@asmlift/core 0.8.1 → 0.10.0

package/src/frontend/ssa.ts

@@ -23,21 +23,58 @@ import {
   type SlotHomes,
   Value,
   type WriteOrder,
+  callArgs,
   defOpMap,
   mkOp,
   mkValue,
+  replaceAllUsesWith,
+  terminator,
+  truncateCallArgs,
 } from '../ir/core';
 import { pruneDeadParams, simplifyTrivialPhis } from '../ir/simplify';
-import { T } from '../ir/types';
-import { FrontendUnsupportedError } from './errors';
+import { type IrType, T } from '../ir/types';
+import { globalRegisterSymbol } from '../target';
+import { type FrontendRefusal, FrontendUnsupportedError } from './errors';
 
 export interface SsaBuilder {
   fn: Fn;
   irBlocks: Block[];
   /** Current SSA value of `reg` on entry to block `b` (creating phis/params as needed). */
   readVar(reg: string, b: number): Value;
+  /** Read `reg` as an argument register of a call whose arity was GUESSED — otherwise identical to
+   *  {@link readVar}, and used INSTEAD of it so the read carries no claim.
+   *
+   *  `fallbackArgc` counts argument registers by reaching definition, so a read here is a QUESTION
+   *  ("did the caller set this up?") rather than an assertion, and {@link trimClobberedCallArgs} is
+   *  what answers it. That answer already covers a register a call destroyed, and it covers it
+   *  EXHAUSTIVELY: destroyed on any path means not written-since-the-call on that path, so the
+   *  must-analysis drops it from the run and the operand goes — bar an argument register the ABI
+   *  ALIASES onto the return register, which a call that writes its result there does not list as
+   *  destroyed; one that writes none there does, and the trim reads that too. So none of these
+   *  reads can leave a destroyed value in the graph, and refusing the function over one would cost
+   *  a row the trim has already made correct.
+   *
+   *  THAT ALIASING IS A PER-TARGET FACT AND TWO TARGETS HERE DO NOT HAVE IT. ARM and PowerPC both
+   *  pass argument 0 in the return register (r0/r0, r3/r3), so on them the exemption is the whole
+   *  of the gap. MIPS returns in `v0` and passes in `a0`, so `clobberedByCall` lists `a0` for both
+   *  MIPS targets and there is no exemption to reason about — which is the sound direction, not a
+   *  hole.
+   *
+   *  A DECLARED arity uses `readVar`, and must: there the callee says the argument exists, so
+   *  reading a destroyed register for it is a wrong value with nothing to retract it.
+   *
+   *  One of the three call verbs `CallDeclarations.lower` owns ({@link noteCall}). */
+  readGuessedArg(reg: string, b: number): Value;
+  /** The value `reg` holds at the END of block `b` once `b` is filled, as the edges out of it carry
+   *  it; `null` before. A lookup, not a read: it records no read for `finish` to judge. */
+  readAtEnd(reg: string, b: number): Value | null;
   /** Record that `reg` now holds `v` within block `b`. */
   writeVar(reg: string, b: number, v: Value): void;
+  /** Every value written to a frame-slot key ({@link stackSlotKey}) or an incoming stack-argument key
+   *  ({@link stackArgKey}): a word the machine STORED to its stack. The slot is a variable here, so a
+   *  store nothing reloads leaves no op behind, and the value it stored looks unused — the dead-read
+   *  pin asks this (frontend/dead-reads.ts `spilled`). */
+  readonly frameWrites: ReadonlySet<Value>;
   /** Mark block `b` fully emitted (terminator pushed); seals any now-ready successors. */
   markFilled(b: number): void;
   /** Live-in parameter value → the key it arrived on (for calling-convention order). Usually an
@@ -54,7 +91,9 @@ export interface SsaBuilder {
    *  Never touches the block's definitions: the parameter is added and left unused, so any local
    *  value already flowing keeps flowing. Only meaningful on a block with no predecessors —
    *  elsewhere a parameter is a phi whose position is aligned with its predecessors' terminator
-   *  args, and appending an unpaired one would corrupt that. */
+   *  args, and appending an unpaired one would corrupt that. Nor on a register the live-in model
+   *  calls an uninitialised local's home (`LiveInModel.uninitRegs`): no caller fills it, so no
+   *  convention proves an argument there, and {@link entryValue} answers `undefined` for it. */
   ensureParam(key: string, b: number): void;
   /** Whether `reg` has a definition reaching block `b` (best-effort call-arity heuristic).
    *
@@ -63,15 +102,105 @@ export interface SsaBuilder {
    *  "a def reaches here" and "a value reaches here" are the same question only when every def is
    *  a value. */
   hasReachingDef(reg: string, b: number, accept?: (v: Value) => boolean): boolean;
+  /** {@link hasReachingDef}, with a path ending where a call destroyed `reg` (`noteCall`): whether a
+   *  value this function named reaches it here on some path. A path that brings the destroyed bytes
+   *  and one that brings a value still answer yes, and the read that follows refuses at `finish`. */
+  holdsValue(reg: string, b: number, accept?: (v: Value) => boolean): boolean;
+  /** The MUST question beside {@link hasReachingDef}'s MAY one: whether EVERY path into the end of
+   *  block `b` brings a definition of `reg` that `accept` takes, with no call destroying it since
+   *  (`noteCall`). A path from the entry that defines nothing answers no — the register holds the
+   *  caller's value there. Asked once every block is filled: before that, a back edge from a block
+   *  not yet filled carries definitions this walk cannot see, so it refuses to answer. */
+  everyReachingDef(reg: string, b: number, accept: (v: Value) => boolean): boolean;
+  /** The entry parameter `reg` still holds at this point of block `b`, taken WITHOUT a read. A read
+   *  leaves a definition behind, and `hasReachingDef` counts it as argument setup, so a frontend that
+   *  only moves the argument somewhere (a frame store) would raise the guessed arity of every later
+   *  prototype-less call. `undefined` where "still the entry value" is not shown: a definition or a
+   *  call reaches from some path, or a block on the way is not filled yet. */
+  entryValue(reg: string, b: number): Value | undefined;
+  /** Whether `reg` still holds its entry value at this point of block `b`, in {@link entryValue}'s
+   *  sense, answered without the entry parameter that one hands back. A callee-saved register stored
+   *  to its save slot holds the caller's value, which is no parameter, so asking must not mint one. */
+  holdsEntryValue(reg: string, b: number): boolean;
+  /** Whether block `b` WROTE `reg` since its last call so far (since its start if it made none).
+   *  Only a write counts: a read leaves a definition behind but is not one (`writeVar`). */
+  writtenSinceCall(reg: string, b: number): boolean;
+  /** Whether EVERY path into this point of block `b` wrote `reg` (or had a call destroy it) after
+   *  leaving the last block `stop` names: {@link writtenSinceCall} asked of `b` so far and, where `b`
+   *  did not write it, of each predecessor in turn. A path reaching a `stop` block, the entry, or a
+   *  block not filled yet answers no; a cycle adds no path the first visit did not judge. `visit`
+   *  is told each block the walk passes through after `b`. */
+  writtenOnEveryPath(reg: string, b: number, stop: (at: number) => boolean, visit?: (at: number) => void): boolean;
+  /** Record that the frontend CONSUMED `v`, which it read from a register in block `b`, without
+   *  placing it in any op: PowerPC's register save routine takes its frame address in r11 and is
+   *  erased, so the address appears in no operand. The refusal of a read a call destroyed
+   *  (`refuseStaleCallerSavedReads`) judges a read by its uses, and an op-less use is one too — left
+   *  unrecorded, a frame address a call destroyed would still be consumed, silently. */
+  useOutsideOps(v: Value, b: number): void;
   /** Record that block `b` makes a call HERE: the ABI's caller-saved registers stop being ones the
-   *  caller set up. Call it AFTER `recordGuessedCall` for the same instruction, and after writing
-   *  the call's own result — the result is the CALLEE's, so it must not count as caller-side
-   *  argument setup for whatever call comes next. */
-  noteCall(b: number): void;
+   *  caller set up.
+   *
+   *  THE CALL VERBS ARE `CallDeclarations.lower`'s (frontend/call-plan.ts): a frontend lowers a
+   *  call through it, and it alone calls this, {@link recordGuessedCall} and {@link readGuessedArg},
+   *  in one order — `recordGuessedCall`, then the call's own result, then this. The result is the
+   *  CALLEE's, so it must not count as caller-side argument setup for whatever call comes next.
+   *
+   *  `clobbers` are the registers the callee DESTROYS and leaves holding nothing this function can
+   *  name — {@link clobberedByCall} spells it, and it is the ABI's caller-saved set minus the
+   *  return register precisely because of the ordering above: the callee's own result is already
+   *  written there, so that one register does have a name. A callee that hands a STRUCT back in
+   *  that register writes no value a caller may read as a word, so none is written and the
+   *  register is listed here too — save one whose bytes a local of the struct is read back from,
+   *  which is written as the call's value and noted as an image ({@link noteStructImage}).
+   *  Required rather than optional: a call lowered without it would keep resolving a destroyed
+   *  register to its pre-call value, silently. */
+  noteCall(b: number, clobbers: readonly string[]): void;
+  /** The call {@link noteCall} just recorded in `b` left `reg` holding `image`, the bytes of a
+   *  struct its callee is declared to return there (frontend/call-plan.ts `registerStructLocal`).
+   *  A read takes it as the call's value, and the lift re-reads it off the struct's local; a GUESSED
+   *  arity does not count it, as it counts no register a call destroyed: a call nothing declares
+   *  may be handed the struct by value or a member of it, in the same register, and the bytes do
+   *  not say which. So the trim treats `reg` as destroyed, and a guess that still passes the image
+   *  refuses in `finish`. */
+  noteStructImage(b: number, reg: string, image: Value): void;
   /** Register a `call` op whose arity was GUESSED (no prototype), so `finish` can cut it back to the
    *  argument registers that were actually set up on every path (see {@link trimClobberedCallArgs}).
-   *  `abi` is the target's argument-register order and its return register. */
-  recordGuessedCall(op: Op, b: number, abi: { argRegs: string[]; returnReg: string }): void;
+   *  `abi` is the target's argument-register order and its return register. It snapshots what the
+   *  caller wrote, so it comes before the call's result is written ({@link noteCall}).
+   *  `passesCalleeResult`, `trimmed`, `withholdsSetupArgs`, `asksEveryCut` and `floor`: see
+   *  {@link GuessedCallSite}. */
+  recordGuessedCall(
+    op: Op,
+    b: number,
+    abi: { argRegs: string[]; returnReg: string },
+    passesCalleeResult?: (result: Value) => boolean,
+    trimmed?: (cut: readonly string[], kept: readonly string[]) => void,
+    withholdsSetupArgs?: () => boolean,
+    asksEveryCut?: () => boolean,
+    floor?: number,
+  ): void;
+  /** Require that nothing but `op` reads `v` once the function is lifted — no other op, no join that
+   *  survives, no frame store (`frameWrites`), no op-less use (`useOutsideOps`) — or call `refuse`.
+   *  A read the lowering has yet to see may come after `op` through a copy in a register the call
+   *  leaves alone, so the question is asked in `finish`, of the finished function. Its asker is the
+   *  guessed-arity gap (frontend/call-plan.ts `decideGap`). */
+  requireSoleReader(v: Value, op: Op, refuse: () => void): void;
+  /** Require that something other than a `ret` reads `v` once the function is lifted — an op, a
+   *  frame store or an op-less use, of `v` or of a join it reaches — or call `refuse`. Asked in
+   *  `finish`, as `requireSoleReader` is, and by the same asker: a decided gap at the first argument
+   *  register, where the call's result being read is what says the callee returns a word
+   *  (frontend/call-plan.ts `decideGap`). A `ret` does not count, since a frontend returns the
+   *  return register at every `ret` whatever the declared type. */
+  requireReader(v: Value, refuse: () => void): void;
+  /** Record that `v` is a value an instruction wrote as a SIDE EFFECT of its own job, which the
+   *  compiler may leave in a register nobody reads: the base writeback of a Thumb `ldmia`/`stmia`,
+   *  which has no form without one, and the base a PowerPC load or store with update advances. Such
+   *  a value is no evidence that anything wanted it, so the guessed-arity gap (frontend/call-plan.ts
+   *  `decideGap`) never takes one as an argument. agbcc copies a struct of 3+ words with
+   *  `ldmia r3!, {r4, r5, r6}; stmia r2!, {r4, r5, r6}` and leaves both writebacks dead in r2/r3. */
+  noteIncidentalWrite(v: Value): void;
+  /** Whether {@link noteIncidentalWrite} recorded `v`. */
+  isIncidentalWrite(v: Value): boolean;
   /** Remove trivial phis and enforce the frontend's postconditions; call once every block is
    *  filled. Throws FrontendUnsupportedError if a stack slot escaped as an entry parameter. */
   finish(): void;
@@ -80,7 +209,7 @@ export interface SsaBuilder {
 /** `preds` is per-EDGE (see the module header): one entry per CFG edge into each block. */
 // VARIABLE NAMES ARE NOT ALWAYS MACHINE REGISTERS. `readVar`/`writeVar` key on an arbitrary string,
 // and frontends mint VIRTUAL keys for storage the ISA has no register for — MIPS `sp@<off>` for a
-// stack slot (frontend/mips.ts), Thumb `@sarg<k>` for an incoming stack argument (frontend/thumb.ts).
+// stack slot (frontend/mips.ts), `@sarg<k>` for an incoming stack argument (`stackArgKey`).
 // A virtual key must be outside its ISA's register grammar so it cannot collide with a real one, and
 // a key read with no reaching def becomes a function PARAMETER by the live-in path below — which is
 // how both of those capabilities get their parameters without a new opcode or pass.
@@ -95,7 +224,7 @@ export interface LiveInModel {
    *
    *  Asserts more than ownership: that this function's own stores are the ONLY writer. An address
    *  into the frame that escapes to anything which could write it stops that holding, and the
-   *  retraction is the frontend's obligation (frontend/thumb.ts, after the frame-object audit). */
+   *  retraction is the frontend's obligation (the frame-object audit, frontend/frame-objects.ts). */
   ownedLocals?: { from: number; to: number };
   /** Storage this function DECLARES as locals ⇒ a `[sp,#k]` spill here is a DECLARATION RANK
    *  (`ir/core.ts` `SlotHomes`, ordered by `l3/slotorder.ts`). `[from, to)`.
@@ -125,8 +254,8 @@ export interface LiveInModel {
    *  eight more). None reaches the ordering today, for an unrelated reason (`l3/slotorder.ts`'s
    *  REACH note), so nothing downstream is guarding this.
    *
-   *  ABSENT ⇒ NO STAMP. MIPS and PPC declare no frame partition at all, so they stamp nothing,
-   *  which is the refusing direction. */
+   *  ABSENT ⇒ NO STAMP. MIPS and PPC declare none (MIPS claims `ownedLocals` alone), so they stamp
+   *  nothing, which is the refusing direction. */
   declaredLocals?: { from: number; to: number };
   /** Storage the CALLER wrote — incoming stack arguments ⇒ a def-less read is a parameter.
    *  `[from, to)`. O32's register-parameter home area belongs to NEITHER range: caller-owned, but
@@ -138,13 +267,23 @@ export interface LiveInModel {
    *  saved the register (so it is one the compiler was free to home a local in). The ABI half alone
    *  describes the CALLER, and asm that follows no ABI — hand-written, or a mid-function fragment,
    *  which klonoa's `bl`-as-a-long-branch splits produce for real — is genuinely handed live values
-   *  in registers it never saved. Passing the ABI list unfiltered cost the MP2K engine's
-   *  `ChnVolSetAsm` its two-pointer signature and left it storing through `uninit_r4`, silently.
+   *  in registers it never saved. Passing the ABI list unfiltered left the MP2K engine's
+   *  `ChnVolSetAsm` storing through `uninit_r4`, silently; such a read is
+   *  `unsavedCalleeSavedRegs`' instead.
    *
-   *  The save is a MEASUREMENT, like the frame's, and belongs to whoever can make it — Thumb reads
-   *  the leading push run (`savedRegs`); a frontend that cannot measure it passes nothing here and
+   *  The save is a MEASUREMENT, like the frame's, and belongs to whoever can make it. Thumb reads
+   *  its `push`es (`savedRegs`; past the prologue, `bodySavedRegs`). PPC reads every save in the
+   *  entry block of a register nothing before it named (`prologueSavedRegs`), because mwcc
+   *  interleaves its saves with the body (`stw r31; mr r31,r3; stw r30`); "nothing named it first"
+   *  is the condition Thumb's leading run meets by construction; MIPS reads its entry block the same way
+   *  (frontend/mips.ts `prologueSavedRegs`). A frontend that cannot measure it passes nothing here and
    *  keeps the parameter it would have got anyway.
    *
+   *  The one register class exempt from the save is the ABI's scratch set (`target.scratchRegs`):
+   *  a callee may use one with no save at all, so demanding one would refuse a local the compiler
+   *  homed there with no prologue (agbcc's `ip`, mwcc's `r0`). `registerLiveIns` composes both
+   *  halves for every frontend, so this list is never assembled by hand.
+   *
    *  The frame's sole-writer obligation has no counterpart here and needs none: a register has no
    *  address, so nothing outside this function can name it and there is no escape to retract.
    *
@@ -155,6 +294,41 @@ export interface LiveInModel {
    *
    *  Declaring this obliges `argRegs` below, and the two must be DISJOINT. */
   uninitRegs?: readonly string[];
+  /** Of `uninitRegs`, the ones something outside the C convention hands an input in
+   *  (`target.hiddenInputRegs`). The entry value of one must reach A JOIN that also takes a
+   *  definition the entry value does not feed — the shape of a local the compiler assigned on one
+   *  arm, which may also be read before that assignment. A join alone is not enough: an input
+   *  carried round a loop meets its own next value at the loop header. Meeting no such join, it is
+   *  the input, and `finish` refuses rather than spell it `uninit_<reg>`. */
+  hiddenInputRegs?: readonly string[];
+  /** Registers the ABI requires a callee to PRESERVE (`target.nonArgRegs` less `target.scratchRegs`)
+   *  that this function did NOT save — the third side of the register partition. No caller passes
+   *  an argument in one, and the compiler homed no local of this function there, so a value it holds
+   *  on entry is one the function shares with every other: a FILE-SCOPE GLOBAL REGISTER VARIABLE
+   *  (`register int g asm("r8");`), which is exactly what agbcc, gcc 2.7.2, KMC and mwcc 2.4 compile
+   *  `return g;` to (`mov r0, r8`, `move v0,s0`, `mr r3,r14`). gcc's `globalize_reg` (regclass.c)
+   *  marks such a register fixed and call-used, so no prologue saves it. A def-less read of one
+   *  refuses: naming it a parameter puts a value in the signature that a C caller would pass in an
+   *  argument register. A WRITE to one is visible to the caller just the same. Both refuse in
+   *  `finish`, of the finished function — unless the compiler can spell the global, which is
+   *  `globalRegs`.
+   *
+   *  Disjoint from `argRegs` and `uninitRegs`, checked with them. */
+  unsavedCalleeSavedRegs?: readonly string[];
+  /** Of `unsavedCalleeSavedRegs`, the ones the function does save or restore, but not around every
+   *  use or not restored at every return (a `pop` with no `push` before it, a `push` past a read, a
+   *  use past the restore). Refused like the rest, and named apart only so the refusal says what it
+   *  saw. */
+  misSavedRegs?: readonly string[];
+  /** Where the frontend looks for the saves it measures, for those refusals to name: the partition
+   *  is only as wide as that look, and a save it does not read is still a save. */
+  saveSite?: string;
+  /** The registers of `unsavedCalleeSavedRegs`' kind the target can declare a global register
+   *  variable in (`target.globalRegisterVariables`), each to the name `__asm__` takes. Every read of
+   *  one is a load of that global and every write a store to it, so a call between two reads may
+   *  change it, as it may change any global. Disjoint from the other three lists, checked with
+   *  them. */
+  globalRegs?: ReadonlyMap<string, string>;
   /** Registers the ABI DOES pass arguments in — the other side of the register partition, and the
    *  only reason the side above is checkable rather than believed. The frame coordinate declares
    *  both of its sides and refuses an offset in neither; this one declares both and refuses a key
@@ -166,6 +340,13 @@ export interface LiveInModel {
    *  `readRecursive` cannot catch that on its own — it never sees the argument registers, because
    *  a read of one takes the parameter path by falling through every other case. */
   argRegs?: readonly string[];
+  /** The argument words the function's own declaration fills (`proto.ts` `ownArgumentWords`), where
+   *  it states them. A register past them is in `uninitRegs`; an INCOMING STACK ARGUMENT at or past
+   *  them is refused, because no local lives in the caller's frame and the read says the
+   *  declaration is wrong. Taken as a parameter it would be named by position, one slot below the
+   *  registers the declaration left out: `int st2(int a,int b,int c,int d,int e){ return g(a)+e; }`
+   *  declared with two parameters would lift `st2(a0, a1, a2)`, returning the fifth argument as `a2`. */
+  ownArgWords?: number;
 }
 
 /** The register partition's postcondition, checked at the point of USE. `uninitRegs` asserts "no
@@ -191,29 +372,305 @@ function checkedLiveInModel(fnName: string, m: LiveInModel): LiveInModel {
         `and one the ABI does not pass arguments in`,
     );
   }
+  const unsaved = [...(m.unsavedCalleeSavedRegs ?? []), ...(m.globalRegs?.keys() ?? [])];
+  const twice = unsaved.filter((r, i) => args.includes(r) || m.uninitRegs?.includes(r) || unsaved.indexOf(r) !== i);
+  if (twice.length > 0) {
+    throw new Error(
+      `lifting '${fnName}': the live-in model lists ${twice.join(', ')} as an unsaved callee-saved ` +
+        `register AND as an argument register or an uninitialised local's home`,
+    );
+  }
   return m;
 }
 
+/** A `scratchRegs` entry outside `nonArgRegs` is inert, and inert is how a partition rots: the list
+ *  would go on reading as if it exempted something. Refused as a target bug, like the
+ *  argRegs/uninitRegs contradiction `checkedLiveInModel` refuses, rather than declined as a property
+ *  of the input. */
+export function assertScratchRegsPartitioned(target: {
+  id: string;
+  nonArgRegs?: readonly string[];
+  scratchRegs?: readonly string[];
+}): ReadonlySet<string> {
+  const scratchRegs = new Set(target.scratchRegs ?? []);
+  for (const r of scratchRegs) {
+    if (!(target.nonArgRegs ?? []).includes(r)) {
+      throw new Error(`target '${target.id}': scratch register ${r} is not among the non-argument registers`);
+    }
+  }
+  return scratchRegs;
+}
+
+/** ONE SPELLING PER REGISTER, WHERE A FUNCTION WRITES ONE REGISTER TWO WAYS. The builder keys a
+ *  register by its operand text, and so does every save measurement a frontend makes, so `sl` and
+ *  `r10` (or O32's `s8` and `fp`) would be two variables and two partition entries for one register:
+ *  `mov sl, r0; mov r0, r10` would return a second parameter where the machine returns the first,
+ *  and a register saved as `s8` and written as `fp` would read as never saved, its writes as a
+ *  global's. `pairs`
+ *  is each register's two spellings, the one kept first. Only a function that names BOTH of a pair
+ *  is rewritten — every other keeps the spelling it was written in, and with it the name of any local
+ *  homed there — and an alias is rewritten wherever it stands as a whole word of an operand, so a
+ *  memory operand's base (`8(fp)`) is too. */
+export function unifyRegisterSpellings(
+  instrs: Iterable<{ ops: string[] }>,
+  pairs: readonly (readonly [keep: string, alias: string])[],
+): void {
+  const all = [...instrs];
+  const words = new Set(all.flatMap((ins) => ins.ops.flatMap((op) => op.match(/[A-Za-z_$.][\w$.]*/g) ?? [])));
+  for (const [keep, alias] of pairs) {
+    if (!words.has(keep) || !words.has(alias)) {
+      continue;
+    }
+    const re = new RegExp(`(?<![\\w$.])${alias}(?![\\w$.])`, 'g');
+    for (const ins of all) {
+      ins.ops = ins.ops.map((op) => op.replace(re, keep));
+    }
+  }
+}
+
+/** THE REGISTER HALF OF THE LIVE-IN MODEL (`LiveInModel.uninitRegs` and `argRegs`), composed here
+ *  once for every frontend that claims it, so that no frontend can drop a half of the rule. A
+ *  register is an uninitialised local's home when the ABI passes no argument in it
+ *  (`target.nonArgRegs`) AND either the ABI lets a callee use it with no save (`target.scratchRegs`,
+ *  checked against `nonArgRegs`) or this function saved it — `savedRegs`, the frontend's measurement
+ *  of its saves. The rest — callee-saved, and not saved — is `globalRegs` where the target can
+ *  declare a global register variable there and `unsavedCalleeSavedRegs` where it cannot, or where
+ *  the function saves or restores it but not around every use of it (`misSaved`, a measurement only
+ *  Thumb makes, whose `push` and `pop` are nothing but saves and restores): compiled code never saves
+ *  a global register variable's register, and asm that saves one restores it too, so its writes are
+ *  not the caller's and its entry value is no global's. A target stating no `nonArgRegs` claims no
+ *  partition and gets an empty model, so every def-less read stays a parameter.
+ *
+ *  THE FUNCTION'S OWN DECLARATION MOVES THE PARTITION'S EDGE. `ownWords` is how many argument
+ *  words it can fill (`proto.ts` `ownArgumentWords`, an upper bound), and an argument register at
+ *  or past it is one no caller fills for THIS function, so it moves from `argRegs` to `uninitRegs`.
+ *  It needs no save: every argument register is one a callee may use unsaved (`clobberedByCall`
+ *  checks they are caller-saved). KMC homes a local in `a2` past `uninit_spill(int k, int *p)`, which
+ *  without the edge reads as a third parameter. Absent (no declaration, or one that bounds
+ *  nothing), the ABI's whole list stays arguments. */
+export function registerLiveIns(
+  target: {
+    id: string;
+    argRegs: readonly string[];
+    nonArgRegs?: readonly string[];
+    scratchRegs?: readonly string[];
+    hiddenInputRegs?: readonly string[];
+    globalRegisterVariables?: { regs: Readonly<Record<string, string>> };
+  },
+  savedRegs: ReadonlySet<string>,
+  ownWords?: number,
+  misSaved: ReadonlySet<string> = new Set(),
+): Pick<
+  LiveInModel,
+  | 'uninitRegs'
+  | 'argRegs'
+  | 'hiddenInputRegs'
+  | 'ownArgWords'
+  | 'unsavedCalleeSavedRegs'
+  | 'misSavedRegs'
+  | 'globalRegs'
+> {
+  const scratchRegs = assertScratchRegsPartitioned(target);
+  for (const r of target.hiddenInputRegs ?? []) {
+    if (!scratchRegs.has(r)) {
+      throw new Error(`target '${target.id}': hidden-input register ${r} is not among the scratch registers`);
+    }
+  }
+  if (target.nonArgRegs === undefined) {
+    return {};
+  }
+  const filled = ownWords === undefined ? target.argRegs.length : Math.min(ownWords, target.argRegs.length);
+  const unsaved = target.nonArgRegs.filter((r) => !scratchRegs.has(r) && !savedRegs.has(r));
+  const spelled = target.globalRegisterVariables?.regs ?? {};
+  return {
+    uninitRegs: [
+      ...target.nonArgRegs.filter((r) => scratchRegs.has(r) || savedRegs.has(r)),
+      ...target.argRegs.slice(filled),
+    ],
+    argRegs: target.argRegs.slice(0, filled),
+    hiddenInputRegs: target.hiddenInputRegs,
+    unsavedCalleeSavedRegs: unsaved.filter((r) => !Object.hasOwn(spelled, r) || misSaved.has(r)),
+    misSavedRegs: unsaved.filter((r) => misSaved.has(r)),
+    globalRegs: new Map(
+      unsaved.filter((r) => Object.hasOwn(spelled, r) && !misSaved.has(r)).map((r) => [r, spelled[r]]),
+    ),
+    ...(ownWords === undefined ? {} : { ownArgWords: ownWords }),
+  };
+}
+
+/** REFUSE A WRITE TO A SAVED REGISTER THAT THE CALLER SEES. A register the frontend read as saved
+ *  (its save store, `LiveInModel.uninitRegs`) is a local's home, and the lift drops what is left
+ *  in it at a return — right only if every path restores it after its last write. A write past the
+ *  restore (`lw s0,4(sp); move s0,a0; jr ra`), a reload from a word that is not its save, or a
+ *  return its restore never reaches leaves the caller holding a value the C never assigns, so the
+ *  function refuses here rather than drop it. MIPS and PowerPC read a save as an ordinary store in
+ *  the entry block, so this is asked once the blocks are filled; Thumb asks the same of its
+ *  `push`/`pop` pairs in `bodySavedRegs`.
+ *
+ *  A forward may-dataflow over the asm: a register is DIRTY from a write (`writes`) until a restore
+ *  of it (`restores`: the instructions the frontend lowered as reloading its save word), and dirty
+ *  at the end of a block that returns is the refusal. Compiled code restores every saved register
+ *  in its epilogue, after its last write, so it never fires there; a path that never writes the
+ *  register needs no restore. */
+export function refuseSavedRegisterLeaks<I extends { addr: number }>(
+  name: string,
+  blocks: readonly { instrs: readonly I[]; returns: boolean }[],
+  preds: readonly (readonly number[])[],
+  saved: ReadonlySet<string>,
+  writes: (ins: I, reg: string) => boolean,
+  restores: ReadonlyMap<I, ReadonlySet<string>>,
+): void {
+  if (saved.size === 0) {
+    return;
+  }
+  // register → the address of a write no restore has answered since, on some path
+  const outs: (Map<string, number> | null)[] = blocks.map(() => null);
+  const transfer = (b: number, dirty: Map<string, number>) => {
+    for (const ins of blocks[b].instrs) {
+      for (const r of saved) {
+        if (restores.get(ins)?.has(r)) {
+          dirty.delete(r);
+        } else if (writes(ins, r)) {
+          dirty.set(r, ins.addr);
+        }
+      }
+    }
+    return dirty;
+  };
+  const inOf = (b: number) => {
+    const dirty = new Map<string, number>();
+    for (const p of preds[b]) {
+      outs[p]?.forEach((at, r) => dirty.has(r) || dirty.set(r, at));
+    }
+    return dirty;
+  };
+  for (let changed = true; changed;) {
+    changed = false;
+    blocks.forEach((_, b) => {
+      if (b !== 0 && !preds[b].some((p) => outs[p] !== null)) {
+        return;
+      }
+      const out = transfer(b, inOf(b));
+      if (outs[b] === null || out.size !== outs[b]!.size) {
+        outs[b] = out;
+        changed = true;
+      }
+    });
+  }
+  blocks.forEach((blk, b) => {
+    const [leak] = blk.returns ? [...(outs[b] ?? [])] : [];
+    if (leak !== undefined) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': the write to saved ${leak[0]} at 0x${leak[1].toString(16)} reaches a return ` +
+          `with no restore of ${leak[0]} after it, so the caller sees it — no C local spells a write ` +
+          'that outlives the function',
+      );
+    }
+  });
+}
+
+/** A read whose register may be holding a callee's leftover — see `refuseStaleCallerSavedReads`. */
+interface StaleRead {
+  reg: string;
+  value: Value;
+  block: number;
+  /** the block's op count when the read happened. The uses this read answers for start here: an op
+   *  before it consumed a value read while the register was still this function's own, and the same
+   *  register really can be read on both sides of a call without its value changing. */
+  fromOp: number;
+  /** a call in this very block destroyed it, so the predecessors have nothing to add. */
+  local: boolean;
+  /** The OTHER keys this block wrote the read's value into after it — a `move` or a slot store of
+   *  the destroyed register, which carries the callee's leftover out of the block under a name no
+   *  call destroyed. */
+  carriedBy: Set<string>;
+}
+
+/** The registers a call leaves holding nothing the CALLER can name — what {@link SsaBuilder.noteCall}
+ *  wants. The ABI's caller-saved set minus the return register: `CallDeclarations.lower` writes the
+ *  callee's own result there before recording the clobber, so that one register does have a name
+ *  and the rest do not.
+ *
+ *  CHECKED rather than trusted, the way `checkedLiveInModel` checks the register partition: a
+ *  register the caller passes arguments in is by construction one the callee may destroy, so
+ *  `argRegs` must be a subset of `callerSaved`. A target spelling one of them differently in the two
+ *  lists would silently stop refusing reads of it. */
+export function clobberedByCall(target: {
+  callerSaved: readonly string[];
+  argRegs: readonly string[];
+  returnReg: string;
+}): readonly string[] {
+  const missing = target.argRegs.filter((r) => !target.callerSaved.includes(r));
+  if (missing.length > 0) {
+    throw new Error(
+      `this target passes arguments in ${missing.join(', ')} but does not list ${missing.length > 1 ? 'them' : 'it'} ` +
+        `as caller-saved, so a read of one past a call cannot be refused`,
+    );
+  }
+  return target.callerSaved.filter((r) => r !== target.returnReg);
+}
+
 export function makeSsaBuilder(
   name: string,
   blockCount: number,
   preds: number[][],
-  /** A supplier because half the partition is MEASURED rather than declared: Thumb's local area
-   *  comes from a prologue walk that runs after this call. Evaluated once, on first use. Omitted ⇒
+  /** Evaluated once, at its first use, which is where `checkedLiveInModel` checks it. Omitted ⇒
    *  no partition is claimed, so every slot refuses and every register is a parameter. */
   liveInOf: () => LiveInModel = () => ({}),
+  /** The type of a value that stands for `key` before any instruction defines it — a parameter, a
+   *  phi. A register FILE, not a register: the FPU's keys are floats wherever they arrive, and every
+   *  other key is `unknown` for type recovery to settle. */
+  keyType: (key: string) => IrType | undefined = () => undefined,
+  /** `LiveInModel.globalRegs`, which every read and write consults — so it is handed over when the
+   *  builder is made, not when the model is first used. The frontend passes the same map in its
+   *  model, where it is checked against the other lists. */
+  globalRegs: ReadonlyMap<string, string> = new Map(),
 ): SsaBuilder {
+  const unset = (key: string): IrType => keyType(key) ?? T.unk(32);
   let modelMemo: LiveInModel | null = null;
   // Checked ONCE, where the model is materialised — every function with a parameter reads a
   // register def-lessly, so this runs on effectively every lift rather than only on the rare
   // function that reads the mis-listed register. A contradictory or half-declared partition is a
   // bug in the TARGET, not an unliftable function, so it throws a plain Error: a decline would
   // report the target's typo as a property of the input, once per function, forever.
-  const model = (): LiveInModel => (modelMemo ??= checkedLiveInModel(name, liveInOf()));
+  const model = (): LiveInModel => (modelMemo ??= sameGlobalRegs(checkedLiveInModel(name, liveInOf())));
+  // The model's `globalRegs` is the copy checked against the other lists, and the builder's own the
+  // one every read and write consults: two copies of one fact, which must be one.
+  const sameGlobalRegs = (m: LiveInModel): LiveInModel => {
+    const theirs = m.globalRegs ?? new Map<string, string>();
+    if (theirs.size !== globalRegs.size || [...theirs].some(([r, n]) => globalRegs.get(r) !== n)) {
+      throw new Error(`lifting '${name}': the live-in model's global registers are not the ones the builder was given`);
+    }
+    return m;
+  };
+  // What the refusals of unsaved callee-saved registers say of their saves (`misSavedRegs`).
+  const unsavedWhy = (regs: readonly string[]): string => {
+    const mis = regs.filter((r) => model().misSavedRegs?.includes(r));
+    const never = regs.filter((r) => !mis.includes(r));
+    return [
+      ...(mis.length
+        ? [
+            `saves or restores ${mis.join(', ')} but not around every use of it, restored at every return, on every path`,
+          ]
+        : []),
+      ...(never.length ? [`no ${model().saveSite ?? 'save this lift reads'} saves ${never.join(', ')}`] : []),
+    ].join(', and ');
+  };
+  // What compiled code means by such a register — but not by one the function saves and breaks the
+  // save of (`misSavedRegs`), which the measurement has shown is no global's.
+  const globalNote = (regs: readonly string[]): string =>
+    regs.some((r) => model().misSavedRegs?.includes(r)) ? '' : ' (a global register variable)';
   const inRange = (off: number, r?: { from: number; to: number }) => r !== undefined && off >= r.from && off < r.to;
   const irBlocks: Block[] = Array.from({ length: blockCount }, () => ({ params: [] as Value[], ops: [] }));
   // `writeOrder` and `slotHomes` are filled in below, where the builder's counters live.
-  const fn: Fn = { name, blocks: irBlocks, writeOrder: undefined, slotHomes: undefined, paramEvidence: undefined };
+  const fn: Fn = {
+    name,
+    blocks: irBlocks,
+    writeOrder: undefined,
+    slotHomes: undefined,
+    paramEvidence: undefined,
+    localObjects: undefined,
+  };
 
   const defs: Array<Map<string, Value>> = irBlocks.map(() => new Map());
   const sealed: boolean[] = irBlocks.map(() => false);
@@ -224,6 +681,9 @@ export function makeSsaBuilder(
   // arrives as a PHI — which is what happens when the entry block is itself a loop header — is
   // invisible to the escape check below. Braun's construction gives no other way to tell.
   const phiKey = new Map<Value, string>();
+  // The entry value of a register a runtime hands a hidden input in (`LiveInModel.hiddenInputRegs`),
+  // minted as an uninitialised local, for `finish` to check that a join takes it.
+  const hiddenEntryValues = new Map<Value, string>();
   const paramReg = new Map<Value, string>();
   // Parameters created by ensureParam that nothing has read yet. They are deliberately NOT in
   // `defs`: a parameter asserted because a calling convention proves it exists is not evidence that
@@ -243,6 +703,38 @@ export function makeSsaBuilder(
   // wrapper, and a MISSED write under-counts an arity — which drops a real argument silently.
   const writtenSinceCall: Array<Set<string>> = irBlocks.map(() => new Set());
   const callsIn = new Set<number>();
+  // WHAT A CALL DESTROYED, which is a DIFFERENT question from the one above and not its complement.
+  // `writtenSinceCall` asks "did the CALLER set this register up" — a MUST question, whose answer
+  // for the return register is deliberately no, because `CallDeclarations.lower` writes the
+  // callee's result there before recording the clobber. This asks "does this register still hold a
+  // value anyone can name" — a MAY question, whose answer for that same register is yes. One
+  // analysis serving both would have to be wrong about one of them, so they are two, and each names
+  // the other.
+  //
+  // `clobberedLocal[b]`: destroyed by a call in `b` with nothing written since. `decidedLocal[b]`:
+  // registers `b` has settled either way, so a register in neither inherits its fate from the
+  // predecessors.
+  const clobberedLocal: Array<Set<string>> = irBlocks.map(() => new Set());
+  const decidedLocal: Array<Set<string>> = irBlocks.map(() => new Set());
+  // `imageLocal[b]`: holding a struct's image a call in `b` handed back, with nothing written since
+  // (`noteStructImage`) — destroyed for a guessed arity alone
+  const imageLocal: Array<Set<string>> = irBlocks.map(() => new Set());
+  const structImages = new Set<Value>();
+  const staleCandidates: StaleRead[] = [];
+  const staleByValue = new Map<Value, StaleRead[]>();
+  /** The op-less uses `useOutsideOps` recorded, each at the op count of its block when it happened. */
+  const usesOutsideOps: Array<{ value: Value; block: number; atOp: number }> = [];
+  /** The sole-reader obligations `requireSoleReader` recorded, checked in `finish`. */
+  const soleReaders: Array<{ value: Value; op: Op; refuse: () => void }> = [];
+  /** The reader obligations `requireReader` recorded, checked in `finish`. */
+  const readObligations: Array<{ value: Value; refuse: () => void }> = [];
+  /** The side-effect values `noteIncidentalWrite` recorded. */
+  const incidentalWrites = new Set<Value>();
+  // `readVar` runs once per operand, so a memo per (register, verdict) keeps the record list
+  // proportional to what a block READS rather than to how many times it reads it. The value a key
+  // holds only changes at a write, and the verdict only flips at a call, so a run of identical
+  // reads collapses to the earliest — which is the one whose uses cover the rest.
+  const staleSeen: Array<Map<string, Value>> = irBlocks.map(() => new Map());
   const guessedCalls: GuessedCallSite[] = [];
   let abiSeen: { argRegs: string[]; returnReg: string } = { argRegs: [], returnReg: '' };
 
@@ -256,10 +748,11 @@ export function makeSsaBuilder(
   fn.writeOrder = writeOrder;
 
   // SLOT HOMES (ir/core.ts `SlotHomes`). Measured HERE, in the shared builder, for the same
-  // reason the clobber set and the write order are: BOTH frontends already spell a word spill as
-  // a write to the key `sp@k` (`stackSlotKey`, below), so the frontend supplies the coordinate
-  // and one rule applies it — a per-frontend stamp would be right only while each remembered to
-  // route every slot write past a wrapper, and a missed write is a local with no frame order.
+  // reason the clobber set and the write order are: every slot-modelling frontend (MIPS, Thumb,
+  // PowerPC) spells a word spill as a write to the key `sp@k` (`stackSlotKey`, below), so the
+  // frontend supplies the coordinate and one rule applies it — a per-frontend stamp would be right
+  // only while each remembered to route every slot write past a wrapper, and a missed write is a
+  // local with no frame order.
   // Empty rather than absent on a function that spills nothing: this builder measured it.
   const slotHomes: SlotHomes = new Map();
   fn.slotHomes = slotHomes;
@@ -270,7 +763,7 @@ export function makeSsaBuilder(
     }
     // THE KEY SPELLING CANNOT DECIDE THIS, exactly as `readRecursive` says below of a def-less
     // read: `sp@40` is a local on one ABI and the caller's fifth argument on another. So the stamp
-    // asks the frontend for a partition and refuses where no answer exists. The two frontends
+    // asks the frontend for a partition and refuses where no answer exists. The frontends
     // differ here and the refusal is what makes that safe: Thumb declares a range; MIPS declares NO
     // partition (frontend/mips.ts: `addiu sp,sp,±N` is transparent, so its slot keys span O32's
     // caller-owned register-parameter home area `[0,16)` and the incoming stack arguments above
@@ -306,6 +799,16 @@ export function makeSsaBuilder(
     // separately declared SCALARS; intra-aggregate offsets are fixed by the aggregate's layout at
     // expand time.
     //
+    // A FORM OF THAT RECOVERY EXISTS, and what keeps the condition unmet is two guards, this
+    // function's and one in another file. The frame-object audit declares an untyped frame object
+    // as `u8 name[N]` over the DECLARED range (`notTheWholeArea`, frontend/frame-objects.ts) and
+    // refuses it where the slot model keys any byte of that range (`overSlot`, refused by
+    // `failIfSlotKeysIt`). The slots it does share a frame with lie below `declaredLocals` — the
+    // licensed outgoing argument words — and the `declaredLocals` test above stamps none of them.
+    // So no slot home sits beside one of those arrays and nothing here is ever asked to order the
+    // two. Letting a keyed slot into the declared range beside the array is what meets the
+    // condition, and it has to bring `l3/slotorder.ts` with it.
+    //
     // UNION, not a choice (ir/core.ts `SlotHomes`): whether the earlier declaration rank is the
     // lower or the higher offset is a per-COMPILER fact, and this builder is handed a name, a
     // block count, a predecessor list and a live-in model — no target. `l3/slotorder.ts` reduces.
@@ -320,7 +823,7 @@ export function makeSsaBuilder(
   };
   // PARAMETER EVIDENCE (ir/core.ts `ParamEvidence`), measured HERE for the same reason the clobber
   // set, the write order and the slot homes are: a slot write is a `writeVar` and a slot read is a
-  // `readVar` in BOTH slot-modelling frontends, so one rule covers them and no frontend can forget
+  // `readVar` in every slot-modelling frontend, so one rule covers them and no frontend can forget
   // to route a store past a wrapper. The two directions are NOT symmetric: raise/paramwidth.ts reads
   // an absent observation as proof the declaration was wide, so a missed one costs a narrowing while
   // a spurious one retypes a parameter the machine never declared narrow.
@@ -362,23 +865,119 @@ export function makeSsaBuilder(
     }
   };
 
+  const frameWrites = new Set<Value>();
+  // Every key some instruction wrote, for `finish` to find a write to an unsaved callee-saved
+  // register (`LiveInModel.unsavedCalleeSavedRegs`).
+  const writtenKeys = new Set<string>();
+  // A GLOBAL REGISTER VARIABLE (`LiveInModel.globalRegs`) is memory, not an SSA variable: each
+  // read loads the global and each write stores it, at the point the instruction runs, so nothing
+  // is forwarded across a call that may change it and the caller sees every write. Appended to the
+  // block being filled, which is where a frontend puts the op that reads or writes the register.
+  const globalLoads = new Set<Value>();
+  const globalCell = (reg: string, b: number): Value => {
+    if (filled[b]) {
+      throw new Error(`lifting '${name}': global register ${reg} accessed in block ${b} after it was filled`);
+    }
+    const asmName = globalRegs.get(reg)!;
+    const cell = mkValue(T.unk(32));
+    irBlocks[b].ops.push(
+      mkOp('gaddr', { results: [cell], attrs: { sym: globalRegisterSymbol(asmName), globalRegister: asmName } }),
+    );
+    return cell;
+  };
+  // A load of one nothing reads is a frontend reading the register for a question of its own (MIPS
+  // asks of an `addu` operand more than once), not an instruction's read: reading a register does
+  // nothing, so it goes, with its address.
+  const dropUnreadGlobalRegisterLoads = (): void => {
+    if (globalRegs.size === 0) {
+      return;
+    }
+    const read = new Set<Value>();
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        op.operands.forEach((v) => read.add(v));
+        op.successors.forEach((s) => s.args.forEach((v) => read.add(v)));
+      }
+    }
+    for (const blk of irBlocks) {
+      const dead = new Set<Value>();
+      for (const op of blk.ops) {
+        if (op.opcode === 'load' && !read.has(op.results[0]) && globalLoads.has(op.results[0])) {
+          dead.add(op.results[0]);
+          dead.add(op.operands[0]);
+        }
+      }
+      blk.ops = blk.ops.filter((op) => !op.results.some((r) => dead.has(r)));
+    }
+  };
   const writeVar = (reg: string, b: number, v: Value) => {
+    if (globalRegs.has(reg)) {
+      irBlocks[b].ops.push(mkOp('store', { operands: [globalCell(reg, b), v], attrs: { off: 0, width: 4 } }));
+      return;
+    }
+    writtenKeys.add(reg);
+    if (slotKeyOffset(reg) !== null || reg.startsWith(STACK_ARG_PREFIX)) {
+      frameWrites.add(v);
+    }
     noteSlotHome(reg, v);
     noteSlotTraffic(reg, v);
+    for (const c of staleByValue.get(v) ?? []) {
+      if (c.block === b && c.reg !== reg) {
+        c.carriedBy.add(reg);
+      }
+    }
     if (b === 0 && !firstEntryWrite.has(reg)) {
       firstEntryWrite.set(reg, v);
     }
     writtenSinceCall[b].add(reg);
+    clobberedLocal[b].delete(reg);
+    imageLocal[b].delete(reg);
+    decidedLocal[b].add(reg);
     defs[b].set(reg, v);
     lastWriteAt[b].set(reg, writeCount[b]++);
   };
   const readVar = (reg: string, b: number): Value => {
+    if (globalRegs.has(reg)) {
+      const loaded = mkValue(T.unk(32));
+      globalLoads.add(loaded);
+      const cell = globalCell(reg, b);
+      irBlocks[b].ops.push(
+        mkOp('load', { operands: [cell], results: [loaded], attrs: { off: 0, width: 4, signed: true } }),
+      );
+      return loaded;
+    }
+    const v = readAny(reg, b);
+    noteStaleCandidate(reg, b, v);
+    return v;
+  };
+  /** The lookup, with no claim attached. The FRONTEND's read is what asserts "this register holds
+   *  this value here"; the lookups this construction makes on its own — a single predecessor's
+   *  definition, a phi's operand at each in-edge — are how that one read is answered, not further
+   *  reads to be judged. Recording them would blame a use in one block on a read in another. */
+  const readAny = (reg: string, b: number): Value => {
     noteSlotTraffic(reg, null);
     return defs[b].get(reg) ?? readRecursive(reg, b);
   };
+  /** Record a read whose register MIGHT be holding a callee's leftover, for `finish` to judge. A
+   *  register this block has already settled answers here and needs no record; one it has not takes
+   *  its answer from the predecessors, which are not all filled yet. */
+  const noteStaleCandidate = (reg: string, b: number, v: Value) => {
+    const local = clobberedLocal[b].has(reg);
+    if (decidedLocal[b].has(reg) && !local) {
+      return; // this function wrote it after the last call in this block: it is its own value
+    }
+    const key = `${reg}|${local ? 1 : 0}`;
+    if (staleSeen[b].get(key) === v) {
+      return;
+    }
+    staleSeen[b].set(key, v);
+    const c: StaleRead = { reg, value: v, block: b, fromOp: irBlocks[b].ops.length, local, carriedBy: new Set() };
+    staleCandidates.push(c);
+    staleByValue.set(v, [...(staleByValue.get(v) ?? []), c]);
+  };
 
   const newPhi = (reg: string, b: number): Value => {
-    const phi = mkValue(T.unk(32));
+    const phi = mkValue(unset(reg));
     irBlocks[b].params.push(phi);
     phiBlock.set(phi, b);
     phiKey.set(phi, reg);
@@ -389,6 +988,9 @@ export function makeSsaBuilder(
     defs[b].set(reg, phi); // set before wiring operands to break cycles
     return phi;
   };
+  // The single-predecessor blocks the current read is walking up through. A join ends the walk:
+  // its phi is in `defs` before its operands are read, so a cycle through it is already cut there.
+  let singlePredWalk = new Set<string>();
   const readRecursive = (reg: string, b: number): Value => {
     if (!sealed[b]) {
       // predecessors not all filled yet (e.g. a loop back-edge): defer operand wiring.
@@ -409,6 +1011,10 @@ export function makeSsaBuilder(
       // a measurement: a caller cannot pass a value in a register the ABI does not pass arguments
       // in, so a read of one before any write is an uninitialised local.
       const off = slotKeyOffset(reg);
+      if (globalRegs.has(reg)) {
+        // only `readVar` reads one, and never through the SSA: a live-in here would be a parameter
+        throw new Error(`lifting '${name}': global register ${reg} read as an SSA variable`);
+      }
       if (off !== null && !inRange(off, model().ownedLocals) && !inRange(off, model().callerParams)) {
         throw new FrontendUnsupportedError(
           `cannot lift '${name}': ${reg} is read on a path that never stores it, and lies outside ` +
@@ -421,8 +1027,19 @@ export function makeSsaBuilder(
         const op = mkOp('undef', { results: [mkValue(T.unk(32))], attrs: { key: reg } });
         irBlocks[b].ops.unshift(op); // ahead of everything in a block that nothing precedes
         defs[b].set(reg, op.results[0]);
+        if (off === null && model().hiddenInputRegs?.includes(reg)) {
+          hiddenEntryValues.set(op.results[0], reg);
+        }
         return op.results[0];
       }
+      const rank = stackArgIndex(reg);
+      const declared = model().ownArgWords;
+      if (rank !== null && declared !== undefined && rank >= declared) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': it reads incoming stack argument ${rank}, past the ${declared} argument ` +
+            `words its own declaration fills — the declaration and the body disagree`,
+        );
+      }
       // an incoming argument register → function parameter.
       // If one was already asserted for this key (ensureParam), adopt it — minting a second
       // parameter for the same key would put the key in the signature twice.
@@ -432,16 +1049,38 @@ export function makeSsaBuilder(
         defs[b].set(reg, obliged);
         return obliged;
       }
-      const p = mkValue(T.unk(32));
+      const p = mkValue(unset(reg));
       irBlocks[b].params.push(p);
       defs[b].set(reg, p);
       paramReg.set(p, reg);
       return p;
     }
     if (ps.length === 1) {
-      const v = readVar(reg, ps[0]);
-      defs[b].set(reg, v);
-      return v;
+      // A walk up single predecessors that comes back to where it started has gone round a cycle
+      // no edge enters from outside, so no path from the entry reaches it — unless the entry is on
+      // it. agbcc leaves such a cycle behind a loop it proved never runs. No execution reads the
+      // key there, which is the uninitialised read's answer. Through the entry, the value is a
+      // live-in joined with the cycle's, which a single-predecessor block has no phi for.
+      const at = `${b}|${reg}`;
+      if (singlePredWalk.has(at)) {
+        if (singlePredWalk.has(`0|${reg}`)) {
+          throw new FrontendUnsupportedError(
+            `cannot lift '${name}': ${reg} is read in a cycle through the entry block with no join to meet at`,
+          );
+        }
+        const op = mkOp('undef', { results: [mkValue(T.unk(32))], attrs: { key: reg } });
+        irBlocks[b].ops.unshift(op);
+        defs[b].set(reg, op.results[0]);
+        return op.results[0];
+      }
+      singlePredWalk.add(at);
+      try {
+        const v = readAny(reg, ps[0]);
+        defs[b].set(reg, v);
+        return v;
+      } finally {
+        singlePredWalk.delete(at);
+      }
     }
     // sealed join: create the phi and wire every predecessor's terminator arg now.
     const phi = newPhi(reg, b);
@@ -452,8 +1091,17 @@ export function makeSsaBuilder(
   // write-order record is keyed by. `phi` is passed rather than looked up: by the time a deferred
   // phi is wired the block may have written its key again, so `defs[b]` no longer names it.
   const addPhiOperands = (reg: string, b: number, phi: Value) => {
+    const walk = singlePredWalk;
+    singlePredWalk = new Set();
+    try {
+      addEachPhiOperand(reg, b, phi);
+    } finally {
+      singlePredWalk = walk;
+    }
+  };
+  const addEachPhiOperand = (reg: string, b: number, phi: Value) => {
     for (const p of distinctPreds(b)) {
-      appendSuccessorArg(p, b, readVar(reg, p));
+      appendSuccessorArg(p, b, readAny(reg, p));
       const at = lastWriteAt[p].get(reg);
       if (at !== undefined) {
         const rec = writeOrder.lastWrite.get(irBlocks[p]) ?? new Map<Value, number>();
@@ -505,19 +1153,25 @@ export function makeSsaBuilder(
     if (preds[b].length > 0) {
       return; // a parameter here is a phi; see the precondition on the interface
     }
+    if (slotKeyOffset(key) === null && model().uninitRegs?.includes(key)) {
+      return; // no caller fills it (an argument register past the own declaration's words)
+    }
     for (const p of irBlocks[b].params) {
       if (paramReg.get(p) === key) {
         return; // already a parameter, however it got there
       }
     }
-    const p = mkValue(T.unk(32));
+    const p = mkValue(unset(key));
     irBlocks[b].params.push(p);
     paramReg.set(p, key); // ranked by the ABI sort like any other parameter
     obligedParams[b].set(key, p);
   };
 
-  const hasReachingDef = (reg: string, b: number, accept: (v: Value) => boolean = () => true): boolean => {
+  const reaches = (reg: string, b: number, accept: (v: Value) => boolean, throughCalls: boolean): boolean => {
     const walk = (at: number, seen: Set<number>): boolean => {
+      if (!throughCalls && clobberedLocal[at].has(reg)) {
+        return false;
+      }
       const own = defs[at].get(reg);
       // A def `accept` rejects does not fall through to the predecessors: it is still a def, and
       // nothing older than it reaches past it.
@@ -532,28 +1186,556 @@ export function makeSsaBuilder(
     };
     return walk(b, new Set<number>());
   };
+  const hasReachingDef = (reg: string, b: number, accept: (v: Value) => boolean = () => true): boolean =>
+    reaches(reg, b, accept, true);
+  const holdsValue = (reg: string, b: number, accept: (v: Value) => boolean = () => true): boolean =>
+    reaches(reg, b, accept, false);
+  const everyReachingDef = (reg: string, b: number, accept: (v: Value) => boolean): boolean => {
+    if (!filled.every(Boolean)) {
+      throw new Error('everyReachingDef: asked before every block is filled');
+    }
+    // A block met again on a cycle adds no path the first visit did not already judge.
+    const seen = new Set<number>();
+    const walk = (at: number): boolean => {
+      if (clobberedLocal[at].has(reg)) {
+        return false;
+      }
+      const own = defs[at].get(reg);
+      if (own !== undefined) {
+        return accept(own);
+      }
+      if (seen.has(at)) {
+        return true;
+      }
+      seen.add(at);
+      return preds[at].length > 0 && preds[at].every(walk);
+    };
+    return walk(b);
+  };
+
+  const holdsEntryValue = (reg: string, b: number): boolean => {
+    // A predecessor is known only once filled, and `b` itself only up to here — so a path that comes
+    // back round to `b` carries writes this walk has not seen.
+    const untouched = (at: number, seen: Set<number>): boolean => {
+      if (at === b || !filled[at]) {
+        return false;
+      }
+      if (seen.has(at)) {
+        return true;
+      }
+      seen.add(at);
+      return clean(at, seen);
+    };
+    // `decidedLocal` holds a register a call destroyed as well as one this block wrote.
+    const clean = (at: number, seen: Set<number>): boolean => {
+      if (defs[at].has(reg) || decidedLocal[at].has(reg)) {
+        return false;
+      }
+      const ps = distinctPreds(at);
+      return ps.length === 0 ? at === 0 : ps.every((p) => untouched(p, seen));
+    };
+    return clean(b, new Set());
+  };
+  const entryValue = (reg: string, b: number): Value | undefined => {
+    if (!holdsEntryValue(reg, b)) {
+      return undefined;
+    }
+    ensureParam(reg, 0);
+    return irBlocks[0].params.find((p) => paramReg.get(p) === reg);
+  };
+
+  /** REFUSE a value the ABI destroyed. The builder is RIGHT that a caller-saved register has a
+   *  reaching definition after a call; what it cannot see is that the call destroyed the bytes, so
+   *  that definition names something the callee overwrote. Resolving the read to it is a silently
+   *  wrong VALUE at exit 0 — `mov r3,#0x2a; bl f; add r4,r3,#0` reading as `return 42` — which is
+   *  the one failure a frontend may not produce.
+   *
+   *  It fires on a USE rather than on the read, and after two things in `finish` that legitimately
+   *  retract one: `trimClobberedCallArgs`, which drops a read that fed a guessed call's argument
+   *  list — the sound answer for those, and not a reason to refuse the function as well — and
+   *  `pruneDeadParams`, which drops one that fed a join nothing reads. A destroyed value nothing is
+   *  left holding is a dead register, not a wrong answer.
+   *
+   *  TWO-SIDED, so both sides are stated. TOO STRICT costs a row and nothing else: a register the
+   *  compiler rematerialised in a way no `writeVar` saw reads as destroyed and the function
+   *  declines. TOO LOOSE is the wrong value, and the MAY direction below is what rules it out — a
+   *  register destroyed on ANY path into a block is destroyed there, so a join cannot launder one. */
+  /** Per block, the registers a call destroyed on SOME path into it with nothing written since:
+   *  the UNION, against `trimClobberedCallArgs`'s intersection, and for the opposite reason. That
+   *  one proves the caller set a register up, which needs every path to agree; this one proves
+   *  nobody can name it, which one path is enough for. Meaningful once every block is filled. */
+  const destroyedOnEntry = (images = false): Array<Set<string>> => {
+    const destroyedIn: Array<Set<string>> = irBlocks.map(() => new Set());
+    const outOf = (b: number): Set<string> => {
+      const out = new Set([...clobberedLocal[b], ...(images ? imageLocal[b] : [])]);
+      for (const r of destroyedIn[b]) {
+        if (!decidedLocal[b].has(r)) {
+          out.add(r);
+        }
+      }
+      return out;
+    };
+    for (let changed = true; changed;) {
+      changed = false;
+      for (let b = 0; b < irBlocks.length; b++) {
+        for (const p of distinctPreds(b)) {
+          for (const r of outOf(p)) {
+            if (!destroyedIn[b].has(r)) {
+              destroyedIn[b].add(r);
+              changed = true;
+            }
+          }
+        }
+      }
+    }
+    return destroyedIn;
+  };
+  /** A destroyed value a copy carries OUT of its block (`StaleRead.carriedBy`) is used where any
+   *  block the read's block reaches uses it — an edge argument included, which is how a slot the
+   *  copy stored reaches its reload at a join. The destroyed register itself needs none of this:
+   *  every block it reaches marks it destroyed on entry (`destroyedOnEntry`) and judges its own
+   *  reads. Every later use of the value counts, under whatever name, which can only refuse more. */
+  const carriedOut = (c: StaleRead): boolean => {
+    if (![...c.carriedBy].some((k) => defs[c.block].get(k) === c.value)) {
+      return false;
+    }
+    const index = new Map(irBlocks.map((blk, i) => [blk, i]));
+    const usesIt = (op: Op) => op.operands.includes(c.value) || op.successors.some((s) => s.args.includes(c.value));
+    const seen = new Set<number>();
+    const work = irBlocks[c.block].ops.slice(c.fromOp).flatMap((op) => op.successors.map((s) => s.block));
+    if (irBlocks[c.block].ops.slice(c.fromOp).some(usesIt)) {
+      return true;
+    }
+    for (let blk = work.pop(); blk !== undefined; blk = work.pop()) {
+      const b = index.get(blk);
+      if (b === undefined || seen.has(b)) {
+        continue;
+      }
+      seen.add(b);
+      if (blk.ops.some(usesIt) || usesOutsideOps.some((u) => u.value === c.value && u.block === b)) {
+        return true;
+      }
+      work.push(...blk.ops.flatMap((op) => op.successors.map((s) => s.block)));
+    }
+    return false;
+  };
+  const refuseStaleCallerSavedReads = () => {
+    if (staleCandidates.length === 0) {
+      return;
+    }
+    const destroyedIn = destroyedOnEntry();
+    for (const c of staleCandidates) {
+      if (!c.local && !destroyedIn[c.block].has(c.reg)) {
+        continue;
+      }
+      const ops = irBlocks[c.block].ops;
+      if (
+        ops.slice(c.fromOp).some((op) => op.operands.includes(c.value)) ||
+        usesOutsideOps.some((u) => u.value === c.value && u.block === c.block && u.atOp >= c.fromOp) ||
+        carriedOut(c)
+      ) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': ${c.reg} is read on a path where a call has destroyed it, so what ` +
+            `it holds is the callee's and not a value this function named — not modelled`,
+        );
+      }
+    }
+  };
+
+  /** Where each value is read: the joins it is an edge argument of, and `null` for an op's operand. */
+  const readersOf = (): Map<Value, Set<Value | null>> => {
+    const readers = new Map<Value, Set<Value | null>>();
+    const note = (v: Value, r: Value | null) => (readers.get(v) ?? readers.set(v, new Set()).get(v)!).add(r);
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        op.operands.forEach((v) => note(v, null));
+        for (const s of op.successors) {
+          s.args.forEach((v, i) => note(v, s.block.params[i]));
+        }
+      }
+    }
+    return readers;
+  };
+
+  /** Each non-entry block param → the argument every in-edge passes it, in edge order. */
+  const joinArgs = (): Map<Value, Value[]> => {
+    const m = new Map<Value, Value[]>();
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        for (const s of op.successors) {
+          if (s.block === irBlocks[0]) {
+            continue;
+          }
+          s.block.params.forEach((p, i) => {
+            (m.get(p) ?? m.set(p, []).get(p)!).push(s.args[i]);
+          });
+        }
+      }
+    }
+    return m;
+  };
+
+  /** ANOTHER STORAGE'S UNDEFINED VALUE IS AN ASSIGNMENT. `int x, y; if (c) x = y;` at ido7.1
+   *  copies the word at 0(sp) into 4(sp) on one path, so the join keyed `sp@4` takes `sp@0`'s
+   *  undefined value as an edge argument. The structurer drops an undefined edge copy (structure.ts
+   *  `undefCarriesNothing`), which is right for the join's OWN storage — that path left the local
+   *  unassigned — and wrong for another's, where the machine ran a load and a store. Each such edge
+   *  argument becomes its own undefined value under the source's key, marked `copied`, which the
+   *  structurer spells as the assignment `x = uninit_sp0` and names as the value it copies. A join
+   *  whose key the builder did not record is left as it was.
+   *
+   *  FRAME WORDS ONLY, both of them. A compiler gives a stack local one word and moves no local from
+   *  word to word, so two words are two locals. A register is no such identity: agbcc keeps a local
+   *  in r8 and moves it to a low register to use it (`synthetic:uninit_spill`), and a spill writes a
+   *  register's local to a word — one source variable under two keys, where a spelled copy would
+   *  invent an assignment the source never wrote. So `x = y` between two locals in registers
+   *  (`uninit_both_saved` on agbcc) still collapses into one undefined value where nothing else
+   *  reads it (below).
+   *
+   *  A REGISTER CACHING TWO FRAME WORDS. ido7.1 -O2 gives an uninitialised local its word and then
+   *  caches it in a register across a loop or an arm: `int x, y; if (c) x = y; else y = x;
+   *  return x - y;` is `lw a0,0(sp); move v1,a0` on one arm and `lw v1,4(sp); move a0,v1` on the
+   *  other, so the joins keyed v1 and a0 each take sp@0's undefined value on one edge and sp@4's on
+   *  the other, and collapsing them into two unrelated undefined values loses that x - y is 0.
+   *  Where the joins one register-keyed join is connected to by its edge arguments (a loop header's
+   *  and the arm join inside it, in `for (…) if (i & 1) x = y;`) take the undefined values of TWO
+   *  OR MORE frame words between them, the register is no one local's home, and each such edge
+   *  argument is marked `copied` too: every one is a load the machine ran. Of ONE frame word only
+   *  (an arm that leaves the cached local as it was) the web is that local's, and stays as it was —
+   *  so long as nothing else reads the value, below.
+   *
+   *  A VALUE READ ELSEWHERE IS A RELATION, whatever the keys. Dropping an edge copy leaves the
+   *  join's local unassigned on that path, which is as undefined as the machine's word only where
+   *  that word is read through this join alone. `int x, z; if (c) z = x; else z = 7; return z - x;`
+   *  at ido7.1 caches x's word 4(sp) in z's register v1 on one arm and reads 4(sp) again for the
+   *  subtraction, so `c != 0` returns 0; with the copy dropped, z's local is unassigned there and
+   *  the C returns garbage. So an undefined edge argument, of any storage and into a join of any
+   *  key (registers too: gcc 2.7.2 keeps x in v1 and runs `move v0,v1`), is a copy here whenever
+   *  ANOTHER JOIN also takes it, since that join's local and this one hold the same value on the
+   *  machine. One the function also reads directly is left to the structurer, which names the
+   *  value as the join's local when it can (`g = x; if (c) x = 5; return x;`) and spells the copy
+   *  when it cannot (structure.ts `undefCarriesNothing`); `collapseUndefinedJoins` keeps such a
+   *  join for it. What agbcc's prologue relates by staging a high register for its push is not
+   *  this function's copy and never reaches here (thumb.ts `prologueSavedRegs`). */
+  const markCopiedUndefs = () => {
+    const defOf = defOpMap(fn);
+    const replaced = new Set<Value>();
+    const frameUndefKey = (v: Value): string | undefined => {
+      const d = defOf.get(v);
+      return d?.opcode === 'undef' && d.attrs.copied !== true && slotKeyOffset(String(d.attrs.key)) !== null
+        ? String(d.attrs.key)
+        : undefined;
+    };
+    // The register-keyed joins whose web of joins takes two or more frame words' undefined values.
+    const mixedRegisterJoins = new Set<Value>();
+    {
+      const incoming = joinArgs();
+      const isRegJoin = (p: Value) => {
+        const k = phiKey.get(p);
+        return incoming.has(p) && k !== undefined && slotKeyOffset(k) === null;
+      };
+      const parent = new Map<Value, Value>();
+      const find = (v: Value): Value => {
+        let r = v;
+        while (parent.get(r) !== undefined && parent.get(r) !== r) {
+          r = parent.get(r)!;
+        }
+        parent.set(v, r);
+        return r;
+      };
+      for (const [p, args] of incoming) {
+        if (!isRegJoin(p)) {
+          continue;
+        }
+        if (!parent.has(p)) {
+          parent.set(p, p);
+        }
+        for (const a of args) {
+          if (isRegJoin(a)) {
+            if (!parent.has(a)) {
+              parent.set(a, a);
+            }
+            parent.set(find(a), find(p));
+          }
+        }
+      }
+      const keysOf = new Map<Value, Set<string>>();
+      for (const [p, args] of incoming) {
+        if (!isRegJoin(p)) {
+          continue;
+        }
+        const root = find(p);
+        const ks = keysOf.get(root) ?? keysOf.set(root, new Set()).get(root)!;
+        for (const a of args) {
+          const k = frameUndefKey(a);
+          if (k !== undefined) {
+            ks.add(k);
+          }
+        }
+      }
+      for (const p of parent.keys()) {
+        if ((keysOf.get(find(p))?.size ?? 0) >= 2) {
+          mixedRegisterJoins.add(p);
+        }
+      }
+    }
+    const readers = readersOf();
+    const joinedElsewhere = (u: Value, p: Value) => [...(readers.get(u) ?? [])].some((r) => r !== null && r !== p);
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        for (const s of op.successors) {
+          if (s.block === irBlocks[0]) {
+            continue;
+          }
+          s.block.params.forEach((p, i) => {
+            const d = defOf.get(s.args[i]);
+            const key = phiKey.get(p);
+            if (d?.opcode !== 'undef' || d.attrs.copied === true || key === undefined) {
+              return;
+            }
+            const frameCopy =
+              d.attrs.key !== key &&
+              slotKeyOffset(String(d.attrs.key)) !== null &&
+              (slotKeyOffset(key) !== null || mixedRegisterJoins.has(p));
+            if (!frameCopy && !joinedElsewhere(s.args[i], p)) {
+              return;
+            }
+            const copy = mkOp('undef', {
+              results: [mkValue(s.args[i].type)],
+              attrs: { key: d.attrs.key, copied: true },
+            });
+            irBlocks[0].ops.unshift(copy);
+            replaced.add(s.args[i]);
+            s.args[i] = copy.results[0];
+          });
+        }
+      }
+    }
+    if (replaced.size > 0) {
+      const used = new Set(
+        irBlocks.flatMap((b) => b.ops.flatMap((o) => [...o.operands, ...o.successors.flatMap((s) => s.args)])),
+      );
+      for (const blk of irBlocks) {
+        blk.ops = blk.ops.filter((o) => !replaced.has(o.results[0]) || used.has(o.results[0]));
+      }
+    }
+  };
+
+  /** A JOIN NO PATH DEFINES IS ONE UNINITIALISED VALUE. A join whose every argument is its own
+   *  storage's undefined value (`markCopiedUndefs` has already turned another frame word's into an
+   *  assignment) would keep its local and lose every assignment to it, since the structurer drops
+   *  each such edge copy, and its own postcondition then reports a local read but never assigned.
+   *  Such a join is replaced by one fresh undefined value at the entry, keyed as the join was,
+   *  which dominates every use the join had. The greatest such set, so a loop that only carries an
+   *  undefined value round (`phi(undef, phi(…))`) collapses with it. Run after the hidden-input
+   *  check, which refuses the joins whose undefined arguments are a hand-written routine's inputs.
+   *  The fresh value lists the other keys whose undefined values it absorbed (`ABSORBED_KEYS`):
+   *  `x = a ? b : c` past a one-word declaration joins r1's and r2's into r4's, and a reader asking
+   *  whether the lift still reads r1 must find it there. */
+  const collapseUndefinedJoins = () => {
+    const incoming = joinArgs();
+    const undefs = new Set<Value>();
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        if (op.opcode === 'undef' && op.attrs.copied !== true) {
+          undefs.add(op.results[0]);
+        }
+      }
+    }
+    if (undefs.size === 0) {
+      return;
+    }
+    // A join one of whose undefined arguments is also read directly keeps it: the fresh value it
+    // would collapse into is a second undefined value where the machine holds one, and the
+    // structurer spells the edge copy instead (`markCopiedUndefs`, A VALUE READ ELSEWHERE).
+    const readers = readersOf();
+    const readDirectly = (a: Value) => undefs.has(a) && (readers.get(a)?.has(null) ?? false);
+    const doomed = new Set(
+      [...incoming.keys()].filter((p) => incoming.get(p)!.length > 0 && !incoming.get(p)!.some(readDirectly)),
+    );
+    for (let changed = true; changed;) {
+      changed = false;
+      for (const p of doomed) {
+        if (incoming.get(p)!.some((a) => a !== p && !undefs.has(a) && !doomed.has(a))) {
+          doomed.delete(p);
+          changed = true;
+        }
+      }
+    }
+    // ...and reaches an undefined value at all: a param only its own back edge feeds is a cycle no
+    // entry reaches (`readRecursive`'s unreachable walk), which carries no value to collapse into.
+    const grounded = new Set<Value>();
+    for (let changed = true; changed;) {
+      changed = false;
+      for (const p of doomed) {
+        if (!grounded.has(p) && incoming.get(p)!.some((a) => undefs.has(a) || grounded.has(a))) {
+          grounded.add(p);
+          changed = true;
+        }
+      }
+    }
+    for (const p of [...doomed]) {
+      if (!grounded.has(p)) {
+        doomed.delete(p);
+      }
+    }
+    if (doomed.size === 0) {
+      return;
+    }
+    const orphans = new Set([...doomed].flatMap((p) => incoming.get(p)!.filter((a) => undefs.has(a))));
+    const defOf = defOpMap(fn);
+    // The keys of the undefined values a join absorbs, through the doomed joins it takes.
+    const absorbed = (p: Value, seen = new Set<Value>()): string[] =>
+      seen.has(p)
+        ? []
+        : (seen.add(p),
+          incoming
+            .get(p)!
+            .flatMap((a) =>
+              undefs.has(a) ? [String(defOf.get(a)!.attrs.key)] : doomed.has(a) ? absorbed(a, seen) : [],
+            ));
+    for (const p of doomed) {
+      const firstUndef = incoming.get(p)!.find((a) => undefs.has(a));
+      const key = phiKey.get(p) ?? (firstUndef && defOf.get(firstUndef)?.attrs.key) ?? '';
+      const from = [...new Set(absorbed(p))].filter((k) => k !== key).sort();
+      const op = mkOp('undef', {
+        results: [mkValue(T.unk(32))],
+        attrs: from.length === 0 ? { key } : { key, [ABSORBED_KEYS]: from.join(',') },
+      });
+      irBlocks[0].ops.unshift(op);
+      replaceAllUsesWith(fn, p, op.results[0]);
+    }
+    for (const blk of irBlocks) {
+      for (let i = blk.params.length - 1; i >= 0; i--) {
+        const p = blk.params[i];
+        if (!doomed.has(p)) {
+          continue;
+        }
+        dropPhiRecord(p);
+        blk.params.splice(i, 1);
+        for (const b2 of irBlocks) {
+          for (const o of b2.ops) {
+            for (const s of o.successors) {
+              if (s.block === blk) {
+                s.args.splice(i, 1);
+              }
+            }
+          }
+        }
+      }
+    }
+    // The undefined arguments the collapsed joins took and nothing else reads.
+    const used = new Set(
+      irBlocks.flatMap((b) => b.ops.flatMap((o) => [...o.operands, ...o.successors.flatMap((s) => s.args)])),
+    );
+    for (const blk of irBlocks) {
+      blk.ops = blk.ops.filter((o) => !orphans.has(o.results[0]) || used.has(o.results[0]));
+    }
+  };
+
+  const dropPhiRecord = (p: Value) => {
+    phiBlock.delete(p);
+    phiKey.delete(p);
+    forgetOrder(p);
+  };
 
   return {
     fn,
     irBlocks,
     readVar,
+    readGuessedArg: readAny, // see the interface: the trim is this read's answer, not a refusal
+    readAtEnd: (reg: string, b: number) => (filled[b] ? readAny(reg, b) : null),
     writeVar,
+    frameWrites,
     paramReg,
     ensureParam,
     hasReachingDef,
-    noteCall: (b: number) => {
+    holdsValue,
+    everyReachingDef,
+    entryValue,
+    holdsEntryValue,
+    writtenSinceCall: (reg: string, b: number) => writtenSinceCall[b].has(reg),
+    writtenOnEveryPath: (reg, b, stop, visit) => {
+      // `b` is judged up to here on the first visit; met again round a loop, it is the end of `b`,
+      // which a back edge brings, and a cycle adds no path the first visit did not judge
+      const seen = new Set<number>([b]);
+      const walk = (at: number): boolean => {
+        if (writtenSinceCall[at].has(reg) || clobberedLocal[at].has(reg)) {
+          return true;
+        }
+        const ps = distinctPreds(at);
+        return (
+          ps.length > 0 &&
+          ps.every((p) => {
+            if (seen.has(p)) {
+              return true;
+            }
+            seen.add(p);
+            if (!filled[p] || stop(p)) {
+              return false;
+            }
+            visit?.(p);
+            return walk(p);
+          })
+        );
+      };
+      return walk(b);
+    },
+    requireSoleReader: (value: Value, op: Op, refuse: () => void) => {
+      soleReaders.push({ value, op, refuse });
+    },
+    requireReader: (value: Value, refuse: () => void) => {
+      readObligations.push({ value, refuse });
+    },
+    noteIncidentalWrite: (v: Value) => {
+      incidentalWrites.add(v);
+    },
+    isIncidentalWrite: (v: Value) => incidentalWrites.has(v),
+    useOutsideOps: (v: Value, b: number) => {
+      usesOutsideOps.push({ value: v, block: b, atOp: irBlocks[b].ops.length });
+    },
+    noteCall: (b: number, clobbers: readonly string[]) => {
       callsIn.add(b);
       // the callee clobbers the caller-saved registers, its own result register included — see
       // the ordering contract on the interface
       writtenSinceCall[b] = new Set();
+      for (const r of clobbers) {
+        clobberedLocal[b].add(r);
+        decidedLocal[b].add(r);
+      }
+      imageLocal[b] = new Set();
+    },
+    noteStructImage: (b: number, reg: string, image: Value) => {
+      imageLocal[b].add(reg);
+      structImages.add(image);
     },
-    recordGuessedCall: (op: Op, b: number, abi: { argRegs: string[]; returnReg: string }) => {
+    recordGuessedCall: (
+      op: Op,
+      b: number,
+      abi: { argRegs: string[]; returnReg: string },
+      passesCalleeResult?: (result: Value) => boolean,
+      trimmed?: (cut: readonly string[], kept: readonly string[]) => void,
+      withholdsSetupArgs?: () => boolean,
+      asksEveryCut?: () => boolean,
+      floor?: number,
+    ) => {
       abiSeen = abi;
       guessedCalls.push({
         block: b,
         op,
+        passesCalleeResult,
+        trimmed,
+        withholdsSetupArgs,
+        asksEveryCut,
+        ...(floor ? { floor } : {}),
         freshBefore: new Set(writtenSinceCall[b]),
         afterCallInBlock: callsIn.has(b), // `noteCall` runs after this, so this means an EARLIER call
+        returnRegBefore:
+          clobberedLocal[b].has(abi.returnReg) || imageLocal[b].has(abi.returnReg)
+            ? 'destroyed'
+            : decidedLocal[b].has(abi.returnReg)
+              ? 'written'
+              : 'inherited',
       });
     },
     markFilled: (b: number) => {
@@ -575,31 +1757,197 @@ export function makeSsaBuilder(
           }
         }
         trimClobberedCallArgs({
+          name,
           argRegs: abiSeen.argRegs,
           returnReg: abiSeen.returnReg,
           calleeResults,
+          destroyedIn: destroyedOnEntry(true),
           preds,
+          blocks: irBlocks,
           freshAtEnd: writtenSinceCall,
           callsIn,
           sites: guessedCalls,
         });
+        // what the trim leaves a guess passing a struct's image: a copy of it into another argument
+        // register (`add r1, r0, #0`), which is as undecided as the image itself
+        for (const site of guessedCalls) {
+          const at = callArgs(site.op).findIndex((v) => structImages.has(v));
+          if (at >= 0) {
+            // worded as `trimClobberedCallArgs` refuses the image left in the return register itself
+            const callee = site.op.attrs.target;
+            throw new FrontendUnsupportedError(
+              `cannot lift '${name}': argument ${at + 1} of the call to ${typeof callee === 'string' ? `'${callee}'` : 'a callee'} ` +
+                `is a struct an earlier call handed back in ${abiSeen.returnReg}, and nothing here passes one on as an argument — not modelled`,
+            );
+          }
+        }
       }
       irBlocks.forEach((blk, i) => writeOrder.writes.set(blk, writeCount[i]));
-      simplifyTrivialPhis(fn, (p) => {
-        phiBlock.delete(p);
-        phiKey.delete(p);
-        forgetOrder(p);
-      });
-      // Then the phis nothing reads at all — a register two paths leave holding different junk
-      // (a loop counter after its last use, a scratch the epilogue overwrites) still joins as a
-      // phi, and a dead phi is not junk downstream: its edge args become post-loop copies in the
-      // emitted C and block gates keyed on "this exit carries nothing". Order matters only for
-      // economy: trivial-phi removal can orphan a phi's last reader, never the reverse.
-      pruneDeadParams(fn, (p) => {
-        phiBlock.delete(p);
-        phiKey.delete(p);
-        forgetOrder(p);
-      });
+      // The phis nothing reads at all — a register two paths leave holding different junk (a loop
+      // counter after its last use, a scratch the epilogue overwrites) still joins as a phi, and a
+      // dead phi is not junk downstream: its edge args become post-loop copies in the emitted C and
+      // block gates keyed on "this exit carries nothing".
+      //
+      // DEAD-PHI PRUNING RUNS FIRST, and `refuseStaleCallerSavedReads` is why. That check asks
+      // whether a destroyed value still reaches a use, and a dead phi's edge arg is not one. The
+      // trivial-phi
+      // pass must not run before it for the opposite reason: that one REPLACES the phi's uses with
+      // the arg and splices the arg away, which takes the last visible use of a destroyed value out
+      // of sight. Running it twice is what keeps both true — trivial-phi removal can orphan a phi's
+      // last reader, never the reverse, so the second sweep is the one that pays for the first.
+      pruneDeadParams(fn, dropPhiRecord);
+      refuseStaleCallerSavedReads();
+      simplifyTrivialPhis(fn, dropPhiRecord);
+      pruneDeadParams(fn, dropPhiRecord);
+      // A SOLE-READER OBLIGATION (`requireSoleReader`), over the finished function: after both
+      // prunes, so a join nothing reads is no reader.
+      for (const { value, op, refuse } of soleReaders) {
+        const reads = (o: Op) =>
+          o !== op && (o.operands.includes(value) || o.successors.some((e) => e.args.includes(value)));
+        if (
+          frameWrites.has(value) ||
+          usesOutsideOps.some((u) => u.value === value) ||
+          irBlocks.some((blk) => blk.ops.some(reads))
+        ) {
+          refuse();
+        }
+      }
+      // …AND A READER OBLIGATION (`requireReader`), over the same finished function. A join the
+      // value reaches is followed to its own readers, and a `ret` is no reader: a frontend returns
+      // the return register at every `ret` whatever the function's declared type.
+      for (const { value, refuse } of readObligations) {
+        const reached = new Set<Value>([value]);
+        for (let grew = true; grew;) {
+          grew = false;
+          for (const blk of irBlocks) {
+            for (const op of blk.ops) {
+              for (const e of op.successors) {
+                e.block.params.forEach((p, i) => {
+                  if (reached.has(e.args[i]) && !reached.has(p)) {
+                    reached.add(p);
+                    grew = true;
+                  }
+                });
+              }
+            }
+          }
+        }
+        const read = [...reached].some(
+          (v) =>
+            frameWrites.has(v) ||
+            usesOutsideOps.some((u) => u.value === v) ||
+            irBlocks.some((blk) => blk.ops.some((o) => o.opcode !== 'ret' && o.operands.includes(v))),
+        );
+        if (!read) {
+          refuse();
+        }
+      }
+      // A HIDDEN INPUT IS NO UNINITIALISED LOCAL (`LiveInModel.hiddenInputRegs`). After the
+      // trivial-phi pass, so a join every path of which arrives undefined is no join. The
+      // compiler's local is assigned on SOME path, and its entry value meets that definition as a
+      // join's edge argument; once it does, a direct use is the same local read before that
+      // assignment (`uninitfirst`). An entry value that meets no such definition is the input.
+      //
+      // MEETING A JOIN IS NOT MEETING A DEFINITION. A register that carries an input round a loop
+      // (`addiu t0,t0,-1; bnez t0,top` on a hand-written count) sends its entry value into the
+      // loop header's join too, and the back edge's argument is that input's own next value. So
+      // the join must also take an INDEPENDENT definition (`independentOfEntry`): a value no chain
+      // of operands or join arguments derives from the entry value, other than through a join one
+      // of whose other arguments is itself independent. A conditional assignment inside a loop
+      // (`for (…) if (c) x = i;`) meets that through the inner join, and so does one the loop then
+      // transforms before its back edge — a bit reader's `if (!bits) code = *src++; … code <<= 1;`,
+      // whose shift reaches the entry value only through the join the load also feeds. A counter
+      // that only advances the entry value, and two undefined values joined (`phi(t0, v1)`), do
+      // not, and refuse. A bit reader HANDED its buffer meets the same join and lifts with the
+      // input dropped: the rule's blind side, at `O32_SCRATCH_REGS` in target.ts.
+      if (hiddenEntryValues.size > 0) {
+        const incoming = joinArgs();
+        const defOf = defOpMap(fn);
+        // Read forwards: who reads each value, as an operand or as a join's edge argument.
+        const readers = new Map<Value, Value[]>();
+        const addReader = (v: Value, r: Value) => (readers.get(v) ?? readers.set(v, []).get(v)!).push(r);
+        for (const blk of irBlocks) {
+          for (const op of blk.ops) {
+            for (const v of op.operands) {
+              for (const r of op.results) {
+                addReader(v, r);
+              }
+            }
+          }
+        }
+        for (const [p, args] of incoming) {
+          for (const a of args) {
+            addReader(a, p);
+          }
+        }
+        const isJoin = (v: Value) => incoming.has(v) && !irBlocks[0].params.includes(v);
+        /** The values independent of `u`, as a least fixpoint. A join is independent once one of
+         *  its arguments is; any other value once no chain of operands or join arguments reaches
+         *  `u` without passing through an independent join. Grown from nothing, so no join is
+         *  independent on the strength of its own back edge (`addiu t0,t0,-1` round a loop). */
+        const independentOfEntry = (u: Value): ((v: Value) => boolean) => {
+          const absorbing = new Set<Value>();
+          for (;;) {
+            const derived = new Set<Value>([u]);
+            const work = [u];
+            for (let w = work.pop(); w !== undefined; w = work.pop()) {
+              for (const r of readers.get(w) ?? []) {
+                if (!derived.has(r) && !absorbing.has(r)) {
+                  derived.add(r);
+                  work.push(r);
+                }
+              }
+            }
+            const indep = (v: Value) =>
+              v !== u && defOf.get(v)?.opcode !== 'undef' && (absorbing.has(v) || (!isJoin(v) && !derived.has(v)));
+            let grew = false;
+            for (let changed = true; changed;) {
+              changed = false;
+              for (const [p, args] of incoming) {
+                if (isJoin(p) && !absorbing.has(p) && args.some(indep)) {
+                  absorbing.add(p);
+                  changed = grew = true;
+                }
+              }
+            }
+            if (!grew) {
+              return indep;
+            }
+          }
+        };
+        const metMemo = new Map<Value, boolean>();
+        const met = (u: Value): boolean => {
+          let m = metMemo.get(u);
+          if (m === undefined) {
+            const joins = [...incoming.entries()].filter(([p, args]) => isJoin(p) && args.includes(u));
+            const indep = joins.length === 0 ? undefined : independentOfEntry(u);
+            m = indep !== undefined && joins.some(([, args]) => args.some(indep));
+            metMemo.set(u, m);
+          }
+          return m;
+        };
+        for (const blk of irBlocks) {
+          for (const op of blk.ops) {
+            const reg = [...op.operands, ...op.successors.flatMap((s) => s.args)]
+              .filter((v) => hiddenEntryValues.has(v) && !met(v))
+              .map((v) => hiddenEntryValues.get(v))
+              .find((r) => r !== undefined);
+            if (reg !== undefined) {
+              throw new FrontendUnsupportedError(
+                `cannot lift '${name}': ${reg} is read before anything writes it, and ` +
+                  `no join meets it with a definition of its own — an input handed over outside the ` +
+                  `C convention (a save routine's frame address, a member-function pointer, a register ` +
+                  `hand-written asm passes a value in, a count it carries round a loop), not modelled ` +
+                  `as an uninitialised local`,
+              );
+            }
+          }
+        }
+      }
+      dropUnreadGlobalRegisterLoads();
+      markCopiedUndefs();
+      collapseUndefinedJoins();
+      simplifyTrivialPhis(fn, dropPhiRecord);
       // SEAL THE PARAMETER EVIDENCE (ir/core.ts `ParamEvidence`). Here and not at the store or the
       // write, because `pruneDeadParams` above is the last thing that can retire an entry
       // parameter, and an observation about a value no longer in the signature is one the reader
@@ -616,6 +1964,12 @@ export function makeSsaBuilder(
         }
       }
       const defs0 = defOpMap(fn);
+      for (const v of deadHomed) {
+        const d = defs0.get(v);
+        if (d?.opcode === 'undef') {
+          d.attrs[HOMED_UNDEF] = true;
+        }
+      }
       for (const p of irBlocks[0].params) {
         const reg = paramReg.get(p);
         const first = reg === undefined ? undefined : firstEntryWrite.get(reg);
@@ -662,25 +2016,177 @@ export function makeSsaBuilder(
               `(partially-initialised local, or storage this function does not own) — not modelled`,
           );
         }
+        // …AND NEITHER MAY A CALLEE-SAVED REGISTER THIS FUNCTION NEVER SAVED
+        // (`LiveInModel.unsavedCalleeSavedRegs`): no caller passes an argument there, so as a
+        // parameter it would be read from the argument register a C caller fills instead.
+        if (key !== undefined && koff === null && model().unsavedCalleeSavedRegs?.includes(key)) {
+          throw new FrontendUnsupportedError(
+            `cannot lift '${name}': it reads callee-saved ${key} before writing it, and ${unsavedWhy([key])} — ` +
+              `a value no caller passes as an argument${globalNote([key])} — not modelled`,
+          );
+        }
+      }
+      // A write to one is handed back to the caller (a global register variable's store,
+      // `mov r8, r0`): no C local spells it, and dropping it drops an effect.
+      const leaked = (model().unsavedCalleeSavedRegs ?? []).filter((r) => writtenKeys.has(r));
+      if (leaked.length > 0) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': it writes callee-saved ${leaked.join(', ')}, and ${unsavedWhy(leaked)} — ` +
+            `the caller sees the write${globalNote(leaked)} — not modelled`,
+        );
       }
     },
   };
 }
 
-// ── shared frontend tail helpers ──
+// ── a guessed call arity: counted by `CallDeclarations.lower`, trimmed by `finish` ──
 
 /** Best-effort call arity when a callee has no prototype: the count of contiguous argument
  *  registers with a value reaching the call's block. Correct when the arguments are set up in
  *  the calling block; it can under-count pass-through parameters — which is why a prototype's
- *  declared `params` is authoritative when available. */
+ *  declared `params` is authoritative when available.
+ *
+ *  `accept` says which definitions are values (`SsaBuilder.hasReachingDef`). A pending high half
+ *  is a def but not a value, and counted it raises the arity: a `lis` hoisted into the prologue
+ *  leaves its half in r4 across an intervening call and makes `strlen(s)` into
+ *  `strlen(s, <half>)`, which then refuses at the read.
+ *
+ *  `gap` MAKES A GAP REFUSE. The count is contiguous, so an argument register with nothing reaching
+ *  it ends it — and one is empty for two opposite reasons. Either the call really takes that few
+ *  arguments, or the register still holds this function's own untouched incoming argument, a value
+ *  the machine passes on that SSA has no definition for because nothing ever wrote it. When a
+ *  LATER argument register does hold a value the second reading is the only one left, and taking
+ *  the first drops that argument and every one after it: `ac-decomp:evw_anime_colreg_manual` sets
+ *  up seven registers for `evw_color_set` and, with r4 at its incoming value, lifts to
+ *  `evw_color_set(a0);` — its divide, its multiply and five arguments gone. Which reading it is
+ *  cannot be decided from the register file alone — the function's own arity is exactly what is
+ *  missing — so this refuses and names the gap rather than guessing, unless `decide` answers it:
+ *  the lowering may show that the register above the gap is surely an argument, and where argument
+ *  words fill in order the gap below it is then this function's own arguments passed on
+ *  (frontend/call-plan.ts `decideGap`). A declaration answers it outright, and this scan is never
+ *  weighed against one: it is a guess, and a guess that cannot fail cannot witness a width a
+ *  declaration left open. */
 export function fallbackArgc(
-  ssa: { hasReachingDef(reg: string, b: number): boolean },
-  argRegs: string[],
+  ssa: { hasReachingDef(reg: string, b: number, accept?: (v: Value) => boolean): boolean },
+  argRegs: readonly string[],
   bi: number,
+  opts: {
+    /** whether `v`, reaching argument register `reg`, is a value the caller may have set up */
+    accept?: (v: Value, reg: string) => boolean;
+    /** the call's function, where it is (`CallSite`'s `guess.at`), and the frontend's own refusal */
+    gap: { name: string; at: number | string; fail: FrontendRefusal };
+    /** the leading arguments a declaration states (`GuessedCallSite.floor`): counted whether or not
+     *  the caller set them up, so only the registers above them are guessed */
+    floor?: number;
+    /** whether argument register `reg` still holds this function's own incoming value at the call
+     *  (an entry parameter, which a read leaves behind as a definition) on some path the caller
+     *  did not set it up on: one a call destroyed it on ends there, and one this block wrote it on
+     *  since its last call set it up (`CallDeclarations.lower` asks it) */
+    entry?: (reg: string) => boolean;
+    /** whether the gap `gap` — argument registers nothing reaches, in order — below `set`, the next
+     *  one a value reaches, is decided: the frontend shows `set` holds an argument, so `gap` holds
+     *  arguments passed on unchanged (`CallDeclarations.lower`'s `decideGap`). Handed the gap's
+     *  refusal, owed should a proof it defers fail. Absent, or false, the gap refuses. It is asked
+     *  again with an empty `gap` for every register the count takes past a decided gap. Each must be
+     *  proven an argument the same way, or the gap refuses. */
+    decide?: (gap: readonly string[], set: string, refuse: () => void) => boolean;
+    /** whether what a jump-table dispatch parked in argument register `reg` reaches the call
+     *  (`CallSite.parked`). Where nothing `accept` takes reaches it too, the count stops below it: no
+     *  compiler hands a callee the dispatch's own register, so no register above it is an argument.
+     *
+     *  WHY THIS STOPS WHERE A CALL-DESTROYED REGISTER REFUSES (`r2 holds a value and r1 holds
+     *  none`): where the value above came from. A call destroys every caller-saved register, so one
+     *  holding a value after it was written since, for a call — an argument as likely as not. A
+     *  dispatch clobbers only its idiom's registers, and agbcc moves a value it keeps live across the
+     *  switch out of them, upward, before the idiom runs (`add r2,r1,#0` ahead of the `lsl` in a
+     *  switch on r0 whose cases call): the value above the parked register was set up for the switch,
+     *  not for the call. The cost is a value a case itself writes above the parked register, dropped
+     *  too (`mov r2,#5; mov r0,#1; bl g` lifts `g(1)`): no compiler measured writes one there. A
+     *  parked register a call in the case destroyed is that call's hole, not the dispatch's, and it
+     *  stops the count only where no register above holds a value written since that call
+     *  (`SsaBuilder.holdsValue`): `bl h; mov r2,#5; mov r0,#1; bl g` refuses, while `add r3,r1,#0`
+     *  ahead of the idiom and `bl h; mov r0,#1; bl g` in a case lifts `g(1)` — the gap rule's
+     *  `setUp` walks through calls and would count r3's copy, which `h` destroyed. */
+    parked?: (reg: string) => boolean;
+  },
 ): number {
-  let n = 0;
-  while (n < argRegs.length && ssa.hasReachingDef(argRegs[n], bi)) {
-    n++;
+  const accept = opts.accept ?? (() => true);
+  // whether the caller set argument register k up: a definition reaches it, through a call too
+  const setUp = (k: number) => ssa.hasReachingDef(argRegs[k], bi, (v) => accept(v, argRegs[k]));
+  const { name, at, fail } = opts.gap;
+  const call = typeof at === 'number' ? `at 0x${at.toString(16)}` : at;
+  const floor = opts.floor ?? 0;
+  // the registers past the lowest parked one are none of the call's: neither counted nor a gap's top
+  const parkedAt = argRegs.findIndex((r, k) => k >= floor && opts.parked?.(r) === true && !setUp(k));
+  const top = parkedAt < 0 ? argRegs.length : parkedAt;
+  // the run of argument registers the caller set up from `from`, each past a declaration's
+  // stated words asked whether it still holds the incoming value
+  const run = (from: number): number => {
+    let n = from;
+    while (n < top && setUp(n)) {
+      // PAST A DECLARATION'S STATED WORDS, A REGISTER STILL HOLDING ITS INCOMING VALUE REFUSES. A
+      // read of it (a home store, a compare, a store to a global) leaves the entry parameter behind
+      // as a definition, so it reads as set up, and it is exactly as undecidable as the gap below: the
+      // function's own argument passed on, or one the call is not handed. Counted, it is an argument
+      // the source never passed — `int logv(const char *, int, ...)` and `logv(s, c) + 1` in a
+      // function whose unused third parameter IDO home-stores lifts `logv(a0, a1, a2)`. Below a
+      // floor the scan never asks, and with none the guess keeps counting it: there it is the far
+      // commoner `if (a) g(a)`, and the same refusal declines 17 lifts of kleod's 20 units and 40 of
+      // sa3's (`DecompressAlloc(a0)`, `m4aSongNumStart(a1)`), where the floored rule moves none.
+      //
+      // ONLY A PATH THE ENTRY VALUE STILL ARRIVES BY IS ASKED. `setUp` walks through calls, so an
+      // entry value a call destroyed reaches it too — `g(x); dprint(s)` — and that register holds
+      // nothing; the trim cuts it (`trimClobberedCallArgs`) and `dprint(a0)` is the bytes. And a
+      // register this block wrote since its last call was set up here, by the copy that put the
+      // value back — `g(y); dprint(s, x)` re-sets r1 from a saved copy — whatever value SSA names.
+      if (floor > 0 && opts.entry?.(argRegs[n])) {
+        fail(
+          `cannot lift '${name}': the call ${call} has a prototype stating only its first ${floor} ` +
+            `argument${floor === 1 ? '' : 's'}, and ${argRegs[n]} past them still holds this function's own incoming ` +
+            'value — an argument passed on unchanged and one the call is not handed look the same here, so the ' +
+            'argument count is not decidable',
+        );
+      }
+      n++;
+    }
+    return n;
+  };
+  let n = run(floor);
+  // A GAP BELOW A REGISTER THAT HOLDS A VALUE refuses, unless the frontend decides it: then the run
+  // goes on through the gap and the register above it, and the next gap is asked the same.
+  //
+  // PAST A DECIDED GAP, EVERY REGISTER THE RUN COUNTS MUST BE PROVEN TOO (asked of `decide` with an
+  // empty gap), or the gap refuses. The decision says the register above the gap is an argument and
+  // nothing about the ones above that. Without the gap's refusal the run would count whatever reaches
+  // them: a store's address or value, a discarded volatile read, a temp, an incoming value read
+  // elsewhere. Measured 2026-10-18 at canonical flags: `gp[1] = 3; return g(a, -gy) + 1;` would
+  // lift `g(a0, -gy, &gp)` on agbcc, `return g(a, c + 1) + 1;` `g(a0, a2 + 1, a2)` on all seven
+  // toolchains, and `*(volatile int *)K; g(a, b, (short)c)` made agbcc's discarded read a fourth
+  // argument.
+  for (let k = n + 1; k < top; k++) {
+    if (setUp(k)) {
+      const [gapAt, setAt] = [n, k];
+      const refuse = () =>
+        fail(
+          `cannot lift '${name}': the call ${call} ` +
+            (opts.floor
+              ? `has a prototype stating only its first ${opts.floor} argument${opts.floor === 1 ? '' : 's'}`
+              : 'has no prototype') +
+            `, ${argRegs[setAt]} holds a ` +
+            `value and ${argRegs[gapAt]} holds none — an argument register left at its incoming value and one ` +
+            `the call does not pass look the same here, so the argument count is not decidable`,
+        );
+      if (!opts.decide?.(argRegs.slice(n, k), argRegs[k], refuse)) {
+        refuse();
+      }
+      n = run(k);
+      for (let above = k + 1; above < n; above++) {
+        if (!opts.decide?.([], argRegs[above], refuse)) {
+          refuse();
+        }
+      }
+      k = n;
+    }
   }
   return n;
 }
@@ -689,15 +2195,43 @@ export function fallbackArgc(
  *  of its own block up to that instruction. */
 export interface GuessedCallSite {
   block: number;
-  /** the `call` op — its operands are the guessed arguments, in argument-register order */
+  /** the `call` op — its arguments (`callArgs`) are the guessed ones, in argument-register order */
   op: Op;
   /** argument registers written between the last call in this block (or the block's start) and here */
   freshBefore: Set<string>;
   /** did this block already make a call before this one? */
   afterCallInBlock: boolean;
+  /** what this block did to the return register before this call: a call here left it holding
+   *  nothing (`destroyed`), the block wrote it since (`written`), or neither, so the predecessors
+   *  decide (`inherited`) */
+  returnRegBefore: 'destroyed' | 'written' | 'inherited';
+  /** which earlier callee's result in the return register is an argument here, not a leftover:
+   *  the site's lowering says so ({@link SsaBuilder.recordGuessedCall}). Absent where none is. */
+  passesCalleeResult?: (result: Value) => boolean;
+  /** handed the FRESH argument registers the trim cuts from this site's guess, and the ones it
+   *  keeps — the lowering's `CallSite.leftOut` question, asked again where the arity shrinks a
+   *  second time. An unfresh cut is the trim's own proof; a fresh one went with a hole below it
+   *  (see {@link trimClobberedCallArgs}), which proves nothing. The `/setup-args` reading asks it a
+   *  third time, of the cut registers the call's own block wrote (of every one it cuts, where
+   *  `asksEveryCut`), and a refusal there withholds that reading for the site instead of declining.
+   *  Absent where nothing is asked. */
+  trimmed?: (cut: readonly string[], kept: readonly string[]) => void;
+  /** whether the frontend withholds the `/setup-args` reading from this site whatever it would cut
+   *  (`CallSite.withholdsSetupArgs`). Absent where it does not. */
+  withholdsSetupArgs?: () => boolean;
+  /** whether the `/setup-args` reading of this site asks `trimmed` of every register it cuts, an
+   *  earlier block's leftovers included ({@link narrowingKeepsFrameAddresses};
+   *  `CallSite.asksEveryCut`). Absent where it asks only of what the call's own block wrote. */
+  asksEveryCut?: () => boolean;
+  /** how many leading arguments a declaration STATES, so neither reading cuts below them: the
+   *  fixed parameters of a variadic declaration that are each one word (frontend/call-plan.ts
+   *  `variadicFloor`). Only the arguments past them are guessed. Absent where none is stated. */
+  floor?: number;
 }
 
 export interface CallArgTrim {
+  /** the function being lifted, for a refusal */
+  name: string;
   argRegs: string[];
   /** the ABI return register. Load-bearing only where it IS `argRegs[0]` (ARM r0, PPC r3) — that
    *  aliasing is what makes a callee's result indistinguishable from caller-side argument setup. */
@@ -705,8 +2239,14 @@ export interface CallArgTrim {
   /** every value a `call` op produced. Tells a callee's own return apart from a join that merely
    *  PASSES THROUGH one, which the register file cannot: both leave argument 0 unfresh. */
   calleeResults: ReadonlySet<Value>;
+  /** per block, the registers a call destroyed on SOME path into it with nothing written since. A
+   *  call lists the return register there only when it leaves it holding nothing the caller can
+   *  name — a struct handed back in it ({@link SsaBuilder.noteCall}). */
+  destroyedIn: ReadonlyArray<ReadonlySet<string>>;
   /** one entry per CFG edge, as passed to {@link makeSsaBuilder} */
   preds: number[][];
+  /** the blocks `preds` indexes, terminators included — the edges a guard proves a value on */
+  blocks: readonly Block[];
   /** per block: the keys written since its LAST call (since its start if it makes none). Indexed by
    *  block, and it holds every key the builder saw, not only argument registers. */
   freshAtEnd: Array<Set<string>>;
@@ -736,12 +2276,13 @@ export interface CallArgTrim {
  *  real argument CAN go with them: a fresh register above a hole stops the run (a 64-bit return
  *  occupies two registers and the frontend cannot express one, so the caller's r2 goes with the
  *  unfillable r1), and a callee's return read as the callee's own drops an argument a `g(f())`
- *  source did pass. A declared prototype is what closes either.
+ *  source did pass. A declared prototype is what closes either for a named callee; a call through a
+ *  register has none, so it keeps that return instead (`GuessedCallSite.passesCalleeResult`).
  *
  *  Frontend-agnostic: the caller supplies what its own lifting scan observed, so nothing here
  *  re-derives which instruction writes which register. */
 export function trimClobberedCallArgs(inp: CallArgTrim): void {
-  const { argRegs, returnReg, calleeResults, preds, freshAtEnd, callsIn, sites } = inp;
+  const { argRegs, returnReg, calleeResults, destroyedIn, preds, blocks, freshAtEnd, callsIn, sites } = inp;
   const blockCount = freshAtEnd.length;
   const all = () => new Set(argRegs);
   const localEnd = (b: number) => freshAtEnd[b] ?? new Set<string>();
@@ -792,7 +2333,7 @@ export function trimClobberedCallArgs(inp: CallArgTrim): void {
   // (`bl __mulsf3; add r1,r4,#0; bl __addsf3` is `__addsf3(__mulsf3(a, b), c)`).
   const setsUpLater = (fresh: Set<string>): boolean => argRegs.some((r, i) => i > 0 && fresh.has(r));
   // THE RETURN REGISTER IS NOT ARGUMENT SETUP. Where the ABI aliases it onto argument 0, the
-  // frontends record a call's clobber AFTER its own result, so the result leaves the register
+  // call lowering records a call's clobber AFTER its own result, so the result leaves the register
   // UNfresh here. That disproves caller setup only where the callee's return is BOTH what the
   // register still holds and all the site has to go on: with a later register set up (above), or
   // with a value no call produced — a join of one path's return with another path's caller-computed
@@ -804,20 +2345,142 @@ export function trimClobberedCallArgs(inp: CallArgTrim): void {
   // `f` to return a value and `g` to accept one — a spelling the project's own header rejects
   // outright when it does not. A declared prototype never reaches here, and stays the way `g(f())`
   // is recovered.
-  const argcAt = (fresh: Set<string>, op: Op): number => {
-    if (argRegs[0] !== returnReg || fresh.has(argRegs[0])) {
+  //
+  // A SITE THAT PASSES THE RESULT ON keeps it (`GuessedCallSite.passesCalleeResult`).
+  //
+  // THE EXEMPTION NEEDS A RESULT IN THE REGISTER. A call that hands a struct back in it (`struct W1
+  // mkw(s32)`) writes no value there — its bytes are a struct, not a word — so the register still
+  // names what it held BEFORE that call, and neither clause above can tell: that value is no callee
+  // result, which is the join clause's sign of a real argument. Destroyed on any path is no setup on
+  // that path, so the register is an ordinary unfresh one there, and the run stops below it —
+  // unless a later register is set up, which puts argument 0 below a proven one: that argument is
+  // then the struct itself (`other(mv(a), b)`), a value no register here names, and it declines.
+  //
+  // WHETHER AN EDGE PROVES `v` CONSTANT EVERYWHERE `b` IS REACHED: up the chain of blocks with one
+  // predecessor, a conditional branch on `v == K` arriving by its true edge, or on `v != K` by its
+  // false one. K is any value arithmetic builds out of literals: agbcc compares with 1000 as
+  // `mov r1,#250; lsl r1,#2; cmp r0,r1`. `v` holds every name the value goes by: compared past a join
+  // the trivial-phi pass has yet to fold, a callee's result is that join's parameter.
+  let defs: Map<Value, Op> | undefined;
+  const defOf = (v: Value): Op | undefined => {
+    defs ??= new Map(blocks.flatMap((blk) => blk.ops.flatMap((op) => op.results.map((r) => [r, op] as const))));
+    return defs.get(v);
+  };
+  const isLiteral = (v: Value): boolean => {
+    const d = defOf(v);
+    return (
+      d?.opcode === 'const' ||
+      (d !== undefined && LITERAL_ARITHMETIC.has(d.opcode) && d.operands.length > 0 && d.operands.every(isLiteral))
+    );
+  };
+  const provenConstant = (v: ReadonlySet<Value>, b: number): boolean => {
+    for (let at = b, seen = new Set<number>(); !seen.has(at);) {
+      seen.add(at);
+      const ps = [...new Set(preds[at] ?? [])];
+      if (ps.length !== 1) {
+        return false;
+      }
+      const term = terminator(blocks[ps[0]]);
+      const arrives = term?.successors.map((e) => e.block === blocks[at]) ?? [];
+      const cmp = term?.opcode === 'cond_br' && arrives[0] !== arrives[1] ? defOf(term.operands[0]) : undefined;
+      const equalEdge = cmp?.opcode === 'icmp_eq' ? 0 : cmp?.opcode === 'icmp_ne' ? 1 : -1;
+      if (
+        equalEdge >= 0 &&
+        arrives[equalEdge] &&
+        cmp!.operands.some((o) => v.has(o)) &&
+        cmp!.operands.some((o) => !v.has(o) && isLiteral(o))
+      ) {
+        return true;
+      }
+      at = ps[0];
+    }
+    return false;
+  };
+  // THE RESULT A SITE PASSES ON is looked for through the joins the trivial-phi pass has yet to
+  // fold: this trim runs before it, so a result r0 carries untouched across a loop reaches the call
+  // as the loop header's parameter, not as the callee's own value. The site passes one where every
+  // path brings it an earlier callee's result it passes (`GuessedCallSite.passesCalleeResult`) —
+  // that value, or the join itself where the paths bring different ones (`v = x ? g() : h(); p(v);`).
+  let joinArgs: Map<Value, Value[]> | undefined;
+  const joinedInto = (v: Value): Value[] | undefined => {
+    if (joinArgs === undefined) {
+      joinArgs = new Map();
+      for (const blk of blocks) {
+        for (const op of blk.ops) {
+          for (const e of op.successors) {
+            // the entry block's parameters are the function's own, whatever a back edge brings
+            if (e.block === blocks[0]) {
+              continue;
+            }
+            e.block.params.forEach((param, i) => {
+              const into = joinArgs!.get(param);
+              if (into) {
+                into.push(e.args[i]);
+              } else {
+                joinArgs!.set(param, [e.args[i]]);
+              }
+            });
+          }
+        }
+      }
+    }
+    return joinArgs.get(v);
+  };
+  const passedResult = (s: GuessedCallSite): Value | undefined => {
+    const arg = callArgs(s.op)[0];
+    const passes = s.passesCalleeResult;
+    if (arg === undefined || passes === undefined) {
+      return undefined;
+    }
+    const results = new Set<Value>();
+    const seen = new Set<Value>();
+    for (const work = [arg]; work.length > 0;) {
+      const v = work.pop()!;
+      if (seen.has(v)) {
+        continue;
+      }
+      seen.add(v);
+      const into = joinedInto(v);
+      if (into !== undefined) {
+        work.push(...into);
+      } else if (calleeResults.has(v) && passes(v)) {
+        results.add(v);
+      } else {
+        return undefined;
+      }
+    }
+    return results.size === 0 ? undefined : results.size === 1 ? [...results][0] : arg;
+  };
+  const argcAt = (s: GuessedCallSite, fresh: Set<string>): number => {
+    const destroyed =
+      s.returnRegBefore === 'destroyed' || (s.returnRegBefore === 'inherited' && destroyedIn[s.block].has(returnReg));
+    if (argRegs[0] === returnReg && !fresh.has(argRegs[0]) && destroyed && setsUpLater(fresh)) {
+      const callee = s.op.attrs.target;
+      throw new FrontendUnsupportedError(
+        `cannot lift '${inp.name}': argument 1 of the call to ${typeof callee === 'string' ? `'${callee}'` : 'a callee'} ` +
+          `is a struct an earlier call handed back in ${returnReg}, and nothing here passes one on as an argument — not modelled`,
+      );
+    }
+    if (argRegs[0] !== returnReg || fresh.has(argRegs[0]) || destroyed) {
       return runOfFresh(fresh, 0);
     }
-    if (setsUpLater(fresh) || !calleeResults.has(op.operands[0])) {
+    const op = s.op;
+    if (setsUpLater(fresh) || !calleeResults.has(callArgs(op)[0]) || passedResult(s) !== undefined) {
       return runOfFresh(new Set([argRegs[0], ...fresh]), 0);
     }
     return 0;
   };
   for (const s of sites) {
     const fresh = s.afterCallInBlock ? s.freshBefore : new Set([...freshIn[s.block], ...s.freshBefore]);
-    const n = argcAt(fresh, s.op);
-    if (n < s.op.operands.length) {
-      s.op.operands.length = n;
+    const n = Math.max(s.floor ?? 0, argcAt(s, fresh));
+    if (n < callArgs(s.op).length) {
+      // only the FRESH ones: an unfresh register is the trim's proof (a path reaches here with
+      // nothing set up in it since a call), a fresh one went with a hole below it
+      s.trimmed?.(
+        argRegs.slice(n, callArgs(s.op).length).filter((r) => fresh.has(r)),
+        argRegs.slice(0, n),
+      );
+      truncateCallArgs(s.op, n);
     }
     // The SHORTER arity the same evidence also allows, recorded for {@link narrowToSetupArgs}: the
     // run over what THIS BLOCK wrote, dropping the registers that are fresh only because no call
@@ -825,25 +2488,256 @@ export function trimClobberedCallArgs(inp: CallArgTrim): void {
     // is recorded rather than applied. A survivor is what it drops, so the join clause above has no
     // place here — but `setsUpLater` still does: a register this block set up two instructions
     // before the call is not something the narrower reading may call dead.
-    const localFresh = setsUpLater(s.freshBefore) ? new Set([argRegs[0], ...s.freshBefore]) : s.freshBefore;
-    const local = Math.min(runOfFresh(localFresh, 0), s.op.operands.length);
-    if (local < s.op.operands.length) {
+    //
+    // A SITE THAT PASSES AN EARLIER CALLEE'S RESULT ON keeps it in this reading too, except where an
+    // edge proves that result equal to a constant on the way here (`if (g() == 0) p();`): a source
+    // that passed it there makes the compiler load the constant it proved (`mov r0,#0`), so an asm
+    // with no such load passed nothing. Per site, because this reading cuts every site at once, and a
+    // drop that one site needs would otherwise drop a value another site passes.
+    const result = n > 0 ? passedResult(s) : undefined;
+    const passed = result !== undefined;
+    const dropsPassed = passed && provenConstant(new Set([result, callArgs(s.op)[0]]), s.block);
+    const localFresh =
+      setsUpLater(s.freshBefore) || (passed && !dropsPassed) ? new Set([argRegs[0], ...s.freshBefore]) : s.freshBefore;
+    const local = Math.min(Math.max(s.floor ?? 0, runOfFresh(localFresh, 0)), callArgs(s.op).length);
+    if (
+      local < callArgs(s.op).length &&
+      s.withholdsSetupArgs?.() !== true &&
+      narrowingKeepsFrameAddresses(s, argRegs, local)
+    ) {
       setupArgc.set(s.op, local);
+      if (local === 0 && dropsPassed) {
+        discardsPassedResult.add(s.op);
+      }
     }
   }
 }
 
+/** Whether the narrower reading of `s` ({@link narrowToSetupArgs}, cutting it to `local` arguments)
+ *  passes the lowering's `CallSite.leftOut` question too (`GuessedCallSite.trimmed`). That reading
+ *  is applied in the ranker AFTER the lift and its frame audit, so nothing downstream re-asks it: a
+ *  register it cuts can hold a frame address set up in the call's own block (`mov r2, sp`) above an
+ *  argument that came from an earlier one, and the cut lifts `g(a, b, s)` as `g(a)`, leaving the
+ *  stores to `s` dead.
+ *
+ *  ONLY WHAT THE CALL'S OWN BLOCK WROTE is asked (`freshBefore`). That a value an earlier block left
+ *  in a register is dead is this reading's whole guess, and a frame address is no exception: agbcc
+ *  keeps `mov r3, sp` as a store base across blocks and calls `TransformSprite(s, t)` with it still
+ *  in r3 (sa3 sub_805DADC), where the cut is the right arity. A register this block wrote is not
+ *  that guess — the block set it up for the call — so where it may hold a frame address the call
+ *  passes, the cut would drop an argument. A refusal withholds this candidate for this site only;
+ *  the default reading stands. A leftover the guess was wrong about is caught of the lifted IR
+ *  instead, where the cut leaves the object it addresses unread ({@link cutsUnreadFrameObjects}).
+ *
+ *  …AND EVERY REGISTER IT CUTS where the frontend says so (`GuessedCallSite.asksEveryCut`): a
+ *  function whose frame verdict reads every argument register a call holds as possibly handed
+ *  over, where a frame address an earlier block left is not the dead base this reading guesses at,
+ *  and the IR question cannot settle it when the object is read elsewhere too
+ *  (`if (a) h(b, a, t); else *q = t[0];` with `&t` left in r2). The question refuses only frame
+ *  addresses, so a call that cuts none still narrows. */
+function narrowingKeepsFrameAddresses(s: GuessedCallSite, argRegs: readonly string[], local: number): boolean {
+  const every = s.asksEveryCut?.() === true;
+  const cut = argRegs.slice(local, callArgs(s.op).length).filter((r) => every || s.freshBefore.has(r));
+  if (s.trimmed === undefined || cut.length === 0) {
+    return true;
+  }
+  try {
+    s.trimmed(cut, argRegs.slice(0, local));
+    return true;
+  } catch (e) {
+    if (e instanceof FrontendUnsupportedError) {
+      return false;
+    }
+    throw e;
+  }
+}
+
+/** The opcodes whose result is a literal when every operand is one ({@link trimClobberedCallArgs}). */
+const LITERAL_ARITHMETIC: ReadonlySet<string> = new Set([
+  'add',
+  'sub',
+  'mul',
+  'and',
+  'or',
+  'xor',
+  'shl',
+  'shr_u',
+  'shr_s',
+  'not',
+  'neg',
+]);
+
 /** The narrower arity {@link narrowToSetupArgs} would cut each guessed call to. A SIDE table and
  *  not an attr: this is a fact about one LIFT, not part of the IR the rest of the pipeline compares
  *  and prints — `structure/hazards.ts` decides two ops equal by comparing their attrs verbatim, so
  *  an attr only one of an otherwise-matching pair carries would cost a recovery. */
 const setupArgc = new WeakMap<Op, number>();
 
+/** The calls whose narrower arity drops an earlier callee's result that the site passes on
+ *  (`GuessedCallSite.passesCalleeResult`): only where an edge proves that result constant on the way
+ *  to the call ({@link trimClobberedCallArgs}). Read by {@link setupArgsDiscardsPassedResult}. */
+const discardsPassedResult = new WeakSet<Op>();
+
+/** Whether {@link narrowToSetupArgs} drops, somewhere in `fn`, an earlier callee's result that a
+ *  call through a register is passed — the fact that makes the narrowed lift's candidates lose a
+ *  score tie (`Candidate.discardsPassedResult`). */
+export function setupArgsDiscardsPassedResult(fn: Fn): boolean {
+  return fn.blocks.some((b) => b.ops.some((op) => discardsPassedResult.has(op)));
+}
+
 /** Whether anything in `fn` HAS the narrower reading — the variation's gate, so the ~99% of functions
  *  with no narrowable call cost no re-lift. Read it off the lift itself: a later pipeline stage may
- *  replace a `call` op (softdiv rewrites one to a division), and the table is keyed by op. */
+ *  replace a `call` op (softdiv rewrites one to a division), and the table is keyed by op. A call
+ *  {@link cutsUnreadFrameObjects} withholds has none. */
 export function hasSetupArgsNarrowing(fn: Fn): boolean {
-  return fn.blocks.some((b) => b.ops.some((op) => setupArgc.has(op)));
+  if (!fn.blocks.some((b) => b.ops.some((op) => setupArgc.has(op)))) {
+    return false;
+  }
+  const withheld = cutsUnreadFrameObjects(fn);
+  return fn.blocks.some((b) => b.ops.some((op) => setupArgc.has(op) && !withheld.has(op)));
+}
+
+/** A frame address in the lifted IR: a `laddr`'s offset plus the constants added to it. `exact` is
+ *  false once a term that is not a constant was added (`&buf[i]`), and `off` is then the address
+ *  that term was added to. `end` is where the `laddr`'s storage ends. */
+interface FrameAddress {
+  readonly off: number;
+  readonly exact: boolean;
+  readonly end: number;
+}
+
+/** The calls whose `/setup-args` reading cuts the address of a frame object nothing else in `fn`
+ *  reads, under that reading — which is then withheld for that call, the default reading standing.
+ *
+ *  THE QUESTION THE IR CAN ANSWER of a frame address an earlier block left in a register the reading
+ *  cuts. That such a leftover is dead is the reading's whole guess, and agbcc does leave a dead
+ *  `mov r3, sp` store base in a call's argument registers (sa3 sub_805DADC, which reloads the
+ *  object after the call). Where the leftover was an argument after all, cutting it leaves the
+ *  object's stores with no reader: `if (a) g(b, s)` with `s` left in r1 by the entry block lifts as
+ *  `g(a1)` beside `s[0] = a0; s[1] = a1;`, which nothing reads. A source that compiled to those stores
+ *  read the object somewhere, so a cut that leaves it unread drops an argument. The register file
+ *  cannot tell the two leftovers apart; the object's readers can.
+ *
+ *  A READER is any use of an address into the object but the address operand of a store into it
+ *  and an argument the narrower reading cuts — a load, an address stored or returned or carried
+ *  to another block, an argument some call still passes. The other calls are read under the same
+ *  narrowing, since the ranker applies it to every call at once.
+ *
+ *  THE OBJECT is the span between the offsets the function forms addresses at or accesses. Where the
+ *  frame audit sized one `laddr` over two source objects (an escaped `sp+k`, which excuses every word
+ *  from k up), the address the compiler formed for the second one (`add r2, sp, #0xc`) is where it
+ *  starts: `int s[3]; char t[16]; ... if (a) g(b, s, t)` cut to `g(a1, sp0)` leaves `t` unread
+ *  though `sp0` is passed. An access's offset counts as well, because the lift folds a formed
+ *  `add r4, sp, #8` into the offsets of the loads and stores through r4, so the `laddr` they share
+ *  no longer says where the second object starts. Splitting finer only withholds more. A load or
+ *  argument at an offset reads the span it falls in. An address with a term that is not a constant
+ *  reads its base's span: an index stays inside the object its base addresses.
+ *
+ *  NOT ANSWERED HERE: a cut whose object is read elsewhere too. That leftover cannot be told from the
+ *  sub_805DADC dead base, by the IR or by the register file, so it narrows, except where the frontend
+ *  withholds the reading at that call (`GuessedCallSite.withholdsSetupArgs`) or asks the register
+ *  question of every cut there (`GuessedCallSite.asksEveryCut`). */
+function cutsUnreadFrameObjects(fn: Fn): Set<Op> {
+  const def = defOpMap(fn);
+  const memo = new Map<Value, FrameAddress | null>();
+  const frameAddress = (v: Value): FrameAddress | null => {
+    if (memo.has(v)) {
+      return memo.get(v)!;
+    }
+    memo.set(v, null); // a cycle through a phi's operands is no frame address
+    const d = def.get(v);
+    let r: FrameAddress | null = null;
+    if (d?.opcode === 'laddr') {
+      const off = d.attrs.off as number;
+      r = { off, exact: true, end: off + (d.attrs.width as number) * (d.attrs.count as number) };
+    } else if ((d?.opcode === 'add' || d?.opcode === 'sub') && d.operands.length === 2) {
+      const konst = (x: Value): number | undefined => {
+        const k = def.get(x);
+        return k?.opcode === 'const' && typeof k.attrs.value === 'number' ? k.attrs.value : undefined;
+      };
+      const [x, y] = d.operands;
+      const fx = frameAddress(x);
+      const fy = d.opcode === 'add' ? frameAddress(y) : null; // `k - &s` is no address
+      const base = fx === null ? fy : fy === null ? fx : null;
+      if (base !== null) {
+        const k = konst(fx === null ? x : y);
+        r =
+          k === undefined || !base.exact
+            ? { ...base, exact: false }
+            : { ...base, off: d.opcode === 'add' ? base.off + k : base.off - k };
+      }
+    }
+    memo.set(v, r);
+    return r;
+  };
+  const bounds = new Set<number>();
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      for (const r of op.results) {
+        frameAddress(r);
+      }
+      const at = op.opcode === 'load' || op.opcode === 'store' ? frameAddress(op.operands[0]) : null;
+      if (at?.exact) {
+        bounds.add(at.off + (op.attrs.off as number)); // an access's offset (see THE OBJECT)
+      }
+    }
+  }
+  for (const a of memo.values()) {
+    if (a !== null) {
+      bounds.add(a.end);
+      if (a.exact) {
+        bounds.add(a.off);
+      }
+    }
+  }
+  const sorted = [...bounds].sort((x, y) => x - y);
+  /** the span an access at `a` (plus `extra` bytes) reads — see THE OBJECT above */
+  const span = (a: FrameAddress, extra = 0): [number, number] => {
+    const at = a.off + extra;
+    const lo = sorted.filter((x) => x <= at).pop() ?? at;
+    const hi = sorted.find((x) => x > at) ?? a.end;
+    return [lo, Math.max(hi, lo + 1)];
+  };
+  const reads: [number, number][] = [];
+  const cuts = new Map<Op, [number, number][]>();
+  const read = (v: Value, extra = 0): void => {
+    const a = frameAddress(v);
+    if (a !== null) {
+      reads.push(span(a, extra));
+    }
+  };
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      if ((op.opcode === 'add' || op.opcode === 'sub') && frameAddress(op.results[0]) !== null) {
+        continue; // a derivation: its result's uses are the ones that read
+      }
+      const args = op.opcode === 'call' ? callArgs(op) : [];
+      const keep = setupArgc.get(op) ?? args.length;
+      op.operands.forEach((v, i) => {
+        if ((op.opcode === 'store' || op.opcode === 'astore') && i === 0) {
+          return;
+        }
+        if (op.opcode === 'call' && i >= keep && i < args.length) {
+          const a = frameAddress(v);
+          if (a !== null) {
+            cuts.set(op, [...(cuts.get(op) ?? []), span(a)]);
+          }
+          return;
+        }
+        read(v, op.opcode === 'load' && i === 0 ? (op.attrs.off as number) : 0);
+      });
+      for (const s of op.successors) {
+        s.args.forEach((v) => read(v));
+      }
+    }
+  }
+  const withheld = new Set<Op>();
+  for (const [op, spans] of cuts) {
+    if (spans.some(([lo, hi]) => !reads.some(([rlo, rhi]) => rlo < hi && rhi > lo))) {
+      withheld.add(op);
+    }
+  }
+  return withheld;
 }
 
 /** Cut every guessed call to the arity its OWN BLOCK set up, and report whether anything moved.
@@ -861,11 +2755,16 @@ export function hasSetupArgsNarrowing(fn: Fn): boolean {
  *  Applies only to arities that were GUESSED — a declared prototype never recorded the fact. */
 export function narrowToSetupArgs(fn: Fn): boolean {
   let changed = false;
+  const withheld = cutsUnreadFrameObjects(fn);
   for (const b of fn.blocks) {
     for (const op of b.ops) {
+      if (withheld.has(op)) {
+        setupArgc.delete(op);
+        discardsPassedResult.delete(op);
+      }
       const setup = setupArgc.get(op);
-      if (setup !== undefined && setup < op.operands.length) {
-        op.operands.length = setup;
+      if (setup !== undefined && setup < callArgs(op).length) {
+        truncateCallArgs(op, setup);
         changed = true;
       }
     }
@@ -879,9 +2778,23 @@ export function narrowToSetupArgs(fn: Fn): boolean {
   return changed;
 }
 
-/** The stack-slot key both the MIPS and Thumb frontends use for a word-sized local in the
- *  function's own frame. Shared so the two spell it identically and the frame-partition rule can
- *  recognise either frontend's slots. See the virtual-key note in the module header. */
+// ── shared frontend tail helpers ──
+
+/** The `undef` attribute naming the other keys whose undefined values a collapsed join absorbed
+ *  (`collapseUndefinedJoins`), comma-separated. Read once, by the own-entry bound (pipeline.ts `readDroppedArgRegs`),
+ *  and removed before anything else sees the lift. */
+export const ABSORBED_KEYS = 'absorbed';
+
+/** The `undef` attribute marking an undefined value the machine stored to a stack slot nothing reads
+ *  back (`finish`, the same test as an entry parameter's `deadHome`). The store reaches no op, so the
+ *  value looks dead, yet the asm read the register: IDO at -g3 and -O0 homes every argument register
+ *  its definition declares (`sw a1,4(sp)`) whether or not the body uses it. Read once, by the
+ *  own-entry bound (pipeline.ts `readDroppedArgRegs`), and removed with `ABSORBED_KEYS`. */
+export const HOMED_UNDEF = 'homed';
+
+/** The stack-slot key the MIPS, Thumb and PowerPC frontends use for a word-sized local in the
+ *  function's own frame. Shared so they spell it identically and the frame-partition rule can
+ *  recognise any frontend's slots. See the virtual-key note in the module header. */
 const SLOT_PREFIX = 'sp@';
 export const stackSlotKey = (off: number): string => `${SLOT_PREFIX}${off}`;
 /** The byte offset a slot key names, or null if `key` is not a slot key at all (an ordinary
@@ -890,20 +2803,116 @@ export const stackSlotKey = (off: number): string => `${SLOT_PREFIX}${off}`;
 export const slotKeyOffset = (key: string): number | null =>
   key.startsWith(SLOT_PREFIX) ? Number(key.slice(SLOT_PREFIX.length)) : null;
 
-/** Order the TRUE entry block's parameters by ABI argument register, so downstream naming
- *  (`a0`, `a1`, …) matches the calling convention, not first-read order (a callee-saved copy can
- *  read a later argument register first). No-op when the entry has predecessors — a loop
- *  header's params are phis position-aligned with predecessor terminator args and must not be
- *  reordered. `rank` is per-ISA: the tie-break for a non-ABI live-in deliberately differs
- *  (Thumb sorts it LAST via 99, MIPS/PPC FIRST via indexOf's -1) to keep each frontend's
- *  output byte-exact. */
+/** The virtual key of incoming stack argument `index` (its ABI argument rank, the registers
+ *  counted), which the Thumb, MIPS and PPC frontends read an incoming stack word through. Reading it goes
+ *  through the ordinary Braun live-in path, which turns a read with no reaching def into a function
+ *  parameter — so it needs NO new representation, opcode or pass. The `@` cannot appear in a real
+ *  register token, so the key cannot collide with one. */
+const STACK_ARG_PREFIX = '@sarg';
+export const stackArgKey = (index: number): string => `${STACK_ARG_PREFIX}${index}`;
+/** The {@link stackArgKey} of the incoming word at `entryOff` bytes above the caller's stack pointer,
+ *  on an ABI whose caller's parameter area starts `paramAreaAt` bytes above it and whose first
+ *  `regArgs` argument words travel in registers: word k past them is at `paramAreaAt + 4k`
+ *  (O32: 16, past the a0..a3 home; the PPC EABI: 8, past the back chain and the LR save word).
+ *  Undefined below the area and for an offset off the word grid. */
+export const incomingStackArgKey = (entryOff: number, paramAreaAt: number, regArgs: number): string | undefined =>
+  entryOff >= paramAreaAt && entryOff % 4 === 0 ? stackArgKey(regArgs + (entryOff - paramAreaAt) / 4) : undefined;
+/** The argument rank a {@link stackArgKey} names, or null for any other key. Defined beside its mint
+ *  site on purpose: the format string and its parser once drifted 650 lines apart. */
+export const stackArgIndex = (key: string): number | null => {
+  const m = /^@sarg(\d+)$/.exec(key);
+  return m ? +m[1] : null;
+};
+
+/** Where a live-in of the entry block sits in the calling convention: `slotOf` gives its ABI
+ *  argument rank (a register or an incoming stack word), or null for a live-in no argument arrives
+ *  in — an uninitialised register the body reads; `holes` gives the keys of the argument slots the
+ *  convention proves precede the ones read (`readKeys`), whether or not the body reads them. One per
+ *  frontend, read by both halves of the entry-parameter rule: {@link mintArgSlotHoles} and
+ *  {@link abiSortEntryParams}.
+ *
+ *  `holes` is a function of everything read, not a slot-to-key table, because where two register
+ *  files share one slot sequence (MIPS o32's floats) the file a hole comes from depends on what the
+ *  function reads — `frontend/fpu.ts` `fpuArgSlots`.
+ *
+ *  Both halves need an entry block with NO predecessors, whose parameters are the function's own.
+ *  A loop header's are phis, index-aligned with its predecessors' edge arguments, and neither
+ *  minting one nor reordering them is legal there — so a frontend whose first block is a branch
+ *  target inserts an empty preheader ahead of it (each frontend's `preheader` note). */
+export interface ArgSlots {
+  slotOf(key: string): number | null;
+  holes(readKeys: readonly string[]): string[];
+}
+
+/** The slots of a convention that passes arguments in `argRegs` only: every register below the
+ *  highest one read. */
+export const registerArgSlots = (argRegs: readonly string[]): ArgSlots => ({
+  slotOf: (key) => (argRegs.includes(key) ? argRegs.indexOf(key) : null),
+  holes: (readKeys) => argRegs.slice(0, Math.max(0, ...readKeys.map((k) => argRegs.indexOf(k)))),
+});
+
+/** The slots of a convention that passes arguments past `argRegs` on the stack: `regs` for the
+ *  registers, then incoming stack word k as slot k ({@link stackArgKey}). Reading a stack word
+ *  proves every register slot and every lower stack word precede it, one word per argument.
+ *  `besideStackWords` is the convention's own refusal of a read it cannot place beside them (O32's
+ *  float arguments, which take integer slots this rule does not count), called with the highest
+ *  stack slot read. */
+export const stackArgSlots = (
+  regs: ArgSlots,
+  argRegs: readonly string[],
+  besideStackWords?: (readKeys: readonly string[], top: number) => void,
+): ArgSlots => ({
+  slotOf: (key) => stackArgIndex(key) ?? regs.slotOf(key),
+  holes: (readKeys) => {
+    const top = Math.max(-1, ...readKeys.map((k) => stackArgIndex(k) ?? -1));
+    if (top < 0) {
+      return regs.holes(readKeys);
+    }
+    besideStackWords?.(readKeys, top);
+    return Array.from({ length: top }, (_, k) => (k < argRegs.length ? argRegs[k] : stackArgKey(k)));
+  },
+});
+
+/** A rank past every argument slot, for a live-in that is not one. */
+const NOT_AN_ARGUMENT = Number.MAX_SAFE_INTEGER;
+
+/** Give the entry block a parameter for every argument slot below the highest one it takes. Naming
+ *  is POSITIONAL (`a0`, `a1`, … in {@link abiSortEntryParams} order), so a slot the body never reads
+ *  drops out of the signature and binds every later argument one slot low, silently: `int f(int a,
+ *  int b, int c) { return a + c; }` reads r3 and r5, and lifted as `f(a0, a1)` with r5 in r4's slot.
+ *  Arguments take their slots in order, registers first and then the stack words, so reading slot
+ *  k proves slots 0..k-1 precede it — an obligation on the signature, which is what `ensureParam`
+ *  is for. A live-in that is no slot proves nothing about that sequence. Call it before `finish()`,
+ *  which records evidence for every entry parameter. */
+export function mintArgSlotHoles(
+  ssa: Pick<SsaBuilder, 'irBlocks' | 'paramReg' | 'ensureParam'>,
+  entryHasPreds: boolean,
+  slots: ArgSlots,
+): void {
+  assertTrueEntry(entryHasPreds);
+  const read = ssa.irBlocks[0].params.map((p) => ssa.paramReg.get(p)).filter((k): k is string => k !== undefined);
+  for (const k of slots.holes(read)) {
+    ssa.ensureParam(k, 0);
+  }
+}
+
+/** Order the entry block's parameters by ABI argument slot, so downstream naming (`a0`, `a1`, …)
+ *  matches the calling convention, not first-read order (a callee-saved copy can read a later
+ *  argument register first). A live-in that is no slot goes after every one that is: ranked
+ *  first, it takes `a0` and binds every real argument one slot high. */
 export function abiSortEntryParams(
   entry: { params: Value[] },
   entryHasPreds: boolean,
-  rank: (v: Value) => number,
+  paramReg: ReadonlyMap<Value, string>,
+  slots: ArgSlots,
 ): void {
+  assertTrueEntry(entryHasPreds);
+  const rank = (v: Value): number => slots.slotOf(paramReg.get(v) ?? '') ?? NOT_AN_ARGUMENT;
+  entry.params.sort((x, y) => rank(x) - rank(y));
+}
+
+function assertTrueEntry(entryHasPreds: boolean): void {
   if (entryHasPreds) {
-    return;
+    throw new Error('internal: the entry-parameter rule needs an entry block with no predecessors');
   }
-  entry.params.sort((x, y) => rank(x) - rank(y));
 }