@asmlift/core 0.8.1 → 0.10.0

package/src/frontend/ppc.ts

@@ -20,9 +20,12 @@
 //    genuine rotate/insert stays an opaque.
 //  • CALLS (`bl`) — the callee symbol comes from the interleaved `R_PPC_REL24` relocation (an
 //    unresolved `bl` in a .o encodes a 0 placeholder); arguments come from r3.. per the callee
-//    prototype (falling back to argument-register liveness). The frame — `stwu r1`, `mflr`/`mtlr`,
-//    r1-relative spills — is transparent to dataflow, so a value in a callee-saved register
-//    survives the call.
+//    prototype (falling back to argument-register liveness). The frame bookkeeping — `stwu r1`,
+//    the link-register save, callee-saved saves — is transparent to dataflow, so a value in a
+//    callee-saved register survives the call; a word stored to the frame with a value is a
+//    stack-slot variable (`frameStore`). Inside the local area of a function that takes a frame
+//    address (`measurePpcFrame`), every access is memory through a frame object the shared audit
+//    proves instead.
 //  • RECORD FORM (`.` = the Rc bit, e.g. `andi.`/`add.`) also sets cr0 from a signed compare of
 //    the result against 0; that implicit compare is wired so a following `beq`/`bne` fuses.
 //
@@ -36,12 +39,45 @@
 // conditional-CTR forms (`bdz`/`bdnzt`/…), an unrecovered `bctr`, and a `bdnz` with no reaching
 // `mtctr`. NOTE mwcc at -O4 aggressively UNROLLS loops into a `bdnz` main loop + a remainder
 // loop; an unrolled loop recovers as the unrolled form (sound, rarely a match).
-import { Fn, Op, Successor, Value, mkOp, mkValue } from '../ir/core';
-import type { Opcode } from '../ir/opcodes';
+import { ownArgumentWordsOn } from '../aggregate';
+import {
+  Block,
+  Fn,
+  Op,
+  REGISTER_STRUCT,
+  STRUCT_HOMED,
+  Successor,
+  Value,
+  mkOp,
+  mkValue,
+  replaceAllUsesWith,
+} from '../ir/core';
+import { deletableWhenDead } from '../ir/discipline';
+import { FCMP_TRUTH, NEGATED_FCMP, type Opcode, fcmpOfTruth } from '../ir/opcodes';
 import { T } from '../ir/types';
-import { type Prototypes, protoArity } from '../proto';
+import {
+  type FnProto,
+  type Prototypes,
+  declaredWidth,
+  declaresVoidReturn,
+  isFloatingSpelling,
+  ownFirstArgumentPassed,
+  wordsOf,
+} from '../proto';
+import type { ContextGlobals } from '../proto-context';
+import { registerSaveRoutineOf } from '../runtime-helpers';
+import type { SymbolMap } from '../symbols';
 import type { TargetDescription } from '../target';
 import { type AsmData, readJumpTable } from './asmdata';
+import { type CallDeclarations, type ParamClass, callDeclarations } from './call-plan';
+import {
+  type Declarations,
+  computedOnlyToReturn,
+  leftInDiscardRegister,
+  pinDeadReads,
+  unreadPairHalf,
+} from './dead-reads';
+import { pinDeviceAccesses } from './device-pins';
 import {
   type DisasmInstr,
   parseImm,
@@ -50,17 +86,67 @@ import {
   sliceSymbol,
 } from './disasm';
 import { mkEmitKit, pushSwitchBr } from './emit';
-import { FrontendUnsupportedError } from './errors';
+import { type FrontendRefusal, FrontendUnsupportedError } from './errors';
+import { inheritFlags } from './flags-edge';
 import { assertInputFormat } from './format';
-import type { Frontend } from './frontend';
+import {
+  type ReturnHomeRule,
+  carriesFloatHome,
+  declaredPrecision,
+  floatHomeAt,
+  fpPrecision,
+  fpuArgSlots,
+  refuseBothPrecisions,
+  refuseFpWordCrossings,
+  returnHomeRule,
+  settleReturnHome,
+  writesFloatReturn,
+} from './fpu';
+import {
+  FRAME_OBJECT_AUDIT,
+  type FrameObjectRelift,
+  type FrameRange,
+  areaAboveOutgoing,
+  landsOnArea,
+  liftWithRelift,
+} from './frame-objects';
+import { type Frontend, type LiftOptions, type OwnDeclaration, ownDeclarationOf } from './frontend';
 import { makeHighHalves } from './high-half';
+import {
+  type HoistedDispatch,
+  type IdiomLeft,
+  type StaleIdiomRead,
+  type TableKey,
+  agreedTable,
+  caseEntries,
+  enterCaseTarget,
+  entersBetween,
+  idiomLeaves,
+  makeTableBases,
+  parkedIn,
+  refuseReachableDispatch,
+  refuseStaleIdiomReads,
+  scaledIndexIn,
+} from './jump-table';
+import { makeLocalStatics, readObjectLocalObject } from './local-object';
 import { opaqueDest } from './opaque';
-import { unspellableReason } from './reloc-symbol';
-import { abiSortEntryParams } from './ssa';
-import { makeSsaBuilder } from './ssa';
+import { classifyRelocSymbol, unspellableReason } from './reloc-symbol';
+import {
+  type ArgSlots,
+  abiSortEntryParams,
+  incomingStackArgKey,
+  mintArgSlotHoles,
+  stackArgSlots,
+  stackSlotKey,
+} from './ssa';
+import { makeSsaBuilder, refuseSavedRegisterLeaks, registerLiveIns } from './ssa';
 
 type Instr = DisasmInstr;
 
+/** The instructions that READ the carry bit (each also writes it), and every other writer of it. */
+const CARRY_READERS = /^(adde|addme|addze|subfe|subfme|subfze)o?$/;
+const CARRY_WRITERS = /^(addc|addco|addic|subfc|subfco|subfic|srawi|sraw|mtxer|mcrxr)$/;
+
 // Branch-condition mnemonic → the icmp for its TAKEN edge, split by compare signedness. PowerPC's
 // branch already names the relation (no negation fold needed). `signed` picks the row.
 const COND_SIGNED: Record<string, Opcode> = {
@@ -116,6 +202,39 @@ const isModeledBranch = (ins: Instr) => isXfer(ins) || ins.mnemonic === 'bl';
 
 const isReg = (s: string | undefined): s is string => /^r\d+$/.test(s ?? '');
 
+/** The FPU arithmetic this frontend lifts, onto the float opcodes, with the precision each computes
+ *  in; `fmr` is a copy and has no opcode. `fneg` and `fmr` carry no precision at all — an FPR holds a
+ *  double either way — so they take the function's (`frontend/fpu.ts` `fpPrecision`); in a function
+ *  of only those, the floats state none (`T.fUnstated`), because the float and double spellings of a
+ *  negation or a copy compile to one object. The compares and `fctiwz` (`FP_CROSSINGS`) are decoded
+ *  in their own cases. Everything else in the file keeps the register-file refusal `opaqueDest`
+ *  gives it: `frsp`, the loads and stores but an integer word's `stfd` to the frame, the other
+ *  conversions, the fused multiply-adds, paired singles — and a record form (`fadds.`), which sets
+ *  `cr1`. */
+const FP_ARITH: Readonly<Record<string, { op: Opcode | 'copy'; width: 32 | 64 | null }>> = {
+  fadds: { op: 'fadd', width: 32 },
+  fsubs: { op: 'fsub', width: 32 },
+  fmuls: { op: 'fmul', width: 32 },
+  fdivs: { op: 'fdiv', width: 32 },
+  fadd: { op: 'fadd', width: 64 },
+  fsub: { op: 'fsub', width: 64 },
+  fmul: { op: 'fmul', width: 64 },
+  fdiv: { op: 'fdiv', width: 64 },
+  fneg: { op: 'fneg', width: null },
+  fmr: { op: 'copy', width: null },
+};
+const FP_ARITH_MNEMONICS: ReadonlySet<string> = new Set(Object.keys(FP_ARITH));
+/** The FPU instructions that move a float's information into the integer file, none of which states
+ *  a precision: the compares (an FPR holds a double either way, and `a > b` over two floats is the
+ *  same `fcmpo` as over two doubles) and `fctiwz`, the truncation to an integer word. */
+const FP_CROSSINGS: ReadonlySet<string> = new Set(['fcmpo', 'fcmpu', 'fctiwz']);
+
+/** An FPU register: the token, and the key the SSA builder holds it under. ONE predicate for the
+ *  decode above and the register-file refusal below (`fpReg`), so a token one of them reads as an
+ *  FPR cannot be one the other does not. */
+const PPC_FP_REG = /^f\d+$/;
+const isFpKey = (k: string) => PPC_FP_REG.test(k);
+
 // Shared objdump scaffolding (frontend/disasm.ts). parseMem narrowed to `r\d+` bases — a
 // non-register base is an SDA/global placeholder assertOrdinaryMem declines.
 const parseMem = (operand: string): { off: number; base: string } => parseSharedMem(operand, /r\d+/);
@@ -138,6 +257,42 @@ const rlwinmMask = (mb: number, me: number): number => {
 // stripping, the mnemonic misses the cond tables and the branch is silently dropped).
 const parseDisasm = (disasm: string): Instr[] => parseSharedDisasm(disasm, { relocs: true, hintSuffixes: true });
 
+/** A compare a `cr` field holds: its operands and signedness, which the reading branch turns into a
+ *  condition. A FLOAT compare (`fcmpo`/`fcmpu`) states instead which compare each of the field's
+ *  three bits holds, since a `cror` can change one (`bits`); `quiet` is `fcmpu`'s, which C emits for
+ *  `==` and `!=` alone, so an ordering bit of it is refused. */
+type CrCompare = { lhs: Value; rhs: Value; signed: boolean; bits?: CrBits; quiet?: boolean };
+type CrBits = { readonly lt: Opcode; readonly gt: Opcode; readonly eq: Opcode };
+/** The bit of a field each branch reads, and whether it is taken when the bit is SET: `ble` is
+ *  "branch if not greater than", which after a float compare is `!(a > b)`, true on a NaN — never
+ *  `a <= b`. */
+const BRANCH_BIT: Readonly<Record<string, { bit: keyof CrBits; set: boolean }>> = {
+  blt: { bit: 'lt', set: true },
+  bge: { bit: 'lt', set: false },
+  bgt: { bit: 'gt', set: true },
+  ble: { bit: 'gt', set: false },
+  beq: { bit: 'eq', set: true },
+  bne: { bit: 'eq', set: false },
+};
+/** A condition-register bit as `cror` and the `mfcr` extracts name it: its field and its place in
+ *  the field, or null for the summary-overflow bit (`so`), which a float compare sets on a NaN and
+ *  nothing here reads. `eq` names cr0's; `4*cr1+eq` cr1's. */
+const crBitOf = (tok: string): { field: string; bit: keyof CrBits } | null => {
+  const m = /^(?:4\*cr([0-7])\+)?(lt|gt|eq)$/.exec(tok);
+  return m ? { field: `cr${m[1] ?? 0}`, bit: m[2] as keyof CrBits } : null;
+};
+const CR_BIT_NAMES: readonly (keyof CrBits | null)[] = ['lt', 'gt', 'eq', null];
+
+/** What a block leaves in the condition register for a successor to inherit. `fields` holds, per
+ *  field, the compare it holds, or the sentence saying what overwrote it. A field absent from the map
+ *  never held a compare on the chain of edges that reached here, and `none` is why: the sentence
+ *  from the block where that chain started. */
+type CrExit = { fields: ReadonlyMap<string, CrCompare | string>; none: string };
+
+/** The `cr` fields the EABI makes volatile across a call: cr0, cr1 and cr5–cr7. The callee may
+ *  write any of them, so a compare in one does not survive a `bl`. cr2–cr4 are nonvolatile. */
+const CR_VOLATILE = ['cr0', 'cr1', 'cr5', 'cr6', 'cr7'] as const;
+
 interface PpcBlock {
   startAddr: number;
   body: Instr[];
@@ -146,99 +301,214 @@ interface PpcBlock {
 }
 
 // A recovered dense-switch jump table (Regime B), keyed
-// by the BOUNDS branch (`bgt DEF`) whose block emits the `switch_br`. `caseAddrs[k]` is the `.text`
+// by the BOUNDS branch (`bgt DEF`, or `bgtlr`) whose block emits the `switch_br`. `caseAddrs[k]` is the `.text`
 // address of case `k` (dense 0..N-1); `bctrAddr` is the elided dispatch's indirect jump. The mwcc
 // idiom:
 //   cmplwi rS,N-1 ; bgt DEF                                        (bounds)
 //   lis rT,0 [ADDR16_HA @tbl] ; slwi rIdx,rS,2 ; addi rB,rT,0 [ADDR16_LO @tbl]
 //   ; lwzx rV,rB,rIdx ; mtctr rV ; bctr                           (dispatch — table in .data)
+// mwcc schedules other words into the bounds pair (`boundsCompare`), orders the dispatch's freely,
+// and 2.3.3 forms the table base outside the dispatch (`hoistedTable`).
 interface PpcJT {
   scrutReg: string;
+  /** The bounds compare's address: nothing may enter after it, up to the `bctr`. */
+  cmpAddr: number;
   caseAddrs: number[];
-  defaultAddr: number;
+  /** The default arm's address, or null for a `bgtlr` bound: out-of-range values return. */
+  defaultAddr: number | null;
   bctrAddr: number;
+  /** The base register and table of a dispatch whose block does not form its base (mwcc 2.3.3
+   *  hoists the `lis`/`addi` pair out of a loop): `lift` proves the base reaches it
+   *  (frontend/jump-table.ts). Null when the pruned block forms the base itself. */
+  hoisted: HoistedDispatch | null;
+  /** What the pruned dispatch leaves in each register it writes, `ctr` included (`idiomLeaves`). */
+  leaves: ReadonlyMap<string, IdiomLeft>;
+}
+
+/** The `cr` field a compare writes or a conditional branch reads: its first operand when it names
+ *  one, else cr0. */
+const crFieldOf = (ins: Instr): string => (ins.ops[0]?.startsWith('cr') ? ins.ops[0] : 'cr0');
+
+/** Whether `ins` may write a CR field. A DENY-LIST, so an unknown writer stops the reader rather
+ *  than being stepped past: the compares, the record forms (`.`), the CR-logical and move-to-CR
+ *  forms, and every branch — a `bl` destroys the volatile fields. */
+const mayWriteCr = (ins: Instr): boolean =>
+  /^(cmp|fcmp|cr|mcr|mtcr|b)/.test(ins.mnemonic) || ins.mnemonic.endsWith('.');
+
+/** Whether `ins` may write GPR `r`. A DENY-LIST like mips.ts's `writtenReg`: an instruction writes
+ *  its first operand unless it is a store, compare, trap, move-to-special or cache op; an update form
+ *  (`lwzu`, `stwux`) also writes its base, `lmw rD` writes rD..r31, and any branch may (a call
+ *  clobbers the volatile registers). */
+const mayWriteGpr = (ins: Instr, r: string): boolean => {
+  const m = ins.mnemonic;
+  if (m.startsWith('b')) {
+    return true;
+  }
+  if (m === 'lmw') {
+    return /^r\d+$/.test(r) && Number(r.slice(1)) >= Number(ins.ops[0]?.slice(1));
+  }
+  if (/^(l|st)\w*ux?$/.test(m) && ins.ops.slice(1).some((o) => new RegExp(`\\b${r}\\b`).test(o))) {
+    return true;
+  }
+  return !/^(st|cmp|fcmp|tw|mt|dc|ic|sync|isync|eieio)/.test(m) && ins.ops[0] === r;
+};
+
+/** The bounds compare of a jump table, or null: the `cmplwi rS,N-1` the bounds branch at `j` reads,
+ *  with its address and the case count `n` it states. Scanned back inside the branch's block, past
+ *  instructions that write neither a CR field nor `rS` — mwcc schedules the default's value or the
+ *  LR save between the two — and it must set the CR field the branch tests. The first CR writer met
+ *  decides: any other one, or a write of `rS` after the compare, declines. So does a branch landing
+ *  after the compare, up to the bounds branch itself: that path brings a CR field of its own, and the
+ *  `switch_br` would bound it by a compare it never ran (`entersBetween`). */
+function boundsCompare(instrs: Instr[], j: number, scrutReg: string): { addr: number; n: number } | null {
+  const crField = crFieldOf(instrs[j]);
+  for (let k = j - 1; k >= 0 && !isXfer(instrs[k]); k--) {
+    const c = instrs[k];
+    if (c.mnemonic === 'cmplwi' && c.ops[c.ops.length - 2] === scrutReg && crFieldOf(c) === crField) {
+      return entersBetween(instrs, c.addr, instrs[j].addr)
+        ? null
+        : { addr: c.addr, n: parseImm(c.ops[c.ops.length - 1]) + 1 };
+    }
+    if (mayWriteCr(c) || mayWriteGpr(c, scrutReg)) {
+      return null;
+    }
+  }
+  return null;
 }
 
+/** The table a base formed OUTSIDE the dispatch block addresses, as far as the instructions say:
+ *  every `addi rB,rX,SYM@l` in the function must name one table, or the guess is left undecided.
+ *  mwcc 2.3.3 forms the base once at entry and dispatches from a loop. Only a guess — `lift` pairs
+ *  the halves and proves the base reaches the dispatch (frontend/jump-table.ts). */
+const hoistedTable = (instrs: Instr[], rB: string): TableKey | null =>
+  agreedTable(
+    instrs.flatMap((x) =>
+      x.mnemonic === 'addi' && x.ops[0] === rB && x.reloc?.type === 'R_PPC_ADDR16_LO' && parseImm(x.ops[2]) === 0
+        ? [{ sym: x.reloc.sym, addend: x.reloc.addend }]
+        : [],
+    ),
+  );
+
 // Recover mwcc jump tables from the dispatch idiom + the AsmData side-table. Fail-closed: any
-// deviation from the exact idiom, or a table that doesn't resolve to N in-function targets, declines
+// deviation from the idiom, or a table that doesn't resolve to N in-function targets, declines
 // (→ the `bctr` loud-fail fires). Index IDENTITY guard: `slwi rIdx,rS,2` must be the bounds-checked
 // scrutinee scaled only by <<2 — no xor/neg/extra op.
 function recoverPpcJumpTables(instrs: Instr[], ad: AsmData): Map<number, PpcJT> {
   const out = new Map<number, PpcJT>();
-  for (let i = 5; i < instrs.length; i++) {
+  for (let i = 0; i < instrs.length; i++) {
     if (instrs[i].mnemonic !== 'bctr') {
       continue;
     }
-    const [lis, lwzx, mtctr] = [instrs[i - 5], instrs[i - 2], instrs[i - 1]];
-    // The index is scaled and the table's low half formed in either order: mwcc 2.4.2 emits the
-    // `slwi` first, GC/1.2.5n the `addi`. The two instructions are independent.
-    const [slwi, addi] =
-      instrs[i - 4].mnemonic === 'slwi' ? [instrs[i - 4], instrs[i - 3]] : [instrs[i - 3], instrs[i - 4]];
-    if (
-      lis.mnemonic !== 'lis' ||
-      slwi.mnemonic !== 'slwi' ||
-      addi.mnemonic !== 'addi' ||
-      lwzx.mnemonic !== 'lwzx' ||
-      mtctr.mnemonic !== 'mtctr'
-    ) {
+    // THE DISPATCH BLOCK: after the bounds branch, the nearest transfer before the `bctr`.
+    let j = i - 1;
+    while (j >= 0 && !isXfer(instrs[j])) {
+      j--;
+    }
+    const bgt = instrs[j];
+    // `bgt DEF`, or `bgtlr` when the default arm is the return itself: mwcc bounds a switch whose
+    // default falls straight out of a leaf that way.
+    if (!bgt || !((bgt.mnemonic === 'bgt' && bgt.target !== undefined) || bgt.mnemonic === 'bgtlr')) {
+      continue;
+    }
+    // Each piece of the idiom is the LAST write of its register inside the block, so nothing between
+    // a def and its reader can have changed it. The order varies: mwcc 2.4.2 scales the index first,
+    // GC/1.2.5n forms the table's low half first.
+    const defIn = (r: string, before: number): number => {
+      for (let k = before - 1; k > j; k--) {
+        if (mayWriteGpr(instrs[k], r)) {
+          return k;
+        }
+      }
+      return -1;
+    };
+    const mi = i - 1;
+    const mtctr = instrs[mi];
+    if (mtctr?.mnemonic !== 'mtctr' || mi <= j) {
       continue;
     }
-    const rV = mtctr.ops[0];
-    if (lwzx.ops[0] !== rV) {
+    const li = defIn(mtctr.ops[0], mi); // rV = mem[rB + rIdx]
+    const lwzx = instrs[li];
+    if (lwzx?.mnemonic !== 'lwzx') {
       continue;
-    } // rV = mem[rB + rIdx]
+    }
     const [rB, rIdx] = [lwzx.ops[1], lwzx.ops[2]];
-    if (slwi.ops[0] !== rIdx || (slwi.ops[2] !== '2' && slwi.ops[2] !== '0x2')) {
+    const si = defIn(rIdx, li);
+    const slwi = instrs[si];
+    if (slwi?.mnemonic !== 'slwi' || (slwi.ops[2] !== '2' && slwi.ops[2] !== '0x2')) {
       continue;
     } // identity: rIdx = rS<<2
     const scrutReg = slwi.ops[1];
-    if (addi.ops[0] !== rB || parseImm(addi.ops[2]) !== 0) {
+    const ai = defIn(rB, li);
+    const lisI = ai < 0 ? -1 : defIn(instrs[ai].ops[1], ai);
+    const hoisted = ai < 0 ? hoistedTable(instrs, rB) : null;
+    let table: TableKey | null = hoisted;
+    if (ai >= 0) {
+      const [lis, addi] = [instrs[lisI], instrs[ai]];
+      // The table's base is the same `@ha`/`@l` pair the address fold consumes and must show the
+      // same evidence — both relocation types, one symbol, one addend — so a dispatch is never
+      // recovered from two instructions that never addressed the table together. It stays a
+      // separate pairing: it runs before the blocks exist, and it wants the table's NAME, for
+      // `readJumpTable`, not its address. It skips the naming policy deliberately — a table base is
+      // read here as data, never written into the candidate as an identifier — so the `@N` and
+      // `.`-prefixed symbols the address fold must refuse (292 of the corpus's `ADDR16` relocations)
+      // are harmless here.
+      table =
+        addi.mnemonic === 'addi' &&
+        parseImm(addi.ops[2]) === 0 &&
+        lis?.mnemonic === 'lis' &&
+        lis.ops[0] === addi.ops[1] &&
+        lis.reloc?.type === 'R_PPC_ADDR16_HA' &&
+        addi.reloc?.type === 'R_PPC_ADDR16_LO' &&
+        addi.reloc.sym === lis.reloc.sym &&
+        addi.reloc.addend === lis.reloc.addend
+          ? { sym: lis.reloc.sym, addend: lis.reloc.addend }
+          : null;
+    }
+    if (table === null) {
       continue;
-    } // rB = &table (lo) + 0
-    const rT = addi.ops[1];
-    // The table's base is the same `@ha`/`@l` pair the address fold consumes and must show the same
-    // evidence — both relocation types, one symbol, one addend — so a dispatch is never recovered
-    // from two instructions that never addressed the table together. It stays a separate pairing:
-    // it runs before the blocks exist, and it wants the table's NAME, for `readJumpTable`, not its
-    // address. It skips the naming policy deliberately — a table base is read here as data, never
-    // written into the candidate as an identifier — so the `@N` and `.`-prefixed symbols the
-    // address fold must refuse (292 of the corpus's `ADDR16` relocations) are harmless here.
-    const tableSym = lis.reloc?.sym;
+    }
+    // The block is pruned unread once the table is recovered, so it may hold the idiom and nothing
+    // else, nothing may branch into it past the bounds check, and none of the idiom may rewrite the
+    // scrutinee before the `slwi` scales it — the `switch_br` reads it at the bounds branch.
+    const idiom = new Set(hoisted === null ? [lisI, si, ai, li, mi] : [si, li, mi]);
     if (
-      lis.ops[0] !== rT ||
-      !tableSym ||
-      lis.reloc?.type !== 'R_PPC_ADDR16_HA' ||
-      addi.reloc?.type !== 'R_PPC_ADDR16_LO' ||
-      addi.reloc.sym !== tableSym ||
-      addi.reloc.addend !== lis.reloc.addend
+      instrs.slice(j + 1, i).some((_, o) => !idiom.has(j + 1 + o)) ||
+      instrs.slice(j + 1, si).some((x) => mayWriteGpr(x, scrutReg)) ||
+      entersBetween(instrs, bgt.addr, instrs[i].addr)
     ) {
       continue;
     }
-    // Bounds: the nearest preceding `cmplwi scrutReg,N-1 ; bgt DEF` guard. The `bgt` is itself a
-    // transfer, so match the pair directly (the cmplwi sits one instruction behind it); a different
-    // transfer before the guard ⇒ decline.
-    let bounds: { addr: number; n: number; def: number } | null = null;
-    for (let j = i - 6; j >= 1; j--) {
-      const bgt = instrs[j];
-      if (bgt.mnemonic === 'bgt' && bgt.target !== undefined) {
-        const c = instrs[j - 1];
-        if (c && c.mnemonic === 'cmplwi' && c.ops[c.ops.length - 2] === scrutReg) {
-          bounds = { addr: bgt.addr, n: parseImm(c.ops[c.ops.length - 1]) + 1, def: bgt.target };
-        }
-        break;
-      }
-      if (isXfer(bgt)) {
-        break;
-      }
-    }
-    if (!bounds || bounds.n < 2) {
+    const bound = boundsCompare(instrs, j, scrutReg);
+    if (bound === null || bound.n < 2) {
       continue;
     }
-    const caseAddrs = readJumpTable(ad, tableSym, 0, bounds.n);
+    const caseAddrs = readJumpTable(ad, table.sym, table.addend, bound.n);
     if (!caseAddrs) {
       continue;
     }
-    out.set(bounds.addr, { scrutReg, caseAddrs, defaultAddr: bounds.def, bctrAddr: instrs[i].addr });
+    // In program order, `mtctr` writing `ctr`, the `slwi` the scaled scrutinee, every other word its
+    // first operand (`lis`, `addi`, `lwzx`).
+    const leaves = idiomLeaves(
+      [...idiom].sort((a, b) => a - b).map((k) => ({ reg: k === mi ? 'ctr' : instrs[k].ops[0], scaled: k === si })),
+    );
+    out.set(bgt.addr, {
+      scrutReg,
+      cmpAddr: bound.addr,
+      caseAddrs,
+      defaultAddr: bgt.target ?? null,
+      bctrAddr: instrs[i].addr,
+      hoisted: hoisted === null ? null : { reg: rB, table: hoisted },
+      leaves,
+    });
+  }
+  // A table's case is a branch target too, which `entersBetween` cannot see before the tables are
+  // read: one landing between a table's bounds compare and its indirect jump — its own table's or
+  // another's — enters that window as a branch would, and that table declines.
+  const cases = [...out.values()].flatMap((jt) => jt.caseAddrs);
+  for (const [at, jt] of out) {
+    if (cases.some((a) => a > jt.cmpAddr && a <= jt.bctrAddr)) {
+      out.delete(at);
+    }
   }
   return out;
 }
@@ -261,7 +531,9 @@ function toBlocks(instrs: Instr[], name: string, jts: Map<number, PpcJT>): { blo
     for (const a of jt.caseAddrs) {
       leaders.add(a);
     }
-    leaders.add(jt.defaultAddr);
+    if (jt.defaultAddr !== null) {
+      leaders.add(jt.defaultAddr);
+    }
   }
 
   const blocks: PpcBlock[] = [];
@@ -282,6 +554,13 @@ function toBlocks(instrs: Instr[], name: string, jts: Map<number, PpcJT>): { blo
   const idxOf = new Map(blocks.map((b, i) => [b.startAddr, i]));
   const fallAddr = (b: PpcBlock) => (b.branch ?? b.body[b.body.length - 1]).addr + 4;
   const succIdx: number[][] = blocks.map(() => []);
+  /** A conditional return's taken edge: a block of its own that returns, appended past the real ones.
+   *  Its index. */
+  const synthReturn = (): number => {
+    blocks.push({ startAddr: -1 - blocks.length, body: [], branch: null, synthReturn: true });
+    succIdx.push([]);
+    return blocks.length - 1;
+  };
   blocks.forEach((b, i) => {
     const br = b.branch;
     // Recovered switch: the bounds block dispatches to its case blocks + default (the `cmplwi`/`bgt`
@@ -289,7 +568,13 @@ function toBlocks(instrs: Instr[], name: string, jts: Map<number, PpcJT>): { blo
     // leader, so all resolve; a target that is not a block boundary makes it malformed → loud-fail.
     const jt = br ? jts.get(br.addr) : undefined;
     if (jt) {
-      const succ = [...jt.caseAddrs, jt.defaultAddr].map((a) => idxOf.get(a));
+      const succ: Array<number | undefined> = jt.caseAddrs.map((a) => idxOf.get(a));
+      if (jt.defaultAddr !== null) {
+        succ.push(idxOf.get(jt.defaultAddr));
+      } else {
+        // A `bgtlr` bound: the default edge is a synthetic return, as for any conditional return.
+        succ.push(synthReturn());
+      }
       if (succ.some((x) => x === undefined)) {
         throw new PpcUnsupportedError(`cannot lift '${name}': jump-table target is not a block boundary`);
       }
@@ -313,17 +598,15 @@ function toBlocks(instrs: Instr[], name: string, jts: Map<number, PpcJT>): { blo
       return;
     }
     if (isCondReturn(br)) {
-      const synth: PpcBlock = { startAddr: -1 - blocks.length, body: [], branch: null, synthReturn: true };
-      const si = blocks.length;
-      blocks.push(synth);
-      succIdx.push([]);
+      const si = synthReturn();
       const fall = idxOf.get(br.addr + 4); // fall = instruction after the cond-return (no delay slot)
       succIdx[i] = fall !== undefined ? [si, fall] : [si];
       return;
     }
     // conditional branch to a label: [taken, fall]. Both must land on block boundaries; otherwise the
-    // branch leaves the function (a tail branch) or targets unrecovered flow — fail LOUD and catchably
+    // branch falls off the function's end or targets unrecovered flow — fail LOUD and catchably
     // rather than silently dropping an edge (which surfaces as an opaque `verify` successor-count error).
+    // A branch out of the function, relocated or not, has already refused as a tail call (`liftPrelude`).
     const taken = idxOf.get(br.target!);
     const fall = idxOf.get(br.addr + 4);
     if (taken === undefined || fall === undefined) {
@@ -356,16 +639,804 @@ function toBlocks(instrs: Instr[], name: string, jts: Map<number, PpcJT>): { blo
   };
 }
 
+/** The PPC EABI's small-data base registers: r13 points into `.sdata`/`.sbss` and r2 into
+ *  `.sdata2`/`.sbss2`, both set once by the runtime's startup code and never by a compiled function.
+ *  A compiled access names its symbol in an `R_PPC_EMB_SDA21` relocation, which this frontend reads
+ *  instead of the base (`sdaAccess`). A base read as a VALUE — `lbzx r0,r3,r13`, which mwcc 2.4.7
+ *  emits for `playerOrderNew[j - 1]` (MP4 `OrderPlayers`), or `lwz r3,-0x7ff0(r13)` in a linked image —
+ *  has no C spelling here, and the SSA builder would otherwise read the def-less register as an
+ *  invented parameter. It refuses, as MIPS refuses `gp` used as data. */
+const SMALL_DATA_BASES: readonly string[] = ['r13', 'r2'];
+
+/** The link register's save word, as an offset from the entry r1: the second word of the caller's
+ *  frame header, after the back chain. mwcc 2.3.3 spells it `4(r1)` before the push and 2.4.x
+ *  `N+4(r1)` after it (`r1Displacements`). */
+const LR_SAVE_WORD = 4;
+/** The caller's parameter area, as an offset from the entry r1: past the back chain and the link
+ *  register's save word, the words a call takes past its eight argument registers. */
+const PARAM_AREA_AT = 8;
+/** Every load that takes an `off(rA)` operand: integer, multiple, update and floating-point
+ *  (`outgoing-area-probes.test.ts` classifies every memory mnemonic of the committed probes against it). */
+export const PPC_FRAME_LOAD = /^(lbz|lhz|lha|lwz|lmw|lbzu|lhzu|lhau|lwzu|lfs|lfd|lfsu|lfdu|psq_l|psq_lu)$/;
+
+/** The register save or restore routine a `bl` calls (runtime-helpers.ts `RegisterSaveRoutines`),
+ *  named by its `R_PPC_REL24`, or null for any other `bl`. Only the relocation names it: a `bl` with
+ *  none — a linked image, or an objdump without `-r` — is no routine, and `case 'bl'` refuses it
+ *  there as a call with no callee symbol. */
+const saveRoutineOf = (target: TargetDescription, ins: Instr) =>
+  ins.mnemonic === 'bl' && ins.reloc?.type === 'R_PPC_REL24'
+    ? registerSaveRoutineOf(target.registerSaveRoutines, ins.reloc.sym)
+    : null;
+
+/** A general register a callee must preserve: one the EABI neither passes an argument in, nor lets
+ *  a callee destroy, nor reserves (r1, and the small-data bases). `prologueSavedRegs` counts the
+ *  first store of ANY register in `regs`; only these are saves of the caller's value in `offsets`. */
+const isCalleeSaved = (target: TargetDescription, r: string): boolean =>
+  isReg(r) &&
+  r !== 'r1' &&
+  !SMALL_DATA_BASES.includes(r) &&
+  !target.argRegs.includes(r) &&
+  !target.callerSaved.includes(r);
+
+/** Whether any of `body` names a callee-saved general register (`isCalleeSaved`), as an operand or
+ *  a memory base, that the prologue did not save — the mark of hand-written asm, since compiled
+ *  code saves such a register before it touches it. A save routine or `stmw` names only its first
+ *  register, and saves it, so either is in `saved`.
+ *
+ *  A GLOBAL REGISTER VARIABLE'S register (`target.globalRegisterVariables`) does not count: it is
+ *  the one callee-saved register COMPILED code names unsaved, and the live-in model reads it as that
+ *  global (`registerLiveIns`). Counted, it would make the detector and the model disagree about one
+ *  register, and drop the bound a compiled body's own declaration states: mwcc 2.4.2's
+ *  `register int g __asm__("r14"); int f(int a) { int x, y; if (a) { x = a; y = a + 1; } … a * g`
+ *  homes x and y in r4/r5, and `f(s32)` would lift as `f(s32 a0, s32 a1, s32 a2)` with no note. The
+ *  blind side is a hand-written entry point handed inputs in r14..r28 and in argument registers
+ *  past its declaration, which then reads those as `uninit_<reg>`; asm that names no other unsaved
+ *  callee-saved register is byte-for-byte the compiled shape. No function of the ac, mp4 or Pikmin
+ *  builds names an unsaved r14..r28 at all. */
+const namesUnsavedCalleeSaved = (
+  body: readonly Instr[],
+  target: TargetDescription,
+  saved: ReadonlySet<string>,
+): boolean =>
+  body.some((ins) =>
+    ins.ops.some((op) => {
+      const reg = op.includes('(') ? parseMem(op).base : op;
+      return (
+        isCalleeSaved(target, reg) && !saved.has(reg) && !Object.hasOwn(target.globalRegisterVariables?.regs ?? {}, reg)
+      );
+    }),
+  );
+
+/** WHAT THE PROLOGUE SAVED, AND WHERE. `regs` is the save half of the register partition
+ *  (frontend/ssa.ts, `LiveInModel.uninitRegs`). A register the ABI passes no argument in is an
+ *  uninitialised local only where the compiler could home a local there, which it may do only after
+ *  saving it; without this, an uninitialised local in a callee-saved register lifts as an extra
+ *  PARAMETER (`int x; if (s) x = k(a); return k(a) + x;` would take a third).
+ *
+ *  Read off the ENTRY block, the one every path starts with: `stmw rS,D(r1)` saves rS..r31, a GPR
+ *  save routine rNN..r31, and `stw rN,D(r1)` rN. A register counts as saved only where NO earlier
+ *  instruction names it, as an operand or as a memory base, read or written. That is what a save
+ *  is: the first thing the function does with the register. A write before the store makes the
+ *  `stw` a spill; a READ before it is asm handed a live value there, which the save then preserves
+ *  — the very case the save half exists to keep a parameter for, so it must not count.
+ *
+ *  NOT Thumb's rule (`savedRegs` in frontend/thumb.ts), which ends the measurement at the end of the
+ *  LEADING run of saves. mwcc interleaves its saves with the body's first instructions
+ *  (`stw r31,12(r1); mr r31,r3; stw r30,8(r1)`), and the save routine's `addi r11,r1,N` need not sit
+ *  next to its `bl`, so a leading run would drop saves the prologue really makes. The two rules
+ *  agree on what they let through: no instruction before a counted save touches the register. The
+ *  operand text can only over-name (a register spelt in a branch target names nothing), which
+ *  under-states the set — the direction that keeps a parameter.
+ *
+ *  `offsets` are where the saves of the caller's values lie, as entry-r1 offsets, which bound the
+ *  local area from above (`measurePpcFrame`): each `stw` of a callee-saved register (`isCalleeSaved`)
+ *  the same first-naming rule counts, each such word of a `stmw`, each word a save routine stores
+ *  below its frame address (`addi r11,r1,N`), and each floating-point save (`stfd`, or the FPR
+ *  routine), which this frontend refuses elsewhere but which still bounds where a local may lie.
+ *  Null where a save's offset cannot be named: r1's depth at it, or the routine's frame address, is
+ *  unknown.
+ *
+ *  A SAVE IS RELOADED. In a function that returns, an `stw` of a callee-saved register that no
+ *  reload of it from r1 answers anywhere — an `lwz` of it, an `lmw` or restore routine reaching it —
+ *  saves nothing: the caller gets the register back as the body left it, so the word is a value.
+ *  mwcc 2.4 stores a file-scope global register variable passed on the stack exactly so, in the
+ *  entry block — `register int g __asm__("r14"); return k(1, …, 8, g) + g;` is `stw r14,8(r1); bl k`
+ *  and no reload of r14 — and counting it as a save would turn the read of `g` after the call into
+ *  `uninit_r14` and drop the ninth argument. Which word a reload reads is judged where it is
+ *  lowered (`restoreFrom`). A function with no return keeps the entry-block reading. */
+function prologueSavedRegs(
+  entry: readonly Instr[],
+  target: TargetDescription,
+  r1At: ReadonlyMap<Instr, number | string>,
+  blocks: readonly PpcBlock[],
+): { regs: ReadonlySet<string>; offsets: number[] | null } {
+  const code = blocks.flatMap((b) => [...b.body, ...(b.branch ? [b.branch] : [])]);
+  const returns = blocks.some((b) => b.synthReturn) || code.some((ins) => isReturn(ins) || isCondReturn(ins));
+  const reloaded = (r: string) =>
+    code.some((ins) => {
+      const routine = saveRoutineOf(target, ins);
+      return routine
+        ? routine.restore && !routine.fpr && Number(r.slice(1)) >= routine.first
+        : ins.ops[1]?.includes('(') === true &&
+            parseMem(ins.ops[1]).base === 'r1' &&
+            ((ins.mnemonic === 'lwz' && ins.ops[0] === r) ||
+              (ins.mnemonic === 'lmw' && Number(r.slice(1)) >= Number(ins.ops[0]?.slice(1))));
+    });
+  const regs = new Set<string>();
+  const named = new Set<string>();
+  const offsets: number[] = [];
+  let unnamed = false;
+  const word = (off: number | null) => {
+    if (off === null) {
+      unnamed = true;
+    } else {
+      offsets.push(off);
+    }
+  };
+  let frameAddress: number | null = null;
+  for (const ins of entry) {
+    const [d, s] = ins.ops;
+    const depth = r1At.get(ins);
+    const routine = saveRoutineOf(target, ins);
+    if (ins.mnemonic === 'addi' && d === target.registerSaveRoutines?.frameReg && s === 'r1') {
+      frameAddress = typeof depth === 'number' ? depth + parseImm(ins.ops[2]) : null;
+    } else if (routine) {
+      if (!routine.restore) {
+        const bytes = routine.fpr ? 8 : 4;
+        for (let k = routine.first; k <= 31; k++) {
+          if (!routine.fpr && !named.has(`r${k}`)) {
+            regs.add(`r${k}`);
+          }
+          word(frameAddress === null ? null : frameAddress - bytes * (32 - k));
+        }
+      }
+    } else if (/^(stw|stmw|stfd)$/.test(ins.mnemonic) && s?.includes('(') && parseMem(s).base === 'r1') {
+      const first = ins.mnemonic === 'stmw' ? Number(d.slice(1)) : 0;
+      const n = ins.mnemonic === 'stmw' ? 32 - first : 1;
+      // A single `stw` no reload answers, in a function that returns, saves nothing (see below).
+      const unanswered = ins.mnemonic === 'stw' && isCalleeSaved(target, d) && returns && !reloaded(d);
+      for (let k = 0; k < (unanswered ? 0 : n); k++) {
+        const reg = ins.mnemonic === 'stmw' ? `r${first + k}` : d;
+        if (ins.mnemonic !== 'stfd' && !named.has(reg)) {
+          regs.add(reg);
+        }
+        if (ins.mnemonic === 'stfd' || (isCalleeSaved(target, reg) && !named.has(reg))) {
+          word(typeof depth === 'number' ? parseMem(s).off + depth + 4 * k : null);
+        }
+      }
+    }
+    for (const op of ins.ops) {
+      const reg = op.includes('(') ? parseMem(op).base : op;
+      if (isReg(reg)) {
+        named.add(reg);
+      }
+    }
+  }
+  return { regs, offsets: unnamed ? null : offsets };
+}
+
+/** Where r1 stands, relative to its value at entry, just BEFORE an instruction runs: a byte count
+ *  (0 before the frame push, -N after `stwu r1,-N(r1)`), or why it is not known there.
+ *
+ *  A frame slot has to be named by its offset from the ENTRY r1, because the compilers disagree on
+ *  which side of the push they save the link register. mwcc 2.4.x pushes first and saves at
+ *  `N+4(r1)`; mwcc 2.3.3 saves at `4(r1)` BEFORE `stwu r1,-N(r1)` and restores from `N+4(r1)`. That is
+ *  one word of the caller's frame spelled at two offsets, and an offset from the CURRENT r1 reads it
+ *  as two different words.
+ *
+ *  Forward dataflow over the block graph, per instruction. Only the two forms a compiler uses to
+ *  move r1 are counted: `stwu r1,-N(r1)` from the entry value, and `addi r1,r1,N`. Anything else
+ *  that writes r1 — a second push, an `addi r1,rX,N` from another register, an `mr r1,r11` — makes
+ *  the displacement unknown from there on, and so does a join whose predecessors arrive at
+ *  different depths. Unknown is not a refusal by itself: a displacement nothing reads decides
+ *  nothing. The frame accesses and the push that DO read it refuse loud (`lift`, `entryOffset`). */
+function r1Displacements(blocks: PpcBlock[], succIdx: number[][]): Map<Instr, number | string> {
+  const at = new Map<Instr, number | string>();
+  const into: Array<number | string | undefined> = blocks.map(() => undefined);
+  // A block whose displacement is unknown stays unknown, under the first reason found.
+  const meet = (bi: number, d: number | string): boolean => {
+    const old = into[bi];
+    let next = d;
+    if (typeof old === 'string' || old === d) {
+      next = old;
+    } else if (typeof old === 'number' && typeof d === 'number') {
+      const where = blocks[bi].startAddr >= 0 ? `0x${blocks[bi].startAddr.toString(16)}` : 'a synthesized return';
+      next = `the paths into ${where} arrive with r1 at two depths (${old} and ${d} bytes from its entry value)`;
+    }
+    into[bi] = next;
+    return next !== old;
+  };
+  const writesR1 = (ins: Instr) => ins.ops[0] === 'r1' && !/^(st|cmp|tw|mt|dc|ic)/.test(ins.mnemonic);
+  meet(0, 0);
+  const work = [0];
+  while (work.length) {
+    const bi = work.pop()!;
+    let d = into[bi]!;
+    for (const ins of [...blocks[bi].body, ...(blocks[bi].branch ? [blocks[bi].branch] : [])]) {
+      at.set(ins, d);
+      const where = `0x${ins.addr.toString(16)}`;
+      if (ins.mnemonic === 'stwu' && ins.ops[0] === 'r1' && parseMem(ins.ops[1]).base === 'r1') {
+        d =
+          d === 0
+            ? parseMem(ins.ops[1]).off
+            : `the frame push at ${where} is a second one (r1 already moved from its entry value)`;
+      } else if (ins.mnemonic === 'addi' && ins.ops[0] === 'r1' && ins.ops[1] === 'r1' && !ins.reloc) {
+        d = typeof d === 'number' ? d + parseImm(ins.ops[2]) : d;
+      } else if (writesR1(ins)) {
+        d = `'${ins.mnemonic} ${ins.ops.join(',')}' at ${where} sets r1 to a value this frontend does not track`;
+      }
+    }
+    for (const s of succIdx[bi]) {
+      if (meet(s, d)) {
+        work.push(s);
+      }
+    }
+  }
+  return at;
+}
+
+/** What the link-register proof knows at one point: what the link register holds (`lr`: null where
+ *  it is still the caller's return address on every path, else the instruction that put something
+ *  else there on some path), which general registers hold a copy of the return address on every
+ *  path (`regs`), and whether the link register's save word does (`slot`). */
+interface LrState {
+  readonly lr: Instr | null;
+  readonly regs: ReadonlySet<string>;
+  readonly slot: boolean;
+}
+
+/** EVERY RETURN OF THIS FUNCTION JUMPS THROUGH THE CALLER'S RETURN ADDRESS, or the lift declines —
+ *  PowerPC's half of what `refuseReturnsNotThroughCallersLr` asks of Thumb (frontend/thumb.ts).
+ *
+ *  `blr` and a conditional return (`beqlr`) read as returns from the instruction alone, and each is
+ *  one only where the link register holds the address this function was called with. A forward
+ *  dataflow over the blocks tracks where that address is:
+ *    • the link register holds it at entry; a `bl` writes it (a call, and a register save or restore
+ *      routine too), and an `mtlr rS` puts back whatever rS holds;
+ *    • `mflr rD` copies it into rD, `mr` copies it on, and any other write to a register loses it —
+ *      an ordinary call loses every register the EABI lets a callee destroy, a save routine none, and
+ *      a GPR restore routine the r{first}..r31 it reloads, as `lmw` does;
+ *    • a `stw` of a register holding it into the link register's save word (`LR_SAVE_WORD`, named
+ *      from the entry r1 through `r1At`) puts it in that word, and a `lwz` from that word copies it
+ *      back out. Any other store reaching those bytes, a store through r1 at an unknown depth, a call
+ *      made before the frame push (the callee saves ITS return address in that very word), and a
+ *      save routine whose frame address could reach it all overwrite it.
+ *  Paths meet by agreement: the link register, a register or the word holds the address only if it
+ *  does on every path in.
+ *
+ *  So `li r3,7; mtlr r4; blr`, `lwz r0,0(r3); mtlr r0; blr`, `mflr r0; addi r0,r0,4; mtlr r0; blr`, an
+ *  `mtlr` on one path only, and a `bl` with no saved address put back before the `blr` all decline,
+ *  where mwcc's `mflr r0; stw r0,N+4(r1)` … `lwz r0,N+4(r1); mtlr r0; blr` (2.3.3 saves at `4(r1)`
+ *  before the push) and a leaf that never names the link register are returns. No compiler emits a
+ *  violation; hand-written asm can, and it would otherwise lift as a C `return`.
+ *
+ *  Returned per instruction that reads the link register as the return address where it may not be
+ *  that, with the instruction that put something else there on some path: a return, and an `mflr`
+ *  after a `bl` (its copy would be taken for the return address, and is the address after the `bl`
+ *  instead). Absent everywhere else. Blocks no path from the entry reaches are not asked: they never
+ *  run.
+ *
+ *  NOT ASKED: a store through a register holding a frame address (`addi r3,r1,N`) is not traced to
+ *  the save word. A compiler addresses that word only through r1. */
+function linkRegisterProof(
+  blocks: PpcBlock[],
+  succIdx: number[][],
+  r1At: ReadonlyMap<Instr, number | string>,
+  target: TargetDescription,
+): Map<Instr, Instr> {
+  const at = new Map<Instr, Instr>();
+  const destroyed = new Set(['r0', ...target.argRegs, ...target.callerSaved]);
+  const frameReg = target.registerSaveRoutines?.frameReg;
+  const join = (a: LrState, b: LrState): LrState => ({
+    lr: a.lr ?? b.lr,
+    regs: new Set([...a.regs].filter((r) => b.regs.has(r))),
+    slot: a.slot && b.slot,
+  });
+  const same = (a: LrState, b: LrState) =>
+    a.lr === b.lr && a.slot === b.slot && a.regs.size === b.regs.size && [...a.regs].every((r) => b.regs.has(r));
+  // The bytes `[lo, hi)` a store through r1 writes, as entry-r1 offsets, or null where r1's depth is
+  // not known there or the address takes an index register.
+  const storedRange = (ins: Instr): [number, number] | null => {
+    const d = r1At.get(ins);
+    const mem = ins.ops[1];
+    if (typeof d !== 'number' || !mem?.includes('(')) {
+      return null;
+    }
+    const mn = ins.mnemonic;
+    const width =
+      mn === 'stmw'
+        ? 4 * (32 - Number(ins.ops[0].slice(1)))
+        : /^stb/.test(mn)
+          ? 1
+          : /^sth/.test(mn)
+            ? 2
+            : /^stfd/.test(mn)
+              ? 8
+              : 4;
+    const lo = parseMem(mem).off + d;
+    return [lo, lo + width];
+  };
+  const namesR1 = (ins: Instr) => ins.ops.some((op) => (op.includes('(') ? parseMem(op).base : op) === 'r1');
+
+  const run = (bi: number, inState: LrState, record: boolean): LrState => {
+    let { lr, slot } = inState;
+    const regs = new Set(inState.regs);
+    let frameAddress: number | null = null;
+    for (const ins of [...blocks[bi].body, ...(blocks[bi].branch ? [blocks[bi].branch] : [])]) {
+      const mn = ins.mnemonic;
+      const [d, s] = ins.ops;
+      if (
+        record &&
+        ((mn === 'mflr' && lr?.mnemonic === 'bl') || ((isReturn(ins) || isCondReturn(ins)) && lr !== null))
+      ) {
+        at.set(ins, lr!);
+      }
+      if (mn === 'bl') {
+        const routine = saveRoutineOf(target, ins);
+        lr = ins;
+        if (routine) {
+          // A save routine stores below its frame address; a restore routine writes no memory.
+          const bytes = routine.fpr ? 8 : 4;
+          if (
+            !routine.restore &&
+            (frameAddress === null ||
+              (frameAddress - bytes * (32 - routine.first) < LR_SAVE_WORD + 4 && frameAddress > LR_SAVE_WORD))
+          ) {
+            slot = false;
+          }
+          // A GPR restore routine reloads r{first}..r31 from their save words, as `lmw` does: none of
+          // them holds the return address after it, whatever was copied into them before.
+          if (routine.restore && !routine.fpr) {
+            for (const r of [...regs]) {
+              if (Number(r.slice(1)) >= routine.first) {
+                regs.delete(r);
+              }
+            }
+          }
+        } else {
+          for (const r of destroyed) {
+            regs.delete(r);
+          }
+          if (r1At.get(ins) === 0 || typeof r1At.get(ins) !== 'number') {
+            slot = false;
+          }
+        }
+        continue;
+      }
+      if (mn === 'mtlr') {
+        lr = regs.has(d) ? null : ins;
+        continue;
+      }
+      if (mn === 'mflr') {
+        if (lr === null) {
+          regs.add(d);
+        } else {
+          regs.delete(d);
+        }
+        continue;
+      }
+      if (/^st/.test(mn)) {
+        if (namesR1(ins)) {
+          const range = storedRange(ins);
+          if (mn === 'stw' && range !== null && range[0] === LR_SAVE_WORD && regs.has(d)) {
+            slot = true;
+          } else if (range === null || (range[0] < LR_SAVE_WORD + 4 && range[1] > LR_SAVE_WORD)) {
+            slot = false;
+          }
+        }
+        // An update form writes its base register.
+        if (/^st\w*ux?$/.test(mn)) {
+          regs.delete(s?.includes('(') ? parseMem(s).base : s);
+        }
+        continue;
+      }
+      if (/^(cmp|tw|mt|dc|ic|b|sync|isync|eieio)/.test(mn)) {
+        continue;
+      }
+      if (mn === 'lmw' || /^lsw/.test(mn)) {
+        const first = mn === 'lmw' ? Number(d.slice(1)) : 0;
+        for (const r of [...regs]) {
+          if (Number(r.slice(1)) >= first) {
+            regs.delete(r);
+          }
+        }
+        continue;
+      }
+      const copies =
+        (mn === 'mr' && regs.has(s)) ||
+        (mn === 'or' && s === ins.ops[2] && regs.has(s)) ||
+        (mn === 'lwz' &&
+          slot &&
+          s?.includes('(') &&
+          parseMem(s).base === 'r1' &&
+          typeof r1At.get(ins) === 'number' &&
+          parseMem(s).off + (r1At.get(ins) as number) === LR_SAVE_WORD);
+      if (frameReg !== undefined && mn === 'addi' && d === frameReg && s === 'r1' && !ins.reloc) {
+        const depth = r1At.get(ins);
+        frameAddress = typeof depth === 'number' ? depth + parseImm(ins.ops[2]) : null;
+      } else if (d === frameReg) {
+        frameAddress = null;
+      }
+      if (isReg(d)) {
+        regs.delete(d);
+      }
+      // A load with update writes its base register too.
+      if (/^l\w*ux?$/.test(mn) && mn !== 'lux') {
+        regs.delete(s?.includes('(') ? parseMem(s).base : s);
+      }
+      if (copies && isReg(d)) {
+        regs.add(d);
+      }
+    }
+    return { lr, regs, slot };
+  };
+
+  const into: Array<LrState | undefined> = blocks.map(() => undefined);
+  into[0] = { lr: null, regs: new Set(), slot: false };
+  const work = [0];
+  while (work.length) {
+    const bi = work.pop()!;
+    const out = run(bi, into[bi]!, false);
+    for (const s of succIdx[bi]) {
+      const prev = into[s];
+      const next = prev === undefined ? out : join(prev, out);
+      if (prev === undefined || !same(prev, next)) {
+        into[s] = next;
+        work.push(s);
+      }
+    }
+  }
+  // Ask each reader once the states are settled, so a reason names the fixed point's writer.
+  into.forEach((st, bi) => {
+    if (st !== undefined) {
+      run(bi, st, true);
+    }
+  });
+  return at;
+}
+
+/** The sub-word load and store mnemonics this frontend lifts. */
+const SUBWORD_MEM: ReadonlySet<string> = new Set(['lbz', 'lha', 'lhz', 'stb', 'sth']);
+
+/** An instruction that takes a frame address as data: `addi rD,r1,k`. The register save routines'
+ *  `addi r11,r1,N` is frame bookkeeping (`frame-address` in `nonValues`), not a capture. */
+const takesFrameAddress = (ins: Instr, frameReg: string | undefined): boolean =>
+  ins.mnemonic === 'addi' && ins.ops[1] === 'r1' && ins.ops[0] !== 'r1' && ins.ops[0] !== frameReg && !ins.reloc;
+
+/** THE LOADED-WORD BOUND (`compilerBehaviors.outgoingAreaNeverLoadedFrom`, 8 on mwcc), per r1
+ *  depth: the lowest frame word, as an offset from the entry r1, that this function LOADS at that
+ *  depth from the parameter area up, past the callee's back chain and link-register words. mwcc
+ *  loads no word of its outgoing area, before a call or after, so a word it loads is a local's,
+ *  and since the area is one region at the frame bottom every word at or above it is no call's
+ *  stack argument. Only an instruction the entry reaches has a depth, so every load counted can
+ *  run; one at another depth names another frame's words. Measured once, in `liftPrelude`: the
+ *  undeclared-call guess (through `measurePpcFrame`'s `outgoingEnd`), the unread-store decline and
+ *  the frame-object audit (`loadedWords`) take this number, and it counts what the IR does not
+ *  show the audit — the slot reloads and the epilogue's restores. The local area's partition does
+ *  not: it starts at the parameter area whatever the bound, and rests on the guess and the audit.
+ *  `Infinity` at every depth where the target states no such offset. */
+function ppcLoadedWordBound(
+  blocks: readonly PpcBlock[],
+  r1At: ReadonlyMap<Instr, number | string>,
+  target: TargetDescription,
+): (depth: number) => number {
+  const loadedFrom = target.compilerBehaviors.outgoingAreaNeverLoadedFrom;
+  if (loadedFrom === undefined) {
+    return () => Infinity;
+  }
+  const bounds = new Map<number, number>();
+  for (const b of blocks) {
+    for (const ins of b.body) {
+      const depth = r1At.get(ins);
+      const mem = ins.ops.find((o) => /^-?\d+\(r1\)$/.test(o));
+      if (typeof depth !== 'number' || mem === undefined || !PPC_FRAME_LOAD.test(ins.mnemonic)) {
+        continue;
+      }
+      const off = parseMem(mem).off;
+      const word = off - (((off % 4) + 4) % 4);
+      if (word >= loadedFrom) {
+        bounds.set(depth, Math.min(bounds.get(depth) ?? Infinity, depth + word));
+      }
+    }
+  }
+  return (depth: number) => bounds.get(depth) ?? Infinity;
+}
+
+/** THE LOCAL AREA of a function that takes a frame address, reaches its frame below a word, or
+ *  keeps a dead local there, and the size of the one frame it pushes — or null, which leaves every
+ *  such access the refusal it had without one. Null where none of the three happens; where the
+ *  function does not push exactly one frame, with `stwu r1,-N(r1)` at entry depth; where a capture
+ *  runs at another depth; where the target states no layout, a save's offset cannot be named, or
+ *  no area is left; and where an r1 access at another depth lands on the area's bytes
+ *  (`landsOnArea`), which the routing by post-push offset would then misname.
+ *
+ *  The area starts where the caller's parameter area does (`PARAM_AREA_AT`), past the back chain
+ *  and the link-register save word, and runs to the lowest save (`compilerBehaviors.linkageLocalArea`,
+ *  `areaAboveOutgoing`). The measured rule puts it past the widest call's stack words too; no call
+ *  this frontend lowers takes any, so a call whose declaration may take some refuses here, where the
+ *  area is drawn: one declared with more parameter words than argument registers, with a 64-bit parameter (the EABI
+ *  aligns a pair to an odd register, so a packed word count does not say where the stack words
+ *  start), or with more floating parameters than f1..f8. So does a declared parameter that is a
+ *  struct or union passed by value (`ParamClass` `by-value`), which mwcc passes as the address of a
+ *  copy in this area (`tb(1, b)` copies `b` to r1+8 and passes `addi r4,r1,8` at -O4,p) — a copy no
+ *  source declares, whose address the lift would pass where the callee takes the struct — and one
+ *  nothing sizes (`unsized`), which may be that, a pair or a stack word.
+ *
+ *  A CALL NOTHING DECLARES IS PROVEN CLEAR OF THE AREA ONLY BY THE LOADED-WORD BOUND
+ *  (`ppcLoadedWordBound`): mwcc loads no word of its outgoing area from the parameter area up, so
+ *  the call's stack words, if any, lie below the lowest pushed-frame word this function loads.
+ *  `outgoingEnd` is that word, or the parameter area's start where every call is declared: where it
+ *  is past the area's start, the area may hold such a word. Its lowering's guess reads it, refusing
+ *  a call whose guessed arity reaches seven argument registers unless `outgoingEnd` is at or below
+ *  the area's start (`lift`, the guess's `refuse`) — but the guess counts only the registers this function
+ *  sets, none it passes straight through, so `g9(a, …, h, 77)` with r3..r10 untouched passes it
+ *  and the word at r1+8 is g9's ninth argument, inside the area. What refuses that call is the
+ *  shared audit (frame-objects.ts `storedNeverRead`): the store to r1+8 reaches the call unread,
+ *  below the bound it takes (`loadedWords`, the same measurement), so no load proves it a local's.
+ *  That audit is the backstop this partition rests on for an undeclared callee; a change to the
+ *  guess or to the audit's survivor rule moves it.
+ *
+ *  A word stored to the frame that no word load reads back, in a function that makes no call, is a
+ *  DEAD LOCAL: no callee can take it as a stack argument. A tail branch, which would hand this
+ *  frame's caller's parameter area to another function, refuses before this runs (`liftPrelude`).
+ *  It lifts as a store to a frame object, and what reaches the C is then the shared lift's, as for
+ *  the same store on Thumb and MIPS: a fixed-offset scalar becomes a local, which the dead-store
+ *  pass drops (`l3/dce.ts`) unless its value is a read it keeps (`sp8 = *a0`), so `int v; v = x;`
+ *  at -O0,p lifts to an empty body and a `volatile` local's stores are lost with it — no code can
+ *  observe that word — and only a store at a runtime index stays one, into the frame array. A dead
+ *  local alone draws the area only where one lies inside it. */
+function measurePpcFrame({
+  name,
+  blocks,
+  saves,
+  r1At,
+  target,
+  calls,
+  loadedWordBound,
+  fail,
+}: {
+  name: string;
+  blocks: readonly PpcBlock[];
+  /** the prologue's save words, as entry-r1 offsets (`prologueSavedRegs`) */
+  saves: readonly number[] | null;
+  r1At: ReadonlyMap<Instr, number | string>;
+  target: TargetDescription;
+  calls: CallDeclarations;
+  /** `ppcLoadedWordBound`, the one the lift reads */
+  loadedWordBound: (depth: number) => number;
+  fail: FrontendRefusal;
+}): { area: FrameRange; size: number; outgoingEnd: number } | null {
+  const code = blocks.flatMap((b) => [...b.body, ...(b.branch ? [b.branch] : [])]);
+  const bls = blocks.flatMap((b) => b.body).filter((ins) => ins.mnemonic === 'bl' && !saveRoutineOf(target, ins));
+  const frameReg = target.registerSaveRoutines?.frameReg;
+  const r1Mem = (ins: Instr) => {
+    const last = ins.ops[ins.ops.length - 1] ?? '';
+    return last.includes('(') && parseMem(last).base === 'r1' && ins.mnemonic !== 'stwu' ? parseMem(last) : undefined;
+  };
+  const captures = code.filter((ins) => takesFrameAddress(ins, frameReg));
+  const subword = code.filter((ins) => SUBWORD_MEM.has(ins.mnemonic) && r1Mem(ins) !== undefined);
+  const entryOff = (ins: Instr) => {
+    const at = r1At.get(ins);
+    return typeof at === 'number' ? r1Mem(ins)!.off + at : undefined;
+  };
+  const loadedWords = new Set(
+    code.flatMap((ins) => {
+      const at = r1Mem(ins) && /^(lwz|lmw)$/.test(ins.mnemonic) ? entryOff(ins) : undefined;
+      return at === undefined
+        ? []
+        : ins.mnemonic === 'lmw'
+          ? [...Array(32 - Number(ins.ops[0].slice(1))).keys()].map((k) => at + 4 * k)
+          : [at];
+    }),
+  );
+  const deadStores =
+    bls.length > 0
+      ? []
+      : code.filter(
+          (ins) => ins.mnemonic === 'stw' && r1Mem(ins) !== undefined && !loadedWords.has(entryOff(ins) ?? NaN),
+        );
+  if (captures.length === 0 && subword.length === 0 && deadStores.length === 0) {
+    return null;
+  }
+  const pushes = code.filter((ins) => ins.mnemonic === 'stwu' && ins.ops[0] === 'r1');
+  if (pushes.length !== 1 || r1At.get(pushes[0]) !== 0 || parseMem(pushes[0].ops[1]).base !== 'r1') {
+    return null;
+  }
+  const size = -parseMem(pushes[0].ops[1]).off;
+  if (!(size > 0) || captures.some((ins) => r1At.get(ins) !== -size) || saves === null) {
+    return null;
+  }
+  const area = target.compilerBehaviors.linkageLocalArea
+    ? areaAboveOutgoing({ frameSize: size, outgoingEnd: PARAM_AREA_AT, saves: saves.map((o) => o + size), align: 4 })
+    : null;
+  if (area === null) {
+    return null;
+  }
+  for (const ins of code) {
+    const off = r1Mem(ins) === undefined || r1At.get(ins) === -size ? undefined : entryOff(ins);
+    if (off !== undefined && landsOnArea(area, off + size, 4)) {
+      return null;
+    }
+  }
+  // Drawn for dead stores alone, the area must hold one: a save the prologue made is no local.
+  const inArea = (ins: Instr) => {
+    const at = (entryOff(ins) ?? NaN) + size;
+    return at >= area.from && at < area.to;
+  };
+  if (captures.length === 0 && subword.length === 0 && !deadStores.some(inArea)) {
+    return null;
+  }
+  const fprArgs = target.fpu?.argRegs.length ?? 0;
+  for (const ins of bls) {
+    const callee = ins.reloc?.sym ?? '';
+    const params = calls.declaredParams(callee);
+    if (params === null) {
+      continue;
+    }
+    const at = `'${callee}', called at 0x${ins.addr.toString(16)},`;
+    const copied = params.findIndex((p) => p.kind === 'by-value');
+    if (copied >= 0) {
+      fail(
+        `cannot lift '${name}': address-taken stack local — ${at} takes its parameter ${copied + 1} as ` +
+          `'${params[copied].spelling}', which no word holds: a struct or union passed by value, which this compiler ` +
+          "passes as the address of a copy in the caller's local area — not modelled",
+      );
+    }
+    const count = (kind: ParamClass) => params.filter((p) => p.kind === kind).length;
+    const unsized = params.findIndex((p) => p.kind === 'unsized');
+    const why =
+      count('wide') > 0
+        ? 'a 64-bit parameter, which the EABI places in an aligned register pair or on the stack'
+        : count('word') > target.argRegs.length
+          ? `${count('word')} parameter words and the argument registers carry ${target.argRegs.length}`
+          : count('float') > fprArgs
+            ? `${count('float')} floating parameters and the floating-point argument registers carry ${fprArgs}`
+            : unsized >= 0
+              ? `its parameter ${unsized + 1} as '${params[unsized].spelling}', which nothing here sizes: a word, a ` +
+                'pair, a stack word or a by-value copy in the local area'
+              : undefined;
+    if (why !== undefined) {
+      fail(
+        `cannot lift '${name}': outgoing stack arguments not modelled — ${at} is declared with ${why}, and this ` +
+          "compiler's local area starts past the stack words a call takes",
+      );
+    }
+  }
+  // Every call a declaration sizes takes no stack word, or refused above. One nothing declares
+  // takes none past the loaded-word bound of the pushed frame, the most its area can reach.
+  const undeclared = bls.some((ins) => calls.declaredParams(ins.reloc?.sym ?? '') === null);
+  const outgoingEnd = undeclared ? Math.max(PARAM_AREA_AT, loadedWordBound(-size) + size) : PARAM_AREA_AT;
+  return { area, size, outgoingEnd };
+}
+
+/** What a call's lowering on this frontend carries out (`CallLowering`): no pair, no stack word, no
+ *  struct returned through memory. */
+const PPC_CALL_LOWERING = {
+  pairs: false,
+  memoryReturn: false,
+  stackArgs: false,
+  voidReturn: false,
+  argRegisterBoundsArity: false,
+} as const;
+
+/** This frontend's refusal, for the shared code that refuses on its behalf. */
+const ppcRefusal: FrontendRefusal = (message) => {
+  throw new PpcUnsupportedError(message);
+};
+
+/** WHAT `lift` READS OFF THE TEXT BEFORE IT DECODES AN INSTRUCTION: the control transfers it
+ *  refuses, the blocks (with the preheader), r1's depth at each instruction, the prologue's saves,
+ *  the callees' declarations, and the local area those draw (`measurePpcFrame`). `lift` and
+ *  `__testing.frameOf` both run it, so the area a test pins is the one the lift draws. */
+function liftPrelude(
+  name: string,
+  instrs: Instr[],
+  target: TargetDescription,
+  prototypes: Prototypes,
+  jts: Map<number, PpcJT>,
+  ownDeclaration?: () => OwnDeclaration | undefined,
+) {
+  const recoveredBctr = new Set([...jts.values()].map((j) => j.bctrAddr));
+  // TRUSTWORTHINESS: fail loud on an unmodelled control transfer rather than dropping it (which
+  // would silently miscompile the control flow). CTR-counted loops and indirect branches land here.
+  for (const ins of instrs) {
+    if (ins.mnemonic.startsWith('b') && !isModeledBranch(ins)) {
+      if (ins.mnemonic === 'bctr' && recoveredBctr.has(ins.addr)) {
+        continue;
+      } // recovered switch dispatch
+      throw new PpcUnsupportedError(
+        `cannot lift '${name}': unmodelled control transfer '${ins.mnemonic}' at 0x${ins.addr.toString(16)} ` +
+          (ins.mnemonic === 'blrl' || ins.mnemonic === 'bctrl'
+            ? `(an indirect call — a virtual dispatch or a call through a pointer — is not yet supported)`
+            : `(CTR-counted loop or indirect branch — mwcc -O4 loop unrolling is not yet supported)`),
+      );
+    }
+  }
+  // A BRANCH OUT OF THE FUNCTION is a tail call: the callee takes over this frame's caller's
+  // parameter area as its own, so a word stored there may be its stack argument, and the call
+  // itself would be dropped. objdump prints one either at an address outside the function or,
+  // relocated, at its own address, which would read as a loop. A conditional branch out
+  // (`beq- g`, `R_PPC_REL14`) and a `bdnz` out are tail calls too.
+  const tail = instrs.find(
+    (i) =>
+      (isUncond(i) || isCond(i) || isCtrLoop(i)) &&
+      (i.reloc !== undefined || (i.target !== undefined && !instrs.some((j) => j.addr === i.target))),
+  );
+  if (tail !== undefined) {
+    throw new PpcUnsupportedError(
+      `cannot lift '${name}': the '${tail.mnemonic}' at 0x${tail.addr.toString(16)} leaves the function` +
+        (tail.reloc ? ` for '${tail.reloc.sym}'` : '') +
+        ' — a tail call is not modelled',
+    );
+  }
+  const { blocks, succIdx } = toBlocks(instrs, name, jts);
+  refuseReachableDispatch(name, blocks, recoveredBctr, ppcRefusal);
+  const entryBody = blocks[0].body;
+  // PREHEADER. A function whose first block is a branch target (`do b = b * b; while (--n);` is a
+  // loop at the entry) would take its parameters as that loop header's phis. An empty block ahead
+  // of it becomes the entry, and its live-ins are the function's parameters (frontend/ssa.ts
+  // `ArgSlots`). It starts where the function does, which is what its label says.
+  if (succIdx.some((ss) => ss.includes(0))) {
+    blocks.unshift({ startAddr: blocks[0].startAddr, body: [], branch: null });
+    succIdx.forEach((ss, i) => (succIdx[i] = ss.map((j) => j + 1)));
+    succIdx.unshift([1]);
+  }
+  const r1At = r1Displacements(blocks, succIdx);
+  const saves = prologueSavedRegs(entryBody, target, r1At, blocks);
+  const calls = callDeclarations(name, target, prototypes, PPC_CALL_LOWERING, ppcRefusal, ownDeclaration);
+  // THE LOCAL AREA, where a function takes a frame address, reaches its frame below a word, or
+  // keeps a dead local there (`measurePpcFrame`, `compilerBehaviors.linkageLocalArea`): every r1
+  // access inside it, any width, is MEMORY through an `laddr` the shared frame-object audit then
+  // proves, as on Thumb and MIPS, and every word access outside it keeps the slot model. Null where
+  // neither happens, or the frame is one this cannot partition, and then every capture keeps its
+  // r1-as-data refusal and every sub-word access its own.
+  const loadedWordBound = ppcLoadedWordBound(blocks, r1At, target);
+  const frame = measurePpcFrame({
+    name,
+    blocks,
+    saves: saves.offsets,
+    r1At,
+    target,
+    calls,
+    loadedWordBound,
+    fail: ppcRefusal,
+  });
+  return { blocks, succIdx, r1At, savedRegs: saves.regs, calls, frame, loadedWordBound };
+}
+
 /** Lift disassembled PowerPC text → an L1 Fn with block-argument SSA. `asmData` (optional) supplies
  *  the data-section jump table for dense-switch (Regime-B) recovery; absent ⇒ a `bctr` dispatch
- *  loud-fails. */
+ *  loud-fails.
+ *
+ *  AT MOST TWICE, as on Thumb and MIPS (`frontend/frame-objects.ts` `liftWithRelift`): where the
+ *  frame-object audit answers that a callee may write the local area without bound, or that nothing
+ *  escapes and the per-object model does not describe it, it asks for the area kept as one object,
+ *  and the second lift's audit judges it so and refuses rather than asking again. */
 export function lift(
   name: string,
   asm: string,
   target: TargetDescription,
   prototypes: Prototypes = {},
   asmData?: AsmData,
+  symbols?: SymbolMap,
+  context?: ContextGlobals,
+  options: LiftOptions = {},
 ): Fn {
+  return liftWithRelift(name, (oneObject) =>
+    liftOnce(name, asm, target, prototypes, asmData, { symbols, context }, oneObject, options),
+  );
+}
+
+function liftOnce(
+  name: string,
+  asm: string,
+  target: TargetDescription,
+  prototypes: Prototypes,
+  asmData: AsmData | undefined,
+  declarations: Declarations,
+  oneObject: FrameRange | undefined,
+  { contextOwnWords, contextOwnProto }: Pick<LiftOptions, 'contextOwnWords' | 'contextOwnProto'>,
+): Fn | FrameObjectRelift {
   assertInputFormat('ppc', 'objdump', asm);
   const instrs = parseDisasm(sliceSymbol(asm, name)); // ONE function only — an absent symbol declines loud
   if (instrs.length === 0) {
@@ -375,19 +1446,27 @@ export function lift(
   // recovered dispatch's `bctr` is subsumed into a `switch_br` (emitted from its bounds block), so
   // it is exempted from the loud-fail below; an UNrecovered `bctr` still fails loud.
   const jts = asmData ? recoverPpcJumpTables(instrs, asmData) : new Map<number, PpcJT>();
-  const recoveredBctr = new Set([...jts.values()].map((j) => j.bctrAddr));
   // A data reloc on an instruction whose decode did not TAKE it means objdump printed a LINK-TIME
   // placeholder (`lis r4,0` + R_PPC_ADDR16_HA sym): the real value is the symbol's half, and
   // lifting the 0 silently reads the wrong address — plausible-but-wrong C, the forbidden class.
   // The jump-table idiom's own @tbl pair never reaches this guard: a recovered dispatch block
-  // is the bounds branch's replaced fall-through, pruned as unreachable before decode.
+  // is the bounds branch's replaced fall-through, pruned as unreachable before decode, and a
+  // hoisted pair is decoded into a table base (`tableBases`).
   //
   // TWO refusals, because they are different problems and the reader acts on them differently. A
   // symbol the naming policy calls unspellable (frontend/reloc-symbol.ts) is a DEAD END: recovering
   // the address perfectly would still leave a name no C source can write, so no amount of lifting
   // opens the row. A spellable symbol is a CAPABILITY GAP: the address is recoverable and the row
   // waits on the fold. Saying which one a row hit is the whole value of the message.
-  const relocSite = (ins: Instr) => `cannot lift '${name}': '${ins.mnemonic}' at 0x${ins.addr.toString(16)}`;
+  //
+  // An update form is decoded as the `addi` that advances its base and then the plain access
+  // (`withUpdate` in `decode`); a refusal of that `addi`'s relocation, or of either one's write
+  // (`write`), names the instruction the listing holds, not the one it was decoded through.
+  const decodedFrom = new WeakMap<Instr, Instr>();
+  const relocSite = (at: Instr) => {
+    const ins = decodedFrom.get(at) ?? at;
+    return `cannot lift '${name}': '${ins.mnemonic}' at 0x${ins.addr.toString(16)}`;
+  };
   /** Whether the decode of the instruction in hand has TAKEN its relocation. `decode` asks once, of
    *  every modelled instruction, so a relocation no case consumed refuses instead of being dropped.
    *  A per-case guard would only cover the cases that remember to carry one, and every other
@@ -395,12 +1474,26 @@ export function lift(
    *  `R_PPC_EMB_SDA21` is `a0 & 0`). An UNmodelled instruction refuses earlier and for a better
    *  reason: `lfs`/`lfd` under either relocation name the float gap, not this one. */
   let relocTaken = false;
+  const statics = makeLocalStatics();
   /** The symbol a relocation names, once the naming policy has passed it. Every recovery below goes
    *  through here FIRST, so an unspellable name can never reach the declaration minter looking like
-   *  an ordinary identifier — recovering the address is only half of being able to write it down. */
+   *  an ordinary identifier — recovering the address is only half of being able to write it down.
+   *
+   *  A function-scope static is the one kind no `extern` can name that a lift can still WRITE: the
+   *  function defines it, so its definition, read out of the side table, is recorded beside the Fn
+   *  under the linker name the IR keeps, and structure spells it by its source name. */
   const spellableSym = (ins: Instr): string => {
     relocTaken = true;
     const sym = ins.reloc?.sym ?? '';
+    if (classifyRelocSymbol(sym) === 'local-static') {
+      const read = asmData
+        ? readObjectLocalObject(asmData, sym, name)
+        : { refused: "whose definition needs the object's data, which this lift was not given" };
+      if ('refused' in read) {
+        throw new PpcUnsupportedError(`${relocSite(ins)} names a function-scope static ('${sym}') ${read.refused}`);
+      }
+      return statics.define(read);
+    }
     const why = unspellableReason(sym);
     if (why) {
       throw new PpcUnsupportedError(`${relocSite(ins)} ${why}`);
@@ -413,22 +1506,18 @@ export function lift(
         `is a link-time placeholder, not the value`,
     );
   };
-  // TRUSTWORTHINESS: fail loud on an unmodelled control transfer rather than dropping it (which
-  // would silently miscompile the control flow). CTR-counted loops and indirect branches land here.
-  for (const ins of instrs) {
-    if (ins.mnemonic.startsWith('b') && !isModeledBranch(ins)) {
-      if (ins.mnemonic === 'bctr' && recoveredBctr.has(ins.addr)) {
-        continue;
-      } // recovered switch dispatch
-      throw new PpcUnsupportedError(
-        `cannot lift '${name}': unmodelled control transfer '${ins.mnemonic}' at 0x${ins.addr.toString(16)} ` +
-          (ins.mnemonic === 'blrl' || ins.mnemonic === 'bctrl'
-            ? `(an indirect call — a virtual dispatch or a call through a pointer — is not yet supported)`
-            : `(CTR-counted loop or indirect branch — mwcc -O4 loop unrolling is not yet supported)`),
-      );
-    }
-  }
-  const { blocks, succIdx } = toBlocks(instrs, name, jts);
+  const fail = ppcRefusal;
+  // the own declaration binds only a body a compiler wrote (`ownDeclared`, measured below, before
+  // any call is lowered)
+  const { blocks, succIdx, r1At, savedRegs, calls, frame, loadedWordBound } = liftPrelude(
+    name,
+    instrs,
+    target,
+    prototypes,
+    jts,
+    () => (!ownDeclared ? undefined : ownDeclarationOf(name, prototypes, contextOwnProto)),
+  );
+  const lrUnproven = linkRegisterProof(blocks, succIdx, r1At, target);
 
   const preds: number[][] = blocks.map(() => []);
   blocks.forEach((_, i) => {
@@ -437,9 +1526,89 @@ export function lift(
     }
   });
 
-  const ssa = makeSsaBuilder(name, blocks.length, preds);
+  const fpu = target.fpu;
+  // A CALL IN A FUNCTION THAT COMPUTES ON FLOATS refuses — at the float instruction, so a refusal
+  // the stream reaches first keeps its own reason: which FPRs a callee destroys, which it reads as
+  // float arguments and which it returns in are all unmodelled, so a float live across a call — or
+  // handed to one in f1 — would resolve to a value the callee overwrote or be dropped. Both scans
+  // read the blocks the entry reaches: a `bl` on no path makes no call.
+  const reached = blocks.flatMap((b) => b.body);
+  // A register save routine is no call: it moves only the registers it saves (`saveRoutine`).
+  const callInsn = reached.find((ins) => ins.mnemonic === 'bl' && !saveRoutineOf(target, ins));
+
+  // THE LIVE-IN MODEL is the register half only (this frontend claims no frame partition): a
+  // def-less read of a register the ABI passes no argument in, and that the prologue saved or the
+  // ABI lets a callee use unsaved, is an uninitialised local. `registerLiveIns` (frontend/ssa.ts)
+  // composes it, as it does for Thumb. The FPU's callee-saved half is not measured, so f14..f31 keep
+  // the treatment a target claiming no partition gets. The function's own declaration bounds the
+  // general argument registers (`ownArgumentWordsOn`): mwcc 2.3.3 homes locals in r5..r10 past a
+  // two-parameter one. The FPRs are not bounded here.
+  //
+  // NOT WHERE THE BODY IS HAND-WRITTEN. A declaration states a compiled function's register
+  // interface, and only a compiled one's: a CodeWarrior `asm` function's type — `ksNesInit03__Fv`,
+  // declared `void ()` — says nothing of the registers it really takes (r4..r8 there, set by the
+  // emulator core that calls it), and bounding by it turns each into `uninit_<reg>`. The cheap
+  // tell is a callee-saved register the body names without the prologue having saved it
+  // (`stw r7,5612(r31)` with no save of r31), which compiled code never does: it saves before it
+  // touches one. Such a body keeps every argument register a parameter, as with no declaration.
+  const ownDeclared = !namesUnsavedCalleeSaved(reached, target, savedRegs);
+  // Which home the function returns in (frontend/fpu.ts `returnHomeRule`), by the own declaration
+  // where the body is a compiler's.
+  const homeRule: ReturnHomeRule = !fpu
+    ? { home: 'integer', declared: false }
+    : returnHomeRule(
+        ownDeclared ? ownDeclarationOf(name, prototypes, contextOwnProto) : undefined,
+        reached.some((ins) => FP_CROSSINGS.has(ins.mnemonic)),
+        () => writesFloatReturn(reached, FP_ARITH_MNEMONICS, (t) => (isFpKey(t) ? t : null), fpu),
+      );
+  const floatReturn = homeRule.home === 'float';
+  const fpType = declaredPrecision(
+    fpPrecision(reached, (m) => FP_ARITH[m]?.width ?? (FP_CROSSINGS.has(m) ? null : undefined)),
+    ownDeclared ? ownDeclarationOf(name, prototypes, contextOwnProto) : undefined,
+  );
+  const liveIns = registerLiveIns(
+    target,
+    savedRegs,
+    !ownDeclared ? undefined : (contextOwnWords ?? ownArgumentWordsOn(name, prototypes[name], target)),
+  );
+  const ssa = makeSsaBuilder(
+    name,
+    blocks.length,
+    preds,
+    () => ({ ...liveIns, saveSite: 'store or save routine in its entry block' }),
+    (k) => (isFpKey(k) ? (fpType ?? T.f32()) : undefined),
+    liveIns.globalRegs,
+  );
   const { irBlocks, readVar, writeVar, paramReg } = ssa;
 
+  /** Where an r1 access of `width` bytes at `ins` lies in the local area: its post-push offset, or
+   *  undefined for one outside it. An access across the area's edge refuses: half memory and half
+   *  slot is neither. `measurePpcFrame` refuses a frame where an access at another depth lands in
+   *  the area, so one inside it runs at the frame's own depth. */
+  const inLocalArea = (ins: Instr, mem: string, width: number): number | undefined => {
+    const depth = r1At.get(ins);
+    if (frame === null || parseMem(mem).base !== 'r1' || typeof depth !== 'number') {
+      return undefined;
+    }
+    const at = parseMem(mem).off + depth + frame.size;
+    if (at >= frame.area.to || at + width <= frame.area.from) {
+      return undefined;
+    }
+    if (at < frame.area.from || at + width > frame.area.to) {
+      fail(
+        `cannot lift '${name}': address-taken stack local — '${ins.mnemonic}' at 0x${ins.addr.toString(16)} reaches ` +
+          `across an edge of the local area, r1+${frame.area.from} up to r1+${frame.area.to} — part memory, part slot`,
+      );
+    }
+    return at;
+  };
+  // The frame offset each `laddr` this lift emitted names — function-scoped, since a register
+  // holding one crosses blocks — and every capture moved into another (`addi rD,rCapture,k`
+  // re-minted as the `laddr` of the sum), handed to the audit so a base only the move read is
+  // dropped rather than judged as a capture (`foldMovedCaptures`).
+  const laddrAt = new Map<Value, number>();
+  const movedCaptures = new Set<Value>();
+
   /** The HIGH half of a relocated address, per value standing for one. The invariant, and every
    *  way a placeholder could leak past it, lives in frontend/high-half.ts — shared with
    *  frontend/mips.ts, which folds the same two-instruction address under `%hi`/`%lo`.
@@ -457,71 +1626,247 @@ export function lift(
     hi: '@ha',
     hiArticle: 'an',
     lo: '@l',
-    fail: (message) => {
-      throw new PpcUnsupportedError(message);
-    },
+    fail,
   });
+  /** The jump-table bases a recovered dispatch reads from outside its own block — the `@l` that
+   *  completes one defines no value but the base (frontend/jump-table.ts). */
+  const tableBases = makeTableBases(
+    [...jts.values()].flatMap((j) => (j.hoisted ? [j.hoisted] : [])),
+    fail,
+  );
+  // What an elided dispatch left at each case target's entry (jump-table.ts `caseEntries`), and the
+  // markers written there, by value.
+  const entries = caseEntries(
+    blocks.flatMap((b, at) => {
+      const jt = b.branch ? jts.get(b.branch.addr) : undefined;
+      if (jt === undefined) {
+        return [];
+      }
+      const n = jt.caseAddrs.length;
+      // the default is a `bgtlr` bound's synthetic return of its own, or the default block
+      return [
+        { at, scrutReg: jt.scrutReg, cases: succIdx[at].slice(0, n), defaultBlock: succIdx[at][n], leaves: jt.leaves },
+      ];
+    }),
+    preds,
+  );
+  const staleIdiom = new Map<Value, StaleIdiomRead>();
+  const parked = parkedIn(staleIdiom);
+  const scaledIndex = scaledIndexIn(staleIdiom);
+  /** What this frontend defines registers with that is no argument: a pending `@ha` half and a
+   *  table base. NOT a marker an elided dispatch left (`staleIdiom`): a case may copy one
+   *  (`mr r3,r4`), and a return or a call that skipped it would drop what the case handed on. */
+  const placeholders = {
+    has: (v: Value) => highHalves.has(v) || tableBases.has(v),
+    guardRead: (n: string, r: string, v: Value) => tableBases.guardRead(n, r, highHalves.guardRead(n, r, v)),
+  };
   /** Reading a register AS A VALUE. A register holding a high half is not one, so this refuses loud
    *  rather than handing back a plausible number standing for an address. `foldLoHalf` is the only
    *  code entitled to look at a high half, which is why it reaches `readVar` directly. */
-  const readReg = (r: string, at: number): Value => highHalves.guardRead(name, r, readVar(r, at));
+  const readReg = (r: string, at: number): Value => {
+    if (SMALL_DATA_BASES.includes(r)) {
+      fail(
+        `cannot lift '${name}': ${r} (the small-data base) used as data — an access the relocation ` +
+          `does not name is not modelled`,
+      );
+    }
+    const v = placeholders.guardRead(name, r, readVar(r, at));
+    const nv = nonValues.get(v);
+    if (nv !== undefined && NON_VALUE_RULES[nv.kind].refuseAtRead) {
+      refuseNonValue(nv);
+    }
+    return v;
+  };
+  /** Reading r1 (the stack pointer) as a DATA operand means frame-pointer arithmetic or an
+   *  address-taken local (`addi r3,r1,8` = `&local`) — not modellable without a stack abstraction,
+   *  and fabricating a value for r1 silently miscompiles. */
+  const r1AsData = (): never =>
+    fail(
+      `cannot lift '${name}': stack pointer r1 used as data (address-taken local / frame arithmetic) — not supported`,
+    );
+  /** An `mflr` reached by a `bl` with no `mtlr` since, or a return the link-register proof could
+   *  not show jumps through the caller's return address (`linkRegisterProof`). */
+  const refuseOverwrittenLink = (ins: Instr) => {
+    const by = lrUnproven.get(ins);
+    const at = (i: Instr) => `'${i.mnemonic}' at 0x${i.addr.toString(16)}`;
+    if (by === undefined) {
+      return;
+    }
+    if (ins.mnemonic === 'mflr') {
+      fail(
+        `cannot lift '${name}': the ${at(ins)} reads the link register the ${at(by)} overwrote on some path, ` +
+          `with no 'mtlr' since — the return address is lost there`,
+      );
+    }
+    if (by.mnemonic === 'bl') {
+      fail(
+        `cannot lift '${name}': the ${at(ins)} may not return through the caller's link register — the ` +
+          `${at(by)} overwrote it on some path, and no 'mtlr' put the saved return address back`,
+      );
+    }
+    fail(
+      `cannot lift '${name}': the ${at(ins)} may not return through the caller's link register — on some ` +
+        `path the ${at(by)} put ${by.ops[0]} there, which does not hold the return address an 'mflr' copied ` +
+        `out or its reload from the link register's save word`,
+    );
+  };
+  /** DEFINITIONS THAT ARE NOT VALUES: the frame bookkeeping this frontend erases. Each kind is
+   *  written into a register as an ordinary SSA definition, so SSA answers whether one reaches a use,
+   *  and is keyed by that value, as the high halves are (frontend/high-half.ts). Its one legitimate
+   *  consumer looks it up here; every other use refuses through `refuseNonValue`,
+   *  checked at a read (`readReg`) where the kind says so and, always, on the finished function
+   *  (`assertNoNonValueEscaped`), because a use can reach through a join's incoming arguments, which
+   *  no read sees. A new kind is one more member of the union, one rule and one refusal, and the
+   *  three checks cover it. The high halves keep their own module only because MIPS shares it.
+   *
+   *  - `frame-address`: what `addi r11,r1,N` forms — its offset from the entry r1 (or why that is not
+   *    known there) and the address of the `addi`. Its one consumer is a register save or restore
+   *    routine (`saveRoutineOf`), which takes it in the target's `registerSaveRoutines.frameReg`, so
+   *    that register is the only destination deferred; every other `addi rD,r1,N` refuses where it
+   *    stands. Any other use is the frame read as data, and refuses as the `addi` itself would. One
+   *    no routine took refuses too, even where nothing reads it (`assertNonValuesConsumed`). A `bl`
+   *    to the routine that carries no relocation (a linked image, or objdump without `-r`) never gets
+   *    that far: it is no routine, and `case 'bl'` refuses it as a call with no callee symbol.
+   *  - `restored`: the caller's value a restore puts back in a callee-saved register
+   *    (`restoreFrom`). No C value names it, so it has no consumer.
+   *  - `return-address`: what `mflr rD` copies out of the link register, with the address of the
+   *    `mflr`. Storing it to the link register's save word is the LR save (`frameStore`), and moving
+   *    it back with `mtlr` is the return. Any other use is a function reading its own return address
+   *    (MP4's `asm { mflr retaddr }` does, to tag an allocation with its caller), which no C
+   *    expression spells: a store elsewhere refuses at once, anything else once the function is
+   *    built. A read alone does not refuse, so a copy (`mr`) still carries it to its save.
+   *  - `fctiwz-high`: the HIGH word an `stfd` of an `fctiwz` result stores, with the address of the
+   *    `stfd`. `fctiwz` leaves that half undefined, so a reload of it is no value. No consumer. */
+  type NonValue =
+    | { kind: 'frame-address'; off: number | string; addr: number }
+    | { kind: 'restored'; reg: string; addr: number }
+    | { kind: 'return-address'; addr: number }
+    | { kind: 'fctiwz-high'; addr: number };
+  const NON_VALUE_RULES: Record<NonValue['kind'], { refuseAtRead: boolean; mustBeConsumed: boolean }> = {
+    'frame-address': { refuseAtRead: true, mustBeConsumed: true },
+    restored: { refuseAtRead: true, mustBeConsumed: false },
+    'return-address': { refuseAtRead: false, mustBeConsumed: false },
+    'fctiwz-high': { refuseAtRead: true, mustBeConsumed: false },
+  };
+  const nonValues = new Map<Value, NonValue>();
+  /** The non-values their consumer took (only `frame-address` has one that must). */
+  const consumedNonValues = new Set<Value>();
+  /** The non-value of kind `k` that `v` stands for, or undefined. */
+  const nonValueOf = <K extends NonValue['kind']>(v: Value, k: K): Extract<NonValue, { kind: K }> | undefined => {
+    const nv = nonValues.get(v);
+    return nv?.kind === k ? (nv as Extract<NonValue, { kind: K }>) : undefined;
+  };
+  const refuseNonValue = (nv: NonValue): never => {
+    switch (nv.kind) {
+      case 'frame-address':
+        return r1AsData();
+      case 'restored':
+        return fail(
+          `cannot lift '${name}': ${nv.reg} is read after the restore at 0x${nv.addr.toString(16)} put the ` +
+            `caller's ${nv.reg} back — no C value names it`,
+        );
+      case 'return-address':
+        return fail(
+          `cannot lift '${name}': the return address the 'mflr' at 0x${nv.addr.toString(16)} ` +
+            `copies out is used as a value — a function reading its own return address has no C spelling`,
+        );
+      case 'fctiwz-high':
+        return fail(
+          `cannot lift '${name}': the high word the 'stfd' at 0x${nv.addr.toString(16)} stores is reloaded and ` +
+            `used — 'fctiwz' leaves that half of its result undefined`,
+        );
+    }
+  };
+  /** Checked on the finished function, after `finish` pruned the joins nothing reads. */
+  const assertNoNonValueEscaped = (fnBlocks: Block[]) => {
+    for (const b of fnBlocks) {
+      for (const op of b.ops) {
+        for (const v of [...op.operands, ...op.successors.flatMap((s) => s.args)]) {
+          const nv = nonValues.get(v);
+          if (nv !== undefined) {
+            refuseNonValue(nv);
+          }
+        }
+      }
+    }
+  };
+  const assertNonValuesConsumed = () => {
+    for (const [v, nv] of nonValues) {
+      if (NON_VALUE_RULES[nv.kind].mustBeConsumed && !consumedNonValues.has(v)) {
+        refuseNonValue(nv);
+      }
+    }
+  };
   const RET = target.returnReg;
   const ARG_REGS = target.argRegs;
 
-  // Best-effort call arity when a callee has no prototype: the count of contiguous argument
-  // registers (r3..) with a VALUE reaching the call. A prototype's `params` is authoritative when
-  // supplied; this liveness heuristic covers the rest.
+  // THE FRAME, as two kinds of word slot, each named by its offset from the ENTRY r1
+  // (`r1Displacements`).
   //
-  // A pending `@ha` high half is a def but not a value, and it must not raise the count: a `lis`
-  // hoisted into the prologue leaves its half in r4 across an intervening call, and counted, it
-  // makes `strlen(s)` into `strlen(s, <half>)` — which then refuses at the read. Measured on
-  // `pikmin:searchKanjiCode__FUs`, whose `lis r4` at 0x4 pairs only at 0x28, past the `bl strlen`.
+  // A SAVE holds an entry value that is no C value: a callee-saved register's, the link register's
+  // word, or the back chain the frame push stores (the caller's r1). Nothing but the caller reads it
+  // back. Its restore — a load into the register it was saved from — puts the caller's value back,
+  // which no C value names, so a read of the register after it refuses (`restored` in
+  // `nonValues`); a load into any other register refuses at once. Function-scoped, so a save in the
+  // prologue matches a restore in any epilogue.
   //
-  // A GAP REFUSES. The count is contiguous, so an argument register with nothing reaching it ends
-  // it — and one is empty for two opposite reasons. Either the call really takes that few
-  // arguments, or the register still holds this function's own untouched incoming argument, a value
-  // the machine passes on that SSA has no definition for because nothing ever wrote it. When a
-  // LATER argument register does hold a value the second reading is the only one left, and taking
-  // the first drops that argument and every one after it: `ac-decomp:evw_anime_colreg_manual` sets
-  // up seven registers for `evw_color_set` and, with r4 at its incoming value, lifts to
-  // `evw_color_set(a0);` — its divide, its multiply and five arguments gone. Which reading it is
-  // cannot be decided here — the function's own arity is exactly what is missing — so this refuses
-  // and names the gap rather than guessing. A prototype answers it (`protoArity` is asked first).
-  const fallbackArgc = (bi: number, at: number): number => {
-    const holdsValue = (k: number) => ssa.hasReachingDef(ARG_REGS[k], bi, (v) => !highHalves.has(v));
-    let n = 0;
-    while (n < ARG_REGS.length && holdsValue(n)) {
-      n++;
-    }
-    for (let k = n + 1; k < ARG_REGS.length; k++) {
-      if (holdsValue(k)) {
-        throw new PpcUnsupportedError(
-          `cannot lift '${name}': the call at 0x${at.toString(16)} has no prototype, ${ARG_REGS[k]} holds a ` +
-            `value and ${ARG_REGS[n]} holds none — an argument register left at its incoming value and one ` +
-            `the call does not pass look the same here, so the argument count is not decidable`,
-        );
-      }
+  // ONE SAVE AND ONE RESTORE, whichever instruction does it: `stmw`/`lmw`, a single `stw`/`lwz`
+  // and a register save routine all go through `saveInto` and `restoreFrom`. A single `stw` is the
+  // one save that may also be a spill: of a register this function already wrote, it stores a
+  // value. A `stmw` or a routine has no such reading, and saving a written register refuses.
+  //
+  // Every other word store is a VALUE — an argument's home, or a live value spilled — and it is the
+  // shared stack-slot variable (`stackSlotKey`, frontend/ssa.ts) MIPS and Thumb use. A reload into
+  // any register reads it; a reload on a path that never stored it refuses in the builder; a store
+  // nothing reloads refuses at the end of `lift`.
+  //
+  // A slot is one kind for the whole function: a word both saved and stored with a value has no
+  // single reading, and refuses.
+  const saveSlots = new Map<number, string>();
+  // Each reload (`lwz`, `lmw`, restore routine) that restores a save, and the registers it restores:
+  // a save holds only while every path restores it after its last write (`refuseSavedRegisterLeaks`).
+  const restoredBy = new Map<Instr, ReadonlySet<string>>();
+  // AN INCOMING STACK WORD HAS ONE NAME, `@sarg<k>`, for its loads and its stores: the EABI passes
+  // integer argument word k >= 8 at entry r1 + 8 + 4(k - 8), in the caller's parameter area past
+  // its back chain and link-register save word (`corpus/probe-mwcc-frame.c`, `in9`/`in10`). A read
+  // no store reaches is the caller's argument through the ordinary live-in path, and a store makes
+  // the parameter an assigned one, as Thumb and MIPS name it. Words only: a sub-word incoming
+  // argument (`lha 10(r1)` for a `short`) refuses as a sub-word frame access, a float past f8 is
+  // loaded with the unmodelled `lfs`/`lfd`, and a function reading one beside a float argument or
+  // declared with a 64-bit or floating parameter refuses (`ppcArgSlots`). Undefined for every
+  // other word.
+  const incomingStackKey = (entryOff: number): string | undefined =>
+    incomingStackArgKey(entryOff, PARAM_AREA_AT, ARG_REGS.length);
+  const valueSlots = new Map<
+    number,
+    { addr: number; mem: string; read: boolean; stored: { v: Value; at: number }[] }
+  >();
+  // What each `mfcr` copied: the fields the condition register held, by the value the copy stands
+  // for. Nothing defines that value — it is no integer — and only an extract of one bit of a float
+  // compare's field reads it (`crBitValue`); anything else that does refuses once the SSA is finished.
+  const crCopies = new Map<Value, ReadonlyMap<string, CrCompare | string>>();
+  const loadedFrom = target.compilerBehaviors.outgoingAreaNeverLoadedFrom;
+  const refuseMixedSlot = (ins: Instr, mem: string, off: number, kind: 'save' | 'value') => {
+    if (kind === 'save' ? valueSlots.has(off) : saveSlots.has(off)) {
+      throw new PpcUnsupportedError(
+        `cannot lift '${name}': local stack frames not supported — '${mem}' at 0x${ins.addr.toString(16)} ` +
+          `is a word this function both saves a register in and stores a value to`,
+      );
     }
-    return n;
   };
-
-  // Frame slots (r1-relative offsets) that hold a TRANSPARENT save, and WHICH REGISTER each one
-  // holds — a callee-saved register's entry value or the saved link register. A reload is dropped
-  // (the value is unchanged, so the in-register SSA value already carries it) only when it restores
-  // the very register the slot was saved from. Function-scoped so a save in the prologue block
-  // matches a restore in a different epilogue block. Any OTHER r1 access is a genuine local spill /
-  // address-taken stack object this frontend cannot model — those fail LOUD (below), never silently
-  // drop, because a dropped local spill is a silent miscompile.
-  //
-  // THE REGISTER IS PART OF THE SLOT, not bookkeeping about it. `stw r3,8(r1)` / `lwz r4,8(r1)` is
-  // mwcc spilling an incoming ARGUMENT and reading it back into another register — a real value
-  // moving through memory, not a save/restore pair, and an offset-only record cannot tell the two
-  // apart. Dropping that reload leaves the destination with no definition at all, and
-  // `fallbackArgc`'s contiguous scan then takes every LATER argument with it.
-  // `pikmin:__ct__7ActFreeFP4Piki` is the benchmark's inhabitant — it reads `this` back into r4 —
-  // and 28 Mario Party 4 checkout functions share the shape, each losing an argument the relocation
-  // fold recovered.
-  const savedSlots = new Map<number, string>();
+  /** The slot an r1-relative operand names: its offset from the entry r1. Where r1's displacement is
+   *  not known, no offset can be named, and a save or restore there refuses rather than being
+   *  matched against a slot it may not be. */
+  const entryOffset = (ins: Instr, mem: string): number => {
+    const d = r1At.get(ins);
+    if (typeof d !== 'number') {
+      throw new PpcUnsupportedError(
+        `cannot lift '${name}': stack-frame access '${mem}' at 0x${ins.addr.toString(16)} — the stack ` +
+          `pointer's offset from its entry value is not known there: ${d ?? 'the instruction is unreachable'}`,
+      );
+    }
+    return parseMem(mem).off + d;
+  };
   // `stmw rS,D(r1)` saves rS..r31 into consecutive words from D; `lmw rD,D(r1)` restores the same
   // range.
   const frameRange = (firstReg: string, off: number): Array<{ off: number; reg: string }> => {
@@ -533,29 +1878,192 @@ export function lift(
     return slots;
   };
 
+  // What each filled block left in the condition register. Written as blocks are filled, so a lookup
+  // finds only blocks filled earlier, which is what `inheritFlags` needs to tell "not known" from
+  // "none".
+  const exitCr = new Map<number, CrExit>();
+  const blockLabel = (bi: number): string =>
+    blocks[bi].startAddr >= 0
+      ? `${name}+0x${blocks[bi].startAddr.toString(16)}`
+      : `the return block '${name}' synthesizes`;
+
+  // A FLOAT RETURN is decided for the whole function (frontend/fpu.ts `returnHomeRule`), and then
+  // r3 is scratch like any other integer register. An undecided one returns r3 here, and
+  // `settleReturnHome` may hand each return f1 instead. A table base left in r3 is no return value, as a
+  // pending half is none (`placeholders`); reading one would refuse, and a merge of one with a value
+  // still does.
+  const returnOperands = (bi: number): Value[] =>
+    floatReturn
+      ? [readReg(fpu!.returnReg, bi)]
+      : ssa.hasReachingDef(RET, bi, (v) => !placeholders.has(v) && !parked(v, RET))
+        ? [readReg(RET, bi)]
+        : [];
+  // A RETURN NOTHING WROTE r3 FOR STILL RETURNS r3 — the caller's value, which on PowerPC is the
+  // first argument. `int f(int a, int x) { if (x) return a; … return 5; }` is `cmpwi r4,0 ; bnelr`:
+  // that path neither reads nor writes r3, so `returnOperands` finds no definition and returns
+  // nothing, while every other path returns a word — C that falls off the end of an `int` function,
+  // and that loses `a`. Whether the function returns a word is known only once every block is
+  // filled, so a bare return is recorded here and given r3's entry value after the fill
+  // (`returnUntouchedArg`) when another return hands back a word. Only where r3 still holds the
+  // entry value on every path into it: a path a call destroyed r3 on returns nothing a C expression
+  // names, and stays bare.
+  //
+  // AND ONLY WHERE r3 IS AN ARGUMENT AT ALL (`r3IsAnArgument`). "r3 still holds what the caller
+  // left" says nothing about whether the caller left anything: `void f(void) { if (gA & 2) return;
+  // gB++; }` uses r3 as a temporary on the other path, so that path "returns a word", and filling
+  // the bare return would mint a parameter the ABI never passed — `f(s32 a0)`, which contradicts a
+  // declared `void f(void)` (the candidate does not compile) and a C++ `__Fv` mangling.
+  const bareReturns: Array<{ op: Op; bi: number }> = [];
+  const wordReturns: number[] = [];
+  // What r4, the second register of an r3:r4 return, may hold at each word return where no
+  // declaration pins the width (frontend/dead-reads.ts `unreadPairHalf`).
+  const unreadHigh = new Set<Value>();
+  // Each of those word returns: what r3 returns there and what r4 may hold (`computedPairHalf`).
+  const pairReturns: PairReturn[] = [];
+  // Every value a compare consumed, whether or not a branch reads the field it set: a compare
+  // nothing reads leaves no op, so this is the only record that the value was used
+  // (frontend/dead-reads.ts `compared`).
+  const compared = new Set<Value>();
+  // Every value a carry reader consumed by folding it away: the constant a `subfze` reads, and the
+  // `rB - 1` a `subfe rD,rA,rB` cancels. The machine read them, and no op says so (`computedPairHalf`).
+  const readWithoutOp = new Set<Value>();
+  // Every `subfc`/`subfic` difference whose carry a reader turned into a 0/1 truth value: the
+  // difference may be the by-product of a 32-bit compare, not the low word of a 64-bit result,
+  // which `computedPairHalf` settles (`TruthDifference`). `carrySource` maps each carry compare to
+  // the difference its writer computed, and `truthPending` each reader result one step short of
+  // the truth value to it.
+  const truthDifferences: TruthDifference[] = [];
+  const carrySource = new Map<Value, Value>();
+  const truthPending = new Map<Value, { diff: Value; via: 'neg' | 'and1' }>();
+  // Every load into the register the compiler discards an unused read into at a level that keeps a
+  // plain one (`compilerBehaviors.discardsUnusedReadsInto`, frontend/dead-reads.ts `discarded`).
+  const discarded = new Set<Value>();
+  const discardReg = target.compilerBehaviors.discardsUnusedReadsInto;
+  // Every value written to a register other than the discard register: `leftInDiscardRegister`
+  // takes out of `discarded` each load one of them derives from, which mwcc put in a home.
+  const writtenElsewhere: Value[] = [];
+  // A `subfze` over a register this block takes in from another block: modelled as `~rA + CA`, and
+  // kept only where `ssa.finish` resolves rA to one constant on every path in (`subfze` case below).
+  const joinedCarryConsts: { ins: Instr; not: Op; add: Op; ca: Value }[] = [];
+  let wordReturn = false;
+  /** Every return, as it is emitted. */
+  const returns: { op: Op; bi: number }[] = [];
+  const emitReturn = (ops: Op[], bi: number) => {
+    const op = mkOp('ret', { operands: returnOperands(bi) });
+    ops.push(op);
+    returns.push({ op, bi });
+    if (floatReturn) {
+      return;
+    }
+    if (op.operands.length > 0) {
+      wordReturn = true;
+      wordReturns.push(bi);
+      const high = new Set<Value>();
+      unreadPairHalf(ssa, prototypes[name], ARG_REGS[1], bi, high);
+      high.forEach((v) => unreadHigh.add(v));
+      pairReturns.push({ word: op.operands[0], high });
+    } else {
+      bareReturns.push({ op, bi });
+    }
+  };
+  /** Whether every word return hands back a value computed ONLY to be returned: on every path into
+   *  it, r3's last write is one (frontend/dead-reads.ts `computedOnlyToReturn`), so the function
+   *  returns a word. `int f(int a) { switch (gS) { case 0: return 3; … } return a; }` is `li r3,3 ;
+   *  blr` on every case and a bare `blr` out of range. A temporary is read again (`lwz r3,gB ; addi
+   *  r0,r3,1`), and a call's result and a load are excluded — a void function's call leaves its
+   *  callee's result in r3, and a discarded `volatile` read is a load nobody reads — so `void
+   *  f(void) { if (gA & 2) return; gB++; }` still answers no.
+   *
+   *  What it cannot tell apart is an `int f(void)` with a path that falls off its end: that path
+   *  returns whatever the caller left in r3 too, and is lifted as returning it — the bytes' own
+   *  behaviour, at the cost of a parameter the source did not name. A CodeWarrior C++ symbol says
+   *  so where there is one (`__Fv`), and a declaration always decides first. */
+  const r3WrittenToReturn = (): boolean => {
+    if (wordReturns.length === 0) {
+      return false;
+    }
+    const computed = computedOnlyToReturn(irBlocks);
+    return wordReturns.every((bi) => ssa.everyReachingDef(RET, bi, computed));
+  };
+  /** Whether the caller passes r3, so a bare return of it hands back an argument. A declaration
+   *  decides when it says (`ownFirstArgumentPassed`, which reads it as the live-in bound does): a
+   *  non-void return and a parameter word or `this` first, or a nonzero register count — and a free
+   *  function of none (`g__Fv`) or a count of 0 is passed nothing, which no body evidence
+   *  overrides. A hand-written body (`ownDeclared` false) is read as having none. Without one, only
+   *  the body can show it: r3 is already an entry parameter, or a higher argument register is live
+   *  in, which puts an argument in r3 by position (the obligation `mintArgSlotHoles` discharges), or
+   *  every word return hands back a value computed only to be returned (`r3WrittenToReturn`) — then
+   *  the function returns a word, and a bare return of it hands back what the caller left in r3. */
+  const r3IsAnArgument = (): boolean => {
+    const own = prototypes[name];
+    if (declaresVoidReturn(own)) {
+      return false;
+    }
+    // a count bounds no register, but says whether any argument is passed at all
+    if (typeof own?.params === 'number') {
+      return own.params > 0;
+    }
+    const declared = ownDeclared ? ownFirstArgumentPassed(name, own, target) : undefined;
+    if (declared !== undefined) {
+      return declared;
+    }
+    const live = new Set(irBlocks[0].params.map((p) => paramReg.get(p)));
+    return ARG_REGS.some((r) => live.has(r)) || r3WrittenToReturn();
+  };
+  /** Whether the function's own STATED declaration returns a word: then it returns one even where
+   *  no path writes r3, and a bare return hands back what the caller left there — `int f(int a) {
+   *  return a; }` is a bare `blr`. A context's own entry is not read for this (its return is a
+   *  header nothing checked), and neither is a hand-written body's (`ownDeclared` false). */
+  const statesWordReturn = (): boolean => {
+    const r = prototypes[name]?.returns;
+    const width = r === undefined || isFloatingSpelling(r) ? undefined : declaredWidth(r);
+    return ownDeclared && width !== undefined && width <= 32;
+  };
+  const returnUntouchedArg = () => {
+    if (!(wordReturn || statesWordReturn()) || bareReturns.length === 0 || !r3IsAnArgument()) {
+      return;
+    }
+    for (const { op, bi } of bareReturns) {
+      const v = ssa.entryValue(RET, bi);
+      if (v !== undefined) {
+        op.operands = [v];
+      }
+    }
+  };
+
   const fillBlock = (b: PpcBlock, bi: number) => {
     const ops = irBlocks[bi].ops;
     const succ = (j: number): Successor => ({ block: irBlocks[j], args: [] });
 
     // A synthetic conditional-return block: just return the current return register.
     if (b.synthReturn) {
-      const retOps = ssa.hasReachingDef(RET, bi) ? [readReg(RET, bi)] : [];
-      ops.push(mkOp('ret', { operands: retOps }));
+      emitReturn(ops, bi);
       return;
     }
+    // A case target of an elided dispatch is entered with what the idiom left in its registers.
+    const entry = entries.get(bi);
+    if (entry !== undefined) {
+      enterCaseTarget(
+        entry,
+        ops,
+        {
+          key: (r) => r,
+          scrutinee: (r) => readReg(r, bi),
+          dispatchScrutinee: (r) => ssa.readAtEnd(r, entry.at),
+          write: (r, v) => writeVar(r, bi, v),
+        },
+        staleIdiom,
+      );
+    }
 
     // `lastDef` is the value most recently written to a register in this instruction — used to
     // wire a record-form op's implicit cr0 side effect (see the `rc` handling in `decode`).
     let lastDef: Value | null = null;
-    // Reading r1 (the stack pointer) as a DATA operand means frame-pointer arithmetic or an
-    // address-taken local (`addi r3,r1,8` = `&local`) — not modellable without a stack abstraction,
-    // and fabricating a value for r1 silently miscompiles. Fail LOUD. (Frame bookkeeping never
-    // reaches here: stwu / addi r1 / mflr / mtlr / r1-relative spills are handled before `read`.)
+    // r1 read as data fails LOUD (`r1AsData`). Frame bookkeeping never reaches here: stwu / addi r1
+    // / mflr / mtlr / r1-relative spills / the save routines' frame address are handled before `read`.
     const read = (r: string): Value => {
       if (r === 'r1') {
-        throw new PpcUnsupportedError(
-          `cannot lift '${name}': stack pointer r1 used as data (address-taken local / frame arithmetic) — not supported`,
-        );
+        r1AsData();
       }
       return readReg(r, bi);
     };
@@ -576,43 +2084,213 @@ export function lift(
         );
       }
     };
-    // A word store/load based on r1. Returns true if it is TRANSPARENT frame bookkeeping (skip):
-    // a save of a register with no reaching def (callee-saved entry value / saved lr), or a reload
-    // from a recorded save slot. A store of a LIVE (reaching-def) value is a real local spill →
-    // fail LOUD. A reload from an unrecorded slot is a genuine stack local → fail LOUD.
-    const frameStore = (srcReg: string, mem: string): boolean => {
-      const { base, off } = parseMem(mem);
-      if (base !== 'r1') {
+    /** The instruction a save or restore refusal names. */
+    const site = (ins: Instr) =>
+      `the '${ins.mnemonic}'${ins.mnemonic === 'bl' && ins.reloc ? ` to '${ins.reloc.sym}'` : ''} at 0x${ins.addr.toString(16)}`;
+    /** Save `reg`'s entry value into the save slot at entry offset `off`, named `mem` in `ins`. */
+    const saveInto = (ins: Instr, reg: string, off: number, mem: string) => {
+      if (ssa.hasReachingDef(reg, bi)) {
+        // A read leaves a definition too: the entry value, as a parameter, since `prologueSavedRegs`
+        // does not count a save after a read.
+        throw new PpcUnsupportedError(
+          ssa.hasReachingDef(reg, bi, (v) => !paramReg.has(v))
+            ? `cannot lift '${name}': ${site(ins)} saves ${reg} after this function wrote it, so '${mem}' holds a ` +
+                `value, not the caller's ${reg}`
+            : `cannot lift '${name}': ${site(ins)} saves ${reg} after this function read it — a value handed ` +
+                `over in a register no argument is passed in, which a compiled prologue saves before any use`,
+        );
+      }
+      refuseMixedSlot(ins, mem, off, 'save');
+      saveSlots.set(off, reg);
+    };
+    /** Restore `reg` from the save slot at `off`: it must be the slot `reg` was saved into, and `reg`
+     *  then holds the caller's value again. r1 is no SSA register: its reload is the back chain the
+     *  frame push stored, and `r1Displacements` tracks it instead. */
+    const restoreFrom = (ins: Instr, reg: string, off: number, mem: string) => {
+      const saved = saveSlots.get(off);
+      if (saved !== reg) {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': reload of '${mem}' into ${reg}, ` +
+            (saved === undefined
+              ? `a word nothing saved it into (${site(ins)})`
+              : `a slot ${saved} was saved into — the word holds the caller's ${saved}, which no C value ` +
+                `names (${site(ins)})`),
+        );
+      }
+      if (reg !== 'r1') {
+        restoredBy.set(ins, new Set([...(restoredBy.get(ins) ?? []), reg]));
+        const caller = mkValue(T.unk(32));
+        nonValues.set(caller, { kind: 'restored', reg, addr: ins.addr });
+        writeVar(reg, bi, caller);
+      }
+    };
+    // A word store/load based on r1: a SAVE or a VALUE slot (see `saveSlots` above). Returns false
+    // for any other base, which is ordinary memory.
+    const frameStore = (ins: Instr, srcReg: string, mem: string): boolean => {
+      if (parseMem(mem).base !== 'r1' || inLocalArea(ins, mem, 4) !== undefined) {
+        return false;
+      }
+      const off = entryOffset(ins, mem);
+      const isArg = ARG_REGS.includes(srcReg);
+      // The LR SAVE stores the return address `mflr` copied out, and only into the link register's
+      // save word, 4 bytes above the entry r1. Anywhere else the word is a value — past the push,
+      // 8 bytes up is the callee's parameter area, where it is a ninth argument — and a register
+      // holding the return address on some paths and another value on others is not a save at all.
+      const isReturnAddress = (v: Value) => nonValueOf(v, 'return-address') !== undefined;
+      if (ssa.hasReachingDef(srcReg, bi, isReturnAddress)) {
+        const mixed = ssa.hasReachingDef(srcReg, bi, (v) => !isReturnAddress(v));
+        if (mixed || off !== LR_SAVE_WORD) {
+          throw new PpcUnsupportedError(
+            `cannot lift '${name}': the store to '${mem}' at 0x${ins.addr.toString(16)} is not the link ` +
+              `register's save — ${
+                mixed
+                  ? `${srcReg} holds the return address an 'mflr' copies out on some paths and another value on others`
+                  : `the return address an 'mflr' copies out lands ${off} bytes from the entry r1, not in the ` +
+                    `save word ${LR_SAVE_WORD} bytes up, so it is used as a value`
+              }`,
+          );
+        }
+        refuseMixedSlot(ins, mem, off, 'save');
+        saveSlots.set(off, srcReg);
+        return true;
+      }
+      // Any other save stores what the register held at entry: nothing defined it on any path. An
+      // argument register nothing defined holds the argument, which is a value.
+      // …save a global register variable's: compiled code stores one only as a value, the outgoing
+      // stack argument `k(1, …, 8, g)` is (`stw r14,8(r1)`), and the builder records no definition
+      // for it (its writes are stores to the global), so "nothing defined it" is no evidence of a save.
+      if (!isArg && !liveIns.globalRegs?.has(srcReg) && !ssa.hasReachingDef(srcReg, bi)) {
+        saveInto(ins, srcReg, off, mem);
+        return true;
+      }
+      refuseMixedSlot(ins, mem, off, 'value');
+      // An argument moved to its home is not an argument set up for the next call.
+      const v = (isArg ? ssa.entryValue(srcReg, bi) : undefined) ?? readReg(srcReg, bi);
+      // An assignment to an incoming stack parameter is that parameter's SSA variable, and no call
+      // made here takes the word: it is the caller's (a tail branch, whose callee would read the
+      // same words as its own stack arguments, refuses in `liftPrelude`).
+      const incoming = incomingStackKey(off);
+      if (incoming !== undefined) {
+        writeVar(incoming, bi, v);
+        return true;
+      }
+      writeVar(stackSlotKey(off), bi, v);
+      if (!valueSlots.has(off)) {
+        valueSlots.set(off, { addr: ins.addr, mem, read: false, stored: [] });
+      }
+      valueSlots.get(off)!.stored.push({ v, at: ins.addr });
+      return true;
+    };
+    const frameLoad = (ins: Instr, dstReg: string, mem: string): boolean => {
+      if (parseMem(mem).base !== 'r1' || inLocalArea(ins, mem, 4) !== undefined) {
         return false;
       }
-      if (!ssa.hasReachingDef(srcReg, bi)) {
-        savedSlots.set(off, srcReg);
+      const off = entryOffset(ins, mem);
+      if (saveSlots.has(off)) {
+        restoreFrom(ins, dstReg, off, mem);
         return true;
       }
-      throw new PpcUnsupportedError(
-        `cannot lift '${name}': spill of a live value to the stack ('${srcReg},${mem}') — local stack frames not supported`,
-      );
-    };
-    const frameLoad = (dstReg: string, mem: string): boolean => {
-      const { base, off } = parseMem(mem);
-      if (base !== 'r1') {
-        return false;
+      const incoming = incomingStackKey(off);
+      if (incoming !== undefined) {
+        write(dstReg, readVar(incoming, bi));
+        return true;
+      }
+      const slot = valueSlots.get(off);
+      if (slot === undefined || !ssa.hasReachingDef(stackSlotKey(off), bi)) {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': reload of a stack local ('${mem}') — local stack frames not supported`,
+        );
+      }
+      slot.read = true;
+      write(dstReg, readVar(stackSlotKey(off), bi));
+      return true;
+    };
+    /** The instruction `decode` is lifting, for a refusal raised below it. */
+    let decoding: Instr | null = null;
+    // THE STACK POINTER IS NO VALUE A LIFT WRITES. The frame push, `addi r1,r1,N` and the reload of
+    // the back chain move r1, and `r1Displacements` follows them; none reaches here. Any other write
+    // (`lwz r1,4(r3)` in a longjmp, `mr r1,r10` in a context switch) would land in an SSA
+    // variable nothing reads, since a read of r1 is refused as data (`read`), and the lift
+    // would drop the write: a load into r1 would become a discarded volatile read. So it refuses.
+    // THE SMALL-DATA BASES ARE NONE EITHER, for the same reason one step removed: an access through
+    // r13 or r2 is read off its `R_PPC_EMB_SDA21` relocation (`sdaAccess`), never off the register,
+    // so a write to either (`lwzu r13,4(r3)`, `mr r2,r4`) would be dropped and every later small-data
+    // access would still name its symbol as if the base had not moved.
+    const write = (r: string, v: Value) => {
+      // the instruction the listing holds, not the plain access an update form is decoded through
+      const by = () => {
+        const listed = decoding === null ? null : (decodedFrom.get(decoding) ?? decoding);
+        return listed === null
+          ? 'an instruction'
+          : `'${listed.mnemonic} ${listed.ops.join(',')}' at 0x${listed.addr.toString(16)}`;
+      };
+      if (r === 'r1') {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': ${by()} writes the stack pointer r1 — only the frame push, 'addi r1,r1,N' ` +
+            `and the back-chain reload move r1 here, and the value it would take is not one this lift tracks`,
+        );
+      }
+      if (SMALL_DATA_BASES.includes(r)) {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': ${by()} writes the small-data base ${r} — a small-data access is read ` +
+            `off its relocation, not off the register, so a moved base is not one this lift tracks`,
+        );
+      }
+      writeVar(r, bi, v);
+      lastDef = v;
+      if (discardReg !== undefined && r !== discardReg) {
+        writtenElsewhere.push(v);
+      }
+    };
+    // A `bl` into a register save or restore routine is frame bookkeeping, not a call: it writes no
+    // register this function reads (only the link register, already copied out — which
+    // `linkRegisterProof` checks), so nothing is destroyed and r0 keeps the return address
+    // `mflr` put there. A SAVE records a save slot per word, at the routine's fixed offsets below the
+    // frame address in r11; a RESTORE must find the same register in every word it reloads. It
+    // refuses where:
+    //   • r11 does not hold one frame address on every path into the call, or a call destroyed it on
+    //     the way (`useOutsideOps`; and a frame address no routine takes refuses at the end of `lift`);
+    //   • r1's displacement at the `addi` is not known, so no slot can be named;
+    //   • the routine's number is outside r14..r31 (no such runtime routine);
+    //   • it moves floating-point registers (named, not modelled);
+    //   • a register it saves was written or read first, or a word it restores was not saved from
+    //     that register — `saveInto` and `restoreFrom`, the rules every save and restore keeps.
+    const saveRoutine = (ins: Instr, r: NonNullable<ReturnType<typeof saveRoutineOf>>) => {
+      const at = `the 'bl' to '${r.sym}' at 0x${ins.addr.toString(16)}`;
+      if (r.first < 14 || r.first > 31 || ins.reloc!.addend !== 0) {
+        throw new PpcUnsupportedError(`cannot lift '${name}': ${at} names no register save routine of the runtime`);
+      }
+      // The FPR half is named and refused. Every compiled function that calls it (doubles live
+      // across a call, a 24-float leaf; 2.4.2 and 2.4.7 at -O4,p, 2.3.3 at -O4,s) already declines
+      // on the unmodelled `stfd`/`lfd` or on a float live across a call, and no row calls it, so a
+      // model of its 8-byte slots would be a model no lift has checked.
+      if (r.fpr) {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': ${at} saves or restores floating-point registers — not modelled`,
+        );
+      }
+      const fr = target.registerSaveRoutines!.frameReg;
+      const base = ssa.hasReachingDef(fr, bi, (v) => !nonValueOf(v, 'frame-address')) ? undefined : readVar(fr, bi);
+      const frame = base === undefined ? undefined : nonValueOf(base, 'frame-address');
+      if (frame === undefined) {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': ${at} does not find one frame address ('addi ${fr},r1,N') in ${fr} on every path`,
+        );
+      }
+      consumedNonValues.add(base!);
+      // If a call between the `addi` and here destroyed r11, the routine would store through what the
+      // callee left there: the builder refuses that read once it knows it was used.
+      ssa.useOutsideOps(base!, bi);
+      if (typeof frame.off !== 'number') {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': ${at} saves below the frame address formed at 0x${frame.addr.toString(16)}, where ` +
+            `the stack pointer's offset from its entry value is not known: ${frame.off}`,
+        );
       }
-      const saved = savedSlots.get(off);
-      if (saved === dstReg) {
-        return true;
+      for (let k = r.first; k <= 31; k++) {
+        const disp = -4 * (32 - k);
+        (r.restore ? restoreFrom : saveInto)(ins, `r${k}`, frame.off + disp, `${disp}(${fr})`);
       }
-      throw new PpcUnsupportedError(
-        saved === undefined
-          ? `cannot lift '${name}': reload of a stack local ('${mem}') — local stack frames not supported`
-          : `cannot lift '${name}': reload of '${mem}' into ${dstReg}, a slot ${saved} was saved into — ` +
-              `a load that does not restore the register the slot holds is a value read back through the ` +
-              `stack, which is a local stack frame this frontend does not model`,
-      );
-    };
-    const write = (r: string, v: Value) => {
-      writeVar(r, bi, v);
-      lastDef = v;
     };
     // Shared emitter kit (frontend/emit.ts) — the ISA-specific readers/guards stay above.
     const kit = mkEmitKit(ops, write);
@@ -622,10 +2300,58 @@ export function lift(
     // emit an honest `opaque` instead, which fails LOUD at assertResolved whether or not anything
     // reads that register (see frontend/opaque.ts for the policy).
     const emitOpaqueDest = (ins: Instr) => {
+      // AN OPAQUE STANDS FOR ONE DESTINATION, `ops[0]`. An unmodelled load that writes a second
+      // GPR would leave that one holding its old value with nothing marking it, which annotate mode
+      // (the CLI and bench default) then prints as ordinary C: `lwzux r0,r3,r4; lbz r3,0(r3)` read
+      // `*a0` where the byte is at `a0 + a1`. So refuse, as a store refuses, every load that writes
+      // more than its first operand: an indexed update load (`lbzux`, `lhzux`, `lhaux`, `lwzux`,
+      // which also write rA, as `mayWriteGpr` knows), `lmw` below r31 and the string loads. The FP
+      // update forms keep the floating-point refusal `opaqueDest` gives them. The test is on the
+      // lower-cased mnemonic, as `opaqueDest`'s classes are case-blind: the decode's cases are
+      // lower case, so an upper-case `LWZU` or `LBZUX` (pasted asm; objdump and dtk never print
+      // one) reaches here undecoded, and the displacement update forms are refused with the indexed.
+      const mn = ins.mnemonic.toLowerCase();
+      const lmwFirst = mn === 'lmw' ? Number(ins.ops[0]?.slice(1)) : NaN;
+      const second = /^l(?!f)\w*ux?$/.test(mn)
+        ? `its base ${mn.endsWith('x') ? ins.ops[1] : parseMem(ins.ops[1] ?? '').base}`
+        : lmwFirst < 31
+          ? `r${lmwFirst + 1}${lmwFirst + 1 < 31 ? '..r31' : ''}`
+          : /^lsw[ix]$/.test(mn)
+            ? 'the registers after it'
+            : null;
+      if (second !== null) {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name} @0x${ins.addr.toString(16)}': unmodelled instruction '${ins.mnemonic}' writes ${second} ` +
+            `as well as ${ins.ops[0]}, and an opaque stands for one destination`,
+        );
+      }
       // storeClass: every PPC store mnemonic is st* — an unmodelled one (`stwbrx`, `sthbrx`, …)
       // must throw, never skip (its first token is the SOURCE register).
       const od = opaqueDest(ins.mnemonic, ins.ops, {
         isReg,
+        // The floating-point register file. `isReg` is `r\d+`, so an `fN` operand is invisible to
+        // it: `fadds f1,f1,f2` reads as "no register destination" and `fcmpo cr0,f1,f2` as the same
+        // thing about a CONDITION register, when both are one missing file. `stfs`/`stfd` reach
+        // this arm ahead of `^st` deliberately — they are refused for the file they move, not for
+        // the memory they move it to.
+        //
+        // NO SIGIL, WHICH IS THE OPPOSITE OF THE MIPS CHOICE, and it needs its own argument because
+        // PowerPC objdump prints an FPU register bare (`f1`) and has no sigil to require. The
+        // collision the MIPS predicate pays a sigil to avoid is live here in principle — objdump
+        // writes a branch target as bare lower-case hex, so `f0`/`f4`/`f8` are addresses AND
+        // matches. What makes it unreachable is not this pattern but the branch handling above: a
+        // `b*` mnemonic in `isModeledBranch` is decoded as a transfer or a call and never falls to
+        // `emitOpaqueDest`, and every other `b*` is refused by the whole-function control-transfer
+        // pre-pass before a block is even filled. Those two are exhaustive over the mnemonics that
+        // can carry an address, so no operand reaching this policy is one. `test/fp-refusal.test.ts`
+        // pins it, and moving the FPU check into a pre-pass ahead of that one turns it red.
+        fpReg: PPC_FP_REG,
+        // The FPSCR moves that name no `fN` operand at all: `mtfsfi 7,0` takes a field number,
+        // `mtfsb0`/`mtfsb1` a bit number, `mcrfs cr0,cr1` two condition registers. Without this
+        // they read as "no register destination to degrade", which is the message that hides a
+        // missing file behind the shape of the instruction. `mffs f0` and `mtfsf 0xff,f0` DO name
+        // one and are `fpReg`'s.
+        fpControl: /^(mtfsfi|mtfsb0|mtfsb1|mcrfs)$/i,
         storeClass: /^st/i,
         skipSafe: /^nop$/i,
         context: `${name} @0x${ins.addr.toString(16)}`,
@@ -654,6 +2380,15 @@ export function lift(
       ops.push(mkOp('gaddr', { results: [g], attrs: { sym } }));
       return g;
     };
+    // A FRAME ADDRESS AS DATA: post-push offset k of the local area, lowered to the `laddr` the
+    // frame-object audit proves (`FRAME_OBJECT_AUDIT`, frontend/frame-objects.ts `frameObjects`),
+    // which also judges where it lies against the area: below it or above it refuses.
+    const emitLaddr = (k: number): Value => {
+      const v = mkValue(T.unk(32));
+      ops.push(mkOp('laddr', { results: [v], attrs: { off: k } }));
+      laddrAt.set(v, k);
+      return v;
+    };
     // `lwz rD,0(0)` under an `R_PPC_EMB_SDA21` relocation is a SMALL-DATA access. Both printed
     // fields are link-time placeholders: the linker substitutes r13/r2 for the base register and a
     // section-relative displacement for the offset, so the address is exactly `&SYM` plus the
@@ -675,11 +2410,15 @@ export function lift(
     // The base value + byte offset of a displacement memory operand: a small-data global, or an
     // ordinary register base. Read BEFORE a store's source register, because read order decides
     // block-parameter layout.
-    const memOperand = (ins: Instr, mem: string): { base: Value; off: number } => {
+    const memOperand = (ins: Instr, mem: string, width: number): { base: Value; off: number } => {
       const sda = sdaAccess(ins, mem);
       if (sda) {
         return sda;
       }
+      const local = inLocalArea(ins, mem, width);
+      if (local !== undefined) {
+        return { base: emitLaddr(local), off: 0 };
+      }
       assertOrdinaryMem(mem);
       const { off, base } = parseMem(mem);
       return { base: read(base), off };
@@ -717,12 +2456,41 @@ export function lift(
       const hi = highHalves.pair(relocSite(ins), rHi, readVar(rHi, bi), lo.sym, (h) => h.addend === lo.addend);
       return emitGaddr(hi.sym);
     };
+    /** `addi rD,rHi,SYM@l` completing the base of a jump table a dispatch reads from outside its
+     *  block: the pair is proven as `foldLoHalf` proves it, and rD holds the table base. */
+    const foldTableBase = (ins: Instr, rHi: string): Value | null => {
+      const lo = ins.reloc!;
+      const key = { sym: lo.sym, addend: lo.addend };
+      if (!tableBases.wants(key)) {
+        return null;
+      }
+      relocTaken = true;
+      highHalves.pair(relocSite(ins), rHi, readVar(rHi, bi), lo.sym, (h) => h.addend === lo.addend);
+      const v = mkValue(T.unk(32));
+      tableBases.record(v, key, ins.addr);
+      return v;
+    };
     const emitLoad = (ins: Instr, d: string, mem: string, width: number, signed: boolean) => {
-      const { base, off } = memOperand(ins, mem);
-      emit('load', d, [base], { off, width, signed });
+      const { base, off } = memOperand(ins, mem, width);
+      const v = emit('load', d, [base], { off, width, signed });
+      if (d === discardReg) {
+        discarded.add(v);
+      }
     };
     const emitStore = (ins: Instr, srcReg: string, mem: string, width: number) => {
-      const { base, off } = memOperand(ins, mem);
+      const { base, off } = memOperand(ins, mem, width);
+      // A register the prologue saves is saved above the local area by construction, so its
+      // entry value stored inside it is a frame this does not describe.
+      if (
+        inLocalArea(ins, mem, width) !== undefined &&
+        isCalleeSaved(target, srcReg) &&
+        !ssa.hasReachingDef(srcReg, bi)
+      ) {
+        fail(
+          `cannot lift '${name}': address-taken stack local — '${ins.mnemonic}' at 0x${ins.addr.toString(16)} stores ` +
+            `the caller's ${srcReg} inside the local area, a frame this does not describe`,
+        );
+      }
       ops.push(mkOp('store', { operands: [base, read(srcReg)], attrs: { off, width } }));
     };
     // Register+register INDEXED addressing (`lwzx rD,rA,rB` = *(rA+rB), `stwx rS,rA,rB` = *(rA+rB)=rS).
@@ -736,14 +2504,41 @@ export function lift(
       return addr;
     };
     const emitLoadX = (d: string, rA: string, rB: string, width: number, signed: boolean) => {
-      emit('load', d, [addrX(rA, rB)], { off: 0, width, signed });
+      const v = emit('load', d, [addrX(rA, rB)], { off: 0, width, signed });
+      if (d === discardReg) {
+        discarded.add(v);
+      }
     };
     const emitStoreX = (srcReg: string, rA: string, rB: string, width: number) => {
       ops.push(mkOp('store', { operands: [addrX(rA, rB), read(srcReg)], attrs: { off: 0, width } }));
     };
 
     // cr-field compare state, so a following branch fuses. Keyed by cr name ("cr0" default).
-    const cmpDef = new Map<string, { lhs: Value; rhs: Value; signed: boolean }>();
+    //
+    // A block starts with what its predecessor left, under the edge rule both frontends share
+    // (`inheritFlags`, frontend/flags-edge.ts): one predecessor, already filled, not a jump-table
+    // dispatch. The edge out of a CONDITIONAL branch carries too, because a `bc` writes no CR field:
+    // mwcc's switch dispatch `cmpwi r0,1; beq- case1; bge- default` reads one compare from the
+    // `beq-` and then from the `bge-` on its fall-through, which begins a block of its own.
+    //
+    // The clobber rule is this frontend's own: a compare writes its field (a float compare too), a
+    // record-form op writes cr0, a `cror` rewrites one bit of a float compare's field, and a call
+    // destroys every volatile field (CR_VOLATILE). A field something else wrote holds the sentence
+    // saying so rather than an entry, so the branch that reads it can name the writer. Every other
+    // instruction that writes a CR field (`crxor`, `mtcrf`, …) names no register destination and is
+    // refused outright by the opaque policy, so it never reaches here.
+    const inherited = inheritFlags(bi, {
+      preds,
+      exit: exitCr,
+      label: blockLabel,
+      dispatches: (i) => {
+        const pbr = blocks[i].branch;
+        return pbr !== null && jts.has(pbr.addr);
+      },
+      refusesConditional: () => false,
+    });
+    const cmpDef = new Map<string, CrCompare | string>(typeof inherited === 'string' ? [] : inherited.fields);
+    const noCmpWhy = typeof inherited === 'string' ? inherited : inherited.none;
     // One operand-grammar normalizer for the four compare decodes: `cmpX rA,…` (cr0 implicit)
     // or `cmpX crN,rA,…` → the cr field, the lhs register token, and the rhs token (register or
     // immediate — the case reads/parses it).
@@ -752,11 +2547,100 @@ export function lift(
       const args = hasCr ? cmpOps.slice(1) : cmpOps;
       return { cr: hasCr ? cmpOps[0] : 'cr0', lhsTok: args[0], rhsTok: args[args.length - 1] };
     };
+    // An FPU register holds a float or, after `fctiwz`, an integer word (frontend/fpu.ts
+    // `refuseFpWordCrossings` checks the edges); a float read refuses the word.
+    const readFloat = (ins: Instr, key: string): Value => {
+      const v = readReg(key, bi);
+      if (v.type.kind !== 'float') {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': '${ins.mnemonic}' at 0x${ins.addr.toString(16)} reads ${key} as a float, and it ` +
+            'holds an integer word',
+        );
+      }
+      return v;
+    };
+    // A compare or a conversion refuses beside a call (`callInsn`), and in a function its own
+    // declaration puts in both precisions (`declaredPrecision`): neither states a precision itself.
+    const refuseCrossingUnmodelled = (ins: Instr) => {
+      if (callInsn) {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': '${ins.mnemonic}' computes on a float and '${callInsn.mnemonic}' at ` +
+            `0x${callInsn.addr.toString(16)} makes a call — the floating-point registers a call reads, returns ` +
+            `in and destroys are not modelled`,
+        );
+      }
+      if (fpType === null) {
+        refuseBothPrecisions(name, ins.mnemonic);
+      }
+    };
+    // ONE BIT of an `mfcr` copy, as the 0/1 it is: bit `n` counts from the most significant, four to
+    // a field (`lt`, `gt`, `eq`, `so`). `rlwinm rD,r0,K,31,31` rotates bit K-1 to the bottom and
+    // `srwi rD,r0,31` takes bit 0. Only a float compare's bit is read this way here, and it is the
+    // compare that bit holds (`CrBits`); anything else refuses.
+    const crBitValue = (ins: Instr, copy: Value, n: number): Value => {
+      const fields = crCopies.get(copy)!;
+      const field = `cr${n >> 2}`;
+      const bit = n < 0 ? null : CR_BIT_NAMES[n & 3];
+      const held = fields.get(field);
+      if (bit === null || typeof held !== 'object' || !held.bits || (held.quiet && bit !== 'eq')) {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': '${ins.mnemonic}' at 0x${ins.addr.toString(16)} extracts from a copy of the ` +
+            'condition register something other than one bit a float compare set',
+        );
+      }
+      const v = mkValue(T.unk(32));
+      ops.push(mkOp(held.bits[bit], { operands: [held.lhs, held.rhs], results: [v] }));
+      return v;
+    };
     const recordCmp = (cr: string, lhs: Value, rhs: Value, signed: boolean) => {
       cmpDef.set(cr, { lhs, rhs, signed });
+      compared.add(lhs).add(rhs);
+    };
+
+    // The carry bit, XER[CA], as a 0/1 value. mwcc computes a materialised compare branch-free
+    // through it (`subfc` then `subfe`/`subfze`/`adde`/`addze`), so a reader needs the comparison
+    // the writer left there. Three writers are modelled, each as the compare its carry IS:
+    //   subfc rD,rA,rB   rD = rB - rA          CA = rB >=u rA
+    //   subfic rD,rA,K   rD = K - rA           CA = K >=u rA   (K == 0: rA == 0)
+    //   addic rD,rA,K    rD = rA + K           CA = carry of the unsigned add (K == -1: rA != 0)
+    // The compare is built at its reader, so a carry nothing reads adds no op. A carry is
+    // UNKNOWN, and its reader refuses naming why, when no instruction of this block set it (a carry
+    // across a block edge is not modelled), a call clobbered it, or a writer this frontend does not
+    // model set it: `srawi`/`sraw` (the signed `/2^k` round-up), `addc` (the low half of a 64-bit
+    // add), and the extended forms, whose own carry-out is a high word's. An `addic` carry is
+    // read only as a compare (`subfe`, `subfze`): `adde`/`addze` over it is the high word of
+    // mwcc 2.4.x's 64-bit add of a constant, which is not built, so they refuse it as they refuse
+    // an `addc` carry.
+    type Carry = { make: () => Value; addic: boolean } | { why: string };
+    let carry: Carry = { why: 'nothing in its own block set it (a carry across a block edge is not modelled)' };
+    const setCarry = (make: () => Value, addic = false) => {
+      carry = { make, addic };
+    };
+    /** The carry, as the compare that set it. `wide` marks an extended add (`adde`/`addze`), which
+     *  over an `addic` carry is the high word of a 64-bit add. */
+    const readCarry = (ins: Instr, wide = false): Value => {
+      const why =
+        'why' in carry
+          ? carry.why
+          : wide && carry.addic
+            ? 'an addic set it: an extended add over that carry is the high word of a 64-bit add, which is not modelled'
+            : undefined;
+      if (why !== undefined) {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': the '${ins.mnemonic}' at 0x${ins.addr.toString(16)} ` +
+            `reads the carry bit (XER[CA]), and ${why}`,
+        );
+      }
+      return (carry as { make: () => Value }).make();
+    };
+    /** The value of `v` when this block defines it as a `const`. */
+    const constIn = (v: Value): number | undefined => {
+      const def = ops.find((o) => o.results[0] === v);
+      return def?.opcode === 'const' ? (def.attrs.value as number) : undefined;
     };
 
     const decode = (ins: Instr) => {
+      decoding = ins;
       const [d, s, t] = ins.ops;
       // Record form: a trailing `.` (the Rc bit) means the op ALSO sets cr0 from a signed compare
       // of its result against 0 (e.g. `andi.`, `addic.`). Decode the base op, then record that
@@ -766,50 +2650,210 @@ export function lift(
       const mnem = rc ? ins.mnemonic.slice(0, -1) : ins.mnemonic;
       lastDef = null;
       relocTaken = false;
+      // Every carry writer and every call leaves the carry unknown unless its case below models it.
+      const clobberCarry = (how: string) => {
+        carry = { why: `the '${ins.mnemonic}' at 0x${ins.addr.toString(16)} ${how}` };
+      };
+      if (CARRY_WRITERS.test(mnem)) {
+        clobberCarry('set it, a carry this frontend does not model');
+      } else if (/^b.*l$/.test(mnem)) {
+        clobberCarry('is a call, which clobbers it');
+      }
+      // A LOAD OR STORE WITH UPDATE (`lbzu`/`lhzu`/`lhau`/`lwzu`, `stbu`/`sthu`/`stwu`) addresses
+      // `rA + D` and leaves that address in rA: `lbzu rD,1(r3)` is `r3 += 1; rD = *(u8 *)r3`, and
+      // `stbu rS,1(r3)` is `r3 += 1; *(u8 *)r3 = rS`. mwcc emits them for a fully unrolled scan of a
+      // table, a run of stores to a global array and a pre-increment pointer walk (`*++p`) at -O4,p,
+      // and for the word loop of a struct copy at every level. Decoded as exactly that: the
+      // `addi rA,rA,D` this frontend already lifts, then the plain access at `0(rA)`. So an `@l` displacement (`lhzu r0,gH@l(r4)`, the
+      // FIRST access of a run over a `u16`/`u32` table or a store run) completes its `lis` the way
+      // `addi rD,rHi,gH@l` does, and leaves `&gH` in rA; a base holding a frame address moves as a
+      // capture moved by `addi` does, and the frame-object audit judges what it then reaches.
+      //
+      // It refuses where that reading is not the instruction's:
+      //   • a base field of 0 (`r0`) is the literal 0, which the ISA makes an invalid form for every
+      //     update form, and so is a load into its own base (rD == rA): neither has one meaning;
+      //   • a store of its own base (rS == rA) stores the value BEFORE the update, which an
+      //     `addi`-first decode would not;
+      //   • a base of r1 moves the stack pointer, which `r1Displacements` tracks only for the frame
+      //     push (`case 'stwu'`) and `addi r1,r1,N`, and so does a load into r1;
+      //   • a relocation other than `R_PPC_ADDR16_LO` (no compiler emits one).
+      // Not decoded, and refused as unmodelled (`emitOpaqueDest` refuses the loads, which write a
+      // second register an opaque cannot stand for; `opaqueDest` the stores): the INDEXED update forms
+      // (`lwzux`, `stbux`, …), which in 2004 functions with an update form across pikmin,
+      // ac-decomp and marioparty4 appear only in hand-written asm, and the floating-point ones
+      // (`lfsu`, `stfdu`, …), whose plain forms this frontend does not lift either.
+      const withUpdate = (plain: string, store: boolean) => {
+        const [r, mem] = ins.ops;
+        const { off, base } = parseMem(mem ?? '');
+        const why =
+          !isReg(base) || base === 'r0'
+            ? `its base is ${base === 'r0' ? 'r0' : `'${mem}'`}, which the ISA makes an invalid form of an update`
+            : base === 'r1'
+              ? 'it moves the stack pointer, which only the frame push may do here'
+              : !store && r === 'r1'
+                ? 'it loads into the stack pointer, a value this lift does not track'
+                : r === base
+                  ? store
+                    ? `it stores its own base ${r}, whose stored value is the one before the update`
+                    : `it loads into its own base ${r}, which the ISA makes an invalid form`
+                  : ins.reloc !== undefined && ins.reloc.type !== 'R_PPC_ADDR16_LO'
+                    ? `it carries a '${ins.reloc.type}' relocation, which no update form is decoded under`
+                    : undefined;
+        if (why !== undefined) {
+          throw new PpcUnsupportedError(
+            `cannot lift '${name}': '${ins.mnemonic} ${ins.ops.join(',')}' at 0x${ins.addr.toString(16)} is a ` +
+              `${store ? 'store' : 'load'} with update not modelled — ${why}`,
+          );
+        }
+        const advance: Instr = { ...ins, mnemonic: 'addi', ops: [base, base, String(off)] };
+        decodedFrom.set(advance, ins);
+        decode(advance);
+        // The advanced base is the update's side effect, and proves no argument (`ssa.ts`
+        // `noteIncidentalWrite`).
+        if (lastDef !== null) {
+          ssa.noteIncidentalWrite(lastDef);
+        }
+        const access: Instr = { addr: ins.addr, mnemonic: plain, ops: [r, `0(${base})`] };
+        decodedFrom.set(access, ins);
+        decode(access);
+        // The `addi` took the relocation or threw, at its own choke point.
+        relocTaken = true;
+      };
       switch (mnem) {
         case 'nop':
           break;
         // --- call + frame/link-register bookkeeping ---
         // `bl <sym>`: read the argument registers (r3..), produce the return value in r3. The
-        // callee symbol comes from the relocation (ins.reloc); caller-saved clobbering is implicit
-        // (anything live across the call has already been moved to a callee-saved register).
+        // callee symbol comes from the relocation (ins.reloc), and the caller-saved set is recorded
+        // as destroyed (`calls.lower`) — a read of one past here names bytes the callee overwrote,
+        // and it has a reaching definition all the same.
         case 'bl': {
           relocTaken = ins.reloc?.type === 'R_PPC_REL24';
-          const sym = ins.reloc?.sym ?? 'func';
-          const declared = protoArity(prototypes[sym]);
-          const argc = declared ?? fallbackArgc(bi, ins.addr);
-          const args: Value[] = [];
-          for (let k = 0; k < argc; k++) {
-            args.push(read(ARG_REGS[k]));
+          const routine = saveRoutineOf(target, ins);
+          if (routine) {
+            saveRoutine(ins, routine);
+            break;
+          }
+          // A `bl` no relocation names is a call the assembler resolved to an offset in this
+          // section — into this function's own body, or to a neighbour — and has no name to call.
+          if (ins.reloc?.type !== 'R_PPC_REL24') {
+            throw new PpcUnsupportedError(
+              `cannot lift '${name}': the 'bl' at 0x${ins.addr.toString(16)} has no callee symbol — no ` +
+                `R_PPC_REL24 relocation names it, so it calls an offset in this section, which has no name to call it by`,
+            );
           }
-          // Pushed with `tmp` rather than `emit` so the result register is written separately from
-          // the op — r3.. are volatile under the EABI, so a GUESSED arity that counted a register
-          // set up before an intervening call passes an argument the caller never set up
-          // (`finish()` cuts those back — frontend/ssa.ts), and the call's OWN result is the
-          // CALLEE's write, so `noteCall` records the clobber after it rather than before.
-          const res = kit.tmp('call', args, { target: sym });
-          if (declared === undefined) {
-            ssa.recordGuessedCall(ops[ops.length - 1], bi, { argRegs: ARG_REGS, returnReg: RET });
+          const sym = ins.reloc.sym;
+          calls.lower({
+            callee: sym,
+            ssa,
+            bi,
+            read,
+            write,
+            // a pending `@ha` half and a table base are no argument
+            placeholders,
+            parked,
+            scaledIndex,
+            guess: {
+              // a gap in the argument registers refuses, naming this address (`fallbackArgc`)
+              at: ins.addr,
+              // A GUESS THAT FILLS EVERY ARGUMENT REGISTER CANNOT SAY WHERE THE LIST ENDS. The ninth
+              // argument travels in the callee's parameter area, 8 bytes above the pushed r1 (past the
+              // back chain and the LR save word), and a value stored there that reaches the call is that
+              // argument or a local the compiler put in the same words. Reading THAT word back does not
+              // decide it on a compiler that may load its outgoing area, so the end-of-lift check for a
+              // store nothing reloads is not enough here. Without a prototype this refuses; a declared
+              // arity says which — and so does the loaded-word bound: mwcc loads no word of its
+              // parameter area, so a word at or above the lowest one it loads is a local's.
+              //
+              // A guess of seven is the same question for one shape. A 64-bit argument takes an aligned
+              // register pair, so one that follows seven words skips r10 and fills the first two words
+              // of the parameter area (mwcc 2.3.3 builds `g(1, 2, 3, 4, 5, 6, 7, x)` with `long long x`
+              // that way). A single word there cannot be an argument after seven: the eighth word would
+              // have gone in r10.
+              refuse: (argc) => {
+                if (argc < ARG_REGS.length - 1) {
+                  return;
+                }
+                // The same question decides where the local area starts: past the widest call's
+                // stack words, so a guess that cannot say whether this call takes any cannot draw it
+                // — save where the loaded-word bound reaches the area's start, so that no word of the
+                // area is any call's stack argument (`measurePpcFrame`'s `outgoingEnd`).
+                if (frame !== null && (r1At.get(ins) !== -frame.size || frame.outgoingEnd > frame.area.from)) {
+                  fail(
+                    `cannot lift '${name}': outgoing stack arguments not modelled — nothing declares '${sym}', called at ` +
+                      `0x${ins.addr.toString(16)} with ${argc} argument registers filled, so whether it takes stack words ` +
+                      `is unknown, and this compiler's local area starts past them`,
+                  );
+                }
+                const depth = r1At.get(ins);
+                const reaching = (off: number) =>
+                  valueSlots.has(off) && ssa.hasReachingDef(stackSlotKey(off), bi, (v) => !nonValues.has(v));
+                // …save a word at or above the loaded-word bound, which is a local's
+                const inParamArea = (off: number) =>
+                  typeof depth !== 'number' ||
+                  (off >= depth + PARAM_AREA_AT && off < 0 && off + 4 <= loadedWordBound(depth));
+                const word = [...valueSlots.keys()].find((off) => inParamArea(off) && reaching(off));
+                const passed =
+                  argc === ARG_REGS.length || typeof depth !== 'number'
+                    ? word
+                    : reaching(depth + PARAM_AREA_AT) &&
+                        reaching(depth + PARAM_AREA_AT + 4) &&
+                        inParamArea(depth + PARAM_AREA_AT + 4)
+                      ? depth + PARAM_AREA_AT
+                      : undefined;
+                if (passed !== undefined) {
+                  const slot = valueSlots.get(passed)!;
+                  throw new PpcUnsupportedError(
+                    `cannot lift '${name}': outgoing stack arguments not modelled — the undeclared call to '${sym}' at ` +
+                      `0x${ins.addr.toString(16)} fills ${argc} argument registers, and the value ` +
+                      `stored to '${slot.mem}' at 0x${slot.addr.toString(16)} reaches it in the callee's ` +
+                      `parameter area, where an argument past the registers travels`,
+                  );
+                }
+              },
+            },
+          });
+          for (const cr of CR_VOLATILE) {
+            cmpDef.set(
+              cr,
+              `the call at 0x${ins.addr.toString(16)} destroyed it (the EABI does not preserve ${cr} across a call)`,
+            );
           }
-          write(RET, res);
-          ssa.noteCall(bi);
           break;
         }
         // Stack-frame + link-register bookkeeping. `stwu r1,-N(r1)` / `addi r1,r1,N` adjust the frame
-        // pointer; `mflr`/`mtlr` save/restore the return address. Transparent. Register saves/restores
-        // (individual r1 spills, and `stmw`/`lmw` of a callee-saved range) are transparent ONLY when
-        // they move an unchanged entry value — `frameStore`/`frameLoad` enforce that (a spill of a
-        // LIVE value fails loud); `stmw`/`lmw` record/consume the slot directly.
-        // The GENERAL form `stwu rS,D(rA)` (base ≠ r1) is a real store-with-BASE-UPDATE
-        // (`*(rA+D)=rS; rA+=D`) — neither effect is modelled here, so loud-fail rather than drop both.
+        // pointer; `mflr` copies the return address out (a `return-address` in `nonValues`) and `mtlr`
+        // puts it back.
+        // A word store or load on r1 is a save or a value slot (`frameStore`/`frameLoad`); `stmw`
+        // records save slots.
+        // The GENERAL form `stwu rS,D(rA)` (base ≠ r1) is a store with update (`withUpdate`).
+        // The push itself must be the only one, taken from the entry r1: every slot is named by its
+        // offset from there (`r1Displacements`), and a push from anywhere else moves that origin.
         case 'stwu':
           if (parseMem(s).base === 'r1') {
+            if (d !== 'r1' || r1At.get(ins) !== 0) {
+              throw new PpcUnsupportedError(
+                `cannot lift '${name}': '${ins.mnemonic} ${ins.ops.join(',')}' at 0x${ins.addr.toString(16)} ` +
+                  `is not the one frame push from the entry stack pointer — ` +
+                  `${d !== 'r1' ? `it stores ${d}, not the back chain` : `r1 had already moved (${r1At.get(ins)})`}`,
+              );
+            }
+            // The push also STORES: the entry r1, at its new top, which is the entry offset of `s`
+            // because r1 has not moved yet. A value stored there before the push is overwritten, and
+            // a load from it afterwards reads the caller's r1.
+            refuseMixedSlot(ins, s, parseMem(s).off, 'save');
+            saveSlots.set(parseMem(s).off, 'r1');
             break;
           }
-          throw new PpcUnsupportedError(
-            `cannot lift '${name}': stwu with update on ${parseMem(s).base} (store-with-base-update) not modelled`,
-          );
-        case 'mflr':
+          withUpdate('stw', true);
+          break;
+        case 'mflr': {
+          refuseOverwrittenLink(ins);
+          const lr = mkValue(T.unk(32));
+          nonValues.set(lr, { kind: 'return-address', addr: ins.addr });
+          write(d, lr);
+          break;
+        }
         case 'mtlr':
           break;
         // `mtctr rS` initialises the CTR loop counter — track it as the `ctr` pseudo-register so
@@ -821,21 +2865,34 @@ export function lift(
           break;
         case 'stmw':
           if (parseMem(s).base === 'r1') {
-            for (const slot of frameRange(d, parseMem(s).off)) {
-              savedSlots.set(slot.off, slot.reg);
+            if (inLocalArea(ins, s, 4 * (32 - Number(d.slice(1)))) !== undefined) {
+              fail(
+                `cannot lift '${name}': address-taken stack local — the 'stmw' at 0x${ins.addr.toString(16)} saves ` +
+                  `into the local area, a frame this does not describe`,
+              );
+            }
+            const off = entryOffset(ins, s);
+            const depth = off - parseMem(s).off;
+            for (const slot of frameRange(d, off)) {
+              saveInto(ins, slot.reg, slot.off, `${slot.off - depth}(r1)`);
             }
             break;
           }
           assertOrdinaryMem(s);
           emitOpaqueDest(ins);
           break;
-        // The restore half. Every word it reads must be the slot the matching `stmw` wrote, for the
-        // same register — `frameLoad` asks that question one word at a time, and refuses loud when
-        // the answer is no, exactly as the single-register `lwz` does.
+        // The restore half: `frameLoad` judges each word it reads, exactly as for a single `lwz`.
         case 'lmw':
           if (parseMem(s).base === 'r1') {
             for (const slot of frameRange(d, parseMem(s).off)) {
-              frameLoad(slot.reg, `${slot.off}(r1)`);
+              const word = `${slot.off}(r1)`;
+              if (inLocalArea(ins, word, 4) !== undefined) {
+                fail(
+                  `cannot lift '${name}': address-taken stack local — the 'lmw' at 0x${ins.addr.toString(16)} ` +
+                    `reloads ${slot.reg} out of '${word}', inside the local area, a frame this does not describe`,
+                );
+              }
+              frameLoad(ins, slot.reg, word);
             }
             break;
           }
@@ -877,9 +2934,14 @@ export function lift(
                   `is '${s}', not the expected 0 placeholder`,
               );
             }
+            // A jump table's own name is read as data and never written down, so the naming policy
+            // does not ask it; RELA pairs a half only with a low half of the same symbol and addend,
+            // and that one, with no immediate of its own, makes a table base (`foldTableBase`).
+            const table = tableBases.wants({ sym: ins.reloc.sym, addend: ins.reloc.addend });
+            relocTaken = true;
             const hi = mkValue(T.unk(32));
             highHalves.record(hi, {
-              sym: spellableSym(ins),
+              sym: table ? ins.reloc.sym : spellableSym(ins),
               addend: ins.reloc.addend,
               addr: ins.addr,
               mnemonic: ins.mnemonic,
@@ -899,7 +2961,9 @@ export function lift(
           // The STACK POINTER first, before any fold looks at the operands. `addi r1,r1,N` is frame
           // teardown and is skipped; a relocation on it is no known compiler's output, and folding
           // one would write an address into r1 and let the function lift as if the teardown had
-          // happened — silent, and about the frame rather than the value.
+          // happened — silent, and about the frame rather than the value. Only `addi r1,r1,N` is the
+          // teardown: `addi r1,r3,N` sets r1 to another register's value, and falls through to
+          // `write`, which refuses it like any other write to the stack pointer.
           if (d === 'r1') {
             if (ins.reloc) {
               throw new PpcUnsupportedError(
@@ -907,15 +2971,59 @@ export function lift(
                   `adjust — an address built in r1 is not a shape this frontend models`,
               );
             }
+            if (s === 'r1') {
+              break;
+            }
+          }
+          // A capture, `addi rD,r1,k`, is the `laddr` of the local area's offset k, where the frame
+          // has one (`measurePpcFrame`); without one it reaches `read`'s r1-as-data refusal. A capture
+          // moved by a constant is the capture at the sum.
+          if (frame !== null && takesFrameAddress(ins, target.registerSaveRoutines?.frameReg)) {
+            write(d, emitLaddr(parseImm(t) + (r1At.get(ins) as number) + frame.size));
+            break;
+          }
+          if (
+            frame !== null &&
+            mnem === 'addi' &&
+            !ins.reloc &&
+            isReg(s) &&
+            s !== 'r0' &&
+            s !== 'r1' &&
+            !SMALL_DATA_BASES.includes(s)
+          ) {
+            const raw = readVar(s, bi);
+            const at = laddrAt.get(raw);
+            if (at !== undefined) {
+              movedCaptures.add(raw);
+              write(d, emitLaddr(at + parseImm(t)));
+              break;
+            }
+          }
+          if (mnem === 'addi' && d === target.registerSaveRoutines?.frameReg && s === 'r1' && !ins.reloc) {
+            const v = mkValue(T.unk(32));
+            const depth = r1At.get(ins);
+            nonValues.set(v, {
+              kind: 'frame-address',
+              off: typeof depth === 'number' ? depth + parseImm(t) : (depth ?? 'the instruction is unreachable'),
+              addr: ins.addr,
+            });
+            write(d, v);
             break;
           }
           // `addi rD,rHi,SYM@l` completes the address a `lis` began: rD = &SYM (+ the relocation's
-          // addend). It is the only `@l` consumer modelled here. The others — `ori`, `addic`, and
-          // the `@l`-in-a-displacement form (1,935 integer load/store sites across the three
-          // checkouts, plus the float loads) — are left unbuilt per docs/level-tower.md's "earn the
-          // level": no row in this benchmark reaches them. Each refuses at its own guard, and a
-          // high half none of them consumed is caught by `readReg` or by the dangling-`@ha` check.
+          // addend). It is the only `@l` consumer modelled here, and an update form's `@l`
+          // displacement reaches it as the `addi` that advances its base (`withUpdate`). The others —
+          // `ori`, `addic`, and the `@l`-in-a-displacement form of a PLAIN load or store (1,935
+          // integer load/store sites across the three checkouts, plus the float loads) — are left
+          // unbuilt per docs/level-tower.md's "earn the level": no row in this benchmark reaches
+          // them. Each refuses at its own guard, and a high half none of them consumed is caught
+          // by `readReg` or by the dangling-`@ha` check.
           if (mnem === 'addi' && ins.reloc?.type === 'R_PPC_ADDR16_LO') {
+            const base = parseImm(t) === 0 ? foldTableBase(ins, s) : null;
+            if (base !== null) {
+              write(d, base);
+              break;
+            }
             const g = foldLoHalf(ins, s, t);
             if (ins.reloc.addend === 0) {
               write(d, g);
@@ -924,7 +3032,37 @@ export function lift(
             }
             break;
           }
-          emitBin('add', d, read(s), constVal(parseImm(t)));
+          // An rA field of 0 is the literal 0, not r0: `addi rD,0,SIMM` is `li`. A disassembler that
+          // prints it as `addi rD,r0,SIMM` still means the constant.
+          if (mnem === 'addi' && s === 'r0') {
+            write(d, constVal(parseImm(t)));
+            break;
+          }
+          // `addi rD,rS,0` is a register move: rS + 0 is rS, as Thumb's `add rD,rS,#0` is
+          // (frontend/thumb.ts). mwcc 2.3.3 spells its moves this way. Lifted as an add, the `+ 0`
+          // makes a pointer an integer sum, and C++ will not pass `(u32)&table + 0` as a
+          // `const char *`. `addic` sets the carry and is not a move.
+          if (mnem === 'addi' && parseImm(t) === 0) {
+            write(d, read(s));
+            break;
+          }
+          {
+            const a = read(s);
+            const k = parseImm(t);
+            emitBin('add', d, a, constVal(k));
+            if (mnem === 'addic') {
+              // a + K carries out exactly when a >=u 2^32 - K; K == 0 never carries.
+              setCarry(
+                () =>
+                  k === 0
+                    ? constVal(0)
+                    : k === -1
+                      ? kit.tmp('icmp_ne', [a, constVal(0)])
+                      : kit.tmp('icmp_uge', [a, constVal((2 ** 32 - (k >>> 0)) | 0)]),
+                true,
+              );
+            }
+          }
           break;
         // add immediate SHIFTED — the register-based `%ha` anchor: mwcc derives an absolute base
         // from a scaled index (`addis r4,r3,-32736` = r3 + 0x80200000). The jump-table lis/addi
@@ -932,19 +3070,114 @@ export function lift(
         // arithmetic, and a reloc-carrying one never gets here — the choke point in `decode` takes
         // it.
         case 'addis':
+          if (s === 'r0') {
+            write(d, constVal((parseImm(t) << 16) >> 0)); // `addis rD,0,SIMM` is `lis`, as for `addi`
+            break;
+          }
           emitBin('add', d, read(s), constVal((parseImm(t) << 16) >> 0));
           break;
         case 'subf':
-        case 'subfc':
         case 'subfo':
-          emitBin('sub', d, read(t), read(s));
+        case 'subfc':
+        case 'subfco': {
+          const b = read(t);
+          const a = read(s);
+          const diff = emitBin('sub', d, b, a);
+          if (mnem.startsWith('subfc')) {
+            setCarry(() => {
+              const c = kit.tmp('icmp_uge', [b, a]);
+              carrySource.set(c, diff);
+              return c;
+            });
+          }
           break; // rD = rB - rA (reversed)
-        case 'subfic':
-          emitBin('sub', d, constVal(parseImm(t)), read(s));
+        }
+        case 'subfic': {
+          const k = constVal(parseImm(t));
+          const a = read(s);
+          const diff = emitBin('sub', d, k, a);
+          setCarry(() => {
+            const c = parseImm(t) === 0 ? kit.tmp('icmp_eq', [a, constVal(0)]) : kit.tmp('icmp_uge', [k, a]);
+            carrySource.set(c, diff);
+            return c;
+          });
           break; // rD = imm - rA
-        case 'neg':
-          emitUn('neg', d, read(s));
+        }
+        // The carry READERS, each over the carry its block's writer left (`readCarry`):
+        //   subfe rD,rA,rB = ~rA + rB + CA      adde rD,rA,rB = rA + rB + CA
+        //   subfze rD,rA   = ~rA + CA           addze rD,rA   = rA + CA
+        // Two `subfe` shapes are modelled, both of whose register halves cancel: `subfe rD,rY,rY`
+        // (~y + y = -1, so CA - 1, reading no rY — mwcc writes it over a register holding anything,
+        // the return address included) and `subfe rD,rA,rB` with rA = rB - 1 (~(x-1) + x = 0, so
+        // CA). Any other `subfe` is the high half of a 64-bit subtract, and `subfze` over a register
+        // that is no constant is a 64-bit negate: both stay unmodelled, as do `addme`/`subfme`.
+        case 'subfe': {
+          if (s === t) {
+            const c = readCarry(ins);
+            const r = emitBin('add', d, c, constVal(-1));
+            const diff = carrySource.get(c);
+            if (diff !== undefined) {
+              truthPending.set(r, { diff, via: 'neg' }); // CA - 1; its negation is the 0/1 `rA <u rB`
+            }
+            break;
+          }
+          const b = read(t);
+          const def = ops.find((o) => o.results[0] === read(s));
+          if (def?.opcode === 'add' && def.operands[0] === b && constIn(def.operands[1]) === -1) {
+            readWithoutOp.add(def.results[0]);
+            write(d, readCarry(ins));
+            break;
+          }
+          emitOpaqueDest(ins);
+          break;
+        }
+        case 'subfze': {
+          const x = read(s);
+          const k = constIn(x);
+          if (k !== undefined) {
+            readWithoutOp.add(x);
+            const ca = readCarry(ins);
+            ~k === 0 ? write(d, ca) : emitBin('add', d, constVal(~k), ca);
+            break;
+          }
+          // mwcc hoists the constant out of a loop (`li r3,-1` ahead of the loop, `subfze r0,r3` in
+          // its body), so the register comes in through a join. Whether every path brings the same
+          // constant is known only once every block is filled; the exact `~rA + CA` stands until then.
+          // The value may also come down through blocks with one predecessor from the block that set
+          // it, so only a value this block computes is settled here; an entry parameter is the
+          // caller's value, never a constant, and the settling refuses it.
+          if (bi === 0 || ops.some((o) => o.results.includes(x))) {
+            emitOpaqueDest(ins);
+            break;
+          }
+          const ca = readCarry(ins);
+          const inv = mkValue(T.unk(32));
+          const not = mkOp('not', { operands: [x], results: [inv] });
+          ops.push(not);
+          emitBin('add', d, inv, ca);
+          joinedCarryConsts.push({ ins, not, add: ops[ops.length - 1], ca });
+          break;
+        }
+        case 'adde':
+          emitBin('add', d, binTmp('add', read(s), read(t)), readCarry(ins, true));
+          break;
+        case 'addze': {
+          const c = readCarry(ins, true);
+          const r = emitBin('add', d, read(s), c);
+          const diff = carrySource.get(c);
+          if (diff !== undefined) {
+            truthPending.set(r, { diff, via: 'and1' }); // mwcc's signed compare keeps bit 0 of this
+          }
+          break;
+        }
+        case 'neg': {
+          const x = read(s);
+          const n = emitUn('neg', d, x);
+          if (truthPending.get(x)?.via === 'neg') {
+            truthDifferences.push({ diff: truthPending.get(x)!.diff, carry: x, truth: n });
+          }
           break;
+        }
         case 'mullw':
         case 'mullwo':
           emitBin('mul', d, read(s), read(t));
@@ -1038,6 +3271,10 @@ export function lift(
           emitShImm('shl', d, read(s), parseImm(t));
           break;
         case 'srwi':
+          if (crCopies.has(read(s))) {
+            write(d, crBitValue(ins, read(s), parseImm(t) === 31 ? 0 : -1));
+            break;
+          }
           emitShImm('shr_u', d, read(s), parseImm(t));
           break;
         case 'srawi':
@@ -1057,37 +3294,66 @@ export function lift(
           break;
         }
         // rotate-and-mask, rotate 0 only: `clrlwi rD,rS,n` = rS & (~0>>>n); `clrrwi` = rS & (~0<<n).
-        case 'clrlwi':
-          emitBin('and', d, read(s), constVal((0xffffffff >>> parseImm(t)) >>> 0));
+        case 'clrlwi': {
+          const x = read(s);
+          const m = emitBin('and', d, x, constVal((0xffffffff >>> parseImm(t)) >>> 0));
+          if (parseImm(t) === 31 && truthPending.get(x)?.via === 'and1') {
+            truthDifferences.push({ diff: truthPending.get(x)!.diff, carry: x, truth: m });
+          }
           break;
+        }
         case 'clrrwi':
           emitBin('and', d, read(s), constVal((0xffffffff << parseImm(t)) >>> 0));
           break;
         case 'rlwinm': {
           const [sh, mb, me] = [parseImm(ins.ops[2]), parseImm(ins.ops[3]), parseImm(ins.ops[4])];
+          if (crCopies.has(read(s))) {
+            write(d, crBitValue(ins, read(s), mb === 31 && me === 31 ? (sh + 31) % 32 : -1));
+            break;
+          }
           // `rlwinm rD,rS,SH,MB,ME` = rotl(rS,SH) & mask(MB,ME). Three cases we can lower exactly:
           //  • SH==0            — a pure masked AND.
-          //  • right-shift EXTRACT `(x>>n)&m` — ME==31 and the field does not wrap (SH+MB>=32): the
-          //    compiler's form for `(x>>n)&mask`, with n=32-SH and mask=mask(MB,31). Emit the shift
-          //    then the AND — the faithful, idiomatic C that recompiles to this exact rlwinm.
+          //  • right-shift EXTRACT `(x>>n)&m` — the field lies in the SH bits the rotate brings round
+          //    from the top (MB >= 32-SH, MB <= ME): the compiler's form for `(x>>n)&mask`, with
+          //    n=32-SH and mask=mask(MB,ME). Emit the shift then the AND — the faithful, idiomatic C
+          //    that recompiles to this exact rlwinm. Where that field is the one bit x's sign bit
+          //    lands on (MB == ME == 32-SH) it is `(x >>u 31) << (SH-1)`: mwcc merges a shift of a
+          //    0/1 value into its extract (`(a < b) << 3` ends `rlwinm r3,r0,4,28,28` on 2.4.x), and
+          //    the `srwi 31` the branch-free compare folds read is then whole (pattern/engine.ts
+          //    MWCC_COMPARE_PATTERNS).
+          //  • left-shift INSERT `(x&m)<<SH` — the field lies wholly in the bits the shift fills
+          //    (MB <= ME <= 31-SH): `(x & (mask >> SH)) << SH`, mwcc's form for a masked value moved
+          //    up (`(a < b) << 5` over 2.3.3's `& 1` ends `rlwinm r3,r0,5,26,26`).
           //  • anything else (a genuine rotate / bitfield insert) stays an opaque — loud, not dropped.
           if (sh === 0) {
             emitBin('and', d, read(s), constVal(rlwinmMask(mb, me)));
             break;
           }
-          if (me === 31 && sh + mb >= 32) {
+          if (mb === me && mb === 32 - sh && sh > 1) {
+            const sign = mkValue(T.unk(32));
+            ops.push(mkOp('shr_u', { operands: [read(s)], results: [sign], attrs: { imm: 31 } }));
+            emitShImm('shl', d, sign, sh - 1);
+            break;
+          }
+          if (mb <= me && me <= 31 - sh) {
+            const masked = mkValue(T.unk(32));
+            ops.push(mkOp('and', { operands: [read(s), constVal(rlwinmMask(mb, me) >>> sh)], results: [masked] }));
+            emitShImm('shl', d, masked, sh);
+            break;
+          }
+          if (mb <= me && sh + mb >= 32) {
             const shifted = mkValue(T.unk(32));
             ops.push(mkOp('shr_u', { operands: [read(s)], results: [shifted], attrs: { imm: (32 - sh) & 31 } }));
-            emitBin('and', d, shifted, constVal(rlwinmMask(mb, 31)));
+            emitBin('and', d, shifted, constVal(rlwinmMask(mb, me)));
             break;
           }
           emitOpaqueDest(ins);
           break;
         }
-        // Word load/store: a transparent frame save/restore is skipped; a live-value spill or a
-        // stack local fails loud (frameStore/frameLoad); otherwise it is ordinary memory.
+        // Word load/store: an r1-relative word is a frame slot (frameStore/frameLoad); otherwise it is
+        // ordinary memory.
         case 'lwz':
-          if (frameLoad(d, s)) {
+          if (frameLoad(ins, d, s)) {
             break;
           }
           emitLoad(ins, d, s, 4, true);
@@ -1102,7 +3368,7 @@ export function lift(
           emitLoad(ins, d, s, 1, false);
           break;
         case 'stw':
-          if (frameStore(d, s)) {
+          if (frameStore(ins, d, s)) {
             break;
           }
           emitStore(ins, d, s, 4);
@@ -1113,6 +3379,17 @@ export function lift(
         case 'stb':
           emitStore(ins, d, s, 1);
           break;
+        // The update forms (`withUpdate`); `stwu` is decoded with the frame push above.
+        case 'lwzu':
+        case 'lhzu':
+        case 'lhau':
+        case 'lbzu':
+          withUpdate(mnem.slice(0, -1), false);
+          break;
+        case 'sthu':
+        case 'stbu':
+          withUpdate(mnem.slice(0, -1), true);
+          break;
         // Register+register indexed forms (variable-index array access). Widths/signedness mirror the
         // displacement loads/stores above; `lhax` is the sign-extending halfword (algebraic).
         case 'lwzx':
@@ -1162,14 +3439,144 @@ export function lift(
           recordCmp(c.cr, read(c.lhsTok), rhs, false);
           break;
         }
+        // A FLOAT COMPARE sets its field's three bits from the IEEE relation of its operands; a NaN
+        // clears all three (and sets `so`). Which compare each bit holds is what a branch, a `cror`
+        // or an extract then reads.
+        case 'fcmpo':
+        case 'fcmpu': {
+          const [cr, a, bReg] = ins.ops;
+          if (fpu === undefined || !/^cr[0-7]$/.test(cr ?? '') || ![a, bReg].every(isFpKey)) {
+            emitOpaqueDest(ins);
+            break;
+          }
+          refuseCrossingUnmodelled(ins);
+          const lhs = readFloat(ins, a);
+          const rhs = readFloat(ins, bReg);
+          cmpDef.set(cr, {
+            lhs,
+            rhs,
+            signed: true,
+            bits: { lt: 'fcmp_olt', gt: 'fcmp_ogt', eq: 'fcmp_oeq' },
+            quiet: mnem === 'fcmpu',
+          });
+          break;
+        }
+        // `cror bD,bA,bB` ORs two bits into a third. mwcc's `<=` and `>=` over floats set `eq` to
+        // `lt | eq` or `gt | eq` of one field, which is the compare whose truth table is the OR of
+        // the two (`FCMP_TRUTH`). Bits of two fields, or of an integer compare, are not modelled.
+        case 'cror': {
+          const [dst, x, y] = ins.ops.map(crBitOf);
+          const field = dst?.field;
+          const held = field === undefined ? undefined : cmpDef.get(field);
+          const bits = typeof held === 'object' ? held.bits : undefined;
+          if (!dst || !x || !y || x.field !== field || y.field !== field || held === undefined || !bits) {
+            throw new PpcUnsupportedError(
+              `cannot lift '${name}': 'cror' at 0x${ins.addr.toString(16)} — only an OR of two bits of the field a ` +
+                'float compare set, into that field, is modelled',
+            );
+          }
+          const truth = FCMP_TRUTH[bits[x.bit]].map((t, i) => t || FCMP_TRUTH[bits[y.bit]][i]);
+          const opcode = fcmpOfTruth(truth);
+          if (opcode === undefined) {
+            throw new PpcUnsupportedError(
+              `cannot lift '${name}': 'cror' at 0x${ins.addr.toString(16)} ORs two bits into no compare of the operands`,
+            );
+          }
+          cmpDef.set(field!, { ...(held as CrCompare), bits: { ...bits, [dst.bit]: opcode } });
+          break;
+        }
+        case 'mfcr': {
+          const copy = mkValue(T.unk(32));
+          crCopies.set(copy, new Map(cmpDef));
+          write(d, copy);
+          break;
+        }
+        // `fctiwz fD,fS` truncates toward zero into the integer word of fD's low half, which reaches
+        // the integer file only through memory: `stfd fD,N(r1)` and `lwz rT,N+4(r1)` (the low word,
+        // big-endian). So fD holds that integer as a WORD, and its `stfd` stores it to the frame word
+        // a reload reads; its high half is no value (`fctiwz-high`), so a use of its reload refuses.
+        case 'fctiwz': {
+          if (fpu === undefined || ins.ops.length !== 2 || !ins.ops.every(isFpKey)) {
+            emitOpaqueDest(ins);
+            break;
+          }
+          refuseCrossingUnmodelled(ins);
+          const v = mkValue(T.unk(32));
+          ops.push(mkOp('fptosi', { operands: [readFloat(ins, s)], results: [v] }));
+          writeVar(d, bi, v);
+          break;
+        }
+        case 'stfd': {
+          const held = isFpKey(d) && fpu !== undefined ? readReg(d, bi) : undefined;
+          if (held === undefined || held.type.kind === 'float' || parseMem(s).base !== 'r1') {
+            emitOpaqueDest(ins);
+            break;
+          }
+          const off = entryOffset(ins, s) + 4;
+          refuseMixedSlot(ins, s, off - 4, 'value');
+          refuseMixedSlot(ins, s, off, 'value');
+          const high = mkValue(T.unk(32));
+          nonValues.set(high, { kind: 'fctiwz-high', addr: ins.addr });
+          writeVar(stackSlotKey(off - 4), bi, high);
+          writeVar(stackSlotKey(off), bi, held);
+          if (!valueSlots.has(off)) {
+            valueSlots.set(off, { addr: ins.addr, mem: s, read: false, stored: [] });
+          }
+          valueSlots.get(off)!.stored.push({ v: held, at: ins.addr });
+          break;
+        }
+        case 'fadds':
+        case 'fsubs':
+        case 'fmuls':
+        case 'fdivs':
+        case 'fadd':
+        case 'fsub':
+        case 'fmul':
+        case 'fdiv':
+        case 'fneg':
+        case 'fmr': {
+          const { op } = FP_ARITH[mnem];
+          if (rc || fpu === undefined || ins.ops.length === 0 || !ins.ops.every(isFpKey)) {
+            emitOpaqueDest(ins);
+            break;
+          }
+          if (callInsn) {
+            throw new PpcUnsupportedError(
+              `cannot lift '${name}': '${ins.mnemonic}' computes on a float and '${callInsn.mnemonic}' at ` +
+                `0x${callInsn.addr.toString(16)} makes a call — the floating-point registers a call reads, returns ` +
+                `in and destroys are not modelled`,
+            );
+          }
+          if (fpType === null) {
+            refuseBothPrecisions(name, ins.mnemonic);
+          }
+          const [dst, ...srcs] = ins.ops;
+          if (op === 'copy') {
+            writeVar(dst, bi, readFloat(ins, srcs[0]));
+            break;
+          }
+          const v = mkValue(fpType);
+          ops.push(mkOp(op, { operands: srcs.map((k) => readFloat(ins, k)), results: [v] }));
+          writeVar(dst, bi, v);
+          break;
+        }
         default:
           emitOpaqueDest(ins);
           break; // unmodelled: an honest opaque, never a silent drop
       }
+      if (CARRY_READERS.test(mnem)) {
+        clobberCarry('set it as the carry out of an extended add or subtract, which is not modelled');
+      }
       // A record-form op sets cr0 from a signed compare of its result against 0. Wire that so the
       // next branch reading cr0 fuses (`andi. r0,r3,1; beq …` → `if ((a0 & 1) == 0)`).
       if (rc && lastDef) {
         cmpDef.set('cr0', { lhs: lastDef, rhs: constVal(0), signed: true });
+        compared.add(lastDef);
+      } else if (rc) {
+        cmpDef.set(
+          'cr0',
+          `'${ins.mnemonic}' at 0x${ins.addr.toString(16)} wrote it from no value this frontend models`,
+        );
       }
       // THE CHOKE POINT. Everything above either took the relocation or threw; a relocation still
       // sitting here was dropped, and a dropped relocation is the printed placeholder standing in
@@ -1182,13 +3589,27 @@ export function lift(
     for (const ins of b.body) {
       decode(ins);
     }
+    // No terminator writes a CR field (a `bc` reads one, `bdnz` writes CTR), so the state after the
+    // body is the state at the block's exit. Recorded for EVERY block, including those whose edges
+    // `inheritFlags` will refuse: the edge rule lives in one place, and a second copy of it here
+    // could disagree with the first.
+    exitCr.set(bi, { fields: cmpDef, none: noCmpWhy });
 
     const br = b.branch;
     // Recovered dense switch: the bounds block dispatches a `switch_br` over the scrutinee — N case
     // blocks (dense 0..N-1) then the default (last successor). The `cmplwi`/`bgt` and the elided
     // dispatch (`lis…lwzx;mtctr;bctr`) are subsumed.
     const jt = br ? jts.get(br.addr) : undefined;
+    // Asked before the jump-table lowering: a table whose bound is a conditional return
+    // (`cmplwi rS,N; bgtlr`) lowers that return as the switch's default edge, and it jumps through
+    // whatever the link register holds there exactly as a plain `bgtlr` does.
+    if (br && (isReturn(br) || isCondReturn(br))) {
+      refuseOverwrittenLink(br);
+    }
     if (jt) {
+      if (jt.hoisted) {
+        tableBases.demand(jt.hoisted, bi, jt.bctrAddr);
+      }
       pushSwitchBr(
         ops,
         readReg(jt.scrutReg, bi),
@@ -1248,15 +3669,27 @@ export function lift(
       // The branch names its cr field as the first operand when not cr0.
       const crName = br.ops[0]?.startsWith('cr') ? br.ops[0] : 'cr0';
       const cmp = cmpDef.get(crName);
-      // `cmpDef` is block-local; a compare split from its branch by a block boundary is a
-      // cross-block cr dependency this frontend does not model. Decline loud.
+      if (typeof cmp === 'string') {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': conditional branch '${base}' tests ${crName}, but ${cmp}`,
+        );
+      }
       if (!cmp) {
         throw new PpcUnsupportedError(
-          `cannot lift '${name}': conditional branch '${base}' has no reaching compare (${crName}) in its block`,
+          `cannot lift '${name}': conditional branch '${base}' has no reaching compare (${crName}): ${noCmpWhy}`,
         );
       }
       const table = !cmp.signed ? COND_UNSIGNED : COND_SIGNED;
-      const cond = mkCmp(ops, table[base], cmp.lhs, cmp.rhs);
+      const { bit, set } = BRANCH_BIT[base];
+      if (cmp.bits && cmp.quiet && bit !== 'eq') {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': conditional branch '${base}' orders the operands of an 'fcmpu', which C emits ` +
+            'for == and != alone',
+        );
+      }
+      const cond = cmp.bits
+        ? mkCmp(ops, set ? cmp.bits[bit] : NEGATED_FCMP[cmp.bits[bit]], cmp.lhs, cmp.rhs)
+        : mkCmp(ops, table[base], cmp.lhs, cmp.rhs);
       ops.push(mkOp('cond_br', { operands: [cond], successors: succIdx[bi].map((j) => succ(j)) }));
       return;
     }
@@ -1265,8 +3698,17 @@ export function lift(
         ops.push(mkOp('br', { attrs: { fallthrough: true }, successors: [succ(succIdx[bi][0])] }));
         return;
       }
-      const retOps = ssa.hasReachingDef(RET, bi) ? [readReg(RET, bi)] : [];
-      ops.push(mkOp('ret', { operands: retOps }));
+      // A LAST block with no terminator runs off the end of the text: the input stops before the
+      // function does (a dump split at a foreign label, a hand-supplied fragment), and what
+      // follows is unknown. Lifting it as a return invents one. Thumb refuses the same way.
+      if (!br) {
+        const last = b.body[b.body.length - 1];
+        fail(
+          `cannot lift '${name}': control falls off the end (the block at 0x${b.startAddr.toString(16)} has no ` +
+            `terminator and no successor${last ? `; its last instruction is at 0x${last.addr.toString(16)}` : ''})`,
+        );
+      }
+      emitReturn(ops, bi);
       return;
     }
     // unconditional branch
@@ -1277,26 +3719,454 @@ export function lift(
     fillBlock(b, bi);
     ssa.markFilled(bi);
   });
+  refuseSavedRegisterLeaks(
+    name,
+    blocks.map((b) => ({
+      instrs: [...b.body, ...(b.branch ? [b.branch] : [])],
+      returns: b.synthReturn === true || (b.branch !== null && (isReturn(b.branch) || isCondReturn(b.branch))),
+    })),
+    preds,
+    new Set([...saveSlots.values()].filter((r) => isCalleeSaved(target, r))),
+    // a call preserves every callee-saved register, and a restore routine is a restore
+    (ins, r) => !ins.mnemonic.startsWith('b') && mayWriteGpr(ins, r),
+    restoredBy,
+  );
+  returnUntouchedArg();
+  // What f1 holds at each return, and, where the home is undecided and f1 holds a float this function
+  // computed on every path into every return, that float — read now, before the SSA is finished.
+  const homes = fpu ? returns.map(({ bi }) => floatHomeAt(ssa, fpu.returnReg, bi)) : [];
+  const carriesFloat = carriesFloatHome(homeRule, homes);
+  if (carriesFloat) {
+    returns.forEach(({ op, bi }) => op.operands.push(readReg(fpu!.returnReg, bi)));
+  }
   // A high half no `@l` ever completed — every `@l` consumer this frontend does not model (`ori`, a
   // float load's displacement) lands here, which is what keeps "not modelled" from becoming "not
   // emitted".
   highHalves.assertAllConsumed(name);
+  tableBases.prove(name, ssa);
+  refuseStaleIdiomReads(name, irBlocks, staleIdiom, ssa, prototypes[name] ?? contextOwnProto?.proto, ppcRefusal, calls);
+  // A value stored to the frame that nothing reloads is either a home the body never reads or an
+  // OUTGOING stack argument (`stw r4,8(r1)` before a nine-argument `bl` passes the ninth in the
+  // callee's parameter area, as ac-decomp's `aQMgr_order_decide_trade_*` do). The two are the same
+  // store, and dropping the second loses an argument — save a word at or above the loaded-word
+  // bound of the frame it was stored in, which is no call's argument and so a dead local's.
+  //
+  // A STRUCT'S HOME is the other unread word that is no argument. mwcc 2.4.2 and 2.4.7 give a struct
+  // a callee returned in r3 (`registerStructLocal`, call-plan.ts) a home in the frame and store the
+  // register there whole even where every member read is taken off r3 itself: `s = mk1(x); gW =
+  // s.x;` is `bl mk1; stw r3,gW; ...; stw r3,8(r1)`, and nothing reloads the home. A word every
+  // store of which is such an image holds that struct, and is no call's stack argument where every
+  // call that can run after one of those stores — later in its block, or in a block reachable from
+  // it — is declared to take none: then it is the local the call assigns, which
+  // `liftRegisterStructCalls` (frontend/register-struct-call.ts) declares. A call before every store
+  // reads the word before it is written, so it cannot be handed the struct there.
+  const imageCalls = new Map(
+    irBlocks.flatMap((b) =>
+      b.ops.filter((op) => op.attrs[REGISTER_STRUCT] !== undefined).map((op) => [op.results[0], op] as const),
+    ),
+  );
+  const images = new Set(imageCalls.keys());
+  // a struct with a home is one the source names (ir/core.ts `STRUCT_HOMED`)
+  for (const { stored } of valueSlots.values()) {
+    for (const { v } of stored) {
+      const call = imageCalls.get(v);
+      if (call !== undefined) {
+        call.attrs = { ...call.attrs, [REGISTER_STRUCT]: STRUCT_HOMED };
+      }
+    }
+  }
+  const takesNoStackWord = (ins: Instr): boolean => {
+    if (ins.mnemonic === 'bctrl' || ins.mnemonic === 'blrl') {
+      return false; // nothing declares what an indirect call takes
+    }
+    if (ins.mnemonic !== 'bl' || saveRoutineOf(target, ins)) {
+      return true;
+    }
+    const declared = calls.declaredCall(ins.reloc?.sym ?? '');
+    return declared !== null && wordsOf(declared.widths, target) <= ARG_REGS.length;
+  };
+  const blockOfAddr = new Map(blocks.flatMap((b, bi) => b.body.map((ins, k) => [ins.addr, { bi, k }] as const)));
+  const noCallAfterTakesStack = (addr: number): boolean => {
+    const at = blockOfAddr.get(addr);
+    if (at === undefined) {
+      return false;
+    }
+    if (!blocks[at.bi].body.slice(at.k + 1).every(takesNoStackWord)) {
+      return false;
+    }
+    const seen = new Set<number>();
+    const work = [...succIdx[at.bi]];
+    while (work.length > 0) {
+      const bi = work.pop()!;
+      if (seen.has(bi)) {
+        continue;
+      }
+      seen.add(bi);
+      if (!blocks[bi].body.every(takesNoStackWord)) {
+        return false;
+      }
+      work.push(...succIdx[bi]);
+    }
+    return true;
+  };
+  const depthOfAddr = new Map(blocks.flatMap((b) => b.body.map((ins) => [ins.addr, r1At.get(ins)] as const)));
+  for (const [off, { addr, mem, read, stored }] of valueSlots) {
+    const depth = depthOfAddr.get(addr);
+    const deadLocal = typeof depth === 'number' && off < 0 && off >= loadedWordBound(depth);
+    const structHome = stored.length > 0 && stored.every(({ v, at }) => images.has(v) && noCallAfterTakesStack(at));
+    if (!read && !deadLocal && !structHome) {
+      throw new PpcUnsupportedError(
+        `cannot lift '${name}': local stack frames not supported — '${mem}' is stored at 0x${addr.toString(16)} ` +
+          `and never read back, and an unread home and a call's argument passed on the stack are the same store`,
+      );
+    }
+  }
+  const argSlots = ppcArgSlots(name, fpuArgSlots(name, fpu, ARG_REGS, isFpKey, fpType), ARG_REGS, prototypes[name]);
+  mintArgSlotHoles(ssa, preds[0].length > 0, argSlots);
+  const droppedPairHalf = computedPairHalf(
+    irBlocks,
+    pairReturns,
+    target.compilerBehaviors.keepsUnusedReads === true
+      ? (v) => paramReg.get(v) === RET && irBlocks[0].params.includes(v)
+      : undefined,
+    truthDifferences,
+    (v) => compared.has(v) || readWithoutOp.has(v) || ssa.frameWrites.has(v),
+  );
   ssa.finish();
+  // A copy of the condition register is no integer: only a one-bit extract in its own block reads
+  // it, and a read across an edge resolves to it only now.
+  for (const blk of irBlocks) {
+    for (const op of blk.ops) {
+      if ([...op.operands, ...op.successors.flatMap((x) => x.args)].some((v) => crCopies.has(v))) {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': a copy of the condition register ('mfcr') is read as an integer, which is not modelled`,
+        );
+      }
+    }
+  }
+  refuseFpWordCrossings(name, ssa.fn);
+  // Asked once the lift is done, so a refusal the stream meets first keeps its own reason.
+  if (fpu) {
+    settleReturnHome(name, ssa.fn, homeRule, returns, homes, carriesFloat, fpu, RET);
+  }
+  resolveJoinedCarryConsts(name, ssa.fn, joinedCarryConsts);
+  if (droppedPairHalf) {
+    throw new PpcUnsupportedError(
+      `cannot lift '${name}': at a word return no declaration sizes, r4 holds a value this function computed ` +
+        'and nothing reads, which is the other word of a 64-bit return (r3:r4); returning r3 alone would drop it',
+    );
+  }
   highHalves.assertNoneEscaped(name, irBlocks);
+  tableBases.assertNoneEscaped(name, irBlocks);
+  // A non-value reaches a use through a join's incoming arguments as well as directly (`nonValues`).
+  assertNoNonValueEscaped(irBlocks);
+  assertNonValuesConsumed();
+
+  if (frame !== null) {
+    // Prove every `laddr` names storage of this frame at a shape the machine states, or decline
+    // (`auditFrameObjects`); an accepted function then gets the device pin the audit answers. The
+    // slot model's words are named from the pushed r1, as the audit names every offset.
+    const verdict = FRAME_OBJECT_AUDIT.run({
+      name,
+      irBlocks,
+      ownedLocals: frame.area,
+      declaredLocals: frame.area,
+      usedSlotOffsets: new Set(
+        [...valueSlots.keys()].map((o) => o + frame.size).filter((o) => o >= 0 && o < frame.size),
+      ),
+      // the bound of the pushed frame, named from the pushed r1 as every offset here is
+      loadedWords:
+        loadedFrom === undefined ? undefined : { from: loadedFrom, bound: loadedWordBound(-frame.size) + frame.size },
+      capturedObjectIsTheWholeFrame: false,
+      movedCaptures,
+      returnsWithoutHiddenPointer: calls.returnsWithoutHiddenPointer,
+      symbols: undefined,
+      target,
+      oneObject,
+    });
+    if (verdict !== undefined && 'oneObject' in verdict) {
+      return verdict;
+    }
+    if (verdict !== undefined) {
+      pinDeviceAccesses(irBlocks, verdict, target, undefined);
+    }
+  }
+  pinDeadReads(irBlocks, target, {
+    name,
+    own: prototypes[name],
+    atWordReturn: unreadHigh,
+    atUndeclaredCall: calls.heldAtUndeclaredCall,
+    compared,
+    spilled: ssa.frameWrites,
+    discarded: leftInDiscardRegister(irBlocks, discarded, writtenElsewhere),
+    declarations,
+  });
 
-  // ABI-ordered entry parameters (r3, r4, …) — a callee-saved copy can read a later argument
-  // register first, so sort the true entry's params by argument-register index.
-  const entry = irBlocks[0];
-  // non-ABI live-in ranks FIRST (indexOf's -1) — deliberate MIPS/PPC tie-break; Thumb's is 99/last
-  abiSortEntryParams(entry, preds[0].length > 0, (v) => ARG_REGS.indexOf(paramReg.get(v) ?? ''));
+  abiSortEntryParams(irBlocks[0], preds[0].length > 0, paramReg, argSlots);
+  ssa.fn.localObjects = statics.finish();
   return ssa.fn;
 }
 
+/** WHETHER A WORD RETURN'S r4 WAS COMPUTED FOR NOTHING, which the lift refuses. `returns` holds,
+ *  for each word return no declaration pins the width of, the word r3 returns and what r4, the
+ *  second register of an r3:r4 return, may hold there (frontend/dead-reads.ts `unreadPairHalf`).
+ *  Where one of those values is the result of an op that nothing reads — directly, or through joins
+ *  nothing reads — the compiler computed it for the caller: an optimizing compiler deletes a pure
+ *  computation nobody reads, so a value that survives in r4 with no reader is the other word of a
+ *  64-bit return, and returning r3 alone drops it. mwcc's `(unsigned long long)a - b` is `subfc
+ *  r4,r4,r3; subfe r3,r4,r4`, whose high word is the very `subfe` a 32-bit `-(a < b)` is, and `long
+ *  long x = a; if (c) x = -x; return x;` joins `0 - a` into r4 below the branch; both would lift as
+ *  their high word.
+ *
+ *  AT A LEVEL THAT KEEPS DEAD CODE (`entryWord` given, where `keepsUnusedReads` holds) that premise
+ *  fails for a parameter: mwcc -O0 keeps `b = a + 1;` in b's register r4. There a return whose r3
+ *  is still the entry value (`entryWord`, directly or through joins of only it) is not asked, since
+ *  -O0 spells a 64-bit op as both words' ops and writes r3 even where its word is unchanged (`x |
+ *  0xff` is `or r4,r4,r5; or r3,r3,r0` with r0 = 0), in every 64-bit shape measured on 2.4.2, 2.4.7
+ *  and 2.3.3. At -O4 an untouched r3 is evidence of nothing: `((u64)a << 32) | (b + 1)` is `addi
+ *  r4,r4,1`. A dead parameter store beside a computed r3 (`b = a * 3; return a + 1;`) still
+ *  refuses.
+ *
+ *  Asked BEFORE `ssa.finish`, while every join is still a parameter with its incoming values wired,
+ *  so a join the trivial-phi pass would fold is walked, not lost, and refused AFTER it, so an
+ *  unmodelled instruction or an unresolved `subfze` keeps its own message. `exemptValue` names a
+ *  value the machine did use where the lift left no op for the use: one a compare consumed (`compared`),
+ *  one a carry reader folded away (`readWithoutOp`: ac-decomp's `mSP_GetRealShopLevel` returns `(x
+ *  >= 25000)` as `li r4,-1; subfc r0,r0,r3; subfze r3,r4`), a `subfc`/`subfic` difference whose
+ *  carry a reader turned into a 0/1 truth value (`truthDifferences`, kept only where that reader is
+ *  the carry's sole consumer in its block and neither is r3's word: 2.3.3's `a + (a < b)` is
+ *  `subfc r4,r4,r3; subfe r0,r0,r0; neg r0,r0; add r3,r3,r0` over the dead `b`, and the signed one
+ *  keeps bit 0 of an `addze`; a 64-bit high word reads the borrow as `CA - 1`, which r3 returns),
+ *  and one stored to the frame (`frameWrites`). A function that holds an
+ *  unmodelled instruction is not asked: the `opaque` may read r4 without naming it, and it declines
+ *  under its own name. A value r4 holds that the function did not compute — its entry value, the
+ *  caller's `a` that `long long z(unsigned a) { return a; }` moves there — is not seen, and that
+ *  word return still drops the low word. */
+type PairReturn = { word: Value; high: ReadonlySet<Value> };
+/** A `subfc`/`subfic` difference (`diff`) whose carry a reader made a 0/1 truth value: `carry` is
+ *  the `subfe rX,rY,rY` (CA - 1) or `addze` result, `truth` the `neg` or `clrlwi 31` over it. */
+type TruthDifference = { diff: Value; carry: Value; truth: Value };
+function computedPairHalf(
+  blocks: readonly Block[],
+  returns: readonly PairReturn[],
+  entryWord: ((v: Value) => boolean) | undefined,
+  truthDifferences: readonly TruthDifference[],
+  exemptValue: (v: Value) => boolean,
+): boolean {
+  if (returns.every((r) => r.high.size === 0) || blocks.some((b) => b.ops.some((o) => o.opcode === 'opaque'))) {
+    return false;
+  }
+  const defOf = new Map<Value, Op>();
+  const blockOf = new Map<Op, Block>();
+  const incoming = new Map<Value, Value[]>();
+  // Every reader of each value: the ops that take it as an operand, a join argument counting as one.
+  const readers = new Map<Value, number>();
+  const readBy = (v: Value) => readers.set(v, (readers.get(v) ?? 0) + 1);
+  for (const b of blocks) {
+    for (const o of b.ops) {
+      blockOf.set(o, b);
+      o.results.forEach((r) => defOf.set(r, o));
+      o.operands.forEach(readBy);
+      for (const succ of o.successors) {
+        succ.args.forEach((a, i) => {
+          readBy(a);
+          const p = succ.block.params[i];
+          incoming.set(p, [...(incoming.get(p) ?? []), a]);
+        });
+      }
+    }
+  }
+  // What r3 may hold at a word return: the word itself, and every value a join of it carries in.
+  const returned = new Set<Value>();
+  const toReturn = returns.map((r) => r.word);
+  while (toReturn.length > 0) {
+    const v = toReturn.pop()!;
+    if (!returned.has(v)) {
+      returned.add(v);
+      toReturn.push(...(incoming.get(v) ?? []));
+    }
+  }
+  // A truth value's difference is the compare's by-product only where nothing else saw the carry:
+  // the reader is its sole consumer and runs in its block, so on every path the difference takes,
+  // and neither the carry nor the truth value is what r3 returns. mwcc's `u64 d = (u64)a - b; *p =
+  // -(int)(d >> 32); return d;` is `subfc r4,r4,r3; subfe r3,r4,r4; neg r0,r3`: that `subfe` is
+  // the high word, the `neg` beside it is a second reader, and r4 is the low word.
+  const comparedDifference = new Set<Value>();
+  for (const { diff, carry, truth } of truthDifferences) {
+    const reader = defOf.get(truth);
+    const writer = defOf.get(carry);
+    if (
+      reader !== undefined &&
+      writer !== undefined &&
+      reader.operands.filter((x) => x === carry).length === 1 &&
+      readers.get(carry) === 1 &&
+      !exemptValue(carry) &&
+      blockOf.get(reader) === blockOf.get(writer) &&
+      !returned.has(carry) &&
+      !returned.has(truth)
+    ) {
+      comparedDifference.add(diff);
+    }
+  }
+  const exempt = (v: Value) => exemptValue(v) || comparedDifference.has(v);
+  // What some kept op reads, through the joins that carry it there.
+  const read = new Set<Value>();
+  const work: Value[] = [];
+  const mark = (v: Value) => {
+    if (!read.has(v)) {
+      read.add(v);
+      work.push(v);
+    }
+  };
+  for (const b of blocks) {
+    for (const o of b.ops) {
+      if (!deletableWhenDead(o)) {
+        o.operands.forEach(mark);
+      }
+    }
+  }
+  while (work.length > 0) {
+    const v = work.pop()!;
+    defOf.get(v)?.operands.forEach(mark);
+    incoming.get(v)?.forEach(mark);
+  }
+  const seen = new Set<Value>();
+  const computedForNothing = (v: Value): boolean => {
+    if (seen.has(v) || read.has(v) || exempt(v)) {
+      return false;
+    }
+    seen.add(v);
+    const def = defOf.get(v);
+    if (def !== undefined) {
+      return def.opcode !== 'undef';
+    }
+    return (incoming.get(v) ?? []).some(computedForNothing);
+  };
+  // Whether `v` is r3's entry value on every path: directly, or through joins of nothing else.
+  const entry = (v: Value, on: Set<Value>): boolean => {
+    if (entryWord!(v)) {
+      return true;
+    }
+    const ins = incoming.get(v);
+    if (ins === undefined || on.has(v)) {
+      return ins !== undefined;
+    }
+    on.add(v);
+    return ins.every((x) => entry(x, on));
+  };
+  return returns.some(
+    (r) => !(entryWord !== undefined && entry(r.word, new Set())) && [...r.high].some(computedForNothing),
+  );
+}
+
+/** Settle each `subfze rD,rA` whose rA came in through a join (the `subfze` decode): where every
+ *  path brings the same constant K — the join's incoming values followed back, each a `const` or a
+ *  join of its own, a cycle adding nothing — the `~rA + CA` becomes `~K + CA`, which is CA itself
+ *  for mwcc's `li -1`. Anything else refuses, as an unmodelled `subfze` does in its own block: over
+ *  a register that is no constant it is the high half of a 64-bit negate. */
+function resolveJoinedCarryConsts(
+  name: string,
+  fn: Fn,
+  pending: readonly { ins: Instr; not: Op; add: Op; ca: Value }[],
+): void {
+  if (pending.length === 0) {
+    return;
+  }
+  const defs = new Map<Value, Op>();
+  const incoming = new Map<Value, Value[]>();
+  for (const b of fn.blocks) {
+    for (const o of b.ops) {
+      o.results.forEach((r) => defs.set(r, o));
+      for (const succ of o.successors) {
+        succ.args.forEach((a, i) => {
+          const p = succ.block.params[i];
+          incoming.set(p, [...(incoming.get(p) ?? []), a]);
+        });
+      }
+    }
+  }
+  // The one constant `v` is on every path, `null` where it is none, `undefined` where only a cycle
+  // brings it (which says nothing).
+  const constantOf = (v: Value, seen: Set<Value>): number | null | undefined => {
+    const def = defs.get(v);
+    if (def !== undefined) {
+      return def.opcode === 'const' && typeof def.attrs.value === 'number' ? def.attrs.value | 0 : null;
+    }
+    const ins = incoming.get(v);
+    if (ins === undefined) {
+      return null; // an entry parameter
+    }
+    if (seen.has(v)) {
+      return undefined;
+    }
+    seen.add(v);
+    let k: number | undefined;
+    for (const a of ins) {
+      const c = constantOf(a, seen);
+      if (c === null || (c !== undefined && k !== undefined && c !== k)) {
+        return null;
+      }
+      k ??= c;
+    }
+    return k ?? null;
+  };
+  for (const { ins, not, add, ca } of pending) {
+    const k = constantOf(not.operands[0], new Set());
+    if (k === null || k === undefined) {
+      throw new PpcUnsupportedError(
+        `cannot lift '${name}': unmodelled instruction '${ins.mnemonic}' at 0x${ins.addr.toString(16)} — it reads ` +
+          `${ins.ops[1]}, which is not one constant on every path into its block, and a subfze over a register is the ` +
+          'upper word of a 64-bit negate',
+      );
+    }
+    const home = fn.blocks.find((b) => b.ops.includes(add))!;
+    if (~k === 0) {
+      replaceAllUsesWith(fn, add.results[0], ca);
+      home.ops.splice(home.ops.indexOf(add), 1);
+      home.ops.splice(home.ops.indexOf(not), 1);
+    } else {
+      Object.assign(not, { opcode: 'const', operands: [], attrs: { value: ~k } });
+    }
+  }
+}
+
 function mkCmp(ops: Op[], opc: Opcode, l: Value, r: Value): Value {
   const v = mkValue(T.unk(32));
   ops.push(mkOp(opc, { operands: [l, r], results: [v] }));
   return v;
 }
 
+/** The EABI's slots: the shared register-then-stack-word rule (`stackArgSlots`), refusing a stack
+ *  word read beside a floating-point argument — the FPRs are a separate file, so where a float
+ *  parameter falls among the integer ones is not in the object — or in a function whose own
+ *  declaration has a 64-bit or floating parameter, which takes words the integer count does not. */
+function ppcArgSlots(name: string, regs: ArgSlots, argRegs: readonly string[], own: FnProto | undefined): ArgSlots {
+  return stackArgSlots(regs, argRegs, (readKeys, top) => {
+    const float = readKeys.find(isFpKey);
+    const declared = Array.isArray(own?.params)
+      ? own.params.find((p) => isFloatingSpelling(p) || (declaredWidth(p) ?? 0) > 32)
+      : undefined;
+    if (float !== undefined || declared !== undefined) {
+      throw new PpcUnsupportedError(
+        `cannot lift '${name}': incoming stack argument ${top + 1} is read beside ` +
+          (float !== undefined ? `the floating-point argument in ${float}` : `a parameter declared '${declared}'`) +
+          ` — which words that argument takes ahead of the stack words is not modelled`,
+      );
+    }
+  });
+}
+
 /** The PowerPC / CodeWarrior frontend, registered for the `ppc` target. */
 export const ppcFrontend: Frontend = { id: 'ppc', inputFormat: 'objdump', lift };
+
+/** Internal surface for this module's own tests, and for nothing else (`frontend/frame-objects.ts`
+ *  says why it is not a plain export). */
+export const __testing = {
+  PARAM_AREA_AT,
+  /** the local area `lift` draws for one function of objdump text (`liftPrelude`), or its refusal */
+  frameOf: (name: string, asm: string, target: TargetDescription, prototypes: Prototypes = {}, asmData?: AsmData) => {
+    const instrs = parseDisasm(sliceSymbol(asm, name));
+    const jts = asmData ? recoverPpcJumpTables(instrs, asmData) : new Map<number, PpcJT>();
+    return liftPrelude(name, instrs, target, prototypes, jts).frame;
+  },
+};