get(off)!.push({ width: op.attrs.width as number, signed: false, isLoad: false });
+          continue;
+        }
+        if (byValueOperands(op).some((b) => b.at === idx)) {
+          // the fold types the operand a pointer to the struct passed (call-plan.ts `foldByValueArgs`)
+          const type = v.type.kind === 'ptr' ? v.type.to : undefined;
+          if (type?.kind !== 'struct' || type.size === undefined) {
+            throw new Error(`internal: a by-value operand of a call to '${calleeName(op)}' has no declared struct`);
+          }
+          (byValueReads.get(off) ?? byValueReads.set(off, []).get(off)!).push({ op, type });
+          fixed.push({ op, at: off, width: type.size, isLoad: true, frameOnly: frameOnEveryPath.has(v) });
+          continue;
+        }
+        if ((op.opcode === 'store' && idx === 1) || op.opcode === 'call') {
+          escaped.add(off); // the address ESCAPES as a value — the point of the capability
+          const copied = op.opcode === 'call' ? boundedCopy(op, idx, facts, readValues) : undefined;
+          (escapeExtents.get(off) ?? escapeExtents.set(off, []).get(off)!).push(
+            copied === undefined ? null : { lo: off + copied.lo, hi: off + copied.hi, into: copied.into },
+          );
+          const handedTo = op.opcode === 'store' ? facts.readsThrough(op) : [];
+          const read = op.opcode === 'call' ? transferRead(op, idx, off, target, facts) : undefined;
+          if (read !== undefined) {
+            const had = calleeReads.get(off) ?? read;
+            calleeReads.set(off, { lo: Math.min(had.lo, read.lo), hi: Math.max(had.hi, read.hi) });
+            if (read.fill) {
+              filledFrom.add(off);
+            }
+          } else if (handedTo.length === 0) {
+            if (op.opcode === 'store') {
+              publishedToWriter.add(off);
+            }
+          } else {
+            const stores = sourceStores.get(off) ?? sourceStores.set(off, []).get(off)!;
+            handedTo.forEach((sink) => stores.push({ op, sink }));
+          }
+          if (op.opcode === 'call') {
+            passedToCallee.add(off);
+            if (read === undefined) {
+              passedToWriter.add(off);
+            }
+            if (idx === 0 && op.attrs.sret === true) {
+              (returnTemps.get(off) ?? returnTemps.set(off, []).get(off)!).push(op);
+            } else if (idx === 0) {
+              const t = op.attrs.target;
+              const cs = arg0Callees.get(off) ?? new Set<string | null>();
+              cs.add(typeof t === 'string' ? t : null);
+              arg0Callees.set(off, cs);
+            }
+          } else {
+            published.add(off); // written to memory — the DMA idiom's `*dmaReg = &tmp`
+            // The licence's two conditions, asked of the IR: the WHOLE address (a word), and a
+            // destination that is not this frame. `taint` answers the second exactly — it holds
+            // every value that may carry one of this function's frame addresses, which is both
+            // spellings the pre-lift scan excludes by name (`str rS, [sp]` and a store through
+            // another held capture, since at a one-word frame [sp,#0] IS the object).
+            if ((op.attrs.width as number) === 4 && taint.get(op.operands[0]) === undefined) {
+              publishedOutward.add(off);
+            }
+          }
+          continue;
+        }
+        // A RUNTIME INDEX into the object: `mov r1, sp / add r0, r1, r4 / ldrb r0, [r0]` is
+        // agbcc's `a[i]` on a `u8 a[n]` local. The sum names no fixed offset, so it is not a
+        // capture of its own; what it may do is judged here, whole, and the object it indexes is
+        // judged with the rest (`objectShapes`).
+        const other = op.opcode === 'add' && op.operands.length === 2 ? op.operands[1 - idx] : undefined;
+        if (other !== undefined && taint.get(other) === undefined && defOf.get(other)?.opcode !== 'const') {
+          indexedAccess(irBlocks, { indexed, accessOps }, { off, through: v }, op.results[0], facts.constOf, fail);
+          continue;
+        }
+        // A CONSTANT move left after the fold (`foldMovedCaptures`) moves a capture a phi carried.
+        // When the phi also carries a pointer from outside the frame — `if (!info) info = &local;
+        // info->x` — the missing capability is that merge, not a walk through the frame.
+        if (other !== undefined && defOf.get(other)?.opcode === 'const' && !frameOnEveryPath.has(v)) {
+          fail(
+            `the captured address at [sp,#${off}) reaches a phi that merges it with a pointer from outside the ` +
+              'frame, and is then moved by a constant — a field of what may or may not be a local is not modelled',
+          );
+        }
+        // …and when every value the phi carries is this frame's, it is a pointer stepped through
+        // the frame, which names a different object on each trip.
+        if (other !== undefined && defOf.get(other)?.opcode === 'const') {
+          fail(
+            `the captured address at [sp,#${off}) reaches a phi and is then moved by a constant — ` +
+              'a pointer stepped through the frame names no one object',
+          );
+        }
+        fail(`the captured address flows into \`${op.opcode}\` — not an access, an escape, or a phi`);
+      }
+    }
+  }
+  return {
+    accesses,
+    accessOps,
+    escaped,
+    sourceStores,
+    calleeReads,
+    filledFrom,
+    passedToCallee,
+    passedToWriter,
+    published,
+    publishedOutward,
+    publishedToWriter,
+    arg0Callees,
+    returnTemps,
+    byValueReads,
+    useCount,
+    indexed,
+    members,
+    memberRefusal: memberRefusals.find(([off]) => !returnTemps.has(off) && !byValueReads.has(off))?.[1],
+    escapeExtents,
+    fixed,
+  };
+}
+
+// The bytes, relative to the address at operand `idx`, that a call of a standard block copy with
+// a literal, positive count reaches through it, and whether it writes them (`idx` is its
+// destination) — or `undefined` for any other callee, operand or count, which this does not
+// bound, and for a copy whose result (`memcpy` returns its destination) anything in `read` uses.
+function boundedCopy(
+  op: Op,
+  idx: number,
+  facts: LiteralAddresses,
+  read: ReadonlySet<Value>,
+): { lo: number; hi: number; into: boolean } | undefined {
+  const roles = blockCopyRoles(op.attrs.target);
+  if (
+    roles === undefined ||
+    (idx !== roles.dst && idx !== roles.src) ||
+    op.operands.length <= roles.n ||
+    op.results.some((r) => read.has(r))
+  ) {
+    return undefined;
+  }
+  const n = facts.constOf(op.operands[roles.n]);
+  return n !== undefined && Number.isInteger(n) && n > 0 ? { lo: 0, hi: n, into: idx === roles.dst } : undefined;
+}
+
+// The bytes a block transfer that took the address at `idx` reads, when `idx` is its source and
+// its control word is a literal.
+function transferRead(
+  op: Op,
+  idx: number,
+  off: number,
+  target: TargetDescription,
+  facts: LiteralAddresses,
+): { lo: number; hi: number; fill: boolean } | undefined {
+  const callee = op.attrs.target;
+  const calls = target.capabilities.blockTransferCalls;
+  const call = typeof callee === 'string' && calls && Object.hasOwn(calls, callee) ? calls[callee] : undefined;
+  const control = call === undefined || idx !== call.source ? undefined : op.operands[call.control];
+  const word = control === undefined ? undefined : facts.constOf(control);
+  if (call === undefined || word === undefined) {
+    return undefined;
+  }
+  const read = blockTransferRead(call, word);
+  return { ...sourceReach(read, off), fill: read.walk === 'fixed' };
+}
+
+// Records every access through `sum`, a runtime index into the object at `off`.
+//
+// A SUM MOVED BY A LITERAL IS THE SAME INDEX, DISPLACED. Thumb has no `ldrsb`/`ldrsh` with an
+// immediate, so agbcc loads the whole displacement into a register (thumb.md:411-505, `mov %0,%2 ;
+// ldrs[bh] %0,[%1,%0]`) and the frontend lowers that register-offset load as `add` + load@0:
+// `add r0, r1, r4 / mov r1, #0x0 / ldrsb r1, [r0, r1]` is `a[i]` on an `s8 a[n]` local. So the
+// uses of an `add` of the sum and a `const` are judged at that displacement. One `add` deep: agbcc
+// emits one `mov` per load, and no other compiler emits a literal index register. Only
+// displacement 0 is the indexed element. A nonzero `const` on a sum whose base is a capture never
+// arrives here: `foldMovedCaptures` has already moved the index to the object at the sum, which is
+// what agbcc's `mov r0, sp / add r0, r0, r4 / add r0, #0x4` is (an array above the outgoing word),
+// and what `mov r1, #0x3 / ldrsb r1, [r0, r1]` and a load's own displacement, `ldrb r0, [r0,
+// #0x1]` (a field of an element struct, or `a[i + 1]`), reach. What is left nonzero — a constant
+// computed rather than loaded as a `const`, a literal or a displacement on an index into a capture
+// a phi carries, or a displacement on top of the zero literal, which no compiler emits — refuses
+// naming the displacement.
+//
+// The element is judged here and left where the register put it, so it is spelled with the
+// literal: `*(s16 *)((u32)sp0 + (a0 << 1) + 0)`. Re-pointing it at the sum spells
+// `((s16 *)sp0)[a0]`, an index through a cast on the `u8` storage (`objectShapes`), which agbcc
+// compiles to `add r4, r4, sp` and the source's `mov r1, sp / add r0, r1, r4` does not: the `u16`
+// twin `((u16 *)sp0)[a0]` misses the same way. Left raw, the access compiles to the source's
+// bytes with or without the `+ 0`.
+function indexedAccess(
+  irBlocks: readonly Block[],
+  {
+    indexed,
+    accessOps,
+  }: { indexed: Map<number, { width: number; signed: boolean }[]>; accessOps: Map<Op, FrameAccessOp> },
+  object: FrameAccessOp,
+  sum: Value,
+  constOf: (v: Value) => number | undefined,
+  fail: Refuse,
+): void {
+  const { off } = object;
+  const got = indexed.get(off) ?? indexed.set(off, []).get(off)!;
+  const judge = (at: Value, by: number): void => {
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        const roles = [
+          ...op.operands.flatMap((v, i) => (v === at ? [i] : [])),
+          ...(op.successors ?? []).flatMap((s) => (s.args.includes(at) ? [-1] : [])),
+        ];
+        for (const i of roles) {
+          const k =
+            at === sum && op.opcode === 'add' && op.operands.length === 2 && i >= 0
+              ? constOf(op.operands[1 - i])
+              : undefined;
+          if (k !== undefined) {
+            judge(op.results[0], k);
+            continue;
+          }
+          const access = (op.opcode === 'load' || op.opcode === 'store') && i === 0;
+          if (!access) {
+            fail(
+              `a runtime index into the object at [sp,#${off}) flows into \`${i === -1 ? 'a phi' : op.opcode}\` — ` +
+                'only a load or store at the indexed address is modelled',
+            );
+          }
+          const at0 = (by + (op.attrs.off as number)) | 0;
+          if (at0 !== 0) {
+            fail(
+              `a runtime index into the object at [sp,#${off}) is accessed at displacement ${at0} from the indexed element — ` +
+                'only a load or store at the indexed address is modelled',
+            );
+          }
+          got.push({ width: op.attrs.width as number, signed: op.opcode === 'load' && op.attrs.signed === true });
+          accessOps.set(op, object);
+        }
+      }
+    }
+  };
+  judge(sum, 0);
+}
+
+/** Why two access types on one byte refuse, as every refusal of it words it. THE RULE IS AGBCC'S
+ *  AND IS HELD ON EVERY TARGET: agbcc at -O2 serves a read of one type past a store of the other
+ *  (`indexedWidth` has the compiled cases), while IDO 7.1, KMC gcc and gcc 2.7.2 reload past every such
+ *  store, so on MIPS it is only more cautious than it has to be. The text names no compiler of the
+ *  input, since the audit is handed none. */
+const STALE_ACROSS_TYPES =
+  'and type-based alias analysis can let a read of one type pass a store of the other (agbcc at -O2 does, ' +
+  'and the audit refuses it on every target) — a cast spelling could read stale';
+
+/** The one width wider than a byte that runtime-indexed accesses take, or why there is not one.
+ *
+ *  A runtime index names no byte, so its access type must agree with every access it may reach,
+ *  and "agree" is what stops agbcc reordering two of them. At -O2 it runs type-based alias
+ *  analysis (toplev.c:3616), and `c_get_alias_set` (c-common.c:1892-2005) gives an integer type
+ *  and its unsigned twin one set, a character type set 0 (conflicting with every set), a
+ *  member access its member's type's set, and any other type — a pointer included — a new set.
+ *  Compiled at the corpus's flags, `k(sp0); ((int *)sp0)[i] = 1; ((T *)sp0)[j] = 0; return
+ *  ((int *)sp0)[i];` reloads the word for T = int, unsigned int and unsigned char, and returns the
+ *  stale 1 for T = unsigned short, void * and long.
+ *
+ *  So ONE WIDTH IS ONE SET only while every access of that width READS AT one integer type or its
+ *  twin: a cast on the storage to `s32`/`u32` (`int`/`unsigned int` in every agbcc project), or a
+ *  member of an element struct (raise/struct-arrays) whose FIELD is such an integer — never the pointer an element
+ *  may hold. `/ptr-field`'s `over-local-storage` gate keeps such a field an integer, and contracts.ts
+ *  `assertLocalStorageStaysInteger` holds every respelled tree to it. The storage stays
+ *  `u8 name[n]` whatever the width. */
+function indexedWidth(accesses: readonly { readonly width: number }[]): {
+  width: number | null;
+  refusal: string | null;
+} {
+  const widths = [...new Set(accesses.map((x) => x.width))].filter((w) => w !== 1);
+  return {
+    width: widths[0] ?? null,
+    refusal: widths.length > 1 ? `accesses ${widths.join(' and ')} bytes wide, ${STALE_ACROSS_TYPES}` : null,
+  };
+}
+
+/** The bytes an escape may reach, `[lo, hi)` from the object's own offset, and how it reads them
+ *  as a refusal words it. */
+interface ReadWindow {
+  readonly lo: number;
+  readonly hi: number;
+  readonly why: string;
+  /** bounded only because a store through a computed pointer provably misses the control
+   *  halfword (`misses`): without that proof the read is unbounded, and the one-object answer
+   *  that held it then stays on offer (`chooseFrameModel`) */
+  readonly sparedByMiss?: true;
+}
+
+/** Each op's block and index, over the IR as the classification judged it. */
+function opPositions(irBlocks: readonly Block[]): Map<Op, { blk: Block; i: number }> {
+  const at = new Map<Op, { blk: Block; i: number }>();
+  for (const blk of irBlocks) {
+    blk.ops.forEach((op, i) => at.set(op, { blk, i }));
+  }
+  return at;
+}
+
+/** The read window of every escaped object, in the order the classification found the escapes. */
+function escapeWindows(
+  irBlocks: readonly Block[],
+  uses: FrameUses,
+  flow: AddressFlow,
+  facts: FrameAddressFacts,
+  target: TargetDescription,
+): Map<number, ReadWindow> {
+  const at = opPositions(irBlocks);
+  return new Map([...uses.escaped].map((off) => [off, readWindow(off, { at, uses, flow, facts, target })] as const));
+}
+
+const unbounded = (why: string): ReadWindow => ({ lo: -Infinity, hi: Infinity, why });
+
+/** THE BYTES AN ESCAPE MAY REACH, as `[lo, hi)` relative to the object's own offset. Anything
+ *  that may write, and anything this cannot bound, reaches the whole frame — save a callee
+ *  handed only its own return storage, which writes the struct it returns (`returnTemps`). A
+ *  device that only reads is bounded by its channel's control halfword (`readSourceControl`),
+ *  per TRANSFER: the device reads the object on every arm of the channel from the store that
+ *  handed it the address until a later word store to the same source register replaces it, so
+ *  the control stores that bound it are the ones reachable in between. Each has to be a literal
+ *  the target decodes. A store through a pointer this cannot resolve — one that is this frame's
+ *  on only some paths included (`frameOnEveryPath`) — may BE the control halfword, so it leaves
+ *  the read unbounded; so does a transfer never armed here at all. A store whose every address
+ *  misses that halfword (`misses`) is not such a store. An unbounded device read says which of
+ *  those it met (`why`): each is a different capability to build. A block transfer
+ *  that took the address as its source adds the bytes its control word reads (`calleeReads`).
+ *
+ *  A NAMED SYMBOL PLUS A CONSTANT IS RESOLVED WHERE THE SYMBOL MAP PLACES THE NAME, and then
+ *  exactly, by the overlap test below. agbcc's alias model never lets a C identifier plus a
+ *  constant meet a literal address (alias.c:812-819, 1064-1068), but nothing in the asm says a
+ *  name is a C identifier: a disassembly spells an I/O register the way it spells a global
+ *  (`.word REG_VCOUNT`). So a name the map does not place is an unresolved pointer here.
+ *
+ *  THE PREMISE, stated once and not checkable from one function: a callee or an interrupt
+ *  handler arms only a transfer it set up itself, source register first. So a call on the path
+ *  does not unbound the read, and neither does an interrupt at any instruction: whatever re-arms
+ *  the channel with this frame's address still in the source register is this function's own
+ *  store, and the walk sees every one of those. */
+function readWindow(
+  off: number,
+  {
+    at,
+    uses,
+    flow,
+    facts,
+    target,
+  }: {
+    at: ReadonlyMap<Op, { blk: Block; i: number }>;
+    uses: FrameUses;
+    flow: AddressFlow;
+    facts: FrameAddressFacts;
+    target: TargetDescription;
+  },
+): ReadWindow {
+  // a callee handed only its own return storage writes the struct it returns and nothing else —
+  // and this function's own reads of it hand the address to nobody
+  const temps = uses.returnTemps.get(off);
+  const reads = uses.accesses.get(off)?.filter((a) => a.isLoad).length ?? 0;
+  if (temps !== undefined && uses.useCount.get(off) === temps.length + reads) {
+    return { lo: 0, hi: returnedSize(temps[0]), why: 'that returns its struct into it' };
+  }
+  const control = target.capabilities.readSourceControl;
+  const stores = uses.sourceStores.get(off);
+  const called = uses.calleeReads.get(off);
+  if (!mayWrite(uses, off) && stores === undefined && called !== undefined) {
+    return { lo: called.lo, hi: called.hi, why: 'that reads through it' };
+  }
+  if (mayWrite(uses, off) || stores === undefined || control === undefined) {
+    return unbounded('that reads through it');
+  }
+  const little = target.capabilities.endianness === 'little';
+  const halves: number[] = [];
+  let spared = false;
+  for (const { op: handed, sink } of stores) {
+    const cnt = sink + control.offset;
+    let armed = false;
+    const entered = new Set<Block>();
+    const work: [Block, number][] = [[at.get(handed)!.blk, at.get(handed)!.i + 1]];
+    walk: while (work.length > 0) {
+      const [blk, from] = work.pop()!;
+      for (let i = from; i < blk.ops.length; i++) {
+        const op = blk.ops[i];
+        if (op.opcode !== 'store') {
+          continue;
+        }
+        const base = facts.literalAddrOf(op.operands[0]);
+        if (base === undefined) {
+          if (!flow.frameOnEveryPath.has(op.operands[0])) {
+            if (!misses(op, facts, cnt)) {
+              return unbounded('a later store through an unresolved pointer may re-arm');
+            }
+            spared = true;
+          }
+          continue;
+        }
+        const a = base + (op.attrs.off as number);
+        const w = op.attrs.width as number;
+        if (a === sink && w === 4) {
+          continue walk;
+        }
+        if (a + w <= cnt || a >= cnt + 2) {
+          continue;
+        }
+        const v = facts.defOf.get(op.operands[1]);
+        if (v?.opcode !== 'const' || a > cnt || a + w < cnt + 2) {
+          return unbounded('whose control word is not a literal');
+        }
+        const shift = 8 * (little ? cnt - a : a + w - cnt - 2);
+        halves.push(((v.attrs.value as number) >>> shift) & 0xffff);
+        armed = true;
+      }
+      for (const s of blk.ops[blk.ops.length - 1]?.successors ?? []) {
+        if (!entered.has(s.block)) {
+          entered.add(s.block);
+          work.push([s.block, 0]);
+        }
+      }
+    }
+    if (!armed) {
+      return unbounded('this function never arms');
+    }
+  }
+  let { lo, hi } = called ?? { lo: 0, hi: 0 };
+  for (const h of halves) {
+    const read = sourceControlRead(control, h);
+    if (read === null) {
+      return unbounded('whose control word bounds nothing');
+    }
+    const reach = sourceReach(read, off);
+    lo = Math.min(lo, reach.lo);
+    hi = Math.max(hi, reach.hi);
+  }
+  return { lo, hi, why: 'that reads through it', ...(spared ? { sparedByMiss: true as const } : {}) };
+}
+
+/** A store through a computed pointer that provably misses the control halfword at `cnt`: no
+ *  address its base may hold (`addressRangeOf`, a strided interval), displaced by the store's own
+ *  offset, starts a store whose bytes overlap `[cnt, cnt + 2)`. agbcc's `gEnts[i].f = 1` after a
+ *  transfer, `i` a `u8`, writes one byte at `gEnts + 4 + 8 * [0, 255]`, and no `i` makes that the
+ *  channel's control register — so it cannot re-arm the channel, and the window stays where the
+ *  literal stores put it. The stride decides it where the interval alone cannot: placed at
+ *  0x04000000 that span covers 0x040000DE, and still no `i` lands on it. Not "the transfer is
+ *  over": an immediate transfer is, but a later store that sets the enable bit again reloads the
+ *  source register and reads the frame anew (GBATEK, DMA control bit 15), which is what this
+ *  guards against. A store this cannot bound on every value stays an unresolved pointer. */
+function misses(op: Op, facts: FrameAddressFacts, cnt: number): boolean {
+  const r = facts.addressRangeOf(op.operands[0]);
+  if (r === undefined) {
+    return false;
+  }
+  const off = op.attrs.off as number;
+  const width = op.attrs.width as number;
+  const lo = r.lo + off;
+  const hi = r.hi + off;
+  if (lo < 0 || hi + width > 2 ** 32) {
+    return false;
+  }
+  // the first start at or above the lowest one that overlaps, against the highest that does
+  const from = cnt - width + 1;
+  const first = from <= lo || r.stride === 0 ? lo : lo + Math.ceil((from - lo) / r.stride) * r.stride;
+  return first > Math.min(hi, cnt + 1) || first < from;
+}
+
+/** Which model the audit judges the frame in. `refused` is the one mutable fact the audit
+ *  carries across stages: set when a shape the per-object model refuses is met while the
+ *  one-object answer is on offer, and read by the relift test. */
+interface ModelChoice {
+  readonly onOffer: boolean;
+  /** the escapes whose read is unbounded, or was before `misses` bounded it (`sparedByMiss`) — the
+   *  one fact both the offer and the relift test (`answered`) read, so the miss proof moves neither */
+  readonly unboundedAt: ReadonlySet<number>;
+  refused: boolean;
+  /** refuses `why` where it stands, or, with the one-object answer on offer, asks for it instead */
+  shapeRefused(why: string): void;
+  /** `why`, naming the writer that withheld the one-object answer where one did — for a refusal
+   *  that answer would otherwise have taken */
+  withheld(why: string): string;
+}
+
+/** Why a writer of the frame keeps the one-object answer from holding it, or null. The one object
+ *  is every byte of the declared area, so what a holder writes through any address inside it is
+ *  bytes one declaration owns, at offsets one array makes adjacent — below them is the outgoing
+ *  block and above them the saved registers, neither a local. That is the whole-area argument the
+ *  untyped object is sized by, and it holds the same escapes here (`wholeAreaEscapeRefusal`). Not
+ *  kept besides is a callee's RETURN STORAGE: the struct it returns through a hidden pointer is its
+ *  declared type, not bytes of an array. */
+function writerNotKept(uses: FrameUses, returnsWithoutHiddenPointer: (callee: string) => boolean): string | null {
+  for (const off of [...uses.escaped].filter((o) => mayWrite(uses, o))) {
+    const at = `the captured address at [sp,#${off})`;
+    const temp = uses.returnTemps.get(off)?.[0];
+    if (temp !== undefined) {
+      return `${at} is where \`${temp.attrs.target}\` returns its struct`;
+    }
+    const why = wholeAreaEscapeRefusal(off, uses, returnsWithoutHiddenPointer);
+    if (why !== null) {
+      return `${at}: ${why}`;
+    }
+  }
+  return null;
+}
+
+/** THE MODEL IS CHOSEN BEFORE ANY SHAPE IS JUDGED. The one-object answer is on offer in two
+ *  frames. Where one escape reaches without bound and that answer can hold every writer
+ *  (`writerNotKept`) — two out-parameters handed to one callee as readily as a device read. And
+ *  where NO ADDRESS ESCAPES AT ALL: then there is no writer and no reader but this function's own
+ *  accesses, so keeping every word of the declared area in memory keeps every store and every load
+ *  the machine made there, and a spill kept in memory changes no value. That second frame is the
+ *  one a by-value struct parameter leaves: agbcc spills its registers word by word (`str r1, [sp]`,
+ *  the slot model's) and, Thumb having no sp-relative halfword or byte load, reads its members
+ *  through `mov rD, sp` (the object's) — `int f(struct Q { u8 a[9]; } p){ return p.a[1] + p.a[8]; }`,
+ *  or a member read signed and unsigned, or the struct copied out a word at a time. The shapes the
+ *  per-object model refuses are ones that answer can hold: a member at [+k] through a capture, two
+ *  widths or two signednesses at one address, a runtime index, overlapping objects, a second
+ *  object beside an untyped one, an object over a slot. So there each of those refusals asks for
+ *  that answer instead of declining (`shapeRefused`), and the second audit judges the bytes as one
+ *  object by its own rules — two types at one byte are a union there, or refuse. Where the answer
+ *  is not on offer, each refuses where it stands.
+ *
+ *  A frame nothing escapes from can still hold a CALL'S STACK ARGUMENT: agbcc builds one it cannot
+ *  place with `str rX, [sp,#k]` through `mov rD, sp` — a by-value struct block-copied with
+ *  `ldmia`/`stmia`, a compound literal stored a byte or a halfword at a time — and the address
+ *  escapes nowhere. Kept here as a local, in either model, those stores outlive the call that took
+ *  them. That is `storedNeverRead`'s to refuse, the stage after this one, and it asks it of every
+ *  call, whatever a prototype says. */
+function chooseFrameModel({
+  oneObject,
+  uses,
+  windows,
+  returnsWithoutHiddenPointer,
+  fail,
+}: {
+  oneObject: FrameRange | undefined;
+  uses: FrameUses;
+  windows: ReadonlyMap<number, ReadWindow>;
+  returnsWithoutHiddenPointer: (callee: string) => boolean;
+  fail: Refuse;
+}): ModelChoice {
+  const unboundedAt = new Set(
+    [...windows]
+      .filter(([, w]) => (w.lo === -Infinity && w.hi === Infinity) || w.sparedByMiss === true)
+      .map(([off]) => off),
+  );
+  const unbounded = oneObject === undefined && unboundedAt.size > 0;
+  const writer = unbounded ? writerNotKept(uses, returnsWithoutHiddenPointer) : null;
+  const escapeFree = oneObject === undefined && uses.escaped.size === 0;
+  // A struct passed by value is ONE object of its declared type, which the call names whole; the
+  // one object is bytes, and a call handed them would pass a pointer.
+  const onOffer = uses.byValueReads.size === 0 && ((unbounded && writer === null) || escapeFree);
+  const model: ModelChoice = {
+    onOffer,
+    unboundedAt,
+    refused: false,
+    shapeRefused: (why) => {
+      if (!onOffer) {
+        fail(model.withheld(why));
+      }
+      model.refused = true;
+    },
+    // A refusal the one-object answer would have taken names the writer that withheld it: the
+    // shape alone is one the answer holds, so the shape alone does not say why this declined.
+    withheld: (why) => (writer === null ? why : `${why} — and the one object cannot hold every writer: ${writer}`),
+  };
+  if (uses.memberRefusal !== undefined) {
+    model.shapeRefused(uses.memberRefusal);
+  }
+  return model;
+}
+
+/** A FRAME STORE THAT REACHES A CALL UNREAD, BENEATH EVERY WORD PROVEN A LOCAL, MAY BE THAT
+ *  CALL'S STACK ARGUMENT — refuse. agbcc builds an argument it cannot place with `str rX, [sp,#k]`
+ *  IN PLACE through a capture: a by-value struct is `mov rD, sp` + `stmia`, a compound literal is
+ *  `strb`/`strh` through `mov rD, sp` moved by `add rD, #k`. The stack-argument analysis
+ *  (stackargs.ts) sees `[sp,#k]` slot stores alone, so it never weighs these, and no prototype
+ *  bounds them: a callee no prototype states counts argument registers alone, and a stated list is
+ *  a LOWER bound on the words a call takes — a variadic callee's list is a prefix, and DWARF's
+ *  `symbolPrototype` drops the `...`. Whatever model then holds the bytes, a local per capture or
+ *  the one object, keeps the stores and the call loses its stack words:
+ *  `th(1, 2, 3, 4, (struct S){{x, y}})` lifts as `th(1, 2, 3, 4)`. So this asks EVERY call.
+ *
+ *  A store is asked when it reaches a call PENDING — on some path from it to the call nothing loads
+ *  a byte it wrote, and on EVERY path from the entry some byte of it is written by such a store and
+ *  not loaded since — since a word the callee takes is one the caller wrote for it on every path
+ *  to the call and did not read back. A store through a pointer that is the
+ *  frame's on only some paths (`*(p ? p : &local) = x`) is not asked: it is not a store the
+ *  outgoing block alone can own. Nor is a store a runtime index or an escaped address reaches from
+ *  an object at or below it: whoever that hands the bytes to may read them.
+ *
+ *  AND ONLY A STORE BENEATH THE LOADED-WORD BOUND. Under `localsAboveOutgoingArea` a compiler keeps
+ *  one outgoing area at the frame bottom, below every local, and never reads it back after a call;
+ *  so a frame byte loaded after a call before anything re-stores it held a value across that call,
+ *  its word is a local's, and so is every word above it. Under the strong form,
+ *  `outgoingAreaNeverLoadedFrom`, any load in a word at or above that offset bounds it: from 0 on
+ *  agbcc, past the a0..a3 home on O32 (whose compilers load a by-value aggregate's home words back)
+ *  and from the parameter area on mwcc (`target.ts` says why). The frontend measures that bound
+ *  once, off its instructions, and hands it here (`loadedWords`) — the same number its own
+ *  stack-argument refusals take (stackargs' `loadedWordBound` on Thumb).
+ *  Every compiled outgoing-argument shape sits beneath any such bound, and a local the source reads
+ *  after a call does not: `g(); b[0] = x; b[1] = y; return b[0];` reaches no call, `b[0] = x; g();
+ *  return b[0];` is above the bound. What this still refuses that is honest is a local the source
+ *  stores, never reads back, and calls past — a dead local and an outgoing argument are the same
+ *  machine code, and the lift cannot tell which. The after-call liveness weighs this audit's fixed
+ *  accesses alone, so it sits at or above the bound the frontend's slot loads would give, which
+ *  only asks more; the strong form adds the frontend's bound (`loadedWords`). Without either
+ *  premise the bound proves nothing, and every pending store is asked. */
+function storedNeverRead(
+  irBlocks: readonly Block[],
+  uses: FrameUses,
+  loadedWords: FrameObjectAudit['loadedWords'],
+  target: TargetDescription,
+  fail: Refuse,
+): void {
+  const calls = irBlocks.flatMap((b) => b.ops.filter((op) => op.opcode === 'call'));
+  if (calls.length === 0) {
+    return;
+  }
+  const byOp = new Map(uses.fixed.map((a) => [a.op, a]));
+  const bytes = (a: { at: number; width: number }): number[] => [...Array(a.width).keys()].map((i) => a.at + i);
+  const index = new Map(irBlocks.map((b, i) => [b, i]));
+  const succs = irBlocks.map((b) => successorsOf(b).map((s) => index.get(s)!));
+  const live = new Set(irBlocks.length > 0 ? [0] : []);
+  for (const stack = [...live]; stack.length;) {
+    for (const s of succs[stack.pop()!]) {
+      if (!live.has(s)) {
+        live.add(s);
+        stack.push(s);
+      }
+    }
+  }
+
+  // THE SURVIVOR BOUND: a backward liveness over the frame bytes this function reads at fixed
+  // offsets through an address that is the frame's on every path. A load makes its bytes live, a
+  // store that writes them kills them, and a call is transparent but marks every byte live across
+  // it. A load whose address may be elsewhere proves nothing and a store that may write elsewhere
+  // kills nothing; nor does a block the entry cannot reach.
+  let bound = Infinity;
+  if (target.compilerBehaviors.localsAboveOutgoingArea === true) {
+    const liveIn = irBlocks.map(() => new Set<number>());
+    for (let changed = true; changed;) {
+      changed = false;
+      for (let b = irBlocks.length - 1; b >= 0; b--) {
+        if (!live.has(b)) {
+          continue;
+        }
+        const cur = new Set(succs[b].flatMap((s) => [...liveIn[s]]));
+        for (const op of [...irBlocks[b].ops].reverse()) {
+          const a = byOp.get(op);
+          if (op.opcode === 'call') {
+            for (const o of cur) {
+              bound = Math.min(bound, o - (o % 4));
+            }
+          } else if (a?.frameOnly) {
+            for (const o of bytes(a)) {
+              if (a.isLoad) {
+                cur.add(o);
+              } else {
+                cur.delete(o);
+              }
+            }
+          }
+        }
+        if ([...cur].some((o) => !liveIn[b].has(o))) {
+          liveIn[b] = cur;
+          changed = true;
+        }
+      }
+    }
+  }
+  // …and under the STRONG form (`outgoingAreaNeverLoadedFrom`) the caller loads no word of the
+  // area from that offset up before a call either, so ANY frame byte loaded there bounds it. The
+  // frontend measured that bound off its instructions (`loadedWords`): the slot reloads the IR
+  // does not show, and the prologue's and epilogue's own loads — without them
+  // `mov r3, sp; strh r0, [r3]; … bl sink; ldr r0, [sp]` refuses the `strh` on a word the code
+  // itself proves a local's. What only this audit sees is a load through a captured address, in a
+  // block the entry reaches, and it bounds the same way. A load in a word below the offset proves
+  // nothing: O32 compilers load the a1..a3 home words they stage a by-value aggregate in.
+  if (loadedWords !== undefined) {
+    bound = Math.min(bound, loadedWords.bound);
+    for (const b of live) {
+      for (const op of irBlocks[b].ops) {
+        const a = byOp.get(op);
+        const word = a === undefined ? -1 : a.at - (a.at % 4);
+        if (a?.isLoad && a.frameOnly && word >= loadedWords.from) {
+          bound = Math.min(bound, word);
+        }
+      }
+    }
+  }
+  const from = loadedWords?.from;
+
+  // THE PENDING STORES, two forward dataflows from the entry over the blocks it reaches. The MAY
+  // set is the stores this asks that some path brings to a point unread: a load of any byte a
+  // store wrote ends it — an argument is a word the caller writes and never reads, so a store
+  // with any byte read is a local's — as a frame store covering every byte it wrote does. The
+  // MUST set is the bytes every path brings to a point written by a store this asks and not
+  // loaded since: a load ends the bytes it reads, a frame store the bytes it writes, and a store
+  // that may write elsewhere ends nothing. An argument is staged on EVERY path to its call — a
+  // tail-merged call is staged in each predecessor — so a byte some path reaches the call without
+  // is not this call's to take: a loop's store that the first trip calls past is a local's.
+  const reachedFrom = Math.min(...uses.escaped, ...uses.indexed.keys());
+  type Fixed = FrameUses['fixed'][number];
+  const asked = (a: Fixed): boolean => !a.isLoad && a.frameOnly && a.at + a.width <= reachedFrom && a.at < bound;
+  interface Pending {
+    may: Set<Fixed>;
+    must: Set<number>;
+  }
+  const step = (op: Op, cur: Pending): void => {
+    const a = byOp.get(op);
+    if (a === undefined) {
+      return;
+    }
+    const touched = new Set(bytes(a));
+    for (const p of [...cur.may]) {
+      const mine = bytes(p);
+      if (a.isLoad ? mine.some((o) => touched.has(o)) : a.frameOnly && mine.every((o) => touched.has(o))) {
+        cur.may.delete(p);
+      }
+    }
+    if (a.isLoad || a.frameOnly) {
+      for (const o of touched) {
+        cur.must.delete(o);
+      }
+    }
+    if (asked(a)) {
+      cur.may.add(a);
+      for (const o of touched) {
+        cur.must.add(o);
+      }
+    }
+  };
+  const into: (Pending | undefined)[] = irBlocks.map((_, b) =>
+    b === 0 ? { may: new Set(), must: new Set() } : undefined,
+  );
+  for (let changed = true; changed;) {
+    changed = false;
+    for (let b = 0; b < irBlocks.length; b++) {
+      const at = into[b];
+      if (!live.has(b) || at === undefined) {
+        continue;
+      }
+      const cur: Pending = { may: new Set(at.may), must: new Set(at.must) };
+      irBlocks[b].ops.forEach((op) => step(op, cur));
+      for (const s of succs[b]) {
+        const old = into[s];
+        if (s === 0) {
+          continue;
+        }
+        if (old === undefined) {
+          into[s] = { may: new Set(cur.may), must: new Set(cur.must) };
+          changed = true;
+          continue;
+        }
+        const may = new Set([...old.may, ...cur.may]);
+        const must = new Set([...old.must].filter((o) => cur.must.has(o)));
+        if (may.size !== old.may.size || must.size !== old.must.size) {
+          into[s] = { may, must };
+          changed = true;
+        }
+      }
+    }
+  }
+  for (let b = 0; b < irBlocks.length; b++) {
+    const at = into[b];
+    if (!live.has(b) || at === undefined) {
+      continue;
+    }
+    const cur: Pending = { may: new Set(at.may), must: new Set(at.must) };
+    for (const op of irBlocks[b].ops) {
+      // a struct a call is passed by value is read by that call (`byValueReads`), not handed over
+      if (op.opcode === 'call' && byOp.has(op)) {
+        step(op, cur);
+      }
+      if (op.opcode === 'call') {
+        const store = [...cur.may].filter((p) => bytes(p).some((o) => cur.must.has(o))).sort((x, y) => x.at - y.at)[0];
+        if (store !== undefined) {
+          const callee = calleeName(op);
+          fail(
+            `the ${store.width}-byte store at [sp,#${store.at}) through a captured address reaches the call to ` +
+              `${callee === undefined ? 'an indirect callee' : `\`${callee}\``} unread on every path, and no ` +
+              `${from === undefined ? 'load after a call' : from === 0 ? 'load at or beneath it' : `load at or beneath it, from [sp,#${from}) up,`} proves it a local's — it may be ` +
+              "that call's stack argument, which the lift would drop",
+          );
+        }
+      }
+      step(op, cur);
+    }
+  }
+}
+
+/** THE ACCEPTANCE'S PREMISE, RE-ASKED OF THE IR. `capturedObjectIsTheWholeFrame` is a reading
+ *  of the TEXT and it is the one thing in this file that switches a refusal OFF, so the two
+ *  facts it claims are re-proven here, where they are exact, rather than left to the
+ *  approximation that licensed them. Neither is a second opinion on the same evidence: the
+ *  scan asks what a REGISTER holds at a `bl`; this asks what the finished function does with
+ *  the OBJECT.
+ *
+ *  THE ADDRESS ESCAPED. The whole licence is "something outside this function is holding the
+ *  address of this frame", and the pre-lift scan can say that of a register whose value never
+ *  reaches a call operand or a store — a declared arity trims it away, or the register is dead
+ *  by the time the call is built. When it does, [sp,#0] has been re-modelled as an addressable
+ *  object on no evidence at all, and the outgoing argument that really lived there is gone
+ *  from the call. EITHER escape re-proves it, because either one licensed it: a call taking
+ *  the address, or a store publishing it outward. They are asked as one question because they
+ *  license one thing.
+ *
+ *  AND EACH ARM IS AT MOST AS WIDE AS THE LICENCE IT RE-PROVES, which is what makes this a
+ *  containment rather than a second door. The callee arm is narrower for free — a `call`
+ *  operand is the address reaching a callee, which is what the scan approximated. The publish
+ *  arm is `publishedOutward` and not `published` for the same reason spelled out there: read
+ *  off the wider set, this re-proof accepts a halfword store and a store back into the
+ *  object's own bytes, both of which the licence refuses by name — so a frame the pre-lift
+ *  scan would never have licensed passes the check that exists to re-prove the licence.
+ *
+ *  THE CONTAINMENT IS STRICT AND THE SLACK IS ON THIS SIDE. `taint` is whole-function where the
+ *  pre-lift walk is block-local, so a base captured in an earlier block is refused HERE and
+ *  accepted THERE. That is the only direction the two can differ in without a wrong answer
+ *  reaching a caller, and it is structural rather than lucky: this set is built from a superset
+ *  of the facts the walk has. `packages/core/test/thumb-frontend.test.ts` carries the input.
+ *
+ *  NOT A STRUCT-RETURN TEMP, which `hiddenReturnPointerStands` asks. */
+function recheckWholeFramePremise({
+  uses,
+  returnsWithoutHiddenPointer,
+  fail,
+}: {
+  uses: FrameUses;
+  returnsWithoutHiddenPointer: (callee: string) => boolean;
+  fail: Refuse;
+}): void {
+  if (!uses.passedToCallee.has(0) && !uses.publishedOutward.has(0)) {
+    fail(
+      'the one-word-frame proof licensed this lift on the frame base escaping, and in the ' +
+        'lifted function no call takes it and no word store publishes it outside this frame — ' +
+        'so nothing rules out an outgoing stack argument at [sp,#0]',
+    );
+  }
+  const writtenHere = uses.accesses.get(0)?.some((a) => !a.isLoad) === true;
+  const whyItStands = writtenHere ? null : hiddenReturnPointerStands(0, uses.arg0Callees, returnsWithoutHiddenPointer);
+  if (whyItStands !== null) {
+    fail(`the one-word frame is never written here, and ${whyItStands}`);
+  }
+}
+
+/** THE ESCAPE EVENT'S PREMISE, RE-ASKED OF THE IR — `recheckWholeFramePremise`'s first half at
+ *  any frame size. The outgoing-argument analysis lets a frame address leaving this function end
+ *  the pending stores from its offset up (`StackArgsEscape`), reading the escape off what a
+ *  REGISTER holds at a `bl` or a word `str`. Where its verdict leans on that (it would refuse
+ *  without the escapes), each offset it read must reach a call operand or a word store outside the
+ *  frame in the lifted function too. It catches an arity that shrinks after the event was read
+ *  without passing the lowering's `CallSite.leftOut` question. Same two arms, same width as the
+ *  licence they re-prove. */
+function recheckEscapesReliedOn(offsets: ReadonlySet<number>, uses: FrameUses | undefined, fail: Refuse): void {
+  for (const off of offsets) {
+    if (uses === undefined || (!uses.passedToCallee.has(off) && !uses.publishedOutward.has(off))) {
+      fail(
+        `the outgoing-argument analysis set aside the stores from [sp,#${off}] up on that address escaping, and in the ` +
+          'lifted function no call takes it and no word store publishes it outside this frame — so nothing rules out ' +
+          'an outgoing stack argument there',
+      );
+    }
+  }
+}
+
+/** NOT A STRUCT-RETURN TEMP. A one-word frame rules out agbcc's block-copy bases (each needs
+ *  two words) but NOT the hidden return pointer of a <=4-byte non-integer-like struct, which is
+ *  exactly one word: `struct S4 { char a,b,c,d; }; struct S4 s = mk(x);` compiles to `add
+ *  sp,#-4 / mov r0,sp / bl mk / ldr r0,[sp]`, instruction for instruction an out-parameter
+ *  call. Left alone that lifted as `mk(&sp0, a0)` — a call the real prototype rejects.
+ *
+ *  TWO facts rule it out and either will do, because a return temp is storage the CALLEE owns
+ *  outright: it is written only by the callee, and the callee RETURNS the struct THROUGH IT.
+ *  So a store of our own says the object is one this function fills; and a callee whose RETURN
+ *  is known to need no hidden pointer says the same by the ABI — a function that returns
+ *  nothing, or returns in a register, has no such pointer to be given, whatever sits in r0.
+ *
+ *  AND THE QUESTION IS PER-CALL, which is what bounds how far it has to be asked: the pointer
+ *  is argument 0, always (compiled — `struct S4 mk3(int,int,int)` puts sp in r0 and shifts all
+ *  three real arguments up), so an address NO call takes at argument 0 cannot be one, whatever
+ *  else the function does with it. That is the whole of this function and it is why the
+ *  block-copy idiom `memcpy(dst, buf, sizeof buf)` — buffer at argument 1 — needs no declaration
+ *  at all. Per-call and not per-object: an address handed over at argument 1 somewhere leaves the
+ *  call that takes it at argument 0 exactly as ambiguous as before, so position acquits a call
+ *  rather than an object.
+ *
+ *  THE THIRD IS A DECLARATION, NOT AN INFERENCE, and so is its converse: a callee declared to
+ *  return a struct through memory, whose call the frontend stamps `sret`, makes the object that
+ *  call's return storage (`returnTemps`). Those two are the only answers here read off something
+ *  other than the instruction stream. The frontend's call declarations answer the third
+ *  (`FrameObjectAudit.returnsWithoutHiddenPointer`, which aggregate.ts's
+ *  `returnsWithoutHiddenPointer` decides), from the project's own `returnsVoid`, from a struct its
+ *  declaration returns that the target hands back in a register, or from the `returns` of a
+ *  signature the C standard fixes — the same table whose `params` decide a call's arity. It is
+ *  asked of EVERY callee that took the address at argument 0, because the object gets one
+ *  decision: one callee about whose return nothing is known leaves the ambiguity standing and the
+ *  refusal fires.
+ *
+ *  AN ARITY CANNOT ANSWER IT, which is worth saying because the count is right there and looks
+ *  like evidence: a hidden pointer does set one argument register more than the callee
+ *  declares, but the register count is what the machine WROTE, and a register already holding
+ *  this function's own incoming parameter is written by nobody. Compiled: `void f(const void
+ *  *a, const void *b){ struct Blob64 s = makeblob(b); }` emits `add sp,#-0x40 / mov r0,sp /
+ *  bl makeblob` — one written register against one declared parameter — so counting registers
+ *  reads a real struct return as an out-parameter and declares the callee's own storage as a
+ *  local. The question is about the RETURN and only a statement about the return decides it.
+ *
+ *  WHAT IT COSTS WHEN THE DECLARATION IS WRONG, measured rather than compared. On the `sret`
+ *  shape above, with `mk` (which really returns `struct S4`) declared `params: 1,
+ *  returnsVoid: true`, the lift succeeds and emits `s32 sret(s32 a0) { s32 sp0; mk(&sp0);
+ *  return (u8)sp0; }` — a compiling, plausible, WRONG program with the real argument dropped,
+ *  where a loud decline stood. Not a smaller cost than a wrong ARITY, either: the same entry
+ *  supplies both facts, so a wrong `returnsVoid` drops the argument too, and the frame re-model
+ *  is the silent half. The trade is accepted because there IS no other discriminator: compiled
+ *  through
+ *  the benchmark's own agbcc command, the hidden struct return and the out-parameter emit the
+ *  same instructions in the same order, the slot is read back at a scalar width in both, and
+ *  in both the value read back is what the function returns — so an asm-side corroboration
+ *  would be a rule with no discriminating input. The mitigation is that under-declaring is the
+ *  safe direction (a callee whose return nothing describes still declines) and that `FnProto`
+ *  says so at the field.
+ *
+ *  The residual cost is stated rather than hidden: an OUTPUT-only parameter taken at argument
+ *  0 of a callee the project has NOT declared is still byte-for-byte a struct return, and
+ *  still declines with it.
+ *
+ *  ONE SOURCE FOR THE DECISION AND ITS REASON, because every arm of this audit asks it and a
+ *  predicate beside a message is two things that can disagree. Returns why the pointer is not
+ *  ruled out — the caller frames it for its own arm — or null. */
+function hiddenReturnPointerStands(
+  off: number,
+  arg0Callees: FrameUses['arg0Callees'],
+  returnsWithoutHiddenPointer: (callee: string) => boolean,
+): string | null {
+  const cs = arg0Callees.get(off);
+  if (cs === undefined || cs.size === 0) {
+    return null;
+  }
+  const unknown = [...cs].filter((c) => c === null || !returnsWithoutHiddenPointer(c));
+  if (unknown.length === 0) {
+    return null;
+  }
+  return (
+    `\`${unknown.map((c) => c ?? '?').join('`, `')}\` takes it at argument 0 and nothing says ` +
+    'what that callee returns — a struct returned through a hidden pointer is handed this same frame'
+  );
+}
+
+// TWO MODELS FOR ONE BYTE is a silent disagreement: the slot model keeps an SSA slot in a
+// register, so a store through an object over the same bytes would never be seen there.
+function overlaps(a: number, aw: number, b: number, bw: number): boolean {
+  return a < b + bw && b < a + aw;
+}
+
+function failIfSlotKeysIt(
+  off: number,
+  width: number,
+  {
+    usedSlotOffsets,
+    objects,
+    foldedHere,
+    fail,
+  }: {
+    usedSlotOffsets: ReadonlySet<number>;
+    objects: ReadonlyMap<number, readonly Op[]>;
+    foldedHere: ReadonlySet<Op>;
+    fail: Refuse;
+  },
+): void {
+  for (const slot of usedSlotOffsets) {
+    if (overlaps(off, width, slot, 4)) {
+      fail(
+        objects.get(off)?.some((op) => foldedHere.has(op))
+          ? `the capture moved by a constant to [sp,#${off}) is a move the pre-lift walk does not follow, ` +
+              `so the slot model keys [sp,#${slot}] too — one byte, two models`
+          : `the object at [sp,#${off}) overlaps the SSA slot at [sp,#${slot}] — one byte, two models`,
+      );
+    }
+  }
+}
+
+/** ONE OBJECT IN MEMORY, the answer a device read or a callee write nothing bounds is given
+ *  instead of a refusal (`oneObject`, requested by the relift test where the escapes are judged).
+ *  Every byte of `[from, to)` is declared one `u8` array whose address the device or the callee
+ *  holds (`writerNotKept` says which writers it can hold) — or one per part, where the accesses
+ *  prove the bytes are several objects no use reads across (`provenParts`) — and every access
+ *  inside it is a cast-spelled access to that array (an element of a part, by its index:
+ *  structure.ts `frameArrayElement`), or a view of the union it is declared as where two widths
+ *  meet at one byte — so each store the machine made there is a store the
+ *  recompile makes too. That is what agbcc does for an object whose address escaped: it keeps
+ *  every store to it, in order (flow.c deletes a memory store only when an identical later
+ *  store in the same block overwrites it). And it is right whichever the source had there: a
+ *  member of the escaped object, which the device may read, or a spill, which no one reads —
+ *  the asm spells both as a store and a reload, and keeping a spill in memory changes no value. */
+function keepAsOneObject({
+  oneObject: { from, to },
+  irBlocks,
+  objects,
+  uses,
+  usedSlotOffsets,
+  returnsWithoutHiddenPointer,
+  arrayOrder,
+  arrayAlignment,
+  fail,
+}: {
+  oneObject: FrameRange;
+  irBlocks: Block[];
+  objects: ReadonlyMap<number, readonly Op[]>;
+  uses: FrameUses;
+  usedSlotOffsets: ReadonlySet<number>;
+  returnsWithoutHiddenPointer: (callee: string) => boolean;
+  arrayOrder: TargetDescription['compilerBehaviors']['addressTakenArrayOrder'];
+  arrayAlignment: TargetDescription['compilerBehaviors']['addressTakenArrayAlignment'];
+  fail: Refuse;
+}): void {
+  const kept = `the bytes [sp,#${from}) to [sp,#${to}) kept as one object`;
+  for (const off of objects.keys()) {
+    if (off < from || off >= to) {
+      fail(`the object at [sp,#${off}) lies outside ${kept}`);
+    }
+  }
+  for (const slot of usedSlotOffsets) {
+    if (overlaps(slot, 4, from, to - from)) {
+      fail(`the SSA slot at [sp,#${slot}] lies inside ${kept} — one byte, two models`);
+    }
+  }
+  const writer = writerNotKept(uses, returnsWithoutHiddenPointer);
+  if (writer !== null) {
+    fail(`${kept} cannot hold every writer — ${writer}`);
+  }
+  // A runtime index names no byte, so the rule below is asked of it at EVERY byte it may reach:
+  // all of them. Two indexed widths refuse here; an index beside a member of another width
+  // refuses after the members are checked against each other, so a member pair keeps naming its
+  // own byte (`indexedWidth` says why one width is enough).
+  const index = indexedWidth([...uses.indexed.values()].flat());
+  if (index.refusal !== null) {
+    fail(`a runtime index into ${kept} ${index.refusal}`);
+  }
+  // ONE TYPE PER BYTE, OR ONE UNION. agbcc at -O2 turns on type-based alias analysis
+  // (toplev.c:3616), and compiled, a `u32` read through a cast is served the earlier `u32` store
+  // straight past a `u16` store to the same bytes — a stale value. So a byte two accesses of
+  // different widths reach cannot be spelled through casts. A byte access is exempt, since
+  // character types alias everything, and so is a signedness difference, since the signed and
+  // unsigned types of one width share an alias set (c-common.c:1962-1974). The first audit asks
+  // for this answer rather than refusing two widths — an object read at both, or a `strh` member
+  // through the captured address over a word the slot model had — so this is where they are judged.
+  //
+  // What two widths at one byte CAN be spelled as is a UNION of per-width views, every access made
+  // directly through it (`sp0.half[1]`): c_get_alias_set gives any access through a member of a
+  // union alias set 0 (c-common.c, the COMPONENT_REF walk), which conflicts with every set, so no
+  // read moves past a store to the same bytes — compiled, a `u16` read, a `u32` store and the same
+  // read again reloads through the union and returns the stale value through casts. So the object
+  // is stamped with the views its accesses use (`unionViews`) and declared as that union
+  // (structure.ts `laddrType`), where every access to it is a fixed offset on the object itself,
+  // aligned to its own width — the cases `unionRefusal` names refuse as before.
+  const widthAt = new Map<number, number>();
+  let twoWidths: { b: number; had: number; width: number } | undefined;
+  for (const m of uses.members) {
+    if (m.at < from || m.at + m.width > to) {
+      fail(`an access of ${m.width} bytes at [sp,#${m.at}) reaches past ${kept}`);
+    }
+    if (m.width === 1) {
+      continue;
+    }
+    for (let b = m.at; b < m.at + m.width; b++) {
+      const had = widthAt.get(b);
+      if (had !== undefined && had !== m.width) {
+        twoWidths ??= { b, had, width: m.width };
+      }
+      widthAt.set(b, m.width);
+    }
+  }
+  if (twoWidths !== undefined) {
+    // any runtime index, a byte one too: `indexedWidth` leaves width 1 out because a char access
+    // agrees with every width, but a union view is still spelled for fixed offsets alone
+    const why = unionRefusal({ from, to, uses, indexed: uses.indexed.size > 0 });
+    if (why !== null) {
+      fail(
+        `the byte at [sp,#${twoWidths.b}] of ${kept} is accessed ${twoWidths.had} and ${twoWidths.width} bytes ` +
+          `wide, ${STALE_ACROSS_TYPES}, and ${why}`,
+      );
+    }
+  }
+  for (const [b, had] of widthAt) {
+    if (index.width !== null && had !== index.width) {
+      fail(
+        `the byte at [sp,#${b}] of ${kept} is accessed ${had} bytes wide and by a runtime index ${index.width} ` +
+          `bytes wide, ${STALE_ACROSS_TYPES}`,
+      );
+    }
+  }
+  // Rewritten onto one `laddr` at `from`: an access through a member at `k` becomes an access
+  // at `k - from` off the object, and a member address used any other way becomes the object's
+  // address moved by that constant.
+  //
+  // `volatile` goes on each ACCESS where the address was stored somewhere a writer may hold it
+  // (`publishedToWriter`): unqualified, a spin on a byte a holder of the address sets compiles to
+  // a loop that never reads it again. Never on the array: every member is spelled through a cast,
+  // whose pointee drops the array's qualifier, so it would reach no access and only make agbcc
+  // warn `discards qualifiers` wherever the bare array is named. A reader alone — a DMA source, a
+  // transfer's fill source (`filledFrom`) — changes no byte a re-read returns. KNOWN GAP: a
+  // callee that keeps the address it was handed, for an interrupt to write later, is a holder
+  // nothing here sees, so a spin on such a byte compiles unqualified; the per-object stamp has the
+  // same gap (`stampObjects`: not on an ordinary `&local` argument).
+  const reread = uses.publishedToWriter.size > 0;
+  // …and declared as SEVERAL objects where the accesses prove the bytes are several
+  // (`provenParts`), each rewritten on its own: an access through a member at `k` lands on the
+  // part that holds `k`, at `k` less the part's start. Only on a compiler that places address-
+  // taken arrays in a known order against their declarations (`addressTakenArrayOrder`): the
+  // parts are declared in that order, or the recompile swaps their addresses. And at a known
+  // alignment (`addressTakenArrayAlignment`), which says where a part may start.
+  const parts =
+    twoWidths === undefined && arrayOrder !== undefined && arrayAlignment !== undefined
+      ? provenParts({ from, to }, objects, uses, arrayAlignment)
+      : [{ from, to }];
+  // …stamped `part` where there are several: storage a copy proved one object of the source's, so
+  // its bytes are that object's elements rather than the one object's mix of members and spills,
+  // and the emitter may name them as elements (structure.ts `frameArrayElement`)
+  const laddrs = parts.map(({ from: lo, to: hi }) =>
+    mkOp('laddr', {
+      results: [mkValue(T.unk(32))],
+      attrs: { off: lo, width: 1, signed: false, count: hi - lo, ...(parts.length > 1 ? { part: true } : {}) },
+    }),
+  );
+  const partOf = (at: number) => parts.findIndex((p) => at >= p.from && at < p.to);
+  const object = laddrs[0];
+  const base = object.results[0];
+  const memberAt = new Map<Value, number>();
+  for (const op of [...objects.values()].flat()) {
+    memberAt.set(op.results[0], op.attrs.off as number);
+  }
+  const baseAt = (at: number) => laddrs[partOf(at)].results[0];
+  const startAt = (at: number) => parts[partOf(at)].from;
+  // The qualifier goes on every access the classification judged one (`accessOps`) — through a
+  // member, a runtime index into one, or a phi that carries one (`p = c ? buf : gOther; while
+  // (*p == 0);`). Only an access through a member is rebased: a phi's incoming member is
+  // rewritten below, where it is an edge argument.
+  const stillUsed = new Set<Value>();
+  for (const blk of irBlocks) {
+    for (const op of blk.ops) {
+      const at = memberAt.get(op.operands[0]);
+      const access = op.opcode === 'load' || op.opcode === 'store';
+      if (reread && uses.accessOps.has(op)) {
+        op.attrs = { ...op.attrs, volatile: true };
+      }
+      if (access && at !== undefined) {
+        op.operands = [baseAt(at), ...op.operands.slice(1)];
+        op.attrs = { ...op.attrs, off: (op.attrs.off as number) + at - startAt(at) };
+      }
+      op.operands.forEach((v) => memberAt.has(v) && stillUsed.add(v));
+      (op.successors ?? []).forEach((sx) => sx.args.forEach((v) => memberAt.has(v) && stillUsed.add(v)));
+    }
+  }
+  const atBase = (v: Value): Value => {
+    const at = memberAt.get(v);
+    return at !== undefined && at === startAt(at) ? baseAt(at) : v;
+  };
+  for (const blk of irBlocks) {
+    blk.ops = blk.ops.flatMap((op) => {
+      const at = op.opcode === 'laddr' ? memberAt.get(op.results[0]) : undefined;
+      if (at === undefined) {
+        op.operands = op.operands.map(atBase);
+        (op.successors ?? []).forEach((sx) => (sx.args = sx.args.map(atBase)));
+        return [op];
+      }
+      if (!stillUsed.has(op.results[0]) || at === startAt(at)) {
+        return [];
+      }
+      const by = mkValue(T.unk(32));
+      return [
+        mkOp('const', { results: [by], attrs: { value: at - startAt(at) } }),
+        mkOp('add', { operands: [baseAt(at), by], results: op.results }),
+      ];
+    });
+  }
+  if (twoWidths !== undefined) {
+    // …every access is now a fixed offset on the object itself, which is what a view spells; one
+    // that is not was carried there by a phi, as a pointer, and a pointer to the union's bytes is
+    // read through a cast again
+    for (const op of uses.accessOps.keys()) {
+      if (op.operands[0] !== base) {
+        fail(
+          `the bytes [sp,#${from}) to [sp,#${to}) are accessed at two widths, which only a union of views ` +
+            'spells without a stale read — and an access reaches them through a pointer a phi carries, which ' +
+            'no view of the union names',
+        );
+      }
+    }
+    object.attrs = { ...object.attrs, views: unionViews(irBlocks, base) };
+  }
+  irBlocks[0].ops.unshift(...(arrayOrder === 'descending' ? [...laddrs].reverse() : laddrs));
+}
+
+/** THE PARTS THE ACCESSES PROVE `[from, to)` IS MADE OF, lowest first — or the whole range, one
+ *  part, wherever they do not. A part is a maximal run of bytes that overlapping uses chain
+ *  together — a fixed-offset access, a struct passed by value, and an escape a standard block copy
+ *  with a literal count bounds (`escapeExtents`) each name the bytes they touch — and a run that
+ *  merely abuts the one below it starts a new part only where such a copy starts — and so must
+ *  the lowest part, or nothing is split. Two brace-initialised arrays side by side are agbcc's
+ *  `memcpy(a, .LC0, 16); memcpy(b, .LC2, 16)`, and declared as one `u8[32]` neither image can be
+ *  folded into its own local (l3/constinit.ts).
+ *
+ *  ONE PART, never a refusal, whenever a byte could be read through two parts: a runtime index
+ *  (it names no byte, so it may reach every one), an escape nothing bounds (a callee or a holder
+ *  that may reach any byte from the address it was given), a byte no use names (nothing says
+ *  which side it belongs to), or a use through a member that lands outside the part its own
+ *  address lies in (`&a[16]` read at [-1]: one pointer walking two parts is one object). The
+ *  union views of two widths at one byte are not split either (the caller asks only without
+ *  them). An access straddling two runs chains them into one part by construction. */
+function provenParts(
+  { from, to }: FrameRange,
+  objects: ReadonlyMap<number, readonly Op[]>,
+  uses: FrameUses,
+  alignment: number,
+): FrameRange[] {
+  const whole = [{ from, to }];
+  if (uses.indexed.size > 0) {
+    return whole;
+  }
+  const touched: { owner: number; lo: number; hi: number }[] = [];
+  for (const [op, { off }] of uses.accessOps) {
+    const at = off + (op.attrs.off as number);
+    touched.push({ owner: off, lo: at, hi: at + (op.attrs.width as number) });
+  }
+  for (const [off, reads] of uses.byValueReads) {
+    reads.forEach(({ type }) =>
+      touched.push({ owner: off, lo: off, hi: off + (type.kind === 'struct' ? (type.size ?? Infinity) : Infinity) }),
+    );
+  }
+  for (const [off, extents] of uses.escapeExtents) {
+    for (const e of extents) {
+      if (e === null) {
+        return whole;
+      }
+      touched.push({ owner: off, ...e });
+    }
+  }
+  // …and a boundary only where a bounded copy starts: an address handed to `memcpy` is where
+  // the source put an object it fills. A run starting anywhere else is bytes reached from below,
+  // which says nothing of where one object ends — the one-object relift reads every slot through
+  // an address of its own, so a struct spilled word by word and read through its base shows a
+  // run per word, and is one object at every word. The LOWEST part is held to the same test
+  // (below): where it is only stores, a copy above it is as likely `memcpy(&buf[4], s, 12)` into
+  // the middle of one array as the start of a second one, and declared as two the recompile
+  // reads `buf[6]` through a base it holds where the target re-formed sp+6. Only a copy's
+  // DESTINATION counts: a copy reading OUT of the frame says where the source took bytes from,
+  // which is as likely `memcpy(g, &w[2], 8)` from the middle of one array as a second object.
+  const starts = new Set([...uses.escapeExtents.values()].flat().flatMap((e) => (e?.into ? [e.lo] : [])));
+  const parts: { from: number; to: number }[] = [];
+  for (const { lo, hi } of [...touched].sort((a, b) => a.lo - b.lo)) {
+    const last = parts.at(-1);
+    if (last !== undefined && (lo < last.to || (lo === last.to && !starts.has(lo)))) {
+      last.to = Math.max(last.to, hi);
+    } else {
+      parts.push({ from: lo, to: hi });
+    }
+  }
+  const tiles =
+    parts.length > 1 &&
+    parts[0].from === from &&
+    parts.at(-1)!.to === to &&
+    parts.every((p, i) => i === 0 || parts[i - 1].to === p.from);
+  const partOf = (at: number) => parts.findIndex((p) => at >= p.from && at < p.to);
+  if (
+    !tiles ||
+    [...objects.keys()].some((off) => partOf(off) < 0) ||
+    touched.some(({ owner, lo }) => partOf(owner) !== partOf(lo))
+  ) {
+    return whole;
+  }
+  // …and a part starts only where the compiler places a local array of its own: at a multiple of
+  // its `alignment` (agbcc pads `u8 a[18]` to 20, so a split there declares `b` at sp+20 where the
+  // target had it at sp+18; gcc 2.7.2 on MIPS starts every one at a multiple of 8, so a part at
+  // sp+20 is placed at sp+24 and the frame grows), and never as ONE byte, which declared alone is
+  // a `u8` scalar whose address nothing takes — kept in a register, it drops the frame byte and
+  // the store the target made. Such a part joins the one below it, and the lowest one byte joins
+  // the one above: fewer parts only ever read as the one object does, so this costs a split,
+  // never a value.
+  const merged: { from: number; to: number }[] = [];
+  for (const p of parts) {
+    const last = merged.at(-1);
+    if (last !== undefined && (p.from % alignment !== 0 || p.to - p.from === 1 || last.to - last.from === 1)) {
+      last.to = p.to;
+    } else {
+      merged.push({ ...p });
+    }
+  }
+  return merged.length > 1 && merged.every((p) => starts.has(p.from)) ? merged : whole;
+}
+
+/** Why the one object's bytes, accessed at two widths, cannot be spelled as a union of per-width
+ *  views, or null. A view names an ELEMENT, so every access must sit at a multiple of its own width
+ *  from the object's start and every view must tile the object; and it names it at a constant
+ *  index, so a runtime index into the object — whose element width a view could carry, but whose
+ *  spelling nothing here builds — keeps the refusal, and so does a qualifier on the accesses
+ *  (`publishedToWriter`), which a member access of an unqualified union cannot carry. */
+function unionRefusal({
+  from,
+  to,
+  uses,
+  indexed,
+}: {
+  from: number;
+  to: number;
+  uses: FrameUses;
+  indexed: boolean;
+}): string | null {
+  if (indexed) {
+    return 'a runtime index reaches them too, which no view of a union is spelled for';
+  }
+  if (uses.publishedToWriter.size > 0) {
+    return 'the address is stored where a writer may hold it, and a view of a union carries no per-access qualifier';
+  }
+  for (const m of uses.members) {
+    if ((m.at - from) % m.width !== 0) {
+      return `the ${m.width}-byte access at [sp,#${m.at}) is not aligned to its width, so no view of a union names it`;
+    }
+    if ((to - from) % m.width !== 0) {
+      return `the ${to - from} bytes are not a whole number of ${m.width}-byte elements, so no view of a union tiles them`;
+    }
+  }
+  return null;
+}
+
+/** The views a union object's accesses use, as `laddr`'s `views` attr: one entry per view, its
+ *  element width in bytes, NEGATIVE for a signed narrow view — which views, by the rule
+ *  raise/structs.ts declares a struct member's union by (ir/types.ts `unionViewSigns`). A word's
+ *  one view is `s32` whichever sign it carries, so it is entered unsigned. Widest first, unsigned
+ *  before signed. */
+function unionViews(irBlocks: readonly Block[], base: Value): number[] {
+  const byWidth = new Map<number, { isLoad: boolean; signed: boolean; stamped: boolean }[]>();
+  for (const op of irBlocks.flatMap((b) => b.ops)) {
+    if ((op.opcode === 'load' || op.opcode === 'store') && op.operands[0] === base) {
+      const w = op.attrs.width as number;
+      (byWidth.get(w) ?? byWidth.set(w, []).get(w)!).push({
+        isLoad: op.opcode === 'load',
+        signed: (op.attrs.signed as boolean) ?? false,
+        stamped: op.opcode === 'store' && op.attrs.signed !== undefined,
+      });
+    }
+  }
+  return [...byWidth]
+    .sort(([a], [b]) => b - a)
+    .flatMap(([w, accesses]) => unionViewSigns(w, accesses).map((sg) => (sg && w !== 4 ? -w : w)));
+}
+
+/** One object's shape: `count` elements of `width` bytes. */
+interface ObjectShape {
+  readonly width: number;
+  readonly count: number;
+}
+
+/** The per-object model's reading of every object. */
+interface ObjectShapes {
+  readonly extent: ReadonlyMap<number, ObjectShape>;
+  /** the declared struct each return temp is, by offset */
+  readonly aggregateAt: ReadonlyMap<number, IrType>;
+  /** each object over a slot the slot model keys, as `[off, width]`, refused last (`failIfSlotKeysIt`) */
+  readonly overSlot: readonly (readonly [number, number])[];
+}
+
+const span = (o: ObjectShape) => o.width * o.count;
+
+function slotKeys(usedSlotOffsets: ReadonlySet<number>, off: number, width: number): boolean {
+  return [...usedSlotOffsets].some((slot) => overlaps(off, width, slot, 4));
+}
+
+/** The SHAPE of each object — `count` elements of `width` bytes, spanning `width * count` —
+ *  and then that its bytes belong to nothing else.
+ *
+ *  AN OBJECT OVER A SLOT IS REFUSED LAST, after the one-object answer is asked: that answer
+ *  routes every word of the local area through `laddr`, so no slot is left for the object to
+ *  overlap, and refusing first would decline exactly the frames it exists for — an object at
+ *  [sp,#0] whose first member is a word stored `str rN, [sp]`, or a by-value struct parameter
+ *  spilled word by word and read through `mov rD, sp` where nothing escapes. The other per-object
+ *  refusals here go through `shapeRefused`, for the same reason: where nothing escapes, each of
+ *  them asks for that answer too (`chooseFrameModel`). */
+function objectShapes({
+  objects,
+  uses,
+  owned,
+  declared,
+  usedSlotOffsets,
+  returnsWithoutHiddenPointer,
+  model,
+  fail,
+}: {
+  objects: ReadonlyMap<number, readonly Op[]>;
+  uses: FrameUses;
+  owned: FrameRange;
+  declared: FrameRange;
+  usedSlotOffsets: ReadonlySet<number>;
+  returnsWithoutHiddenPointer: (callee: string) => boolean;
+  model: ModelChoice;
+  fail: Refuse;
+}): ObjectShapes {
+  const extent = new Map<number, ObjectShape>();
+  const aggregateAt = new Map<number, IrType>();
+  const overSlot: [number, number][] = [];
+  for (const [off, acc] of uses.accesses) {
+    const byIndex = uses.indexed.get(off) ?? [];
+    const temps = uses.returnTemps.get(off);
+    const passed = uses.byValueReads.get(off);
+    if (passed !== undefined) {
+      // A struct passed BY VALUE (`foldByValueArgs`): this function writes and reads its members,
+      // and the call reads it whole. A struct-return temp passed on, an index, or any other use of
+      // the address is not modelled.
+      const type = passed[0].type;
+      const at = `the object at [sp,#${off}) is passed by value as ${structSpelling(type)}`;
+      if (temps !== undefined) {
+        fail(`${at}, and is also the storage a call returns a struct into — not modelled`);
+      }
+      if (passed.some((p) => !typeEquals(p.type, type))) {
+        fail(`${at} to calls declared to take different types`);
+      }
+      if (byIndex.length > 0) {
+        fail(`${at}, and this function also indexes it — only its members' accesses are modelled`);
+      }
+      if (uses.useCount.get(off) !== acc.length + passed.length) {
+        fail(`${at}, and its address is also used another way — only its members' accesses are modelled`);
+      }
+      const size = type.kind === 'struct' ? type.size! : 0;
+      const past = uses.fixed.find(
+        (f) => uses.accessOps.get(f.op)?.off === off && (f.at < off || f.at + f.width > off + size),
+      );
+      if (past !== undefined) {
+        fail(`${at}, and this function accesses [sp,#${past.at}) of width ${past.width}, past the struct`);
+      }
+      extent.set(off, { width: 1, count: size });
+      aggregateAt.set(off, type);
+      continue;
+    }
+    if (temps !== undefined) {
+      // The callee writes the whole struct and this function names it as the call's destination,
+      // and READS it: each load is of bytes inside the struct, which the struct's declaration
+      // types (raise/aggmembers.ts reads a word's members, structure.ts spells a member access).
+      // A write, an index, or any other use of the address is not modelled.
+      const callee = temps[0].attrs.target as string;
+      const type = temps[0].results[0].type;
+      const spelling = type.kind === 'struct' ? (type.declared ?? `struct ${type.name}`) : typeToString(type);
+      const at = `the object at [sp,#${off}) is where \`${callee}\` returns ${spelling}`;
+      if (temps.some((t) => !typeEquals(t.results[0].type, type))) {
+        fail(`the object at [sp,#${off}) is the struct-return storage of calls declared to return different types`);
+      }
+      if (acc.some((a) => !a.isLoad) || byIndex.length > 0) {
+        fail(
+          `${at}, and this function also ${byIndex.length > 0 ? 'indexes' : 'writes'} it — only a read of a ` +
+            'returned struct is modelled',
+        );
+      }
+      if (uses.useCount.get(off) !== temps.length + acc.length) {
+        fail(`${at}, and its address is also used another way — only the call it is returned by is modelled`);
+      }
+      const size = returnedSize(temps[0]);
+      const past = uses.fixed.find(
+        (f) => uses.accessOps.get(f.op)?.off === off && (f.at < off || f.at + f.width > off + size),
+      );
+      if (past !== undefined) {
+        fail(`${at}, and this function reads [sp,#${past.at}) of width ${past.width}, past the struct`);
+      }
+      extent.set(off, { width: 1, count: returnedSize(temps[0]) });
+      aggregateAt.set(off, type);
+      continue;
+    }
+    if (acc.length === 0) {
+      // An object with no access of its own has no declared type and no extent, and the two
+      // ways it gets there are two different gaps. Its bytes may already be keyed by the slot
+      // model, which one byte is enough to decide; otherwise nothing in-function pins it at
+      // all, and a guessed declaration is the plausible-but-wrong class.
+      if (slotKeys(usedSlotOffsets, off, 1)) {
+        overSlot.push([off, 1]);
+        continue;
+      }
+      const why = notTheWholeArea(off, byIndex.length > 0, {
+        objects,
+        uses,
+        declared,
+        returnsWithoutHiddenPointer,
+      });
+      if (why !== null) {
+        model.shapeRefused(
+          (byIndex.length > 0
+            ? 'the captured address is addressed only through a runtime index'
+            : 'the captured address is never dereferenced in this function') +
+            `, so nothing pins the local object type — and ${why}`,
+        );
+        // …asked for the one object instead, which sizes no object of its own
+        continue;
+      }
+      // An indexed access reads THROUGH A CAST on the storage declared below, at its own width
+      // and signedness, as an access to the one object does (`keepAsOneObject`), so the accesses
+      // wider than a byte must be of one width, one alias set (`indexedWidth`).
+      const index = indexedWidth(byIndex);
+      if (index.refusal !== null) {
+        model.shapeRefused(`a runtime index into the object at [sp,#${off}) ${index.refusal}`);
+      }
+      // STORAGE, NOT A TYPE. The reservation says how many bytes the frame holds and the
+      // conjuncts above say they are all this object's, so the declaration commits to an EXTENT
+      // and to nothing else: `u8 name[n]` over the declared range, unsigned bytes because no
+      // access named an element type and inventing one is the guess this refuses everywhere else.
+      // An indexed access names only its own width, which its cast spells where it reads.
+      //
+      // THE EXTENT IS A ROUNDED ONE, stated because it is not a defect. agbcc reserves the
+      // local area in whole words, so a source object of 13, 14, 15 or 16 bytes all reserve
+      // sixteen — compiled and diffed at the row's own flags, `u8 x[0xD]` and `u8 x[0x10]`
+      // reach the same object where `u8 x[0xC]` and `u8 x[0x11]` do not. What is declared is
+      // the RESERVATION, which is the thing the asm carries; every source extent inside one
+      // word of it emits the same object, so no member of that class is more right than this.
+      //
+      // NO COMPILER TERM, unlike `capturedObjectIsTheWholeFrame`, whose one-word reading is a
+      // fact about what agbcc puts in a four-byte frame. This argument needs only that the
+      // reservation ROUNDS UP to some granularity, which is a property of every stack ABI, and
+      // it declares the reservation rather than a guess inside it — so a coarser rounding makes
+      // the declared extent coarser too, never wrong about the bytes the machine reserved.
+      extent.set(off, { width: 1, count: declared.to - declared.from });
+      continue;
+    }
+    if (byIndex.length > 0) {
+      model.shapeRefused(
+        `a runtime index into the object at [sp,#${off}), which an access of its own types as one ` +
+          'scalar — only the untyped storage of the whole declared area is indexed',
+      );
+    }
+    const widths = new Set(acc.map((a) => a.width));
+    if (widths.size > 1) {
+      model.shapeRefused(`the accesses through the captured address disagree on width (${[...widths].join(' vs ')})`);
+    }
+    // …and on SIGNEDNESS, over the loads, for the same reason: one declared type extends one
+    // way, so an object read by both `ldrsb` and `ldrb` has no faithful declaration —
+    // `sp4 - sp4` would fold to 0 where the machine computes sext(b) - zext(b). Loads only: a
+    // store extends nothing, and `strb` beside `ldrsb` is not a disagreement.
+    const signs = new Set(acc.filter((a) => a.isLoad).map((a) => a.signed));
+    if (signs.size > 1) {
+      model.shapeRefused(
+        'the loads through the captured address disagree on signedness — one declared type extends one way',
+      );
+    }
+    // …and a scalar this function only READS is the callee's to fill, which is what a struct
+    // return's hidden temp is: agbcc spells `s = mk(x)` above an outgoing block as `add r0, sp,
+    // #0x4 / bl mk / ldr r0, [sp, #0x4]`, instruction for instruction an out-parameter call. The
+    // question the whole-frame and untyped arms ask, asked of every object.
+    const whyItStands = acc.some((a) => !a.isLoad)
+      ? null
+      : hiddenReturnPointerStands(off, uses.arg0Callees, returnsWithoutHiddenPointer);
+    if (whyItStands !== null) {
+      fail(`the object at [sp,#${off}) is never written here, and ${whyItStands}`);
+    }
+    extent.set(off, { width: acc[0].width, count: 1 });
+  }
+  // Each object must own its bytes outright: inside the reserved local area, clear of every SSA
+  // slot (`overSlot`, refused last), and clear of every other object.
+  const objs = [...extent].sort((x, y) => x[0] - y[0]);
+  for (const [off, obj] of objs) {
+    if (off < owned.from || off + span(obj) > owned.to) {
+      fail(`the object at [sp,#${off}) of width ${span(obj)} lies outside the reserved local area`);
+    }
+    if (slotKeys(usedSlotOffsets, off, span(obj))) {
+      overSlot.push([off, span(obj)]);
+    }
+  }
+  for (let i = 1; i < objs.length; i++) {
+    const [off, obj] = objs[i];
+    const [prev, prevObj] = objs[i - 1];
+    if (overlaps(prev, span(prevObj), off, span(obj))) {
+      model.shapeRefused(`the objects at [sp,#${prev}) and [sp,#${off}) overlap — one byte, two models`);
+    }
+  }
+  return { extent, aggregateAt, overSlot };
+}
+
+/** THE FRAME RESERVATION IS AN EXTENT, when the declared local area is provably one object's alone.
+ *  `add sp, sp, #-0x10` reserves sixteen bytes; if exactly one address-taken object sits at the
+ *  bottom of the DECLARED part of them and the slot model keys none of that part (`overSlot`, which
+ *  `objectShapes` asks of every extent), then there is nothing else those bytes can be — a
+ *  compiler does not reserve frame for nothing. That is the frame-accounting equation the escape
+ *  rules (`FRAME_ESCAPE_GATES`) already solve word by word, asked in the other direction: they
+ *  check that the objects and slots TILE the reserved area, this reads the declared range off as
+ *  the one object's size.
+ *
+ *  THE DECLARED RANGE, NOT THE OWNED ONE. Below `declared.from` lies the outgoing stack-argument
+ *  block `analyzeOutgoingArgs` licensed — arguments 5+ of this function's calls, which C stages
+ *  and never declares — so those bytes are not this object's, and the slots keyed there are those
+ *  arguments. The escape gates read the frame the same way: `reaches-a-slot` looks no lower than
+ *  `declared.from`, and `reaches-an-unaccounted-word` counts the argument words as accounted.
+ *  agbcc lays its locals out like this (ACCUMULATE_OUTGOING_ARGS 1, STARTING_FRAME_OFFSET 0,
+ *  thumb.h): `struct S t; f(&t, b, c, d, e, g, h, i)` with an 8-byte `S` reserves 0x18, stages
+ *  the four argument words at [sp,#0..#0xc] and puts `t` at [sp,#0x10]. The block is LICENSED by
+ *  construction: one not stored on every path is `analyzeOutgoingArgs`'s own blocker, which turns
+ *  the slot model off, and every `laddr` mint is behind `slotsOk`.
+ *
+ *  Returns why it does not apply, or null. Every clause refuses in its own words: the reason an
+ *  acceptance did not fire is as much an attribution as the reason a lift declined, and one
+ *  sentence covering all of them is how several gaps come to look like one.
+ *
+ *  FOUR CLAUSES BOUND THIS PATH — a second object, an object that does not start at the bottom of
+ *  the declared area, an address that reaches memory rather than a callee, and the callee's
+ *  declared return — and each has a test that fails without it. A fifth return, the precautionary
+ *  one marked where it sits, has none.
+ *
+ *  The last two are about an ESCAPE (`wholeAreaEscapeRefusal`), and they are asked only of an
+ *  object that escapes or that nothing in this function addresses. An object this function indexes
+ *  and never lets go of is written and read by its own indexed accesses alone, so the reservation
+ *  is all there is to size it by: `u8 a[8]; for (j = 0; j < 8; j++) a[j] = tbl[j]; return a[i];`. */
+function notTheWholeArea(
+  off: number,
+  indexedHere: boolean,
+  {
+    objects,
+    uses,
+    declared,
+    returnsWithoutHiddenPointer,
+  }: {
+    objects: ReadonlyMap<number, readonly Op[]>;
+    uses: FrameUses;
+    declared: FrameRange;
+    returnsWithoutHiddenPointer: (callee: string) => boolean;
+  },
+): string | null {
+  if (objects.size !== 1) {
+    return 'another address-taken object shares the frame, so the reservation is not this one alone';
+  }
+  if (off !== declared.from || declared.to <= declared.from) {
+    return 'the object does not start at the bottom of the declared area, so something below it is unaccounted for';
+  }
+  // PRECAUTIONARY for an object nothing indexes: an address that neither accesses nor escapes
+  // already declines where the audit classifies its uses ("flows into `ret`"), so it never arrives
+  // here unescaped. Kept because storage declared with no writer is a SILENT wrong answer.
+  if (!uses.escaped.has(off)) {
+    return indexedHere
+      ? null
+      : 'the address never leaves this function, so there is no writer of the storage to size it for';
+  }
+  return wholeAreaEscapeRefusal(off, uses, returnsWithoutHiddenPointer);
+}
+
+/** Why the escape of the address at `off` is not one the WHOLE-AREA argument holds, or null. That
+ *  argument — the object is every byte of the declared area, so whatever a holder of the address
+ *  does through it lands on bytes one declaration owns — is made twice: for one untyped object
+ *  (`notTheWholeArea`) and for the one object several captures are members of (`writerNotKept`).
+ *  It needs a callee to have been handed the address as an argument, the one holder this frontend
+ *  can name; an address that only reached memory has none. A store of the address beside that
+ *  call is held with it, whether to an ordinary global or into a device's source register — and
+ *  where the store hands the address to something that may write through it (`publishedToWriter`),
+ *  only when that callee may write through it too: a bounded block transfer reading its source
+ *  names no writer.
+ *
+ *  The frame's SIZE changes nothing about whose storage it is, so the hidden-pointer question is
+ *  the one the one-word arm asks, asked here of the same callees. */
+function wholeAreaEscapeRefusal(
+  off: number,
+  uses: FrameUses,
+  returnsWithoutHiddenPointer: (callee: string) => boolean,
+): string | null {
+  if (!uses.passedToCallee.has(off)) {
+    return 'the address is published rather than passed as an argument, and nothing declares what reads it';
+  }
+  if (uses.publishedToWriter.has(off) && !uses.passedToWriter.has(off)) {
+    return (
+      'the address is published, and the only callee handed it is a block transfer that reads through it, ' +
+      'so nothing declares what reads it'
+    );
+  }
+  return hiddenReturnPointerStands(off, uses.arg0Callees, returnsWithoutHiddenPointer);
+}
+
+/** Every escaped object as the rules an escape retracts read it (`FRAME_ESCAPE_GATES`), computed
+ *  ONCE, with whether the escape may write and how it left, so a new bound — a callee's declared
+ *  extent — has one place to go. */
+function frameEscapes({
+  irBlocks,
+  uses,
+  windows,
+  shapes: { extent },
+  owned,
+  declared,
+  usedSlotOffsets,
+}: {
+  irBlocks: readonly Block[];
+  uses: FrameUses;
+  windows: ReadonlyMap<number, ReadWindow>;
+  shapes: ObjectShapes;
+  owned: FrameRange;
+  declared: FrameRange;
+  usedSlotOffsets: ReadonlySet<number>;
+}): FrameEscape[] {
+  const undefSlots = irBlocks
+    .flatMap((blk) => blk.ops.filter((op) => op.opcode === 'undef'))
+    .map((op) => slotKeyOffset(op.attrs.key as string))
+    .filter((slot) => slot !== null)
+    .sort((x, y) => x - y);
+  const accountedWords = new Set<number>();
+  for (const [off, obj] of extent) {
+    for (let w = off - (off % 4); w < off + span(obj); w += 4) {
+      accountedWords.add(w);
+    }
+  }
+  for (const slot of usedSlotOffsets) {
+    accountedWords.add(slot - (slot % 4));
+  }
+  const unaccountedIn = (lo: number, hi: number): number | undefined => {
+    for (let w = owned.from; w < owned.to; w += 4) {
+      if (!accountedWords.has(w) && w < hi && w + 4 > lo) {
+        return w;
+      }
+    }
+    return undefined;
+  };
+  const escapes: FrameEscape[] = [];
+  for (const off of uses.escaped) {
+    const { lo, hi, why } = windows.get(off)!;
+    const writes = mayWrite(uses, off);
+    const objectReached = [...extent].find(([o, obj]) => o !== off && o < off + hi && off + lo < o + span(obj));
+    let slotReached: FrameEscape['slotReached'];
+    for (const slot of usedSlotOffsets) {
+      if (slot > off && slot < off + hi) {
+        slotReached = { slot, above: true };
+        break;
+      }
+      if (slot < off && slot >= declared.from && slot + 4 > off + lo) {
+        slotReached = { slot, above: false };
+        break;
+      }
+    }
+    escapes.push({
+      off,
+      lo,
+      hi,
+      writes,
+      how: uses.passedToCallee.has(off)
+        ? 'is passed to a callee'
+        : writes
+          ? 'is stored to memory'
+          : `is handed to a device ${why}`,
+      objectReached: objectReached?.[0],
+      slotReached,
+      undefReached: undefSlots.find((slot) => slot < off + hi && slot + 4 > off + lo),
+      unaccountedWord: unaccountedIn(off + lo, off + hi),
+    });
+  }
+  return escapes;
+}
+
+function escapeRefusal(id: string, e: FrameEscape): string {
+  const at = `the captured address at [sp,#${e.off}) ${e.how}`;
+  switch (id) {
+    case 'reaches-another-object':
+      return e.lo === -Infinity && e.hi === Infinity
+        ? 'the captured address escapes, so something outside this function reaches the whole frame — including another object'
+        : `${at}, which may read the object at [sp,#${e.objectReached})`;
+    case 'writer-over-undef':
+      return e.lo === -Infinity && e.hi === Infinity
+        ? 'the captured address escapes, so a callee may write any frame offset and an unstored slot is not provably uninitialised'
+        : `${at}, which may write the slot at [sp,#${e.undefReached}] — an unstored slot it reaches is not provably uninitialised`;
+    case 'reaches-a-slot':
+      return !e.slotReached!.above
+        ? `${at}, and it may point INTO an object that starts lower — the slot at [sp,#${e.slotReached!.slot}] below it is kept in a register, not the frame`
+        : e.writes
+          ? `${at}, which may write the slot at [sp,#${e.slotReached!.slot}] — this function's own store there would be forwarded past the write`
+          : `${at}, which may read the slot at [sp,#${e.slotReached!.slot}] — this function's own store there is kept in a register, not the frame`;
+    default:
+      return (
+        `the word at [sp,#${e.unaccountedWord}] is neither an object this lift models nor a slot it keys, ` +
+        `and the captured address reaches something that may ${e.writes ? 'write' : 'read'} it — nothing accounts for the ` +
+        "rest of the frame, so nothing bounds the captured object's extent"
+      );
+  }
+}
+
+/** Proven. Stamp the MACHINE FACTS the audit established — width and signedness are what the
+ *  accesses used, so the declaration downstream is a fact, not a guess. The C-level NAME is
+ *  deliberately NOT chosen here: identifiers live in the structurer's namespace (params,
+ *  locals, globals, the symbol map), which the frontend cannot see — a frontend-chosen `sp0`
+ *  silently shadowed a project global of the same name.
+ *  `volatile` iff the address is PUBLISHED — written to memory, rather than handed to a
+ *  callee. That is the DMA idiom this rule was written for and it IS the source's own
+ *  spelling there: klonoa's `DMA_FILL` writes `vu##bit tmp` outright, sa3's does under
+ *  `PLATFORM_GBA`, pokeemerald's inside `DMA_FILL_UNCHECKED`, and the address goes to a device
+ *  register through a store. Reproducing that source means reproducing the qualifier.
+ *
+ *  …and iff it is the FIXED source of a block transfer (`filledFrom`), the same idiom through a
+ *  BIOS call: every fill macro writes `vu##bit tmp = value; CpuSet((void *)&tmp, …)` (sa3's
+ *  cpuset_macros.h, pokeemerald's macro.h). Compiled, the plain spelling is not the same
+ *  program: a `u16` parameter stored to a plain `u16 tmp` loses its `lsl`/`lsr` pair, and the
+ *  pool loads around the call reorder.
+ *
+ *  NOT on an ordinary `&local` ARGUMENT, where no source in the corpus writes one and the
+ *  qualifier is not free. `void f(u32 i){ s32 w; w = gEnts[i].h; use(&w); four(w,w,w,w); }`
+ *  compiles to one `ldr` reloaded into four registers by copies; the structurer emits one C
+ *  read per USE rather than per machine load, so `volatile` forbids the CSE and makes it four
+ *  `ldr`s — a byte-exact candidate turned into a four-instruction nonmatch (compiled, agbcc
+ *  2.9-arm-000512, `-O2 -mthumb-interwork -Wimplicit -fhex-asm -fprologue-bugfix`). It is free
+ *  only where the object is read at most once, which is all the rows that first shipped it
+ *  did. agbcc also warns `discards qualifiers` at every such call.
+ *
+ *  NOT because gcc would otherwise delete the store. That claim was here for several releases
+ *  and does not reproduce: taking `&tmp` makes the local addressable, so gcc-2.9 keeps the
+ *  store with or without the qualifier, measured on store-then-escape, publish-then-fill, and
+ *  a loop that stores and escapes each iteration. What the qualifier does change is register
+ *  ALLOCATION — the same function compiled `vu16` and `u16` is 98 instructions either way and
+ *  differs in three register assignments — which is why it still has to be right. asmlift's
+ *  OWN dead-store pass keys on address-taken, not on the qualifier (l3/dce.ts), so dropping the
+ *  qualifier here cannot cost a store.
+ *
+ *  An object whose address never leaves the function needs no volatile and must not pay it.
+ *
+ *  AN UNTYPED OBJECT REACHES THIS RULE TOO, where the address is both published and handed to
+ *  a callee whose return is declared. It cannot pay the price above — that price is a read the
+ *  compiler may no longer fold, and an object with no access in this function has none —
+ *  compiled at the corpus's flags, the qualified and plain spellings are byte-identical and
+ *  differ in two `discards qualifiers` warnings. So the rule is the same rule, and the reason
+ *  it is free here is not the reason it is free on a scalar read once. */
+function stampObjects(
+  objects: ReadonlyMap<number, readonly Op[]>,
+  { extent, aggregateAt }: ObjectShapes,
+  uses: FrameUses,
+): void {
+  for (const [off, ops] of objects) {
+    const { width, count } = extent.get(off)!;
+    const aggregate = aggregateAt.get(off);
+    // a declared struct's storage is bytes, whatever signedness its members are read at
+    const signed = aggregate === undefined && uses.accesses.get(off)!.some((a) => a.signed);
+    for (const op of ops) {
+      const qualified = uses.published.has(off) || uses.filledFrom.has(off);
+      op.attrs = {
+        ...op.attrs,
+        width,
+        signed,
+        count,
+        ...(qualified ? { volatile: true } : {}),
+        ...(aggregate !== undefined ? { aggregate: true } : {}),
+      };
+      // a return temp's address points at the struct the call returns
+      if (aggregate !== undefined) {
+        op.results[0].type = T.ptr(aggregate);
+      }
+    }
+  }
+  // The declaration carries the qualifier to an access spelled through the object's own name, and
+  // not to one through a phi that carries its address: that phi is a pointer local typed from the
+  // access, so `p = c ? &b : gOther; while (*p == 0);` would compile to a loop that never reads
+  // `b` again. Such an access carries the qualifier itself.
+  for (const [op, { off, through }] of uses.accessOps) {
+    const own = objects.get(off)!.some((o) => o.results[0] === through);
+    if (!own && (uses.published.has(off) || uses.filledFrom.has(off))) {
+      op.attrs = { ...op.attrs, volatile: true };
+    }
+  }
+}
+
+function gcd(a: number, b: number): number {
+  return b === 0 ? Math.abs(a) : gcd(b, a % b);
+}
+
+/** The size of the struct a call stamped `sret` returns through its argument 0 (frontend/call-plan.ts
+ *  types the call's result as that struct, for every frontend whose lowering passes the pointer). */
+function returnedSize(call: Op): number {
+  const t = call.results[0].type;
+  if (t.kind !== 'struct' || t.size === undefined) {
+    throw new Error(`a call stamped sret returns ${typeToString(t)}, not a laid-out struct`);
+  }
+  return t.size;
+}
+
+/** The block parameters every incoming value of which is a local's address or another such
+ *  parameter: the greatest set closed under that, so a loop-carried address is one too. Each maps to
+ *  the frame offsets its incoming addresses name, through such parameters. The entry block's are the
+ *  function's parameters, and are left out. */
+function mergedFrameAddresses(irBlocks: readonly Block[]): Map<Value, ReadonlySet<number>> {
+  const laddrOff = new Map<Value, number>();
+  for (const op of irBlocks.flatMap((b) => b.ops)) {
+    if (op.opcode === 'laddr') {
+      laddrOff.set(op.results[0], op.attrs.off as number);
+    }
+  }
+  const incoming = new Map<Value, Value[]>();
+  for (const b of irBlocks.slice(1)) {
+    for (const p of b.params) {
+      incoming.set(p, []);
+    }
+  }
+  for (const op of irBlocks.flatMap((b) => b.ops)) {
+    for (const succ of op.successors) {
+      succ.block.params.forEach((p, i) => incoming.get(p)?.push(succ.args[i]));
+    }
+  }
+  const merged = new Set([...incoming].filter(([, vs]) => vs.length > 0).map(([p]) => p));
+  for (let changed = true; changed;) {
+    changed = false;
+    for (const p of merged) {
+      if (incoming.get(p)!.some((v) => !laddrOff.has(v) && !merged.has(v))) {
+        merged.delete(p);
+        changed = true;
+      }
+    }
+  }
+  const out = new Map<Value, ReadonlySet<number>>();
+  for (const p of merged) {
+    const offs = new Set<number>();
+    const seen = new Set<Value>([p]);
+    const work = [p];
+    while (work.length > 0) {
+      for (const v of incoming.get(work.pop()!)!) {
+        if (laddrOff.has(v)) {
+          offs.add(laddrOff.get(v)!);
+        } else if (!seen.has(v)) {
+          seen.add(v);
+          work.push(v);
+        }
+      }
+    }
+    out.set(p, offs);
+  }
+  return out;
+}
+
+/** A STRUCT RETURNED THROUGH A MERGE OF ONE LOCAL'S ADDRESS IS THAT LOCAL. gcc rotates a loop that
+ *  calls a struct-returning function, `while (lo > 0) { qr = ldiv(lo, 10); … }`, so `addiu a0,sp,16`
+ *  runs once ahead of the loop and once in the delay slot of its back branch, and hoists it into
+ *  both arms of `if (x) a = f(x); else a = f(x + 1);` ahead of one shared `jal`. The call then
+ *  reads a block parameter, but every path hands it the same frame address, so the call is handed
+ *  that address: an `laddr` of it, minted ahead of the call, which the frame-object audit types as
+ *  the struct (`declaredStructs`) and `refuseSretOutsideFrame` accepts. A merge of two offsets is
+ *  two objects, and is left for the audit to refuse. Run before the audit, on every frontend whose call
+ *  lowering passes the hidden pointer. */
+export function nameMergedSretObjects(irBlocks: Block[]): void {
+  const merged = mergedFrameAddresses(irBlocks);
+  for (const b of irBlocks) {
+    b.ops = b.ops.flatMap((op) => {
+      const offs = op.opcode === 'call' && op.attrs.sret === true ? merged.get(op.operands[0]) : undefined;
+      if (offs === undefined || offs.size !== 1) {
+        return [op];
+      }
+      const at = mkValue(T.unk(32));
+      op.operands = [at, ...op.operands.slice(1)];
+      return [mkOp('laddr', { results: [at], attrs: { off: [...offs][0] } }), op];
+    });
+  }
+}
+
+/** A STRUCT RETURNED THROUGH MEMORY IS SPELLED `local = f(..)`, which hands the callee that local's
+ *  address: the hidden pointer must be a frame object the audit accepted. A global or a pointer
+ *  handed over directly — `gS = f(..)` (agbcc, ido, gcc), IDO's `*p = f(..)`, and the caller's own
+ *  hidden pointer forwarded by `return f(..)` — is another spelling, which nothing here states. A
+ *  merge of frame addresses never reaches here: one that names one address on every path was handed
+ *  that address's `laddr` before the audit (`nameMergedSretObjects`), and a merge of two names no one
+ *  storage, which the audit refuses first (`addressFlow`: `a phi merges the frame objects`). Asked
+ *  of every frontend whose call lowering passes the hidden pointer
+ *  (`CallLowering.memoryReturn`). */
+export function refuseSretOutsideFrame(name: string, irBlocks: readonly Block[], target: TargetDescription): void {
+  const laddrs = new Set(
+    irBlocks.flatMap((b) => b.ops.filter((op) => op.opcode === 'laddr').map((op) => op.results[0])),
+  );
+  for (const op of irBlocks.flatMap((b) => b.ops)) {
+    if (op.opcode === 'call' && op.attrs.sret === true && !laddrs.has(op.operands[0])) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': \`${op.attrs.target as string}\` returns struct ${typeToString(op.results[0].type)} through the pointer in ${target.argRegs[0]}, ` +
+          'and that pointer is not the address of a local of this frame — a struct returned into a global or ' +
+          'through a pointer is not modelled',
+      );
+    }
+  }
+}
+
+/** THE CALLER-SIDE SEAM. A frontend calls the audit THROUGH this record rather than through the
+ *  `auditFrameObjects` binding, so a process outside core can put a wrapped `gates` table in front of a real
+ *  lift (`pnpm bench gates --pass frame-objects`): a module-namespace binding is read-only and
+ *  cannot be swapped (`apps/benchmark/src/run/gate-census.ts`, WHAT PUTS A PASS IN THE REGISTRY). */
+export const FRAME_OBJECT_AUDIT: { run: (audit: FrameObjectAudit) => FrameObjectVerdict } = {
+  run: (audit) => auditFrameObjects(audit),
+};
+
+/** Internal surface for this module's own tests, and for nothing else. `@asmlift/core` exports
+ *  every source path under `./*`, so a plain `export` here would put the audit's stages into the
+ *  package's public API, where no consumer should be able to depend on them. The name says what it
+ *  is; nothing in `src` reads it. */
+export const __testing = {
+  frameRefusal,
+  foldMovedCaptures,
+  frameAddressFacts,
+  splitAddressingCopies,
+  frameObjects,
+  addressFlow,
+  classifyFrameUses,
+  opPositions,
+  escapeWindows,
+  readWindow,
+  chooseFrameModel,
+  objectShapes,
+  frameEscapes,
+};