@asmlift/core 0.9.0 → 0.11.0

package/src/frontend/frame-objects.ts

@@ -9,11 +9,19 @@
  *  every ISA — the level-tower split for this frame model: the frontend supplies the PARTITION,
  *  the shared pass applies the rule. Messages name the frame base `sp`.
  *
- *  Thumb is the only caller today; the worked examples below are agbcc's, because agbcc is the
- *  compiler every rule was measured against. */
-import { type Block, type Op, type Value, mkOp, mkValue } from '../ir/core';
-import { type IrType, T, typeEquals, typeToString } from '../ir/types';
-import type { Gate } from '../l3/gates';
+ *  Three frontends call it: Thumb; MIPS, which lowers `addiu rD,sp,k` and `addu rD,sp,rX` to an
+ *  `laddr` and hands over the O32 local area as both ranges (`frontend/mips.ts` `measureO32Frame`);
+ *  and PPC, which lowers `addi rD,r1,k` and every r1 access inside mwcc's local area the same way
+ *  (`frontend/ppc.ts` `measurePpcFrame`).
+ *  The worked examples below are agbcc's, because agbcc is the compiler every rule was first
+ *  measured against; IDO, gcc 2.7.2 and mwcc reload past every store of another type (strict
+ *  aliasing does not reorder there), so the cast and union refusals below are only more cautious on
+ *  MIPS and PPC. */
+import { type StridedRange, linearFactor } from '../ir/bits';
+import { type Block, type Op, type Value, byValueOperands, calleeName, mkOp, mkValue, successorsOf } from '../ir/core';
+import { type IrType, T, structSpelling, typeEquals, typeToString, unionViewSigns } from '../ir/types';
+import { type Gate, firstRejection } from '../l3/gates';
+import { blockCopyRoles } from '../proto';
 import type { SymbolMap } from '../symbols';
 import { type TargetDescription, blockTransferRead, sourceControlRead, sourceReach } from '../target';
 import type { CallDeclarations } from './call-plan';
@@ -31,9 +39,25 @@ export interface FrameObjectAudit {
    *  stack-argument block staged at its bottom, which is where an untyped object claims to start */
   declaredLocals: NonNullable<LiveInModel['declaredLocals']>;
   usedSlotOffsets: ReadonlySet<number>;
+  /** THE FRONTEND'S LOADED-WORD BOUND, present where the target states `outgoingAreaNeverLoadedFrom`:
+   *  `from` is that offset and `bound` the lowest frame word, in this audit's offsets, the frontend
+   *  saw the function load from `from` up, or `Infinity`. The frontend reads it ONCE off its
+   *  instructions — slot reloads, the epilogue's restores and plain loads alike, which the IR does
+   *  not all show — and its own stack-argument refusals take the same number, so one lift answers
+   *  the premise once (`storedNeverRead` adds only the loads it alone sees, through a captured
+   *  address). Absent where the target states no such offset. */
+  loadedWords?: { readonly from: number; readonly bound: number };
   capturedObjectIsTheWholeFrame: boolean;
+  /** the frame offsets whose escape the frontend's outgoing-argument verdict leans on — each one
+   *  re-proven here (`recheckEscapesReliedOn`). Absent or empty where it leans on none. */
+  escapesReliedOn?: ReadonlySet<number>;
   /** every capture the add arm re-minted at a constant offset from it */
   movedCaptures: ReadonlySet<Value>;
+  /** the `laddr`s the frontend minted for a DIRECT frame access (`off(sp)` inside its local area)
+   *  rather than for a captured address: a word reached only through them is one its slot model
+   *  lifts again outside a relift's bytes (`reliftRange`). Thumb, which lifts a direct word access
+   *  as a slot, has none. */
+  directAccesses?: ReadonlySet<Value>;
   /** whether a callee's declaration rules out a struct returned through a hidden pointer at
    *  argument 0 (aggregate.ts `returnsWithoutHiddenPointer`), asked of the frontend's call
    *  declarations */
@@ -43,6 +67,17 @@ export interface FrameObjectAudit {
   /** the retraction rules an escape is judged by; `FRAME_ESCAPE_GATES` when absent, and a
    *  census or an ablation hands in its own (`FRAME_OBJECT_AUDIT`) */
   gates?: readonly Gate<FrameEscape>[];
+  /** the rules that keep a frame's end word in the one object (`reliftRange`);
+   *  `RELIFT_HAND_BACK_GATES` when absent, and a census or an ablation hands in its own */
+  reliftGates?: readonly Gate<HandBack>[];
+  /** THE ARGUMENT HOMES THE FRONTEND KEPT FROM THE SLOT MODEL FOR THE ONE-OBJECT ANSWER ALONE: frame
+   *  words an incoming argument register is stored to on entry, whose narrow reloads the frontend
+   *  left as captures rather than reading them as the word narrowed, because a by-value struct
+   *  parameter's home recompiles as that one object (Thumb `argumentHomes`). Where that answer is
+   *  withheld and the audit refuses, it asks for a relift with them released
+   *  (`FrameObjectRelift.homesReleased`) rather than refusing, and a relift that declines reports
+   *  this refusal first. Absent or empty where none was kept. */
+  releasableHomes?: ReadonlySet<number>;
   /** the bytes a first audit asked to have kept as ONE object in memory (`FrameObjectRelift`):
    *  the frontend routes every access inside them through an `laddr`, and the audit declares
    *  them one object rather than judging each offset on its own */
@@ -54,12 +89,113 @@ export interface FrameRange {
   readonly to: number;
 }
 
-/** What an audit answers instead of a refusal when a device may read the frame, or a callee write
- *  it, without bound: lift again with `oneObject` set to these bytes. */
+/** THE LOCAL AREA ABOVE A FRAME'S OUTGOING AREA, `[from, to)` in post-push stack-pointer offsets:
+ *  from where the outgoing words end (`outgoingEnd`, rounded up to `align`) to the lowest register
+ *  save at or above that, or the frame's top. The rule O32's `above-outgoing-area` compilers
+ *  (frontend/mips.ts `o32LocalArea`) and mwcc (frontend/ppc.ts, `compilerBehaviors.linkageLocalArea`)
+ *  both keep; each frontend measures the numbers it is applied to. Null where nothing is left. */
+export function areaAboveOutgoing({
+  frameSize,
+  outgoingEnd,
+  saves,
+  align,
+}: {
+  frameSize: number;
+  outgoingEnd: number;
+  saves: readonly number[];
+  align: number;
+}): FrameRange | null {
+  const from = Math.ceil(outgoingEnd / align) * align;
+  const area = { from, to: Math.min(frameSize, ...saves.filter((o) => o >= from)) };
+  return area.from < area.to ? area : null;
+}
+
+/** Whether a `width`-byte frame access at post-push offset `at` lands on a byte of `area`. A
+ *  frontend that routes accesses into the area by their post-push offset asks it of every access
+ *  made at ANOTHER depth, which that routing would misname, and draws no area where one does. */
+export const landsOnArea = (area: FrameRange, at: number, width: number): boolean =>
+  at < area.to && at + width > area.from;
+
+/** Whether a `width`-byte access at `at` inside a frontend's local area is MEMORY in a relift that
+ *  keeps `kept` as one object: inside it, yes; wholly outside, no — a word the first audit handed
+ *  back to the slot model (`reliftRange`); across its edge, refused, half memory and half slot. */
+export function keptInRelift(kept: FrameRange, at: number, width: number, what: () => string, name: string): boolean {
+  if (at >= kept.from && at + width <= kept.to) {
+    return true;
+  }
+  if (at >= kept.to || at + width <= kept.from) {
+    return false;
+  }
+  throw new FrontendUnsupportedError(
+    `cannot lift '${name}': address-taken stack local — ${what()} reaches across an edge of the bytes ` +
+      `[sp,#${kept.from}) to [sp,#${kept.to}) kept as one object — part memory, part slot`,
+  );
+}
+
+/** What an audit answers instead of a refusal. Where a device may read the frame, or a callee write
+ *  it, without bound: lift again with `oneObject` set to these bytes. Where the one-object answer is
+ *  withheld and the audit refuses a frame with an argument home the frontend kept out of the slot
+ *  model for that answer alone (`FrameObjectAudit.releasableHomes`): lift again with `oneObject`
+ *  unset and `homesReleased`, so the frontend reads those homes as the slots they are. */
 export interface FrameObjectRelift {
-  readonly oneObject: FrameRange;
+  readonly oneObject: FrameRange | undefined;
+  /** with `homesReleased`, the first audit's refusal, which a relift that declines again reports
+   *  first: the frame as the first lift read it, followed by the second lift's own refusal where it
+   *  differs (`bothRefusals`) */
+  readonly homesReleased?: { readonly refusal: FrontendUnsupportedError };
+}
+
+/** THE RELIFT PROTOCOL, AT MOST TWICE, the one copy every frontend that runs the audit calls: lift,
+ *  and where the audit answers with a relift (`FrameObjectRelift`), lift once more as it asks —
+ *  bytes to keep as one object routed through an `laddr`, or argument homes released to the slot
+ *  model. The second audit judges the frame as asked and refuses rather than asking again, so a
+ *  second request is an internal error, not a third lift. A second lift with homes released that
+ *  declines reports the first audit's refusal (`homesReleased.refusal`), then its own where that
+ *  differs. A frontend that hands the audit no `releasableHomes` is never asked to release one. */
+export function liftWithRelift<F>(
+  name: string,
+  liftOnce: (oneObject: FrameRange | undefined, homesReleased: boolean) => F | FrameObjectRelift,
+): F {
+  const first = liftOnce(undefined, false);
+  if (!isRelift(first)) {
+    return first;
+  }
+  const released = first.homesReleased;
+  let again: F | FrameObjectRelift;
+  try {
+    again = liftOnce(first.oneObject, released !== undefined);
+  } catch (e) {
+    if (released !== undefined && e instanceof FrontendUnsupportedError) {
+      throw bothRefusals(name, released.refusal, e);
+    }
+    throw e;
+  }
+  if (isRelift(again)) {
+    throw new Error(`internal: the frame-object audit of '${name}' asked for a second relift`);
+  }
+  return again;
 }
 
+/** A released relift's decline, worded as both lifts read the frame: the first audit's refusal of
+ *  the frame with the homes held, then the second's with them released, which may name another
+ *  obstacle (an escape the first refusal stopped short of). The first leads, so a message that
+ *  only the first lift's refusal explains reads as it would with no release; the second is
+ *  appended only where it says something else. */
+function bothRefusals(
+  name: string,
+  first: FrontendUnsupportedError,
+  second: FrontendUnsupportedError,
+): FrontendUnsupportedError {
+  const lead = `cannot lift '${name}': `;
+  const reason = second.message.startsWith(lead) ? second.message.slice(lead.length) : second.message;
+  return first.message.endsWith(reason)
+    ? first
+    : new FrontendUnsupportedError(`${first.message}; with the argument home released: ${reason}`);
+}
+
+const isRelift = <F>(x: F | FrameObjectRelift): x is FrameObjectRelift =>
+  typeof x === 'object' && x !== null && 'oneObject' in x;
+
 /** What an audit answers: lift again (`FrameObjectRelift`), the device pin the accepted function
  *  owes (`DevicePins`, applied by `pinDeviceAccesses`), or nothing, when no frame address was
  *  taken. */
@@ -247,13 +383,20 @@ export const FRAME_ESCAPE_GATES: readonly Gate<FrameEscape>[] = [
  *  anywhere as a VALUE — into an MMIO register (the DMA-fill idiom), a call, a phi — and it is
  *  judged in one of two models, chosen before any shape is:
  *   - PER OBJECT, the default: every MEMORY access through it must be at offset 0, with one agreed
- *     width and one agreed extension, or a byte read or written through a runtime index into
- *     storage nothing else types, and its bytes must belong to nothing else in the frame;
+ *     width and one agreed extension, or a read or write through a runtime index into storage
+ *     nothing else types — bytes, or ONE wider width, read through a cast on the bytes
+ *     (`indexedWidth`) — and its bytes must belong to nothing else in the frame;
  *   - ONE OBJECT, where a device reads or a callee writes without bound and every writer is one
- *     that answer can hold (`writerNotKept`; `oneObject`, which this answers and the frontend
- *     lifts again with): the local area is one `u8` array in memory, every fixed-offset access in
- *     it is a member at its own offset, a runtime index may reach a byte of it, and two widths at
- *     one byte refuse.
+ *     that answer can hold (`writerNotKept`), or where no address escapes at all and the
+ *     per-object model refuses (`oneObject`, which this answers and the frontend lifts again
+ *     with): the local area is one `u8` array in memory, every fixed-offset access in it is a
+ *     member at its own offset, a runtime index may reach it at a byte or at ONE wider
+ *     width (`indexedWidth`), and two widths at one byte are the views of one union
+ *     (`unionViews`), or refuse where no view names them (`unionRefusal`).
+ *  In either model, a store through a capture that reaches a call unread on every path, beneath
+ *  every word a load proves a local's, declines: it may be that call's stack argument
+ *  (`storedNeverRead`). Which load proves it is the compiler's premise: one after a call under
+ *  `localsAboveOutgoingArea`, and any load from the offset up under `outgoingAreaNeverLoadedFrom`.
  *  Any use the audit cannot vouch for declines the whole function loudly. Nothing here guesses: a
  *  scalar's declared type is exactly the access type the machine used, and an object NO access
  *  reaches is sized by the frame reservation and left untyped.
@@ -273,41 +416,92 @@ export const FRAME_ESCAPE_GATES: readonly Gate<FrameEscape>[] = [
  *  the fold, the split, the one-object answer and the stamp; `foldedHere`, which the split adds to
  *  and the slot-overlap refusal reads; and `ModelChoice.refused`, which the model choice and the
  *  shape stage set and the relift test reads. */
-export function auditFrameObjects({
+export function auditFrameObjects(audit: FrameObjectAudit): FrameObjectVerdict {
+  // AN ARGUMENT HOME HELD FOR AN ANSWER THAT DID NOT COME. The frontend keeps a by-value struct
+  // parameter's home out of the slot model (`releasableHomes`) so the one-object answer can take it
+  // whole. Where this audit declines instead, that answer withheld (an address escapes to a writer
+  // it cannot hold, such as a struct-return temp), the decline becomes a relift with the homes
+  // released. The hold is for byte-exactness, not soundness: a home's narrow reload read as the
+  // word narrowed is the value the entry stored, and the second audit judges the frame whole, so
+  // the release is value-sound whichever refusal fired. Asked of the first lift alone: a relift
+  // that keeps one object has already had the answer the homes were held for.
+  const { oneObject, releasableHomes } = audit;
+  if (oneObject !== undefined || releasableHomes === undefined || releasableHomes.size === 0) {
+    return auditFrame(audit);
+  }
+  try {
+    return auditFrame(audit);
+  } catch (e) {
+    if (e instanceof FrontendUnsupportedError) {
+      return { oneObject: undefined, homesReleased: { refusal: e } };
+    }
+    throw e;
+  }
+}
+
+function auditFrame({
   name,
   irBlocks,
   ownedLocals: owned,
   declaredLocals: declared,
   usedSlotOffsets,
+  loadedWords,
   capturedObjectIsTheWholeFrame,
+  escapesReliedOn = new Set(),
   movedCaptures,
+  directAccesses = new Set(),
   returnsWithoutHiddenPointer,
   symbols,
   target,
   gates = FRAME_ESCAPE_GATES,
+  reliftGates = RELIFT_HAND_BACK_GATES,
   oneObject,
 }: FrameObjectAudit): FrameObjectVerdict {
   const { laddrs: captures, foldedHere } = foldMovedCaptures(irBlocks, movedCaptures);
   // …and the audit runs for a licensed acceptance with no object at all, so the premise re-check
   // is total rather than resting on "the capture always survives into the IR".
-  if (captures.length === 0 && !capturedObjectIsTheWholeFrame) {
+  if (captures.length === 0 && !capturedObjectIsTheWholeFrame && escapesReliedOn.size === 0) {
     return undefined;
   }
   const fail = frameRefusal(name);
+  if (captures.length === 0 && escapesReliedOn.size > 0) {
+    recheckEscapesReliedOn(escapesReliedOn, undefined, fail);
+  }
   const facts = frameAddressFacts(irBlocks, symbols, target);
-  const { laddrs, splitRefusal } = splitAddressingCopies(irBlocks, captures, foldedHere);
+  const { laddrs, splitRefusal } = splitAddressingCopies(irBlocks, captures, foldedHere, declaredStructs(irBlocks));
   const objects = frameObjects(laddrs, owned, fail);
   const flow = addressFlow(irBlocks, objects, facts, fail);
-  const uses = classifyFrameUses({ irBlocks, objects, flow, facts, splitRefusal, oneObject, target, fail });
+  const uses = classifyFrameUses({
+    irBlocks,
+    objects,
+    flow,
+    facts,
+    splitRefusal,
+    oneObject,
+    target,
+    fail,
+  });
   const windows = escapeWindows(irBlocks, uses, flow, facts, target);
-  const model = chooseFrameModel(oneObject, uses, windows, returnsWithoutHiddenPointer, fail);
+  const model = chooseFrameModel({ oneObject, uses, windows, returnsWithoutHiddenPointer, fail });
   if (capturedObjectIsTheWholeFrame) {
     recheckWholeFramePremise({ uses, returnsWithoutHiddenPointer, fail });
   }
+  recheckEscapesReliedOn(escapesReliedOn, uses, fail);
+  storedNeverRead(irBlocks, uses, loadedWords, target, fail);
   // The device pin's trigger: the `readOnlyAddressSinks` registers a frame address was stored to.
   const sinks = [...new Set([...uses.sourceStores.values()].flat().map((s) => s.sink))];
   if (oneObject !== undefined) {
-    keepAsOneObject({ oneObject, irBlocks, objects, uses, usedSlotOffsets, returnsWithoutHiddenPointer, fail });
+    keepAsOneObject({
+      oneObject,
+      irBlocks,
+      objects,
+      uses,
+      usedSlotOffsets,
+      returnsWithoutHiddenPointer,
+      arrayOrder: target.compilerBehaviors.addressTakenArrayOrder,
+      arrayAlignment: target.compilerBehaviors.addressTakenArrayAlignment,
+      fail,
+    });
     return { policy: 'one-object', sinks };
   }
   const shapes = objectShapes({
@@ -321,20 +515,32 @@ export function auditFrameObjects({
     fail,
   });
   const escapes = frameEscapes({ irBlocks, uses, windows, shapes, owned, declared, usedSlotOffsets });
-  // THE ONE-OBJECT ANSWER, where it is on offer (one escape reaches without bound, and every
-  // writer is one it can hold) and the per-object model does not describe the frame: it refused a
-  // shape, an object sits over a slot, or the unbounded reach meets another object, a slot or a
-  // word nothing accounts for. Then what the device may read or the callee may write is kept
-  // rather than refused: lift again with the local area as one object in memory
+  // THE ONE-OBJECT ANSWER, where it is on offer (`chooseFrameModel`: one escape reaches without
+  // bound and every writer is one it can hold, or no address escapes at all) and the per-object
+  // model does not describe the frame: it refused a shape, an object sits over a slot, or the
+  // unbounded reach meets another object, a slot or a word nothing accounts for. Then what the
+  // device may read or the callee may write — or, with no escape, only this function's own
+  // accesses — is kept rather than refused: lift again with the local area as one object in memory
   // (`keepAsOneObject`). Below the local area are the outgoing arguments and above it the saved
   // registers, neither of them an object. Where the per-object model does describe the frame —
   // one object and nothing else in reach — it stands, and the object keeps its own type.
+  // An escape `misses` bounded is asked as the unbounded read it was without that proof
+  // (`ModelChoice.unboundedAt`): the proof may add a per-object lift, never take the one-object one.
   const answered = (e: FrameEscape): boolean =>
-    e.lo === -Infinity &&
-    e.hi === Infinity &&
+    model.unboundedAt.has(e.off) &&
     (e.objectReached !== undefined || e.slotReached !== undefined || e.unaccountedWord !== undefined);
   if (model.onOffer && (model.refused || shapes.overSlot.length > 0 || escapes.some(answered))) {
-    return { oneObject: { from: declared.from, to: declared.to } };
+    return {
+      oneObject: reliftRange({
+        declared,
+        objects,
+        uses,
+        usedSlotOffsets,
+        directAccesses,
+        splits: splitsOneObject(target),
+        gates: reliftGates,
+      }),
+    };
   }
   const failWithheld: Refuse = (why) => fail(model.withheld(why));
   for (const [off, width] of shapes.overSlot) {
@@ -352,6 +558,147 @@ export function auditFrameObjects({
   return { policy: 'per-object', sinks };
 }
 
+/** THE BYTES THE ONE-OBJECT RELIFT KEEPS: the declared local area, less the words at either end
+ *  that are a scalar's and nothing else's — a word the slot model keys and no access names, or one
+ *  the frontend reached only by direct whole-word accesses (`directAccesses`), which escapes
+ *  nowhere — and, past such a word, words nothing touches at all. The frontend lifts a word
+ *  outside the range with its slot model (Thumb `isFrameObjectAccess`, MIPS `keptInRelift`; PPC
+ *  is never handed a narrowed range, `no-split-follows`), so the one object is the bytes its
+ *  escapes and accesses reach, and `provenParts` can split it where they tile: agbcc's reload puts
+ *  spill slots ABOVE the arrays (the Thumb frame grows up, thumb.h:569/573, reload1.c:2274),
+ *  ido7.1 puts them below, and gcc 2.7.2 leaves a pad word between (each array starts at a
+ *  multiple of 8); kept in the one object, such a word joins the part beside it.
+ *
+ *  A word is handed back only where no rule of `RELIFT_HAND_BACK_GATES` keeps it: a reach through
+ *  the object, or no split to follow. What makes a word a scalar's (`scalarWord`) is not tabled,
+ *  and its clauses are not each measured for soundness: a word it gets wrong meets the second
+ *  audit's refusals where an object or an access lands outside the kept bytes (`keepAsOneObject`).
+ *
+ *  The copies do NOT tell a spill from a struct member only stored (`struct { u8 a[16], b[16];
+ *  u32 y; }` with `s.y = x` and nothing reading it): that member is handed back too, and its store
+ *  drops. No value changes, since nothing reads the word through the object (an index or an
+ *  escape reaching it keeps it); what is lost is one store the target made. */
+function reliftRange({
+  declared,
+  objects,
+  uses,
+  usedSlotOffsets,
+  directAccesses,
+  splits,
+  gates,
+}: {
+  declared: FrameRange;
+  objects: ReadonlyMap<number, readonly Op[]>;
+  uses: FrameUses;
+  usedSlotOffsets: ReadonlySet<number>;
+  directAccesses: ReadonlySet<Value>;
+  splits: boolean;
+  gates: readonly Gate<HandBack>[];
+}): FrameRange {
+  const whole = { from: declared.from, to: declared.to };
+  const reaches = frameReaches(uses);
+  const fills = copyStarts(reaches);
+  const kept = (word: number): boolean => firstRejection(gates, { word, reaches, fills, splits }) !== null;
+  const scalarWord = (w: number, pastScalar: boolean): boolean => {
+    const touching = uses.fixed.filter((f) => overlaps(f.at, f.width, w, 4));
+    const owners = [...objects.keys()].filter((o) => overlaps(o, 1, w, 4));
+    if ([...usedSlotOffsets].some((s) => s !== w && overlaps(s, 4, w, 4))) {
+      return false;
+    }
+    if (usedSlotOffsets.has(w) || touching.length === 0) {
+      // …and past one, a word nothing touches: no value lives in it either way
+      return owners.length === 0 && touching.length === 0 && (usedSlotOffsets.has(w) || pastScalar);
+    }
+    return (
+      owners.length === 1 &&
+      owners[0] === w &&
+      !uses.escaped.has(w) &&
+      uses.useCount.get(w) === (uses.accesses.get(w)?.length ?? 0) &&
+      touching.every((f) => {
+        const by = uses.accessOps.get(f.op);
+        return f.at === w && f.width === 4 && by?.off === w && directAccesses.has(by.through);
+      })
+    );
+  };
+  const handedBack = (w: number, pastScalar: boolean): boolean => !kept(w) && scalarWord(w, pastScalar);
+  let { from, to } = whole;
+  while (to - from > 4 && handedBack(to - 4, to < whole.to)) {
+    to -= 4;
+  }
+  while (to - from > 4 && handedBack(from, from > whole.from)) {
+    from += 4;
+  }
+  return { from, to };
+}
+
+/** Whether `keepAsOneObject` may split the one object on this target at all: where it places
+ *  address-taken arrays in a known order and at a known alignment. */
+function splitsOneObject(target: TargetDescription): boolean {
+  return (
+    target.compilerBehaviors.addressTakenArrayOrder !== undefined &&
+    target.compilerBehaviors.addressTakenArrayAlignment !== undefined
+  );
+}
+
+/** What `RELIFT_HAND_BACK_GATES` asks of one end word of the local area: the word, and every
+ *  escape and runtime index of the frame as the bytes each may reach (`frameReaches`). */
+export interface HandBack {
+  readonly word: number;
+  /** every escape and runtime index, with the bytes each may reach */
+  readonly reaches: readonly OwnedReach[];
+  /** where a bounded copy writes into the frame */
+  readonly fills: ReadonlySet<number>;
+  /** the target may split the one object (`splitsOneObject`) */
+  readonly splits: boolean;
+}
+
+/** WHAT KEEPS AN END WORD IN THE ONE OBJECT (`reliftRange`): a reach through the object that may
+ *  land on it, or no split to gain by handing it back. A word handed back is a local whose address
+ *  nothing takes, so the recompile keeps it in a register or drops its store, and whatever reached
+ *  it through the object in the source reads or writes another byte. */
+export const RELIFT_HAND_BACK_GATES: readonly Gate<HandBack>[] = [
+  // `struct S { u8 a[16], b[16]; u32 y; } s; … s.y = x; h(s.a, 16); g(s.b); return s.y + s.a[3];`
+  // on agbcc: `g` may write `s.y` through the address it was handed, and the target reads it back
+  {
+    id: 'escape-without-bound',
+    why: 'a callee handed an address nothing bounds may reach any byte of the frame from it',
+    sound: true,
+    guardedBy: 'frame-audit-stages.test.ts: keeps every word where an escape no literal count bounds may reach it',
+    rejects: (c) => c.reaches.some((r) => r.by === 'escape' && r.reach === null),
+  },
+  // `memcpy(s + 4, src, 8)` over a slot keyed at 8 writes the word the slot model would keep
+  {
+    id: 'copy-reaches-word',
+    why: 'a block copy into or out of the frame names the bytes it moves, and this word is one of them',
+    sound: true,
+    guardedBy: 'frame-audit-stages.test.ts: keeps a word a bounded copy reaches',
+    rejects: (c) => c.reaches.some((r) => r.by === 'escape' && r.reach !== null && mayTouch(r.reach, c.word, 4)),
+  },
+  // An index nothing bounds reaches every byte of the object it is based in, so no split follows
+  // it (`provenParts` keeps the one object whole), and a word handed back would only leave the
+  // bytes the index may reach. `*(u32 *)(s + 32) = x; return s[16 + i];` on agbcc is spelled
+  // exactly as a spill slot beside an index is. An index whose range is proven (its `reach`:
+  // `s[16 + (i & 7) * 2]`) reaches only the bytes it names, so a word outside every such reach is
+  // read through no index, and handing it back loses nothing an index could read.
+  {
+    id: 'runtime-index',
+    why: 'a runtime index may reach this word: nothing bounds it, or its bounded reach covers it',
+    sound: true,
+    guardedBy: 'thumb-frontend.test.ts: a word a runtime index may reach is not handed back to the slot model',
+    rejects: (c) => c.reaches.some((r) => r.by === 'index' && mayTouch(r.reach, c.word, 4)),
+  },
+  // Handing back buys a split and nothing else: two or more copies with a literal count must fill
+  // the area, on a target that splits at all (PPC_MWCC places address-taken arrays in no order
+  // `target.ts` records). Elsewhere it would only cost a stored-only member's store.
+  {
+    id: 'no-split-follows',
+    why: 'a word is handed back only so that the copies can split the one object',
+    sound: false,
+    guardedBy: 'frame-audit-stages.test.ts: keeps every word where no split could follow',
+    rejects: (c) => c.fills.size < 2 || !c.splits,
+  },
+];
+
 /** Refuses the whole function, naming the address-taken local as what it cannot lift. */
 type Refuse = (why: string) => never;
 
@@ -361,6 +708,42 @@ function frameRefusal(name: string): Refuse {
   };
 }
 
+/** THE FRAME BYTES A DECLARATION TYPES AS ONE STRUCT: a call's return storage (`sret`) and a
+ *  struct passed by value (`byValue`, call-plan.ts `foldByValueArgs`), where the operand is an
+ *  `laddr`. */
+function declaredStructs(irBlocks: readonly Block[]): FrameRange[] {
+  const laddrOff = new Map<Value, number>();
+  for (const b of irBlocks) {
+    for (const op of b.ops) {
+      if (op.opcode === 'laddr') {
+        laddrOff.set(op.results[0], op.attrs.off as number);
+      }
+    }
+  }
+  const out: FrameRange[] = [];
+  for (const b of irBlocks) {
+    for (const op of b.ops) {
+      if (op.opcode !== 'call') {
+        continue;
+      }
+      const t = op.results[0]?.type;
+      const from = laddrOff.get(op.operands[0]);
+      if (op.attrs.sret === true && from !== undefined && t?.kind === 'struct' && t.size !== undefined) {
+        out.push({ from, to: from + t.size });
+      }
+      for (const { at } of byValueOperands(op)) {
+        const v = op.operands[at];
+        const off = laddrOff.get(v);
+        const t = v?.type.kind === 'ptr' ? v.type.to : undefined;
+        if (off !== undefined && t?.kind === 'struct' && t.size !== undefined) {
+          out.push({ from: off, to: off + t.size });
+        }
+      }
+    }
+  }
+  return out;
+}
+
 /** A CAPTURE MOVED BY A CONSTANT IS THE CAPTURE AT THE SUM, and here the constant is exact: an
  *  `add` of a `laddr` and a `const` — a register the lift could not see through, `mov r0, sp /
  *  movs r2, #0 / ldrsh r1, [r0, r2]`, or a move the pre-lift walk does not follow — is re-minted
@@ -369,6 +752,22 @@ function frameRefusal(name: string): Refuse {
  *  lands on a keyed slot is refused as the move, the capability that is missing
  *  (`failIfSlotKeysIt`).
  *
+ *  AN INDEX INTO A CAPTURE, MOVED BY A NONZERO CONSTANT, IS THE SAME INDEX INTO THE CAPTURE AT THE
+ *  SUM. agbcc spells `a[i]` on a local at [sp,#k) as the frame base plus the index, moved after:
+ *  `mov r0, sp / add r0, r0, r4 / add r0, #0x4` or `add r0, r0, sp / add r0, #0x4` — the bytes
+ *  `add r0, sp, #0x4 / add r0, r0, r4` reach, so `add(add(laddr@a, i), k)` is re-minted as
+ *  `add(laddr@(a+k), i)`, and the inner sum and capture are dropped when nothing else reads them.
+ *  The object at [sp,#a) is often the outgoing-argument word (a 5-argument call beside
+ *  the array), which the index never touches. Zero is left alone: `add(sum, 0)` is agbcc's
+ *  `mov r1, #0x0 / ldrsb r0, [r0, r1]`, which `indexedAccess` judges where the register put it.
+ *  The rebased object is held to every rule an object at a+k is held to, so a displaced FIELD of a
+ *  struct element — no object of its own at a+k, the struct's other bytes at a — lands as a second
+ *  object beside the first and is refused or lifted as one object by the same rules. A load or
+ *  store's own nonzero displacement on the sum is the same move: `ldrb r0, [r0, #0x1]` (the field
+ *  agbcc reads unsigned) and `mov r1, #0x1 / ldrsb r0, [r0, r1]` (signed) reach the same byte, so
+ *  the access is re-pointed at `add(laddr@(a+d), i)` with displacement 0, and the verdict does not
+ *  depend on where the literal sits.
+ *
  *  Returns every `laddr` that survives, in block order. */
 function foldMovedCaptures(
   irBlocks: Block[],
@@ -387,23 +786,77 @@ function foldMovedCaptures(
       }
     }
   }
+  // the `add` of a capture and a runtime value that defines each value, for the index rebase
+  const indexOf = new Map<Value, { base: Op; index: Value; sum: Op }>();
+  const rebased = new Set<Op>();
   for (let changed = true; changed;) {
     changed = false;
     for (const blk of irBlocks) {
-      blk.ops = blk.ops.map((op) => {
+      blk.ops = blk.ops.flatMap((op) => {
         const [x, y] = op.operands;
+        const sum0 = (op.opcode === 'load' || op.opcode === 'store') && x !== undefined ? indexOf.get(x) : undefined;
+        const disp = (op.attrs.off as number | undefined) ?? 0;
+        if (sum0 !== undefined && disp !== 0) {
+          const object = mkOp('laddr', {
+            results: [mkValue(sum0.base.results[0].type)],
+            attrs: { off: ((sum0.base.attrs.off as number) + disp) | 0 },
+          });
+          const moves = mkOp('add', {
+            results: [mkValue(x.type)],
+            operands: [object.results[0], sum0.index],
+            attrs: sum0.sum.attrs,
+          });
+          laddrOf.set(object.results[0], object);
+          indexOf.set(moves.results[0], { base: object, index: sum0.index, sum: moves });
+          moved.add(sum0.base.results[0]);
+          foldedHere.add(object);
+          rebased.add(sum0.sum);
+          op.operands[0] = moves.results[0];
+          op.attrs = { ...op.attrs, off: 0 };
+          changed = true;
+          return [object, moves, op];
+        }
+        if (op.opcode !== 'add' || op.operands.length !== 2) {
+          return [op];
+        }
         const base = laddrOf.get(x) ?? laddrOf.get(y);
         const by = constOf.get(laddrOf.has(x) ? y : x);
-        if (op.opcode !== 'add' || op.operands.length !== 2 || base === undefined || by === undefined) {
-          return op;
+        if (base !== undefined && by !== undefined) {
+          const off = ((base.attrs.off as number) + by) | 0;
+          const object = mkOp('laddr', { results: op.results, attrs: { off } });
+          laddrOf.set(op.results[0], object);
+          moved.add(base.results[0]);
+          foldedHere.add(object);
+          changed = true;
+          return [object];
+        }
+        const index = base === undefined ? undefined : laddrOf.has(x) ? y : x;
+        if (base !== undefined && index !== undefined && !laddrOf.has(index)) {
+          // a sum first seen here takes another pass: a use laid out in an EARLIER block was
+          // visited before the sum was known, and is moved only on the next one
+          if (!indexOf.has(op.results[0])) {
+            indexOf.set(op.results[0], { base, index, sum: op });
+            changed = true;
+          }
+          return [op];
         }
-        const off = ((base.attrs.off as number) + by) | 0;
-        const object = mkOp('laddr', { results: op.results, attrs: { off } });
-        laddrOf.set(op.results[0], object);
-        moved.add(base.results[0]);
+        const sum = indexOf.get(x) ?? indexOf.get(y);
+        const k = constOf.get(indexOf.has(x) ? y : x);
+        if (sum === undefined || k === undefined || k === 0) {
+          return [op];
+        }
+        const object = mkOp('laddr', {
+          results: [mkValue(sum.base.results[0].type)],
+          attrs: { off: ((sum.base.attrs.off as number) + k) | 0 },
+        });
+        const moves = mkOp('add', { results: op.results, operands: [object.results[0], sum.index], attrs: op.attrs });
+        laddrOf.set(object.results[0], object);
+        indexOf.set(op.results[0], { base: object, index: sum.index, sum: moves });
+        moved.add(sum.base.results[0]);
         foldedHere.add(object);
+        rebased.add(sum.sum);
         changed = true;
-        return object;
+        return [object, moves];
       });
     }
   }
@@ -412,13 +865,24 @@ function foldMovedCaptures(
   // the write-back of `stmia r1!, {r2, r3, r4}` through a capture is `add r1, r1, #12`, a pointer
   // to the end of what was copied that the machine never uses. Only those: an unused `mov rD, sp`
   // of the machine's own is still a capture, and is judged.
-  const read = new Set<Value>();
-  for (const blk of irBlocks) {
-    for (const op of blk.ops) {
-      op.operands.forEach((v) => read.add(v));
-      (op.successors ?? []).forEach((s) => s.args.forEach((v) => read.add(v)));
+  const readNow = (): Set<Value> => {
+    const read = new Set<Value>();
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        op.operands.forEach((v) => read.add(v));
+        (op.successors ?? []).forEach((s) => s.args.forEach((v) => read.add(v)));
+      }
+    }
+    return read;
+  };
+  // …and an index sum a rebase moved off, once nothing reads it, goes the same way first
+  if (rebased.size > 0) {
+    const before = readNow();
+    for (const blk of irBlocks) {
+      blk.ops = blk.ops.filter((op) => !rebased.has(op) || before.has(op.results[0]));
     }
   }
+  const read = readNow();
   const laddrs: Op[] = [];
   for (const blk of irBlocks) {
     blk.ops = blk.ops.filter(
@@ -474,7 +938,7 @@ function frameAddressFacts(
     }
     for (const [lit, index] of [d.operands, [...d.operands].reverse()]) {
       const from = literalAddrOf(lit);
-      const stride = from === undefined ? 0 : factorOf(addresses, index);
+      const stride = from === undefined ? 0 : linearFactor({ defs: defOf, constOf: addresses.constOf }, index);
       if (from !== undefined && readOnlySinks.has(from + off) && stride > 0 && stride % sinkSpacing === 0) {
         return [...readOnlySinks].filter((s) => (s - (from + off)) % stride === 0);
       }
@@ -484,47 +948,6 @@ function frameAddressFacts(
   return { ...addresses, readsThrough };
 }
 
-// `v` as a sum of runtime values times constants, plus a constant (the `1` key): agbcc's `ch *
-// 12` is `((ch << 1) + ch) << 2`, which is 12 times `ch` only once the two `ch` terms are added.
-// Undefined past what this can read.
-function linearOf(facts: LiteralAddresses, v: Value, depth = 0): Map<Value | 1, number> | undefined {
-  const c = facts.constOf(v);
-  if (c !== undefined) {
-    return new Map([[1, c]]);
-  }
-  const d = facts.defOf.get(v);
-  if (d === undefined || depth > 8) {
-    return new Map([[v, 1]]);
-  }
-  const scaled = (x: Value, by: number) => {
-    const l = linearOf(facts, x, depth + 1);
-    return l && new Map([...l].map(([t, k]) => [t, k * by] as const));
-  };
-  const k = d.operands.length === 1 ? (d.attrs.imm as number | undefined) : facts.constOf(d.operands[1]);
-  if (d.opcode === 'shl' && k !== undefined && k >= 0 && k < 31) {
-    return scaled(d.operands[0], 2 ** k);
-  }
-  if (d.opcode === 'mul' && d.operands.length === 2 && k !== undefined) {
-    return scaled(d.operands[0], k);
-  }
-  if ((d.opcode === 'add' || d.opcode === 'sub') && d.operands.length === 2) {
-    const x = linearOf(facts, d.operands[0], depth + 1);
-    const y = scaled(d.operands[1], d.opcode === 'add' ? 1 : -1);
-    if (x === undefined || y === undefined) {
-      return undefined;
-    }
-    y.forEach((n, t) => x.set(t, (x.get(t) ?? 0) + n));
-    return x;
-  }
-  return new Map([[v, 1]]);
-}
-
-// A number every value of `v` is a multiple of, or 0 when this cannot name one.
-function factorOf(facts: LiteralAddresses, v: Value): number {
-  const l = linearOf(facts, v);
-  return l === undefined ? 0 : [...l.values()].reduce(gcd, 0);
-}
-
 /** A FRAME BASE ADDRESSED THROUGH IS NOT A CAPTURE. Thumb-1 gives `ldr`/`str` an `[sp,#imm]`
  *  encoding and gives the sub-word forms none, so a byte or halfword spill can only be spelled
  *  by copying sp into a register and addressing through the copy:
@@ -556,6 +979,7 @@ function splitAddressingCopies(
   irBlocks: Block[],
   laddrs: Op[],
   foldedHere: Set<Op>,
+  structs: readonly FrameRange[] = [],
 ): { laddrs: Op[]; splitRefusal: Map<Value, string> } {
   const splitRefusal = new Map<Value, string>();
   const uses = new Map<Value, { op: Op; idx: number; blk: Block }[]>();
@@ -593,13 +1017,42 @@ function splitAddressingCopies(
     if (at.length === 0 || accesses.length !== at.length) {
       continue;
     }
+    // AN ADDRESS STRICTLY INSIDE A DECLARED STRUCT, ONLY ACCESSED, IS A MEMBER ACCESS OF THAT
+    // STRUCT. A word store into a struct passed by value goes straight to `[sp,#k]` — `x.c = w` is
+    // `str r1, [sp, #0x4]` over `struct F {u16 a,b; u32 c; s8 e,f;}` at [sp,#0) — and the frontend
+    // mints that access its own `laddr` at k. The declaration says those bytes are the struct's,
+    // so the address is re-rooted on the struct's base with the displacement on the access, and
+    // the audit judges one object rather than two that overlap. Any use that is not an access —
+    // `&x.c` handed on — is an interior pointer, which is not this shape and is left to refuse.
+    const off = capture.attrs.off as number;
+    const holders = structs.filter((r) => r.from < off && off < r.to);
+    const holder = holders[0];
+    const inHolder = (u: { op: Op }): boolean =>
+      off + (u.op.attrs.off as number) >= holder!.from &&
+      off + (u.op.attrs.off as number) + (u.op.attrs.width as number) <= holder!.to;
+    if (
+      holder !== undefined &&
+      holders.every((r) => r.from === holder.from && r.to === holder.to) &&
+      accesses.every(inHolder)
+    ) {
+      for (const u of accesses) {
+        u.op.attrs = { ...u.op.attrs, off: off - holder.from + (u.op.attrs.off as number) };
+      }
+      capture.attrs = { ...capture.attrs, off: holder.from };
+      continue;
+    }
     if (!subWord) {
       splitRefusal.set(capture.results[0], 'a WORD access through the copy, and `ldr`/`str` have an `[sp,#imm]` form');
       continue;
     }
     // Nothing to split when the capture already names ONE object: every access at offset 0 is
-    // the frame base itself, which is what the DMA-fill idiom captures.
-    if (accesses.every((u) => u.op.attrs.off === 0)) {
+    // the frame base itself, which is what the DMA-fill idiom captures — or every access lands in
+    // the declared struct the capture is the start of (`declaredStructs`), whose members they are.
+    const base = capture.attrs.off as number;
+    const into = (r: FrameRange): boolean =>
+      base === r.from &&
+      accesses.every((u) => base + (u.op.attrs.off as number) + (u.op.attrs.width as number) <= r.to);
+    if (accesses.every((u) => u.op.attrs.off === 0) || structs.some(into)) {
       continue;
     }
     for (const u of accesses) {
@@ -644,8 +1097,16 @@ function frameObjects(laddrs: readonly Op[], owned: FrameRange, fail: Refuse): M
   // saved register's — `g(&e)` for a fifth parameter `e` is `add r0, sp, #0x8` over a one-word
   // local area — and no other rule of the audit is about that gap. The TOP itself is also C's
   // one-past-the-end pointer, `g(buf, buf + 8)` over an 8-byte array, and the refusal names both
-  // readings.
+  // readings. BELOW IT is the outgoing block a call's stack words are staged in, and on O32 also
+  // the saves IDO keeps under its locals: an address there is no local's either. Every object's
+  // extent is held to the area again below; this says why, for the frontend that supplied it.
   for (const off of objects.keys()) {
+    if (off < owned.from) {
+      fail(
+        `the captured address at [sp,#${off}) is below the reserved local area, which starts at [sp,#${owned.from}) — ` +
+          'an outgoing stack argument word or a saved register, whose address is not modelled',
+      );
+    }
     if (off === owned.to) {
       fail(
         `the captured address at [sp,#${off}) is the top of the reserved local area of ${owned.to - owned.from} bytes — ` +
@@ -764,10 +1225,70 @@ interface FrameAccess {
 }
 
 /** A load or store judged an access to the object at `off`, and the address value it reaches the
- *  object through: a capture, or a phi that carries one — for a runtime index, the indexed one. */
+ *  object through: a capture, or a phi that carries one — for a runtime index, the indexed one,
+ *  and then `index` is the access as `FrameUses.indexed` records it. Without `index` the access
+ *  is at its own displacement from `through`. */
 interface FrameAccessOp {
   readonly off: number;
   readonly through: Value;
+  readonly index?: IndexedAccess;
+}
+
+/** THE FRAME BYTES `[lo, hi)` ONE USE MAY TOUCH, or `null` where nothing bounds it, which is every
+ *  byte: a runtime index's reach (`FrameUses.indexed`) and an escape's extent
+ *  (`FrameUses.escapeExtents`) are each one. */
+type FrameReach = { readonly lo: number; readonly hi: number } | null;
+
+/** Whether a use reaching `r` may touch any of the `width` bytes at `lo`: every byte where
+ *  nothing bounds it. */
+function mayTouch(r: FrameReach, lo: number, width: number): boolean {
+  return r === null || overlaps(lo, width, r.lo, r.hi - r.lo);
+}
+
+/** Whether two reaches may share a byte. */
+function mayShare(a: FrameReach, b: FrameReach): boolean {
+  return b === null || mayTouch(a, b.lo, b.hi - b.lo);
+}
+
+/** One reach through the frame, with the object whose address it starts from (`owner`), what
+ *  makes it (`by`: an escape of that address, or a runtime index into it), and `into` where it is
+ *  a bounded block copy that WRITES the bytes (the address is its destination). */
+interface OwnedReach {
+  readonly owner: number;
+  readonly by: 'escape' | 'index';
+  readonly reach: FrameReach;
+  readonly into: boolean;
+}
+
+/** EVERY REACH THROUGH THE FRAME, the one list the split of the one object (`provenParts`) and
+ *  the words handed back to the slot model (`reliftRange`) read: each escape's extent, and each
+ *  runtime-indexed access's reach. */
+function frameReaches(uses: FrameUses): OwnedReach[] {
+  return [
+    ...[...uses.escapeExtents].flatMap(([owner, extents]) =>
+      extents.map((e): OwnedReach => ({
+        owner,
+        by: 'escape',
+        reach: e === null ? null : { lo: e.lo, hi: e.hi },
+        into: e?.into === true,
+      })),
+    ),
+    ...[...uses.indexed].flatMap(([owner, accesses]) =>
+      accesses.map((x): OwnedReach => ({ owner, by: 'index', reach: x.reach, into: false })),
+    ),
+  ];
+}
+
+/** Where a bounded block copy writes into the frame: the start of each copy's destination. */
+function copyStarts(reaches: readonly OwnedReach[]): Set<number> {
+  return new Set(reaches.flatMap((r) => (r.into && r.reach !== null ? [r.reach.lo] : [])));
+}
+
+/** One access through a runtime index: its width and signedness, and the bytes it may touch. */
+interface IndexedAccess {
+  readonly width: number;
+  readonly signed: boolean;
+  readonly reach: FrameReach;
 }
 
 /** Every use of every frame object, by offset — what each later stage reads. Each field is
@@ -786,10 +1307,30 @@ interface FrameUses {
   readonly publishedToWriter: ReadonlySet<number>;
   readonly arg0Callees: ReadonlyMap<number, ReadonlySet<string | null>>;
   readonly returnTemps: ReadonlyMap<number, readonly Op[]>;
+  /** the calls each object is passed to BY VALUE (`foldByValueArgs`), with the struct each passes */
+  readonly byValueReads: ReadonlyMap<number, readonly { readonly op: Op; readonly type: IrType }[]>;
   readonly useCount: ReadonlyMap<number, number>;
-  readonly indexed: ReadonlyMap<number, readonly { readonly width: number; readonly signed: boolean }[]>;
+  /** every runtime-indexed access of each object, with the frame bytes `[lo, hi)` it may touch
+   *  (`reach`, `indexedAccess`), or `null` where nothing bounds the index */
+  readonly indexed: ReadonlyMap<number, readonly IndexedAccess[]>;
   readonly members: readonly { readonly at: number; readonly width: number }[];
   readonly memberRefusal: string | undefined;
+  /** every escape of each object's address, as the frame bytes it may reach: `[lo, hi)` where a
+   *  literal-count block copy proves them (`boundedCopy`), `null` where nothing does, and `into`
+   *  where the copy WRITES them (the address is its destination, not its source). Only the split
+   *  of the one object reads this (`provenParts`); the escape windows keep the copy as an
+   *  unbounded writer, which is what puts that one object on offer at all (`chooseFrameModel`). */
+  readonly escapeExtents: ReadonlyMap<
+    number,
+    readonly ({ readonly lo: number; readonly hi: number; readonly into: boolean } | null)[]
+  >;
+  readonly fixed: readonly {
+    readonly op: Op;
+    readonly at: number;
+    readonly width: number;
+    readonly isLoad: boolean;
+    readonly frameOnly: boolean;
+  }[];
 }
 
 /** Did the address at `off` reach something that may write the frame back: a callee that is not a
@@ -885,11 +1426,14 @@ function classifyFrameUses({
   // is the callee's return storage, a local of the declared type. `useCount` counts every use of
   // each object, so a return temp this function does anything else with is told apart.
   const returnTemps = new Map<number, Op[]>();
+  // …and a call's operand its lowering passes BY VALUE (`foldByValueArgs`) is no escape: the
+  // callee receives a copy of the whole struct, so it is a read of the object's bytes at the call
+  const byValueReads = new Map<number, { op: Op; type: IrType }[]>();
   const useCount = new Map<number, number>();
   // The accesses through a runtime-indexed address, per object — kept apart from `accesses`,
   // which types the object at its own offset: `a[i]` says what one ELEMENT is, not what sits at
   // `a`.
-  const indexed = new Map<number, { width: number; signed: boolean }[]>();
+  const indexed = new Map<number, IndexedAccess[]>();
   for (const off of objects.keys()) {
     accesses.set(off, []);
   }
@@ -897,17 +1441,37 @@ function classifyFrameUses({
   // access at [+k] through a capture is a member of the one object rather than a second object
   const members: { at: number; width: number }[] = [];
   // …and without it, the first such access, which the per-object model refuses once the model is
-  // chosen (`chooseFrameModel`)
-  let memberRefusal: string | undefined;
+  // chosen (`chooseFrameModel`) — save one of a call's return storage or of a struct passed by
+  // value, whose members are the struct's declared ones (`objectShapes`)
+  const memberRefusals: [number, string][] = [];
+  const escapeExtents = new Map<number, ({ lo: number; hi: number; into: boolean } | null)[]>();
+  // …and every value something reads, since a copy whose returned destination is read hands the
+  // address on to a use nothing here follows
+  const readValues = new Set<Value>(
+    irBlocks.flatMap((b) => b.ops.flatMap((op) => [...op.operands, ...(op.successors ?? []).flatMap((sx) => sx.args)])),
+  );
+  // …and in either model, every fixed-offset access as the op that makes it, the frame bytes it
+  // touches, whether it reads them, and whether its address is this frame's on every path — what
+  // `storedNeverRead` asks of a frame that makes a call
+  const fixed: { op: Op; at: number; width: number; isLoad: boolean; frameOnly: boolean }[] = [];
   const scalar = (kind: string, op: Op, off: number, v: Value): void => {
+    fixed.push({
+      op,
+      at: off + (op.attrs.off as number),
+      width: op.attrs.width as number,
+      isLoad: kind === 'load',
+      frameOnly: frameOnEveryPath.has(v),
+    });
     if (oneObject !== undefined) {
       members.push({ at: off + (op.attrs.off as number), width: op.attrs.width as number });
       return;
     }
     if ((op.attrs.off as number) !== 0) {
-      memberRefusal ??=
+      memberRefusals.push([
+        off,
         `a ${kind} at [+${op.attrs.off}] through the captured address — ` +
-        (splitRefusal.get(v) ?? 'only a scalar at the captured address is modelled');
+          (splitRefusal.get(v) ?? 'only a scalar at the captured address is modelled'),
+      ]);
     }
   };
   for (const blk of irBlocks) {
@@ -934,8 +1498,22 @@ function classifyFrameUses({
           accesses.get(off)!.push({ width: op.attrs.width as number, signed: false, isLoad: false });
           continue;
         }
+        if (byValueOperands(op).some((b) => b.at === idx)) {
+          // the fold types the operand a pointer to the struct passed (call-plan.ts `foldByValueArgs`)
+          const type = v.type.kind === 'ptr' ? v.type.to : undefined;
+          if (type?.kind !== 'struct' || type.size === undefined) {
+            throw new Error(`internal: a by-value operand of a call to '${calleeName(op)}' has no declared struct`);
+          }
+          (byValueReads.get(off) ?? byValueReads.set(off, []).get(off)!).push({ op, type });
+          fixed.push({ op, at: off, width: type.size, isLoad: true, frameOnly: frameOnEveryPath.has(v) });
+          continue;
+        }
         if ((op.opcode === 'store' && idx === 1) || op.opcode === 'call') {
           escaped.add(off); // the address ESCAPES as a value — the point of the capability
+          const copied = op.opcode === 'call' ? boundedCopy(op, idx, facts, readValues) : undefined;
+          (escapeExtents.get(off) ?? escapeExtents.set(off, []).get(off)!).push(
+            copied === undefined ? null : { lo: off + copied.lo, hi: off + copied.hi, into: copied.into },
+          );
           const handedTo = op.opcode === 'store' ? facts.readsThrough(op) : [];
           const read = op.opcode === 'call' ? transferRead(op, idx, off, target, facts) : undefined;
           if (read !== undefined) {
@@ -984,7 +1562,14 @@ function classifyFrameUses({
         // judged with the rest (`objectShapes`).
         const other = op.opcode === 'add' && op.operands.length === 2 ? op.operands[1 - idx] : undefined;
         if (other !== undefined && taint.get(other) === undefined && defOf.get(other)?.opcode !== 'const') {
-          indexedAccess(irBlocks, { indexed, accessOps }, { off, through: v }, op.results[0], fail);
+          indexedAccess(
+            irBlocks,
+            { indexed, accessOps },
+            { off, through: v },
+            { sum: op.results[0], range: facts.addressRangeOf(other, blk, 'narrowest') },
+            facts.constOf,
+            fail,
+          );
           continue;
         }
         // A CONSTANT move left after the fold (`foldMovedCaptures`) moves a capture a phi carried.
@@ -1022,13 +1607,39 @@ function classifyFrameUses({
     publishedToWriter,
     arg0Callees,
     returnTemps,
+    byValueReads,
     useCount,
     indexed,
     members,
-    memberRefusal,
+    memberRefusal: memberRefusals.find(([off]) => !returnTemps.has(off) && !byValueReads.has(off))?.[1],
+    escapeExtents,
+    fixed,
   };
 }
 
+// The bytes, relative to the address at operand `idx`, that a call of a standard block copy with
+// a literal, positive count reaches through it, and whether it writes them (`idx` is its
+// destination) — or `undefined` for any other callee, operand or count, which this does not
+// bound, and for a copy whose result (`memcpy` returns its destination) anything in `read` uses.
+function boundedCopy(
+  op: Op,
+  idx: number,
+  facts: LiteralAddresses,
+  read: ReadonlySet<Value>,
+): { lo: number; hi: number; into: boolean } | undefined {
+  const roles = blockCopyRoles(op.attrs.target);
+  if (
+    roles === undefined ||
+    (idx !== roles.dst && idx !== roles.src) ||
+    op.operands.length <= roles.n ||
+    op.results.some((r) => read.has(r))
+  ) {
+    return undefined;
+  }
+  const n = facts.constOf(op.operands[roles.n]);
+  return n !== undefined && Number.isInteger(n) && n > 0 ? { lo: 0, hi: n, into: idx === roles.dst } : undefined;
+}
+
 // The bytes a block transfer that took the address at `idx` reads, when `idx` is its source and
 // its control word is a literal.
 function transferRead(
@@ -1051,36 +1662,128 @@ function transferRead(
 }
 
 // Records every access through `sum`, a runtime index into the object at `off`.
+//
+// A SUM MOVED BY A LITERAL IS THE SAME INDEX, DISPLACED. Thumb has no `ldrsb`/`ldrsh` with an
+// immediate, so agbcc loads the whole displacement into a register (thumb.md:411-505, `mov %0,%2 ;
+// ldrs[bh] %0,[%1,%0]`) and the frontend lowers that register-offset load as `add` + load@0:
+// `add r0, r1, r4 / mov r1, #0x0 / ldrsb r1, [r0, r1]` is `a[i]` on an `s8 a[n]` local. So the
+// uses of an `add` of the sum and a `const` are judged at that displacement. One `add` deep: agbcc
+// emits one `mov` per load, and no other compiler emits a literal index register. Only
+// displacement 0 is the indexed element. A nonzero `const` on a sum whose base is a capture never
+// arrives here: `foldMovedCaptures` has already moved the index to the object at the sum, which is
+// what agbcc's `mov r0, sp / add r0, r0, r4 / add r0, #0x4` is (an array above the outgoing word),
+// and what `mov r1, #0x3 / ldrsb r1, [r0, r1]` and a load's own displacement, `ldrb r0, [r0,
+// #0x1]` (a field of an element struct, or `a[i + 1]`), reach. What is left nonzero — a constant
+// computed rather than loaded as a `const`, a literal or a displacement on an index into a capture
+// a phi carries, or a displacement on top of the zero literal, which no compiler emits — refuses
+// naming the displacement.
+//
+// The element is judged here and left where the register put it, so it is spelled with the
+// literal: `*(s16 *)((u32)sp0 + (a0 << 1) + 0)`. Re-pointing it at the sum spells
+// `((s16 *)sp0)[a0]`, an index through a cast on the `u8` storage (`objectShapes`), which agbcc
+// compiles to `add r4, r4, sp` and the source's `mov r1, sp / add r0, r1, r4` does not: the `u16`
+// twin `((u16 *)sp0)[a0]` misses the same way. Left raw, the access compiles to the source's
+// bytes with or without the `+ 0`.
+//
+// WHAT IT MAY REACH is the object's offset plus every value the index may hold (`range`, ir/bits.ts
+// `stridedRange`, asked at the sum's block): a mask, a zero-fill shift, an unsigned narrow load or a
+// `zext` — by its width, or by its operand's range where that is narrower (`(u8)k` of a counter in
+// [0, 7]); a compare on the way to the access (`if (i < 8) a[i]`); a loop counter its latch bounds,
+// by induction where the latch bounds one side; and linear forms of them. The range is widened by
+// the access's width — the stride is dropped, so the bytes are a superset of the ones reached.
+// Every element is at displacement 0 from the sum (above), so the address is exactly the capture
+// plus the index. An index nothing bounds, or one whose sum could wrap past the top of the address
+// space back below the object, reaches every byte (`null`).
 function indexedAccess(
   irBlocks: readonly Block[],
-  {
-    indexed,
-    accessOps,
-  }: { indexed: Map<number, { width: number; signed: boolean }[]>; accessOps: Map<Op, FrameAccessOp> },
+  { indexed, accessOps }: { indexed: Map<number, IndexedAccess[]>; accessOps: Map<Op, FrameAccessOp> },
   object: FrameAccessOp,
-  sum: Value,
+  { sum, range }: { sum: Value; range: StridedRange | undefined },
+  constOf: (v: Value) => number | undefined,
   fail: Refuse,
 ): void {
   const { off } = object;
   const got = indexed.get(off) ?? indexed.set(off, []).get(off)!;
-  for (const blk of irBlocks) {
-    for (const op of blk.ops) {
-      const roles = [
-        ...op.operands.flatMap((v, i) => (v === sum ? [i] : [])),
-        ...(op.successors ?? []).flatMap((s) => (s.args.includes(sum) ? [-1] : [])),
-      ];
-      for (const i of roles) {
-        if ((op.opcode !== 'load' && op.opcode !== 'store') || i !== 0 || (op.attrs.off as number) !== 0) {
-          fail(
-            `a runtime index into the object at [sp,#${off}) flows into \`${i === -1 ? 'a phi' : op.opcode}\` — ` +
-              'only a load or store at the indexed address is modelled',
-          );
+  const reach = (width: number): FrameReach => {
+    const starts = range === undefined ? null : displaced(range, off, width);
+    return starts === null ? null : { lo: starts.lo, hi: starts.hi + width };
+  };
+  const judge = (at: Value, by: number): void => {
+    for (const blk of irBlocks) {
+      for (const op of blk.ops) {
+        const roles = [
+          ...op.operands.flatMap((v, i) => (v === at ? [i] : [])),
+          ...(op.successors ?? []).flatMap((s) => (s.args.includes(at) ? [-1] : [])),
+        ];
+        for (const i of roles) {
+          const k =
+            at === sum && op.opcode === 'add' && op.operands.length === 2 && i >= 0
+              ? constOf(op.operands[1 - i])
+              : undefined;
+          if (k !== undefined) {
+            judge(op.results[0], k);
+            continue;
+          }
+          const access = (op.opcode === 'load' || op.opcode === 'store') && i === 0;
+          if (!access) {
+            fail(
+              `a runtime index into the object at [sp,#${off}) flows into \`${i === -1 ? 'a phi' : op.opcode}\` — ` +
+                'only a load or store at the indexed address is modelled',
+            );
+          }
+          const at0 = (by + (op.attrs.off as number)) | 0;
+          if (at0 !== 0) {
+            fail(
+              `a runtime index into the object at [sp,#${off}) is accessed at displacement ${at0} from the indexed element — ` +
+                'only a load or store at the indexed address is modelled',
+            );
+          }
+          const width = op.attrs.width as number;
+          const index = { width, signed: op.opcode === 'load' && op.attrs.signed === true, reach: reach(width) };
+          got.push(index);
+          accessOps.set(op, { ...object, index });
         }
-        got.push({ width: op.attrs.width as number, signed: op.opcode === 'load' && op.attrs.signed === true });
-        accessOps.set(op, object);
       }
     }
-  }
+  };
+  judge(sum, 0);
+}
+
+/** Why two access types on one byte refuse, as every refusal of it words it. THE RULE IS AGBCC'S
+ *  AND IS HELD ON EVERY TARGET: agbcc at -O2 serves a read of one type past a store of the other
+ *  (`indexedWidth` has the compiled cases), while IDO 7.1, KMC gcc and gcc 2.7.2 reload past every such
+ *  store, so on MIPS it is only more cautious than it has to be. The text names no compiler of the
+ *  input, since the audit is handed none. */
+const STALE_ACROSS_TYPES =
+  'and type-based alias analysis can let a read of one type pass a store of the other (agbcc at -O2 does, ' +
+  'and the audit refuses it on every target) — a cast spelling could read stale';
+
+/** The one width wider than a byte that runtime-indexed accesses take, or why there is not one.
+ *
+ *  A runtime index names no byte, so its access type must agree with every access it may reach,
+ *  and "agree" is what stops agbcc reordering two of them. At -O2 it runs type-based alias
+ *  analysis (toplev.c:3616), and `c_get_alias_set` (c-common.c:1892-2005) gives an integer type
+ *  and its unsigned twin one set, a character type set 0 (conflicting with every set), a
+ *  member access its member's type's set, and any other type — a pointer included — a new set.
+ *  Compiled at the corpus's flags, `k(sp0); ((int *)sp0)[i] = 1; ((T *)sp0)[j] = 0; return
+ *  ((int *)sp0)[i];` reloads the word for T = int, unsigned int and unsigned char, and returns the
+ *  stale 1 for T = unsigned short, void * and long.
+ *
+ *  So ONE WIDTH IS ONE SET only while every access of that width READS AT one integer type or its
+ *  twin: a cast on the storage to `s32`/`u32` (`int`/`unsigned int` in every agbcc project), or a
+ *  member of an element struct (raise/struct-arrays) whose FIELD is such an integer — never the pointer an element
+ *  may hold. `/ptr-field`'s `over-local-storage` gate keeps such a field an integer, and contracts.ts
+ *  `assertLocalStorageStaysInteger` holds every respelled tree to it. The storage stays
+ *  `u8 name[n]` whatever the width. */
+function indexedWidth(accesses: readonly { readonly width: number }[]): {
+  width: number | null;
+  refusal: string | null;
+} {
+  const widths = [...new Set(accesses.map((x) => x.width))].filter((w) => w !== 1);
+  return {
+    width: widths[0] ?? null,
+    refusal: widths.length > 1 ? `accesses ${widths.join(' and ')} bytes wide, ${STALE_ACROSS_TYPES}` : null,
+  };
 }
 
 /** The bytes an escape may reach, `[lo, hi)` from the object's own offset, and how it reads them
@@ -1089,6 +1792,10 @@ interface ReadWindow {
   readonly lo: number;
   readonly hi: number;
   readonly why: string;
+  /** bounded only because a store through a computed pointer provably misses the control
+   *  halfword (`misses`): without that proof the read is unbounded, and the one-object answer
+   *  that held it then stays on offer (`chooseFrameModel`) */
+  readonly sparedByMiss?: true;
 }
 
 /** Each op's block and index, over the IR as the classification judged it. */
@@ -1123,8 +1830,9 @@ const unbounded = (why: string): ReadWindow => ({ lo: -Infinity, hi: Infinity, w
  *  the control stores that bound it are the ones reachable in between. Each has to be a literal
  *  the target decodes. A store through a pointer this cannot resolve — one that is this frame's
  *  on only some paths included (`frameOnEveryPath`) — may BE the control halfword, so it leaves
- *  the read unbounded — as does a transfer never armed here at all. An unbounded device read
- *  says which of those it met (`why`): each is a different capability to build. A block transfer
+ *  the read unbounded; so does a transfer never armed here at all. A store whose every address
+ *  misses that halfword (`misses`) is not such a store. An unbounded device read says which of
+ *  those it met (`why`): each is a different capability to build. A block transfer
  *  that took the address as its source adds the bytes its control word reads (`calleeReads`).
  *
  *  A NAMED SYMBOL PLUS A CONSTANT IS RESOLVED WHERE THE SYMBOL MAP PLACES THE NAME, and then
@@ -1154,9 +1862,11 @@ function readWindow(
     target: TargetDescription;
   },
 ): ReadWindow {
-  // a callee handed only its own return storage writes the struct it returns and nothing else
+  // a callee handed only its own return storage writes the struct it returns and nothing else —
+  // and this function's own reads of it hand the address to nobody
   const temps = uses.returnTemps.get(off);
-  if (temps !== undefined && uses.useCount.get(off) === temps.length) {
+  const reads = uses.accesses.get(off)?.filter((a) => a.isLoad).length ?? 0;
+  if (temps !== undefined && uses.useCount.get(off) === temps.length + reads) {
     return { lo: 0, hi: returnedSize(temps[0]), why: 'that returns its struct into it' };
   }
   const control = target.capabilities.readSourceControl;
@@ -1170,6 +1880,7 @@ function readWindow(
   }
   const little = target.capabilities.endianness === 'little';
   const halves: number[] = [];
+  let spared = false;
   for (const { op: handed, sink } of stores) {
     const cnt = sink + control.offset;
     let armed = false;
@@ -1185,7 +1896,10 @@ function readWindow(
         const base = facts.literalAddrOf(op.operands[0]);
         if (base === undefined) {
           if (!flow.frameOnEveryPath.has(op.operands[0])) {
-            return unbounded('a later store through an unresolved pointer may re-arm');
+            if (!misses(op, facts, cnt, blk)) {
+              return unbounded('a later store through an unresolved pointer may re-arm');
+            }
+            spared = true;
           }
           continue;
         }
@@ -1226,7 +1940,44 @@ function readWindow(
     lo = Math.min(lo, reach.lo);
     hi = Math.max(hi, reach.hi);
   }
-  return { lo, hi, why: 'that reads through it' };
+  return { lo, hi, why: 'that reads through it', ...(spared ? { sparedByMiss: true as const } : {}) };
+}
+
+/** The addresses a strided range moved by `off` may hold, where an access `width` bytes wide at
+ *  any of them stays inside one address space — or null where a start could fall below 0 or an
+ *  access wrap past 2^32, so no interval names the bytes it touches. What a runtime index into the
+ *  frame may reach (`indexedAccess`) and where a computed store may land (`misses`) both read it. */
+function displaced(r: StridedRange, off: number, width: number): StridedRange | null {
+  const lo = r.lo + off;
+  const hi = r.hi + off;
+  return lo < 0 || hi + width > 2 ** 32 ? null : { lo, hi, stride: r.stride };
+}
+
+/** A store through a computed pointer that provably misses the control halfword at `cnt`: no
+ *  address its base may hold (`addressRangeOf`, a strided interval), displaced by the store's own
+ *  offset, starts a store whose bytes overlap `[cnt, cnt + 2)`. agbcc's `gEnts[i].f = 1` after a
+ *  transfer, `i` a `u8`, writes one byte at `gEnts + 4 + 8 * [0, 255]`, and no `i` makes that the
+ *  channel's control register — so it cannot re-arm the channel, and the window stays where the
+ *  literal stores put it. The stride decides it where the interval alone cannot: placed at
+ *  0x04000000 that span covers 0x040000DE, and still no `i` lands on it. Not "the transfer is
+ *  over": an immediate transfer is, but a later store that sets the enable bit again reloads the
+ *  source register and reads the frame anew (GBATEK, DMA control bit 15), which is what this
+ *  guards against. A store this cannot bound on every value stays an unresolved pointer. */
+function misses(op: Op, facts: FrameAddressFacts, cnt: number, blk: Block): boolean {
+  const r = facts.addressRangeOf(op.operands[0], blk);
+  if (r === undefined) {
+    return false;
+  }
+  const width = op.attrs.width as number;
+  const starts = displaced(r, op.attrs.off as number, width);
+  if (starts === null) {
+    return false;
+  }
+  const { lo, hi } = starts;
+  // the first start at or above the lowest one that overlaps, against the highest that does
+  const from = cnt - width + 1;
+  const first = from <= lo || r.stride === 0 ? lo : lo + Math.ceil((from - lo) / r.stride) * r.stride;
+  return first > Math.min(hi, cnt + 1) || first < from;
 }
 
 /** Which model the audit judges the frame in. `refused` is the one mutable fact the audit
@@ -1234,6 +1985,9 @@ function readWindow(
  *  one-object answer is on offer, and read by the relift test. */
 interface ModelChoice {
   readonly onOffer: boolean;
+  /** the escapes whose read is unbounded, or was before `misses` bounded it (`sparedByMiss`) — the
+   *  one fact both the offer and the relift test (`answered`) read, so the miss proof moves neither */
+  readonly unboundedAt: ReadonlySet<number>;
   refused: boolean;
   /** refuses `why` where it stands, or, with the one-object answer on offer, asks for it instead */
   shapeRefused(why: string): void;
@@ -1264,27 +2018,56 @@ function writerNotKept(uses: FrameUses, returnsWithoutHiddenPointer: (callee: st
   return null;
 }
 
-/** THE MODEL IS CHOSEN BEFORE ANY SHAPE IS JUDGED. Where one escape reaches without bound and the
- *  one-object answer can hold every writer (`writerNotKept`), that answer is on offer — two
- *  out-parameters handed to one callee as readily as a device read — and the shapes the
- *  per-object model refuses are ones it can hold: a member at [+k] through a capture, two widths
- *  or two signednesses at one address, a runtime index, overlapping objects, a second object
- *  beside an untyped one, an object over a slot. So there each of those refusals asks for that
- *  answer instead of declining (`shapeRefused`), and the second audit judges the bytes as one
- *  object by its own rules — two types at one byte still refuse there. Where the answer is not on offer, each refuses where it stands. */
-function chooseFrameModel(
-  oneObject: FrameRange | undefined,
-  uses: FrameUses,
-  windows: ReadonlyMap<number, ReadWindow>,
-  returnsWithoutHiddenPointer: (callee: string) => boolean,
-  fail: Refuse,
-): ModelChoice {
-  const unbounded =
-    oneObject === undefined && [...windows.values()].some((w) => w.lo === -Infinity && w.hi === Infinity);
+/** THE MODEL IS CHOSEN BEFORE ANY SHAPE IS JUDGED. The one-object answer is on offer in two
+ *  frames. Where one escape reaches without bound and that answer can hold every writer
+ *  (`writerNotKept`) — two out-parameters handed to one callee as readily as a device read. And
+ *  where NO ADDRESS ESCAPES AT ALL: then there is no writer and no reader but this function's own
+ *  accesses, so keeping every word of the declared area in memory keeps every store and every load
+ *  the machine made there, and a spill kept in memory changes no value. That second frame is the
+ *  one a by-value struct parameter leaves: agbcc spills its registers word by word (`str r1, [sp]`,
+ *  the slot model's) and, Thumb having no sp-relative halfword or byte load, reads its members
+ *  through `mov rD, sp` (the object's) — `int f(struct Q { u8 a[9]; } p){ return p.a[1] + p.a[8]; }`,
+ *  or a member read signed and unsigned, or the struct copied out a word at a time. The shapes the
+ *  per-object model refuses are ones that answer can hold: a member at [+k] through a capture, two
+ *  widths or two signednesses at one address, a runtime index, overlapping objects, a second
+ *  object beside an untyped one, an object over a slot. So there each of those refusals asks for
+ *  that answer instead of declining (`shapeRefused`), and the second audit judges the bytes as one
+ *  object by its own rules — two types at one byte are a union there, or refuse. Where the answer
+ *  is not on offer, each refuses where it stands.
+ *
+ *  A frame nothing escapes from can still hold a CALL'S STACK ARGUMENT: agbcc builds one it cannot
+ *  place with `str rX, [sp,#k]` through `mov rD, sp` — a by-value struct block-copied with
+ *  `ldmia`/`stmia`, a compound literal stored a byte or a halfword at a time — and the address
+ *  escapes nowhere. Kept here as a local, in either model, those stores outlive the call that took
+ *  them. That is `storedNeverRead`'s to refuse, the stage after this one, and it asks it of every
+ *  call, whatever a prototype says. */
+function chooseFrameModel({
+  oneObject,
+  uses,
+  windows,
+  returnsWithoutHiddenPointer,
+  fail,
+}: {
+  oneObject: FrameRange | undefined;
+  uses: FrameUses;
+  windows: ReadonlyMap<number, ReadWindow>;
+  returnsWithoutHiddenPointer: (callee: string) => boolean;
+  fail: Refuse;
+}): ModelChoice {
+  const unboundedAt = new Set(
+    [...windows]
+      .filter(([, w]) => (w.lo === -Infinity && w.hi === Infinity) || w.sparedByMiss === true)
+      .map(([off]) => off),
+  );
+  const unbounded = oneObject === undefined && unboundedAt.size > 0;
   const writer = unbounded ? writerNotKept(uses, returnsWithoutHiddenPointer) : null;
-  const onOffer = unbounded && writer === null;
+  const escapeFree = oneObject === undefined && uses.escaped.size === 0;
+  // A struct passed by value is ONE object of its declared type, which the call names whole; the
+  // one object is bytes, and a call handed them would pass a pointer.
+  const onOffer = uses.byValueReads.size === 0 && ((unbounded && writer === null) || escapeFree);
   const model: ModelChoice = {
     onOffer,
+    unboundedAt,
     refused: false,
     shapeRefused: (why) => {
       if (!onOffer) {
@@ -1302,6 +2085,226 @@ function chooseFrameModel(
   return model;
 }
 
+/** A FRAME STORE THAT REACHES A CALL UNREAD, BENEATH EVERY WORD PROVEN A LOCAL, MAY BE THAT
+ *  CALL'S STACK ARGUMENT — refuse. agbcc builds an argument it cannot place with `str rX, [sp,#k]`
+ *  IN PLACE through a capture: a by-value struct is `mov rD, sp` + `stmia`, a compound literal is
+ *  `strb`/`strh` through `mov rD, sp` moved by `add rD, #k`. The stack-argument analysis
+ *  (stackargs.ts) sees `[sp,#k]` slot stores alone, so it never weighs these, and no prototype
+ *  bounds them: a callee no prototype states counts argument registers alone, and a stated list is
+ *  a LOWER bound on the words a call takes — a variadic callee's list is a prefix, and DWARF's
+ *  `symbolPrototype` drops the `...`. Whatever model then holds the bytes, a local per capture or
+ *  the one object, keeps the stores and the call loses its stack words:
+ *  `th(1, 2, 3, 4, (struct S){{x, y}})` lifts as `th(1, 2, 3, 4)`. So this asks EVERY call.
+ *
+ *  A store is asked when it reaches a call PENDING — on some path from it to the call nothing loads
+ *  a byte it wrote, and on EVERY path from the entry some byte of it is written by such a store and
+ *  not loaded since — since a word the callee takes is one the caller wrote for it on every path
+ *  to the call and did not read back. A store through a pointer that is the
+ *  frame's on only some paths (`*(p ? p : &local) = x`) is not asked: it is not a store the
+ *  outgoing block alone can own. Nor is a store a runtime index or an escaped address reaches from
+ *  an object at or below it: whoever that hands the bytes to may read them.
+ *
+ *  AND ONLY A STORE BENEATH THE LOADED-WORD BOUND. Under `localsAboveOutgoingArea` a compiler keeps
+ *  one outgoing area at the frame bottom, below every local, and never reads it back after a call;
+ *  so a frame byte loaded after a call before anything re-stores it held a value across that call,
+ *  its word is a local's, and so is every word above it. Under the strong form,
+ *  `outgoingAreaNeverLoadedFrom`, any load in a word at or above that offset bounds it: from 0 on
+ *  agbcc, past the a0..a3 home on O32 (whose compilers load a by-value aggregate's home words back)
+ *  and from the parameter area on mwcc (`target.ts` says why). The frontend measures that bound
+ *  once, off its instructions, and hands it here (`loadedWords`) — the same number its own
+ *  stack-argument refusals take (stackargs' `loadedWordBound` on Thumb).
+ *  Every compiled outgoing-argument shape sits beneath any such bound, and a local the source reads
+ *  after a call does not: `g(); b[0] = x; b[1] = y; return b[0];` reaches no call, `b[0] = x; g();
+ *  return b[0];` is above the bound. What this still refuses that is honest is a local the source
+ *  stores, never reads back, and calls past — a dead local and an outgoing argument are the same
+ *  machine code, and the lift cannot tell which. The after-call liveness weighs this audit's fixed
+ *  accesses alone, so it sits at or above the bound the frontend's slot loads would give, which
+ *  only asks more; the strong form adds the frontend's bound (`loadedWords`). Without either
+ *  premise the bound proves nothing, and every pending store is asked. */
+function storedNeverRead(
+  irBlocks: readonly Block[],
+  uses: FrameUses,
+  loadedWords: FrameObjectAudit['loadedWords'],
+  target: TargetDescription,
+  fail: Refuse,
+): void {
+  const calls = irBlocks.flatMap((b) => b.ops.filter((op) => op.opcode === 'call'));
+  if (calls.length === 0) {
+    return;
+  }
+  const byOp = new Map(uses.fixed.map((a) => [a.op, a]));
+  const bytes = (a: { at: number; width: number }): number[] => [...Array(a.width).keys()].map((i) => a.at + i);
+  const index = new Map(irBlocks.map((b, i) => [b, i]));
+  const succs = irBlocks.map((b) => successorsOf(b).map((s) => index.get(s)!));
+  const live = new Set(irBlocks.length > 0 ? [0] : []);
+  for (const stack = [...live]; stack.length;) {
+    for (const s of succs[stack.pop()!]) {
+      if (!live.has(s)) {
+        live.add(s);
+        stack.push(s);
+      }
+    }
+  }
+
+  // THE SURVIVOR BOUND: a backward liveness over the frame bytes this function reads at fixed
+  // offsets through an address that is the frame's on every path. A load makes its bytes live, a
+  // store that writes them kills them, and a call is transparent but marks every byte live across
+  // it. A load whose address may be elsewhere proves nothing and a store that may write elsewhere
+  // kills nothing; nor does a block the entry cannot reach.
+  let bound = Infinity;
+  if (target.compilerBehaviors.localsAboveOutgoingArea === true) {
+    const liveIn = irBlocks.map(() => new Set<number>());
+    for (let changed = true; changed;) {
+      changed = false;
+      for (let b = irBlocks.length - 1; b >= 0; b--) {
+        if (!live.has(b)) {
+          continue;
+        }
+        const cur = new Set(succs[b].flatMap((s) => [...liveIn[s]]));
+        for (const op of [...irBlocks[b].ops].reverse()) {
+          const a = byOp.get(op);
+          if (op.opcode === 'call') {
+            for (const o of cur) {
+              bound = Math.min(bound, o - (o % 4));
+            }
+          } else if (a?.frameOnly) {
+            for (const o of bytes(a)) {
+              if (a.isLoad) {
+                cur.add(o);
+              } else {
+                cur.delete(o);
+              }
+            }
+          }
+        }
+        if ([...cur].some((o) => !liveIn[b].has(o))) {
+          liveIn[b] = cur;
+          changed = true;
+        }
+      }
+    }
+  }
+  // …and under the STRONG form (`outgoingAreaNeverLoadedFrom`) the caller loads no word of the
+  // area from that offset up before a call either, so ANY frame byte loaded there bounds it. The
+  // frontend measured that bound off its instructions (`loadedWords`): the slot reloads the IR
+  // does not show, and the prologue's and epilogue's own loads — without them
+  // `mov r3, sp; strh r0, [r3]; … bl sink; ldr r0, [sp]` refuses the `strh` on a word the code
+  // itself proves a local's. What only this audit sees is a load through a captured address, in a
+  // block the entry reaches, and it bounds the same way. A load in a word below the offset proves
+  // nothing: O32 compilers load the a1..a3 home words they stage a by-value aggregate in.
+  if (loadedWords !== undefined) {
+    bound = Math.min(bound, loadedWords.bound);
+    for (const b of live) {
+      for (const op of irBlocks[b].ops) {
+        const a = byOp.get(op);
+        const word = a === undefined ? -1 : a.at - (a.at % 4);
+        if (a?.isLoad && a.frameOnly && word >= loadedWords.from) {
+          bound = Math.min(bound, word);
+        }
+      }
+    }
+  }
+  const from = loadedWords?.from;
+
+  // THE PENDING STORES, two forward dataflows from the entry over the blocks it reaches. The MAY
+  // set is the stores this asks that some path brings to a point unread: a load of any byte a
+  // store wrote ends it — an argument is a word the caller writes and never reads, so a store
+  // with any byte read is a local's — as a frame store covering every byte it wrote does. The
+  // MUST set is the bytes every path brings to a point written by a store this asks and not
+  // loaded since: a load ends the bytes it reads, a frame store the bytes it writes, and a store
+  // that may write elsewhere ends nothing. An argument is staged on EVERY path to its call — a
+  // tail-merged call is staged in each predecessor — so a byte some path reaches the call without
+  // is not this call's to take: a loop's store that the first trip calls past is a local's.
+  const reachedFrom = Math.min(...uses.escaped, ...uses.indexed.keys());
+  type Fixed = FrameUses['fixed'][number];
+  const asked = (a: Fixed): boolean => !a.isLoad && a.frameOnly && a.at + a.width <= reachedFrom && a.at < bound;
+  interface Pending {
+    may: Set<Fixed>;
+    must: Set<number>;
+  }
+  const step = (op: Op, cur: Pending): void => {
+    const a = byOp.get(op);
+    if (a === undefined) {
+      return;
+    }
+    const touched = new Set(bytes(a));
+    for (const p of [...cur.may]) {
+      const mine = bytes(p);
+      if (a.isLoad ? mine.some((o) => touched.has(o)) : a.frameOnly && mine.every((o) => touched.has(o))) {
+        cur.may.delete(p);
+      }
+    }
+    if (a.isLoad || a.frameOnly) {
+      for (const o of touched) {
+        cur.must.delete(o);
+      }
+    }
+    if (asked(a)) {
+      cur.may.add(a);
+      for (const o of touched) {
+        cur.must.add(o);
+      }
+    }
+  };
+  const into: (Pending | undefined)[] = irBlocks.map((_, b) =>
+    b === 0 ? { may: new Set(), must: new Set() } : undefined,
+  );
+  for (let changed = true; changed;) {
+    changed = false;
+    for (let b = 0; b < irBlocks.length; b++) {
+      const at = into[b];
+      if (!live.has(b) || at === undefined) {
+        continue;
+      }
+      const cur: Pending = { may: new Set(at.may), must: new Set(at.must) };
+      irBlocks[b].ops.forEach((op) => step(op, cur));
+      for (const s of succs[b]) {
+        const old = into[s];
+        if (s === 0) {
+          continue;
+        }
+        if (old === undefined) {
+          into[s] = { may: new Set(cur.may), must: new Set(cur.must) };
+          changed = true;
+          continue;
+        }
+        const may = new Set([...old.may, ...cur.may]);
+        const must = new Set([...old.must].filter((o) => cur.must.has(o)));
+        if (may.size !== old.may.size || must.size !== old.must.size) {
+          into[s] = { may, must };
+          changed = true;
+        }
+      }
+    }
+  }
+  for (let b = 0; b < irBlocks.length; b++) {
+    const at = into[b];
+    if (!live.has(b) || at === undefined) {
+      continue;
+    }
+    const cur: Pending = { may: new Set(at.may), must: new Set(at.must) };
+    for (const op of irBlocks[b].ops) {
+      // a struct a call is passed by value is read by that call (`byValueReads`), not handed over
+      if (op.opcode === 'call' && byOp.has(op)) {
+        step(op, cur);
+      }
+      if (op.opcode === 'call') {
+        const store = [...cur.may].filter((p) => bytes(p).some((o) => cur.must.has(o))).sort((x, y) => x.at - y.at)[0];
+        if (store !== undefined) {
+          const callee = calleeName(op);
+          fail(
+            `the ${store.width}-byte store at [sp,#${store.at}) through a captured address reaches the call to ` +
+              `${callee === undefined ? 'an indirect callee' : `\`${callee}\``} unread on every path, and no ` +
+              `${from === undefined ? 'load after a call' : from === 0 ? 'load at or beneath it' : `load at or beneath it, from [sp,#${from}) up,`} proves it a local's — it may be ` +
+              "that call's stack argument, which the lift would drop",
+          );
+        }
+      }
+      step(op, cur);
+    }
+  }
+}
+
 /** THE ACCEPTANCE'S PREMISE, RE-ASKED OF THE IR. `capturedObjectIsTheWholeFrame` is a reading
  *  of the TEXT and it is the one thing in this file that switches a refusal OFF, so the two
  *  facts it claims are re-proven here, where they are exact, rather than left to the
@@ -1356,6 +2359,26 @@ function recheckWholeFramePremise({
   }
 }
 
+/** THE ESCAPE EVENT'S PREMISE, RE-ASKED OF THE IR — `recheckWholeFramePremise`'s first half at
+ *  any frame size. The outgoing-argument analysis lets a frame address leaving this function end
+ *  the pending stores from its offset up (`StackArgsEscape`), reading the escape off what a
+ *  REGISTER holds at a `bl` or a word `str`. Where its verdict leans on that (it would refuse
+ *  without the escapes), each offset it read must reach a call operand or a word store outside the
+ *  frame in the lifted function too. It catches an arity that shrinks after the event was read
+ *  without passing the lowering's `CallSite.leftOut` question. Same two arms, same width as the
+ *  licence they re-prove. */
+function recheckEscapesReliedOn(offsets: ReadonlySet<number>, uses: FrameUses | undefined, fail: Refuse): void {
+  for (const off of offsets) {
+    if (uses === undefined || (!uses.passedToCallee.has(off) && !uses.publishedOutward.has(off))) {
+      fail(
+        `the outgoing-argument analysis set aside the stores from [sp,#${off}] up on that address escaping, and in the ` +
+          'lifted function no call takes it and no word store publishes it outside this frame — so nothing rules out ' +
+          'an outgoing stack argument there',
+      );
+    }
+  }
+}
+
 /** NOT A STRUCT-RETURN TEMP. A one-word frame rules out agbcc's block-copy bases (each needs
  *  two words) but NOT the hidden return pointer of a <=4-byte non-integer-like struct, which is
  *  exactly one word: `struct S4 { char a,b,c,d; }; struct S4 s = mk(x);` compiles to `add
@@ -1475,8 +2498,11 @@ function failIfSlotKeysIt(
 /** ONE OBJECT IN MEMORY, the answer a device read or a callee write nothing bounds is given
  *  instead of a refusal (`oneObject`, requested by the relift test where the escapes are judged).
  *  Every byte of `[from, to)` is declared one `u8` array whose address the device or the callee
- *  holds (`writerNotKept` says which writers it can hold), and every access inside it is a
- *  cast-spelled access to that array — so each store the machine made there is a store the
+ *  holds (`writerNotKept` says which writers it can hold) — or one per part, where the accesses
+ *  prove the bytes are several objects no use reads across (`provenParts`) — and every access
+ *  inside it is a cast-spelled access to that array (an element of a part, by its index:
+ *  structure.ts `framePartDecls`), or a view of the union it is declared as where two widths
+ *  meet at one byte — so each store the machine made there is a store the
  *  recompile makes too. That is what agbcc does for an object whose address escaped: it keeps
  *  every store to it, in order (flow.c deletes a memory store only when an identical later
  *  store in the same block overwrites it). And it is right whichever the source had there: a
@@ -1489,6 +2515,8 @@ function keepAsOneObject({
   uses,
   usedSlotOffsets,
   returnsWithoutHiddenPointer,
+  arrayOrder,
+  arrayAlignment,
   fail,
 }: {
   oneObject: FrameRange;
@@ -1497,6 +2525,8 @@ function keepAsOneObject({
   uses: FrameUses;
   usedSlotOffsets: ReadonlySet<number>;
   returnsWithoutHiddenPointer: (callee: string) => boolean;
+  arrayOrder: TargetDescription['compilerBehaviors']['addressTakenArrayOrder'];
+  arrayAlignment: TargetDescription['compilerBehaviors']['addressTakenArrayAlignment'];
   fail: Refuse;
 }): void {
   const kept = `the bytes [sp,#${from}) to [sp,#${to}) kept as one object`;
@@ -1514,22 +2544,41 @@ function keepAsOneObject({
   if (writer !== null) {
     fail(`${kept} cannot hold every writer — ${writer}`);
   }
-  // A runtime index names no byte, so no access type can be checked against the others at the
-  // bytes it reaches — except a byte access, which needs none: character types alias every type.
-  if ([...uses.indexed.values()].some((xs) => xs.some((x) => x.width !== 1))) {
-    fail(
-      `a runtime index into ${kept} accesses more than a byte, and names no byte whose type it can be checked against`,
-    );
-  }
-  // ONE TYPE PER BYTE. agbcc at -O2 turns on type-based alias analysis (toplev.c:3616), and
-  // compiled, a `u32` read through a cast is served the earlier `u32` store straight past a
-  // `u16` store to the same bytes — a stale value. So a byte two accesses of different widths
-  // reach cannot be spelled through casts. A byte access is exempt, since character types
-  // alias everything, and so is a signedness difference, since the signed and unsigned types
-  // of one width share an alias set (c-common.c:1962-1974). The first audit asks for this
-  // answer rather than refusing two widths — an object read at both, or a `strh` member through
-  // the captured address over a word the slot model had — so this is where they refuse.
+  // A runtime index names no byte, so the rule below is asked of it at EVERY byte it may reach:
+  // all of them where nothing bounds it, the bytes its `reach` names where one does — a byte no
+  // index reaches is read at one type whatever the index's is, and accesses that share no byte
+  // cannot serve each other a stale value. Two indexed widths that may share a byte refuse here;
+  // an index beside a member of another width refuses after the members are checked against each
+  // other, so a member pair keeps naming its own byte (`indexedWidth` says why one width is
+  // enough).
+  const indexes = [...uses.indexed.values()].flat();
+  indexes.forEach((x, i) => {
+    for (const y of indexes.slice(i + 1)) {
+      const { refusal } = indexedWidth([x, y]);
+      if (refusal !== null && mayShare(x.reach, y.reach)) {
+        fail(`a runtime index into ${kept} ${refusal}`);
+      }
+    }
+  });
+  // ONE TYPE PER BYTE, OR ONE UNION. agbcc at -O2 turns on type-based alias analysis
+  // (toplev.c:3616), and compiled, a `u32` read through a cast is served the earlier `u32` store
+  // straight past a `u16` store to the same bytes — a stale value. So a byte two accesses of
+  // different widths reach cannot be spelled through casts. A byte access is exempt, since
+  // character types alias everything, and so is a signedness difference, since the signed and
+  // unsigned types of one width share an alias set (c-common.c:1962-1974). The first audit asks
+  // for this answer rather than refusing two widths — an object read at both, or a `strh` member
+  // through the captured address over a word the slot model had — so this is where they are judged.
+  //
+  // What two widths at one byte CAN be spelled as is a UNION of per-width views, every access made
+  // directly through it (`sp0.half[1]`): c_get_alias_set gives any access through a member of a
+  // union alias set 0 (c-common.c, the COMPONENT_REF walk), which conflicts with every set, so no
+  // read moves past a store to the same bytes — compiled, a `u16` read, a `u32` store and the same
+  // read again reloads through the union and returns the stale value through casts. So the object
+  // is stamped with the views its accesses use (`unionViews`) and declared as that union
+  // (structure.ts `laddrType`), where every access to it is a fixed offset on the object itself,
+  // aligned to its own width — the cases `unionRefusal` names refuse as before.
   const widthAt = new Map<number, number>();
+  let twoWidths: { b: number; had: number; width: number } | undefined;
   for (const m of uses.members) {
     if (m.at < from || m.at + m.width > to) {
       fail(`an access of ${m.width} bytes at [sp,#${m.at}) reaches past ${kept}`);
@@ -1540,14 +2589,32 @@ function keepAsOneObject({
     for (let b = m.at; b < m.at + m.width; b++) {
       const had = widthAt.get(b);
       if (had !== undefined && had !== m.width) {
-        fail(
-          `the byte at [sp,#${b}] of ${kept} is accessed ${had} and ${m.width} bytes wide, and agbcc at -O2 ` +
-            'lets a read of one type pass a store of the other (strict aliasing) — a cast spelling would read stale',
-        );
+        twoWidths ??= { b, had, width: m.width };
       }
       widthAt.set(b, m.width);
     }
   }
+  if (twoWidths !== undefined) {
+    // any runtime index, a byte one too, and wherever its reach lies: `indexedWidth` leaves width
+    // 1 out because a char access agrees with every width, but a union view is spelled for fixed
+    // offsets on the object alone, and an indexed access is not one (the rewrite below refuses it)
+    const why = unionRefusal({ from, to, uses, indexed: uses.indexed.size > 0 });
+    if (why !== null) {
+      fail(
+        `the byte at [sp,#${twoWidths.b}] of ${kept} is accessed ${twoWidths.had} and ${twoWidths.width} bytes ` +
+          `wide, ${STALE_ACROSS_TYPES}, and ${why}`,
+      );
+    }
+  }
+  for (const [b, had] of widthAt) {
+    const by = indexes.find((x) => x.width !== 1 && x.width !== had && mayTouch(x.reach, b, 1));
+    if (by !== undefined) {
+      fail(
+        `the byte at [sp,#${b}] of ${kept} is accessed ${had} bytes wide and by a runtime index ${by.width} ` +
+          `bytes wide, ${STALE_ACROSS_TYPES}`,
+      );
+    }
+  }
   // Rewritten onto one `laddr` at `from`: an access through a member at `k` becomes an access
   // at `k - from` off the object, and a member address used any other way becomes the object's
   // address moved by that constant.
@@ -1562,15 +2629,35 @@ function keepAsOneObject({
   // nothing here sees, so a spin on such a byte compiles unqualified; the per-object stamp has the
   // same gap (`stampObjects`: not on an ordinary `&local` argument).
   const reread = uses.publishedToWriter.size > 0;
-  const object = mkOp('laddr', {
-    results: [mkValue(T.unk(32))],
-    attrs: { off: from, width: 1, signed: false, count: to - from },
-  });
+  // …and declared as SEVERAL objects where the accesses prove the bytes are several
+  // (`provenParts`), each rewritten on its own: an access through a member at `k` lands on the
+  // part that holds `k`, at `k` less the part's start. Only on a compiler that places address-
+  // taken arrays in a known order against their declarations (`addressTakenArrayOrder`): the
+  // parts are declared in that order, or the recompile swaps their addresses. And at a known
+  // alignment (`addressTakenArrayAlignment`), which says where a part may start.
+  const parts =
+    twoWidths === undefined && arrayOrder !== undefined && arrayAlignment !== undefined
+      ? provenParts({ from, to }, objects, uses, arrayAlignment)
+      : [{ from, to }];
+  // …stamped `part` where there are several: storage a copy proved one object of the source's, so
+  // its bytes are that object's elements rather than the one object's mix of members and spills,
+  // and the emitter may name them as elements (structure.ts `framePartDecls`), of the type their
+  // accesses agree on (`stampPartElements`, below)
+  const laddrs = parts.map(({ from: lo, to: hi }) =>
+    mkOp('laddr', {
+      results: [mkValue(T.unk(32))],
+      attrs: { off: lo, width: 1, signed: false, count: hi - lo, ...(parts.length > 1 ? { part: true } : {}) },
+    }),
+  );
+  const partOf = (at: number) => parts.findIndex((p) => at >= p.from && at < p.to);
+  const object = laddrs[0];
   const base = object.results[0];
   const memberAt = new Map<Value, number>();
   for (const op of [...objects.values()].flat()) {
     memberAt.set(op.results[0], op.attrs.off as number);
   }
+  const baseAt = (at: number) => laddrs[partOf(at)].results[0];
+  const startAt = (at: number) => parts[partOf(at)].from;
   // The qualifier goes on every access the classification judged one (`accessOps`) — through a
   // member, a runtime index into one, or a phi that carries one (`p = c ? buf : gOther; while
   // (*p == 0);`). Only an access through a member is rebased: a phi's incoming member is
@@ -1584,14 +2671,17 @@ function keepAsOneObject({
         op.attrs = { ...op.attrs, volatile: true };
       }
       if (access && at !== undefined) {
-        op.operands = [base, ...op.operands.slice(1)];
-        op.attrs = { ...op.attrs, off: (op.attrs.off as number) + at - from };
+        op.operands = [baseAt(at), ...op.operands.slice(1)];
+        op.attrs = { ...op.attrs, off: (op.attrs.off as number) + at - startAt(at) };
       }
       op.operands.forEach((v) => memberAt.has(v) && stillUsed.add(v));
       (op.successors ?? []).forEach((sx) => sx.args.forEach((v) => memberAt.has(v) && stillUsed.add(v)));
     }
   }
-  const atBase = (v: Value): Value => (memberAt.get(v) === from ? base : v);
+  const atBase = (v: Value): Value => {
+    const at = memberAt.get(v);
+    return at !== undefined && at === startAt(at) ? baseAt(at) : v;
+  };
   for (const blk of irBlocks) {
     blk.ops = blk.ops.flatMap((op) => {
       const at = op.opcode === 'laddr' ? memberAt.get(op.results[0]) : undefined;
@@ -1600,17 +2690,282 @@ function keepAsOneObject({
         (op.successors ?? []).forEach((sx) => (sx.args = sx.args.map(atBase)));
         return [op];
       }
-      if (!stillUsed.has(op.results[0]) || at === from) {
+      if (!stillUsed.has(op.results[0]) || at === startAt(at)) {
         return [];
       }
       const by = mkValue(T.unk(32));
       return [
-        mkOp('const', { results: [by], attrs: { value: at - from } }),
-        mkOp('add', { operands: [base, by], results: op.results }),
+        mkOp('const', { results: [by], attrs: { value: at - startAt(at) } }),
+        mkOp('add', { operands: [baseAt(at), by], results: op.results }),
       ];
     });
   }
-  irBlocks[0].ops.unshift(object);
+  if (twoWidths !== undefined) {
+    // …every access is now a fixed offset on the object itself, which is what a view spells; one
+    // that is not was carried there by a phi, as a pointer, and a pointer to the union's bytes is
+    // read through a cast again
+    for (const op of uses.accessOps.keys()) {
+      if (op.operands[0] !== base) {
+        fail(
+          `the bytes [sp,#${from}) to [sp,#${to}) are accessed at two widths, which only a union of views ` +
+            'spells without a stale read — and an access reaches them through a pointer a phi carries, which ' +
+            'no view of the union names',
+        );
+      }
+    }
+    object.attrs = { ...object.attrs, views: unionViews(irBlocks, base) };
+  }
+  if (laddrs.length > 1) {
+    stampPartElements(irBlocks, laddrs, uses.accessOps);
+  }
+  irBlocks[0].ops.unshift(...(arrayOrder === 'descending' ? [...laddrs].reverse() : laddrs));
+}
+
+/** THE PARTS THE ACCESSES PROVE `[from, to)` IS MADE OF, lowest first — or the whole range, one
+ *  part, wherever they do not. A part is a maximal run of bytes that overlapping uses chain
+ *  together — a fixed-offset access, a struct passed by value, and an escape a standard block copy
+ *  with a literal count bounds (`escapeExtents`) each name the bytes they touch — and a run that
+ *  merely abuts the one below it starts a new part only where such a copy starts — and so must
+ *  the lowest part, or nothing is split. Two brace-initialised arrays side by side are agbcc's
+ *  `memcpy(a, .LC0, 16); memcpy(b, .LC2, 16)`, and declared as one `u8[32]` neither image can be
+ *  folded into its own local (l3/constinit.ts).
+ *
+ *  ONE PART, never a refusal, whenever a byte could be read through two parts: a runtime index
+ *  nothing bounds (it names no byte, so it may reach every one) or one whose `reach` (the range
+ *  ir/bits.ts proves of the index: `a[(i & 7) * 2]`) crosses a part, an escape nothing bounds (a
+ *  callee or a holder that may reach any byte from the address it was given), a byte no use names
+ *  (nothing says which side it belongs to), or a use through a member that lands outside the part
+ *  its own address lies in (`&a[16]` read at [-1]: one pointer walking two parts is one object). The
+ *  union views of two widths at one byte are not split either (the caller asks only without
+ *  them). An access straddling two runs chains them into one part by construction. */
+function provenParts(
+  { from, to }: FrameRange,
+  objects: ReadonlyMap<number, readonly Op[]>,
+  uses: FrameUses,
+  alignment: number,
+): FrameRange[] {
+  const whole = [{ from, to }];
+  const touched: { owner: number; lo: number; hi: number }[] = [];
+  for (const [op, { off, index }] of uses.accessOps) {
+    // …an access through a runtime index is not at its own displacement: it is its reach (below)
+    if (index !== undefined) {
+      continue;
+    }
+    const at = off + (op.attrs.off as number);
+    touched.push({ owner: off, lo: at, hi: at + (op.attrs.width as number) });
+  }
+  // An escape and a runtime index each touch every byte they may reach (`frameReaches`), so each
+  // chains the runs it spans as one access as wide would — a reach across a copy's start makes
+  // the two copies one part — and a reach that starts in a part other than its object's fails the
+  // owner test below
+  const reaches = frameReaches(uses);
+  for (const { owner, reach } of reaches) {
+    if (reach === null) {
+      return whole;
+    }
+    touched.push({ owner, ...reach });
+  }
+  for (const [off, reads] of uses.byValueReads) {
+    reads.forEach(({ type }) =>
+      touched.push({ owner: off, lo: off, hi: off + (type.kind === 'struct' ? (type.size ?? Infinity) : Infinity) }),
+    );
+  }
+  // …and a boundary only where a bounded copy starts: an address handed to `memcpy` is where
+  // the source put an object it fills. A run starting anywhere else is bytes reached from below,
+  // which says nothing of where one object ends — the one-object relift reads every slot through
+  // an address of its own, so a struct spilled word by word and read through its base shows a
+  // run per word, and is one object at every word. The LOWEST part is held to the same test
+  // (below): where it is only stores, a copy above it is as likely `memcpy(&buf[4], s, 12)` into
+  // the middle of one array as the start of a second one, and declared as two the recompile
+  // reads `buf[6]` through a base it holds where the target re-formed sp+6. Only a copy's
+  // DESTINATION counts: a copy reading OUT of the frame says where the source took bytes from,
+  // which is as likely `memcpy(g, &w[2], 8)` from the middle of one array as a second object.
+  const starts = copyStarts(reaches);
+  const parts: { from: number; to: number }[] = [];
+  for (const { lo, hi } of [...touched].sort((a, b) => a.lo - b.lo)) {
+    const last = parts.at(-1);
+    if (last !== undefined && (lo < last.to || (lo === last.to && !starts.has(lo)))) {
+      last.to = Math.max(last.to, hi);
+    } else {
+      parts.push({ from: lo, to: hi });
+    }
+  }
+  const tiles =
+    parts.length > 1 &&
+    parts[0].from === from &&
+    parts.at(-1)!.to === to &&
+    parts.every((p, i) => i === 0 || parts[i - 1].to === p.from);
+  const partOf = (at: number) => parts.findIndex((p) => at >= p.from && at < p.to);
+  if (
+    !tiles ||
+    [...objects.keys()].some((off) => partOf(off) < 0) ||
+    touched.some(({ owner, lo }) => partOf(owner) !== partOf(lo))
+  ) {
+    return whole;
+  }
+  // …and a part starts only where the compiler places a local array of its own: at a multiple of
+  // its `alignment` (agbcc pads `u8 a[18]` to 20, so a split there declares `b` at sp+20 where the
+  // target had it at sp+18; gcc 2.7.2 on MIPS starts every one at a multiple of 8, so a part at
+  // sp+20 is placed at sp+24 and the frame grows), and never as ONE byte, which declared alone is
+  // a `u8` scalar whose address nothing takes — kept in a register, it drops the frame byte and
+  // the store the target made. Such a part joins the one below it, and the lowest one byte joins
+  // the one above: fewer parts only ever read as the one object does, so this costs a split,
+  // never a value.
+  const merged: { from: number; to: number }[] = [];
+  for (const p of parts) {
+    const last = merged.at(-1);
+    if (last !== undefined && (p.from % alignment !== 0 || p.to - p.from === 1 || last.to - last.from === 1)) {
+      last.to = p.to;
+    } else {
+      merged.push({ ...p });
+    }
+  }
+  return merged.length > 1 && merged.every((p) => starts.has(p.from)) ? merged : whole;
+}
+
+/** Why the one object's bytes, accessed at two widths, cannot be spelled as a union of per-width
+ *  views, or null. A view names an ELEMENT, so every access must sit at a multiple of its own width
+ *  from the object's start and every view must tile the object; and it names it at a constant
+ *  index, so a runtime index into the object — whose element width a view could carry, but whose
+ *  spelling nothing here builds — keeps the refusal, and so does a qualifier on the accesses
+ *  (`publishedToWriter`), which a member access of an unqualified union cannot carry. */
+function unionRefusal({
+  from,
+  to,
+  uses,
+  indexed,
+}: {
+  from: number;
+  to: number;
+  uses: FrameUses;
+  indexed: boolean;
+}): string | null {
+  if (indexed) {
+    return 'a runtime index reaches them too, which no view of a union is spelled for';
+  }
+  if (uses.publishedToWriter.size > 0) {
+    return 'the address is stored where a writer may hold it, and a view of a union carries no per-access qualifier';
+  }
+  for (const m of uses.members) {
+    if ((m.at - from) % m.width !== 0) {
+      return `the ${m.width}-byte access at [sp,#${m.at}) is not aligned to its width, so no view of a union names it`;
+    }
+    if ((to - from) % m.width !== 0) {
+      return `the ${to - from} bytes are not a whole number of ${m.width}-byte elements, so no view of a union tiles them`;
+    }
+  }
+  return null;
+}
+
+/** The views a union object's accesses use, as `laddr`'s `views` attr: one entry per view, its
+ *  element width in bytes, NEGATIVE for a signed narrow view — which views, by the rule
+ *  raise/structs.ts declares a struct member's union by (ir/types.ts `unionViewSigns`). A word's
+ *  one view is `s32` whichever sign it carries, so it is entered unsigned. Widest first, unsigned
+ *  before signed. */
+function unionViews(irBlocks: readonly Block[], base: Value): number[] {
+  const byWidth = new Map<number, { isLoad: boolean; signed: boolean; stamped: boolean }[]>();
+  for (const op of irBlocks.flatMap((b) => b.ops)) {
+    if ((op.opcode === 'load' || op.opcode === 'store') && op.operands[0] === base) {
+      const w = op.attrs.width as number;
+      (byWidth.get(w) ?? byWidth.set(w, []).get(w)!).push({
+        isLoad: op.opcode === 'load',
+        signed: (op.attrs.signed as boolean) ?? false,
+        stamped: op.opcode === 'store' && op.attrs.signed !== undefined,
+      });
+    }
+  }
+  return [...byWidth]
+    .sort(([a], [b]) => b - a)
+    .flatMap(([w, accesses]) => unionViewSigns(w, accesses).map((sg) => (sg && w !== 4 ? -w : w)));
+}
+
+/** THE ELEMENT EACH PROVEN PART IS DECLARED WITH, from the census of its own accesses — the way
+ *  `unionViews` types a union's views from theirs — stamped `elem` on the part's `laddr` (a width in
+ *  bytes, negative for a signed narrow one; absent is the storage default, `u8`).
+ *
+ *  A part is an object of the source's (`provenParts`), and its bare element `sp64[i]` is not the
+ *  same compile as the cast `((u16 *)sp64)[i]` beside a second array whose base agbcc holds (see
+ *  structure.ts `framePartDecls`) — but the bare spelling exists only for an access of the declared
+ *  element's width and extension, so a part of `u16` or `s8` elements declared `u8` reaches no
+ *  access bare. Every access agreeing on one element is the evidence a declaration of it needs. An access that disagrees with the declaration keeps its cast, which is
+ *  one value under any declaration (structure.ts `bareArrayElement`), so the stamp never changes
+ *  what an access reads; nor what it aliases, since a bare element of a `u16` array is a `u16`
+ *  lvalue, the type the cast it replaces names.
+ *
+ *  - One width over every access (a block copy or any other escape has none), aligned to it — the
+ *    part's start, its size and every fixed offset — else the storage default.
+ *  - Its extension from the LOADS: one extension is that one, both is no element (no evidence picks
+ *    between them). An unsigned byte read whose every reader sign-extends it is either: agbcc has
+ *    no `ldrsb` with an immediate offset and mwcc no signed byte load at all, so `s8 a[64]`'s `a[3]`
+ *    is that read (structure.ts `declaredExtendedRead` spells it bare once the part says `s8`). With
+ *    no load committing, such a read makes the element signed, and else a store raise/storesign.ts
+ *    stamped signed does, as `unionViewSigns` reads a view's.
+ *  - A word is one element whatever its loads say (`scalarTypeForAccess`).
+ *  An access whose part is not known — one through a pointer a phi carries, an index nothing bounds
+ *  — leaves every part at the default: its width is not counted, so no census is whole. */
+function stampPartElements(
+  irBlocks: readonly Block[],
+  laddrs: readonly Op[],
+  accessOps: ReadonlyMap<Op, FrameAccessOp>,
+): void {
+  const bases = laddrs.map((d) => d.results[0]);
+  const start = laddrs.map((d) => d.attrs.off as number);
+  const end = laddrs.map((d) => (d.attrs.off as number) + (d.attrs.count as number));
+  const users = new Map<Value, Op[]>();
+  for (const op of irBlocks.flatMap((b) => b.ops)) {
+    op.operands.forEach((v) => (users.get(v) ?? users.set(v, []).get(v)!).push(op));
+  }
+  type Access = { width: number; at: number | null; load: boolean; signed: boolean | null; stamped: boolean };
+  const census = laddrs.map((): Access[] => []);
+  for (const [op, { index }] of accessOps) {
+    const fixed = bases.indexOf(op.operands[0]);
+    const reach = index?.reach ?? null;
+    const part =
+      fixed >= 0 ? fixed : reach === null ? -1 : start.findIndex((lo, i) => reach.lo >= lo && reach.hi <= end[i]);
+    if (part < 0) {
+      return;
+    }
+    const width = op.attrs.width as number;
+    const load = op.opcode === 'load';
+    // …a sign extension as the frontend lifts it: mwcc's `extsb`, or the `lsl #24; asr #24` pair
+    // (the idiom stage folds it to a `sext` later, pattern/engine.ts `sextPat`)
+    const extends8 = (u: Op): boolean =>
+      (u.opcode === 'sext' && u.attrs.width === 8) ||
+      (u.opcode === 'shl' &&
+        u.attrs.imm === 24 &&
+        (users.get(u.results[0]) ?? []).length > 0 &&
+        users.get(u.results[0])!.every((s) => s.opcode === 'shr_s' && s.attrs.imm === 24));
+    const readers = load ? (users.get(op.results[0]) ?? []) : [];
+    const either = width === 1 && op.attrs.signed !== true && readers.length > 0 && readers.every(extends8);
+    census[part].push({
+      width,
+      at: fixed >= 0 ? (op.attrs.off as number) : null,
+      load,
+      signed: !load || either ? null : op.attrs.signed === true,
+      stamped: !load && op.attrs.signed === true,
+    });
+  }
+  laddrs.forEach((d, i) => {
+    const accesses = census[i];
+    const widths = new Set(accesses.map((a) => a.width));
+    if (widths.size !== 1) {
+      return;
+    }
+    const [w] = widths;
+    const count = d.attrs.count as number;
+    if (start[i] % w !== 0 || count % w !== 0 || accesses.some((a) => a.at !== null && a.at % w !== 0)) {
+      return;
+    }
+    const signs = new Set(accesses.flatMap((a) => (a.signed === null ? [] : [a.signed])));
+    if (signs.size > 1) {
+      return;
+    }
+    const signed = signs.size === 1 ? [...signs][0] : accesses.some((a) => a.load || a.stamped);
+    const elem = signed && w !== 4 ? -w : w;
+    if (elem !== 1) {
+      d.attrs = { ...d.attrs, elem };
+    }
+  });
 }
 
 /** One object's shape: `count` elements of `width` bytes. */
@@ -1640,8 +2995,10 @@ function slotKeys(usedSlotOffsets: ReadonlySet<number>, off: number, width: numb
  *  AN OBJECT OVER A SLOT IS REFUSED LAST, after the one-object answer is asked: that answer
  *  routes every word of the local area through `laddr`, so no slot is left for the object to
  *  overlap, and refusing first would decline exactly the frames it exists for — an object at
- *  [sp,#0] whose first member is a word stored `str rN, [sp]`. The other per-object refusals here
- *  go through `shapeRefused`, for the same reason. */
+ *  [sp,#0] whose first member is a word stored `str rN, [sp]`, or a by-value struct parameter
+ *  spilled word by word and read through `mov rD, sp` where nothing escapes. The other per-object
+ *  refusals here go through `shapeRefused`, for the same reason: where nothing escapes, each of
+ *  them asks for that answer too (`chooseFrameModel`). */
 function objectShapes({
   objects,
   uses,
@@ -1667,30 +3024,63 @@ function objectShapes({
   for (const [off, acc] of uses.accesses) {
     const byIndex = uses.indexed.get(off) ?? [];
     const temps = uses.returnTemps.get(off);
+    const passed = uses.byValueReads.get(off);
+    if (passed !== undefined) {
+      // A struct passed BY VALUE (`foldByValueArgs`): this function writes and reads its members,
+      // and the call reads it whole. A struct-return temp passed on, an index, or any other use of
+      // the address is not modelled.
+      const type = passed[0].type;
+      const at = `the object at [sp,#${off}) is passed by value as ${structSpelling(type)}`;
+      if (temps !== undefined) {
+        fail(`${at}, and is also the storage a call returns a struct into — not modelled`);
+      }
+      if (passed.some((p) => !typeEquals(p.type, type))) {
+        fail(`${at} to calls declared to take different types`);
+      }
+      if (byIndex.length > 0) {
+        fail(`${at}, and this function also indexes it — only its members' accesses are modelled`);
+      }
+      if (uses.useCount.get(off) !== acc.length + passed.length) {
+        fail(`${at}, and its address is also used another way — only its members' accesses are modelled`);
+      }
+      const size = type.kind === 'struct' ? type.size! : 0;
+      const past = uses.fixed.find(
+        (f) => uses.accessOps.get(f.op)?.off === off && (f.at < off || f.at + f.width > off + size),
+      );
+      if (past !== undefined) {
+        fail(`${at}, and this function accesses [sp,#${past.at}) of width ${past.width}, past the struct`);
+      }
+      extent.set(off, { width: 1, count: size });
+      aggregateAt.set(off, type);
+      continue;
+    }
     if (temps !== undefined) {
-      // The callee writes the whole struct and this function names it once, as the call's
-      // destination. A read of a member, or any other use of the address, is not modelled —
-      // and most such reads never arrive here: the Thumb slot model refuses a word of the temp
-      // read at a constant offset first ("stack pointer used as data"), a copy of the whole
-      // struct into a global (`gS8 = mk8(x)`, which agbcc stages through the temp) included. So
-      // modelling member reads starts with the slot model handing this audit a read return temp.
+      // The callee writes the whole struct and this function names it as the call's destination,
+      // and READS it: each load is of bytes inside the struct, which the struct's declaration
+      // types (raise/aggmembers.ts reads a word's members, structure.ts spells a member access).
+      // A write, an index, or any other use of the address is not modelled.
       const callee = temps[0].attrs.target as string;
       const type = temps[0].results[0].type;
       const spelling = type.kind === 'struct' ? (type.declared ?? `struct ${type.name}`) : typeToString(type);
+      const at = `the object at [sp,#${off}) is where \`${callee}\` returns ${spelling}`;
       if (temps.some((t) => !typeEquals(t.results[0].type, type))) {
         fail(`the object at [sp,#${off}) is the struct-return storage of calls declared to return different types`);
       }
-      if (acc.length > 0 || byIndex.length > 0) {
+      if (acc.some((a) => !a.isLoad) || byIndex.length > 0) {
         fail(
-          `the object at [sp,#${off}) is where \`${callee}\` returns ${spelling}, and this function also reads or ` +
-            'writes it — a member of a returned struct is not modelled',
+          `${at}, and this function also ${byIndex.length > 0 ? 'indexes' : 'writes'} it — only a read of a ` +
+            'returned struct is modelled',
         );
       }
-      if (uses.useCount.get(off) !== temps.length) {
-        fail(
-          `the object at [sp,#${off}) is where \`${callee}\` returns ${spelling}, and its address is also used ` +
-            'another way — only the call it is returned by is modelled',
-        );
+      if (uses.useCount.get(off) !== temps.length + acc.length) {
+        fail(`${at}, and its address is also used another way — only the call it is returned by is modelled`);
+      }
+      const size = returnedSize(temps[0]);
+      const past = uses.fixed.find(
+        (f) => uses.accessOps.get(f.op)?.off === off && (f.at < off || f.at + f.width > off + size),
+      );
+      if (past !== undefined) {
+        fail(`${at}, and this function reads [sp,#${past.at}) of width ${past.width}, past the struct`);
       }
       extent.set(off, { width: 1, count: returnedSize(temps[0]) });
       aggregateAt.set(off, type);
@@ -1721,26 +3111,18 @@ function objectShapes({
         // …asked for the one object instead, which sizes no object of its own
         continue;
       }
-      // An indexed access reads ONE ELEMENT of the storage declared below, so it must be one:
-      // an unsigned byte. A wider element is a different array over the same bytes, and a
-      // sign-extending read is not what `u8` spells.
-      for (const a of byIndex) {
-        if (a.width !== 1) {
-          model.shapeRefused(
-            `a runtime index into the object at [sp,#${off}) accesses ${a.width} bytes, and the storage ` +
-              'nothing else types is declared as bytes — only a byte element is modelled',
-          );
-        }
-        if (a.signed) {
-          model.shapeRefused(
-            `a runtime index into the object at [sp,#${off}) sign-extends, and the storage is declared unsigned`,
-          );
-        }
+      // An indexed access reads THROUGH A CAST on the storage declared below, at its own width
+      // and signedness, as an access to the one object does (`keepAsOneObject`), so the accesses
+      // wider than a byte must be of one width, one alias set (`indexedWidth`).
+      const index = indexedWidth(byIndex);
+      if (index.refusal !== null) {
+        model.shapeRefused(`a runtime index into the object at [sp,#${off}) ${index.refusal}`);
       }
       // STORAGE, NOT A TYPE. The reservation says how many bytes the frame holds and the
       // conjuncts above say they are all this object's, so the declaration commits to an EXTENT
       // and to nothing else: `u8 name[n]` over the declared range, unsigned bytes because no
       // access named an element type and inventing one is the guess this refuses everywhere else.
+      // An indexed access names only its own width, which its cast spells where it reads.
       //
       // THE EXTENT IS A ROUNDED ONE, stated because it is not a defect. agbcc reserves the
       // local area in whole words, so a source object of 13, 14, 15 or 16 bytes all reserve
@@ -2058,8 +3440,9 @@ function stampObjects(
 ): void {
   for (const [off, ops] of objects) {
     const { width, count } = extent.get(off)!;
-    const signed = uses.accesses.get(off)!.some((a) => a.signed);
     const aggregate = aggregateAt.get(off);
+    // a declared struct's storage is bytes, whatever signedness its members are read at
+    const signed = aggregate === undefined && uses.accesses.get(off)!.some((a) => a.signed);
     for (const op of ops) {
       const qualified = uses.published.has(off) || uses.filledFrom.has(off);
       op.attrs = {
@@ -2092,8 +3475,8 @@ function gcd(a: number, b: number): number {
   return b === 0 ? Math.abs(a) : gcd(b, a % b);
 }
 
-/** The size of the struct a call stamped `sret` returns through its argument 0 (frontend/thumb.ts
- *  types the call's result as that struct). */
+/** The size of the struct a call stamped `sret` returns through its argument 0 (frontend/call-plan.ts
+ *  types the call's result as that struct, for every frontend whose lowering passes the pointer). */
 function returnedSize(call: Op): number {
   const t = call.results[0].type;
   if (t.kind !== 'struct' || t.size === undefined) {
@@ -2102,8 +3485,108 @@ function returnedSize(call: Op): number {
   return t.size;
 }
 
+/** The block parameters every incoming value of which is a local's address or another such
+ *  parameter: the greatest set closed under that, so a loop-carried address is one too. Each maps to
+ *  the frame offsets its incoming addresses name, through such parameters. The entry block's are the
+ *  function's parameters, and are left out. */
+function mergedFrameAddresses(irBlocks: readonly Block[]): Map<Value, ReadonlySet<number>> {
+  const laddrOff = new Map<Value, number>();
+  for (const op of irBlocks.flatMap((b) => b.ops)) {
+    if (op.opcode === 'laddr') {
+      laddrOff.set(op.results[0], op.attrs.off as number);
+    }
+  }
+  const incoming = new Map<Value, Value[]>();
+  for (const b of irBlocks.slice(1)) {
+    for (const p of b.params) {
+      incoming.set(p, []);
+    }
+  }
+  for (const op of irBlocks.flatMap((b) => b.ops)) {
+    for (const succ of op.successors) {
+      succ.block.params.forEach((p, i) => incoming.get(p)?.push(succ.args[i]));
+    }
+  }
+  const merged = new Set([...incoming].filter(([, vs]) => vs.length > 0).map(([p]) => p));
+  for (let changed = true; changed;) {
+    changed = false;
+    for (const p of merged) {
+      if (incoming.get(p)!.some((v) => !laddrOff.has(v) && !merged.has(v))) {
+        merged.delete(p);
+        changed = true;
+      }
+    }
+  }
+  const out = new Map<Value, ReadonlySet<number>>();
+  for (const p of merged) {
+    const offs = new Set<number>();
+    const seen = new Set<Value>([p]);
+    const work = [p];
+    while (work.length > 0) {
+      for (const v of incoming.get(work.pop()!)!) {
+        if (laddrOff.has(v)) {
+          offs.add(laddrOff.get(v)!);
+        } else if (!seen.has(v)) {
+          seen.add(v);
+          work.push(v);
+        }
+      }
+    }
+    out.set(p, offs);
+  }
+  return out;
+}
+
+/** A STRUCT RETURNED THROUGH A MERGE OF ONE LOCAL'S ADDRESS IS THAT LOCAL. gcc rotates a loop that
+ *  calls a struct-returning function, `while (lo > 0) { qr = ldiv(lo, 10); … }`, so `addiu a0,sp,16`
+ *  runs once ahead of the loop and once in the delay slot of its back branch, and hoists it into
+ *  both arms of `if (x) a = f(x); else a = f(x + 1);` ahead of one shared `jal`. The call then
+ *  reads a block parameter, but every path hands it the same frame address, so the call is handed
+ *  that address: an `laddr` of it, minted ahead of the call, which the frame-object audit types as
+ *  the struct (`declaredStructs`) and `refuseSretOutsideFrame` accepts. A merge of two offsets is
+ *  two objects, and is left for the audit to refuse. Run before the audit, on every frontend whose call
+ *  lowering passes the hidden pointer. */
+export function nameMergedSretObjects(irBlocks: Block[]): void {
+  const merged = mergedFrameAddresses(irBlocks);
+  for (const b of irBlocks) {
+    b.ops = b.ops.flatMap((op) => {
+      const offs = op.opcode === 'call' && op.attrs.sret === true ? merged.get(op.operands[0]) : undefined;
+      if (offs === undefined || offs.size !== 1) {
+        return [op];
+      }
+      const at = mkValue(T.unk(32));
+      op.operands = [at, ...op.operands.slice(1)];
+      return [mkOp('laddr', { results: [at], attrs: { off: [...offs][0] } }), op];
+    });
+  }
+}
+
+/** A STRUCT RETURNED THROUGH MEMORY IS SPELLED `local = f(..)`, which hands the callee that local's
+ *  address: the hidden pointer must be a frame object the audit accepted. A global or a pointer
+ *  handed over directly — `gS = f(..)` (agbcc, ido, gcc), IDO's `*p = f(..)`, and the caller's own
+ *  hidden pointer forwarded by `return f(..)` — is another spelling, which nothing here states. A
+ *  merge of frame addresses never reaches here: one that names one address on every path was handed
+ *  that address's `laddr` before the audit (`nameMergedSretObjects`), and a merge of two names no one
+ *  storage, which the audit refuses first (`addressFlow`: `a phi merges the frame objects`). Asked
+ *  of every frontend whose call lowering passes the hidden pointer
+ *  (`CallLowering.memoryReturn`). */
+export function refuseSretOutsideFrame(name: string, irBlocks: readonly Block[], target: TargetDescription): void {
+  const laddrs = new Set(
+    irBlocks.flatMap((b) => b.ops.filter((op) => op.opcode === 'laddr').map((op) => op.results[0])),
+  );
+  for (const op of irBlocks.flatMap((b) => b.ops)) {
+    if (op.opcode === 'call' && op.attrs.sret === true && !laddrs.has(op.operands[0])) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': \`${op.attrs.target as string}\` returns struct ${typeToString(op.results[0].type)} through the pointer in ${target.argRegs[0]}, ` +
+          'and that pointer is not the address of a local of this frame — a struct returned into a global or ' +
+          'through a pointer is not modelled',
+      );
+    }
+  }
+}
+
 /** THE CALLER-SIDE SEAM. A frontend calls the audit THROUGH this record rather than through the
- *  binding above, so a process outside core can put a wrapped `gates` table in front of a real
+ *  `auditFrameObjects` binding, so a process outside core can put a wrapped `gates` table in front of a real
  *  lift (`pnpm bench gates --pass frame-objects`): a module-namespace binding is read-only and
  *  cannot be swapped (`apps/benchmark/src/run/gate-census.ts`, WHAT PUTS A PASS IN THE REGISTRY). */
 export const FRAME_OBJECT_AUDIT: { run: (audit: FrameObjectAudit) => FrameObjectVerdict } = {