@asmlift/core 0.8.1 → 0.10.0

package/src/frontend/mips.ts

@@ -7,9 +7,11 @@
 // EXCEPT that a conditional branch reads its comparison operands as of the branch, so those
 // SSA values are captured BEFORE the delay slot runs, then the delay slot executes, then the
 // `cond_br` is emitted. A `jr ra` return's delay slot (which computes the return value) runs
-// first, then the value is read. Branch-likely ops (`beql`/`bnel`…, which annul the delay slot
-// when not taken) and calls (`jal`) are out of scope — both loud-fail (the control-transfer
-// pre-scan in `lift`).
+// first, then the value is read. A call's (`jal`) delay slot runs before the call, so it can set
+// an argument up. A branch-likely (`beql`/`bnel`…) annuls its slot when not taken, so the slot is
+// a block of its own on the taken edge (`toBlocks`) — unless it is a copy of the word before the
+// target, when the branch is retargeted there with an empty slot (`normaliseBranchLikely`, which
+// does the same for a `b`/`j` whose slot is that copy).
 //
 // Comparison model: MIPS fuses compare-and-branch, so a branch lowers directly to an icmp
 // (the branch mnemonics are signed/equality only). `bltz/bgez/blez/bgtz` compare against zero; `beq/bne`
@@ -18,14 +20,21 @@
 // with no consuming branch (e.g. `return a>b` → `slt v0,a1,a0`) stays an icmp value. Unsigned
 // compares (`sltu`/`sltiu`) lower to `icmp_ult`; recover types their operands u32 so the backend
 // re-emits `sltu` (the operator is the same `<` — the signedness lives in the operand types).
-import { Fn, Op, Successor, Value, mkOp, mkValue } from '../ir/core';
-import { NEGATED_ICMP, type Opcode } from '../ir/opcodes';
+import { ownArgumentWordsOn } from '../aggregate';
+import { type Block, Fn, Op, Successor, Value, mkOp, mkValue } from '../ir/core';
+import { NEGATED_FCMP, NEGATED_ICMP, type Opcode } from '../ir/opcodes';
 import { T } from '../ir/types';
-import type { Prototypes } from '../proto';
-import type { TargetDescription } from '../target';
+import { type Prototypes, declaresVoidReturn, ownReturnWidth, wordsOf } from '../proto';
+import type { ContextGlobals } from '../proto-context';
+import type { SymbolMap } from '../symbols';
+import { O32_REGISTER_ALIASES, type TargetDescription } from '../target';
 import { type AsmData, readJumpTable, textRelocAt } from './asmdata';
+import { callDeclarations, foldByValueArgs } from './call-plan';
+import { pinDeadReads } from './dead-reads';
+import { pinDeviceAccesses } from './device-pins';
 import {
   type DisasmInstr,
+  type DisasmReloc,
   parseImm,
   parseMem,
   parseDisasm as parseSharedDisasm,
@@ -33,14 +42,59 @@ import {
   symbolStart,
 } from './disasm';
 import { mkEmitKit, pushSwitchBr } from './emit';
-import { FrontendUnsupportedError } from './errors';
+import { type FrontendRefusal, FrontendUnsupportedError } from './errors';
 import { assertInputFormat } from './format';
-import type { Frontend } from './frontend';
+import {
+  type ReturnHomeRule,
+  carriesFloatHome,
+  floatHomeAt,
+  fpPrecision,
+  fpuArgSlots,
+  refuseBothPrecisions,
+  refuseFpWordCrossings,
+  returnHomeRule,
+  settleReturnHome,
+  writesFloatReturn,
+} from './fpu';
+import {
+  FRAME_OBJECT_AUDIT,
+  type FrameObjectRelift,
+  type FrameRange,
+  areaAboveOutgoing,
+  landsOnArea,
+  liftWithRelift,
+  nameMergedSretObjects,
+  refuseSretOutsideFrame,
+} from './frame-objects';
+import { type Frontend, type LiftOptions, ownDeclarationOf } from './frontend';
 import { makeHighHalves } from './high-half';
+import {
+  type HoistedDispatch,
+  type IdiomLeft,
+  type StaleIdiomRead,
+  type TableKey,
+  agreedTable,
+  caseEntries,
+  enterCaseTarget,
+  entersBetween,
+  idiomLeaves,
+  makeTableBases,
+  parkedIn,
+  refuseReachableDispatch,
+  refuseStaleIdiomReads,
+  scaledIndexIn,
+} from './jump-table';
 import { opaqueDest } from './opaque';
-import { isSplatMips, parseSplatMips } from './splat';
-import { abiSortEntryParams, stackSlotKey } from './ssa';
-import { makeSsaBuilder } from './ssa';
+import { MIPS_FP_REG, isSplatMips, mipsEvenFpKey, parseSplatMips } from './splat';
+import {
+  type ArgSlots,
+  abiSortEntryParams,
+  incomingStackArgKey,
+  mintArgSlotHoles,
+  stackArgSlots,
+  stackSlotKey,
+} from './ssa';
+import { makeSsaBuilder, refuseSavedRegisterLeaks, registerLiveIns, unifyRegisterSpellings } from './ssa';
 
 type Instr = DisasmInstr;
 
@@ -68,15 +122,85 @@ const LIKELY_BASE: Record<string, string> = {
   bgtzl: 'bgtz',
   bltzl: 'bltz',
   bgezl: 'bgez',
+  bc1tl: 'bc1t',
+  bc1fl: 'bc1f',
 };
-// A coprocessor-1 branch tests an FP condition code (`fcc`) that `c.cond.s/d` sets. Neither the
-// code nor the compare is modelled, so these refuse whether or not they are also likely.
+// A coprocessor-1 branch tests the FP condition code (`fcc`) that a `c.cond.s/d` sets: `bc1t` is
+// taken when it is set, `bc1f` when it is clear. MIPS I-III have one code and the branch names it
+// by its target alone; a MIPS IV `bc1t $fccN, L` names one of eight, which is not modelled.
 const isFpCondBranch = (m: string) => m.startsWith('bc1');
+const FP_COND_BRANCH: Readonly<Record<string, boolean>> = { bc1t: true, bc1f: false };
+
+/** The FPU arithmetic this frontend lifts, onto the float opcodes (`mov.s`/`mov.d` are copies and
+ *  have none), with the precision each computes in: `.s` single, `.d` double, one per function
+ *  (`frontend/fpu.ts` `fpPrecision`). With the conversions and compares below, and `mfc1`/`mtc1`,
+ *  that is the decode; every other FPU instruction — the moves to and from memory, the conversions
+ *  between the precisions — keeps the register-file refusal `opaqueDest` gives it, and so does one
+ *  of these naming an odd register (a double's second half, or a single this frontend does not
+ *  key) or a target with no `fpu` homes. `docs/floating-point.md` says what the next layer is. */
+const FP_ARITH: Readonly<Record<string, { op: Opcode | 'copy'; width: 32 | 64 }>> = {
+  'add.s': { op: 'fadd', width: 32 },
+  'sub.s': { op: 'fsub', width: 32 },
+  'mul.s': { op: 'fmul', width: 32 },
+  'div.s': { op: 'fdiv', width: 32 },
+  'neg.s': { op: 'fneg', width: 32 },
+  'mov.s': { op: 'copy', width: 32 },
+  'add.d': { op: 'fadd', width: 64 },
+  'sub.d': { op: 'fsub', width: 64 },
+  'mul.d': { op: 'fmul', width: 64 },
+  'div.d': { op: 'fdiv', width: 64 },
+  'neg.d': { op: 'fneg', width: 64 },
+  'mov.d': { op: 'copy', width: 64 },
+};
+/** The moves between the FPU's file and the integer file's VALUES, onto the conversions: `trunc.w`
+ *  truncates a float to the integer word it leaves in an FPU register (`mfc1` moves it out), and
+ *  `cvt.s.w`/`cvt.d.w` convert the integer word `mtc1` moved in. Each is one precision, like the
+ *  arithmetic. The `cvt.w` and `cfc1`/`ctc1` rounding-mode sequence IDO converts an UNSIGNED word
+ *  with, `cvt.s.d`/`cvt.d.s` between the precisions, and the other roundings stay refused. */
+const FP_CONVERT: Readonly<Record<string, { op: Opcode; width: 32 | 64 }>> = {
+  'trunc.w.s': { op: 'fptosi', width: 32 },
+  'trunc.w.d': { op: 'fptosi', width: 64 },
+  'cvt.s.w': { op: 'sitofp', width: 32 },
+  'cvt.d.w': { op: 'sitofp', width: 64 },
+};
+/** The compares that set the condition code, onto the float compares. Only the ORDERED three are
+ *  here, because only they are what IDO, KMC and GCC 2.7.2 emit for C's relations (compiled, every
+ *  relation in both precisions): `a > b` is `c.lt.s b, a`, `a != b` is `c.eq.s` with the branch
+ *  sense flipped, and a NaN answers false to all three. */
+const FP_COMPARE: Readonly<Record<string, { op: Opcode; width: 32 | 64 }>> = {
+  'c.eq.s': { op: 'fcmp_oeq', width: 32 },
+  'c.lt.s': { op: 'fcmp_olt', width: 32 },
+  'c.le.s': { op: 'fcmp_ole', width: 32 },
+  'c.eq.d': { op: 'fcmp_oeq', width: 64 },
+  'c.lt.d': { op: 'fcmp_olt', width: 64 },
+  'c.le.d': { op: 'fcmp_ole', width: 64 },
+};
+const FP_ARITH_MNEMONICS: ReadonlySet<string> = new Set(Object.keys(FP_ARITH));
+/** The decoded instructions that leave a FLOAT in an FPU register, which is what puts one in the
+ *  float return home: `trunc.w` leaves an integer word there, and `mtc1` the integer it moved. */
+const FP_FLOAT_WRITERS: ReadonlySet<string> = new Set([
+  ...FP_ARITH_MNEMONICS,
+  ...Object.keys(FP_CONVERT).filter((m) => FP_CONVERT[m].op === 'sitofp'),
+]);
+/** The decoded instructions that carry a float's information into the INTEGER file: a `mfc1` of a
+ *  truncated word, and a condition-code branch. Where one is present a value in `v0` may be the
+ *  function's result, and a write to `$f0` a temporary, so neither decides the return home
+ *  (frontend/fpu.ts `returnHomeRule`). */
+const crossesToIntegers = (m: string) => m === 'mfc1' || (LIKELY_BASE[m] ?? m) in FP_COND_BRANCH;
+/** A key the SSA builder holds for the FPU's file: `mipsEvenFpKey`'s canonical spelling. */
+const isFpKey = (k: string) => /^\$f\d+$/.test(k);
 
 const isZero = (r: string) => r === 'zero' || r === '$0';
 // The stack pointer (`$29`). A `sw/lw` through it is not a store/load through a data pointer — it
 // is a spill/reload of a stack SLOT (an argument home slot or a local). See emitStore/emitLoad.
 const isStackPtr = (r: string) => r === 'sp' || r === '$sp' || r === '$29';
+// Where O32 puts a call's argument k ≥ 4: the caller's outgoing area keeps `[0,16)` as the home of
+// a0..a3, and argument k is the word at `16 + 4(k − 4)` above the `sp` the call is made at.
+// Compiled on ido7.1, gcc2.7.2kmc and gcc2.7.2: `g(a, b, 1, 2, 3)` stores the 3 to `16(sp)`.
+const STACK_ARGS_AT = 16;
+/** Every load whose last operand is `off(base)`: integer, unaligned and FPU
+ *  (`outgoing-area-probes.test.ts` classifies every memory mnemonic of the committed probes against it). */
+export const MIPS_FRAME_LOAD = /^(lb|lbu|lh|lhu|lw|lwl|lwr|lwu|ll|ld|ldl|ldr|lwc1|ldc1)$/;
 // SSA-variable name for the stack slot at a constant `sp`-offset. Distinct namespace from the
 // register names (which are alphabetic / `$N`), so it never collides with a real register var.
 const stackSlot = stackSlotKey; // shared spelling: frontend/ssa.ts
@@ -89,10 +213,11 @@ const SUBWORD_MEM = new Set(['lb', 'lbu', 'lh', 'lhu', 'sb', 'sh']);
 const isMipsReg = (s: string | undefined): s is string =>
   /^(\$\d+|[a-z][a-z0-9]*)$/i.test(s ?? '') && !/^0x/i.test(s ?? '');
 // `jr ra`. A non-ra `jr` also lands here, but by block-fill time it is either a recovered
-// switch dispatch (its block is pruned as unreachable) or has already loud-failed in `lift`.
+// switch dispatch (its block is pruned as unreachable, which `refuseReachableDispatch` checks) or
+// has already loud-failed in `lift`.
 const isReturn = (ins: Instr) => ins.mnemonic === 'jr';
 const isUncond = (ins: Instr) => ins.mnemonic === 'b' || ins.mnemonic === 'j';
-const isCond = (ins: Instr) => ins.mnemonic in COND_Z || ins.mnemonic in COND_RR;
+const isCond = (ins: Instr) => ins.mnemonic in COND_Z || ins.mnemonic in COND_RR || ins.mnemonic in FP_COND_BRANCH;
 const isXfer = (ins: Instr) => isReturn(ins) || isUncond(ins) || isCond(ins);
 // ANY instruction that redirects control, modelled or not: on MIPS that is the whole `b*` space
 // (minus the `break` trap) plus `j*`. `isXfer` is the subset this frontend models; this is the
@@ -135,6 +260,10 @@ const parseDisasm = (disasm: string): Instr[] => parseSharedDisasm(disasm, { zer
 // A recovered JUMP TABLE's dispatch is untouched: Regime B reads the table through `asmdata.ts` and
 // prunes the dispatch block, so its `lui %hi(.rodata)` never reaches `decode`.
 //
+// `R_MIPS_26` is a `jal`'s callee, and a `j`'s target where the jump stays in this section. objdump
+// prints the field, which in a relocatable object is the addend and not the address, so the callee
+// is read off this record alone.
+//
 // `R_MIPS_GOT16`/`R_MIPS_CALL16`/`R_MIPS_GPREL16` are PIC/small-data access, already refused by the
 // `gp`-as-data guard; widening this carrier to them would trade those messages for worse ones
 // without recovering an address.
@@ -142,10 +271,15 @@ const parseDisasm = (disasm: string): Instr[] => parseSharedDisasm(disasm, { zer
 // THE ADDEND IS NOT ON THE RECORD. MIPS objects are REL: the relocation has no addend field and the
 // address's low bits live in the two instruction immediates, so a record that DOES carry an addend
 // is not the format assumed here, and refuses.
-function attachMipsRelocs(name: string, instrs: Instr[], ad: AsmData): void {
+function attachMipsRelocs(name: string, instrs: Instr[], ad: AsmData, freed: ReadonlySet<number>): void {
   const byAddr = new Map(instrs.map((ins) => [ins.addr, ins]));
   for (const r of ad.relocs) {
-    if (r.section !== '.text' || (r.type !== 'R_MIPS_HI16' && r.type !== 'R_MIPS_LO16')) {
+    if (r.section !== '.text' || (r.type !== 'R_MIPS_HI16' && r.type !== 'R_MIPS_LO16' && r.type !== 'R_MIPS_26')) {
+      continue;
+    }
+    // A slot `normaliseBranchLikely` emptied holds a `nop` now; its old word's relocation
+    // describes the copy at the target, which carries its own.
+    if (freed.has(r.offset)) {
       continue;
     }
     const ins = byAddr.get(r.offset);
@@ -195,61 +329,165 @@ interface MipsBlock {
   delayAnnulled: boolean;
 }
 
-// Mnemonics whose destination is `ops[0]` (a plain register write) — the subset the jump-table
-// backward trace chases (index/base/address/load). Stores, branches, `jr`, `nop`, `div`/`mult`
-// (hi/lo writers) are absent, so `destReg` returns null for them and the trace never mis-attributes.
-const WRITES_D = new Set([
-  'lui',
-  'lw',
-  'lh',
-  'lhu',
-  'lb',
-  'lbu',
-  'sll',
-  'srl',
-  'sra',
-  'sllv',
-  'srlv',
-  'srav',
-  'addu',
-  'add',
-  'addiu',
-  'addi',
-  'subu',
-  'sub',
-  'or',
-  'ori',
-  'and',
-  'andi',
-  'xor',
-  'xori',
-  'nor',
-  'move',
-  'li',
-  'slt',
-  'sltu',
-  'slti',
-  'sltiu',
-  'mflo',
-  'mfhi',
-  'mul',
-]);
-const destReg = (ins: Instr): string | null => (WRITES_D.has(ins.mnemonic) ? ins.ops[0] : null);
+// Mnemonics whose FIRST operand is a source, never a destination: the stores, the branches that
+// compare it, and the moves and products that read it.
+const SOURCE_FIRST = /^(s[bhwd]|sw[lr]|sc|s[wd]c1|b\w*|j|jr|mult|multu|div|divu|mt\w+|ctc1|t\w+|cache|sync)$/;
+
+/** THE INTEGER REGISTER AN INSTRUCTION WRITES, or null — the one classifier every reader here asks
+ *  (the jump-table trace, the `gp` skip, the frame-depth walk, the save scan, the 64-bit return
+ *  check), so no two of them can disagree on a mnemonic.
+ *
+ *  A DENY-LIST: every instruction writes its first operand unless it is one of `SOURCE_FIRST`'s.
+ *  Every reader asks "is this the write of r?", and an unknown write answered no would be stepped
+ *  past as though r still held what came before, so the default is the answer that stops them. A
+ *  call writes `ra`, whatever it names first (`jal f`, and `jalr rs` with the implicit `ra`). */
+const writtenReg = (ins: Instr): string | null => {
+  if (ins.mnemonic === 'jalr') {
+    return ins.ops.length > 1 ? ins.ops[0] : 'ra';
+  }
+  if (isCallInstr(ins)) {
+    return 'ra';
+  }
+  return SOURCE_FIRST.test(ins.mnemonic) || !isMipsReg(ins.ops[0]) ? null : ins.ops[0];
+};
+
+/** A call: every instruction that links into `ra` — `jal`, `jalr`, and the linking branches. */
+const isCallInstr = (ins: Instr) => /^(jal|jalr|bal|bgezall?|bltzall?)$/.test(ins.mnemonic);
+
+/** The register a register COPY reads — `move rD,rS`, or `addu`/`add`/`or` with `zero` beside it,
+ *  which is how Splat and IDO spell the same move — or undefined for any other instruction. */
+const copiedReg = (ins: Instr): string | undefined => {
+  const [, s, t] = ins.ops;
+  if (ins.mnemonic === 'move') {
+    return s;
+  }
+  if (!/^(addu|add|or)$/.test(ins.mnemonic) || s === undefined || t === undefined) {
+    return undefined;
+  }
+  return isZero(t) ? s : isZero(s) ? t : undefined;
+};
 
 // A recovered dense-switch jump table (Regime B), keyed
-// by the BOUNDS branch (`beqz tmp, DEF`) whose block emits the `switch_br`. Two idioms are
-// handled: IDO gp-relative (`lw base,0(gp)` GOT16; `addu rV,rV,gp`
-// after the load) and KMC absolute (`lui base` HI16). Delay slots are honoured — the `beqz` delay
-// slot (which on IDO carries the DEFAULT return value `li v0,-1`) still executes before the
-// `switch_br`.
+// by the BOUNDS branch (`beqz tmp, DEF`) whose block emits the `switch_br`. The table base is one of:
+//   - absolute, formed in the dispatch's block: `lui at,%hi(T) ; addu at,at,rI ; lw rV,%lo(T)(at)`,
+//     the table's `%lo` folded into the load's displacement (IDO, KMC and gcc 2.7.2 non-PIC, whenever
+//     the block forms the base itself);
+//   - absolute, hoisted: `lui rH,%hi(T) ; addiu rB,rH,%lo(T)` in a loop's preheader, the load at
+//     displacement 0 (KMC and gcc 2.7.2; `HoistedDispatch`);
+//   - PIC, IDO `-KPIC`: `lw at,%got(T)(gp)` GOT16 (its displacement the `%hi`), the load carrying
+//     the `%lo` LO16, and `addu rV,rV,gp` after it (the entries are gp-relative) (`inBlockTable`).
+// The table must sit in a read-only section (`tableBaseOf`).
+// Delay slots are honoured — the `beqz` delay slot (which on IDO carries the DEFAULT return value
+// `li v0,-1`) still executes before the `switch_br`.
 interface MipsJT {
   scrutReg: string;
   caseAddrs: number[];
   defaultAddr: number;
   jrAddr: number;
+  /** The start of the bounds block when its `sltiu` runs on the edges into it, not inside it
+   *  (`mipsBounds`); null otherwise. */
+  entry: number | null;
+  /** The base register and table of a dispatch whose block does not form its base (KMC and gcc
+   *  2.7.2 hoist the `lui`/`addiu` pair into a loop's preheader): `lift` proves the base reaches it
+   *  (frontend/jump-table.ts). Null when the pruned block forms the base itself. */
+  hoisted: HoistedDispatch | null;
+  /** What the pruned dispatch leaves in each register it writes (`idiomLeaves`). */
+  leaves: ReadonlyMap<string, IdiomLeft>;
 }
 
-function recoverMipsJumpTables(instrs: Instr[], ad: AsmData): Map<number, MipsJT> {
+/** A MIPS jump table's bounds guard for the dispatch whose `jr` is at `i`: `sltiu tmp,scrutReg,N`
+ *  then `beqz tmp,DEF`, where the beqz is the nearest transfer before the `jr`. `at` is the beqz's
+ *  index.
+ *
+ *  The `sltiu` is the last write of `tmp` on EVERY path into the beqz, so it is found per entry of
+ *  the beqz's block, and every entry must run the same one: inside the block, after nothing that
+ *  writes `tmp` or the scrutinee (IDO schedules `move s0,a1` between the two); or, where the block
+ *  holds none, as the last word each edge into it runs. IDO rotates a `while` loop so that both of
+ *  its entries do: the bounds `sltiu` sits in the delay slot of the loop-entry `beqz` (which runs it
+ *  on the fall-through) and in the LIKELY slot of the latch `bnezl` (which runs it on the taken edge
+ *  alone). An edge whose last word is not that `sltiu` — the not-taken edge of a likely branch, a
+ *  call's return, the function's entry — leaves `tmp` unknown, and declines. `likely` holds the
+ *  branch-likely addresses `normaliseBranchLikely` rewrote. */
+function mipsBounds(
+  instrs: Instr[],
+  i: number,
+  scrutReg: string,
+  likely: ReadonlySet<number>,
+): { at: number; addr: number; n: number; def: number; entry: number | null } | null {
+  let k = i - 1;
+  while (k >= 0 && !isControlTransfer(instrs[k])) {
+    k--;
+  }
+  const beqz = instrs[k];
+  if (!beqz || beqz.mnemonic !== 'beqz' || beqz.target === undefined) {
+    return null;
+  }
+  const tmp = beqz.ops[0];
+  const isBound = (c: Instr | undefined) => c?.mnemonic === 'sltiu' && c.ops[0] === tmp && c.ops[1] === scrutReg;
+  const bound = (c: Instr, entry: number | null) => {
+    // `sltiu tmp, scrut, N` bounds `scrut < N`: the immediate IS the case count (PPC's `cmplwi`
+    // states the max index).
+    const n = parseImm(c.ops[2]);
+    return n < 2 ? null : { at: k, addr: beqz.addr, n, def: beqz.target!, entry };
+  };
+  const isTarget = (addr: number) => instrs.some((x) => x.target === addr);
+  // The beqz's block: back to a branch target, or to the word after a transfer's delay slot.
+  let s = k;
+  while (
+    s > 0 &&
+    !isTarget(instrs[s].addr) &&
+    !isControlTransfer(instrs[s - 1]) &&
+    !(s > 1 && isControlTransfer(instrs[s - 2]))
+  ) {
+    s--;
+  }
+  for (let j = k - 1; j >= s; j--) {
+    const c = instrs[j];
+    if (isBound(c)) {
+      return bound(c, null);
+    }
+    if (writtenReg(c) === tmp || writtenReg(c) === scrutReg) {
+      return null;
+    }
+  }
+  // No `sltiu` in the block: the last word each edge into it runs.
+  const last: Array<Instr | undefined> = [];
+  const p = instrs[s - 1];
+  const t = instrs[s - 2];
+  if (p === undefined || isControlTransfer(p)) {
+    return null;
+  }
+  if (t !== undefined && isControlTransfer(t)) {
+    // `p` is a delay slot: the fall-through edge runs it after a branch that is neither likely (its
+    // not-taken edge annuls the slot) nor a call (which returns here from the callee); a jump has no
+    // fall-through edge at all.
+    if (likely.has(t.addr) || isCallInstr(t)) {
+      return null;
+    }
+    if (!isUncond(t) && !isReturn(t)) {
+      last.push(p);
+    }
+  } else {
+    last.push(p);
+  }
+  // A taken edge runs the branch's delay slot, a likely one's included.
+  instrs.forEach((x, o) => {
+    if (x.target === instrs[s].addr) {
+      last.push(isCallInstr(x) ? undefined : instrs[o + 1]);
+    }
+  });
+  const first = last[0];
+  if (
+    first === undefined ||
+    !isBound(first) ||
+    !last.every((c) => c !== undefined && c.ops.join() === first.ops.join() && c.mnemonic === 'sltiu')
+  ) {
+    return null;
+  }
+  return bound(first, instrs[s].addr);
+}
+
+function recoverMipsJumpTables(instrs: Instr[], ad: AsmData, likely: ReadonlySet<number>): Map<number, MipsJT> {
   // Nearest def of `reg` strictly before index `p`, not crossing a control transfer (so the trace
   // stays inside the dispatch's extended block). Returns the instruction index, or -1.
   const defBefore = (reg: string, p: number): number => {
@@ -257,14 +495,18 @@ function recoverMipsJumpTables(instrs: Instr[], ad: AsmData): Map<number, MipsJT
       if (isXfer(instrs[j])) {
         return -1;
       }
-      if (destReg(instrs[j]) === reg) {
+      if (writtenReg(instrs[j]) === reg) {
         return j;
       }
     }
     return -1;
   };
-  // Is `ins` a table-base materialisation (`lui rB,hi` HI16, or `lw rB,0(gp)` GOT16) with a `.text`
-  // relocation into a data section? Returns {sym, addend} locating the table, or null.
+  // Is `ins` a table-base materialisation (`lui rB,hi` HI16, or `lw rB,hi(gp)` GOT16) with a `.text`
+  // relocation into a READ-ONLY data section? Returns {sym, addend} locating the table, or null.
+  // A writable table is refused: the table is read once, at its initial contents, and a switch
+  // lifted from it would ignore every store that retargets an entry. The compilers put a switch's
+  // table in `.rodata`/`.rdata`; what lands in `.data` is a non-const computed-goto label table
+  // (`static void *t[] = {&&a, ...}`), which its own function may write (`t[1] = &&c`).
   const tableBaseOf = (ins: Instr): { sym: string; addend: number } | null => {
     const isLui = ins.mnemonic === 'lui';
     const isGpLw = ins.mnemonic === 'lw' && ins.ops[1] !== undefined && parseMem(ins.ops[1]).base === 'gp';
@@ -276,12 +518,76 @@ function recoverMipsJumpTables(instrs: Instr[], ad: AsmData): Map<number, MipsJT
       return null;
     }
     const sec = ad.symbols.get(r.sym)?.section ?? r.sym; // ".rodata" section symbol → ".rodata"
-    if (!/^\.(rodata|rdata|sdata2?|data)$/.test(sec)) {
+    if (!/^\.(rodata|rdata)$/.test(sec)) {
       return null;
     }
     return { sym: r.sym, addend: r.addend };
   };
 
+  /** The table a base formed OUTSIDE the dispatch block addresses, as far as the instructions say:
+   *  every `addiu rB,rH,%lo` in the function, with the `lui rH,%hi` nearest before it, must name
+   *  one table, or the guess is left undecided. KMC and gcc 2.7.2 form the base in a loop's
+   *  preheader. Only a guess — `lift` pairs the halves and proves the base reaches the dispatch
+   *  (frontend/jump-table.ts). The table's offset is the pair's own `%hi`/`%lo` halves, as REL
+   *  relocations carry it. */
+  const hoistedTable = (rB: string): TableKey | null =>
+    agreedTable(
+      instrs.flatMap((x, q) => {
+        const lo = x.mnemonic === 'addiu' && x.ops[0] === rB ? textRelocAt(ad, x.addr) : null;
+        if (lo?.type !== 'R_MIPS_LO16') {
+          return [];
+        }
+        let p = q - 1;
+        while (p >= 0 && writtenReg(instrs[p]) !== x.ops[1]) {
+          p--;
+        }
+        const hi = p >= 0 && instrs[p].mnemonic === 'lui' ? tableBaseOf(instrs[p]) : null;
+        if (!hi || hi.sym !== lo.sym) {
+          return [{ sym: '', addend: NaN }];
+        }
+        return [paired(hi, parseImm(instrs[p].ops[1]), parseImm(x.ops[2]))];
+      }),
+    );
+  /** The table a `%hi` / `%lo` pair addresses: the high record's symbol and addend plus both
+   *  halves' immediates, the `%lo` sign-extended — REL keeps the offset in the immediates, so a
+   *  table 64 KiB into its section has a high half of 1 and one past 32 KiB has a negative `%lo`.
+   *  The high half is a `lui`'s immediate (HI16) or a `lw rB,hi(gp)`'s displacement (GOT16 on the
+   *  section symbol, whose GOT entry holds the 64 KiB page the LO16 completes). */
+  const paired = (hi: TableKey, hiImm: number, loImm: number): TableKey => ({
+    sym: hi.sym,
+    addend: hi.addend + (((hiImm & 0xffff) << 16) + (((loImm & 0xffff) << 16) >> 16)),
+  });
+  /** The table a base the dispatch's block forms addresses, read with the load's displacement `off`.
+   *  The base pairs with the load: IDO, KMC and gcc 2.7.2 fold the table's `%lo` into the `lw`
+   *  whenever the block forms the base, so `lw rV,%lo(T+K)(at)`'s displacement is the low half of
+   *  the TABLE's address, not an index offset. One rule (`paired`) for both bases: a `lui`'s HI16,
+   *  and IDO `-KPIC`'s GOT16 (`lw at,%got(T)(gp)`), whose displacement is the high half — `lw
+   *  at,1(gp)` for a table 64 KiB in, then `lw rV,-24576(at)` for one at 40 KiB, or `lw rV,8(at)`
+   *  for a later table of the unit. Refuses (null):
+   *    - a non-zero displacement with no R_MIPS_LO16 on the load — `table[i + off/4]`, the base
+   *      left unpaired. No compiler emits an unpaired HI16 or GOT16 for a table; displacement 0
+   *      with no LO16 is still read at the base's own half, the address the pair gives with a
+   *      zero `%lo`, so the hand fixtures that carry no LO16 keep lifting. An unpaired GOT16 is
+   *      read only at immediate 0: against a global symbol it names that symbol's own GOT slot,
+   *      not a page, so a non-zero immediate is no high half;
+   *    - a LO16 on another symbol, or any other relocation on the load. */
+  const inBlockTable = (base: Instr, ld: Instr, off: number): TableKey | null => {
+    const hi = tableBaseOf(base);
+    if (!hi) {
+      return null;
+    }
+    const isLui = base.mnemonic === 'lui';
+    const hiImm = isLui ? parseImm(base.ops[1]) : parseMem(base.ops[1]).off;
+    const lo = textRelocAt(ad, ld.addr);
+    if (lo === null) {
+      return off === 0 && (isLui || hiImm === 0) ? paired(hi, hiImm, 0) : null;
+    }
+    if (lo.type !== 'R_MIPS_LO16' || lo.sym !== hi.sym) {
+      return null;
+    }
+    return paired(hi, hiImm, off);
+  };
+
   const out = new Map<number, MipsJT>();
   for (let i = 0; i < instrs.length; i++) {
     const jr = instrs[i];
@@ -291,10 +597,12 @@ function recoverMipsJumpTables(instrs: Instr[], ad: AsmData): Map<number, MipsJT
     let rV = jr.ops[0];
     // Optional IDO `+gp`: `addu rV, rL, gp` before the load — the loaded value is the other operand.
     let ldIdx = defBefore(rV, i);
+    let gpIdx = -1;
     if (ldIdx >= 0 && instrs[ldIdx].mnemonic === 'addu') {
       const [a, b] = [instrs[ldIdx].ops[1], instrs[ldIdx].ops[2]];
       if (a === 'gp' || b === 'gp') {
         rV = a === 'gp' ? b : a;
+        gpIdx = ldIdx;
         ldIdx = defBefore(rV, ldIdx);
       }
     }
@@ -302,9 +610,6 @@ function recoverMipsJumpTables(instrs: Instr[], ad: AsmData): Map<number, MipsJT
       continue;
     } // rV = *(rAddr)
     const mem = parseMem(instrs[ldIdx].ops[1]);
-    if (mem.off !== 0) {
-      continue;
-    }
     const aIdx = defBefore(mem.base, ldIdx); // rAddr = base + index
     if (aIdx < 0 || instrs[aIdx].mnemonic !== 'addu') {
       continue;
@@ -312,74 +617,137 @@ function recoverMipsJumpTables(instrs: Instr[], ad: AsmData): Map<number, MipsJT
     const [oa, ob] = [instrs[aIdx].ops[1], instrs[aIdx].ops[2]];
     // One operand is the shifted index (`sll rIdx, scrut, 2` — identity guard), the other the table base.
     let scrutReg: string | null = null,
-      table: { sym: string; addend: number } | null = null;
+      table: { sym: string; addend: number } | null = null,
+      sllIdx = -1,
+      baseIdx = -1,
+      hoisted: HoistedDispatch | null = null;
     for (const [idxCand, baseCand] of [
       [oa, ob],
       [ob, oa],
     ] as const) {
       const si = defBefore(idxCand, aIdx);
       const bi2 = defBefore(baseCand, aIdx);
-      if (si < 0 || bi2 < 0) {
+      // A base the dispatch's block does not form is a HOISTED one (`hoistedTable`), whose `%lo`
+      // its own `addiu` carries: the load reads displacement 0 off it.
+      const out = bi2 < 0 && si >= 0 && mem.off === 0 ? hoistedTable(baseCand) : null;
+      if (si < 0 || (bi2 < 0 && !out)) {
         continue;
       }
       const sll = instrs[si];
       if (sll.mnemonic !== 'sll' || (sll.ops[2] !== '0x2' && sll.ops[2] !== '2')) {
         continue;
       } // index*4
-      const tb = tableBaseOf(instrs[bi2]);
+      const tb = out ?? inBlockTable(instrs[bi2], instrs[ldIdx], mem.off);
       if (!tb) {
         continue;
       }
       scrutReg = sll.ops[1];
       table = tb;
+      [sllIdx, baseIdx] = [si, bi2];
+      hoisted = out ? { reg: baseCand, table: out } : null;
       break;
     }
     if (!scrutReg || !table) {
       continue;
     }
-    // Bounds: `sltiu tmp, scrutReg, N ; beqz tmp, DEF` — the guard whose delay-slot-consuming branch
-    // block will emit the switch_br. Scan back for the sltiu on the scrutinee.
-    let bounds: { addr: number; n: number; def: number } | null = null;
-    for (let j = aIdx; j >= 0; j--) {
-      const c = instrs[j];
-      if (c.mnemonic === 'sltiu' && c.ops[1] === scrutReg) {
-        const tmp = c.ops[0];
-        // the beqz reading tmp (the block terminator); it may follow the sltiu directly.
-        for (let k = j + 1; k < instrs.length && k <= j + 3; k++) {
-          if (instrs[k].mnemonic === 'beqz' && instrs[k].ops[0] === tmp && instrs[k].target !== undefined) {
-            // `sltiu tmp, scrut, N` bounds `scrut < N` — the immediate IS the case count (unlike PPC's
-            // `cmplwi rS, N-1` which uses the max index). So N = the immediate, not immediate+1.
-            bounds = { addr: instrs[k].addr, n: parseImm(c.ops[2]), def: instrs[k].target! };
-            break;
-          }
-        }
-        break;
-      }
+    // Bounds: `sltiu tmp, scrutReg, N ; beqz tmp, DEF`, the beqz the nearest transfer before the
+    // dispatch. Its block emits the `switch_br`, reading the scrutinee where the beqz reads `tmp`.
+    const bounds = mipsBounds(instrs, i, scrutReg, likely);
+    if (!bounds) {
+      continue;
     }
-    if (!bounds || bounds.n < 2) {
+    // THE DISPATCH BLOCK — after the bounds branch's delay slot, through the `jr` and its own slot —
+    // is pruned unread once the table is recovered, so it may hold the idiom and nothing else:
+    // anything more would be dropped. Nothing may branch into it past the bounds check, the `jr`'s
+    // slot must be empty, and nothing from the bounds slot on may rewrite the scrutinee before the
+    // `sll` scales it (IDO's in-place `sll` IN the slot is that `sll`).
+    const k = bounds.at;
+    const idiom = new Set([ldIdx, aIdx, gpIdx, sllIdx, baseIdx]);
+    if (
+      instrs[i + 1]?.mnemonic !== 'nop' ||
+      entersBetween(instrs, instrs[k].addr, instrs[i + 1].addr) ||
+      instrs.slice(k + 2, i).some((_, o) => !idiom.has(k + 2 + o)) ||
+      instrs.slice(k + 1, sllIdx).some((x) => writtenReg(x) === scrutReg)
+    ) {
       continue;
     }
     const caseAddrs = readJumpTable(ad, table.sym, table.addend, bounds.n);
     if (!caseAddrs) {
       continue;
     }
-    out.set(bounds.addr, { scrutReg, caseAddrs, defaultAddr: bounds.def, jrAddr: jr.addr });
+    // Only the words past the bounds branch's delay slot are pruned: the slot runs on both paths and
+    // is lifted (KMC's `sll`, IDO's in-place one, a `lui` gcc puts there).
+    const leaves = idiomLeaves(
+      [...idiom]
+        .filter((x) => x > k + 1)
+        .sort((a, b) => a - b)
+        .flatMap((x) => {
+          const r = writtenReg(instrs[x]);
+          return r === null ? [] : [{ reg: r, scaled: x === sllIdx }];
+        }),
+    );
+    out.set(bounds.addr, {
+      scrutReg,
+      caseAddrs,
+      defaultAddr: bounds.def,
+      jrAddr: jr.addr,
+      entry: bounds.entry,
+      hoisted,
+      leaves,
+    });
+  }
+  // A bound read off its block's ENTRY EDGES holds only for the edges `mipsBounds` saw. A table's
+  // arm is an edge too, and no table existed while it looked: one landing there declines.
+  const arms = new Set([...out.values()].flatMap((jt) => [...jt.caseAddrs, jt.defaultAddr]));
+  for (const [addr, jt] of out) {
+    if (jt.entry !== null && arms.has(jt.entry)) {
+      out.delete(addr);
+    }
   }
   return out;
 }
 
-// BRANCH-LIKELY → the ordinary branch that tests the same way, in place, returning the addresses
-// rewritten. The mnemonic is all that differs in the COMPARISON; what differs in the FLOW is the
-// delay slot, which `toBlocks` then places on the taken edge alone.
+// BRANCH-LIKELY → the ordinary branch that tests the same way, in place. The mnemonic is all that
+// differs in the COMPARISON; what differs in the FLOW is the delay slot, which `toBlocks` then
+// places on the taken edge alone. `likely` holds the branches so placed.
+//
+// UNLESS THE SLOT IS THE TARGET'S OWN FIRST WORD, STOLEN — which is how IDO, KMC and GCC 2.7.2 fill
+// a likely slot: `bnezl r,T; S` where the word at T-4 is also S (ido 4932 of the 4984 likely
+// branches in the af splat corpus). Then the branch is retargeted to T-4 with an empty slot,
+// `bnez r,T-4; nop`, and `freed` holds the slot addresses so emptied. That is exact on both paths
+// WHATEVER ELSE REACHES T-4: taken runs S then T either way, and not taken annuls S either way. It
+// matters because the copy otherwise becomes a block of its own on the taken edge, which reaches T
+// past every join T-4 is part of — a switch arm whose `break` it skips, so the arms stop
+// linearizing (ido), or a recovered switch's bounds branch that cannot annul its slot (KMC). The
+// rewrite holds only while every word means what its bytes say, so it is made only when:
+//   - the two words are the same instruction with the same relocation — text alone cannot tell
+//     `lui at,0x0` against one symbol from the same text against another;
+//   - T-4 is not the slot itself (T = branch+8, a slot that skips only itself: nothing to share);
+//   - T-4 and T are both in the function, and T-4 is no transfer's delay slot — a slot runs only
+//     after its own transfer, so falling into one from T-8's side is not what its bytes say;
+//   - the slot completes no `%lo`. Its `%hi` is a register each path loads for itself (`lui v1;
+//     b T; lw v1,%lo(g)(v1)` against `lui v1; …; lw v1,%lo(g)(v1); T:`), and retargeted, the one
+//     copy at T-4 reads that register at a join, where it is the block parameter and not the half:
+//     the high/low fold would refuse a function the kept slot lifts. Exact either way, so the
+//     shape keeps its slot rather than trade a lift for a decline.
+// A branch landing on the slot refuses below, rewrite or not; a recovered jump-table arm landing on
+// a freed slot refuses in `lift`, where the tables exist.
 //
 // Refuses, by name, every shape that placement cannot model. A nullified slot read as an ordinary
 // always-executed one is not a cosmetic error: `absi` would return `-x` for every `x >= 0`, and a
 // store in such a slot would be performed on a path that never performs it. That is C which
 // compiles and is wrong — strictly worse than the decline it would replace.
-function normaliseBranchLikely(name: string, instrs: Instr[], startAddr: number): Set<number> {
+function normaliseBranchLikely(
+  name: string,
+  instrs: Instr[],
+  startAddr: number,
+  relocOf: (ins: Instr) => DisasmReloc | null,
+  options: LiftOptions = {},
+): { likely: Set<number>; freed: Set<number> } {
   const likely = instrs.filter((ins) => ins.mnemonic in LIKELY_BASE);
-  if (likely.length === 0) {
-    return new Set();
+  const uncond = instrs.filter(isUncond);
+  if (likely.length === 0 && uncond.length === 0) {
+    return { likely: new Set(), freed: new Set() };
   }
   const refusal = (ins: Instr, why: string) =>
     new FrontendUnsupportedError(
@@ -397,6 +765,32 @@ function normaliseBranchLikely(name: string, instrs: Instr[], startAddr: number)
   const at = new Map(instrs.map((ins) => [ins.addr, ins]));
   const hex = (a: number) => `0x${a.toString(16)}`;
   const rewritten = new Set<number>();
+  const freed = new Set<number>();
+  // The words as listed, before any slot below is emptied.
+  const listed = new Map(at);
+  // `br T; S` → `br T-4; nop` when S is the word at T-4, stolen; true when it did.
+  const unsteal = (br: Instr, slot: Instr): boolean => {
+    const target = br.target!;
+    const stolen = at.get(target - 4);
+    const beforeStolen = at.get(target - 8);
+    if (
+      target === br.addr + 8 ||
+      stolen === undefined ||
+      !at.has(target) ||
+      (beforeStolen !== undefined && isControlTransfer(beforeStolen)) ||
+      !sameWord(slot, stolen, relocOf) ||
+      relocOf(slot)?.type === 'R_MIPS_LO16'
+    ) {
+      return false;
+    }
+    br.target = target - 4;
+    // The emptied slot is a fresh `nop`: the old word's relocation must not ride along with it.
+    const nop: Instr = { addr: slot.addr, mnemonic: 'nop', ops: [] };
+    instrs[instrs.indexOf(slot)] = nop;
+    at.set(slot.addr, nop);
+    freed.add(slot.addr);
+    return true;
+  };
   for (const br of likely) {
     const slot = at.get(br.addr + 4);
     const fallThrough = at.get(br.addr + 8);
@@ -433,9 +827,68 @@ function normaliseBranchLikely(name: string, instrs: Instr[], startAddr: number)
       throw refusal(br, 'another branch targets the delay slot, which would run it unconditioned');
     }
     br.mnemonic = LIKELY_BASE[br.mnemonic];
-    rewritten.add(br.addr);
+    if (!unsteal(br, slot)) {
+      rewritten.add(br.addr);
+    }
+  }
+  // AN UNCONDITIONAL `b`/`j` RUNS ITS SLOT ON ITS ONE EDGE ALONE, which is all the proof above asks
+  // of the slot, and the same fill steals the target's first word into it (`b T; S` with S at T-4:
+  // ido 1234, gcc 2.7.2 1075, KMC 51 in the splat corpus). Unretargeted, the copy is the `b`'s own
+  // body and T-4 a separate block reaching T, so a join that the two share is split into one arm
+  // per copy. Asked here only where nothing else depends on the slot: not a slot already empty, not
+  // a `b` in some transfer's own delay slot, not a slot another branch lands on (entered there, the
+  // word runs and the flow falls on to the `b`'s next word, not to T), and not a `j` relocated
+  // against a symbol, whose printed target is a field rather than an address (it refuses below).
+  for (const br of uncond) {
+    const slot = at.get(br.addr + 4);
+    const prev = at.get(br.addr - 4);
+    const reloc = br.mnemonic === 'j' ? relocOf(br) : null;
+    if (
+      br.target === undefined ||
+      slot === undefined ||
+      slot.mnemonic === 'nop' ||
+      isControlTransfer(slot) ||
+      targets.has(slot.addr) ||
+      (prev === undefined ? br.addr !== startAddr : isControlTransfer(prev)) ||
+      (reloc !== null && !reloc.sym.startsWith('.'))
+    ) {
+      continue;
+    }
+    // A `b` THAT JUMPS OVER EXACTLY THE ONE COPY (`b T; S; S; T:`, KMC `sw_void`, ido `mergeu16`)
+    // would, retargeted, jump to its own next word: the two arms are each written out, and nothing
+    // was stolen from T. That is a fact of the jump, so it is answered here.
+    if (br.target - 4 === br.addr + 8) {
+      continue;
+    }
+    // A COMMON TAIL OF TWO OR MORE WORDS is the question the asm leaves open: `sll; b T; sra`
+    // against `sll; sra; T:` (ido `mergenarrow`) is one sign extension per arm, written out twice,
+    // or a stolen `sra` whose arms the source merged — the same object either way. Retargeted, the
+    // `<< 16` stays in each arm and the `>> 16` moves past the join; kept, each arm reads as the
+    // one `(s16)` it is. Neither reading wins on the corpus (over the af/mp3/sbk2 splat functions
+    // with this shape, retargeting shortens 19 lifts and lengthens 3, `func_80026D34` the
+    // `mergenarrow` case), so the default retargets and the kept slot is the `/kept-slot` lift
+    // variation the differ referees. A likely slot emptied above the `b` is no common tail; one
+    // emptied before T still counts, as the word it was. A `nop` is no tail at all.
+    const before = listed.get(br.target - 8);
+    const tail =
+      prev !== undefined && prev.mnemonic !== 'nop' && before !== undefined && sameWord(prev, before, relocOf);
+    if (tail && options.keepTailSlots === true) {
+      continue;
+    }
+    if (unsteal(br, slot) && tail) {
+      options.onTailSlot?.();
+    }
+  }
+  return { likely: rewritten, freed };
+}
+
+/** Two words are the same instruction: one spelling and one relocation (or none on either). */
+function sameWord(a: Instr, b: Instr, relocOf: (ins: Instr) => DisasmReloc | null): boolean {
+  if (a.mnemonic !== b.mnemonic || a.ops.join() !== b.ops.join() || a.target !== b.target) {
+    return false;
   }
-  return rewritten;
+  const [ra, rb] = [relocOf(a), relocOf(b)];
+  return ra === null || rb === null ? ra === rb : ra.type === rb.type && ra.sym === rb.sym && ra.addend === rb.addend;
 }
 
 // EVERY control transfer this frontend models has a delay slot — the word at `branch + 4`, which
@@ -466,6 +919,368 @@ function checkDelaySlots(name: string, instrs: Instr[]): void {
   }
 }
 
+/** WHETHER THE RETURN ENDING BLOCK `bi` MAY HAND BACK A 64-BIT PAIR, read off the asm: O32 returns
+ *  one in v0:v1, the low word in v1, and v1 is also ordinary scratch, so the question is what each
+ *  write of v1 that reaches the return was made for. Two answers say "the low word":
+ *
+ *  - NOTHING IN THE FUNCTION READS IT, on any path from it. An optimising compiler computes no
+ *    dead value, so a write no instruction reads is one the caller reads (`lw v0,16(sp);
+ *    lw v1,20(sp)` for `return e;`, `mflo v1` for a product). A loop's induction update is read
+ *    round the back edge, and a value one arm of a branch reads is read, so neither counts.
+ *  - IT IS AN `addu`/`addiu` WHOSE SUM IS COMPARED, unsigned, against what it added: the carry out
+ *    of a 64-bit add's low word into its high one (`addu v1,a3,a0; sltu t,v1,a0`, `addiu v1,a1,5;
+ *    sltiu t,v1,5`). A pointer bound check compares the sum against something else (`addu v1,a1,a0;
+ *    sltu v0,v0,v1`). A function that computes a carry and returns only the high word is declined
+ *    with the pairs — loud, and the price of one rule.
+ *  - IT IS A COPY OF A REGISTER THAT STILL HOLDS THE SAME VALUE wherever v1 is read: the reads
+ *    could have named the source, so the copy is made for the caller (`move v1,a3; jr ra;
+ *    sw v1,4(a0)` for `*p = x; return x;`). A copy made because its source is about to be
+ *    overwritten (a swap, a pointer bumped after its old value is kept), or read past a join, is
+ *    scratch.
+ *
+ *  A call ends a path either way: it destroys v1 (`clobberedByCall`), and its delay slot runs
+ *  before it. The entry ends the backward walk, since what v1 held there is no value this
+ *  function computed. */
+function v1MayHoldLowWord(blocks: readonly MipsBlock[], preds: readonly (readonly number[])[], bi: number): boolean {
+  const readsV1 = (ins: Instr) => {
+    const dest = writtenReg(ins) !== null && writtenReg(ins) === ins.ops[0];
+    return ins.ops.some((o, k) => !(dest && k === 0) && (o === 'v1' || /\(v1\)$/.test(o)));
+  };
+  // Each block in execution order: a call's delay slot runs before the call.
+  const runs = blocks.map((b) => {
+    const seq = [...b.body, ...(b.branch ? [b.branch] : []), ...(b.delay ? [b.delay] : [])];
+    for (let k = 0; k + 1 < seq.length; k++) {
+      if (isCallInstr(seq[k])) {
+        [seq[k], seq[k + 1]] = [seq[k + 1], seq[k]];
+        k++;
+      }
+    }
+    return seq;
+  });
+  const succs = blocks.map((): number[] => []);
+  preds.forEach((ps, to) => ps.forEach((from) => succs[from].push(to)));
+  // What follows the write at `runs[at][k]` on every path, up to a call or the next write of v1:
+  // the instructions that read it, and whether register `src` is written meanwhile.
+  const after = (at: number, k: number, src: string | undefined) => {
+    const readers: Instr[] = [];
+    let srcWritten = false;
+    const seen = new Set<number>();
+    const from = (blk: number, start: number) => {
+      for (const ins of runs[blk].slice(start)) {
+        if (readsV1(ins)) {
+          readers.push(ins);
+        }
+        if (isCallInstr(ins) || writtenReg(ins) === 'v1') {
+          return;
+        }
+        srcWritten ||= src !== undefined && writtenReg(ins) === src;
+      }
+      for (const n of succs[blk]) {
+        if (!seen.has(n)) {
+          seen.add(n);
+          from(n, 0);
+        }
+      }
+    };
+    from(at, k + 1);
+    return { readers, srcWritten };
+  };
+  const lowWord = (at: number, k: number): boolean => {
+    const ins = runs[at][k];
+    const [, x, y] = ins.ops;
+    // A register copy's source, unless that is zero (a constant).
+    const copied = copiedReg(ins);
+    const src = copied === undefined || isZero(copied) ? undefined : copied;
+    const { readers, srcWritten } = after(at, k, src);
+    // The carry compares the sum against what was added: `sltu t,v1,X` for `addu v1,X,Y` (either
+    // addend other than v1 itself), `sltiu t,v1,k` for `addiu v1,X,k`.
+    const carries = (r: Instr) =>
+      r.ops[1] === 'v1' &&
+      ((ins.mnemonic === 'addu' && r.mnemonic === 'sltu' && r.ops[2] !== 'v1' && [x, y].includes(r.ops[2])) ||
+        (ins.mnemonic === 'addiu' && r.mnemonic === 'sltiu' && parseImm(r.ops[2] ?? '') === parseImm(y ?? '')));
+    // A copy is judged only where its every read follows it in its own block: a read past a join
+    // is where a compiler coalesces each arm's value into one register (`addu v1,a1,zero` on one
+    // arm, `ori v1,a1,0xe000` on the other), which is scratch.
+    const local = readers.every((r) => runs[at].indexOf(r) > k);
+    return readers.length === 0 || readers.some(carries) || (src !== undefined && !srcWritten && local);
+  };
+  // Every write of v1 that reaches the end of `bi`, walking back.
+  const seen = new Set<number>();
+  const back = (at: number, end: number): boolean => {
+    for (let k = end - 1; k >= 0; k--) {
+      const ins = runs[at][k];
+      if (isCallInstr(ins)) {
+        return false;
+      }
+      if (writtenReg(ins) === 'v1') {
+        return lowWord(at, k);
+      }
+    }
+    return preds[at].some((p) => !seen.has(p) && (seen.add(p), back(p, runs[p].length)));
+  };
+  return back(bi, runs[bi].length);
+}
+
+/** THE FRAME DEPTH AT EACH INSTRUCTION: how many bytes below the `sp` the function was entered
+ *  with it runs, so an `off(sp)` it makes names entry-relative byte `off - depth`. Exact or absent —
+ *  null wherever one number per instruction is not proven, and every reader then keeps its refusal.
+ *
+ *  Proven for the frame every compiler here builds: at most one `addiu sp,sp,-N`, in the entry
+ *  block (anywhere in it, IDO's leaves load before they push), and `addiu sp,sp,N` only in a block
+ *  that returns, after which the block runs at depth 0. The entry runs from depth 0 and every other
+ *  block from N, which holds because the entry runs once and every other block is reached through
+ *  it. Refused: any other write to `sp`, a second push, a push outside the entry or in an entry a
+ *  branch re-enters (the preheader's case), a pop of another size or in a block that does not
+ *  return. */
+function frameDepths(blocks: readonly MipsBlock[], entryReentered: boolean): ReadonlyMap<Instr, number> | null {
+  const depths = new Map<Instr, number>();
+  const adjust = (ins: Instr): number | null | undefined => {
+    if (!isStackPtr(writtenReg(ins) ?? '')) {
+      return undefined; // leaves sp alone
+    }
+    const by = parseImm(ins.ops[2] ?? '');
+    return (ins.mnemonic === 'addiu' || ins.mnemonic === 'addi') && isStackPtr(ins.ops[1] ?? '') && Number.isFinite(by)
+      ? by
+      : null;
+  };
+  const pushes = blocks.flatMap((b) => [...b.body, ...(b.delay ? [b.delay] : [])]).filter((i) => (adjust(i) ?? 0) < 0);
+  if (pushes.length > 1) {
+    return null;
+  }
+  const size = pushes.length === 1 ? -adjust(pushes[0])! : 0;
+  for (const [bi, b] of blocks.entries()) {
+    let depth = bi === 0 ? 0 : size;
+    for (const ins of [...b.body, ...(b.delay ? [b.delay] : [])]) {
+      depths.set(ins, depth);
+      const by = adjust(ins);
+      if (by === undefined) {
+        continue;
+      }
+      if (by === null) {
+        return null;
+      }
+      if (by < 0 && (bi !== 0 || entryReentered || depth !== 0)) {
+        return null;
+      }
+      if (by > 0 && (by !== depth || b.branch === null || !isReturn(b.branch))) {
+        return null;
+      }
+      depth -= by;
+    }
+  }
+  return depths;
+}
+
+/** What the return proof knows at one point: which registers hold the caller's return address on
+ *  every path (`regs`, `ra` among them while it is untouched), the instruction that last wrote
+ *  something else into `ra` on some path (`lost`), the entry-`sp` offset of the word it was saved
+ *  in (`slot`), and `sp`'s signed offset from its entry value (`depth`, -24 after `addiu sp,sp,-24`;
+ *  the opposite sign to `frameDepths`' positive depth), each null where unknown. */
+interface RaState {
+  readonly regs: ReadonlySet<string>;
+  readonly lost: Instr | null;
+  readonly slot: number | null;
+  readonly depth: number | null;
+}
+
+/** Bytes a store mnemonic writes. Only the stores the lowering models (`emitStore`) are named; the
+ *  proof treats any other instruction that writes no register and addresses memory through `sp`
+ *  (`swl`/`swr`, `sc`, `sd*`, `swc1`/`sdc1`, all refused earlier by `opaqueDest`'s `storeClass` or
+ *  the FPU arm today) as a store of unknown bytes, which overwrites the save word. */
+const STORE_BYTES: Readonly<Record<string, [before: number, width: number]>> = {
+  sb: [0, 1],
+  sh: [0, 2],
+  sw: [0, 4],
+};
+
+/** Whether `r` is one of the target's `kernelRegs` (O32's `k0`/`k1`), in any spelling. */
+const isKernelReg = (kernelRegs: readonly string[], r: string) =>
+  kernelRegs.includes(r === '$26' ? 'k0' : r === '$27' ? 'k1' : r.replace(/^\$/, ''));
+
+/** EVERY `jr ra` OF THIS FUNCTION JUMPS TO THE CALLER'S RETURN ADDRESS, or the lift declines — the
+ *  MIPS half of what `refuseReturnsNotThroughCallersLr` asks of Thumb (frontend/thumb.ts).
+ *
+ *  `jr ra` reads as a return from its operand alone, and it is one only where `ra` holds the address
+ *  this function was called with. It reads `ra` when it runs, before its delay slot. A forward
+ *  dataflow over the blocks tracks where that address is:
+ *    • `ra` holds it at entry; a call (`jal`) writes `ra`, runs its delay slot, and only then
+ *      destroys every register O32 lets a callee destroy (and its home area), so a slot's write is
+ *      exposed to the callee; a slot that writes `ra` refuses, since the callee then returns
+ *      somewhere other than the code after the call; a copy (`move`, `addu`/`or` with `zero`)
+ *      carries it on; any other write to a register — `lw ra,0(a0)`, `addiu ra,ra,8`, `lui ra` —
+ *      loses it;
+ *    • a `sw` of a register holding it through `sp` puts it in that word, named by its offset from
+ *      the entry `sp` (this walk follows `addiu sp,sp,N`; any other write to `sp` makes the depth
+ *      unknown), and a `lw` from that word copies it back out. Any other store reaching those bytes,
+ *      a store through `sp` at an unknown depth or of unknown width (`STORE_BYTES`), and a call whose
+ *      home area (`[sp, sp+16)` at the call) holds the word overwrite it.
+ *  Paths meet by agreement: a register or the word holds the address only if it does on every path
+ *  in, and a depth the paths disagree on is unknown.
+ *
+ *  So `move ra,a1; jr ra`, `lw ra,0(a0)`, `addiu ra,ra,8`, `lui ra,0x8000`, a `move ra` on one path
+ *  only, and a `jal` whose `ra` nothing reloaded all decline, where every compiler's `sw ra,N(sp)` …
+ *  `lw ra,N(sp)` and a leaf that never names `ra` are returns. A reload from a word another
+ *  register was saved in already refuses (`emitLoad`). No compiler emits a violation; hand-written
+ *  asm can, and it would otherwise lift as a C `return`. A tail call (`j` to another function) and an indirect
+ *  `jr` already refuse in `lift`, so `jr ra` is the only exit asked.
+ *
+ *  A copy into a kernel register (`kernelRegs`, O32's `k0`/`k1`) holds nothing: an exception handler
+ *  may overwrite it at any instruction, so `move k0,ra` … `move ra,k0` declines.
+ *
+ *  NOT ASKED: a store through a register holding a frame address is not traced to the save word.
+ *  A compiler addresses that word only through `sp`. */
+function refuseReturnsNotThroughCallersRa(
+  name: string,
+  blocks: readonly MipsBlock[],
+  succIdx: readonly number[][],
+  callerSaved: readonly string[],
+  kernelRegs: readonly string[],
+): void {
+  const canon = (r: string) => (r === '$ra' || r === '$31' ? 'ra' : r);
+  const join = (a: RaState, b: RaState): RaState => {
+    const regs = new Set([...a.regs].filter((r) => b.regs.has(r)));
+    const depth = a.depth !== null && a.depth === b.depth ? a.depth : null;
+    return {
+      regs,
+      lost: regs.has('ra') ? null : ((a.regs.has('ra') ? null : a.lost) ?? (b.regs.has('ra') ? null : b.lost)),
+      slot: depth !== null && a.slot !== null && a.slot === b.slot ? a.slot : null,
+      depth,
+    };
+  };
+  const same = (a: RaState, b: RaState) =>
+    a.lost === b.lost &&
+    a.slot === b.slot &&
+    a.depth === b.depth &&
+    a.regs.size === b.regs.size &&
+    [...a.regs].every((r) => b.regs.has(r));
+
+  const run = (bi: number, inState: RaState): RaState => {
+    const regs = new Set(inState.regs);
+    let { lost, slot, depth } = inState;
+    const b = blocks[bi];
+    const step = (ins: Instr): void => {
+      const mn = ins.mnemonic;
+      if (mn === 'jr' && canon(ins.ops[0] ?? '') === 'ra' && !regs.has('ra')) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': the 'jr ra' at 0x${ins.addr.toString(16)} may not return through the caller's ` +
+            `return address — ` +
+            (lost === null
+              ? `ra does not hold it on some path`
+              : `on some path the '${lost.mnemonic}' at 0x${lost.addr.toString(16)} wrote ra, and no reload from ` +
+                `the word it was saved in put it back`),
+        );
+      }
+      const store = STORE_BYTES[mn];
+      if (store !== undefined) {
+        const mem = ins.ops[1] ?? '';
+        if (mem.includes('(') && isStackPtr(parseMem(mem).base)) {
+          const at = depth === null ? null : parseMem(mem).off + depth;
+          if (mn === 'sw' && at !== null && regs.has(canon(ins.ops[0]))) {
+            slot = at;
+          } else if (at === null || (slot !== null && at - store[0] < slot + 4 && at - store[0] + store[1] > slot)) {
+            slot = null;
+          }
+        }
+        return;
+      }
+      const w = writtenReg(ins);
+      if (w === null) {
+        if (ins.ops.some((op) => op.includes('(') && isStackPtr(parseMem(op).base))) {
+          slot = null;
+        }
+        return;
+      }
+      const dest = canon(w);
+      const mem = ins.ops[1] ?? '';
+      const reload =
+        mn === 'lw' &&
+        slot !== null &&
+        depth !== null &&
+        mem.includes('(') &&
+        isStackPtr(parseMem(mem).base) &&
+        parseMem(mem).off + depth === slot;
+      const copy = copiedReg(ins);
+      const holds = !isKernelReg(kernelRegs, dest) && (reload || (copy !== undefined && regs.has(canon(copy))));
+      if (isStackPtr(dest)) {
+        depth =
+          depth !== null &&
+          /^addiu?$/.test(mn) &&
+          isStackPtr(ins.ops[1] ?? '') &&
+          /^-?(0x)?[0-9a-f]+$/i.test(ins.ops[2] ?? '')
+            ? depth + parseImm(ins.ops[2])
+            : null;
+      }
+      if (holds) {
+        regs.add(dest);
+      } else {
+        regs.delete(dest);
+        if (dest === 'ra') {
+          lost = ins;
+        }
+      }
+      if (dest === 'ra' && holds) {
+        lost = null;
+      }
+    };
+    // A call links `ra`, runs its delay slot, then enters the callee (the doc above). The lowering
+    // refuses a `jal` whose slot is not the next word of its block, and every other linking transfer
+    // before `toBlocks`, so this walk only asserts it.
+    const seq = [...b.body, ...(b.branch ? [b.branch] : []), ...(b.delay ? [b.delay] : [])];
+    for (let k = 0; k < seq.length; k++) {
+      const call = seq[k];
+      if (!isCallInstr(call)) {
+        step(call);
+        continue;
+      }
+      regs.delete('ra');
+      lost = call;
+      const delay = seq[k + 1];
+      if (delay?.addr !== call.addr + 4) {
+        throw new Error(
+          `internal: the '${call.mnemonic}' at 0x${call.addr.toString(16)} in '${name}' reached the return proof ` +
+            `without its delay slot as the next instruction of its block, which the lowering's fill loop refuses`,
+        );
+      }
+      const w = writtenReg(delay);
+      if (w !== null && canon(w) === 'ra') {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': the '${delay.mnemonic}' at 0x${delay.addr.toString(16)} in the delay slot of the ` +
+            `'${call.mnemonic}' at 0x${call.addr.toString(16)} writes ra, so the callee may not return through the ` +
+            `caller's return address to the code after the call`,
+        );
+      }
+      step(delay);
+      k++;
+      for (const r of callerSaved) {
+        regs.delete(r);
+      }
+      if (slot !== null && (depth === null || (slot >= depth && slot < depth + STACK_ARGS_AT))) {
+        slot = null;
+      }
+    }
+    return { regs, lost, slot, depth };
+  };
+
+  if (blocks.length === 0) {
+    return;
+  }
+  const into: Array<RaState | undefined> = blocks.map(() => undefined);
+  into[0] = { regs: new Set(['ra']), lost: null, slot: null, depth: 0 };
+  const work = [0];
+  while (work.length) {
+    const bi = work.pop()!;
+    const out = run(bi, into[bi]!);
+    for (const s of succIdx[bi]) {
+      const prev = into[s];
+      const next = prev === undefined ? out : join(prev, out);
+      if (prev === undefined || !same(prev, next)) {
+        into[s] = next;
+        work.push(s);
+      }
+    }
+  }
+}
+
 // Split the instruction stream into basic blocks. Delay slots are consumed into their
 // branching block; leaders are the entry, every branch target, and each conditional branch's
 // fall-through. A branch-LIKELY's slot is not consumed — it becomes its own block (see
@@ -582,15 +1397,39 @@ function toBlocks(
   return { blocks: blocks.filter((b) => reachable.has(b)), succAddrs };
 }
 
-/** Lift disassembled MIPS text → an L1 Fn with block-argument SSA. `prototypes` reserved for
- *  call arity (calls are a later milestone). */
+/** Lift disassembled MIPS text → an L1 Fn with block-argument SSA. `prototypes` declares each
+ *  callee's arity (`frontend/call-plan.ts`).
+ *
+ *  AT MOST TWICE, as on Thumb (`frontend/frame-objects.ts` `liftWithRelift`): where the frame-object audit answers
+ *  that a callee may write the local area without bound, or that nothing escapes and the per-object
+ *  model does not describe it, it asks for the area kept as one object, and the second lift's audit
+ *  judges it so and refuses rather than asking again. */
 export function lift(
   name: string,
   asm: string,
   target: TargetDescription,
-  _prototypes: Prototypes = {},
+  prototypes: Prototypes = {},
   asmData?: AsmData,
+  symbols?: SymbolMap,
+  context?: ContextGlobals,
+  options: LiftOptions = {},
 ): Fn {
+  return liftWithRelift(name, (oneObject) =>
+    liftOnce(name, asm, target, prototypes, asmData, symbols, context, oneObject, options),
+  );
+}
+
+function liftOnce(
+  name: string,
+  asm: string,
+  target: TargetDescription,
+  prototypes: Prototypes,
+  asmData: AsmData | undefined,
+  symbols: SymbolMap | undefined,
+  context: ContextGlobals | undefined,
+  oneObject: FrameRange | undefined,
+  options: LiftOptions,
+): Fn | FrameObjectRelift {
   // Two input dialects reach this frontend: `objdump -d` text (IDO/KMC — no compiler-emitted asm),
   // and Splat-disassembled `.s` (pmret-style N64 projects). Splat is normalised to the SAME
   // DisasmInstr[] shape (frontend/splat.ts) so everything below is dialect-agnostic.
@@ -604,38 +1443,56 @@ export function lift(
   if (instrs.length === 0) {
     throw new FrontendUnsupportedError(`cannot lift '${name}': no instructions found in the input text`);
   }
+  // $30 has two names, and everything below keys a register by its spelling.
+  unifyRegisterSpellings(instrs, O32_REGISTER_ALIASES);
   // Headerless input — a raw fragment, and every Splat listing — says where the function starts
   // only by its first line.
   const startAddr = (splat ? undefined : symbolStart(sliced)) ?? instrs[0].addr;
-  // An FP condition-code branch is a DIFFERENT gap from a branch-likely, and saying so is what lets
-  // each be worked on alone: `bc1fl` is both, and the condition code blocks it either way. Asked
-  // FIRST, before the likely rewrite, so that a function carrying both reports the FP gap rather
-  // than whatever the likely placement happens to say about the other branch.
+  // An FP condition-code branch this frontend cannot read — one naming a MIPS IV condition code, or
+  // any on a target with no FPU homes — is a DIFFERENT gap from a branch-likely, and saying so is
+  // what lets each be worked on alone. Asked FIRST, before the likely rewrite, so that a function
+  // carrying both reports the FP gap rather than whatever the likely placement says about it.
   for (const ins of instrs) {
-    if (isFpCondBranch(ins.mnemonic)) {
+    const plain = LIKELY_BASE[ins.mnemonic] ?? ins.mnemonic;
+    if (isFpCondBranch(ins.mnemonic) && !(target.fpu && plain in FP_COND_BRANCH && ins.ops.length === 1)) {
       throw new FrontendUnsupportedError(
         `cannot lift '${name}': floating-point condition-code branch '${ins.mnemonic}' at 0x${ins.addr.toString(16)} ` +
-          `— the FP condition code is not modelled`,
+          '— only the one condition code a `c.cond` sets, named by the target alone, is modelled',
       );
     }
   }
   // BRANCH-LIKELY is rewritten to its ordinary branch FIRST, so everything downstream — jump-table
   // recovery's block-boundary walk included — sees one branch vocabulary. What stays special is the
   // slot, and `toBlocks` is where that is placed.
-  const likelyAddrs = normaliseBranchLikely(name, instrs, startAddr);
+  // A word's relocation is on the word in Splat text, and in the object's table for objdump.
+  const relocOf = (ins: Instr): DisasmReloc | null =>
+    splat ? (ins.reloc ?? null) : asmData ? textRelocAt(asmData, ins.addr) : null;
+  const { likely: likelyAddrs, freed: freedSlots } = normaliseBranchLikely(name, instrs, startAddr, relocOf, options);
   // Regime B: recover jump tables from the `jr`-dispatch idiom + the AsmData table. A recovered
   // dispatch's `jr` is subsumed into a `switch_br` (emitted from its bounds block), so it is
   // exempted from the loud-fail below; an UNrecovered `jr <non-ra>` still fails loud.
-  const jts = asmData ? recoverMipsJumpTables(instrs, asmData) : new Map<number, MipsJT>();
+  const jts = asmData ? recoverMipsJumpTables(instrs, asmData, likelyAddrs) : new Map<number, MipsJT>();
   const recoveredJr = new Set([...jts.values()].map((j) => j.jrAddr));
-  // THE TWO WAYS A RECOVERED TABLE MEETS AN ANNULLED SLOT, neither of which `normaliseBranchLikely`
-  // can see: the table does not exist while it runs. (1) The dispatch's bounds branch emits a
-  // `switch_br`, which runs its delay slot unconditionally — a nullified slot is not that. (2) An
-  // arm of the table lands ON a nullified slot, which would run the slot with no branch
-  // conditioning it and then jump to that branch's target: `case 1:` would take the taken arm's
-  // value where the hardware runs the slot and falls on through. Neither idiom has ever been seen
-  // in the corpus; refuse rather than answer either one wrong.
+  // THE WAYS A RECOVERED TABLE MEETS A LIKELY SLOT, none of which `normaliseBranchLikely` can see:
+  // the table does not exist while it runs. (1) The dispatch's bounds branch emits a `switch_br`,
+  // which runs its delay slot unconditionally — a nullified slot is not that. KMC writes this
+  // bounds branch as `beqzl at,DEF` with DEF's first word in the slot (`sw_h3`..`sw_h5`), and that
+  // one was retargeted to an ordinary branch before it got here; a slot that is NOT the default's
+  // stolen word still refuses. (2) An arm of the table lands ON a nullified slot, which would run
+  // the slot with no branch conditioning it and then jump to that branch's target: `case 1:` would
+  // take the taken arm's value where the hardware runs the slot and falls on through. (3) An arm
+  // lands on a slot the rewrite EMPTIED, a likely branch's or a `b`/`j`'s, which would run the
+  // `nop` where the hardware runs the word it replaced. (2) and (3) have never been seen in the
+  // corpus; refuse rather than answer any of them wrong.
   const jtArms = new Set([...jts.values()].flatMap((jt) => [...jt.caseAddrs, jt.defaultAddr]));
+  for (const addr of freedSlots) {
+    if (jtArms.has(addr)) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': a recovered switch arm lands on the delay slot at 0x${addr.toString(16)}, ` +
+          'which the stolen-slot rewrite of a branch-likely or `b`/`j` emptied',
+      );
+    }
+  }
   for (const addr of likelyAddrs) {
     if (jts.has(addr)) {
       throw new FrontendUnsupportedError(
@@ -652,19 +1509,27 @@ export function lift(
   // text spells the halves and writes its own records). Runs AFTER jump-table recovery, so that
   // reads `.text` relocs pristine and a recovered table base is decided before any of this.
   if (!splat && asmData) {
-    attachMipsRelocs(name, instrs, asmData);
+    attachMipsRelocs(name, instrs, asmData, freedSlots);
   }
   // TRUSTWORTHINESS: fail LOUD on a control transfer this frontend cannot model — the `opaque`
-  // path cannot catch these (implicit or no register destination). `jal`/`jalr` clobber `v0`
-  // implicitly, so dropping a call fabricates `v0` from a stale value; a `jr` to anything but `ra`
-  // (jump table / computed goto) is not a plain return. Calls are a later milestone; until then
-  // they are a catchable "out of scope" signal, mirroring the PPC frontend.
+  // path cannot catch these (implicit or no register destination). A `jalr` clobbers `v0`
+  // implicitly, so dropping it fabricates `v0` from a stale value, and the callee it reaches is a
+  // register's value; a `jr` to anything but `ra` (jump table / computed goto) is not a plain
+  // return. `jal` is lowered where its block is filled (`lowerJal`).
   for (const ins of instrs) {
-    if (ins.mnemonic === 'jal' || ins.mnemonic === 'jalr') {
+    if (ins.mnemonic === 'jalr') {
       throw new FrontendUnsupportedError(
         `cannot lift '${name}': function call '${ins.mnemonic}' at 0x${ins.addr.toString(16)} — MIPS calls not yet modelled`,
       );
     }
+    // A `j` relocated against a symbol leaves this section's code for another function's, which is
+    // a tail call; the target objdump prints is the field, not the address.
+    if (ins.mnemonic === 'j' && ins.reloc !== undefined && !ins.reloc.sym.startsWith('.')) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': 'j' at 0x${ins.addr.toString(16)} jumps to '${ins.reloc.sym}' — a tail call into ` +
+          'another function is not modelled',
+      );
+    }
     if (ins.mnemonic === 'jr' && ins.ops[0] !== 'ra' && !recoveredJr.has(ins.addr)) {
       throw new FrontendUnsupportedError(
         `cannot lift '${name}': indirect jump 'jr ${ins.ops[0] ?? ''}' at 0x${ins.addr.toString(16)} — jump tables / tail calls not supported`,
@@ -682,6 +1547,26 @@ export function lift(
   }
   checkDelaySlots(name, instrs);
   const { blocks, succAddrs } = toBlocks(instrs, jts, likelyAddrs);
+  // `isReturn` reads every surviving non-`ra` `jr` as a return, which holds only while each
+  // recovered dispatch's block is pruned (frontend/jump-table.ts).
+  refuseReachableDispatch(name, blocks, recoveredJr, (m) => {
+    throw new FrontendUnsupportedError(m);
+  });
+  // PREHEADER, as in frontend/ppc.ts: an entry that is a branch target gets an empty block ahead of
+  // it, whose live-ins are the function's parameters. One word below the function, so it falls
+  // through to it.
+  const entryReentered = blocks.some((b) => succAddrs.get(b)!.includes(blocks[0].startAddr));
+  if (entryReentered) {
+    const ph: MipsBlock = {
+      startAddr: blocks[0].startAddr - 4,
+      body: [],
+      branch: null,
+      delay: null,
+      delayAnnulled: false,
+    };
+    succAddrs.set(ph, [blocks[0].startAddr]);
+    blocks.unshift(ph);
+  }
   const idxOf = new Map(blocks.map((b, i) => [b.startAddr, i]));
 
   // CFG predecessors by block index.
@@ -695,47 +1580,364 @@ export function lift(
     }
   });
 
-  // NO FRAME PARTITION IS CLAIMED, so every def-less slot read refuses (frontend/ssa.ts,
-  // LiveInModel). This frontend has no frame bound at all — `addiu sp,sp,±N` is transparent and
-  // every word sp-relative access becomes `sp@<rawOff>` — so its slot keys span O32's CALLER-owned
-  // register-parameter home area and the incoming stack arguments above it, where a def-less read
-  // is argument 5, not an uninitialised local.
+  // THE SLOT MODEL CLAIMS ONE PARTITION, `ownedLocals` (`ownedFrame`, below): a def-less read of a
+  // word this function provably owns is an uninitialised local, and any other def-less slot read
+  // refuses (frontend/ssa.ts, LiveInModel) unless `emitLoad` places it. It declares no
+  // `declaredLocals`, so no slot is stamped a declaration rank. A slot key is the RAW `sp@<off>`;
+  // what the offset names is read through the frame depth (`frameDepths`, below): a word at or past
+  // entry + 16 is incoming stack argument k, read and written as `@sarg<k>` (`incomingStackKey`;
+  // O32's `<pentry offset="16">` in `mips32be.cspec`), and `[0,16)` at entry is the caller-owned
+  // home of a0..a3, which is in neither range. A function that takes a frame address gets a local
+  // area as well (`measureO32Frame`, `compilerBehaviors.o32LocalArea`), whose accesses are memory
+  // through an `laddr` the shared frame-object audit proves, as on Thumb.
   //
-  // Claiming one needs the frame SIZE those offsets are measured against, which is not computed
-  // here, plus ensureParam for the register half. The ranges themselves are known: O32 reserves
-  // `[0,16)` as the caller-owned home area (in NEITHER range — caller-owned, but not an argument)
-  // with stack arguments from 16 up, which is what `mips32be.cspec`'s `<localrange>` and stack
-  // `<pentry offset="16">` encode.
-  const ssa = makeSsaBuilder(name, blocks.length, preds);
+  // THE REGISTER HALF of the live-in model IS claimed: a def-less read of a register O32 passes no
+  // argument in, and that is scratch or the prologue saved (`prologueSavedRegs`), is an
+  // uninitialised local (`registerLiveIns`, frontend/ssa.ts, as on Thumb and PPC). The saves are
+  // measured HERE, before any block is lowered, because the builder evaluates the model once, at
+  // its first use, while `saveSlots` below fills progressively. The function's own declaration
+  // bounds the argument registers (`ownArgumentWordsOn`): KMC and gcc 2.7.2 home a local in a2/a3
+  // past a two-parameter one.
+  const fpType = fpPrecision(instrs, (m) => FP_ARITH[m]?.width ?? FP_CONVERT[m]?.width ?? FP_COMPARE[m]?.width);
+  const savedRegs = prologueSavedRegs(
+    [...blocks[0].body, ...(blocks[0].delay ? [blocks[0].delay] : [])],
+    target,
+    instrs,
+  );
+  // The frame half is measured further down (`ownedFrame`), once the frame depths are; a model the
+  // builder asks for before that claims no frame, which only refuses more.
+  let ownedFrameOf: (() => { from: number; to: number } | undefined) | undefined;
+  const liveIns = registerLiveIns(
+    target,
+    savedRegs,
+    options.contextOwnWords ?? ownArgumentWordsOn(name, prototypes[name], target),
+  );
+  const ssa = makeSsaBuilder(
+    name,
+    blocks.length,
+    preds,
+    () => {
+      const owned = ownedFrameOf?.();
+      return {
+        ...liveIns,
+        saveSite: 'store in its entry block',
+        ...(owned === undefined ? {} : { ownedLocals: owned }),
+      };
+    },
+    (k) => (isFpKey(k) ? (fpType ?? T.f32()) : undefined),
+    liveIns.globalRegs,
+  );
   const { irBlocks, readVar, writeVar, paramReg } = ssa;
   const RET = target.returnReg;
+  // Whether this function's own declaration says its return fits one word (`v1MayHoldLowWord`):
+  // void, or a scalar or pointer no wider than 32 bits. An aggregate says nothing here. A declared
+  // WIDER return is refused for every frontend after the lift (pipeline.ts
+  // `refuseNarrowReturnsOfWideDeclaration`), so this only clears the asm rule, never requires it.
+  const own = prototypes[name];
+  const ownWidth = ownReturnWidth(own);
+  const ownReturnFitsAWord = declaresVoidReturn(own) || (ownWidth !== undefined && ownWidth <= 32);
   const ARG_REGS = target.argRegs;
+  const fpu = target.fpu;
+  const bodyInstrs = blocks.flatMap((b) => (b.delay ? [...b.body, b.delay] : b.body));
+  // Which home the function returns in (frontend/fpu.ts `returnHomeRule`). The branches count: a
+  // condition-code branch is how a compare's answer reaches the integer file.
+  const homeRule: ReturnHomeRule = !fpu
+    ? { home: 'integer', declared: false }
+    : returnHomeRule(
+        ownDeclarationOf(name, prototypes, options.contextOwnProto),
+        [...bodyInstrs, ...blocks.flatMap((b) => (b.branch ? [b.branch] : []))].some((ins) =>
+          crossesToIntegers(ins.mnemonic),
+        ),
+        () => writesFloatReturn(bodyInstrs, FP_FLOAT_WRITERS, mipsEvenFpKey, fpu),
+      );
+  const floatReturn = homeRule.home === 'float';
 
   // The pending `%hi` halves of this function's global addresses, keyed by the SSA VALUE each `lui`
   // defines (frontend/high-half.ts holds the invariant and why a register-keyed map cannot answer
   // the question; frontend/ppc.ts folds the same one). FUNCTION-scoped, because a value is: a pair
   // split across blocks folds when SSA says the half reaches, and refuses when what arrives is the
   // block parameter standing for a merge.
-  const highHalves = makeHighHalves({
-    hi: '%hi',
-    hiArticle: 'a',
-    lo: '%lo',
-    fail: (message) => {
-      throw new FrontendUnsupportedError(message);
-    },
+  /** This frontend's refusal, for the shared code that refuses on its behalf. */
+  const fail: FrontendRefusal = (message) => {
+    throw new FrontendUnsupportedError(message);
+  };
+  const highHalves = makeHighHalves({ hi: '%hi', hiArticle: 'a', lo: '%lo', fail });
+  /** The jump-table bases a recovered dispatch reads from outside its own block — the `%lo` that
+   *  completes one defines no value but the base (frontend/jump-table.ts). */
+  const tableBases = makeTableBases(
+    [...jts.values()].flatMap((j) => (j.hoisted ? [j.hoisted] : [])),
+    fail,
+  );
+  /** What this frontend defines registers with that is no argument: a pending `%hi` half and a
+   *  table base. */
+  const placeholders = {
+    has: (v: Value) => highHalves.has(v) || tableBases.has(v),
+    guardRead: (n: string, r: string, v: Value) => tableBases.guardRead(n, r, highHalves.guardRead(n, r, v)),
+  };
+  // A table entry naming an address no block of this function starts at (another function's
+  // code, read off a table that is not this dispatch's) declines here, before any arm is built.
+  const armBlock = (addr: number): number => {
+    const j = idxOf.get(addr);
+    if (j === undefined) {
+      throw new FrontendUnsupportedError(`cannot lift '${name}': jump-table target is not a block boundary`);
+    }
+    return j;
+  };
+  // What an elided dispatch left at each case target's entry (jump-table.ts `caseEntries`), and the
+  // markers written there, by value. Not a placeholder: a case may copy one (`move v0,at`), and a
+  // return or a call that skipped it would drop what the case handed on.
+  const entries = caseEntries(
+    blocks.flatMap((b, at) => {
+      const jt = b.branch ? jts.get(b.branch.addr) : undefined;
+      return jt === undefined
+        ? []
+        : [
+            {
+              at,
+              scrutReg: jt.scrutReg,
+              cases: jt.caseAddrs.map(armBlock),
+              defaultBlock: armBlock(jt.defaultAddr),
+              leaves: jt.leaves,
+            },
+          ];
+    }),
+    preds,
+  );
+  const staleIdiom = new Map<Value, StaleIdiomRead>();
+  const parked = parkedIn(staleIdiom);
+  const scaledIndex = scaledIndexIn(staleIdiom);
+  // O32 passes the words past a0..a3 on the stack, returns a word in v0, and returns every struct
+  // and union through a hidden pointer in a0 (`aggregateReturn: 'memory'`). This lowering builds no
+  // register pair, so the plan refuses one. A call through an argument register bounds no arity
+  // here: a leading float leaves a0 free.
+  const calls = callDeclarations(
+    name,
+    target,
+    prototypes,
+    { pairs: false, memoryReturn: true, stackArgs: true, voidReturn: true, argRegisterBoundsArity: false },
+    fail,
+    () => ownDeclarationOf(name, prototypes, options.contextOwnProto),
+  );
+  // The first instruction naming the FPU's file, a data register or the control register. A call
+  // in a function that has one refuses: which floating-point registers a callee reads, returns in
+  // and destroys is not modelled. A float that crosses the call untouched in $f12 or $f0 names no
+  // register here, so only the callee's declaration shows it (`plan`).
+  const fpuInstr = instrs.find(
+    (ins) => /^(cfc1|ctc1)$/i.test(ins.mnemonic) || ins.ops.some((o) => MIPS_FP_REG.test(o)),
+  );
+
+  // THE FRAME A CALL'S STACK ARGUMENTS ARE STAGED IN: the bytes one `addiu sp,sp,-N` pushed. Its
+  // outgoing area is `[16, N)`; a word at or above N is this function's own incoming home area, which
+  // IDO stores a0..a3 to, so it is never an argument of a call made here. Undefined where the
+  // function pushes no frame or more than one.
+  const pushes = instrs.filter(
+    (ins) =>
+      (ins.mnemonic === 'addiu' || ins.mnemonic === 'addi') &&
+      isStackPtr(ins.ops[0]) &&
+      isStackPtr(ins.ops[1] ?? '') &&
+      parseImm(ins.ops[2] ?? '') < 0,
+  );
+  const frameSize = pushes.length === 1 ? -parseImm(pushes[0].ops[2]) : undefined;
+  const depthAt = frameDepths(blocks, entryReentered);
+  // AN INCOMING STACK WORD HAS ONE NAME, `@sarg<k>`, for its loads AND its stores: O32 passes
+  // argument word k >= 4 at entry sp + 16 + 4(k-4), above the caller's 16-byte home of a0..a3, and
+  // a word slot there is keyed by that entry-relative position (`frameDepths`), never by the raw
+  // `sp@<off>` of the depth it was reached at. A function that assigns to its stack parameter (IDO
+  // stores it back in place: `if (a) e = b;` is `beqz a0; sw a1,40(sp)`) is then the same SSA
+  // variable as one that assigns to a register parameter: a read no store reaches is the caller's
+  // argument through the ordinary live-in path, and one a store reaches on some paths is the merge
+  // of the two. The store keeps no memory effect, which is sound because nothing else reads the
+  // word: the caller never reads its outgoing area back (`compilerBehaviors` on all three O32
+  // compilers, measured), a sub-word or FPU access to it turns the slot model off or refuses
+  // (`spSlotSafe`, the FP arm), and taking its address refuses (it is outside the local area).
+  // Undefined for every other word, and wherever the depth walk could not measure the frame.
+  const incomingStackKey = (ins: Instr, off: number): string | undefined => {
+    const depth = depthAt?.get(ins);
+    const entryOff = depth === undefined ? undefined : off - depth;
+    return entryOff === undefined ? undefined : incomingStackArgKey(entryOff, STACK_ARGS_AT, ARG_REGS.length);
+  };
+
+  // THE FRAME'S SAVES. A word store of `ra`, or of a register O32 does not let a callee destroy,
+  // made while the register still holds what the caller left in it, is a SAVE: the word holds the
+  // caller's value, which no C value names, so the store mints no parameter. The reload into the
+  // same register is the restore, and what it writes refuses any use, as a `%hi` half does: a read
+  // at once, a use reached through a merge once the function is built. A reload into another
+  // register refuses. Every other word store is a VALUE slot, and a slot is one kind for the whole
+  // function. Keyed by the raw `sp` offset, as every slot here is, so a prologue save matches an
+  // epilogue restore in any block.
+  const saveSlots = new Map<number, string>();
+  const valueSlots = new Set<number>();
+  const restores = new Map<Value, { reg: string; addr: number }>();
+  // Each `lw` that restores a save, and the register it restores: a save holds only while every path
+  // restores it after its last write (`refuseSavedRegisterLeaks`).
+  const restoredBy = new Map<Instr, ReadonlySet<string>>();
+  // Every load into the register the compiler discards an unused read into at a level that keeps a
+  // plain one (`compilerBehaviors.discardsUnusedReadsInto`, frontend/dead-reads.ts `discarded`):
+  // IDO's `lw zero`, which `write` drops, so the load's value is recorded here or nowhere.
+  const discarded = new Set<Value>();
+  const discardReg = target.compilerBehaviors.discardsUnusedReadsInto;
+  const discards = (r: string) => discardReg !== undefined && (r === discardReg || (isZero(r) && isZero(discardReg)));
+  // A `$`-spelt operand is an FPU register or a bare number, and the target's list names neither.
+  const savedByCallee = (r: string) =>
+    r === 'ra' || (!r.startsWith('$') && !target.callerSaved.includes(r) && !['zero', 'sp', 'gp'].includes(r));
+  const refuseMixedSlot = (ins: Instr, mem: string, off: number, kind: 'save' | 'value') => {
+    if (kind === 'save' ? valueSlots.has(off) : saveSlots.has(off)) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': local stack frames not supported — '${mem}' at 0x${ins.addr.toString(16)} ` +
+          `is a word this function both saves a register in and stores a value to`,
+      );
+    }
+  };
+
+  const code = blocks.flatMap((b) => [...b.body, ...(b.delay ? [b.delay] : [])]);
+  // THE LOADED-WORD BOUND (`compilerBehaviors.outgoingAreaNeverLoadedFrom`, 16 on all three O32
+  // toolchains): the lowest frame word this function LOADS at the frame's own depth from that
+  // offset up, or `Infinity`. No word at or above it is any call's stack argument (the field says
+  // why); below 16 a load proves nothing, since the compilers load back the a1..a3 home words they
+  // stage a by-value aggregate in. Every block here is entry-reachable, so every load counted can
+  // run; a load at another depth names other storage under the same raw offset and is not counted.
+  // Read once, before the frame is partitioned: it caps where an unsized call's outgoing area can
+  // end (`o32OutgoingArea`'s `widest`, which the local area's partition and the owned range of an
+  // uninitialised read take), the a0..a3 guess below weighs only the words beneath it, and the
+  // frame-object audit takes it too (`loadedWords`), counting what the IR does not show the audit:
+  // the slot reloads and the epilogue's `lw ra`.
+  const loadedFrom = target.compilerBehaviors.outgoingAreaNeverLoadedFrom;
+  const loadedWordBound = ((): number => {
+    if (loadedFrom === undefined || frameSize === undefined || depthAt === null) {
+      return Infinity;
+    }
+    let bound = Infinity;
+    for (const ins of code) {
+      const last = ins.ops[ins.ops.length - 1] ?? '';
+      if (!MIPS_FRAME_LOAD.test(ins.mnemonic) || !last.includes('(') || depthAt.get(ins) !== frameSize) {
+        continue;
+      }
+      const { base, off } = parseMem(last);
+      const word = off - (((off % 4) + 4) % 4);
+      if (isStackPtr(base) && word >= loadedFrom) {
+        bound = Math.min(bound, word);
+      }
+    }
+    return bound;
+  })();
+
+  // THE LOCAL AREA, where a function takes a frame address (`measureO32Frame`): every `off(sp)`
+  // access inside it is MEMORY, read and written through an `laddr` the frame-object audit then
+  // proves, and every one outside it keeps the slot model below. Null where no frame address is
+  // taken, or the frame is one this cannot partition, and then every capture keeps the
+  // sp-as-data refusal.
+  /** The stack words a `jal`'s callee takes, by its declaration; null where nothing declares it. */
+  const stackWordsOf = (callee: string | undefined): number | null => {
+    const declared = callee === undefined ? null : calls.declaredCall(callee);
+    return declared === null ? null : Math.max(0, wordsOf(declared.widths, target) - ARG_REGS.length);
+  };
+  const frame = measureO32Frame({
+    name,
+    code,
+    entry: [...blocks[0].body, ...(blocks[0].delay ? [blocks[0].delay] : [])],
+    depthAt,
+    frameSize,
+    rule: target.compilerBehaviors.o32LocalArea,
+    stackWordsOf,
+    savedByCallee,
+    splat,
+    loadedWordBound,
   });
+  /** Whether `off(sp)` at `ins` is an access inside the local area, refusing one that straddles its
+   *  edge: half memory and half slot is neither. */
+  const inLocalArea = (ins: Instr, off: number, width: number): boolean => {
+    // The area is in post-push offsets, and `off` is the access's own: before the push (IDO's
+    // leaves load first) or after the pop it names the byte `size - depth` higher, so an incoming
+    // stack word read at entry as `lw t6,16(sp)` is not the local a later `0(sp)` stores, whatever
+    // the raw numbers say. `measureO32Frame` refuses an access at another depth whose TRUE position
+    // lies in the area, so one at another depth is never in it.
+    if (frame === null || depthAt?.get(ins) !== frame.size) {
+      return false;
+    }
+    if (off >= frame.area.to || off + width <= frame.area.from) {
+      return false;
+    }
+    if (off < frame.area.from || off + width > frame.area.to) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': address-taken stack local — '${ins.mnemonic}' at 0x${ins.addr.toString(16)} reaches across an edge of the ` +
+          `local area, sp+${frame.area.from} up to sp+${frame.area.to} — part memory, part slot`,
+      );
+    }
+    return true;
+  };
 
   // SOUNDNESS GUARD. The word stack-slot model (emitLoad/emitStore) is safe ONLY when every
-  // sp-relative access in the function is word-width. If a SUB-WORD sp access aliases a word slot
+  // sp-relative access it keys is word-width. If a SUB-WORD sp access aliases a word slot
   // (`sw a0,4(sp)` then `lbu v0,4(sp)`), routing the word store to an SSA slot while the sub-word
   // reload stays on the memory path DROPS the store and reads uninitialised memory — a silent
   // miscompile that ALSO masks the struct-overlap loud-fail (raise/structs.ts). So if ANY sub-word
-  // sp access exists, disable slot-modelling for the whole function: everything sp-relative falls
-  // back to the memory path, which loud-fails on a genuine overlap instead of miscompiling.
-  const spSlotSafe = !instrs.some(
-    (ins) =>
-      SUBWORD_MEM.has(ins.mnemonic) && ins.ops.length > 0 && isStackPtr(parseMem(ins.ops[ins.ops.length - 1]).base),
-  );
+  // sp access exists OUTSIDE the local area, disable slot-modelling for the whole function:
+  // everything sp-relative falls back to the memory path, which loud-fails on a genuine overlap
+  // instead of miscompiling. One inside it is memory like every access there (`inLocalArea`).
+  const spSlotSafe = !code.some((ins) => {
+    if (!SUBWORD_MEM.has(ins.mnemonic) || ins.ops.length === 0) {
+      return false;
+    }
+    const { base, off } = parseMem(ins.ops[ins.ops.length - 1]);
+    return isStackPtr(base) && !inLocalArea(ins, off, ins.mnemonic.includes('b') ? 1 : 2);
+  });
+
+  // THE FRAME HALF of the live-in model (`LiveInModel.ownedLocals`), in the raw `sp@<off>` keys
+  // the slot model uses: the words of the one frame this function pushed that it OWNS, so that a
+  // def-less read of one is an uninitialised local — IDO homes `int r; if (a > 0) r = a*2;` in
+  // `4(sp)` of an 8-byte leaf frame and reads it back on the path that never stored it. A word no
+  // store reaches on ANY path is the same local (`uninit_spill` reads `36(sp)` and `0(sp)`, which
+  // no instruction stores), as on Thumb (`lowerLoad`).
+  //
+  // WHAT ELSE COULD HAVE WRITTEN THE WORD is the whole soundness of it, and the claim is made only
+  // where the answer is "nothing":
+  //   • another function holding a frame address — none is taken (`takesFrameAddress`), so the
+  //     frame-object audit has nothing to retract;
+  //   • a CALLEE, which O32 lets write the bottom of this frame: it stores its a0..a3 into the
+  //     home words `[0,16)` (IDO: `sw a2,40(sp)` in its own frame) and assigns a stack parameter in
+  //     place (`compilerBehaviors.localsAboveOutgoingArea`'s probe). So a function that calls owns
+  //     only the words past its widest call's outgoing area, `[16 + 4·words, frameSize)`. One whose
+  //     callee no declaration sizes owns the words from the loaded-word bound up, which no call's
+  //     stack argument reaches (`o32OutgoingArea`'s `widest`), and claims nothing where it loads
+  //     no frame word from 16 up. A leaf owns the whole frame;
+  //   • the same raw offset at ANOTHER depth — the key is the raw offset, so a word reached before
+  //     the push or after the pop names other storage under the same spelling. Every `sp` access
+  //     must run at the frame's own depth, save the incoming stack words that are keyed `@sarg<k>`.
+  // The caller's home `[frameSize, frameSize + 16)` is in no range, so a def-less read there still
+  // refuses. Sub-word frame traffic turns the slot model off (`spSlotSafe`) and claims nothing.
+  let ownedMemo: { range: { from: number; to: number } | undefined } | undefined;
+  const ownedFrame = (): { from: number; to: number } | undefined =>
+    (ownedMemo ??= { range: measureOwnedFrame() }).range;
+  const measureOwnedFrame = (): { from: number; to: number } | undefined => {
+    if (frameSize === undefined || depthAt === null || !spSlotSafe || code.some(takesFrameAddress)) {
+      return undefined;
+    }
+    for (const ins of code) {
+      const last = ins.ops[ins.ops.length - 1] ?? '';
+      if (!last.includes('(') || !isStackPtr(parseMem(last).base) || depthAt.get(ins) === frameSize) {
+        continue;
+      }
+      if (ins.mnemonic === 'lw' || ins.mnemonic === 'sw') {
+        if (incomingStackKey(ins, parseMem(last).off) !== undefined) {
+          continue;
+        }
+      }
+      return undefined;
+    }
+    // A declaration the call lowering cannot carry out refuses THERE, in its own words; measured
+    // here first, it claims nothing rather than pre-empting that refusal with another.
+    let outgoing: ReturnType<typeof o32OutgoingArea>;
+    try {
+      outgoing = o32OutgoingArea(code, stackWordsOf, splat, loadedWordBound);
+    } catch (e) {
+      if (e instanceof FrontendUnsupportedError) {
+        return undefined;
+      }
+      throw e;
+    }
+    return outgoing.widest < frameSize ? { from: outgoing.widest, to: frameSize } : undefined;
+  };
+  ownedFrameOf = ownedFrame;
 
   // Hardware divide state (capabilities.hwDivide). MIPS `div`/`divu rs,rt` set the hi/lo pair
   // implicitly; a later `mflo`/`mfhi` reads the quotient/remainder. FUNCTION-scoped: GCC schedules
@@ -745,9 +1947,37 @@ export function lift(
   // overwrites the same hi/lo pair, so it clears this (below) — whichever divide/multiply ran most
   // recently owns the next `mf*`, the true hardware semantics.
   let divState: { rs: Value; rt: Value; signed: boolean } | null = null;
+  // The frame offset each `laddr` this lift emitted names, and the deferred `sp + index` sums
+  // (`emitLaddr`, `materialize`) — function-scoped, since a register holding one crosses blocks.
+  const laddrAt = new Map<Value, number>();
+  const frameSums = new Map<Value, FrameSum>();
+  // Every capture this lift moved into another (`addiu rD,rCapture,k` re-minted as the `laddr` of
+  // the sum, or `addu` deferring one into a `FrameSum`), handed to the audit as Thumb hands its
+  // own: a base only the move read names no object, so the audit drops it rather than judging a
+  // dead `laddr` as a capture (`foldMovedCaptures`).
+  const movedCaptures = new Set<Value>();
 
+  /** Every return, as it is emitted: `settleReturnHome` may hand it the float home instead. */
+  const returns: { op: Op; bi: number }[] = [];
+  /** The words an `mtc1` moved into an FPU register (`emitFpMove`). */
+  const movedIn = new Set<Value>();
   const fillBlock = (b: MipsBlock, bi: number) => {
     const ops = irBlocks[bi].ops;
+    // A case target of an elided dispatch is entered with what the idiom left in its registers.
+    const entry = entries.get(bi);
+    if (entry !== undefined) {
+      enterCaseTarget(
+        entry,
+        ops,
+        {
+          key: (r) => r,
+          scrutinee: (r) => readVar(r, bi),
+          dispatchScrutinee: (r) => ssa.readAtEnd(r, entry.at),
+          write: (r, v) => writeVar(r, bi, v),
+        },
+        staleIdiom,
+      );
+    }
     // Materialise the address of a named global — the same `gaddr` op the Thumb frontend emits; the
     // structurer lowers a load/store through it to `SYM` (scalar) or `((T *)&SYM)[i]` (aggregate).
     const emitGaddr = (sym: string): Value => {
@@ -760,15 +1990,23 @@ export function lift(
         return constVal(0);
       }
       // Reading `sp` as a DATA operand means frame-pointer arithmetic or an address-taken local
-      // (`addiu a0,sp,8` = `&local`) — not modellable without a stack abstraction. Fabricating a
-      // value for `sp` invents a PHANTOM leading parameter that shifts every real argument — a
-      // silent miscompile. Fail LOUD instead, mirroring the PPC frontend's r1. Frame setup/teardown
-      // (`addiu sp,sp,±N`) and word spill/reload slots are handled before `read`.
+      // (`addiu a0,sp,8` = `&local`). Fabricating a value for `sp` invents a PHANTOM leading
+      // parameter that shifts every real argument — a silent miscompile. Fail LOUD instead,
+      // mirroring the PPC frontend's r1. Frame setup/teardown (`addiu sp,sp,±N`), word spill/reload
+      // slots and, where `measureO32Frame` drew a local area, frame captures are handled before `read`.
       if (isStackPtr(r)) {
         throw new FrontendUnsupportedError(
           `cannot lift '${name}': stack pointer used as data (address-taken local / frame arithmetic) — local stack frames not supported`,
         );
       }
+      // A KERNEL REGISTER (`target.kernelRegs`) holds nothing this function wrote: an exception
+      // handler may overwrite it between any two instructions.
+      if (isKernelReg(target.kernelRegs ?? [], r)) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': ${r} read as a value — the ABI reserves it to the kernel, and an exception ` +
+            'handler may overwrite it at any instruction',
+        );
+      }
       // `gp` writes (the PIC prologue) are skipped as transparent; a `gp` READ that survives here is a
       // PIC/small-data global access (`lw x,off(gp)`) this frontend does not model — the recovered
       // jump-table dispatch's own `lw …,0(gp)` is elided, so reaching this is a genuine decline, not a
@@ -778,10 +2016,55 @@ export function lift(
           `cannot lift '${name}': gp used as data (PIC / small-data global access) — not supported`,
         );
       }
-      // A register holding the high half of an address is NOT a value. The legitimate consumers
-      // (`addiu %lo`, a `%lo` load/store base) reach the half through `foldLoHalf` instead.
-      return highHalves.guardRead(name, r, readVar(r, bi));
+      // A register holding the high half of an address is NOT a value. Its legitimate consumers
+      // (`addiu %lo`, a `%lo` load/store base, and `addu` adding a runtime index between the
+      // halves) reach the half without this read.
+      const v = readVar(r, bi);
+      const sum = frameSums.get(v);
+      if (sum !== undefined) {
+        return materialize(sum, 0);
+      }
+      const restore = restores.get(v);
+      if (restore) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': ${r} is read after the 'lw' at 0x${restore.addr.toString(16)} restores the ` +
+            `caller's ${restore.reg} into it — no C value names it`,
+        );
+      }
+      return placeholders.guardRead(name, r, v);
+    };
+    // A FRAME ADDRESS AS DATA. `addiu rD,sp,k` and `move rD,sp` name frame offset k, and lower to
+    // an `laddr` the frame-object audit proves. `addu rD,sp,rX` — in either operand order — names
+    // `sp + rX`, a runtime index from the frame base, and that sum is DEFERRED: the access through
+    // it says which object it indexes, since `lw v0,24(v0)` after `addu v0,sp,t6` is `a[i]` on an
+    // array at sp+24 (IDO), not at sp+0. So the register holds a `FrameSum`, and each use builds
+    // `laddr(base + displacement) + index` there — an access at its displacement, any other use at
+    // 0. A capture or sum moved by a constant is the same capture at the sum. Where a frame address
+    // lies against the local area is the shared audit's to judge (`FRAME_OBJECT_AUDIT`,
+    // frontend/frame-objects.ts `frameObjects`), as on Thumb: below it or above it refuses.
+    const emitLaddr = (k: number): Value => {
+      const v = mkValue(T.unk(32));
+      ops.push(mkOp('laddr', { results: [v], attrs: { off: k } }));
+      laddrAt.set(v, k);
+      return v;
+    };
+    const materialize = (sum: FrameSum, displacement: number): Value => {
+      const v = mkValue(T.unk(32));
+      ops.push(mkOp('add', { operands: [emitLaddr(sum.base + displacement), sum.index], results: [v] }));
+      return v;
     };
+    const deferSum = (base: number, index: Value): Value => {
+      const v = mkValue(T.unk(32));
+      frameSums.set(v, { base, index });
+      return v;
+    };
+    // What a register holds when it may be a frame address, unguarded — `read` then guards and
+    // materializes everything else.
+    const rawFrame = (r: string | undefined): Value | undefined =>
+      frame === null || r === undefined || isZero(r) || isStackPtr(r) || r === 'gp' ? undefined : readVar(r, bi);
+    /** Whether `r` holds a pending `%hi` half here (indexed or not), unguarded. */
+    const halfIn = (r: string | undefined): boolean =>
+      r !== undefined && !isZero(r) && !isStackPtr(r) && r !== 'gp' && highHalves.has(readVar(r, bi));
     // `slt`-family results, so a following `beqz`/`bnez` can fold into one compare.
     //
     // Keyed by the SSA VALUE the compare produced, never by its register. Keying by register is the
@@ -812,6 +2095,10 @@ export function lift(
     // DELIBERATELY (unlike divState): a cross-block `mult`/`mflo` pair has no observed inhabitant,
     // and the miss degrades to a LOUD opaque, never silence.
     let mulState: { rs: Value; rt: Value; signed: boolean } | null = null;
+    // The FP condition code a `c.cond` set in THIS block, as the compare it holds. Block-local like
+    // `mulState`: every compare and branch the compilers emit sit in one block, and a branch with
+    // none set here refuses rather than read a code across an edge.
+    let fcc: { opcode: Opcode; lhs: Value; rhs: Value; value: Value } | null = null;
     const emitCmp = (opc: Opcode, d: string, lhs: Value, rhs: Value) => {
       const v = mkValue(T.unk(32));
       ops.push(mkOp(opc, { operands: [lhs, rhs], results: [v] }));
@@ -825,6 +2112,14 @@ export function lift(
     // Set by every case entitled to fold a relocation, cleared per instruction, and answered by
     // `relocPlaceholder`.
     let relocTaken = false;
+    // The words loads into the discard register read whose pair half has not come yet (`emitLoad`):
+    // each one's base register, or the symbol a relocation names, and its offset. IDO's -O1
+    // scheduler puts frame reloads, argument loads and stores between the halves, a store through
+    // the pair's own base among them (`s->a; s->b = x; g(x);` is `lw zero,0(t6); sw t7,8(t6);
+    // lw a0,28(sp); jal g; lw at,4(t6)`). No access makes the `at` word anything but the pair half
+    // — IDO never gives `at` a C value — so a word stays pending across every one of them. What ends
+    // one: a write to its base register, which moves the address the half would read, and a call.
+    let firstWords: { reg: string | undefined; sym: string | undefined; off: number }[] = [];
     // EVERY immediate this frontend turns into a value goes through here. objdump prints them as
     // numbers, so a non-numeric one means the operand is not an immediate at all — a relocation
     // spelling the reader failed to resolve, a label — and bare `parseImm` answers NaN, which
@@ -843,20 +2138,33 @@ export function lift(
     const decode = (ins: Instr) => {
       const [d, s, t] = ins.ops;
       relocTaken = false;
+      if (ins.mnemonic.startsWith('jal')) {
+        firstWords = [];
+      } else if (ins.mnemonic !== 'lw') {
+        const w = writtenReg(ins);
+        firstWords = firstWords.filter((f) => f.reg === undefined || f.reg !== w);
+      }
       // The GOT/small-data base register `gp` is set up by IDO's PIC prologue (`lui gp; addiu gp,gp,lo;
       // addu gp,gp,t9`, an `_gp_disp` HI16/LO16 pair). It is a RELOCATION base, never program data — and
       // reading `t9` for the `addu` would fabricate a phantom leading parameter (like the sp/r1 guards).
       // Its only real use, the GOT table-base `lw ...,0(gp)` in a jump-table dispatch, is subsumed by the
       // recovered `switch_br` (that block is elided). So a write to `gp` is transparent: skip it.
-      if (destReg(ins) === 'gp') {
+      if (writtenReg(ins) === 'gp') {
         return;
       }
       switch (ins.mnemonic) {
         case 'nop':
           break;
-        case 'move':
-          write(d, read(s));
-          break; // pseudo: addu/or rD,rS,zero
+        case 'move': {
+          // pseudo: addu/or rD,rS,zero
+          if (frame !== null && isStackPtr(s)) {
+            write(d, emitLaddr(0));
+            break;
+          }
+          const raw = rawFrame(s);
+          write(d, raw !== undefined && frameSums.has(raw) ? raw : read(s));
+          break;
+        }
         case 'li':
           write(d, constVal(imm(ins, s)));
           break; // pseudo: load immediate
@@ -905,10 +2213,39 @@ export function lift(
           if (isStackPtr(d)) {
             break;
           }
+          if (frame !== null && ins.reloc === undefined) {
+            if (isStackPtr(s)) {
+              write(d, emitLaddr(imm(ins, t)));
+              break;
+            }
+            const raw = rawFrame(s)!;
+            const at = raw === undefined ? undefined : laddrAt.get(raw);
+            if (at !== undefined) {
+              movedCaptures.add(raw!);
+              write(d, emitLaddr(at + imm(ins, t)));
+              break;
+            }
+            const sum = raw === undefined ? undefined : frameSums.get(raw);
+            if (sum !== undefined) {
+              write(d, deferSum(sum.base + imm(ins, t), sum.index));
+              break;
+            }
+          }
           // `addiu rD, rHi, %lo(SYM)` completes a global's address begun by a `lui %hi(SYM)`:
           // rD = &SYM (+ a byte offset into it). Emits the shared `gaddr` op.
           if (ins.reloc?.type === 'R_MIPS_LO16') {
-            const { base: g, off } = foldLoHalf(ins, s, imm(ins, t));
+            const at = pairLoHalf(ins, s, imm(ins, t));
+            // The base of a jump table a dispatch reads from outside its block is no value but the
+            // table base (frontend/jump-table.ts), which only that dispatch may take — and a table
+            // base is never indexed.
+            const table = { sym: ins.reloc.sym, addend: at.off };
+            if (at.index === undefined && tableBases.wants(table)) {
+              const base = mkValue(T.unk(32));
+              tableBases.record(base, table, ins.addr);
+              write(d, base);
+              break;
+            }
+            const { base: g, off } = addressAt(ins, at);
             // `&SYM` (offset 0), or `&SYM + N` for a byte offset into the global. The `add` tree is
             // folded byte-correctly by memAccess when this address is a load/store base; if it
             // instead ESCAPES as a value, `assertDerefsTyped` declines it (the byte offset would
@@ -923,9 +2260,47 @@ export function lift(
           emitBin('add', d, read(s), constVal(imm(ins, t)));
           break;
         case 'addu':
-        case 'add':
+        case 'add': {
+          // `addu rD,sp,zero` is Splat's spelling of objdump's `move rD,sp`: the frame base.
+          if (frame !== null && isStackPtr(copiedReg(ins) ?? '')) {
+            write(d, emitLaddr(0));
+            break;
+          }
+          if (frame !== null && t !== undefined && isStackPtr(s) !== isStackPtr(t) && !isZero(isStackPtr(s) ? t : s)) {
+            write(d, deferSum(0, read(isStackPtr(s) ? t : s)));
+            break;
+          }
+          const [rs, rt] = [rawFrame(s), rawFrame(t)];
+          const capturedAt = (v: Value | undefined) => (v === undefined ? undefined : laddrAt.get(v));
+          const [cs, ct] = [capturedAt(rs), capturedAt(rt)];
+          if ((cs === undefined) !== (ct === undefined)) {
+            movedCaptures.add((cs === undefined ? rt : rs)!);
+            write(d, deferSum((cs ?? ct)!, read(cs === undefined ? s : t)));
+            break;
+          }
+          // `lui rH,%hi(S); addu rH,rH,idx; l*/s* x,%lo(S)(rH)` is ido's, KMC's and GCC 2.7.2's
+          // `S[i]`: a runtime byte index added BETWEEN the halves. rD is still no value — it is an
+          // indexed half (frontend/high-half.ts `index`) that only its `%lo` completes, to
+          // `gaddr(S) + idx` at the halves' combined offset. Either operand order is accepted, as
+          // `addu` commutes (every compiler measured puts rH first). Two halves added together
+          // refuse: two addresses added is not an address. A COPY (`addu rD,rH,zero`) is no index:
+          // it reads the half as a value and refuses, as `move` and `or rD,rH,zero` do.
+          const [hs, ht] = copiedReg(ins) === undefined ? [halfIn(s), halfIn(t)] : [false, false];
+          if (hs && ht) {
+            throw new FrontendUnsupportedError(
+              `${site(ins)} adds a high half to another high half — the sum of two addresses is not an address this frontend can write down`,
+            );
+          }
+          if (hs || ht) {
+            const idx = read(hs ? t! : s);
+            const v = mkValue(T.unk(32));
+            highHalves.index(v, readVar(hs ? s : t!, bi), idx, { addr: ins.addr, mnemonic: ins.mnemonic });
+            write(d, v);
+            break;
+          }
           emitBin('add', d, read(s), read(t));
           break;
+        }
         case 'subu':
         case 'sub':
           emitBin('sub', d, read(s), read(t));
@@ -983,6 +2358,10 @@ export function lift(
           emitBin('and', d, read(s), constVal(imm(ins, t)));
           break;
         case 'or':
+          if (frame !== null && isStackPtr(copiedReg(ins) ?? '')) {
+            write(d, emitLaddr(0)); // `or rD,sp,zero`, IDO's spelling of the same move
+            break;
+          }
           isZero(t) ? write(d, read(s)) : emitBin('or', d, read(s), read(t));
           break;
         case 'ori':
@@ -1076,6 +2455,42 @@ export function lift(
         case 'sb':
           emitStore(ins, d, s, 1);
           break;
+        // A call reaches here only from a delay slot (the fill loop lowers every other one), and a
+        // transfer in a delay slot is one the ISA leaves undefined.
+        case 'jal':
+          throw new FrontendUnsupportedError(`${site(ins)} sits in the delay slot of a transfer`);
+        case 'add.s':
+        case 'sub.s':
+        case 'mul.s':
+        case 'div.s':
+        case 'neg.s':
+        case 'mov.s':
+        case 'add.d':
+        case 'sub.d':
+        case 'mul.d':
+        case 'div.d':
+        case 'neg.d':
+        case 'mov.d':
+          emitFpArith(ins);
+          break;
+        case 'mfc1':
+        case 'mtc1':
+          emitFpMove(ins);
+          break;
+        case 'trunc.w.s':
+        case 'trunc.w.d':
+        case 'cvt.s.w':
+        case 'cvt.d.w':
+          emitFpConvert(ins);
+          break;
+        case 'c.eq.s':
+        case 'c.lt.s':
+        case 'c.le.s':
+        case 'c.eq.d':
+        case 'c.lt.d':
+        case 'c.le.d':
+          emitFpCompare(ins);
+          break;
         default:
           emitOpaqueDest(ins);
           break; // unmodelled: an honest opaque, never a silent drop
@@ -1108,9 +2523,16 @@ export function lift(
       if (ins.reloc) {
         relocPlaceholder(ins);
       }
-      // storeClass: unmodelled MIPS stores — incl. the unaligned pair swl/swr and the FPU stores,
-      // whose FIRST token is a register (a SOURCE, not a dest) that would otherwise fabricate an
-      // opaque write to it while dropping the real memory write.
+      // storeClass: unmodelled MIPS stores, whose FIRST token is a register (a SOURCE, not a dest)
+      // that would otherwise fabricate an opaque write to it while dropping the real memory write.
+      // `swc1`/`sdc1` are in the list and are NOT reached by any spelling `fpReg` covers — an FPU
+      // store's `rt` is an FP register by ISA, so the arm above claims it first — but that is a
+      // claim about the PREDICATE, not about the ISA, and it is false for every register spelling
+      // the predicate misses: the store then arrives here and is named by the memory it writes
+      // instead of by the file it moves. So they are kept as a live backstop, and
+      // `test/fp-refusal.test.ts` asserts the FP arm wins on each spelling rather than assuming it.
+      // Everything else here is genuinely reachable: `swl`/`swr` are the unaligned pair, `sc`/`sd*`
+      // the rest.
       // skipSafe `break`: the compiler-emitted divide-by-zero guard trap inside the hw-divide
       // idiom (KMC GCC `break 0x7`); recompiling the recovered `/` regenerates it, so it is
       // transparent by the same modelling as the divide itself (byte-exactness proven by the
@@ -1118,6 +2540,22 @@ export function lift(
       const od = opaqueDest(ins.mnemonic, ins.ops, {
         isReg: isMipsReg,
         isZero,
+        // The coprocessor-1 register file. `isMipsReg` rejects `$f12` — the `$`-prefixed forms it
+        // takes are the numeric GPRs (`$4`) — so without this arm an `add.s` is refused for the
+        // lesser reason, "no register destination", while `mfc1 v0,$f12` has a destination it
+        // ACCEPTS and would build an opaque whose source list quietly omits the register the
+        // instruction actually read. The file is what is missing; say so.
+        //
+        // BOTH DIALECTS AND EVERY SPELLING, which is why this is `frontend/splat.ts`'s exported
+        // constant and not a literal: the reader decides which tokens still carry a sigil when they
+        // get here, so a predicate written twice is a predicate that can disagree with itself, and
+        // each half of that disagreement is silent. Its docblock lists the spellings and says why
+        // the sigil is required.
+        fpReg: MIPS_FP_REG,
+        // The FPU CONTROL register, which both moves spell `$31` — a GPR-shaped token no register
+        // predicate can tell from an integer one. `ctc1`'s first operand is its SOURCE, so this
+        // also stops an opaque being fabricated on a register the instruction only reads.
+        fpControl: /^(cfc1|ctc1)$/i,
         storeClass: /^(sb|sh|sw|swl|swr|sc|sd|sdl|sdr|swc1|sdc1)$/i,
         skipSafe: /^(nop|ssnop|break)$/i,
         context: `${name} @0x${ins.addr.toString(16)}`,
@@ -1131,24 +2569,127 @@ export function lift(
       write(od.dst, res);
     };
     const emitUn = kit.un;
+    // Arithmetic on the FPU's file, keyed by `mipsEvenFpKey` so both dialects' spellings of one
+    // register are one SSA variable. Anything it cannot key — an odd half, a target with no float
+    // homes — keeps the register-file refusal.
+    const emitFpArith = (ins: Instr) => {
+      const keys = ins.ops.map(mipsEvenFpKey);
+      if (fpu === undefined || keys.length === 0 || keys.some((k) => k === null)) {
+        emitOpaqueDest(ins);
+        return;
+      }
+      if (fpType === null) {
+        refuseBothPrecisions(name, ins.mnemonic);
+      }
+      const [dst, ...srcs] = keys as string[];
+      const { op } = FP_ARITH[ins.mnemonic];
+      if (op === 'copy') {
+        write(dst, readFloat(ins, srcs[0]));
+        return;
+      }
+      const v = mkValue(fpType);
+      ops.push(mkOp(op, { operands: srcs.map((k) => readFloat(ins, k)), results: [v] }));
+      write(dst, v);
+    };
+    // AN FPU REGISTER HOLDS A FLOAT OR AN INTEGER WORD, and which is a fact about the instruction
+    // that last wrote it: `trunc.w` and `mtc1` leave a word, everything else a float. Each read says
+    // which it expects and refuses the other, so a word is never computed on as a float, nor a
+    // float's bits moved out as an integer.
+    const readFloat = (ins: Instr, key: string): Value => {
+      const v = read(key);
+      if (v.type.kind !== 'float') {
+        throw new FrontendUnsupportedError(`${site(ins)} reads ${key} as a float, and it holds an integer word`);
+      }
+      return v;
+    };
+    const readWord = (ins: Instr, key: string): Value => {
+      const v = read(key);
+      if (v.type.kind === 'float') {
+        throw new FrontendUnsupportedError(
+          `${site(ins)} reads ${key} as an integer word, and it holds a float — moving a float's bits is not modelled`,
+        );
+      }
+      return v;
+    };
+    // The keys of an instruction's FPU operands, or the register-file refusal where it names an odd
+    // half or the target has no float homes.
+    const fpOperands = (ins: Instr, at: readonly number[]): string[] | null => {
+      const keys = at.map((i) => mipsEvenFpKey(ins.ops[i] ?? ''));
+      if (fpu === undefined || keys.some((k) => k === null)) {
+        emitOpaqueDest(ins);
+        return null;
+      }
+      if (fpType === null) {
+        refuseBothPrecisions(name, ins.mnemonic);
+      }
+      return keys as string[];
+    };
+    // `mfc1 rt, fs` / `mtc1 rt, fs`: an integer word between the files, unchanged. Which words came
+    // IN is kept for `settleReturnHome`: the IR holds both homes as one value.
+    const emitFpMove = (ins: Instr) => {
+      const keys = fpOperands(ins, [1]);
+      if (keys === null) {
+        return;
+      }
+      if (ins.mnemonic === 'mfc1') {
+        write(ins.ops[0], readWord(ins, keys[0]));
+      } else {
+        const v = read(ins.ops[0]);
+        movedIn.add(v);
+        write(keys[0], v);
+      }
+    };
+    const emitFpConvert = (ins: Instr) => {
+      const keys = fpOperands(ins, [0, 1]);
+      if (keys === null) {
+        return;
+      }
+      const { op } = FP_CONVERT[ins.mnemonic];
+      const toInt = op === 'fptosi';
+      const v = mkValue(toInt ? T.unk(32) : fpType!);
+      ops.push(mkOp(op, { operands: [toInt ? readFloat(ins, keys[1]) : readWord(ins, keys[1])], results: [v] }));
+      write(keys[0], v);
+    };
+    const emitFpCompare = (ins: Instr) => {
+      const keys = fpOperands(ins, [0, 1]);
+      if (keys === null) {
+        return;
+      }
+      const opcode = FP_COMPARE[ins.mnemonic].op;
+      const [lhs, rhs] = keys.map((k) => readFloat(ins, k));
+      const value = mkValue(T.unk(32));
+      ops.push(mkOp(opcode, { operands: [lhs, rhs], results: [value] }));
+      fcc = { opcode, lhs, rhs, value };
+    };
     // `%lo` completes the address a `lui %hi` began. The pairing asks SSA — through `readVar`, not
     // `read`, which refuses a half — what `rHi` holds HERE, so a pair separated by unrelated
     // instructions folds while a register reused between the halves does not, and a half that
     // arrives only through a merge or a loop header comes back as the block parameter standing for
     // the join, which is not a half and refuses.
-    const foldLoHalf = (ins: Instr, rHi: string, loImm: number): { base: Value; off: number } => {
+    const foldLoHalf = (ins: Instr, rHi: string, loImm: number): { base: Value; off: number } =>
+      addressAt(ins, pairLoHalf(ins, rHi, loImm));
+    /** `&SYM + off` (`+ index` for an indexed half), for the `%lo` at `ins` that completed it. `off`
+     *  may be negative: `S[i - k]` puts the constant element in the `%lo`, whether the index is added
+     *  between the halves (`lw v0,-4(v0)`, ido, KMC and GCC 2.7.2) or after a base completed first
+     *  (`addiu v0,v0,%lo(S)-4; addu v0,a0,v0`, KMC and GCC 2.7.2), and the address is exactly
+     *  `S + off` either way. */
+    const addressAt = (ins: Instr, { off, index }: { off: number; index?: Value }): { base: Value; off: number } => {
+      const g = emitGaddr(ins.reloc!.sym);
+      if (index === undefined) {
+        return { base: g, off };
+      }
+      const v = mkValue(T.unk(32));
+      ops.push(mkOp('add', { operands: [g, index], results: [v] }));
+      return { base: v, off };
+    };
+    /** The byte offset into its symbol of the address the `%lo` at `ins` completes, the pair proven,
+     *  and the runtime byte index an indexed half added between the halves. */
+    const pairLoHalf = (ins: Instr, rHi: string, loImm: number): { off: number; index?: Value } => {
       relocTaken = true;
-      const lo = ins.reloc!;
-      const hi = highHalves.pair(site(ins), rHi, readVar(rHi, bi), lo.sym);
+      // `addressAt` adds the index back, so this consumer takes an indexed half.
+      const hi = highHalves.pair(site(ins), rHi, readVar(rHi, bi), ins.reloc!.sym, undefined, true);
       // The addend is split across the two instruction immediates because MIPS is REL.
-      const off = hi.addend + loImm;
-      if (off < 0) {
-        throw new FrontendUnsupportedError(
-          `${site(ins)} completes '${lo.sym}' at ` +
-            `byte offset ${off} — an address BELOW the symbol (an index-biased array base) is not yet modelled`,
-        );
-      }
-      return { base: emitGaddr(lo.sym), off };
+      return { off: hi.addend + loImm, index: hi.index };
     };
     // A displacement memory operand whose base is a `%hi` half: the global's address plus the
     // access offset. A non-`%lo` instruction returns null (the caller falls through to the ordinary
@@ -1160,33 +2701,110 @@ export function lift(
       const { off, base } = parseMem(mem);
       return foldLoHalf(ins, base, off);
     };
+    // The address an access in the local area, or through a frame sum, is made at — undefined for
+    // every other access. A register the prologue SAVES may not be stored there: the save area is
+    // outside it by construction, so a save inside it is a frame this does not describe.
+    const frameAccess = (ins: Instr, base: string, off: number, width: number, stored?: string) => {
+      if (isStackPtr(base)) {
+        if (!inLocalArea(ins, off, width)) {
+          return undefined;
+        }
+        if (stored !== undefined && savedByCallee(stored) && ssa.holdsEntryValue(stored, bi)) {
+          throw new FrontendUnsupportedError(
+            `cannot lift '${name}': address-taken stack local — '${ins.mnemonic}' at 0x${ins.addr.toString(16)} saves the caller's ${stored} inside the local area, a frame this does not describe`,
+          );
+        }
+        return emitLaddr(off);
+      }
+      const raw = rawFrame(base);
+      const sum = raw === undefined ? undefined : frameSums.get(raw);
+      return sum === undefined ? undefined : materialize(sum, off);
+    };
+    // IDO reads a `volatile` doubleword nothing uses into the register PAIR its discard register
+    // heads: `lw zero,0(a0)` then `lw at,4(a0)` (O32 pairs a register with the next one, and `at`
+    // follows `zero`), measured at -O1 and -O0 for `volatile long long` and `volatile double`
+    // through a pointer, an index and a global (`lui at` re-formed between the words), the `at`
+    // word in the `jr`'s delay slot at -O1. So a word load into `at` is discarded too where it reads
+    // the word above one the discard register took, at the same address, with no write to that
+    // address's base register and no call between (`firstWords`); anywhere else `at` is the
+    // assembler's own temporary.
+    const loaded = (d: string, res: Value, discard: boolean) => {
+      if (discard) {
+        discarded.add(res);
+      }
+      write(d, res);
+    };
     const emitLoad = (ins: Instr, d: string, mem: string, width: number, signed: boolean) => {
+      const sym = ins.reloc?.type === 'R_MIPS_LO16' ? ins.reloc.sym : undefined;
+      const { off: wordOff, base: wordBase } = parseMem(mem);
+      const word = { reg: sym === undefined ? wordBase : undefined, sym, off: wordOff };
+      const first =
+        d === 'at' && width === 4
+          ? firstWords.find((f) => word.reg === f.reg && word.sym === f.sym && word.off === f.off + 4)
+          : undefined;
+      const discard = discards(d) || first !== undefined;
+      firstWords = firstWords.filter((f) => f !== first && (f.reg === undefined || f.reg !== d));
+      if (discards(d) && width === 4) {
+        firstWords.push(word);
+      }
       const g = globalBase(ins, mem);
       if (g) {
         const res = mkValue(T.unk(32));
         ops.push(mkOp('load', { operands: [g.base], results: [res], attrs: { off: g.off, width, signed } }));
-        write(d, res);
+        loaded(d, res, discard);
         return;
       }
       const { off, base } = parseMem(mem);
+      // An access inside the local area, or through a frame sum, is MEMORY (`inLocalArea`).
+      const at = frameAccess(ins, base, off, width);
+      if (at !== undefined) {
+        const res = mkValue(T.unk(32));
+        ops.push(mkOp('load', { operands: [at], results: [res], attrs: { off: 0, width, signed } }));
+        loaded(d, res, discard);
+        return;
+      }
       // A word reload from a stack slot is transparent to dataflow — the SAME value spilled — so
       // route it through the slot SSA variable, not a `load` through `sp` (which would make `sp` a
       // spurious pointer parameter). Compiler spills/reloads are always word-width; sub-word `sp`
       // access is not spill output, so it stays on the memory path.
       if (spSlotSafe && isStackPtr(base) && width === 4) {
+        const saved = saveSlots.get(off);
+        if (saved !== undefined) {
+          if (saved !== d) {
+            throw new FrontendUnsupportedError(
+              `cannot lift '${name}': reload of '${mem}' into ${d}, a slot ${saved} was saved into — the ` +
+                `word holds the caller's ${saved}, which no C value names`,
+            );
+          }
+          const caller = mkValue(T.unk(32));
+          restores.set(caller, { reg: d, addr: ins.addr });
+          restoredBy.set(ins, new Set([d]));
+          write(d, caller);
+          return;
+        }
         // SOUNDNESS GUARD (mirrors PPC frameLoad): only route through the slot SSA var if that slot was
         // actually STORED (has a reaching def). A word `lw` from an sp offset that was NEVER spilled is an
-        // incoming STACK-PASSED argument (5th+ param, O32) or an uninitialised local — neither modelled.
-        // Without this, readVar would FABRICATE a phantom entry parameter for the slot, silently emitting a
-        // function of wrong arity that returns the wrong argument. Loud-fail instead of miscompiling.
+        // incoming STACK-PASSED argument (5th+ param, O32) or an uninitialised local. Without this,
+        // readVar would FABRICATE a phantom entry parameter for the slot, silently emitting a function
+        // of wrong arity that returns the wrong argument.
         //
-        // Those two cases are SEPARABLE, and the Thumb frontend now separates them (frontend/thumb.ts,
-        // incomingArgIndex): a slot at or above the callee's own frame cannot have been written by this
-        // function, so it is an incoming argument; below the frame top it is a local. Doing the same here
-        // needs O32's own frame rule — the 16-byte home area means a stack argument is NOT simply "above
-        // the frame", so the Thumb arithmetic does not carry over — plus ssa.ensureParam for the register
-        // half. Until then this stays one loud decline for both.
-        if (!ssa.hasReachingDef(stackSlot(off), bi)) {
+        // The two are told apart by where the word is (`incomingStackKey`): a word at or past entry +
+        // 16 is that argument, `@sarg<k>`, a parameter through the ordinary live-in path, as on
+        // Thumb, merged with whatever this function stored there. Everything else keeps the
+        // decline: a word of this frame, of the home area, or at an unproven depth. A sub-word or
+        // floating-point incoming argument never reaches here (the `spSlotSafe` guard and the FP
+        // arm).
+        const incoming = incomingStackKey(ins, off);
+        if (incoming !== undefined) {
+          write(d, readVar(incoming, bi));
+          return;
+        }
+        // A word of the frame this function OWNS (`ownedFrame`) that no store reaches is an
+        // uninitialised local, which `readVar` answers with `undef` through the live-in model.
+        const owned = ownedFrame();
+        const ownsWord =
+          owned !== undefined && depthAt?.get(ins) === frameSize && off >= owned.from && off + 4 <= owned.to;
+        if (!ownsWord && !ssa.hasReachingDef(stackSlot(off), bi)) {
           throw new FrontendUnsupportedError(
             `cannot lift '${name}': load from stack slot sp@${off} that was never stored ` +
               `(stack-passed argument beyond the 4 register args, or an address-taken/uninitialised local) — not modelled`,
@@ -1197,7 +2815,7 @@ export function lift(
       }
       const res = mkValue(T.unk(32));
       ops.push(mkOp('load', { operands: [read(base)], results: [res], attrs: { off, width, signed } }));
-      write(d, res);
+      loaded(d, res, discard);
     };
     const emitStore = (ins: Instr, srcReg: string, mem: string, width: number) => {
       const g = globalBase(ins, mem);
@@ -1206,18 +2824,172 @@ export function lift(
         return;
       }
       const { off, base } = parseMem(mem);
+      const at = frameAccess(ins, base, off, width, srcReg);
+      if (at !== undefined) {
+        ops.push(mkOp('store', { operands: [at, read(srcReg)], attrs: { off: 0, width } }));
+        return;
+      }
       // A word spill to a stack slot (an argument home slot `sw a0,0(sp)`, or a local): record the
       // slot's value in SSA, do NOT emit a `store` through `sp`. A never-reloaded spill (the ABI
       // home-slot store) then has no uses and simply drops. See isStackPtr / spSlotSafe.
       if (spSlotSafe && isStackPtr(base) && width === 4) {
-        writeVar(stackSlot(off), bi, read(srcReg));
+        // A global register variable's register is never saved — compiled code stores it only as a
+        // value, the outgoing stack argument `k(1, 2, 3, 4, g)` is (`sw s0,16(sp)`) — and the builder
+        // records no definition for one (its writes are stores to the global), so "still holds the
+        // entry value" is no evidence of a save there.
+        if (savedByCallee(srcReg) && !liveIns.globalRegs?.has(srcReg) && ssa.holdsEntryValue(srcReg, bi)) {
+          refuseMixedSlot(ins, mem, off, 'save');
+          saveSlots.set(off, srcReg);
+          return;
+        }
+        refuseMixedSlot(ins, mem, off, 'value');
+        valueSlots.add(off);
+        // an assignment to an incoming stack parameter is that parameter's SSA variable
+        writeVar(incomingStackKey(ins, off) ?? stackSlot(off), bi, read(srcReg));
         return;
       }
       ops.push(mkOp('store', { operands: [read(base), read(srcReg)], attrs: { off, width } }));
     };
 
-    for (const ins of b.body) {
-      decode(ins);
+    // A CALL, WITH ITS DELAY SLOT RUN FIRST: the word at `jal + 4` executes before the callee is
+    // entered, so it can set an argument up (KMC stores argument 5 there). The plan answers what
+    // the callee's declaration says (`frontend/call-plan.ts`); what is O32's alone is here: where
+    // argument k ≥ 4 lives, and the guess that cannot see past a3.
+    const lowerJal = (ins: Instr) => {
+      const at = `0x${ins.addr.toString(16)}`;
+      const callee = jalCallee(ins, splat);
+      if (callee?.startsWith('.')) {
+        throw new FrontendUnsupportedError(
+          `${site(ins)} is relocated against the section '${callee}' — a callee known only by its offset ` +
+            'in a section has no name to call it by',
+        );
+      }
+      if (callee === undefined || !/^[A-Za-z_]\w*$/.test(callee)) {
+        throw new FrontendUnsupportedError(
+          `${site(ins)} has no callee symbol — no R_MIPS_26 relocation names it, and its operand ` +
+            `'${ins.ops[0] ?? ''}' is not a name`,
+        );
+      }
+      if (fpuInstr !== undefined) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': '${fpuInstr.mnemonic}' at 0x${fpuInstr.addr.toString(16)} uses the FPU and ` +
+            `'jal' at ${at} makes a call — the floating-point registers a call reads, returns in and destroys ` +
+            'are not modelled',
+        );
+      }
+      if (frameSize === undefined) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': the call at ${at} is made in a frame that is not one 'addiu sp,sp,-N', so ` +
+            'where its outgoing stack arguments end is not known',
+        );
+      }
+      calls.lower({
+        callee,
+        ssa,
+        bi,
+        read,
+        write,
+        // ARGUMENT WORD k ≥ 4 travels in `16+4(k-4)(sp)`, inside the one frame this function pushed
+        stackWord: (k) => {
+          const off = STACK_ARGS_AT + 4 * (k - ARG_REGS.length);
+          if (off >= frameSize) {
+            throw new FrontendUnsupportedError(
+              `cannot lift '${name}': outgoing stack argument ${k + 1} of '${callee}' at ${at} travels in ` +
+                `${off}(sp), past the ${frameSize}-byte frame this function pushed`,
+            );
+          }
+          if (!valueSlots.has(off) || !ssa.hasReachingDef(stackSlot(off), bi)) {
+            throw new FrontendUnsupportedError(
+              `cannot lift '${name}': outgoing stack argument ${k + 1} of '${callee}' at ${at} travels in ` +
+                `${off}(sp), and no value stored there reaches the call`,
+            );
+          }
+          return readVar(stackSlot(off), bi);
+        },
+        // a pending `%hi` half and a table base are no argument
+        placeholders,
+        parked,
+        scaledIndex,
+        guess: {
+          // a gap in the argument registers refuses, naming this address (`fallbackArgc`)
+          at: ins.addr,
+          // A GUESS THAT FILLS a0..a3 CANNOT SAY WHERE THE LIST ENDS: a word of the outgoing area that
+          // reaches the call is argument 5 onward, or a local the compiler put there.
+          refuse: (argc) => {
+            // …and with a local area a guess says less still. A word staged for the call above the
+            // home area may be MEMORY there, which the slot test below cannot see; and a word
+            // staged below it reaches the call whether or not a3 is set, since an 8-aligned
+            // argument (`long long`, a struct holding one) skips a3 for the stack. Where the
+            // loaded-word bound reaches the local area, no word of it is a stack argument, and the
+            // slot test below sees every word that can be one.
+            if (frame !== null) {
+              if (argc >= ARG_REGS.length && loadedWordBound > frame.area.from) {
+                throw new FrontendUnsupportedError(
+                  `cannot lift '${name}': outgoing stack arguments not modelled — the undeclared call to '${callee}' ` +
+                    `at ${at} fills a0..a3 in a frame whose local area holds a captured address, so where its ` +
+                    'stack words end is not known',
+                );
+              }
+              const staged = [...valueSlots]
+                .filter(
+                  (off) =>
+                    off >= STACK_ARGS_AT &&
+                    off < frame.area.from &&
+                    off < loadedWordBound &&
+                    ssa.hasReachingDef(stackSlot(off), bi),
+                )
+                .sort((x, y) => x - y)[0];
+              if (staged !== undefined) {
+                throw new FrontendUnsupportedError(
+                  `cannot lift '${name}': outgoing stack arguments not modelled — the word stored to ${staged}(sp), ` +
+                    `below the local area, reaches the undeclared call to '${callee}' at ${at}, where a stack ` +
+                    'argument travels',
+                );
+              }
+            }
+            if (argc < ARG_REGS.length) {
+              return;
+            }
+            // …save a word at or above the loaded-word bound, which is a local's
+            const passed = [...valueSlots]
+              .filter(
+                (off) =>
+                  off >= STACK_ARGS_AT &&
+                  off < frameSize &&
+                  off < loadedWordBound &&
+                  ssa.hasReachingDef(stackSlot(off), bi),
+              )
+              .sort((x, y) => x - y)[0];
+            if (passed !== undefined) {
+              throw new FrontendUnsupportedError(
+                `cannot lift '${name}': outgoing stack arguments not modelled — the undeclared call to '${callee}' ` +
+                  `at ${at} fills a0..a3, and the word stored to ${passed}(sp) reaches it where an argument past ` +
+                  'the registers travels',
+              );
+            }
+          },
+        },
+      });
+      // hi and lo are the callee's to overwrite
+      divState = null;
+      mulState = null;
+    };
+    for (let i = 0; i < b.body.length; i++) {
+      const ins = b.body[i];
+      if (ins.mnemonic !== 'jal') {
+        decode(ins);
+        continue;
+      }
+      const slot = b.body[i + 1];
+      if (slot?.addr !== ins.addr + 4) {
+        throw new FrontendUnsupportedError(
+          `${site(ins)} — its delay slot at 0x${(ins.addr + 4).toString(16)} is not the next instruction of ` +
+            'its block (a branch target, a control transfer, or missing), so it does not run before this call alone',
+        );
+      }
+      decode(slot);
+      i++;
+      lowerJal(ins);
     }
 
     // Terminator. For a conditional branch, capture the comparison operands from the register
@@ -1238,20 +3010,45 @@ export function lift(
       return { block: irBlocks[j], args: [] };
     };
 
-    // Recovered dense switch: run the `beqz` delay slot first — on IDO it computes the DEFAULT
-    // return value (`li v0,-1`, read by the default block); on KMC it is the now-dead index shift —
-    // then dispatch a `switch_br` over the scrutinee (N case blocks, dense 0..N-1, + default).
+    // `bc1t` is taken on the code a compare in this block set, `bc1f` on its logical NOT, which is
+    // the UNORDERED compare (`NEGATED_FCMP`): `!(a < b)` is true on a NaN, and `a >= b` is not. A
+    // compare in the delay slot would set the code after the branch read it.
+    const fpCondValue = (ins: Instr): Value => {
+      if (fcc === null) {
+        throw new FrontendUnsupportedError(`${site(ins)} tests a condition code no compare in its block set`);
+      }
+      if (b.delay && b.delay.mnemonic in FP_COMPARE) {
+        throw new FrontendUnsupportedError(`${site(ins)} has a compare in its delay slot`);
+      }
+      if (FP_COND_BRANCH[ins.mnemonic]) {
+        return fcc.value;
+      }
+      const v = mkValue(T.unk(32));
+      ops.push(mkOp(NEGATED_FCMP[fcc.opcode], { operands: [fcc.lhs, fcc.rhs], results: [v] }));
+      return v;
+    };
+
+    // Recovered dense switch: dispatch a `switch_br` over the scrutinee (N case blocks, dense
+    // 0..N-1, + default). The scrutinee is the value the `sltiu` bounded, so it is read BEFORE the
+    // `beqz` delay slot runs, as a conditional branch reads its operands: IDO can scale the index
+    // IN PLACE there (`sll t6,t6,2`), and reading after the slot would switch on `k << 2` over the
+    // unscaled labels 0..N-1. The slot still runs, because it can also compute the DEFAULT value
+    // (IDO's `li v0,-1`, read by the default block).
     const jt = br ? jts.get(br.addr) : undefined;
     if (jt) {
+      const scrut = readVar(jt.scrutReg, bi);
       if (b.delay) {
         decode(b.delay);
       }
-      pushSwitchBr(ops, readVar(jt.scrutReg, bi), [...jt.caseAddrs, jt.defaultAddr].map(succ));
+      if (jt.hoisted) {
+        tableBases.demand(jt.hoisted, bi, jt.jrAddr);
+      }
+      pushSwitchBr(ops, scrut, [...jt.caseAddrs, jt.defaultAddr].map(succ));
       return;
     }
 
     if (br && isCond(br)) {
-      const cond = condValue(br, ops, read, constVal, cmpDef);
+      const cond = br.mnemonic in FP_COND_BRANCH ? fpCondValue(br) : condValue(br, ops, read, constVal, cmpDef);
       // A NULLIFIED slot is not decoded here: it is its own block on the taken edge, and the
       // not-taken edge skips past it (toBlocks). Every pass after this one sees ordinary
       // conditional execution.
@@ -1277,17 +3074,48 @@ export function lift(
       // loud, but for a merge that never happened. Rejecting it gives the honest void return.
       // PowerPC reads its return register through the guard, so the refusal it would get is already
       // the right one; it passes this same predicate to its call-arity count.
-      const retOps = ssa.hasReachingDef(RET, bi, (v) => !highHalves.has(v)) ? [readVar(RET, bi)] : [];
+      //
+      // NOR IS WHAT A VOID CALLEE LEFT IN v0. The call writes no v0 and destroys it, and `holdsValue`
+      // ends a path there, so a function that ends on that call returns nothing.
       if (!br) {
         // A nullified slot's block leaves by its branch's TARGET, which need not be the next
         // address, so `fallthrough` is claimed only where control really does fall through.
         const to = succAddrs.get(b)![0];
         const next = (b.body[b.body.length - 1]?.addr ?? b.startAddr) + 4;
         ops.push(mkOp('br', { attrs: to === next ? { fallthrough: true } : {}, successors: [succ(to)] }));
-      } // fall-through
-      else {
-        ops.push(mkOp('ret', { operands: retOps }));
+        return;
+      }
+      // A FLOAT RETURN is decided for the whole function (frontend/fpu.ts `returnHomeRule`), and
+      // then `v0` is scratch like any other integer register. An undecided one returns `v0` here,
+      // and `settleReturnHome` may hand the return the float home instead.
+      //
+      // NOR ANYTHING AT ALL WHERE THE FUNCTION'S OWN DECLARATION IS VOID. Then `v0` is scratch on every
+      // path: a loop can leave a value in it on one path while a void callee destroyed it on another
+      // (`for (..) if (t[i] == 7) { Ping(i); return; }`), and reading it would join the callee's
+      // leftover into a return the declaration says carries nothing — refused as a stale read
+      // (ssa.ts `refuseStaleCallerSavedReads`), and dropped unread after the lift anyway (pipeline.ts
+      // `dropVoidReturnOperands`). The same declaration `ownReturnFitsAWord` reads.
+      const returnsWord =
+        !floatReturn &&
+        !declaresVoidReturn(own) &&
+        ssa.holdsValue(RET, bi, (v) => !placeholders.has(v) && !parked(v, RET));
+      // A 64-BIT INTEGER RETURN COMES BACK IN v0:v1, the high word in v0, and this lowering returns
+      // one word: returning v0 alone hands back the high word with the low one dropped, a function
+      // that compiles and returns the wrong value (`long long f(int a, int b, int c, int d,
+      // long long e) { return e; }` read as `return a4;`). Where v1 was last written for the caller
+      // (`v1MayHoldLowWord`) this refuses, unless the function's own declaration says the return
+      // fits a word. Modelling the pair is the capability this stands in for.
+      if (returnsWord && !ownReturnFitsAWord && v1MayHoldLowWord(blocks, preds, bi)) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': the return at 0x${br.addr.toString(16)} may hand back the halves of a 64-bit pair ` +
+            'in v0:v1 (v1 is written for the caller, and nothing declares a return no wider than a word), and this ' +
+            'lowering returns one word',
+        );
       }
+      const retOps = floatReturn ? [read(fpu!.returnReg)] : returnsWord ? [readVar(RET, bi)] : [];
+      const ret = mkOp('ret', { operands: retOps });
+      ops.push(ret);
+      returns.push({ op: ret, bi });
       return;
     }
     // unconditional branch
@@ -1298,19 +3126,371 @@ export function lift(
     fillBlock(b, bi);
     ssa.markFilled(bi);
   });
+  refuseSavedRegisterLeaks(
+    name,
+    blocks.map((b) => ({
+      instrs: [...b.body, ...(b.delay ? [b.delay] : [])],
+      returns: b.branch !== null && isReturn(b.branch) && b.branch.ops[0] === 'ra',
+    })),
+    preds,
+    new Set([...saveSlots.values()].filter((r) => r !== 'ra')),
+    (ins, r) => writtenReg(ins) === r,
+    restoredBy,
+  );
+  // What the float home holds at each return, and, where the home is undecided and holds a float on
+  // every path into every return, that float — read now, before the SSA is finished.
+  const homes = fpu ? returns.map(({ bi }) => floatHomeAt(ssa, fpu.returnReg, bi)) : [];
+  const carriesFloat = carriesFloatHome(homeRule, homes);
+  if (carriesFloat) {
+    returns.forEach(({ op, bi }) => op.operands.push(readVar(fpu!.returnReg, bi)));
+  }
   highHalves.assertAllConsumed(name);
+  tableBases.prove(name, ssa);
+  refuseStaleIdiomReads(
+    name,
+    irBlocks,
+    staleIdiom,
+    ssa,
+    prototypes[name] ?? options.contextOwnProto?.proto,
+    fail,
+    calls,
+  );
+  const argSlots = o32ArgSlots(name, fpuArgSlots(name, fpu, ARG_REGS, isFpKey, fpType), ARG_REGS);
+  mintArgSlotHoles(ssa, preds[0].length > 0, argSlots);
   ssa.finish();
+  refuseFpWordCrossings(name, ssa.fn);
+  // Asked once the lift is done, so a refusal the stream meets first keeps its own reason.
+  if (fpu) {
+    settleReturnHome(name, ssa.fn, homeRule, returns, homes, carriesFloat, fpu, RET, movedIn);
+  }
   highHalves.assertNoneEscaped(name, irBlocks);
+  tableBases.assertNoneEscaped(name, irBlocks);
+  for (const blk of irBlocks) {
+    const used = [
+      ...blk.params,
+      ...blk.ops.flatMap((op) => [...op.operands, ...op.results, ...op.successors.flatMap((s) => s.args)]),
+    ];
+    const restore = used.map((v) => restores.get(v)).find((r) => r !== undefined);
+    if (restore) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': the caller's ${restore.reg}, which the 'lw' at 0x${restore.addr.toString(16)} ` +
+          `restores, reaches a value this function computes with — no C value names it`,
+      );
+    }
+  }
+
+  // A struct passed by value becomes the one object its words hold (call-plan.ts `foldByValueArgs`)
+  // before the audit judges the frame objects, as on Thumb.
+  foldByValueArgs(name, irBlocks, calls, { symbols, context });
+  nameMergedSretObjects(irBlocks);
 
-  // ABI-ordered entry parameters (a0, a1, …) — a callee-saved copy can read a later argument
-  // register first. Only the true entry (no predecessors) is sorted; a loop header's phis are
-  // index-aligned with predecessor args and must not be reordered.
-  const entry = irBlocks[0];
-  // non-ABI live-in ranks FIRST (indexOf's -1) — deliberate MIPS/PPC tie-break; Thumb's is 99/last
-  abiSortEntryParams(entry, preds[0].length > 0, (v) => ARG_REGS.indexOf(paramReg.get(v) ?? ''));
+  if (frame !== null) {
+    refuseEscapedFrameSums(name, irBlocks, frameSums);
+    // Prove every `laddr` names storage of this frame at a shape the machine states, or decline
+    // (`auditFrameObjects`); an accepted function then gets the device pin the audit answers.
+    const verdict = FRAME_OBJECT_AUDIT.run({
+      name,
+      irBlocks,
+      ownedLocals: frame.area,
+      declaredLocals: frame.area,
+      usedSlotOffsets: new Set([...valueSlots].filter((o) => o < frame.size)),
+      loadedWords: loadedFrom === undefined ? undefined : { from: loadedFrom, bound: loadedWordBound },
+      capturedObjectIsTheWholeFrame: false,
+      movedCaptures,
+      returnsWithoutHiddenPointer: calls.returnsWithoutHiddenPointer,
+      symbols,
+      target,
+      oneObject,
+    });
+    if (verdict !== undefined && 'oneObject' in verdict) {
+      return verdict;
+    }
+    if (verdict !== undefined) {
+      pinDeviceAccesses(irBlocks, verdict, target, symbols);
+    }
+  }
+  refuseSretOutsideFrame(name, irBlocks, target);
+  pinDeadReads(irBlocks, target, {
+    name,
+    own: prototypes[name],
+    atUndeclaredCall: calls.heldAtUndeclaredCall,
+    spilled: ssa.frameWrites,
+    discarded,
+    declarations: { symbols, context },
+  });
+
+  // Asked once everything else lifted, so a function that declines for another reason keeps that message.
+  refuseReturnsNotThroughCallersRa(
+    name,
+    blocks,
+    blocks.map((b) => succAddrs.get(b)!.flatMap((a) => (idxOf.has(a) ? [idxOf.get(a)!] : []))),
+    target.callerSaved,
+    target.kernelRegs ?? [],
+  );
+  abiSortEntryParams(irBlocks[0], preds[0].length > 0, paramReg, argSlots);
   return ssa.fn;
 }
 
+/** `sp + index`, deferred to its use (`materialize`): the frame offset it starts from and the index. */
+interface FrameSum {
+  readonly base: number;
+  readonly index: Value;
+}
+
+/** A frame sum is a VALUE no op defines — every use builds its own `laddr` and `add` — so one that
+ *  reached a phi, or anything else the fill did not materialize, refuses. */
+function refuseEscapedFrameSums(name: string, irBlocks: readonly Block[], sums: ReadonlyMap<Value, FrameSum>): void {
+  for (const blk of irBlocks) {
+    for (const op of blk.ops) {
+      if ([...op.operands, ...op.successors.flatMap((x) => x.args)].some((v) => sums.has(v))) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': address-taken stack local — a frame address plus a runtime index reaches \`${op.opcode}\` across a join, ` +
+            'which object it indexes is not known there',
+        );
+      }
+    }
+  }
+}
+
+/** An instruction that takes a frame address as data: `addiu rD,sp,k`, `move rD,sp`, or `addu
+ *  rD,sp,rX` in either operand order. */
+function takesFrameAddress(ins: Instr): boolean {
+  const [d, s, t] = ins.ops;
+  if (d === undefined || isStackPtr(d)) {
+    return false;
+  }
+  if (ins.mnemonic === 'addiu' || ins.mnemonic === 'addi' || ins.mnemonic === 'move') {
+    return isStackPtr(s ?? '');
+  }
+  if (ins.mnemonic === 'or') {
+    return isStackPtr(copiedReg(ins) ?? '');
+  }
+  return (
+    (ins.mnemonic === 'addu' || ins.mnemonic === 'add') && t !== undefined && isStackPtr(s ?? '') !== isStackPtr(t)
+  );
+}
+
+/** THE REGISTERS THE PROLOGUE SAVES: a word store to `sp` of a register O32 makes a callee
+ *  preserve, in the entry block (its delay slot included — the slot of a branch-likely is its own
+ *  block, so never this one) before any instruction NAMES that register, read or written. What it
+ *  stores is then what the caller left there, which is the half of `LiveInModel.uninitRegs` the
+ *  frontend owes: a compiler homes a local in a callee-saved register only after saving it, so a
+ *  def-less read of a saved one is that local, uninitialised, and of an unsaved one is a global
+ *  register variable's or refuses (`registerLiveIns`). "Nothing named it first" is PPC's condition
+ *  (`prologueSavedRegs` there): a read before the store would be a use of the caller's value. A
+ *  re-entered entry gets an empty preheader as `blocks[0]`, so it measures no save at all.
+ *
+ *  A SAVE IS RELOADED. In a function that returns, a store no `lw` of the same register from `sp`
+ *  ever answers saves nothing: the caller gets the register back as the body left it, so the word
+ *  is a value. gcc 2.7.2 and KMC put exactly such a store in the entry block for a file-scope
+ *  global register variable passed on the stack — `register int g __asm__("$16"); return k(1, 2,
+ *  3, 4, g) + g;` is `sw s0,16(sp); jal k` and no reload of s0 — and counting it as a save would
+ *  turn the read of `g` after the call into `uninit_s0` and drop the fifth argument. Any `lw` of the
+ *  register from `sp` will do, whatever its word: which word a restore reads is judged where it is
+ *  lowered. A function with no return keeps the entry-block reading: nothing reaches a caller. */
+function prologueSavedRegs(
+  entry: readonly Instr[],
+  target: TargetDescription,
+  code: readonly Instr[],
+): ReadonlySet<string> {
+  const saved = new Set<string>();
+  const named = new Set<string>();
+  const calleeSaved = (r: string) => isMipsReg(r) && !r.startsWith('$') && !target.callerSaved.includes(r);
+  const returns = code.some((ins) => ins.mnemonic === 'jr' && ins.ops[0] === 'ra');
+  const reloaded = (r: string) =>
+    code.some((ins) => ins.mnemonic === 'lw' && ins.ops[0] === r && isStackPtr(parseMem(ins.ops[1] ?? '').base));
+  for (const ins of entry) {
+    const [src, mem] = ins.ops;
+    if (ins.mnemonic === 'sw' && src !== undefined && mem !== undefined && isStackPtr(parseMem(mem).base)) {
+      if (calleeSaved(src) && !named.has(src) && (!returns || reloaded(src))) {
+        saved.add(src);
+      }
+    }
+    for (const op of ins.ops) {
+      const reg = op.includes('(') ? parseMem(op).base : op;
+      if (isMipsReg(reg)) {
+        named.add(reg);
+      }
+    }
+    const w = writtenReg(ins);
+    if (w !== null) {
+      named.add(w);
+    }
+  }
+  return saved;
+}
+
+/** The local area of a function that takes a frame address (`o32LocalArea`), and the depth every
+ *  access it routes runs at — or null, which leaves every capture its sp-as-data refusal. Null
+ *  where nothing takes a frame address; where the depth walk is unproven or the frame is not one
+ *  push; where a capture runs at another depth; where the target states no layout or leaves no
+ *  area; and where an `sp` access at another depth lands on the area's bytes, which the routing by
+ *  raw offset would then misname.
+ *
+ *  The outgoing area ends past the widest call's stack words, read off each callee's declaration
+ *  (`stackWordsOf`). A CALL NO DECLARATION SIZES refuses here, where the number is computed, rather
+ *  than relying on its own lowering to refuse it: gcc stages `fp(1, 2, 3, 4, x)`'s fifth word at
+ *  sp+16 and puts the local at sp+24, so an extent read without that call would draw the area over
+ *  the staged word. A call through a register (`jalr`) or a linking branch always refuses. A `jal`
+ *  to an undeclared callee refuses where the area depends on its extent — where drawing the
+ *  outgoing area as far as it can reach would move it: up to the lowest save, or to the
+ *  loaded-word bound (`o32OutgoingArea`'s `widest`) where that is lower. That is gcc's layout,
+ *  whose locals start where the outgoing area ends: `tl(1, 2, 3, (long long)x)` to an
+ *  unprototyped `tl` skips a3 and stages x at sp+16..24, which no guess of a0..a3 sees. IDO's area
+ *  starts above the saves, which the outgoing area lies below whatever its extent, so there the
+ *  undeclared call costs nothing.
+ *  The saves are the prologue's: a store of `ra` or a callee-saved register in the entry block
+ *  before anything writes it. */
+/** THE OUTGOING ARGUMENT AREA OF AN O32 FRAME, the part of it a callee may write: the a0..a3 home
+ *  words `[0,16)` and the widest call's stack words past them, by each callee's declaration. `end`
+ *  is where it stops, 0 in a leaf. `unsized` is the first call no declaration sizes (a `jal` nothing
+ *  declares, or a call through a register), counted in `end` as taking no stack words. `widest`
+ *  is the most the area can reach: `end` where every call is sized, else no further than the
+ *  loaded-word bound (`compilerBehaviors.outgoingAreaNeverLoadedFrom`: the compiler loads no word
+ *  of its outgoing area from that offset up, so the lowest word there this function loads is a
+ *  local's, and so is every word above it), and `Infinity` where no load bounds it. Each caller
+ *  reads the one number: `measureO32Frame` refuses where it could move the local area, and
+ *  `ownedFrame` claims the frame only from it up. */
+function o32OutgoingArea(
+  code: readonly Instr[],
+  stackWordsOf: (callee: string | undefined) => number | null,
+  splat: boolean,
+  loadedWordBound: number,
+): { end: number; unsized: Instr | undefined; widest: number } {
+  const calls = code.filter(isCallInstr);
+  const words = calls.map((ins) => (ins.mnemonic === 'jal' ? stackWordsOf(jalCallee(ins, splat)) : null));
+  const end = calls.length === 0 ? 0 : STACK_ARGS_AT + 4 * Math.max(0, ...words.map((w) => w ?? 0));
+  const unsized = calls.find((_, k) => words[k] === null);
+  return { end, unsized, widest: unsized === undefined ? end : Math.max(end, loadedWordBound) };
+}
+
+export function measureO32Frame({
+  name,
+  code,
+  entry,
+  depthAt,
+  frameSize,
+  rule,
+  stackWordsOf,
+  savedByCallee,
+  splat,
+  loadedWordBound = Infinity,
+}: {
+  name: string;
+  code: readonly Instr[];
+  entry: readonly Instr[];
+  depthAt: ReadonlyMap<Instr, number> | null;
+  frameSize: number | undefined;
+  rule: TargetDescription['compilerBehaviors']['o32LocalArea'];
+  /** The stack words a `jal`'s callee takes, by its declaration; null where nothing declares it. */
+  stackWordsOf: (callee: string | undefined) => number | null;
+  savedByCallee: (r: string) => boolean;
+  splat: boolean;
+  /** The lowest frame word from 16 up this function loads (`lift`'s loaded-word bound), which caps
+   *  how far an unsized call's stack words can reach; `Infinity` where nothing bounds it. */
+  loadedWordBound?: number;
+}): { area: FrameRange; size: number } | null {
+  const captures = code.filter(takesFrameAddress);
+  if (captures.length === 0 || depthAt === null || frameSize === undefined) {
+    return null;
+  }
+  if (captures.some((ins) => depthAt.get(ins) !== frameSize)) {
+    return null;
+  }
+  const unsized = code.find((ins) => isCallInstr(ins) && ins.mnemonic !== 'jal');
+  if (unsized !== undefined) {
+    throw new FrontendUnsupportedError(
+      `cannot lift '${name}': outgoing stack arguments not modelled — the call '${unsized.mnemonic}' at ` +
+        `0x${unsized.addr.toString(16)} has no declaration to size its stack words by, in a frame whose local ` +
+        'area holds a captured address',
+    );
+  }
+  const written = new Set<string>();
+  const saves: number[] = [];
+  for (const ins of entry) {
+    const mem = ins.mnemonic === 'sw' ? parseMem(ins.ops[1] ?? '') : undefined;
+    if (mem !== undefined && isStackPtr(mem.base) && savedByCallee(ins.ops[0]) && !written.has(ins.ops[0])) {
+      saves.push(mem.off);
+    } else if (writtenReg(ins) !== null) {
+      written.add(writtenReg(ins)!);
+    }
+  }
+  const {
+    end: outgoingEnd,
+    unsized: undeclared,
+    widest: widestEnd,
+  } = o32OutgoingArea(code, stackWordsOf, splat, loadedWordBound);
+  const area = o32LocalArea(rule, { frameSize, outgoingEnd, saves });
+  if (area === null) {
+    return null;
+  }
+  if (undeclared !== undefined) {
+    const widest = o32LocalArea(rule, {
+      frameSize,
+      outgoingEnd: Math.max(outgoingEnd, Math.min(frameSize, widestEnd, ...saves)),
+      saves,
+    });
+    if (widest?.from !== area.from || widest.to !== area.to) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': outgoing stack arguments not modelled — nothing declares the callee of the \`jal\` at ` +
+          `0x${undeclared.addr.toString(16)}, so how many stack words it takes is unknown, and this compiler's local ` +
+          'area starts past them',
+      );
+    }
+  }
+  for (const ins of code) {
+    const last = ins.ops[ins.ops.length - 1] ?? '';
+    const depth = depthAt.get(ins);
+    if (!/\(/.test(last) || !isStackPtr(parseMem(last).base) || depth === frameSize) {
+      continue;
+    }
+    if (landsOnArea(area, parseMem(last).off - depth! + frameSize, 4)) {
+      return null;
+    }
+  }
+  return { area, size: frameSize };
+}
+
+/** A `jal`'s callee: the Splat operand, or the R_MIPS_26 record's symbol. */
+function jalCallee(ins: Instr, splat: boolean): string | undefined {
+  return splat ? ins.ops[0] : ins.reloc?.type === 'R_MIPS_26' ? ins.reloc.sym : undefined;
+}
+
+/** THE LOCAL AREA OF AN O32 FRAME, `[from, to)` in post-push `sp` offsets: where this compiler
+ *  keeps the locals and spill temps (`compilerBehaviors.o32LocalArea`), so where a captured frame
+ *  address may name a local and nothing else does. Below it is the outgoing area, which ends at
+ *  `outgoingEnd` — 0 in a function that makes no call, else the 16-byte home of a0..a3 and then
+ *  every stack word a call takes; above it, or below it on IDO, the registers the prologue saved at
+ *  `saves`. Null where the target states no layout, or the area is empty. */
+function o32LocalArea(
+  rule: TargetDescription['compilerBehaviors']['o32LocalArea'],
+  { frameSize, outgoingEnd, saves }: { frameSize: number; outgoingEnd: number; saves: readonly number[] },
+): FrameRange | null {
+  if (rule === 'above-outgoing-area') {
+    return areaAboveOutgoing({ frameSize, outgoingEnd, saves, align: 8 });
+  }
+  if (rule === 'above-saved-registers') {
+    const area = { from: Math.max(outgoingEnd, ...saves.map((o) => o + 4)), to: frameSize };
+    return area.from < area.to ? area : null;
+  }
+  return null;
+}
+
+/** O32's slots: the shared register-then-stack-word rule (`stackArgSlots`), with a floating-point
+ *  register read beside a stack word refused — where a float shadows the integer slots ahead of
+ *  the stack words is not modelled here. */
+function o32ArgSlots(name: string, regs: ArgSlots, argRegs: readonly string[]): ArgSlots {
+  return stackArgSlots(regs, argRegs, (readKeys, top) => {
+    const float = readKeys.find(isFpKey);
+    if (float !== undefined) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': ${float} carries a floating-point argument beside the incoming stack argument ` +
+          `${top + 1} — which integer slots the float takes ahead of the stack words is not modelled`,
+      );
+    }
+  });
+}
+
 // Build the "branch taken" condition value for a conditional branch (emitting the icmp op).
 function condValue(
   br: Instr,
@@ -1345,3 +3525,7 @@ function condValue(
 
 /** The MIPS-II / IDO frontend, registered for the `mips` target. */
 export const mipsFrontend: Frontend = { id: 'mips', inputFormat: 'objdump', lift };
+
+/** Internal surface for this module's own tests, and for nothing else (`frontend/frame-objects.ts`
+ *  says why it is not a plain export). */
+export const __testing = { o32LocalArea, refuseReturnsNotThroughCallersRa };