@asmlift/core 0.9.0 → 0.10.0

package/src/frontend/thumb.ts

@@ -18,33 +18,72 @@
 // incoming stack argument at `[sp, #N]` locatable at all. Because agbcc may
 // copy a callee-saved argument (e.g. into r4) before touching r0, entry parameters are
 // ordered by ABI register (r0, r1, …), not by the order they were first read.
+import { ownArgumentWordsOn } from '../aggregate';
 import { Block, Fn, Successor, Value, mergeClasses, mkOp, mkValue } from '../ir/core';
 import type { Opcode } from '../ir/opcodes';
-import { T, typeToString } from '../ir/types';
-import { type Prototypes, wordsOf } from '../proto';
+import { T } from '../ir/types';
+import { type FnProto, type Prototypes, ownLeadingWordRegisters, wordsOf } from '../proto';
+import type { ContextGlobals } from '../proto-context';
 import { type SymbolMap, lookupInterior, lookupSymbol } from '../symbols';
-import type { TargetDescription } from '../target';
+import { ARM_REGISTER_ALIASES, type TargetDescription } from '../target';
 import type { AsmData } from './asmdata';
-import { type CallDeclarations, type CallLowering, callDeclarations } from './call-plan';
+import { type CallDeclarations, type CallLowering, callDeclarations, foldByValueArgs } from './call-plan';
+import { pinDeadReads, unreadPairHalf } from './dead-reads';
 import { pinDeviceAccesses } from './device-pins';
 import { pushSwitchBr } from './emit';
 import { FrontendUnsupportedError } from './errors';
 import { inheritFlags } from './flags-edge';
 import { assertInputFormat } from './format';
-import { FRAME_OBJECT_AUDIT, type FrameObjectAudit, type FrameObjectRelift, type FrameRange } from './frame-objects';
-import type { Frontend } from './frontend';
-import { type LocalStatics, gasPoolReferrers, makeLocalStatics, readGasLocalObject } from './local-object';
+import {
+  FRAME_OBJECT_AUDIT,
+  type FrameObjectAudit,
+  type FrameObjectRelift,
+  type FrameRange,
+  liftWithRelift,
+  nameMergedSretObjects,
+  refuseSretOutsideFrame,
+} from './frame-objects';
+import { type Frontend, type LiftOptions, type OwnDeclaration, ownDeclarationOf } from './frontend';
+import {
+  type CaseEntry,
+  type IdiomLeft,
+  type StaleIdiomRead,
+  caseEntries,
+  enterCaseTarget,
+  idiomLeaves,
+  parkedIn,
+  refuseStaleIdiomReads,
+  staleMarker,
+} from './jump-table';
+import {
+  type LocalStatics,
+  gasPoolReferrers,
+  makeLocalStatics,
+  readGasAnonymousObject,
+  readGasLocalObject,
+} from './local-object';
 import { opaqueDest } from './opaque';
 import { classifyRelocSymbol, unspellableReason } from './reloc-symbol';
 import {
-  type ArgSlots,
   type SsaBuilder,
   abiSortEntryParams,
+  assertScratchRegsPartitioned,
   makeSsaBuilder,
   mintArgSlotHoles,
+  registerArgSlots,
+  registerLiveIns,
+  stackArgKey,
+  stackArgSlots,
   stackSlotKey,
+  unifyRegisterSpellings,
 } from './ssa';
-import { type OutgoingArgs, type StackArgsEvent, analyzeOutgoingArgs } from './stackargs';
+import {
+  type OutgoingArgs,
+  type StackArgsBlock,
+  type StackArgsEvent,
+  analyzeOutgoingArgs,
+  loadedWordBound,
+} from './stackargs';
 
 interface Instr {
   /** the CANONICAL spelling — legacy names are normalised (see LEGACY_MNEMONICS) so that every
@@ -55,7 +94,16 @@ interface Instr {
    *  Messages must use this: a decline naming `ldrsh` for a file containing `ldsh` sends the
    *  reader looking for an instruction that is not there. */
   asWritten?: string;
+  /** set only on a `bl <label>` whose line carried the target's far-jump mark — agbcc's
+   *  `@far jump` / `@ far jump`, the relay it spells a branch past Thumb's ±2 KB reach with (see
+   *  `compilerBehaviors.farJumpRelay`); never on a target that declares no mark. The
+   *  comment is the ONLY text that separates it from a call: everything else on the line is
+   *  dropped at tokenizing, and a call thunk is the same `bl` to a label of this function. */
+  farJump?: true;
 }
+/** The label a block the .s does not label is given — one no .s spells (`thumbCallLocator`). */
+const ANON_BLOCK_PREFIX = '.L_anon';
+
 interface AsmBlock {
   label: string;
   instrs: Instr[];
@@ -224,15 +272,21 @@ const controlContinuesPast = (ins: Instr) => {
  *  `mov pc, rN`.) */
 function classifyXfer(ins: Instr): XferKind | null {
   const mn = ins.mnemonic;
-  if (mn === 'b') {
+  // agbcc's far-jump relay is a branch wearing the call mnemonic. Classified here so the layout
+  // questions asked BEFORE it is lowered to `b` (`readThumbText`: `lowerFarJumpRelays`) — whether
+  // a fill after it is sealed, whether the block before a pool falls into data — read it as the
+  // transfer it is; it keeps its 4 bytes there because the mnemonic is still `bl`.
+  if (mn === 'b' || (mn === 'bl' && ins.farJump)) {
     return 'uncond';
   }
   if (COND_OPCODE[mn]) {
     return 'cond';
   }
-  // `bx rN`: agbcc's return is `bx lr` or `pop {rN}; bx rN` (rN holds the restored LR) — a return.
-  // (agbcc emits jump tables via `mov pc`, NOT `bx`; a computed tail-call `bx rN` is out of scope and
-  // would need call modelling — accepted limitation, not a jump-table dispatch form.)
+  // `bx rN`: agbcc's return is `bx lr` or `pop {…, rN}; bx rN` (rN holds the restored LR) — a return.
+  // This sees one instruction, so it cannot tell what rN holds; once the CFG exists, every return
+  // of the selected function is asked whether it reads the caller's lr from the frame word the
+  // prologue saved it in (`refuseReturnsNotThroughCallersLr`), and any other declines as the
+  // indirect jump it is. (agbcc emits jump tables via `mov pc`, NOT `bx`.)
   if (mn === 'bx') {
     return 'return';
   }
@@ -332,8 +386,9 @@ const REG_NUM: Record<string, number> = Object.assign(Object.create(null), { sp:
 
 // Registers Thumb-1's `push` cannot name, in every spelling this ISA's asm uses for them. Saving
 // one takes agbcc's `mov rLow, rHi; push {rLow}`, which is why the prologue's save set has to read
-// the `mov` as well as the list (see `savedRegs`). Spellings, not numbers: nothing here normalises
-// a register name, so `sl` and `r10` are separate keys everywhere the frontend uses one.
+// the `mov` as well as the list (see `savedRegs`). Spellings, not numbers: a register keeps the
+// name it was written with, and only a function that writes one two ways is rewritten to one of them
+// (`unifyRegisterSpellings` in `readThumbText`), so `sl` and `r10` are never both keys of one lift.
 const HIGH_REGS: ReadonlySet<string> = new Set(['r8', 'r9', 'r10', 'r11', 'r12', 'sb', 'sl', 'fp', 'ip']);
 
 /** The operands of a `cmp` whose flags are still live — the whole of the condition state this
@@ -352,16 +407,25 @@ const HIGH_REGS: ReadonlySet<string> = new Set(['r8', 'r9', 'r10', 'r11', 'r12',
  *      the edges of a conditional branch (mwcc's switch dispatch reads one `cmpwi` from a `beq`
  *      and then from the `bge` on its fall-through), and Thumb, with no row inhabiting that shape,
  *      does not. */
-type PendingCmp = { lhs: Value; rhs: Value };
+type PendingCmp = {
+  lhs: Value;
+  rhs: Value;
+  /** The flags came from `cmn lhs, rhs`, which stands for `cmp lhs, -rhs`. Nothing is minted for
+   *  the negation until a branch reads it: the tag travels with the compare, across an edge too
+   *  (`inheritFlags` carries the record whole), and the terminator mints the `neg` in the READING
+   *  block with the attrs that branch needs, or refuses. See `CMN_EXACT`. */
+  cmn?: true;
+};
 
 // Thumb-1 data-processing mnemonics that write the condition flags when their destination is a LOW
 // register — which is all of them on this ISA, `s`-suffix or not (the assembler picks the encoding).
 // Used to invalidate a pending compare: see the decode loop. Loads, stores and push/pop leave the
-// flags alone. Three mnemonics that DO write them are absent, each for its own reason, and lumping
+// flags alone. Three kinds of writer that DO write them are absent, each for its own reason, and lumping
 // them under one was how `cmn`/`tst` came to be described as instructions that set no flags:
-//   * `cmp` seeds the pending compare instead of invalidating it — it is the modelled one;
-//   * `cmn`/`tst` write the flags and define no register, so the membership test below (which
-//     reads a destination) cannot judge them — `FLAG_ONLY` does;
+//   * `cmp` and `cmn` seed the pending compare instead of invalidating it — they are the modelled
+//     ones (`cmn` as `cmp rA, -rB`, `lowerCmn`);
+//   * `tst` writes the flags and defines no register, so the membership test below (which reads a
+//     destination) cannot judge it — `FLAG_ONLY` does;
 //   * a CALL is not an instruction's flag write at all: `bl` writes none itself, but the function
 //     it enters retires compares of its own, and AAPCS lets it. Invalidated separately.
 const FLAG_SETTING = new Set([
@@ -401,20 +465,45 @@ const FLAG_SETTING = new Set([
   'sbcs',
 ]);
 
-// The flag writers with no destination to read. `tst`/`cmn` compute a value they throw away and
-// keep only the flags, so `FLAG_SETTING`'s destination test cannot see them — yet they take the
-// flags from a pending compare exactly as `sub` does, and the branch that follows tests THEIRS.
+// The flag writer with no destination to read. `tst` computes a value it throws away and keeps
+// only the flags, so `FLAG_SETTING`'s destination test cannot see it — yet it takes the flags from
+// a pending compare exactly as `sub` does, and the branch that follows tests ITS.
 //
-// Unconditional, unlike `FLAG_SETTING`: neither has a destination whose width could pick a
-// non-flag-setting encoding, and Thumb-1 encodes both on low registers only.
+// Unconditional, unlike `FLAG_SETTING`: it has no destination whose width could pick a
+// non-flag-setting encoding, and Thumb-1 encodes it on low registers only.
 //
-// They still decode to an `opaque` (the default arm), so a function containing one declines either
+// It still decodes to an `opaque` (the default arm), so a function containing one declines either
 // way and this changes no verdict — only which decline, and the terminator's is the true one.
 // Without it `cmp r0,r1 / tst r2,r3 / bge` FOLDED the stale compare into the condition and was
 // loud solely because the opaque it minted is unresolvable: the right answer resting on an
-// accident of an unrelated model. Making `tst` transparent instead — it defines nothing, so a
-// `tst` no branch reads is dead — is a capability with no row in this corpus to earn it.
-const FLAG_ONLY = new Set(['tst', 'cmn']);
+// accident of an unrelated model. Modelling `tst` is a capability with no inhabitant: agbcc's
+// `tstsi` prints `cmp %0, #0` (gcc/thumb.md:818-821), so every `tst` in the corpus is hand-written.
+//
+// `cmn` is not here: it is a compare (the decode loop's `cmn` arm). agbcc's `cmnsi`
+// (thumb.md:823-827) is `(compare rA (neg rB))`, which combine makes of `a == -b` and `a <= -b`.
+const FLAG_ONLY = new Set(['tst']);
+
+// The branches that read a `cmn`'s flags as the compare it stands for, and why the others cannot.
+// `cmn rA, rB` sets NZCV from rA + rB, and `cmp rA, -rB` from rA - (-rB):
+//   * N and Z come from the same 32-bit result, so `beq`/`bne` read the WRAPPED a + b == 0, which
+//     the plain wrapping negation spells: exactly for an unsigned or narrower `b`, and for an `s32`
+//     one everywhere but b == INT_MIN, where C's `-b` overflows — the spelling every wrapping `neg`
+//     in this frontend already has;
+//   * V differs only at rB == INT_MIN, where cmn reports the true sign of rA + 2^31 and the
+//     compare's `-rB` wraps back to INT_MIN. The lift spells the negation SIGNED (`neg_s`), so its
+//     C differs from the bytes at that one input only, where its `-b` is undefined. agbcc folds the
+//     defined `a > (int)(0u - b)` into `cmn; bgt` too, and miscompiles it there, so the claim is
+//     narrower than "exact for every source": a C spelling that recompiles to the same bytes AND
+//     diverges from them only where it is itself undefined. When rB always holds INT_MIN that one
+//     input is every input, and the structurer refuses (structure.ts, `neg_s`);
+//   * C is the carry out of rA + rB, which is NOT rA >=u -rB: at rB == 0 cmn's carry is clear and
+//     the compare's is set. agbcc folds unsigned `a < -b` into `cmn; bcs` regardless — it
+//     miscompiles at b == 0 — and the C that is exact there (`a + b >= a`) compiles to
+//     `add; cmp; bcc` instead. Unsigned C defines every input, so no spelling both matches the
+//     bytes and leaves the divergence undefined, and the unsigned branches refuse. The sentence
+//     stays literal at its throw in `lowerTerminator`: the decline taxonomy (`cmn-carry`) is
+//     checked against throw texts as written.
+const CMN_EXACT = new Set(['beq', 'bne', 'blt', 'ble', 'bgt', 'bge']);
 const regNum = (r: string) => (r[0] === 'r' ? Number(r.slice(1)) : REG_NUM[r]);
 function expandRegList(tokens: string[]): string[] {
   const out: string[] = [];
@@ -629,25 +718,15 @@ const isFrameAdjust = (
   (base === undefined || isSpReg(base)) &&
   (off?.startsWith('#') ?? false);
 
-// A virtual register key per incoming stack argument. Reading it goes through the ordinary Braun
-// live-in path (frontend/ssa.ts), which turns a read with no reaching def into a function
-// parameter — so this needs NO new representation, opcode or pass. The `@` cannot appear in a
-// real register token, so the key cannot collide with one.
-const stackArgKey = (index: number) => `@sarg${index}`;
-// Defined beside its mint site on purpose: the format string and its parser drifted 650 lines
-// apart in the first version, with the convention explained only at one end.
-const stackArgIndex = (key: string): number | null => {
-  const m = /^@sarg(\d+)$/.exec(key);
-  return m ? +m[1] : null;
-};
-
 // INCOMING STACK ARGUMENTS (AAPCS). Args 1-4 arrive in r0-r3; args 5+ are pushed by the CALLER,
 // so the callee reads them at `[sp, #N]` where N is at or above its own frame. Those are
 // PARAMETERS, not locals — declining them as "sp used as data" refuses a calling convention.
 //
-// The frame depth is tracked by a linear walk of the ENTRY BLOCK only, which is
-// why the gate is what it is: within one straight-line block the depth at each instruction is
-// exact and needs no CFG reasoning. Every case that would need more declines.
+// The frame depth is tracked by a linear walk of ONE BLOCK, from a depth that is exact where the
+// block starts: 0 at the entry block (when nothing branches back to it), and for every other block
+// the depth the entry block leaves, but only where the function is proven never to move sp outside
+// its prologue and its returning tails (`frameDepthBlocker`). Within a straight-line block the depth
+// at each instruction is then exact. Every case that would need more declines.
 //
 // `push {a,b,c}` deepens by 4 per register; `sub sp, #N` and `add sp, sp, #-N` deepen by N.
 //
@@ -660,12 +739,12 @@ const stackArgIndex = (key: string): number | null => {
 // preserve is written next to the state it is about.
 //
 // `deps` carries the only two things about the FUNCTION this needs — the ABI's argument-register
-// count, and whether the entry block has predecessors — so the walk itself reads nothing but the
-// instructions it is stepped over.
-const makeFrameWalk = (deps: { argRegs: readonly string[]; entryHasPreds: boolean }) => {
+// count, and the depth this block starts at (null where none is proven) — so the walk itself reads
+// nothing but the instructions it is stepped over.
+const makeFrameWalk = (deps: { argRegs: readonly string[]; start: number | null }) => {
   // Bytes the frame has grown since function entry, along this block's linear order only.
-  let depth = 0;
-  let depthKnown = true;
+  let depth = deps.start ?? 0;
+  let depthKnown = deps.start !== null;
 
   // Returns null whenever the depth cannot be computed exactly — including for any write to sp
   // this does not model. The capability rests on the depth being EXACT, so an approximation is
@@ -730,6 +809,11 @@ const makeFrameWalk = (deps: { argRegs: readonly string[]; entryHasPreds: boolea
       }
     },
 
+    /** The depth the instructions stepped so far leave, or null where it is not exact. */
+    depthNow(): number | null {
+      return depthKnown ? depth : null;
+    },
+
     // Is `[sp, #off]` an incoming stack argument, and which one? `null` means NO — and every null is
     // a DECLINE, because the caller falls through to readData's sp guard.
     //
@@ -753,19 +837,16 @@ const makeFrameWalk = (deps: { argRegs: readonly string[]; entryHasPreds: boolea
     // reads. `step` enforces it, and never un-poisons: once sp has been above the line, a push during
     // the excursion may have written the later slots too. This is a PREMISE, not a detail — leaving
     // it unstated is what let the first version hand back a callee-saved register as an argument.
-    argIndex(addr: { base: string; off: number; regOff?: string }, width: number, bi: number): number | null {
+    argIndex(addr: { base: string; off: number; regOff?: string }, width: number): number | null {
       const { base, off, regOff } = addr;
       if (!isSpReg(base) || regOff !== undefined) {
         return null; // not sp, or `[sp, rX]` — not a fixed argument slot
       }
-      if (bi !== 0 || deps.entryHasPreds) {
-        return null; // depth is exact only along the ENTRY block's linear order, and only when its
-        // params are parameters rather than phis
-      }
       if (!depthKnown || depth <= 0) {
-        return null; // an unmeasurable frame, or none established: a headerless FRAGMENT whose
-        // prologue was sliced off looks identical to a frameless function, and there the slots are
-        // locals — minting one would be the silent-wrong trade this frontend refuses
+        return null; // no exact start (`start`), an unmeasurable frame, or none established: a
+        // headerless FRAGMENT whose prologue was sliced off looks identical to a frameless
+        // function, and there the slots are locals — minting one would be the silent-wrong trade
+        // this frontend refuses
       }
       if (width !== 4 || off < depth || (off - depth) % 4 !== 0) {
         return null; // the argument area is word-granular; BELOW the top is a local, which is the
@@ -966,11 +1047,14 @@ const sayFact = (f: LayoutFact): string => {
 function decode(
   name: string,
   asm: string,
+  farJumpMark?: RegExp,
 ): {
   blocks: AsmBlock[];
   dataWords: Map<string, string[]>;
   nonWordData: Map<string, string>;
   funcLabels: Set<string>;
+  /** Each label that shares its instruction with a later one, to the label whose block was kept. */
+  aliasOf: ReadonlyMap<string, string>;
 } {
   // Flatten to (label | instr | data) items, then split into blocks at labels / after branches.
   // `.word LABEL` directives are captured into dataWords keyed by the most recent label (the
@@ -1022,10 +1106,19 @@ function decode(
   //     `.Letext0`) that no code line names. A label starts a block, and a block split at a
   //     lexical-scope marker restructures the loop around it: kept, it lifts the pair's `gcd` loop as
   //     an `if` around a `do` instead of a `while`.
+  //
+  // Every `@` comment is dropped here save ONE fact read from it: that a `bl` line carried the
+  // target's far-jump mark (`farJumpMark`, from `compilerBehaviors.farJumpRelay`). Kept as a set of
+  // line positions, not as text, so nothing downstream can read any other comment.
   const codeLines: string[] = [];
+  const farJumpLines = new Set<number>();
   for (const rawLine of withoutDebugSections(asm).split('\n')) {
-    const line = rawLine.split('@')[0].trim();
+    const at = rawLine.indexOf('@');
+    const line = (at === -1 ? rawLine : rawLine.slice(0, at)).trim();
     if (line) {
+      if (at !== -1 && farJumpMark?.test(rawLine.slice(at))) {
+        farJumpLines.add(codeLines.length);
+      }
       codeLines.push(line);
     }
   }
@@ -1037,7 +1130,8 @@ function decode(
     }
   }
   const isDebugMarker = (label: string) => /^\.L(?:FB|FE|M|BB|BE|etext)\d+$/.test(label) && !namedByCode.has(label);
-  for (let rest of codeLines) {
+  for (const [lineNo, line] of codeLines.entries()) {
+    let rest = line;
     // A label may share the line with what follows it (pret pools: `_08x: .4byte 0x…`) — peel it.
     const lm = rest.match(/^([A-Za-z_.$][\w.$]*):\s*(.*)$/);
     if (lm && isDebugMarker(lm[1]) && lm[2] === '') {
@@ -1234,6 +1328,7 @@ function decode(
         mnemonic: canon,
         ops,
         ...(canon === m[1] ? {} : { asWritten: m[1] }),
+        ...(canon === 'bl' && ops.length === 1 && farJumpLines.has(lineNo) ? { farJump: true as const } : {}),
       },
     });
   }
@@ -1738,7 +1833,7 @@ function decode(
         continue;
       }
       if (!cur) {
-        cur = { label: first ? name : `.L_anon${anon++}`, instrs: [] };
+        cur = { label: first ? name : `${ANON_BLOCK_PREFIX}${anon++}`, instrs: [] };
         blocks.push(cur);
         first = false;
       }
@@ -1787,7 +1882,9 @@ function decode(
     for (const b of aliasOf.size ? blocks : []) {
       for (const ins of b.instrs) {
         const k = ins.ops.length - 1;
-        if ((ins.mnemonic === 'b' || COND_OPCODE[ins.mnemonic]) && k >= 0) {
+        // A marked relay is a branch here too (classifyXfer), though still spelt `bl` until
+        // `lowerFarJumpRelays`: a relay to a dropped alias must name the label it stands for.
+        if ((ins.mnemonic === 'b' || COND_OPCODE[ins.mnemonic] || ins.farJump) && k >= 0) {
           ins.ops[k] = aliasOf.get(ins.ops[k]) ?? ins.ops[k];
         }
       }
@@ -1870,7 +1967,7 @@ function decode(
       boundaryIdx++;
       continue;
     }
-    return { blocks: live, dataWords, nonWordData, funcLabels: new Set(funcLabels) };
+    return { blocks: live, dataWords, nonWordData, funcLabels: new Set(funcLabels), aliasOf };
   }
 }
 
@@ -1994,6 +2091,7 @@ type PoolRef =
   | { kind: 'const'; value: number }
   | { kind: 'gaddr'; sym: string; addend: number }
   | { kind: 'local-static'; symbol: string; addend: number }
+  | { kind: 'anonymous'; label: string }
   | { kind: 'unmodelled'; why: string };
 
 /** Classify a word-load operand `LABEL[+N]` against the captured literal pools. Returns null when
@@ -2126,6 +2224,13 @@ function poolRef(
       why: `pool word '${w}' has a leading-zero magnitude, which is octal to the assembler`,
     };
   }
+  // A bare `.L` label in a pool word is the address of something the compiler placed and the
+  // source never named (reloc-symbol.ts `anon-pool`): agbcc's `.LC0` is the constant image a local
+  // aggregate's initializer is copied from. The caller reads it as an anonymous object, or refuses
+  // naming why it is not one.
+  if (classifyRelocSymbol(w) === 'anon-pool') {
+    return { kind: 'anonymous', label: w };
+  }
   return { kind: 'unmodelled', why: `pool word '${w}' is not a symbol, symbol±offset, or number` };
 }
 
@@ -2181,7 +2286,8 @@ function poolNamesASymbol(
 // and its unique bounds predecessor `bounds` ending in `cmp rX,#(N-1); bhi DEF`, verify the exact
 // idiom and read the inline table — else return null (→ the indirect-jump loud-fail fires). The
 // recovered switch REPLACES both blocks: `bounds` emits a `switch_br` (scrutinee rX; successors =
-// case blocks + DEF).
+// case blocks + DEF) — unless the dispatch carries code of its own (`extras`), which keeps it as
+// the block that emits the switch, with the bounds test left as an ordinary branch.
 //
 //   bounds:  cmp rX,#(N-1); bhi DEF          disp: lsl rY,rX,#2 ; ldr rP,=PTR ; add rA,rY,rP
 //                                                  ; ldr rV,[rA] ; mov pc,rV
@@ -2193,6 +2299,13 @@ interface JumpTable {
   scrutReg: string;
   caseLabels: string[];
   defaultLabel: string;
+  /** What runs between the table load and the `mov pc` ({@link dispatchExtraRefusal}). */
+  extras: Instr[];
+  /** What the dispatch idiom leaves in each register it writes (index, table pointer, target;
+   *  jump-table.ts `idiomLeaves`). The `add` rewrites the index the `lsl` scaled, so every one is a
+   *  marker here: an elided dispatch writes them at the entry of each case target (`caseEntries`), a
+   *  kept one at its own block's end, save the ones its extras rewrote. */
+  leaves: ReadonlyMap<string, IdiomLeft>;
 }
 
 // Accept a data-processing mnemonic in either the pre-UAL (`lsl`, `add`) or UAL (`lsls`, `adds`)
@@ -2235,9 +2348,10 @@ interface JumpTable {
 // Inside the dispatch block the distinction is additionally UNOBSERVABLE: the block computes
 // `table_base + index*4`, loads the target and writes `pc`. Nothing between the `lsl` and the
 // `mov pc` reads NZCV, no path leaves the block by falling through, and on a successful recovery the
-// block is ELIDED from the CFG entirely — the bounds test that does feed a conditional branch lives
-// in `bounds`, whose `cmp`/`bhi`/`bls` this function matches by exact name. Doubly moot in fact,
-// since `lsl rD, rS, #imm` is low-register-only, so the add here is always the low-register form.
+// idiom is never lifted (the block is elided, or keeps only the code `dispatchExtraRefusal` admits)
+// — the bounds test that does feed a conditional branch lives in `bounds`, whose `cmp`/`bhi`/`bls`
+// this function matches by exact name. Doubly moot in fact, since `lsl rD, rS, #imm` is
+// low-register-only, so the add here is always the low-register form.
 const isDataOp = (mn: string, base: 'lsl' | 'add'): boolean => mn === base || mn === `${base}s`;
 
 function recoverJumpTable(
@@ -2246,6 +2360,8 @@ function recoverJumpTable(
   dataWords: Map<string, string[]>,
   nonWordData: Map<string, string>,
   blockLabels: Set<string>,
+  aliasOf: ReadonlyMap<string, string>,
+  refused: (why: string) => void,
   longDefault?: string,
 ): JumpTable | null {
   // bounds: last two instrs are `cmp rX,#M` then the out-of-range guard, in one of two spellings.
@@ -2290,12 +2406,15 @@ function recoverJumpTable(
     return null; // a bound that admits no case at all is not a dispatch — fail closed
   }
 
-  // disp: exactly the 5-op idiom, threading a single index register from `lsl rY,rX,#2`.
+  // disp: the 5-op idiom, threading a single index register from `lsl rY,rX,#2`, with any
+  // instructions between the table load and the `mov pc` (`extras`, judged below).
   const d = disp.instrs;
-  if (d.length !== 5) {
+  if (d.length < 5) {
     return null;
   }
-  const [lsl, ldrP, add, ldrV, movpc] = d;
+  const [lsl, ldrP, add, ldrV] = d;
+  const movpc = d[d.length - 1];
+  const extras = d.slice(4, -1);
   if (!isDataOp(lsl.mnemonic, 'lsl') || lsl.ops[1] !== scrutReg || !immEq(lsl.ops[2], 2)) {
     return null;
   }
@@ -2344,12 +2463,13 @@ function recoverJumpTable(
   if (movpc.mnemonic !== 'mov' || movpc.ops[0] !== 'pc') {
     return null;
   }
+  const extraRefusal = dispatchExtraRefusal(extras, ldrV.ops[0], [idxReg, ptrReg, ldrV.ops[0]]);
+  if (extraRefusal !== null) {
+    refused(extraRefusal);
+    return null;
+  }
 
   // Read the table: the ldr loads a POINTER word (PTR: .word TABLE); the table is TABLE: .word C0…
-  // Note the case labels are matched against `blockLabels` as WRITTEN: the adjacent-label aliasing in
-  // `decode` rewrites branch operands, not `.word` entries, so a table naming an aliased label would
-  // decline here rather than dispatch anywhere. Loud, and no corpus instance — left as a known edge
-  // rather than fixed speculatively.
   //
   // The pointer word is addressed the same way every other pool load in this frontend is —
   // `LABEL[+N]`, selecting word N/4 — because a literal pool is a POOL: agbcc packs the dispatch
@@ -2373,16 +2493,71 @@ function recoverJumpTable(
   if (ptrOff % 4 !== 0 || ptrOff / 4 >= ptrWords.length) {
     return null; // misaligned or past the end of the pool — not a word this pool holds
   }
-  const caseLabels = recordedWords(ptrWords[ptrOff / 4].trim(), dataWords, nonWordData);
-  if (!caseLabels || caseLabels.length !== n) {
+  const written = recordedWords(ptrWords[ptrOff / 4].trim(), dataWords, nonWordData);
+  if (!written || written.length !== n) {
     return null;
   } // table length must equal the bound
+  // An entry naming a label that shares its instruction with a later one dispatches to that one, as
+  // a branch to it does (`decode`'s `aliasOf`): jump.c cross-jumps a case arm identical to the
+  // default's onto the default's first instruction and leaves the case's label standing on it. Only
+  // the TABLE's entries are read through it — a pool word naming a code label elsewhere is an
+  // address constant, not a transfer — and `aliasOf` already holds no data label on either side, so
+  // an entry naming a label that fronts data, or one left trailing, still declines below.
+  const caseLabels = written.map((l) => aliasOf.get(l) ?? l);
   // Every case target and the default must resolve to a real decoded block; a label that is an
   // expression (`.L4+4`) or points outside the function would otherwise crash later — decline cleanly.
   if (!blockLabels.has(defaultLabel) || caseLabels.some((l) => !blockLabels.has(l))) {
     return null;
   }
-  return { scrutReg, caseLabels, defaultLabel };
+  const leaves = idiomLeaves([idxReg, ptrReg, ldrV.ops[0]].map((reg) => ({ reg, scaled: false })));
+  return { scrutReg, caseLabels, defaultLabel, extras, leaves };
+}
+
+// The instructions an agbcc dispatch may carry between the table load and the `mov pc`. gcse's
+// PRE (`insert_insn_end_bb`, gcse.c:4231-4236) places an expression a later block needs "just before
+// the tablejump" — thumb.md's `tablejump` is the `mov pc` alone, so after the load. They run on every
+// dispatch and on nothing else, so they stay in a block of their own between the bounds test and the
+// switch (`readThumbText`), which switches on the scrutinee as the dispatch's first instruction read
+// it (`lowerTerminator`). PRE inserts `reg = expr` and nothing more, so the instructions accepted are
+// the ones `mayWriteReg` knows write their first operand — the data-processing ops and the single
+// loads — less the two that read the carry; anything else refuses:
+//   - a store, a call, a transfer, a flag READ (`adc`/`sbc`), or any other mnemonic;
+//   - a write to the loaded target (it is what `mov pc` jumps through), or to sp/pc/lr. A write to
+//     the scrutinee is admitted: the switch does not read it after the extras, and the case blocks
+//     read what the extras left there on the hardware too. lr is refused because the lifter reads
+//     `bx lr` as a return by the register's name (`refuseReturnsNotThroughCallersLr`'s NOT ASKED):
+//     a case's `bx lr` after `mov lr, r3` would lift as `return`, where the hardware jumps to r3.
+//     PRE never inserts an lr write, so the refusal costs no compiled dispatch;
+//   - a read of a register the idiom wrote (index, table pointer, target) before an extra rewrote it:
+//     the idiom is not lifted, so such a read would see the value from before the dispatch.
+// The reason is returned so the decline can name it (`readThumbText`'s indirect-jump refusal).
+const READS_CARRY = /^(?:adc|sbc)s?$/;
+/** Besides a load (`SINGLE_LOAD`), the forms that write their destination without reading it. */
+const DEST_ONLY = /^(?:mov|mvn|neg)s?$/;
+function dispatchExtraRefusal(
+  extras: readonly Instr[],
+  targetReg: string,
+  idiomRegs: readonly string[],
+): string | null {
+  const stale = new Set(idiomRegs);
+  for (const ins of extras) {
+    const mn = ins.mnemonic;
+    const say = `'${mn} ${ins.ops.join(', ')}'`;
+    if (!(SINGLE_LOAD.test(mn) || WRITES_OPERAND_0.test(mn)) || READS_CARRY.test(mn) || ins.ops.length < 2) {
+      return `${say} is not a register computation or a load`;
+    }
+    const dest = ins.ops[0];
+    if ([targetReg, 'sp', 'r13', 'pc', 'r15', 'lr', 'r14'].includes(dest)) {
+      return `${say} writes the register the dispatch needs, '${dest}'`;
+    }
+    const reads = ins.ops.length > 2 || SINGLE_LOAD.test(mn) || DEST_ONLY.test(mn) ? ins.ops.slice(1) : ins.ops;
+    const read = [...stale].find((r) => mentionsReg({ ops: reads }, r));
+    if (read !== undefined) {
+      return `${say} reads '${read}', which the unlifted dispatch idiom wrote`;
+    }
+    stale.delete(dest);
+  }
+  return null;
 }
 
 /** Lift decoded asm → an L1 Fn with block-argument SSA. `prototypes` supplies each callee's
@@ -2402,16 +2577,12 @@ export function lift(
   prototypes: Prototypes = {},
   asmData?: AsmData,
   symbols?: SymbolMap,
+  context?: ContextGlobals,
+  options: LiftOptions = {},
 ): Fn {
-  const first = liftOnce(name, asm, target, prototypes, asmData, symbols, undefined);
-  if (!('oneObject' in first)) {
-    return first;
-  }
-  const again = liftOnce(name, asm, target, prototypes, asmData, symbols, first.oneObject);
-  if ('oneObject' in again) {
-    throw new Error(`internal: the frame-object audit of '${name}' asked for a second relift`);
-  }
-  return again;
+  return liftWithRelift(name, (oneObject) =>
+    liftOnce(name, asm, target, prototypes, asmData, symbols, context, oneObject, options),
+  );
 }
 
 /** ONE LIFT, AS STAGES RUN IN THEIR REFUSAL ORDER: every stage before the fill (`thumbFillOf`: the
@@ -2430,9 +2601,11 @@ function liftOnce(
   prototypes: Prototypes,
   _asmData: AsmData | undefined,
   symbols: SymbolMap | undefined,
+  context: ContextGlobals | undefined,
   oneObject: FrameRange | undefined,
+  options: Pick<LiftOptions, 'contextOwnWords' | 'contextOwnProto' | 'ownMemoryReturn'>,
 ): Fn | FrameObjectRelift {
-  const fill = thumbFillOf(name, asm, target, prototypes, symbols, oneObject);
+  const fill = thumbFillOf(name, asm, target, prototypes, symbols, oneObject, options);
   const { cfg, frame, ssa, pairs, statics } = fill;
   const { fn, irBlocks, paramReg } = ssa;
 
@@ -2441,26 +2614,47 @@ function liftOnce(
     fillThumbBlock(fill, ab, bi);
     ssa.markFilled(bi);
   });
+  refuseStaleIdiomReads(
+    name,
+    irBlocks,
+    fill.staleIdiomValues,
+    ssa,
+    prototypes[name] ?? options.contextOwnProto?.proto,
+    (m) => {
+      throw new FrontendUnsupportedError(m);
+    },
+    fill.calls,
+  );
+  // After the fill, so a block's own refusal (the frame's, the operands') keeps its place in the
+  // refusal order: the proof reads only the text and the CFG, and changes nothing.
+  refuseReturnsNotThroughCallersLr(name, cfg);
+  // The fill reads a `pop` as transparent, so a callee-saved register one fills with another
+  // register's word is a write no op shows: refused here, after the return proof, which judges the
+  // same words for lr and has its own answer for a pop that takes lr's.
+  const [foreign] = fill.poppedForeign;
+  if (foreign !== undefined) {
+    const [reg, at] = foreign;
+    throw new FrontendUnsupportedError(
+      `cannot lift '${name}': '${at.mnemonic} ${at.ops.join(', ')}' loads a word that is not ${reg}'s own save ` +
+        `into callee-saved ${reg}, and ${reg} reaches a return so, unrestored — the caller sees the write, which ` +
+        'no C statement spells',
+    );
+  }
 
   pairs.refuseWordReturns();
   // An argument register by its place in `argRegs`, an incoming stack word by its index after them.
   // One word per argument, which is what this frontend assumes everywhere: an 8-byte argument,
   // which AAPCS may align into r1 or straddle across r3 and the stack, would break the index-slot
   // correspondence, and recovering one is its own capability.
-  const slotOf = (key: string): number | null => {
-    const i = target.argRegs.indexOf(key);
-    return i >= 0 ? i : stackArgIndex(key);
-  };
-  const argSlots: ArgSlots = {
-    slotOf,
-    holes: (readKeys) =>
-      Array.from({ length: Math.max(0, ...readKeys.map((k) => slotOf(k) ?? -1)) }, (_, k) =>
-        k < target.argRegs.length ? target.argRegs[k] : stackArgKey(k),
-      ),
-  };
+  const argSlots = stackArgSlots(registerArgSlots(target.argRegs), target.argRegs);
   mintArgSlotHoles(ssa, cfg.preds[0].length > 0, argSlots);
   ssa.finish();
 
+  // A struct passed by value becomes the one object its words hold (call-plan.ts `foldByValueArgs`)
+  // before the audit judges the frame objects, that one among them.
+  foldByValueArgs(name, irBlocks, fill.calls, { symbols, context });
+  nameMergedSretObjects(irBlocks);
+
   // Prove every `laddr` this function emitted really does name storage of this function's own, at
   // a shape the machine states, or decline (auditFrameObjects); an accepted function then gets the
   // device pin the audit answers (pinDeviceAccesses).
@@ -2469,7 +2663,9 @@ function liftOnce(
     irBlocks,
     ...frame.partition,
     usedSlotOffsets: fill.frameUses.usedSlotOffsets,
+    loadedWords: frame.loadedWords,
     capturedObjectIsTheWholeFrame: frame.capturedObjectIsTheWholeFrame,
+    escapesReliedOn: frame.escapesReliedOn,
     movedCaptures: fill.frameUses.movedCaptures,
     returnsWithoutHiddenPointer: fill.calls.returnsWithoutHiddenPointer,
     symbols,
@@ -2482,21 +2678,31 @@ function liftOnce(
   if (verdict !== undefined) {
     pinDeviceAccesses(irBlocks, verdict, target, symbols);
   }
-  refuseSretOutsideFrame(name, irBlocks);
+  refuseSretOutsideFrame(name, irBlocks, target);
+  pinDeadReads(irBlocks, target, {
+    name,
+    own: prototypes[name],
+    atWordReturn: pairs.unreadHigh,
+    atUndeclaredCall: fill.calls.heldAtUndeclaredCall,
+    compared: fill.flags.compared,
+    spilled: ssa.frameWrites,
+    declarations: { symbols, context },
+  });
 
   abiSortEntryParams(irBlocks[0], cfg.preds[0].length > 0, paramReg, argSlots);
   fn.localObjects = statics.finish();
   return fn;
 }
 
-/** THE TEXT A LIFT READS: the decoded blocks with every recovered jump table's dispatch elided,
- *  and the data its pool loads read. Every control transfer the CFG cannot model is refused by the
- *  time this exists. */
+/** THE TEXT A LIFT READS: the decoded blocks with every recovered jump table's dispatch elided
+ *  (or, where it carries code of its own, cut down to that code), and the data its pool loads
+ *  read. Every control transfer the CFG cannot model is refused by the time this exists. */
 interface ThumbText {
   /** The blocks the CFG is built from — read by `thumbCfg` alone; every later stage indexes
    *  `ThumbCfg.asmBlocks`. */
   readonly blocks: readonly AsmBlock[];
-  /** A recovered jump table, by its bounds block. */
+  /** A recovered jump table, by the block that emits its switch: the bounds block, or a kept
+   *  dispatch block. */
   readonly tables: ReadonlyMap<AsmBlock, JumpTable>;
   readonly dataWords: ReadonlyMap<string, string[]>;
   readonly nonWordData: ReadonlyMap<string, string>;
@@ -2505,14 +2711,308 @@ interface ThumbText {
   readonly poolNamesSymbols: boolean;
 }
 
-function readThumbText(name: string, asm: string): ThumbText {
+// One spelling per register for the return proof below, which tracks registers by identity:
+// `r14` and `lr` are one register, and so are `ip` and `r12`.
+const REG_ALIAS: Readonly<Record<string, string>> = {
+  sp: 'r13',
+  lr: 'r14',
+  pc: 'r15',
+  sb: 'r9',
+  sl: 'r10',
+  fp: 'r11',
+  ip: 'r12',
+};
+const canonReg = (r: string): string | null => {
+  const t = r.replace(/!$/, '');
+  return /^r(\d|1[0-5])$/.test(t) ? t : (REG_ALIAS[t] ?? null);
+};
+const regIndex = (r: string): number => Number(r.slice(1));
+/** A push/pop/ldm list in the order the machine moves it, canonical names (`canonReg`): by register
+ *  number, lowest address first. Null where a name is not a register. */
+const byRegNumber = (list: readonly string[]): string[] | null => {
+  const regs = list.map(canonReg);
+  return regs.some((r) => r === null) ? null : (regs as string[]).sort((x, y) => regIndex(x) - regIndex(y));
+};
+// Registers `ins` may write, besides sp and besides a `pop`'s list (the proof reads both itself).
+// OVER-approximate: naming a register here that the instruction does not write costs a decline,
+// and missing one costs a wrong return. 'all' for a call, and for anything this cannot read.
+const NO_REG_WRITE: ReadonlySet<string> = new Set([
+  'str',
+  'strb',
+  'strh',
+  'push',
+  'cmp',
+  'cmn',
+  'tst',
+  'nop',
+  'b',
+  'bx',
+]);
+function regWritesOf(ins: Instr): readonly string[] | 'all' {
+  const mn = ins.mnemonic;
+  if (NO_REG_WRITE.has(mn) || COND_OPCODE[mn]) {
+    return [];
+  }
+  if (mn === 'bl' || mn === 'blx' || mn === 'swi') {
+    return 'all';
+  }
+  if (/^(ldm|stm)/.test(mn)) {
+    const base = canonReg(ins.ops[0] ?? '');
+    const list = /^ldm/.test(mn) ? regListOf(ins.ops.slice(1)) : [];
+    if (base === null || list === null) {
+      return 'all';
+    }
+    const listed = list.map(canonReg);
+    return listed.some((r) => r === null) ? 'all' : [base, ...(listed as string[])];
+  }
+  const dest = canonReg(ins.ops[0] ?? '');
+  return dest === null ? 'all' : [dest];
+}
+
+/** What the return proof knows at one point of the function: the frame depth `makeFrameWalk`
+ *  measures, which word of the frame holds the caller's lr (`slot`, as the depth at which it sits:
+ *  the word at entry sp − slot), and which registers hold it. */
+interface LrState {
+  readonly depth: number | null;
+  readonly slot: number | null;
+  readonly regs: ReadonlySet<string>;
+}
+
+/** EVERY RETURN OF THIS FUNCTION RETURNS THROUGH THE CALLER'S lr, or the lift declines.
+ *
+ *  `classifyXfer` reads `bx rN`, `pop {…, pc}` and `mov pc, lr` as returns from the instruction
+ *  alone, and each is one only when the word it transfers to is the lr this function was called
+ *  with: in lr itself, in the frame word the prologue's `push` saved it to, or in a register a
+ *  `pop` loaded from that word. Which word a `pop` reads is a question about the FRAME, not about
+ *  register names — a `pop` fills its list in register-number order from the lowest address up —
+ *  so this walks the frame (`makeFrameWalk`) over the CFG and tracks where the caller's lr is:
+ *    • a `push` that saves a register holding it records the word it went to;
+ *    • a `pop` whose k-th register (by number) reads that word puts it in that register, and every
+ *      other register it fills loses it;
+ *    • the word stops holding it when sp rises past it (a `pop` or `add sp` releases it), a
+ *      `str` through sp overwrites it, or the depth stops being one number;
+ *    • a register stops holding it when anything writes the register (a call writes them all);
+ *      a `mov` copies it.
+ *  Paths meet by agreement: a depth or a word the predecessors disagree on is unknown, and a
+ *  register holds lr only if it does on every path in.
+ *
+ *  So `push {r4, lr}; pop {r0}; bx r0` (the saved r4), `push {lr}; sub sp, #8; pop {r1}; bx r1` (a
+ *  local), `pop {r4, r1}` after `push {r4, lr}` (r1 is filled first, from r4's word) and
+ *  `mov r0, #7; bx r3` all decline, where agbcc's `pop {r4}; pop {r0}; bx r0` and its variadic
+ *  `push {r0-r3}; push {lr}; … pop {r3}; add sp, sp, #0x10; bx r3` are returns. It is also what the
+ *  far-jump relay's lowering needs and does not itself prove (`lowerFarJumpRelays`): with every
+ *  return reading the CALLER's lr, the lr a relay writes cannot be what a return jumps to.
+ *
+ *  NOT ASKED: `bx lr` and `mov pc, lr` are returns by the register's name, whether or not a call
+ *  has since overwritten lr. A compiler saves lr before it calls, so no compiled function reaches
+ *  that case. The far-jump relay does not lean on it: its lowering declines any function in which
+ *  an instruction other than the entry `push` names lr.
+ *
+ *  Blocks no path from the entry reaches are not asked: they never run. */
+function refuseReturnsNotThroughCallersLr(name: string, cfg: ThumbCfg): void {
+  const { asmBlocks, preds, entryReachable } = cfg;
+  const succs: number[][] = asmBlocks.map(() => []);
+  preds.forEach((ps, b) => ps.forEach((p) => succs[p].push(b)));
+  const LR = 'r14';
+  const join = (a: LrState, b: LrState): LrState => {
+    const depth = a.depth !== null && a.depth === b.depth ? a.depth : null;
+    return {
+      depth,
+      slot: depth !== null && a.slot !== null && a.slot === b.slot ? a.slot : null,
+      regs: new Set([...a.regs].filter((r) => b.regs.has(r))),
+    };
+  };
+  const same = (a: LrState, b: LrState) =>
+    a.depth === b.depth && a.slot === b.slot && a.regs.size === b.regs.size && [...a.regs].every((r) => b.regs.has(r));
+  const refuse = (ins: Instr): never => {
+    throw new FrontendUnsupportedError(
+      `cannot lift '${name}': indirect/computed jump '${ins.mnemonic} ${ins.ops.join(', ')}' is not a return ` +
+        `through the caller's lr — on some path what it jumps to is not lr, nor the frame word the prologue ` +
+        `saved lr in — jump tables / computed gotos / register tail calls not supported`,
+    );
+  };
+
+  // Run one block from its in-state, asking each return as it is reached; the out-state.
+  const run = (b: number, inState: LrState): LrState => {
+    const walk = makeFrameWalk({ argRegs: [], start: inState.depth });
+    let slot = inState.slot;
+    const regs = new Set(inState.regs);
+    for (const ins of asmBlocks[b].instrs) {
+      const mn = ins.mnemonic;
+      const depth = walk.depthNow();
+      const xfer = classifyXfer(ins);
+      const isPop =
+        mn === 'pop' || ((mn === 'ldmia' || mn === 'ldmfd') && isSpReg((ins.ops[0] ?? '').replace(/!$/, '')));
+      if (isPop) {
+        const list = byRegNumber(regListOf(mn === 'pop' ? ins.ops : ins.ops.slice(1)) ?? []);
+        if (list === null || list.length === 0) {
+          if (xfer === 'return') {
+            refuse(ins);
+          }
+          regs.clear();
+        } else {
+          list.forEach((r, k) => {
+            if (depth !== null && slot !== null && depth - 4 * k === slot) {
+              regs.add(r);
+            } else {
+              regs.delete(r);
+            }
+          });
+          if (xfer === 'return' && !regs.has('r15')) {
+            refuse(ins); // `pop {…, pc}` that does not load pc from the saved lr's word
+          }
+        }
+      } else if (xfer === 'return') {
+        // `bx rN`: the register itself must hold the caller's lr. `bx lr` and `mov pc, lr` are
+        // returns by name (see the doc comment).
+        const via = canonReg(mn === 'bx' ? (ins.ops[0] ?? '') : (ins.ops[1] ?? ''));
+        if (via !== LR && (via === null || !regs.has(via))) {
+          refuse(ins);
+        }
+      } else if (mn === 'push') {
+        const list = byRegNumber(regListOf(ins.ops) ?? []);
+        const k = list?.findIndex((r) => regs.has(r)) ?? -1;
+        if (list !== null && k >= 0 && depth !== null) {
+          slot = depth + 4 * list.length - 4 * k;
+        }
+      } else if (/^str[bh]?$/.test(mn)) {
+        const { base, off, regOff } = parseAddr(ins.ops[1] ?? '');
+        if (isSpReg(base) && slot !== null) {
+          const width = mn === 'strb' ? 1 : mn === 'strh' ? 2 : 4;
+          const at = depth === null || regOff !== undefined ? null : depth - off; // the word's depth
+          if (at === null || (at - width < slot && at > slot - 4)) {
+            slot = null;
+          }
+        }
+      } else if (!isSpReg(ins.ops[0])) {
+        const writes = regWritesOf(ins);
+        if (writes === 'all') {
+          regs.clear();
+        } else {
+          const src = /^movs?$/.test(mn) ? canonReg(ins.ops[1] ?? '') : null;
+          const copies = src !== null && regs.has(src);
+          writes.forEach((r) => regs.delete(r));
+          if (copies) {
+            regs.add(writes[0]);
+          }
+        }
+      }
+      walk.step(ins);
+      const after = walk.depthNow();
+      if (slot !== null && (after === null || slot > after)) {
+        slot = null; // released, or the frame is no longer one number
+      }
+    }
+    return { depth: walk.depthNow(), slot, regs };
+  };
+
+  const inStates = new Map<number, LrState>([[0, { depth: 0, slot: null, regs: new Set([LR]) }]]);
+  const work = [0];
+  while (work.length > 0) {
+    const b = work.pop()!;
+    const out = run(b, inStates.get(b)!);
+    for (const s of succs[b]) {
+      if (!entryReachable.has(s)) {
+        continue;
+      }
+      const prev = inStates.get(s);
+      const next = prev === undefined ? out : join(prev, out);
+      if (prev === undefined || !same(prev, next)) {
+        inStates.set(s, next);
+        work.push(s);
+      }
+    }
+  }
+}
+
+/** Lower every far-jump relay the target marks (`bl .Lx @far jump`, agbcc's; see
+ *  `compilerBehaviors.farJumpRelay`) in the selected function to the `b .Lx` it stands for, in
+ *  place, or decline. Only a target that declares the mark gets here with one: `decode` sets
+ *  `farJump` from that declaration alone.
+ *
+ *  A relay and a call differ in one effect: `bl` writes lr, `b` does not. So the lowering is sound
+ *  exactly when nothing can observe the lr the relay wrote. What the mark MEANS is the compiler's
+ *  fact, declared with it. That nothing observes lr is checked here on the function's own text,
+ *  not assumed from agbcc's habit (thumb.c `far_jump_used_p` makes it push lr in any function with
+ *  a far jump, which is why every relay in practice passes):
+ *    • the entry block saves lr with a `push`, and no branch of this function names the entry
+ *      label, so that push runs once, before any relay, and saves the CALLER's lr. A recovered
+ *      jump table is the other way back to the entry, and `readThumbText` asks that once the
+ *      tables exist (`relayed`). A `.word` naming the entry is not one: `dataWords` is the whole
+ *      file's, and a function stored as a callback in another function's pool is a pointer;
+ *    • no other instruction of the function names lr at all — no `bx lr`, no `mov pc, lr`, no
+ *      `mov rX, lr`, no second `push`. So the lr the relay writes never reaches a register, and no
+ *      code can return to it: `b` dropping that write is unobservable.
+ *  That every RETURN jumps through the caller's lr — not through a word the relay's lr could have
+ *  reached, nor through a saved callee register — is the other half of the argument, and it is
+ *  asked of every Thumb function once the CFG exists (`refuseReturnsNotThroughCallersLr`), where
+ *  the frame walk says which word each `pop` reads.
+ *  The mark itself is the only thing that makes a `bl` a relay: a call thunk (`bl call_r3`, in a
+ *  function that pushes lr too) has the same shape and no mark, and declines below.
+ *
+ *  The relay must also target a code label of THIS function that is not a declared function start:
+ *  agbcc only relays within a function, and a marked `bl` anywhere else is not its relay. */
+function lowerFarJumpRelays(name: string, blocks: readonly AsmBlock[], funcLabels: ReadonlySet<string>): Instr | null {
+  const instrs = blocks.flatMap((b) => b.instrs);
+  const relays = instrs.filter((ins) => ins.farJump);
+  if (relays.length === 0) {
+    return null;
+  }
+  const blockLabels = new Set(blocks.map((b) => b.label));
+  // The compiler is the target's declaration, not a name this function knows: "a far-jump relay".
+  const say = (ins: Instr) => `'${ins.asWritten ?? ins.mnemonic} ${ins.ops.join(', ')}' (a far-jump relay)`;
+  const refuse = (ins: Instr, why: string) => {
+    throw new FrontendUnsupportedError(
+      `cannot lift '${name}': ${say(ins)} ${why} — lowering it to a branch would drop the lr write a \`bl\` makes`,
+    );
+  };
+  for (const relay of relays) {
+    const target = relay.ops[0];
+    if (!blockLabels.has(target) || funcLabels.has(target)) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': ${say(relay)} does not target a code label of this function`,
+      );
+    }
+  }
+  const namesLr = (ins: Instr) => mentionsReg(ins, 'lr') || mentionsReg(ins, 'r14');
+  const entry = blocks[0];
+  const save = entry?.instrs.find(namesLr);
+  if (!save || save.mnemonic !== 'push' || !(regListOf(save.ops) ?? []).some((r) => r === 'lr' || r === 'r14')) {
+    refuse(relays[0], 'is in a function whose entry block does not save lr with a `push`');
+  }
+  if (instrs.some((ins) => classifyXfer(ins) !== null && ins.ops.includes(entry.label))) {
+    refuse(relays[0], `is in a function that branches back to its entry '${entry.label}', past the lr save`);
+  }
+  const reader = instrs.find((ins) => ins !== save && namesLr(ins));
+  if (reader) {
+    refuse(relays[0], `is in a function that names lr after saving it ('${reader.mnemonic} ${reader.ops.join(', ')}')`);
+  }
+  for (const relay of relays) {
+    relay.mnemonic = 'b';
+    relay.asWritten = 'bl';
+  }
+  return relays[0];
+}
+
+/** `farJumpMark` is the target's `compilerBehaviors.farJumpRelay` comment; absent, no `bl` is a
+ *  relay, and one to a label of this function declines below. */
+function readThumbText(name: string, asm: string, farJumpMark?: RegExp): ThumbText {
   assertInputFormat('thumb', 'gnu-as', asm);
-  const { blocks: rawBlocks, dataWords, nonWordData, funcLabels } = decode(name, asm);
+  const { blocks: rawBlocks, dataWords, nonWordData, funcLabels, aliasOf } = decode(name, asm, farJumpMark);
+  // Everything below keys a register by its spelling, so a function that writes one two ways
+  // (`sl` and `r10`) is read in one of them.
+  unifyRegisterSpellings(
+    rawBlocks.flatMap((b) => b.instrs),
+    ARM_REGISTER_ALIASES,
+  );
+  // Before anything below reads a `b`: the jump-table recovery counts branch references, and a
+  // relay is one.
+  const relayed = lowerFarJumpRelays(name, rawBlocks, funcLabels);
 
   // Regime B: recover agbcc jump tables. A dispatch block (`mov pc, rN`) plus its bounds
   // predecessor (`cmp; bhi DEF`) collapse into a `switch_br` emitted from the BOUNDS block; the
-  // dispatch block is ELIDED from the CFG. A `mov pc` that is NOT a recognised table falls through
-  // to the loud-fail below.
+  // dispatch block is ELIDED from the CFG — or kept, when it carries code (below). A `mov pc` that
+  // is NOT a recognised table falls through to the loud-fail below.
   const blockLabels = new Set(rawBlocks.map((b) => b.label));
   const poolNamesSymbols = poolNamesASymbol(dataWords, nonWordData, blockLabels);
   // Any label referenced as a branch target (so we can tell if an elided dispatch block has a SECOND
@@ -2528,8 +3028,25 @@ function readThumbText(name: string, asm: string): ThumbText {
       }
     }
   }
-  const tables = new Map<AsmBlock, JumpTable>(); // bounds block → recovered table
-  const elided = new Set<AsmBlock>(); // dispatch (and long-jump default) blocks removed from the CFG
+  const tables = new Map<AsmBlock, JumpTable>(); // the block emitting the switch → recovered table
+  const elided = new Set<AsmBlock>(); // dispatch blocks removed from the CFG
+  const relays = new Set<AsmBlock>(); // long-jump `b DEF` blocks removed with an elided dispatch
+  // A dispatch carrying code of its own (`JumpTable.extras`) is not elided: it stays as the block the
+  // bounds test leads to, holding only that code, and the switch is emitted from it. The bounds test
+  // and the long-jump `b DEF` keep their ordinary edges, so the code runs on the dispatched path and
+  // on no other.
+  const kept = new Map<AsmBlock, AsmBlock>();
+  const keepDispatch = (d: AsmBlock, jt: JumpTable): boolean => {
+    if (jt.extras.length === 0) {
+      return false;
+    }
+    const own = { ...d, instrs: jt.extras };
+    kept.set(d, own);
+    tables.set(own, jt);
+    return true;
+  };
+  // Why a dispatch's table was recognised and then refused, for the indirect-jump decline below.
+  const tableRefusals = new Map<AsmBlock, string>();
   rawBlocks.forEach((d, i) => {
     const last = d.instrs[d.instrs.length - 1];
     if (!last || last.mnemonic !== 'mov' || last.ops[0] !== 'pc' || last.ops[1] === 'lr') {
@@ -2540,7 +3057,12 @@ function readThumbText(name: string, asm: string): ThumbText {
     // Direct form: the dispatch is reached ONLY by falling through from its bounds predecessor. A
     // `b disp` from anywhere else would leave a dangling edge after elision, so decline (→ loud-fail).
     if (prev && refs === 0) {
-      const jt = recoverJumpTable(prev, d, dataWords, nonWordData, blockLabels);
+      const jt = recoverJumpTable(prev, d, dataWords, nonWordData, blockLabels, aliasOf, (why) =>
+        tableRefusals.set(d, why),
+      );
+      if (jt && keepDispatch(d, jt)) {
+        return;
+      }
       if (jt) {
         tables.set(prev, jt);
         elided.add(d);
@@ -2548,29 +3070,71 @@ function readThumbText(name: string, asm: string): ThumbText {
       }
     }
     // Long-jump form: `bounds` (cmp; bls DISP), then a lone `b DEF` block, then the dispatch. The
-    // dispatch is entered by exactly that one `bls` and nothing else, and the `b DEF` block —
-    // synthetically labelled, so unnameable and unreachable once the bounds block dispatches — is
-    // elided WITH it. Leaving it would make it a parameterless predecessor of the default block,
-    // and wiring a phi through it fabricates an entry parameter (the phantom-param miscompile).
+    // dispatch is entered by exactly that one `bls` and nothing else. When the dispatch is elided,
+    // the `b DEF` block — named by no branch, so unreachable once the bounds block dispatches — is
+    // elided WITH it unless a table entry names it. Leaving an unreachable one would make it a
+    // parameterless predecessor of the default block, and wiring a phi through it fabricates an
+    // entry parameter (the phantom-param miscompile). A kept dispatch keeps it as the bounds test's
+    // fall-through.
     const boundsB = rawBlocks[i - 2];
     const prevNamed = prev ? (branchRefs.get(prev.label) ?? 0) > 0 : false;
     if (refs === 1 && prev && boundsB && !prevNamed && prev.instrs.length === 1 && prev.instrs[0].mnemonic === 'b') {
-      const jt = recoverJumpTable(boundsB, d, dataWords, nonWordData, blockLabels, prev.instrs[0].ops[0]);
-      if (jt) {
+      const jt = recoverJumpTable(
+        boundsB,
+        d,
+        dataWords,
+        nonWordData,
+        blockLabels,
+        aliasOf,
+        (why) => tableRefusals.set(d, why),
+        prev.instrs[0].ops[0],
+      );
+      if (jt && !keepDispatch(d, jt)) {
         tables.set(boundsB, jt);
         elided.add(d);
-        elided.add(prev);
+        relays.add(prev);
       }
     }
   });
-  const asmBlocks = rawBlocks.filter((b) => !elided.has(b));
+  // A table entry naming a relay is an edge to the default through it, so that relay stays: it is
+  // reachable, and the kept form's relay is the same block.
+  const named = new Set([...tables.values()].flatMap((t) => [...t.caseLabels, t.defaultLabel]));
+  const asmBlocks = rawBlocks
+    .filter((b) => !elided.has(b) && !(relays.has(b) && !named.has(b.label)))
+    .map((b) => kept.get(b) ?? b);
+  // The branch counts above vouch that a recovered dispatch is entered only from its bounds test, but
+  // a TABLE entry is an edge too, and no table existed while they were counted — the rule MIPS and
+  // PowerPC check on their built CFG (jump-table.ts `refuseReachableDispatch`). An entry naming a
+  // dispatch block jumps through the code address the idiom loaded; a kept dispatch would instead
+  // switch again on the unscaled scrutinee, and an elided one names no block at all. Both decline.
+  const dispatchLabels = new Set([...elided, ...kept.keys()].map((b) => b.label));
+  for (const [at, t] of tables) {
+    const entered = [...t.caseLabels, t.defaultLabel].find((l) => dispatchLabels.has(l));
+    if (entered !== undefined) {
+      const movpc = rawBlocks.find((b) => b.label === entered)!.instrs.at(-1)!;
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': the recovered jump table's '${movpc.mnemonic} ${movpc.ops.join(', ')}' at '${entered}' ` +
+          `is still reachable — a case of the table dispatched at '${at.label}' enters its dispatch block past the bounds check`,
+      );
+    }
+  }
+  // The far-jump lowering's last question, askable only now: a recovered table dispatching to the
+  // entry would re-run the lr save after a relay clobbered lr (see `lowerFarJumpRelays`).
+  const entryLabel = rawBlocks[0]?.label;
+  if (relayed && [...tables.values()].some((t) => [...t.caseLabels, t.defaultLabel].includes(entryLabel))) {
+    throw new FrontendUnsupportedError(
+      `cannot lift '${name}': '${relayed.asWritten} ${relayed.ops.join(', ')}' (a far-jump relay) is in a function ` +
+        `whose jump table dispatches back to its entry '${entryLabel}', past the lr save — lowering it to a branch ` +
+        `would drop the lr write a \`bl\` makes`,
+    );
+  }
 
   // TRUSTWORTHINESS: loud-fail on a control transfer this frontend cannot model, rather than
   // silently dropping it. A computed/loaded PC write (`mov pc, rN`, `ldr pc, …`, `add/sub pc`,
   // `ldmia rN!,{…,pc}` with rN≠sp) is a jump table / computed goto / register tail call — decode
   // ends the block at it, but it has no static successor, so it must be a catchable "out of scope"
   // signal, not a vanished branch. Mirrors MIPS `jr`/PPC `bctr`. (A RECOGNISED jump table's
-  // dispatch block is already elided above, so it is not scanned here.)
+  // dispatch block is already elided or cut to its extras above, so it is not scanned here.)
   //
   // The same rule for a `bl` whose target is inside this function's own text. agbcc relays a
   // conditional branch past Thumb's ±256-byte reach through an unconditional one, and past THAT
@@ -2579,13 +3143,14 @@ function readThumbText(name: string, asm: string): ThumbText {
   // lift emits a call to a block label (`.L3(a0, a1, a2)`): not a branch that vanished but a
   // transfer turned into something that RETURNS, and syntactically not C.
   //
-  // The refusal is wider than that one shape because the asm does not separate it from a
+  // A relay agbcc MARKED (`@far jump`) never reaches here: `lowerFarJumpRelays` has already lowered
+  // it to `b`, behind a proof that lr is dead. What is left is a `bl` to a label of this function
+  // with no mark, and the shape does not separate a relay whose comment a splitter dropped from a
   // locally-defined call thunk — `call_r3: bx r3`, ARMv4T's stand-in for the `blx rN` it has no
   // encoding for, which pokeemerald's m4a_1.s calls four times from inside MPlayMain's own slice.
   // Both are a `bl` to a bare label the slice defines, both sit under a conditional branch that
-  // skips them, and both leave `lr` clobbered, so no liveness or layout fact tells them apart.
-  // Lifting the relay as a `br` is the other half of the gap and needs the same distinction plus a
-  // proof that `lr` is dead there, since `bl` overwrites it and a branch must not.
+  // skips them, both leave `lr` clobbered, and the thunk's function pushes lr too (`push {r0, lr}`),
+  // so no liveness, layout or prologue fact tells them apart. Only the mark does.
   //
   // DECLARED function starts are excluded: a `.thumb_func`/`thumb_func_start` label is a function
   // by declaration, so `bl` to one is a call however the slice came to contain it — the entry
@@ -2602,9 +3167,12 @@ function readThumbText(name: string, asm: string): ThumbText {
         );
       }
       if (classifyXfer(ins) === 'indirect') {
+        const why = tableRefusals.get(ab);
+        const detail =
+          why === undefined ? '' : ` — this one is a jump table whose dispatch carries code it refuses: ${why}`;
         throw new FrontendUnsupportedError(
           `cannot lift '${name}': indirect/computed jump '${ins.mnemonic} ${ins.ops.join(', ')}' ` +
-            `— jump tables / computed gotos / register tail calls not supported`,
+            `— jump tables / computed gotos / register tail calls not supported${detail}`,
         );
       }
       const callee = (ins.mnemonic === 'bl' || ins.mnemonic === 'blx') && ins.ops.length === 1 ? ins.ops[0] : undefined;
@@ -2682,8 +3250,9 @@ function buildCfg(
   const labelIndex = new Map<string, number>();
   blocks.forEach((b, i) => labelIndex.set(b.label, i));
   const succLabels: string[][] = blocks.map((b, i) => {
-    // A recovered jump-table BOUNDS block dispatches to its case blocks + default (the elided
-    // dispatch block's targets); its `bhi`/fall-through successors are replaced entirely.
+    // The block emitting a recovered table's switch dispatches to its case blocks + default. For a
+    // BOUNDS block (the dispatch elided) that replaces its `bhi`/fall-through successors entirely; a
+    // kept dispatch block had no static successor of its own.
     const jt = tables.get(b);
     if (jt) {
       return [...jt.caseLabels, jt.defaultLabel];
@@ -2719,19 +3288,6 @@ function buildCfg(
   return { labelIndex, preds };
 }
 
-// A `scratchRegs` entry outside `nonArgRegs` is inert, and inert is how a partition rots: the
-// list would go on reading as if it exempted something. Refused as a target bug, like the
-// argRegs/uninitRegs contradiction, rather than declined as a property of the input.
-function assertScratchRegsPartitioned(target: TargetDescription): ReadonlySet<string> {
-  const scratchRegs = new Set(target.scratchRegs ?? []);
-  for (const r of scratchRegs) {
-    if (!(target.nonArgRegs ?? []).includes(r)) {
-      throw new Error(`target '${target.id}': scratch register ${r} is not among the non-argument registers`);
-    }
-  }
-  return scratchRegs;
-}
-
 /** A `bl` passes a pair in two argument words, a struct-return pointer in r0, and the words past r3
  *  in the outgoing block `analyzeOutgoingArgs` licensed; a call through rN passes r0..r(N-1). */
 const THUMB_CALL_LOWERING: CallLowering = {
@@ -2746,16 +3302,36 @@ const THUMB_CALL_LOWERING: CallLowering = {
 interface ThumbFrame {
   readonly localArea: number;
   readonly savedRegs: ReadonlySet<string>;
+  /** the prologue's `mov rLow, rHi` that only stage a high register for its `push` (see
+   *  `prologueSavedRegs`); the fill does not lift them */
+  readonly saveCarriers: ReadonlySet<Instr>;
   readonly capturedObjectIsTheWholeFrame: boolean;
+  /** the offsets of the escaped frame addresses the outgoing-argument verdict leans on, which the
+   *  audit re-proves of the lifted IR; empty where the verdict leans on none */
+  readonly escapesReliedOn: ReadonlySet<number>;
+  /** the calls that hand out an escape the verdict leans on; empty where it leans on none */
+  readonly callsReliedOn: ReadonlySet<Instr>;
   /** the frame offset each instruction leaves a register holding, where `heldFrameWalk` follows it */
   readonly captureOffsetOf: ReadonlyMap<Instr, number>;
+  /** at each call, the frame addresses its argument registers may and must hold (`frameAddressesAtCalls`) */
+  readonly frameAddressesAtCall: ReadonlyMap<Instr, FrameAddressesAtCall>;
   readonly outgoingArgs: OutgoingArgs<Instr>;
+  /** the loaded-word bound both `outgoingArgs` and the frame-object audit take
+   *  (`FrameObjectAudit.loadedWords`); absent where the target states no start offset */
+  readonly loadedWords: FrameObjectAudit['loadedWords'];
   /** why the word-slot model is off, or null when it is on (`slotModelBlocker`) */
   readonly slotsOffReason: string | null;
   readonly slotsOk: boolean;
+  /** the frame depth at every instruction outside the entry block, or null where it is not proven
+   *  one number (`frameDepthBlocker`) */
+  readonly settledDepth: number | null;
   readonly partition: Readonly<Pick<FrameObjectAudit, 'ownedLocals' | 'declaredLocals'>>;
   isFrameObjectAccess(base: string, off: number, regOff: string | undefined, width: number): boolean;
   isOwnFrameWordSlot(base: string, off: number, regOff: string | undefined, width: number): boolean;
+  /** the word slot each narrow reload through a copy of sp reads the low-order part of
+   *  (`narrowSlotReloads`), and the copies those reloads consume, which name no object */
+  readonly narrowReloadOf: ReadonlyMap<Instr, number>;
+  readonly narrowReloadCopies: ReadonlySet<Instr>;
 }
 
 /** The frame offset of each word of a declared call's outgoing block, or null where it stages none.
@@ -2775,7 +3351,7 @@ interface ThumbFrame {
  *
  *  Null for an arity that fits in registers, where there IS no outgoing block. */
 function outgoingBlock(widths: readonly number[], target: TargetDescription): number[] | null {
-  const words = wordsOf(widths) - target.argRegs.length;
+  const words = wordsOf(widths, target) - target.argRegs.length;
   return words > 0 && target.compilerBehaviors.stagesOutgoingArgsInFrame === true
     ? Array.from({ length: words }, (_, i) => 4 * i)
     : null;
@@ -2799,15 +3375,20 @@ function calleeRegister(ins: Instr, target: TargetDescription): string | null |
 }
 
 function measureThumbFrame({
+  name,
   target,
   cfg: { asmBlocks, preds, entryReachable },
   calls,
   oneObject,
+  own,
 }: {
+  name: string;
   target: TargetDescription;
   cfg: ThumbCfg;
   calls: CallDeclarations;
   oneObject: FrameRange | undefined;
+  /** the function's own declaration (`ownDeclarationOf`), read only where it `proves` */
+  own: OwnDeclaration | undefined;
 }): ThumbFrame {
   // THE FRAME BASE PASSED TO A CALLEE. What this computes is exactly what its name says and nothing
   // more: somewhere in entry-reachable code a bare `mov rD, sp` copies the frame base into a
@@ -2817,15 +3398,19 @@ function measureThumbFrame({
   // feeds (`capturedObjectIsTheWholeFrame`, below `localArea`), not here.
   //
   // ARGUMENT registers only: the frame base merely live across a call is not evidence that it was
-  // passed to one, and for `blx rN` the TARGET register is not an argument either.
+  // passed to one, and for `blx rN` the TARGET register is not an argument either. Which registers
+  // a call reads, and which stores send a word outside the frame, are ONE rule for every escape
+  // this function asks about — `frameAddressReceivers` — so the three walks that ask differ only
+  // in the kill rule, and `heldFrameWalk` says why that one differs.
+  const mayHoldFrameAddress = registersThatMayHoldAFrameAddress(asmBlocks, entryReachable);
+  const handedOutRegs = (ins: Instr): readonly string[] =>
+    frameAddressReceivers(ins, target, calls, mayHoldFrameAddress);
   const frameBasePassedToCallee = heldFrameWalk(asmBlocks, entryReachable, mentionsReg, (ins, held) => {
     if (ins.mnemonic !== 'bl' && ins.mnemonic !== 'blx') {
       return false;
     }
-    // A call through a register is no argument of it: `mov r3, sp; blx r3` branches THROUGH the
-    // frame base, it does not pass it.
-    const targetReg = calleeRegister(ins, target);
-    return [...held].some(([r, off]) => off === 0 && target.argRegs.includes(r) && r !== targetReg);
+    const handed = handedOutRegs(ins);
+    return [...held].some(([r, off]) => off === 0 && handed.includes(r));
   });
 
   // THE FRAME BASE PUBLISHED TO MEMORY — the other way an agbcc frame address escapes, and the
@@ -2882,7 +3467,9 @@ function measureThumbFrame({
   // (u32)&b;` compiles to `add sp,#-0x44 / mov r0,sp / mov r2,#0x44 / bl memcpy / ldr r0,.L9+4 /
   // mov r1,sp / str r1,[r0]` — a block-copy base that IS published to memory (measured). At a
   // wider frame the publish escape admits exactly the shape the callee escape's table warns
-  // about; at one word it cannot occur.
+  // about; at one word it cannot occur. A wider frame's publish is read by the outgoing-argument
+  // `escape` event instead (below), per program point, which is the reading that survives a block
+  // copy: see "ONE DECISION, TWO LICENCES" above `capturedObjectIsTheWholeFrame`.
   //
   // THE WALK IS `heldFrameWalk`, the same one the callee escape is spelled with, because the
   // question is the same one and only the consuming event differs. Here that event is a WORD store
@@ -2898,21 +3485,21 @@ function measureThumbFrame({
   // refusal it produces stops being the two-models-for-one-byte one and becomes the audit's. A
   // clause without a row is decoration until an input says otherwise.
   //
-  // THE AUDIT'S RE-PROOF IS NOT THIS PREDICATE RE-SPELLED, and the one place they part is worth
-  // knowing: this walk is BLOCK-LOCAL while `taint` is whole-function, so a base captured in an
-  // earlier block is excluded there and not here. The containment still holds — whole-function
-  // taint is a superset of block-local held-ness, so the audit excludes every base this excludes
-  // and more — and the difference therefore lands on the refusing side. Pinned as a row.
-  const frameBasePublishedToMemory = heldFrameWalk(asmBlocks, entryReachable, mentionsReg, (ins, held) => {
-    if (ins.mnemonic !== 'str' || held.get(reg(ins.ops[0] ?? '')) !== 0) {
-      return false;
-    }
-    const { base } = parseAddr(ins.ops[1] ?? '');
-    return !isSpReg(base) && !held.has(reg(base));
-  });
+  // THE AUDIT'S RE-PROOF IS NOT THIS PREDICATE RE-SPELLED, but its BASE clause is the same
+  // whole-function fact on both sides. The stored VALUE must be held here (block-local); the BASE
+  // must be no register that holds a frame address ANYWHERE in the function
+  // (`registersThatMayHoldAFrameAddress`), the audit's whole-function `taint` read off the
+  // instructions. So a base captured in an earlier block is refused by the licence itself, before
+  // the audit sees it. Pinned as a row.
+  const frameBasePublishedToMemory = heldFrameWalk(
+    asmBlocks,
+    entryReachable,
+    mentionsReg,
+    (ins, held) => ins.mnemonic === 'str' && handedOutRegs(ins).some((r) => held.get(r) === 0),
+  );
 
   const localArea = reservedLocalArea(asmBlocks[0]);
-  const savedRegs = prologueSavedRegs(asmBlocks[0]);
+  const { saved: savedRegs, carriers: saveCarriers } = prologueSavedRegs(asmBlocks[0]);
 
   // …AND THE FRAME IS THAT OBJECT. The two escape scans above are facts about a REGISTER — that a
   // bare `mov rD, sp` is still held when a callee is entered, or when it is stored to memory.
@@ -2950,7 +3537,8 @@ function measureThumbFrame({
   // block-copy base — each needs two frame words before agbcc names its base with a register at
   // all — and the two-word struct returns with them. Any larger frame has bytes this model does not
   // describe, and they are either the rest of a wider object the callee writes or another call's
-  // argument slots; neither is provable here, so the answer stays the decline.
+  // argument slots. Neither is provable from the frame alone, so THIS licence stays at one word,
+  // and a larger frame is left to the `escape` event, which does not have to decide it.
   //
   // What the frame size does NOT exclude is the one-word struct return in the table above, which is
   // instruction-for-instruction an out-parameter call. That one is settled after the lift, by the
@@ -2962,8 +3550,8 @@ function measureThumbFrame({
   // handed to a callee arrives there through a frame this conjunct never looks at, and what bounds
   // its extent is the audit's frame-accounting rule rather than anything here.
   //
-  // WHY IT IS NOT WIDENED anyway, since a wider frame is the obvious next change. Three shapes,
-  // each compiled with agbcc 2.9-arm-000512, `-O2 -mthumb-interwork -Wimplicit -fhex-asm
+  // WHY THIS FLOW-INSENSITIVE LICENCE IS NOT WIDENED, since a wider frame is the obvious next
+  // change (the `escape` event reads a wider frame instead). Three shapes, each compiled with agbcc 2.9-arm-000512, `-O2 -mthumb-interwork -Wimplicit -fhex-asm
   // -fprologue-bugfix`, and only the first is about extent at all:
   //
   // UNDECIDABLE — a slot THIS FUNCTION stores and reloads. Two sources that disagree about who
@@ -3017,6 +3605,15 @@ function measureThumbFrame({
   // modelled as `volatile u16 sp0`, and its lift is byte-identical with this conjunct widened to
   // `localArea >= 4` (measured). Nothing about the frame size moves it either way — which is what
   // makes it the wrong function to reason about a wider licence from.
+  //
+  // ONE DECISION, TWO LICENCES. This gate and the outgoing-argument `escape` event (fed below,
+  // under `compilerBehaviors.escapedFrameAddressNamesALocal`) read the same escapes
+  // (`frameAddressReceivers`) and differ only in flow-sensitivity. This gate is flow-INSENSITIVE —
+  // one escape anywhere and no frame word is any call's argument — which is sound only where no
+  // block-copy base fits, a one-word frame. The event ends only the stores pending where the address
+  // leaves, at any frame size; that field says why that survives a block copy. So what this gate
+  // adds is a store that reaches an undeclared call BEFORE the address leaves (the CONTROL of "a
+  // capture in an unreachable block proves nothing"), and every "not widened" above is about it.
   const capturedObjectIsTheWholeFrame =
     target.compilerBehaviors.oneWordFrameIsTheCapturedObject === true &&
     (frameBasePassedToCallee || frameBasePublishedToMemory) &&
@@ -3028,20 +3625,184 @@ function measureThumbFrame({
   // What the walk cannot follow (a move in another block than the capture) the lift does not
   // fold either; the audit folds it from the IR, and refuses it by that name where the object
   // lands on a word this left keyed as a slot.
+  //
+  // …AND THE LOWEST FRAME ADDRESS EACH INSTRUCTION HANDS OUT, off the same walk: one held in an
+  // argument register the callee's declaration reads at a call (every one, where nothing declares
+  // it), or stored as a word to memory outside the frame — the two escapes above, at any offset.
+  // This walk keeps a capture addressed through (`mov r0, sp / strb r3, [r0, #8] / bl use`, sa3's
+  // `sub_8060940`), because the question here is what the receiver CAN read, and the outgoing-
+  // argument analysis only lets it end a word's pending store (`escapeEvent`, below). Its receivers
+  // are `handedOutRegs`, the rule the two licences above read too.
   const captureOffsetOf = new Map<Instr, number>();
+  const escapedOffsetOf = new Map<Instr, number>();
+  let frameBaseIsReturnStorage = false;
   heldFrameWalk(asmBlocks, entryReachable, mayWriteReg, (ins, held) => {
+    if (
+      ins.mnemonic === 'bl' &&
+      held.get(target.argRegs[0]) === 0 &&
+      calleeRegister(ins, target) === null &&
+      typeof calls.declaredCall(ins.ops[0] ?? '?')?.returned === 'object'
+    ) {
+      frameBaseIsReturnStorage = true;
+    }
+    const handed = handedOutRegs(ins);
+    const offs = [...held].filter(([r, off]) => handed.includes(r) && off >= 0).map(([, off]) => off);
+    if (offs.length > 0) {
+      escapedOffsetOf.set(ins, Math.min(...offs));
+    }
     const defined = frameAddressDefined(ins, held);
-    if (defined !== null) {
+    if (defined !== null && Number.isFinite(defined[1])) {
       captureOffsetOf.set(ins, defined[1]);
     }
     return false;
   });
-  // …and the offsets themselves, nonzero only — the frame base has its own licence,
-  // `capturedObjectIsTheWholeFrame`. A word whose address is taken is not an outgoing argument —
+  // …and the offsets themselves. A word whose address is taken is not an outgoing argument —
   // C gives an argument no address — so the outgoing-argument analysis below does not see these
   // offsets either: a store there reaching a call unread is the object being filled for the
   // callee that is handed it.
-  const constantCaptureOffsets: ReadonlySet<number> = new Set([...captureOffsetOf.values()].filter((o) => o > 0));
+  //
+  // THE FRAME BASE, ONLY AS A DECLARED CALL'S RETURN STORAGE AND ONLY WHERE NO CALL TAKES A STACK
+  // WORD. A bare `mov rD, sp` is also the base of a by-value argument's block copy into the
+  // outgoing area, and [sp,#0] is then a call's fifth argument word (the producer table above
+  // `capturedObjectIsTheWholeFrame`, which keeps its own licence for a one-word frame). Where every
+  // call is to a callee whose declaration places all of its arguments in registers there is no
+  // outgoing area, and where the base is handed as the hidden pointer of a callee declared to
+  // return a struct through memory it is that struct's storage: two struct-return temps,
+  // `mov r0, sp / bl mk` and `add r0, sp, #4 / bl mk`. A call nothing declares, a call through a
+  // register, or a declaration nothing sizes may take a stack word, and keeps offset 0 out.
+  const noCallTakesAStackWord = [...entryReachable].every((b) =>
+    asmBlocks[b].instrs.every((ins) => {
+      if (ins.mnemonic !== 'bl' && ins.mnemonic !== 'blx') {
+        return true;
+      }
+      const declared = calleeRegister(ins, target) === null ? calls.declaredCall(ins.ops[0] ?? '?') : null;
+      return declared !== null && outgoingBlock(declared.widths, target) === null;
+    }),
+  );
+
+  // A STRUCT PASSED BY VALUE, LOADED OFF THE FRAME A WORD AT A TIME. agbcc builds the argument in
+  // the frame — through a copy of sp, Thumb having no sp-relative halfword or byte store — and
+  // then loads its words into the argument registers the declaration places it in (`struct A
+  // {u16 a,b,c,d; s8 e,f;} a; a.a = x; … take2(a);` is `mov r2, sp / strh r0, [r2] / … / ldr r0,
+  // [sp] / ldr r1, [sp, #0x4] / ldr r2, [sp, #0x8] / bl take2`). Those words are the object's, not
+  // slots: each `[sp,#k]` inside such a block is routed through an `laddr` (`isFrameObjectAccess`),
+  // and the loads are folded into the object passed whole or refused (call-plan.ts
+  // `foldByValueArgs`). A block is read only where every one of its registers is
+  // last written, in the call's own block, by a word load at the next word of one frame range.
+  const byValueBlocks: FrameRange[] = [];
+  for (const b of entryReachable) {
+    const instrs = asmBlocks[b].instrs;
+    instrs.forEach((call, at) => {
+      if (call.mnemonic !== 'bl' || calleeRegister(call, target) !== null) {
+        return;
+      }
+      const declared = calls.declaredCall(call.ops[0] ?? '?');
+      for (const arg of declared?.byValue ?? []) {
+        // `word` indexes the call's widths, where a 64-bit argument is one entry of two registers
+        const reg = wordsOf(declared!.widths.slice(0, arg.word), target);
+        const offs = target.argRegs.slice(reg, reg + arg.words).map((r) => {
+          const def = instrs
+            .slice(0, at)
+            .reverse()
+            .find((ins) => mayWriteReg(ins, r));
+          const acc = def !== undefined && def.mnemonic === 'ldr' && def.ops[0] === r ? spMemAccess(def) : null;
+          return acc !== null && !acc.regOff && acc.width === 4 ? acc.off : null;
+        });
+        if (offs.every((o, i) => o !== null && o === offs[0]! + 4 * i)) {
+          byValueBlocks.push({ from: offs[0]!, to: offs[0]! + 4 * arg.words });
+        }
+      }
+    });
+  }
+  const inByValueBlock = (off: number, width: number): boolean =>
+    byValueBlocks.some((r) => off >= r.from && off + width <= r.to);
+
+  // THE NARROW RELOADS OF A WORD SLOT (`narrowSlotReloads`), kept only where the word is a slot
+  // and no object's: a word `str` to [sp,#slot] in live code writes it — without one the bytes are
+  // a sub-word local's (`mov r3, sp / strh r2, [r3, #4]`), which the object model owns — no other
+  // copy of sp names the slot's offset, and neither a by-value block nor the one object covers it.
+  // The one-word frame object (`capturedObjectIsTheWholeFrame`) needs no test of its own: its
+  // escape is a copy of sp at offset 0 handed out, which no candidate's copy can be (that one dies
+  // in its load), so it is another capture at the slot's offset.
+  //
+  // …AND THE WORD IS NOT AN INCOMING ARGUMENT'S HOME. A by-value struct parameter is the other
+  // producer of these instructions: agbcc stores its argument registers word by word on entry and
+  // reads each member at its width through a copy of sp (`struct P { u16 a, b, c, d; s8 e; }; int
+  // b2(struct P p){ return p.a + p.c - p.e; }` is `str r0, [sp] / … / mov r0, sp / ldrh r0, [r0]`),
+  // and there the frame is the parameter, one object whose union recompiles byte-exact
+  // (cli/test/matching/frame-union.test.ts) where the words narrowed recompile with no frame at
+  // all. A word the entry block stores straight from an argument register it has not written is
+  // that home, and its reloads keep the object model. A spilled promoted local is stored from the
+  // value it was computed as. That test reads the asm alone, and the function's own declaration
+  // overrules it where it proves the register holds one integer word (`proto.ts`
+  // `ownLeadingWordRegisters`): a `u32 k` spilled on entry and read back as `(u8)k` is no struct's
+  // home, and lifts as the slot narrowed. A copy kept here is no capture, so its offset leaves
+  // `constantCaptureOffsets` and the slot's own `str`/`ldr` stay slot accesses; one dropped stays a
+  // capture.
+  const narrowCandidates = narrowSlotReloads(
+    asmBlocks,
+    entryReachable,
+    localArea,
+    target.capabilities.endianness === 'little',
+  );
+  const candidateCopies = new Set([...narrowCandidates.values()].map((n) => n.copy));
+  const otherCaptureOffsets = new Set(
+    [...captureOffsetOf].filter(([ins]) => !candidateCopies.has(ins)).map(([, off]) => off),
+  );
+  const wordStoredSlots = new Set(
+    [...entryReachable].flatMap((b) =>
+      asmBlocks[b].instrs.flatMap((ins) => {
+        const a = spMemAccess(ins);
+        return ins.mnemonic === 'str' && a !== null && !a.regOff ? [a.off] : [];
+      }),
+    ),
+  );
+  const argumentHomes = new Set<number>();
+  {
+    const proving = own?.proves === true ? own.proto : undefined;
+    const wordArgRegs = new Set(target.argRegs.slice(0, ownLeadingWordRegisters(name, proving)));
+    const written = new Set<string>();
+    for (const ins of asmBlocks[0].instrs) {
+      const a = spMemAccess(ins);
+      const src = reg(ins.ops[0] ?? '');
+      if (
+        ins.mnemonic === 'str' &&
+        a !== null &&
+        !a.regOff &&
+        target.argRegs.includes(src) &&
+        !wordArgRegs.has(src) &&
+        !written.has(src)
+      ) {
+        argumentHomes.add(a.off);
+      }
+      for (const r of target.argRegs) {
+        if (ins.mnemonic === 'bl' || ins.mnemonic === 'blx' || mayWriteReg(ins, r)) {
+          written.add(r);
+        }
+      }
+    }
+  }
+  const narrowReloadOf = new Map<Instr, number>();
+  for (const [load, { slot }] of narrowCandidates) {
+    if (
+      wordStoredSlots.has(slot) &&
+      !argumentHomes.has(slot) &&
+      !otherCaptureOffsets.has(slot) &&
+      !inByValueBlock(slot, 4) &&
+      !(oneObject !== undefined && slot < oneObject.to && slot + 4 > oneObject.from)
+    ) {
+      narrowReloadOf.set(load, slot);
+    }
+  }
+  const narrowReloadCopies: ReadonlySet<Instr> = new Set(
+    [...narrowCandidates].filter(([load]) => narrowReloadOf.has(load)).map(([, n]) => n.copy),
+  );
+  const constantCaptureOffsets: ReadonlySet<number> = new Set(
+    [...captureOffsetOf]
+      .filter(([ins]) => !narrowReloadCopies.has(ins))
+      .map(([, o]) => o)
+      .filter((o) => o > 0 || (o === 0 && frameBaseIsReturnStorage && noCallTakesAStackWord)),
+  );
 
   // THE OUTGOING STACK-ARGUMENT AREA. `frontend/stackargs.ts` holds the licence and every refusal;
   // what belongs HERE is the decoding it deliberately does not do — which accesses are whole frame
@@ -3055,40 +3816,102 @@ function measureThumbFrame({
     const a = spMemAccess(ins);
     return a && !a.regOff && a.width === 4 && a.off % 4 === 0 && a.off >= 0 && a.off + 4 <= localArea ? a.off : null;
   };
-  const outgoingArgs = analyzeOutgoingArgs<Instr>({
-    blocks: asmBlocks.map((ab) => ({
-      events: ab.instrs.flatMap((ins): StackArgsEvent<Instr>[] => {
-        const off = slotAcc(ins);
-        if (off !== null && !constantCaptureOffsets.has(off)) {
-          return [{ kind: /^str/.test(ins.mnemonic) ? 'store' : 'load', off }];
-        }
-        if (ins.mnemonic === 'bl' || ins.mnemonic === 'blx') {
-          const callee = ins.ops[0] ?? '?';
-          const declared = calleeRegister(ins, target) === null ? calls.declaredCall(callee) : null;
-          return [
-            {
-              kind: 'call',
-              call: ins,
-              callee,
-              declared: declared === null ? null : outgoingBlock(declared.widths, target),
-              params: declared?.params,
-            },
-          ];
-        }
-        return [];
-      }),
-    })),
-    preds,
-    live: entryReachable,
-    localArea,
-    argRegs: target.argRegs.length,
-    capturedWholeFrame: capturedObjectIsTheWholeFrame,
-    localsAboveOutgoingArea: target.compilerBehaviors.localsAboveOutgoingArea === true,
-  });
+  //
+  // AN ESCAPED FRAME ADDRESS IS READ BY ITS RECEIVER, and the event says so just before the call or
+  // the store that hands it over — but only where the target declares the layout premise that
+  // makes the words from that address up a local's (`escapedFrameAddressNamesALocal`).
+  const escapesHere = target.compilerBehaviors.escapedFrameAddressNamesALocal === true;
+  const escapeEvent = (ins: Instr): StackArgsEvent<Instr>[] => {
+    const off = escapedOffsetOf.get(ins);
+    return escapesHere && off !== undefined ? [{ kind: 'escape', off }] : [];
+  };
+  const eventBlocks = asmBlocks.map((ab) => ({
+    events: ab.instrs.flatMap((ins): StackArgsEvent<Instr>[] => {
+      const escaped = escapeEvent(ins);
+      if (escaped.length > 0 && ins.mnemonic === 'str') {
+        return escaped;
+      }
+      // …and a narrow reload of a word slot is that slot's reload, as its word reload would be
+      const off = slotAcc(ins) ?? narrowReloadOf.get(ins) ?? null;
+      if (off !== null && !constantCaptureOffsets.has(off) && !inByValueBlock(off, 4)) {
+        return [{ kind: /^str/.test(ins.mnemonic) ? 'store' : 'load', off }];
+      }
+      if (ins.mnemonic === 'bl' || ins.mnemonic === 'blx') {
+        const callee = ins.ops[0] ?? '?';
+        const declared = calleeRegister(ins, target) === null ? calls.declaredCall(callee) : null;
+        return [
+          ...escaped,
+          {
+            kind: 'call',
+            call: ins,
+            callee,
+            declared: declared === null ? null : outgoingBlock(declared.widths, target),
+            params: declared?.params,
+          },
+        ];
+      }
+      return [];
+    }),
+  }));
+  // THE LOADED-WORD BOUND, read once (`outgoingAreaNeverLoadedFrom`, 0 on agbcc): the outgoing
+  // argument analysis and the frame-object audit both take this number.
+  const loadedFrom = target.compilerBehaviors.outgoingAreaNeverLoadedFrom;
+  const loadedBound = loadedWordBound(eventBlocks, entryReachable, loadedFrom);
+  const outgoingArgsOver = (blocks: readonly StackArgsBlock<Instr>[]): OutgoingArgs<Instr> =>
+    analyzeOutgoingArgs<Instr>({
+      blocks,
+      preds,
+      live: entryReachable,
+      localArea,
+      argRegs: target.argRegs.length,
+      capturedWholeFrame: capturedObjectIsTheWholeFrame,
+      loadedWordBound: loadedBound,
+    });
+  const outgoingArgs = outgoingArgsOver(eventBlocks);
+  // THE ESCAPES THE VERDICT LEANS ON, re-asked of the lifted IR (`auditFrameObjects`'
+  // `escapesReliedOn`). The `escape` event is read off what a REGISTER holds at a `bl` or a `str`,
+  // and it switches refusals OFF; the lift then decides what the call is really handed, and an
+  // arity that shrinks after the event was read (a guess, then the trim) can leave the address out
+  // of the call while its stores stay excused. The one-word licence has this re-check
+  // (`recheckWholeFramePremise`); this is the same one at any frame size. Only where the analysis
+  // would refuse WITHOUT the escapes, so an escape that excused nothing asks nothing of the IR.
+  const escapeOffsets = new Set(
+    [...entryReachable].flatMap((b) => eventBlocks[b].events.flatMap((ev) => (ev.kind === 'escape' ? [ev.off] : []))),
+  );
+  const escapesReliedOn: ReadonlySet<number> =
+    outgoingArgs.blocker === null &&
+    escapeOffsets.size > 0 &&
+    outgoingArgsOver(eventBlocks.map((b) => ({ events: b.events.filter((ev) => ev.kind !== 'escape') }))).blocker !==
+      null
+      ? escapeOffsets
+      : new Set();
+  const callsReliedOn: ReadonlySet<Instr> = new Set(
+    escapesReliedOn.size === 0
+      ? []
+      : [...escapedOffsetOf.keys()].filter((ins) => ins.mnemonic === 'bl' || ins.mnemonic === 'blx'),
+  );
 
   const slotsOffReason = slotModelBlocker(asmBlocks, localArea, outgoingArgs);
   const slotsOk = slotsOffReason === null;
 
+  // THE DEPTH EVERY OTHER BLOCK RUNS AT: what the entry block leaves, where `frameDepthBlocker`
+  // proves no block but a returning one moves sp again. Not where the entry is itself a loop
+  // target (its prologue would run twice) or returns (no block runs after it).
+  const entry = asmBlocks[0];
+  const entryWalk = makeFrameWalk({ argRegs: target.argRegs, start: 0 });
+  for (const ins of entry.instrs) {
+    if (!classifyXfer(ins)) {
+      entryWalk.step(ins);
+    }
+  }
+  const entryEnd = entry.instrs[entry.instrs.length - 1];
+  const settledDepth =
+    frameDepthBlocker(asmBlocks) === null &&
+    preds[0].length === 0 &&
+    !(entryEnd !== undefined && classifyXfer(entryEnd) === 'return')
+      ? entryWalk.depthNow()
+      : null;
+
   // …AND THE ONE OFFSET THAT MUST NOT BE A SLOT. When `capturedObjectIsTheWholeFrame` holds, the
   // frame is one word and a callee is being handed its address, so an `[sp,#0]` access is an access
   // to THAT OBJECT — provisionally, since the audit is what proves the object is a local at all. Keying it as an SSA slot instead moves the value into a
@@ -3121,6 +3944,7 @@ function measureThumbFrame({
     width === 4 &&
     ((capturedObjectIsTheWholeFrame && off === 0) ||
       (constantCaptureOffsets.has(off) && off >= outgoingArgs.area && off + 4 <= localArea) ||
+      (inByValueBlock(off, 4) && off >= outgoingArgs.area && off + 4 <= localArea) ||
       (oneObject !== undefined && off >= oneObject.from && off + 4 <= oneObject.to));
 
   // LOCAL STACK SLOTS. A spill or a local that never has its address taken is transparent to
@@ -3181,14 +4005,22 @@ function measureThumbFrame({
   return {
     localArea,
     savedRegs,
+    saveCarriers,
     capturedObjectIsTheWholeFrame,
+    escapesReliedOn,
+    callsReliedOn,
     captureOffsetOf,
+    frameAddressesAtCall: frameAddressesAtCalls(asmBlocks, preds, entryReachable, calls.callClobbers),
     outgoingArgs,
+    loadedWords: loadedFrom === undefined ? undefined : { from: loadedFrom, bound: loadedBound },
     slotsOffReason,
     slotsOk,
+    settledDepth,
     partition,
     isFrameObjectAccess,
     isOwnFrameWordSlot,
+    narrowReloadOf,
+    narrowReloadCopies,
   };
 }
 
@@ -3216,6 +4048,13 @@ function measureThumbFrame({
 // question, and there the capture has to reach the consumer UNTOUCHED (`mentionsReg`): a copy
 // addressed through and still live at a call is an addressing copy, not an argument —
 // `EReader_Reset` is `mov r1, sp / strh r0, [r1] / … / bl` into callees that take nothing.
+// WHAT THE RECEIVER CAN READ is the third question, the outgoing-argument analysis's `escape`
+// event, and it reads the first rule: sa3's `sub_8060940` fills its object through the very copy it
+// passes (`mov r0, sp / strb r3, [r0, #8] / bl use`). What keeps `EReader_Reset` out there is the
+// receiver rule both share (`frameAddressReceivers`): a callee declared to take nothing is handed
+// no register. And an undeclared callee that took a stack word needs all four argument registers
+// written for it first, which the write rule sees, so a capture still held in one at the `bl` is
+// passed to it.
 //
 // A `bl` CLEARS EVERY HELD REGISTER, and for the callee escape that is the ABI — the argument
 // registers are the only ones it tests and the callee clobbers them. The publish escape can hold
@@ -3256,6 +4095,13 @@ function heldFrameWalk(
 // null. The shapes that carry one: the capture itself (`mov rD, sp`, `add rD, sp, #k`), a copy
 // of a held register (`mov rD, rS`, and agbcc's `add rD, rS, #0`), and a held register moved by
 // a constant (`add rD, rS, #c`, `add rD, #c`). Everything else only kills.
+//
+// …AND A FRAME ADDRESS MOVED BY A REGISTER, at an offset nothing here knows (NaN): sp or a held
+// register plus a runtime index, `add r2, r2, sp` — agbcc's `&buf[i]` — or `mov r1, sp / add r0,
+// r1, r4`. It names no one word, so no walk that asks for an offset can credit it (NaN equals
+// none, and an escape at NaN is no escape); what it is carried for is the "may hold a frame
+// address" questions: without it an undeclared call's guessed arity drops `&buf[i]` with no
+// refusal (`g3(a, b, &buf[i])` as `g3()`).
 function frameAddressDefined(ins: Instr, held: ReadonlyMap<string, number>): [string, number] | null {
   const [d, s1, s2] = ins.ops;
   if (d === undefined || isSpReg(d)) {
@@ -3269,15 +4115,235 @@ function frameAddressDefined(ins: Instr, held: ReadonlyMap<string, number>): [st
   }
   if (/^adds?$/.test(ins.mnemonic)) {
     const [src, by] = s2 === undefined ? [d, s1] : [s1, s2];
-    if (src === undefined || by === undefined || !IMM_LITERAL.test(by)) {
+    if (src === undefined || by === undefined) {
       return null;
     }
-    const from = isSpReg(src) ? 0 : held.get(reg(src));
+    const at = (r: string): number | undefined => (isSpReg(r) ? 0 : held.get(reg(r)));
+    if (!IMM_LITERAL.test(by)) {
+      return at(src) !== undefined || at(by) !== undefined ? [reg(d), NaN] : null;
+    }
+    const from = at(src);
     return from === undefined ? null : [reg(d), from + imm(by)];
   }
   return null;
 }
 
+// A NARROW RELOAD OF A WORD SLOT, read through a copy of sp. agbcc promotes a `u8`/`u16` local to
+// a word (thumb.h PROMOTE_MODE), spills it with `str`, and where a use is narrow it reloads only
+// the narrow part. Thumb has no sp-relative `ldrb`/`ldrh`, so that reload goes through a copy of
+// sp made for it alone: `add r3, sp, #0x28 / ldrb r3, [r3]` (a byte slot past the `ldrb` offset
+// range), `mov r2, sp / ldrh r2, [r2, #0x4]`. The narrow bytes are the slot's LOW-ORDER part —
+// on a little-endian target its own address, on a big-endian one its last `width` bytes — so the
+// load reads the stored word's value narrowed, `zext(sp@<slot>)`, and the copy names no object.
+//
+// What this finds is a shape and not yet a licence; the copy is a capture everywhere it fails:
+//   * the copy is `mov rD, sp` or `add rD, sp, #c`, entry-reachable, and in ONE block it is read
+//     by exactly one instruction, a zero-extending `ldrb`/`ldrh` at an immediate offset from rD
+//     that writes rD itself, so the address dies at that load. Anything else that mentions rD
+//     before it (a second load, a store through it, an escape), a call, a control transfer or a
+//     write of sp ends the search, and the copy stays a capture.
+//   * the load's bytes are the low-order part of a whole aligned word of the reserved local area.
+//     A load at any other byte of the word is not that word's value narrowed, whatever it reads.
+//   * `ldrsb`/`ldrsh` exist only register-offset in Thumb-1, and agbcc's signed use reloads a word
+//     and shifts (measured), so no signed shape is taken.
+// What the caller then adds, because it needs the frame model: a word `str` to the slot in live
+// code, the slot named by no other capture, no argument's home, outside a by-value block and
+// outside the one object (`measureThumbFrame`), and at the lowering a slot the word reload would
+// read (`lowerLoad` `readsOwnSlot`). A narrow STORE into
+// the slot through any other address is the frame-object audit's: it sees that slot used and the
+// object overlapping it, the "one byte, two models" refusal.
+function narrowSlotReloads(
+  asmBlocks: readonly AsmBlock[],
+  entryReachable: ReadonlySet<number>,
+  localArea: number,
+  littleEndian: boolean,
+): Map<Instr, { copy: Instr; slot: number }> {
+  const found = new Map<Instr, { copy: Instr; slot: number }>();
+  for (const b of entryReachable) {
+    const instrs = asmBlocks[b].instrs;
+    instrs.forEach((copy, at) => {
+      const [d, s1, s2] = copy.ops;
+      const from = capturesSp(copy)
+        ? 0
+        : /^adds?$/.test(copy.mnemonic) && isSpReg(s1) && s2 !== undefined && IMM_LITERAL.test(s2)
+          ? imm(s2)
+          : null;
+      if (from === null || d === undefined || isSpReg(d)) {
+        return;
+      }
+      const rD = reg(d);
+      for (const ins of instrs.slice(at + 1)) {
+        if (ins.mnemonic === 'bl' || ins.mnemonic === 'blx' || classifyXfer(ins) !== null || modifiesSp(ins)) {
+          return;
+        }
+        if (!mentionsReg(ins, rD)) {
+          continue;
+        }
+        const width = ins.mnemonic === 'ldrb' ? 1 : ins.mnemonic === 'ldrh' ? 2 : 0;
+        const addr = ins.ops[1] === undefined ? null : parseAddr(ins.ops[1]);
+        if (width === 0 || reg(ins.ops[0] ?? '') !== rD || addr === null || reg(addr.base) !== rD || addr.regOff) {
+          return;
+        }
+        const slot = from + addr.off - (littleEndian ? 0 : 4 - width);
+        if (slot % 4 === 0 && slot >= 0 && slot + 4 <= localArea) {
+          found.set(ins, { copy, slot });
+        }
+        return;
+      }
+    });
+  }
+  return found;
+}
+
+// Every register that holds a frame address at some instruction of live code — the shapes
+// `frameAddressDefined` carries, closed over every block at once rather than along one. So it is
+// a SUPERSET of every block's `held`, and what it EXCLUDES is the only thing it is used for: a
+// store through one of these is not a store outside the frame. A frame address reloaded from
+// memory is not followed; the store through it then counts as leaving the frame, which is the
+// imprecision `frameAddressReceivers` states.
+function registersThatMayHoldAFrameAddress(
+  asmBlocks: readonly AsmBlock[],
+  entryReachable: ReadonlySet<number>,
+): ReadonlySet<string> {
+  const held = new Map<string, number>();
+  for (let grew = true; grew;) {
+    grew = false;
+    for (const b of entryReachable) {
+      for (const ins of asmBlocks[b].instrs) {
+        // CONSTANT OFFSETS ONLY. Closed over every block at once, an index sum (NaN) would carry
+        // the frame base through every `add rD, rS, rT` in the function — measured: klonoa's
+        // `DmaControllerInit` then held its DMA register's base, and its publish stopped counting
+        // as one. A store through `&buf[i]` stays the counted-as-leaving imprecision stated above.
+        const defined = frameAddressDefined(ins, held);
+        if (defined !== null && Number.isFinite(defined[1]) && !held.has(defined[0])) {
+          held.set(defined[0], 0); // the offset is not the question here, only the register
+          grew = true;
+        }
+      }
+    }
+  }
+  return new Set(held.keys());
+}
+
+// THE FRAME ADDRESSES ARGUMENT REGISTERS HOLD AT EACH CALL, two ways. The shapes carried are
+// `frameAddressDefined`'s, and a write of anything else ends one, as in `heldFrameWalk`.
+//   - `may`: on SOME path from the entry, ACROSS blocks, joined by union — the question is a
+//     refusal's, so a capture made in one block and handed over in the next (`mov r5, sp` / … /
+//     `.L3: add r3, r5, #0` / `bl`) must count, and a call ends only what it clobbers, because a
+//     capture in r4-r7 outlives it. Two paths that disagree on the offset leave it unknown (NaN).
+//     The entry block starts empty, which keeps an incoming argument register from counting:
+//     nothing arrives in it but the caller's value.
+//   - `must`: defined in the call's own block, which every path to the call runs.
+interface FrameAddressesAtCall {
+  readonly may: ReadonlyMap<string, number>;
+  readonly must: ReadonlyMap<string, number>;
+}
+function frameAddressesAtCalls(
+  asmBlocks: readonly AsmBlock[],
+  preds: readonly (readonly number[])[],
+  entryReachable: ReadonlySet<number>,
+  clobbers: readonly string[],
+): ReadonlyMap<Instr, FrameAddressesAtCall> {
+  const atCall = new Map<Instr, FrameAddressesAtCall>();
+  const out = asmBlocks.map(() => new Map<string, number>());
+  const step = (ins: Instr, held: Map<string, number>): void => {
+    if (ins.mnemonic === 'bl' || ins.mnemonic === 'blx') {
+      clobbers.forEach((r) => held.delete(r));
+      return;
+    }
+    const carried = frameAddressDefined(ins, held);
+    for (const r of [...held.keys()]) {
+      if (mayWriteReg(ins, r)) {
+        held.delete(r);
+      }
+    }
+    if (carried !== null) {
+      held.set(carried[0], carried[1]);
+    }
+  };
+  const flow = (b: number, record: boolean): Map<string, number> => {
+    const may = new Map<string, number>();
+    for (const p of preds[b] ?? []) {
+      for (const [r, off] of out[p]) {
+        may.set(r, !may.has(r) || may.get(r) === off ? off : NaN);
+      }
+    }
+    const must = new Map<string, number>();
+    for (const ins of asmBlocks[b].instrs) {
+      if (record && (ins.mnemonic === 'bl' || ins.mnemonic === 'blx')) {
+        atCall.set(ins, { may: new Map(may), must: new Map(must) });
+      }
+      step(ins, may);
+      step(ins, must);
+    }
+    return may;
+  };
+  const same = (a: ReadonlyMap<string, number>, b: ReadonlyMap<string, number>) =>
+    a.size === b.size && [...a].every(([r, off]) => b.has(r) && Object.is(b.get(r), off));
+  for (let changed = true; changed;) {
+    changed = false;
+    for (const b of entryReachable) {
+      const next = flow(b, false);
+      if (!same(next, out[b])) {
+        out[b] = next;
+        changed = true;
+      }
+    }
+  }
+  for (const b of entryReachable) {
+    flow(b, true);
+  }
+  return atCall;
+}
+
+// THE REGISTERS AN INSTRUCTION HANDS TO CODE OUTSIDE THIS FUNCTION — the one definition of a frame
+// address escaping, which every escape walk in `measureThumbFrame` reads, so which registers a
+// callee reads and which stores leave the frame are decided once.
+//
+// A CALL hands over the argument registers its callee's DECLARATION reads — one per 32-bit word,
+// so `g(void)` is handed nothing — and every argument register where nothing declares it. A call
+// through a register (`blx r3`, a `_call_via_r3` thunk) branches THROUGH that register; it does not
+// pass it. "Every register" is wider than what the lift passes an undeclared callee — a guessed
+// count, or the bound of a call through an argument register — and the two agree on a frame address
+// only because the lowering refuses to leave one out (`lowerCall`'s `leftOut`, over
+// `frameAddressesAtCalls`, which holds at each call a superset of what the walks here hold) — of
+// the registers its guess leaves out, of those the trim cuts afterwards (`GuessedCallSite.
+// trimmed`), and of those the call's own block wrote that the ranked `/setup-args` reading would
+// cut, which is withheld for that site instead (it runs in the ranker, after the audit below). Where
+// the outgoing-argument verdict leans on an escape, the audit re-proves it of the lifted IR as well
+// (`escapesReliedOn`), which catches a shrink inside the lift that bypassed the question, and
+// `/setup-args` is not offered at a call that hands out such an escape (`lowerCall`'s
+// `withholdsSetupArgs`), since this definition read every argument register it holds as handed
+// over; at the function's other calls the reading asks `leftOut` of every register it cuts
+// (`asksEveryCut`), an earlier block's frame address included. Elsewhere that a value an EARLIER
+// block left is dead is the whole guess of that reading, and agbcc does leave a dead `mov r3, sp`
+// base in a call's argument registers (sa3 sub_805DADC). Those cuts are asked of the lifted IR instead: the reading is withheld where the cut leaves the object
+// it addresses with no reader (`frontend/ssa.ts` cutsUnreadFrameObjects).
+//
+// A WORD `str` hands its source register to whoever reads the memory it writes, unless the base is
+// sp or any register that may hold a frame address (`registersThatMayHoldAFrameAddress`, whole-
+// function): then the address is written INTO this frame, and nothing outside has been handed it.
+// A frame address the base reached through memory is the one this misses, and it counts as
+// leaving. A `strh`/`strb` hands over part of an address, which no reader can follow.
+function frameAddressReceivers(
+  ins: Instr,
+  target: TargetDescription,
+  calls: CallDeclarations,
+  mayHoldFrameAddress: ReadonlySet<string>,
+): readonly string[] {
+  if (ins.mnemonic === 'bl' || ins.mnemonic === 'blx') {
+    const targetReg = calleeRegister(ins, target);
+    const declared = targetReg === null ? calls.declaredCall(ins.ops[0] ?? '?') : null;
+    const words = declared?.widths.reduce((n, w) => n + Math.ceil(w / 32), 0) ?? target.argRegs.length;
+    return target.argRegs.slice(0, words).filter((r) => r !== targetReg);
+  }
+  if (ins.mnemonic !== 'str') {
+    return [];
+  }
+  const { base } = parseAddr(ins.ops[1] ?? '');
+  return isSpReg(base) || mayHoldFrameAddress.has(reg(base)) ? [] : [reg(ins.ops[0] ?? '')];
+}
+
 // Is the word-slot model safe for THIS function? Every disqualifier below leaves every `[sp,#k]`
 // access on the old path, which declines — so the answer to "not sure" is the loud one.
 // Returns null when the word-slot model is SAFE for this function, else the reason it is off —
@@ -3309,13 +4375,54 @@ function slotModelBlocker(
       // frameless function taking sp's address has nothing to model and refuses in those arms.
     }
   }
-  // sp must be CONSTANT wherever a slot is keyed, because the key IS the raw offset. Two shapes
-  // are legitimate and everything else refuses: a PROLOGUE (sp moves before the block touches the
-  // frame) and an EPILOGUE (sp moves after it has finished touching it, and the block returns, so
-  // nothing downstream can key a slot against the changed sp). A modification BETWEEN two
-  // accesses moves the frame under a slot already keyed, and only the entry block may deepen —
-  // elsewhere a pre-access modification would put the block at a different depth from the one the
-  // prologue established.
+  const depthBlocker = frameDepthBlocker(asmBlocks);
+  if (depthBlocker !== null) {
+    return depthBlocker;
+  }
+  // OUTGOING ARGUMENTS — one analysis, and its refusals are this guard's. `analyzeOutgoingArgs`
+  // decides per call whether the words staged at the bottom of the frame are a callee's
+  // arguments; everything it cannot license refuses here, so a `[sp,#k]` access in such a
+  // function still declines loud.
+  if (outgoing.blocker !== null) {
+    return outgoing.blocker;
+  }
+  // A `pop`/`ldm` off sp READS frame memory, and push/pop are transparent to dataflow, so a pop
+  // taken while the local area is still reserved reads a slot this model has retargeted into SSA
+  // — the load simply disagrees with the store. A real epilogue releases the locals first
+  // (`add sp,#N; pop {…}`), which is what this requires; `pop {r1}` mid-frame does not.
+  for (const ab of asmBlocks) {
+    let released = 0;
+    for (const ins of ab.instrs) {
+      if ((ins.mnemonic === 'pop' || ins.mnemonic === 'ldmia') && released < localArea) {
+        const base = ins.mnemonic === 'pop' ? 'sp' : (ins.ops[0] ?? '').replace(/!$/, '');
+        if (isSpReg(base)) {
+          return 'a pop reads the frame while the local area is still reserved';
+        }
+      }
+      if ((ins.mnemonic === 'add' || ins.mnemonic === 'sub') && isSpReg(ins.ops[0])) {
+        const d = spAdjust(ins);
+        if (d !== null && d > 0) {
+          released += d;
+        }
+      }
+    }
+  }
+  return null;
+}
+
+// Is sp ONE VALUE at every frame access of this function, the one its prologue leaves? Null when it
+// is, else why not. The slot model needs it because a slot's key IS the raw offset, and an incoming
+// stack argument read outside the entry block needs it because its index is the offset less the
+// depth (`makeFrameWalk`).
+//
+// Two shapes are legitimate and everything else refuses: a PROLOGUE (sp moves before the block
+// touches the frame) and an EPILOGUE (sp moves after it has finished touching it, and the block
+// returns, so nothing downstream can key a slot against the changed sp). A modification BETWEEN two
+// accesses moves the frame under a slot already keyed, and only the entry block may deepen —
+// elsewhere a pre-access modification would put the block at a different depth from the one the
+// prologue established. So every block but the entry starts at the depth the entry leaves, and
+// only a block that returns moves sp.
+function frameDepthBlocker(asmBlocks: readonly AsmBlock[]): string | null {
   for (let bi = 0; bi < asmBlocks.length; bi++) {
     const ins = asmBlocks[bi].instrs;
     const mems = ins.map((x, i) => (touchesFrame(x) ? i : -1)).filter((i) => i >= 0);
@@ -3346,34 +4453,6 @@ function slotModelBlocker(
       }
     }
   }
-  // OUTGOING ARGUMENTS — one analysis, and its refusals are this guard's. `analyzeOutgoingArgs`
-  // decides per call whether the words staged at the bottom of the frame are a callee's
-  // arguments; everything it cannot license refuses here, so a `[sp,#k]` access in such a
-  // function still declines loud.
-  if (outgoing.blocker !== null) {
-    return outgoing.blocker;
-  }
-  // A `pop`/`ldm` off sp READS frame memory, and push/pop are transparent to dataflow, so a pop
-  // taken while the local area is still reserved reads a slot this model has retargeted into SSA
-  // — the load simply disagrees with the store. A real epilogue releases the locals first
-  // (`add sp,#N; pop {…}`), which is what this requires; `pop {r1}` mid-frame does not.
-  for (const ab of asmBlocks) {
-    let released = 0;
-    for (const ins of ab.instrs) {
-      if ((ins.mnemonic === 'pop' || ins.mnemonic === 'ldmia') && released < localArea) {
-        const base = ins.mnemonic === 'pop' ? 'sp' : (ins.ops[0] ?? '').replace(/!$/, '');
-        if (isSpReg(base)) {
-          return 'a pop reads the frame while the local area is still reserved';
-        }
-      }
-      if ((ins.mnemonic === 'add' || ins.mnemonic === 'sub') && isSpReg(ins.ops[0])) {
-        const d = spAdjust(ins);
-        if (d !== null && d > 0) {
-          released += d;
-        }
-      }
-    }
-  }
   return null;
 }
 
@@ -3437,14 +4516,18 @@ function reservedLocalArea(entry: AsmBlock): number {
   return Math.max(0, reserved);
 }
 
+/** the low registers agbcc's callers expect back intact (r0-r3 are argument and scratch) */
+const CALLEE_SAVED_LOW_REGS: ReadonlySet<string> = new Set(['r4', 'r5', 'r6', 'r7']);
+
 // WHAT THE PROLOGUE SAVED — the second half of the register partition (frontend/ssa.ts,
 // LiveInModel.uninitRegs), in operand spellings. "The ABI does not pass arguments here" is a fact
 // about the CALLER and cannot on its own make a def-less read an uninitialised local; what does is
 // that the compiler homed a local in the register, which it may only do after saving it. Asm that
 // saves nothing follows no such convention, and some of it really is handed live values there:
 // the MP2K engine's hand-written `ChnVolSetAsm`, vendored in klonoa, sa3 and pokeemerald alike,
-// takes two pointers in r4/r5 and has no prologue at all — classified by the ABI alone it lost its
-// signature and stored through reads of registers nothing ever wrote.
+// reads r4/r5 with no prologue at all — classified by the ABI alone it stored through reads of
+// registers nothing ever wrote. Unsaved, they are global register variables
+// (`LiveInModel.globalRegs`), which is what agbcc compiles `register u8 *p asm("r4")` to.
 //
 // PER REGISTER, because saving r5 says nothing about r4 — a mid-function fragment reached by
 // agbcc's `bl`-as-a-long-branch saves what it uses and is handed the rest.
@@ -3453,9 +4536,30 @@ function reservedLocalArea(entry: AsmBlock): number {
 // the set. `HIGH_REGS` have no `push` encoding, so agbcc saves them as `mov rLow, rHi; push
 // {rLow}` and the source of such a `mov` joins the set when its low register is pushed — every
 // high-register inhabitant in the corpus goes through that idiom.
-function prologueSavedRegs(entry: AsmBlock): ReadonlySet<string> {
+//
+// THAT `mov` IS THE SAVE'S, NOT THE FUNCTION'S, and is returned as `carriers` for the fill to
+// skip. Lifted, it leaves the low register holding the high one's entry value, so where a local
+// homed in each is left uninitialised on one path (`synthetic:dma_fill_uninit`: a switch with no
+// default, ten locals spread over r5-r7 and r8-sl) the two read as one undefined value, and
+// frontend/ssa.ts `markCopiedUndefs` spells that relation as an assignment between two locals the
+// source never related. What the machine relates there is the CALLER's register to its own save
+// copy; no statement of this function computed it. Skipped, the low register's def-less read is
+// its own undefined value, which the push has saved (so it is in `saved`). The blind side, which
+// the relation this drops is: a body that reads the low register before writing it and compares
+// it with the high one sees two unrelated values where the machine holds one — agbcc only does
+// this for two distinct uninitialised locals, which no statement of the source relates.
+//
+// ONLY A CALLEE-SAVED LOW REGISTER THAT AN EARLIER `push` ALREADY SAVED IS A CARRIER. That is the
+// shape agbcc emits (`push {r4-r7, lr}; mov r7, sl; mov r6, r8; push {r6, r7}`): the low register's
+// own entry value is safe in the first save, so the `mov` destroys nothing the function could
+// read. Hand-written asm may stage through anything — `mov r3, r8; push {r3}; add r0, r0, r3`
+// reads r3 as the high register's value, and skipping that `mov` there would turn r3 into the
+// caller's fourth argument. Such a `mov` is lifted as the function's own; the high register still
+// joins `saved`, as it always has.
+function prologueSavedRegs(entry: AsmBlock): { saved: ReadonlySet<string>; carriers: ReadonlySet<Instr> } {
   const saved = new Set<string>();
-  const carries = new Map<string, string>(); // low register ← the high one moved into it
+  const carriers = new Set<Instr>();
+  const carries = new Map<string, { mov: Instr; carrier: boolean }>(); // low register ← the `mov` that moved a high one into it
   for (const x of entry.instrs) {
     if (x.mnemonic === 'push') {
       const list = regListOf(x.ops);
@@ -3464,24 +4568,317 @@ function prologueSavedRegs(entry: AsmBlock): ReadonlySet<string> {
       }
       for (const r of list) {
         saved.add(r);
-        const hi = carries.get(r);
-        if (hi !== undefined) {
-          saved.add(hi);
+        const staged = carries.get(r);
+        if (staged !== undefined) {
+          saved.add(staged.mov.ops[1]);
+          if (staged.carrier) {
+            carriers.add(staged.mov);
+          }
+          carries.delete(r);
         }
       }
     } else if (/^movs?$/.test(x.mnemonic) && HIGH_REGS.has(x.ops[1] ?? '') && !HIGH_REGS.has(x.ops[0] ?? '')) {
-      carries.set(x.ops[0], x.ops[1]);
+      carries.set(x.ops[0], { mov: x, carrier: CALLEE_SAVED_LOW_REGS.has(x.ops[0]) && saved.has(x.ops[0]) });
     } else if (spAdjust(x) === null) {
       break;
     }
   }
-  return saved;
+  return { saved, carriers };
+}
+
+/** WHAT A `push` SAVES AROUND EVERY USE, ON EVERY PATH — the prologue's (`prologueSavedRegs`) and
+ *  any other. A register the function names nowhere before a `push` of it, nor after the `pop`
+ *  that restores it, along any path from the entry, and that every path restores before it
+ *  returns, is saved as surely as one the prologue saves (`saved`): its writes are undone and its
+ *  entry value is the caller's, so it is a local's home like the prologue's
+ *  (`LiveInModel.uninitRegs`). Hand-written asm saves late: `cmp r0, #0; beq .L1; push {r4}; …;
+ *  pop {r4}; .L1: bx lr` uses r4 only between its save and its restore. A `push` is nothing but a
+ *  save and a `pop` nothing but a restore, which is what lets this read them anywhere; MIPS's `sw`
+ *  and PPC's `stw` also store a value (a global register variable passed on the stack is
+ *  `sw s0,16(sp)`), so those frontends read saves only in the entry block.
+ *
+ *  A high register is saved through the `mov rLow, rHi` that stages it, and that `mov` is the
+ *  save's, provided `rLow` reaches the `push` unchanged — PROLOGUESAVEDREGS' RULE, here past the
+ *  leading run too, so the two readings of one idiom agree: `mov r0, r8; add r0, #1; push {r0}`
+ *  saves no r8. It is restored by `pop {rLow}; mov rHi, rLow` likewise, and that `pop` restores no
+ *  `rLow`: agbcc's `pop {r3, r4}; mov r8, r3; mov sl, r4; pop {r4-r7}` hands r4 sl's word first.
+ *
+ *  THE RESTORE ENDS THE SAVE. Past it the register holds the caller's value again, so a read there
+ *  is the caller's value and a write there is one the caller sees, neither of them a local's —
+ *  and the fill keeps the `pop` transparent, so a read would see the function's last write
+ *  (`push {r4}; mov r4, #5; pop {r4}; mov r0, r4` would lift `return 5;`). For the same reason a save
+ *  that some path carries unrestored to a return the frame is balanced at — a `push` whose word is
+ *  popped into another register or dropped with `add sp` — saved nothing on that path. A return
+ *  with the word still on the stack is an input whose epilogue was left out, and is not asked: the
+ *  blind side is hand-written asm that returns with its frame unbalanced, which no caller survives.
+ *
+ *  A RESTORE IS THE REGISTER'S OWN WORD, not its name. The walk keeps the stack word by word —
+ *  whose entry value each pushed word holds — and a `pop` (or a staging pop's `mov rHi, rLow`)
+ *  restores a register only when the word it loads is that register's: `push {r4, r5}; pop {r5};
+ *  pop {r4}` names both and swaps the caller's r4 and r5, and agbcc's staging with its two `mov`s
+ *  crossed swaps r8 and r9. A push labels a word with a register only while that register still
+ *  holds its entry value (`dirty`): pushed again after a write, a foreign pop or a save dropped
+ *  with `add sp`, it pushes a value of the function's, and the pop of that word restores nothing.
+ *  Where paths as deep disagree about a word, the word is no register's. Such a pop is a write the
+ *  caller sees that the fill, reading the `pop` as transparent, never shows, so a callee-saved
+ *  register one reaches a balanced return with is `leaked`, and refused outright (after the
+ *  return proof, `poppedForeign`). The blind side: where the stack is not known — paths that
+ *  disagree about its depth, a move of sp the frame walk cannot follow, a store through a
+ *  register-indexed sp address — a restore is read by name, and a store through a copy of sp
+ *  into a pushed word is not seen. `refuseReturnsNotThroughCallersLr`
+ *  asks the same word question of lr alone, on its own walk.
+ *
+ *  `misSaved` is every register a save or a restore names that some path uses outside a save, or
+ *  returns with still saved: a `pop {r4}` with no `push` before it (`mov r0, r4; pop {r4}; bx lr`),
+ *  a `push` past a read, a use past the restore, a staged `push {r3}` of r8 popped into r1. Its
+ *  writes are not all the caller's and its entry value is no global's, so `registerLiveIns`
+ *  refuses it rather than spell it either way. "Uses" is any naming in an operand, read or write. */
+const CALL_CLOBBERS = ['r0', 'r1', 'r2', 'r3', 'r12', 'r14'];
+const ALL_REGS = ['r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10', 'r11', 'r12', 'r14'];
+function bodySavedRegs(
+  blocks: readonly AsmBlock[],
+  preds: readonly (readonly number[])[],
+): { saved: ReadonlySet<string>; misSaved: ReadonlySet<string>; leaked: ReadonlyMap<string, Instr> } {
+  // What each instruction saves, restores and otherwise names; the staging `mov`s first.
+  const savesHi = new Map<Instr, string>(); // `mov rLow, rHi` ⇒ rHi, where rLow is pushed unchanged
+  const restoresHi = new Set<Instr>(); // `mov rHi, rLow` where rLow was popped unchanged
+  const stagingPops = new Map<Instr, Set<string>>(); // a `pop`'s rLow that a `mov rHi, rLow` restores through
+  for (const b of blocks) {
+    const staged = new Map<string, Instr>(); // low register ← the `mov` that put a high one there
+    const popped = new Map<string, Instr>(); // low register ← the `pop` that filled it
+    for (const x of b.instrs) {
+      const list = x.mnemonic === 'push' || x.mnemonic === 'pop' ? (regListOf(x.ops) ?? []) : [];
+      if (x.mnemonic === 'push') {
+        list.forEach((r) => staged.has(r) && savesHi.set(staged.get(r)!, staged.get(r)!.ops[1]));
+      }
+      const isMov = /^movs?$/.test(x.mnemonic);
+      const from = isMov && HIGH_REGS.has(x.ops[0] ?? '') ? popped.get(x.ops[1] ?? '') : undefined;
+      if (from !== undefined) {
+        restoresHi.add(x);
+        stagingPops.set(from, (stagingPops.get(from) ?? new Set()).add(x.ops[1]));
+      }
+      const writes = x.mnemonic === 'push' ? [] : x.mnemonic === 'pop' ? list : regWritesOf(x);
+      if (writes === 'all') {
+        staged.clear();
+        popped.clear();
+      } else {
+        for (const w of writes) {
+          staged.delete(w);
+          popped.delete(w);
+        }
+      }
+      if (x.mnemonic === 'pop') {
+        list.forEach((r) => popped.set(r, x));
+      } else if (isMov && HIGH_REGS.has(x.ops[1] ?? '') && !HIGH_REGS.has(x.ops[0] ?? '')) {
+        staged.set(x.ops[0], x);
+      }
+    }
+  }
+  const namedBy = (x: Instr): string[] => [
+    ...(x.ops.join(',').match(/(?<![\w.#])(r1[0-5]|r\d|sb|sl|fp|ip)(?![\w])/g) ?? []),
+    ...(/^(ldm|stm)/.test(x.mnemonic) ? (regListOf(x.ops.slice(1)) ?? []) : []),
+  ];
+  const savedSomewhere = new Set<string>();
+  const restoredSomewhere = new Set<string>();
+  const usedUnsaved = new Set<string>();
+  const unrestored = new Set<string>(); // still saved at a balanced return on some path
+  // Forward dataflow over two sets: the registers saved on EVERY path into each block (`cur`, a
+  // must-set; null: not reached yet) and on SOME path (`open`, a may-set) — a use needs the first,
+  // a return must find the second empty — and the frame depth (`makeFrameWalk`; null where paths
+  // disagree or it is not exact).
+  //
+  // And the STACK, word by word (`stack`, top last; null where paths disagree about its depth or a
+  // move of sp is not exact; a word null where they disagree about it): whose entry value each pushed word holds, so that a restore is a restore only when the
+  // word its `pop` loads is that register's own. `pop {r5}; pop {r4}` after `push {r4, r5}` NAMES
+  // both registers and restores neither — it swaps the caller's r4 and r5.
+  type Stack = readonly (string | null)[];
+  // `clobbered` (a may-set) is each callee-saved register a pop has loaded another word into since
+  // its last restore, with that pop: the fill reads a `pop` as transparent, so no write of the body
+  // shows it, and one that reaches a balanced return is refused here (`leaked`).
+  type State = {
+    cur: Set<string>;
+    open: Set<string>;
+    depth: number | null;
+    stack: Stack | null;
+    clobbered: Map<string, Instr>;
+    dirty: Set<string>;
+  };
+  // `dirty` (a may-set) is each register that may no longer hold its entry value: written, or loaded
+  // by a pop from a word not its own, since the entry or its last restore. A push labels a word with
+  // a register only while it is not: `push {r4}; mov r4, r0; add sp, #4; push {r4}; pop {r4}` pushes
+  // a0 the second time, and that pop is no restore — however its push named the register.
+  const stateIn: (State | null)[] = blocks.map((_, i) =>
+    i === 0 ? { cur: new Set(), open: new Set(), depth: 0, stack: [], clobbered: new Map(), dirty: new Set() } : null,
+  );
+  const leaked = new Map<string, Instr>();
+  const word = (r: string) => canonReg(r) ?? r;
+  const walk = (b: number, record: boolean): State => {
+    const cur = new Set(stateIn[b]!.cur);
+    const open = new Set(stateIn[b]!.open);
+    const clobbered = new Map(stateIn[b]!.clobbered);
+    const dirty = new Set(stateIn[b]!.dirty);
+    const frame = makeFrameWalk({ argRegs: [], start: stateIn[b]!.depth });
+    let stack: (string | null)[] | null = stateIn[b]!.stack === null ? null : [...stateIn[b]!.stack!];
+    const holds = new Map<string, string>(); // low register ← the high one a save's staging `mov` copied
+    const loaded = new Map<string, string | null>(); // a staging pop's low register ← whose word it loaded
+    for (const x of blocks[b].instrs) {
+      const before = frame.depthNow();
+      frame.step(x);
+      const after = frame.depthNow();
+      const saves = x.mnemonic === 'push' ? (regListOf(x.ops) ?? []) : savesHi.has(x) ? [savesHi.get(x)!] : [];
+      const named =
+        x.mnemonic === 'pop'
+          ? (regListOf(x.ops) ?? []).filter((r) => !stagingPops.get(x)?.has(r))
+          : restoresHi.has(x)
+            ? [x.ops[0]]
+            : [];
+      // Which of them the word they load really restores: all, by name, where the stack is not known.
+      let own: ((r: string) => boolean) | null = null;
+      const list = x.mnemonic === 'push' || x.mnemonic === 'pop' ? byRegNumber(regListOf(x.ops) ?? []) : null;
+      if (x.mnemonic === 'push') {
+        // a push stores its highest-numbered register deepest
+        // a word is a register's own only while that register holds its entry value (`dirty`)
+        const label = (r: string) => (dirty.has(holds.get(r) ?? r) ? null : (holds.get(r) ?? r));
+        stack = stack === null || list === null ? null : [...stack, ...list.map(label).reverse()];
+      } else if (x.mnemonic === 'pop') {
+        if (stack === null || list === null || stack.length < list.length) {
+          stack = null;
+        } else {
+          const popped = new Map(list.map((r) => [r, stack!.pop()!] as const));
+          own = (r) => popped.get(word(r)) === word(r);
+          stagingPops.get(x)?.forEach((r) => loaded.set(word(r), popped.get(word(r)) ?? null));
+        }
+      } else if (restoresHi.has(x)) {
+        const from = loaded.get(word(x.ops[1]));
+        own = stack === null || from === undefined ? null : (r) => from === word(r);
+      } else if (stack !== null && /^str[bh]?$/.test(x.mnemonic) && isSpReg(parseAddr(x.ops[1] ?? '').base)) {
+        // a store into a pushed word replaces what it holds
+        const { off, regOff } = parseAddr(x.ops[1] ?? '');
+        if (regOff !== undefined) {
+          stack = null;
+        } else if (Math.floor(off / 4) < stack.length) {
+          stack[stack.length - 1 - Math.floor(off / 4)] = null;
+        }
+      } else if (stack !== null && before !== after) {
+        // any other move of sp (`sub sp, #8`, `add sp, #4`) pushes or drops whole anonymous words
+        const words = before === null || after === null || (after - before) % 4 !== 0 ? null : (after - before) / 4;
+        stack =
+          words === null || stack.length + words < 0
+            ? null
+            : words > 0
+              ? [...stack, ...Array<null>(words).fill(null)]
+              : stack.slice(0, stack.length + words);
+      }
+      const writes = x.mnemonic === 'push' ? [] : x.mnemonic === 'pop' ? (regListOf(x.ops) ?? []) : regWritesOf(x);
+      if (writes === 'all') {
+        holds.clear();
+        // a call leaves the registers the ABI has it preserve; anything else unread may write any
+        (/^(bl|blx|swi)$/.test(x.mnemonic) ? CALL_CLOBBERS : ALL_REGS).forEach((r) => dirty.add(r));
+      } else {
+        writes.forEach((r) => {
+          holds.delete(word(r));
+          dirty.add(word(r));
+        });
+      }
+      if (savesHi.has(x)) {
+        holds.set(word(x.ops[0]), word(savesHi.get(x)!));
+      }
+      const restores = own === null ? named : named.filter(own);
+      const uses =
+        x.mnemonic === 'push'
+          ? []
+          : savesHi.has(x)
+            ? [x.ops[0]]
+            : [...named, ...namedBy(x), ...(x.mnemonic === 'pop' ? (regListOf(x.ops) ?? []) : [])];
+      if (record) {
+        saves.forEach((r) => savedSomewhere.add(r));
+        named.forEach((r) => restoredSomewhere.add(r));
+        uses.filter((r) => !cur.has(r)).forEach((r) => usedUnsaved.add(r));
+      }
+      saves
+        .filter((r) => !uses.includes(r))
+        .forEach((r) => {
+          cur.add(r);
+          open.add(r);
+        });
+      restores.forEach((r) => {
+        cur.delete(r);
+        open.delete(r);
+        clobbered.delete(word(r));
+        dirty.delete(word(r));
+      });
+      // A pop that loads another register's word writes this one and restores nothing: it is no
+      // longer saved, and its own save, still open, is unrestored at a balanced return.
+      named
+        .filter((r) => !restores.includes(r))
+        .forEach((r) => {
+          cur.delete(r);
+          if (/^r([4-9]|1[01])$/.test(word(r))) {
+            clobbered.set(word(r), x);
+          }
+        });
+      // Only a return the frame is balanced at: one with the `push` still on the stack is an
+      // input whose epilogue was left out (a fragment, a fixture), which the prologue's reading
+      // has always taken as restored.
+      if (record && classifyXfer(x) === 'return' && frame.depthNow() === 0) {
+        open.forEach((r) => unrestored.add(r));
+        clobbered.forEach((at, r) => leaked.has(r) || leaked.set(r, at));
+      }
+    }
+    return { cur, open, depth: frame.depthNow(), stack, clobbered, dirty };
+  };
+  const sameStack = (x: Stack | null, y: Stack | null) =>
+    x === null || y === null ? x === y : x.length === y.length && x.every((w, i) => w === y[i]);
+  // Paths whose stacks are as deep keep each word they agree on, and the rest is no register's: a
+  // pop of it restores nothing. Paths that disagree about the depth leave the stack unknown.
+  const joinStacks = (xs: readonly (Stack | null)[]): Stack | null =>
+    xs.some((x) => x === null || x.length !== xs[0]!.length)
+      ? null
+      : xs[0]!.map((w, i) => (xs.every((x) => x![i] === w) ? w : null));
+  const sameSet = (x: ReadonlySet<string>, y: ReadonlySet<string>) =>
+    x.size === y.size && [...x].every((r) => y.has(r));
+  for (let changed = true; changed;) {
+    changed = false;
+    for (let b = 1; b < blocks.length; b++) {
+      const ins = preds[b].filter((p) => stateIn[p] !== null).map((p) => walk(p, false));
+      if (ins.length === 0) {
+        continue;
+      }
+      const cur = new Set([...ins[0].cur].filter((r) => ins.every((s) => s.cur.has(r))));
+      const open = new Set(ins.flatMap((s) => [...s.open]));
+      const depth = ins.every((s) => s.depth === ins[0].depth) ? ins[0].depth : null;
+      const stack = joinStacks(ins.map((s) => s.stack));
+      const clobbered = new Map(ins.flatMap((s) => [...s.clobbered]));
+      const dirty = new Set(ins.flatMap((s) => [...s.dirty]));
+      const was = stateIn[b];
+      if (
+        was === null ||
+        was.cur.size !== cur.size ||
+        was.open.size !== open.size ||
+        was.depth !== depth ||
+        !sameStack(was.stack, stack) ||
+        was.clobbered.size !== clobbered.size ||
+        !sameSet(was.dirty, dirty)
+      ) {
+        stateIn[b] = { cur, open, depth, stack, clobbered, dirty };
+        changed = true;
+      }
+    }
+  }
+  blocks.forEach((_, b) => stateIn[b] !== null && walk(b, true));
+  const mis = (r: string) => usedUnsaved.has(r) || unrestored.has(r);
+  return {
+    saved: new Set([...savedSomewhere].filter((r) => !mis(r))),
+    misSaved: new Set([...savedSomewhere, ...restoredSomewhere].filter(mis)),
+    leaked,
+  };
 }
 
 /** How the fill reads and writes an operand: the guards that keep sp, pc and a data label from
  *  being read or written as a register, and the function-scope statics a pool word names. */
 interface ThumbOperands {
   localStatic(symbol: string): string;
+  anonymousObject(label: string): string;
   constVal(n: number, b: number): Value;
   spAsDataError(): FrontendUnsupportedError;
   readData(r: string, b: number): Value;
@@ -3523,6 +4920,22 @@ function thumbOperands({
     return statics.define(read);
   };
 
+  /** The compiler's anonymous constant a pool word names (agbcc's `.LC0`), read out of this same
+   *  asm and recorded beside the statics — or a decline naming why it is not one. Unlike a static,
+   *  it need not be this function's alone: agbcc places one image for every identical constant in
+   *  a unit (varasm.c `output_constant_def` hashes them), and each function that copies it spells
+   *  its own initializer, which the recompiled unit shares again. */
+  const anonymousObject = (label: string): string => {
+    const read = readGasAnonymousObject(asm, label);
+    if ('refused' in read) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': literal-pool load of a pool word that names the compiler's anonymous data ` +
+          `('${label}') ${read.refused}`,
+      );
+    }
+    return statics.define(read);
+  };
+
   const constVal = (n: number, b: number): Value => {
     const v = mkValue(T.unk(32));
     irBlocks[b].ops.push(mkOp('const', { results: [v], attrs: { value: n } }));
@@ -3632,7 +5045,7 @@ function thumbOperands({
     }
     writeVar(r, b, v);
   };
-  return { localStatic, constVal, spAsDataError, readData, writeData };
+  return { localStatic, anonymousObject, constVal, spAsDataError, readData, writeData };
 }
 
 /** One half of a 64-bit value this lift projected into a register. */
@@ -3647,21 +5060,30 @@ interface PairHalf {
 interface ThumbPairs {
   readonly halfOf: ReadonlyMap<Value, PairHalf>;
   readonly wordReturns: { bi: number; lo: Value; widerEpilogue: boolean }[];
+  /** what r1 may hold at each word return, where no declaration pins the width (dead-reads.ts
+   *  `unreadPairHalf`) */
+  readonly unreadHigh: Set<Value>;
   projectHalf(irb: Block, whole: Value, half: 'lo' | 'hi', at: Instr): Value;
   fuseHalves(irb: Block, lo: Value, hi: Value): Value;
   wideReturn(lo: Value, bi: number): Value | null;
+  /** record a return of one word in block `bi`, for `refuseWordReturns` and the dead-read pin */
+  noteWordReturn(bi: number, lo: Value, widerEpilogue: boolean): void;
   refuseWordReturns(): void;
 }
 
 function thumbPairs({
   name,
   target,
+  own,
+  ownMemoryReturn,
   ssa,
   asmBlocks,
   callClobbers,
 }: {
   name: string;
   target: TargetDescription;
+  own: FnProto | undefined;
+  ownMemoryReturn: LiftOptions['ownMemoryReturn'];
   ssa: SsaBuilder;
   asmBlocks: readonly AsmBlock[];
   callClobbers: readonly string[];
@@ -3725,6 +5147,7 @@ function thumbPairs({
   // epilogue says the return type is 5 to 8 bytes — judged by `refuseWordReturns` once every block
   // is filled.
   const wordReturns: ThumbPairs['wordReturns'] = [];
+  const unreadHigh = new Set<Value>();
   /** THE WORD RETURNS THAT WOULD DROP A HIGH HALF, refused. Run after every block is filled and
    *  before `ssa.finish()`: a join's phi operands are wired by then, and not yet folded away.
    *
@@ -3741,7 +5164,10 @@ function thumbPairs({
    *  eightByteReturnScratch`), over r0:r1 that hold no pair this lift built — a high word computed
    *  from shifts, a `double`, or an 8-byte aggregate returned through memory, which agbcc sizes
    *  the same way. A word return drops r1 in the first two, and the third is a false decline the
-   *  epilogue cannot tell apart from them. */
+   *  epilogue cannot tell apart from them — save where the function's own declaration says it
+   *  returns a struct of 5 to 8 bytes through memory (`ownMemoryReturn`): the refusal is then
+   *  deferred to the pipeline, which throws it unless the lift proves r0 is only that struct's
+   *  storage (frontend/own-struct-return.ts), and that proof is what tells the third case apart. */
   const refuseWordReturns = () => {
     const classes = halfOf.size ? mergeClasses({ blocks: ssa.irBlocks }) : new Map<Value, readonly Value[]>();
     const carries = (v: Value, half: 'lo' | 'hi') => (classes.get(v) ?? [v]).some((m) => halfOf.get(m)?.half === half);
@@ -3758,14 +5184,31 @@ function thumbPairs({
         );
       }
       if (widerEpilogue) {
-        throw new FrontendUnsupportedError(
-          `cannot lift '${name}': the epilogue of '${asmBlocks[bi].label}' says the return type is 5 to 8 bytes ` +
-            '(a 64-bit integer, a double, or an 8-byte aggregate), and no 64-bit pair this lift built is in r0:r1',
-        );
+        const label = asmBlocks[bi].label;
+        // `unproved`: why the declared struct, which would explain the epilogue, is not shown to be it
+        const refuse = (unproved?: string): never => {
+          throw new FrontendUnsupportedError(
+            `cannot lift '${name}': the epilogue of '${label}' says the return type is 5 to 8 bytes ` +
+              '(a 64-bit integer, a double, or an 8-byte aggregate), and no 64-bit pair this lift built is in r0:r1' +
+              (unproved === undefined
+                ? ''
+                : `; the ${ownMemoryReturn!.bytes}-byte struct its own declaration returns through r0 would explain it, ` +
+                  `but the lift cannot show r0 is only that struct's storage: ${unproved}`),
+          );
+        };
+        if (ownMemoryReturn !== undefined && ownMemoryReturn.bytes > 4 && ownMemoryReturn.bytes <= 8) {
+          ownMemoryReturn.defer(refuse);
+          continue;
+        }
+        refuse();
       }
     }
   };
-  return { halfOf, wordReturns, projectHalf, fuseHalves, wideReturn, refuseWordReturns };
+  const noteWordReturn = (bi: number, lo: Value, widerEpilogue: boolean): void => {
+    wordReturns.push({ bi, lo, widerEpilogue });
+    unreadPairHalf(ssa, own, target.argRegs[1], bi, unreadHigh);
+  };
+  return { halfOf, wordReturns, unreadHigh, noteWordReturn, projectHalf, fuseHalves, wideReturn, refuseWordReturns };
 }
 
 /** Whether, from instruction `from` of block `bi` to its end, nothing puts into the pair's high
@@ -3840,6 +5283,10 @@ function highRegisterHeld(ab: AsmBlock, from: number, hi: string, callClobbers:
 interface ThumbFlagCarry {
   readonly exitCmp: Map<number, PendingCmp | string>;
   inheritedCmp(bi: number): PendingCmp | string;
+  /** every value a `cmp` compared, whether or not a branch reads the flags it set: a compare
+   *  nothing reads leaves no op, so this is the only record that the value was consumed (the
+   *  dead-read pin's `compared`, frontend/dead-reads.ts) */
+  readonly compared: Set<Value>;
 }
 
 function thumbFlagCarry({ asmBlocks, preds }: ThumbCfg, tables: ReadonlyMap<AsmBlock, JumpTable>): ThumbFlagCarry {
@@ -3875,7 +5322,7 @@ function thumbFlagCarry({ asmBlocks, preds }: ThumbCfg, tables: ReadonlyMap<AsmB
         return plast !== undefined && classifyXfer(plast) === 'cond';
       },
     });
-  return { exitCmp, inheritedCmp };
+  return { exitCmp, inheritedCmp, compared: new Set<Value>() };
 }
 
 /** The two frame facts the fill accumulates and the frame-object audit reads: every offset the
@@ -3885,6 +5332,9 @@ function thumbFlagCarry({ asmBlocks, preds }: ThumbCfg, tables: ReadonlyMap<AsmB
 interface ThumbFrameUses {
   readonly usedSlotOffsets: Set<number>;
   readonly movedCaptures: Set<Value>;
+  /** the blocks other than the entry that read an incoming stack argument
+   *  (`ThumbFrame.settledDepth`), which `lowerCall`'s `withholdsSetupArgs` reads */
+  readonly offEntryArgReads: Set<number>;
 }
 
 /** WHAT THE FILL OF A BLOCK READS: the records of the stages before it, the SSA builder it writes
@@ -3904,6 +5354,13 @@ interface ThumbFill {
   /** the function-scope statics the operands define, finished into the lifted function's objects */
   readonly statics: LocalStatics;
   readonly frameUses: ThumbFrameUses;
+  /** What an elided or kept dispatch left in its idiom's registers, by the value standing for each. */
+  readonly staleIdiomValues: Map<Value, StaleIdiomRead>;
+  /** What an elided dispatch left at each case target's entry, by block index. */
+  readonly caseEntries: ReadonlyMap<number, CaseEntry>;
+  /** Each callee-saved register a `pop` loads another word into and that reaches a balanced return
+   *  so (`bodySavedRegs`'s `leaked`), with that pop: refused once the return proof has run. */
+  readonly poppedForeign: ReadonlyMap<string, Instr>;
 }
 
 /** EVERY STAGE BEFORE THE FILL, in their refusal order: the text, the CFG, the target's scratch
@@ -3917,33 +5374,63 @@ function thumbFillOf(
   prototypes: Prototypes,
   symbols: SymbolMap | undefined,
   oneObject: FrameRange | undefined,
+  {
+    contextOwnWords,
+    contextOwnProto,
+    ownMemoryReturn,
+  }: Pick<LiftOptions, 'contextOwnWords' | 'contextOwnProto' | 'ownMemoryReturn'> = {},
 ): ThumbFill {
-  const text = readThumbText(name, asm);
+  const text = readThumbText(name, asm, target.compilerBehaviors.farJumpRelay?.comment);
   const cfg = thumbCfg(name, text.blocks, text.tables);
-  const scratchRegs = assertScratchRegsPartitioned(target);
-  const calls = callDeclarations(name, target, prototypes, THUMB_CALL_LOWERING, (message) => {
-    throw new FrontendUnsupportedError(message);
+  assertScratchRegsPartitioned(target); // first, for the refusal order; `registerLiveIns` asks again
+  const calls = callDeclarations(
+    name,
+    target,
+    prototypes,
+    THUMB_CALL_LOWERING,
+    (message) => {
+      throw new FrontendUnsupportedError(message);
+    },
+    () => ownDeclarationOf(name, prototypes, contextOwnProto),
+  );
+  const frame = measureThumbFrame({
+    name,
+    target,
+    cfg,
+    calls,
+    oneObject,
+    own: ownDeclarationOf(name, prototypes, contextOwnProto),
   });
-  const frame = measureThumbFrame({ target, cfg, calls, oneObject });
 
   // --- ISA-neutral SSA construction (shared Braun builder) ---
   // THE LIVE-IN MODEL is the frame's partition (`ThumbFrame.partition`) and a register half.
   // The register half needs both of its facts, and they come from different places. The target says
   // which registers no caller can hand a value over in; `savedRegs` says which ones THIS function
-  // saved, and so could have homed a local in. A register in only the first is one the ABI does not
-  // describe — hand-written asm with a private convention, or a mid-function fragment — and it keeps
-  // the treatment a target claiming no partition gets. The save is asked only of the registers the
-  // ABI requires preserving: `target.scratchRegs` need none, so demanding one there would refuse a
-  // local the compiler was entitled to put in place with no prologue at all.
-  const ssa = makeSsaBuilder(name, cfg.asmBlocks.length, cfg.preds, () => ({
-    ...frame.partition,
-    ...(target.nonArgRegs
-      ? {
-          uninitRegs: target.nonArgRegs.filter((r) => scratchRegs.has(r) || frame.savedRegs.has(r)),
-          argRegs: target.argRegs,
-        }
-      : {}),
-  }));
+  // saved, and so could have homed a local in — in its prologue, or by a `push` ahead of every use
+  // (`bodySavedRegs`). A register in only the first is one the function shares with every other: a
+  // global register variable, or a refusal where the target cannot spell one. The save is asked only
+  // of the registers the ABI requires preserving: `target.scratchRegs` need none, so demanding one
+  // there would refuse a local the compiler was entitled to put in place with no prologue at all.
+  // `registerLiveIns` (frontend/ssa.ts) composes it, as it does for PPC. The function's own
+  // declaration bounds the argument registers (`ownArgumentWordsOn`): agbcc homes a local in r3 past
+  // a two-parameter one.
+  // A prologue save that some path uses past its restore, or carries to a return unrestored, is
+  // `misSaved` and no save: the prologue's reading of it sees only the `push`.
+  const body = bodySavedRegs(cfg.asmBlocks, cfg.preds);
+  const liveIns = registerLiveIns(
+    target,
+    new Set([...frame.savedRegs, ...body.saved].filter((r) => !body.misSaved.has(r))),
+    contextOwnWords ?? ownArgumentWordsOn(name, prototypes[name], target),
+    body.misSaved,
+  );
+  const ssa = makeSsaBuilder(
+    name,
+    cfg.asmBlocks.length,
+    cfg.preds,
+    () => ({ ...frame.partition, ...liveIns, saveSite: '`push` ahead of every use' }),
+    undefined,
+    liveIns.globalRegs,
+  );
   const statics = makeLocalStatics();
   const operands = thumbOperands({
     name,
@@ -3953,7 +5440,15 @@ function thumbFillOf(
     statics,
     slotsOffReason: frame.slotsOffReason,
   });
-  const pairs = thumbPairs({ name, target, ssa, asmBlocks: cfg.asmBlocks, callClobbers: calls.callClobbers });
+  const pairs = thumbPairs({
+    name,
+    target,
+    own: prototypes[name],
+    ownMemoryReturn,
+    ssa,
+    asmBlocks: cfg.asmBlocks,
+    callClobbers: calls.callClobbers,
+  });
   const flags = thumbFlagCarry(cfg, text.tables);
   return {
     name,
@@ -3968,10 +5463,36 @@ function thumbFillOf(
     pairs,
     flags,
     statics,
-    frameUses: { usedSlotOffsets: new Set(), movedCaptures: new Set() },
+    frameUses: {
+      usedSlotOffsets: new Set(),
+      movedCaptures: new Set(),
+      offEntryArgReads: new Set(),
+    },
+    staleIdiomValues: new Map(),
+    caseEntries: elidedCaseEntries(cfg, text.tables),
+    poppedForeign: body.leaked,
   };
 }
 
+/** Each case target of an ELIDED dispatch, with what the idiom left at its entry (jump-table.ts
+ *  `caseEntries`). A kept dispatch's block is lifted and leaves its markers at its own end
+ *  (`lowerTerminator`), where the default path never goes. */
+function elidedCaseEntries(cfg: ThumbCfg, tables: ReadonlyMap<AsmBlock, JumpTable>): Map<number, CaseEntry> {
+  const at = (label: string) => cfg.labelIndex.get(label)!;
+  return caseEntries(
+    [...tables]
+      .filter(([, jt]) => jt.extras.length === 0)
+      .map(([ab, jt]) => ({
+        at: at(ab.label),
+        scrutReg: jt.scrutReg,
+        cases: jt.caseLabels.map(at),
+        defaultBlock: at(jt.defaultLabel),
+        leaves: jt.leaves,
+      })),
+    cfg.preds,
+  );
+}
+
 type FrameWalk = ReturnType<typeof makeFrameWalk>;
 
 /** ONE BLOCK BEING FILLED, and the three things that change as its instructions are read: the
@@ -3985,10 +5506,28 @@ interface BlockCursor {
   pendingCmp: PendingCmp | null;
   noCmpWhy: string;
   consumed: Instr | null;
+  /** A kept jump-table dispatch's scrutinee, read at the block's entry (`lowerTerminator`). */
+  readonly dispatchScrutinee: Value | null;
 }
 
-function openBlockCursor({ target, cfg, ssa, flags }: ThumbFill, ab: AsmBlock, bi: number): BlockCursor {
+function openBlockCursor(fill: ThumbFill, ab: AsmBlock, bi: number): BlockCursor {
+  const { target, text, cfg, ssa, flags, frame } = fill;
   const irb = ssa.irBlocks[bi];
+  // A case target of an elided dispatch is entered with what the idiom left in its registers.
+  const entry = fill.caseEntries.get(bi);
+  if (entry !== undefined) {
+    enterCaseTarget(
+      entry,
+      irb.ops,
+      {
+        key: reg,
+        scrutinee: (r) => ssa.readVar(reg(r), bi),
+        dispatchScrutinee: (r) => ssa.readAtEnd(reg(r), entry.at),
+        write: (r, v) => ssa.writeVar(reg(r), bi, v),
+      },
+      fill.staleIdiomValues,
+    );
+  }
   // Seeded at the block's FIRST instruction, not at its terminator, so an inherited compare is
   // judged by the in-block clear (`retireFlags`) exactly as one this block made itself would be: a
   // block that inherits flags and then writes its own must lose them.
@@ -3998,13 +5537,15 @@ function openBlockCursor({ target, cfg, ssa, flags }: ThumbFill, ab: AsmBlock, b
   // that made a compare and then overwrote it is a different gap from one that never had a
   // compare at all, and a single message for both makes two gaps read as one.
   const noCmpWhy = typeof inherited === 'string' ? inherited : '';
-  // Tracks the frame through this block's linear instruction order. Meaningful for the entry
-  // block; elsewhere a `[sp,#N]` access declines. Both dependencies are read HERE rather than
-  // closed over: `preds` is final long before the first `fillThumbBlock` runs, so the boolean is the
-  // same for every block, and passing it in makes that a property of this line instead of a
-  // property of wherever the walk happens to be declared.
-  const walk = makeFrameWalk({ argRegs: target.argRegs, entryHasPreds: cfg.preds[0].length > 0 });
-  return { ab, bi, irb, walk, pendingCmp, noCmpWhy, consumed: null };
+  // Tracks the frame through this block's linear instruction order, from the depth the block starts
+  // at: 0 for an entry block nothing branches back to (its params are parameters, not phis), and
+  // the depth the entry leaves for every other block where the frame is proven settled
+  // (`ThumbFrame.settledDepth`). Elsewhere a `[sp,#N]` access declines.
+  const start = bi === 0 ? (cfg.preds[0].length > 0 ? null : 0) : frame.settledDepth;
+  const walk = makeFrameWalk({ argRegs: target.argRegs, start });
+  const jt = text.tables.get(ab);
+  const dispatchScrutinee = jt && jt.extras.length > 0 ? ssa.readVar(reg(jt.scrutReg), bi) : null;
+  return { ab, bi, irb, walk, pendingCmp, noCmpWhy, consumed: null, dispatchScrutinee };
 }
 
 /** Fill block `bi`: lower each instruction in order, record what the block leaves in the flags,
@@ -4031,6 +5572,9 @@ function fillThumbBlock(fill: ThumbFill, ab: AsmBlock, bi: number): void {
     switch (ins.mnemonic) {
       case 'mov':
       case 'movs': {
+        if (fill.frame.saveCarriers.has(ins)) {
+          break; // the save's staging copy, not the function's (`prologueSavedRegs`)
+        }
         lowerMov(fill, cur, ins);
         break;
       }
@@ -4166,6 +5710,11 @@ function fillThumbBlock(fill: ThumbFill, ab: AsmBlock, bi: number): void {
         }
         const rhs = b.startsWith('#') ? constVal(imm(b), bi) : readData(reg(b), bi);
         cur.pendingCmp = { lhs: readData(reg(a), bi), rhs };
+        fill.flags.compared.add(cur.pendingCmp.lhs).add(rhs);
+        break;
+      }
+      case 'cmn': {
+        lowerCmn(fill, cur, ins);
         break;
       }
       case 'ldr':
@@ -4209,6 +5758,25 @@ function fillThumbBlock(fill: ThumbFill, ab: AsmBlock, bi: number): void {
   lowerTerminator(fill, cur);
 }
 
+/** `cmn rA, rB` as the compare it stands for, `cmp rA, -rB`: it records both registers' values and
+ *  the terminator mints the negation once it knows which branch reads it (`CMN_EXACT`). Thumb-1
+ *  encodes `cmn` on low registers only; hand-written text with any other operand takes the flags
+ *  with nothing modelled, exactly as `tst` does. */
+function lowerCmn(fill: ThumbFill, cur: BlockCursor, ins: Instr): void {
+  const { readData } = fill.operands;
+  const [a, b] = ins.ops;
+  if (a === undefined || b === undefined || !/^r[0-7]$/.test(reg(a)) || !/^r[0-7]$/.test(reg(b))) {
+    cur.noCmpWhy = `the flags it tests were written by 'cmn' in '${cur.ab.label}', and only a register 'cmn' is modelled`;
+    cur.pendingCmp = null;
+    emitOpaqueDest(fill, cur, ins);
+    return;
+  }
+  const lhs = readData(reg(a), cur.bi);
+  const rhs = readData(reg(b), cur.bi);
+  cur.pendingCmp = { lhs, rhs, cmn: true };
+  fill.flags.compared.add(lhs).add(rhs);
+}
+
 /** What an instruction does to the flags the block holds: a writer retires the compare, and
  *  `noCmpWhy` names it. */
 function retireFlags(cur: BlockCursor, ins: Instr): void {
@@ -4238,7 +5806,8 @@ function retireFlags(cur: BlockCursor, ins: Instr): void {
   // The inhabitant the guard itself exists for is hand-written asm in the playground, where
   // there is no oracle to catch a lie.
   //
-  // `tst`/`cmn` take them with no destination to read at all (`FLAG_ONLY`, above).
+  // `tst` takes them with no destination to read at all (`FLAG_ONLY`, above). `cmn` is a compare
+  // and seeds its own (`lowerCmn`), as `cmp` does.
   //
   // A CALL takes them too, and this is the one flag writer that is not an instruction: `bl`
   // writes no flags, but the function it enters retires compares of its own, and the ABI lets
@@ -4428,6 +5997,10 @@ function lowerMov(fill: ThumbFill, cur: BlockCursor, ins: Instr): void {
   // a reserved local area for the object to live in.
   if (!b?.startsWith('#') && isSpReg(b ?? '') && !isSpReg(a ?? '')) {
     if (frame.slotsOk && frame.localArea > 0) {
+      // a copy only a narrow slot reload reads names no object; the reload reads the slot
+      if (frame.narrowReloadCopies.has(ins)) {
+        return;
+      }
       const res = mkValue(T.unk(32));
       irb.ops.push(mkOp('laddr', { results: [res], attrs: { off: 0 } }));
       writeData(reg(a), bi, res);
@@ -4462,6 +6035,9 @@ function lowerAdd(fill: ThumbFill, cur: BlockCursor, ins: Instr, ii: number): vo
   // audit; only the offset differs.
   if (isSpReg(b ?? '') && !isSpReg(a ?? '') && c !== undefined && IMM_LITERAL.test(c)) {
     if (frame.slotsOk && frame.localArea > 0) {
+      if (frame.narrowReloadCopies.has(ins)) {
+        return; // see lowerMov
+      }
       const res = mkValue(T.unk(32));
       irb.ops.push(mkOp('laddr', { results: [res], attrs: { off: imm(c) } }));
       writeData(reg(a), bi, res);
@@ -4656,6 +6232,9 @@ function lowerBlockTransfer(fill: ThumbFill, cur: BlockCursor, ins: Instr): void
     const adv = mkValue(T.unk(32));
     irb.ops.push(mkOp('add', { operands: [base0, constVal(4 * list.length, bi)], results: [adv] }));
     writeData(baseReg, bi, adv);
+    // agbcc's block copy leaves this dead in an argument register before a call (`ssa.ts`
+    // `noteIncidentalWrite`), so it proves no argument there.
+    fill.ssa.noteIncidentalWrite(adv);
   }
 }
 
@@ -4665,7 +6244,7 @@ function lowerLoad(fill: ThumbFill, cur: BlockCursor, ins: Instr): void {
   const { name, symbols, text, frame, ssa } = fill;
   const { readVar } = ssa;
   const { usedSlotOffsets } = fill.frameUses;
-  const { localStatic, readData, writeData } = fill.operands;
+  const { localStatic, anonymousObject, readData, writeData } = fill.operands;
   const { bi, irb, walk } = cur;
   const [a, b] = ins.ops;
   // A word load whose operand NAMES a literal pool is a pool reference, not a memory base:
@@ -4677,7 +6256,11 @@ function lowerLoad(fill: ThumbFill, cur: BlockCursor, ins: Instr): void {
     // A function-scope static is the address of an object this function DEFINES: the
     // `gaddr` below under its linker name, with the definition recorded beside the Fn.
     const pr: PoolRef | null =
-      ref?.kind === 'local-static' ? { kind: 'gaddr', sym: localStatic(ref.symbol), addend: ref.addend } : ref;
+      ref?.kind === 'local-static'
+        ? { kind: 'gaddr', sym: localStatic(ref.symbol), addend: ref.addend }
+        : ref?.kind === 'anonymous'
+          ? { kind: 'gaddr', sym: anonymousObject(ref.label), addend: 0 }
+          : ref;
     if (pr?.kind === 'const') {
       // Numeric-pool PROMOTION (symbols.ts): a pool-loaded word whose value the
       // project's symbol map knows becomes the NAMED global's address — the same
@@ -4769,12 +6352,58 @@ function lowerLoad(fill: ThumbFill, cur: BlockCursor, ins: Instr): void {
   // `argIndex` can make, and the soundness proof that each one is needed for, lives on the
   // predicate itself — restating them here is how the two copies drifted.
   {
-    const index = walk.argIndex({ base, off, regOff }, width, bi);
+    const index = walk.argIndex({ base, off, regOff }, width);
     if (index !== null) {
+      if (bi !== 0) {
+        fill.frameUses.offEntryArgReads.add(bi);
+      }
       writeData(reg(a), bi, readVar(stackArgKey(index), bi));
       return;
     }
   }
+  // WHICH RELOADS OF THIS FUNCTION'S OWN FRAME ARE SLOT READS — the dual of the spill in the str
+  // arm, and the whole soundness of it. The narrow reload next and the word reload below both ask
+  // it.
+  //
+  // One a store reaches on some path reads that store, and a path that brings none reads an
+  // uninitialised local: the frame is `ownedLocals`, so `readVar` answers that path with `undef`,
+  // never with a parameter (frontend/ssa.ts `LiveInModel`).
+  //
+  // A slot NO store reaches, on any path, is the same local read before any store — `if (k > 5)
+  // use(v0); … v0 = p[0];`, or a local the source never initialises. Only two kinds of callee
+  // could have written it instead. One that assigned the word as its own stack parameter ran
+  // before the load, so the load is after a call, which the after-call layout claim
+  // (`localsAboveOutgoingArea`) says no word of the outgoing area is; with no call reaching the
+  // load there is no such callee. Without the claim it may be one, and falls through to the
+  // decline. The stronger `outgoingAreaNeverLoadedFrom` adds nothing here: a load BEFORE a call reads
+  // a staged word, and a staged word has a reaching store. The other is a callee holding an
+  // address of the frame, which the frame-object audit refuses: an `undef` slot an escaped writer
+  // reaches (`writer-over-undef`), or one a captured object overlaps.
+  const readsOwnSlot = (at: string, o: number, ro: string | undefined, w: number): boolean =>
+    frame.isOwnFrameWordSlot(at, o, ro, w) &&
+    (ssa.hasReachingDef(stackSlotKey(o), bi) || fill.target.compilerBehaviors.localsAboveOutgoingArea === true);
+  // A NARROW RELOAD OF A WORD SLOT through a copy of sp nothing else reads (`narrowSlotReloads`):
+  // the low-order part of the word the slot holds, so the slot's value narrowed — taken where the
+  // word reload of the slot would be, and the slot is no object's. Its copy was not lifted, so a
+  // reload this cannot take refuses here rather than reading through a register never set.
+  {
+    const slot = frame.narrowReloadOf.get(ins);
+    if (slot !== undefined) {
+      if (!readsOwnSlot('sp', slot, undefined, 4) || frame.isFrameObjectAccess('sp', slot, undefined, 4)) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': narrow reload of a stack local through a copy of sp — ` +
+            `'${ins.mnemonic} ${ins.ops.join(', ')}' reads the word slot [sp,#${slot}], which the word-slot model does not key here`,
+        );
+      }
+      usedSlotOffsets.add(slot);
+      const res = mkValue(T.unk(32));
+      irb.ops.push(
+        mkOp('zext', { operands: [readVar(stackSlotKey(slot), bi)], results: [res], attrs: { width: 8 * width } }),
+      );
+      writeData(reg(a), bi, res);
+      return;
+    }
+  }
   // An address-taken object comes FIRST: it is memory, not a slot, so it is
   // read with a real `load` through its `laddr` (see isFrameObjectAccess). No
   // reaching-def test — the callee holding the address is a writer this function cannot
@@ -4787,16 +6416,8 @@ function lowerLoad(fill: ThumbFill, cur: BlockCursor, ins: Instr): void {
     writeData(reg(a), bi, res);
     return;
   }
-  // A word reload from this function's own frame — the dual of the spill in the str arm.
-  //
-  // The reaching-def test is the whole soundness of it, and it mirrors the MIPS guard
-  // exactly: a slot that was never STORED holds nothing this function put there, so
-  // `readVar` would mint a phantom entry parameter for it and hand back a value the machine
-  // never had. Above the frame that reading is right and is the incoming-argument path
-  // above; INSIDE the frame it is an uninitialised local (or one whose address escaped
-  // through a path the model missed), and the honest answer is the decline this falls
-  // through to.
-  if (frame.isOwnFrameWordSlot(base, off, regOff, width) && ssa.hasReachingDef(stackSlotKey(off), bi)) {
+  // A word reload from this function's own frame (`readsOwnSlot`, above).
+  if (readsOwnSlot(base, off, regOff, width)) {
     usedSlotOffsets.add(off);
     writeData(reg(a), bi, readVar(stackSlotKey(off), bi));
     return;
@@ -4853,6 +6474,28 @@ function lowerStore(fill: ThumbFill, cur: BlockCursor, ins: Instr): void {
   irb.ops.push(mkOp('store', { operands: [storeBase, readData(reg(a), bi)], attrs: { off, width } }));
 }
 
+/** WHERE A READER FINDS A CALL IN THE .s, for a refusal that names it: a Thumb `Instr` carries no
+ *  address. A block the .s labels (the function's own entry, a `.L3`) names it by that label and
+ *  the call; a block the splitter opened after a branch has only a label it made up (`.L_anon0`),
+ *  which appears nowhere in the .s, so the call is named by its ordinal among the calls to the same
+ *  callee in the function, in the order the .s lists them. */
+function thumbCallLocator(blocks: readonly AsmBlock[], bi: number, ins: Instr): string {
+  const call = `'${ins.mnemonic} ${ins.ops[0]}'`;
+  const label = blocks[bi].label;
+  if (!label.startsWith(ANON_BLOCK_PREFIX)) {
+    return `${call} in block '${label}'`;
+  }
+  const same = blocks.flatMap((b) => b.instrs).filter((i) => i.mnemonic === ins.mnemonic && i.ops[0] === ins.ops[0]);
+  const k = same.indexOf(ins);
+  if (k < 0 || same.length === 1) {
+    return `${call} in '${blocks[0].label}'`;
+  }
+  return `${call} in '${blocks[0].label}' (the ${ordinal(k + 1)} of its ${same.length} calls there)`;
+}
+
+const ordinal = (n: number): string =>
+  `${n}${n % 100 >= 11 && n % 100 <= 13 ? 'th' : (['th', 'st', 'nd', 'rd'][n % 10] ?? 'th')}`;
+
 /** `bl` / `blx`: the call its callee's declaration plans, lowered by `CallDeclarations.lower`. */
 function lowerCall(fill: ThumbFill, cur: BlockCursor, ins: Instr): void {
   const { name, target, text, calls, frame, ssa, pairs } = fill;
@@ -4882,6 +6525,8 @@ function lowerCall(fill: ThumbFill, cur: BlockCursor, ins: Instr): void {
     callee: through === null ? callee : { address: readData(through, bi), reg: through },
     ssa,
     bi,
+    // what an elided or kept dispatch left in an argument register is no argument
+    parked: parkedIn(fill.staleIdiomValues, reg),
     read: (r) => ssa.readVar(r, bi),
     write: (r, v) => writeData(r, bi, v),
     // ARGUMENT WORD `k` past the registers is a word of this frame's outgoing area, at [sp,#0]
@@ -4896,6 +6541,72 @@ function lowerCall(fill: ThumbFill, cur: BlockCursor, ins: Instr): void {
       usedSlotOffsets.add(off);
       return ssa.readVar(stackSlotKey(off), bi);
     },
+    // A FRAME ADDRESS AN UNDECLARED ARITY LEAVES OUT IS AN ARGUMENT ALL THE SAME. The frame walks
+    // read the call as handed every argument register it holds (`frameAddressReceivers`), and the
+    // lift reads the object as written by that receiver (`isFrameObjectAccess`, with no reaching-
+    // definition test). A count that leaves out a register holding one lifts the call without the
+    // address, and the object's reads come back as a local nothing wrote (`func(p0, p1, p2, &d[1])`
+    // as `func()`, then `*data = sp1`). A GUESSED count leaves one out only past a register it did
+    // not set, which is a gap the guess refuses first (`guess` below); what reaches here is a call
+    // through r1, which stops at the bound r1 sets and leaves r2 out (`CallDeclarations.lower`'s
+    // KNOWN GAP), and the `/setup-args` cut (`asksEveryCut`). Which count is right the register
+    // file cannot say, so this refuses.
+    //
+    // …UNLESS A REGISTER IT DOES PASS HOLDS THE SAME ADDRESS, in the call's own block: the callee is
+    // handed the object either way, and agbcc leaves a capture it addressed through in r3 beside
+    // the copy it passes in r0 (`mov r3, sp / str r0, [r3] / mov r0, sp / bl g`).
+    leftOut: (regs, passed) => {
+      const at = frame.frameAddressesAtCall.get(ins);
+      // …and an address at an offset nothing knows (NaN, `&buf[i]`) is the same as no other one
+      const handed = new Set(
+        passed.flatMap((p) => (at?.must.has(p) && Number.isFinite(at.must.get(p)) ? [at.must.get(p)] : [])),
+      );
+      const r = regs.find((r) => at?.may.has(r) && !handed.has(at.may.get(r)!));
+      if (r !== undefined) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': the call '${ins.mnemonic} ${callee}' has no prototype, and the arity lifted ` +
+            `without one leaves out ${r}, which may hold a frame address — so whether the callee is handed the ` +
+            `object is not decidable`,
+        );
+      }
+    },
+    // NO `/setup-args` READING at a call whose escape the outgoing-argument verdict leaned on (an
+    // escaped `sp+k` excuses every frame word from k up as the callee's to read). That verdict read
+    // every argument register the call holds as handed over (`frameAddressReceivers`), so a reading
+    // that cuts one contradicts it, whatever the register holds: `&t` an earlier block formed, a
+    // second `mov r3, sp` the `leftOut` exception excuses beside a passed `sp`, or the `mov r2, #0`
+    // agbcc reuses from the frame's initialisation (`g(a, s, 0, 0)` would narrow to `g(a, s)`).
+    //
+    // …NOR AT ANY CALL OF A FUNCTION WHOSE BLOCK OTHER THAN THE ENTRY READS AN INCOMING STACK
+    // ARGUMENT. That is a conservative guard, not a property of the cut: the licence that lifts such a
+    // read (`ThumbFrame.settledDepth`) reads no argument register. It keeps the guess off the
+    // functions only that licence lifts (`if (a) g(n, w, e)` with `&w` left in r1 by the entry would
+    // narrow to `g(n)`). The same leftover still narrows where agbcc schedules the stack argument's
+    // load into the entry block instead (`w[1] = e; if (a) g(n, w)` as `g(n)`, which assembles to the
+    // same bytes), as it does with four parameters.
+    withholdsSetupArgs: () => frame.callsReliedOn.has(ins) || fill.frameUses.offEntryArgReads.size > 0,
+    // A GAP IN THE ARGUMENT REGISTERS REFUSES (`fallbackArgc`) UNLESS IT IS DECIDED: `logv(s, 1)`
+    // sets r1 alone and leaves `s` in r0, so a count that stops at r0 would lift `logv()`. The gap is
+    // decided where r1 surely is an argument (frontend/call-plan.ts `decideGap`: a value nothing but
+    // the call reads and no memory read produced). agbcc fills argument words in order, so `s` is
+    // then passed on and the call lifts `logv(a0, 1)`. A run of incoming arguments
+    // passed on with no register set up past it (`g2(a, b)`) leaves no gap, is the same machine code
+    // as `g2()`, and is lifted as the shorter call. The instruction carries no address, so the
+    // refusal names the call by where the .s puts it (`thumbCallLocator`).
+    //
+    // No `refuse`: a guess that fills r0..r3 asks nothing of the outgoing area here. A word agbcc
+    // stages at [sp, #k] for the call is an argument only where `analyzeOutgoingArgs` licensed the
+    // block, and the frame model refuses any other store there. agbcc's `g5(1, 2, 3, 4, a)` to an
+    // undeclared `g5` declines as "stack pointer used as data" before any call is lowered.
+    guess: { at: thumbCallLocator(fill.cfg.asmBlocks, bi, ins) },
+    // …AND AT EVERY OTHER CALL OF A FUNCTION WHOSE VERDICT LEANED ON AN ESCAPE, the reading asks
+    // `leftOut` of every register it cuts, not only of those this block wrote. The verdict read every
+    // argument register as possibly handed over, so a frame address an EARLIER block left there is
+    // not the dead base the reading guesses at: `g(b, s)` escapes, then `&t` formed before a branch
+    // reaches `if (a) h(b, a, t); else *q = t[0];` in r2, and the cut `h(b, a)` would drop it while
+    // the else arm still reads `t`. The question refuses only frame addresses, so a call that cuts
+    // none (a sibling `f2()`) still narrows.
+    asksEveryCut: () => frame.escapesReliedOn.size > 0,
     pairs: {
       fuse: (lo, hi) => pairs.fuseHalves(irb, lo, hi),
       project: (whole, half) => pairs.projectHalf(irb, whole, half, ins),
@@ -4915,9 +6626,27 @@ function lowerTerminator(fill: ThumbFill, cur: BlockCursor): void {
   const succ = (label: string): Successor => ({ block: irBlocks[cfg.labelIndex.get(label)!], args: [] });
   const jt = text.tables.get(ab);
   if (jt) {
-    // Regime B: the bounds block dispatches a `switch_br` over the scrutinee — N case blocks (values
-    // 0..N-1, dense) followed by the default block (last successor). The `cmp`/`bhi` are subsumed.
-    pushSwitchBr(irb.ops, readVar(reg(jt.scrutReg), bi), [...jt.caseLabels.map(succ), succ(jt.defaultLabel)]);
+    // Regime B: a `switch_br` over the scrutinee — N case blocks (values 0..N-1, dense) followed by
+    // the default block (last successor). From the bounds block, the `cmp`/`bhi` are subsumed. A
+    // kept dispatch (`JumpTable.extras`) switches on the scrutinee its block was entered with: the
+    // idiom read it first, and the extras after it may overwrite the register. Its bounds test stays
+    // a branch and already sent every value past N-1 to the default, so its switch is `exhaustive`.
+    const scrut = cur.dispatchScrutinee ?? readVar(reg(jt.scrutReg), bi);
+    // What the unlifted idiom left in the registers no extra rewrote is no value the lift models: on
+    // the hardware the case blocks see the scaled index, the table's address and the case's own code
+    // address. Each is a marker here, and a read of one declines (`refuseStaleIdiomReads`). The
+    // elided form cannot put them here, since its bounds block's default path never ran the idiom: it
+    // writes them at each case target's entry instead (`openBlockCursor`).
+    if (cur.dispatchScrutinee !== null) {
+      for (const r of [...jt.leaves.keys()].filter((r) => !jt.extras.some((ins) => ins.ops[0] === r))) {
+        ssa.writeVar(
+          reg(r),
+          bi,
+          staleMarker(irb.ops, reg(r), { reg: r, form: 'kept', parks: true }, fill.staleIdiomValues),
+        );
+      }
+    }
+    pushSwitchBr(irb.ops, scrut, [...jt.caseLabels.map(succ), succ(jt.defaultLabel)], cur.dispatchScrutinee !== null);
   } else if (!last) {
     // an EMPTY block is only ever the synthetic entry preheader (decoded blocks are non-empty):
     // fall through to the real entry, whose loop-header phis take their entry operand from here.
@@ -4951,7 +6680,7 @@ function lowerTerminator(fill: ThumbFill, cur: BlockCursor): void {
           last.ops[0] === scratch &&
           prev?.mnemonic === 'pop' &&
           regListOf(prev.ops)?.join() === scratch;
-        pairs.wordReturns.push({ bi, lo, widerEpilogue });
+        pairs.noteWordReturn(bi, lo, widerEpilogue);
       }
       irb.ops.push(mkOp('ret', { operands: [whole ?? lo] }));
     }
@@ -4965,10 +6694,25 @@ function lowerTerminator(fill: ThumbFill, cur: BlockCursor): void {
         `cannot lift '${name}': conditional branch '${last.mnemonic}' has no reaching compare: ${cur.noCmpWhy}`,
       );
     }
+    const { lhs, cmn } = cur.pendingCmp;
+    let { rhs } = cur.pendingCmp;
+    if (cmn) {
+      if (!CMN_EXACT.has(last.mnemonic)) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': conditional branch '${last.mnemonic}' tests the carry of a 'cmn', and the carry ` +
+            'out of a + b is not a >=u -b (they differ at b == 0)',
+        );
+      }
+      // The signed branches read the TRUE sign of a + b, so the negation they compare against is
+      // the mathematical one (`neg_s`, ir/opcodes.ts). `beq`/`bne` read the wrapped sum, which the
+      // plain wrapping `neg` spells (see `CMN_EXACT` for the one `s32` input it leaves undefined).
+      const negated = mkValue(T.unk(32));
+      const signed = last.mnemonic !== 'beq' && last.mnemonic !== 'bne';
+      irb.ops.push(mkOp(signed ? 'neg_s' : 'neg', { operands: [rhs], results: [negated] }));
+      rhs = negated;
+    }
     const cond = mkValue(T.unk(32));
-    irb.ops.push(
-      mkOp(COND_OPCODE[last.mnemonic], { operands: [cur.pendingCmp.lhs, cur.pendingCmp.rhs], results: [cond] }),
-    );
+    irb.ops.push(mkOp(COND_OPCODE[last.mnemonic], { operands: [lhs, rhs], results: [cond] }));
     irb.ops.push(
       mkOp('cond_br', { operands: [cond], successors: [succ(last.ops[0]), succ(fallLabel(cfg.asmBlocks, name, bi))] }),
     );
@@ -4990,25 +6734,6 @@ function fallLabel(asmBlocks: readonly AsmBlock[], name: string, bi: number): st
   return nb.label;
 }
 
-// A struct returned through memory is spelled `local = f(..)`, which hands the callee that local's
-// address: the destination must be a frame object the audit accepted. A global or a pointer handed
-// over directly is another spelling (`gDst = f(..)` needs the global declared as the struct), which
-// nothing here states.
-function refuseSretOutsideFrame(name: string, irBlocks: readonly Block[]): void {
-  const laddrs = new Set(
-    irBlocks.flatMap((b) => b.ops.filter((op) => op.opcode === 'laddr').map((op) => op.results[0])),
-  );
-  for (const op of irBlocks.flatMap((b) => b.ops)) {
-    if (op.opcode === 'call' && op.attrs.sret === true && !laddrs.has(op.operands[0])) {
-      throw new FrontendUnsupportedError(
-        `cannot lift '${name}': \`${op.attrs.target as string}\` returns struct ${typeToString(op.results[0].type)} through the pointer in r0, ` +
-          'and that pointer is not the address of a local of this frame — a struct returned into a global or ' +
-          'through a pointer is not modelled',
-      );
-    }
-  }
-}
-
 /** The ARMv4T / Thumb (agbcc) frontend, registered for the `armv4t` target. */
 export const thumbFrontend: Frontend = { id: 'thumb', inputFormat: 'gnu-as', lift };
 
@@ -5017,6 +6742,7 @@ export const thumbFrontend: Frontend = { id: 'thumb', inputFormat: 'gnu-as', lif
  *  package's public API, where no consumer should be able to depend on them. The name says what it
  *  is; nothing in `src` reads it. */
 export const __testing = {
+  decode,
   PAD_ENCODINGS,
   isPadInstr,
   factKey,