@asmlift/core 0.9.0 → 0.11.0

package/src/target.ts

@@ -5,7 +5,9 @@
 // What each datum drives:
 //   • id               → frontend dispatch (registry.ts)
 //   • compiler         → idiom gating (patternApplies) + the report
-//   • argRegs / returnReg → entry-param ordering and return-value read in the frontends
+//   • argRegs / returnReg → entry-param ordering and return-value read in the frontends; argRegs
+//     also says whether an ARM body's argument scan counts this target's words
+//     (frontend/arm-body.ts `scansArgumentsOf`, read by frontend/callee-body.ts)
 //   • capabilities.hwDivide → gates the MIPS hardware-divide decode (mips.ts), the soft-division
 //     pre-recovery pass, and idiom gating; a `div` on a target declaring no divider degrades to
 //     a loud opaque (exercised by packages/cli/test/matching/divmul.test.ts). `hwFloat` → idiom
@@ -19,14 +21,12 @@
 //     device may read, so a slot it cannot reach is not refused.
 //   • capabilities.blockTransferCalls → the same audit: a frame address handed to one of these
 //     as its SOURCE is read as far as the call's literal control word says, and never written.
-//   • capabilities.deviceRegisters → six readers, and they ask ONE question — "would a source
+//   • capabilities.deviceRegisters → five readers, and they ask ONE question — "would a source
 //     have spelled this address `volatile`" — which is a question about SPELLING and may be
 //     approximate: the `/vol-store` variation's eligibility (l3/volstore.ts), rank.ts's volatility
 //     tie-break between two byte-identical spellings, the first half of `/unreduce`'s
 //     disjointness gate (l3/unreduce.ts), the `/homesplit` pairing's refusal to leave a device
-//     READ inline where the spelling it replaces would have qualified it (l3/homesplit.ts), the
-//     structurer's refusal to SPELL a dead memory read whose address no qualifier could ever
-//     reach (structure.ts `volatileQualifiable`, threaded through StructureOptions), and the
+//     READ inline where the spelling it replaces would have qualified it (l3/homesplit.ts), and the
 //     device pin (frontend/device-pins.ts), which spells every access in the window `volatile`
 //     in a function the frame-object audit keeps as one object, and in one it accepts object by
 //     object every device read and the device stores a later store in their block overwrites —
@@ -44,14 +44,19 @@
 //     Others are read off the target directly by a consumer that is not the structurer — among
 //     them `nearBaseSpan` and `foldsConstAddrOffset` (rank.ts, L3 respell variations),
 //     `reloadsLocalReread`, `narrowParamWitness` and `aggregateBoundary` (raise/pre-recovery.ts),
-//     `aggregateReturn`, `largestAlignment`, `enumBytes` and `bitfieldPacking` (aggregate.ts, for
-//     frontend/thumb.ts, frontend/ppc.ts and frontend/frame-objects.ts),
+//     `aggregateReturn`, `largestAlignment`, `enumBytes`, `bitfieldPacking` and
+//     `byValueAggregateArgWords` (aggregate.ts, for frontend/call-plan.ts — which the Thumb, MIPS
+//     and PowerPC lowerings share — frontend/thumb.ts, frontend/mips.ts, frontend/ppc.ts and
+//     frontend/frame-objects.ts; `enumBytes` is the structurer's too, through StructureOptions),
 //     `hoistsSingleSetArm` (raise/narrowlocal.ts and raise/retsink.ts), `arrayShapeFromStride`
 //     (raise/globalshape.ts, run on the LIFTED fn), `eightByteReturnScratch`
 //     (frontend/thumb.ts, which reads the epilogue), `callThunks` (frontend/thumb.ts, which
-//     lowers a `bl` to one as a call through its register), `roundTripsDoubleLiterals`
-//     (raise/floathelpers.ts) and `volatileReadsExtendInRegister` (frontend/device-pins.ts, and
-//     raise/declared-volatile.ts through liftStamped and the offset-name pass). The
+//     lowers a `bl` to one as a call through its register), `farJumpRelay` (frontend/thumb.ts,
+//     which lowers a marked `bl` to the branch it stands for), `roundTripsDoubleLiterals`
+//     (raise/floathelpers.ts), `volatileReadsExtendInRegister` (frontend/device-pins.ts, and
+//     raise/declared-volatile.ts through liftStamped and the offset-name pass), and
+//     `keepsUnusedReads` and `discardsUnusedReadsInto` (frontend/dead-reads.ts, the second
+//     gathered by frontend/ppc.ts and frontend/mips.ts as they lower a load). The
 //     field names are a SUPERSET of
 //     StructureOptions' — see `structureOptionsFor`.
 //
@@ -70,6 +75,8 @@ import {
   IDO_RUNTIME_HELPERS,
   MIPS_GCC_RUNTIME_HELPERS,
   PPC_MWCC_RUNTIME_HELPERS,
+  PPC_MWCC_SAVE_ROUTINES,
+  type RegisterSaveRoutines,
   type RuntimeHelper,
 } from './runtime-helpers';
 import type { StaticLayout } from './structure/local-statics';
@@ -91,6 +98,29 @@ export interface SourceRead {
   bytes?: number;
 }
 
+/** WHERE THIS ABI CAN LEAVE A GENERAL ARGUMENT REGISTER EMPTY BELOW ONE A CALL FILLS — the two ways
+ *  argument words stop filling in order, read off the facts that already place them:
+ *   - `skippable`: the registers an argument aligned to 8 can skip, every odd argument word where
+ *     `evenWordAlignedArgs` holds (O32 `a1`/`a3`, PowerPC `r4`/`r6`/`r8`/`r10`). Compiled on
+ *     2026-10-18: `g(1, b, 3LL)` and `g(1, 3LL)` are one object on gcc2.7.2kmc, gcc2.7.2 and the
+ *     three mwcc builds, `a1`/`r4` untouched under a set pair. agbcc fills every word in order
+ *     (`g(1, 3LL)` is r0, r1:r2), so it has none.
+ *   - `leadingFloatShadow`: a leading floating argument travels in the FPU's registers and leaves
+ *     the general words it counts against holding nothing (`fpu.slots: 'leading'`, O32): with `gp`
+ *     unprototyped, `gp(x, 5)` of a `float x` parameter and of an `int x` one compile alike on
+ *     ido7.1, gcc2.7.2kmc and gcc2.7.2 (`li a1,5`, `a0` untouched). PowerPC's floats take no general
+ *     word (`'separate'`), so they leave no hole there.
+ *  Its reader is the guessed-arity gap (frontend/call-plan.ts `decideGap`). */
+export function argRegisterHoles(target: Pick<TargetDescription, 'argRegs' | 'evenWordAlignedArgs' | 'fpu'>): {
+  skippable: ReadonlySet<string>;
+  leadingFloatShadow: boolean;
+} {
+  return {
+    skippable: new Set(target.evenWordAlignedArgs ? target.argRegs.filter((_, k) => k % 2 === 1) : []),
+    leadingFloatShadow: target.fpu?.slots === 'leading',
+  };
+}
+
 /** The bytes a source read reaches from an address `off` bytes into the frame, as `[lo, hi)`
  *  relative to that address. The machine may force the address down to a unit boundary — the
  *  GBA's DMA and BIOS both do — so a 32-bit read of the halfword at [sp,#2] reads from [sp,#0],
@@ -202,16 +232,27 @@ export interface TargetDescription {
    *  PARM_BOUNDARY is 32 (:354).
    *
    *  o32 MIPS has an FPU and a double after an integer argument still takes two general words,
-   *  high first, at an even word as its `long long` does (IDO 7.1). The MIPS targets do not state it
-   *  because their frontend lays out no 64-bit argument (`CallLowering.pairs`). PowerPC EABI passes
-   *  a double in a float register that takes no general word (`fpu.slots: 'separate'`), so it has
-   *  none to state. */
+   *  high first, at an even word as its `long long` does (`evenWordAlignedArgs`). The MIPS targets
+   *  do not state it because their frontend lays out no 64-bit argument (`CallLowering.pairs`).
+   *  PowerPC EABI passes a double in a float register that takes no general word
+   *  (`fpu.slots: 'separate'`), so it has none to state. */
   doubleArgWords?: 'high-first';
+  /** AN ARGUMENT ALIGNED TO 8 STARTS AT AN EVEN ARGUMENT WORD, and the word it skips is left empty:
+   *  a `long long`, a `double` in general words, and a struct passed by value whose alignment is 8,
+   *  alike. `proto.ts` `wordsOf` counts the skipped word, and `aggregate.ts` `byValueCallArgs` reads
+   *  the same count to place a struct. O32, compiled on ido7.1, gcc2.7.2kmc and gcc2.7.2:
+   *  `takeLL(1, 0x200000003LL)` and `takeD(1, 2.5)` set `a0` and `a2:a3` with `a1` unset, and so does
+   *  `takeL(s32 k, struct L { long long v; } l)`; at word 0 each is `a0:a1`. mwcc's PowerPC EABI aligns
+   *  a `long long` the same way (its doubles take no general word, and a struct passed by value is
+   *  passed by address). ABSENT ⇒ every argument takes the next free word: agbcc (the note at
+   *  `wordsOf`). */
+  evenWordAlignedArgs?: true;
   /** Registers this ABI does NOT pass arguments in — half of what makes a def-less live-in read an
    *  uninitialised local rather than an argument. The other half is a measurement the FRONTEND
    *  owes (did this function save the register), and the rule that combines them is in
-   *  frontend/ssa.ts (LiveInModel.uninitRegs). ABSENT ⇒ no register partition is claimed, which is
-   *  what MIPS and PPC take today.
+   *  frontend/ssa.ts (LiveInModel.uninitRegs). Thumb and PPC state it and measure the save half
+   *  from their prologues (Thumb `savedRegs`, PPC and MIPS `prologueSavedRegs`). ABSENT ⇒ no register
+   *  partition is claimed.
    *
    *  It must be DISJOINT from `argRegs`, and the frontend hands both to the builder so that is
    *  checked rather than trusted (`checkedLiveInModel`): a spelling that lands in both lists used
@@ -219,14 +260,43 @@ export interface TargetDescription {
   nonArgRegs?: readonly string[];
   /** Of `nonArgRegs`, the ones this ABI does NOT require a callee to preserve — so the compiler may
    *  home a local in one with no prologue save at all, and the save half of the rule above does not
-   *  apply to it. AAPCS's `ip` is the whole set here, and agbcc really does use it that way.
+   *  apply to it. AAPCS's `ip` is the whole set on Thumb, and agbcc really does use it that way;
+   *  on PPC it is `r0`, `r11` and `r12`, where mwcc homes a leaf's uninitialised locals (PPC_MWCC).
    *
    *  UNDER-stating this list only makes the classification stricter: an unlisted register whose save
-   *  the frontend cannot find falls back to being a parameter, which is what a target claiming no
-   *  partition gets. OVER-stating it is the unsound direction — a callee-saved register listed here
-   *  is classified with no evidence at all, which is the defect the save half exists to close. Every
-   *  entry must appear in `nonArgRegs`; the frontend refuses a target where one does not. */
+   *  the frontend cannot find is read as one the callee must preserve, and a read of it before any
+   *  write refuses (frontend/ssa.ts `LiveInModel.unsavedCalleeSavedRegs`). OVER-stating it is the
+   *  unsound direction — a callee-saved register listed here is classified with no evidence at all,
+   *  which is the defect the save half exists to close. Every entry must appear in `nonArgRegs`;
+   *  the frontend refuses a target where one does not. */
   scratchRegs?: readonly string[];
+  /** Of `scratchRegs`, the ones something outside the C calling convention hands an input in. On
+   *  PPC that is mwcc's RUNTIME: its register save routines take their frame address in r11
+   *  (`addi r11,r1,N; bl _savegpr_NN`, and `_savegpr_31` is `stw r31,-4(r11); blr`), and
+   *  `__ptmf_scall` takes its member-function pointer in r12 (`lwz r0,0(r12)`). On O32 it is
+   *  hand-written asm, and every scratch register (`O32_SCRATCH_REGS`). Asm that reads one of these
+   *  first is being handed a value, not reading an uninitialised local.
+   *
+   *  What separates the two is MEASURED on 2.4.2 and 2.3.3: the uninitialised local the compiler
+   *  homes in r11 or r12 is assigned on SOME path (`uninit_r12`: `if (s) { x = a*b; ... }`), so its
+   *  entry value meets that definition at a join. A def-less read of one of these registers whose
+   *  entry value no join meets with a definition of its own refuses (frontend/ssa.ts
+   *  `LiveInModel.hiddenInputRegs`). r0 is not
+   *  listed: the same compilers read a never-assigned local straight out of r0 (`int x; return x +
+   *  a;` is `add r3,r0,r3`), and the runtime passes nothing there.
+   *
+   *  Every entry must appear in `scratchRegs`; the frontend refuses a target where one does not. */
+  hiddenInputRegs?: readonly string[];
+  /** FILE-SCOPE GLOBAL REGISTER VARIABLES this compiler accepts (`register T g __asm__("r8");`):
+   *  each callee-saved register a translation unit may bind a global to, keyed by its disassembly
+   *  spelling and valued by the name `__asm__` takes. gcc's `globalize_reg` (agbcc regclass.c
+   *  :587-611) makes such a register fixed and call-used, so no prologue saves it: a callee-saved
+   *  register a function reads before writing, or writes, WITHOUT saving it is one of these, and
+   *  the lift reads and writes it as that global (frontend/ssa.ts `LiveInModel.globalRegs`).
+   *  `contiguous` is the order a compiler that declares them only as a contiguous run requires
+   *  them in: declaring one declares every register before it. ABSENT ⇒ the compiler has no
+   *  spelling for one, and such a read or write refuses (`unsavedCalleeSavedRegs`). */
+  globalRegisterVariables?: { regs: Readonly<Record<string, string>>; contiguous?: readonly string[] };
   /** Registers a CALL destroys: after one, they hold whatever the callee left there, and no value
    *  this function computed. The frontends hand this to the SSA builder so a read of one past a
    *  call refuses instead of resolving to the pre-call definition (frontend/ssa.ts).
@@ -242,6 +312,12 @@ export interface TargetDescription {
    *  construction one the callee may destroy — and `clobberedByCall` (frontend/ssa.ts) checks that
    *  rather than trusting it, the way `checkedLiveInModel` checks the register partition. */
   callerSaved: readonly string[];
+  /** Registers the ABI reserves to the kernel, which an exception handler may overwrite between ANY
+   *  two instructions (O32's `k0`/`k1`), so no value written to one is proved to be there when it is
+   *  read. A read of one refuses, and the return proof never counts one as holding the return
+   *  address (frontend/mips.ts). Only hand-written asm names them. Absent on an ABI that reserves
+   *  none. */
+  kernelRegs?: readonly string[];
   /** The COMPILER RUNTIME HELPERS this compiler's codegen calls, and what each computes
    *  (runtime-helpers.ts). A compiler fact, which is why it lives here and not in `proto.ts`: that
    *  file holds signatures fixed by the C STANDARD, and a helper name is fixed by a runtime
@@ -256,6 +332,10 @@ export interface TargetDescription {
    *  `__`-prefixed function by spelling — but it buys nothing on a target whose runtime has simply
    *  not been enumerated. */
   runtimeHelpers?: Readonly<Record<string, RuntimeHelper>>;
+  /** The runtime's OUT-OF-LINE REGISTER SAVE ROUTINES (runtime-helpers.ts `RegisterSaveRoutines`).
+   *  ABSENT ⇒ none is recognised: a `bl` to one is an ordinary call, and the frame address it would
+   *  have consumed is the stack pointer read as data, which refuses. */
+  registerSaveRoutines?: RegisterSaveRoutines;
   // HARDWARE / ISA facts — independent of the compiler.
   capabilities: {
     endianness: 'little' | 'big'; // consumed by structureOptionsFor (bitfield extract recognition is LSB-first)
@@ -454,6 +534,51 @@ export interface TargetDescription {
     // says so, but nothing in this bag could express it if they did not. Any behavior that can
     // differ between two toolchains sharing one description is mis-keyed by construction.
     spillSlotOrder?: 'ascending' | 'descending' | 'unknown';
+    // Which way this compiler places the ADDRESS-TAKEN local arrays of one frame against their
+    // DECLARATION order: `ascending` = the earlier-declared array takes the lower address. Read
+    // where the frame audit declares the one object as several (frame-objects.ts
+    // `keepAsOneObject`, which declares the parts `provenParts` finds in this order), so the
+    // recompile puts each part back at its own offset. Absent REFUSES that split: the one object
+    // stays one array.
+    //
+    // MEASURED on `u8 a[64]; u8 b[32]; u8 c[48];`, each filled by a `memcpy`, at canonical flags:
+    // agbcc a@0 b@64 c@96; gcc2.7.2 and gcc2.7.2kmc a@16 b@80 c@112; ido7.1 a@104 b@72 c@24 (the
+    // reverse); mwcc_242_81 a@88 b@8 c@40, neither order — so absent there.
+    addressTakenArrayOrder?: 'ascending' | 'descending';
+    // The frame-offset multiple this compiler starts each address-taken `u8` array of a frame at,
+    // whatever its size. Read by the same split (frame-objects.ts `provenParts`): a boundary off
+    // this multiple is never where two of the source's arrays met, and a part declared there is
+    // placed at the next multiple by the recompile, moving it and growing the frame. Absent
+    // REFUSES the split, as `addressTakenArrayOrder` does.
+    //
+    // MEASURED on `u8 a[na]; u8 b[nb];`, each filled by a `memcpy` and both handed to a callee, at
+    // canonical flags, for na x nb = 4x12, 12x12, 6x10, 8x8, 20x16, 2x14: agbcc puts b at sp+4,
+    // 12, 8, 8, 20, 4 (4); gcc2.7.2 and gcc2.7.2kmc a@16 and b@24, 32, 24, 24, 40, 24 (8:
+    // BIGGEST_ALIGNMENT on MIPS, for a BLKmode local); ido7.1 b@24 and a@36, 36, 40, 32, 44, 44 (4).
+    addressTakenArrayAlignment?: 4 | 8;
+    // Does this compiler's C front end take a DESIGNATED array element in an initializer —
+    // `u8 a[16] = { 1, [8] = 2 };`? A fact about the dialect the compiler parses, not about C or
+    // C++ as languages: GNU C had it long before C99, and agbcc and gcc 2.7.2 (KMC's build and the
+    // plain one) compile the line above, while IDO 7.1's cfe ("Syntax Error") and every mwcc build
+    // the benchmark ships, 2.3.3, 2.4.2 and 2.4.7 ("expression syntax error"), refuse it — each
+    // compiled. Read by the C-family printer (`SFn.designators`) where a constant image
+    // (l3/constinit.ts) leaves elements out: it spells the element after a run of them by index,
+    // and without this spells the run as zeros, which a compiler that cannot parse the index takes.
+    // Absent ⇒ zeros, the spelling every C compiler parses.
+    designatedInitializers?: boolean;
+    // Does this compiler's C front end REFUSE the three pointer conversions C makes implicitly — an
+    // integer to a pointer, a pointer to an integer, and an object pointer to one of another
+    // pointee — as C++ does? Every mwcc build the benchmark ships refuses all three in C, compiled
+    // with `-lang=c`: 2.4.2 and 2.4.7 ("illegal implicit conversion" of an `unsigned int` to an
+    // `int *`) and 2.3.3 ("cannot convert"). agbcc, IDO 7.1 and both gcc 2.7.2 builds compile the same three
+    // calls at their canonical flags. Read by the C-family printer (`SFn.strictConversions`), which
+    // then casts an argument to its callee's declared parameter and a pointer of another pointee
+    // into a pointer slot exactly as it does for C++ (backend/cfamily.ts `argConversion`,
+    // `legalizePointerWrites`), and by the store of an integer into a declared pointer cell
+    // (structure/pointer-spelling.ts `intoPtrCell`, which declines that store under C++, where only a
+    // cast to the cell's own type converts). Each cast is the conversion the compiler would
+    // otherwise have made, so it changes no instruction. Absent ⇒ C's implicit conversions.
+    strictPointerConversions?: boolean;
     // Arguments past the argument registers are staged into an area this function RESERVES at the
     // BOTTOM of its own frame — `[sp,#0]` upward, one word each — rather than pushed at the call
     // site. It is GCC's ACCUMULATE_OUTGOING_ARGS target macro, and it is what makes an outgoing
@@ -476,24 +601,87 @@ export interface TargetDescription {
     // every call, with every local and spill above it, and the caller never reads a word of it
     // back after a call — the callee may assign to its stack parameters, so the caller re-stages
     // an argument before every call. A compiler can stage in its frame
-    // (`stagesOutgoingArgsInFrame`) and still break this: mwcc may put a local in the words its
-    // outgoing parameters use (`frontend/ppc.ts`, "A GUESS THAT FILLS EVERY ARGUMENT REGISTER").
+    // (`stagesOutgoingArgsInFrame`) and still break this. mwcc does not, though it puts a local in
+    // the words a call COULD take as stack arguments where no call takes any — which is why a
+    // guess that cannot say whether one does refuses (`frontend/ppc.ts`, "A GUESS THAT FILLS EVERY
+    // ARGUMENT REGISTER") — and not where one does: the area starts past them.
     //
-    // It is a UNIVERSAL — for every source, the compiler emits no such read — and its one reader
-    // applies the contrapositive (`frontend/stackargs.ts` `survivorBound`): a word loaded after a
-    // call before any re-store is not in the area, so it is a local, and so is every word above it,
-    // which lets a spill live across a call lift, and a call NO declaration covers
-    // (`docs/level-tower.md`, THE CONTRAPOSITIVE OF A UNIVERSAL IS NOT A BACKWARDS READING). It is
+    // It is a UNIVERSAL — for every source, the compiler emits no such read — and its readers apply
+    // the contrapositive (`docs/level-tower.md`, THE CONTRAPOSITIVE OF A UNIVERSAL IS NOT A
+    // BACKWARDS READING): a word loaded after a call is not in the area, so it is a local, and so is
+    // every word above it (`frontend/frame-objects.ts` `storedNeverRead`). An own-frame word no store
+    // reaches on any path is a local too, but only the Thumb frontend acts on that
+    // (`frontend/thumb.ts`'s own-frame load arm, which reads it as uninitialised), and it was probed
+    // on agbcc alone; a MIPS or PPC reader needs its own probe first. A callee that assigned the
+    // word as its stack parameter ran before the load, so the load is after a call, and with no
+    // call reaching the load there is no such callee. It is
     // exactly as sound as the universal, so its residue is every producer the universal does not
-    // cover: hand-written asm that reads its outgoing argument back after a call loses that
-    // argument silently. The premise is this compiler's, not the ISA's.
+    // cover: hand-written asm that reads its outgoing argument back after a call loses that argument
+    // silently. The premise is this compiler's, not the ISA's.
     // Absent ⇒ every staged word stays a candidate argument.
     //
+    // It promises the AFTER-CALL form and no more: a compiler may still load a staged word BEFORE a
+    // call — o32 gcc defines REG_PARM_STACK_SPACE, so calls.c's save_fixed_argument_area loads
+    // staged reg-parm words around a nested call. The stronger form, no load of the area at all,
+    // is its own field (`outgoingAreaNeverLoadedFrom`), stated per compiler and never read off this.
+    //
     // Set on agbcc: thumb.h puts the locals at sp + outgoing_args_size (ACCUMULATE_OUTGOING_ARGS)
     // and `calls.c` sizes the area as the maximum over all calls; compiled, `spill10` and
     // `spillarg` keep their spills above the area, and `test/corpus/agbcc-restage.s` holds the
-    // re-staging and the callee's write. NOT set anywhere else, for the reason above.
+    // re-staging, the callee's write, and no load of the area around calls inside arguments. Set
+    // on the three MIPS toolchains off their own probe (`test/corpus/probe-o32-frame.c`), where
+    // the frame-object audit is the only reader. Set on
+    // mwcc off `test/corpus/probe-mwcc-frame.c` on all three builds (`mwcc-frame-probes.test.ts`):
+    // nothing but outgoing words lies below the local area, no word there is loaded, and `twice9`
+    // stores its ninth argument again before its second call. The frame-object audit is the only
+    // reader there too, and on mwcc it is LOAD-BEARING: it is what refuses an undeclared call whose
+    // ninth argument the arity guess cannot see (frontend/ppc.ts `measurePpcFrame`).
     localsAboveOutgoingArea?: boolean;
+    // The STRONG form of `localsAboveOutgoingArea`, which it requires: from this offset up, the
+    // caller never loads a word of its outgoing area at all — not after a call, and not before one
+    // either. The offset counts from the area's start, the frame bottom: `[sp,#0]` on Thumb, `0(sp)`
+    // on O32 (whose area opens with the a0..a3 home), `0(r1)` past the push on PowerPC (whose
+    // parameter area opens at 8, past the callee's back chain and link-register words). From it up
+    // the area holds only what the caller staged for a callee; every argument that contains a call
+    // is computed before any word is staged, and nothing is saved there around a nested call. So
+    // ANY frame word this function loads at or above the offset is a local, and so is every word
+    // above it, since the area is one region at the frame bottom. Its readers apply that
+    // contrapositive, at exactly the soundness of the universal. Each frontend measures the lowest
+    // such word once (Thumb through `frontend/stackargs.ts` `loadedWordBound`, MIPS in `liftOnce`,
+    // PPC `ppcLoadedWordBound`), and every reader takes that number: Thumb's outgoing-argument
+    // analysis, `frontend/frame-objects.ts` `storedNeverRead` for its pending stores, the MIPS and
+    // PPC undeclared-call guesses (`frontend/mips.ts` `lowerJal`, `frontend/ppc.ts` `bl`), and PPC's
+    // unread-slot decline, each weighing only the words beneath it. On MIPS it also caps how far an
+    // undeclared call's area can reach (`o32OutgoingArea`'s `widest`), which the local area's
+    // partition (`measureO32Frame`) and the owned range of an uninitialised read
+    // (`measureOwnedFrame`) both read. A load BELOW the offset proves nothing, and no reader counts
+    // it. A word no store reaches on any path needs only the after-call form (see
+    // `localsAboveOutgoingArea`).
+    // Absent ⇒ only the after-call form is claimed (when `localsAboveOutgoingArea` is set).
+    //
+    // Its residue is the universal's: hand-written asm that loads a word it staged, then stages it
+    // for a call, loses that argument. Each value is MEASURED, and the compiled probes are committed
+    // (`packages/core/test/outgoing-area-probes.test.ts` reads every one):
+    //   • agbcc, 0, off its source: thumb.h defines no REG_PARM_STACK_SPACE, so calls.c:642's
+    //     save_fixed_argument_area — which loads staged words around a nested call — is not
+    //     compiled; calls.c:1599-1610 precomputes every argument containing a call; and
+    //     store_one_arg (calls.c:3420-3470) saves an argument word only when a nested call overlaps
+    //     it, which the precompute rules out. Compiled, `test/corpus/agbcc-restage.s` loads no word
+    //     of the area around calls in stack arguments.
+    //   • ido7.1, gcc2.7.2kmc and gcc2.7.2, 16: `test/corpus/*-outarea.txt` at the rows' levels
+    //     (ido -O1, -O2 and -O2 -g3; gcc 2.7.2 -O1 and -O2) and at -O0. NOT 0 — ido stages a
+    //     by-value aggregate's register words in the a1..a3 home and loads them back before the
+    //     call (`big1`: `lw a1,4(sp)`), and kmc and gcc 2.7.2 do it for a char-array struct (`d3`,
+    //     `d5`): o32 gcc defines REG_PARM_STACK_SPACE, and GCC 2.9's save_fixed_argument_area
+    //     (calls.c:648-711) covers only `[0, reg_parm_stack_space)`. No probe loads a word from
+    //     16(sp) up the area.
+    //   • mwcc, 8, on all three builds at the rows' flags and at -O0,p, and on mwcc_242_81 at -O4,s
+    //     too: no probe loads a word of the parameter area; a struct-return temp or a by-value copy
+    //     sits at 8(r1) only where no call takes a stack word, and above the area beside one that
+    //     does.
+    // Like `stagesOutgoingArgsInFrame`, a second compiler of the same ISA must state this premise
+    // rather than inherit it.
+    outgoingAreaNeverLoadedFrom?: number;
     // A frame of EXACTLY ONE reserved word whose base escapes this function holds that object and
     // nothing else. It is the layout premise the Thumb frontend's address-taken-local capability
     // rests on (`frontend/thumb.ts`, `capturedObjectIsTheWholeFrame`): a bare `mov rD, sp` names
@@ -513,6 +701,94 @@ export interface TargetDescription {
     // producer a one-word frame does NOT exclude is a <=4-byte non-integer-like struct return,
     // which the post-lift audit settles per call rather than by size.
     oneWordFrameIsTheCapturedObject?: boolean;
+    // A frame address this function hands out — in an argument register at a call, or stored to
+    // memory — is the address of a LOCAL, so its receiver may read the frame from there up and no
+    // word from there up is a call's outgoing argument. Its first reader is the outgoing-argument
+    // analysis (`frontend/stackargs.ts`, the `escape` event): a store never reloaded HERE is read
+    // THERE. Absent ⇒ a handed-out frame address explains nothing.
+    //
+    // Set on agbcc, compiled at 2.9-arm-000512 and its canonical flags, and re-measurable from the
+    // committed probe (`scripts/regen-outgoing-area-probes.ts` → `test/corpus/agbcc-escape.s`, read
+    // by `frame-escape-probes.test.ts`). An address-taken local sits ABOVE the outgoing area
+    // (`f1`: `add r0, sp, #4` beside `h5(1,2,3,4,x)`), and at [sp,#0] only when no call in the
+    // function takes a stack word (`f0`).
+    //
+    // Its RESIDUE is a by-value struct argument's block copy (`mov r0, sp` / `add r0, sp, #4`, then
+    // `bl memcpy`), whose base IS the outgoing area. agbcc stages a call's outgoing words in
+    // ASCENDING offset order, the copy included (`qh5`, `a2`, `a3`): a word staged before the copy
+    // lies below its base, and one staged after it is still pending at the call. That is why the
+    // event ends pending words PER PROGRAM POINT and only from its offset up — read
+    // flow-insensitively, it would set aside `qh5`'s fifth `h5` word and lift `h5(1, 2, 3, 4)`. The
+    // cost is false alarms that decline loud (`if (x) gt(&s); else h(y);`); where the analysis also
+    // reads the event whole-function, it only refuses or excuses a word no call takes
+    // (stackargs.ts). `oneWordFrameIsTheCapturedObject` is the flow-insensitive licence for any
+    // receiver, sound only where no block copy fits.
+    //
+    // Its SECOND reader is the Thumb frame model's [sp,#0] capture (`frontend/thumb.ts`, beside
+    // `noCallTakesAStackWord`), which reads the universal whole-function at offset 0: where the
+    // frame base is handed as the hidden pointer of a callee DECLARED to return a struct through
+    // memory, it is a local's address, so no word of the frame is any call's outgoing argument and
+    // the area is empty — whatever the other calls are (sret2knr: `u8 rnd();` beside two temps).
+    // This premise is read only where some call may take a stack word: where none does there is
+    // no outgoing area to confuse, and an escaping frame base is a local's address on any target,
+    // whoever receives it (a DMA source published to the device's registers, `dmafill_wh`).
+    // The residue cannot reach it: a block copy's base goes to `memcpy`, no struct-returning
+    // callee. That reading is agbcc's layout, and is measured beyond `f0`: thumb.h:573
+    // STARTING_FRAME_OFFSET 0 and :620-621 add `current_function_outgoing_args_size` to every
+    // elimination to sp (:628 ACCUMULATE_OUTGOING_ARGS); function.c:2629 puts STACK_DYNAMIC_OFFSET
+    // past the same size; calls.c:1598-1609 precomputes into a temp every argument containing a
+    // call whenever the call has stack arguments, so a struct result is never built straight into
+    // an outgoing word. Compiled at the rows' flags: `mk(..)` by value as the 5th argument, as the
+    // 1st followed by four ints, `mk(..).a` as the 5th, a 20-byte struct by value, and a 5-argument
+    // K&R `rnd(1, 2, 3, 4, 5)` beside a temp each put the temp at sp+4 or higher, with [sp,#0] the
+    // outgoing word. A frame whose sp moves between two accesses is refused before this is read
+    // (thumb.ts `frameDepthBlocker`). Hand-written asm that builds a struct return at [sp,#0] and
+    // also stores a stack argument there declines; one that hands that word, unstored, to an
+    // undeclared callee as its fifth argument loses it from the callee's guessed arity.
+    escapedFrameAddressNamesALocal?: boolean;
+    // WHERE AN O32 FUNCTION KEEPS ITS LOCALS in the one frame `addiu sp,sp,-N` reserves — the area
+    // the MIPS frontend hands the frame-object audit as `ownedLocals`/`declaredLocals`. Below it
+    // lies the OUTGOING area, the 16-byte home of a0..a3 every calling function reserves and then
+    // the stack words its widest call takes (none in a function that makes no call); the saved
+    // registers and the locals share the rest, and which way round is the compiler's:
+    //   'above-outgoing-area'   — from the outgoing area's end, rounded up to the 8-byte stack
+    //                             alignment, to the lowest saved register;
+    //   'above-saved-registers' — from just above the highest saved register (or the outgoing
+    //                             area's end, where that is higher) to the frame top N.
+    // Spill temps live in the same area on both, so it is the locals' and the spills' together.
+    //
+    // MEASURED off `corpus/probe-o32-frame.c` (`scripts/regen-o32-frame-probes.ts`, read by
+    // `o32-frame-probes.test.ts`): a leaf's array at sp+0 on all three MIPS toolchains; with a call
+    // taking no stack word, gcc 2.7.2 (both builds) at sp+16 under the saves and IDO at the frame top
+    // above `ra`; with one stack word, gcc at sp+24 (20 rounded) and IDO still at the top; and IDO's
+    // spill of a value live across a call between `ra` and the array.
+    //
+    // Absent ⇒ no partition is claimed, and a captured frame address keeps its refusal.
+    o32LocalArea?: 'above-outgoing-area' | 'above-saved-registers';
+    // WHERE A FUNCTION THAT PUSHES ONE FRAME KEEPS ITS LOCALS, on a target whose frame starts with a
+    // fixed LINKAGE area — the back chain and the callee's link-register save word, which the ABI
+    // fixes and the frontend states (`frontend/ppc.ts` `PARAM_AREA_AT`, where the caller's parameter
+    // area starts). Above it the OUTGOING area holds the stack words of the widest call (none in a
+    // function whose calls take none), and the locals and spill temps share what is left below the
+    // lowest saved register:
+    //   [linkage + 4 * (stack words of the widest call), lowest saved register)
+    // in post-push offsets — O32's `above-outgoing-area` rule (`o32LocalArea`) past a linkage area
+    // instead of the a0..a3 home, without the 8-byte rounding (`areaAboveOutgoing`). The PPC
+    // frontend hands it to the frame-object audit as `ownedLocals`/`declaredLocals`; a call it
+    // lowers takes no stack word, so it refuses one whose declaration may and draws the area from
+    // the linkage's end. No object start inside it is fixed: the compiler chooses where in the area
+    // each local goes.
+    //
+    // MEASURED on mwcc 2.3.3, 2.4.2 (at -O4,p and at Mario Party 4's -O0,p) and 2.4.7 off
+    // `corpus/probe-mwcc-frame.c` (`scripts/regen-mwcc-frame-probes.ts`, read by
+    // `mwcc-frame-probes.test.ts`): every local and every home or spill lies in the area, a leaf
+    // with a local still pushes a frame whose area starts at 8, one or two stack words of a call push
+    // the locals past them, and the widest call sizes the area for every call. The first local's
+    // offset inside it differs per build and per function (8, 12 or 16 on 2.3.3; a homed parameter
+    // takes 8 at -O0,p), which is why this is an area and not a start.
+    //
+    // Absent ⇒ no partition is claimed, and a captured frame address keeps its refusal.
+    linkageLocalArea?: 'above-outgoing-area';
     // How this compiler calls through a register: `bl <prefix><reg>` enters a runtime thunk that
     // branches to the address in <reg> with every register as the caller left it, so the call is
     // an indirect call through <reg> and the thunk is no function a source names. `regs` are the
@@ -521,6 +797,16 @@ export interface TargetDescription {
     //
     // ABSENT ⇒ a `bl` names a function on this target, whatever it is called.
     callThunks?: { readonly prefix: string; readonly regs: readonly string[] };
+    // How this compiler marks a BRANCH it had to spell as a call: a `bl <label>` whose line carries
+    // a comment matching `comment` (tested against the text from its `@` to the end of the line) is
+    // a relay to that label of the same function, not a call. Two of its facts are this compiler's,
+    // and the Thumb frontend's lowering rests on them (`lowerFarJumpRelays`): what the mark means,
+    // and that the compiler pushes lr in every function with one, so the lr the relay writes is
+    // never the one the function returns through.
+    //
+    // ABSENT ⇒ no comment makes a `bl` anything but a call: a `bl` to a label of the function keeps
+    // its decline, however its line is commented.
+    farJumpRelay?: { readonly comment: RegExp };
     // Regime-A switch recovery: accept a RELATIONAL test as a case where the scrutinee values that
     // can reach it — narrowed by the tests above it — leave exactly one on a side this compiler's
     // dispatch lands a case body on: `'taken'` for its BRANCH only, `'either'` for both sides
@@ -629,6 +915,34 @@ export interface TargetDescription {
     // and PPC lanes put the addend in the instruction by construction (`lui`/`%lo`, `lis`/`ori`),
     // so a surviving offset carries no information there. Absent ⇒ the row is never offered.
     foldsConstAddrOffset?: boolean;
+    // Does a STORE to a struct member past the ISA's displacement range compile differently from the
+    // same store through a cast of the base (`p->f38 = v` against `*((u8 *)p + 38) = v`)? agbcc's
+    // does: expand_assignment (gcc/expr.c) expands only the base of a COMPONENT_REF target (:2535)
+    // and evaluates the right-hand side first in store_field (:2624), and it expands a cast target
+    // whole (:2689) before the right-hand side (:2747). Measured on agbcc for a loaded, a constant, a
+    // computed and a parameter right-hand side: every pair builds two objects, and a hoisted
+    // `u8 *d = &p->f38; *d = v;` builds the cast's. True reads a moved store whose right-hand side
+    // is computed before its address as struct evidence (raise/structs.ts `memberStoreOrder`).
+    // ido, KMC, GCC 2.7.2 and the three mwcc builds put the two spellings in one object, a loaded
+    // right-hand side included, so they leave it absent. `/far-cast`, the lift that keeps such a
+    // store on its materialised address, is offered on every target and does not read this.
+    farMemberStoreOrder?: boolean;
+    // Does a member past the displacement range get its OWN materialised base at every access, so
+    // that one base read or written at two distinct offsets is a pointer the source held? Stated
+    // as the displacement `past` which that holds: a base materialised with a displacement whose
+    // magnitude exceeds it was built for one access. agbcc's is 0, every base: `p->f38 + p->f39`
+    // compiles to `add r0, #0x26; ldrb [r0]` and `add r1, #0x27; ldrb [r1]`, while
+    // `u8 *d = &p->f38; d[0] + d[1]` shares one `add r1, #0x26` between `ldrb [r1]` and
+    // `ldrb [r1, #1]`, and only the pointer spelling rebuilds those bytes. ido's is 32767, the
+    // `addiu` reach: inside it ido shares one `addiu at, a0, 32767` across adjacent members
+    // (`sb a1, 7232(at); sb a2, 7233(at)`), and past it the assembler expands every member access
+    // to its own `lui at, 3; addu at, at, a0` while a held `u8 *d = &p->b` (b at 200000) shares one
+    // `lui at, 3; addu v0, a0, at` between `sb t6, 3392(v0)` and `sw zero, 3396(v0)`. True refuses
+    // raise/structs.ts's displaced-access fold for such a base (`held-pointer-offsets`). The three
+    // mwcc builds share one `addis` base across members and a held pointer alike, and KMC and
+    // GCC 2.7.2 lift the held pair as members at the same bytes, so they leave it absent. Absent ⇒
+    // the fold reads a shared base as members.
+    farMemberBasePerAccess?: { past: number };
     // Does this compiler fold a pointer local's OWN ADVANCE back into the memory operand —
     // `*p = a; p = p + 1; *p = b;` → `strh [r3, #0]` + `strh [r3, #2]`, no `add` — so the advanced
     // spelling emits the indexed one's stores wherever the pointee is not volatile? agbcc does, on
@@ -654,6 +968,25 @@ export interface TargetDescription {
     // does not declare it: the matching suite compiles each witness on one compiler. Absent ⇒
     // offered.
     pointerIntConversionIsFree?: boolean;
+    // Does this compiler keep the constant addend of a POINTER sum's offset where the source put it,
+    // and move an INTEGER sum's out to the base? agbcc does: `(u8 *)((u32)g + ((a << 4) + 772))`
+    // computes `(g + 772) + (a << 4)` (fold-const.c:5033-5058, `A + (V + C)` → `(A + C) + V`), while
+    // `(u8 *)g + ((a << 4) + 772)` computes `g + ((a << 4) + 772)` (c-typeck.c:2663-2692 distributes
+    // the constant, fold-const.c:4997-5011 folds it back), which is what the project's own
+    // `g->arr[a]` compiles to. Compiled at each toolchain's canonical flags, with `g` a struct
+    // pointer, a `void *` and a `u32`, as a call argument and under a dereference: agbcc,
+    // gcc2.7.2kmc and gcc2.7.2 build the two spellings into two objects wherever the offset has a
+    // constant addend and into one where it has none; ido7.1 builds one object every time, and
+    // mwcc_242_81 is CodeWarrior's index-first order (structure/pointer-spelling.ts, THE INTEGER
+    // SUM). Two rules read it. True ⇒ the arithmetic table's value row (ARITH_ROWS) spells an
+    // undeclared pointer global plus an integer with a constant term as the pointer sum where the
+    // sum is a value rather than an access's address; and the structurer declares `u8 *` a temp
+    // holding a pointer global's value that is the base of such a sum (`declaresBytePointer`),
+    // which an integer temp would compile as `(t + K) + x`. Through a temp ido7.1 does build two
+    // objects, the byte pointer's index first where the integer temp and the struct source keep the
+    // base first, and mwcc_242_81 builds one (the cli matching suite's pointer-spelling.test.ts).
+    // Absent ⇒ the integer sum and the integer temp.
+    keepsPointerSumAddend?: boolean;
     // Does this compiler EMIT a memory read in the block the source SPELLED it in? One direction
     // only: the def-block placement rule (StructureOptions.readsStayWhereWritten) re-spells a read
     // at the block the asm performed it in, which reproduces the asm iff nothing sinks a spelled
@@ -692,6 +1025,16 @@ export interface TargetDescription {
     // three descriptions that measured false (four compilers) set it anyway, so absent means
     // UNMEASURED rather than "no".
     reloadsLocalReread?: boolean;
+    // Does this compiler convert a constant to a NARROW lvalue's type before it materializes it
+    // for the store? Then the stored register's upper bits say the lvalue's signedness whenever
+    // the narrow sign bit is set: `u16 *p; p[6] = -1;` loads 0xffff and `s16 *p; p[6] = 0xFFFF;`
+    // loads -1. Measured on every bench compiler at its rows' flags by lifting the probe in
+    // packages/cli/test/matching/narrow-store-constant.test.ts and reading the const each store
+    // takes. Read by raise/storesign.ts (through raise/pre-recovery.ts).
+    //
+    // ABSENT ⇒ the seed stands down and a narrow store keeps the unsigned view; a compiler opts IN
+    // on its own probe.
+    narrowStoreConstantTakesLvalueType?: boolean;
     // A LAYOUT fact rather than a canonicalization one, kept here because it is the COMPILER's:
     // the size, in bytes, it aligns and rounds EVERY struct and union to, whatever its members.
     // agbcc: 4 — `sizeof(struct { u16 h; })` is 4, and `struct { u8 a; union { u16 h; u8 b[2]; } u; }`
@@ -699,12 +1042,13 @@ export interface TargetDescription {
     // answer 2 and 2: the natural layout, 1. Compiled as `return sizeof …` / `return (int)&((T *)0)->m`
     // at each row's flags; gcc2.7.2 (-O1), mwcc_233_163n and mwcc_247_107 answer the same as their
     // descriptions' measured compilers. Read by raise/structs.ts (through raise/pre-recovery.ts),
-    // which sizes a recovered UNION member with it; raise/struct-arrays.ts sizes element structs
-    // without it, which on agbcc is a known gap.
+    // which sizes a recovered UNION member with it, and by raise/struct-arrays.ts, which declines
+    // an element struct whose stride it would round (agbcc: a stride-6 `u16 [3]` row is 8 bytes).
     //
-    // ABSENT ⇒ unmeasured, and the union recovery declines every union narrower than a word: no
-    // value is safe to assume, since one too small mislays the fields after it on agbcc and one too
-    // large drops the pad in front of them everywhere else.
+    // ABSENT ⇒ unmeasured: the union recovery declines every union narrower than a word, and the
+    // struct-array recovery declines every element struct. No value is safe to assume, since one
+    // too small mislays the fields after it on agbcc (and mis-strides an element struct) and one
+    // too large drops the pad in front of them everywhere else.
     aggregateBoundary?: number;
     // The largest alignment any member of a struct takes, in bytes (BIGGEST_ALIGNMENT): agbcc 4,
     // thumb.h:358, so a `long long` member sits at a word. With `aggregateBoundary` it is what sizes
@@ -712,8 +1056,8 @@ export interface TargetDescription {
     largestAlignment?: number;
     // HOW A STRUCT OR UNION RETURNED BY VALUE COMES BACK, which decides whether a call to a function
     // declared to return one hands it a hidden pointer as argument 0 and moves every declared
-    // argument one register up (`aggregate.ts` `returnsInMemory`, read by frontend/thumb.ts and
-    // frontend/ppc.ts).
+    // argument one register up (`aggregate.ts` `returnsInMemory`, read by the call lowering every
+    // frontend shares, frontend/call-plan.ts).
     //   • 'apcs' — in memory when bigger than a word, when a struct has a second member that is not
     //     a bitfield, or when a union has a member that would be; in the return register otherwise.
     //     agbcc, thumb.c:1423-1493 (compiled: `{u8 a,b,c,d}` through memory; `{u32}`, `{u32 w[1]}`,
@@ -722,10 +1066,55 @@ export interface TargetDescription {
     //     included); in memory otherwise. mwcc_242_81, mwcc_233_163n and mwcc_247_107 alike
     //     (compiled: 1 to 8 bytes, `{float}`, `{double}` and a union come back in r3/r3:r4; a 9- and a
     //     12-byte struct are handed `addi r3,…` ahead of the call).
-    // ABSENT ⇒ unmeasured, and such a call declines. IDO 7.1 returns every aggregate through memory,
-    // a one-word one included (compiled: `struct {u32 x;} mkw(s32)` is called `addiu a0,sp,28 / jal
-    // mkw / lw v0,28(sp)`), and states nothing: the MIPS frontend lowers no call to read it.
-    aggregateReturn?: 'apcs' | 'svr4';
+    //   • 'memory' — always in memory, whatever its size or members. ido7.1, gcc2.7.2kmc and gcc2.7.2
+    //     alike (compiled: `{u8}`, `{u16}`, `{u32}`, `{float}`, `{double}`, 4-, 8- and 12-byte
+    //     structs, `union {u32; u16;}` and `{u32 a:8; u32 b:8;}` are each handed `addiu a0,sp,N`
+    //     ahead of the `jal`, with the declared arguments from a1 on, and the callee returns that
+    //     pointer, `move v0,a0`).
+    // Under every rule the caller's half is lowered (frontend/call-plan.ts), and a function that
+    // itself returns a struct through memory lifts as that struct where its declaration says so and
+    // the lift proves the hidden pointer is only its storage (frontend/own-struct-return.ts); it is
+    // read as the pointer function it compiles to where nothing declares it, or where a context's
+    // declaration does and the proof fails (pipeline.ts `returnOwnStruct`).
+    // ABSENT ⇒ unmeasured, and such a call declines.
+    aggregateReturn?: 'apcs' | 'svr4' | 'memory';
+    // WHETHER A FUNCTION THAT RETURNS A STRUCT THROUGH MEMORY HANDS THE HIDDEN POINTER BACK in the
+    // return register — a COMPILER fact, which no rule above implies. `true` for ido7.1, gcc2.7.2kmc
+    // and gcc2.7.2 (`move v0,a0`, the O32 rule) and for agbcc (`add r0, r6, #0` after a call, r0
+    // left alone in a leaf: compiled `struct S12 f(s32 x)` with and without a call to `fill(t)`).
+    // `false` for mwcc_242_81, mwcc_233_163n and mwcc_247_107, whose callee clobbers r3 before the
+    // `blr`: the same `struct S12 b4(s32 x)` saves the pointer in r30/r31, stores through it, and
+    // returns with r3 = a reload of a frame word. It decides what the proof that a function's own
+    // struct return goes through that pointer asks of each `ret` (frontend/own-struct-return.ts):
+    // where it is `true` every `ret` must hand back the pointer, and where it is `false` what the
+    // return register holds is no part of the function, save a value computed for the return alone
+    // (`returnedAlone`). ABSENT ⇒ unmeasured, and read as `true`, which only refuses more.
+    structReturnHandsBackPointer?: boolean;
+    // WHETHER A CALLER HANDS ITS OWN DESTINATION POINTER STRAIGHT ON as a callee's hidden
+    // struct-return pointer, leaving the first argument register at its incoming value below the
+    // arguments it sets up. `true` for ido7.1: `int b3(struct S *p){ *p = sg(1); return 0; }` is
+    // `jal sg; li a1,1` with a0 never touched, the bytes of `sg(p, 1)` with its result unused.
+    // `false` for gcc2.7.2kmc, gcc2.7.2, agbcc and mwcc_242_81, mwcc_233_163n and mwcc_247_107,
+    // which copy through a frame temporary (a0/r0/r3 set to a frame address ahead of the call).
+    // Compiled at the canonical flags, `b3` and `void b6(struct S *p, int k){ *p = sg(k, 5); }`.
+    // Read by the guessed-arity gap (frontend/call-plan.ts `decideGap`): where it holds, a gap at
+    // the first argument register is decided only where the call's result is read, which no
+    // forwarded struct return's is (IDO reloads `p` from its home after the call in all five shapes
+    // compiled: `return (*p = sg(1)).b`, `return p` and three more). ABSENT ⇒ unmeasured, and read
+    // as `true`, which only refuses more.
+    forwardsStructReturnDestination?: boolean;
+    // A STRUCT PASSED BY VALUE TRAVELS IN CONSECUTIVE ARGUMENT WORDS, the first at the next free
+    // argument word, its size rounded up to words (`aggregate.ts` `byValueCallArgs`). agbcc,
+    // thumb.h:632-650 (FUNCTION_ARG places by word offset, FUNCTION_ARG_PARTIAL_NREGS splits a
+    // BLKmode argument across r3 and the stack, FUNCTION_ARG_ADVANCE rounds its size to a word, and
+    // no FUNCTION_ARG_PASS_BY_REFERENCE is defined); compiled, `struct A {u16 a,b,c,d; s8 e,f;}`
+    // is `ldr r0..r2` off the frame copy ahead of `bl take2`. O32 too, compiled on ido7.1,
+    // gcc2.7.2kmc and gcc2.7.2: `takeQ(s32 k, struct Q {u32 a, b;})` is passed `a1:a2` and a
+    // three-word struct `a0..a2` (an 8-aligned one starts at an even word:
+    // `evenWordAlignedArgs`); IDO also stores each word into its home slot, which the
+    // call owns. ABSENT ⇒ the target passes one some other way or states nothing: mwcc passes the
+    // address of a copy (frontend/ppc.ts refuses it).
+    byValueAggregateArgWords?: boolean;
     // The bytes an enum takes as a struct member (`aggregate.ts`). agbcc: 4 — flag_short_enums is 0
     // unless `-fshort-enums` is given (toplev.c:3552-3554 with no DEFAULT_SHORT_ENUMS), so an enum
     // whose values fit an int is an int (c-decl.c:6123-6135); compiled, `sizeof(enum {K0, K1})`
@@ -734,6 +1123,16 @@ export interface TargetDescription {
     // (proto-context.ts). ABSENT ⇒ unmeasured,
     // and an aggregate with an enum member is not sized.
     enumBytes?: number;
+    // Whether a plain `char` is signed, read where a context declares a global `char` and the lift
+    // asks whether a narrow read of it agrees with that declaration (structure.ts
+    // `storageDisagrees`). The compiler's default, with no flag; `targetFor` applies the flags that
+    // change it (`-funsigned-char`/`-fsigned-char`, IDO's `-signed`, mwcc's `-char`). MEASURED,
+    // `s32 g(void){ return gC; }` over `extern char gC;` at each toolchain's canonical flags: agbcc
+    // `ldrb` and ido7.1 `lbu` (unsigned), gcc2.7.2 `lb` (signed; gcc2.7.2kmc's canonical
+    // `-funsigned-char` makes it `lbu`), mwcc_242_81 `lbz` + `extsb` (signed). ABSENT ⇒ unmeasured,
+    // and a narrow read of a declared plain `char` agrees with neither sign, so it is spelled
+    // through its address.
+    plainCharSigned?: boolean;
     // How a struct's bitfields are placed (`aggregate.ts`). 'contiguous' — each at the bit after the
     // one before, straddling a byte or a word of its declared type, with the next member that is not
     // a bitfield at the first byte past it that its alignment allows. agbcc: thumb.h defines no
@@ -784,9 +1183,207 @@ export interface TargetDescription {
     // ABSENT ⇒ false: a sign-extending load says nothing about the qualifier, and a device read is
     // pinned, and a read of a declared object placed, whatever its extension.
     volatileReadsExtendInRegister?: boolean;
+    // Does this compiler RELOAD a cell stored through one spelling and read back through another —
+    // two names, or a name and a numeric address, for the same byte? MEASURED at -O2, each probe
+    // storing 5 to a word, 7 to one of its bytes, and reading the word back: IDO 7.1 reloads
+    // (`D_80100000 = 5; ((u8 *)0x80100000)[1] = 7; return D_80100000;` is `sb; jr ra; lw v0`);
+    // agbcc (`sRandCount = 5; ((u8 *)&sUnknown)[4] = 7; return sRandCount;` is `strb; mov r0,
+    // #5`) and gcc 2.7.2 (`sb; jr ra; li v0, 5`) forward the stored value. IDO also reloads across
+    // two externs, two statics, an array element beside a scalar, and a word-wide literal beside
+    // a name. It reloads only a read that FOLLOWS the store: a read placed before a byte store
+    // through another name is sunk past it (`v0 = D_80100004; ((u8 *)&D_80100000)[5] = 7;
+    // return v0;` is `sb; jr ra; lw v0`). So where it holds, a pair of spellings in one block
+    // outside any loop, the store first, is faithful lifted as-is, whether the asm carries both or
+    // the map chose one; any other order, and every pair where it does not hold (an asm that went
+    // back to memory proves the source did not spell the byte two ways), raise/offsetnames.ts
+    // `cellSpelledTwice` declines.
+    //
+    // ABSENT ⇒ false: the compiler forwards (or is unmeasured, which declines the same pairs).
+    reloadsAcrossSpellings?: boolean;
+    // Does this compiler, AT THESE FLAGS, keep a plain read whose value nothing uses? A FLAG fact,
+    // never written in a description: `targetFor` sets it from the optimisation level
+    // (`keepsUnusedReadsAt`), so a target at other flags has it absent. Where it holds, a read
+    // the lift finds unused is no evidence of `volatile`, and the dead-read pin
+    // (frontend/dead-reads.ts) stamps only one the machine loaded into the register the compiler
+    // discards a volatile read into (`discardsUnusedReadsInto`).
+    //
+    // ABSENT ⇒ false: the compiler deletes every plain read nobody uses, so one still in the target
+    // was qualified.
+    keepsUnusedReads?: boolean;
+    // WHERE DOES THIS COMPILER PUT A READ NOBODY USES, at a level that keeps a plain one
+    // (`keepsUnusedReads`)? The register a `volatile` read with no consumer is loaded into, and no
+    // plain local is ever homed in. COMPILED at the keeping levels, one statement per line:
+    // `*p;`, `s->b;`, `gV;` and `(*p, 1)` through a volatile lvalue load into `r0` on mwcc 2.4.2,
+    // 2.4.7 and 2.3.3 at `-O0,p`, and into `$zero` on IDO 7.1 at `-O1` and `-O0`; the plain
+    // `x = p[5]; x = 0;` takes a home there instead (`lwz r31`, `lw t6` and a frame store), and so
+    // does a `register` local (`lwz r31`, `lw a2`). Over the 409 complete Mario Party 4 units built
+    // at `-O0,p`, 924 non-frame loads nothing reads land in r17-r31 and f18-f31, and exactly one in
+    // r0: WipeExecAlways's `wipe->type;`, a `volatile u8` member. So a dead load into this
+    // register is a qualified read, and the dead-read pin (frontend/dead-reads.ts) stamps it at a
+    // keeping level too. mwcc keeps one plain read in r0 as well, a read under an arithmetic or a
+    // cast nothing uses (`p[5] + 1;`, `(char)p[5];`), which no real unit holds: that is the pin's
+    // residue. A load this register took and an op then wrote to a home (`lwz r0` + `extsb r31,r0`,
+    // a plain `s8` local) is not discarded (frontend/dead-reads.ts `leftInDiscardRegister`). One
+    // register cannot name a pair: IDO discards a doubleword into zero:at, `lw zero,0(a0)` +
+    // `lw at,4(a0)`, which frontend/mips.ts `emitLoad` reads as the pair this register heads.
+    //
+    // ABSENT ⇒ the compiler has no such register, or it is unmeasured. agbcc, gcc 2.7.2 and KMC
+    // gcc 2.7.2 at `-O0` have none: a volatile `*p;` is an `ldr r0`/`lw v0` nothing stores, the
+    // same instructions as a `register` local assigned and overwritten, so the pin cannot tell the
+    // two apart there and refuses rather than drop the read.
+    discardsUnusedReadsInto?: string;
+    // MAY A DISCARDED READ LAND IN AN ARGUMENT REGISTER, at flags that delete a plain read nobody
+    // uses? Where it may, a value a load left in an argument register is no proof that the next
+    // call takes it. The discard register is the allocator's first free one, not a fixed register,
+    // so a single read on its own says nothing: the probe that decides is one where the usual
+    // discard register is busy. `true` for agbcc, which loads a discarded `volatile` read into the
+    // lowest free argument register (`*(volatile int *)K; g(s)` is `ldr r1,[r1]; bl g`, the bytes of
+    // `g(s, *(int *)K)`). `true` for gcc2.7.2kmc and gcc2.7.2, which discard into v0/v1 until those
+    // are busy and then into a1: `int a = ga * 3; *(volatile int *)&gx; *(volatile int *)&gx;
+    // ga = a + 1; return logv(s) + 1;` is `lw a1,0(v0); lw v0,0(v0); ... jal logv` (`lw a1,0(v1)` on
+    // gcc2.7.2), the bytes of the twin that passes the first read. `true` for mwcc_242_81,
+    // mwcc_233_163n and mwcc_247_107, which discard into r0 until it is busy and then into r4: the
+    // same function's first read is `lwz r4,gx` on all three, and with three reads mwcc_233_163n's
+    // last one is `lwz r4,gx` right before `bl logv`, byte-identical to the twin that passes it.
+    // `false` for ido7.1 alone: `lw zero`, `lbu zero`, `lh zero`, and `lw zero` + `lw at` for a
+    // doubleword, with four discarded reads stacked under the same pressure too. Compiled at the
+    // canonical flags. Read by the guessed-arity gap (frontend/call-plan.ts `decideGap`), which a
+    // load decides only where this is `false`. ABSENT ⇒ unmeasured, and read as `true`, which only
+    // refuses more.
+    discardedReadMayFillArgRegister?: boolean;
+    // DOES THE COMPILER CROSS-JUMP RETURN TAILS? Where two arms end in the same code before the
+    // same return, does it keep ONE copy and jump the other arm into it? Where it does, the source
+    // may have written the tail into every arm (`h(10, 0); return;` in each) and the object still
+    // holds it once. So a join in the CFG is no evidence the source wrote one. What tells the two
+    // spellings apart is where the surviving copy sits, and which arms became one block. Read by
+    // the return-tail chooser (pipeline.ts `structureReturnTailReading`): it publishes the copies
+    // where the target's layout shows that merge (structure/cross-jumped-tail.ts), and never reads
+    // the layout where this is absent.
+    //
+    // gcc 2.x's jump2 pass does it: jump.c, in the `JUMP_CROSS_JUMP` run of `jump_optimize` that
+    // toplev.c makes at `optimize > 0`.
+    //   - An unconditional jump is first cross-jumped into the code before its own target label
+    //     (`find_cross_jump (insn, JUMP_LABEL (insn), 1)`).
+    //   - Only then is it tried against the other jumps to that label, and that search runs only
+    //     `if (INSN_UID (JUMP_LABEL (insn)) < max_uid)`.
+    //   - `do_cross_jump` keeps the LATER copy and jumps to a label before it. `get_label_before`
+    //     creates that label, so a jump already redirected is never searched for siblings again.
+    // So the copies spelling leaves three shapes in the object (structure/cross-jumped-tail.ts):
+    //   - an arm that does not use the tail stays laid out after the surviving copy, and that copy
+    //     ends in a jump over it;
+    //   - identical arm bodies stay separate blocks, where the join's one original label would have
+    //     merged them;
+    //   - `find_cross_jump` compares backward and stops at the first pair that differs, so a call
+    //     the tail opens with can be cut from the argument setup each arm keeps.
+    // MEASURED on two probe pairs, `corpus/probe-rettail-{pa,pb}-{copies,join}.c`: a three-arm `if`
+    // and a seven-case `switch`. Each is compiled at each toolchain's canonical flags by
+    // `scripts/regen-rettail-probes.ts`, and cross-jumped-tail.test.ts reads the objects:
+    //   - agbcc: the `pa` copies keep the tail mid-construct, ending in `b`, with the else arm laid
+    //     out after it. The `pb` copies hold the tail's store ONCE, in six case bodies; the join
+    //     has three bodies.
+    //   - gcc2.7.2 (-O1) and gcc2.7.2kmc (-O2): `pb` is the same, one store, six bodies against
+    //     three. The `pa` copies and join compile byte-identical, because the fall-through arm's
+    //     call merged too.
+    //   - ido7.1 and mwcc_242_81: NO. The `pb` copies keep all seven stores, each before its own
+    //     return, and the `pa` copies keep three calls.
+    // So `true` on ARMV4T_AGBCC and on MIPS_GCC. Each toolchain MIPS_GCC serves owes its own pair
+    // (the KEYED BY DESCRIPTION note at `spillSlotOrder`), and both are committed. ABSENT means no
+    // such merge: the chooser's size bound alone decides. mwcc_233_163n and mwcc_247_107 are
+    // unprobed, and PPC_MWCC claims nothing for them. Read only where the join is the default
+    // (`joinPastReturnsByDefault`), which both descriptions declaring this field leave out, so the
+    // marks decide no shipped default; the probe pairs still pin each one.
+    crossJumpsReturnTails?: boolean;
+    // DOES THE COMPILER FOLD THE CONSTANT A BRANCH PROVED INTO A RETURN ON THE BRANCH'S TAKEN EDGE?
+    // After `if (x == 0)`, a `return x` the jump reaches is `return 0` where it does. gcc 2.x's cse
+    // records the branch's equivalence on the NOT-taken edge of every jump (`record_jump_equiv
+    // (insn, 0)`, cse.c:7597), and on the taken edge only along a path it follows (`record_jump_equiv
+    // (insn, 1)`, cse.c:8545). It follows one only under -fcse-follow-jumps, which toplev.c:3606-3607
+    // sets at `optimize >= 2` (-fcse-skip-blocks skips a block without recording the edge:
+    // `cseFollowsJumpsUnder`). (Line numbers are agbcc's gcc 2.9 tree; for
+    // 2.7.2 the probe below is the evidence.) So where this is `false`, a return of the tested value
+    // left UNFOLDED in the object was the jump-target arm of its branch in the source: an `else`.
+    // The join past early returns spells it `if (x == 0) return x;`, the then arm, which folds.
+    // Read by the return-tail chooser (pipeline.ts `structureReturnTailReading`), which publishes the
+    // copies at such a return (structure/unfolded-branch-constant.ts), and only where the join is
+    // the default (`joinPastReturnsByDefault`), which MIPS_GCC, the one description declaring this
+    // field, leaves out: so it decides no shipped default, and the probes below still pin it.
+    // `false` only by the flags (`targetFor`), never declared.
+    //
+    // MEASURED on the probe pair `corpus/probe-rettail-pg-{copies,join}.c`, the `return gB` after a
+    // `gB` tested against 0, compiled by scripts/regen-rettail-probes.ts. The `beqz`'s delay slot:
+    //   - gcc2.7.2 at -O1 (canonical): copies `nop`, join `move v0,zero`. With the arms of the
+    //     copies flipped (the return the then arm), and with `-O1 -fcse-follow-jumps`, `move v0,zero`.
+    //   - gcc2.7.2 at -O2, and gcc2.7.2kmc at -O2 (canonical): `move v0,zero` under every spelling.
+    // So `true` on MIPS_GCC, and `false` from the flags where cse follows no jump (level 1 without
+    // -fcse-follow-jumps, or -fno-cse-follow-jumps: `cseFollowsJumpsUnder`). Absent elsewhere: agbcc
+    // at -O2 re-loads `gB` for the copies' `else` and does not fold it, which no value of this field
+    // says; ido7.1 and mwcc are unprobed.
+    foldsBranchConstantOnTakenEdge?: boolean;
+    // IS THE JOIN PAST EARLY RETURNS THE DEFAULT READING HERE? Not a compiler behaviour but a MEASURED
+    // DEFAULT, kept beside the behaviours because it is per compiler and read by the chooser they
+    // feed (pipeline.ts `structureReturnTailReading`), which the size bound and the marks above
+    // steer only where this is `true`. ABSENT ⇒ the return-tail copies are published, as before the
+    // join was a default, and the join is still structured and kept in the ranked fan as
+    // `/ret-join`. A compiler the held-out measurement has not reached publishes the copies first,
+    // and the join only where the copies refuse, so it lifts every function it lifted before and
+    // may lift one the old default declined (pipeline.ts `copiesByDefault`).
+    // docs/level-tower.md (A MEASURED DEFAULT IS THE ONE EXCEPTION) says why a field whose readings
+    // split site by site may still be declared here, and what re-measures it.
+    //
+    // MEASURED over held-out real functions, every function of a project outside the 620 the marks
+    // were chosen on, both readings really compiled against the project's own objects (2026-11-06),
+    // and over 160 generated functions written with the copies (2026-11-09). `true` only where the
+    // size bound with every mark loses no match the copies have on every measured set:
+    //   - mwcc_233_163n (Pikmin at its own flags, 2733 functions lifted, 66 re-spelled): 0 lost,
+    //     3 gained (two `actByEvent` methods 4/22 -> 0/20, `stickSlot__6PelletFi` 3/28 -> 0/26);
+    //     the generated functions: every source identical to the copies';
+    //   - mwcc_242_81 (ac-decomp and Mario Party 4, every unit compiled at this build although 9 of
+    //     Mario Party 4's rows are mwcc_247_107; 141 re-spelled): 0 lost, 0 gained; the generated
+    //     functions: every source identical to the copies'.
+    // So `true` on PPC_MWCC (mwcc_242_81) and PPC_MWCC_233; PPC_MWCC_247 (mwcc_247_107) leaves it
+    // out, no held-out unit measured at that build. Left out where it loses, the copies' default
+    // given back with the join's gains:
+    //   - gcc2.7.2kmc: held out (Snowboard Kids 2, 78 re-spelled) 0 lost, 2 gained
+    //     (`func_8003513C_35D3C`, `func_80045564_46164`); generated, 3 lost (the copies match, the
+    //     join is 2 to 8 lines off) and 5 gained. Given up: those 2 held out and the 5 generated.
+    //   - gcc2.7.2: held out (Mario Party 3, all 10019 functions, 150 re-spelled) 0 lost once the
+    //     unfolded return is read (`foldsBranchConstantOnTakenEdge`), none gained; generated, 1 lost
+    //     (4 lines off) and 2 gained. No mark read from the layout or the unfolded return separates
+    //     the 4 generated losses on the two lanes. Given up: the 2 generated, and the held-out and
+    //     620 functions the join brought closer.
+    //   - agbcc (pokeemerald, 15062 functions, 963 re-spelled): 9 lost, 18 gained. None of the 9 is
+    //     marked: switch and comparison-tree sites, a call cross-jumped across arms that pass it
+    //     different arguments, and a third source spelling the copies happen to share. Given up:
+    //     18 held out and 2 of the 620.
+    //   - ido7.1 (Animal Forest, 11363 functions, 252 re-spelled): 4 lost, one shape, 18 gained. ido
+    //     never cross-jumps, so no cross-jump mark applies. Counting copies of the arm's store does
+    //     not separate the readings either: compiled, the join of `func_80A42DB4_jp` ALSO keeps two
+    //     `sw zero,0(a3)`, because ido fills a `beql`'s likely slot with a copy of its target's first
+    //     word. What differs is the branch the slot copy rides: the copies' arm schedules its own
+    //     store into the slot of a plain `b`, the join's copy sits in a `beql`'s. That is the
+    //     candidate signal, unmeasured: frontend/mips.ts `normaliseBranchLikely` rewrites both to one
+    //     shape (its `likely` and `freed` sets still tell them apart) before the layout is recorded,
+    //     so no layout entry carries it. Given up: 18 held out and 7 of the 620.
+    joinPastReturnsByDefault?: boolean;
   };
 }
 
+/** THE SPELLINGS ONE REGISTER HAS in an ISA's asm, as `[number, alias]` pairs — the one place they
+ *  are stated. A frontend keys registers by spelling, so a function that names one register two
+ *  ways is rewritten to one of them first (frontend/ssa.ts `unifyRegisterSpellings`, which both
+ *  frontends hand these tables); and every register list a target states names both spellings of a
+ *  pair or neither, which `target-register-aliases.test.ts` checks against these tables. A pair
+ *  missing here splits one register into two partition keys: saved as `sl` and written as `r10`, its
+ *  writes read as a global's the epilogue undoes. */
+export const ARM_REGISTER_ALIASES: readonly (readonly [string, string])[] = [
+  ['r9', 'sb'],
+  ['r10', 'sl'],
+  ['r11', 'fp'],
+  ['r12', 'ip'],
+];
+/** O32's `$30`, which objdump prints `s8` and hand-written asm also writes `fp` (`ARM_REGISTER_ALIASES`). */
+export const O32_REGISTER_ALIASES: readonly (readonly [string, string])[] = [['s8', 'fp']];
+
 export const ARMV4T_AGBCC: TargetDescription = {
   id: 'armv4t',
   compiler: 'agbcc',
@@ -803,6 +1400,17 @@ export const ARMV4T_AGBCC: TargetDescription = {
   // `mov ip, r1` in two switch arms, no save anywhere, and a `mov r0, ip` past a third arm that
   // writes nothing — an uninitialised local by construction.
   scratchRegs: ['r12', 'ip'],
+  // MEASURED at the canonical flags, `register int g __asm__("rN")` for each of r4-r11: `f(){ return
+  // g; }` is `add r0, r4, #0` / `mov r0, r8` / `mov r0, sl`, and `s(a){ g = a; }` the reverse, with no
+  // save. agbcc prints r9 as `r9`, r10 as `sl` and r11 as `fp`; hand-written asm also writes `sb`.
+  globalRegisterVariables: {
+    regs: {
+      ...Object.fromEntries(['r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10', 'r11'].map((r) => [r, r])),
+      sb: 'r9',
+      sl: 'r10',
+      fp: 'r11',
+    },
+  },
   // AAPCS: r0-r3 pass arguments and return, r12 (`ip`) is the intra-procedure-call scratch, and lr
   // holds the return address the `bl` itself overwrites. agbcc's own machine description says the
   // same (`thumb.h` CALL_USED_REGISTERS). Both spellings of r12 for the reason `nonArgRegs` carries
@@ -883,20 +1491,40 @@ export const ARMV4T_AGBCC: TargetDescription = {
     nearBaseSpan: 255,
     volatileReadsExtendInRegister: true,
     foldsConstAddrOffset: true,
+    farMemberStoreOrder: true,
+    farMemberBasePerAccess: { past: 0 },
     foldsPointerAdvance: true,
     pointerIntConversionIsFree: true,
+    keepsPointerSumAddend: true,
     readsStayWhereWritten: true,
     switchBoundCase: 'taken',
     switchArmsFollowLayout: true,
     switchRequiresFrontLoadedTests: true,
+    // MEASURED on the probe pairs at the field (gcc 2.x jump.c's cross-jump). Read only where the join
+    // is the default (`joinPastReturnsByDefault`), which agbcc leaves out: the join loses 9 of
+    // pokeemerald's matches no mark separates.
+    crossJumpsReturnTails: true,
     hoistsSingleSetArm: true,
     eightByteReturnScratch: 'r2',
     arrayShapeFromStride: true,
     reloadsLocalReread: true,
+    // MEASURED: the probe at the field. A signed constant often lifts as `mov #1; neg` or
+    // `mov #0x80; lsl #8`, a `neg`/`shl` the seed does not read. agbcc also materializes one
+    // constant ONCE for several narrow stores through the same base, whatever their signedness:
+    // `struct { s32 a; s16 b; u16 c; } *p; p->b = -300; p->c = -300;` is one `ldr r1,=0xfed4` for
+    // both `strh`. A stamp here then names one store's type, not necessarily each's (the `s16`
+    // store is stamped unsigned, which is also the convention).
+    narrowStoreConstantTakesLvalueType: true,
     aggregateBoundary: 4,
     largestAlignment: 4,
     aggregateReturn: 'apcs',
+    structReturnHandsBackPointer: true,
+    // MEASURED: the probes at the fields.
+    forwardsStructReturnDestination: false,
+    discardedReadMayFillArgRegister: true,
+    byValueAggregateArgWords: true,
     enumBytes: 4,
+    plainCharSigned: false,
     bitfieldPacking: 'contiguous',
     roundTripsDoubleLiterals: true,
     // agbcc 2.9 (gcc/varasm.c `assemble_variable`, gcc/thumb.h): an array takes its element's
@@ -914,16 +1542,23 @@ export const ARMV4T_AGBCC: TargetDescription = {
     // operand rows and nothing else, from two locals declared the other way round) and its
     // control `synthetic:spillorder_rev` (the same body in the order asmlift already emits, which
     // must stay a MATCH), plus `synthetic:dma_fill_uninit`, a row this did not author.
+    designatedInitializers: true, // agbcc compiles `{ 1, [8] = 2 }` (see the field)
     spillSlotOrder: 'ascending',
+    addressTakenArrayOrder: 'ascending', // MEASURED, the probe at the field
+    addressTakenArrayAlignment: 4, // MEASURED, the probe at the field
     // agbcc reserves the outgoing area with the rest of the frame (`add sp, sp, #-N` covers both)
     // and stages arguments 5+ into it at [sp,#0] upward — thumb.h's ACCUMULATE_OUTGOING_ARGS.
     stagesOutgoingArgsInFrame: true,
     // …one area for every call, below the locals (thumb.h:573/600-622/628, calls.c:1675), which
     // agbcc re-stages before each call and never reads back after one (agbcc-restage.s).
     localsAboveOutgoingArea: true,
+    // …nor loads at all, before a call or after: no REG_PARM_STACK_SPACE (see the field).
+    outgoingAreaNeverLoadedFrom: 0,
     // the two producer tables behind this are compiled, at agbcc 2.9-arm-000512 and the rows' own
     // flags, and they are written out where the predicate reads it (`frontend/thumb.ts`)
     oneWordFrameIsTheCapturedObject: true,
+    // compiled: the committed probe `test/corpus/agbcc-escape.s` (`scripts/regen-outgoing-area-probes.ts`)
+    escapedFrameAddressNamesALocal: true,
     // agbcc's `*call_indirect` and `*call_value_indirect` emit `bl _call_via_%0` (gcc/thumb.md:997-1021),
     // and libgcc defines `_call_via_<reg>` as `bx <reg>` for r0-r9, sl, fp, ip, sp and lr
     // (libgcc/lib1thumb.asm:595-633). Neither `sp` (the frame) nor `lr` (which the `bl` itself
@@ -932,6 +1567,13 @@ export const ARMV4T_AGBCC: TargetDescription = {
       prefix: '_call_via_',
       regs: ['r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'sl', 'fp', 'ip'],
     },
+    // agbcc spells a branch past the ±2 KB reach of Thumb `b` as `bl <label>` with this comment,
+    // from three patterns: `jump` (`bl %l0\t@ far jump`, gcc/thumb.md:837), and the relays of
+    // `*cond_branch` (`.LCB`, :930) and `*cond_branch_reversed` (`.LCBR`, :957), both
+    // `bl %l0\t@far jump`. thumb.c `far_jump_used_p` (:715, read at :785 and :1065) makes it push lr
+    // in any function that has one. Only the WHOLE comment is the mark: a longer comment that
+    // mentions a far jump is not the compiler's.
+    farJumpRelay: { comment: /^@\s*far jump\s*$/ },
   },
 };
 
@@ -939,6 +1581,58 @@ export const ARMV4T_AGBCC: TargetDescription = {
  *  halves (`$f13`, `$f15`) carry the other word of a DOUBLE argument, which no frontend lifts. */
 const O32_FPU: TargetDescription['fpu'] = { argRegs: ['$f12', '$f14'], returnReg: '$f0', slots: 'leading' };
 
+/** O32's register partition, shared by every compiler that targets it (`nonArgRegs` and
+ *  `scratchRegs`). Every general register but the four argument registers and the ones that are
+ *  never a local's home (`zero`, `k0`/`k1`, `gp`, `sp`, `ra`). `s8` and `fp` are the two spellings
+ *  of $30, listed both as `ARMV4T_AGBCC` lists `r12` and `ip`: objdump prints `s8`, and a spelling
+ *  nobody listed keeps its existing treatment. */
+const O32_NON_ARG_REGS = [
+  'at',
+  'v0',
+  'v1',
+  ...Array.from({ length: 10 }, (_, i) => `t${i}`),
+  ...Array.from({ length: 8 }, (_, i) => `s${i}`),
+  's8',
+  'fp',
+] as const;
+/** Of those, the ones O32 lets a callee use with no save — `at`, `v0`/`v1` and `t0`..`t9`, the
+ *  caller-saved registers that pass no argument. MEASURED on GCC_KMC_TOOLCHAIN and the stock gcc
+ *  2.7.2 toolchain at their synthetic flags: a leaf homes an uninitialised local in v0
+ *  (`uninit_join`: `bgtzl a0,…; sll v0,a0,1; jr ra; ori v0,v0,1`) and in v1 (`uninit_sw`).
+ *
+ *  Every one of them is also a `hiddenInputRegs` entry, because O32's hand-written asm hands values
+ *  over in them: af's famicom_emu routines are handed a value in t0 or v1 (`sw t0,6348(s8)` is
+ *  its first instruction), and a label inside a function starts with its registers live.
+ *  MEASURED over every function and label symbol of the vendored snowboardkids2 (KMC),
+ *  marioparty3 (gcc 2.7.2) and af (IDO) objects, 29,399 in all, the refusal below fires on 17 —
+ *  twelve labels, three hand-written routines (two of famicom_emu's and libkmc's `div64_64_1`) and
+ *  two data symbols disassembled as code — and on no compiled function. A
+ *  compiled local is assigned on some path, so its entry value meets that assignment at a join;
+ *  `uninitfirst` also reads one before the switch that assigns it, which a join allows. The join
+ *  must take a definition the entry value does not feed, because an input carried round a loop
+ *  (`addiu t0,t0,-1; bnez t0,top`) meets only its own next value at the loop header. famicom_emu's
+ *  hand-written Yaz0 reader `func_8082E4E0_jp` is NOT that shape:
+ *  its t0 is a bit buffer loaded whenever the count runs out (and the count starts at 0), then
+ *  shifted each trip, and it lifts with t0 an uninitialised local no path reads before the load.
+ *  The cost is a local NO path assigns
+ *  (`int r; return r + a;` is `jr ra; addu v0,v0,a0` on gcc, and `int x, y; if (c) x = y;` joins
+ *  v0 with v1), which refuses: none of the 29,399 is one.
+ *
+ *  THE RULE'S BLIND SIDE is a count a hand-written routine is handed and RELOADS on an outer arm
+ *  (`… addiu t0,t0,-1; bnez t0,inner; …; bnezl a1,inner; li t0,8`): the outer arm's constant is a
+ *  definition of its own at the inner loop's header, so the entry value counts as met and the first
+ *  pass reads an undeclared local — the input is dropped. Nothing tells it from compiled
+ *  `int t; do { do { … } while (--t); t = 8; } while (--n);`, and none of the 29,399 is either.
+ *  The same side holds an input RELOADED FROM MEMORY on one arm and then transformed: hand
+ *  func_8082E4E0_jp its count in a2 as well (drop its `move a2,zero`), and the arm that runs when
+ *  the count is not 0 reads the caller's bit buffer in t0, but the loop header's join meets the
+ *  shift `sll t0,t0,1`, which reaches t0's entry value only through the join the load `lw t0,0(a0)`
+ *  also feeds. So the shift is a definition of its own, the routine lifts with `int code;` read on
+ *  that first pass, and the caller's t0 is dropped. Nothing tells it from compiled `int code;`
+ *  with the bit count a parameter, and none of the 29,399 is that shape: the real routine zeroes
+ *  a2 before the loop, so its load runs first. */
+const O32_SCRATCH_REGS = ['at', 'v0', 'v1', ...Array.from({ length: 10 }, (_, i) => `t${i}`)] as const;
+
 /** MIPS-II / IDO 7.1 target. IDO is the IRIX C compiler,
  *  statically recompiled to run natively (ido-static-recomp). Unlike agbcc
  *  it emits no textual asm, so asmlift's input is the DISASSEMBLED object (`mips-linux-gnu-
@@ -949,6 +1643,8 @@ export const MIPS_IDO: TargetDescription = {
   compiler: 'ido',
   argRegs: ['a0', 'a1', 'a2', 'a3'],
   returnReg: 'v0',
+  // MEASURED on ido7.1, gcc2.7.2kmc and gcc2.7.2: the probes at the field.
+  evenWordAlignedArgs: true,
   // O32: at, v0-v1, a0-a3, t0-t9 and ra are all caller-saved. `frontend/mips.ts` reads the rest, and
   // `ra`, as the registers a frame store SAVES.
   callerSaved: [
@@ -971,6 +1667,13 @@ export const MIPS_IDO: TargetDescription = {
     't9',
     'ra',
   ],
+  // O32's partition (`O32_NON_ARG_REGS`). The frontend narrows it to the scratch half and the
+  // callee-saved registers its prologue saves (frontend/mips.ts `prologueSavedRegs`).
+  nonArgRegs: O32_NON_ARG_REGS,
+  scratchRegs: O32_SCRATCH_REGS,
+  // Every scratch register, for the measurement at `O32_SCRATCH_REGS`.
+  hiddenInputRegs: O32_SCRATCH_REGS,
+  kernelRegs: ['k0', 'k1'],
   runtimeHelpers: IDO_RUNTIME_HELPERS,
   // MEASURED with this toolchain's own flags: `float f(float a, float b){ return a + b; }` is
   // `jr ra; add.s $f0,$f12,$f14`, and the `'leading'` rule's two halves are the pair in `fpu`'s note.
@@ -979,6 +1682,7 @@ export const MIPS_IDO: TargetDescription = {
   // `switchAllowsNeqCase: false` — IDO's switch dispatch uses `==`/`<`, never `!=` cases;
   // leaving it permissive mis-recognises `!=`-rooted if-else chains as switches.
   compilerBehaviors: {
+    plainCharSigned: false,
     contractsFloatProducts: false,
     coalesceLoopInit: true,
     preserveDivergentBranchSense: true,
@@ -986,7 +1690,19 @@ export const MIPS_IDO: TargetDescription = {
     switchAllowsNeqCase: false,
     // MEASURED — the pair at the field compiles to one load of `p[1]` for every local spelling.
     reloadsLocalReread: false,
+    // MEASURED: the probe at the field (`lw v0` after the byte store).
+    reloadsAcrossSpellings: true,
+    // MEASURED: the probe at the field.
+    narrowStoreConstantTakesLvalueType: true,
     aggregateBoundary: 1,
+    // MEASURED on all three O32 toolchains (ido7.1, gcc2.7.2kmc, gcc2.7.2): `struct {char c; double d;}`
+    // and its `long long` twin put the member at 8 and size 16 (`sizeof` and the member's offset
+    // compiled into `.data`).
+    largestAlignment: 8,
+    // MEASURED on all three O32 toolchains: the probes at the field.
+    aggregateReturn: 'memory',
+    structReturnHandsBackPointer: true,
+    byValueAggregateArgWords: true,
     // MEASURED at `-mips2 -O2 -32 -non_shared -G 0`: the `sll` leads the function for BOTH
     // spellings, so the prologue position cannot decide; a narrow DECLARED parameter is the one that
     // is both homed dead AND widened in its own argument register. raise/paramwidth.ts's header has
@@ -1007,6 +1723,26 @@ export const MIPS_IDO: TargetDescription = {
     // O32's caller-owned home area `[0,16)` would be read as this function's first four
     // declaration ranks. Shipping a direction before the partition orders by argument index.
     spillSlotOrder: 'unknown',
+    addressTakenArrayOrder: 'descending', // MEASURED, the probe at the field
+    addressTakenArrayAlignment: 4, // MEASURED, the probe at the field
+    // MEASURED, the probe at the field: the local ends at the frame top, above `ra` and the spills.
+    o32LocalArea: 'above-saved-registers',
+    // MEASURED off the same probe (`twice`, `owns`): O32's outgoing area is the frame bottom, an
+    // unchanged argument is staged again before each call, and a callee assigns to its stack
+    // parameter in place. Read by the frame-object audit alone here (`storedNeverRead`).
+    localsAboveOutgoingArea: true,
+    // MEASURED at -O1, -O2, -O2 -g3 and -O0 (`test/corpus/ido71*-outarea.txt`): no load from 16(sp)
+    // up, but the a1..a3 home words a by-value aggregate is staged in are loaded back (see the field).
+    outgoingAreaNeverLoadedFrom: 16,
+    // MEASURED at -O1 and -O0: the note at the field — `lw zero` for a volatile read, a `t6` load
+    // and a frame store for a plain dead local, `lw a2` for a `register` one.
+    discardsUnusedReadsInto: 'zero',
+    // MEASURED: the probes at the fields.
+    forwardsStructReturnDestination: true,
+    discardedReadMayFillArgRegister: false,
+    // MEASURED, the probes at the field: past the `addiu` reach every member access gets its own
+    // `lui`/`addu`, and a held pointer shares one.
+    farMemberBasePerAccess: { past: 32767 },
   },
 };
 
@@ -1018,6 +1754,8 @@ export const MIPS_GCC: TargetDescription = {
   compiler: 'gcc',
   argRegs: ['a0', 'a1', 'a2', 'a3'],
   returnReg: 'v0',
+  // MEASURED on ido7.1, gcc2.7.2kmc and gcc2.7.2: the probes at the field.
+  evenWordAlignedArgs: true,
   // The same O32 convention MIPS_IDO carries, read the same way.
   callerSaved: [
     'at',
@@ -1039,6 +1777,22 @@ export const MIPS_GCC: TargetDescription = {
     't9',
     'ra',
   ],
+  // O32's partition, as at MIPS_IDO.
+  nonArgRegs: O32_NON_ARG_REGS,
+  scratchRegs: O32_SCRATCH_REGS,
+  hiddenInputRegs: O32_SCRATCH_REGS,
+  // MEASURED on gcc2.7.2kmc and gcc2.7.2 at their canonical flags: `register int g __asm__("$16");
+  // int f(void){ return g; }` is `jr ra; move v0,s0`, and `$23`/`$30` give s7/s8. KMC's `-fno-asm`
+  // rejects the bare `asm(` spelling, which is why every target spells `__asm__`. IDO 7.1 has no
+  // such declaration (its cfe rejects both spellings), so MIPS_IDO states none.
+  globalRegisterVariables: {
+    regs: {
+      ...Object.fromEntries(Array.from({ length: 8 }, (_, i) => [`s${i}`, `$${16 + i}`])),
+      s8: '$30',
+      fp: '$30',
+    },
+  },
+  kernelRegs: ['k0', 'k1'],
   runtimeHelpers: MIPS_GCC_RUNTIME_HELPERS,
   // KMC GCC keeps a loop seeded from an argument register IN that register (coalesceLoopInit
   // true, like IDO): test/corpus/gcc-gcd.asm runs its whole loop on a0/a1 with no init copies,
@@ -1062,6 +1816,7 @@ export const MIPS_GCC: TargetDescription = {
   fpu: O32_FPU,
   capabilities: { endianness: 'big', hwDivide: true, hwFloat: true, flags: false },
   compilerBehaviors: {
+    plainCharSigned: true,
     contractsFloatProducts: false,
     coalesceLoopInit: true,
     preserveDivergentBranchSense: true,
@@ -1101,10 +1856,29 @@ export const MIPS_GCC: TargetDescription = {
     // sub-trees a decline leaves, so a NESTED dispatch comes back as an `if` nest around a `switch`
     // over some of its arms.
     switchRequiresFrontLoadedTests: true,
+    // MEASURED on BOTH toolchains this description serves, the probe pairs at the field.
+    crossJumpsReturnTails: true,
+    // MEASURED at -O2 on both toolchains this description serves, the probe pair at the field;
+    // gcc2.7.2's canonical -O1 clears it (`targetFor`).
+    foldsBranchConstantOnTakenEdge: true,
+    // `joinPastReturnsByDefault` LEFT OUT, so the copies are published and the join is ranked as
+    // `/ret-join`. On held-out real functions it lost none of the copies' matches on either toolchain
+    // this description serves, but on 160 generated functions written with the copies it lost 3 on
+    // gcc2.7.2kmc and 1 on gcc2.7.2, which no mark separates (the field's note).
     // MEASURED on BOTH toolchains this description serves (the note above): one load of `p[1]` for
     // every local spelling of the pair at the field, gcc2.7.2kmc at -O2 and gcc2.7.2 at -O1 alike.
     reloadsLocalReread: false,
+    // MEASURED on BOTH toolchains this description serves, the probe at the field.
+    narrowStoreConstantTakesLvalueType: true,
+    // MEASURED on BOTH toolchains this description serves, the pairs at the field.
+    keepsPointerSumAddend: true,
     aggregateBoundary: 1,
+    // MEASURED on BOTH toolchains this description serves, and on ido7.1: the probe at MIPS_IDO's.
+    largestAlignment: 8,
+    // MEASURED on BOTH toolchains this description serves: the probes at the field.
+    aggregateReturn: 'memory',
+    structReturnHandsBackPointer: true,
+    byValueAggregateArgWords: true,
     // MEASURED on BOTH toolchains this description serves: `int f(s8 x){return x;}` and
     // `int f(s32 x){return (s8)x;}` compile to BYTE-IDENTICAL objects, gcc2.7.2kmc at -O2 and
     // gcc2.7.2 at -O1 alike — so the object carries no witness at all and the pass refuses.
@@ -1118,7 +1892,21 @@ export const MIPS_GCC: TargetDescription = {
     // The two agreeing is not a formality. The value is per DESCRIPTION and TWO toolchains map
     // here, so a toolchain whose direction differed from its description's would need a
     // per-toolchain override this bag cannot express — see the note at `compilerBehaviors`.
+    designatedInitializers: true, // both gcc 2.7.2 builds compile `{ 1, [8] = 2 }` (see the field)
     spillSlotOrder: 'unknown',
+    addressTakenArrayOrder: 'ascending', // MEASURED on both toolchains, the probe at the field
+    addressTakenArrayAlignment: 8, // MEASURED on both toolchains, the probe at the field
+    // MEASURED on BOTH toolchains this description serves, the probe at the field: identical
+    // layouts, the local right above the 8-aligned outgoing area and under the saves.
+    o32LocalArea: 'above-outgoing-area',
+    // MEASURED on BOTH toolchains this description serves, the probe at `o32LocalArea` (`twice`).
+    localsAboveOutgoingArea: true,
+    // MEASURED on BOTH toolchains at their rows' levels and at -O0 (`test/corpus/gcc272*-outarea.txt`):
+    // no load from 16(sp) up the area; a char-array struct's home words are loaded (see the field).
+    outgoingAreaNeverLoadedFrom: 16,
+    // MEASURED on BOTH toolchains this description serves: the probes at the fields.
+    forwardsStructReturnDestination: false,
+    discardedReadMayFillArgRegister: true,
   },
 };
 
@@ -1134,11 +1922,37 @@ export const PPC_MWCC: TargetDescription = {
   // PPC EABI: r3–r10 pass integer/pointer arguments; r3 also returns.
   argRegs: ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'],
   returnReg: 'r3',
+  // MEASURED on 2.4.2 at the synthetic tier's flags and on 2.3.3 and 2.4.7 at -O4,p:
+  // `takeLL(1, gL)` sets r3 and r5:r6 with r4 unset.
+  evenWordAlignedArgs: true,
   // PPC EABI: r0 and r3-r12 are volatile, and lr carries the return address `bl` overwrites. r11
   // and r12 are the linker's stub scratch, r13 is the small-data base and r14 upward are
   // callee-saved.
   callerSaved: ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10', 'r11', 'r12', 'lr'],
+  // Every GPR but r1 (the stack pointer, never an SSA register here) and the eight argument
+  // registers. The frontend narrows it to `scratchRegs` and the ones the prologue saved
+  // (`prologueSavedRegs`). r2 and r13, the small-data bases, never reach that rule: a read of either
+  // as a value refuses first (`SMALL_DATA_BASES` in frontend/ppc.ts).
+  nonArgRegs: ['r0', 'r2', ...Array.from({ length: 21 }, (_, i) => `r${i + 11}`)],
+  // The volatile registers no argument travels in, which a callee may use with no save. MEASURED on
+  // 2.4.2 at the synthetic tier's flags and on 2.3.3 at Pikmin's -O4,p (in C): a leaf homes an
+  // uninitialised local in each of them, unsaved — `int x; if (s) x = a*3; return x + a;` is
+  // `mulli r0,r4,3; add r3,r0,r4`, and with all eight argument registers live two such locals land
+  // in r11 and r12. 2.4.7 at MP4's flags puts them in saved registers instead.
+  scratchRegs: ['r0', 'r11', 'r12'],
+  // r11 is the save routines' frame address and r12 `__ptmf_scall`'s member-function pointer: a
+  // read of either that no path's definition joins refuses instead of minting `uninit_r11`.
+  hiddenInputRegs: ['r11', 'r12'],
+  // MEASURED on 2.4.2 and 2.4.7 at -O4,p: `register int g __asm__("r14"); int f(void){ return g; }`
+  // is `mr r3,r14`. They accept r14..r28 only ("supports 15 registers beginning with r14") and no
+  // gap among them ("nothing at 'r19' not permitted"), in any declaration order. 2.3.3 refuses the
+  // storage class, so `mwcc_233_163n` drops this field.
+  globalRegisterVariables: {
+    regs: Object.fromEntries(Array.from({ length: 15 }, (_, i) => [`r${14 + i}`, `r${14 + i}`])),
+    contiguous: Array.from({ length: 15 }, (_, i) => `r${14 + i}`),
+  },
   runtimeHelpers: PPC_MWCC_RUNTIME_HELPERS,
+  registerSaveRoutines: PPC_MWCC_SAVE_ROUTINES,
   // PPC EABI with `-fp hard`, measured at the synthetic tier's flags: `fadds f1,f1,f2; blr`, a third
   // float argument in f3, and the GPR/FPR order of mixed parameters absent from the object.
   fpu: { argRegs: ['f1', 'f2', 'f3', 'f4', 'f5', 'f6', 'f7', 'f8'], returnReg: 'f1', slots: 'separate' },
@@ -1147,7 +1961,11 @@ export const PPC_MWCC: TargetDescription = {
   // defaults; coalesceLoopInit false until a CW loop fixture says otherwise — the second of the
   // two compiler-wide guesses standing in for the per-function observation named at MIPS_GCC.
   compilerBehaviors: {
+    plainCharSigned: true,
     contractsFloatProducts: true,
+    // MEASURED on all three builds in C: an integer, a pointer and a `u16 *` passed to an `s32 *`,
+    // `u32` and `s32 *` parameter each fail to compile, and each compiles once cast (see the field).
+    strictPointerConversions: true,
     coalesceLoopInit: false,
     preserveDivergentBranchSense: true,
     orderArgCopiesByWriteOrder: true,
@@ -1156,11 +1974,16 @@ export const PPC_MWCC: TargetDescription = {
     // `u8 v = p[3]; if ((v & 0x7f) == 0x7f) { fnA(); p[4] = v; return; }` under an `if (a)`
     // matches only once `read-behind-effect` stops refusing it (3/24 → MATCH 0/22).
     reloadsLocalReread: false,
+    // MEASURED on all three builds at -O4,p, and on mwcc_247_107 at -O0,p: the probe at the field.
+    narrowStoreConstantTakesLvalueType: true,
     aggregateBoundary: 1,
     // MEASURED on all three builds: `struct {u8 a; double d;}` and its `long long` twin put the
     // member at 8 and size 16
     largestAlignment: 8,
     aggregateReturn: 'svr4',
+    // MEASURED on all three builds: r3 holds a reload of a frame word at the `blr` of a struct
+    // returner that calls something
+    structReturnHandsBackPointer: false,
     // MEASURED on mwcc_242_81 through the `.comment` alignment record: an array or a struct is at
     // 4 at least (`u8[1]`, a struct of two bytes), a scalar at its width; a string-literal
     // initializer gets no more than the array does (`char s[] = "hello!"` and a `u8` list both 4);
@@ -1187,6 +2010,15 @@ export const PPC_MWCC: TargetDescription = {
     // frontend lifts to the same `sext` op agbcc's shift pair folds to — the position shape, on
     // another ISA. `synthetic:{sextb,tos8}:mwcc_242_81` are its rows, MATCH through that pass.
     narrowParamWitness: 'prologue-extension',
+    // MEASURED on all three builds: the note at the field.
+    linkageLocalArea: 'above-outgoing-area',
+    // MEASURED off the same probes, on all three builds and at -O0,p (`twice9`, and every outgoing
+    // word below the area unread): Mario Party 4's -O0,p homes a parameter in the area and reloads
+    // it after a call, which proves the word a local's (`ee`, `synthetic:homecall:mwcc_242_81`).
+    localsAboveOutgoingArea: true,
+    // MEASURED on all three builds at the rows' flags and -O0,p, and on mwcc_242_81 at -O4,s
+    // (`test/corpus/mwcc*-outarea.txt`): no load of the parameter area, which starts at 8(r1).
+    outgoingAreaNeverLoadedFrom: 8,
     // NOT MEASURED, and `'unknown'` is therefore the only honest value here rather than a withheld
     // one, as it is at MIPS_IDO and MIPS_GCC. No mwcc row lifts with two or more spilled user
     // locals, and the compiler does not spill the committed declaration-rank probe either: at
@@ -1195,9 +2027,38 @@ export const PPC_MWCC: TargetDescription = {
     // first: `frontend/ppc.ts` claims no `LiveInModel.declaredLocals`, so the shared stamp records
     // no slot home on this target at all and a direction here would order nothing until it does.
     spillSlotOrder: 'unknown',
+    // MEASURED on all three builds at -O0,p: the note at the field — `lwz r0` for a volatile read,
+    // an `r31` home for a plain or `register` dead local.
+    discardsUnusedReadsInto: 'r0',
+    // MEASURED on all three builds: the probes at the fields.
+    forwardsStructReturnDestination: false,
+    discardedReadMayFillArgRegister: true,
+    // MEASURED over held-out real functions at mwcc_242_81 and mwcc_233_163n, at the field;
+    // PPC_MWCC_247 leaves it out.
+    joinPastReturnsByDefault: true,
   },
 };
 
+/** A description's behaviours less `joinPastReturnsByDefault`, for a build that shares the
+ *  description but was not measured for that default. */
+function withoutJoinDefault(d: TargetDescription): TargetDescription['compilerBehaviors'] {
+  const { joinPastReturnsByDefault: _measuredElsewhere, ...behaviors } = d.compilerBehaviors;
+  return behaviors;
+}
+
+/** CodeWarrior 2.3.3b163n (Pikmin): `PPC_MWCC` but for the one declaration a probe refuted there —
+ *  it rejects a global register variable ("illegal storage class"), so it has no spelling for one.
+ *  The return-tail default is PPC_MWCC's, measured at this build over Pikmin
+ *  (`joinPastReturnsByDefault`). */
+export const PPC_MWCC_233: TargetDescription = {
+  ...PPC_MWCC,
+  globalRegisterVariables: undefined,
+};
+
+/** CodeWarrior 2.4.7b107 (Mario Party 4's other build): `PPC_MWCC` less the return-tail default no
+ *  held-out function measured at this build (`joinPastReturnsByDefault`). */
+export const PPC_MWCC_247: TargetDescription = { ...PPC_MWCC, compilerBehaviors: withoutJoinDefault(PPC_MWCC) };
+
 /** A toolchain: one compiler binary, named as decomp.me names it. Several toolchains may share a
  *  description (`MIPS_GCC` serves two), and each keeps its own evidence. */
 export interface ToolchainTarget {
@@ -1271,7 +2132,8 @@ export const TOOLCHAIN_TARGETS = {
     description: PPC_MWCC,
   },
   // The other two CodeWarrior builds the GameCube projects compile with: 2.3.3b163n (Pikmin's whole
-  // game tree) and 2.4.7b107 (Mario Party 4's DOL). Both SHARE `PPC_MWCC`, and on their own evidence
+  // game tree) and 2.4.7b107 (Mario Party 4's DOL). Both SHARE `PPC_MWCC` (2.3.3 less the global
+  // register variables it refuses, `PPC_MWCC_233`), and on their own evidence
   // rather than because they are the same compiler family: `test/matching/ppc-compiler-behaviors.test.ts`
   // re-runs both of its probes on each binary at the flags that build's rows compile at, and each
   // reads as the description says. What moves those readings is the optimisation level — at `-O0,p`
@@ -1283,11 +2145,11 @@ export const TOOLCHAIN_TARGETS = {
   // are two different sets, neither of which is "the" one. See `canonicalFlags` above.
   mwcc_233_163n: {
     family: 'mwcc',
-    description: PPC_MWCC,
+    description: PPC_MWCC_233,
   },
   mwcc_247_107: {
     family: 'mwcc',
-    description: PPC_MWCC,
+    description: PPC_MWCC_247,
   },
 } as const satisfies Readonly<Record<string, ToolchainTarget>>;
 
@@ -1328,6 +2190,41 @@ export interface ResolvedTarget {
   profile: CodegenProfile;
 }
 
+/** Does a compiler of `family`, at optimisation level `level` (the profile's `O` slot), keep a plain
+ *  read whose value nothing uses (`compilerBehaviors.keepsUnusedReads`)? COMPILED, `int x; x = p[5];
+ *  x = 0; *q = x;` and `int x = p[1];`: mwcc 2.3.3 and 2.4.2 at `-O0` and 2.4.7 at `-O0,p` keep
+ *  `lwz r31, 20(r3)` in a register nothing reads; IDO 7.1 at `-O0` and at `-O1` (its default) keeps
+ *  `lw t6, 20(a0)`; agbcc and KMC gcc 2.7.2 at `-O0` keep the read and store it to the frame. None
+ *  of them does at agbcc/KMC `-O1`, `-O2` or `-O3`, IDO `-O2` or `-O3`, or mwcc 2.4.2 `-O1` through
+ *  `-O4,p` and `-O4,s`. A plain expression statement's read (`*p;`) is gone at every level on every
+ *  one of them; a volatile one stays, at a keeping level in the register `discardsUnusedReadsInto`
+ *  names where the compiler has one.
+ *
+ *  A LEVEL NO FLAG NAMES (`undefined`) KEEPS. Every family's unflagged compile was measured keeping:
+ *  agbcc's and IDO's are their `-O0` and `-O1` (codegen-flags.ts `EFFECTIVE` names them, so they
+ *  never reach here unnamed), KMC gcc 2.7.2 with no `-O` emits `-O0`'s object byte for byte, and
+ *  mwcc 2.4.2 with no level, with `-opt off` or with `-opt level=0` keeps `x = p[5]; x = 0;`'s
+ *  `lwz r31, 20(r3)` as at `-O0`. And the cost runs one way: answering "keeps" where the compiler
+ *  deletes withholds a `volatile` outside the discard register (`discardsUnusedReadsInto`): the
+ *  read is dropped as plain on mwcc and IDO, and the lift refuses on a compiler with none. Answering
+ *  "deletes" where it keeps publishes one the source never wrote, a value this stamp alone decides,
+ *  with no candidate to referee it (docs/level-tower.md, A PROFILE OF A COMPILER INHERITS). */
+export function keepsUnusedReadsAt(family: FlagFamily, level: string | undefined): boolean {
+  if (level === undefined) {
+    return true;
+  }
+  const n = /^\d/.exec(level)?.[0];
+  return n === '0' || (family === 'ido' && n === '1');
+}
+
+/** The level `keepsUnusedReadsAt` judges a profile at: its `O` slot, or none where a word the table
+ *  does not read may set it too — mwcc's `-opt off` and `-opt level=0` compile at `-O0`, and the
+ *  table reads neither, so a profile that spells one has a level nothing here knows. */
+function unusedReadLevel(profile: CodegenProfile): string | undefined {
+  const optWord = profile.family === 'mwcc' && profile.unclassified.some((w) => w.startsWith('-opt'));
+  return optWord ? undefined : profile.slots.O;
+}
+
 /** The target a function compiled by `toolchain` at `cflags` decompiles against, and the profile
  *  those flags describe. Throws on a level word the toolchain's family cannot read. */
 export function targetFor(toolchain: ToolchainId, cflags: readonly string[]): ResolvedTarget {
@@ -1335,15 +2232,76 @@ export function targetFor(toolchain: ToolchainId, cflags: readonly string[]): Re
   const profile = parseFlags(t.family, cflags);
   const cpp = dialectOf(profile.slots.lang) === 'c++';
   let target: TargetDescription = cpp ? { ...t.description, dialect: 'c++' } : t.description;
+  if (keepsUnusedReadsAt(t.family, unusedReadLevel(profile))) {
+    target = { ...target, compilerBehaviors: { ...target.compilerBehaviors, keepsUnusedReads: true } };
+  }
   if (profile.slots['-fshort-enums'] === 'on') {
     // every enum is the smallest integer its values fit (c-decl.c:6064-6065, :6123; compiled,
     // `sizeof(struct {enum {K0, K1} k[2];})` is 4 under the flag and 8 without), so none is enumBytes
     const { enumBytes: _flagged, ...behaviors } = target.compilerBehaviors;
     target = { ...target, compilerBehaviors: behaviors };
   }
+  if (target.compilerBehaviors.foldsBranchConstantOnTakenEdge === true && !cseFollowsJumpsUnder(profile)) {
+    target = { ...target, compilerBehaviors: { ...target.compilerBehaviors, foldsBranchConstantOnTakenEdge: false } };
+  }
+  const charSigned = plainCharSignedUnder(t.family, profile.slots);
+  if (charSigned !== 'default' && charSigned !== target.compilerBehaviors.plainCharSigned) {
+    const { plainCharSigned: _default, ...behaviors } = target.compilerBehaviors;
+    target = {
+      ...target,
+      compilerBehaviors: charSigned === undefined ? behaviors : { ...behaviors, plainCharSigned: charSigned },
+    };
+  }
   return { toolchain, cflags, target, profile };
 }
 
+/** Does gcc's cse follow jumps at these flags (`compilerBehaviors.foldsBranchConstantOnTakenEdge`)?
+ *  Only a jump cse FOLLOWS gets its taken edge's equivalence: `cse_end_of_basic_block` marks a path
+ *  branch TAKEN only under `follow_jumps` (cse.c:8192-8211), and the branch around a block that
+ *  `skip_blocks` adds is AROUND, whose block is invalidated, not recorded (cse.c:8223, :8545-8548).
+ *  toplev.c:3606-3607 sets `flag_cse_follow_jumps` at `optimize >= 2`, and the switch sets or clears
+ *  it by name either way, the level's value standing where it is not given. -O0 is answered `true`:
+ *  cse does not run there, which is a different compiler again, and a level no table reads keeps
+ *  the declaration. (cse.c line numbers are agbcc's gcc 2.9 tree.)
+ *
+ *  MEASURED on `corpus/probe-rettail-pg` at gcc2.7.2, the copies' `beqz` delay slot: `nop` (unfolded)
+ *  at -O1, at `-O1 -fcse-skip-blocks`, at `-O2 -fno-cse-follow-jumps` and at `-O2
+ *  -fno-cse-follow-jumps -fno-cse-skip-blocks`; `move v0,zero` at -O2, at `-O2 -fno-cse-skip-blocks`
+ *  and at `-O1 -fcse-follow-jumps`. The join is `move v0,zero` under all seven. */
+function cseFollowsJumpsUnder(profile: CodegenProfile): boolean {
+  if (profile.family !== 'gcc' && profile.family !== 'agbcc') {
+    return true;
+  }
+  if (profile.slots.O === '0') {
+    return true;
+  }
+  const flag = profile.slots['-fcse-follow-jumps'];
+  return flag === 'on' ? true : flag === 'off' ? false : profile.slots.O !== '1';
+}
+
+/** What the flags say a plain `char` is (`compilerBehaviors.plainCharSigned`): `default` where they
+ *  leave it to the compiler. gcc keeps one flag, `flag_signed_char`, that `-fsigned-char` and
+ *  `-fno-unsigned-char` set and `-funsigned-char` and `-fno-signed-char` clear, the last one given
+ *  winning; the profile keeps the two switches apart, so where both are given and they disagree the
+ *  order is lost and the answer is undefined. IDO's `-signed` makes it signed, and mwcc's `-char`
+ *  takes `signed` or `unsigned`. */
+function plainCharSignedUnder(
+  family: FlagFamily,
+  slots: Readonly<Record<string, string>>,
+): boolean | undefined | 'default' {
+  if (family === 'ido') {
+    return slots.char === 'signed' ? true : 'default';
+  }
+  if (family === 'mwcc') {
+    return slots.char === 'signed' ? true : slots.char === 'unsigned' ? false : 'default';
+  }
+  const said = [
+    slots['-fsigned-char'] === undefined ? undefined : slots['-fsigned-char'] === 'on',
+    slots['-funsigned-char'] === undefined ? undefined : slots['-funsigned-char'] === 'off',
+  ].filter((x) => x !== undefined);
+  return said.length === 0 ? 'default' : said.every((x) => x === said[0]) ? said[0] : undefined;
+}
+
 /** Build the structurer's options for a target: the function's own `returnsVoid` plus every
  *  `compilerBehaviors` field. The ONE place a target's compiler behaviors flow into the
  *  target-agnostic structurer — a new compiler behavior is a field in `compilerBehaviors`, consumed
@@ -1359,9 +2317,8 @@ export function structureOptionsFor(
   returnsVoid: boolean,
   prototypes: Prototypes = {},
 ): StructureOptions {
-  // `littleEndian` and `deviceRegisters` are the HARDWARE capabilities the structurer consumes
-  // (bitfield extract recognition is LSB-first; the dead-read spelling refuses outside the device
-  // window); everything else is a compiler behavior.
+  // `littleEndian` is the HARDWARE capability the structurer consumes (bitfield extract recognition
+  // is LSB-first); everything else is a compiler behavior.
   //
   // ONE FIELD IS NOT A STRAIGHT SPREAD, and this is where the difference belongs. A frame
   // direction has THREE states here — `ascending`, `descending`, and `'unknown'` meaning measured
@@ -1372,16 +2329,19 @@ export function structureOptionsFor(
   const { spillSlotOrder, ...behaviors } = t.compilerBehaviors;
   return {
     returnsVoid,
-    declaredArgs: declaredArgTypes(prototypes),
+    declaredArgs: declaredArgTypes(prototypes, t.dialect !== 'c++'),
     declaredReturns: declaredReturnTypes(prototypes),
     ...(t.dialect === 'c++' ? { dialect: 'c++' as const } : {}),
     littleEndian: t.capabilities.endianness === 'little',
-    ...(t.capabilities.deviceRegisters ? { deviceRegisters: t.capabilities.deviceRegisters } : {}),
     ...behaviors,
     ...(spillSlotOrder === 'ascending' || spillSlotOrder === 'descending' ? { spillSlotOrder } : {}),
   };
 }
 
+/** The global a register `globalRegisterVariables` names is lifted as (`asmName` its `__asm__`
+ *  name: `greg_r8`, and `greg_r16` for MIPS `$16`). */
+export const globalRegisterSymbol = (asmName: string): string => `greg_${asmName.replace(/^\$/, 'r')}`;
+
 /** The candidate prelude: a `typedef` for every name in the scalar vocabulary. PRINTED from
  *  `proto.ts`'s `PRELUDE_TYPEDEFS` rather than spelled out, because the other reader of that
  *  vocabulary decides which type texts asmlift may PRINT into a candidate, and a second copy of
@@ -1393,18 +2353,32 @@ export const C_TYPEDEFS = `${[...PRELUDE_TYPEDEFS].map(([name, base]) => `typede
 
 /** Each declared callee's parameter types, where one can be PRINTED as a cast — the argument
  *  conversions C++ refuses to make implicitly (backend/cfamily.ts `argConversion`), and a pointer
- *  cell's integer arguments (l3/ptrcell.ts). An entry this cannot spell is `undefined`, and that
- *  argument is printed uncast. */
-function declaredArgTypes(prototypes: Prototypes): Record<string, readonly (ParamType | undefined)[]> {
+ *  cell's integer arguments (l3/ptrcell.ts). In C (`opaquePointers`), an object pointer to a type
+ *  this cannot spell — `struct S *` — is kept too: the printer casts its argument through `void *`,
+ *  which C converts to any object pointer implicitly, where a strict front end (mwcc) refuses
+ *  `use2(s)` for a `u32 s[2]` the static's bytes were typed as. Any other entry this cannot spell is
+ *  `undefined`, and that argument is printed uncast. */
+function declaredArgTypes(
+  prototypes: Prototypes,
+  opaquePointers: boolean,
+): Record<string, readonly (ParamType | undefined)[]> {
   const out: Record<string, readonly (ParamType | undefined)[]> = {};
   for (const [name, p] of Object.entries(prototypes)) {
     if (Array.isArray(p.params)) {
-      out[name] = p.params.map((t) => (spellableType(t) && declaredWidth(t) !== undefined ? t : undefined));
+      out[name] = p.params.map((t) =>
+        (spellableType(t) && declaredWidth(t) !== undefined) || (opaquePointers && objectPointerType(t))
+          ? t
+          : undefined,
+      );
     }
   }
   return out;
 }
 
+/** A pointer to an object, a pointer to a function excluded: `void *` converts to it implicitly in
+ *  C, which it does not to a function pointer. */
+const objectPointerType = (t: ParamType): boolean => /\*\s*(?:const|volatile|\s)*$/.test(t) && !t.includes('(');
+
 /** Each declared callee's return type as the project spells it, which is never printed: whether a
  *  pointer cell compared with the call meets a pointer (l3/ptrcell.ts). */
 function declaredReturnTypes(prototypes: Prototypes): Record<string, ParamType> {