@asmlift/core 0.8.1 → 0.10.0

package/src/target.ts

@@ -13,27 +13,50 @@
 //   • capabilities.endianness → structureOptionsFor (`littleEndian`), gating LSB-first
 //     bitfield-extract recognition in the structurer.
 //   • capabilities.flags → RESERVED, not yet read by any pass (PPC condition regs will).
-//   • capabilities.readOnlyAddressSinks → the Thumb frame-object audit: a frame address stored to
+//   • capabilities.readOnlyAddressSinks → the frame-object audit: a frame address stored to
 //     one of these reached a device that only reads through it, so it does not retract `undef`.
+//   • capabilities.readSourceControl → the same audit: which frame bytes beside the object that
+//     device may read, so a slot it cannot reach is not refused.
+//   • capabilities.blockTransferCalls → the same audit: a frame address handed to one of these
+//     as its SOURCE is read as far as the call's literal control word says, and never written.
 //   • capabilities.deviceRegisters → five readers, and they ask ONE question — "would a source
 //     have spelled this address `volatile`" — which is a question about SPELLING and may be
 //     approximate: the `/vol-store` variation's eligibility (l3/volstore.ts), rank.ts's volatility
 //     tie-break between two byte-identical spellings, the first half of `/unreduce`'s
 //     disjointness gate (l3/unreduce.ts), the `/homesplit` pairing's refusal to leave a device
-//     READ inline where the spelling it replaces would have qualified it (l3/homesplit.ts), and
-//     the structurer's refusal to SPELL a dead memory read whose address no qualifier could ever
-//     reach (structure.ts `volatileQualifiable`, threaded through StructureOptions).
+//     READ inline where the spelling it replaces would have qualified it (l3/homesplit.ts), and the
+//     device pin (frontend/device-pins.ts), which spells every access in the window `volatile`
+//     in a function the frame-object audit keeps as one object, and in one it accepts object by
+//     object every device read and the device stores a later store in their block overwrites —
+//     under either policy save a read the compiler could not have made of a `volatile`
+//     (`volatileReadsExtendInRegister`).
+//     That last reader makes the answer a correctness one — agbcc deletes or hoists a plain
+//     device access the machine made — so it may be approximate in ONE direction only: the
+//     window must cover every register a source reaches, and covering more costs a spelling,
+//     never an access.
 //   • capabilities.deviceMemoryWriters → the MEMORY-MODEL question, which is a different one and
 //     may NOT be approximate: "can a write to this register make the DEVICE write ordinary
 //     memory". One reader — `/unreduce`'s second half. Split from `deviceRegisters` because
 //     conflating them recorded a false premise (see the field's own comment).
 //   • compilerBehaviors.* → mostly consumed by the structurer (threaded via StructureOptions).
-//     Five exceptions are read off the target directly, their consumers not being the
-//     structurer: `nearBaseSpan` and `foldsConstAddrOffset` (rank.ts, L3 respell variations),
-//     `reloadsLocalReread` (raise/pre-recovery.ts), `hoistsSingleSetArm` (two raising passes —
-//     raise/narrowlocal.ts and raise/retsink.ts) and
-//     `arrayShapeFromStride` (raise/globalshape.ts, run on the LIFTED fn). The field names are a
-//     SUPERSET of StructureOptions' — see `structureOptionsFor`.
+//     Others are read off the target directly by a consumer that is not the structurer — among
+//     them `nearBaseSpan` and `foldsConstAddrOffset` (rank.ts, L3 respell variations),
+//     `reloadsLocalReread`, `narrowParamWitness` and `aggregateBoundary` (raise/pre-recovery.ts),
+//     `aggregateReturn`, `largestAlignment`, `enumBytes`, `bitfieldPacking` and
+//     `byValueAggregateArgWords` (aggregate.ts, for frontend/call-plan.ts — which the Thumb, MIPS
+//     and PowerPC lowerings share — frontend/thumb.ts, frontend/mips.ts, frontend/ppc.ts and
+//     frontend/frame-objects.ts),
+//     `hoistsSingleSetArm` (raise/narrowlocal.ts and raise/retsink.ts), `arrayShapeFromStride`
+//     (raise/globalshape.ts, run on the LIFTED fn), `eightByteReturnScratch`
+//     (frontend/thumb.ts, which reads the epilogue), `callThunks` (frontend/thumb.ts, which
+//     lowers a `bl` to one as a call through its register), `farJumpRelay` (frontend/thumb.ts,
+//     which lowers a marked `bl` to the branch it stands for), `roundTripsDoubleLiterals`
+//     (raise/floathelpers.ts), `volatileReadsExtendInRegister` (frontend/device-pins.ts, and
+//     raise/declared-volatile.ts through liftStamped and the offset-name pass), and
+//     `keepsUnusedReads` and `discardsUnusedReadsInto` (frontend/dead-reads.ts, the second
+//     gathered by frontend/ppc.ts and frontend/mips.ts as they lower a load). The
+//     field names are a SUPERSET of
+//     StructureOptions' — see `structureOptionsFor`.
 //
 // `capabilities` (HARDWARE facts) vs `compilerBehaviors` (COMPILER canonicalization decisions) are
 // deliberately separate bags: a new compiler must set its behaviors EXPLICITLY instead of
@@ -42,27 +65,192 @@
 // This module is browser-pure by contract (no Node APIs, enforced by
 // test/browser-safe.test.ts): the toolchain paths that COMPILE for these targets
 // live in @asmlift/toolchains.
-import { type CodegenProfile, type FlagFamily, parseFlags } from './codegen-flags';
+import { type CodegenProfile, type FlagFamily, dialectOf, parseFlags } from './codegen-flags';
+import type { Op } from './ir/core';
+import { PRELUDE_TYPEDEFS, type ParamType, type Prototypes, declaredWidth, spellableType } from './proto';
+import {
+  AGBCC_RUNTIME_HELPERS,
+  IDO_RUNTIME_HELPERS,
+  MIPS_GCC_RUNTIME_HELPERS,
+  PPC_MWCC_RUNTIME_HELPERS,
+  PPC_MWCC_SAVE_ROUTINES,
+  type RegisterSaveRoutines,
+  type RuntimeHelper,
+} from './runtime-helpers';
+import type { StaticLayout } from './structure/local-statics';
 import type { StructureOptions } from './structure/structure';
+import type { SwitchBoundCase } from './structure/switch-recover';
 
 /** What a compiler's OBJECT shows for a narrow declared parameter — see
  *  `compilerBehaviors.narrowParamWitness` for the compiled pair behind each value. */
 export type NarrowParamWitness = 'prologue-extension' | 'home-store-and-in-place' | 'none';
 
+/** What one transfer reads from its SOURCE, as its control bits say: the `unit` it reads in, and
+ *  which way it `walk`s from the address — `fixed` re-reading one unit, `increment` upward for
+ *  `bytes` when the control says how many and without end when it does not, `decrement` downward
+ *  without end. Each transfer source decodes its own bit layout into this (`sourceControlRead`,
+ *  `blockTransferRead`), and `sourceReach` alone turns it into frame bytes. */
+export interface SourceRead {
+  unit: number;
+  walk: 'fixed' | 'increment' | 'decrement';
+  bytes?: number;
+}
+
+/** WHERE THIS ABI CAN LEAVE A GENERAL ARGUMENT REGISTER EMPTY BELOW ONE A CALL FILLS — the two ways
+ *  argument words stop filling in order, read off the facts that already place them:
+ *   - `skippable`: the registers an argument aligned to 8 can skip, every odd argument word where
+ *     `evenWordAlignedArgs` holds (O32 `a1`/`a3`, PowerPC `r4`/`r6`/`r8`/`r10`). Compiled on
+ *     2026-10-18: `g(1, b, 3LL)` and `g(1, 3LL)` are one object on gcc2.7.2kmc, gcc2.7.2 and the
+ *     three mwcc builds, `a1`/`r4` untouched under a set pair. agbcc fills every word in order
+ *     (`g(1, 3LL)` is r0, r1:r2), so it has none.
+ *   - `leadingFloatShadow`: a leading floating argument travels in the FPU's registers and leaves
+ *     the general words it counts against holding nothing (`fpu.slots: 'leading'`, O32): with `gp`
+ *     unprototyped, `gp(x, 5)` of a `float x` parameter and of an `int x` one compile alike on
+ *     ido7.1, gcc2.7.2kmc and gcc2.7.2 (`li a1,5`, `a0` untouched). PowerPC's floats take no general
+ *     word (`'separate'`), so they leave no hole there.
+ *  Its reader is the guessed-arity gap (frontend/call-plan.ts `decideGap`). */
+export function argRegisterHoles(target: Pick<TargetDescription, 'argRegs' | 'evenWordAlignedArgs' | 'fpu'>): {
+  skippable: ReadonlySet<string>;
+  leadingFloatShadow: boolean;
+} {
+  return {
+    skippable: new Set(target.evenWordAlignedArgs ? target.argRegs.filter((_, k) => k % 2 === 1) : []),
+    leadingFloatShadow: target.fpu?.slots === 'leading',
+  };
+}
+
+/** The bytes a source read reaches from an address `off` bytes into the frame, as `[lo, hi)`
+ *  relative to that address. The machine may force the address down to a unit boundary — the
+ *  GBA's DMA and BIOS both do — so a 32-bit read of the halfword at [sp,#2] reads from [sp,#0],
+ *  and the object below shares its unit. The frame base is at least unit-aligned, so the offset
+ *  says how far down. */
+export function sourceReach(read: SourceRead, off: number): { lo: number; hi: number } {
+  return {
+    lo: read.walk === 'decrement' ? -Infinity : 0 - (off % read.unit),
+    hi: read.walk === 'increment' ? (read.bytes ?? Infinity) : read.unit,
+  };
+}
+
+/** Could the source have made this read through a `volatile` lvalue, on a compiler that behaves as
+ *  `behaviors` says? Not a sign-extending narrow load where the compiler extends a qualified narrow
+ *  read in a register (`volatileReadsExtendInRegister`): the qualified read is another instruction
+ *  sequence. The device pin (frontend/device-pins.ts) and the `declared` stamp
+ *  (raise/declared-volatile.ts) both ask it, so the two placements read one load the same way. */
+export function readCouldBeVolatile(
+  behaviors: Pick<TargetDescription['compilerBehaviors'], 'volatileReadsExtendInRegister'>,
+  op: Op,
+): boolean {
+  const width = (op.opcode === 'aload' ? op.attrs.elemSize : op.attrs.width) as number;
+  return !(behaviors.volatileReadsExtendInRegister === true && op.attrs.signed === true && width < 4);
+}
+
+/** A device channel's source control, read off the halfword at `sink + offset` of a
+ *  `readOnlyAddressSinks` register: `modes`, indexed by `(control >> modeShift) & (modes.length -
+ *  1)`, is the way the source address steps per unit, null for a setting that bounds nothing; a
+ *  unit is `units[1]` bytes when `wideBit` is set and `units[0]` when not. See `sourceControlRead`. */
+export interface SourceControl {
+  offset: number;
+  modeShift: number;
+  modes: readonly ('increment' | 'decrement' | 'fixed' | null)[];
+  wideBit: number;
+  units: readonly [number, number];
+}
+
+/** The source read one control halfword arms, or null for a mode that bounds nothing. The count
+ *  lives in another register, so an incrementing read carries no `bytes`. */
+export function sourceControlRead(control: SourceControl, half: number): SourceRead | null {
+  const unit = control.units[(half & control.wideBit) !== 0 ? 1 : 0];
+  const walk = control.modes[(half >> control.modeShift) & (control.modes.length - 1)];
+  return walk === null || walk === undefined ? null : { unit, walk };
+}
+
+/** How far a block-transfer call reads through its `source` argument, decoded from the argument
+ *  at `control`: `control & countMask` units, of `units[1]` bytes when `wideBit` is set and
+ *  `units[0]` when not, rounded up to a multiple of `countGranule` units — or ONE unit when
+ *  `fixedBit` is set, since a fill reads its source once. See `blockTransferRead`. */
+export interface BlockTransferCall {
+  source: number;
+  control: number;
+  countMask: number;
+  fixedBit: number;
+  wideBit: number;
+  units: readonly [number, number];
+  countGranule: number;
+}
+
+/** The source read a block-transfer call makes for a literal control word. */
+export function blockTransferRead(call: BlockTransferCall, control: number): SourceRead {
+  const unit = call.units[(control & call.wideBit) !== 0 ? 1 : 0];
+  if ((control & call.fixedBit) !== 0) {
+    return { unit, walk: 'fixed' };
+  }
+  const count = (control & call.countMask) >>> 0;
+  return { unit, walk: 'increment', bytes: Math.ceil(count / call.countGranule) * call.countGranule * unit };
+}
+
 export interface TargetDescription {
   id: string; // the ISA — 'armv4t' / 'mips' / 'ppc'. Selects the frontend (registry.ts).
   // The COMPILER is a first-class field distinct from the ISA (matching = deoptimize to a specific
   // compiler): two targets can share an ISA (⇒ one frontend) yet differ here — e.g. MIPS_IDO vs
-  // MIPS_GCC. Consumed by pattern gating (patternApplies) and the report. (version/flags/language
-  // are future fields, added when earned.)
+  // MIPS_GCC. Consumed by pattern gating (patternApplies) and the report. (version/flags are future
+  // fields, added when earned.)
   compiler: string; // 'agbcc' / 'ido' / 'gcc' / 'mwcc'
+  /** `'c++'` when the build compiles its unit as C++ (mwcc `-lang=c++`/`ec++`), which is what
+   *  `targetFor` reads off the flags; absent is C. A candidate is C-shaped text either way — only
+   *  what the C++ front end refuses differs, and `structureOptionsFor` is where that is answered. */
+  dialect?: 'c++';
   argRegs: string[];
   returnReg: string;
+  /** The floating-point ABI: where a float argument and a float return travel, on a target whose
+   *  frontend lifts hardware floating point (`docs/floating-point.md`). ABSENT ⇒ none is claimed, and
+   *  a frontend refuses every read of its FPU file that no instruction of the function wrote.
+   *
+   *  `argRegs` are the float argument registers in argument order, spelled as the frontend keys
+   *  them; `returnReg` the float return. `slots` is how they count against `argRegs` above, and the
+   *  two ABIs here differ in kind rather than in degree — both MEASURED by compiling (below):
+   *   - `'leading'` (MIPS o32): argument k is in `argRegs[k]` only while arguments 0..k are ALL
+   *     floating, and it still takes integer slot k — `float f(float a, int b)` reads `$f12` and
+   *     `a1`, while `float f(int a, float b)` receives `b` in `a1` and moves it over with `mtc1`.
+   *   - `'separate'` (PowerPC EABI): floating arguments count on their own and take no integer
+   *     slot — `float g(int *p, float b)` and `float g(float b, int *p)` are one object, `r3` and
+   *     `f1` either way. */
+  fpu?: { argRegs: readonly string[]; returnReg: string; slots: 'leading' | 'separate' };
+  /** A `double` crosses a call in GENERAL argument words: the two a 64-bit argument takes wherever
+   *  this target's call placement puts them, HIGH word first, so the sign and exponent are in the
+   *  first word. Its readers are `proto.ts` `declaredCallArgs` (the call's layout) and
+   *  `raise/floathelpers.ts` (a literal's two words). ABSENT ⇒ a declared `double` parameter states
+   *  no layout and the call takes the arg-register guess.
+   *
+   *  IT IS AN ABI FACT BESIDE `fpu`, NOT INSTEAD OF IT. Where the words go is the frontend's 64-bit
+   *  placement, which a `long long` shares; this states only that a double takes them, and their
+   *  order, which a `long long` need not share. agbcc: FLOAT_WORDS_BIG_ENDIAN 1
+   *  (gcc/config/arm/thumb.h:335) on a little-endian target, so the pair is not a `long long`'s
+   *  naming of the same bits; FUNCTION_ARG (:632) places by word offset, FUNCTION_ARG_PARTIAL_NREGS
+   *  (:636) splits a pair across r3 and the stack, FUNCTION_ARG_ADVANCE (:647) rounds to a word and
+   *  PARM_BOUNDARY is 32 (:354).
+   *
+   *  o32 MIPS has an FPU and a double after an integer argument still takes two general words,
+   *  high first, at an even word as its `long long` does (`evenWordAlignedArgs`). The MIPS targets
+   *  do not state it because their frontend lays out no 64-bit argument (`CallLowering.pairs`).
+   *  PowerPC EABI passes a double in a float register that takes no general word
+   *  (`fpu.slots: 'separate'`), so it has none to state. */
+  doubleArgWords?: 'high-first';
+  /** AN ARGUMENT ALIGNED TO 8 STARTS AT AN EVEN ARGUMENT WORD, and the word it skips is left empty:
+   *  a `long long`, a `double` in general words, and a struct passed by value whose alignment is 8,
+   *  alike. `proto.ts` `wordsOf` counts the skipped word, and `aggregate.ts` `byValueCallArgs` reads
+   *  the same count to place a struct. O32, compiled on ido7.1, gcc2.7.2kmc and gcc2.7.2:
+   *  `takeLL(1, 0x200000003LL)` and `takeD(1, 2.5)` set `a0` and `a2:a3` with `a1` unset, and so does
+   *  `takeL(s32 k, struct L { long long v; } l)`; at word 0 each is `a0:a1`. mwcc's PowerPC EABI aligns
+   *  a `long long` the same way (its doubles take no general word, and a struct passed by value is
+   *  passed by address). ABSENT ⇒ every argument takes the next free word: agbcc (the note at
+   *  `wordsOf`). */
+  evenWordAlignedArgs?: true;
   /** Registers this ABI does NOT pass arguments in — half of what makes a def-less live-in read an
    *  uninitialised local rather than an argument. The other half is a measurement the FRONTEND
    *  owes (did this function save the register), and the rule that combines them is in
-   *  frontend/ssa.ts (LiveInModel.uninitRegs). ABSENT ⇒ no register partition is claimed, which is
-   *  what MIPS and PPC take today.
+   *  frontend/ssa.ts (LiveInModel.uninitRegs). Thumb and PPC state it and measure the save half
+   *  from their prologues (Thumb `savedRegs`, PPC and MIPS `prologueSavedRegs`). ABSENT ⇒ no register
+   *  partition is claimed.
    *
    *  It must be DISJOINT from `argRegs`, and the frontend hands both to the builder so that is
    *  checked rather than trusted (`checkedLiveInModel`): a spelling that lands in both lists used
@@ -70,14 +258,82 @@ export interface TargetDescription {
   nonArgRegs?: readonly string[];
   /** Of `nonArgRegs`, the ones this ABI does NOT require a callee to preserve — so the compiler may
    *  home a local in one with no prologue save at all, and the save half of the rule above does not
-   *  apply to it. AAPCS's `ip` is the whole set here, and agbcc really does use it that way.
+   *  apply to it. AAPCS's `ip` is the whole set on Thumb, and agbcc really does use it that way;
+   *  on PPC it is `r0`, `r11` and `r12`, where mwcc homes a leaf's uninitialised locals (PPC_MWCC).
    *
    *  UNDER-stating this list only makes the classification stricter: an unlisted register whose save
-   *  the frontend cannot find falls back to being a parameter, which is what a target claiming no
-   *  partition gets. OVER-stating it is the unsound direction — a callee-saved register listed here
-   *  is classified with no evidence at all, which is the defect the save half exists to close. Every
-   *  entry must appear in `nonArgRegs`; the frontend refuses a target where one does not. */
+   *  the frontend cannot find is read as one the callee must preserve, and a read of it before any
+   *  write refuses (frontend/ssa.ts `LiveInModel.unsavedCalleeSavedRegs`). OVER-stating it is the
+   *  unsound direction — a callee-saved register listed here is classified with no evidence at all,
+   *  which is the defect the save half exists to close. Every entry must appear in `nonArgRegs`;
+   *  the frontend refuses a target where one does not. */
   scratchRegs?: readonly string[];
+  /** Of `scratchRegs`, the ones something outside the C calling convention hands an input in. On
+   *  PPC that is mwcc's RUNTIME: its register save routines take their frame address in r11
+   *  (`addi r11,r1,N; bl _savegpr_NN`, and `_savegpr_31` is `stw r31,-4(r11); blr`), and
+   *  `__ptmf_scall` takes its member-function pointer in r12 (`lwz r0,0(r12)`). On O32 it is
+   *  hand-written asm, and every scratch register (`O32_SCRATCH_REGS`). Asm that reads one of these
+   *  first is being handed a value, not reading an uninitialised local.
+   *
+   *  What separates the two is MEASURED on 2.4.2 and 2.3.3: the uninitialised local the compiler
+   *  homes in r11 or r12 is assigned on SOME path (`uninit_r12`: `if (s) { x = a*b; ... }`), so its
+   *  entry value meets that definition at a join. A def-less read of one of these registers whose
+   *  entry value no join meets with a definition of its own refuses (frontend/ssa.ts
+   *  `LiveInModel.hiddenInputRegs`). r0 is not
+   *  listed: the same compilers read a never-assigned local straight out of r0 (`int x; return x +
+   *  a;` is `add r3,r0,r3`), and the runtime passes nothing there.
+   *
+   *  Every entry must appear in `scratchRegs`; the frontend refuses a target where one does not. */
+  hiddenInputRegs?: readonly string[];
+  /** FILE-SCOPE GLOBAL REGISTER VARIABLES this compiler accepts (`register T g __asm__("r8");`):
+   *  each callee-saved register a translation unit may bind a global to, keyed by its disassembly
+   *  spelling and valued by the name `__asm__` takes. gcc's `globalize_reg` (agbcc regclass.c
+   *  :587-611) makes such a register fixed and call-used, so no prologue saves it: a callee-saved
+   *  register a function reads before writing, or writes, WITHOUT saving it is one of these, and
+   *  the lift reads and writes it as that global (frontend/ssa.ts `LiveInModel.globalRegs`).
+   *  `contiguous` is the order a compiler that declares them only as a contiguous run requires
+   *  them in: declaring one declares every register before it. ABSENT ⇒ the compiler has no
+   *  spelling for one, and such a read or write refuses (`unsavedCalleeSavedRegs`). */
+  globalRegisterVariables?: { regs: Readonly<Record<string, string>>; contiguous?: readonly string[] };
+  /** Registers a CALL destroys: after one, they hold whatever the callee left there, and no value
+   *  this function computed. The frontends hand this to the SSA builder so a read of one past a
+   *  call refuses instead of resolving to the pre-call definition (frontend/ssa.ts).
+   *
+   *  REQUIRED, unlike its two neighbours above, and the asymmetry is the point. An absent
+   *  `nonArgRegs` claims no partition, which only makes classification stricter; an absent
+   *  `scratchRegs` under-states a set whose own comment says under-stating is safe. An absent
+   *  caller-saved list takes the UNSOUND direction — nothing refuses, so a destroyed register keeps
+   *  resolving to a value the callee overwrote, silently and with exit 0. A channel whose omission
+   *  is unsound is a required argument, so that forgetting it is a type error.
+   *
+   *  `argRegs` must be a SUBSET of it — a register the caller passes arguments in is by
+   *  construction one the callee may destroy — and `clobberedByCall` (frontend/ssa.ts) checks that
+   *  rather than trusting it, the way `checkedLiveInModel` checks the register partition. */
+  callerSaved: readonly string[];
+  /** Registers the ABI reserves to the kernel, which an exception handler may overwrite between ANY
+   *  two instructions (O32's `k0`/`k1`), so no value written to one is proved to be there when it is
+   *  read. A read of one refuses, and the return proof never counts one as holding the return
+   *  address (frontend/mips.ts). Only hand-written asm names them. Absent on an ABI that reserves
+   *  none. */
+  kernelRegs?: readonly string[];
+  /** The COMPILER RUNTIME HELPERS this compiler's codegen calls, and what each computes
+   *  (runtime-helpers.ts). A compiler fact, which is why it lives here and not in `proto.ts`: that
+   *  file holds signatures fixed by the C STANDARD, and a helper name is fixed by a runtime
+   *  library — agbcc calls `__muldi3`, CodeWarrior `__div2i`, IDO `__ll_mul`.
+   *
+   *  ABSENT ⇒ no helper is recognised AND none is refused, so every such call stays an ordinary
+   *  call with its arguments guessed and the backend spells it. That is the UNMEASURED direction,
+   *  not the safe one: re-emitting a compiler's own runtime call is the one failure that MATCHES,
+   *  because a compiler handed `__div2i(a, b)` emits the `bl __div2i` the row was lifted from
+   *  (`raise/widehelpers.ts` states this at the refusal it exists to make). Absence is still the
+   *  right default, because a name outside the table cannot be told from a project's own
+   *  `__`-prefixed function by spelling — but it buys nothing on a target whose runtime has simply
+   *  not been enumerated. */
+  runtimeHelpers?: Readonly<Record<string, RuntimeHelper>>;
+  /** The runtime's OUT-OF-LINE REGISTER SAVE ROUTINES (runtime-helpers.ts `RegisterSaveRoutines`).
+   *  ABSENT ⇒ none is recognised: a `bl` to one is an ordinary call, and the frame address it would
+   *  have consumed is the stack pointer read as data, which refuses. */
+  registerSaveRoutines?: RegisterSaveRoutines;
   // HARDWARE / ISA facts — independent of the compiler.
   capabilities: {
     endianness: 'little' | 'big'; // consumed by structureOptionsFor (bitfield extract recognition is LSB-first)
@@ -88,18 +344,26 @@ export interface TargetDescription {
     // over as a transfer SOURCE, and two facts together are what make that safe to model: the
     // device only ever reads from it, and the register is WRITE-ONLY, so nobody can read the
     // address back out and turn it into a destination. The only code that can name the frame is
-    // therefore this function's own, which the Thumb frame-object audit walks.
+    // therefore this function's own, which the frame-object audit walks.
     //
     // Hardware, so it belongs here — `endianness` above is a board fact rather than an ISA one too
     // (ARMv4T is bi-endian). ABSENT ⇒ every escape is assumed to write, which is the safe
     // direction and what every other target gets.
     readOnlyAddressSinks?: readonly number[];
+    // HOW FAR a device reads from the address a `readOnlyAddressSinks` register was handed, read
+    // off the control halfword at `sink + offset` (`SourceControl`). A fixed source re-reads one
+    // unit — the unit-aligned one holding the address, since the device may drop its low bits — so
+    // the frame bytes outside that unit are provably not read.
+    // ABSENT ⇒ the read is unbounded in both directions, the safe direction.
+    readSourceControl?: SourceControl;
     // The device-register window, `[start, end)`. A cell in it changes under the program's feet,
     // so a source that touched one all but certainly declared it `volatile`. Its readers all ask
     // the same SPELLING question — "would a source have written `volatile` here" — and the file
-    // header's ledger names them and what each does with the answer. None of them decides for the
-    // reader: which cells a source qualified is not derivable from the asm, so both spellings are
-    // enumerated and the differ referees. ABSENT ⇒ the variation declines everywhere and the tie-break
+    // header's ledger names them and what each does with the answer. All but one leave the
+    // decision to the differ: which cells a source qualified is not derivable from the asm, so
+    // both spellings are enumerated and the differ referees. The device pin decides, because
+    // there the plain spelling recompiles to a different program; that is why the window has to
+    // cover every register. ABSENT ⇒ the variation declines everywhere and the tie-break
     // has no preference, which is the neutral direction — outside a declared window the qualifier
     // is a claim about ordinary memory that the target does not support.
     //
@@ -123,6 +387,16 @@ export interface TargetDescription {
     // ABSENT ⇒ the target claims nothing, and the one reader treats EVERY device write as a
     // possible memory write — the conservative direction, and what every non-GBA target takes.
     deviceMemoryWriters?: readonly (readonly [number, number])[];
+    // CALLS that only READ through one argument, as far as a control argument says — a platform's
+    // block-transfer services, bound to a name by the SDK's own stubs. The frame-object audit is
+    // the reader: a frame address handed to one as its `source`, with a literal control word,
+    // reaches the bytes `blockTransferRead` decodes and is not an address anything writes through.
+    // The destination needs no entry, since a frame address handed over anywhere else keeps
+    // escaping as one a callee may write through.
+    //
+    // ABSENT, or a callee it does not name ⇒ an address handed to a callee may be read and written
+    // without bound, the safe direction.
+    blockTransferCalls?: Readonly<Record<string, BlockTransferCall>>;
   };
   // COMPILER BEHAVIORS — the specific compiler's canonicalization decisions, distinct from
   // hardware `capabilities`. Mostly consumed by the structurer (threaded through StructureOptions);
@@ -182,6 +456,14 @@ export interface TargetDescription {
     // compiler behavior is to claim nothing. The evidence a future round needs is one run of
     // `scripts/regen-select-spelling-probes.ts` retargeted at the compiler in question.
     hoistsSingleSetArm?: boolean;
+    // THE REGISTER AN INTERWORKING EPILOGUE POPS THE RETURN ADDRESS INTO WHEN THE RETURN TYPE IS 5
+    // TO 8 BYTES, which is then a fact the epilogue states about the function's width. agbcc's
+    // `thumb_exit` (gcc/thumb.c) picks that register from the SIZE of the return mode, not from
+    // liveness — r0 for `void`, r1 up to 4 bytes, r2 up to 8 — so `pop {r2}; bx r2` ends a function
+    // returning a `long long`, a `double`, or an 8-byte aggregate (which DImode covers even when it is
+    // returned through memory). Read by `frontend/thumb.ts`'s `refuseWordReturns` directly, not by
+    // the structurer. Absent ⇒ the epilogue states nothing.
+    eightByteReturnScratch?: string;
     // WHAT, IN THIS COMPILER'S OBJECT, WITNESSES A NARROW DECLARED PARAMETER — the fact
     // raise/paramwidth.ts needs before it may retype `s32 a0` to `s8 a0`. Three answers, because
     // the compilers measured give three, and the pass refuses wherever the object is silent. Each
@@ -250,41 +532,295 @@ export interface TargetDescription {
     // says so, but nothing in this bag could express it if they did not. Any behavior that can
     // differ between two toolchains sharing one description is mis-keyed by construction.
     spillSlotOrder?: 'ascending' | 'descending' | 'unknown';
+    // Which way this compiler places the ADDRESS-TAKEN local arrays of one frame against their
+    // DECLARATION order: `ascending` = the earlier-declared array takes the lower address. Read
+    // where the frame audit declares the one object as several (frame-objects.ts
+    // `keepAsOneObject`, which declares the parts `provenParts` finds in this order), so the
+    // recompile puts each part back at its own offset. Absent REFUSES that split: the one object
+    // stays one array.
+    //
+    // MEASURED on `u8 a[64]; u8 b[32]; u8 c[48];`, each filled by a `memcpy`, at canonical flags:
+    // agbcc a@0 b@64 c@96; gcc2.7.2 and gcc2.7.2kmc a@16 b@80 c@112; ido7.1 a@104 b@72 c@24 (the
+    // reverse); mwcc_242_81 a@88 b@8 c@40, neither order — so absent there.
+    addressTakenArrayOrder?: 'ascending' | 'descending';
+    // The frame-offset multiple this compiler starts each address-taken `u8` array of a frame at,
+    // whatever its size. Read by the same split (frame-objects.ts `provenParts`): a boundary off
+    // this multiple is never where two of the source's arrays met, and a part declared there is
+    // placed at the next multiple by the recompile, moving it and growing the frame. Absent
+    // REFUSES the split, as `addressTakenArrayOrder` does.
+    //
+    // MEASURED on `u8 a[na]; u8 b[nb];`, each filled by a `memcpy` and both handed to a callee, at
+    // canonical flags, for na x nb = 4x12, 12x12, 6x10, 8x8, 20x16, 2x14: agbcc puts b at sp+4,
+    // 12, 8, 8, 20, 4 (4); gcc2.7.2 and gcc2.7.2kmc a@16 and b@24, 32, 24, 24, 40, 24 (8:
+    // BIGGEST_ALIGNMENT on MIPS, for a BLKmode local); ido7.1 b@24 and a@36, 36, 40, 32, 44, 44 (4).
+    addressTakenArrayAlignment?: 4 | 8;
+    // Does this compiler's C front end take a DESIGNATED array element in an initializer —
+    // `u8 a[16] = { 1, [8] = 2 };`? A fact about the dialect the compiler parses, not about C or
+    // C++ as languages: GNU C had it long before C99, and agbcc and gcc 2.7.2 (KMC's build and the
+    // plain one) compile the line above, while IDO 7.1's cfe ("Syntax Error") and every mwcc build
+    // the benchmark ships, 2.3.3, 2.4.2 and 2.4.7 ("expression syntax error"), refuse it — each
+    // compiled. Read by the C-family printer (`SFn.designators`) where a constant image
+    // (l3/constinit.ts) leaves elements out: it spells the element after a run of them by index,
+    // and without this spells the run as zeros, which a compiler that cannot parse the index takes.
+    // Absent ⇒ zeros, the spelling every C compiler parses.
+    designatedInitializers?: boolean;
+    // Does this compiler's C front end REFUSE the three pointer conversions C makes implicitly — an
+    // integer to a pointer, a pointer to an integer, and an object pointer to one of another
+    // pointee — as C++ does? Every mwcc build the benchmark ships refuses all three in C, compiled
+    // with `-lang=c`: 2.4.2 and 2.4.7 ("illegal implicit conversion" of an `unsigned int` to an
+    // `int *`) and 2.3.3 ("cannot convert"). agbcc, IDO 7.1 and both gcc 2.7.2 builds compile the same three
+    // calls at their canonical flags. Read by the C-family printer (`SFn.strictConversions`), which
+    // then casts an argument to its callee's declared parameter and a pointer of another pointee
+    // into a pointer slot exactly as it does for C++ (backend/cfamily.ts `argConversion`,
+    // `legalizePointerWrites`), and by the store of an integer into a declared pointer cell
+    // (structure/pointer-spelling.ts `intoPtrCell`, which declines that store under C++, where only a
+    // cast to the cell's own type converts). Each cast is the conversion the compiler would
+    // otherwise have made, so it changes no instruction. Absent ⇒ C's implicit conversions.
+    strictPointerConversions?: boolean;
     // Arguments past the argument registers are staged into an area this function RESERVES at the
     // BOTTOM of its own frame — `[sp,#0]` upward, one word each — rather than pushed at the call
     // site. It is GCC's ACCUMULATE_OUTGOING_ARGS target macro, and it is what makes an outgoing
     // argument INDISTINGUISHABLE by code alone from a dead local: the words sit inside this
     // frame's reservation and nothing this function does ever reloads one.
     //
-    // Absent ⇒ no outgoing area is claimed and the Thumb frontend's stack-argument licence never
-    // fires, so a `[sp,#k]` store reaching a call unread declines exactly as it did before that
-    // licence existed. Read off the target by the frontend (`frontend/thumb.ts` `declaredCall`),
-    // not by the structurer.
-    //
-    // Set on agbcc, where the layout was read off `gcc/config/arm/thumb.h` and then measured —
-    // the corpus's `stkarg` (accepting) and `stkwide` (refusing) rows and kleod's
-    // `sub_0804C300` all stage their words at [sp,#0] upward inside the prologue's own
-    // reservation. NOT set anywhere else: a push-based caller would stage nothing inside the
-    // frame, and `docs/level-tower.md`'s rule for an unmeasured compiler behavior is to claim
-    // nothing. No other frontend calls the analysis today, so the field claims a premise rather
-    // than changing a verdict — which is the point: a second armv4t compiler must state it.
+    // It says WHERE the words go and nothing about the rest of the frame. Its one reader is the
+    // Thumb frontend's stack-argument licence (`frontend/thumb.ts` `declaredCall`): a declared call
+    // consumes the words it stages. Absent ⇒ no outgoing area is claimed, and a `[sp,#k]` store
+    // reaching a call unread declines.
+    //
+    // Set on agbcc, where the layout was read off `gcc/config/arm/thumb.h` and then measured — the
+    // corpus's `stkarg` and `stkwide` rows and kleod's `sub_0804C300` all stage their words at
+    // [sp,#0] upward inside the prologue's own reservation. NOT set anywhere
+    // else: a push-based caller would stage nothing inside the frame, and `docs/level-tower.md`'s
+    // rule for an unmeasured compiler behavior is to claim nothing. No other frontend calls the
+    // analysis today, so a second armv4t compiler must state this premise rather than inherit it.
     stagesOutgoingArgsInFrame?: boolean;
-    // Regime-A switch recovery: accept a RELATIONAL test whose BRANCH admits exactly one scrutinee
-    // value as that case (`cmp r0, #1 / bcc` is `case 0:` of an unsigned switch) rather than as
-    // navigation.
-    //
-    // A DEFAULT rather than a candidate variation because for agbcc the asm determines the source: at
-    // -O2 fold-const rewrites a bounded unsigned comparison into an equality before codegen, so
-    // `x < 1u` compiles to `cmp r0, #0 / bne` and `x > 0u` to `cmp r0, #0 / beq` — no source-level
-    // comparison chain emits a bound test at all. `emit_case_nodes` runs after folding and does:
-    // it jumps straight to `node->left->code_label` on LT once `node_is_bounded (node->left)`, so
-    // the remaining value's own test is never emitted. One producer, one reading.
-    //
-    // Absent ⇒ false, and inheriting it would be wrong rather than merely unmeasured: on the MIPS
-    // lanes `sltiu rd, rs, 1` is the ordinary spelling of `!x`, and it lifts to `icmp_ult rs, 1`
-    // with no equality fold anywhere — the identical IR shape, from a producer that is not a
-    // dispatch. Each compiler opts in on its own dispatch's evidence.
-    switchAllowsBoundCase?: boolean;
+    // The outgoing area is ONE region at the frame bottom, sized for the widest call and shared by
+    // every call, with every local and spill above it, and the caller never reads a word of it
+    // back after a call — the callee may assign to its stack parameters, so the caller re-stages
+    // an argument before every call. A compiler can stage in its frame
+    // (`stagesOutgoingArgsInFrame`) and still break this. mwcc does not, though it puts a local in
+    // the words a call COULD take as stack arguments where no call takes any — which is why a
+    // guess that cannot say whether one does refuses (`frontend/ppc.ts`, "A GUESS THAT FILLS EVERY
+    // ARGUMENT REGISTER") — and not where one does: the area starts past them.
+    //
+    // It is a UNIVERSAL — for every source, the compiler emits no such read — and its readers apply
+    // the contrapositive (`docs/level-tower.md`, THE CONTRAPOSITIVE OF A UNIVERSAL IS NOT A
+    // BACKWARDS READING): a word loaded after a call is not in the area, so it is a local, and so is
+    // every word above it (`frontend/frame-objects.ts` `storedNeverRead`). An own-frame word no store
+    // reaches on any path is a local too, but only the Thumb frontend acts on that
+    // (`frontend/thumb.ts`'s own-frame load arm, which reads it as uninitialised), and it was probed
+    // on agbcc alone; a MIPS or PPC reader needs its own probe first. A callee that assigned the
+    // word as its stack parameter ran before the load, so the load is after a call, and with no
+    // call reaching the load there is no such callee. It is
+    // exactly as sound as the universal, so its residue is every producer the universal does not
+    // cover: hand-written asm that reads its outgoing argument back after a call loses that argument
+    // silently. The premise is this compiler's, not the ISA's.
+    // Absent ⇒ every staged word stays a candidate argument.
+    //
+    // It promises the AFTER-CALL form and no more: a compiler may still load a staged word BEFORE a
+    // call — o32 gcc defines REG_PARM_STACK_SPACE, so calls.c's save_fixed_argument_area loads
+    // staged reg-parm words around a nested call. The stronger form, no load of the area at all,
+    // is its own field (`outgoingAreaNeverLoadedFrom`), stated per compiler and never read off this.
+    //
+    // Set on agbcc: thumb.h puts the locals at sp + outgoing_args_size (ACCUMULATE_OUTGOING_ARGS)
+    // and `calls.c` sizes the area as the maximum over all calls; compiled, `spill10` and
+    // `spillarg` keep their spills above the area, and `test/corpus/agbcc-restage.s` holds the
+    // re-staging, the callee's write, and no load of the area around calls inside arguments. Set
+    // on the three MIPS toolchains off their own probe (`test/corpus/probe-o32-frame.c`), where
+    // the frame-object audit is the only reader. Set on
+    // mwcc off `test/corpus/probe-mwcc-frame.c` on all three builds (`mwcc-frame-probes.test.ts`):
+    // nothing but outgoing words lies below the local area, no word there is loaded, and `twice9`
+    // stores its ninth argument again before its second call. The frame-object audit is the only
+    // reader there too, and on mwcc it is LOAD-BEARING: it is what refuses an undeclared call whose
+    // ninth argument the arity guess cannot see (frontend/ppc.ts `measurePpcFrame`).
+    localsAboveOutgoingArea?: boolean;
+    // The STRONG form of `localsAboveOutgoingArea`, which it requires: from this offset up, the
+    // caller never loads a word of its outgoing area at all — not after a call, and not before one
+    // either. The offset counts from the area's start, the frame bottom: `[sp,#0]` on Thumb, `0(sp)`
+    // on O32 (whose area opens with the a0..a3 home), `0(r1)` past the push on PowerPC (whose
+    // parameter area opens at 8, past the callee's back chain and link-register words). From it up
+    // the area holds only what the caller staged for a callee; every argument that contains a call
+    // is computed before any word is staged, and nothing is saved there around a nested call. So
+    // ANY frame word this function loads at or above the offset is a local, and so is every word
+    // above it, since the area is one region at the frame bottom. Its readers apply that
+    // contrapositive, at exactly the soundness of the universal. Each frontend measures the lowest
+    // such word once (Thumb through `frontend/stackargs.ts` `loadedWordBound`, MIPS in `liftOnce`,
+    // PPC `ppcLoadedWordBound`), and every reader takes that number: Thumb's outgoing-argument
+    // analysis, `frontend/frame-objects.ts` `storedNeverRead` for its pending stores, the MIPS and
+    // PPC undeclared-call guesses (`frontend/mips.ts` `lowerJal`, `frontend/ppc.ts` `bl`), and PPC's
+    // unread-slot decline, each weighing only the words beneath it. On MIPS it also caps how far an
+    // undeclared call's area can reach (`o32OutgoingArea`'s `widest`), which the local area's
+    // partition (`measureO32Frame`) and the owned range of an uninitialised read
+    // (`measureOwnedFrame`) both read. A load BELOW the offset proves nothing, and no reader counts
+    // it. A word no store reaches on any path needs only the after-call form (see
+    // `localsAboveOutgoingArea`).
+    // Absent ⇒ only the after-call form is claimed (when `localsAboveOutgoingArea` is set).
+    //
+    // Its residue is the universal's: hand-written asm that loads a word it staged, then stages it
+    // for a call, loses that argument. Each value is MEASURED, and the compiled probes are committed
+    // (`packages/core/test/outgoing-area-probes.test.ts` reads every one):
+    //   • agbcc, 0, off its source: thumb.h defines no REG_PARM_STACK_SPACE, so calls.c:642's
+    //     save_fixed_argument_area — which loads staged words around a nested call — is not
+    //     compiled; calls.c:1599-1610 precomputes every argument containing a call; and
+    //     store_one_arg (calls.c:3420-3470) saves an argument word only when a nested call overlaps
+    //     it, which the precompute rules out. Compiled, `test/corpus/agbcc-restage.s` loads no word
+    //     of the area around calls in stack arguments.
+    //   • ido7.1, gcc2.7.2kmc and gcc2.7.2, 16: `test/corpus/*-outarea.txt` at the rows' levels
+    //     (ido -O1, -O2 and -O2 -g3; gcc 2.7.2 -O1 and -O2) and at -O0. NOT 0 — ido stages a
+    //     by-value aggregate's register words in the a1..a3 home and loads them back before the
+    //     call (`big1`: `lw a1,4(sp)`), and kmc and gcc 2.7.2 do it for a char-array struct (`d3`,
+    //     `d5`): o32 gcc defines REG_PARM_STACK_SPACE, and GCC 2.9's save_fixed_argument_area
+    //     (calls.c:648-711) covers only `[0, reg_parm_stack_space)`. No probe loads a word from
+    //     16(sp) up the area.
+    //   • mwcc, 8, on all three builds at the rows' flags and at -O0,p, and on mwcc_242_81 at -O4,s
+    //     too: no probe loads a word of the parameter area; a struct-return temp or a by-value copy
+    //     sits at 8(r1) only where no call takes a stack word, and above the area beside one that
+    //     does.
+    // Like `stagesOutgoingArgsInFrame`, a second compiler of the same ISA must state this premise
+    // rather than inherit it.
+    outgoingAreaNeverLoadedFrom?: number;
+    // A frame of EXACTLY ONE reserved word whose base escapes this function holds that object and
+    // nothing else. It is the layout premise the Thumb frontend's address-taken-local capability
+    // rests on (`frontend/thumb.ts`, `capturedObjectIsTheWholeFrame`): a bare `mov rD, sp` names
+    // frame offset 0, and the question this answers is whether the rest of that reservation could
+    // be somebody else's — an outgoing argument staged at [sp,#0], a by-value struct argument's
+    // block-copy destination, or a struct return's hidden pointer.
+    //
+    // Absent ⇒ no such claim, and every `[sp,#k]` store reaching a call unread keeps the refusal
+    // it had before the capability existed. It is a layout fact about ONE compiler and it is not
+    // derivable from the architecture, which is why it is a field and not an `arch ==` branch
+    // (`docs/level-tower.md`).
+    //
+    // Set on agbcc, where it is two compiled producer tables rather than a reading — one per
+    // escape, both written out at the predicate: at one word agbcc stages no outgoing argument
+    // under a captured local (it moves the local above the area and spells its address `add rD,
+    // sp, #4`), and it names a block-copy base with a register only from two words up. The one
+    // producer a one-word frame does NOT exclude is a <=4-byte non-integer-like struct return,
+    // which the post-lift audit settles per call rather than by size.
+    oneWordFrameIsTheCapturedObject?: boolean;
+    // A frame address this function hands out — in an argument register at a call, or stored to
+    // memory — is the address of a LOCAL, so its receiver may read the frame from there up and no
+    // word from there up is a call's outgoing argument. Its one reader is the outgoing-argument
+    // analysis (`frontend/stackargs.ts`, the `escape` event): a store never reloaded HERE is read
+    // THERE. Absent ⇒ a handed-out frame address explains nothing.
+    //
+    // Set on agbcc, compiled at 2.9-arm-000512 and its canonical flags, and re-measurable from the
+    // committed probe (`scripts/regen-outgoing-area-probes.ts` → `test/corpus/agbcc-escape.s`, read
+    // by `frame-escape-probes.test.ts`). An address-taken local sits ABOVE the outgoing area
+    // (`f1`: `add r0, sp, #4` beside `h5(1,2,3,4,x)`), and at [sp,#0] only when no call in the
+    // function takes a stack word (`f0`).
+    //
+    // Its RESIDUE is a by-value struct argument's block copy (`mov r0, sp` / `add r0, sp, #4`, then
+    // `bl memcpy`), whose base IS the outgoing area. agbcc stages a call's outgoing words in
+    // ASCENDING offset order, the copy included (`qh5`, `a2`, `a3`): a word staged before the copy
+    // lies below its base, and one staged after it is still pending at the call. That is why the
+    // event ends pending words PER PROGRAM POINT and only from its offset up — read
+    // flow-insensitively, it would set aside `qh5`'s fifth `h5` word and lift `h5(1, 2, 3, 4)`. The
+    // cost is false alarms that decline loud (`if (x) gt(&s); else h(y);`); where the analysis also
+    // reads the event whole-function, it only refuses or excuses a word no call takes
+    // (stackargs.ts). `oneWordFrameIsTheCapturedObject` is the flow-insensitive licence, sound only
+    // where no block copy fits.
+    escapedFrameAddressNamesALocal?: boolean;
+    // WHERE AN O32 FUNCTION KEEPS ITS LOCALS in the one frame `addiu sp,sp,-N` reserves — the area
+    // the MIPS frontend hands the frame-object audit as `ownedLocals`/`declaredLocals`. Below it
+    // lies the OUTGOING area, the 16-byte home of a0..a3 every calling function reserves and then
+    // the stack words its widest call takes (none in a function that makes no call); the saved
+    // registers and the locals share the rest, and which way round is the compiler's:
+    //   'above-outgoing-area'   — from the outgoing area's end, rounded up to the 8-byte stack
+    //                             alignment, to the lowest saved register;
+    //   'above-saved-registers' — from just above the highest saved register (or the outgoing
+    //                             area's end, where that is higher) to the frame top N.
+    // Spill temps live in the same area on both, so it is the locals' and the spills' together.
+    //
+    // MEASURED off `corpus/probe-o32-frame.c` (`scripts/regen-o32-frame-probes.ts`, read by
+    // `o32-frame-probes.test.ts`): a leaf's array at sp+0 on all three MIPS toolchains; with a call
+    // taking no stack word, gcc 2.7.2 (both builds) at sp+16 under the saves and IDO at the frame top
+    // above `ra`; with one stack word, gcc at sp+24 (20 rounded) and IDO still at the top; and IDO's
+    // spill of a value live across a call between `ra` and the array.
+    //
+    // Absent ⇒ no partition is claimed, and a captured frame address keeps its refusal.
+    o32LocalArea?: 'above-outgoing-area' | 'above-saved-registers';
+    // WHERE A FUNCTION THAT PUSHES ONE FRAME KEEPS ITS LOCALS, on a target whose frame starts with a
+    // fixed LINKAGE area — the back chain and the callee's link-register save word, which the ABI
+    // fixes and the frontend states (`frontend/ppc.ts` `PARAM_AREA_AT`, where the caller's parameter
+    // area starts). Above it the OUTGOING area holds the stack words of the widest call (none in a
+    // function whose calls take none), and the locals and spill temps share what is left below the
+    // lowest saved register:
+    //   [linkage + 4 * (stack words of the widest call), lowest saved register)
+    // in post-push offsets — O32's `above-outgoing-area` rule (`o32LocalArea`) past a linkage area
+    // instead of the a0..a3 home, without the 8-byte rounding (`areaAboveOutgoing`). The PPC
+    // frontend hands it to the frame-object audit as `ownedLocals`/`declaredLocals`; a call it
+    // lowers takes no stack word, so it refuses one whose declaration may and draws the area from
+    // the linkage's end. No object start inside it is fixed: the compiler chooses where in the area
+    // each local goes.
+    //
+    // MEASURED on mwcc 2.3.3, 2.4.2 (at -O4,p and at Mario Party 4's -O0,p) and 2.4.7 off
+    // `corpus/probe-mwcc-frame.c` (`scripts/regen-mwcc-frame-probes.ts`, read by
+    // `mwcc-frame-probes.test.ts`): every local and every home or spill lies in the area, a leaf
+    // with a local still pushes a frame whose area starts at 8, one or two stack words of a call push
+    // the locals past them, and the widest call sizes the area for every call. The first local's
+    // offset inside it differs per build and per function (8, 12 or 16 on 2.3.3; a homed parameter
+    // takes 8 at -O0,p), which is why this is an area and not a start.
+    //
+    // Absent ⇒ no partition is claimed, and a captured frame address keeps its refusal.
+    linkageLocalArea?: 'above-outgoing-area';
+    // How this compiler calls through a register: `bl <prefix><reg>` enters a runtime thunk that
+    // branches to the address in <reg> with every register as the caller left it, so the call is
+    // an indirect call through <reg> and the thunk is no function a source names. `regs` are the
+    // thunks whose register can hold an address a source computed; a `<prefix>` callee outside them
+    // declines.
+    //
+    // ABSENT ⇒ a `bl` names a function on this target, whatever it is called.
+    callThunks?: { readonly prefix: string; readonly regs: readonly string[] };
+    // How this compiler marks a BRANCH it had to spell as a call: a `bl <label>` whose line carries
+    // a comment matching `comment` (tested against the text from its `@` to the end of the line) is
+    // a relay to that label of the same function, not a call. Two of its facts are this compiler's,
+    // and the Thumb frontend's lowering rests on them (`lowerFarJumpRelays`): what the mark means,
+    // and that the compiler pushes lr in every function with one, so the lr the relay writes is
+    // never the one the function returns through.
+    //
+    // ABSENT ⇒ no comment makes a `bl` anything but a call: a `bl` to a label of the function keeps
+    // its decline, however its line is commented.
+    farJumpRelay?: { readonly comment: RegExp };
+    // Regime-A switch recovery: accept a RELATIONAL test as a case where the scrutinee values that
+    // can reach it — narrowed by the tests above it — leave exactly one on a side this compiler's
+    // dispatch lands a case body on: `'taken'` for its BRANCH only, `'either'` for both sides
+    // (structure/switch-recover.ts, the note at `Ranges`).
+    //
+    // One mechanism on both compilers that declare it: a binary-search dispatch stops testing a
+    // value once the tests above have narrowed it to one. agbcc's `emit_case_nodes` jumps straight to
+    // `node->left->code_label` on LT once `node_is_bounded (node->left)` holds, so
+    // `switch (x) { case 1: … case 2: … case 3: … case 4: … case 5: … case 1000: … case 2000: … }`
+    // pins `case 3` with `cmp r1, #2; bgt` under `x < 4`, `x != 2` (`corpus/agbcc-swpathbound.s`),
+    // and an unsigned switch's `case 0` with `cmp r0, #1; bcc`, which pins it at the end of the
+    // domain whatever came first. mwcc's `switch (x) { case 0: … case 1: … default: … }` is
+    // `cmpwi r3,1; beq- case1; bge- default; cmpwi r3,0; bge- case0; b default`, where `x >= 0` is
+    // `case 0` only because `x != 1` and `x < 1` came first (`corpus/mwcc-swdispatch.asm`).
+    //
+    // THE SIDES DIFFER, and each is read off its own compiler. Every jump in `emit_case_nodes` that
+    // lands on a case body is its test's BRANCH, while the fall-through always continues into more
+    // dispatch, and none of 3176 generated agbcc dispatches lands a body on a fall side — so agbcc
+    // is `'taken'`. mwcc lands one on either: `synthetic:sw_ret:mwcc_242_81` pins `case 3` on the
+    // FALL side (`cmpwi r3,4; bge- default; b case3` under `x > 2`, `x != 2`), so mwcc is
+    // `'either'`.
+    //
+    // A DEFAULT rather than a candidate variation because each declaring compiler's other producer
+    // of the same test is told apart by its LAYOUT. An if/else-if ladder written with relational
+    // tests pins values by its path just the same (`if (x >= 4) { if (x < 5) … } else if (x >= 3)
+    // …` pins 4 and 3) but puts a body between two tests, where the dispatch puts every test above
+    // every body — so this reading needs `switchRequiresFrontLoadedTests` beside it, and both
+    // declaring compilers declare that too (`corpus/mwcc-sw{dispatch,ladder,relladder,relnest}.asm`
+    // from `corpus/probe-mwcc-sw*.c`, regenerated by `scripts/regen-switch-spelling-probes.ts`). On
+    // agbcc the unsigned endpoint has no ladder at all: -O2 fold-const rewrites `x < 1u` into
+    // `cmp r0, #0 / bne` before codegen. All three builds PPC_MWCC serves emit the dispatch
+    // identically at -O4,p and at -O0,p (`packages/cli/test/matching/ppc-compiler-behaviors.test.ts`).
+    //
+    // Absent ⇒ every relational test navigates, and inheriting it would be wrong rather than merely
+    // unmeasured: on the MIPS lanes `sltiu rd, rs, 1` is the ordinary spelling of `!x`, and it lifts
+    // to `icmp_ult rs, 1` with no equality fold anywhere — the identical IR shape, from a producer
+    // that is not a dispatch. Each compiler opts in on its own dispatch's evidence.
+    switchBoundCase?: SwitchBoundCase;
     // Switch recovery: emit the case arms in the order the ASSEMBLY lays their bodies out, rather
     // than sorted by ascending case value. True claims the compiler emits case bodies as it walks
     // the arms and never MOVES one afterwards — neither reordering basic blocks nor scheduling
@@ -294,8 +830,14 @@ export interface TargetDescription {
     // neither sched.c nor reorg.c. SCOPE — SRCS does compile jump.c, whose cross-jump merges two
     // identical arm bodies into ONE block, so a merged pair's own order is gone from the asm; that
     // surfaces as two case values sharing a body, which switch-recover.ts ties by ascending value.
-    // Absent ⇒ ascending case value, where ido/kmc-gcc/mwcc sit: each has a scheduler and none has
-    // been put through that evidence. A compiler opts in on its own, never by inheriting.
+    // Absent ⇒ ascending case value, where ido/kmc-gcc/mwcc sit. ido and kmc-gcc have a scheduler
+    // and have not been put through that evidence. mwcc_242_81 HAS been, on two compiled pairs, and
+    // lays the bodies in source order: `synthetic:sw_defmid` with `default:` between two cases, and
+    // a three-case switch whose first case is a `beqlr`. What keeps it from declaring the reading is
+    // its FRONTEND: frontend/ppc.ts appends every conditional-return block after all the real ones,
+    // so such an arm sorts last whatever its address (switch-recover.ts, at `layoutIndex`). Placing
+    // those blocks at their branch's address is the prerequisite, and a declaration after it owes
+    // its own pairs. A compiler opts in on its own, never by inheriting.
     switchArmsFollowLayout?: boolean;
     // Switch recovery: DECLINE a comparison tree whose own layout INTERLEAVES a test block with a
     // case body, on the reading that the source wrote an if/else-if LADDER there. True claims the
@@ -321,8 +863,12 @@ export interface TargetDescription {
     // `corpus/probe-agbcc-sw{frontload,ladder}.c`, regenerated by
     // `scripts/regen-switch-spelling-probes.ts`, asserted in switch-arms.test.ts.
     //
-    // Absent ⇒ every recoverable tree is still spelled `switch`, which is where ido/mwcc sit: each
-    // has a scheduler that may move a body above a test, and neither has been put through the pair.
+    // mwcc declares it on its own objects: its `switch` dispatch puts every test above every body,
+    // and a ladder written with relational tests puts a body between two of them
+    // (`corpus/mwcc-sw{dispatch,relladder,relnest}.asm`, the note at `switchBoundCase`).
+    //
+    // Absent ⇒ every recoverable tree is still spelled `switch`, which is where ido sits: it has a
+    // scheduler that may move a body above a test, and it has not been put through the pair.
     // A compiler opts in on its own compiled evidence, never by inheriting — and where one
     // description serves two toolchains (`MIPS_GCC`), each toolchain owes its own pair, because the
     // field cannot distinguish them (the KEYED BY DESCRIPTION note at `spillSlotOrder`).
@@ -345,6 +891,34 @@ export interface TargetDescription {
     // and PPC lanes put the addend in the instruction by construction (`lui`/`%lo`, `lis`/`ori`),
     // so a surviving offset carries no information there. Absent ⇒ the row is never offered.
     foldsConstAddrOffset?: boolean;
+    // Does a STORE to a struct member past the ISA's displacement range compile differently from the
+    // same store through a cast of the base (`p->f38 = v` against `*((u8 *)p + 38) = v`)? agbcc's
+    // does: expand_assignment (gcc/expr.c) expands only the base of a COMPONENT_REF target (:2535)
+    // and evaluates the right-hand side first in store_field (:2624), and it expands a cast target
+    // whole (:2689) before the right-hand side (:2747). Measured on agbcc for a loaded, a constant, a
+    // computed and a parameter right-hand side: every pair builds two objects, and a hoisted
+    // `u8 *d = &p->f38; *d = v;` builds the cast's. True reads a moved store whose right-hand side
+    // is computed before its address as struct evidence (raise/structs.ts `memberStoreOrder`).
+    // ido, KMC, GCC 2.7.2 and the three mwcc builds put the two spellings in one object, a loaded
+    // right-hand side included, so they leave it absent. `/far-cast`, the lift that keeps such a
+    // store on its materialised address, is offered on every target and does not read this.
+    farMemberStoreOrder?: boolean;
+    // Does a member past the displacement range get its OWN materialised base at every access, so
+    // that one base read or written at two distinct offsets is a pointer the source held? Stated
+    // as the displacement `past` which that holds: a base materialised with a displacement whose
+    // magnitude exceeds it was built for one access. agbcc's is 0, every base: `p->f38 + p->f39`
+    // compiles to `add r0, #0x26; ldrb [r0]` and `add r1, #0x27; ldrb [r1]`, while
+    // `u8 *d = &p->f38; d[0] + d[1]` shares one `add r1, #0x26` between `ldrb [r1]` and
+    // `ldrb [r1, #1]`, and only the pointer spelling rebuilds those bytes. ido's is 32767, the
+    // `addiu` reach: inside it ido shares one `addiu at, a0, 32767` across adjacent members
+    // (`sb a1, 7232(at); sb a2, 7233(at)`), and past it the assembler expands every member access
+    // to its own `lui at, 3; addu at, at, a0` while a held `u8 *d = &p->b` (b at 200000) shares one
+    // `lui at, 3; addu v0, a0, at` between `sb t6, 3392(v0)` and `sw zero, 3396(v0)`. True refuses
+    // raise/structs.ts's displaced-access fold for such a base (`held-pointer-offsets`). The three
+    // mwcc builds share one `addis` base across members and a held pointer alike, and KMC and
+    // GCC 2.7.2 lift the held pair as members at the same bytes, so they leave it absent. Absent ⇒
+    // the fold reads a shared base as members.
+    farMemberBasePerAccess?: { past: number };
     // Does this compiler fold a pointer local's OWN ADVANCE back into the memory operand —
     // `*p = a; p = p + 1; *p = b;` → `strh [r3, #0]` + `strh [r3, #2]`, no `add` — so the advanced
     // spelling emits the indexed one's stores wherever the pointee is not volatile? agbcc does, on
@@ -357,6 +931,38 @@ export interface TargetDescription {
     // the plain variation ships, which is the conservative reading for a compiler whose pair nobody has
     // compiled — a compiler opts in on its own evidence and never by inheriting.
     foldsPointerAdvance?: boolean;
+    // Does this compiler build a word global read through a pointer conversion, or stored a pointer
+    // it converts implicitly, into the object of the bare integer spelling? agbcc does: under
+    // `extern u32 g;` the pointer spelling of a cell, `g = (void *)((u8 *)g + 4); … (gLimit ^ (u32)g)`,
+    // and the integer one, `g = g + 4; … (gLimit ^ g)`, are one object (the pair
+    // `TARGET_BEHAVIOR_READINGS` compiles), the implicit conversion costing a warning. True ⇒ the
+    // `int-cell` registry entry's target gate withholds that variation, which can only tie the
+    // default's bytes here. It does not tie the warning: under -Werror the pointer spelling does not
+    // build against the integer declaration and the integer one does, which no gate sees, since the
+    // witness and the bench compile without -Werror. IDO builds the pair into two objects and
+    // CodeWarrior rejects the pointer store, so both are offered. KMC gcc builds one object too and
+    // does not declare it: the matching suite compiles each witness on one compiler. Absent ⇒
+    // offered.
+    pointerIntConversionIsFree?: boolean;
+    // Does this compiler keep the constant addend of a POINTER sum's offset where the source put it,
+    // and move an INTEGER sum's out to the base? agbcc does: `(u8 *)((u32)g + ((a << 4) + 772))`
+    // computes `(g + 772) + (a << 4)` (fold-const.c:5033-5058, `A + (V + C)` → `(A + C) + V`), while
+    // `(u8 *)g + ((a << 4) + 772)` computes `g + ((a << 4) + 772)` (c-typeck.c:2663-2692 distributes
+    // the constant, fold-const.c:4997-5011 folds it back), which is what the project's own
+    // `g->arr[a]` compiles to. Compiled at each toolchain's canonical flags, with `g` a struct
+    // pointer, a `void *` and a `u32`, as a call argument and under a dereference: agbcc,
+    // gcc2.7.2kmc and gcc2.7.2 build the two spellings into two objects wherever the offset has a
+    // constant addend and into one where it has none; ido7.1 builds one object every time, and
+    // mwcc_242_81 is CodeWarrior's index-first order (structure/pointer-spelling.ts, THE INTEGER
+    // SUM). Two rules read it. True ⇒ the arithmetic table's value row (ARITH_ROWS) spells an
+    // undeclared pointer global plus an integer with a constant term as the pointer sum where the
+    // sum is a value rather than an access's address; and the structurer declares `u8 *` a temp
+    // holding a pointer global's value that is the base of such a sum (`declaresBytePointer`),
+    // which an integer temp would compile as `(t + K) + x`. Through a temp ido7.1 does build two
+    // objects, the byte pointer's index first where the integer temp and the struct source keep the
+    // base first, and mwcc_242_81 builds one (the cli matching suite's pointer-spelling.test.ts).
+    // Absent ⇒ the integer sum and the integer temp.
+    keepsPointerSumAddend?: boolean;
     // Does this compiler EMIT a memory read in the block the source SPELLED it in? One direction
     // only: the def-block placement rule (StructureOptions.readsStayWhereWritten) re-spells a read
     // at the block the asm performed it in, which reproduces the asm iff nothing sinks a spelled
@@ -395,14 +1001,230 @@ export interface TargetDescription {
     // three descriptions that measured false (four compilers) set it anyway, so absent means
     // UNMEASURED rather than "no".
     reloadsLocalReread?: boolean;
+    // Does this compiler convert a constant to a NARROW lvalue's type before it materializes it
+    // for the store? Then the stored register's upper bits say the lvalue's signedness whenever
+    // the narrow sign bit is set: `u16 *p; p[6] = -1;` loads 0xffff and `s16 *p; p[6] = 0xFFFF;`
+    // loads -1. Measured on every bench compiler at its rows' flags by lifting the probe in
+    // packages/cli/test/matching/narrow-store-constant.test.ts and reading the const each store
+    // takes. Read by raise/storesign.ts (through raise/pre-recovery.ts).
+    //
+    // ABSENT ⇒ the seed stands down and a narrow store keeps the unsigned view; a compiler opts IN
+    // on its own probe.
+    narrowStoreConstantTakesLvalueType?: boolean;
+    // A LAYOUT fact rather than a canonicalization one, kept here because it is the COMPILER's:
+    // the size, in bytes, it aligns and rounds EVERY struct and union to, whatever its members.
+    // agbcc: 4 — `sizeof(struct { u16 h; })` is 4, and `struct { u8 a; union { u16 h; u8 b[2]; } u; }`
+    // seats `u` at 4 (gcc 2.9's arm STRUCTURE_SIZE_BOUNDARY). ido7.1, gcc2.7.2kmc and mwcc_242_81
+    // answer 2 and 2: the natural layout, 1. Compiled as `return sizeof …` / `return (int)&((T *)0)->m`
+    // at each row's flags; gcc2.7.2 (-O1), mwcc_233_163n and mwcc_247_107 answer the same as their
+    // descriptions' measured compilers. Read by raise/structs.ts (through raise/pre-recovery.ts),
+    // which sizes a recovered UNION member with it, and by raise/struct-arrays.ts, which declines
+    // an element struct whose stride it would round (agbcc: a stride-6 `u16 [3]` row is 8 bytes).
+    //
+    // ABSENT ⇒ unmeasured: the union recovery declines every union narrower than a word, and the
+    // struct-array recovery declines every element struct. No value is safe to assume, since one
+    // too small mislays the fields after it on agbcc (and mis-strides an element struct) and one
+    // too large drops the pad in front of them everywhere else.
+    aggregateBoundary?: number;
+    // The largest alignment any member of a struct takes, in bytes (BIGGEST_ALIGNMENT): agbcc 4,
+    // thumb.h:358, so a `long long` member sits at a word. With `aggregateBoundary` it is what sizes
+    // a declared aggregate (`aggregate.ts`). ABSENT ⇒ unmeasured, and no aggregate is sized.
+    largestAlignment?: number;
+    // HOW A STRUCT OR UNION RETURNED BY VALUE COMES BACK, which decides whether a call to a function
+    // declared to return one hands it a hidden pointer as argument 0 and moves every declared
+    // argument one register up (`aggregate.ts` `returnsInMemory`, read by the call lowering every
+    // frontend shares, frontend/call-plan.ts).
+    //   • 'apcs' — in memory when bigger than a word, when a struct has a second member that is not
+    //     a bitfield, or when a union has a member that would be; in the return register otherwise.
+    //     agbcc, thumb.c:1423-1493 (compiled: `{u8 a,b,c,d}` through memory; `{u32}`, `{u32 w[1]}`,
+    //     `{u32 a:8; u32 b:8;}` and `union {u32; u16;}` in r0).
+    //   • 'svr4' — in r3, or r3:r4, when it is 8 bytes or less, whatever its members (a float's
+    //     included); in memory otherwise. mwcc_242_81, mwcc_233_163n and mwcc_247_107 alike
+    //     (compiled: 1 to 8 bytes, `{float}`, `{double}` and a union come back in r3/r3:r4; a 9- and a
+    //     12-byte struct are handed `addi r3,…` ahead of the call).
+    //   • 'memory' — always in memory, whatever its size or members. ido7.1, gcc2.7.2kmc and gcc2.7.2
+    //     alike (compiled: `{u8}`, `{u16}`, `{u32}`, `{float}`, `{double}`, 4-, 8- and 12-byte
+    //     structs, `union {u32; u16;}` and `{u32 a:8; u32 b:8;}` are each handed `addiu a0,sp,N`
+    //     ahead of the `jal`, with the declared arguments from a1 on, and the callee returns that
+    //     pointer, `move v0,a0`).
+    // Under every rule the caller's half is lowered (frontend/call-plan.ts), and a function that
+    // itself returns a struct through memory lifts as that struct where its declaration says so and
+    // the lift proves the hidden pointer is only its storage (frontend/own-struct-return.ts); it is
+    // read as the pointer function it compiles to where nothing declares it, or where a context's
+    // declaration does and the proof fails (pipeline.ts `returnOwnStruct`).
+    // ABSENT ⇒ unmeasured, and such a call declines.
+    aggregateReturn?: 'apcs' | 'svr4' | 'memory';
+    // WHETHER A FUNCTION THAT RETURNS A STRUCT THROUGH MEMORY HANDS THE HIDDEN POINTER BACK in the
+    // return register — a COMPILER fact, which no rule above implies. `true` for ido7.1, gcc2.7.2kmc
+    // and gcc2.7.2 (`move v0,a0`, the O32 rule) and for agbcc (`add r0, r6, #0` after a call, r0
+    // left alone in a leaf: compiled `struct S12 f(s32 x)` with and without a call to `fill(t)`).
+    // `false` for mwcc_242_81, mwcc_233_163n and mwcc_247_107, whose callee clobbers r3 before the
+    // `blr`: the same `struct S12 b4(s32 x)` saves the pointer in r30/r31, stores through it, and
+    // returns with r3 = a reload of a frame word. It decides what the proof that a function's own
+    // struct return goes through that pointer asks of each `ret` (frontend/own-struct-return.ts):
+    // where it is `true` every `ret` must hand back the pointer, and where it is `false` what the
+    // return register holds is no part of the function, save a value computed for the return alone
+    // (`returnedAlone`). ABSENT ⇒ unmeasured, and read as `true`, which only refuses more.
+    structReturnHandsBackPointer?: boolean;
+    // WHETHER A CALLER HANDS ITS OWN DESTINATION POINTER STRAIGHT ON as a callee's hidden
+    // struct-return pointer, leaving the first argument register at its incoming value below the
+    // arguments it sets up. `true` for ido7.1: `int b3(struct S *p){ *p = sg(1); return 0; }` is
+    // `jal sg; li a1,1` with a0 never touched, the bytes of `sg(p, 1)` with its result unused.
+    // `false` for gcc2.7.2kmc, gcc2.7.2, agbcc and mwcc_242_81, mwcc_233_163n and mwcc_247_107,
+    // which copy through a frame temporary (a0/r0/r3 set to a frame address ahead of the call).
+    // Compiled at the canonical flags, `b3` and `void b6(struct S *p, int k){ *p = sg(k, 5); }`.
+    // Read by the guessed-arity gap (frontend/call-plan.ts `decideGap`): where it holds, a gap at
+    // the first argument register is decided only where the call's result is read, which no
+    // forwarded struct return's is (IDO reloads `p` from its home after the call in all five shapes
+    // compiled: `return (*p = sg(1)).b`, `return p` and three more). ABSENT ⇒ unmeasured, and read
+    // as `true`, which only refuses more.
+    forwardsStructReturnDestination?: boolean;
+    // A STRUCT PASSED BY VALUE TRAVELS IN CONSECUTIVE ARGUMENT WORDS, the first at the next free
+    // argument word, its size rounded up to words (`aggregate.ts` `byValueCallArgs`). agbcc,
+    // thumb.h:632-650 (FUNCTION_ARG places by word offset, FUNCTION_ARG_PARTIAL_NREGS splits a
+    // BLKmode argument across r3 and the stack, FUNCTION_ARG_ADVANCE rounds its size to a word, and
+    // no FUNCTION_ARG_PASS_BY_REFERENCE is defined); compiled, `struct A {u16 a,b,c,d; s8 e,f;}`
+    // is `ldr r0..r2` off the frame copy ahead of `bl take2`. O32 too, compiled on ido7.1,
+    // gcc2.7.2kmc and gcc2.7.2: `takeQ(s32 k, struct Q {u32 a, b;})` is passed `a1:a2` and a
+    // three-word struct `a0..a2` (an 8-aligned one starts at an even word:
+    // `evenWordAlignedArgs`); IDO also stores each word into its home slot, which the
+    // call owns. ABSENT ⇒ the target passes one some other way or states nothing: mwcc passes the
+    // address of a copy (frontend/ppc.ts refuses it).
+    byValueAggregateArgWords?: boolean;
+    // The bytes an enum takes as a struct member (`aggregate.ts`). agbcc: 4 — flag_short_enums is 0
+    // unless `-fshort-enums` is given (toplev.c:3552-3554 with no DEFAULT_SHORT_ENUMS), so an enum
+    // whose values fit an int is an int (c-decl.c:6123-6135); compiled, `sizeof(enum {K0, K1})`
+    // and `enum {B0 = 300}` are both 4. `targetFor` drops it under `-fshort-enums`, and an enum
+    // declared with an attribute (`packed`), or with a value an int cannot hold, is not sized
+    // (proto-context.ts). ABSENT ⇒ unmeasured,
+    // and an aggregate with an enum member is not sized.
+    enumBytes?: number;
+    // How a struct's bitfields are placed (`aggregate.ts`). 'contiguous' — each at the bit after the
+    // one before, straddling a byte or a word of its declared type, with the next member that is not
+    // a bitfield at the first byte past it that its alignment allows. agbcc: thumb.h defines no
+    // PCC_BITFIELD_TYPE_MATTERS, so stor-layout.c:404-405 lays a bitfield at bit alignment and
+    // skips the no-straddle rule of :462-481 (compiled: `{u32 a:20; u32 b:20; u8 c;}` puts `c` at
+    // 5, `{u32 a:31; u32 b:31; u32 c:2;}` is 8 bytes, `{u8 a:5; u8 b:5; u8 c;}` puts `c` at 2). A
+    // zero-width bitfield, which moves the next member to EMPTY_FIELD_BOUNDARY, is not placed.
+    // ABSENT ⇒ unmeasured, and an aggregate with a bitfield is not sized.
+    bitfieldPacking?: 'contiguous';
+    // Can this compiler CONTRACT a float multiply and the add or subtract that reads it into one
+    // fused instruction, which rounds once? mwcc can: `-fp_contract on` (set on some pikmin,
+    // marioparty4 and ac-decomp units) turns `a * b + c` into `fmadds` and `-(a * b) + c` into
+    // `fnmsubs`, but only within one expression, so the structurer names every such product
+    // (StructureOptions.contractsFloatProducts) and the spelling compiles to the unfused pair under
+    // either setting. The MIPS targets cannot: MIPS II (ido7.1 `-mips2`) and MIPS III (kmc `-mips3`)
+    // have no fused multiply-add, and naming the product there only moves the register allocation
+    // off the object (`fpu-lift.test.ts` pins one on ido7.1).
+    //
+    // ABSENT ⇒ false. A compiler with a fused multiply-add must opt in; the no-FPU targets never
+    // compute on a float at all.
+    contractsFloatProducts?: boolean;
+    // Does this compiler read a double literal's shortest round-trip decimal (`ir/float-bits.ts`
+    // `doubleLiteral`) back as the same double? That is how an `fconst` is printed, so its
+    // producers run only where this is true. agbcc does: c-lex.c:1308 hands the token to
+    // REAL_VALUE_ATOF at DFmode, which is real.c:461 `ereal_atof` → `asctoe53` (:3512) →
+    // `asctoeg(s, y, 53)` (:3533), a conversion in extended precision rounded once to 53 bits.
+    //
+    // ABSENT ⇒ unmeasured, and a literal declines.
+    roundTripsDoubleLiterals?: boolean;
+    // How the compiler lays out a FUNCTION-SCOPE STATIC: the least alignment of an array, the
+    // alignment of a string-literal initializer, and whether a zero scalar keeps its `.data`. The
+    // bytes of a static do not say how the source declared it; these, with the alignment and
+    // section the target shows, say which declaration lands it there (structure/local-statics.ts).
+    // A LAYOUT fact like `aggregateBoundary`, and the compiler's, read by the structurer.
+    //
+    // ABSENT ⇒ unmeasured, and a function that defines a static declines: a wrong floor mislays
+    // every static after the first, which no score sees.
+    staticLayout?: StaticLayout;
+    // Does this compiler load a `volatile` narrow signed read zero-extended and sign-extend it in a
+    // register, never in the load itself? agbcc: yes — `*(volatile s16 *)a` is `ldrh; lsl #16; asr
+    // #16` and `volatile s8` is `ldrb; lsl; asr`, where the plain `s16` read is `ldrsh`: the
+    // sign-extend expander refuses a volatile MEM while expanding (`general_operand`, recog.c:918,
+    // under `init_recog_no_volatile`, function.c:5564) and thumb.md:393-409 then extends in a
+    // register; compiled at the canonical flags. So a lifted sign-extending narrow load is evidence
+    // the source read was plain (`readCouldBeVolatile`): the device pin (frontend/device-pins.ts)
+    // leaves it plain, and the `declared` stamp (raise/declared-volatile.ts) leaves it unplaced.
+    //
+    // ABSENT ⇒ false: a sign-extending load says nothing about the qualifier, and a device read is
+    // pinned, and a read of a declared object placed, whatever its extension.
+    volatileReadsExtendInRegister?: boolean;
+    // Does this compiler, AT THESE FLAGS, keep a plain read whose value nothing uses? A FLAG fact,
+    // never written in a description: `targetFor` sets it from the optimisation level
+    // (`keepsUnusedReadsAt`), so a target at other flags has it absent. Where it holds, a read
+    // the lift finds unused is no evidence of `volatile`, and the dead-read pin
+    // (frontend/dead-reads.ts) stamps only one the machine loaded into the register the compiler
+    // discards a volatile read into (`discardsUnusedReadsInto`).
+    //
+    // ABSENT ⇒ false: the compiler deletes every plain read nobody uses, so one still in the target
+    // was qualified.
+    keepsUnusedReads?: boolean;
+    // WHERE DOES THIS COMPILER PUT A READ NOBODY USES, at a level that keeps a plain one
+    // (`keepsUnusedReads`)? The register a `volatile` read with no consumer is loaded into, and no
+    // plain local is ever homed in. COMPILED at the keeping levels, one statement per line:
+    // `*p;`, `s->b;`, `gV;` and `(*p, 1)` through a volatile lvalue load into `r0` on mwcc 2.4.2,
+    // 2.4.7 and 2.3.3 at `-O0,p`, and into `$zero` on IDO 7.1 at `-O1` and `-O0`; the plain
+    // `x = p[5]; x = 0;` takes a home there instead (`lwz r31`, `lw t6` and a frame store), and so
+    // does a `register` local (`lwz r31`, `lw a2`). Over the 409 complete Mario Party 4 units built
+    // at `-O0,p`, 924 non-frame loads nothing reads land in r17-r31 and f18-f31, and exactly one in
+    // r0: WipeExecAlways's `wipe->type;`, a `volatile u8` member. So a dead load into this
+    // register is a qualified read, and the dead-read pin (frontend/dead-reads.ts) stamps it at a
+    // keeping level too. mwcc keeps one plain read in r0 as well, a read under an arithmetic or a
+    // cast nothing uses (`p[5] + 1;`, `(char)p[5];`), which no real unit holds: that is the pin's
+    // residue. A load this register took and an op then wrote to a home (`lwz r0` + `extsb r31,r0`,
+    // a plain `s8` local) is not discarded (frontend/dead-reads.ts `leftInDiscardRegister`). One
+    // register cannot name a pair: IDO discards a doubleword into zero:at, `lw zero,0(a0)` +
+    // `lw at,4(a0)`, which frontend/mips.ts `emitLoad` reads as the pair this register heads.
+    //
+    // ABSENT ⇒ the compiler has no such register, or it is unmeasured. agbcc, gcc 2.7.2 and KMC
+    // gcc 2.7.2 at `-O0` have none: a volatile `*p;` is an `ldr r0`/`lw v0` nothing stores, the
+    // same instructions as a `register` local assigned and overwritten, so the pin cannot tell the
+    // two apart there and refuses rather than drop the read.
+    discardsUnusedReadsInto?: string;
+    // MAY A DISCARDED READ LAND IN AN ARGUMENT REGISTER, at flags that delete a plain read nobody
+    // uses? Where it may, a value a load left in an argument register is no proof that the next
+    // call takes it. The discard register is the allocator's first free one, not a fixed register,
+    // so a single read on its own says nothing: the probe that decides is one where the usual
+    // discard register is busy. `true` for agbcc, which loads a discarded `volatile` read into the
+    // lowest free argument register (`*(volatile int *)K; g(s)` is `ldr r1,[r1]; bl g`, the bytes of
+    // `g(s, *(int *)K)`). `true` for gcc2.7.2kmc and gcc2.7.2, which discard into v0/v1 until those
+    // are busy and then into a1: `int a = ga * 3; *(volatile int *)&gx; *(volatile int *)&gx;
+    // ga = a + 1; return logv(s) + 1;` is `lw a1,0(v0); lw v0,0(v0); ... jal logv` (`lw a1,0(v1)` on
+    // gcc2.7.2), the bytes of the twin that passes the first read. `true` for mwcc_242_81,
+    // mwcc_233_163n and mwcc_247_107, which discard into r0 until it is busy and then into r4: the
+    // same function's first read is `lwz r4,gx` on all three, and with three reads mwcc_233_163n's
+    // last one is `lwz r4,gx` right before `bl logv`, byte-identical to the twin that passes it.
+    // `false` for ido7.1 alone: `lw zero`, `lbu zero`, `lh zero`, and `lw zero` + `lw at` for a
+    // doubleword, with four discarded reads stacked under the same pressure too. Compiled at the
+    // canonical flags. Read by the guessed-arity gap (frontend/call-plan.ts `decideGap`), which a
+    // load decides only where this is `false`. ABSENT ⇒ unmeasured, and read as `true`, which only
+    // refuses more.
+    discardedReadMayFillArgRegister?: boolean;
   };
 }
 
+/** THE SPELLINGS ONE REGISTER HAS in an ISA's asm, as `[number, alias]` pairs — the one place they
+ *  are stated. A frontend keys registers by spelling, so a function that names one register two
+ *  ways is rewritten to one of them first (frontend/ssa.ts `unifyRegisterSpellings`, which both
+ *  frontends hand these tables); and every register list a target states names both spellings of a
+ *  pair or neither, which `target-register-aliases.test.ts` checks against these tables. A pair
+ *  missing here splits one register into two partition keys: saved as `sl` and written as `r10`, its
+ *  writes read as a global's the epilogue undoes. */
+export const ARM_REGISTER_ALIASES: readonly (readonly [string, string])[] = [
+  ['r9', 'sb'],
+  ['r10', 'sl'],
+  ['r11', 'fp'],
+  ['r12', 'ip'],
+];
+/** O32's `$30`, which objdump prints `s8` and hand-written asm also writes `fp` (`ARM_REGISTER_ALIASES`). */
+export const O32_REGISTER_ALIASES: readonly (readonly [string, string])[] = [['s8', 'fp']];
+
 export const ARMV4T_AGBCC: TargetDescription = {
   id: 'armv4t',
   compiler: 'agbcc',
   argRegs: ['r0', 'r1', 'r2', 'r3'],
   returnReg: 'r0',
+  doubleArgWords: 'high-first',
   // AAPCS passes four in r0-r3, so nothing above them can be an argument. The ATPCS aliases are
   // the spellings this ISA's asm actually uses: censused over the vendored ARM asm, `sb`/`sl`/`ip`/
   // `fp` all occur as operands and no `v<n>`/`a<n>` form does. `sp`, `lr` and `pc` are deliberately
@@ -413,6 +1235,23 @@ export const ARMV4T_AGBCC: TargetDescription = {
   // `mov ip, r1` in two switch arms, no save anywhere, and a `mov r0, ip` past a third arm that
   // writes nothing — an uninitialised local by construction.
   scratchRegs: ['r12', 'ip'],
+  // MEASURED at the canonical flags, `register int g __asm__("rN")` for each of r4-r11: `f(){ return
+  // g; }` is `add r0, r4, #0` / `mov r0, r8` / `mov r0, sl`, and `s(a){ g = a; }` the reverse, with no
+  // save. agbcc prints r9 as `r9`, r10 as `sl` and r11 as `fp`; hand-written asm also writes `sb`.
+  globalRegisterVariables: {
+    regs: {
+      ...Object.fromEntries(['r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10', 'r11'].map((r) => [r, r])),
+      sb: 'r9',
+      sl: 'r10',
+      fp: 'r11',
+    },
+  },
+  // AAPCS: r0-r3 pass arguments and return, r12 (`ip`) is the intra-procedure-call scratch, and lr
+  // holds the return address the `bl` itself overwrites. agbcc's own machine description says the
+  // same (`thumb.h` CALL_USED_REGISTERS). Both spellings of r12 for the reason `nonArgRegs` carries
+  // both: the ATPCS aliases are what this ISA's asm writes.
+  callerSaved: ['r0', 'r1', 'r2', 'r3', 'r12', 'ip', 'lr'],
+  runtimeHelpers: AGBCC_RUNTIME_HELPERS,
   // GBA hardware, which this target implies: agbcc is the GBA compiler and this is the only
   // armv4t entry, so `armv4t + agbcc` is the platform. Stated because nothing else states it.
   capabilities: {
@@ -430,6 +1269,15 @@ export const ARMV4T_AGBCC: TargetDescription = {
     // The idiom this exists for is their `DMA_FILL`: `vu16 tmp = value;
     // DmaSet(n, &tmp, dest, … DMA_SRC_FIXED …)`, where the frame local is the source.
     readOnlyAddressSinks: [0x040000b0, 0x040000bc, 0x040000c8, 0x040000d4],
+    // DMAnCNT_H, 10 bytes above each SAD: Source Address Control is bits 7-8 (setting 3 is
+    // prohibited) and bit 10 selects 32-bit units. `DMA_FILL`'s `DMA_SRC_FIXED` is setting 2.
+    readSourceControl: {
+      offset: 0xa,
+      modeShift: 7,
+      modes: ['increment', 'decrement', 'fixed', null],
+      wideBit: 0x0400,
+      units: [2, 4],
+    },
     // The GBA I/O register file — one page from 0x04000000, the last live register being
     // 0x04000301 (HALTCNT). Everything a source reaches through `REG_*` is in here, and nothing
     // else is: IWRAM, EWRAM, palette, VRAM and OAM are ordinary memory a source does not qualify.
@@ -443,21 +1291,79 @@ export const ARMV4T_AGBCC: TargetDescription = {
       [0x040000d2, 0x040000d4],
       [0x040000de, 0x040000e0],
     ],
+    // The BIOS block transfers, SWI 0Bh CpuSet and SWI 0Ch CpuFastSet (GBATEK, "BIOS Memory
+    // Copy"): r0 the source, r1 the destination, r2 the control — a count in bits 0-20, bit 24 a
+    // FIXED source (a fill, reading one unit of r0), and for CpuSet bit 26 selecting 32-bit units
+    // over 16-bit ones; CpuFastSet moves words only, its count rounded up to eight. Neither writes
+    // through r0. The names are the SDK's: sa3's and pokeemerald's `libagbsyscall.s` bind
+    // `CpuSet: svc #11` and `CpuFastSet: svc #12`, kleod's `CpuSet: svc #0xb`, and each declares
+    // `void CpuSet(const void *src, void *dest, u32 control)`.
+    blockTransferCalls: {
+      CpuSet: {
+        source: 0,
+        control: 2,
+        countMask: 0x1fffff,
+        fixedBit: 0x01000000,
+        wideBit: 0x04000000,
+        units: [2, 4],
+        countGranule: 1,
+      },
+      CpuFastSet: {
+        source: 0,
+        control: 2,
+        countMask: 0x1fffff,
+        fixedBit: 0x01000000,
+        wideBit: 0,
+        units: [4, 4],
+        countGranule: 8,
+      },
+    },
   },
   compilerBehaviors: {
     coalesceLoopInit: false,
     preserveDivergentBranchSense: true,
     orderArgCopiesByWriteOrder: true,
     nearBaseSpan: 255,
+    volatileReadsExtendInRegister: true,
     foldsConstAddrOffset: true,
+    farMemberStoreOrder: true,
+    farMemberBasePerAccess: { past: 0 },
     foldsPointerAdvance: true,
+    pointerIntConversionIsFree: true,
+    keepsPointerSumAddend: true,
     readsStayWhereWritten: true,
-    switchAllowsBoundCase: true,
+    switchBoundCase: 'taken',
     switchArmsFollowLayout: true,
     switchRequiresFrontLoadedTests: true,
     hoistsSingleSetArm: true,
+    eightByteReturnScratch: 'r2',
     arrayShapeFromStride: true,
     reloadsLocalReread: true,
+    // MEASURED: the probe at the field. A signed constant often lifts as `mov #1; neg` or
+    // `mov #0x80; lsl #8`, a `neg`/`shl` the seed does not read. agbcc also materializes one
+    // constant ONCE for several narrow stores through the same base, whatever their signedness:
+    // `struct { s32 a; s16 b; u16 c; } *p; p->b = -300; p->c = -300;` is one `ldr r1,=0xfed4` for
+    // both `strh`. A stamp here then names one store's type, not necessarily each's (the `s16`
+    // store is stamped unsigned, which is also the convention).
+    narrowStoreConstantTakesLvalueType: true,
+    aggregateBoundary: 4,
+    largestAlignment: 4,
+    aggregateReturn: 'apcs',
+    structReturnHandsBackPointer: true,
+    // MEASURED: the probes at the fields.
+    forwardsStructReturnDestination: false,
+    discardedReadMayFillArgRegister: true,
+    byValueAggregateArgWords: true,
+    enumBytes: 4,
+    bitfieldPacking: 'contiguous',
+    roundTripsDoubleLiterals: true,
+    // agbcc 2.9 (gcc/varasm.c `assemble_variable`, gcc/thumb.h): an array takes its element's
+    // alignment (no DATA_ALIGNMENT); a declaration initialized by a STRING_CST is word-aligned —
+    // CONSTANT_ALIGNMENT (thumb.h:361) over DECL_INITIAL (varasm.c:1214-1216), so
+    // `static const char s[] = "hi"` is at 4 while `= {'h', 'i', 0}` and an array of strings
+    // (whose DECL_INITIAL is a CONSTRUCTOR) are at 1; and `= 0` keeps its `.data`, where only a
+    // declaration with no initializer is `.lcomm` (compiled).
+    staticLayout: { aggregateAlign: 1, stringAlign: 4, zeroScalar: 'data' },
     narrowParamWitness: 'prologue-extension',
     // agbcc: reload walks pseudos ascending handing each global-alloc loser a fresh slot, a user
     // local's pseudo number is its `expand_decl` position, and the Thumb frame grows UPWARD
@@ -466,13 +1372,97 @@ export const ARMV4T_AGBCC: TargetDescription = {
     // operand rows and nothing else, from two locals declared the other way round) and its
     // control `synthetic:spillorder_rev` (the same body in the order asmlift already emits, which
     // must stay a MATCH), plus `synthetic:dma_fill_uninit`, a row this did not author.
+    designatedInitializers: true, // agbcc compiles `{ 1, [8] = 2 }` (see the field)
     spillSlotOrder: 'ascending',
+    addressTakenArrayOrder: 'ascending', // MEASURED, the probe at the field
+    addressTakenArrayAlignment: 4, // MEASURED, the probe at the field
     // agbcc reserves the outgoing area with the rest of the frame (`add sp, sp, #-N` covers both)
     // and stages arguments 5+ into it at [sp,#0] upward — thumb.h's ACCUMULATE_OUTGOING_ARGS.
     stagesOutgoingArgsInFrame: true,
+    // …one area for every call, below the locals (thumb.h:573/600-622/628, calls.c:1675), which
+    // agbcc re-stages before each call and never reads back after one (agbcc-restage.s).
+    localsAboveOutgoingArea: true,
+    // …nor loads at all, before a call or after: no REG_PARM_STACK_SPACE (see the field).
+    outgoingAreaNeverLoadedFrom: 0,
+    // the two producer tables behind this are compiled, at agbcc 2.9-arm-000512 and the rows' own
+    // flags, and they are written out where the predicate reads it (`frontend/thumb.ts`)
+    oneWordFrameIsTheCapturedObject: true,
+    // compiled: the committed probe `test/corpus/agbcc-escape.s` (`scripts/regen-outgoing-area-probes.ts`)
+    escapedFrameAddressNamesALocal: true,
+    // agbcc's `*call_indirect` and `*call_value_indirect` emit `bl _call_via_%0` (gcc/thumb.md:997-1021),
+    // and libgcc defines `_call_via_<reg>` as `bx <reg>` for r0-r9, sl, fp, ip, sp and lr
+    // (libgcc/lib1thumb.asm:595-633). Neither `sp` (the frame) nor `lr` (which the `bl` itself
+    // overwrites) holds a function's address.
+    callThunks: {
+      prefix: '_call_via_',
+      regs: ['r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'sl', 'fp', 'ip'],
+    },
+    // agbcc spells a branch past the ±2 KB reach of Thumb `b` as `bl <label>` with this comment,
+    // from three patterns: `jump` (`bl %l0\t@ far jump`, gcc/thumb.md:837), and the relays of
+    // `*cond_branch` (`.LCB`, :930) and `*cond_branch_reversed` (`.LCBR`, :957), both
+    // `bl %l0\t@far jump`. thumb.c `far_jump_used_p` (:715, read at :785 and :1065) makes it push lr
+    // in any function that has one. Only the WHOLE comment is the mark: a longer comment that
+    // mentions a far jump is not the compiler's.
+    farJumpRelay: { comment: /^@\s*far jump\s*$/ },
   },
 };
 
+/** MIPS o32's floating-point homes, shared by both compilers that target it (see `fpu`). The odd
+ *  halves (`$f13`, `$f15`) carry the other word of a DOUBLE argument, which no frontend lifts. */
+const O32_FPU: TargetDescription['fpu'] = { argRegs: ['$f12', '$f14'], returnReg: '$f0', slots: 'leading' };
+
+/** O32's register partition, shared by every compiler that targets it (`nonArgRegs` and
+ *  `scratchRegs`). Every general register but the four argument registers and the ones that are
+ *  never a local's home (`zero`, `k0`/`k1`, `gp`, `sp`, `ra`). `s8` and `fp` are the two spellings
+ *  of $30, listed both as `ARMV4T_AGBCC` lists `r12` and `ip`: objdump prints `s8`, and a spelling
+ *  nobody listed keeps its existing treatment. */
+const O32_NON_ARG_REGS = [
+  'at',
+  'v0',
+  'v1',
+  ...Array.from({ length: 10 }, (_, i) => `t${i}`),
+  ...Array.from({ length: 8 }, (_, i) => `s${i}`),
+  's8',
+  'fp',
+] as const;
+/** Of those, the ones O32 lets a callee use with no save — `at`, `v0`/`v1` and `t0`..`t9`, the
+ *  caller-saved registers that pass no argument. MEASURED on GCC_KMC_TOOLCHAIN and the stock gcc
+ *  2.7.2 toolchain at their synthetic flags: a leaf homes an uninitialised local in v0
+ *  (`uninit_join`: `bgtzl a0,…; sll v0,a0,1; jr ra; ori v0,v0,1`) and in v1 (`uninit_sw`).
+ *
+ *  Every one of them is also a `hiddenInputRegs` entry, because O32's hand-written asm hands values
+ *  over in them: af's famicom_emu routines are handed a value in t0 or v1 (`sw t0,6348(s8)` is
+ *  its first instruction), and a label inside a function starts with its registers live.
+ *  MEASURED over every function and label symbol of the vendored snowboardkids2 (KMC),
+ *  marioparty3 (gcc 2.7.2) and af (IDO) objects, 29,399 in all, the refusal below fires on 17 —
+ *  twelve labels, three hand-written routines (two of famicom_emu's and libkmc's `div64_64_1`) and
+ *  two data symbols disassembled as code — and on no compiled function. A
+ *  compiled local is assigned on some path, so its entry value meets that assignment at a join;
+ *  `uninitfirst` also reads one before the switch that assigns it, which a join allows. The join
+ *  must take a definition the entry value does not feed, because an input carried round a loop
+ *  (`addiu t0,t0,-1; bnez t0,top`) meets only its own next value at the loop header. famicom_emu's
+ *  hand-written Yaz0 reader `func_8082E4E0_jp` is NOT that shape:
+ *  its t0 is a bit buffer loaded whenever the count runs out (and the count starts at 0), then
+ *  shifted each trip, and it lifts with t0 an uninitialised local no path reads before the load.
+ *  The cost is a local NO path assigns
+ *  (`int r; return r + a;` is `jr ra; addu v0,v0,a0` on gcc, and `int x, y; if (c) x = y;` joins
+ *  v0 with v1), which refuses: none of the 29,399 is one.
+ *
+ *  THE RULE'S BLIND SIDE is a count a hand-written routine is handed and RELOADS on an outer arm
+ *  (`… addiu t0,t0,-1; bnez t0,inner; …; bnezl a1,inner; li t0,8`): the outer arm's constant is a
+ *  definition of its own at the inner loop's header, so the entry value counts as met and the first
+ *  pass reads an undeclared local — the input is dropped. Nothing tells it from compiled
+ *  `int t; do { do { … } while (--t); t = 8; } while (--n);`, and none of the 29,399 is either.
+ *  The same side holds an input RELOADED FROM MEMORY on one arm and then transformed: hand
+ *  func_8082E4E0_jp its count in a2 as well (drop its `move a2,zero`), and the arm that runs when
+ *  the count is not 0 reads the caller's bit buffer in t0, but the loop header's join meets the
+ *  shift `sll t0,t0,1`, which reaches t0's entry value only through the join the load `lw t0,0(a0)`
+ *  also feeds. So the shift is a definition of its own, the routine lifts with `int code;` read on
+ *  that first pass, and the caller's t0 is dropped. Nothing tells it from compiled `int code;`
+ *  with the bit count a parameter, and none of the 29,399 is that shape: the real routine zeroes
+ *  a2 before the loop, so its load runs first. */
+const O32_SCRATCH_REGS = ['at', 'v0', 'v1', ...Array.from({ length: 10 }, (_, i) => `t${i}`)] as const;
+
 /** MIPS-II / IDO 7.1 target. IDO is the IRIX C compiler,
  *  statically recompiled to run natively (ido-static-recomp). Unlike agbcc
  *  it emits no textual asm, so asmlift's input is the DISASSEMBLED object (`mips-linux-gnu-
@@ -483,16 +1473,63 @@ export const MIPS_IDO: TargetDescription = {
   compiler: 'ido',
   argRegs: ['a0', 'a1', 'a2', 'a3'],
   returnReg: 'v0',
+  // MEASURED on ido7.1, gcc2.7.2kmc and gcc2.7.2: the probes at the field.
+  evenWordAlignedArgs: true,
+  // O32: at, v0-v1, a0-a3, t0-t9 and ra are all caller-saved. `frontend/mips.ts` reads the rest, and
+  // `ra`, as the registers a frame store SAVES.
+  callerSaved: [
+    'at',
+    'v0',
+    'v1',
+    'a0',
+    'a1',
+    'a2',
+    'a3',
+    't0',
+    't1',
+    't2',
+    't3',
+    't4',
+    't5',
+    't6',
+    't7',
+    't8',
+    't9',
+    'ra',
+  ],
+  // O32's partition (`O32_NON_ARG_REGS`). The frontend narrows it to the scratch half and the
+  // callee-saved registers its prologue saves (frontend/mips.ts `prologueSavedRegs`).
+  nonArgRegs: O32_NON_ARG_REGS,
+  scratchRegs: O32_SCRATCH_REGS,
+  // Every scratch register, for the measurement at `O32_SCRATCH_REGS`.
+  hiddenInputRegs: O32_SCRATCH_REGS,
+  kernelRegs: ['k0', 'k1'],
+  runtimeHelpers: IDO_RUNTIME_HELPERS,
+  // MEASURED with this toolchain's own flags: `float f(float a, float b){ return a + b; }` is
+  // `jr ra; add.s $f0,$f12,$f14`, and the `'leading'` rule's two halves are the pair in `fpu`'s note.
+  fpu: O32_FPU,
   capabilities: { endianness: 'big', hwDivide: true, hwFloat: true, flags: false },
   // `switchAllowsNeqCase: false` — IDO's switch dispatch uses `==`/`<`, never `!=` cases;
   // leaving it permissive mis-recognises `!=`-rooted if-else chains as switches.
   compilerBehaviors: {
+    contractsFloatProducts: false,
     coalesceLoopInit: true,
     preserveDivergentBranchSense: true,
     orderArgCopiesByWriteOrder: true,
     switchAllowsNeqCase: false,
     // MEASURED — the pair at the field compiles to one load of `p[1]` for every local spelling.
     reloadsLocalReread: false,
+    // MEASURED: the probe at the field.
+    narrowStoreConstantTakesLvalueType: true,
+    aggregateBoundary: 1,
+    // MEASURED on all three O32 toolchains (ido7.1, gcc2.7.2kmc, gcc2.7.2): `struct {char c; double d;}`
+    // and its `long long` twin put the member at 8 and size 16 (`sizeof` and the member's offset
+    // compiled into `.data`).
+    largestAlignment: 8,
+    // MEASURED on all three O32 toolchains: the probes at the field.
+    aggregateReturn: 'memory',
+    structReturnHandsBackPointer: true,
+    byValueAggregateArgWords: true,
     // MEASURED at `-mips2 -O2 -32 -non_shared -G 0`: the `sll` leads the function for BOTH
     // spellings, so the prologue position cannot decide; a narrow DECLARED parameter is the one that
     // is both homed dead AND widened in its own argument register. raise/paramwidth.ts's header has
@@ -503,8 +1540,7 @@ export const MIPS_IDO: TargetDescription = {
     // reversed-declaration twin, with this compiler's objects beside them — and a test reads the
     // correspondence off it: 16 of 16 spills, and rank → offset unchanged when the declaration
     // list is reversed, which is what separates declaration rank from the order of the
-    // assignments. No ido7.1 benchmark row lifts with two or more spilled user locals — the only
-    // spilling shape in the corpus carries a call, and this frontend declines a call — so no row
+    // assignments. No ido7.1 benchmark row lifts with two or more spilled user locals, so no row
     // can tell a wrong value from a right one here.
     //
     // FLIP CONDITION, and it has TWO parts because the second is easy to miss. (1) The first
@@ -514,6 +1550,26 @@ export const MIPS_IDO: TargetDescription = {
     // O32's caller-owned home area `[0,16)` would be read as this function's first four
     // declaration ranks. Shipping a direction before the partition orders by argument index.
     spillSlotOrder: 'unknown',
+    addressTakenArrayOrder: 'descending', // MEASURED, the probe at the field
+    addressTakenArrayAlignment: 4, // MEASURED, the probe at the field
+    // MEASURED, the probe at the field: the local ends at the frame top, above `ra` and the spills.
+    o32LocalArea: 'above-saved-registers',
+    // MEASURED off the same probe (`twice`, `owns`): O32's outgoing area is the frame bottom, an
+    // unchanged argument is staged again before each call, and a callee assigns to its stack
+    // parameter in place. Read by the frame-object audit alone here (`storedNeverRead`).
+    localsAboveOutgoingArea: true,
+    // MEASURED at -O1, -O2, -O2 -g3 and -O0 (`test/corpus/ido71*-outarea.txt`): no load from 16(sp)
+    // up, but the a1..a3 home words a by-value aggregate is staged in are loaded back (see the field).
+    outgoingAreaNeverLoadedFrom: 16,
+    // MEASURED at -O1 and -O0: the note at the field — `lw zero` for a volatile read, a `t6` load
+    // and a frame store for a plain dead local, `lw a2` for a `register` one.
+    discardsUnusedReadsInto: 'zero',
+    // MEASURED: the probes at the fields.
+    forwardsStructReturnDestination: true,
+    discardedReadMayFillArgRegister: false,
+    // MEASURED, the probes at the field: past the `addiu` reach every member access gets its own
+    // `lui`/`addu`, and a held pointer shares one.
+    farMemberBasePerAccess: { past: 32767 },
   },
 };
 
@@ -525,6 +1581,46 @@ export const MIPS_GCC: TargetDescription = {
   compiler: 'gcc',
   argRegs: ['a0', 'a1', 'a2', 'a3'],
   returnReg: 'v0',
+  // MEASURED on ido7.1, gcc2.7.2kmc and gcc2.7.2: the probes at the field.
+  evenWordAlignedArgs: true,
+  // The same O32 convention MIPS_IDO carries, read the same way.
+  callerSaved: [
+    'at',
+    'v0',
+    'v1',
+    'a0',
+    'a1',
+    'a2',
+    'a3',
+    't0',
+    't1',
+    't2',
+    't3',
+    't4',
+    't5',
+    't6',
+    't7',
+    't8',
+    't9',
+    'ra',
+  ],
+  // O32's partition, as at MIPS_IDO.
+  nonArgRegs: O32_NON_ARG_REGS,
+  scratchRegs: O32_SCRATCH_REGS,
+  hiddenInputRegs: O32_SCRATCH_REGS,
+  // MEASURED on gcc2.7.2kmc and gcc2.7.2 at their canonical flags: `register int g __asm__("$16");
+  // int f(void){ return g; }` is `jr ra; move v0,s0`, and `$23`/`$30` give s7/s8. KMC's `-fno-asm`
+  // rejects the bare `asm(` spelling, which is why every target spells `__asm__`. IDO 7.1 has no
+  // such declaration (its cfe rejects both spellings), so MIPS_IDO states none.
+  globalRegisterVariables: {
+    regs: {
+      ...Object.fromEntries(Array.from({ length: 8 }, (_, i) => [`s${i}`, `$${16 + i}`])),
+      s8: '$30',
+      fp: '$30',
+    },
+  },
+  kernelRegs: ['k0', 'k1'],
+  runtimeHelpers: MIPS_GCC_RUNTIME_HELPERS,
   // KMC GCC keeps a loop seeded from an argument register IN that register (coalesceLoopInit
   // true, like IDO): test/corpus/gcc-gcd.asm runs its whole loop on a0/a1 with no init copies,
   // and the row it comes from matches only with the parameters as the loop's homes. The other
@@ -542,8 +1638,12 @@ export const MIPS_GCC: TargetDescription = {
   // and dmastride on agbcc lost; maxarr and preupdate_exit_call on agbcc gained) — because a pred
   // that computes the initial value INTO the param's own register wrote the key and still
   // coalesces.
+  // The same o32 convention, measured on GCC_KMC_TOOLCHAIN at -O2: the fadd pair compiles to the
+  // same two instructions IDO's does, and `float f(int a, float b)` moves `b` over with `mtc1 a1`.
+  fpu: O32_FPU,
   capabilities: { endianness: 'big', hwDivide: true, hwFloat: true, flags: false },
   compilerBehaviors: {
+    contractsFloatProducts: false,
     coalesceLoopInit: true,
     preserveDivergentBranchSense: true,
     orderArgCopiesByWriteOrder: true,
@@ -585,6 +1685,17 @@ export const MIPS_GCC: TargetDescription = {
     // MEASURED on BOTH toolchains this description serves (the note above): one load of `p[1]` for
     // every local spelling of the pair at the field, gcc2.7.2kmc at -O2 and gcc2.7.2 at -O1 alike.
     reloadsLocalReread: false,
+    // MEASURED on BOTH toolchains this description serves, the probe at the field.
+    narrowStoreConstantTakesLvalueType: true,
+    // MEASURED on BOTH toolchains this description serves, the pairs at the field.
+    keepsPointerSumAddend: true,
+    aggregateBoundary: 1,
+    // MEASURED on BOTH toolchains this description serves, and on ido7.1: the probe at MIPS_IDO's.
+    largestAlignment: 8,
+    // MEASURED on BOTH toolchains this description serves: the probes at the field.
+    aggregateReturn: 'memory',
+    structReturnHandsBackPointer: true,
+    byValueAggregateArgWords: true,
     // MEASURED on BOTH toolchains this description serves: `int f(s8 x){return x;}` and
     // `int f(s32 x){return (s8)x;}` compile to BYTE-IDENTICAL objects, gcc2.7.2kmc at -O2 and
     // gcc2.7.2 at -O1 alike — so the object carries no witness at all and the pass refuses.
@@ -598,7 +1709,21 @@ export const MIPS_GCC: TargetDescription = {
     // The two agreeing is not a formality. The value is per DESCRIPTION and TWO toolchains map
     // here, so a toolchain whose direction differed from its description's would need a
     // per-toolchain override this bag cannot express — see the note at `compilerBehaviors`.
+    designatedInitializers: true, // both gcc 2.7.2 builds compile `{ 1, [8] = 2 }` (see the field)
     spillSlotOrder: 'unknown',
+    addressTakenArrayOrder: 'ascending', // MEASURED on both toolchains, the probe at the field
+    addressTakenArrayAlignment: 8, // MEASURED on both toolchains, the probe at the field
+    // MEASURED on BOTH toolchains this description serves, the probe at the field: identical
+    // layouts, the local right above the 8-aligned outgoing area and under the saves.
+    o32LocalArea: 'above-outgoing-area',
+    // MEASURED on BOTH toolchains this description serves, the probe at `o32LocalArea` (`twice`).
+    localsAboveOutgoingArea: true,
+    // MEASURED on BOTH toolchains at their rows' levels and at -O0 (`test/corpus/gcc272*-outarea.txt`):
+    // no load from 16(sp) up the area; a char-array struct's home words are loaded (see the field).
+    outgoingAreaNeverLoadedFrom: 16,
+    // MEASURED on BOTH toolchains this description serves: the probes at the fields.
+    forwardsStructReturnDestination: false,
+    discardedReadMayFillArgRegister: true,
   },
 };
 
@@ -614,11 +1739,49 @@ export const PPC_MWCC: TargetDescription = {
   // PPC EABI: r3–r10 pass integer/pointer arguments; r3 also returns.
   argRegs: ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'],
   returnReg: 'r3',
+  // MEASURED on 2.4.2 at the synthetic tier's flags and on 2.3.3 and 2.4.7 at -O4,p:
+  // `takeLL(1, gL)` sets r3 and r5:r6 with r4 unset.
+  evenWordAlignedArgs: true,
+  // PPC EABI: r0 and r3-r12 are volatile, and lr carries the return address `bl` overwrites. r11
+  // and r12 are the linker's stub scratch, r13 is the small-data base and r14 upward are
+  // callee-saved.
+  callerSaved: ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10', 'r11', 'r12', 'lr'],
+  // Every GPR but r1 (the stack pointer, never an SSA register here) and the eight argument
+  // registers. The frontend narrows it to `scratchRegs` and the ones the prologue saved
+  // (`prologueSavedRegs`). r2 and r13, the small-data bases, never reach that rule: a read of either
+  // as a value refuses first (`SMALL_DATA_BASES` in frontend/ppc.ts).
+  nonArgRegs: ['r0', 'r2', ...Array.from({ length: 21 }, (_, i) => `r${i + 11}`)],
+  // The volatile registers no argument travels in, which a callee may use with no save. MEASURED on
+  // 2.4.2 at the synthetic tier's flags and on 2.3.3 at Pikmin's -O4,p (in C): a leaf homes an
+  // uninitialised local in each of them, unsaved — `int x; if (s) x = a*3; return x + a;` is
+  // `mulli r0,r4,3; add r3,r0,r4`, and with all eight argument registers live two such locals land
+  // in r11 and r12. 2.4.7 at MP4's flags puts them in saved registers instead.
+  scratchRegs: ['r0', 'r11', 'r12'],
+  // r11 is the save routines' frame address and r12 `__ptmf_scall`'s member-function pointer: a
+  // read of either that no path's definition joins refuses instead of minting `uninit_r11`.
+  hiddenInputRegs: ['r11', 'r12'],
+  // MEASURED on 2.4.2 and 2.4.7 at -O4,p: `register int g __asm__("r14"); int f(void){ return g; }`
+  // is `mr r3,r14`. They accept r14..r28 only ("supports 15 registers beginning with r14") and no
+  // gap among them ("nothing at 'r19' not permitted"), in any declaration order. 2.3.3 refuses the
+  // storage class, so `mwcc_233_163n` drops this field.
+  globalRegisterVariables: {
+    regs: Object.fromEntries(Array.from({ length: 15 }, (_, i) => [`r${14 + i}`, `r${14 + i}`])),
+    contiguous: Array.from({ length: 15 }, (_, i) => `r${14 + i}`),
+  },
+  runtimeHelpers: PPC_MWCC_RUNTIME_HELPERS,
+  registerSaveRoutines: PPC_MWCC_SAVE_ROUTINES,
+  // PPC EABI with `-fp hard`, measured at the synthetic tier's flags: `fadds f1,f1,f2; blr`, a third
+  // float argument in f3, and the GPR/FPR order of mixed parameters absent from the object.
+  fpu: { argRegs: ['f1', 'f2', 'f3', 'f4', 'f5', 'f6', 'f7', 'f8'], returnReg: 'f1', slots: 'separate' },
   capabilities: { endianness: 'big', hwDivide: true, hwFloat: true, flags: true },
   // CodeWarrior's structuring compiler behaviors are UNKNOWN until fixtures reveal them — safe universal
   // defaults; coalesceLoopInit false until a CW loop fixture says otherwise — the second of the
   // two compiler-wide guesses standing in for the per-function observation named at MIPS_GCC.
   compilerBehaviors: {
+    contractsFloatProducts: true,
+    // MEASURED on all three builds in C: an integer, a pointer and a `u16 *` passed to an `s32 *`,
+    // `u32` and `s32 *` parameter each fail to compile, and each compiles once cast (see the field).
+    strictPointerConversions: true,
     coalesceLoopInit: false,
     preserveDivergentBranchSense: true,
     orderArgCopiesByWriteOrder: true,
@@ -627,10 +1790,51 @@ export const PPC_MWCC: TargetDescription = {
     // `u8 v = p[3]; if ((v & 0x7f) == 0x7f) { fnA(); p[4] = v; return; }` under an `if (a)`
     // matches only once `read-behind-effect` stops refusing it (3/24 → MATCH 0/22).
     reloadsLocalReread: false,
+    // MEASURED on all three builds at -O4,p, and on mwcc_247_107 at -O0,p: the probe at the field.
+    narrowStoreConstantTakesLvalueType: true,
+    aggregateBoundary: 1,
+    // MEASURED on all three builds: `struct {u8 a; double d;}` and its `long long` twin put the
+    // member at 8 and size 16
+    largestAlignment: 8,
+    aggregateReturn: 'svr4',
+    // MEASURED on all three builds: r3 holds a reload of a frame word at the `blr` of a struct
+    // returner that calls something
+    structReturnHandsBackPointer: false,
+    // MEASURED on mwcc_242_81 through the `.comment` alignment record: an array or a struct is at
+    // 4 at least (`u8[1]`, a struct of two bytes), a scalar at its width; a string-literal
+    // initializer gets no more than the array does (`char s[] = "hello!"` and a `u8` list both 4);
+    // and a scalar `= 0` moves to bss, where `int q[1] = {0}` stays in `.data`. In both bss
+    // sections the moved scalars come first in declaration order. The statics with no initializer
+    // follow reversed in `.sbss`; in `.bss` (an object over the `-sdata` threshold: an array over 8
+    // bytes, every scalar at `-sdata 0`) they follow in the order the compiler first uses them
+    // (`a[i]=1; b[i]=2;` puts a first, the swap b), which neither the source's text
+    // (`x = b[i]; a[i] = 1;` puts a first) nor the emitted code (`a[i] = b[i]` reads b first, puts a
+    // first) fixes. The other mwcc builds this description serves are not measured.
+    staticLayout: {
+      aggregateAlign: 4,
+      stringAlign: 4,
+      zeroScalar: 'bss',
+      uninitOrder: { '.sbss': 'reversed', '.bss': 'first-use' },
+    },
+    // MEASURED on all three builds at -O4,p and -O0,p: the note at the field. The two are one
+    // declaration: without the layout gate a relational if-ladder reads as a `switch`. The gate's
+    // reach is the committed probes alone — withdrawn, it moves 0 of the 180 PPC benchmark rows
+    // that lift — so switch-arms.test.ts holds the pairing over every target instead of a row.
+    switchBoundCase: 'either',
+    switchRequiresFrontLoadedTests: true,
     // The PowerPC prologue widens a declared narrow parameter with `extsb`/`extsh`, which the
     // frontend lifts to the same `sext` op agbcc's shift pair folds to — the position shape, on
     // another ISA. `synthetic:{sextb,tos8}:mwcc_242_81` are its rows, MATCH through that pass.
     narrowParamWitness: 'prologue-extension',
+    // MEASURED on all three builds: the note at the field.
+    linkageLocalArea: 'above-outgoing-area',
+    // MEASURED off the same probes, on all three builds and at -O0,p (`twice9`, and every outgoing
+    // word below the area unread): Mario Party 4's -O0,p homes a parameter in the area and reloads
+    // it after a call, which proves the word a local's (`ee`, `synthetic:homecall:mwcc_242_81`).
+    localsAboveOutgoingArea: true,
+    // MEASURED on all three builds at the rows' flags and -O0,p, and on mwcc_242_81 at -O4,s
+    // (`test/corpus/mwcc*-outarea.txt`): no load of the parameter area, which starts at 8(r1).
+    outgoingAreaNeverLoadedFrom: 8,
     // NOT MEASURED, and `'unknown'` is therefore the only honest value here rather than a withheld
     // one, as it is at MIPS_IDO and MIPS_GCC. No mwcc row lifts with two or more spilled user
     // locals, and the compiler does not spill the committed declaration-rank probe either: at
@@ -639,9 +1843,19 @@ export const PPC_MWCC: TargetDescription = {
     // first: `frontend/ppc.ts` claims no `LiveInModel.declaredLocals`, so the shared stamp records
     // no slot home on this target at all and a direction here would order nothing until it does.
     spillSlotOrder: 'unknown',
+    // MEASURED on all three builds at -O0,p: the note at the field — `lwz r0` for a volatile read,
+    // an `r31` home for a plain or `register` dead local.
+    discardsUnusedReadsInto: 'r0',
+    // MEASURED on all three builds: the probes at the fields.
+    forwardsStructReturnDestination: false,
+    discardedReadMayFillArgRegister: true,
   },
 };
 
+/** CodeWarrior 2.3.3b163n (Pikmin): `PPC_MWCC` but for the one declaration a probe refuted there —
+ *  it rejects a global register variable ("illegal storage class"), so it has no spelling for one. */
+export const PPC_MWCC_233: TargetDescription = { ...PPC_MWCC, globalRegisterVariables: undefined };
+
 /** A toolchain: one compiler binary, named as decomp.me names it. Several toolchains may share a
  *  description (`MIPS_GCC` serves two), and each keeps its own evidence. */
 export interface ToolchainTarget {
@@ -715,7 +1929,8 @@ export const TOOLCHAIN_TARGETS = {
     description: PPC_MWCC,
   },
   // The other two CodeWarrior builds the GameCube projects compile with: 2.3.3b163n (Pikmin's whole
-  // game tree) and 2.4.7b107 (Mario Party 4's DOL). Both SHARE `PPC_MWCC`, and on their own evidence
+  // game tree) and 2.4.7b107 (Mario Party 4's DOL). Both SHARE `PPC_MWCC` (2.3.3 less the global
+  // register variables it refuses, `PPC_MWCC_233`), and on their own evidence
   // rather than because they are the same compiler family: `test/matching/ppc-compiler-behaviors.test.ts`
   // re-runs both of its probes on each binary at the flags that build's rows compile at, and each
   // reads as the description says. What moves those readings is the optimisation level — at `-O0,p`
@@ -727,7 +1942,7 @@ export const TOOLCHAIN_TARGETS = {
   // are two different sets, neither of which is "the" one. See `canonicalFlags` above.
   mwcc_233_163n: {
     family: 'mwcc',
-    description: PPC_MWCC,
+    description: PPC_MWCC_233,
   },
   mwcc_247_107: {
     family: 'mwcc',
@@ -766,17 +1981,64 @@ export interface ResolvedTarget {
   toolchain: ToolchainId;
   /** the flags the function's target and every candidate compile with */
   cflags: readonly string[];
-  /** the description asmlift decompiles against: the toolchain's, at every flag set */
+  /** the description asmlift decompiles against: the toolchain's, less a fact a flag changes */
   target: TargetDescription;
   /** what the flags make the compiler do */
   profile: CodegenProfile;
 }
 
+/** Does a compiler of `family`, at optimisation level `level` (the profile's `O` slot), keep a plain
+ *  read whose value nothing uses (`compilerBehaviors.keepsUnusedReads`)? COMPILED, `int x; x = p[5];
+ *  x = 0; *q = x;` and `int x = p[1];`: mwcc 2.3.3 and 2.4.2 at `-O0` and 2.4.7 at `-O0,p` keep
+ *  `lwz r31, 20(r3)` in a register nothing reads; IDO 7.1 at `-O0` and at `-O1` (its default) keeps
+ *  `lw t6, 20(a0)`; agbcc and KMC gcc 2.7.2 at `-O0` keep the read and store it to the frame. None
+ *  of them does at agbcc/KMC `-O1`, `-O2` or `-O3`, IDO `-O2` or `-O3`, or mwcc 2.4.2 `-O1` through
+ *  `-O4,p` and `-O4,s`. A plain expression statement's read (`*p;`) is gone at every level on every
+ *  one of them; a volatile one stays, at a keeping level in the register `discardsUnusedReadsInto`
+ *  names where the compiler has one.
+ *
+ *  A LEVEL NO FLAG NAMES (`undefined`) KEEPS. Every family's unflagged compile was measured keeping:
+ *  agbcc's and IDO's are their `-O0` and `-O1` (codegen-flags.ts `EFFECTIVE` names them, so they
+ *  never reach here unnamed), KMC gcc 2.7.2 with no `-O` emits `-O0`'s object byte for byte, and
+ *  mwcc 2.4.2 with no level, with `-opt off` or with `-opt level=0` keeps `x = p[5]; x = 0;`'s
+ *  `lwz r31, 20(r3)` as at `-O0`. And the cost runs one way: answering "keeps" where the compiler
+ *  deletes withholds a `volatile` outside the discard register (`discardsUnusedReadsInto`): the
+ *  read is dropped as plain on mwcc and IDO, and the lift refuses on a compiler with none. Answering
+ *  "deletes" where it keeps publishes one the source never wrote, a value this stamp alone decides,
+ *  with no candidate to referee it (docs/level-tower.md, A PROFILE OF A COMPILER INHERITS). */
+export function keepsUnusedReadsAt(family: FlagFamily, level: string | undefined): boolean {
+  if (level === undefined) {
+    return true;
+  }
+  const n = /^\d/.exec(level)?.[0];
+  return n === '0' || (family === 'ido' && n === '1');
+}
+
+/** The level `keepsUnusedReadsAt` judges a profile at: its `O` slot, or none where a word the table
+ *  does not read may set it too — mwcc's `-opt off` and `-opt level=0` compile at `-O0`, and the
+ *  table reads neither, so a profile that spells one has a level nothing here knows. */
+function unusedReadLevel(profile: CodegenProfile): string | undefined {
+  const optWord = profile.family === 'mwcc' && profile.unclassified.some((w) => w.startsWith('-opt'));
+  return optWord ? undefined : profile.slots.O;
+}
+
 /** The target a function compiled by `toolchain` at `cflags` decompiles against, and the profile
  *  those flags describe. Throws on a level word the toolchain's family cannot read. */
 export function targetFor(toolchain: ToolchainId, cflags: readonly string[]): ResolvedTarget {
   const t: ToolchainTarget = TOOLCHAIN_TARGETS[toolchain];
-  return { toolchain, cflags, target: t.description, profile: parseFlags(t.family, cflags) };
+  const profile = parseFlags(t.family, cflags);
+  const cpp = dialectOf(profile.slots.lang) === 'c++';
+  let target: TargetDescription = cpp ? { ...t.description, dialect: 'c++' } : t.description;
+  if (keepsUnusedReadsAt(t.family, unusedReadLevel(profile))) {
+    target = { ...target, compilerBehaviors: { ...target.compilerBehaviors, keepsUnusedReads: true } };
+  }
+  if (profile.slots['-fshort-enums'] === 'on') {
+    // every enum is the smallest integer its values fit (c-decl.c:6064-6065, :6123; compiled,
+    // `sizeof(struct {enum {K0, K1} k[2];})` is 4 under the flag and 8 without), so none is enumBytes
+    const { enumBytes: _flagged, ...behaviors } = target.compilerBehaviors;
+    target = { ...target, compilerBehaviors: behaviors };
+  }
+  return { toolchain, cflags, target, profile };
 }
 
 /** Build the structurer's options for a target: the function's own `returnsVoid` plus every
@@ -789,10 +2051,13 @@ export function targetFor(toolchain: ToolchainId, cflags: readonly string[]): Re
  *  `nearBaseSpan` / `foldsConstAddrOffset` are read off the target by rank.ts. So the field names
  *  are a SUPERSET of StructureOptions', not a bijection, and nothing may derive one from the other
  *  by enumerating keys. */
-export function structureOptionsFor(t: TargetDescription, returnsVoid: boolean): StructureOptions {
-  // `littleEndian` and `deviceRegisters` are the HARDWARE capabilities the structurer consumes
-  // (bitfield extract recognition is LSB-first; the dead-read spelling refuses outside the device
-  // window); everything else is a compiler behavior.
+export function structureOptionsFor(
+  t: TargetDescription,
+  returnsVoid: boolean,
+  prototypes: Prototypes = {},
+): StructureOptions {
+  // `littleEndian` is the HARDWARE capability the structurer consumes (bitfield extract recognition
+  // is LSB-first); everything else is a compiler behavior.
   //
   // ONE FIELD IS NOT A STRAIGHT SPREAD, and this is where the difference belongs. A frame
   // direction has THREE states here — `ascending`, `descending`, and `'unknown'` meaning measured
@@ -803,13 +2068,64 @@ export function structureOptionsFor(t: TargetDescription, returnsVoid: boolean):
   const { spillSlotOrder, ...behaviors } = t.compilerBehaviors;
   return {
     returnsVoid,
+    declaredArgs: declaredArgTypes(prototypes, t.dialect !== 'c++'),
+    declaredReturns: declaredReturnTypes(prototypes),
+    ...(t.dialect === 'c++' ? { dialect: 'c++' as const } : {}),
     littleEndian: t.capabilities.endianness === 'little',
-    ...(t.capabilities.deviceRegisters ? { deviceRegisters: t.capabilities.deviceRegisters } : {}),
     ...behaviors,
     ...(spillSlotOrder === 'ascending' || spillSlotOrder === 'descending' ? { spillSlotOrder } : {}),
   };
 }
 
-export const C_TYPEDEFS =
-  'typedef unsigned char u8;typedef unsigned short u16;typedef unsigned int u32;' +
-  'typedef signed char s8;typedef short s16;typedef int s32;\n';
+/** The global a register `globalRegisterVariables` names is lifted as (`asmName` its `__asm__`
+ *  name: `greg_r8`, and `greg_r16` for MIPS `$16`). */
+export const globalRegisterSymbol = (asmName: string): string => `greg_${asmName.replace(/^\$/, 'r')}`;
+
+/** The candidate prelude: a `typedef` for every name in the scalar vocabulary. PRINTED from
+ *  `proto.ts`'s `PRELUDE_TYPEDEFS` rather than spelled out, because the other reader of that
+ *  vocabulary decides which type texts asmlift may PRINT into a candidate, and a second copy of
+ *  the list is a copy that can disagree — in the direction no test over two lists catches.
+ *
+ *  The decomp checkouts all define the same names, and the harness keeps typedefs per NAME against
+ *  the vendored ctx, so a unit that already has them gets no redefinition. */
+export const C_TYPEDEFS = `${[...PRELUDE_TYPEDEFS].map(([name, base]) => `typedef ${base} ${name};`).join('')}\n`;
+
+/** Each declared callee's parameter types, where one can be PRINTED as a cast — the argument
+ *  conversions C++ refuses to make implicitly (backend/cfamily.ts `argConversion`), and a pointer
+ *  cell's integer arguments (l3/ptrcell.ts). In C (`opaquePointers`), an object pointer to a type
+ *  this cannot spell — `struct S *` — is kept too: the printer casts its argument through `void *`,
+ *  which C converts to any object pointer implicitly, where a strict front end (mwcc) refuses
+ *  `use2(s)` for a `u32 s[2]` the static's bytes were typed as. Any other entry this cannot spell is
+ *  `undefined`, and that argument is printed uncast. */
+function declaredArgTypes(
+  prototypes: Prototypes,
+  opaquePointers: boolean,
+): Record<string, readonly (ParamType | undefined)[]> {
+  const out: Record<string, readonly (ParamType | undefined)[]> = {};
+  for (const [name, p] of Object.entries(prototypes)) {
+    if (Array.isArray(p.params)) {
+      out[name] = p.params.map((t) =>
+        (spellableType(t) && declaredWidth(t) !== undefined) || (opaquePointers && objectPointerType(t))
+          ? t
+          : undefined,
+      );
+    }
+  }
+  return out;
+}
+
+/** A pointer to an object, a pointer to a function excluded: `void *` converts to it implicitly in
+ *  C, which it does not to a function pointer. */
+const objectPointerType = (t: ParamType): boolean => /\*\s*(?:const|volatile|\s)*$/.test(t) && !t.includes('(');
+
+/** Each declared callee's return type as the project spells it, which is never printed: whether a
+ *  pointer cell compared with the call meets a pointer (l3/ptrcell.ts). */
+function declaredReturnTypes(prototypes: Prototypes): Record<string, ParamType> {
+  const out: Record<string, ParamType> = {};
+  for (const [name, p] of Object.entries(prototypes)) {
+    if (p.returns !== undefined) {
+      out[name] = p.returns;
+    }
+  }
+  return out;
+}