@asmlift/core 0.9.0 → 0.11.0

package/src/frontend/ssa.ts

@@ -16,6 +16,7 @@
 // `irBlocks`, args left empty — phi wiring appends them), then call `markFilled(b)`. When all
 // blocks are filled, call `finish()` to remove trivial phis.
 import {
+  type AsmLayout,
   Block,
   Fn,
   Op,
@@ -27,11 +28,13 @@ import {
   defOpMap,
   mkOp,
   mkValue,
+  replaceAllUsesWith,
   terminator,
   truncateCallArgs,
 } from '../ir/core';
 import { pruneDeadParams, simplifyTrivialPhis } from '../ir/simplify';
 import { type IrType, T } from '../ir/types';
+import { globalRegisterSymbol } from '../target';
 import { type FrontendRefusal, FrontendUnsupportedError } from './errors';
 
 export interface SsaBuilder {
@@ -63,8 +66,21 @@ export interface SsaBuilder {
    *
    *  One of the three call verbs `CallDeclarations.lower` owns ({@link noteCall}). */
   readGuessedArg(reg: string, b: number): Value;
+  /** Record that the call being lowered in block `b` reads `v` from argument register `reg` it
+   *  guessed it takes, for {@link readAfterEveryReachingWrite} alone: the call is an instruction
+   *  reading what the register's last write left there, as a sibling path's call may be, while
+   *  {@link readGuessedArg} makes the read carry no claim for `finish` to judge. */
+  noteGuessedArgRead(reg: string, b: number, v: Value): void;
+  /** The value `reg` holds at the END of block `b` once `b` is filled, as the edges out of it carry
+   *  it; `null` before. A lookup, not a read: it records no read for `finish` to judge. */
+  readAtEnd(reg: string, b: number): Value | null;
   /** Record that `reg` now holds `v` within block `b`. */
   writeVar(reg: string, b: number, v: Value): void;
+  /** Every value written to a frame-slot key ({@link stackSlotKey}) or an incoming stack-argument key
+   *  ({@link stackArgKey}): a word the machine STORED to its stack. The slot is a variable here, so a
+   *  store nothing reloads leaves no op behind, and the value it stored looks unused — the dead-read
+   *  pin asks this (frontend/dead-reads.ts `spilled`). */
+  readonly frameWrites: ReadonlySet<Value>;
   /** Mark block `b` fully emitted (terminator pushed); seals any now-ready successors. */
   markFilled(b: number): void;
   /** Live-in parameter value → the key it arrived on (for calling-convention order). Usually an
@@ -81,7 +97,9 @@ export interface SsaBuilder {
    *  Never touches the block's definitions: the parameter is added and left unused, so any local
    *  value already flowing keeps flowing. Only meaningful on a block with no predecessors —
    *  elsewhere a parameter is a phi whose position is aligned with its predecessors' terminator
-   *  args, and appending an unpaired one would corrupt that. */
+   *  args, and appending an unpaired one would corrupt that. Nor on a register the live-in model
+   *  calls an uninitialised local's home (`LiveInModel.uninitRegs`): no caller fills it, so no
+   *  convention proves an argument there, and {@link entryValue} answers `undefined` for it. */
   ensureParam(key: string, b: number): void;
   /** Whether `reg` has a definition reaching block `b` (best-effort call-arity heuristic).
    *
@@ -94,6 +112,12 @@ export interface SsaBuilder {
    *  value this function named reaches it here on some path. A path that brings the destroyed bytes
    *  and one that brings a value still answer yes, and the read that follows refuses at `finish`. */
   holdsValue(reg: string, b: number, accept?: (v: Value) => boolean): boolean;
+  /** The MUST question beside {@link hasReachingDef}'s MAY one: whether EVERY path into the end of
+   *  block `b` brings a definition of `reg` that `accept` takes, with no call destroying it since
+   *  (`noteCall`). A path from the entry that defines nothing answers no — the register holds the
+   *  caller's value there. Asked once every block is filled: before that, a back edge from a block
+   *  not yet filled carries definitions this walk cannot see, so it refuses to answer. */
+  everyReachingDef(reg: string, b: number, accept: (v: Value) => boolean): boolean;
   /** The entry parameter `reg` still holds at this point of block `b`, taken WITHOUT a read. A read
    *  leaves a definition behind, and `hasReachingDef` counts it as argument setup, so a frontend that
    *  only moves the argument somewhere (a frame store) would raise the guessed arity of every later
@@ -104,6 +128,61 @@ export interface SsaBuilder {
    *  sense, answered without the entry parameter that one hands back. A callee-saved register stored
    *  to its save slot holds the caller's value, which is no parameter, so asking must not mint one. */
   holdsEntryValue(reg: string, b: number): boolean;
+  /** Whether block `b` WROTE `reg` since its last call so far (since its start if it made none).
+   *  Only a write counts: a read leaves a definition behind but is not one (`writeVar`). */
+  writtenSinceCall(reg: string, b: number): boolean;
+  /** How many ops block `b` held when it last wrote `reg` so far, or `undefined` where `b` has not
+   *  written it: every op at or past that index came after the write. A copy (`add r1, r5, #0`) names
+   *  no new value, so this is how a question about one WRITE of a register is asked, where its value
+   *  was read before the write too (frontend/call-plan.ts `leftover`). */
+  lastWriteOp(reg: string, b: number): number | undefined;
+  /** Whether an instruction READ `reg` after EACH write of it that reaches block `b` and whose value
+   *  `passes`, on ANY path out of that write but the ones into `b`, the first read on that path being
+   *  one whose value `accept` takes. A write no read follows on any path was
+   *  made for `b`'s use, so one is enough to answer no. A call destroying `reg` is no write of this
+   *  function's, and neither is the entry's value where a path from the entry writes neither, so they
+   *  do not answer no; the entry's value read after (as `accept` takes it), or read by a lowered op
+   *  at all (as `unlowered` takes it: no write placed that read), counts as a write read. Where a
+   *  call destroyed `reg` on EVERY path in, it holds what a callee left there and the answer is yes.
+   *  The question is about the write, not its value: a copy (`add r4, r0, #0`) reads `r0` and lowers
+   *  to no op, so no op-level question sees that read, and it counts here; a copy made in an earlier
+   *  block names the value it copies, read before that write too, and is no read of it. Any path out
+   *  of the write, because a MIPS compiler hoists one call's argument into the delay slot of the
+   *  branch that picks it (`bnez v0, L; move a0, zero`), so the write reaches the other call unread
+   *  on the path between. `b`'s own reads are not asked: what a read there that lowers to no op says
+   *  differs by compiler (frontend/call-plan.ts `leftover`). Only the frontend's own reads count
+   *  ({@link readVar}), and a guessed call's argument read the planner records for it
+   *  ({@link noteGuessedArgRead}: a sibling path's call reads the write); a lookup this construction
+   *  makes, or the planner's own probe ({@link readGuessedArg} alone), is none. A block not
+   *  filled yet is passed through looking for the write, as {@link holdsValue} does; a path out of
+   *  a write that reaches one has reads nobody has seen yet, and the write's value answers for it
+   *  as `unlowered` takes it (IDO reloads `lw a0, 24(sp)` in a branch's delay slot for the arm laid
+   *  out after the call). A write of a value `answersIfRead` takes (an earlier call's result, copied
+   *  or reloaded) answers yes where it was read after, and is otherwise none: such a value is the
+   *  callee's, saved across a call as often as handed to one. `undefined` where no write of this
+   *  function's is left to judge and no entry value read: the question has no answer here. */
+  readAfterEveryReachingWrite(
+    reg: string,
+    b: number,
+    ask: {
+      passes: (v: Value) => boolean;
+      accept: (v: Value) => boolean;
+      unlowered: (v: Value) => boolean;
+      answersIfRead: (v: Value) => boolean;
+    },
+  ): boolean | undefined;
+  /** Whether EVERY path into this point of block `b` wrote `reg` (or had a call destroy it) after
+   *  leaving the last block `stop` names: {@link writtenSinceCall} asked of `b` so far and, where `b`
+   *  did not write it, of each predecessor in turn. A path reaching a `stop` block, the entry, or a
+   *  block not filled yet answers no; a cycle adds no path the first visit did not judge. `visit`
+   *  is told each block the walk passes through after `b`. */
+  writtenOnEveryPath(reg: string, b: number, stop: (at: number) => boolean, visit?: (at: number) => void): boolean;
+  /** Record that the frontend CONSUMED `v`, which it read from a register in block `b`, without
+   *  placing it in any op: PowerPC's register save routine takes its frame address in r11 and is
+   *  erased, so the address appears in no operand. The refusal of a read a call destroyed
+   *  (`refuseStaleCallerSavedReads`) judges a read by its uses, and an op-less use is one too — left
+   *  unrecorded, a frame address a call destroyed would still be consumed, silently. */
+  useOutsideOps(v: Value, b: number): void;
   /** Record that block `b` makes a call HERE: the ABI's caller-saved registers stop being ones the
    *  caller set up.
    *
@@ -117,20 +196,57 @@ export interface SsaBuilder {
    *  return register precisely because of the ordering above: the callee's own result is already
    *  written there, so that one register does have a name. A callee that hands a STRUCT back in
    *  that register writes no value a caller may read as a word, so none is written and the
-   *  register is listed here too. Required rather than optional: a call lowered without it would
-   *  keep resolving a destroyed register to its pre-call value, silently. */
+   *  register is listed here too — save one whose bytes a local of the struct is read back from,
+   *  which is written as the call's value and noted as an image ({@link noteStructImage}).
+   *  Required rather than optional: a call lowered without it would keep resolving a destroyed
+   *  register to its pre-call value, silently. */
   noteCall(b: number, clobbers: readonly string[]): void;
+  /** The call {@link noteCall} just recorded in `b` left `reg` holding `image`, the bytes of a
+   *  struct its callee is declared to return there (frontend/call-plan.ts `registerStructLocal`).
+   *  A read takes it as the call's value, and the lift re-reads it off the struct's local; a GUESSED
+   *  arity does not count it, as it counts no register a call destroyed: a call nothing declares
+   *  may be handed the struct by value or a member of it, in the same register, and the bytes do
+   *  not say which. So the trim treats `reg` as destroyed, and a guess that still passes the image
+   *  refuses in `finish`. */
+  noteStructImage(b: number, reg: string, image: Value): void;
   /** Register a `call` op whose arity was GUESSED (no prototype), so `finish` can cut it back to the
    *  argument registers that were actually set up on every path (see {@link trimClobberedCallArgs}).
    *  `abi` is the target's argument-register order and its return register. It snapshots what the
    *  caller wrote, so it comes before the call's result is written ({@link noteCall}).
-   *  `passesCalleeResult`: see {@link GuessedCallSite}. */
+   *  `passesCalleeResult`, `trimmed`, `withholdsSetupArgs`, `asksEveryCut` and `floor`: see
+   *  {@link GuessedCallSite}. */
   recordGuessedCall(
     op: Op,
     b: number,
     abi: { argRegs: string[]; returnReg: string },
     passesCalleeResult?: (result: Value) => boolean,
+    trimmed?: (cut: readonly string[], kept: readonly string[]) => void,
+    withholdsSetupArgs?: () => boolean,
+    asksEveryCut?: () => boolean,
+    floor?: number,
   ): void;
+  /** Require that nothing but `op` reads `v` once the function is lifted — no other op, no join that
+   *  survives, no frame store (`frameWrites`), no op-less use (`useOutsideOps`) — or call `refuse`.
+   *  A read the lowering has yet to see may come after `op` through a copy in a register the call
+   *  leaves alone, so the question is asked in `finish`, of the finished function. Its asker is the
+   *  guessed-arity gap (frontend/call-plan.ts `decideGap`). */
+  requireSoleReader(v: Value, op: Op, refuse: () => void): void;
+  /** Require that something other than a `ret` reads `v` once the function is lifted — an op, a
+   *  frame store or an op-less use, of `v` or of a join it reaches — or call `refuse`. Asked in
+   *  `finish`, as `requireSoleReader` is, and by the same asker: a decided gap at the first argument
+   *  register, where the call's result being read is what says the callee returns a word
+   *  (frontend/call-plan.ts `decideGap`). A `ret` does not count, since a frontend returns the
+   *  return register at every `ret` whatever the declared type. */
+  requireReader(v: Value, refuse: () => void): void;
+  /** Record that `v` is a value an instruction wrote as a SIDE EFFECT of its own job, which the
+   *  compiler may leave in a register nobody reads: the base writeback of a Thumb `ldmia`/`stmia`,
+   *  which has no form without one, and the base a PowerPC load or store with update advances. Such
+   *  a value is no evidence that anything wanted it, so the guessed-arity gap (frontend/call-plan.ts
+   *  `decideGap`) never takes one as an argument. agbcc copies a struct of 3+ words with
+   *  `ldmia r3!, {r4, r5, r6}; stmia r2!, {r4, r5, r6}` and leaves both writebacks dead in r2/r3. */
+  noteIncidentalWrite(v: Value): void;
+  /** Whether {@link noteIncidentalWrite} recorded `v`. */
+  isIncidentalWrite(v: Value): boolean;
   /** Remove trivial phis and enforce the frontend's postconditions; call once every block is
    *  filled. Throws FrontendUnsupportedError if a stack slot escaped as an entry parameter. */
   finish(): void;
@@ -139,7 +255,7 @@ export interface SsaBuilder {
 /** `preds` is per-EDGE (see the module header): one entry per CFG edge into each block. */
 // VARIABLE NAMES ARE NOT ALWAYS MACHINE REGISTERS. `readVar`/`writeVar` key on an arbitrary string,
 // and frontends mint VIRTUAL keys for storage the ISA has no register for — MIPS `sp@<off>` for a
-// stack slot (frontend/mips.ts), Thumb `@sarg<k>` for an incoming stack argument (frontend/thumb.ts).
+// stack slot (frontend/mips.ts), `@sarg<k>` for an incoming stack argument (`stackArgKey`).
 // A virtual key must be outside its ISA's register grammar so it cannot collide with a real one, and
 // a key read with no reaching def becomes a function PARAMETER by the live-in path below — which is
 // how both of those capabilities get their parameters without a new opcode or pass.
@@ -184,8 +300,8 @@ export interface LiveInModel {
    *  eight more). None reaches the ordering today, for an unrelated reason (`l3/slotorder.ts`'s
    *  REACH note), so nothing downstream is guarding this.
    *
-   *  ABSENT ⇒ NO STAMP. MIPS and PPC declare no frame partition at all, so they stamp nothing,
-   *  which is the refusing direction. */
+   *  ABSENT ⇒ NO STAMP. MIPS and PPC declare none (MIPS claims `ownedLocals` alone), so they stamp
+   *  nothing, which is the refusing direction. */
   declaredLocals?: { from: number; to: number };
   /** Storage the CALLER wrote — incoming stack arguments ⇒ a def-less read is a parameter.
    *  `[from, to)`. O32's register-parameter home area belongs to NEITHER range: caller-owned, but
@@ -197,13 +313,23 @@ export interface LiveInModel {
    *  saved the register (so it is one the compiler was free to home a local in). The ABI half alone
    *  describes the CALLER, and asm that follows no ABI — hand-written, or a mid-function fragment,
    *  which klonoa's `bl`-as-a-long-branch splits produce for real — is genuinely handed live values
-   *  in registers it never saved. Passing the ABI list unfiltered cost the MP2K engine's
-   *  `ChnVolSetAsm` its two-pointer signature and left it storing through `uninit_r4`, silently.
+   *  in registers it never saved. Passing the ABI list unfiltered left the MP2K engine's
+   *  `ChnVolSetAsm` storing through `uninit_r4`, silently; such a read is
+   *  `unsavedCalleeSavedRegs`' instead.
    *
-   *  The save is a MEASUREMENT, like the frame's, and belongs to whoever can make it — Thumb reads
-   *  the leading push run (`savedRegs`); a frontend that cannot measure it passes nothing here and
+   *  The save is a MEASUREMENT, like the frame's, and belongs to whoever can make it. Thumb reads
+   *  its `push`es (`savedRegs`; past the prologue, `bodySavedRegs`). PPC reads every save in the
+   *  entry block of a register nothing before it named (`prologueSavedRegs`), because mwcc
+   *  interleaves its saves with the body (`stw r31; mr r31,r3; stw r30`); "nothing named it first"
+   *  is the condition Thumb's leading run meets by construction; MIPS reads its entry block the same way
+   *  (frontend/mips.ts `prologueSavedRegs`). A frontend that cannot measure it passes nothing here and
    *  keeps the parameter it would have got anyway.
    *
+   *  The one register class exempt from the save is the ABI's scratch set (`target.scratchRegs`):
+   *  a callee may use one with no save at all, so demanding one would refuse a local the compiler
+   *  homed there with no prologue (agbcc's `ip`, mwcc's `r0`). `registerLiveIns` composes both
+   *  halves for every frontend, so this list is never assembled by hand.
+   *
    *  The frame's sole-writer obligation has no counterpart here and needs none: a register has no
    *  address, so nothing outside this function can name it and there is no escape to retract.
    *
@@ -214,6 +340,41 @@ export interface LiveInModel {
    *
    *  Declaring this obliges `argRegs` below, and the two must be DISJOINT. */
   uninitRegs?: readonly string[];
+  /** Of `uninitRegs`, the ones something outside the C convention hands an input in
+   *  (`target.hiddenInputRegs`). The entry value of one must reach A JOIN that also takes a
+   *  definition the entry value does not feed — the shape of a local the compiler assigned on one
+   *  arm, which may also be read before that assignment. A join alone is not enough: an input
+   *  carried round a loop meets its own next value at the loop header. Meeting no such join, it is
+   *  the input, and `finish` refuses rather than spell it `uninit_<reg>`. */
+  hiddenInputRegs?: readonly string[];
+  /** Registers the ABI requires a callee to PRESERVE (`target.nonArgRegs` less `target.scratchRegs`)
+   *  that this function did NOT save — the third side of the register partition. No caller passes
+   *  an argument in one, and the compiler homed no local of this function there, so a value it holds
+   *  on entry is one the function shares with every other: a FILE-SCOPE GLOBAL REGISTER VARIABLE
+   *  (`register int g asm("r8");`), which is exactly what agbcc, gcc 2.7.2, KMC and mwcc 2.4 compile
+   *  `return g;` to (`mov r0, r8`, `move v0,s0`, `mr r3,r14`). gcc's `globalize_reg` (regclass.c)
+   *  marks such a register fixed and call-used, so no prologue saves it. A def-less read of one
+   *  refuses: naming it a parameter puts a value in the signature that a C caller would pass in an
+   *  argument register. A WRITE to one is visible to the caller just the same. Both refuse in
+   *  `finish`, of the finished function — unless the compiler can spell the global, which is
+   *  `globalRegs`.
+   *
+   *  Disjoint from `argRegs` and `uninitRegs`, checked with them. */
+  unsavedCalleeSavedRegs?: readonly string[];
+  /** Of `unsavedCalleeSavedRegs`, the ones the function does save or restore, but not around every
+   *  use or not restored at every return (a `pop` with no `push` before it, a `push` past a read, a
+   *  use past the restore). Refused like the rest, and named apart only so the refusal says what it
+   *  saw. */
+  misSavedRegs?: readonly string[];
+  /** Where the frontend looks for the saves it measures, for those refusals to name: the partition
+   *  is only as wide as that look, and a save it does not read is still a save. */
+  saveSite?: string;
+  /** The registers of `unsavedCalleeSavedRegs`' kind the target can declare a global register
+   *  variable in (`target.globalRegisterVariables`), each to the name `__asm__` takes. Every read of
+   *  one is a load of that global and every write a store to it, so a call between two reads may
+   *  change it, as it may change any global. Disjoint from the other three lists, checked with
+   *  them. */
+  globalRegs?: ReadonlyMap<string, string>;
   /** Registers the ABI DOES pass arguments in — the other side of the register partition, and the
    *  only reason the side above is checkable rather than believed. The frame coordinate declares
    *  both of its sides and refuses an offset in neither; this one declares both and refuses a key
@@ -225,6 +386,13 @@ export interface LiveInModel {
    *  `readRecursive` cannot catch that on its own — it never sees the argument registers, because
    *  a read of one takes the parameter path by falling through every other case. */
   argRegs?: readonly string[];
+  /** The argument words the function's own declaration fills (`proto.ts` `ownArgumentWords`), where
+   *  it states them. A register past them is in `uninitRegs`; an INCOMING STACK ARGUMENT at or past
+   *  them is refused, because no local lives in the caller's frame and the read says the
+   *  declaration is wrong. Taken as a parameter it would be named by position, one slot below the
+   *  registers the declaration left out: `int st2(int a,int b,int c,int d,int e){ return g(a)+e; }`
+   *  declared with two parameters would lift `st2(a0, a1, a2)`, returning the fifth argument as `a2`. */
+  ownArgWords?: number;
 }
 
 /** The register partition's postcondition, checked at the point of USE. `uninitRegs` asserts "no
@@ -250,9 +418,203 @@ function checkedLiveInModel(fnName: string, m: LiveInModel): LiveInModel {
         `and one the ABI does not pass arguments in`,
     );
   }
+  const unsaved = [...(m.unsavedCalleeSavedRegs ?? []), ...(m.globalRegs?.keys() ?? [])];
+  const twice = unsaved.filter((r, i) => args.includes(r) || m.uninitRegs?.includes(r) || unsaved.indexOf(r) !== i);
+  if (twice.length > 0) {
+    throw new Error(
+      `lifting '${fnName}': the live-in model lists ${twice.join(', ')} as an unsaved callee-saved ` +
+        `register AND as an argument register or an uninitialised local's home`,
+    );
+  }
   return m;
 }
 
+/** A `scratchRegs` entry outside `nonArgRegs` is inert, and inert is how a partition rots: the list
+ *  would go on reading as if it exempted something. Refused as a target bug, like the
+ *  argRegs/uninitRegs contradiction `checkedLiveInModel` refuses, rather than declined as a property
+ *  of the input. */
+export function assertScratchRegsPartitioned(target: {
+  id: string;
+  nonArgRegs?: readonly string[];
+  scratchRegs?: readonly string[];
+}): ReadonlySet<string> {
+  const scratchRegs = new Set(target.scratchRegs ?? []);
+  for (const r of scratchRegs) {
+    if (!(target.nonArgRegs ?? []).includes(r)) {
+      throw new Error(`target '${target.id}': scratch register ${r} is not among the non-argument registers`);
+    }
+  }
+  return scratchRegs;
+}
+
+/** ONE SPELLING PER REGISTER, WHERE A FUNCTION WRITES ONE REGISTER TWO WAYS. The builder keys a
+ *  register by its operand text, and so does every save measurement a frontend makes, so `sl` and
+ *  `r10` (or O32's `s8` and `fp`) would be two variables and two partition entries for one register:
+ *  `mov sl, r0; mov r0, r10` would return a second parameter where the machine returns the first,
+ *  and a register saved as `s8` and written as `fp` would read as never saved, its writes as a
+ *  global's. `pairs`
+ *  is each register's two spellings, the one kept first. Only a function that names BOTH of a pair
+ *  is rewritten — every other keeps the spelling it was written in, and with it the name of any local
+ *  homed there — and an alias is rewritten wherever it stands as a whole word of an operand, so a
+ *  memory operand's base (`8(fp)`) is too. */
+export function unifyRegisterSpellings(
+  instrs: Iterable<{ ops: string[] }>,
+  pairs: readonly (readonly [keep: string, alias: string])[],
+): void {
+  const all = [...instrs];
+  const words = new Set(all.flatMap((ins) => ins.ops.flatMap((op) => op.match(/[A-Za-z_$.][\w$.]*/g) ?? [])));
+  for (const [keep, alias] of pairs) {
+    if (!words.has(keep) || !words.has(alias)) {
+      continue;
+    }
+    const re = new RegExp(`(?<![\\w$.])${alias}(?![\\w$.])`, 'g');
+    for (const ins of all) {
+      ins.ops = ins.ops.map((op) => op.replace(re, keep));
+    }
+  }
+}
+
+/** THE REGISTER HALF OF THE LIVE-IN MODEL (`LiveInModel.uninitRegs` and `argRegs`), composed here
+ *  once for every frontend that claims it, so that no frontend can drop a half of the rule. A
+ *  register is an uninitialised local's home when the ABI passes no argument in it
+ *  (`target.nonArgRegs`) AND either the ABI lets a callee use it with no save (`target.scratchRegs`,
+ *  checked against `nonArgRegs`) or this function saved it — `savedRegs`, the frontend's measurement
+ *  of its saves. The rest — callee-saved, and not saved — is `globalRegs` where the target can
+ *  declare a global register variable there and `unsavedCalleeSavedRegs` where it cannot, or where
+ *  the function saves or restores it but not around every use of it (`misSaved`, a measurement only
+ *  Thumb makes, whose `push` and `pop` are nothing but saves and restores): compiled code never saves
+ *  a global register variable's register, and asm that saves one restores it too, so its writes are
+ *  not the caller's and its entry value is no global's. A target stating no `nonArgRegs` claims no
+ *  partition and gets an empty model, so every def-less read stays a parameter.
+ *
+ *  THE FUNCTION'S OWN DECLARATION MOVES THE PARTITION'S EDGE. `ownWords` is how many argument
+ *  words it can fill (`proto.ts` `ownArgumentWords`, an upper bound), and an argument register at
+ *  or past it is one no caller fills for THIS function, so it moves from `argRegs` to `uninitRegs`.
+ *  It needs no save: every argument register is one a callee may use unsaved (`clobberedByCall`
+ *  checks they are caller-saved). KMC homes a local in `a2` past `uninit_spill(int k, int *p)`, which
+ *  without the edge reads as a third parameter. Absent (no declaration, or one that bounds
+ *  nothing), the ABI's whole list stays arguments. */
+export function registerLiveIns(
+  target: {
+    id: string;
+    argRegs: readonly string[];
+    nonArgRegs?: readonly string[];
+    scratchRegs?: readonly string[];
+    hiddenInputRegs?: readonly string[];
+    globalRegisterVariables?: { regs: Readonly<Record<string, string>> };
+  },
+  savedRegs: ReadonlySet<string>,
+  ownWords?: number,
+  misSaved: ReadonlySet<string> = new Set(),
+): Pick<
+  LiveInModel,
+  | 'uninitRegs'
+  | 'argRegs'
+  | 'hiddenInputRegs'
+  | 'ownArgWords'
+  | 'unsavedCalleeSavedRegs'
+  | 'misSavedRegs'
+  | 'globalRegs'
+> {
+  const scratchRegs = assertScratchRegsPartitioned(target);
+  for (const r of target.hiddenInputRegs ?? []) {
+    if (!scratchRegs.has(r)) {
+      throw new Error(`target '${target.id}': hidden-input register ${r} is not among the scratch registers`);
+    }
+  }
+  if (target.nonArgRegs === undefined) {
+    return {};
+  }
+  const filled = ownWords === undefined ? target.argRegs.length : Math.min(ownWords, target.argRegs.length);
+  const unsaved = target.nonArgRegs.filter((r) => !scratchRegs.has(r) && !savedRegs.has(r));
+  const spelled = target.globalRegisterVariables?.regs ?? {};
+  return {
+    uninitRegs: [
+      ...target.nonArgRegs.filter((r) => scratchRegs.has(r) || savedRegs.has(r)),
+      ...target.argRegs.slice(filled),
+    ],
+    argRegs: target.argRegs.slice(0, filled),
+    hiddenInputRegs: target.hiddenInputRegs,
+    unsavedCalleeSavedRegs: unsaved.filter((r) => !Object.hasOwn(spelled, r) || misSaved.has(r)),
+    misSavedRegs: unsaved.filter((r) => misSaved.has(r)),
+    globalRegs: new Map(
+      unsaved.filter((r) => Object.hasOwn(spelled, r) && !misSaved.has(r)).map((r) => [r, spelled[r]]),
+    ),
+    ...(ownWords === undefined ? {} : { ownArgWords: ownWords }),
+  };
+}
+
+/** REFUSE A WRITE TO A SAVED REGISTER THAT THE CALLER SEES. A register the frontend read as saved
+ *  (its save store, `LiveInModel.uninitRegs`) is a local's home, and the lift drops what is left
+ *  in it at a return — right only if every path restores it after its last write. A write past the
+ *  restore (`lw s0,4(sp); move s0,a0; jr ra`), a reload from a word that is not its save, or a
+ *  return its restore never reaches leaves the caller holding a value the C never assigns, so the
+ *  function refuses here rather than drop it. MIPS and PowerPC read a save as an ordinary store in
+ *  the entry block, so this is asked once the blocks are filled; Thumb asks the same of its
+ *  `push`/`pop` pairs in `bodySavedRegs`.
+ *
+ *  A forward may-dataflow over the asm: a register is DIRTY from a write (`writes`) until a restore
+ *  of it (`restores`: the instructions the frontend lowered as reloading its save word), and dirty
+ *  at the end of a block that returns is the refusal. Compiled code restores every saved register
+ *  in its epilogue, after its last write, so it never fires there; a path that never writes the
+ *  register needs no restore. */
+export function refuseSavedRegisterLeaks<I extends { addr: number }>(
+  name: string,
+  blocks: readonly { instrs: readonly I[]; returns: boolean }[],
+  preds: readonly (readonly number[])[],
+  saved: ReadonlySet<string>,
+  writes: (ins: I, reg: string) => boolean,
+  restores: ReadonlyMap<I, ReadonlySet<string>>,
+): void {
+  if (saved.size === 0) {
+    return;
+  }
+  // register → the address of a write no restore has answered since, on some path
+  const outs: (Map<string, number> | null)[] = blocks.map(() => null);
+  const transfer = (b: number, dirty: Map<string, number>) => {
+    for (const ins of blocks[b].instrs) {
+      for (const r of saved) {
+        if (restores.get(ins)?.has(r)) {
+          dirty.delete(r);
+        } else if (writes(ins, r)) {
+          dirty.set(r, ins.addr);
+        }
+      }
+    }
+    return dirty;
+  };
+  const inOf = (b: number) => {
+    const dirty = new Map<string, number>();
+    for (const p of preds[b]) {
+      outs[p]?.forEach((at, r) => dirty.has(r) || dirty.set(r, at));
+    }
+    return dirty;
+  };
+  for (let changed = true; changed;) {
+    changed = false;
+    blocks.forEach((_, b) => {
+      if (b !== 0 && !preds[b].some((p) => outs[p] !== null)) {
+        return;
+      }
+      const out = transfer(b, inOf(b));
+      if (outs[b] === null || out.size !== outs[b]!.size) {
+        outs[b] = out;
+        changed = true;
+      }
+    });
+  }
+  blocks.forEach((blk, b) => {
+    const [leak] = blk.returns ? [...(outs[b] ?? [])] : [];
+    if (leak !== undefined) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': the write to saved ${leak[0]} at 0x${leak[1].toString(16)} reaches a return ` +
+          `with no restore of ${leak[0]} after it, so the caller sees it — no C local spells a write ` +
+          'that outlives the function',
+      );
+    }
+  });
+}
+
 /** A read whose register may be holding a callee's leftover — see `refuseStaleCallerSavedReads`. */
 interface StaleRead {
   reg: string;
@@ -264,6 +626,10 @@ interface StaleRead {
   fromOp: number;
   /** a call in this very block destroyed it, so the predecessors have nothing to add. */
   local: boolean;
+  /** The OTHER keys this block wrote the read's value into after it — a `move` or a slot store of
+   *  the destroyed register, which carries the callee's leftover out of the block under a name no
+   *  call destroyed. */
+  carriedBy: Set<string>;
 }
 
 /** The registers a call leaves holding nothing the CALLER can name — what {@link SsaBuilder.noteCall}
@@ -290,6 +656,57 @@ export function clobberedByCall(target: {
   return target.callerSaved.filter((r) => r !== target.returnReg);
 }
 
+/** One asm block as {@link recordAsmLayout} reads it: its instructions without its control transfer,
+ *  and whether that transfer is an unconditional jump to a label. `undefined` for a block the
+ *  frontend made up, which has no place in the asm. An instruction's `reloc` is the relocation that
+ *  fills it, where the operands do not name the symbol (disasm.ts `DisasmInstr.reloc`). */
+export interface AsmBlockText {
+  readonly body: readonly {
+    readonly mnemonic: string;
+    readonly ops: readonly string[];
+    readonly reloc?: { readonly sym: string; readonly addend: number };
+  }[];
+  readonly endsInJump: boolean;
+  /** which instructions of `body` make a call, which only the frontend's ISA knows */
+  readonly isCall: (ins: AsmBlockText['body'][number]) => boolean;
+}
+
+/** One instruction of {@link AsmBlockText} as the layout record spells it: `mnemonic op,op`, then the
+ *  symbol its relocation fills in, if any. In a relocatable object's disassembly the operands of a
+ *  global's load or store, or of a call, read the same whichever symbol it is: gcc 2.7.2's `lui
+ *  at,0x0` / `sw a2,0(at)` for `gT = c` and for `gW = c`, and `jal 0 <f>` for every callee. Spelled
+ *  without the symbol, two arms that store to different globals would read as identical bodies. */
+function layoutText(ins: AsmBlockText['body'][number]): string {
+  const text = ins.ops.length ? `${ins.mnemonic} ${ins.ops.join(',')}` : ins.mnemonic;
+  if (ins.reloc === undefined) {
+    return text;
+  }
+  const addend = ins.reloc.addend === 0 ? '' : `+0x${ins.reloc.addend.toString(16)}`;
+  return `${text} <${ins.reloc.sym}${addend}>`;
+}
+
+/** The layout record (ir/core.ts `AsmLayout`): asm block `i` is `irBlocks[i]`, which is how every
+ *  frontend's builder numbers them, and its index is its position among the blocks that have a
+ *  place in the asm. */
+export function recordAsmLayout(
+  irBlocks: readonly Block[],
+  asmBlocks: readonly (AsmBlockText | undefined)[],
+): AsmLayout {
+  const layout: AsmLayout = new Map();
+  let index = 0;
+  asmBlocks.forEach((ab, i) => {
+    if (ab !== undefined) {
+      layout.set(irBlocks[i], {
+        index: index++,
+        body: ab.body.map(layoutText),
+        calls: ab.body.flatMap((ins, at) => (ab.isCall(ins) ? [at] : [])),
+        endsInJump: ab.endsInJump,
+      });
+    }
+  });
+  return layout;
+}
+
 export function makeSsaBuilder(
   name: string,
   blockCount: number,
@@ -301,6 +718,10 @@ export function makeSsaBuilder(
    *  phi. A register FILE, not a register: the FPU's keys are floats wherever they arrive, and every
    *  other key is `unknown` for type recovery to settle. */
   keyType: (key: string) => IrType | undefined = () => undefined,
+  /** `LiveInModel.globalRegs`, which every read and write consults — so it is handed over when the
+   *  builder is made, not when the model is first used. The frontend passes the same map in its
+   *  model, where it is checked against the other lists. */
+  globalRegs: ReadonlyMap<string, string> = new Map(),
 ): SsaBuilder {
   const unset = (key: string): IrType => keyType(key) ?? T.unk(32);
   let modelMemo: LiveInModel | null = null;
@@ -309,7 +730,33 @@ export function makeSsaBuilder(
   // function that reads the mis-listed register. A contradictory or half-declared partition is a
   // bug in the TARGET, not an unliftable function, so it throws a plain Error: a decline would
   // report the target's typo as a property of the input, once per function, forever.
-  const model = (): LiveInModel => (modelMemo ??= checkedLiveInModel(name, liveInOf()));
+  const model = (): LiveInModel => (modelMemo ??= sameGlobalRegs(checkedLiveInModel(name, liveInOf())));
+  // The model's `globalRegs` is the copy checked against the other lists, and the builder's own the
+  // one every read and write consults: two copies of one fact, which must be one.
+  const sameGlobalRegs = (m: LiveInModel): LiveInModel => {
+    const theirs = m.globalRegs ?? new Map<string, string>();
+    if (theirs.size !== globalRegs.size || [...theirs].some(([r, n]) => globalRegs.get(r) !== n)) {
+      throw new Error(`lifting '${name}': the live-in model's global registers are not the ones the builder was given`);
+    }
+    return m;
+  };
+  // What the refusals of unsaved callee-saved registers say of their saves (`misSavedRegs`).
+  const unsavedWhy = (regs: readonly string[]): string => {
+    const mis = regs.filter((r) => model().misSavedRegs?.includes(r));
+    const never = regs.filter((r) => !mis.includes(r));
+    return [
+      ...(mis.length
+        ? [
+            `saves or restores ${mis.join(', ')} but not around every use of it, restored at every return, on every path`,
+          ]
+        : []),
+      ...(never.length ? [`no ${model().saveSite ?? 'save this lift reads'} saves ${never.join(', ')}`] : []),
+    ].join(', and ');
+  };
+  // What compiled code means by such a register — but not by one the function saves and breaks the
+  // save of (`misSavedRegs`), which the measurement has shown is no global's.
+  const globalNote = (regs: readonly string[]): string =>
+    regs.some((r) => model().misSavedRegs?.includes(r)) ? '' : ' (a global register variable)';
   const inRange = (off: number, r?: { from: number; to: number }) => r !== undefined && off >= r.from && off < r.to;
   const irBlocks: Block[] = Array.from({ length: blockCount }, () => ({ params: [] as Value[], ops: [] }));
   // `writeOrder` and `slotHomes` are filled in below, where the builder's counters live.
@@ -320,6 +767,7 @@ export function makeSsaBuilder(
     slotHomes: undefined,
     paramEvidence: undefined,
     localObjects: undefined,
+    asmLayout: undefined,
   };
 
   const defs: Array<Map<string, Value>> = irBlocks.map(() => new Map());
@@ -331,6 +779,9 @@ export function makeSsaBuilder(
   // arrives as a PHI — which is what happens when the entry block is itself a loop header — is
   // invisible to the escape check below. Braun's construction gives no other way to tell.
   const phiKey = new Map<Value, string>();
+  // The entry value of a register a runtime hands a hidden input in (`LiveInModel.hiddenInputRegs`),
+  // minted as an uninitialised local, for `finish` to check that a join takes it.
+  const hiddenEntryValues = new Map<Value, string>();
   const paramReg = new Map<Value, string>();
   // Parameters created by ensureParam that nothing has read yet. They are deliberately NOT in
   // `defs`: a parameter asserted because a calling convention proves it exists is not evidence that
@@ -343,6 +794,16 @@ export function makeSsaBuilder(
 
   // `preds` lists an entry per CFG EDGE; these are the distinct predecessor BLOCKS.
   const distinctPreds = (b: number): number[] => [...new Set(preds[b])];
+  // the distinct successor blocks of each, built on first ask (`readAfterEveryReachingWrite`)
+  let successorsMemo: number[][] | undefined;
+  const successors = (): number[][] => {
+    if (successorsMemo === undefined) {
+      const succ: number[][] = irBlocks.map(() => []);
+      irBlocks.forEach((_, s) => distinctPreds(s).forEach((p) => succ[p].push(s)));
+      successorsMemo = succ;
+    }
+    return successorsMemo;
+  };
 
   // CALLER-SAVED CLOBBER, for guessed call arities (see trimClobberedCallArgs). Tracked HERE
   // because every register write in every frontend already goes through `writeVar`: a frontend
@@ -363,7 +824,20 @@ export function makeSsaBuilder(
   // predecessors.
   const clobberedLocal: Array<Set<string>> = irBlocks.map(() => new Set());
   const decidedLocal: Array<Set<string>> = irBlocks.map(() => new Set());
+  // `imageLocal[b]`: holding a struct's image a call in `b` handed back, with nothing written since
+  // (`noteStructImage`) — destroyed for a guessed arity alone
+  const imageLocal: Array<Set<string>> = irBlocks.map(() => new Set());
+  const structImages = new Set<Value>();
   const staleCandidates: StaleRead[] = [];
+  const staleByValue = new Map<Value, StaleRead[]>();
+  /** The op-less uses `useOutsideOps` recorded, each at the op count of its block when it happened. */
+  const usesOutsideOps: Array<{ value: Value; block: number; atOp: number }> = [];
+  /** The sole-reader obligations `requireSoleReader` recorded, checked in `finish`. */
+  const soleReaders: Array<{ value: Value; op: Op; refuse: () => void }> = [];
+  /** The reader obligations `requireReader` recorded, checked in `finish`. */
+  const readObligations: Array<{ value: Value; refuse: () => void }> = [];
+  /** The side-effect values `noteIncidentalWrite` recorded. */
+  const incidentalWrites = new Set<Value>();
   // `readVar` runs once per operand, so a memo per (register, verdict) keeps the record list
   // proportional to what a block READS rather than to how many times it reads it. The value a key
   // holds only changes at a write, and the verdict only flips at a call, so a run of identical
@@ -378,6 +852,13 @@ export function makeSsaBuilder(
   // every ISA with no frontend code. Per block, because the consumer asks a per-EDGE question.
   const writeCount: number[] = irBlocks.map(() => 0);
   const lastWriteAt: Array<Map<string, number>> = irBlocks.map(() => new Map());
+  // the ops block `b` held at each register's last write in it (`lastWriteOp`)
+  const lastWriteOp: Array<Map<string, number>> = irBlocks.map(() => new Map());
+  // the value an instruction last read of each register block `b` read since its last write or the
+  // last call destroying it there (since the block's start where neither), and the value it first
+  // read of each before writing it or a call destroying it: `readAfterEveryReachingWrite`
+  const readSinceWrite: Array<Map<string, Value>> = irBlocks.map(() => new Map());
+  const readBeforeWrite: Array<Map<string, Value>> = irBlocks.map(() => new Map());
   const writeOrder: WriteOrder = { lastWrite: new Map(), writes: new Map() };
   fn.writeOrder = writeOrder;
 
@@ -499,23 +980,101 @@ export function makeSsaBuilder(
     }
   };
 
+  const frameWrites = new Set<Value>();
+  // Every key some instruction wrote, for `finish` to find a write to an unsaved callee-saved
+  // register (`LiveInModel.unsavedCalleeSavedRegs`).
+  const writtenKeys = new Set<string>();
+  // A GLOBAL REGISTER VARIABLE (`LiveInModel.globalRegs`) is memory, not an SSA variable: each
+  // read loads the global and each write stores it, at the point the instruction runs, so nothing
+  // is forwarded across a call that may change it and the caller sees every write. Appended to the
+  // block being filled, which is where a frontend puts the op that reads or writes the register.
+  const globalLoads = new Set<Value>();
+  const globalCell = (reg: string, b: number): Value => {
+    if (filled[b]) {
+      throw new Error(`lifting '${name}': global register ${reg} accessed in block ${b} after it was filled`);
+    }
+    const asmName = globalRegs.get(reg)!;
+    const cell = mkValue(T.unk(32));
+    irBlocks[b].ops.push(
+      mkOp('gaddr', { results: [cell], attrs: { sym: globalRegisterSymbol(asmName), globalRegister: asmName } }),
+    );
+    return cell;
+  };
+  // A load of one nothing reads is a frontend reading the register for a question of its own (MIPS
+  // asks of an `addu` operand more than once), not an instruction's read: reading a register does
+  // nothing, so it goes, with its address.
+  const dropUnreadGlobalRegisterLoads = (): void => {
+    if (globalRegs.size === 0) {
+      return;
+    }
+    const read = new Set<Value>();
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        op.operands.forEach((v) => read.add(v));
+        op.successors.forEach((s) => s.args.forEach((v) => read.add(v)));
+      }
+    }
+    for (const blk of irBlocks) {
+      const dead = new Set<Value>();
+      for (const op of blk.ops) {
+        if (op.opcode === 'load' && !read.has(op.results[0]) && globalLoads.has(op.results[0])) {
+          dead.add(op.results[0]);
+          dead.add(op.operands[0]);
+        }
+      }
+      blk.ops = blk.ops.filter((op) => !op.results.some((r) => dead.has(r)));
+    }
+  };
   const writeVar = (reg: string, b: number, v: Value) => {
+    if (globalRegs.has(reg)) {
+      irBlocks[b].ops.push(mkOp('store', { operands: [globalCell(reg, b), v], attrs: { off: 0, width: 4 } }));
+      return;
+    }
+    writtenKeys.add(reg);
+    if (slotKeyOffset(reg) !== null || reg.startsWith(STACK_ARG_PREFIX)) {
+      frameWrites.add(v);
+    }
     noteSlotHome(reg, v);
     noteSlotTraffic(reg, v);
+    for (const c of staleByValue.get(v) ?? []) {
+      if (c.block === b && c.reg !== reg) {
+        c.carriedBy.add(reg);
+      }
+    }
     if (b === 0 && !firstEntryWrite.has(reg)) {
       firstEntryWrite.set(reg, v);
     }
     writtenSinceCall[b].add(reg);
     clobberedLocal[b].delete(reg);
+    imageLocal[b].delete(reg);
     decidedLocal[b].add(reg);
     defs[b].set(reg, v);
     lastWriteAt[b].set(reg, writeCount[b]++);
+    lastWriteOp[b].set(reg, irBlocks[b].ops.length);
+    readSinceWrite[b].delete(reg);
   };
   const readVar = (reg: string, b: number): Value => {
+    if (globalRegs.has(reg)) {
+      const loaded = mkValue(T.unk(32));
+      globalLoads.add(loaded);
+      const cell = globalCell(reg, b);
+      irBlocks[b].ops.push(
+        mkOp('load', { operands: [cell], results: [loaded], attrs: { off: 0, width: 4, signed: true } }),
+      );
+      return loaded;
+    }
     const v = readAny(reg, b);
     noteStaleCandidate(reg, b, v);
+    noteRead(reg, b, v);
     return v;
   };
+  // an instruction's read, for `readAfterEveryReachingWrite`
+  const noteRead = (reg: string, b: number, v: Value): void => {
+    readSinceWrite[b].set(reg, v);
+    if (!lastWriteOp[b].has(reg) && !clobberedLocal[b].has(reg) && !readBeforeWrite[b].has(reg)) {
+      readBeforeWrite[b].set(reg, v);
+    }
+  };
   /** The lookup, with no claim attached. The FRONTEND's read is what asserts "this register holds
    *  this value here"; the lookups this construction makes on its own — a single predecessor's
    *  definition, a phi's operand at each in-edge — are how that one read is answered, not further
@@ -537,7 +1096,9 @@ export function makeSsaBuilder(
       return;
     }
     staleSeen[b].set(key, v);
-    staleCandidates.push({ reg, value: v, block: b, fromOp: irBlocks[b].ops.length, local });
+    const c: StaleRead = { reg, value: v, block: b, fromOp: irBlocks[b].ops.length, local, carriedBy: new Set() };
+    staleCandidates.push(c);
+    staleByValue.set(v, [...(staleByValue.get(v) ?? []), c]);
   };
 
   const newPhi = (reg: string, b: number): Value => {
@@ -575,6 +1136,10 @@ export function makeSsaBuilder(
       // a measurement: a caller cannot pass a value in a register the ABI does not pass arguments
       // in, so a read of one before any write is an uninitialised local.
       const off = slotKeyOffset(reg);
+      if (globalRegs.has(reg)) {
+        // only `readVar` reads one, and never through the SSA: a live-in here would be a parameter
+        throw new Error(`lifting '${name}': global register ${reg} read as an SSA variable`);
+      }
       if (off !== null && !inRange(off, model().ownedLocals) && !inRange(off, model().callerParams)) {
         throw new FrontendUnsupportedError(
           `cannot lift '${name}': ${reg} is read on a path that never stores it, and lies outside ` +
@@ -587,8 +1152,19 @@ export function makeSsaBuilder(
         const op = mkOp('undef', { results: [mkValue(T.unk(32))], attrs: { key: reg } });
         irBlocks[b].ops.unshift(op); // ahead of everything in a block that nothing precedes
         defs[b].set(reg, op.results[0]);
+        if (off === null && model().hiddenInputRegs?.includes(reg)) {
+          hiddenEntryValues.set(op.results[0], reg);
+        }
         return op.results[0];
       }
+      const rank = stackArgIndex(reg);
+      const declared = model().ownArgWords;
+      if (rank !== null && declared !== undefined && rank >= declared) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': it reads incoming stack argument ${rank}, past the ${declared} argument ` +
+            `words its own declaration fills — the declaration and the body disagree`,
+        );
+      }
       // an incoming argument register → function parameter.
       // If one was already asserted for this key (ensureParam), adopt it — minting a second
       // parameter for the same key would put the key in the signature twice.
@@ -702,6 +1278,9 @@ export function makeSsaBuilder(
     if (preds[b].length > 0) {
       return; // a parameter here is a phi; see the precondition on the interface
     }
+    if (slotKeyOffset(key) === null && model().uninitRegs?.includes(key)) {
+      return; // no caller fills it (an argument register past the own declaration's words)
+    }
     for (const p of irBlocks[b].params) {
       if (paramReg.get(p) === key) {
         return; // already a parameter, however it got there
@@ -736,6 +1315,28 @@ export function makeSsaBuilder(
     reaches(reg, b, accept, true);
   const holdsValue = (reg: string, b: number, accept: (v: Value) => boolean = () => true): boolean =>
     reaches(reg, b, accept, false);
+  const everyReachingDef = (reg: string, b: number, accept: (v: Value) => boolean): boolean => {
+    if (!filled.every(Boolean)) {
+      throw new Error('everyReachingDef: asked before every block is filled');
+    }
+    // A block met again on a cycle adds no path the first visit did not already judge.
+    const seen = new Set<number>();
+    const walk = (at: number): boolean => {
+      if (clobberedLocal[at].has(reg)) {
+        return false;
+      }
+      const own = defs[at].get(reg);
+      if (own !== undefined) {
+        return accept(own);
+      }
+      if (seen.has(at)) {
+        return true;
+      }
+      seen.add(at);
+      return preds[at].length > 0 && preds[at].every(walk);
+    };
+    return walk(b);
+  };
 
   const holdsEntryValue = (reg: string, b: number): boolean => {
     // A predecessor is known only once filled, and `b` itself only up to here — so a path that comes
@@ -788,10 +1389,10 @@ export function makeSsaBuilder(
    *  the UNION, against `trimClobberedCallArgs`'s intersection, and for the opposite reason. That
    *  one proves the caller set a register up, which needs every path to agree; this one proves
    *  nobody can name it, which one path is enough for. Meaningful once every block is filled. */
-  const destroyedOnEntry = (): Array<Set<string>> => {
+  const destroyedOnEntry = (images = false): Array<Set<string>> => {
     const destroyedIn: Array<Set<string>> = irBlocks.map(() => new Set());
     const outOf = (b: number): Set<string> => {
-      const out = new Set(clobberedLocal[b]);
+      const out = new Set([...clobberedLocal[b], ...(images ? imageLocal[b] : [])]);
       for (const r of destroyedIn[b]) {
         if (!decidedLocal[b].has(r)) {
           out.add(r);
@@ -814,6 +1415,35 @@ export function makeSsaBuilder(
     }
     return destroyedIn;
   };
+  /** A destroyed value a copy carries OUT of its block (`StaleRead.carriedBy`) is used where any
+   *  block the read's block reaches uses it — an edge argument included, which is how a slot the
+   *  copy stored reaches its reload at a join. The destroyed register itself needs none of this:
+   *  every block it reaches marks it destroyed on entry (`destroyedOnEntry`) and judges its own
+   *  reads. Every later use of the value counts, under whatever name, which can only refuse more. */
+  const carriedOut = (c: StaleRead): boolean => {
+    if (![...c.carriedBy].some((k) => defs[c.block].get(k) === c.value)) {
+      return false;
+    }
+    const index = new Map(irBlocks.map((blk, i) => [blk, i]));
+    const usesIt = (op: Op) => op.operands.includes(c.value) || op.successors.some((s) => s.args.includes(c.value));
+    const seen = new Set<number>();
+    const work = irBlocks[c.block].ops.slice(c.fromOp).flatMap((op) => op.successors.map((s) => s.block));
+    if (irBlocks[c.block].ops.slice(c.fromOp).some(usesIt)) {
+      return true;
+    }
+    for (let blk = work.pop(); blk !== undefined; blk = work.pop()) {
+      const b = index.get(blk);
+      if (b === undefined || seen.has(b)) {
+        continue;
+      }
+      seen.add(b);
+      if (blk.ops.some(usesIt) || usesOutsideOps.some((u) => u.value === c.value && u.block === b)) {
+        return true;
+      }
+      work.push(...blk.ops.flatMap((op) => op.successors.map((s) => s.block)));
+    }
+    return false;
+  };
   const refuseStaleCallerSavedReads = () => {
     if (staleCandidates.length === 0) {
       return;
@@ -824,7 +1454,11 @@ export function makeSsaBuilder(
         continue;
       }
       const ops = irBlocks[c.block].ops;
-      if (ops.slice(c.fromOp).some((op) => op.operands.includes(c.value))) {
+      if (
+        ops.slice(c.fromOp).some((op) => op.operands.includes(c.value)) ||
+        usesOutsideOps.some((u) => u.value === c.value && u.block === c.block && u.atOp >= c.fromOp) ||
+        carriedOut(c)
+      ) {
         throw new FrontendUnsupportedError(
           `cannot lift '${name}': ${c.reg} is read on a path where a call has destroyed it, so what ` +
             `it holds is the callee's and not a value this function named — not modelled`,
@@ -833,6 +1467,297 @@ export function makeSsaBuilder(
     }
   };
 
+  /** Where each value is read: the joins it is an edge argument of, and `null` for an op's operand. */
+  const readersOf = (): Map<Value, Set<Value | null>> => {
+    const readers = new Map<Value, Set<Value | null>>();
+    const note = (v: Value, r: Value | null) => (readers.get(v) ?? readers.set(v, new Set()).get(v)!).add(r);
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        op.operands.forEach((v) => note(v, null));
+        for (const s of op.successors) {
+          s.args.forEach((v, i) => note(v, s.block.params[i]));
+        }
+      }
+    }
+    return readers;
+  };
+
+  /** Each non-entry block param → the argument every in-edge passes it, in edge order. */
+  const joinArgs = (): Map<Value, Value[]> => {
+    const m = new Map<Value, Value[]>();
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        for (const s of op.successors) {
+          if (s.block === irBlocks[0]) {
+            continue;
+          }
+          s.block.params.forEach((p, i) => {
+            (m.get(p) ?? m.set(p, []).get(p)!).push(s.args[i]);
+          });
+        }
+      }
+    }
+    return m;
+  };
+
+  /** ANOTHER STORAGE'S UNDEFINED VALUE IS AN ASSIGNMENT. `int x, y; if (c) x = y;` at ido7.1
+   *  copies the word at 0(sp) into 4(sp) on one path, so the join keyed `sp@4` takes `sp@0`'s
+   *  undefined value as an edge argument. The structurer drops an undefined edge copy (structure.ts
+   *  `undefCarriesNothing`), which is right for the join's OWN storage — that path left the local
+   *  unassigned — and wrong for another's, where the machine ran a load and a store. Each such edge
+   *  argument becomes its own undefined value under the source's key, marked `copied`, which the
+   *  structurer spells as the assignment `x = uninit_sp0` and names as the value it copies. A join
+   *  whose key the builder did not record is left as it was.
+   *
+   *  FRAME WORDS ONLY, both of them. A compiler gives a stack local one word and moves no local from
+   *  word to word, so two words are two locals. A register is no such identity: agbcc keeps a local
+   *  in r8 and moves it to a low register to use it (`synthetic:uninit_spill`), and a spill writes a
+   *  register's local to a word — one source variable under two keys, where a spelled copy would
+   *  invent an assignment the source never wrote. So `x = y` between two locals in registers
+   *  (`uninit_both_saved` on agbcc) still collapses into one undefined value where nothing else
+   *  reads it (below).
+   *
+   *  A REGISTER CACHING TWO FRAME WORDS. ido7.1 -O2 gives an uninitialised local its word and then
+   *  caches it in a register across a loop or an arm: `int x, y; if (c) x = y; else y = x;
+   *  return x - y;` is `lw a0,0(sp); move v1,a0` on one arm and `lw v1,4(sp); move a0,v1` on the
+   *  other, so the joins keyed v1 and a0 each take sp@0's undefined value on one edge and sp@4's on
+   *  the other, and collapsing them into two unrelated undefined values loses that x - y is 0.
+   *  Where the joins one register-keyed join is connected to by its edge arguments (a loop header's
+   *  and the arm join inside it, in `for (…) if (i & 1) x = y;`) take the undefined values of TWO
+   *  OR MORE frame words between them, the register is no one local's home, and each such edge
+   *  argument is marked `copied` too: every one is a load the machine ran. Of ONE frame word only
+   *  (an arm that leaves the cached local as it was) the web is that local's, and stays as it was —
+   *  so long as nothing else reads the value, below.
+   *
+   *  A VALUE READ ELSEWHERE IS A RELATION, whatever the keys. Dropping an edge copy leaves the
+   *  join's local unassigned on that path, which is as undefined as the machine's word only where
+   *  that word is read through this join alone. `int x, z; if (c) z = x; else z = 7; return z - x;`
+   *  at ido7.1 caches x's word 4(sp) in z's register v1 on one arm and reads 4(sp) again for the
+   *  subtraction, so `c != 0` returns 0; with the copy dropped, z's local is unassigned there and
+   *  the C returns garbage. So an undefined edge argument, of any storage and into a join of any
+   *  key (registers too: gcc 2.7.2 keeps x in v1 and runs `move v0,v1`), is a copy here whenever
+   *  ANOTHER JOIN also takes it, since that join's local and this one hold the same value on the
+   *  machine. One the function also reads directly is left to the structurer, which names the
+   *  value as the join's local when it can (`g = x; if (c) x = 5; return x;`) and spells the copy
+   *  when it cannot (structure.ts `undefCarriesNothing`); `collapseUndefinedJoins` keeps such a
+   *  join for it. What agbcc's prologue relates by staging a high register for its push is not
+   *  this function's copy and never reaches here (thumb.ts `prologueSavedRegs`). */
+  const markCopiedUndefs = () => {
+    const defOf = defOpMap(fn);
+    const replaced = new Set<Value>();
+    const frameUndefKey = (v: Value): string | undefined => {
+      const d = defOf.get(v);
+      return d?.opcode === 'undef' && d.attrs.copied !== true && slotKeyOffset(String(d.attrs.key)) !== null
+        ? String(d.attrs.key)
+        : undefined;
+    };
+    // The register-keyed joins whose web of joins takes two or more frame words' undefined values.
+    const mixedRegisterJoins = new Set<Value>();
+    {
+      const incoming = joinArgs();
+      const isRegJoin = (p: Value) => {
+        const k = phiKey.get(p);
+        return incoming.has(p) && k !== undefined && slotKeyOffset(k) === null;
+      };
+      const parent = new Map<Value, Value>();
+      const find = (v: Value): Value => {
+        let r = v;
+        while (parent.get(r) !== undefined && parent.get(r) !== r) {
+          r = parent.get(r)!;
+        }
+        parent.set(v, r);
+        return r;
+      };
+      for (const [p, args] of incoming) {
+        if (!isRegJoin(p)) {
+          continue;
+        }
+        if (!parent.has(p)) {
+          parent.set(p, p);
+        }
+        for (const a of args) {
+          if (isRegJoin(a)) {
+            if (!parent.has(a)) {
+              parent.set(a, a);
+            }
+            parent.set(find(a), find(p));
+          }
+        }
+      }
+      const keysOf = new Map<Value, Set<string>>();
+      for (const [p, args] of incoming) {
+        if (!isRegJoin(p)) {
+          continue;
+        }
+        const root = find(p);
+        const ks = keysOf.get(root) ?? keysOf.set(root, new Set()).get(root)!;
+        for (const a of args) {
+          const k = frameUndefKey(a);
+          if (k !== undefined) {
+            ks.add(k);
+          }
+        }
+      }
+      for (const p of parent.keys()) {
+        if ((keysOf.get(find(p))?.size ?? 0) >= 2) {
+          mixedRegisterJoins.add(p);
+        }
+      }
+    }
+    const readers = readersOf();
+    const joinedElsewhere = (u: Value, p: Value) => [...(readers.get(u) ?? [])].some((r) => r !== null && r !== p);
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        for (const s of op.successors) {
+          if (s.block === irBlocks[0]) {
+            continue;
+          }
+          s.block.params.forEach((p, i) => {
+            const d = defOf.get(s.args[i]);
+            const key = phiKey.get(p);
+            if (d?.opcode !== 'undef' || d.attrs.copied === true || key === undefined) {
+              return;
+            }
+            const frameCopy =
+              d.attrs.key !== key &&
+              slotKeyOffset(String(d.attrs.key)) !== null &&
+              (slotKeyOffset(key) !== null || mixedRegisterJoins.has(p));
+            if (!frameCopy && !joinedElsewhere(s.args[i], p)) {
+              return;
+            }
+            const copy = mkOp('undef', {
+              results: [mkValue(s.args[i].type)],
+              attrs: { key: d.attrs.key, copied: true },
+            });
+            irBlocks[0].ops.unshift(copy);
+            replaced.add(s.args[i]);
+            s.args[i] = copy.results[0];
+          });
+        }
+      }
+    }
+    if (replaced.size > 0) {
+      const used = new Set(
+        irBlocks.flatMap((b) => b.ops.flatMap((o) => [...o.operands, ...o.successors.flatMap((s) => s.args)])),
+      );
+      for (const blk of irBlocks) {
+        blk.ops = blk.ops.filter((o) => !replaced.has(o.results[0]) || used.has(o.results[0]));
+      }
+    }
+  };
+
+  /** A JOIN NO PATH DEFINES IS ONE UNINITIALISED VALUE. A join whose every argument is its own
+   *  storage's undefined value (`markCopiedUndefs` has already turned another frame word's into an
+   *  assignment) would keep its local and lose every assignment to it, since the structurer drops
+   *  each such edge copy, and its own postcondition then reports a local read but never assigned.
+   *  Such a join is replaced by one fresh undefined value at the entry, keyed as the join was,
+   *  which dominates every use the join had. The greatest such set, so a loop that only carries an
+   *  undefined value round (`phi(undef, phi(…))`) collapses with it. Run after the hidden-input
+   *  check, which refuses the joins whose undefined arguments are a hand-written routine's inputs.
+   *  The fresh value lists the other keys whose undefined values it absorbed (`ABSORBED_KEYS`):
+   *  `x = a ? b : c` past a one-word declaration joins r1's and r2's into r4's, and a reader asking
+   *  whether the lift still reads r1 must find it there. */
+  const collapseUndefinedJoins = () => {
+    const incoming = joinArgs();
+    const undefs = new Set<Value>();
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        if (op.opcode === 'undef' && op.attrs.copied !== true) {
+          undefs.add(op.results[0]);
+        }
+      }
+    }
+    if (undefs.size === 0) {
+      return;
+    }
+    // A join one of whose undefined arguments is also read directly keeps it: the fresh value it
+    // would collapse into is a second undefined value where the machine holds one, and the
+    // structurer spells the edge copy instead (`markCopiedUndefs`, A VALUE READ ELSEWHERE).
+    const readers = readersOf();
+    const readDirectly = (a: Value) => undefs.has(a) && (readers.get(a)?.has(null) ?? false);
+    const doomed = new Set(
+      [...incoming.keys()].filter((p) => incoming.get(p)!.length > 0 && !incoming.get(p)!.some(readDirectly)),
+    );
+    for (let changed = true; changed;) {
+      changed = false;
+      for (const p of doomed) {
+        if (incoming.get(p)!.some((a) => a !== p && !undefs.has(a) && !doomed.has(a))) {
+          doomed.delete(p);
+          changed = true;
+        }
+      }
+    }
+    // ...and reaches an undefined value at all: a param only its own back edge feeds is a cycle no
+    // entry reaches (`readRecursive`'s unreachable walk), which carries no value to collapse into.
+    const grounded = new Set<Value>();
+    for (let changed = true; changed;) {
+      changed = false;
+      for (const p of doomed) {
+        if (!grounded.has(p) && incoming.get(p)!.some((a) => undefs.has(a) || grounded.has(a))) {
+          grounded.add(p);
+          changed = true;
+        }
+      }
+    }
+    for (const p of [...doomed]) {
+      if (!grounded.has(p)) {
+        doomed.delete(p);
+      }
+    }
+    if (doomed.size === 0) {
+      return;
+    }
+    const orphans = new Set([...doomed].flatMap((p) => incoming.get(p)!.filter((a) => undefs.has(a))));
+    const defOf = defOpMap(fn);
+    // The keys of the undefined values a join absorbs, through the doomed joins it takes.
+    const absorbed = (p: Value, seen = new Set<Value>()): string[] =>
+      seen.has(p)
+        ? []
+        : (seen.add(p),
+          incoming
+            .get(p)!
+            .flatMap((a) =>
+              undefs.has(a) ? [String(defOf.get(a)!.attrs.key)] : doomed.has(a) ? absorbed(a, seen) : [],
+            ));
+    for (const p of doomed) {
+      const firstUndef = incoming.get(p)!.find((a) => undefs.has(a));
+      const key = phiKey.get(p) ?? (firstUndef && defOf.get(firstUndef)?.attrs.key) ?? '';
+      const from = [...new Set(absorbed(p))].filter((k) => k !== key).sort();
+      const op = mkOp('undef', {
+        results: [mkValue(T.unk(32))],
+        attrs: from.length === 0 ? { key } : { key, [ABSORBED_KEYS]: from.join(',') },
+      });
+      irBlocks[0].ops.unshift(op);
+      replaceAllUsesWith(fn, p, op.results[0]);
+    }
+    for (const blk of irBlocks) {
+      for (let i = blk.params.length - 1; i >= 0; i--) {
+        const p = blk.params[i];
+        if (!doomed.has(p)) {
+          continue;
+        }
+        dropPhiRecord(p);
+        blk.params.splice(i, 1);
+        for (const b2 of irBlocks) {
+          for (const o of b2.ops) {
+            for (const s of o.successors) {
+              if (s.block === blk) {
+                s.args.splice(i, 1);
+              }
+            }
+          }
+        }
+      }
+    }
+    // The undefined arguments the collapsed joins took and nothing else reads.
+    const used = new Set(
+      irBlocks.flatMap((b) => b.ops.flatMap((o) => [...o.operands, ...o.successors.flatMap((s) => s.args)])),
+    );
+    for (const blk of irBlocks) {
+      blk.ops = blk.ops.filter((o) => !orphans.has(o.results[0]) || used.has(o.results[0]));
+    }
+  };
+
   const dropPhiRecord = (p: Value) => {
     phiBlock.delete(p);
     phiKey.delete(p);
@@ -844,13 +1769,130 @@ export function makeSsaBuilder(
     irBlocks,
     readVar,
     readGuessedArg: readAny, // see the interface: the trim is this read's answer, not a refusal
+    noteGuessedArgRead: noteRead,
+    readAtEnd: (reg: string, b: number) => (filled[b] ? readAny(reg, b) : null),
     writeVar,
+    frameWrites,
     paramReg,
     ensureParam,
     hasReachingDef,
     holdsValue,
+    everyReachingDef,
     entryValue,
     holdsEntryValue,
+    writtenSinceCall: (reg: string, b: number) => writtenSinceCall[b].has(reg),
+    lastWriteOp: (reg: string, b: number) => lastWriteOp[b].get(reg),
+    readAfterEveryReachingWrite: (reg, b, { passes, accept, unlowered, answersIfRead }) => {
+      const writes = (at: number) => lastWriteOp[at].has(reg) || clobberedLocal[at].has(reg);
+      // the blocks whose last write of `reg` reaches `b`, and whether a path from the entry wrote none.
+      // `b` is judged up to here: met again round a loop, its end is no write that reaches here yet
+      const writers: number[] = [];
+      let fromEntry = false;
+      const back = new Set<number>([b]);
+      const walkBack = (at: number): void => {
+        for (const p of distinctPreds(at)) {
+          if (back.has(p)) {
+            continue;
+          }
+          back.add(p);
+          if (filled[p] && writes(p)) {
+            writers.push(p);
+          } else if (preds[p].length === 0) {
+            fromEntry = true;
+          } else {
+            walkBack(p);
+          }
+        }
+      };
+      walkBack(b);
+      const succs = (at: number): number[] => successors()[at].filter((s) => s !== b);
+      // forward from a write of `written` (none for the entry's): the first read on each path, until
+      // another write ends it
+      const ahead = (from: number, seen: Set<number>, written: Value | undefined): boolean =>
+        succs(from).some((s) => {
+          if (seen.has(s)) {
+            return false;
+          }
+          seen.add(s);
+          if (!filled[s]) {
+            return written !== undefined && unlowered(written);
+          }
+          const read = readBeforeWrite[s].get(reg);
+          if (read !== undefined) {
+            return accept(read);
+          }
+          return !writes(s) && ahead(s, seen, written);
+        });
+      const readAfter = (w: number): boolean => {
+        const read = readSinceWrite[w].get(reg);
+        return read !== undefined ? accept(read) : ahead(w, new Set(), defs[w].get(reg));
+      };
+      // a call's destroying it is no write of this function's: it neither counts nor answers; and a
+      // write of a value `answersIfRead` takes answers only where it was read after
+      const own = writers.filter((w) => {
+        const v = defs[w].get(reg)!;
+        return !clobberedLocal[w].has(reg) && passes(v) && (!answersIfRead(v) || readAfter(w));
+      });
+      // nor does the entry's value unread: nothing wrote it for the call. Read, it answers by its
+      // value too (`unlowered`): no write of this function's made it, so no path out of one places
+      // the read, and a path from the entry into a block not lowered yet holds reads nobody has seen
+      const param = irBlocks[0].params.find((v) => paramReg.get(v) === reg);
+      const entryRead =
+        fromEntry &&
+        ((param !== undefined && unlowered(param)) ||
+          (readBeforeWrite[0].has(reg) ? accept(readBeforeWrite[0].get(reg)!) : ahead(0, new Set(), undefined)));
+      // where a call destroyed it on every path in, it holds what a callee left there and nothing
+      // this function named: no argument, whatever an earlier lookup's phi of the bytes before
+      // those calls says (counted, sbk func_800B6E5C_A6D0C's a1 and a2 would be minted as entry
+      // parameters the trim cuts from the call but leaves in the signature)
+      if (!fromEntry && writers.length > 0 && writers.every((w) => clobberedLocal[w].has(reg))) {
+        return true;
+      }
+      // no write of this function's left to judge, and no entry value read: nothing to answer
+      if (own.length === 0 && !entryRead) {
+        return undefined;
+      }
+      return own.every(readAfter);
+    },
+    writtenOnEveryPath: (reg, b, stop, visit) => {
+      // `b` is judged up to here on the first visit; met again round a loop, it is the end of `b`,
+      // which a back edge brings, and a cycle adds no path the first visit did not judge
+      const seen = new Set<number>([b]);
+      const walk = (at: number): boolean => {
+        if (writtenSinceCall[at].has(reg) || clobberedLocal[at].has(reg)) {
+          return true;
+        }
+        const ps = distinctPreds(at);
+        return (
+          ps.length > 0 &&
+          ps.every((p) => {
+            if (seen.has(p)) {
+              return true;
+            }
+            seen.add(p);
+            if (!filled[p] || stop(p)) {
+              return false;
+            }
+            visit?.(p);
+            return walk(p);
+          })
+        );
+      };
+      return walk(b);
+    },
+    requireSoleReader: (value: Value, op: Op, refuse: () => void) => {
+      soleReaders.push({ value, op, refuse });
+    },
+    requireReader: (value: Value, refuse: () => void) => {
+      readObligations.push({ value, refuse });
+    },
+    noteIncidentalWrite: (v: Value) => {
+      incidentalWrites.add(v);
+    },
+    isIncidentalWrite: (v: Value) => incidentalWrites.has(v),
+    useOutsideOps: (v: Value, b: number) => {
+      usesOutsideOps.push({ value: v, block: b, atOp: irBlocks[b].ops.length });
+    },
     noteCall: (b: number, clobbers: readonly string[]) => {
       callsIn.add(b);
       // the callee clobbers the caller-saved registers, its own result register included — see
@@ -859,26 +1901,41 @@ export function makeSsaBuilder(
       for (const r of clobbers) {
         clobberedLocal[b].add(r);
         decidedLocal[b].add(r);
+        readSinceWrite[b].delete(r);
       }
+      imageLocal[b] = new Set();
+    },
+    noteStructImage: (b: number, reg: string, image: Value) => {
+      imageLocal[b].add(reg);
+      structImages.add(image);
     },
     recordGuessedCall: (
       op: Op,
       b: number,
       abi: { argRegs: string[]; returnReg: string },
       passesCalleeResult?: (result: Value) => boolean,
+      trimmed?: (cut: readonly string[], kept: readonly string[]) => void,
+      withholdsSetupArgs?: () => boolean,
+      asksEveryCut?: () => boolean,
+      floor?: number,
     ) => {
       abiSeen = abi;
       guessedCalls.push({
         block: b,
         op,
         passesCalleeResult,
+        trimmed,
+        withholdsSetupArgs,
+        asksEveryCut,
+        ...(floor ? { floor } : {}),
         freshBefore: new Set(writtenSinceCall[b]),
         afterCallInBlock: callsIn.has(b), // `noteCall` runs after this, so this means an EARLIER call
-        returnRegBefore: clobberedLocal[b].has(abi.returnReg)
-          ? 'destroyed'
-          : decidedLocal[b].has(abi.returnReg)
-            ? 'written'
-            : 'inherited',
+        returnRegBefore:
+          clobberedLocal[b].has(abi.returnReg) || imageLocal[b].has(abi.returnReg)
+            ? 'destroyed'
+            : decidedLocal[b].has(abi.returnReg)
+              ? 'written'
+              : 'inherited',
       });
     },
     markFilled: (b: number) => {
@@ -904,13 +1961,26 @@ export function makeSsaBuilder(
           argRegs: abiSeen.argRegs,
           returnReg: abiSeen.returnReg,
           calleeResults,
-          destroyedIn: destroyedOnEntry(),
+          destroyedIn: destroyedOnEntry(true),
           preds,
           blocks: irBlocks,
           freshAtEnd: writtenSinceCall,
           callsIn,
           sites: guessedCalls,
         });
+        // what the trim leaves a guess passing a struct's image: a copy of it into another argument
+        // register (`add r1, r0, #0`), which is as undecided as the image itself
+        for (const site of guessedCalls) {
+          const at = callArgs(site.op).findIndex((v) => structImages.has(v));
+          if (at >= 0) {
+            // worded as `trimClobberedCallArgs` refuses the image left in the return register itself
+            const callee = site.op.attrs.target;
+            throw new FrontendUnsupportedError(
+              `cannot lift '${name}': argument ${at + 1} of the call to ${typeof callee === 'string' ? `'${callee}'` : 'a callee'} ` +
+                `is a struct an earlier call handed back in ${abiSeen.returnReg}, and nothing here passes one on as an argument — not modelled`,
+            );
+          }
+        }
       }
       irBlocks.forEach((blk, i) => writeOrder.writes.set(blk, writeCount[i]));
       // The phis nothing reads at all — a register two paths leave holding different junk (a loop
@@ -929,6 +1999,155 @@ export function makeSsaBuilder(
       refuseStaleCallerSavedReads();
       simplifyTrivialPhis(fn, dropPhiRecord);
       pruneDeadParams(fn, dropPhiRecord);
+      // A SOLE-READER OBLIGATION (`requireSoleReader`), over the finished function: after both
+      // prunes, so a join nothing reads is no reader.
+      for (const { value, op, refuse } of soleReaders) {
+        const reads = (o: Op) =>
+          o !== op && (o.operands.includes(value) || o.successors.some((e) => e.args.includes(value)));
+        if (
+          frameWrites.has(value) ||
+          usesOutsideOps.some((u) => u.value === value) ||
+          irBlocks.some((blk) => blk.ops.some(reads))
+        ) {
+          refuse();
+        }
+      }
+      // …AND A READER OBLIGATION (`requireReader`), over the same finished function. A join the
+      // value reaches is followed to its own readers, and a `ret` is no reader: a frontend returns
+      // the return register at every `ret` whatever the function's declared type.
+      for (const { value, refuse } of readObligations) {
+        const reached = new Set<Value>([value]);
+        for (let grew = true; grew;) {
+          grew = false;
+          for (const blk of irBlocks) {
+            for (const op of blk.ops) {
+              for (const e of op.successors) {
+                e.block.params.forEach((p, i) => {
+                  if (reached.has(e.args[i]) && !reached.has(p)) {
+                    reached.add(p);
+                    grew = true;
+                  }
+                });
+              }
+            }
+          }
+        }
+        const read = [...reached].some(
+          (v) =>
+            frameWrites.has(v) ||
+            usesOutsideOps.some((u) => u.value === v) ||
+            irBlocks.some((blk) => blk.ops.some((o) => o.opcode !== 'ret' && o.operands.includes(v))),
+        );
+        if (!read) {
+          refuse();
+        }
+      }
+      // A HIDDEN INPUT IS NO UNINITIALISED LOCAL (`LiveInModel.hiddenInputRegs`). After the
+      // trivial-phi pass, so a join every path of which arrives undefined is no join. The
+      // compiler's local is assigned on SOME path, and its entry value meets that definition as a
+      // join's edge argument; once it does, a direct use is the same local read before that
+      // assignment (`uninitfirst`). An entry value that meets no such definition is the input.
+      //
+      // MEETING A JOIN IS NOT MEETING A DEFINITION. A register that carries an input round a loop
+      // (`addiu t0,t0,-1; bnez t0,top` on a hand-written count) sends its entry value into the
+      // loop header's join too, and the back edge's argument is that input's own next value. So
+      // the join must also take an INDEPENDENT definition (`independentOfEntry`): a value no chain
+      // of operands or join arguments derives from the entry value, other than through a join one
+      // of whose other arguments is itself independent. A conditional assignment inside a loop
+      // (`for (…) if (c) x = i;`) meets that through the inner join, and so does one the loop then
+      // transforms before its back edge — a bit reader's `if (!bits) code = *src++; … code <<= 1;`,
+      // whose shift reaches the entry value only through the join the load also feeds. A counter
+      // that only advances the entry value, and two undefined values joined (`phi(t0, v1)`), do
+      // not, and refuse. A bit reader HANDED its buffer meets the same join and lifts with the
+      // input dropped: the rule's blind side, at `O32_SCRATCH_REGS` in target.ts.
+      if (hiddenEntryValues.size > 0) {
+        const incoming = joinArgs();
+        const defOf = defOpMap(fn);
+        // Read forwards: who reads each value, as an operand or as a join's edge argument.
+        const readers = new Map<Value, Value[]>();
+        const addReader = (v: Value, r: Value) => (readers.get(v) ?? readers.set(v, []).get(v)!).push(r);
+        for (const blk of irBlocks) {
+          for (const op of blk.ops) {
+            for (const v of op.operands) {
+              for (const r of op.results) {
+                addReader(v, r);
+              }
+            }
+          }
+        }
+        for (const [p, args] of incoming) {
+          for (const a of args) {
+            addReader(a, p);
+          }
+        }
+        const isJoin = (v: Value) => incoming.has(v) && !irBlocks[0].params.includes(v);
+        /** The values independent of `u`, as a least fixpoint. A join is independent once one of
+         *  its arguments is; any other value once no chain of operands or join arguments reaches
+         *  `u` without passing through an independent join. Grown from nothing, so no join is
+         *  independent on the strength of its own back edge (`addiu t0,t0,-1` round a loop). */
+        const independentOfEntry = (u: Value): ((v: Value) => boolean) => {
+          const absorbing = new Set<Value>();
+          for (;;) {
+            const derived = new Set<Value>([u]);
+            const work = [u];
+            for (let w = work.pop(); w !== undefined; w = work.pop()) {
+              for (const r of readers.get(w) ?? []) {
+                if (!derived.has(r) && !absorbing.has(r)) {
+                  derived.add(r);
+                  work.push(r);
+                }
+              }
+            }
+            const indep = (v: Value) =>
+              v !== u && defOf.get(v)?.opcode !== 'undef' && (absorbing.has(v) || (!isJoin(v) && !derived.has(v)));
+            let grew = false;
+            for (let changed = true; changed;) {
+              changed = false;
+              for (const [p, args] of incoming) {
+                if (isJoin(p) && !absorbing.has(p) && args.some(indep)) {
+                  absorbing.add(p);
+                  changed = grew = true;
+                }
+              }
+            }
+            if (!grew) {
+              return indep;
+            }
+          }
+        };
+        const metMemo = new Map<Value, boolean>();
+        const met = (u: Value): boolean => {
+          let m = metMemo.get(u);
+          if (m === undefined) {
+            const joins = [...incoming.entries()].filter(([p, args]) => isJoin(p) && args.includes(u));
+            const indep = joins.length === 0 ? undefined : independentOfEntry(u);
+            m = indep !== undefined && joins.some(([, args]) => args.some(indep));
+            metMemo.set(u, m);
+          }
+          return m;
+        };
+        for (const blk of irBlocks) {
+          for (const op of blk.ops) {
+            const reg = [...op.operands, ...op.successors.flatMap((s) => s.args)]
+              .filter((v) => hiddenEntryValues.has(v) && !met(v))
+              .map((v) => hiddenEntryValues.get(v))
+              .find((r) => r !== undefined);
+            if (reg !== undefined) {
+              throw new FrontendUnsupportedError(
+                `cannot lift '${name}': ${reg} is read before anything writes it, and ` +
+                  `no join meets it with a definition of its own — an input handed over outside the ` +
+                  `C convention (a save routine's frame address, a member-function pointer, a register ` +
+                  `hand-written asm passes a value in, a count it carries round a loop), not modelled ` +
+                  `as an uninitialised local`,
+              );
+            }
+          }
+        }
+      }
+      dropUnreadGlobalRegisterLoads();
+      markCopiedUndefs();
+      collapseUndefinedJoins();
+      simplifyTrivialPhis(fn, dropPhiRecord);
       // SEAL THE PARAMETER EVIDENCE (ir/core.ts `ParamEvidence`). Here and not at the store or the
       // write, because `pruneDeadParams` above is the last thing that can retire an entry
       // parameter, and an observation about a value no longer in the signature is one the reader
@@ -945,6 +2164,12 @@ export function makeSsaBuilder(
         }
       }
       const defs0 = defOpMap(fn);
+      for (const v of deadHomed) {
+        const d = defs0.get(v);
+        if (d?.opcode === 'undef') {
+          d.attrs[HOMED_UNDEF] = true;
+        }
+      }
       for (const p of irBlocks[0].params) {
         const reg = paramReg.get(p);
         const first = reg === undefined ? undefined : firstEntryWrite.get(reg);
@@ -991,6 +2216,24 @@ export function makeSsaBuilder(
               `(partially-initialised local, or storage this function does not own) — not modelled`,
           );
         }
+        // …AND NEITHER MAY A CALLEE-SAVED REGISTER THIS FUNCTION NEVER SAVED
+        // (`LiveInModel.unsavedCalleeSavedRegs`): no caller passes an argument there, so as a
+        // parameter it would be read from the argument register a C caller fills instead.
+        if (key !== undefined && koff === null && model().unsavedCalleeSavedRegs?.includes(key)) {
+          throw new FrontendUnsupportedError(
+            `cannot lift '${name}': it reads callee-saved ${key} before writing it, and ${unsavedWhy([key])} — ` +
+              `a value no caller passes as an argument${globalNote([key])} — not modelled`,
+          );
+        }
+      }
+      // A write to one is handed back to the caller (a global register variable's store,
+      // `mov r8, r0`): no C local spells it, and dropping it drops an effect.
+      const leaked = (model().unsavedCalleeSavedRegs ?? []).filter((r) => writtenKeys.has(r));
+      if (leaked.length > 0) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': it writes callee-saved ${leaked.join(', ')}, and ${unsavedWhy(leaked)} — ` +
+            `the caller sees the write${globalNote(leaked)} — not modelled`,
+        );
       }
     },
   };
@@ -1016,8 +2259,11 @@ export function makeSsaBuilder(
  *  the first drops that argument and every one after it: `ac-decomp:evw_anime_colreg_manual` sets
  *  up seven registers for `evw_color_set` and, with r4 at its incoming value, lifts to
  *  `evw_color_set(a0);` — its divide, its multiply and five arguments gone. Which reading it is
- *  cannot be decided here — the function's own arity is exactly what is missing — so this refuses
- *  and names the gap rather than guessing. A declaration answers it, and this scan is never
+ *  cannot be decided from the register file alone — the function's own arity is exactly what is
+ *  missing — so this refuses and names the gap rather than guessing, unless `decide` answers it:
+ *  the lowering may show that the register above the gap is surely an argument, and where argument
+ *  words fill in order the gap below it is then this function's own arguments passed on
+ *  (frontend/call-plan.ts `decideGap`). A declaration answers it outright, and this scan is never
  *  weighed against one: it is a guess, and a guess that cannot fail cannot witness a width a
  *  declaration left open. */
 export function fallbackArgc(
@@ -1025,27 +2271,170 @@ export function fallbackArgc(
   argRegs: readonly string[],
   bi: number,
   opts: {
-    accept?: (v: Value) => boolean;
-    /** the call's function and address, and the frontend's own refusal */
-    gap?: { name: string; at: number; fail: FrontendRefusal };
-  } = {},
+    /** whether `v`, reaching argument register `reg`, is a value the caller may have set up */
+    accept?: (v: Value, reg: string) => boolean;
+    /** the call's function, where it is (`CallSite`'s `guess.at`), and the frontend's own refusal */
+    gap: { name: string; at: number | string; fail: FrontendRefusal };
+    /** the leading arguments a declaration states (`GuessedCallSite.floor`): counted whether or not
+     *  the caller set them up, so only the registers above them are guessed */
+    floor?: number;
+    /** whether argument register `reg` still holds this function's own incoming value at the call
+     *  (an entry parameter, which a read leaves behind as a definition) on some path the caller
+     *  did not set it up on: one a call destroyed it on ends there, and one this block wrote it on
+     *  since its last call set it up (`CallDeclarations.lower` asks it) */
+    entry?: (reg: string) => boolean;
+    /** whether the gap `gap` — argument registers nothing reaches, in order — below `set`, the next
+     *  one a value reaches, is decided: the frontend shows `set` holds an argument, so `gap` holds
+     *  arguments passed on unchanged (`CallDeclarations.lower`'s `decideGap`). Handed the gap's
+     *  refusal, owed should a proof it defers fail. Absent, or false, the gap refuses. It is asked
+     *  again with an empty `gap` for every register the count takes past a decided gap. Each must be
+     *  proven an argument the same way, or the gap refuses. */
+    decide?: (gap: readonly string[], set: string, refuse: () => void) => boolean;
+    /** whether what a jump-table dispatch parked in argument register `reg` reaches the call
+     *  (`CallSite.parked`). Where nothing `accept` takes reaches it too, the count stops below it: no
+     *  compiler hands a callee the dispatch's own register, so no register above it is an argument.
+     *
+     *  WHY THIS STOPS WHERE A CALL-DESTROYED REGISTER REFUSES (`r2 holds a value and r1 holds
+     *  none`): where the value above came from. A call destroys every caller-saved register, so one
+     *  holding a value after it was written since, for a call — an argument as likely as not. A
+     *  dispatch clobbers only its idiom's registers, and agbcc moves a value it keeps live across the
+     *  switch out of them, upward, before the idiom runs (`add r2,r1,#0` ahead of the `lsl` in a
+     *  switch on r0 whose cases call): the value above the parked register was set up for the switch,
+     *  not for the call. The cost is a value a case itself writes above the parked register, dropped
+     *  too (`mov r2,#5; mov r0,#1; bl g` lifts `g(1)`): no compiler measured writes one there. A
+     *  parked register a call in the case destroyed is that call's hole, not the dispatch's, and it
+     *  stops the count only where no register above holds a value written since that call
+     *  (`SsaBuilder.holdsValue`): `bl h; mov r2,#5; mov r0,#1; bl g` refuses, while `add r3,r1,#0`
+     *  ahead of the idiom and `bl h; mov r0,#1; bl g` in a case lifts `g(1)` — the gap rule's
+     *  `setUp` walks through calls and would count r3's copy, which `h` destroyed. */
+    parked?: (reg: string) => boolean;
+    /** how many argument words the callee's own body reads at most (frontend/callee-body.ts),
+     *  asked only where it can answer something. It is an upper bound on what the callee READS, and
+     *  a source call passes more than that whenever a parameter goes unused or a K&R call hands
+     *  extra arguments — `setx(a + 1, 4)` to a body reading only its first, `rd1(a, b, 7)` to one
+     *  reading r0 — so it never caps what the caller set up for the call: such a register stays
+     *  counted, and a value above a gap still decides the gap below it (`decide`). It answers only
+     *  for registers at or past it, whose being arguments changes nothing the callee computes:
+     *    - one that is a `leftover` stops the count: a write something else read since, which the
+     *      call found there (`gH = 5; gA = rnd()` leaves the store's 5 in r0, which the guess took as
+     *      `rnd(5)`). A copy made for the call is none, whatever read its value before
+     *      (`g4(a, b, c, d); un(a, b, c, d)` copies a..d back from their homes for `un`);
+     *    - a gap starting there, under a register that is a leftover or that no proof makes an
+     *      argument, stops the count at the gap rather than refuse.
+     *  A gap BELOW the bound refuses as ever, whatever lies above it: the callee may read it, and it
+     *  holds this function's own incoming value or nothing. `gp = 3; gq = rd1(a)` leaves the store's 3
+     *  in r1 above r0's a, and stopping there would drop the `a` rd1 reads. */
+    bound?: () => number | undefined;
+    /** whether what reaches argument register `reg` was written for something other than the call,
+     *  which read it since, and left there (frontend/call-plan.ts `leftover`). Asked only at or past
+     *  `bound`. */
+    leftover?: (reg: string) => boolean;
+  },
 ): number {
+  const accept = opts.accept ?? (() => true);
   // whether the caller set argument register k up: a definition reaches it, through a call too
-  const setUp = (k: number) => ssa.hasReachingDef(argRegs[k], bi, opts.accept);
-  let n = 0;
-  while (n < argRegs.length && setUp(n)) {
-    n++;
+  const setUp = (k: number) => ssa.hasReachingDef(argRegs[k], bi, (v) => accept(v, argRegs[k]));
+  const { name, at, fail } = opts.gap;
+  const call = typeof at === 'number' ? `at 0x${at.toString(16)}` : at;
+  const floor = opts.floor ?? 0;
+  // the registers past the lowest parked one are none of the call's: neither counted nor a gap's top
+  const parkedAt = argRegs.findIndex((r, k) => k >= floor && opts.parked?.(r) === true && !setUp(k));
+  const top = parkedAt < 0 ? argRegs.length : parkedAt;
+  // the run of argument registers the caller set up from `from`, each past a declaration's
+  // stated words asked whether it still holds the incoming value
+  // whether argument register `k` lies at or past what the callee's own body reads
+  const unread = (k: number): boolean => {
+    const b = opts.bound?.();
+    return b !== undefined && k >= b;
+  };
+  // past the bound, a leftover is no argument (`bound`): leftover first, the cheaper question
+  const notPassed = (k: number): boolean => opts.leftover?.(argRegs[k]) === true && unread(k);
+  const run = (from: number): number => {
+    let n = from;
+    while (n < top && setUp(n) && !notPassed(n)) {
+      // PAST A DECLARATION'S STATED WORDS, A REGISTER STILL HOLDING ITS INCOMING VALUE REFUSES. A
+      // read of it (a home store, a compare, a store to a global) leaves the entry parameter behind
+      // as a definition, so it reads as set up, and it is exactly as undecidable as the gap below: the
+      // function's own argument passed on, or one the call is not handed. Counted, it is an argument
+      // the source never passed — `int logv(const char *, int, ...)` and `logv(s, c) + 1` in a
+      // function whose unused third parameter IDO home-stores lifts `logv(a0, a1, a2)`. Below a
+      // floor the scan never asks, and with none the guess keeps counting it: there it is the far
+      // commoner `if (a) g(a)`, and the same refusal declines 17 lifts of kleod's 20 units and 40 of
+      // sa3's (`DecompressAlloc(a0)`, `m4aSongNumStart(a1)`), where the floored rule moves none.
+      //
+      // ONLY A PATH THE ENTRY VALUE STILL ARRIVES BY IS ASKED. `setUp` walks through calls, so an
+      // entry value a call destroyed reaches it too — `g(x); dprint(s)` — and that register holds
+      // nothing; the trim cuts it (`trimClobberedCallArgs`) and `dprint(a0)` is the bytes. And a
+      // register this block wrote since its last call was set up here, by the copy that put the
+      // value back — `g(y); dprint(s, x)` re-sets r1 from a saved copy — whatever value SSA names.
+      if (floor > 0 && opts.entry?.(argRegs[n])) {
+        fail(
+          `cannot lift '${name}': the call ${call} has a prototype stating only its first ${floor} ` +
+            `argument${floor === 1 ? '' : 's'}, and ${argRegs[n]} past them still holds this function's own incoming ` +
+            'value — an argument passed on unchanged and one the call is not handed look the same here, so the ' +
+            'argument count is not decidable',
+        );
+      }
+      n++;
+    }
+    return n;
+  };
+  // where the run stopped at a register set up but no argument (`bound`), every one above is past
+  // the bound too, and the count ends there
+  const stoppedPast = (n: number): boolean => n < top && setUp(n);
+  let n = run(floor);
+  if (stoppedPast(n)) {
+    return n;
   }
-  if (opts.gap !== undefined) {
-    const { name, at, fail } = opts.gap;
-    for (let k = n + 1; k < argRegs.length; k++) {
-      if (setUp(k)) {
+  // A GAP BELOW A REGISTER THAT HOLDS A VALUE refuses, unless the frontend decides it: then the run
+  // goes on through the gap and the register above it, and the next gap is asked the same.
+  //
+  // PAST A DECIDED GAP, EVERY REGISTER THE RUN COUNTS MUST BE PROVEN TOO (asked of `decide` with an
+  // empty gap), or the gap refuses. The decision says the register above the gap is an argument and
+  // nothing about the ones above that. Without the gap's refusal the run would count whatever reaches
+  // them: a store's address or value, a discarded volatile read, a temp, an incoming value read
+  // elsewhere. Measured 2026-10-18 at canonical flags: `gp[1] = 3; return g(a, -gy) + 1;` would
+  // lift `g(a0, -gy, &gp)` on agbcc, `return g(a, c + 1) + 1;` `g(a0, a2 + 1, a2)` on all seven
+  // toolchains, and `*(volatile int *)K; g(a, b, (short)c)` made agbcc's discarded read a fourth
+  // argument.
+  for (let k = n + 1; k < top; k++) {
+    if (setUp(k)) {
+      const [gapAt, setAt] = [n, k];
+      const refuse = () =>
         fail(
-          `cannot lift '${name}': the call at 0x${at.toString(16)} has no prototype, ${argRegs[k]} holds a ` +
-            `value and ${argRegs[n]} holds none — an argument register left at its incoming value and one ` +
+          `cannot lift '${name}': the call ${call} ` +
+            (opts.floor
+              ? `has a prototype stating only its first ${opts.floor} argument${opts.floor === 1 ? '' : 's'}`
+              : 'has no prototype') +
+            `, ${argRegs[setAt]} holds a ` +
+            `value and ${argRegs[gapAt]} holds none — an argument register left at its incoming value and one ` +
             `the call does not pass look the same here, so the argument count is not decidable`,
         );
+      // the gap and the register above it are past what the callee reads: no argument it can tell
+      // from a missing one, so the count stops below the gap as at a gapless call
+      if (opts.leftover?.(argRegs[k]) === true && unread(gapAt)) {
+        return gapAt;
+      }
+      if (!opts.decide?.(argRegs.slice(n, k), argRegs[k], refuse)) {
+        if (unread(gapAt)) {
+          return gapAt;
+        }
+        refuse();
       }
+      n = run(k);
+      const stopped = stoppedPast(n);
+      for (let above = k + 1; above < n; above++) {
+        if (!opts.decide?.([], argRegs[above], refuse)) {
+          if (unread(above)) {
+            return above;
+          }
+          refuse();
+        }
+      }
+      if (stopped) {
+        return n;
+      }
+      k = n;
     }
   }
   return n;
@@ -1068,6 +2457,25 @@ export interface GuessedCallSite {
   /** which earlier callee's result in the return register is an argument here, not a leftover:
    *  the site's lowering says so ({@link SsaBuilder.recordGuessedCall}). Absent where none is. */
   passesCalleeResult?: (result: Value) => boolean;
+  /** handed the FRESH argument registers the trim cuts from this site's guess, and the ones it
+   *  keeps — the lowering's `CallSite.leftOut` question, asked again where the arity shrinks a
+   *  second time. An unfresh cut is the trim's own proof; a fresh one went with a hole below it
+   *  (see {@link trimClobberedCallArgs}), which proves nothing. The `/setup-args` reading asks it a
+   *  third time, of the cut registers the call's own block wrote (of every one it cuts, where
+   *  `asksEveryCut`), and a refusal there withholds that reading for the site instead of declining.
+   *  Absent where nothing is asked. */
+  trimmed?: (cut: readonly string[], kept: readonly string[]) => void;
+  /** whether the frontend withholds the `/setup-args` reading from this site whatever it would cut
+   *  (`CallSite.withholdsSetupArgs`). Absent where it does not. */
+  withholdsSetupArgs?: () => boolean;
+  /** whether the `/setup-args` reading of this site asks `trimmed` of every register it cuts, an
+   *  earlier block's leftovers included ({@link narrowingKeepsFrameAddresses};
+   *  `CallSite.asksEveryCut`). Absent where it asks only of what the call's own block wrote. */
+  asksEveryCut?: () => boolean;
+  /** how many leading arguments a declaration STATES, so neither reading cuts below them: the
+   *  fixed parameters of a variadic declaration that are each one word (frontend/call-plan.ts
+   *  `variadicFloor`). Only the arguments past them are guessed. Absent where none is stated. */
+  floor?: number;
 }
 
 export interface CallArgTrim {
@@ -1313,8 +2721,14 @@ export function trimClobberedCallArgs(inp: CallArgTrim): void {
   };
   for (const s of sites) {
     const fresh = s.afterCallInBlock ? s.freshBefore : new Set([...freshIn[s.block], ...s.freshBefore]);
-    const n = argcAt(s, fresh);
+    const n = Math.max(s.floor ?? 0, argcAt(s, fresh));
     if (n < callArgs(s.op).length) {
+      // only the FRESH ones: an unfresh register is the trim's proof (a path reaches here with
+      // nothing set up in it since a call), a fresh one went with a hole below it
+      s.trimmed?.(
+        argRegs.slice(n, callArgs(s.op).length).filter((r) => fresh.has(r)),
+        argRegs.slice(0, n),
+      );
       truncateCallArgs(s.op, n);
     }
     // The SHORTER arity the same evidence also allows, recorded for {@link narrowToSetupArgs}: the
@@ -1334,8 +2748,12 @@ export function trimClobberedCallArgs(inp: CallArgTrim): void {
     const dropsPassed = passed && provenConstant(new Set([result, callArgs(s.op)[0]]), s.block);
     const localFresh =
       setsUpLater(s.freshBefore) || (passed && !dropsPassed) ? new Set([argRegs[0], ...s.freshBefore]) : s.freshBefore;
-    const local = Math.min(runOfFresh(localFresh, 0), callArgs(s.op).length);
-    if (local < callArgs(s.op).length) {
+    const local = Math.min(Math.max(s.floor ?? 0, runOfFresh(localFresh, 0)), callArgs(s.op).length);
+    if (
+      local < callArgs(s.op).length &&
+      s.withholdsSetupArgs?.() !== true &&
+      narrowingKeepsFrameAddresses(s, argRegs, local)
+    ) {
       setupArgc.set(s.op, local);
       if (local === 0 && dropsPassed) {
         discardsPassedResult.add(s.op);
@@ -1344,6 +2762,45 @@ export function trimClobberedCallArgs(inp: CallArgTrim): void {
   }
 }
 
+/** Whether the narrower reading of `s` ({@link narrowToSetupArgs}, cutting it to `local` arguments)
+ *  passes the lowering's `CallSite.leftOut` question too (`GuessedCallSite.trimmed`). That reading
+ *  is applied in the ranker AFTER the lift and its frame audit, so nothing downstream re-asks it: a
+ *  register it cuts can hold a frame address set up in the call's own block (`mov r2, sp`) above an
+ *  argument that came from an earlier one, and the cut lifts `g(a, b, s)` as `g(a)`, leaving the
+ *  stores to `s` dead.
+ *
+ *  ONLY WHAT THE CALL'S OWN BLOCK WROTE is asked (`freshBefore`). That a value an earlier block left
+ *  in a register is dead is this reading's whole guess, and a frame address is no exception: agbcc
+ *  keeps `mov r3, sp` as a store base across blocks and calls `TransformSprite(s, t)` with it still
+ *  in r3 (sa3 sub_805DADC), where the cut is the right arity. A register this block wrote is not
+ *  that guess — the block set it up for the call — so where it may hold a frame address the call
+ *  passes, the cut would drop an argument. A refusal withholds this candidate for this site only;
+ *  the default reading stands. A leftover the guess was wrong about is caught of the lifted IR
+ *  instead, where the cut leaves the object it addresses unread ({@link cutsUnreadFrameObjects}).
+ *
+ *  …AND EVERY REGISTER IT CUTS where the frontend says so (`GuessedCallSite.asksEveryCut`): a
+ *  function whose frame verdict reads every argument register a call holds as possibly handed
+ *  over, where a frame address an earlier block left is not the dead base this reading guesses at,
+ *  and the IR question cannot settle it when the object is read elsewhere too
+ *  (`if (a) h(b, a, t); else *q = t[0];` with `&t` left in r2). The question refuses only frame
+ *  addresses, so a call that cuts none still narrows. */
+function narrowingKeepsFrameAddresses(s: GuessedCallSite, argRegs: readonly string[], local: number): boolean {
+  const every = s.asksEveryCut?.() === true;
+  const cut = argRegs.slice(local, callArgs(s.op).length).filter((r) => every || s.freshBefore.has(r));
+  if (s.trimmed === undefined || cut.length === 0) {
+    return true;
+  }
+  try {
+    s.trimmed(cut, argRegs.slice(0, local));
+    return true;
+  } catch (e) {
+    if (e instanceof FrontendUnsupportedError) {
+      return false;
+    }
+    throw e;
+  }
+}
+
 /** The opcodes whose result is a literal when every operand is one ({@link trimClobberedCallArgs}). */
 const LITERAL_ARITHMETIC: ReadonlySet<string> = new Set([
   'add',
@@ -1379,9 +2836,157 @@ export function setupArgsDiscardsPassedResult(fn: Fn): boolean {
 
 /** Whether anything in `fn` HAS the narrower reading — the variation's gate, so the ~99% of functions
  *  with no narrowable call cost no re-lift. Read it off the lift itself: a later pipeline stage may
- *  replace a `call` op (softdiv rewrites one to a division), and the table is keyed by op. */
+ *  replace a `call` op (softdiv rewrites one to a division), and the table is keyed by op. A call
+ *  {@link cutsUnreadFrameObjects} withholds has none. */
 export function hasSetupArgsNarrowing(fn: Fn): boolean {
-  return fn.blocks.some((b) => b.ops.some((op) => setupArgc.has(op)));
+  if (!fn.blocks.some((b) => b.ops.some((op) => setupArgc.has(op)))) {
+    return false;
+  }
+  const withheld = cutsUnreadFrameObjects(fn);
+  return fn.blocks.some((b) => b.ops.some((op) => setupArgc.has(op) && !withheld.has(op)));
+}
+
+/** A frame address in the lifted IR: a `laddr`'s offset plus the constants added to it. `exact` is
+ *  false once a term that is not a constant was added (`&buf[i]`), and `off` is then the address
+ *  that term was added to. `end` is where the `laddr`'s storage ends. */
+interface FrameAddress {
+  readonly off: number;
+  readonly exact: boolean;
+  readonly end: number;
+}
+
+/** The calls whose `/setup-args` reading cuts the address of a frame object nothing else in `fn`
+ *  reads, under that reading — which is then withheld for that call, the default reading standing.
+ *
+ *  THE QUESTION THE IR CAN ANSWER of a frame address an earlier block left in a register the reading
+ *  cuts. That such a leftover is dead is the reading's whole guess, and agbcc does leave a dead
+ *  `mov r3, sp` store base in a call's argument registers (sa3 sub_805DADC, which reloads the
+ *  object after the call). Where the leftover was an argument after all, cutting it leaves the
+ *  object's stores with no reader: `if (a) g(b, s)` with `s` left in r1 by the entry block lifts as
+ *  `g(a1)` beside `s[0] = a0; s[1] = a1;`, which nothing reads. A source that compiled to those stores
+ *  read the object somewhere, so a cut that leaves it unread drops an argument. The register file
+ *  cannot tell the two leftovers apart; the object's readers can.
+ *
+ *  A READER is any use of an address into the object but the address operand of a store into it
+ *  and an argument the narrower reading cuts — a load, an address stored or returned or carried
+ *  to another block, an argument some call still passes. The other calls are read under the same
+ *  narrowing, since the ranker applies it to every call at once.
+ *
+ *  THE OBJECT is the span between the offsets the function forms addresses at or accesses. Where the
+ *  frame audit sized one `laddr` over two source objects (an escaped `sp+k`, which excuses every word
+ *  from k up), the address the compiler formed for the second one (`add r2, sp, #0xc`) is where it
+ *  starts: `int s[3]; char t[16]; ... if (a) g(b, s, t)` cut to `g(a1, sp0)` leaves `t` unread
+ *  though `sp0` is passed. An access's offset counts as well, because the lift folds a formed
+ *  `add r4, sp, #8` into the offsets of the loads and stores through r4, so the `laddr` they share
+ *  no longer says where the second object starts. Splitting finer only withholds more. A load or
+ *  argument at an offset reads the span it falls in. An address with a term that is not a constant
+ *  reads its base's span: an index stays inside the object its base addresses.
+ *
+ *  NOT ANSWERED HERE: a cut whose object is read elsewhere too. That leftover cannot be told from the
+ *  sub_805DADC dead base, by the IR or by the register file, so it narrows, except where the frontend
+ *  withholds the reading at that call (`GuessedCallSite.withholdsSetupArgs`) or asks the register
+ *  question of every cut there (`GuessedCallSite.asksEveryCut`). */
+function cutsUnreadFrameObjects(fn: Fn): Set<Op> {
+  const def = defOpMap(fn);
+  const memo = new Map<Value, FrameAddress | null>();
+  const frameAddress = (v: Value): FrameAddress | null => {
+    if (memo.has(v)) {
+      return memo.get(v)!;
+    }
+    memo.set(v, null); // a cycle through a phi's operands is no frame address
+    const d = def.get(v);
+    let r: FrameAddress | null = null;
+    if (d?.opcode === 'laddr') {
+      const off = d.attrs.off as number;
+      r = { off, exact: true, end: off + (d.attrs.width as number) * (d.attrs.count as number) };
+    } else if ((d?.opcode === 'add' || d?.opcode === 'sub') && d.operands.length === 2) {
+      const konst = (x: Value): number | undefined => {
+        const k = def.get(x);
+        return k?.opcode === 'const' && typeof k.attrs.value === 'number' ? k.attrs.value : undefined;
+      };
+      const [x, y] = d.operands;
+      const fx = frameAddress(x);
+      const fy = d.opcode === 'add' ? frameAddress(y) : null; // `k - &s` is no address
+      const base = fx === null ? fy : fy === null ? fx : null;
+      if (base !== null) {
+        const k = konst(fx === null ? x : y);
+        r =
+          k === undefined || !base.exact
+            ? { ...base, exact: false }
+            : { ...base, off: d.opcode === 'add' ? base.off + k : base.off - k };
+      }
+    }
+    memo.set(v, r);
+    return r;
+  };
+  const bounds = new Set<number>();
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      for (const r of op.results) {
+        frameAddress(r);
+      }
+      const at = op.opcode === 'load' || op.opcode === 'store' ? frameAddress(op.operands[0]) : null;
+      if (at?.exact) {
+        bounds.add(at.off + (op.attrs.off as number)); // an access's offset (see THE OBJECT)
+      }
+    }
+  }
+  for (const a of memo.values()) {
+    if (a !== null) {
+      bounds.add(a.end);
+      if (a.exact) {
+        bounds.add(a.off);
+      }
+    }
+  }
+  const sorted = [...bounds].sort((x, y) => x - y);
+  /** the span an access at `a` (plus `extra` bytes) reads — see THE OBJECT above */
+  const span = (a: FrameAddress, extra = 0): [number, number] => {
+    const at = a.off + extra;
+    const lo = sorted.filter((x) => x <= at).pop() ?? at;
+    const hi = sorted.find((x) => x > at) ?? a.end;
+    return [lo, Math.max(hi, lo + 1)];
+  };
+  const reads: [number, number][] = [];
+  const cuts = new Map<Op, [number, number][]>();
+  const read = (v: Value, extra = 0): void => {
+    const a = frameAddress(v);
+    if (a !== null) {
+      reads.push(span(a, extra));
+    }
+  };
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      if ((op.opcode === 'add' || op.opcode === 'sub') && frameAddress(op.results[0]) !== null) {
+        continue; // a derivation: its result's uses are the ones that read
+      }
+      const args = op.opcode === 'call' ? callArgs(op) : [];
+      const keep = setupArgc.get(op) ?? args.length;
+      op.operands.forEach((v, i) => {
+        if ((op.opcode === 'store' || op.opcode === 'astore') && i === 0) {
+          return;
+        }
+        if (op.opcode === 'call' && i >= keep && i < args.length) {
+          const a = frameAddress(v);
+          if (a !== null) {
+            cuts.set(op, [...(cuts.get(op) ?? []), span(a)]);
+          }
+          return;
+        }
+        read(v, op.opcode === 'load' && i === 0 ? (op.attrs.off as number) : 0);
+      });
+      for (const s of op.successors) {
+        s.args.forEach((v) => read(v));
+      }
+    }
+  }
+  const withheld = new Set<Op>();
+  for (const [op, spans] of cuts) {
+    if (spans.some(([lo, hi]) => !reads.some(([rlo, rhi]) => rlo < hi && rhi > lo))) {
+      withheld.add(op);
+    }
+  }
+  return withheld;
 }
 
 /** Cut every guessed call to the arity its OWN BLOCK set up, and report whether anything moved.
@@ -1399,8 +3004,13 @@ export function hasSetupArgsNarrowing(fn: Fn): boolean {
  *  Applies only to arities that were GUESSED — a declared prototype never recorded the fact. */
 export function narrowToSetupArgs(fn: Fn): boolean {
   let changed = false;
+  const withheld = cutsUnreadFrameObjects(fn);
   for (const b of fn.blocks) {
     for (const op of b.ops) {
+      if (withheld.has(op)) {
+        setupArgc.delete(op);
+        discardsPassedResult.delete(op);
+      }
       const setup = setupArgc.get(op);
       if (setup !== undefined && setup < callArgs(op).length) {
         truncateCallArgs(op, setup);
@@ -1419,6 +3029,18 @@ export function narrowToSetupArgs(fn: Fn): boolean {
 
 // ── shared frontend tail helpers ──
 
+/** The `undef` attribute naming the other keys whose undefined values a collapsed join absorbed
+ *  (`collapseUndefinedJoins`), comma-separated. Read once, by the own-entry bound (pipeline.ts `readDroppedArgRegs`),
+ *  and removed before anything else sees the lift. */
+export const ABSORBED_KEYS = 'absorbed';
+
+/** The `undef` attribute marking an undefined value the machine stored to a stack slot nothing reads
+ *  back (`finish`, the same test as an entry parameter's `deadHome`). The store reaches no op, so the
+ *  value looks dead, yet the asm read the register: IDO at -g3 and -O0 homes every argument register
+ *  its definition declares (`sw a1,4(sp)`) whether or not the body uses it. Read once, by the
+ *  own-entry bound (pipeline.ts `readDroppedArgRegs`), and removed with `ABSORBED_KEYS`. */
+export const HOMED_UNDEF = 'homed';
+
 /** The stack-slot key the MIPS, Thumb and PowerPC frontends use for a word-sized local in the
  *  function's own frame. Shared so they spell it identically and the frame-partition rule can
  *  recognise any frontend's slots. See the virtual-key note in the module header. */
@@ -1430,6 +3052,27 @@ export const stackSlotKey = (off: number): string => `${SLOT_PREFIX}${off}`;
 export const slotKeyOffset = (key: string): number | null =>
   key.startsWith(SLOT_PREFIX) ? Number(key.slice(SLOT_PREFIX.length)) : null;
 
+/** The virtual key of incoming stack argument `index` (its ABI argument rank, the registers
+ *  counted), which the Thumb, MIPS and PPC frontends read an incoming stack word through. Reading it goes
+ *  through the ordinary Braun live-in path, which turns a read with no reaching def into a function
+ *  parameter — so it needs NO new representation, opcode or pass. The `@` cannot appear in a real
+ *  register token, so the key cannot collide with one. */
+const STACK_ARG_PREFIX = '@sarg';
+export const stackArgKey = (index: number): string => `${STACK_ARG_PREFIX}${index}`;
+/** The {@link stackArgKey} of the incoming word at `entryOff` bytes above the caller's stack pointer,
+ *  on an ABI whose caller's parameter area starts `paramAreaAt` bytes above it and whose first
+ *  `regArgs` argument words travel in registers: word k past them is at `paramAreaAt + 4k`
+ *  (O32: 16, past the a0..a3 home; the PPC EABI: 8, past the back chain and the LR save word).
+ *  Undefined below the area and for an offset off the word grid. */
+export const incomingStackArgKey = (entryOff: number, paramAreaAt: number, regArgs: number): string | undefined =>
+  entryOff >= paramAreaAt && entryOff % 4 === 0 ? stackArgKey(regArgs + (entryOff - paramAreaAt) / 4) : undefined;
+/** The argument rank a {@link stackArgKey} names, or null for any other key. Defined beside its mint
+ *  site on purpose: the format string and its parser once drifted 650 lines apart. */
+export const stackArgIndex = (key: string): number | null => {
+  const m = /^@sarg(\d+)$/.exec(key);
+  return m ? +m[1] : null;
+};
+
 /** Where a live-in of the entry block sits in the calling convention: `slotOf` gives its ABI
  *  argument rank (a register or an incoming stack word), or null for a live-in no argument arrives
  *  in — an uninitialised register the body reads; `holes` gives the keys of the argument slots the
@@ -1457,6 +3100,28 @@ export const registerArgSlots = (argRegs: readonly string[]): ArgSlots => ({
   holes: (readKeys) => argRegs.slice(0, Math.max(0, ...readKeys.map((k) => argRegs.indexOf(k)))),
 });
 
+/** The slots of a convention that passes arguments past `argRegs` on the stack: `regs` for the
+ *  registers, then incoming stack word k as slot k ({@link stackArgKey}). Reading a stack word
+ *  proves every register slot and every lower stack word precede it, one word per argument.
+ *  `besideStackWords` is the convention's own refusal of a read it cannot place beside them (O32's
+ *  float arguments, which take integer slots this rule does not count), called with the highest
+ *  stack slot read. */
+export const stackArgSlots = (
+  regs: ArgSlots,
+  argRegs: readonly string[],
+  besideStackWords?: (readKeys: readonly string[], top: number) => void,
+): ArgSlots => ({
+  slotOf: (key) => stackArgIndex(key) ?? regs.slotOf(key),
+  holes: (readKeys) => {
+    const top = Math.max(-1, ...readKeys.map((k) => stackArgIndex(k) ?? -1));
+    if (top < 0) {
+      return regs.holes(readKeys);
+    }
+    besideStackWords?.(readKeys, top);
+    return Array.from({ length: top }, (_, k) => (k < argRegs.length ? argRegs[k] : stackArgKey(k)));
+  },
+});
+
 /** A rank past every argument slot, for a live-in that is not one. */
 const NOT_AN_ARGUMENT = Number.MAX_SAFE_INTEGER;
 
@@ -1493,8 +3158,21 @@ export function abiSortEntryParams(
   assertTrueEntry(entryHasPreds);
   const rank = (v: Value): number => slots.slotOf(paramReg.get(v) ?? '') ?? NOT_AN_ARGUMENT;
   entry.params.sort((x, y) => rank(x) - rank(y));
+  for (const v of entry.params) {
+    const r = rank(v);
+    if (r !== NOT_AN_ARGUMENT) {
+      argRanks.set(v, r);
+    }
+  }
 }
 
+/** The ABI argument rank each entry parameter arrived in, as {@link abiSortEntryParams} ranked it. */
+const argRanks = new WeakMap<Value, number>();
+
+/** The argument rank (registers counted, then incoming stack words) entry parameter `v` arrived in,
+ *  or undefined for a live-in that is no argument slot, or a value no entry sort ranked. */
+export const entryArgRank = (v: Value): number | undefined => argRanks.get(v);
+
 function assertTrueEntry(entryHasPreds: boolean): void {
   if (entryHasPreds) {
     throw new Error('internal: the entry-parameter rule needs an entry block with no predecessors');