Add Chapter 29 for tech debt cleanup with the parser splitmain

Keep Chapter 28b intact and carry the grammar-oriented parser package, Var move, IterPeeps move, and parser regression tests into Chapter 29. Defer privacy and exclude its experimental tests and fixture changes.

Register the chapter in the indexes, IntelliJ modules and run configurations, Maven reactor, roadmap, and linear-history publisher. Windows and Linux each pass 573 tests, release builds, 199 allocation replays, and 29 native checks.

231 files changed, 14626 insertions, 0 deletions

diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/AddNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/AddNode.java
new file mode 100644
index 00000000..a29ba73b
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/AddNode.java
@@ -0,0 +1,179 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.type.*;
+
+public class AddNode extends ArithNode {
+    @Override boolean allowFloat() { return true; }
+    public AddNode(Node lhs, Node rhs) { super(null, lhs, rhs); }
+    public AddNode(Node lhs, Node rhs, byte mode) { super(null, lhs, rhs, mode); }
+    @Override public Tag serialTag() { return Tag.Add; }
+
+    @Override public String label() { return "Add"; }
+    @Override public String op() { return "+"; }
+
+    @Override long   doOp( long  x,  long  y ) { return x + y; }
+    @Override double doOp(double x, double y ) { return x + y; }
+    @Override TypeInteger doOp(TypeInteger x, TypeInteger y) {
+        // Fold ranges like {0-1} + {2-3} into {2-4}.
+        if( !overflow(x._min,y._min) &&
+            !overflow(x._max,y._max) )
+            return TypeInteger.make(x._min+y._min,x._max+y._max);
+        return TypeInteger.BOT;
+    }
+
+    @Override
+    public Node idealize () {
+        // Settle the one-shot arithmetic mode before applying family-specific
+        // algebraic identities.
+        if( _mode==0 )
+            return super.idealize();
+
+        Node lhs = in(1);
+        Node rhs = in(2);
+        if( rhs instanceof AddNode add && add.err()!=null )
+            return null;
+        Type t2 = rhs._type;
+
+        // Add of 0.  We do not check for (0+x) because this will already
+        // canonicalize to (x+0)
+        if( t2 == TypeInteger.ZERO && lhs._type.isa(compute()) )
+            return lhs;
+
+        // Add of same to a multiply by 2
+        if( lhs==rhs && _mode==1 )
+            return new ShlNode(null,lhs,CodeGen.CODE.con(1));
+
+        // Goal: a left-spine set of adds, with constants on the rhs (which then fold).
+
+        // Move non-adds to RHS
+        if( !(lhs instanceof AddNode) && rhs instanceof AddNode )
+            return swap12();
+
+        // x+(-y) becomes x-y
+        if( rhs instanceof MinusNode minus )
+            return new SubNode(lhs,minus.in(1),_mode);
+
+        // Now we might see (add add non) or (add non non) or (add add add) but never (add non add)
+
+        // Do we have  x + (y + z) ?
+        // Swap to    (x + y) + z
+        // Rotate (add add add) to remove the add on RHS
+        if( rhs instanceof AddNode add )
+            return copy(copy(lhs,add.in(1)).peephole(), add.in(2));
+
+        // Now we might see (add add non) or (add non non) but never (add non add) nor (add add add)
+        if( !(lhs instanceof AddNode) ) {
+            // Rotate; look for (add (phi cons) con/(phi cons))
+            if( spine_cmp(lhs,rhs,this) ) return swap12();
+            Node n = phiCon(this,true);
+            return n == null ? super.idealize() : n;
+        }
+
+        // Now we only see (add add non)
+
+        // Dead data cycle; comes about from dead infinite loops.  Do nothing,
+        // the loop will peep as dead after a bit.
+        if( lhs.nIns()>=2 && lhs.in(1) == lhs )
+            return null;
+
+        // Do we have (x + con1) + con2?
+        // Replace with (x + (con1+con2) which then fold the constants
+        // lhs.in(2) is con1 here
+        // If lhs.in(2) is not a constant, we add ourselves as a dependency
+        // because if it later became a constant then we could make this
+        // transformation.
+        if( addDep(lhs.in(2))._type.isConstant() && rhs._type.isConstant() )
+            return copy(lhs.in(1),copy(lhs.in(2),rhs).peephole());
+
+
+        // Do we have ((x + (phi cons)) + con) ?
+        // Do we have ((x + (phi cons)) + (phi cons)) ?
+        // Push constant up through the phi: x + (phi con0+con0 con1+con1...)
+        Node phicon = phiCon(this,true);
+        if( phicon!=null ) return phicon;
+
+        // Now we sort along the spine via rotates, to gather similar things together.
+
+        // Do we rotate (x + y) + z
+        // into         (x + z) + y ?
+        if( spine_cmp(lhs.in(2),rhs,this) )
+            return copy(copy(lhs.in(1),rhs).peephole(),lhs.in(2));
+
+        return super.idealize();
+    }
+
+    // Rotation is only valid for associative ops, e.g. Add, Mul, And, Or, Xor.
+    // Do we have ((phi cons)|(x + (phi cons)) + con|(phi cons)|(op y con)) ?
+    // Push constant up through the phi: x + (phi con0+con0 con1+con1...)
+    static Node phiCon(Node op, boolean rotate) {
+        Node lhs = op.in(1);
+        Node rhs = op.in(2);
+        if( rhs._type==TypeInteger.TOP ) return null;
+        // LHS is either a Phi of constants, or another op with Phi of constants
+        PhiNode lphi = pcon(lhs,op);
+        if( rotate && lphi==null && lhs.nIns() > 2 ) {
+            // Only valid to rotate constants if both are same associative ops
+            if( lhs.getClass() != op.getClass() ) return null;
+            lphi = pcon(lhs.in(2),op); // Will rotate with the Phi push
+        }
+        if( lphi==null ) return null;
+        if( lphi.region().nIns() <=2 ) return null; // Phi is collapsing
+
+        // RHS is a constant or a Phi of constants
+        if( !(rhs instanceof ConstantNode) && pcon(rhs,op)==null )
+            return null;
+
+        // If both are Phis, must be same Region
+        if( rhs instanceof PhiNode && lphi.in(0) != rhs.in(0) )
+            return null;
+
+        // Note that this is the exact reverse of Phi pulling a common op down
+        // to reduce total op-count.  We don't get in an endless push-up
+        // push-down peephole cycle because the constants all fold first.
+        Node[] ns = new Node[lphi.nIns()];
+        ns[0] = lphi.in(0);
+        // Push constant up through the phi: x + (phi con0+con0 con1+con1...)
+        for( int i=1; i<ns.length; i++ )
+            ns[i] = op.copy(lphi.in(i), rhs instanceof PhiNode ? rhs.in(i) : rhs).peephole();
+        String label = lphi._label + (rhs instanceof PhiNode rphi ? rphi._label : "");
+        Node phi = new PhiNode(label,ns).peephole();
+        // Rotate needs another op, otherwise just the phi
+        return lhs==lphi ? phi : op.copy(lhs.in(1),phi);
+    }
+
+    /**
+     * Tests if the op is a phi and has all constant inputs.
+     * If not, returns null.
+     * If op is a phi, but its inputs are not all constants, then dep is added as
+     * a dependency to the phi's non-const input, because if later the input turn into a constant
+     * dep can make progress.
+     */
+    static PhiNode pcon(Node op, Node dep) {
+        return op instanceof PhiNode phi && !(phi instanceof ParmNode) && phi.allCons(dep) ? phi : null;
+    }
+
+    // Compare two off-spine nodes and decide what order they should be in.
+    // Do we rotate ((x + hi) + lo) into ((x + lo) + hi) ?
+    // Generally constants always go right, then Phi-of-constants, then muls, then others.
+    // Ties with in a category sort by node ID.
+    // TRUE if swapping hi and lo.
+    static boolean spine_cmp( Node hi, Node lo, Node dep ) {
+        if( lo._type.isConstant() || lo instanceof ConFldOffNode ) return false;
+        if( hi._type.isConstant() || hi instanceof ConFldOffNode ) return true ;
+
+        if( lo instanceof PhiNode lphi && lphi.region()._type==Type.XCONTROL ) return false;
+        if( hi instanceof PhiNode hphi && hphi.region()._type==Type.XCONTROL ) return false;
+
+        if( lo instanceof PhiNode && lo.allCons(dep) ) return false;
+        if( hi instanceof PhiNode && hi.allCons(dep) ) return true ;
+
+        if( lo instanceof PhiNode && !(hi instanceof PhiNode) ) return true;
+        if( hi instanceof PhiNode && !(lo instanceof PhiNode) ) return false;
+
+        // Same category of "others"
+        return lo._nid > hi._nid;
+    }
+
+    @Override Node copy(Node lhs, Node rhs) { return new AddNode(lhs,rhs,_mode); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/AndNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/AndNode.java
new file mode 100644
index 00000000..a1c6bba1
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/AndNode.java
@@ -0,0 +1,50 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeInteger;
+
+public class AndNode extends ArithNode {
+    public AndNode(Lexer loc, Node lhs, Node rhs) { super(loc, lhs, rhs, (byte)1); }
+    @Override public Tag serialTag() { return Tag.And; }
+
+    @Override public String op() { return "&"; }
+    @Override long doOp( long x, long y ) { return x & y; }
+    @Override TypeInteger doOp(TypeInteger x, TypeInteger y) {
+        // Sharpen allowed bits if either value is narrowed
+        long mask = x.mask() & y.mask();
+        return mask < 0 ? TypeInteger.BOT : TypeInteger.make(0,mask);
+    }
+
+    @Override
+    public Node idealize() {
+        Node lhs = in(1);
+        Node rhs = in(2);
+
+        Type t1 = lhs._type;
+        Type t2 = rhs._type;
+        if( !(t1 instanceof TypeInteger && t2 instanceof TypeInteger t2i) )
+            return null; // Malformed, e.g. (17 & 3.14)
+
+        // And of -1.  We do not check for (-1&x) because this will already
+        // canonicalize to (x&-1).  We do not check for zero, because
+        // the compute() call will return a zero already.
+        if( t2i.isConstant() && t2i.value()==-1 && forceInt(lhs) )
+            return lhs;
+
+        // Move constants to RHS: con*arg becomes arg*con
+        if( t1.isConstant() && !t2.isConstant() )
+            return swap12();
+
+        // Do we have ((x & (phi cons)) & con) ?
+        // Do we have ((x & (phi cons)) & (phi cons)) ?
+        // Push constant up through the phi: x & (phi con0&con0 con1&con1...)
+        Node phicon = AddNode.phiCon(this,true);
+        if( phicon!=null )
+            return phicon;
+
+        return super.idealize();
+    }
+    @Override Node copy(Node lhs, Node rhs) { return new AndNode(_loc,lhs,rhs); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ArithNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ArithNode.java
new file mode 100644
index 00000000..16e9ec8d
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ArithNode.java
@@ -0,0 +1,214 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.BAOS;
+import com.seaofnodes.simple.util.Utils;
+
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+public abstract class ArithNode extends Node implements ModeNode {
+    // Source location for late reported errors
+    Lexer _loc;
+    // Mode is 0 for unknown, 1 for int, 2 for flt
+    byte _mode;
+
+    public ArithNode( Lexer loc, Node lhs, Node rhs) { super(null, lhs, rhs); _loc = loc; }
+    public ArithNode( Lexer loc, Node lhs, Node rhs, byte mode) { this(loc,lhs,rhs); _mode=mode; }
+    @Override public void packed(BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node,Integer> anodes) {
+        baos.packed1(_mode);
+    }
+    abstract String op();
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        return p.open().n(in(1)).p(op()).n(in(2)).close();
+    }
+
+    abstract long doOp(long x, long y);
+    abstract TypeInteger doOp(TypeInteger x, TypeInteger y);
+    double doOp(double x, double y) { throw Utils.TODO(); }
+
+    @Override public byte mode() { return _mode; }
+    @Override public Node setMode(byte mode) {
+        assert _mode==0 && (mode==1 || mode==2);
+        unlock();               // _mode participates in GVN hash and equality
+        _mode = mode;
+        return this;
+    }
+    static byte mode( Type t1, Type t2 ) {
+        if( t1 instanceof TypeFloat   || t2 instanceof TypeFloat   )  return 2;
+        if( t1 instanceof TypeInteger && t2 instanceof TypeInteger )  return 1;
+        if( t1 instanceof TypeMemPtr  && t2 instanceof TypeMemPtr  )  return 1;
+        if( t1 instanceof TypeFunPtr  && t2 instanceof TypeFunPtr  )  return 1;
+        return 0;
+    }
+
+    // Int-only ops, such as &, | and shifts, can collapse to one input.  If
+    // that input, or the live arms of a Phi input, are still mode-polymorphic
+    // ops, settle them before returning the value so the replacement remains
+    // at least as narrow as the int-only op.
+    static boolean forceInt(Node n) {
+        if( n instanceof ModeNode mode && mode.mode()==0 ) {
+            mode.setMode((byte)1);
+            n.setType(n.compute());
+            // Mode changes remove n from GVN even if the caller's remaining
+            // conditions prevent replacing the int-only operation by n.
+            CodeGen.CODE.add(n);
+        }
+        return true;
+    }
+
+    // Check that a settled mode agrees with all data inputs.  Takes the Node
+    // instead of a varargs list both to avoid allocation and to keep this ready
+    // to become shared mode-aware Node behavior later.
+    static Parser.ParseException nodeErr(Node n, Lexer loc, String op, byte mode, boolean allowFloat) {
+        Type bad = null;
+        for( int i=1; i<n.nIns(); i++ ) {
+            Type t = n.in(i)._type;
+            if( t==null )
+                return null;
+            if( t.isHigh() )
+                return null;
+            // A weak input is not evidence of a bad mode while the graph is
+            // still being built.  Loop Phis commonly await their backedge.
+            if( CodeGen.CODE._phase.ordinal() < CodeGen.Phase.Opto.ordinal() && t == Type.BOTTOM )
+                return null;
+            bad = switch( t ) {
+            case TypeInteger ti -> mode==1 ? null : t;
+            case TypeMemPtr  ti -> mode==1 ? null : t;
+            case TypeFunPtr  ti -> mode==1 ? null : t;
+            case TypeFloat   tf -> mode==2 ? null : t;
+            default -> t;
+            };
+            if( bad != null ) break;
+        }
+        boolean unsupportedFloat = false;
+        if( !allowFloat )
+            for( int i=1; i<n.nIns(); i++ )
+                if( n.in(i)._type instanceof TypeFloat ) {
+                    bad = n.in(i)._type;
+                    unsupportedFloat = true;
+                    break;
+                }
+        if( bad == null )
+            return null;
+        if( unsupportedFloat || n instanceof BoolNode )
+            return Parser.error("Cannot '"+op+"' "+bad,loc);
+        if( n.nIns()==3 )
+            return Parser.error("Cannot "+n.in(1)._type+" "+op+" "+n.in(2)._type,loc);
+        return Parser.error("Cannot '"+op+"' "+bad,loc);
+    }
+
+    // Arithmetic subclasses which have a floating-point interpretation override.
+    boolean allowFloat() { return false; }
+
+    // Generic arithmetic op math: high returns high; low returns low; 2
+    // constants fold; only 2 non-constants call specialized math.
+    @Override
+    public final Type compute() {
+        Type t1 = in(1)._type, t2 = in(2)._type;
+        // Constant array payloads lie below their element ranges in the lattice.
+        if( t1 instanceof TypeConAry ary ) t1 = ary.elem();
+        if( t2 instanceof TypeConAry ary ) t2 = ary.elem();
+        if( t1==null || t2==null )        return Type.TOP;
+        if( t1.isHigh() || t2.isHigh() )  return Type.TOP;
+        // Without numeric inputs, stay below both possible result families.
+        // Pointer modes belong to comparisons, not arithmetic.
+        if( !(t1 instanceof TypeInteger || t1 instanceof TypeFloat) ||
+            !(t2 instanceof TypeInteger || t2 instanceof TypeFloat) ) return Type.BOTTOM;
+        byte mode = _mode==0 ? mode(t1,t2) : _mode;
+        if( mode==1 ) {
+            if( t1 instanceof TypeInteger x &&
+                t2 instanceof TypeInteger y )
+                return x.isConstant() && y.isConstant()
+                    ? con(x,y)
+                    : doOp(x,y).makeWide( (byte)Math.max(x._widen,y._widen) );
+            return TypeInteger.BOT;
+        }
+        // FP handling
+        if( t1 instanceof TypeFloat f1 && t2 instanceof TypeFloat f2 &&
+            f1.isConstant() && f2.isConstant() )
+            return TypeFloat.constant(doOp(f1.value(),f2.value()));
+        // Two f32 inputs can still produce a result needing f64 precision.
+        return TypeFloat.F64;
+    }
+
+    private TypeInteger con( Type t1, Type t2 ) {
+        return TypeInteger.constant( doOp( ((TypeInteger)t1).value(), ((TypeInteger)t2).value()) );
+    }
+
+    // Check for "op(Phi(con,x),Phi(con,y))" and push-up through the Phi.
+    // Note that this is the exact reverse of Phi pulling a common op down
+    // to reduce total op-count.  We don't get in an endless push-up
+    // push-down peephole cycle because the constants all fold first.
+    // Returns "Phi(op(con,con),op(x,y))".
+
+    // Expected to be called after other ideal checks are done.
+    @Override public Node idealize() {
+        Type t1 = in(1)._type, t2 = in(2)._type;
+
+        // Can we decide int vs flt?
+        if( _mode==0 ) {
+            byte mode = mode(t1,t2);
+            if( mode!=0 ) return setMode(mode).init();
+        }
+        if( _mode==2 ) {
+            if( t1 instanceof TypeInteger ) return copy(new ToFloatNode(in(1)).peephole(),in(2));
+            if( t2 instanceof TypeInteger ) return copy(in(1),new ToFloatNode(in(2)).peephole());
+        }
+
+        if( in(1) instanceof PhiNode lhs &&
+            in(2) instanceof PhiNode rhs &&
+            lhs.nIns() >= 2 && !lhs.inProgress() &&
+            // Disallow with self-looping phi; these will collapse
+            (lhs.nIns() > 2 && lhs.in(2)!=lhs && rhs.nIns() > 2 && rhs.in(2)!=rhs) ) {
+            Node r = lhs.region();
+            if( r==rhs.region() && !(r instanceof FunNode) &&
+                // For loops, the backedge *must* fold away, lest we unroll forever
+                (!(r instanceof LoopNode) || isCon(lhs,rhs,2)) ) {
+                // Profit check: only 1 instance of `this` will remain, all the
+                // others will fold to constants.  For loops, *all* must fold away
+                int cnt=0;
+                for( int i=1; i<lhs.nIns(); i++ )
+                    if( isCon(lhs,rhs,i) )
+                        cnt++;
+                if( lhs.nIns()-1 - cnt <= 1 ) {
+                    // Profit!  Push up-phi and fold
+                    Node[] ns = new Node[lhs.nIns()];
+                    ns[0] = lhs.in(0);
+                    for( int i=1; i<lhs.nIns(); i++ ) {
+                        ns[i] = isCon(lhs,rhs,i)
+                            ? ConstantNode.make(con(lhs.in(i)._type, rhs.in(i)._type)).peephole()
+                            : copy(lhs.in(i), rhs.in(i)).peephole();
+                    }
+                    String label = lhs._label==rhs._label ? lhs._label : lhs._label + rhs._label;
+                    return new PhiNode(label, ns).peephole();
+                }
+            }
+        }
+
+        return null;
+    }
+
+    static boolean isCon( PhiNode lhs, PhiNode rhs, int i ) {
+        return lhs.in(i)._type.isConstant() && rhs.in(i)._type.isConstant();
+    }
+
+
+    static boolean overflow( long x, long y ) {
+        if(    (x ^    y   ) < 0 ) return false; // unequal signs, never overflow
+        return (x ^ (x + y)) < 0; // sum has unequal signs, so overflow
+    }
+
+    @Override public Parser.ParseException err() {
+        return nodeErr(this,_loc,op(),_mode,allowFloat());
+    }
+
+    @Override public boolean eq( Node n ) { return _mode==((ArithNode)n)._mode; }
+    @Override public int hash() { return _mode; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/BoolNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/BoolNode.java
new file mode 100644
index 00000000..02d3e22e
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/BoolNode.java
@@ -0,0 +1,191 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.BAOS;
+import com.seaofnodes.simple.util.Utils;
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+import static com.seaofnodes.simple.type.TypeInteger.*;
+
+abstract public class BoolNode extends Node implements ModeNode {
+
+    // Mode is 0 for unknown, 1 for int, 2 for flt
+    byte _mode;
+
+    public BoolNode(Node lhs, Node rhs) { super(null, lhs, rhs); }
+    public BoolNode(Node lhs, Node rhs, byte mode) { super(null, lhs, rhs); _mode = mode; }
+    @Override public void packed(BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node,Integer> anodes) {
+        baos.packed1(_mode);
+    }
+
+    abstract public String op(); // String opcode name
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        return p.open().n(in(1)).p(op()).n(in(2)).close();
+    }
+
+    @Override
+    public TypeInteger compute() {
+        Type t1 = in(1)._type;
+        Type t2 = in(2)._type;
+        if( t1==null || t2==null )
+            return BOOL;
+        // Exactly equals?
+        if( t1.isHigh() || t2.isHigh() )
+            return (TypeInteger)BOOL.dual();
+        if( in(1)==in(2) )
+            // LT fails, both EQ and LE succeed
+            return this instanceof LT ? FALSE : TRUE;
+        byte mode = _mode==0 ? ArithNode.mode(t1,t2) : _mode;
+        if( mode==0 )
+            return BOOL;
+        // Handle integer compares
+        if( mode==1 ) {
+            if( t1 instanceof TypeInteger i1 &&
+                t2 instanceof TypeInteger i2 )
+                return doOp(i1,i2);
+            return BOOL;
+        }
+        // Floating compare.  Mixed inputs are converted in idealize().
+        if( t1 instanceof TypeFloat f1 &&
+            t2 instanceof TypeFloat f2 &&
+            f1.isConstant() && f2.isConstant() )
+            return doOp(f1.value(), f2.value()) ? TRUE : FALSE;
+        return BOOL;
+    }
+
+    TypeInteger doOp(TypeInteger t1, TypeInteger t2) { throw Utils.TODO(); }
+    boolean doOp(double lhs, double rhs) { throw Utils.TODO(); }
+    public boolean isFloat() { assert _mode!=0; return _mode==2; }
+    @Override public byte mode() { return _mode; }
+    @Override public Node setMode(byte mode) {
+        assert _mode==0 && (mode==1 || mode==2);
+        unlock();               // _mode participates in GVN hash and equality
+        _mode = mode;
+        return this;
+    }
+
+    @Override
+    public Node idealize() {
+        // Compare of same
+        if( in(1)==in(2) )
+            return this instanceof LT ? CodeGen.CODE.ZERO : ConstantNode.make(TRUE);
+        // Can we decide int vs flt?
+        Type t1 = in(1)._type, t2 = in(2)._type;
+        if( t1==null || t2==null )
+            return null;
+        if( _mode==0 ) {
+            byte mode = ArithNode.mode(t1,t2);
+            if( mode!=0 ) return setMode(mode).init();
+        }
+        if( _mode==2 ) {
+            if( t1 instanceof TypeInteger ) return copy(new ToFloatNode(in(1)).peephole(),in(2));
+            if( t2 instanceof TypeInteger ) return copy(in(1),new ToFloatNode(in(2)).peephole());
+        }
+
+
+        // Equals pushes constant to the right; 5==X becomes X==5.
+        if( this instanceof EQ ) {
+            if( !(in(2) instanceof ConstantNode) ) {
+                // con==noncon becomes noncon==con
+                if( in(1) instanceof ConstantNode || in(1)._nid > in(2)._nid )
+                    // Equals sorts by NID otherwise: non.high == non.low becomes non.low == non.high
+                    return new EQ(in(2),in(1));
+            }
+            // Equals X==0 becomes a !X
+            if( (in(2)._type == ZERO || in(2)._type == Type.NIL) )
+                return new NotNode(in(1));
+        }
+
+        // Do we have ((phi cons) cmp con) ?
+        // Do we have ((phi cons) cmp (phi cons)) ?
+        // Push the compare up through the phi: (phi con0 cmp con, con1 cmp con...)
+        Node phicon = AddNode.phiCon(this,this instanceof EQ);
+        if( phicon!=null ) return phicon;
+
+        return null;
+    }
+
+    @Override public boolean eq( Node n ) { return _mode==((BoolNode)n)._mode; }
+    @Override public int hash() { return _mode; }
+    @Override public Parser.ParseException err() {
+        return ArithNode.nodeErr(this,null,op(),_mode,!(this instanceof ULT));
+    }
+
+    public static class EQ extends BoolNode {
+        public EQ(Node lhs, Node rhs) { super(lhs,rhs); }
+        public EQ(Node lhs, Node rhs, byte mode) { super(lhs,rhs, mode); }
+        @Override public Tag serialTag() { return Tag.EQ; }
+        public String op() { return "=="; }
+        TypeInteger doOp(TypeInteger i1, TypeInteger i2) {
+            if( i1==i2 && i1.isConstant() ) return TRUE;
+            if( i1._max < i2._min || i1._min > i2._max ) return FALSE;
+            return BOOL;
+        }
+        @Override boolean doOp(double lhs, double rhs) { return lhs==rhs; }
+        Node copy(Node lhs, Node rhs) { return new EQ(lhs,rhs,_mode); }
+    }
+
+    public static class NE extends BoolNode {
+        public NE(Node lhs, Node rhs) { super(lhs,rhs); }
+        public NE(Node lhs, Node rhs, byte mode) { super(lhs,rhs,mode); }
+        @Override public Tag serialTag() { return Tag.NE; }
+        public String op() { return "!="; }
+        TypeInteger doOp(TypeInteger i1, TypeInteger i2) {
+            if( i1==i2 && i1.isConstant() ) return TRUE;
+            if( i1._max < i2._min || i1._min > i2._max ) return FALSE;
+            return BOOL;
+        }
+        @Override boolean doOp(double lhs, double rhs) { return lhs!=rhs; }
+        Node copy(Node lhs, Node rhs) { return new NE(lhs,rhs,_mode); }
+    }
+
+    public static class LT extends BoolNode {
+        public LT(Node lhs, Node rhs) { super(lhs,rhs); }
+        public LT(Node lhs, Node rhs, byte mode) { super(lhs,rhs, mode); }
+        @Override public Tag serialTag() { return Tag.LT; }
+        public String op() { return "<" ; }
+        TypeInteger doOp(TypeInteger i1, TypeInteger i2) {
+            if( i1._max <  i2._min ) return TRUE;
+            if( i1._min >= i2._max ) return FALSE;
+            return BOOL;
+        }
+        @Override boolean doOp(double lhs, double rhs) { return lhs<rhs; }
+        Node copy(Node lhs, Node rhs) { return new LT(lhs,rhs,_mode); }
+    }
+
+    public static class LE extends BoolNode {
+        public LE(Node lhs, Node rhs) { super(lhs,rhs); }
+        public LE(Node lhs, Node rhs, byte mode) { super(lhs,rhs,mode); }
+        @Override public Tag serialTag() { return Tag.LE; }
+        public String op() { return "<="; }
+        TypeInteger doOp(TypeInteger i1, TypeInteger i2) {
+            if( i1._max <= i2._min ) return TRUE;
+            if( i1._min >  i2._max ) return FALSE;
+            return BOOL;
+        }
+        @Override boolean doOp(double lhs, double rhs) { return lhs<=rhs; }
+        Node copy(Node lhs, Node rhs) { return new LE(lhs,rhs,_mode); }
+    }
+
+    // Unsigned less that, for range checks.  Not directly user writable.
+    public static class ULT extends BoolNode {
+        public ULT(Node lhs, Node rhs) { super(lhs,rhs,(byte)1); }
+        public ULT(Node lhs, Node rhs, byte mode) {
+            super(lhs,rhs,(byte)1);
+            assert mode==1;
+        }
+        @Override public Tag serialTag() { return Tag.ULT; }
+        public String op() { return "u<" ; }
+        TypeInteger doOp(TypeInteger i1, TypeInteger i2) {
+            if( Long.compareUnsigned(i1._max,i2._min) <  0 ) return TRUE;
+            if( Long.compareUnsigned(i1._min,i2._max) >= 0 ) return FALSE;
+            return BOOL;
+        }
+        Node copy(Node lhs, Node rhs) { return new ULT(lhs,rhs); }
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/BulkMemPhiNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/BulkMemPhiNode.java
new file mode 100644
index 00000000..6a902f3c
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/BulkMemPhiNode.java
@@ -0,0 +1,303 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.GlobalBits;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeMem;
+import com.seaofnodes.simple.type.XInt;
+import com.seaofnodes.simple.util.BAOS;
+import com.seaofnodes.simple.util.Utils;
+
+import java.util.BitSet;
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+/**
+ * A Phi for bulk memory.  It covers all aliases except {@link #_aliases};
+ * those aliases must be represented by parallel precise MemPhis at the same
+ * program slice.
+ */
+public class BulkMemPhiNode extends PhiNode {
+
+    private static final BitSet EMPTY = new BitSet();
+
+    // Excluded Aliases; empty means NO exclusions.
+    // Directly visible by design.  Empty sets share EMPTY; splitAlias performs
+    // copy-on-first-write and removes the node from GVN before mutation.
+    public BitSet _aliases;
+
+    public BulkMemPhiNode(String label, Node... inputs) {
+        this(label,EMPTY,inputs);
+    }
+
+    private BulkMemPhiNode(String label, BitSet aliases, Node... inputs) {
+        super(label, inputs);
+        _aliases = aliases;
+    }
+
+    public BulkMemPhiNode(BulkMemPhiNode phi) {
+        super(phi,phi._label);
+        _aliases = phi._aliases.isEmpty() ? EMPTY : (BitSet)phi._aliases.clone();
+    }
+
+    public BulkMemPhiNode(RegionNode r, Node sample) {
+        super(r,sample);
+        _aliases = EMPTY;
+    }
+
+    public boolean isSplit(int alias) { return _aliases.get(alias); }
+
+    @Override public Tag serialTag() { return Tag.BulkMemPhi; }
+
+    @Override
+    public void packed(BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types,
+                       IdentityHashMap<Node,Integer> anodes) {
+        super.packed(baos,strs,types,anodes);
+        baos.packed2(_aliases.cardinality());
+        for( int alias = _aliases.nextSetBit(0); alias >= 0; alias = _aliases.nextSetBit(alias+1) )
+            baos.packed2(alias);
+    }
+
+    static Node make(BAOS bais, String[] strs, Type[] types, GlobalBits fileAliases, GlobalBits aliases) {
+        Node[] ins = new Node[bais.packed1()];
+        String label = strs[bais.packed2()];
+        BitSet bits = new BitSet();
+        for( int i=bais.packed2(); i>0; i-- ) {
+            int alias = bais.packed2();
+            if( alias >= GlobalBits.RESERVED ) alias = aliases.map(fileAliases,alias);
+            bits.set(alias);
+        }
+        return new BulkMemPhiNode(label,bits.isEmpty() ? EMPTY : bits,ins);
+    }
+
+    @Override
+    public Type compute() {
+        Type t = super.compute();
+        return t instanceof TypeMem mem ? mem :
+            t==Type.BOTTOM ? TypeMem.BOT :
+            TypeMem.TOP;
+    }
+
+    @Override
+    public Node idealize() {
+        Node progress = super.idealize();
+        if( progress != null ) return progress;
+        if( ((RegionNode)region()).inProgress() || region().nIns()<=1 )
+            return null;        // Input is in-progress
+
+        // "Peek through" a MemMerge that covers this alias set on its default
+        for( int i=1; i<nIns(); i++ )
+            if( in(i) instanceof MemMergeNode mmm && canPeek(mmm) ) {
+                setDef(i,mmm.in(1));
+                return this;
+            }
+
+        // If any input or output uses or defines a specific alias we cover,
+        // make a private MemPhi for it, and add it to the excluded list.
+        for( int i=1; i<nIns(); i++ ) {
+            int alias = inputAlias(in(i));
+            if( alias!=0 )
+                return slice(alias);
+        }
+
+        for( int i=0; i<nOuts(); i++ ) {
+            int alias = outputAlias(out(i));
+            if( alias!=0 )
+                return slice(alias);
+        }
+
+        return null;
+    }
+
+    static public boolean checkMem(Node n, int alias) {
+        for( Node m : n._inputs )
+            // Bulk memory supplies this alias
+            if( m instanceof BulkMemPhiNode bulk ) {
+                if( bulk._aliases.get(alias) )
+                    return false;
+            } else if( m instanceof MemMergeNode mmm &&
+                       mmm.in(1) instanceof BulkMemPhiNode bulk &&
+                       bulk._aliases.get(alias) &&
+                       (alias >= mmm.nIns() || mmm.in(alias)==null) )
+                return false;
+        return true;
+    }
+
+
+    // True if the MemMerge has no precise slice still covered by this Phi.
+    private boolean canPeek(MemMergeNode mmm) {
+        return missingAlias(mmm)==0;
+    }
+
+    // Return an alias required by an input but still covered by this Phi, or 0.
+    private int inputAlias(Node n) {
+        return switch(n) {
+        case ParmNode p -> { assert p._idx==1; yield 0; }
+        case ProjNode proj -> 0;
+        case ConstantNode con -> {
+            assert !(con._con instanceof TypeMem tmem && tmem._alias != 1);
+            yield 0;
+        }
+        case MemMergeNode mmm -> missingAlias(mmm);
+        case MemOpNode mem -> unsplit(mem._alias);
+        case BulkMemPhiNode bulk -> missingAlias(bulk);
+        default -> throw Utils.TODO("Should not reach here");
+        };
+    }
+
+    // Return an alias required by a user but still covered by this Phi, or 0.
+    private int outputAlias(Node use) {
+        // This decision depends backwards on an immediate user's alias/set.
+        // Normal graph-neighbor enqueueing flows from defs to uses, so retain
+        // an explicit forward dependency to revisit this Phi when the user
+        // sharpens.
+        use = addDepForwards(use);
+        return switch(use) {
+        case ScopeNode scope -> 0;
+        case ParmNode parm -> 0;
+        case MemMergeNode mmm -> missingAlias(mmm);
+        case BulkMemPhiNode bulk -> missingAlias(bulk);
+        case MemOpNode mem -> unsplit(mem._alias);
+        case MemPhiNode phi -> unsplit(phi._alias);
+        case EscapeNode esc -> esc.pub()==this ? unsplit(esc.fld()._alias) : 0;
+        default -> {
+            assert use instanceof ReturnNode || use instanceof CallNode || use instanceof CLInitNode
+                : "Unexpected bulk-memory user "+use.getClass().getSimpleName()+"#"+use._nid+": "+use;
+            yield 0;
+        }
+        };
+    }
+
+    // Alias zero/one is bulk, and an already excluded precise alias cannot
+    // trigger another split of this Phi.
+    private int unsplit(int alias) {
+        if( alias <= 1 ) return 0;
+        assert !_aliases.get(alias);
+        return alias;
+    }
+
+    // First alias excluded by the neighboring bulk Phi but not by this one.
+    private int missingAlias(BulkMemPhiNode bulk) {
+        for( int alias = bulk._aliases.nextSetBit(0); alias >= 0; alias = bulk._aliases.nextSetBit(alias+1) )
+            if( !_aliases.get(alias) )
+                return alias;
+        return 0;
+    }
+
+    // First explicit MemMerge slice still covered by this Phi. A user's slice
+    // may point to this Phi after a precise Phi folds; splitting is still valid.
+    private int missingAlias( MemMergeNode mmm ) {
+        for( int alias=2; alias<mmm.nIns(); alias++ )
+            if( mmm.in(alias)!=null &&
+                mmm.alias(alias)!=mmm.in(1) &&
+                !_aliases.get(alias) )
+                return alias;
+        return 0;
+    }
+
+    // Slice out given alias
+    private MemMergeNode slice( int alias ) {
+        assert !_aliases.get(alias);
+        // Inputs are the same; MemPhi will sharpen his own inputs.  If a
+        // parallel precise Phi already exists, reuse it instead of building a
+        // duplicate for the same Region/alias pair.
+        Node mem = precisePhi(alias);
+        assert ((TypeMem)mem._type)._alias==alias;
+        // A parallel Phi may still be waiting for its inputs' type changes.
+        // Do not replace this memory with slices carrying weaker escape facts.
+        if( !readySlice(mem) ) return null;
+        for( int old = _aliases.nextSetBit(0); old>=0; old = _aliases.nextSetBit(old+1) ) {
+            Node prior = precisePhi(old);
+            if( !readySlice(prior) ) return null;
+        }
+
+        BitSet aliases = ((BitSet)_aliases.clone());
+        aliases.set(alias);
+        BulkMemPhiNode bphi = new BulkMemPhiNode(_label,aliases);
+        for( int i=0; i<nIns(); i++ )
+            bphi.addDef(in(i));
+        // Installing bphi creates a new bulk user with a different exclusion
+        // set.  Queue the original memory inputs before bphi itself can peep
+        // away and hide those neighbor relationships.
+        for( int i=1; i<bphi.nIns(); i++ )
+            CodeGen.CODE.add(bphi.in(i));
+        // Do not peephole bphi here, as BulkMemPhi can recursively start a
+        // second bulk rewrite before this one has finished.  Let the worklist
+        // discover any further splits
+        Node bulk = bphi.init();
+        CodeGen.CODE.add(bulk);
+        CodeGen.CODE.add(mem);
+        return aggregate(bulk,alias,mem);
+    }
+
+    private boolean readySlice(Node precise) {
+        TypeMem mem = (TypeMem)_type;
+        TypeMem part = (TypeMem)precise._type;
+        if( !XInt.bit(mem._escAs,part._alias) || mem.meet(part).isa(mem) ) return true;
+        precise.setType(precise.compute());
+        if( mem.meet(precise._type).isa(mem) ) return true;
+        addDep(precise);
+        return false;
+    }
+
+    // Build aggregate memory over a bulk Phi, preserving every precise slice
+    // which the bulk has already excluded.  The named alias is newly supplied
+    // (or replaces its old slice).
+    MemMergeNode aggregate(Node bulk, int alias, Node precise) {
+        MemMergeNode mmm = new MemMergeNode(null,bulk);
+        for( int old = _aliases.nextSetBit(0); old >= 0; old = _aliases.nextSetBit(old+1) )
+            { assert old != alias; mmm.alias(old,precisePhi(old));}
+        mmm.alias(alias,precise);
+        assert checkMerge(mmm);
+        mmm.init();
+        return mmm;
+    }
+
+    // Find or make the precise Phi parallel to this bulk Phi at the same merge.
+    private Node precisePhi(int alias) {
+        MemPhiNode mphi = _findPhi(alias);
+        if( mphi!=null ) return mphi;
+
+        mphi = new MemPhiNode("$"+alias,alias);
+        mphi.addDef(region());
+        // Due to cycles, must set before calling peephole
+        // Splitting preserves the bulk Phi's established escape bound. Starting
+        // at BOT would temporarily invent escapes when the new slice is merged.
+        TypeMem old = (TypeMem)_type;
+        mphi.setType(TypeMem.make(alias,old._t,old._one,old._clz,false,old._escFs,old._escAs));
+        for( int i=1; i<nIns(); i++ )
+            mphi.addDef(CodeGen.CODE.add(preciseInput(in(i),alias)));
+        return CodeGen.CODE.add(mphi);
+    }
+
+    MemPhiNode _findPhi(int alias) {
+        for( Node use : region().outs() )
+            if( use instanceof MemPhiNode mphi && mphi._alias==alias )
+                return mphi;
+        return null;
+    }
+
+    // Select an alias already split out of a predecessor's bulk memory.
+    private Node preciseInput(Node mem, int alias) {
+        if( mem instanceof MemMergeNode mmm )
+            return mmm.alias(alias);
+        if( mem instanceof BulkMemPhiNode bulk && bulk.isSplit(alias) )
+            return bulk.precisePhi(alias);
+        return mem;
+    }
+
+    // Every alias excluded by a bulk default must be supplied explicitly.
+    static boolean checkMerge(MemMergeNode mmm) {
+        if( !(mmm.in(1) instanceof BulkMemPhiNode bulk) ) return true;
+        for( int alias = bulk._aliases.nextSetBit(0); alias >= 0; alias = bulk._aliases.nextSetBit(alias+1) )
+            if( alias >= mmm.nIns() || mmm.in(alias)==null )
+                return false;
+        return true;
+    }
+
+    @Override public boolean eq(Node n) {
+        return _aliases.equals(((BulkMemPhiNode)n)._aliases) && super.eq(n);
+    }
+
+    @Override int hash() { return _aliases.hashCode(); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/CFGNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/CFGNode.java
new file mode 100644
index 00000000..ba744dc3
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/CFGNode.java
@@ -0,0 +1,310 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.Ary;
+
+import java.util.BitSet;
+import java.util.IdentityHashMap;
+
+/** Control Flow Graph Nodes
+ * <p>
+ *  CFG nodes have a immediate dominator depth (idepth) and a loop nesting
+ *  depth(loop_depth).
+ * <p>
+ *  idepth is computed lazily upon first request, and is valid even in the
+ *  Parser, and is used by peepholes during parsing and afterward.
+ * <p>
+ *  loop_depth is computed after optimization as part of scheduling.
+ *
+ *  Start - Block head; has constants and trailing Funs
+ *  Region - Block head; has Phis.  Includes Fun and Parms.
+ *  CallEnd - Block head; followed by CProj and Proj; also linked RPC Parms
+ *  CProj - Block head
+ *
+ *  If - Block tail; followed by CProj same block
+ *  Call - Block tail; followed by CallEnd and linked Funs
+ *  New/intrinsic - If followed by CProj: block tail else mid-block; followed by Proj
+ *
+ */
+public abstract class CFGNode extends Node {
+
+    public CFGNode(Node...   nodes) { super(nodes); }
+    public CFGNode(CFGNode cfg) {
+        super(cfg);
+        if( cfg != null ) {
+            _idepth = cfg._idepth;
+            _idepthVersion = cfg._idepthVersion;
+            _ltree = cfg._ltree;
+            _pre = cfg._pre;
+        }
+    }
+
+    public CFGNode cfg(int idx) { return (CFGNode)in(idx); }
+
+    // Block head is Start, Region, CProj, but not e.g. If, Return, Stop
+    public boolean blockHead() { return false; }
+
+    // Get the one control following; error to call with more than one e.g. an
+    // IfNode or other multi-way branch.
+    public CFGNode uctrl() {
+        CFGNode c = null;
+        for( Node n : _outputs )
+            if( n instanceof CFGNode cfg )
+                {  assert c==null;  c = cfg; }
+        return c;
+    }
+
+    // Used by the encoding / final BB layout
+    public CFGNode uctrlSkipEmpty() {
+        CFGNode x = this, y;
+        while( x.nOuts() == 1 && (y=x.uctrl())!=null && !(y instanceof CallNode) ) // Skip empty blocks
+            x = y;
+        return x;
+    }
+
+    // ------------------------------------------------------------------------
+    /**
+     * Immediate dominator tree depth, used to approximate a real IDOM during
+     * parsing where we do not have the whole program, and also peepholes
+     * change the CFG incrementally.
+     * <p>
+     * See {@link <a href="https://en.wikipedia.org/wiki/Dominator_(graph_theory)">...</a>}
+     */
+    public char _idepth;
+    public char _idepthVersion;
+    public int idepth() { return validIDepth() ? _idepth : cacheIDepth(idom().idepth()+1); }
+    // Zero depth means uncached. Check before narrowing so overflow cannot wrap.
+    final int cacheIDepth(int depth) {
+        assert 0 <= depth && depth <= Character.MAX_VALUE : "Dominator depth exceeds 65535";
+        _idepthVersion = CodeGen.CODE.iDepthVersion();
+        return _idepth = (char)depth;
+    }
+
+    final boolean validIDepth() { return _idepth!=0 && _idepthVersion==CodeGen.CODE.iDepthVersion(); }
+
+
+    // Return the immediate dominator of this Node and compute dom tree depth.
+    public CFGNode idom(Node dep) { return cfg(0); }
+    public final CFGNode idom() { return idom(null); }
+
+    // Return the LCA of two idoms
+    public CFGNode domLCA(CFGNode rhs, Node dep) {
+        if( rhs==null ) return this;
+        CFGNode lhs = this;
+        while( lhs != rhs ) {
+            if( lhs==null || rhs==null ) return null;
+            int comp = lhs.idepth() - rhs.idepth();
+            if( comp >= 0 ) lhs = (dep==null ? lhs : dep.addDep(lhs)).idom();
+            if( comp <= 0 ) rhs = (dep==null ? rhs : dep.addDep(rhs)).idom();
+        }
+        return lhs;
+    }
+
+    // Safe read of the control input of a data node.
+    public static CFGNode safeCFG(Node n) {
+        if( n==null ) return null;
+        if( !(n.in(0) instanceof CFGNode cfg) ) return null;
+        return cfg._safeCFG();
+    }
+    private CFGNode _safeCFG() {
+        return switch(this) {
+        case CLInitNode init when init.bypass() -> init.cfg0()._safeCFG();
+        case CallNode call when call.cend()._folding -> call.cfg0()._safeCFG();
+        case CallEndNode cend when cend._folding -> cend.cfg(1)._safeCFG();
+        case FunNode fun when fun._folding -> fun.cfg(1)._safeCFG();
+        case ReturnNode ret when ret.fun()._folding -> ret.cfg0()._safeCFG();
+        default -> this;
+        };
+    }
+
+    // True when this node dominates `sub` in the current idom tree.
+    public boolean dominates(CFGNode sub, Node dep) {
+        for( CFGNode cfg=sub; cfg!=null; cfg=cfg.idom() )
+            if( cfg == this )
+                return true;
+            else if( dep != null ) dep.addDep(cfg);
+        return false;
+    }
+
+    public static CFGNode deepest(CFGNode a, CFGNode b) {
+        if( a == null ) return b;
+        if( b == null ) return a;
+        return b.idepth() > a.idepth() ? b : a;
+    }
+
+    public static CFGNode earlyCFG(Node n) {
+        return earlyCFG(n,new IdentityHashMap<>(),new BitSet());
+    }
+
+    public static CFGNode earlyCFG(Node n, IdentityHashMap<Node,CFGNode> cache, BitSet active) {
+        if( n == null ) return null;
+        CFGNode cached = cache.get(n);
+        if( cached != null ) return cached;
+        if( active.get(n._nid) )
+            return safeCFG(n);
+        active.set(n._nid);
+        CFGNode early = null;
+        for( Node x : n._inputs )
+            early = deepest(early,defCFG(x,cache,active));
+        active.clear(n._nid);
+        cache.put(n,early);
+        return early;
+    }
+
+    private static CFGNode defCFG(Node n, IdentityHashMap<Node,CFGNode> cache, BitSet active) {
+        if( n == null || n.isConst() )  return null; // no impact on early cfg
+        return switch( n ) {
+        case PhiNode phi -> phi.region();
+        case CFGNode cfg -> cfg;
+        case ProjNode projNode -> safeCFG( n );
+        default -> earlyCFG( n, cache, active );
+        };
+    }
+
+    public boolean sameFun(CFGNode that) {
+        FunNode fun = fun();
+        return fun != null && fun == that.fun();
+    }
+
+    // Find nearest enclosing FunNode
+    public FunNode fun() {
+        CFGNode cfg = this;
+        while( !(cfg instanceof FunNode fun) ) {
+            if( cfg==null ) return null;
+            cfg = cfg.idom();
+        }
+        return fun;
+    }
+
+    // ------------------------------------------------------------------------
+    // Loop nesting
+    public LoopNode loop() { return _ltree._head; }
+    public int loopDepth() { return _ltree==null ? 0 : _ltree.depth(); }
+
+    public LoopTree _ltree;
+    public int _pre;            // Pre-order numbers for loop tree finding
+    public static class LoopTree {
+        public LoopTree _par;
+        public final LoopNode _head;
+        public int _depth;
+        LoopTree(LoopNode head) { _head = head; }
+        @Override public String toString() { return label(_head); }
+        public int depth() {
+            return _depth==0 ? (_par==null ? 0 : (_depth = _par.depth()+1)) : _depth;
+        }
+    }
+
+    // ------------------------------------------------------------------------
+    // Tag all CFG Nodes with their containing LoopNode; LoopNodes themselves
+    // also refer to *their* containing LoopNode, as well as have their depth.
+    // Start contains the function bodies at depth 0; real loops add depth.
+    public void buildLoopTree( Ary<FunNode> funs, StopNode stop) {
+        _ltree = stop._ltree = CodeGen.CODE.XCTRL._ltree = new LoopTree((StartNode)this);
+        Ary<FunNode> work = new Ary<>(FunNode.class);
+
+        BitSet post = CodeGen.CODE.visit();
+        int pre = 1;
+        _pre = pre++;
+        for( FunNode fun : funs ) {
+            // Summaries have no executable CFG. Their loop trees are built
+            // only if Eval2 later loads the corresponding bodies.
+            if( fun!=null && !fun.isDead() && !fun._type.isHigh() && fun.summary()==null ) {
+                work.push(fun);
+                if(fun.in(1) instanceof StartCUNode start && start._pre==0 ) {
+                    start._pre = pre++;
+                    start._ltree = start.cfg(1)._ltree = _ltree;
+                    post.set(start._nid);
+                }
+            };
+        }
+
+        for( int i=0; i<work._len; i++ )
+            pre = work.at(i)._bltWalk(pre,work.at(i),stop, post, work);
+        post.clear();
+    }
+
+    int _bltWalk( int pre, FunNode fun, StopNode stop, BitSet post, Ary<FunNode> work ) {
+        // Pre-walked?
+        if( _pre!=0 ) return pre;
+        _pre = pre++;
+        // Seed the function's outer tree before walking its body.  Synthetic
+        // exits can be added before the post-order walk reaches the entry.
+        if( this instanceof FunNode ) _ltree = stop._ltree;
+        if( this instanceof ReturnNode ) {
+            _ltree = fun._ltree;
+            post.set(_nid);
+            return pre; // Stop/Start links describe the outside world, not a loop.
+        }
+        // Pre-walk
+        for( Node use : _outputs )
+            if( use instanceof CFGNode usecfg ) {
+                if( skip( usecfg ) ) {
+                    if( usecfg._pre==0 && usecfg instanceof FunNode fun2 && fun2.summary()==null ) work.add( fun2 );
+                } else
+                    pre = usecfg._bltWalk( pre, use instanceof FunNode fuse ? fuse : fun, stop, post, work );
+            }
+
+        // Post-order work: find innermost loop
+        LoopTree inner = null, ltree;
+        for( Node use : _outputs ) {
+            if( !(use instanceof CFGNode usecfg) ) continue;
+            if( skip(usecfg) ) continue;
+            if( usecfg._type == Type.XCONTROL ||       // Do not walk dead control
+                usecfg._type == TypeTuple.IF_NEITHER ) // Nor dead IFs
+                continue;
+            // Child visited but not post-visited?
+            if( !post.get(usecfg._nid) ) {
+                // Must be a backedge to a LoopNode then
+                ltree = usecfg._ltree = new LoopTree((LoopNode)usecfg);
+            } else {
+                // Take child's loop choice, which must exist
+                ltree = usecfg._ltree;
+                // If falling into a loop, use the target loop's parent instead
+                if( ltree._head == usecfg ) {
+                    if( ltree._par == null )
+                        // This loop never had an If test choose to take its
+                        // exit, i.e. it is a no-exit infinite loop.
+                        ltree._par = ltree._head.forceExit(fun,stop)._ltree;
+                    ltree = ltree._par;
+                }
+            }
+            // Sort inner loops.  The decision point is some branch far removed
+            // from either loop head OR either backedge so requires pre-order
+            // numbers to figure out innermost.
+            if( inner == null ) { inner = ltree; continue; }
+            if( inner == ltree ) continue; // No change
+            LoopTree outer = ltree._head._pre > inner._head._pre ? inner : ltree;
+            inner =          ltree._head._pre > inner._head._pre ? ltree : inner;
+            inner._par = outer;
+        }
+        // Set selected loop
+        if( inner!=null )
+            _ltree = inner;
+        // Tag as post-walked
+        post.set(_nid);
+        return pre;
+    }
+
+    public boolean skip(CFGNode usecfg) {
+        // Only walk control users that are alive.
+        // Do not follow interprocedural edges. CLInit's call projection is
+        // only an analysis edge, not a branch in the caller's loop tree.
+        return usecfg instanceof XCtrlNode ||
+                (this instanceof CallNode && usecfg instanceof FunNode) ||
+                (this instanceof CLInitNode && usecfg instanceof CProjNode proj && proj._idx==3) ||
+                (this instanceof CProjNode proj && proj._idx==3 && proj.in(0) instanceof CLInitNode && usecfg instanceof FunNode) ||
+                (this instanceof ReturnNode && usecfg instanceof CallEndNode);
+    }
+
+    public static String label( CFGNode target ) {
+        return switch(target) {
+        case StartNode start -> start.label();
+        case FunNode fun -> fun.label();
+        case LoopNode loop -> "LOOP"+target._nid;
+        default -> "L"+target._nid;
+        };
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/CLInitNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/CLInitNode.java
new file mode 100644
index 00000000..f381e57a
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/CLInitNode.java
@@ -0,0 +1,210 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.print.ExprPrinter;
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.CompUnit;
+import com.seaofnodes.simple.codegen.Iter;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.BAOS;
+import java.util.*;
+
+// Track class initializers - the code just after this point expects the named
+// class to be initialized.  If this code path dies, then the dependency dies
+// also - dead code does not force class init.
+//
+public class CLInitNode extends CFGNode implements MultiNode {
+    public Lexer _loc;          // For error reporting
+
+    // Inputs: control, whole memory, class pointer, loaded $init flag
+    // Results: control, whole memory, known-true flag alias memory, call control.
+    // For field references, the ptr might be the dst clz ptr or not.
+    public CLInitNode(Lexer loc, Node ctrl, Node mem, Node ptr, Node ready) {
+        super(ctrl,mem,ptr,ready);
+        _loc = loc;
+    }
+
+    CLInitNode(BAOS bais, String[] strs) { super(null,null,null,null); _loc=Lexer.unpack(bais,strs); }
+    @Override public Tag serialTag() { return Tag.CLInit; }
+    @Override public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) {
+        Lexer.packed(_loc,baos,strs);
+    }
+    @Override public void gather(HashMap<String,Integer> strs) { Lexer.gather(_loc,strs); }
+
+    public CLInitNode(CLInitNode init) {
+        super(init);
+        _loc = init._loc;
+    }
+
+    public Node mem() { return in(1); }
+    public Node ptr() { return in(2); }
+    public Node ready() { return in(3); }
+
+    // The field/alias can be unresolved until forward references are loaded.
+    public Field flag() {
+        return ptr()._type instanceof TypeMemPtr tmp && Parser.startsClzPrefix(tmp._obj._name)
+            ? tmp._obj.field("$init") : null;
+    }
+    @Override public String label() { return "CLInit"; }
+
+    // Best effort dst compunit, based on ptr - or null
+    public CompUnit cu() {
+        if( !(ptr()._type instanceof TypeMemPtr ptr && Parser.startsClzPrefix(ptr._obj._name)) )
+            return null;
+        // Convert "class:sys.ary" into "sys/ary" and lookup CompUnit
+        String fname = ptr._obj._name.substring(6).replace(".","/");
+        return CodeGen.CODE._compunits.get(fname);
+    }
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        FunNode fun = fun();
+        CompUnit cu = cu();
+        return p.p("CLInit ").p(fun._name).p(" -> ").p(cu==null ? "---" : cu._cname);
+    }
+
+    // Block head is Start, Region, CProj, but not e.g. If, Return, Stop
+    public boolean blockHead() { return true; }
+
+    private boolean instance() {
+        return ptr()._type==Type.NIL ||
+            (ptr()._type instanceof TypeMemPtr tmp && tmp._obj!=TypeStruct.BOT &&
+             !tmp._obj.isHigh() && !tmp._obj._open && !tmp._obj._fref &&
+             !Parser.startsClzPrefix(tmp._obj._name));
+    }
+
+    public boolean bypass() { return instance() || ready()._type==TypeInteger.TRUE; }
+
+    @Override public Type compute() {
+        if( in(0)._type.isHigh() || ptr()._type.isHigh() )
+            return TypeTuple.make(Type.XCONTROL,TypeMem.TOP,TypeMem.TOP,Type.XCONTROL);
+        if( instance() )
+            return TypeTuple.make(in(0)._type,mem()._type,mem()._type,Type.XCONTROL);
+        Field flag = flag();
+        Type slice = flag==null ? TypeMem.BOT : TypeMem.make(flag._alias,TypeInteger.TRUE);
+        // The initializer may write arbitrary public memory. Only its flag
+        // has a guaranteed value on the normal continuation.
+        Type bulk = ready()._type.isHigh() ? TypeMem.TOP :
+            ready()._type==TypeInteger.TRUE ? mem()._type : TypeMem.BOT;
+        Type call = ready()._type.isHigh() || ready()._type==TypeInteger.TRUE ? Type.XCONTROL : in(0)._type;
+        return TypeTuple.make(in(0)._type,bulk,slice,call);
+    }
+
+    @Override public Node pcopy(int idx, Node dep) {
+        if( idx==3 ) return null; // Analysis call edge, removed before scheduling.
+        dep.addDep(ptr());
+        dep.addDep(ready());
+        if( instance() ) return idx==0 ? in(0) : mem();
+        if( ready()._type!=TypeInteger.TRUE ) return null;
+        if( idx==0 ) return in(0);
+        if( idx==1 ) return mem();
+        // Already established on the incoming path; this is a memory fact,
+        // not a new store to the class object.
+        return CodeGen.CODE.con(((TypeTuple)_type)._types[2]);
+    }
+
+    @Override public Node idealize() {
+        if( CodeGen.CODE._phase.ordinal()<CodeGen.Phase.Opto.ordinal() ) return null;
+        if( CodeGen.CODE._phase.ordinal()<CodeGen.Phase.Lower.ordinal() ) return link() ? this : null;
+        if( CodeGen.CODE._phase!=CodeGen.Phase.Lower || bypass() || in(0)._type.isHigh() ) return null;
+        if( CodeGen.CODE._midAssert ) return this;
+        // Until entry arguments become arrays, ordinary initializers receive zero.
+        return expand(CodeGen.CODE.con(TypeInteger.ZERO));
+    }
+
+    // Before lowering, expose the conditional call to interprocedural analysis.
+    // No Return edge is needed: CLInit already conservatively models its effects.
+    public boolean link() {
+        if( in(0)._type.isHigh() || ptr()._type.isHigh() || ready()._type.isHigh() || bypass() ) return false;
+        FunNode target = CodeGen.CODE.link(cu());
+        if( target==null ) return false; // Forward class reference during parsing.
+        assert !target.isDead() : "dead initializer "+target._name;
+        CProjNode call = cproj(3);
+        if( call!=null && target._inputs.find(call)!=-1 ) return false;
+        if( CodeGen.CODE._midAssert ) return true;
+        if( call==null ) call = CodeGen.CODE.add(new CProjNode(this,3,"InitCall").init());
+        CodeGen.CODE.keepInCompUnit(target);
+        CodeGen.CODE.add(target).addDef(call);
+        for( Node use : target._outputs )
+            if( use instanceof ParmNode parm ) {
+                Node arg = switch( parm._idx ) {
+                case 0 -> CodeGen.CODE.con(TypeRPC.BOT);
+                case 1 -> mem();
+                case 2 -> ptr();
+                case 3 -> CodeGen.CODE.con(TypeInteger.ZERO);
+                default -> throw new IllegalStateException("initializer parameter");
+                };
+                CodeGen.CODE.add(parm).addDef(arg);
+            }
+        if( CodeGen.CODE._phase.ordinal()>CodeGen.Phase.Opto.ordinal() ) {
+            boolean repair = !target.compute().isa(target._type);
+            for( Node use : target._outputs )
+                if( use instanceof ParmNode && !use.compute().isa(use._type) ) repair = true;
+            if( repair ) Iter.repair(CodeGen.CODE);
+        }
+        return true;
+    }
+
+    public void unlink() {
+        CProjNode call = cproj(3);
+        if( call==null ) return;
+        keep();
+        for( Node use : call._outputs.asAry() )
+            if( use instanceof FunNode target ) {
+                CodeGen.CODE.add(target);
+                target.removeDeadPath(target._inputs.find(call));
+            }
+        call.isKill();
+        unkeep();
+    }
+
+    // Called only after cycle/type checking. The initialized arm skips the
+    // call; both arms rejoin with whole memory and a known-true flag slice.
+    private Node expand(Node arg) {
+        FunNode target = CodeGen.CODE.link(cu());
+        assert target!=null && !target.isDead();
+        keep();
+        Node ctrl = in(0);
+        Node memory = mem();
+
+        // The callee establishes its parent before setting its own flag.
+        IfNode iff = CodeGen.CODE.add(new IfNode(ctrl,ready()).init());
+        Node done = CodeGen.CODE.add(new CProjNode(iff,0,"True").init());
+        Node cold = CodeGen.CODE.add(new CProjNode(iff,1,"False").init());
+
+        Node fptr = new FunPtrNode(target.sig(),CodeGen.CODE._start,target.ret()).peephole();
+        CallNode call = CodeGen.CODE.add(new CallNode(_loc,cold,memory,ptr(),arg,fptr).init());
+        CallEndNode end = new CallEndNode(call,TypeRPC.constant(CodeGen.CODE.rpc(_loc._cu._cname)));
+        CodeGen.CODE.add(end.init());
+        // Replace the analysis edge with the ordinary call. Its arguments
+        // are the same ones already analyzed before lowering.
+        call.link(target);
+        unlink();
+        Node called = CodeGen.CODE.add(new CProjNode(end,0,ScopeNode.CTRL).init());
+        Node after = CodeGen.CODE.add(new ProjNode(end,1,ScopeNode.MEM0).init());
+        RegionNode region = CodeGen.CODE.add(new RegionNode(_loc,null,done,called).init());
+        Node merged = CodeGen.CODE.add(new BulkMemPhiNode(ScopeNode.MEM0,region,memory,after).init());
+
+        // Replace the individual outputs; no tuple-pack node or second
+        // representation of CLInit is needed while the projections collapse.
+        for( Node use : _outputs.asAry() ) {
+            if( use==null ) continue; // Our temporary keep.
+            assert use instanceof Proj;
+            int idx = ((Proj)use).idx();
+            use.subsume(idx==0 ? region : idx==1 ? merged : CodeGen.CODE.con(((TypeTuple)_type)._types[2]));
+        }
+        CodeGen.CODE.invalidateIDepthCaches();
+        return unkeep(); // Iter removes this now-unused node.
+    }
+
+    // Resolve a precise flag slice even when the parser did not yet know the
+    // class/alias and could only install the whole-memory projection.
+    static Node slice(Node mem, int alias, Node dep) {
+        if( !(mem instanceof ProjNode proj && proj._idx==1 && proj.in(0) instanceof CLInitNode init) )
+            return mem;
+        dep.addDep(init.ptr());
+        Field flag = init.flag();
+        if( flag==null || flag._alias!=alias ) return mem;
+        return new ProjNode(init,2,Parser.memName(alias)).peephole();
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/CProjNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/CProjNode.java
new file mode 100644
index 00000000..073e4658
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/CProjNode.java
@@ -0,0 +1,85 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.Serialize;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeTuple;
+import com.seaofnodes.simple.util.BAOS;
+
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+public class CProjNode extends CFGNode implements Proj {
+
+    // Which slice of the incoming multipart value
+    public int _idx;
+
+    // Debugging label
+    public String _label;
+
+    public CProjNode(Node ctrl, int idx, String label) {
+        super(ctrl);
+        _idx = idx;
+        _label = label;
+    }
+    public CProjNode(CProjNode c) { super(c); _idx = c._idx; _label = c._label; }
+    @Override public Tag serialTag() { return Tag.CProj; }
+    @Override public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) {
+        baos.packed1(_idx);
+        baos.packed2(_label==null ? 0 : strs.get(_label));
+    }
+    static Node make( BAOS bais, String[] strs ) {
+        return new CProjNode(null, bais.packed1(), strs[bais.packed2()] );
+    }
+
+    @Override public String label() { return _label; }
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) { return p.p(_label); }
+
+    @Override public boolean blockHead() { return true; }
+
+    public CFGNode ctrl() { return cfg(0); }
+
+    @Override
+    public Type compute() {
+        Type t = ctrl()._type;
+        return t instanceof TypeTuple tt ? tt._types[_idx] : (t.isHigh() ? Type.TOP : Type.BOTTOM);
+    }
+
+    @Override
+    public Node idealize() {
+        if( ctrl()._type instanceof TypeTuple tt ) {
+            if( tt._types[_idx]==Type.XCONTROL )
+                return CodeGen.CODE.XCTRL; // We are dead
+            if( ctrl() instanceof IfNode && tt._types[1-_idx]==Type.XCONTROL ) // Only true for IfNodes
+                return ctrl().in(0);               // We become our input control
+        }
+
+        // Flip a negating if-test, to remove the not
+        if( ctrl() instanceof IfNode iff && iff.pred() != null && addDep(iff.pred()) instanceof NotNode not )
+            return new CProjNode(new IfNode(iff.ctrl(),not.in(1)).peephole(),1-_idx,_idx==0 ? "False" : "True");
+
+        // Copy of some other input
+        return ((MultiNode)ctrl()).pcopy(_idx,this);
+    }
+
+    // Only called during basic-block layout, inverts a T/F CProj
+    public void invert() {
+        _label = _idx == 0 ? "False" : "True";
+        _idx = 1-_idx;
+    }
+
+    @Override
+    public boolean eq( Node n ) { return _idx == ((CProjNode)n)._idx; }
+
+    @Override
+    int hash() { return _idx; }
+
+    @Override public int idx() { return _idx; }
+
+    @Override public void gather( HashMap<String,Integer> strs ) {
+        Serialize.gather(strs,_label);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/CallEndMach.java b/chapter29/src/main/java/com/seaofnodes/simple/node/CallEndMach.java
new file mode 100644
index 00000000..05707132
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/CallEndMach.java
@@ -0,0 +1,38 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.util.SB;
+
+public class CallEndMach extends CallEndNode implements MachNode {
+    public CallEndMach( CallEndNode n ) { super(n); }
+    // MachNode specifics, shared across all CPUs
+    public int _xslot;
+    private RegMask _retMask;
+    private RegMask _kills;
+    public void cacheRegs(CodeGen code) {
+        // Return mask depends on TFP (either GPR or FPR)
+        _retMask = code._mach.retMask(call().tfp());
+        // Kill mask is all caller-saves, and any mirror stack slots for args
+        // in registers.
+        RegMaskRW kills = (call().external() ? code._cCallerSave : code._callerSave).copy();
+        // Start of stack slots
+        int maxReg = code._mach.regs().length;
+        // Incoming function arg slots, all low numbered in the RA
+        int fslot = fun()._maxArgSlot;
+        // Killed slots for this calls outgoing args
+        int xslot = call().external()
+            ? code._mach.maxArgSlot(call().tfp(),code._cCallingConv)
+            : code._mach.maxArgSlot(call().tfp());
+        _xslot = (maxReg+fslot)+xslot;
+        for( int i=0; i<xslot; i++ )
+            kills.set((maxReg+fslot)+i);
+        _kills = kills;
+    }
+    public String op() { return "cend"; }
+    public RegMask regmap(int i) { return null; }
+    public RegMask outregmap() { return null; }
+    public RegMask outregmap(int idx) { return idx==2  ? _retMask : null; }
+    public RegMask killmap() { return _kills; }
+    public void encoding( Encoding enc ) { }
+    public void asm(CodeGen code, SB sb) {  }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/CallEndNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/CallEndNode.java
new file mode 100644
index 00000000..4056e24e
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/CallEndNode.java
@@ -0,0 +1,321 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.BAOS;
+
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+/**
+ *  CallEnd
+ */
+public class CallEndNode extends CFGNode implements MultiNode {
+
+    // When set true, this Call/CallEnd/Fun/Return is being trivially inlined
+    boolean _folding;
+    // +2: must clone, so await all cleanup but OK
+    // +1: trivial now, so can inline without cloning and without waiting for cleanup
+    //  0: take a look,
+    // -1: somethings wrong, but might improve
+    // -2: never and stop asking,
+    private byte _inline;
+    public final TypeRPC _rpc;
+
+    public CallEndNode(CallNode call, TypeRPC rpc) {
+        super(new Node[]{call});
+        _rpc = rpc;
+    }
+    public CallEndNode(CallEndNode cend) { super(cend); _rpc = cend._rpc; }
+    public CallEndNode(TypeRPC rpc) {
+        super(new Node[0]);
+        _rpc = TypeRPC.constant(CodeGen.CODE._rpcs.next(rpc.rpc()));
+    }
+    private CallEndNode(int nIns, TypeRPC rpc) {
+        super(new Node[nIns]);
+        _rpc = rpc;
+    }
+    @Override public Tag serialTag() { return Tag.CallEnd; }
+    public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) {
+        baos.packed1(Serialize.nIns(this,anodes));
+        // Linked CallEnds depend on Return types which depend on CallEnds;
+        // break the cycle
+        baos.packed2(types.get(_type));
+        baos.packed2(types.get(_rpc));
+    }
+    static Node make( BAOS bais, Type[] types )  {
+        int nIns = bais.packed1();
+        Type type = types[bais.packed2()];
+        Node cend = new CallEndNode(nIns,(TypeRPC)types[bais.packed2()]);
+        cend._type = type;
+        return cend;
+    }
+
+    @Override public boolean blockHead() { return true; }
+
+    public CallNode call() { return (CallNode)in(0); }
+    public boolean folding() { return _folding; }
+
+    @Override public CFGNode idom(Node dep) {
+        // Folding the idom is the one inlining Return
+        return _folding ? cfg(1) : super.idom(dep);
+    }
+
+    @Override
+    protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        p.p("cend( ");
+        p.p( in(0) instanceof CallNode ? "Call, " : "----, ");
+        for( int i=1; i<nIns()-1; i++ )
+            p.n(in(i)).p(",");
+        return p.unchar(',').unchar(' ').close();
+    }
+
+    @Override
+    public Type compute() {
+        // Something is dead or busted, early exit with high/dead result
+        if( !(in(0) instanceof CallNode call) || call._type != Type.CONTROL )
+            return TypeTuple.STATE.dual();
+        // The function pointer carries a result type even without a body.
+        Type ftype = addDep(call.fptr())._type;
+        // Something is dead or busted, early exit with high/dead result
+        if( !(ftype instanceof TypeFunPtr tfp) )
+            return ftype.isHigh() ? TypeTuple.STATE.dual() : TypeTuple.STATE;
+        // Mid-fold, just take the inlined callee's return.
+        if( _folding ) return in(1)._type;
+
+        // Unknown targets can change any memory and return the declared type.
+        if( XInt.isHigh(tfp.fidxs()) )
+            return TypeTuple.make(Type.CONTROL,TypeMem.BOT,tfp.ret());
+
+        // Check for making a "C" call
+        int externs = 0;
+        for( int fidx = XInt.next(tfp.fidxs(),0); fidx >= 0; fidx = XInt.next(tfp.fidxs(),fidx) )
+            if( CodeGen.CODE.externFunc(fidx)!=null ) externs++;
+        if( externs!=0 ) {
+            // C calls have no Return edges. Simple calls have an extra self
+            // argument, so the two cannot be targets of the same valid call.
+            assert externs==tfp.nfcns();
+            return TypeTuple.make(Type.CONTROL,call.exposed(this),tfp.ret());
+        }
+
+        // An unlinked target may have effects, so early conservative return.
+        // This also covers invalid calls (e.g. wrong arity), which never link.
+        // SCCP links valid finite targets as soon as they become known, before
+        // computing their CallEnd, so this check does not trigger during SCCP.
+        if( nIns()-1 < tfp.nfcns() )
+            return TypeTuple.make(Type.CONTROL,TypeMem.BOT,tfp.ret());
+
+        // Start at a high tuple (matching Returns' tuple)
+        TypeTuple state = TypeTuple.STATE.dual();
+        // Meet over all Returns
+        for( int i=1; i<nIns(); i++ )
+            state = (TypeTuple)state.meet(in(i)._type);
+        // Keep a live continuation even before any callee exit is reachable.
+        // Otherwise a transient no-return result can tear down the caller
+        // and lose class-init dependencies before SCCP finds those exits.
+        if( state.ctl()==Type.XCONTROL )
+            return TypeTuple.make(Type.CONTROL,TypeMem.TOP,Type.TOP);
+        // Final JOIN over the signature guarentee and meet-over-returns
+        return state.makeFrom(2,state.ret().join(tfp.ret()));
+    }
+
+    @Override
+    public Node idealize() {
+        return null;
+    }
+
+    public byte maybeInline() {
+        byte inline = inlineCandidate(false);
+        if( CodeGen.CODE._midAssert )
+            return inline;
+        _inline = inline;
+        if( _inline > 0 )
+            doInline();
+
+        return _inline;
+    }
+
+    // This CallEnd might be an inline candidate, but the actual code is in
+    // another CompUnit and needs loading to decide. Called at an empty worklist.
+    public boolean loadForInline() {
+        CodeGen code = CodeGen.CODE;
+        if( code._phase!=CodeGen.Phase.IterPostOpto || nIns()!=2 ||
+            !(in(1) instanceof ReturnNode ret) || ret.fun().summary()==null ) return false;
+        // Fetch bodies only for calls in functions compiled from source here.
+        // Calls inside imported functions become eligible when inlined into one.
+        if( !(in(0) instanceof CallNode call) || !call.fun().isFromSource() ||
+            inlineCandidate(true)<=0 ) return false;
+        code.loadForInline(ret.fun()._compunit);
+        return true;
+    }
+
+    // Check if candidate right now, sets no flags. Loading uses the same
+    // policy, but can only estimate the size of a summarized body.
+    private byte inlineCandidate(boolean loading) {
+        if( _inline < -2 ) return -2; // Never
+        if( _folding ) return -2;     // No, and will collapse anyways
+        if( !(in(0) instanceof CallNode call) ) return -2; // malformed because mid-death
+
+        if( nIns()!=2 ) return -1;    // Not exactly 1 link, but can change
+
+        // Have exactly 1 linked function
+        ReturnNode ret = (ReturnNode)in(1);
+        FunNode fun = ret.fun();
+
+        // Preserve initializer boundaries until post-Opto cycle validation.
+        if( fun.isClz() ) return -2;
+
+        // Heuristic forced inlining turned off via name
+        if( fun._name != null &&
+            fun._name.endsWith("_noInline") )
+            return -2;          // Never, stop asking
+
+        // Disallow self-recursive inlining (loop unrolling by another name).
+        for( int i=1; i < fun.nIns(); i++ )
+            if( fun.cfg(i).fun()==fun ) // Check for linked call input inside "fun"
+                { addDep(fun); return -1; } // No, but can lose the recursive edge
+
+        // Things that might improve, but not now a candidate
+        Node fptr = call.fptr();
+        // Constant Function is being called, and its not-null
+        if( !(fptr._type instanceof TypeFunPtr tfp && tfp.notNull() && tfp.isConstant()) )
+            { addDep(fptr); return -1; }
+
+        // Arguments are correct
+        if( call.nargs()!=tfp.nargs() || !goodArgs(call,tfp) )
+            { addDep(fptr); return -1; }
+
+        // Encouraged inlining because small size and constructor.
+        int maxSize = fun.inlineLimit();
+        // A large parse can leave only a tiny initializer.  Recognize that
+        // and await cleanup to shrink the body.
+        if( fun._approxUIDs >= maxSize ) {
+            if( fun.summary()!=null || !smallBody(fun) ) return -1;
+        } else if( fun.summary()==null && fun.body().cardinality() >= maxSize ) // Expensive size check
+            return -1;          // Try later (if cleanup makes the real body small enough)
+
+        if( fun.summary()!=null ) return loading ? (byte)1 : (byte)-1;
+
+        // Can be cloned but not trivial
+        if( fun.nIns() > 2 ) { addDep(fun); return 2; }
+
+        // A trivial candidate right now
+        return 1;
+    }
+
+    // Bounded, conservative recognition of straight-line initializer boilerplate.
+    // Walk uses from the entry and stop at Return, never following callers or
+    // constant inputs.  This also avoids scanning sparse MemMerge input arrays.
+    // Watch only this small prefix, including an unsupported node that may fold.
+    private static final Node[] TINYBODY = new Node[15]; // Tiny worklist
+    private boolean smallBody(FunNode fun) {
+        ReturnNode ret = fun.ret();
+        for( Node in : ret._inputs )
+            if( in!=null ) addDep(in);
+        if( ret.ctrl()!=fun ) return false;
+        TINYBODY[0] = fun;
+        int len=1;
+        for( int i=0; i<len; i++ ) {
+            Node n = TINYBODY[i];
+            addDep(n);
+            if( n==ret ) continue;
+            if( n instanceof ParmNode parm && parm.region()!=fun ) return false;
+            if( n!=fun && !(n instanceof ParmNode) &&
+                !(n instanceof StoreNode) && !(n instanceof MemMergeNode) )
+                return false;                             // Something unexpected
+            if( n.nOuts()>TINYBODY.length ) return false; // Too big
+            for( Node use : n._outputs ) {
+                if( use==null ) continue;
+                int j=0;
+                while( j<len && TINYBODY[j]!=use ) j++;
+                if( j<len ) continue; // Already in TINYBODY
+                if( len==TINYBODY.length ) { addDep(use); return false; } // Too big
+                TINYBODY[len++] = use;  // Add to worklist
+            }
+        }
+        return true;
+    }
+
+    public void doInline() {
+        assert _inline > 0;    // Only called when possible to inline
+
+        ReturnNode ret = (ReturnNode)in(1);
+        FunNode fun = ret.fun();
+        CallNode call = call();
+        assert fun.sig().isa(call.fptr()._type);
+
+        // Clone first
+        if( _inline==2 ) {
+            assert !CodeGen.CODE._midAssert; // Triggered inlining
+            // Remove the existing function linkage
+            call.unlink_all();
+            // Clone the function body
+            FunNode fun2 = fun.copyBody();
+            // Call uses the unique new function
+            Node fptr2 = new FunPtrNode(fun2.sig(),CodeGen.CODE._start,fun2.ret()).peephole();
+            call.setDef(call.nIns()-1,fptr2);
+            // Link to the new function
+            call.link(fun2);
+            fun = fun2;
+        }
+
+        // Trivial inlining: call site calls a single function; single function
+        // is only called by this call site.
+        doTrivialInlining(fun);
+    }
+
+    boolean goodArgs( CallNode call, TypeFunPtr tfp ) {
+        for( int i=0; i<tfp.nargs(); i++ ) {
+            Node arg = call.arg(i+2);
+            // The graph's function-pointer type can still contain open forward
+            // references here.  Compare against its recursively upgraded form,
+            // so deep mutability requirements participate before inlining.
+            Type formal = tfp.arg(i).upgradeType(Parser.TYPES);
+            if( !arg._type.isa(formal) || !arg._type.accessISA(formal) )
+                { addDep(arg); return  false; }
+        }
+        return true;
+    }
+
+
+    // Do trivial inlining.  Inlining does not need to clone code, merely
+    // triggers folding the Call/Fun and Return/CallEnd away.
+    private boolean doTrivialInlining( FunNode fun ) {
+        assert !CodeGen.CODE._midAssert; // Triggered inlining
+        // Trivial inline: rewrite
+        _folding = true;
+        // Rewrite Fun so the normal RegionNode ideal collapses
+        fun._folding = true;
+        fun.setDef(1,call().ctrl());// Bypass the Call;
+        fun.ret().setDef(3,null);   // Return is folding also
+
+        CodeGen.CODE.addAll(fun._outputs);
+        // Repeat defs 1 layer down, for users of Parm (Phis)
+        for( Node parm : fun._outputs )
+            if( parm instanceof ParmNode )
+                CodeGen.CODE.addAll(parm._outputs);
+
+        // Inlining immediately blows all cache idepth fields past the inline point.
+        // Bump the global version number invalidating them en-masse.
+        CodeGen.CODE.invalidateIDepthCaches();
+        // More peeps
+        CodeGen.CODE.add(fun);
+        CodeGen.CODE.add(this);
+        CodeGen.CODE.addAll(_outputs);
+        CodeGen.CODE.addAll(_inputs);
+        return true;            // Always return true
+    }
+
+
+    @Override public Node pcopy(int idx, Node dep) {
+        return _folding ? in(1).in(idx) : null;
+    }
+
+    @Override public Node copy() {
+        return _folding ? super.copy() : new CallEndNode(_rpc);
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/CallNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/CallNode.java
new file mode 100644
index 00000000..fcadd0e4
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/CallNode.java
@@ -0,0 +1,271 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.Iter;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeFunPtr;
+import com.seaofnodes.simple.type.TypeMem;
+import com.seaofnodes.simple.type.TypeRPC;
+import com.seaofnodes.simple.type.XInt;
+import com.seaofnodes.simple.util.BAOS;
+import com.seaofnodes.simple.util.Utils;
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+/**
+ *  Call
+ */
+public class CallNode extends CFGNode {
+
+    // Source location for late reported errors
+    public final Lexer _loc;
+
+    public CallNode(Lexer loc, Node... nodes) {
+        super(nodes);
+        _loc = loc;
+        CodeGen.CODE._calls.add(this);
+        CodeGen.CODE.add(CodeGen.CODE._globalEscapes);
+    }
+    public CallNode(CallNode call) { super(call); _loc = call._loc; }
+    @Override public Tag serialTag() { return Tag.Call; }
+    public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) {
+        baos.packed1(nIns());
+        Lexer.packed(_loc,baos,strs);
+    }
+    @Override public void gather(HashMap<String,Integer> strs) { Lexer.gather(_loc,strs); }
+    static Node make( BAOS bais, String[] strs ) {
+        int nIns = bais.packed1();
+        return new CallNode(Lexer.unpack(bais,strs),new Node[nIns]);
+    }
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        String fname = name();
+        if( fname == null ) p.n(fptr());
+        else p.p(fname);
+        p.p("( ");
+        for( int i=2; i<nIns()-1; i++ )
+            p.n(in(i)).p(",");
+        return p.unchar(',').unchar(' ').close();
+    }
+    public String name() {
+        if( fptr()._type instanceof TypeFunPtr tfp && tfp._isConstant() && tfp.notNull() ) {
+            FunNode fun = CodeGen.CODE._link(tfp);
+            if( fun !=null ) return fun._name;
+            if( fptr() instanceof ExternNode ex )  return ex._extern;
+        }
+        return null;
+    }
+
+
+
+    Node ctrl() { return in(0); }
+    Node mem () { return in(1); }
+    // Args mapped 1-to-1 on inputs, so conceptually start at 2
+    public Node arg(int idx) { return in(idx); }
+    // Same arg accounting as TFPs, although the numbering starts at 2
+    public int nargs() { return nIns()-3; } // Minus control, memory, fptr
+    // args from input 2 to last; last is function input
+    public Node fptr() { return _inputs.last(); }
+    // Error if not a TFP
+    public TypeFunPtr tfp() { return (TypeFunPtr)fptr()._type; }
+
+    // Call is to an externally supplied code
+    public boolean external() {
+        if( !(fptr()._type instanceof TypeFunPtr tfp) ) return false;
+        if( XInt.isHigh(tfp.fidxs()) ) return true;
+        for( int fidx=XInt.next(tfp.fidxs(),-1); fidx>=0; fidx=XInt.next(tfp.fidxs(),fidx) )
+            if( CodeGen.CODE.externFunc(fidx)!=null ) return true;
+        return false;
+    }
+
+    // Unknown callers contribute declared argument types to the parameters.
+    // Those broad types can hide a particular private callback supplied here.
+    // Expose actual arguments too, including calls through library summaries.
+    boolean exposesArguments(Node dep) {
+        if( external() ) return true;
+        if( !(fptr()._type instanceof TypeFunPtr tfp) ) return false;
+        for( int fidx = XInt.next(tfp.fidxs(),0); fidx>=0; fidx = XInt.next(tfp.fidxs(),fidx) ) {
+            FunNode fun = CodeGen.CODE._link(fidx);
+            if( fun!=null && !fun.isClz() ) {
+                dep.addDepForwards(fun);
+                if( fun.unknownCallers() ) return true;
+            }
+        }
+        return false;
+    }
+
+    // As in the escape chapter, native code may retain an argument even if
+    // this path never returns. StopCU reads this independently of CallEnd.
+    TypeMem exposed(Node dep) {
+        dep.addDepForwards(this);
+        dep.addDepForwards(fptr());
+        if( _type.isHigh() ) return TypeMem.START;
+        // A broad scalar target can refine to a function pointer during Iter.
+        // It cannot yet promise that the call exposes nothing.
+        if( _type!=Type.CONTROL ) return TypeMem.BOT;
+        if( !(fptr()._type instanceof TypeFunPtr) )
+            return fptr()._type.isHigh() ? TypeMem.START : TypeMem.BOT;
+        if( !external() ) return TypeMem.START;
+        Type input = dep.addDepForwards(mem())._type;
+        TypeMem escaped = input instanceof TypeMem m ? m : input.isHigh() ? TypeMem.TOP : TypeMem.BOT;
+        for( int i = 2; i<nIns()-1; i++ ) escaped = escaped.escapes(dep.addDepForwards(arg(i))._type);
+        return TypeMem.make(1,Type.BOTTOM,false,false,false,escaped._escFs,escaped._escAs);
+    }
+
+
+    // Find the Call End from the Call
+    public CallEndNode cend() {
+        // Always in use slot 0
+        if( nOuts()>0 && out(0) instanceof CallEndNode cend ) {
+            assert _cend()==cend;
+            return cend;
+        } else {
+            assert _cend()==null;
+            return null;
+        }
+    }
+    private CallEndNode _cend() {
+        CallEndNode cend=null;
+        for( Node n : _outputs )
+            if( n instanceof CallEndNode cend0 )
+                { assert cend == null; cend = cend0; }
+        return cend;
+    }
+
+    // Get the one control following; error to call with more than one e.g. an
+    // IfNode or other multi-way branch.
+    @Override public CFGNode uctrl() { return cend(); }
+
+
+    @Override
+    public Type compute() {
+        return ctrl()._type;
+    }
+
+    @Override
+    public Node idealize() {
+        // Lowering may introduce calls after the call graph has been analyzed.
+        // These use the callee interface without reopening its parameter flow.
+        if( CodeGen.CODE._phase.ordinal() >= CodeGen.Phase.Lower.ordinal() ) return null;
+        CallEndNode cend = cend();
+        if( cend==null ) return null; // Still building
+
+        // Link: call calls target function.  Linking makes the target FunNode
+        // point to this Call, and all his Parms point to the call arguments;
+        // also the CallEnd points to the Return.
+        Node progress = null;
+        if( fptr()._type instanceof TypeFunPtr tfp && tfp.nargs() == nargs() ) {
+            // If fidxs is negative, then infinite unknown functions
+            int[] fidxs = tfp.fidxs();
+            if( !XInt.isHigh(fidxs) ) {
+                // Walk the bits and link
+                for( int fidx = XInt.next(fidxs,0); fidx > 0; fidx = XInt.next(fidxs,fidx) ) {
+                    FunNode fun = CodeGen.CODE.link(fidx);
+                    if( fun!=null && !fun._folding && !linked(fun) )
+                        progress = link(fun);
+                }
+            }
+        }
+
+        return progress;
+    }
+
+    // True if Fun is linked to this Call
+    public boolean linked( FunNode fun ) {
+        for( Node n : fun._inputs )
+            if( n == this )
+                return true;
+        return false;
+    }
+
+    // Link so this calls fun
+    public Node link( FunNode fun ) {
+        assert !linked(fun);
+        CodeGen.CODE.add(fun).addDef(this);
+        for( Node use : fun._outputs )
+            if( use instanceof ParmNode parm ) {
+                Node def = parm._idx==0 ? ConstantNode.seed(cend()._rpc).peephole() : arg(parm._idx);
+                CodeGen.CODE.add(parm).addDef(def);
+                // Linking can happen during post-SCCP inlining.  Keep an RPC
+                // Parm's cached finite set synchronized with its newly added
+                // input instead of waiting for the next worklist visit.
+                if( parm._idx==0 && parm._type instanceof TypeRPC )
+                    parm._type = parm._type.meet(def._type);
+            }
+        // Call end points to function return
+        CodeGen.CODE.add(cend()).addDef(fun.ret());
+        // Loading/inlining can reveal a target after SCCP.  Its new caller
+        // may bring escapes absent from the cached formal parameter types.
+        // Repair affected bounds before the next type-lifting peephole.
+        CodeGen code = CodeGen.CODE;
+        if( code._phase.ordinal()>CodeGen.Phase.Opto.ordinal() &&
+            code._phase.ordinal()<CodeGen.Phase.Lower.ordinal() ) {
+            boolean repair = !fun.compute().isa(fun._type) || !cend().compute().isa(cend()._type);
+            for( Node use : fun._outputs )
+                if( use instanceof ParmNode && !use.compute().isa(use._type) ) repair = true;
+            if( repair ) Iter.repair(code);
+        }
+        return this;
+    }
+
+    // Unlink a single function
+    public void unlink( FunNode fun, int path ) {
+        assert linked(fun);
+        for( Node use : fun._outputs )
+            if( use instanceof ParmNode )
+                use.delDef(path);
+        fun.delDef(path);
+        CodeGen.CODE.add(fun);
+        CallEndNode cend = cend();
+        ReturnNode ret = fun.ret();
+        if( cend != null ) {
+            ret.keep();
+            cend.delDef(cend._inputs.find(ret));
+            CodeGen.CODE.add(cend);
+            ret.unkeep();
+        }
+        assert !linked(fun);
+    }
+
+
+    // Unlink all linked functions
+    public void unlink_all() {
+        for( int i=0; i<_outputs._len; i++ )
+            if( out(i) instanceof FunNode fun ) {
+                int path = fun._inputs.find(this);
+                unlink(fun,path);
+                i--;
+            }
+    }
+
+    @Override
+    public Parser.ParseException err() {
+        if( fptr()._type == Type.BOTTOM )
+            return null;        // Wrong, but failing earlier
+        if( !(fptr()._type instanceof TypeFunPtr tfp) )
+            return Parser.error("Expected a function, but found " + fptr()._type, _loc);
+        if( !tfp.notNull() )
+            return Parser.error( "Might be null calling "+tfp, _loc);
+        if( nargs() != tfp.nargs() )
+            return Parser.error( "Expecting "+tfp.nargs()+" arguments, but found "+nargs(), _loc);
+
+        // Check for args
+        for( int i=0; i<tfp.nargs(); i++ )
+            if( !arg(i+2)._type.isa(tfp.arg(i)) || !arg(i+2)._type.accessISA(tfp.arg(i)) ) {
+                // Constructors return private memory and carry hidden self and
+                // selfMem arguments ahead of the source-level arguments.
+                int argno = i - (tfp.ret() instanceof TypeMem ? 2 : 0);
+                return Parser.error( "Argument #" + argno + " isa " + arg(i+2)._type + ", but must be a " + tfp.arg(i), _loc );
+            }
+
+        if( tfp.isHigh() )
+            throw Utils.TODO(); // Infinite unknown TFPs?  Should be fairly precise CG
+
+        return null;
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/CalleeSaveNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/CalleeSaveNode.java
new file mode 100644
index 00000000..0afc5827
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/CalleeSaveNode.java
@@ -0,0 +1,23 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.type.Type;
+
+public class CalleeSaveNode extends ProjNode implements MachNode {
+    final RegMask _mask;
+    public CalleeSaveNode(FunNode fun, int reg, String label) {
+        super(fun,reg,label);
+        fun._outputs.pop();
+        int i=0;
+        while( fun.out(i) instanceof PhiNode )  i++;
+        fun._outputs.insert(this,i);
+        _mask = new RegMask(reg);
+    }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return _mask; }
+    @Override public void encoding( Encoding enc ) { }
+
+    @Override public Type compute() { return Type.BOTTOM; }
+    @Override public Node idealize() { return null; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ConFldOffNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ConFldOffNode.java
new file mode 100644
index 00000000..cb99b4dd
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ConFldOffNode.java
@@ -0,0 +1,78 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.type.TypeStruct;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+import java.util.HashMap;
+
+/**
+ * A field offset.  This becomes a constant *after* other optimizations which
+ * determine field sizes - some fields might be dead, or hold only zeros or
+ * small values.
+ */
+
+public class ConFldOffNode extends ConstantNode {
+    public TypeStruct _ts;      // Struct holding field
+    public final String _fname; // Field name
+    public ConFldOffNode( TypeStruct ts, String fname ) { super(TypeInteger.BOT); _ts = ts; _fname = fname; }
+    @Override public Tag serialTag() { throw Utils.TODO("should not reach here"); }
+
+    @Override public String label() {
+        return _fname == " len" ? "sizeof("+_ts._name+")" : "#"+_fname;
+    }
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        return p.p(label());
+    }
+
+    @Override public Node idealize() {
+        // Some array offsets are known early
+        if( _ts.isAry() ) {
+            // Length always at offset zero
+            if( _fname==" len" )
+                return CodeGen.CODE.ZERO;
+            // The shift depends on the element
+            if( _fname=="<<" )
+                return Node.con(_ts.aryScale());
+            // The base depends on the layout (alignment for large elements may
+            // involve padding) and MAY depend on the length if I go for
+            // smaller array lengths.
+        }
+        return null;
+    }
+
+    // Convert field offset to an integer
+    public Node asOffset() {
+        int fldx = _fname==" len" ? _ts._fields.length : _ts.find(_fname);
+        if( fldx == -1 ) return null;
+        // " len" selects the terminal size slot, not a Field.
+        if( fldx < _ts._fields.length && _ts._fields[fldx]._extern )
+            return new ExternOffsetNode(_fname).peephole();
+        return ConstantNode.make(TypeInteger.constant(_ts.offset(fldx))).peephole();
+    }
+
+    // Upgrade the internal type
+    @Override boolean _upgradeType( HashMap<String,Type> TYPES) {
+        boolean progress = super._upgradeType(TYPES);
+        TypeStruct ts = (TypeStruct)_ts.upgradeType(TYPES);
+        if( ts == _ts ) return progress;
+        _ts = ts;
+        return true;
+    }
+
+    @Override public boolean eq(Node n) {
+        ConFldOffNode off = (ConFldOffNode)n; // Invariant
+        return _ts._name==off._ts._name && _fname.equals(off._fname) && super.eq(n);
+    }
+    @Override int hash() { return super.hash() * _ts._name.hashCode() * _fname.hashCode(); }
+
+    @Override public Parser.ParseException err() {
+        return _ts._fref ? Parser.error("Unknown struct type '"+_ts._name+"'",null) : null;
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ConstantNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ConstantNode.java
new file mode 100644
index 00000000..0569f352
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ConstantNode.java
@@ -0,0 +1,91 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeFunPtr;
+import com.seaofnodes.simple.util.BAOS;
+
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+/**
+ * A Constant node represents a constant value.
+ * <p>
+ * Constants have no semantic inputs. However, we set Start as an input to
+ * Constants to enable a forward graph walk.  This edge carries no semantic
+ * meaning, and it is present <em>solely</em> to allow visitation.
+ * <p>
+ * The Constant's value is the value stored in it.
+ */
+
+public class ConstantNode extends TypeNode {
+    public ConstantNode( Type type ) {
+        this(type,false);
+    }
+    protected ConstantNode( Type type, boolean raw ) {
+        super(type,new Node[]{CodeGen.CODE._start});
+        assert raw || !(type instanceof TypeFunPtr tfp && tfp.isConstant()) :
+            "Unique function identities require a Return-linked FunPtrNode";
+        _type = type;
+    }
+    public ConstantNode( ConstantNode con ) { super(con); }
+    @Override public Tag serialTag() { return Tag.Con; }
+    @Override public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) {
+        baos.packed2(types.get(_con)); // NPE if fails lookup
+    }
+    static Node make( BAOS bais, Type[] types)  { return raw(types[bais.packed2()]); }
+
+    // Semantic constant construction through Lower.  A unique internal
+    // function identity carries a lifetime edge to the function's Return.
+    public static Node make( Type type ) {
+        if( type==Type. CONTROL ) return new CtrlNode();
+        if( type==Type.XCONTROL ) return new XCtrlNode();
+        if( CodeGen.CODE._phase != null &&
+            CodeGen.CODE._phase.ordinal() > CodeGen.Phase.Lower.ordinal() )
+            return raw(type);
+        if( type instanceof TypeFunPtr tfp && tfp.isConstant() ) {
+            FunNode fun = CodeGen.CODE._link(tfp);
+            if( fun != null )
+                return new FunPtrNode(tfp,CodeGen.CODE._start,fun.ret()).init();
+            // TODO: A singleton FIDX can also emerge after merging and
+            // guarding several function pointers.  Preserve that identity
+            // even if its internal Return is no longer available.
+            return raw(type);
+        }
+        return new ConstantNode(type);
+    }
+
+    // Exact construction for deserialization and graph-incomplete machine
+    // selection.  No semantic classification, compute, idealize, or GVN.
+    public static ConstantNode raw( Type type ) { return new ConstantNode(type,true); }
+    public static ConstantNode raw( ConstantNode con ) { return new ConstantNode(con); }
+
+    // Analysis input created from whole cloth, rather than a first-class
+    // runtime value.  In particular, a constructor call descriptor does not
+    // own the constructor function; the class FunPtr does.
+    public static ConstantNode seed( Type type ) { return new ConstantNode(type,true); }
+
+    @Override protected String repeatName() {
+        return _con==null || _con.toString().length()<=32 ? null : uniqueName();
+    }
+
+    @Override public String label() { return "Con"; }
+    @Override public Node copy() { return raw(this); }
+
+
+    @Override
+    protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        if( _con instanceof TypeFunPtr tfp && tfp._isConstant() && tfp.notNull() ) {
+            FunNode fun = CodeGen.CODE._link(tfp);
+            if( fun!=null && fun._name != null )
+                return p.p("{ ").p(fun._name).p("}");
+        }
+        return p.p(_con==null ? "---" : _con.toString());
+    }
+
+    @Override public boolean isConst() { return true; }
+    @Override public Type compute() { return _con; }
+    @Override public Node idealize() { return null; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ConvertNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ConvertNode.java
new file mode 100644
index 00000000..a969fb4e
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ConvertNode.java
@@ -0,0 +1,104 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.type.*;
+
+import java.util.HashMap;
+
+// Convert the incoming value; actual conversion depends on the _dst type.
+// Convert ints to floats, ptrs to ints, nullable to not-null, etc.  Once the
+// input type is known precisely enough, the idealize() call triggers and
+// replaces the Convert with a concrete conversion (e.g. toFloatNode).
+//
+// Convert has no runtime dynamic behavior; it must *always* get replaced with
+// some concrete behavior (or its an error).
+public class ConvertNode extends Node {
+    private Type _dst;
+
+    public ConvertNode(Type dst, Node val) {
+        super(null,val);
+        // Folding this conversion would replace the Return-linked FunPtrNode
+        // with an unhooked ConstantNode.
+        assert !(dst instanceof TypeFunPtr && val instanceof FunPtrNode);
+        _dst = dst;
+    }
+
+    public Type dst() { return _dst; }
+    public Node val() { return in(1); }
+
+    @Override public String label() { return "Convert_"+_dst.str(); }
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        return p.p(label()).open().n(val()).close();
+    }
+
+
+    // Not much to do here, if the input type is not sharp enough to fold into
+    // the proper conversion, its not sharp enough to do much else.
+    @Override public Type compute() {
+        Type src = val()._type;
+        if( src.isHigh() ) return Type.TOP;
+        if( !(_dst instanceof TypeMemPtr) && src.isa(_dst) ) return src;
+        return _dst;
+    }
+
+    @Override public Node idealize() {
+        Type src = val()._type;
+        if( src==Type.BOTTOM || src==Type.TOP ) return null;
+        if( (src.isa(_dst) && src.accessISA(_dst)) ) return val();
+
+        // Managed arrays are represented by an object pointer, while C wants
+        // the address of the first element.  The representation cast itself is
+        // zero-code; the Add skips the array header.
+        if( _dst==TypeInteger.BOT && src instanceof TypeMemPtr tmp && tmp._obj.isAry() )
+            return new AddNode(new PtrToIntNode(val()).peephole(),Parser.off(tmp._obj,"[]"));
+
+        // Integer (and nil-as-zero) to floating point.
+        if( (src instanceof TypeInteger || src==Type.NIL) && _dst instanceof TypeFloat )
+            return new ToFloatNode(val());
+
+        // Convert to i64 first, then apply the destination's integer width.
+        if( src instanceof TypeFloat && _dst instanceof TypeInteger )
+            return new ConvertNode(_dst,new ToIntegerNode(val()).peephole());
+
+        // Narrow integers produce the declared sign/zero extension.
+        if( src instanceof TypeInteger && _dst instanceof TypeInteger dst ) {
+            if( dst._min==0 )
+                return new AndNode(null,val(),con(dst._max));
+            int shift = Long.numberOfLeadingZeros(dst._max)-1;
+            Node shf = con(shift);
+            if( shf._type==TypeInteger.ZERO ) return val();
+            return new SarNode(null,new ShlNode(null,val(),shf.keep()).peephole(),shf.unkeep());
+        }
+
+        // Narrow f64 to f32.
+        if( src instanceof TypeFloat && _dst instanceof TypeFloat )
+            return new RoundF32Node(val());
+
+        // Wait for more source information, or report an error after Opto.
+        return null;
+    }
+
+    @Override boolean _upgradeType(HashMap<String,Type> TYPES) {
+        Type dst = _dst.upgradeType(TYPES);
+        if( dst==_dst ) return false;
+        unlock();
+        _dst = dst;
+        return true;
+    }
+
+    @Override public Parser.ParseException err() {
+        if( val()._type==Type.BOTTOM ||
+            val()._type instanceof TypeNil src && src.nullable() && _dst instanceof TypeNil dst && dst.notNull() ) {
+            Node out = out(0);
+            if( out instanceof PhiNode phi ) out = phi.out(0);
+            if( out instanceof StoreNode st )
+                return Parser.error( "'" + ((TypeMemPtr)st.ptr()._type)._obj._name + "' is not fully initialized, field '" + st._name + "' is only partially set in the constructor", null );
+        }
+        return Parser.error("Type "+val()._type.str()+" is not of declared type "+_dst.str(),null);
+    }
+
+    @Override public boolean eq(Node n) { return _dst==((ConvertNode)n)._dst; }
+    @Override int hash() { return _dst.hashCode(); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/CtrlNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/CtrlNode.java
new file mode 100644
index 00000000..277e03dc
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/CtrlNode.java
@@ -0,0 +1,17 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.type.Type;
+
+public class CtrlNode extends CFGNode {
+    public CtrlNode() { super(CodeGen.CODE._start); }
+    @Override public Tag serialTag() { throw com.seaofnodes.simple.util.Utils.TODO(); }
+    @Override public String label() { return "Ctrl"; }
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) { return p.p("Cctrl"); }
+    @Override public boolean isConst() { return true; }
+    @Override  public Type compute() { return Type.CONTROL; }
+    @Override public Node idealize() { return null; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/DivNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/DivNode.java
new file mode 100644
index 00000000..f173f0ef
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/DivNode.java
@@ -0,0 +1,40 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.type.TypeFloat;
+import java.util.BitSet;
+
+public class DivNode extends ArithNode {
+    @Override boolean allowFloat() { return true; }
+    public DivNode(Node lhs, Node rhs) { super(null, lhs, rhs); }
+    public DivNode(Node lhs, Node rhs, byte mode) { super(null, lhs, rhs, mode); }
+    @Override public Tag serialTag() { return Tag.Div; }
+
+    @Override public String op() { return _mode==1 ? "//" : "/"; }
+
+    @Override long   doOp( long  x,  long  y ) { return y==0 ? 0 : x / y; }
+    @Override double doOp(double x, double y ) { return            x / y; }
+    @Override TypeInteger doOp(TypeInteger x, TypeInteger y) {
+        return TypeInteger.BOT;
+    }
+
+    @Override
+    public Node idealize() {
+        // Div of 1.
+        if( in(2)._type == TypeInteger.TRUE && in(1)._type.isa(compute()) )
+            return in(1);
+
+        // Div of constant
+        if( _mode==2 ) {
+            if( in(2)._type == TypeFloat.constant(1.) && in(1)._type.isa(compute()) )
+                return in(1);
+            if( in(2)._type instanceof TypeFloat f && f.isConstant() )
+                return new MulNode(in(1),ConstantNode.make(TypeFloat.constant(1.0/f.value())).peephole(),_mode);
+        }
+
+        return super.idealize();
+    }
+
+    @Override Node copy(Node lhs, Node rhs) { return new DivNode(lhs,rhs,_mode); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/EscapeNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/EscapeNode.java
new file mode 100644
index 00000000..3e95fffb
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/EscapeNode.java
@@ -0,0 +1,116 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.*;
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+/**
+ *  Merge public and private aliases.
+ *  0 - control
+ *  1 - private pointer
+ *  2 - private alias
+ *  3 - public alias
+ */
+public class EscapeNode extends TypeNode {
+
+    public EscapeNode(Field fld, Node self, Node priv, Node pub ) {
+        super(fld,null,self,priv,pub);
+    }
+    public EscapeNode(EscapeNode esc ) {
+        super(esc);             // Copy constructor
+        // Except we do not want/need self ptr past Opto.
+        // *NOTE* the weird direct stomp; this is correct because this
+        // constructor does NOT set the backedges, because it is used to
+        // copy-construct an entire graph and ALL edges will get rewritten.
+        _inputs.set(1,null);
+        _con = esc._con;
+    }
+
+    // Pointer to some private (unescaped) memory from a NewNode
+    public Node self() { return in(1); }
+    public Node priv() { return in(2); }
+    public Node pub () { return in(3); }
+    public Field fld() { return (Field)_con; }
+
+    @Override public Tag serialTag() { return Tag.Escape; }
+    @Override public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) {
+        baos.packed2(types.get(_con));
+    }
+    static Node make( BAOS bais, Type[] types)  {
+        return new EscapeNode((Field)types[bais.packed2()], null,null,null);
+    }
+
+    @Override
+    protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        p.p("Esc#").p(fld()._alias).p(" {");
+        if( self()==null ) p.p("---");
+        else p.n(self()).p(",");
+        p.n(priv()).p("}, ");
+        p.n(pub ());
+        return p;
+    }
+
+    @Override
+    public Type compute() {
+        if( priv()._type.isHigh() ) return TypeMem.TOP;
+        if( pub ()._type.isHigh() ) return TypeMem.TOP;
+        TypeMem mpriv = (TypeMem)priv()._type;
+        TypeMem mpub  = (TypeMem)pub ()._type;
+        // Private memory comes from an allocation or other non-aliased source.
+        // Public  memory comes from anywhere, might be bulk memory with a very weak mem type.
+        Field fld = fld();
+        assert mpriv._alias==1 || mpriv._alias==fld._alias;
+        assert mpub ._alias==1 || mpub ._alias==fld._alias;
+        Type tpriv = mpriv._t instanceof TypeStruct ts && ts.findAlias(fld._alias)!=-1
+            ? ts.at(ts.findAlias(fld._alias))._t
+            : mpriv._t;
+        assert !(mpub._t instanceof TypeStruct); // Never expect this, but if it starts to happen, need to optimize
+        Type tpub = mpub._t;
+
+        // t is meet of pub & priv.  Pub memory can be very weak (e.g. alias 1)
+        // and we're no worse than the declared field type
+        Type t = tpriv.meet(tpub).join(fld._t);
+        int[] fidxes  = XInt.meet(mpriv._escFs, mpub._escFs);
+        int[] aliases = XInt.meet(mpriv._escAs, mpub._escAs);
+        return TypeMem.make(fld._alias, t, false, false, fld._final, fidxes, aliases).escapesFrom(t);
+    }
+
+    @Override public Node idealize() {
+        // Sharpen private memory input
+        if( priv() instanceof MemMergeNode mmm ) {
+            setDef(2,mmm.alias(fld()._alias));
+            return this;
+        }
+        // Sharpen public memory input
+        if( pub() instanceof MemMergeNode mmm ) {
+            setDef(3,mmm.alias(fld()._alias));
+            return this;
+        }
+        // New allocation is dead
+        if( self()._type.isHigh() )
+            if( pub()._type.isa(_type) ) return pub();
+            else addDep(pub());
+        return null;
+    }
+
+// Upgrade the internal type
+@Override boolean _upgradeType( HashMap<String,Type> TYPES) {
+    Type t = _con.upgradeType(TYPES);
+    if( t == _con ) return false;
+    unlock();               // Unlock before changing _con
+    _con = t;
+    return true;
+}
+
+    @Override public boolean eq(Node n) {
+        if( fld()._alias!=((EscapeNode)n).fld()._alias )
+            return false;
+        assert _con == ((EscapeNode)n)._con;
+        return true;
+    }
+
+    @Override int hash() { return _con.hashCode(); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ExternNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ExternNode.java
new file mode 100644
index 00000000..978298fc
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ExternNode.java
@@ -0,0 +1,38 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.codegen.Serialize;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.util.BAOS;
+import com.seaofnodes.simple.util.SB;
+
+import java.util.BitSet;
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+/**
+    A constant with external linkage.
+ */
+
+public class ExternNode extends ConstantNode {
+    public final String _extern;
+    // An exact external function identity has no local FunNode/Return to own.
+    // Its lifetime and eventual relocation are carried by the extern symbol
+    // and CodeGen's FIDX-to-extern mapping instead.
+    public ExternNode(Type t, String ex) { super(t,true); _extern = ex; }
+    @Override public Tag serialTag() { return Tag.Extern; }
+    @Override public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) {
+        baos.packed2(types.get(_con   ));
+        baos.packed2( strs.get(_extern));
+    }
+    static Node make( BAOS bais, String[] strs, Type[] types)  {
+        return new ExternNode(types[bais.packed2()], strs[bais.packed2()]);
+    }
+
+    @Override public String  label() { return "#"+_con+":"+_extern; }
+
+    @Override public boolean eq(Node n) { return this==n; }
+    @Override public void gather( HashMap<String,Integer> strs ) {
+        Serialize.gather(strs,_extern);
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ExternOffsetNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ExternOffsetNode.java
new file mode 100644
index 00000000..409ce5d1
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ExternOffsetNode.java
@@ -0,0 +1,19 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.util.BAOS;
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+// A field address supplied by the C linker, not a displacement from the base.
+// The class base remains available for ideal type/alias analysis. Instruction
+// selection replaces it with this symbol's address and a zero displacement.
+public class ExternOffsetNode extends ExternNode {
+    public ExternOffsetNode(String name) { super(TypeInteger.BOT,name); }
+    @Override public Tag serialTag() { return Tag.ExternOffset; }
+    @Override public Node copy() { return new ExternOffsetNode(_extern); }
+    @Override public void packed(BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node,Integer> nodes) {
+        baos.packed2(strs.get(_extern));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/FRefNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/FRefNode.java
new file mode 100644
index 00000000..3906f7be
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/FRefNode.java
@@ -0,0 +1,51 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.parser.Var;
+import com.seaofnodes.simple.type.Type;
+
+/**
+ *  A Forward Reference.  Its any final constant, including functions.  When
+ *  the Def finally appears its plugged into the forward reference, which then
+ *  peepholes to the Def.
+
+ *  FRefs can be external references, to other Simple defined values in ELF
+ *  files, or external FFI/C libs.  If external, a file system lookup needs to
+ *  find it in another file, and the name (one time) change to match the found
+ *  location.
+ *
+ *  Example, a ambiguous name "foo" is looked up externally; it might resolve
+ *  to "A.B.foo" or "libc.foo" or the like; the name is changed to match.
+ */
+public class FRefNode extends ConstantNode {
+    public static final Type FREF_TYPE = Type.BOTTOM;
+    public String _name;
+    public final Lexer _loc;    // Source location
+
+    public FRefNode( String name, Lexer loc ) { this(name,loc,FREF_TYPE); }
+    public FRefNode( String name, Lexer loc, Type type ) {
+        super(type);
+        _name = name;
+        _loc = loc;
+    }
+
+    @Override public String label() { return "FRef"+_name; }
+
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        return p.p("FRef_").p(_name);
+    }
+
+    @Override public Node idealize() {
+        // When FRef finds its definition, idealize to it
+        return nIns()==1 ? null : in(1);
+    }
+
+    public Parser.ParseException err() { return Parser.error("Undefined name '"+_name+"'",_loc); }
+
+    @Override public boolean eq(Node n) { return this==n; }
+    @Override int hash() { return _name.hashCode(); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/FldOffNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/FldOffNode.java
new file mode 100644
index 00000000..223ca79e
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/FldOffNode.java
@@ -0,0 +1,55 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+import java.util.HashMap;
+
+/**
+ * A field offset.  This becomes a constant *after* other optimizations which
+ * determine field sizes - some fields might be dead, or hold only zeros or
+ * small values.
+ */
+
+public class FldOffNode extends TypeNode {
+    public final String _fname; // Field name
+    public final Lexer _loc;   //
+    public FldOffNode( Node base, String fname, Lexer loc ) { super(TypeInteger.BOT,base); _fname = fname; _loc=loc; }
+    @Override public Tag serialTag() { throw Utils.TODO("should not reach here"); }
+
+    @Override public String label() {
+        return _fname == " len" ? "sizeof()" : "#"+_fname;
+    }
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        return p.p(label());
+    }
+
+    @Override public Type compute() {
+        return Type.BOTTOM;
+    }
+
+    @Override public Node idealize() {
+        // When base() gets typed, this xforms into a ConFldOffNode
+        if( in(0)._type instanceof TypeMemPtr tmp )
+            return new ConFldOffNode(tmp._obj,_fname);
+        return null;
+    }
+
+    @Override public boolean eq(Node n) {
+        FldOffNode off = (FldOffNode)n; // Invariant
+        return _fname.equals(off._fname) && super.eq(n);
+    }
+    @Override int hash() { return super.hash() * _fname.hashCode(); }
+
+    @Override public Parser.ParseException err() {
+        if( in(0)._type instanceof TypeMemPtr tmp && tmp._obj._fref )
+            return Parser.error("Unknown struct type '"+tmp._obj._name+"'",null);
+        return null;
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/FunNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/FunNode.java
new file mode 100644
index 00000000..d76d80b5
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/FunNode.java
@@ -0,0 +1,499 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.BAOS;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+import java.util.Arrays;
+import java.util.BitSet;
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+import static com.seaofnodes.simple.codegen.CodeGen.CODE;
+
+public class FunNode extends RegionNode {
+
+    // When set true, this Call/CallEnd/Fun/Return is being trivially inlined
+    public boolean _folding;
+    public boolean folding() { return _folding; }
+
+    private TypeFunPtr _sig;    // Initial signature
+    private ReturnNode _ret;    // Return pointer
+
+    public String _name;        // Debug name
+
+    public int _approxUIDs;     // Approximate function size, used as a inlining heuristic
+    public CompUnit _compunit;  // Defined in source file
+    public final boolean _extern; // External function; no code, name only
+
+    private FunNode( Lexer loc, Node[] nodes, TypeFunPtr sig, String name, CompUnit compunit, boolean ext ) {
+        super(loc,nodes);
+        _name   = name;
+        _sig    = sig;
+        _extern = ext;
+        _compunit = compunit;
+    }
+    public FunNode( Lexer loc, TypeFunPtr sig, String name, CompUnit compunit, Node... nodes ) { this(loc,nodes,sig,name,compunit,false); }
+    public FunNode( FunNode fun ) {
+        super( fun, fun._loc );
+        _sig = fun.sig();
+        _name = fun._name;
+        _compunit = fun._compunit;
+        _extern = fun._extern;
+    }
+    @Override public Tag serialTag() { return Tag.Fun; }
+    @Override public void packed(BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node,Integer> anodes ) {
+        assert !_folding;
+        baos.packed1(Serialize.nIns(this,anodes)); // Object-local linked calls
+        baos.packed2(types.get(_sig)); // NPE if fails lookup
+        baos.packed2(_name==null ? 0 : strs.get(_name));
+        baos.packed2(_approxUIDs);
+        // _compunit set from context on loading, do not write
+    }
+    static Node make( BAOS bais, String[] strs, Type[] types)  {
+        Node[] ins = new Node[bais.packed1()];
+        TypeFunPtr sig = (TypeFunPtr)types[bais.packed2()];
+        String name = strs[bais.packed2()];
+        FunNode fun = new FunNode(null,sig,name,null,ins);
+        fun._approxUIDs = bais.packed2();
+        // _compunit set from context on loading, do not read
+        return fun;
+    }
+
+    @Override public String label() { return _name == null ? "$fun"+_sig.fidx() : _name; }
+
+    // Find the one CFG user from Fun.  It's not always the Return, but always
+    // the Return *is* a CFG user of Fun.
+    @Override public CFGNode uctrl() {
+        for( Node n : _outputs )
+            if( n instanceof CFGNode cfg &&
+                (cfg instanceof RegionNode || cfg.cfg0()==this) )
+                return cfg;
+        return null;
+    }
+
+    public ParmNode parm(int idx) {
+        ParmNode pidx = null;
+        for( Node n : _outputs )
+            if( n instanceof ParmNode parm && parm._idx==idx )
+                { assert pidx==null; pidx=parm; }
+        return pidx;
+    }
+    public ParmNode rpc() { return parm(0); }
+
+    // An unloaded body's Summary is constructed before every other user.
+    public SummaryNode summary() { return nOuts()>0 && out(0) instanceof SummaryNode summary ? summary : null; }
+
+    // This invocation compiles the defining CompUnit from source. Imported
+    // functions still belong to a CompUnit, but its _src is null.
+    public boolean isFromSource() { return _compunit!=null && _compunit._src!=null; }
+
+    // Cannot create the Return and Fun at the same time; one has to be first.
+    // So setting the return requires a second step.
+    public void setRet(ReturnNode ret) { _ret=ret; }
+    public ReturnNode ret() { assert _ret!=null; return _ret; }
+
+    // Signature can improve over time
+    public TypeFunPtr sig() { return _sig; }
+    public void setSig( TypeFunPtr sig ) {
+        assert sig.isa(_sig) || resolvesForwardSelf(sig,_sig);
+        if( _sig != sig ) {
+            CODE.add(this);
+            // Return uses the signature to bound recursive-result widening.
+            CODE.add(_ret);
+            // Changing the signature can allow more inlining
+            if( _ret != null )
+                for( Node use : ret().outs() )
+                    if( use instanceof CallEndNode || use instanceof FunPtrNode )
+                        CODE.add(use);
+            unlock();
+            _sig = sig;
+        }
+    }
+
+    // A class initializer starts parsing with an open singleton receiver and
+    // closes that same receiver after discovering its fields.  Function
+    // arguments are contravariant, so ordinary isa does not describe this
+    // parser-time forward-reference resolution even though every other part
+    // of the signature sharpens normally.
+    private static boolean resolvesForwardSelf(TypeFunPtr sig, TypeFunPtr old) {
+        if( !(sig.arg(0) instanceof TypeMemPtr now) ||
+            !(old.arg(0) instanceof TypeMemPtr prior) ||
+            now._obj._name != prior._obj._name ||
+            !prior._obj._open || now._obj._open )
+            return false;
+        return sig.makeFrom(old.arg(0),0).isa(old);
+    }
+
+    @Override boolean _upgradeType( HashMap<String,Type> TYPES) {
+        TypeFunPtr sig = (TypeFunPtr)_sig.upgradeType(TYPES);
+        if( sig == _sig ) return false;
+        unlock();
+        _sig = sig;
+        return true;
+    }
+
+    public void setName( String name ) {
+        if( _name==null )
+            _name = _compunit==null || _compunit._cname==null || _compunit._cname.indexOf('.')==-1
+                ? name
+                : (_compunit._cname+"."+name).intern();
+    }
+
+    @Override
+    public Type compute() {
+        // Only dead if no callers after SCCP
+        if( unknownCallers() )
+            return Type.CONTROL;
+        Type t = Type.XCONTROL;
+        for( int i = 1; i < nIns(); i++) {
+            // Since there are no unknown callers, the Start input is only a
+            // fake hook and will be a Tuple with XControl, so ignore it.  Need
+            // to be called from someplace other than Start.
+            if( !(in(i) instanceof StartNode) )
+                t = t.meet(in(i)._type);
+        }
+        return t;
+    }
+
+    @Override
+    public Node idealize() {
+
+        // Some linked path dies, except unknown caller hooks never kill Start.
+        Node progress = deadPath(unknownCallers());
+        if( progress!=null ) {
+            if( nIns()==2 && in(1) instanceof CallNode call )
+                CODE.add(call.cend()); // If no Start and one call, check for inline
+            return progress;
+        }
+
+        // Upgrade inferred or user-written return type to actual
+        if( _ret!=null && _ret._type instanceof TypeTuple tt &&
+            tt.ret() != _sig.ret() && tt.ret().isa(_sig.ret()) ) {
+            setSig(_sig.makeFrom(tt.ret()));
+            return this;
+        }
+
+        // Attempt to get rid of the unknown caller.
+        // - Must be past pessimistic Iter, which discovers and links calls
+        //   through class-field loads and other initially imprecise values.
+        // - FIDX is not in the escape set
+        // - Not called anywhere else; post Opto called-not-escaped functions need to still be hooked to start
+        if( !isRoot() && in(1) instanceof StartCUNode start ) {
+            boolean preOpto = CodeGen.CODE._phase == null ||
+                CodeGen.CODE._phase.ordinal() < CodeGen.Phase.Opto.ordinal();
+            if( !preOpto && !start.escapedFIDX(_sig.fidx()) && nIns()<=2 && _ret!=null ) {
+                _compunit._stop.delDef(_compunit._stop._inputs.find(ret()));
+                return removeDeadPath(1);
+            } else {
+                addDep(start);
+            }
+        }
+
+
+        // If no default/unknown caller, use the normal RegionNode ideal rules
+        // to collapse
+        if( unknownCallers() ) return null;
+
+        // If folding (already inlined) down to a single input, become that input.
+        // Cannot collapse if not-inlining, and might not inline if call site
+        // calls multiple targets.
+        if( _folding && nIns()==2 && !hasPhi() ) {
+            CODE.add( CODE._stop ); // Stop will remove dead path
+            CODE.add( _ret );       // Return will compute to TOP control
+            return in(1); // Collapse if no Phis; 1-input Phis will collapse on their own
+        }
+
+        return null;
+    }
+
+    // Bypass Region idom, always assume depth == 1, one more than Start,
+    // unless folding
+    @Override public int idepth() { return _folding ? super.idepth() : 1; }
+
+    // Bypass Region idom, always assume idom is Start
+    @Override public CFGNode idom(Node dep) {
+        return _folding ? cfg(1) : null;
+    }
+
+    // Always in-progress until we run out of unknown callers
+    public boolean unknownCallers() { return nIns()>=2 && in(1) instanceof StartNode; }
+
+    // The starting initializer and public source classes are external entry
+    // points. Privacy stops at the first private class in the name's path.
+    public boolean isRoot() {
+        return isClz() && (CODE.entryClinitName().equals(_name) || (isFromSource() && isPublic()));
+    }
+
+    public boolean isModInit( ) {
+        // The one top-level <clinit> with no internal dots:
+        // "sys.<clinit>" is a module, but "sys.io.<clinit>" is not.
+        return isClz() && _name.indexOf('.')==_name.lastIndexOf('.');
+    }
+    public boolean isClz ( ) { return isClz (_name); }
+    public boolean isInit( ) { return isInit(_name); }
+    public boolean isInstance() { return isInstance(_name); }
+    public static boolean isClz (String name ) { return name!=null && name.endsWith(".<clinit>"); }
+    public static boolean isInit(String name ) { return name!=null && name.endsWith("init>"); }
+    public static boolean isInstance(String name ) { return name!=null && name.endsWith(".<init>"); }
+
+    // Allocation factories and instance initializers carry extra memory boilerplate.
+    public int inlineLimit() {
+        return isInstance() || (_name!=null && _name.endsWith(".<new>")) ? 200 : 100;
+    }
+
+    // Function is public (callable from Start directly).
+    public boolean isPublic( ) {
+        // Never true for anonymous functions
+        if( _name == null ) return false;
+        // Only public for <clinit> and <init>, all others
+        // are found via field loads.  The <init> Start hook also supplies its
+        // conservative pre-Opto construction inputs; StopCU separately keeps
+        // its private-memory return from escaping as a public result.
+        if( !isInit() ) return false;
+        // Private class, has to be found via program text, not linker
+        if( _name.charAt(0)=='_' ) return false;
+
+        // No instances of "...clz1._clz2..." where the class name path
+        // includes a private class.
+        if( _name.indexOf("._") != -1 ) return false;
+
+        // Public class <cl/init>
+        return true;
+    }
+
+    @Override public boolean inProgress() {
+        return unknownCallers() && CodeGen.CODE._phase.ordinal() < CodeGen.Phase.Opto.ordinal();
+    }
+
+    // Build the function body set
+    public BitSet body() {
+        // Iter drains ordinary peeps between inlines; body discovery precedes
+        // this inline's folding, so function boundaries are stable.
+        assert !_folding;
+        // Forward control includes paths that never reach Return.
+        BitSet cfgs = new BitSet();
+        walkCFG(this,cfgs);
+        cfgs.set(ret()._nid);
+
+        // Top down (start to stop) all flavors.  CFG limit to bitmap.
+        // If data use bottoms out in wrong CFG, returns false - but tries all outputs.
+        // If any output hits an in-CFG use (e.g. phi), then keep node.
+        BitSet body = new BitSet();
+        // The function owns its Return even when it has no executable exit.
+        body.set(ret()._nid);
+        BitSet visit = new BitSet();
+        int old;
+        do {
+            old = body.cardinality();
+            visit.clear();
+            walkDown(this, cfgs, body, visit);
+        } while( old != body.cardinality() );
+        return body;
+    }
+
+    private static void walkCFG(CFGNode n, BitSet cfgs) {
+        if( cfgs.get(n._nid) ) return;
+        cfgs.set(n._nid);
+        if( n instanceof ReturnNode ) return;
+        for( Node use : n._outputs ) {
+            if( !(use instanceof CFGNode cfg) || cfg instanceof FunNode ) continue;
+            if( cfg instanceof RegionNode ? cfg._inputs.find(n)>0 : cfg.in(0)==n )
+                walkCFG(cfg,cfgs);
+        }
+    }
+
+    private static boolean walkDown( Node n, BitSet cfgs, BitSet body, BitSet visit ) {
+        if( n==null ) return false;
+        if( visit.get(n._nid) ) return body.get(n._nid);
+        visit.set(n._nid);
+        // Visit self as CFG outside the function
+        if( n instanceof CFGNode && !cfgs.get(n._nid) )
+            return false;
+        // Pretend the NewNode is a CFG, so its projections stay with it in loops
+        if( n instanceof NewNode nnn ) cfgs.set(n._nid);
+        // Visit n.cfg() outside of function
+        if( n.in(0)!=null && !cfgs.get(n.in(0)._nid) )
+            return false;
+        // Phis inside the function must have their body flag set BEFORE
+        // recursion walks around a loop and finds them again.
+        if( n instanceof PhiNode phi && cfgs.get(phi.in(0)._nid) )
+            body.set(phi._nid); // Find data cycles
+        boolean in = n.in(0)!=null || n instanceof CFGNode;
+        for( Node use : n._outputs ) {
+            // Will hit a backedge, so 'n' MUST be in the function, and must be
+            // set before the cyclic walk finds 'n' again.
+            if( use instanceof PhiNode puse && puse.in(0) instanceof LoopNode loop && puse.in(2)==n )
+                body.set(n._nid); // Set before walk
+            in |= walkDown(use,cfgs,body,visit);
+        }
+        if( in ) body.set(n._nid);
+        return in;
+    }
+
+    // Clone function body.  Give function a new FIDX.
+    FunNode copyBody() {
+        // Build the function body BitSet
+        BitSet body = body();
+        assert body.cardinality() < inlineLimit();
+        // Walk the body, cloning
+        IdentityHashMap<Node,Node> map = new IdentityHashMap<>();
+        BitSet visit = CodeGen.CODE.visit();
+        bodyCopy( visit, body, map, this );
+        bodyCopy( visit, body, map, _ret ); // May be disconnected from executable control.
+        visit.clear();
+        bodyEdge( visit, body, map, this );
+        bodyEdge( visit, body, map, _ret );
+        visit.clear();
+        assert map.size()==body.cardinality();
+
+        // New function/return cross-link each other
+        FunNode    fun2 = (FunNode   )map.get(this);
+        ReturnNode ret2 = (ReturnNode)map.get(_ret);
+        fun2._ret = ret2;
+        ret2._fun = fun2;
+        BitSet body2 = new BitSet();
+        for( Node n : map.values() )
+            body2.set(n._nid);
+
+        // Remove non-body callers.  Body-local call edges were cloned along
+        // with their CallEnds and must stay linked so their cloned types remain
+        // monotonic during the post-Opto Iter.
+        for( int i=1; i<fun2.nIns(); i++ )
+            if( !(fun2.in(i) instanceof CallNode call) || !body2.get(call._nid) )
+                fun2.removeDeadPath(i--);
+
+        // Linking adds graph edges and worklist entries; identity-map order
+        // would make inlining depend on the host JVM's object hashes.
+        Node[] olds = map.keySet().toArray(new Node[0]);
+        Arrays.sort(olds, (x,y) -> Integer.compare(x._nid,y._nid));
+        for( Node old : olds )
+            if( old instanceof CallNode oldCall )
+                relinkClonedCall(oldCall,(CallNode)map.get(oldCall),map);
+
+        // Flip to a new FIDX to avoid confusion with the old one.
+        // This is a non-monotonic (sideways) type move, only applicable
+        // because fun2 is new.  The fidx is also a purely local fiction,
+        // since this body will inline and the fidx goes dead.
+        fun2._sig = _sig.makeFrom(CodeGen.CODE._fidxs.nextInline());
+        return fun2;
+    }
+
+    private static void relinkClonedCall( CallNode oldCall, CallNode call, IdentityHashMap<Node,Node> map ) {
+        CallEndNode oldCend = oldCall.cend();
+        if( oldCend==null || oldCend._folding )
+            return;
+        for( int i=1; i<oldCend.nIns(); i++ ) {
+            ReturnNode oldRet = (ReturnNode)oldCend.in(i);
+            FunNode oldFun = oldRet.fun();
+            FunNode fun = (FunNode)map.get(oldFun);
+            if( fun==null ) fun = oldFun;
+            if( !call.linked(fun) )
+                call.link(fun);
+        }
+        CallEndNode cend = call.cend();
+        if( cend.nIns() > 1 )
+            cend._type = cend.compute();
+    }
+
+    // Clone small function
+    private void bodyCopy( BitSet visit, BitSet body, IdentityHashMap<Node,Node> map, Node n ) {
+        if( n==null ) return;
+        if( !body.get(n._nid) ) return; // Not part of the body
+        if( visit.get(n._nid) ) return; // Been there, done that
+        visit.set(n._nid);
+        Node m = n.copy();
+        CodeGen.CODE.add(m);
+        map.put(n,m);
+        m._type = n._type;
+        for( Node x : n._outputs )
+            bodyCopy(visit,body,map,x);
+    }
+    private void bodyEdge( BitSet visit, BitSet body, IdentityHashMap<Node,Node> map, Node n ) {
+        if( n==null ) return;
+        if( !body.get(n._nid) ) return; // Not part of the body
+        if( visit.get(n._nid) ) return; // Been there, done that
+        visit.set(n._nid);
+        Node m = map.get(n);
+        for( Node e : n._inputs ) {
+            Node x = e;
+            if( e != null ) {
+                if( n instanceof CallEndNode cend && e != cend.call() &&
+                    (!(e instanceof ReturnNode ret) || map.get(ret.fun()) == null) )
+                    continue;
+                x = map.get(e);
+                if( x == null ) {
+                    if( n instanceof CallEndNode cend && e != cend.call() )
+                        continue;
+                    x = e;
+                }
+            }
+            m.addDef(x);
+        }
+        for( Node x : n._outputs )
+            bodyEdge(visit,body,map,x);
+    }
+
+
+    // no 2 FunNodes are ever GVN'able
+    @Override public boolean eq( Node n ) {
+        return this==n;
+    }
+
+    @Override public int hash() {
+        return _sig.hashCode();
+    }
+
+    // ------------
+    // MachNode specifics, shared across all CPUs
+
+    // Function may call other functions?  X86 requires 16b aligned SP on
+    // outbound calls, but not leaf.  Set during an unrelated RA scan.
+    public boolean _hasCalls;
+
+    // Maximum incoming argument slot, based on function type
+    public int _maxArgSlot;
+
+    // Frame adjust, including padding, set during early Encoding
+    public int _frameAdjust;
+
+    public String op() { return _frameAdjust==0 ? "entry" : "subi"; }
+    public void postSelect(CodeGen code) {
+        code.link(this);
+        // Max slot seen past space reserved for incoming arguments
+        _maxArgSlot = code._mach.maxArgSlot(sig());
+    }
+    public RegMask regmap(int i) { return null; }
+    public RegMask outregmap() { return null; }
+    public void encoding( Encoding enc ) { throw Utils.TODO();  }
+    public void asm(CodeGen code, SB sb) {
+        if( _frameAdjust!=0 )
+            sb.p("rsp -= #").p(_frameAdjust);
+    }
+
+    public void computeFrameAdjust(CodeGen code, int maxReg) {
+        // Max slot seen, or 0.
+        int maxSlot = Math.max(maxReg - code._mach.regs().length,_maxArgSlot);
+        // Frame adjust before rounding, can be negative for no spills
+        int size = maxSlot - _maxArgSlot;
+        _frameAdjust = size*8;
+    }
+
+    // Given a high register number and during encoding compute the stack
+    // pointer offset.  Pre-RA we lack the fun._frameAdjust.  We also need a
+    // FunNode.
+    public int computeStackOffset(CodeGen code, int reg) {
+        String[] regs = code._mach.regs();
+        int stackSlot = reg - regs.length;
+        int slotRotate = stackSlot < _maxArgSlot
+            ? stackSlot + (_frameAdjust>>3)
+            : stackSlot - _maxArgSlot;
+        return slotRotate*8;
+    }
+
+    @Override public void gather( HashMap<String,Integer> strs ) {
+        Serialize.gather(strs,_name);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/FunPtrNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/FunPtrNode.java
new file mode 100644
index 00000000..82053fd8
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/FunPtrNode.java
@@ -0,0 +1,68 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.BAOS;
+
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+// Constant function pointer whose type follows the callee signature.
+public class FunPtrNode extends TypeNode {
+    public FunPtrNode(TypeFunPtr tfp, StartNode start, ReturnNode ret) {
+        super(tfp,start,ret);
+    }
+    public FunPtrNode(FunPtrNode fptr) { super(fptr); }
+    @Override public Tag serialTag() { return Tag.FunPtr; }
+    @Override public void packed(BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node,Integer> anodes) {
+        baos.packed2(types.get(_con));
+    }
+    static Node make(BAOS bais, Type[] types) {
+        return new FunPtrNode((TypeFunPtr)types[bais.packed2()],null,null);
+    }
+    public ReturnNode ret() { return (ReturnNode)in(1); }
+    public FunNode fun() { return ret().fun(); }
+
+    @Override public String label() { return "#"+_con; }
+    @Override public Node copy() {
+        FunPtrNode fptr = new FunPtrNode((TypeFunPtr)_con,null,null);
+        fptr._type = _type;
+        return fptr;
+    }
+
+    @Override
+    protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        FunNode fun = CodeGen.CODE._link(((TypeFunPtr)_con).fidx());
+        return fun!=null && fun._name!=null
+            ? p.p("{ ").p(fun._name).p("}")
+            : p.p(_con);
+    }
+
+    @Override public boolean isConst() { return true; }
+    @Override public Type compute() {
+        ReturnNode ret = ret();
+        if( ret == null ) return _con;
+        if( !(ret._type instanceof TypeTuple tt) ) return ret._type.oob();
+        TypeFunPtr tfp = ret.fun().sig();
+        // Both the sig and the return value must be true, so JOIN both
+        Type tret = tfp._ret.join(tt.ret());
+        return tfp.makeFrom(tret);
+    }
+    @Override public Node idealize() {
+        ReturnNode ret = ret();
+        if( ret==null ) return null;
+        // Function died (never executed), but fcn ptr is alive.
+        // Can be checked for null, or for unequals another FunPtr.
+        FunNode fun = addDep(ret.fun());
+        TypeFunPtr sig = fun.sig();
+        if( sig != _con )
+            { liftType(sig);  return this; }
+        // TODO: If the function body dies but this value remains live only as
+        // a null/equality sentinel, preserve the identity without the Return.
+        if( fun.isDead() )
+            { setDef(1,null); liftType(sig.makeFrom(Type.TOP)); return this; }
+        return null;
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/GlobalEscapeNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/GlobalEscapeNode.java
new file mode 100644
index 00000000..dab48530
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/GlobalEscapeNode.java
@@ -0,0 +1,40 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.type.*;
+
+// Escapes from calls and unloaded bodies, shared by all compilation units.
+// These include paths which never Return. Iter creates this after parsing;
+// the outer Start holds it until Unlink. Saved objects contain the resulting
+// StopCU types instead. Dependencies wake this node when contributors change;
+// Stops need waking only when the combined result changes.
+public class GlobalEscapeNode extends Node {
+    public GlobalEscapeNode() { super(new Node[0]); _type = TypeMem.BOT; }
+    @Override public String label() { return "GlobalEscape"; }
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) { return p.p(label()); }
+    @Override public Node idealize() { return null; }
+
+    @Override public TypeMem compute() {
+        TypeMem xmem = StopCUNode.priorEscapes(_type);
+        for( CallNode call : CodeGen.CODE._calls )
+            if( !call.isDead() ) {
+                xmem = StopCUNode.publicBottom(xmem.escapes(call.exposed(this)),xmem);
+                // FULL memory normalizes to public bits. Preserve precise
+                // private arguments independently of that normalization.
+                if( call._type==Type.CONTROL && call.exposesArguments(this) )
+                    for( int i = 0; i<call.nargs(); i++ )
+                        xmem = StopCUNode.publicBottom(xmem.escapes(addDepForwards(call.arg(i+2))._type),xmem);
+            }
+        for( FunNode fun : CodeGen.CODE._linker )
+            if( fun!=null && fun.summary()!=null && !fun.summary().isDead() ) {
+                xmem = StopCUNode.publicBottom(xmem.escapes(fun.summary().exposed(this)),xmem);
+                // A reachable unloaded body can call these targets, including
+                // private initializers. Its arguments are unavailable here.
+                if( fun._type==Type.CONTROL )
+                    for( int fidx : fun.summary()._classDependencyFIDXs )
+                        if( fidx!=0 ) xmem = xmem.makeFrom(XInt.meet(xmem._escFs,XInt.make(fidx)),xmem._escAs);
+            }
+        return xmem;
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/GuardMach.java b/chapter29/src/main/java/com/seaofnodes/simple/node/GuardMach.java
new file mode 100644
index 00000000..202b1ab8
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/GuardMach.java
@@ -0,0 +1,17 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.util.SB;
+
+public class GuardMach extends GuardNode implements MachNode {
+    public GuardMach(GuardNode guard) { super(guard); }
+    @Override public String op() { return label(); }
+    @Override public RegMask regmap(int i) { assert i==1; return RegMask.FULL; }
+    @Override public RegMask outregmap() { return RegMask.FULL; }
+    @Override public int twoAddress() { return in(1)._type==Type.BOTTOM ? 0 : 1; }
+    @Override public void encoding(Encoding enc) { }
+    @Override public void asm(CodeGen code, SB sb) { sb.p(code.reg(in(1))); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/GuardNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/GuardNode.java
new file mode 100644
index 00000000..0ce504d9
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/GuardNode.java
@@ -0,0 +1,68 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeScalar;
+import com.seaofnodes.simple.util.BAOS;
+import com.seaofnodes.simple.util.Utils;
+
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+// A branch-proven refinement to zero/null or non-zero/non-null.  The value
+// family is deliberately taken from the input when it becomes known.
+public class GuardNode extends Node {
+    public final boolean _nonZero;
+
+    public GuardNode(boolean nonZero, Node ctrl, Node val) {
+        super(ctrl,val);
+        _nonZero = nonZero;
+    }
+
+    public GuardNode(GuardNode guard) {
+        super(guard);
+        _nonZero = guard._nonZero;
+    }
+
+    @Override public Tag serialTag() { return Tag.Guard; }
+    @Override public void packed(BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node,Integer> anodes) {
+        baos.write(_nonZero ? 1 : 0);
+    }
+    static Node make(BAOS bais) { return new GuardNode(bais.read()!=0,null,null); }
+
+    @Override public String label() { return _nonZero ? "(!=0)" : "(==0)"; }
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        return p.p(label()).n(in(1));
+    }
+
+    @Override public Type compute() {
+        // Guard is a pinned, path-local fact.  If its control path is not
+        // executable, the fact is not executable either, regardless of how the
+        // value input sharpens later.
+        Type c = in(0)._type;
+        if( c != Type.CONTROL && c != Type.BOTTOM )
+            return Type.TOP;
+        Type t = in(1)._type;
+        if( t==Type.BOTTOM || t==Type.TOP ) return t;
+        // The scalar envelope does not identify a value family.  Preserve it
+        // until SCCP learns whether this is an int, float, pointer, or fptr;
+        // choosing generic ptr here can be weaker than a later concrete type.
+        if( t==TypeScalar.BOT || t==TypeScalar.TOP ) return t;
+        Type t2 = _nonZero ? t.nonZero() : t.makeZero();
+        return t2==null ? (_type==null ? Type.TOP : _type) : t2; // No sane answer for e.g. not-zero of a zero
+    }
+
+    @Override public Node idealize() {
+        if( in(0)._type != Type.CONTROL && in(0)._type != Type.BOTTOM )
+            return null;
+        if( in(1)._type==Type.BOTTOM || in(1)._type==Type.TOP ) return null;
+        if( _type.isHighOrConst() && in(1)._type.isa(_type) )
+            return in(1);
+        return null;
+    }
+
+    @Override public boolean eq(Node n) { return _nonZero==((GuardNode)n)._nonZero; }
+    @Override int hash() { return _nonZero ? 1 : 0; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/IfNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/IfNode.java
new file mode 100644
index 00000000..c83c81d0
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/IfNode.java
@@ -0,0 +1,100 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.Utils;
+
+public class IfNode extends CFGNode implements MultiNode {
+
+    public IfNode(Node ctrl, Node pred) {
+        super(ctrl, pred);
+        CodeGen.CODE.add(this); // Because idoms are complex, just add it
+    }
+    public IfNode(IfNode iff) { super(iff); }
+    @Override public Tag serialTag() { return Tag.If; }
+
+    @Override
+    protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        p.p("if( ");
+        if( in(1)==null ) p.p("never");
+        else p.n(in(1));
+        return p.p(" )");
+    }
+
+    public Node ctrl() { return in(0); }
+    public Node pred() { return in(1); }
+
+    // No one unique control follows
+    @Override public CFGNode uctrl() { return null; }
+
+    @Override
+    public Type compute() {
+        // If the If node is not reachable then neither is any following Proj
+        assert !_inputs.isEmpty();
+        if (ctrl()._type != Type.CONTROL && ctrl()._type != Type.BOTTOM )
+            return TypeTuple.IF_NEITHER;
+        Node pred = pred();
+        Type t = pred._type;
+        // High types mean NEITHER side is reachable.
+        // Wait until the type falls to decide which way to go.
+        if( t.isHigh() )
+            return TypeTuple.IF_NEITHER;
+        // If constant is 0 then false branch is reachable
+        // Else true branch is reachable
+        if( t.isConstant() )
+            return (t==Type.NIL || t==TypeInteger.ZERO || (t instanceof TypeFunPtr tfp && tfp._fidxs== XInt.EMPTY) ) ? TypeTuple.IF_FALSE : TypeTuple.IF_TRUE;
+        // If adding a zero makes a difference, the predicate must not have a zero/null
+        if( !t.makeZero().isa(t) )
+            return TypeTuple.IF_TRUE;
+
+        return TypeTuple.IF_BOTH;
+    }
+
+    @Override
+    public Node idealize() {
+        // Hunt up the immediate dominator tree.  If we find an identical if
+        // test on either the true or false branch, that side wins.
+        if( !pred()._type.isHighOrConst() )
+            for( CFGNode dom = idom(), prior=this; dom!=null;  prior = dom, dom = dom.idom() )
+                if( addDep(dom) instanceof IfNode iff &&
+                    prior instanceof CProjNode prj &&
+                    (addDep(iff.pred())==pred() ||
+                     pred() instanceof GuardNode cast && cast._nonZero && iff.pred()==cast.in(1) ) ) {
+                    setDef(1,con( prj._idx==0 ? 1 : 0 ));
+                    return this;
+                }
+        return null;
+    }
+
+    // MachNode variants need to support this and negate the conditional test.
+    // The following CProjs will be inverted by the caller.
+    public void negate() { throw Utils.TODO(); }
+
+    // Negate the sense of a test
+    public static String negate( String bop ) {
+        return switch( bop ) {
+        case "<"  -> ">=";
+        case "<=" -> ">" ;
+        case "==" -> "!=";
+        case "!=" -> "==";
+        case ">"  -> "<=";
+        case ">=" -> "<" ;
+        default -> throw Utils.TODO();
+        };
+    }
+
+    // Swap compare operands
+    public static String swap( String bop ) {
+        return switch( bop ) {
+        case "<"  -> ">" ;
+        case "<=" -> ">=";
+        case "==" -> "==";
+        case "!=" -> "!=";
+        case ">"  -> "<" ;
+        case ">=" -> "<=";
+        default -> throw Utils.TODO();
+        };
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/LoadNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/LoadNode.java
new file mode 100644
index 00000000..9aa8b311
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/LoadNode.java
@@ -0,0 +1,338 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.GlobalBits;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.BAOS;
+import com.seaofnodes.simple.util.Utils;
+import java.util.BitSet;
+
+/**
+ * Load represents extracting a value from inside a memory object,
+ * in chapter 10 this means Struct fields.
+ */
+public class LoadNode extends MemOpNode {
+
+    /**
+     * Load a value from a ptr.field.
+     *
+     * @param name  The field we are loading
+     * @param mem   The memory alias node - this is updated after a Store
+     * @param ptr   The ptr to the struct base from where we load a field
+     * @param off   The offset inside the struct base
+     */
+    public LoadNode(Lexer loc, String name, int alias, Node ctrl, Node mem, Node ptr, Node off) {
+        super(loc, name, alias, true, Type.BOTTOM, ctrl, mem, ptr, off);
+    }
+    LoadNode( BAOS bais, String[] strs, Type[] types, GlobalBits fileAliases, GlobalBits aliases ) {
+        super(bais,strs,types,fileAliases,aliases,true);
+        _con = Type.BOTTOM;      // Serialized slot retained while MemOps share TypeNode
+    }
+    @Override public Tag serialTag() { return Tag.Load; }
+
+    @Override boolean canDrop(MemOpNode other, Node dep) {
+        return super.canDrop(other,dep) && !clobbered(dep);
+    }
+
+    // Check only immediate memory users. Writers clobber memory; Phis and
+    // aggregates might lead to a clobber, so stop rather than search further.
+    private boolean clobbered(Node dep) {
+        Node mem = mem();
+        dep.addDepForwards(mem);
+        for( Node use : mem._outputs ) {
+            if( use==null ) continue;
+            dep.addDepForwards(use);
+            if( use instanceof StoreNode || use instanceof PhiNode ||
+                use instanceof MemMergeNode ||
+                use instanceof NewNode || use instanceof EscapeNode || use instanceof CallNode ||
+                use instanceof CLInitNode ) return true;
+        }
+        return false;
+    }
+
+    // Debugger label
+    @Override public String  label() { return "ld_"+mlabel(); }
+    @Override
+    protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) { return p.p(".").p(_name); }
+
+    @Override
+    public Type compute() {
+        Type mem0 = mem()._type;
+        Type ptr0 = ptr()._type;
+        // Validate argument types
+        if( ptr0.isHigh() )
+            return TypeScalar.TOP;
+        if( !(mem0 instanceof TypeMem mem) )
+            return mem0.isHigh() ? TypeScalar.TOP : TypeScalar.BOT;
+        if( mem._t == Type.TOP )
+            return TypeScalar.TOP;
+        if( ptr0 == Type.NIL )
+            return Type.BOTTOM; // Load from nil is error
+        if( ptr0 == Type.BOTTOM )
+            return Type.BOTTOM; // Error in is error out
+        if( !(ptr0 instanceof TypeMemPtr tmp) )
+            return scalar(mem._t);
+        if( tmp.nullable() )
+            return Type.BOTTOM; // Load from nil-able is error
+
+        // Load field from object
+        Field pfld = tmp._obj.field(_name);
+        // No field?  Open objects might yet get the field when falling;
+        // closed objects with missing field are an error.
+        if( pfld == null )
+            return tmp.isHigh() || tmp._obj.isHigh() ? TypeScalar.TOP : TypeScalar.BOT;
+
+        Type t = pfld._t;
+        boolean readonly = t instanceof TypeMemPtr view && view._ro;
+        // Load member of constant array
+        if( t instanceof TypeConAry ary )
+            t = ary.elem();     // TODO: if offset is known, can peek the constant
+        if( mem._alias==_alias )
+            t = t.join(mem._t);
+
+        // A deeply read-only base produces a deeply read-only value.  The
+        // generic declared field type must not cast this information away.
+        if( ptr0.isFinal() || readonly )
+            t = t.makeRO();
+        return scalar(t);
+    }
+
+    // Loads produce ordinary scalar values.  Field/memory joins can still
+    // expose the enclosing global lattice bounds through an uninitialized
+    // Type.TOP/BOTTOM field; keep those results inside the scalar envelope.
+    private static Type scalar(Type t) {
+        return t==Type.TOP ? TypeScalar.TOP : t==Type.BOTTOM ? TypeScalar.BOT : t;
+    }
+
+    @Override
+    public Node idealize() {
+        Node mem = mem();
+        Node ptr = ptr();
+
+        // Null checks are handled by types. Array elements retain control for
+        // range checks, but reading an array's length has no index to check.
+        if( in(0)!=null && ptr._type instanceof TypeMemPtr tmp &&
+            (!tmp._obj.isAry() || _name.equals("#")) ) {
+            setDef(0,null);
+            return this;
+        }
+
+        // Forward-ref loads eventually sharpen to a declared type
+        Field fld;
+        if( ptr._type instanceof TypeMemPtr tmp &&
+            (fld=tmp._obj.field(_name)) != null &&
+            _alias != fld._alias) {
+            assert _alias==1 || _alias == fld._alias;
+            assert !tmp._obj._open && !tmp._obj._fref;
+            unlock();           // Alias participates in GVN semantics
+            _alias = fld._alias;
+            return this;
+        }
+        // Must sharpen alias first
+        if( _alias == 1 )
+            return null;
+
+        Node slice = CLInitNode.slice(mem,_alias,this);
+        if( slice!=mem ) { setDef(1,slice); return this; }
+
+        if( mem instanceof MemMergeNode merge ) {
+            setDef(1,merge.alias(_alias));
+            // In support of uplifting control to a prior dominating load, if
+            // we move our memory, recheck other loads to see if they can hoist.
+            for( Node use : in(1).outs() )
+                if( use instanceof LoadNode ld && use != this && ptr == ld.ptr() )
+                    CodeGen.CODE.add(ld);
+
+            return this;
+        }
+
+        // Uplift control to a prior dominating load.
+        for( Node memuse : mem._outputs )
+            // Find a prior load, has same mem,ptr,off but higher ctrl
+            if( memuse != this && memuse instanceof LoadNode ld && ptr==ld.ptr() && off()==ld.off() &&
+                cfg0()!=null && cfg0().domLCA(ld.cfg0(),this) == ld.cfg0() && // Higher control means load is legal earlier
+                addDep(ld)._type.isa(_type) ) // and not rolling backwards
+                return ld;
+
+        Node win = find(mem,ptr,null,null);
+        if( win!=null ) return folded(win);
+        if( ptr instanceof ReadOnlyNode ro ) ptr=ro.in(1);
+
+        // Push a Load up through a Phi, as long as it collapses on at least
+        // one arm.  If at a Loop, the backedge MUST collapse - else we risk
+        // spinning the same transform around the loop indefinitely.
+        //   BEFORE (2 Sts, 1 Ld):          AFTER (1 St, 0 Ld):
+        //   if( pred ) ptr.x = e0;         val = pred ? e0
+        //   else       ptr.x = e1;                    : e1;
+        //   val = ptr.x;                   ptr.x = val;
+        if( mem() instanceof MemPhiNode memphi && memphi.region()._type == Type.CONTROL && memphi.nIns()== 3 &&
+            // Retain control on both copies only if it dominates both paths.
+            // The Region itself, or a later range check, cannot move to its inputs.
+            (in(0)==null || cfg0().domLCA(memphi.region().idom(this),this)==cfg0()) &&
+            // Offset can be hoisted
+            off() instanceof ConstantNode &&
+            // Pointer can be hoisted
+            hoistPtr(ptr,memphi)  ) {
+
+            // Returning to this memory means no change only if the pointer
+            // is also loop invariant. A pointer Phi may select another object.
+            Node stop = memphi.region() instanceof LoopNode &&
+                !(ptr instanceof PhiNode p && p.region()==memphi.region()) ? memphi : null;
+            if( find(memphi.in(2),ptr,stop,new BitSet())!=null ||
+                (!(memphi.region() instanceof LoopNode) && find(memphi.in(1),ptr,null,new BitSet())!=null) ) {
+                // Integer loop Phis widen to i64. Keep the load's declared
+                // width at the result, as for ordinary typed loop variables.
+                if( _type instanceof TypeInteger && !declaredType().isa(_type) ) return null;
+                PhiNode phi = new PhiNode(_name,memphi.region()).keep();
+                phi.setType(_type instanceof TypeInteger ? TypeInteger.BOT : _type);
+                for( int i=1; i<memphi.nIns(); i++ ) {
+                    Node p = ptr instanceof PhiNode pp && pp.region()==memphi.region() ? pp.in(i) : ptr;
+                    phi.addDef(load(memphi.in(i),p,stop,phi));
+                }
+                CodeGen.CODE.add(phi.unkeep());
+                return _type instanceof TypeInteger ? new ConvertNode(declaredType(),phi) : phi;
+            }
+        }
+
+        return null;
+    }
+
+    // Load a flavored zero from a New
+    private Node zero(NewNode nnn) {
+        Type zero = declaredType().makeZero();
+        assert zero.isa(_type); // Catch an uninitialized non-null field
+        return castRO(new ConstantNode(zero).peephole());
+    }
+
+    // Search only; no new nodes or rewiring. Return a Store/New that folds,
+    // the unchanged loop memory, or a merge whose every arm folds. Null fails.
+    // Register dependencies so a later pointer/offset rewrite retries the query.
+    private Node find(Node mem, Node ptr, Node stop, BitSet visit) {
+        if( ptr instanceof ReadOnlyNode ro ) ptr=ro.in(1);
+        Field fld;
+        boolean external = ptr._type instanceof TypeMemPtr tmp &&
+            (fld=tmp._obj.field(_name))!=null && fld._extern;
+        while( mem!=null ) {
+            addDep(mem);
+            if( mem==stop ) return mem;
+            switch( mem ) {
+            case MemMergeNode merge: mem=merge.alias(_alias); break;
+            case StoreNode st:
+                // Alias 1 is still unresolved, not a proven different field.
+                if( st._alias==1 ) return null;
+                addDep(st.ptr());
+                if( _alias==st._alias && (ptr==st.ptr() || ptr==st.nnptr()) && off()==st.off() ) {
+                    // A full-width load cannot narrow the forwarded value.
+                    if( declaredType() instanceof TypeInteger ti && ti.log_size()==3 &&
+                        !addDep(st.val())._type.isa(_type) ) return null;
+                    return st;
+                }
+                if( (external || _alias==st._alias) && (external || !neverAlias(ptr,st.ptr())) &&
+                    !addDep(off())._type.join(addDep(st.off())._type).isHigh() ) return null;
+                mem=st.mem();
+                break;
+            case ProjNode proj:
+                // New's memory is private; public memory is joined at Escape.
+                if( external || !(proj.in(0) instanceof NewNode nnn) ) return null;
+                if( declaredType()==Type.BOTTOM ) return null;
+                return nnn;
+            case EscapeNode esc:
+                if( external ) return null;
+                addDep(esc.self());
+                if( esc.self()==ptr ) { mem=esc.priv(); break; }
+                if( neverAlias(ptr,esc.self()) ) { mem=esc.pub(); break; }
+                return null;
+            case MemPhiNode phi:
+                addDep(phi.region());
+                // Only the original loop closes a successful cycle. Another
+                // loop or an unfinished merge needs a separate proof.
+                if( visit==null || !(phi.region() instanceof RegionNode r) || r instanceof LoopNode ||
+                    r.inProgress() || phi.inProgress() || r._type!=Type.CONTROL ) return null;
+                if( visit.get(phi._nid) ) return phi; // Already proved every arm.
+                for( int i=1; i<phi.nIns(); i++ )
+                    if( find(phi.in(i),ptr,stop,visit)==null ) return null;
+                visit.set(phi._nid);
+                return phi;
+            default: return null;
+            }
+        }
+        return null;
+    }
+
+    private Node folded(Node win) {
+        return win instanceof StoreNode st ? extend(castRO(st.val())) : zero((NewNode)win);
+    }
+
+    // Materialize only after the profitability search succeeds. The value Phi
+    // stands for a load which comes back around the loop with unchanged memory.
+    private Node load(Node mem, Node ptr, Node stop, PhiNode value) {
+        Node win=find(mem,ptr,stop,new BitSet());
+        if( win!=null ) {
+            if( win==stop ) return value;
+            if( win instanceof MemPhiNode mp ) {
+                PhiNode phi=new PhiNode(_name,mp.region()).keep();
+                for( int i=1; i<mp.nIns(); i++ ) phi.addDef(load(mp.in(i),ptr,stop,value));
+                return CodeGen.CODE.add(phi.unkeep().peephole());
+            }
+            Node fold=folded(win);
+            if( fold!=null ) return fold.peephole();
+        }
+        LoadNode ld=new LoadNode(_loc,_name,_alias,in(0),mem,ptr,off());
+        return ld.peephole();
+    }
+
+    private static boolean neverAlias( Node ptr1, Node ptr2 ) {
+        return ptr1.in(0) != ptr2.in(0) &&
+            // Unrelated allocations
+            ptr1 instanceof ProjNode && ptr1.in(0) instanceof NewNode &&
+            ptr2 instanceof ProjNode && ptr2.in(0) instanceof NewNode;
+    }
+
+    private static boolean hoistPtr(Node ptr, PhiNode memphi ) {
+        // Can I hoist ptr above the Region?
+        if( !(memphi.region() instanceof RegionNode r) )
+            return false;       // Dead or dying Region/Phi
+        // If ptr from same Region, then yes, just use hoisted split pointers
+        if( ptr instanceof PhiNode pphi && pphi.region() == r )
+            return true;
+
+        // No, so can we lift this ptr?
+        CFGNode cptr = ptr.cfg0();
+        if( cptr != null )
+            // Pointer is controlled high
+            // TODO: Really needs to be the LCA of all inputs is high
+            return cptr.idepth() <= r.idepth();
+
+        // Dunno without a longer walk
+        return false;
+    }
+
+    // Read-Only is a deep property, and cannot be cast-away
+    private Node castRO(Node rez) {
+        if( (ptr()._type.isFinal() || declaredType().isFinal()) && !rez._type.isFinal() )
+            return new ReadOnlyNode(rez).peephole();
+        return rez;
+    }
+
+    // When a load bypasses a store, the store might truncate bits - and the
+    // load will need to zero/sign-extend.
+    private Node extend(Node val) {
+        if( !(declaredType() instanceof TypeInteger ti) ) return val;
+        if( ti._min==0 )        // Unsigned
+            return new AndNode(null,val,con(ti._max));
+        // Signed extension
+        int shift = Long.numberOfLeadingZeros(ti._max)-1;
+        Node shf = con(shift);
+        if( shift==0 ) {
+            if( !val._type.isa(_type) )
+                { addDep(val); return null; }
+            return val;
+        }
+        Node shl = new ShlNode(null,val,shf.keep()).peephole();
+        return new SarNode(null,shl,shf.unkeep());
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/LoopNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/LoopNode.java
new file mode 100644
index 00000000..c4d55335
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/LoopNode.java
@@ -0,0 +1,112 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeMem;
+import com.seaofnodes.simple.util.BAOS;
+
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+public class LoopNode extends RegionNode {
+    public LoopNode( Lexer loc, Node xctrl, Node entry ) { super(loc,xctrl,entry,null); }
+    public LoopNode( LoopNode loop ) { super(loop); }
+    @Override public Tag serialTag() { return Tag.Loop; }
+    public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) { }
+
+    public CFGNode entry() { return cfg(1); }
+    public CFGNode back () { return cfg(2); }
+
+    @Override
+    public Type compute() {
+        if( inProgress() ) return Type.CONTROL;
+        return entry()._type;
+    }
+
+    // Bypass Region idom, same as the default idom() using use in(1) instead of in(0)
+    @Override public int idepth() { return validIDepth() ? _idepth : cacheIDepth(entry().idepth()+1); }
+    // Bypass Region idom, same as the default idom() using use in(1) instead of in(0)
+    @Override public CFGNode idom(Node dep) { return entry(); }
+
+    // If this is an unreachable loop, it may not have an exit.  If it does not
+    // (i.e., infinite loop), force an exit to make it reachable.
+    public FunNode forceExit( FunNode fun, StopNode stop ) {
+        // Walk the backedge, then immediate dominator tree util we hit this
+        // Loop again.  If we ever hit a CProj from an If (as opposed to
+        // directly on the If) we found our exit.
+        CFGNode x = back();
+        while( x != this ) {
+            if( x instanceof CProjNode exit && exit.in(0) instanceof IfNode iff ) {
+                CFGNode other = iff.cproj(1-exit._idx);
+                if( other!=null && other._ltree != _ltree && nested(_ltree,other._ltree) )
+                    return fun; // Found an exit, not an infinite loop
+            }
+            x = x.idom();
+        }
+        // Found a no-exit loop.  Insert an exit
+        NeverNode iff = new NeverNode(1.2f,back()).init(); // Ideal never-branch
+        CProjNode t = new CProjNode(iff,0,"True" ).init();
+        CProjNode f = new CProjNode(iff,1,"False").init();
+        setDef(2,t);            // True continues loop, False (never) exits loop
+        ReturnNode ret = fun.ret();
+        iff._ltree = t._ltree = _ltree;
+        ret._ltree = f._ltree = fun._ltree;
+
+        // Now fold control into the exit.  Might have 1 valid exit, or an
+        // XCtrl or a bunch of prior NeverNode exits.
+        // Scheduling can prepare a newly loaded object while other code is
+        // executing. Keep synthetic nodes local; do not GVN into that graph.
+        Node top = ConstantNode.raw(Type.TOP);
+        top.setDef(0,fun);
+        Node memout = new MemMergeNode();
+        memout.addDef(f); // placeholder for control
+        memout.addDef(top);
+        for( Node u : _outputs )
+            if( u instanceof PhiNode phi && phi._type.isa(TypeMem.BOT) )
+                memout.addDef(phi);
+        memout.init();
+
+        Node ctrl = ret.ctrl(), mem = ret.mem(), expr = ret.expr();
+        if( ctrl!=null && ctrl._type != Type.XCONTROL ) {
+            // Perfect aligned exit?
+            if( !(ctrl instanceof RegionNode r &&
+                  mem  instanceof PhiNode pmem && pmem.region()==r &&
+                  expr instanceof PhiNode prez && prez.region()==r ) ) {
+                // Nope, insert an aligned exit layer
+                RegionNode r = new RegionNode(_loc,null,ctrl).init();
+                ctrl = r;  r._ltree = fun._ltree;
+                mem  = new BulkMemPhiNode(r,mem).init();
+                expr = new PhiNode(r,expr).init();
+            }
+            // Append new Never exit
+            ctrl.keep().addDef(f  );
+            mem .keep().addDef(memout);
+            expr.keep().addDef(top);
+        } else {
+            ctrl = f     .keep();
+            mem  = memout.keep();
+            expr = top   .keep();
+        }
+        ret.setDef(0,ctrl.unkeep());
+        ret.setDef(1,mem .unkeep());
+        ret.setDef(2,expr.unkeep());
+        // Force sane types to exit; might locally break monotonicity
+        ret.init();
+        ret.out(0).init();
+        stop.init();
+        CodeGen.CODE.add(CodeGen.CODE._start);
+        CodeGen.CODE.add(mem);
+
+        return fun;
+    }
+
+    private static boolean nested(LoopTree inner, LoopTree outer) {
+        for( ; inner!=null; inner = inner._par )
+            if( inner == outer )
+                return true;
+        return false;
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/MachConcreteNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/MachConcreteNode.java
new file mode 100644
index 00000000..b25fcaaf
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/MachConcreteNode.java
@@ -0,0 +1,26 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.type.Type;
+import java.io.ByteArrayOutputStream;
+
+// Generic machine-specific class, has a few Node implementations that have to
+// exist (abstract) but are not useful past the optimizer.
+public abstract class MachConcreteNode extends Node implements MachNode {
+
+    public MachConcreteNode(Node node) { super(node); }
+    public MachConcreteNode(Node[]nodes) { super(nodes); }
+
+    @Override public String label() { return op(); }
+    @Override public Type compute () { throw new AssertionError("Do not call compute on "+getClass().getSimpleName()); }
+    @Override public Node idealize() { throw new AssertionError("Do not call idealize on "+getClass().getSimpleName()); }
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        p.open().p(op()).p(",");
+        for( int i=1; i<nIns(); i++ )
+            (in(i)==null ? p.p(" ---") :  p.n(in(i))).p(",");
+        return p.unchar(',').close();
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/MachNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/MachNode.java
new file mode 100644
index 00000000..025b5dc4
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/MachNode.java
@@ -0,0 +1,60 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.*;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public interface MachNode {
+
+    // Easy access to the abstract Machine
+    default Machine machine() { return CodeGen.CODE._mach; }
+
+    // Run a post-instruction-selection action
+    default void postSelect( CodeGen code ) { }
+
+    // Register mask allowed on input i.  0 for no register.
+    RegMask regmap( int i );
+    // Register mask allowed as a result.  0 for no register.
+    RegMask outregmap();
+    // Multi-reg-defining machine op; idx comes from Proj.
+    // Sometimes these Projs have no uses, and just exist to kill a register.
+    default RegMask outregmap(int idx) { throw Utils.TODO(); }
+
+    // Set of killed registers
+    default RegMask killmap() { return null; }
+
+    // If this op updates the same register as input 'idx', e.g. many X86 "R1 +=
+    // R2" style ops.  This forces the output live range to equal the input live
+    // range, so they both get the same register.
+
+    // This can hold true for projections, if the instruction updates many
+    // registers that it also takes in.  Note that ops also use the same
+    // registers for both inputs and outputs but these are pinned and without any
+    // choices (e.g. always RCX for both an input and output) and are better
+    // served with just declaring as a fixed register.
+
+    // Returns either 0 for not-two-adr or the updated input; for projections
+    // this is their Multi's updated input.
+    default int twoAddress( ) { return 0; }
+    // Ok to switch arguments
+    default boolean commutes() { return false; }
+
+    // Instructions cheaper to recreate than to spill, such as loading small constants
+    default boolean isClone() { return false; }
+
+    // Make a clone of a cheap instruction
+    default Node copy() { return null; }
+
+    // Encoding is appended, relocations gathered.
+    void encoding( Encoding enc );
+
+    // Human-readable form appended to the SB.  Things like the encoding,
+    // indentation, leading address or block labels not printed here.
+    // Just something like "R17=[R18+12] // Load array base".
+    // General form: "dst=src+src".
+    default void asm(CodeGen code, SB sb) { throw Utils.TODO(); }
+
+    // Human-readable opcode; e.g. "ld4" or "call".
+    default String op() { throw Utils.TODO(); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/MemMergeNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/MemMergeNode.java
new file mode 100644
index 00000000..aa3f6d57
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/MemMergeNode.java
@@ -0,0 +1,158 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Var;
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.*;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.util.BAOS;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.Utils;
+
+import java.util.*;
+
+/**
+ *  Memory Merge - a merge of many aliases into a "fat memory".  All aliases
+ *  are here, but most will be lazy - take the default fat memory.
+ */
+public class MemMergeNode extends Node {
+
+    public MemMergeNode( Node ...nodes) { super(nodes); _type = TypeMem.BOT; }
+    public MemMergeNode(MemMergeNode mem) { super(mem); }
+    @Override public Tag serialTag() { return Tag.MemMerge; }
+    public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) { baos.packed1(nIns()); }
+    static Node make( BAOS bais )  { Node mem = new MemMergeNode(); mem.setDefX(bais.packed1()-1,null); return mem; }
+
+    @Override public String label() { return "ALLMEM"; }
+    @Override public boolean isMem() { return true; }
+
+    @Override
+    protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        p.p("MEM[ ");
+        for( int j=2; j<nIns(); j++ ) {
+            p.p(j);
+            p.p(":");
+            Node n = in(j);
+            while( n instanceof ScopeNode loop ) {
+                p.p("Lazy_");
+                n = loop.mem();
+            }
+            if( n==null ) p.p("___ ");
+            else p.n(n).p(" ");
+        }
+        return p.unchar(' ').p("]");
+    }
+
+
+    @Override public Type compute() {
+        Type tmem = in(1)._type;
+        if( !(tmem instanceof TypeMem defmem) )
+            // A MemMerge is structurally memory even while its default input
+            // is a weak, not-yet-specialized Phi.
+            return tmem.isHigh() ? TypeMem.TOP : TypeMem.BOT;
+        // Is this a single private instance memory?
+        if( defmem._one ) {
+            if( !(defmem._t instanceof TypeStruct ts) )
+                return defmem;
+            // Perfect singleton memory, so all updates are parallel and
+            // independent and stack.
+            for( int i=2; i<nIns(); i++ ) {
+                Node in = in(i);
+                if( in !=null && in._type.isHigh() )
+                    return TypeMem.TOP;
+                if( in instanceof StoreNode st ) {
+                    Type val = ((TypeMem)st._type)._t;
+                    Field old = ts.field(st._name);
+                    // Lazy add an expected field for open structs.
+                    if( old==null )  { assert ts._open;
+                        old = Field.make(st._name,Type.BOTTOM,st._alias,st._init);
+                        ts = ts.add(old);
+                    }
+                    Field fld = old.makeFrom(val);
+                    // TODO: val leaks into perfect singleton memory, along with its fidxs and aliases
+                    ts = ts.replace(fld);
+                }
+            }
+            return TypeMem.makePrivate(ts);
+
+        }
+
+        // Normal public memory; meet across escaped inputs
+        TypeMem mem = defmem;
+        for( int i=2; i<nIns(); i++ ) {
+            // Has this alias escaped?
+            if( XInt.bit(mem._escAs,i) &&
+                in(i) != null && !in(i)._type.isHigh() ) {
+                mem = (TypeMem)mem.meet(in(i)._type);
+            }
+        }
+        return mem;
+    }
+
+    @Override public Node idealize() {
+        assert nIns() != 0 && in(1)!=null; // Always have a default.  if( nIns()==0 ) return null;
+
+        // Fold defaults into the default
+        boolean progress=false, allDefault=true;
+        for( int i=2; i<nIns(); i++ ) {
+            if( in(1) == in(i) ) { setDef(i,null); progress=true; }
+            else                 { allDefault=false; }
+        }
+
+        // If not merging any memory (all memory is just the default)
+        if( allDefault )
+            return in(1);       // Become default memory
+
+        // Collapse stacked merged-mem
+        if( in(1) instanceof MemMergeNode mem ) {
+            // A dead memory cycle can lose its last use when we bypass mem.
+            // Keep the peephole's result alive until the worklist sees it.
+            keep();
+            // Goal is to swap my default mem with mem's default mem
+            for( int i=2; i<mem.nIns(); i++ ) {
+                if( mem.in(i) != null ) {
+                    // deeper default mem has a non-default
+                    if( i>=nIns() || in(i)==null )
+                        setDefX(i,mem.in(i));
+                }
+            }
+            CodeGen.CODE.add(mem.in(1));
+            setDef(1,mem.in(1));
+            return unkeep();
+        }
+
+        return progress ? this : null;
+    }
+
+
+    public Node in( Var v ) { return in(v._idx); }
+
+    public Node alias( int alias ) {
+        assert !(in(1) instanceof BulkMemPhiNode bulk && bulk.isSplit(alias) &&
+                 (alias >= nIns() || in(alias)==null));
+        return alias < nIns() && in(alias)!=null ? in(alias) : in(1);
+    }
+
+    public Node alias( int alias, Node st ) { return setDefX(alias,st); }
+
+    // Now one-time do a useless-phi removal
+    void _useless( ) {
+        for( int i=1; i<nIns(); i++ ) {
+            if( in(i) instanceof PhiNode phi ) {
+                // Do an eager useless-phi removal
+                Node in = phi.peephole();
+                CodeGen.CODE.addAll(phi._outputs);
+                phi.moveDepsToWorklist();
+                if( in != phi ) {
+                    if( !phi.iskeep() ) // Keeping phi around for parser elsewhere
+                        phi.subsume(in);
+                    setDef(i,in); // Set the update back into Scope
+                }
+            }
+        }
+    }
+
+    @Override public boolean eq( Node n ) {
+        return this==n;
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/MemOpNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/MemOpNode.java
new file mode 100644
index 00000000..24ca6157
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/MemOpNode.java
@@ -0,0 +1,160 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.GlobalBits;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.*;
+import java.lang.StringBuilder;
+import java.util.*;
+
+/**
+ * Convenience common base for Load and Store.
+ *
+ * 0 - Control
+ * 1 - Memory
+ * 2 - Base of object, OOP
+ * 3 - Offset, integer types
+ * 4 - Value, for Stores only
+ */
+public abstract class MemOpNode extends TypeNode {
+
+    // The equivalence alias class
+    public int _alias;
+
+    // True if load-like, false if store-like.
+    // Used on CPU-specific combined memory+arithmetic ops.
+    //
+    // Stores produce memory (maybe as part of a tuple with other things),
+    // loads do not.
+    //
+    // Loads might pick up anti-dependencies on prior Stores, and never cause an
+    // anti-dependence themselves.
+    //
+    // Stores must maximally sink to the least dominator use.  Loads can be
+    // opportunistically hoisted.
+    public final boolean _isLoad;
+
+    // Field name.
+    public final String _name;
+    // Source location for late reported errors
+    public final Lexer _loc;
+
+    public MemOpNode(Lexer loc, String name, int alias, boolean isLoad, Type decl, Node ctrl, Node mem, Node ptr, Node off) {
+        super(decl, ctrl, mem, ptr, off);
+        _name  = name;
+        _alias = alias;
+        _loc = loc;
+        _isLoad = isLoad;
+    }
+    public MemOpNode(Lexer loc, String name, int alias, boolean isLoad, Type decl, Node ctrl, Node mem, Node ptr, Node off, Node value) {
+        this(loc, name, alias, isLoad, decl, ctrl, mem, ptr, off);
+        addDef(value);
+    }
+    public MemOpNode( Node ideal, MemOpNode mop ) {
+        super(ideal,mop instanceof LoadNode ld ? ld.declaredType() : mop._con);
+        _name  = mop._name;
+        _alias = mop._alias;
+        _loc   = mop._loc;
+        _isLoad= mop._isLoad;
+    }
+
+    MemOpNode( BAOS bais, String[] strs, Type[] types, GlobalBits fileAliases, GlobalBits aliases, boolean isLoad ) {
+        this(null,
+             strs[bais.packed2()],
+             mapAlias(bais,fileAliases,aliases),isLoad,
+             types[bais.packed2()],null,null,null,null);
+    }
+
+    private static int mapAlias( BAOS bais, GlobalBits fileAliases, GlobalBits aliases ) {
+        int alias = bais.packed2();
+        return alias < GlobalBits.RESERVED ? alias : aliases.map(fileAliases,alias);
+    }
+
+    @Override public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) {
+        baos.packed2(_name==null ? 0 : strs.get(_name));
+        baos.packed2(_alias);
+        baos.packed2(types.get(_con));                // NPE if fails lookup
+        assert _isLoad == this instanceof LoadNode; // No machine ops
+    }
+
+    static String mlabel(String name) { return "[]"==name ? "ary" : ("#"==name ? "len" : name); }
+    String mlabel() { return mlabel(_name); }
+
+    public Node mem() { return in(1); }
+    public Node ptr() { return in(2); }
+    public Node off() { return in(3); }
+
+    // Current declared field type.  This is deliberately a live lookup:
+    // cyclic/forward types can sharpen by replacing the pointer's struct.
+    public Type declaredType() {
+        if( !(ptr()._type instanceof TypeMemPtr tmp) )
+            return Type.BOTTOM;
+        Field fld = tmp._obj.field(_name);
+        return fld == null || fld._t == null ? Type.BOTTOM : fld._t;
+    }
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) { return _printMach(p);  }
+    protected ExprPrinter<Node> _printMach(ExprPrinter<Node> p) { throw Utils.TODO(); }
+
+
+    // Extra conditions for factoring matching memory operations through a Phi.
+    // The caller has already checked the opcode, input shape and control.
+    boolean canDrop(MemOpNode other, Node dep) {
+        dep.addDep(ptr());
+        return _alias>1 && _alias==other._alias && declaredType()==other.declaredType() && err()==null;
+    }
+
+    @Override
+    public boolean eq(Node n) {
+        MemOpNode mem = (MemOpNode)n; // Invariant
+        return _alias==mem._alias && super.eq(mem);
+    }
+
+    @Override
+    int hash() { return _alias ^ super.hash(); }
+
+    @Override
+    public Parser.ParseException err() {
+        Type ptr = ptr()._type;
+        // Already an error, but better error messages come from elsewhere
+        if( ptr == Type.BOTTOM ) return null;
+        if( ptr.isHigh() ) return null; // Assume it will fall to not-null
+        // Better be a not-nil TMP
+        if( !(ptr instanceof TypeMemPtr tmp && tmp.notNull()) )
+            return Parser.error( "Might be null accessing '" + _name + "'",_loc);
+        if( tmp._obj.field(_name)==null &&
+            CodeGen.CODE._phase.ordinal() > CodeGen.Phase.FinalizeIR.ordinal() )
+            return Parser.error("Accessing unknown field '"+_name+"' from '*"+tmp._obj._name+"'",_loc);
+        // Sane field
+        if( off() instanceof ConFldOffNode && CodeGen.CODE._phase.ordinal() > CodeGen.Phase.FinalizeIR.ordinal() )
+            return Parser.error("Accessing unknown field '"+_name+"' from '*"+tmp._obj._name+"'",_loc);
+        return null;
+    }
+
+    // Memory writers which must follow this read. A packaging node is not a
+    // write; follow this alias through aggregates to its writers.
+    public Ary<Node> antiDeps( Ary<Node> antideps ) {
+        antideps.clear();
+        return antiDeps(mem(),antideps);
+    }
+
+    private Ary<Node> antiDeps( Node mem, Ary<Node> antideps )  {
+        for( Node use : mem._outputs ) {
+            if( use instanceof MemMergeNode merge ) {
+                if( merge.alias(_alias)==mem )
+                    antiDeps(merge,antideps);
+            } else if( use instanceof CallNode || use instanceof CLInitNode ||
+                       (use instanceof MemOpNode st && !st._isLoad && st._alias==_alias) ||
+                       (use instanceof EscapeNode esc && esc.fld()._alias==_alias) ||
+                       (use instanceof MemPhiNode phi && phi._alias==_alias) ||
+                       (use instanceof BulkMemPhiNode phi && !phi.isSplit(_alias)) ) {
+                if( !antideps.contains(use) ) antideps.add(use);
+            }
+        }
+        return antideps;
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/MemPhiNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/MemPhiNode.java
new file mode 100644
index 00000000..aaaedb89
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/MemPhiNode.java
@@ -0,0 +1,80 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeMem;
+import com.seaofnodes.simple.codegen.GlobalBits;
+import com.seaofnodes.simple.util.BAOS;
+
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+/** A Phi for one precise memory alias. */
+public class MemPhiNode extends PhiNode {
+
+    public final int _alias;
+
+    public MemPhiNode(String label, int alias, Node... inputs) {
+        super(label, inputs);
+        assert alias > 1;
+        _alias = alias;
+    }
+
+    public MemPhiNode(MemPhiNode phi) {
+        super(phi,phi._label);
+        _alias = phi._alias;
+    }
+
+    @Override public Tag serialTag() { return Tag.MemPhi; }
+
+    @Override
+    public void packed(BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types,
+                       IdentityHashMap<Node,Integer> anodes) {
+        super.packed(baos,strs,types,anodes);
+        baos.packed2(_alias);
+    }
+
+    static Node make(BAOS bais, String[] strs, Type[] types, GlobalBits fileAliases, GlobalBits aliases) {
+        Node[] ins = new Node[bais.packed1()];
+        String label = strs[bais.packed2()];
+        int alias = bais.packed2();
+        if( alias >= GlobalBits.RESERVED ) alias = aliases.map(fileAliases,alias);
+        return new MemPhiNode(label,alias,ins);
+    }
+
+    @Override
+    public Type compute() {
+        Type t = super.compute();
+        assert BulkMemPhiNode.checkMem(this,_alias);
+        if( !(t instanceof TypeMem tmem) ) return t;
+        assert tmem._alias==1 || tmem._alias==_alias;
+        // This Phi structurally knows its alias, but not whether the field is
+        // final.  Do not infer slice finality from evolving input types.
+        return TypeMem.make(_alias,tmem._t,tmem._one,tmem._clz,false,tmem._escFs,tmem._escAs);
+    }
+
+    @Override
+    public Node idealize() {
+        // A precise memory Phi can always bypass a MemMerge and select its
+        // matching slice.
+        for( int i=1; i<nIns(); i++ ) {
+            if( in(i) instanceof MemMergeNode mem ) {
+                setDef(i,mem.alias(_alias));
+                return this;
+            }
+            Node slice = CLInitNode.slice(in(i),_alias,this);
+            if( slice!=in(i) ) { setDef(i,slice); return this; }
+        }
+        if( nIns()==3 && region() instanceof LoopNode loop && !loop.inProgress() &&
+            in(2) instanceof StoreNode st && st.mem()==this ) {
+            Node sink = st.sink(this);
+            if( sink!=null ) return sink;
+        }
+        return super.idealize();
+    }
+
+    @Override public boolean eq(Node n) {
+        return _alias==((MemPhiNode)n)._alias && super.eq(n);
+    }
+
+    @Override int hash() { return _alias; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/MinusNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/MinusNode.java
new file mode 100644
index 00000000..4f4343d4
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/MinusNode.java
@@ -0,0 +1,79 @@
+package com.seaofnodes.simple.node;
+
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.BAOS;
+import com.seaofnodes.simple.util.Utils;
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+public class MinusNode extends Node implements ModeNode {
+    // Mode is 0 for unknown, 1 for int, 2 for flt
+    byte _mode;
+
+    public MinusNode(Node in) { super(null, in); }
+    public MinusNode(Node in, byte mode) { super(null, in); _mode = mode; }
+    @Override public void packed(BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node,Integer> anodes) {
+        baos.packed1(_mode);
+    }
+    @Override public Tag serialTag() { return Tag.Minus; }
+
+    @Override public byte mode() { return _mode; }
+    @Override public Node setMode(byte mode) {
+        assert _mode==0 && (mode==1 || mode==2);
+        unlock();               // _mode participates in GVN hash and equality
+        _mode = mode;
+        return this;
+    }
+
+    @Override protected String format() { return "(-%1)"; }
+
+    @Override
+    public Type compute() {
+        Type t = in(1)._type;
+        // Constant array payloads lie below their element ranges in the lattice.
+        if( t instanceof TypeConAry ary ) t = ary.elem();
+        if( t==null )
+            return Type.TOP;
+        if( t.isHigh() )
+            return _mode==0 ? Type.TOP :
+                _mode==1 ? TypeInteger.TOP :
+                t instanceof TypeFloat ? t : TypeFloat.F64.dual();
+        if( t instanceof TypeInteger i0 ) {
+            if( _mode==2 ) return TypeFloat.F64;
+            if( i0._min != Long.MIN_VALUE && i0._max != Long.MIN_VALUE )
+                return TypeInteger.make(-i0._max,-i0._min,i0._widen);
+            return TypeInteger.BOT;
+        }
+        if( t instanceof TypeFloat f ) {
+            if( _mode==1 ) return TypeInteger.BOT;
+            return f.isConstant() ? TypeFloat.constant(-f.value()) : f;
+        }
+        // No numeric family is known. This must be below both integer and
+        // float results, in either analysis direction and with any mode.
+        return Type.BOTTOM;
+    }
+
+    @Override
+    public Node idealize() {
+        // -(-x) is x
+        if( in(1) instanceof MinusNode minus && addDep(minus.in(1))._type.isa(compute()) )
+            return minus.in(1);
+
+        // Can we decide int vs flt?
+        if( _mode==0 ) {
+            byte mode = (byte)(
+                in(1)._type instanceof TypeInteger ? 1 :
+                in(1)._type instanceof TypeFloat   ? 2 : 0);
+            if( mode!=0 ) return setMode(mode).init();
+        }
+
+        return null;
+    }
+    @Override public Parser.ParseException err() {
+        return ArithNode.nodeErr(this,null,"-",_mode,true);
+    }
+    @Override public boolean eq( Node n ) { return _mode==((MinusNode)n)._mode; }
+    @Override public int hash() { return _mode; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ModeNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ModeNode.java
new file mode 100644
index 00000000..dc635447
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ModeNode.java
@@ -0,0 +1,12 @@
+package com.seaofnodes.simple.node;
+
+/**
+ * A node whose numeric input family is selected once: unknown, integer, or
+ * floating point.  Implementors remain ordinary Nodes; this interface only
+ * centralizes the structural mode contract shared by arithmetic, comparisons,
+ * and unary minus.
+ */
+public interface ModeNode {
+    byte mode();
+    Node setMode(byte mode);
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/MulNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/MulNode.java
new file mode 100644
index 00000000..bb99cad5
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/MulNode.java
@@ -0,0 +1,65 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeInteger;
+import java.util.BitSet;
+
+public class MulNode extends ArithNode {
+    @Override boolean allowFloat() { return true; }
+    public MulNode(Node lhs, Node rhs) { super(null, lhs, rhs); }
+    public MulNode(Node lhs, Node rhs, byte mode) { super(null, lhs, rhs, mode); }
+    @Override public Tag serialTag() { return Tag.Mul; }
+
+    @Override public String op() { return "*"; }
+
+    @Override long   doOp( long  x,  long  y ) { return x * y; }
+    @Override double doOp(double x, double y ) { return x * y; }
+    @Override TypeInteger doOp(TypeInteger x, TypeInteger y) {
+        return TypeInteger.BOT;
+    }
+
+    @Override
+    public Node idealize() {
+        Node lhs = in(1);
+        Node rhs = in(2);
+        Type t1 = lhs._type;
+        Type t2 = rhs._type;
+
+        // Move constants to RHS: con*arg becomes arg*con
+        if ( t1.isConstant() && !t2.isConstant() )
+            return swap12();
+
+        // Multiply by constant
+        if ( t2.isConstant() && t2 instanceof TypeInteger i ) {
+            // Mul of 1.  We do not check for (1*x) because this will already
+            // canonicalize to (x*1)
+            long c = i.value();
+            if( c==1 )  return lhs._type.isa(compute()) ? lhs : super.idealize();
+            if( c==0 )  return CodeGen.CODE.ZERO;
+            // Mul by a power of 2, +/-1.  Bit patterns more complex than this
+            // are unlikely to win on an X86 vs the normal "imul", and so
+            // become machine-specific.
+            if( (c & (c-1)) == 0 )
+                return new ShlNode(null,lhs,con(Long.numberOfTrailingZeros(c)));
+            // 2**n + 1, e.g. 9
+            long d = c-1;
+            if( (d & (d-1)) == 0 )
+                return new AddNode(new ShlNode(null,lhs,con(Long.numberOfTrailingZeros(d))).peephole(),lhs);
+            // 2**n - 1, e.g. 31
+            long e = c+1;
+            if( (e & (e-1)) == 0 )
+                return new SubNode(new ShlNode(null,lhs,con(Long.numberOfTrailingZeros(e))).peephole(),lhs);
+
+        }
+
+        // Do we have ((x * (phi cons)) * con) ?
+        // Do we have ((x * (phi cons)) * (phi cons)) ?
+        // Push constant up through the phi: x * (phi con0*con0 con1*con1...)
+        Node phicon = AddNode.phiCon(this,true);
+        if( phicon!=null ) return phicon;
+
+        return super.idealize();
+    }
+    @Override Node copy(Node lhs, Node rhs) { return new MulNode(lhs,rhs,_mode); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/MultiNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/MultiNode.java
new file mode 100644
index 00000000..152d525a
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/MultiNode.java
@@ -0,0 +1,29 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.util.Ary;
+
+
+public interface MultiNode {
+
+    abstract Ary<Node> outs();
+
+    // Find a projection by index
+    default ProjNode proj( int idx ) {
+        for( Node out : outs() )
+            if( out instanceof ProjNode prj && prj._idx==idx )
+                return prj;
+        return null;
+    }
+
+    // Find a projection by index
+    default CProjNode cproj( int idx ) {
+        for( Node out : outs() )
+            if( out instanceof CProjNode prj && prj._idx==idx )
+                return prj;
+        return null;
+    }
+
+    // Return not-null if this projection index is a ideal copy.
+    // Called by ProjNode ideal and used to collapse Multis.
+    default Node pcopy(int idx, Node dep) { return null; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/NeverNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/NeverNode.java
new file mode 100644
index 00000000..f7b5a58a
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/NeverNode.java
@@ -0,0 +1,24 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeTuple;
+
+
+// "Never true" for infinite loop exits
+public class NeverNode extends IfNode {
+    public NeverNode(NeverNode ctrl) { super(ctrl); }
+    public NeverNode(float ignore, Node ctrl) { super(ctrl,null); }
+    @Override public Tag serialTag() { return Tag.Never; }
+
+    @Override public String label() { return "Never"; }
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) { return p.p("Never"); }
+
+    @Override public Type compute() { return TypeTuple.IF_BOTH; }
+
+    @Override public Node idealize() { return null; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/NewNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/NewNode.java
new file mode 100644
index 00000000..d4df7a0b
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/NewNode.java
@@ -0,0 +1,106 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.BAOS;
+import com.seaofnodes.simple.util.SB;
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+/**
+ * Allocation!  Allocate a chunk of memory, no init.
+ * Takes in ctrl and size, and TypeStruct.
+ * Produces a ptr and private memory.
+*/
+public class NewNode extends Node implements MultiNode {
+    public TypeStruct _ts;
+    public NewNode( TypeStruct ts, Node ctrl, Node size ) { super(ctrl,size); _ts = ts; }
+
+    public Node ctrl() { return in(0); }
+    public Node size() { return in(1); }
+
+    // --- Serialization
+    public NewNode(NewNode nnn) { super(nnn); _ts = nnn._ts; }
+    @Override public Tag serialTag() { return Tag.New; }
+    @Override public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) {
+        baos.packed2(types.get(_ts));
+    }
+    static Node make( BAOS bais, Type[] types)  {
+        TypeStruct ts = (TypeStruct)types[bais.packed2()];
+        return new NewNode(ts,null,null);
+    }
+
+    @Override public String label() { return "new_"+(_ts.isAry() ? "ary_"+_ts._fields[1]._t.str() : _ts.str()); }
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        return p.p("new ").p(_ts.str());
+    }
+
+    @Override public TypeTuple compute() {
+        if( ctrl()._type.isHigh() )
+            return TypeTuple.DEAD_NEW;
+        TypeStruct ts = _ts.isAry() ? _ts : _ts.makeInit();
+        return TypeTuple.make(TypeMemPtr.make(_ts),
+                              // Arrays get pre-zeroed by constructor.
+                              // Objects start with default-zero memory for
+                              // fields that can be zero-initialized.  This is
+                              // still private memory, so no aliases escape yet.
+                              TypeMem.make(1,ts,true,false,false,null,null));
+    }
+
+    @Override public Node idealize() { return null; }
+
+    @Override boolean _upgradeType( HashMap<String,Type> TYPES) {
+        Type old = _ts; _ts = (TypeStruct)_ts.upgradeType(TYPES);  return old != _ts;
+    }
+
+    // Two NewNodes are never equal; NewNodes always make independent pointers
+    // so they are not functional - they internally bump-ptr allocate always a
+    // new pointer.
+    @Override public boolean eq(Node n) { return this==n; }
+
+    @Override int hash() { return _ts.hashCode(); }
+
+
+    @Override public Parser.ParseException err() {
+        return _ts._fref ? Parser.error("Unknown struct type '"+_ts._name+"'",null) : null;
+    }
+
+
+    // ------------
+    // MachNode specifics, shared across all CPUs
+    public int _arg2Reg, _xslot;
+    private RegMask _arg3Mask;
+    private RegMask _retMask;
+    private RegMask _kills;
+    public void cacheRegs(CodeGen code) {
+        _arg2Reg  = code._mach.callArgMask(TypeFunPtr.CALLOC,2,0,code._cCallingConv).firstReg();
+        _arg3Mask = code._mach.callArgMask(TypeFunPtr.CALLOC,3,0,code._cCallingConv);
+        // Return mask depends on TFP (either GPR or FPR)
+        _retMask = code._mach.retMask(TypeFunPtr.CALLOC);
+        // Kill mask is all caller-saves, and any mirror stack slots for args
+        // in registers.
+        RegMaskRW kills = code._cCallerSave.copy();
+        // Start of stack slots
+        int maxReg = code._mach.regs().length;
+        // Incoming function arg slots, all low numbered in the RA
+        int fslot = cfg0().fun()._maxArgSlot;
+        // Killed slots for this calls outgoing args
+        int xslot = code._mach.maxArgSlot(TypeFunPtr.CALLOC,code._cCallingConv);
+        _xslot = (maxReg+fslot)+xslot;
+        for( int i=0; i<xslot; i++ )
+            kills.set((maxReg+fslot)+i);
+        _kills = kills;
+    }
+    public String op() { return "alloc"; }
+    public RegMask regmap(int i) { return i==1 ? _arg3Mask : null; }
+    public RegMask outregmap() { return null; }
+    public RegMask outregmap(int idx) { return idx==0  ? _retMask : null; }
+    public RegMask killmap() { return _kills; }
+    public void asm(CodeGen code, SB sb) {
+        sb.p("#malloc, ").p(code.reg(size()));
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/Node.java b/chapter29/src/main/java/com/seaofnodes/simple/node/Node.java
new file mode 100644
index 00000000..cbd35592
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/Node.java
@@ -0,0 +1,779 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.BaseNode;
+
+import com.seaofnodes.simple.codegen.IterPeeps;
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.GlobalBits;
+import com.seaofnodes.simple.print.IRPrinter;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.*;
+import java.util.*;
+import java.util.function.Function;
+import static com.seaofnodes.simple.codegen.CodeGen.CODE;
+
+/**
+ * All Nodes in the Sea of Nodes IR inherit from the Node class.
+ * The Node class provides common functionality used by all subtypes.
+ * Subtypes of Node specialize by overriding methods.
+ */
+public abstract class Node extends BaseNode<Node> implements Cloneable {
+
+    /**
+     * Inputs to the node. These are use-def references to Nodes.
+     * <p>
+     * Generally fixed length, ordered, nulls allowed, no unused trailing space.
+     * Ordering is required because e.g. "a/b" is different from "b/a".
+     * The first input (offset 0) is often a {@link CFGNode} node.
+     */
+    public Ary<Node> _inputs;
+
+    /**
+     * Outputs reference Nodes that are not null and have this Node as an
+     * input.  These nodes are users of this node, thus these are def-use
+     * references to Nodes.
+     * <p>
+     * Outputs directly match inputs, making a directed graph that can be
+     * walked in either direction.  These outputs are typically used for
+     * efficient optimizations but otherwise have no semantics meaning.
+     */
+     public Ary<Node> _outputs;
+
+    /**
+     * Current computed type for this Node.  This value changes as the graph
+     * changes and more knowledge is gained about the program.
+     */
+    public Type _type;
+
+    Node(Node... inputs) {
+        super(CODE.getUID()); // allocate unique dense ID
+        _inputs = new Ary<>(Node.class);
+        Collections.addAll(_inputs,inputs);
+        _outputs = new Ary<>(Node.class);
+        for( Node n : _inputs )
+            if( n != null )
+                n.addUse( this );
+    }
+
+    // Make a Node using the existing arrays of nodes.
+    // Used by any pass rewriting all Node classes but not the edges.
+    Node( Node n ) {
+        super(CODE.getUID()); // allocate unique dense ID
+        assert CodeGen.CODE._phase.ordinal() >= CodeGen.Phase.Select.ordinal();
+        _inputs  = new Ary<>(n==null ? new Node[0] : n._inputs.asAry());
+        _outputs = new Ary<>(Node.class);
+        _type = n==null ? Type.BOTTOM : n._type;
+        _deps = null;
+        _hash = 0;
+    }
+
+    // Disk/serialized opcode tags
+    public enum Tag {
+        Add,And,BulkMemPhi,EQ,NE,LT,LE,ULT,
+        CallEnd,Call,ConFldOff,Con,CLInit,CProj,
+        Div,Escape,Extern,ExternOffset,Fun,FunPtr,Guard,
+        If,Load,Loop,MemMerge,MemPhi,Minus,Mul,
+        New,Never,Not,Or,Parm,Phi,Proj,PtrToInt,
+        ReadOnly,Return,Region,RoundF32,
+        Sar,Shl,Shr,Start,StartCU,StopCU,Stop,Store,Sub,
+        ToInteger,ToFloat,XCtrl,Xor;
+        public static final Tag[] VALS = values();
+        public Node make( BAOS bais, String[] strs, Type[] types, GlobalBits fileAliases, GlobalBits aliases ) {
+            return switch(this) {
+            case Add    -> new   AddNode(null,null,(byte)bais.packed1());
+            case And    -> { int mode=bais.packed1(); assert mode==1; yield new AndNode(null,null,null); }
+            case Div    -> new   DivNode(null,null,(byte)bais.packed1());
+            case Guard -> GuardNode.make(bais);
+            case If     -> new    IfNode(null,null);
+            case Loop   -> new  LoopNode(null,null,null);
+            case Minus  -> new MinusNode(null,(byte)bais.packed1());
+            case Mul    -> new   MulNode(null,null,(byte)bais.packed1());
+            case Never  -> new NeverNode(1.2f, null);
+            case Not    -> new   NotNode(null);
+            case Or     -> { int mode=bais.packed1(); assert mode==1; yield new OrNode(null,null,null); }
+            case ReadOnly-> new ReadOnlyNode((Node)null);
+            case Return ->new ReturnNode(null,null,null,null,null);
+            case RoundF32-> new RoundF32Node(null);
+            case PtrToInt-> new PtrToIntNode((Node)null);
+            case Sar    -> { int mode=bais.packed1(); assert mode==1; yield new SarNode(null,null,null); }
+            case Shl    -> { int mode=bais.packed1(); assert mode==1; yield new ShlNode(null,null,null); }
+            case Shr    -> { int mode=bais.packed1(); assert mode==1; yield new ShrNode(null,null,null); }
+            case Start  -> new StartNode(null,null,TypeInteger.BOT);
+            case Sub    -> new   SubNode(null,null,(byte)bais.packed1());
+            case ToFloat-> new ToFloatNode(null);
+            case ToInteger-> new ToIntegerNode(null);
+            case XCtrl  -> new XCtrlNode();
+            case Xor    -> { int mode=bais.packed1(); assert mode==1; yield new XorNode(null,null,null); }
+
+            case EQ    -> new  BoolNode.EQ (null,null,(byte)bais.packed1());
+            case NE    -> new  BoolNode.NE (null,null,(byte)bais.packed1());
+            case LT    -> new  BoolNode.LT (null,null,(byte)bais.packed1());
+            case LE    -> new  BoolNode.LE (null,null,(byte)bais.packed1());
+            case ULT   -> new  BoolNode.ULT(null,null,(byte)bais.packed1());
+
+            case Call  ->      CallNode.make(bais,strs);
+            case CallEnd->  CallEndNode.make(bais     ,types);
+            case CLInit ->    new CLInitNode(bais,strs);
+            case CProj ->     CProjNode.make(bais,strs);
+            case Con   ->  ConstantNode.make(bais     ,types);
+            case Escape->    EscapeNode.make(bais     ,types);
+            case Extern->    ExternNode.make(bais,strs,types);
+            case ExternOffset-> new ExternOffsetNode(strs[bais.packed2()]);
+            case FunPtr->    FunPtrNode.make(bais,     types);
+            case Fun   ->       FunNode.make(bais,strs,types);
+            case Load  ->       new LoadNode(bais,strs,types,fileAliases,aliases);
+            case MemMerge->MemMergeNode.make(bais);
+            case MemPhi->    MemPhiNode.make(bais,strs,types,fileAliases,aliases);
+            case BulkMemPhi-> BulkMemPhiNode.make(bais,strs,types,fileAliases,aliases);
+            case New   ->       NewNode.make(bais     ,types);
+            case Parm  ->      ParmNode.make(bais,strs,types);
+            case Phi   ->       PhiNode.make(bais,strs,types);
+            case Proj  ->      ProjNode.make(bais,strs);
+            case Store ->      new StoreNode(bais,strs,types,fileAliases,aliases);
+            case Stop  ->      StopNode.make(bais);
+            case StartCU->  StartCUNode.make(bais,strs,types);
+            case StopCU ->   StopCUNode.make(bais);
+            case Region->    RegionNode.make(bais);
+
+            default -> throw Utils.TODO("Should not reach here");
+            };
+        }
+    };
+    public Tag serialTag() { throw Utils.TODO(); }
+    // Serialize extra data, including input counts
+    public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) {}
+
+    // Easy reading label for debugger, e.g. "Add" or "Region" or "EQ"
+    public String label() { return serialTag().toString(); }
+
+    public String p(int depth) { return IRPrinter.prettyPrint(this,depth); }
+
+    public boolean isConst() { return false; }
+
+    // ------------------------------------------------------------------------
+    // Graph Node & Edge manipulation
+
+    @Override public String typeName() { return _type==null ? null : _type.toString(); }
+
+    /**
+     * Gets the ith input node
+     * @param i Offset of the input node
+     * @return Input node or null
+     */
+    public Node in(int i) { return _inputs.get(i); }
+    public Node out(int i) { return _outputs.get(i); }
+    public final Ary<Node> outs() { return _outputs; }
+
+    public int nIns() { return _inputs.size(); }
+
+    public int nOuts() { return _outputs.size(); }
+
+    public boolean isUnused() { return nOuts() == 0; }
+
+    public CFGNode cfg0() { return (CFGNode)in(0); }
+
+    /**
+     * Change a <em>def</em> into a Node.  Keeps the edges correct, by removing
+     * the corresponding <em>use->def</em> edge.  This may make the original
+     * <em>def</em> go dead.  This function is co-recursive with {@link #kill}.
+     * <p>
+
+     * This method is the normal path for altering a Node, because it does the
+     * proper default edge maintenance.  It also <em>immediately</em> kills
+     * Nodes that lose their last use; at times care must be taken to avoid
+     * killing Nodes that are being used without having an output Node.  This
+     * definitely happens in the middle of recursive {@link #peephole} calls.
+     *
+     * @param idx which def to set
+     * @param new_def the new definition
+     * @return new_def for flow coding
+     */
+    public <N extends Node> N setDef(int idx, N new_def ) {
+        unlock();
+        Node old_def = in(idx);
+        if( old_def == new_def ) return new_def; // No change
+        // If new def is not null, add the corresponding def->use edge
+        // This needs to happen before removing the old node's def->use edge as
+        // the new_def might get killed if the old node kills it recursively.
+        if( new_def != null )
+            new_def.addUse(this);
+        // Set the new_def over the old (killed) edge
+        _inputs.set(idx,new_def);
+        if( old_def != null ) {        // If the old def exists, remove a def->use edge
+            if( old_def.delUse(this) ) // If we removed the last use, the old def is now dead
+                old_def.kill();        // Kill old def
+            else CODE.add(old_def);    // Else old lost a use, so onto worklist
+        }
+        moveDepsToWorklist();
+        // Return new_def for easy flow-coding
+        return new_def;
+    }
+    public <N extends Node> N setDefX(int idx, N new_def ) {
+        while( nIns() <= idx ) addDef(null);
+        return setDef(idx,new_def);
+    }
+
+    // Remove the numbered input, compressing the inputs in-place.  This
+    // shuffles the order deterministically - which is suitable for Region and
+    // Phi, but not for every Node.  If the def goes dead, it is recursively
+    // killed, which may include 'this' Node.
+    public Node delDef(int idx) {
+        unlock();
+        Node old_def = in(idx);
+        _inputs.del(idx);
+        if( old_def.delUse(this) ) // If we removed the last use, the old def is now dead
+            old_def.kill();     // Kill old def
+        old_def.moveDepsToWorklist();
+        return this;
+    }
+
+    // Insert the numbered input, sliding other inputs to the right
+    public void insertDef(int idx, Node new_def) {
+        _inputs.insert(null,idx);
+        setDef(idx,new_def);
+    }
+
+    /**
+     * Add a new def to an existing Node.  Keep the edges correct by
+     * adding the corresponding <em>def->use</em> edge.
+     *
+     * @param new_def the new definition, appended to the end of existing definitions
+     * @return new_def for flow coding
+     */
+    public Node addDef(Node new_def) {
+        unlock();
+        // Add use->def edge
+        _inputs.add(new_def);
+        // If new def is not null, add the corresponding def->use edge
+        if( new_def != null )
+            new_def.addUse(this);
+        return new_def;
+    }
+
+    // Breaks the edge invariants, used temporarily
+    @SuppressWarnings("unchecked")
+    protected <N extends Node> N addUse(Node n) { _outputs.add(n); return (N)this; }
+
+    // Remove node 'use' from 'def's (i.e. our) output list, by compressing the list in-place.
+    // Return true if the output list is empty afterward.
+    // Error is 'use' does not exist; ok for 'use' to be null.
+    public boolean delUse( Node use ) {
+        _outputs.del(_outputs.find(use));
+        moveDepsToWorklist(); // User-count and anti-dependence queries can now change.
+        return _outputs.isEmpty();
+    }
+
+    // Shortcut for "popping" until n nodes.  A "pop" is basically a
+    // setDef(last,null) followed by lowering the nIns() count.
+    public void popUntil(int n) {
+        unlock();
+        while( nIns() > n ) {
+            Node old_def = _inputs.pop();
+            if( old_def != null &&     // If it exists and
+                old_def.delUse(this) ) // If we removed the last use, the old def is now dead
+                old_def.kill();        // Kill old def
+        }
+    }
+    public Node removeLast() {
+        Node old_def = _inputs.pop();
+        if( old_def != null )
+            old_def.delUse(this);
+        return old_def;
+    }
+
+    /**
+     * Kill a Node with no <em>uses</em>, by setting all of its <em>defs</em>
+     * to null.  This may recursively kill more Nodes, and is basically dead
+     * code elimination.
+     */
+    public void kill( ) {
+        assert isUnused();      // Has no uses, so it is dead
+        unlock();
+        moveDepsToWorklist();
+        _type=null;             // Flag as dead
+        while( nIns()>0 ) { // Set all inputs to null, recursively killing unused Nodes
+            Node old_def = _inputs.removeLast();
+            // Revisit neighbor because removed use
+            if( old_def != null ) {
+                if( CODE.add(old_def).delUse(this) )
+                    old_def.kill(); // If we removed the last use, the old def is now dead
+                old_def.moveDepsToWorklist(); // Use-count changes can enable distant rewrites.
+            }
+        }
+        assert isDead();        // Really dead now
+    }
+
+    // Preserve CFG use-ordering when killing
+    public void killOrdered() {
+        CFGNode cfg = cfg0();
+        cfg._outputs.remove(cfg._outputs.find(this));
+        _inputs.set(0,null);
+        kill();
+    }
+
+    // Mostly used for asserts and printing.
+    public boolean isDead() { return isUnused() && nIns()==0 && _type==null; }
+
+    // Shortcuts to stop DCE mid-parse
+    // Add bogus null use to keep node alive
+    public <N extends Node> N keep() { return addUse(null); }
+    // Remove bogus null.
+    @SuppressWarnings("unchecked")
+    public <N extends Node> N unkeep() {
+        delUse(null);
+        return (N)this;
+    }
+    // Test "keep" status
+    public boolean iskeep() { return _outputs.find(null) != -1; }
+    public void unkill() {
+        if( unkeep().isUnused() )
+            kill();
+    }
+    public void isKill() {
+        if( isUnused() )
+            kill();
+    }
+
+    // Replace self with nnn in the graph, making 'this' go dead
+    public void subsume( Node nnn ) {
+        assert nnn!=this;
+        while( nOuts() > 0 ) {
+            Node n = _outputs.removeLast();
+            n.unlock();
+            int idx = n._inputs.find(this);
+            n._inputs.set(idx,nnn);
+            nnn.addUse(n);
+            CODE.add(n);
+            CODE.addAll(n._outputs);
+        }
+        kill();
+    }
+
+    // insert `this` immediately after `def` in the same basic block.
+    public void insertAfter( Node def ) {
+        CFGNode cfg = def.cfg0();
+        int i = cfg._outputs.find(def)+1;
+        if( cfg instanceof CallEndNode ) {
+            cfg = cfg.uctrl();  i=0;
+        } else if( def.in(0) instanceof MultiNode ) {
+            assert i==0;
+            i = cfg._outputs.find(def.in(0))+1;
+        }
+
+        while( cfg.out(i) instanceof PhiNode || cfg.out(i) instanceof CalleeSaveNode )  i++;
+        cfg._outputs.insert(this,i);
+        _inputs.set(0,cfg);
+    }
+
+    // Insert this in front of use.in(uidx) with this, and insert this
+    // immediately before use in the basic block.
+    public void insertBefore( Node use, int uidx ) {
+        CFGNode cfg = use.cfg0();
+        int i;
+        if( use instanceof PhiNode phi ) {
+            cfg = phi.region().cfg(uidx);
+            if( cfg instanceof CProjNode && cfg.in(0) instanceof NeverNode nvr )
+                cfg = nvr.cfg0();
+            i = cfg.nOuts()-1;
+        } else {
+            i = cfg._outputs.find(use);
+        }
+        cfg._outputs.insert(this,i);
+        _inputs.set(0,cfg);
+        if( _inputs._len > 1 && this instanceof SplitNode )
+            setDefOrdered(1,use.in(uidx));
+        use.setDefOrdered(uidx,this);
+    }
+
+    public void setDefOrdered( int idx, Node def) {
+        // If old is dying, remove from CFG ordered
+        Node old = in(idx);
+        if( old!=null && old.nOuts()==1 ) {
+            CFGNode cfg = old.cfg0();
+            if( cfg!=null ) {
+                cfg._outputs.remove(cfg._outputs.find(old));
+                old._inputs.set(0,null);
+            }
+        }
+        setDef(idx,def);
+    }
+
+    public void removeSplit() {
+        CFGNode cfg = cfg0();
+        cfg._outputs.remove(cfg._outputs.find(this));
+        _inputs.set(0,null);
+        if( _inputs._len > 1 ) subsume(in(1));
+    }
+
+    // ------------------------------------------------------------------------
+    // Graph-based optimizations
+
+    /**
+     * Try to peephole at this node and return a better replacement Node.
+     * Always returns some not-null Node (often this).
+     */
+    public final Node peephole( ) {
+        var obs = CODE._midAssert ? null : CODE._obs;
+        if( obs != null ) obs.before(this);
+        Node n = peepholeOpt();
+        Node rez = n==null ? this : deadCodeElim(n._nid >= _nid ? n.peephole() : n);
+        if( obs != null ) obs.after(this, n==null ? null : rez, false);
+        return rez;             // Cannot return null for no-progress
+    }
+
+    /**
+     * Try to peephole at this node and return a better replacement Node if
+     * possible.  We compute a {@link Type} and then check and replace:
+     * <ul>
+     * <li>if the Type {@link Type#isConstant}, we replace with a {@link ConstantNode}</li>
+     * <li>in a future chapter we will look for a
+     * <a href="https://en.wikipedia.org/wiki/Common_subexpression_elimination">Common Subexpression</a>
+     * to eliminate.</li>
+     * <li>we ask the Node for a better replacement.  The "better replacement"
+     * is things like {@code (1+2)} becomes {@code 3} and {@code (1+(x+2))} becomes
+     * {@code (x+(1+2))}.  By canonicalizing expressions we fold common addressing
+     * math constants, remove algebraic identities and generally simplify the
+     * code. </li>
+     *
+     * Unlike peephole above, this explicitly returns null for no-change, or not-null
+     * for a better replacement (which can be this).
+     * </ul>
+     */
+    public final Node peepholeOpt( ) {
+        CODE.iterCnt();
+        // Compute initial or improved Type
+        Type old = setType(compute());
+
+        // Replace constant computations from non-constants with a constant node.
+        if( !isConst() && !(this instanceof ParmNode parm && parm.inProgress()) &&
+            _type.isHighOrConst() )
+            return ConstantNode.make(_type).peephole();
+
+        // Global Value Numbering
+        if( _hash==0 ) {
+            Node n = CODE._gvn.get(this); // Will set _hash as a side effect
+            if( n==null )
+                CODE._gvn.put(this,this);  // Put in table now
+            else {
+                // Because of random worklist ordering, the two equal nodes
+                // might have different types.  Because of monotonicity, both
+                // types are valid.  To preserve monotonicity, the resulting
+                // shared Node has to have the best of both types.
+                n.setType(n._type.join(_type));
+                _hash = 0; // Clear, since it never went in the table
+                return deadCodeElim(n);// Return previous; does Common Subexpression Elimination
+            }
+        }
+
+        // Ask each node for a better replacement
+        Node n = idealize();
+        if( n != null )         // Something changed
+            return n;           // Report progress
+
+        if( old!=_type ) return this; // Report progress;
+        CODE.iterNop();
+        return null;            // No progress
+    }
+
+    // m is the new Node, self is the old.
+    // Return 'm', which may have zero uses but is alive nonetheless.
+    // If self has zero uses (and is not 'm'), {@link #kill} self.
+    private Node deadCodeElim(Node m) {
+        // If self is going dead and not being returned here (Nodes returned
+        // from peephole commonly have no uses (yet)), then kill self.
+        if( m != this && isUnused() && !isDead() ) {
+            // Killing self - and since self recursively kills self's inputs we
+            // might end up killing 'm', which we are returning as a live Node.
+            // So we add a bogus extra null output edge to stop kill().
+            m.keep();      // Keep m alive
+            kill();        // Kill self because replacing with 'm'
+            m.unkeep();    // Okay to peephole m
+        }
+        return m;
+    }
+
+    /**
+     * This function needs to be
+     * <a href="https://en.wikipedia.org/wiki/Monotonic_function">Monotonic</a>
+     * as it is part of a Monotone Analysis Framework.
+     * <a href="https://www.cse.psu.edu/~gxt29/teaching/cse597s21/slides/08monotoneFramework.pdf">See for example this set of slides</a>.
+     * <p>
+     * For Chapter 2, all our Types are really integer constants, and so all
+     * the needed properties are trivially true, and we can ignore the high
+     * theory.  Much later on, this will become important and allow us to do
+     * many fancy complex optimizations trivially... because theory.
+     * <p>
+     * {@link #compute()} needs to be stand-alone, and cannot recursively call compute
+     * on its inputs, because programs are cyclic (have loops!) and this will just
+     * infinitely recurse until stack overflow.  Instead, compute typically
+     * computes a new type from the {@link #_type} field of its inputs.
+     */
+    public abstract Type compute();
+
+    // Set the type.  Assert monotonic progress.
+    // If changing, add users to worklist.
+    public Type setType(Type type) {
+        Type old = _type;
+        assert old == null || type.isa(old) : "Monotonicity test failed: "+this+"#"+_nid+" old="+old+" new="+type;
+        //assert !type.hasClosedBuilder0(); // New types should not have closed builders
+        if( old == type ) return old;
+        _type = type;       // Set _type late for easier assert debugging
+        CODE.addAll(_outputs);
+        moveDepsToWorklist();
+        return old;
+    }
+
+    @SuppressWarnings("unchecked")
+    public <N extends Node> N init() { _type = compute(); return (N)this; }
+
+    /**
+     * This function rewrites the current Node into a more "idealized" form.
+     * This is the bulk of our peephole rewrite rules, and we use this to
+     * e.g. turn arbitrary collections of adds and multiplies with mixed
+     * constants into a normal form that's easy for hardware to implement.
+     * Example: An array addressing expression:
+     * <pre>   ary[idx+1]</pre>
+     * might turn into Sea-of-Nodes IR:
+     * <pre>   (ary+12)+((idx+1) * 4)</pre>
+     * This expression can then be idealized into:
+     * <pre>   ary + ((idx*4) + (12 + (1*4)))</pre>
+     * And more folding:
+     * <pre>   ary + ((idx<<2) + 16)</pre>
+     * And during code-gen:
+     * <pre>   MOV4 Rary,[Ridx<<2 +16] // or some such hardware-specific notation </pre>
+     * <p>
+     * {@link #idealize} has a very specific calling convention:
+     * <ul>
+     * <li>If NO change is made, return {@code null}
+     * <li>If ANY change is made, return not-null; this can be {@code this}
+     * <li>The returned Node does NOT call {@link #peephole} on itself; the {@link #peephole} call will recursively peephole it.
+     * <li>Any NEW nodes that are not directly returned DO call {@link #peephole}.
+     * </ul>
+     * <p>
+     * Examples:
+     * <table border="3">
+     * <tr><th>    before       </th><th>       after     </th><th>return </th><th>comment  </th></tr>
+     * <tr><td>{@code (x+5)    }</td><td>{@code   (x+5)  }</td><td>{@code null  }</td><td>No change</td></tr>
+     * <tr><td>{@code (5+x)    }</td><td>{@code   (x+5)  }</td><td>{@code this  }</td><td>Swapped arguments</td></tr>
+     * <tr><td>{@code ((x+1)+2)}</td><td>{@code (x+(1+2))}</td><td>{@code (x+_) }</td><td>Returns 2 new Nodes</td></tr>
+     * </table>
+     *
+     * The last entry deserves more discussion.  The new Node {@code (1+2)}
+     * created in {@link #idealize} calls {@link #peephole} (which then folds
+     * into a constant).  The other new Node {@code (x+3)} does not call
+     * peephole, because it is returned and peephole itself will recursively
+     * call peephole.
+     * <p>
+     * Since idealize calls peephole and peephole calls idealize, you must be
+     * careful that all idealizations are <em>monotonic</em>: all transforms
+     * remove some feature, so that the set of available transforms always
+     * shrinks.  If you don't, you risk an infinite peephole loop!
+     *
+     * @return Either a new or changed node, or null for no changes.
+     */
+    public abstract Node idealize();
+
+    // Some of the peephole rules get complex, and search further afield than
+    // just the nearest neighbor.  These peepholes can fail the pattern match
+    // on a node some distance away, and if that node ever changes we should
+    // retry the peephole.  Track a set of Nodes dependent on `this`, and
+    // revisit them if `this` changes.
+    Ary<Node> _deps;
+    public int nDeps() { return _deps == null ? 0 : _deps.size(); }
+    public Node dep(int idx) { return _deps.at(idx); }
+
+    private boolean addDepImpl( Node dep ) {
+        // Running peepholes during the big assert cannot have side effects
+        // like adding dependencies.
+        if( CODE._midAssert ) return false;
+        if( CODE._obs != null ) CODE._obs.dep(this, dep);
+        if( dep._deps==null ) dep._deps = new Ary<>(Node.class);
+        if( dep._deps   .find(this) != -1 ) return false; // Already on list
+        if( dep._outputs.find(this) != -1 ) return false;
+        return true;
+    }
+
+    /**
+     * Add a node to the list of dependencies.  Only add it if it's not an input
+     * or output of this node, that is, it is at least one step away.  The node
+     * being added must benefit from this node being peepholed.
+     */
+    public <N extends Node> N addDep( N dep ) {
+        if( !addDepImpl(dep) ) return dep;
+        if( dep._inputs .find(this) != -1 ) return dep; // No need for deps on immediate neighbors
+        dep._deps.add(this);
+        return dep;
+    }
+
+    public <N extends Node> N addDepForwards( N dep ) {
+        if( !addDepImpl(dep) ) return dep;
+        dep._deps.add(this);
+        return dep;
+    }
+
+    // Move the dependents onto a worklist, and clear for future dependents.
+    public void moveDepsToWorklist( ) { moveDepsToWorklist(CODE._iter); }
+    public void moveDepsToWorklist( IterPeeps iter ) {
+        if( _deps == null ) return;
+        iter.addAll(_deps);
+        _deps.clear();
+    }
+
+    // Two nodes are equal if they have the same inputs and the same "opcode"
+    // which means the same Java class, plus same internal parts.
+    @Override public final boolean equals( Object o ) {
+        if( o==this ) return true;
+        if( o.getClass() != getClass() ) return false;
+        Node n = (Node)o;
+        int len = _inputs.size();
+        if( len != n._inputs.size() ) return false;
+        for( int i=0; i<len; i++ )
+            if( in(i) != n.in(i) )
+                return false;
+        return eq(n);
+    }
+    // Subclasses add extra checks (such as ConstantNodes have same constant),
+    // and can assume "this!=n" and has the same Java class.
+    public boolean eq( Node n ) { return true; }
+
+    // Cached hash.  If zero, then not computed AND this Node is NOT in the GVN
+    // table - and can have its edges hacked (which will change his hash
+    // anyway).  If Non-Zero then this Node is IN the GVN table, or is being
+    // probed to see if it can be inserted.  His edges are "locked", because
+    // hacking his edges will change his hash.
+    int _hash;
+    // Edge and mode edits remove the node from GVN, even if its type is unchanged.
+    public boolean isUnlocked() { return _hash==0; }
+
+    // If the _hash is set, then the Node is in the GVN table; remove it.
+    void unlock() {
+        if( _hash==0 ) return;
+        Node old = CODE._gvn.remove(this); // Pull from table
+        assert old==this;
+        _hash=0;                // Out of table now
+    }
+
+    // Hash of opcode and inputs
+    @Override public final int hashCode() {
+        if( _hash != 0 ) return _hash;
+        int hash = hash();
+        for( Node n : _inputs )
+            if( n != null )
+                hash = hash ^ (hash<<17) ^ (hash>>13) ^ n._nid;
+        if( hash==0 ) hash = 0xDEADBEEF; // Bad hash, so use some junky thing
+        return (_hash=hash);
+    }
+    // Subclasses add extra hash info (such as ConstantNodes constant)
+    int hash() { return 0; }
+
+    // ------------------------------------------------------------------------
+    //
+
+    /** Is this Node Memory related */
+    public boolean isMem() { return false; }
+
+    // ------------------------------------------------------------------------
+    // Peephole utilities
+
+    // Swap inputs without letting either input go dead during the swap.
+    public Node swap12() {
+        unlock();               // Hash is order dependent
+        _inputs.swap(1,2);
+        return this;
+    }
+
+    /**
+     * Does this node contain all constants?  Ignores in(0), as is usually
+     * control.  In an input is not a constant, we add dep as a dependency to
+     * it because dep can make progress if the input becomes a constant later.
+     * It is sufficient for one of the non-const inputs to have the dependency,
+     * so we don't bother checking the rest.
+     */
+    boolean allCons(Node dep) {
+        for( int i=1; i<nIns(); i++ )
+            if( !(in(i)._type.isConstant()) ) {
+                dep.addDep(in(i)); // If in(i) becomes a constant later, will trigger some peephole
+                return false;
+            }
+        return true;
+    }
+
+    // Make a shallow copy (same class) of this Node, with given inputs and
+    // empty outputs and a new Node ID.  The original inputs are ignored.
+    // Does not need to be implemented in isCFG() nodes.
+    Node copy(Node lhs, Node rhs) { throw Utils.TODO("Binary ops need to implement copy"); }
+
+    public Node copy() { return copyEmpty(); }
+
+    // Exact-class copy with fresh identity and no edges.  Unlike machine
+    // rematerialization copies, this never registers or copies input edges.
+    public final Node copyEmpty() {
+        Node n;
+        try { n = (Node)clone(); }
+        catch( Exception e ) { throw new RuntimeException(e); }
+        n._nid = CODE.getUID(); // allocate unique dense ID
+        n._inputs  = new Ary<>(Node.class);
+        n._outputs = new Ary<>(Node.class);
+        n._deps = null;
+        n._hash = 0;
+        if( n instanceof CallNode call ) {
+            CODE._calls.add(call);
+            CODE.add(CODE._globalEscapes);
+        }
+        return n;
+    }
+
+    // Report any post-optimize errors
+    public Parser.ParseException err() { return null; }
+
+    // Common integer constants
+    public static ConstantNode con(long x) { return (ConstantNode)ConstantNode.make(TypeInteger.constant(x)).peephole(); }
+
+    // Utility to walk the entire graph applying a function; return the first
+    // not-null result.
+    final public <E> E walk( Function<Node,E> pred ) {
+        assert CODE._visit.isEmpty();
+        E rez = _walk(pred);
+        CODE._visit.clear();
+        return rez;
+    }
+
+    private <E> E _walk( Function<Node,E> pred ) {
+        if( CODE._visit.get(_nid) ) return null; // Been there, done that
+        CODE._visit.set(_nid);
+        E x = pred.apply(this);
+        if( x != null ) return x;
+        for( Node def : _inputs  )  if( def != null && (x = def._walk(pred)) != null ) return x;
+        for( Node use : _outputs )  if( use != null && (x = use._walk(pred)) != null ) return x;
+        return null;
+    }
+
+    public void gather(HashMap<String,Integer> strs ) { }
+
+    // If a Type upgrade happens, put on worklist
+    boolean _upgradeType( HashMap<String,Type> TYPES ) { return false; }
+    public final void upgradeType( HashMap<String,Type> TYPES ) {
+        Type old = _type;  _type = _type.upgradeType(TYPES);
+        boolean progress = _upgradeType(TYPES);
+        if( progress || old != _type ) {
+            CODE.add(this);
+            CODE.addAll(_outputs);
+            if( _deps!=null ) CODE.addAll(_deps);
+        }
+    }
+
+    /**
+     * Debugging utility to find a Node by index
+     */
+    public Node find(int nid) { return _find(nid, new BitSet()); }
+    private Node _find(int nid, BitSet bs) {
+        if( bs.get(_nid) ) return null; // Been there, done that
+        bs.set(_nid);
+        if( _nid==nid ) return this;
+        Node x;
+        for( Node def : _inputs  )  if( def != null && (x = def._find(nid,bs)) != null ) return x;
+        for( Node use : _outputs )  if( use != null && (x = use._find(nid,bs)) != null ) return x;
+        return null;
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/NotNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/NotNode.java
new file mode 100644
index 00000000..2328c287
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/NotNode.java
@@ -0,0 +1,25 @@
+package com.seaofnodes.simple.node;
+
+
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.Utils;
+
+public class NotNode extends Node {
+    public NotNode(Node in) { super(null, in); }
+    @Override public Tag serialTag() { return Tag.Not; }
+
+    @Override protected String format() { return "(!%1)"; }
+
+    @Override
+    public TypeInteger compute() {
+        Type t0 = in(1)._type;
+        if( t0.isHigh() )  return (TypeInteger)TypeInteger.BOOL.dual();
+        if( t0 == Type.NIL || t0 == TypeInteger.ZERO ) return TypeInteger.TRUE;
+        if( t0 instanceof TypeNil tn && tn.notNull() ) return TypeInteger.FALSE;
+        if( t0 instanceof TypeInteger i && (i._min > 0 || i._max < 0) ) return TypeInteger.FALSE;
+        return TypeInteger.BOOL;
+    }
+
+    @Override
+    public Node idealize() { return null; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/OrNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/OrNode.java
new file mode 100644
index 00000000..c7dcc75e
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/OrNode.java
@@ -0,0 +1,45 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeInteger;
+
+public class OrNode extends ArithNode {
+    public OrNode( Lexer loc, Node lhs, Node rhs) { super(loc,lhs, rhs, (byte)1); }
+    @Override public Tag serialTag() { return Tag.Or; }
+
+    @Override public String label() { return "Or"; }
+    @Override public String op() { return "|"; }
+    @Override long doOp( long x, long y ) { return x | y; }
+    @Override TypeInteger doOp(TypeInteger x, TypeInteger y) {
+        return TypeInteger.BOT;
+    }
+
+    @Override
+    public Node idealize() {
+        Node lhs = in(1);
+        Node rhs = in(2);
+
+        Type t1 = lhs._type;
+        Type t2 = rhs._type;
+
+        // Or of 0.  We do not check for (0|x) because this will already
+        // canonicalize to (x|0)
+        if( t2.isConstant() && t2 instanceof TypeInteger i && i.value()==0 && t1.isa(TypeInteger.BOT) && forceInt(lhs) )
+            return lhs;
+
+        // Move constants to RHS: con*arg becomes arg*con
+        if ( t1.isConstant() && !t2.isConstant() )
+            return swap12();
+
+        // Do we have ((x | (phi cons)) | con) ?
+        // Do we have ((x | (phi cons)) | (phi cons)) ?
+        // Push constant up through the phi: x | (phi con0|con0 con1|con1...)
+        Node phicon = AddNode.phiCon(this,true);
+        if( phicon!=null ) return phicon;
+
+        return super.idealize();
+    }
+    @Override Node copy(Node lhs, Node rhs) { return new OrNode(_loc,lhs,rhs); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ParmNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ParmNode.java
new file mode 100644
index 00000000..91c471c0
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ParmNode.java
@@ -0,0 +1,109 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.codegen.Serialize;
+import com.seaofnodes.simple.util.BAOS;
+
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+public class ParmNode extends PhiNode {
+
+    // Argument indices are mapped one-to-one on CallNode inputs
+    public final int _idx;             // Argument index
+    public Type _declaredType;
+
+    public ParmNode(String label, int idx, Type declaredType, Node... inputs) {
+        super(label, inputs);
+        _idx = idx;
+        _declaredType = declaredType;
+        _type = declaredType;
+    }
+    public ParmNode(ParmNode parm) { super(parm, parm._label ); _idx = parm._idx; _declaredType = parm._declaredType; }
+    @Override public Tag serialTag() { return Tag.Parm; }
+    @Override public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) {
+        baos.packed1(Serialize.nIns(this,anodes)); // Object-local linked calls
+        baos.packed2(_label==null ? 0 : strs.get(_label));
+        baos.packed2(types.get(_declaredType)); // NPE if fails lookup
+        baos.packed1(_idx);
+    }
+    static Node make( BAOS bais, String[] strs, Type[] types)  {
+        Node[] ins = new Node[bais.packed1()];
+        String label =   strs[bais.packed2()];
+        Type minType =  types[bais.packed2()];
+        return new ParmNode(label, bais.packed1(), minType, ins);
+    }
+
+    @Override public String label() { return MemOpNode.mlabel(_label); }
+
+    @Override boolean _upgradeType( HashMap<String,Type> TYPES) {
+        Type t = _declaredType.upgradeType(TYPES);
+        if( t == _declaredType ) return false;
+        unlock();
+        _declaredType = t;
+        return true;
+    }
+
+    public FunNode fun() { return (FunNode)in(0); }
+
+    @Override
+    protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        if( fun()._name!=null && fun()._name.endsWith("<clinit>") && _label.equals("arg") )
+            return p.p("arg");
+        p.p("Parm_").p(_label).open();
+        for( Node in : _inputs ) p.n(in).p(",");
+        return p.unchar(',').close();
+    }
+
+
+    // Always in-progress until we run out of unknown callers
+    @Override public boolean inProgress() { return in(0) instanceof FunNode fun && fun.inProgress(); }
+
+    @Override
+    public Type compute() {
+        if( !(region() instanceof RegionNode r) )
+            return region()._type==Type.XCONTROL || region()._type==Type.TOP ? (_type instanceof TypeMem ? TypeMem.TOP : Type.TOP) : _type;
+        // During parsing Phis have to be computed type pessimistically.
+        if( r.inProgress() || in(nIns()-1)==null )
+            return _declaredType;
+        // Set type to local top of the starting type
+        Type t = Type.TOP;
+        for( int i = 1; i < nIns(); i++ ) {
+            // If the region's control input is live, add this as a dependency
+            // to the control because we can be peeped should it become dead.
+            Type ctrl = addDep(r.in(i))._type;
+            if( ctrl != Type.XCONTROL && ctrl != Type.TOP ) {
+                if( in(i)._type==Type.BOTTOM )
+                    return Type.BOTTOM;
+                t = t.meet(in(i)._type);
+            }
+        }
+        // Recursion is a loop in disguise. A Parm merges the first argument
+        // with those from recursive calls, just as a loop Phi merges its entry
+        // and backedge. Use the widening rule in PhiNode.compute here too.
+        // CallEndNode.compute handles the separate cycle through return values;
+        // widening this Parm alone cannot stop f(x-1)+1 from growing its result.
+        if( t instanceof TypeInteger ti && !ti.isHigh() && !ti.isConstant() )
+            t = ti.same_but_slightly_wider_than();
+        return t.join(_declaredType);
+    }
+
+    @Override
+    public Node idealize() {
+        if( !(region() instanceof FunNode) )
+            // A dead function can lose every caller before the Parm itself is
+            // removed; there is no replacement input in that transient form.
+            return nIns()==1 ? null : in(1); // Input has collapse to e.g. starting control.
+        // If function is folding, do all possible peeps
+        if( fun()._folding ) return super.idealize();
+
+        // Skip most phi optimizations on parms
+        return null;
+    }
+
+    @Override public boolean eq( Node n ) {
+        return ((ParmNode)n)._idx==_idx && super.eq(n);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/PhiNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/PhiNode.java
new file mode 100644
index 00000000..75d3ff13
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/PhiNode.java
@@ -0,0 +1,288 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.*;
+import com.seaofnodes.simple.codegen.Serialize;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.*;
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+public class PhiNode extends Node {
+
+    public final String _label;
+
+    public PhiNode( String label, Node... inputs) {
+        super(inputs);
+        _label = label;
+    }
+    public static PhiNode make(String label, Type minType, Node... inputs) {
+        return minType instanceof TypeMem mem
+            ? mem._alias==1
+                ? new BulkMemPhiNode(label,inputs)
+                : new MemPhiNode(label,mem._alias,inputs)
+            : new PhiNode(label, inputs);
+    }
+    // Used by ParmNode
+    public PhiNode(PhiNode phi, String label) { super(phi); _label = label; }
+    // Used by instruction Selection
+    public PhiNode(PhiNode phi) { this(phi,phi._label);  }
+    // Used by the infinite-loop exit breaker
+    public PhiNode(RegionNode r, Node sample) {
+        super(new Node[]{r});
+        _label = "";
+        _type = sample._type;
+        while( nIns() < r.nIns() )
+            addDef(sample);
+    }
+    @Override public Tag serialTag() { return Tag.Phi; }
+    @Override public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) {
+        baos.packed1(nIns());
+        baos.packed2(_label==null ? 0 : strs.get(_label));
+    }
+    static Node make( BAOS bais, String[] strs, Type[] types)  {
+        Node[] ins = new Node[bais.packed1()];
+        return new PhiNode(strs[bais.packed2()], ins);
+    }
+
+    @Override public String label() { return "Phi_"+MemOpNode.mlabel(_label); }
+
+    @Override
+    protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        if( !(region() instanceof RegionNode r) || r.inProgress() )
+            p.p("Z");
+        p.p("Phi(");
+        for( Node in : _inputs ) p.n(in).p(",");
+        return p.unchar(',').close();
+    }
+
+    public CFGNode region() { return (CFGNode)in(0); }
+    @Override public boolean isMem() { return _type instanceof TypeMem; }
+
+    @Override
+    public Type compute() {
+        if( !(region() instanceof RegionNode r) )
+            return Type.TOP;
+        // During parsing Phis have to be computed type pessimistically.
+        if( r.inProgress() || in(nIns()-1)==null )
+            return Type.BOTTOM;
+        // Set type to local top of the starting type
+        Type t = Type.TOP;
+        for( int i = 1; i < nIns(); i++ ) {
+            // If the region's control input is live, add this as a dependency
+            // to the control because we can be peeped should it become dead.
+            Type ctrl = addDep(r.in(i))._type;
+            if( ctrl != Type.XCONTROL && ctrl != Type.TOP ) {
+                if( in(i)._type==Type.BOTTOM )
+                    return Type.BOTTOM;
+                t = t.meet(in(i)._type);
+            }
+        }
+
+        // Widen loop Phis so integer ranges cannot grow one step per trip forever.
+        // Recursion is a loop in disguise: ParmNode.compute widens arguments,
+        // and CallEndNode.compute widens results. Both are needed because the
+        // recursive result can feed itself without passing through a Parm.
+        // Above-center ranges may still fall to unwidened constants.
+        // Widen only below-center ranges to preserve monotonicity.
+        if( r instanceof LoopNode && // Only around loops
+            t instanceof TypeInteger ti && // Only widen integers
+            !ti.isHigh() && !ti.isConstant() ) {  // Only widen live ranges
+            // Widen, to prevent infinite falling of TypeIntegers
+            return ti.same_but_slightly_wider_than();
+        }
+
+        return t;
+    }
+
+    @Override
+    public Node idealize() {
+        RegionNode r = (RegionNode)region();
+        if( r.inProgress() || nOuts()==0 )
+            return null;        // Input is in-progress
+
+        // If we have only a single unique input, become it.
+        Node live = singleUniqueInput();
+        if( live != null )
+            return live;
+
+        // No bother if region is going to fold dead paths soon
+        for( int i=1; i<nIns(); i++ )
+            if( r.in(i)._type == Type.XCONTROL )
+                return null;
+
+        // Generic "pull down op"
+        Node progress;
+        if( same_op() && (progress = drop_same_op()) != null )
+            return progress;
+
+        // If merging Phi(ZERO, guardNZ(N)) at the matching `if(N)` join, the
+        // Phi is exactly N.  The guard arm proves N is non-zero, and the other
+        // arm contributes N's zero value.  This is only legal if N is already
+        // available at the Phi region; otherwise a return-scope/live-on-exit
+        // Phi can lose the zero arm and export a branch-local value upward.
+        Node unguard;
+        if( (unguard=matchingGuardMerge(r,1)) != null ) return unguard;
+        if( (unguard=matchingGuardMerge(r,2)) != null ) return unguard;
+
+        return null;
+    }
+
+    private Node matchingGuardMerge(RegionNode r, int nzIdx) {
+        Node zero = in(3-nzIdx);
+        if( !(in(nzIdx) instanceof GuardNode cast && cast._nonZero) ||
+            zero._type.makeZero()!=zero._type ||
+            cast.in(1)==this )
+            return null;
+        if( !(r.in(nzIdx) instanceof CProjNode nz && nz._idx==0 && nz.ctrl() instanceof IfNode iff) )
+            return null;
+        if( !(r.in(3-nzIdx) instanceof CProjNode z && z._idx==1 && z.ctrl()==iff) )
+            return null;
+        // Predicate was guarded?
+        Node n = cast.in(1), tested = null;
+        while( true ) {
+            if( iff.pred()==n ) tested = n;
+            if( !(n instanceof GuardNode guard && guard._nonZero) ) break;
+            n = guard.in(1);
+        }
+        CFGNode early = CFGNode.earlyCFG(n);
+        return tested!=null && (early==null || early.dominates(r,this)) ? n : null;
+    }
+
+    // Same op on all Phi paths; all ops have only the Phi as a use.
+    // None have a control input.
+    private boolean same_op() {
+        Node op = in(1);
+        if( op instanceof EscapeNode || op instanceof CFGNode || op instanceof ConstantNode || op instanceof PhiNode ||
+            op instanceof ProjNode || op instanceof NewNode || op instanceof ScopeNode || op instanceof MemMergeNode ) return false;
+        // A bulk Phi must split its aliases before factoring precise Stores.
+        if( this instanceof BulkMemPhiNode ) return false;
+        // Bulk splitting currently identifies parallel slices by Region/alias.
+        // Factoring can introduce another slice at a different memory point;
+        // wait until that Region's bulk partitioning has finished.
+        if( op instanceof MemOpNode )
+            for( Node use : region()._outputs )
+                if( use instanceof BulkMemPhiNode ) {
+                    addDepForwards(use);
+                    return false;
+                }
+        Node busy = null;
+        for( int i=1; i<nIns(); i++ ) {
+            Node n = in(i);
+            if( addDep(region().in(i))._type==Type.XCONTROL ||
+                op.getClass()!=n.getClass() || n.nIns()!=op.nIns() || n.in(0)!=null || !op.eq(n) ) return false;
+            if( n instanceof MemOpNode mem && !mem.canDrop((MemOpNode)op,this) ) return false;
+            // Moving a Store must remove the old effect, not duplicate it.
+            // Allow one shared arm: the other arms disappear into the single
+            // factored operation, usually reducing the total operation count.
+            addDepForwards(n);
+            if( n.nOuts()>1 ) {
+                for( Node use : n._outputs )
+                    if( use!=null && use!=this ) addDepForwards(use);
+                if( n instanceof StoreNode || busy!=null ) return false;
+                busy=n;
+            }
+            for( int j=1; j<n.nIns(); j++ )
+                if( n.in(j) instanceof ScopeNode || ((n.in(j)==null) != (op.in(j)==null)) ) return false;
+        }
+        return true;
+    }
+
+    private Node drop_same_op() {
+        Node op = in(1), cp = op.copyEmpty();
+        cp._type = null;
+        cp.addDef(null);
+        for( int j=1; j<op.nIns(); j++ ) {
+            Node x = op.in(j);
+            boolean different = false;
+            for( int i=2; i<nIns(); i++ )
+                if( in(i).in(j)!=x ) different=true;
+            if( different ) {
+                Node[] ins = new Node[nIns()];
+                ins[0] = region();
+                Type t = Type.TOP;
+                for( int i=1; i<nIns(); i++ ) {
+                    ins[i] = in(i).in(j);
+                    t = t.meet(ins[i]._type);
+                }
+                // Do not introduce an operand Phi mixing incompatible type families.
+                if( t==Type.BOTTOM ) {
+                    for( int i=1; i<ins.length; i++ ) addDep(ins[i]);
+                    cp.kill();
+                    return null;
+                }
+                PhiNode phi = j==1 && op instanceof MemOpNode mem
+                    ? new MemPhiNode(_label,mem._alias,ins)
+                    : PhiNode.make(_label,t,ins);
+                x = phi.peephole();
+            }
+            cp.addDef(x);
+        }
+        // Factoring must not widen the result (e.g. correlated And operands).
+        if( cp.compute().isa(compute()) ) return cp;
+        for( int i=1; i<nIns(); i++ )
+            for( int j=1; j<in(i).nIns(); j++ )
+                if( in(i).in(j)!=null ) addDep(in(i).in(j));
+        cp.kill();
+        return null;
+    }
+
+    /**
+     * If only single unique input, return it
+     */
+    private Node singleUniqueInput() {
+        if( region() instanceof LoopNode loop && loop.entry()._type == Type.XCONTROL )
+            return null;    // Dead entry loops just ignore and let the loop collapse
+        Node live = null;
+        for( int i=1; i<nIns(); i++ ) {
+            // If the region's control input is live, add this as a dependency
+            // to the control because we can be peeped should it become dead.
+            if( addDep(region().in(i))._type != Type.XCONTROL && in(i) != this )
+                if( live == null || live == in(i) ) live = in(i);
+                else return null;
+        }
+        return live;
+    }
+
+    @Override
+    boolean allCons(Node dep) {
+        if( !(region() instanceof RegionNode r) ) return false;
+        // When the region completes (is no longer in progress) the Phi can
+        // become a "all constants" Phi, and the "dep" might make progress.
+        dep.addDep(this);
+        if( r.inProgress() ) return false;
+        return super.allCons(dep);
+    }
+
+    // True if last input is null
+    public boolean inProgress() {
+        return in(nIns()-1) == null;
+    }
+
+    // Never equal if inProgress.
+    @Override public boolean eq( Node n ) {
+        return !inProgress() && super.eq(n);
+    }
+
+    @Override
+    public Parser.ParseException err() {
+        if( _type != Type.BOTTOM ) return null;
+
+        // Global BOTTOM retains the same role for non-scalar families.
+        for( int i=1; i<nIns(); i++ )
+            // Already an error, but better error messages come from elsewhere
+            if( in(i)._type == Type.BOTTOM )
+                return null;
+
+        SB sb = new SB().p("No common type amongst ");
+        for( int i=1; i<nIns(); i++ )
+            sb.p(in(i)._type.toString()).p(" and ");
+        return Parser.error(sb.unchar(5).toString(),null);
+    }
+
+    @Override public void gather( HashMap<String,Integer> strs ) {
+        Serialize.gather(strs,_label);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/Proj.java b/chapter29/src/main/java/com/seaofnodes/simple/node/Proj.java
new file mode 100644
index 00000000..c8b9378f
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/Proj.java
@@ -0,0 +1,2 @@
+package com.seaofnodes.simple.node;
+public interface Proj { int idx(); }
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ProjNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ProjNode.java
new file mode 100644
index 00000000..fcc113a8
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ProjNode.java
@@ -0,0 +1,71 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.Serialize;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeMem;
+import com.seaofnodes.simple.type.TypeTuple;
+import com.seaofnodes.simple.util.BAOS;
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+public class ProjNode extends Node implements Proj {
+
+    // Which slice of the incoming multipart value
+    public final int _idx;
+
+    // Debugging label
+    public final String _label;
+
+    public ProjNode(Node ctrl, int idx, String label) {
+        super(new Node[]{ctrl});
+        _idx = idx;
+        _label = label;
+    }
+    public ProjNode(ProjNode p) { super(p); _idx = p._idx; _label = p._label; }
+    @Override public Tag serialTag() { return Tag.Proj; }
+    @Override public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) {
+        baos.packed1(_idx);
+        baos.packed2(_label==null ? 0 : strs.get(_label));
+    }
+    static Node make( BAOS bais, String[] strs )  {
+        return new ProjNode(null, bais.packed1(), strs[bais.packed2()] );
+    }
+
+    @Override public String label() { return _label; }
+
+    @Override
+    protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        if( _label != null )  return p.p(_label);
+        if( in(0) instanceof CallEndNode cend && cend.call()!=null )
+            return p.n(cend.call());
+        return p.p("LONELY PROJ");
+    }
+
+    @Override public CFGNode cfg0() {
+        return in(0) instanceof CFGNode cfg ? cfg : in(0).cfg0();
+    }
+
+    @Override public boolean isMem() { return _type instanceof TypeMem; }
+
+    @Override
+    public Type compute() {
+        Type t = in(0)._type;
+        return t instanceof TypeTuple tt ? tt._types[_idx] : t.oob();
+    }
+
+    @Override public Node idealize() { return ((MultiNode)in(0)).pcopy(_idx,this); }
+
+    @Override
+    public boolean eq( Node n ) { return _idx == ((ProjNode)n)._idx; }
+
+    @Override
+    int hash() { return _idx; }
+
+    @Override public int idx() { return _idx; }
+
+    @Override public void gather( HashMap<String,Integer> strs ) {
+        Serialize.gather(strs,_label);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/PtrToIntMach.java b/chapter29/src/main/java/com/seaofnodes/simple/node/PtrToIntMach.java
new file mode 100644
index 00000000..9a9b94fd
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/PtrToIntMach.java
@@ -0,0 +1,17 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.util.SB;
+
+/** Zero-code machine form of {@link PtrToIntNode}. */
+public class PtrToIntMach extends PtrToIntNode implements MachNode {
+    public PtrToIntMach(PtrToIntNode ptr) { super(ptr); }
+    @Override public String op() { return label(); }
+    @Override public RegMask regmap(int i) { assert i==1; return RegMask.FULL; }
+    @Override public RegMask outregmap() { return RegMask.FULL; }
+    @Override public int twoAddress() { return 1; }
+    @Override public void encoding(Encoding enc) { }
+    @Override public void asm(CodeGen code, SB sb) { sb.p(code.reg(in(1))); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/PtrToIntNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/PtrToIntNode.java
new file mode 100644
index 00000000..d528b53b
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/PtrToIntNode.java
@@ -0,0 +1,36 @@
+package com.seaofnodes.simple.node;
+
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.type.TypeMemPtr;
+
+
+/**
+ * Reinterpret a non-null managed pointer as its raw integer address.
+ *
+ * This node changes representation families but emits no code.  No
+ * control-dependent proof can turn a pointer into an integer; array-to-C-pointer
+ * conversion adds the array body offset separately.
+ */
+public class PtrToIntNode extends Node {
+    public PtrToIntNode(Node ptr) { super(null,ptr); }
+    public PtrToIntNode(PtrToIntNode ptr) { super(ptr); }
+
+    @Override public Tag serialTag() { return Tag.PtrToInt; }
+    @Override protected String format() { return "(i64*)%1"; }
+
+    @Override public Type compute() {
+        return in(1)._type.isHigh() ? TypeInteger.TOP : TypeInteger.BOT;
+    }
+
+    @Override public Node idealize() { return null; }
+
+    @Override public Parser.ParseException err() {
+        Type t = in(1)._type;
+        if( t instanceof TypeMemPtr ptr )
+            return ptr.notNull() ? null : Parser.error("Cannot convert a nullable pointer to an integer",null);
+        return Parser.error("Cannot convert "+t.str()+" to an integer pointer",null);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ReadOnlyMach.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ReadOnlyMach.java
new file mode 100644
index 00000000..a35f5a1d
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ReadOnlyMach.java
@@ -0,0 +1,19 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.util.SB;
+
+/**
+ * Cast a pointer to read-only
+ */
+public class ReadOnlyMach extends ReadOnlyNode implements MachNode {
+    public ReadOnlyMach( ReadOnlyNode n ) { super(n); }
+    @Override public String op() { return label(); }
+    @Override public RegMask regmap(int i) { assert i==1; return RegMask.FULL; }
+    @Override public RegMask outregmap() { return RegMask.FULL; }
+    @Override public int twoAddress( ) { return 1; }
+    @Override public void encoding( Encoding enc ) { }
+    @Override public void asm(CodeGen code, SB sb) { sb.p(code.reg(in(1))); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ReadOnlyNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ReadOnlyNode.java
new file mode 100644
index 00000000..0a720d5b
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ReadOnlyNode.java
@@ -0,0 +1,27 @@
+package com.seaofnodes.simple.node;
+
+
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeMemPtr;
+
+/**
+ * Cast a pointer to read-only
+ */
+public class ReadOnlyNode extends Node {
+    public ReadOnlyNode( Node n ) { super(null,n); }
+    public ReadOnlyNode( ReadOnlyNode n ) { super(n); }
+    @Override public Tag serialTag() { return Tag.ReadOnly; }
+
+    @Override protected String format() { return "(const)%1"; }
+    @Override public Type compute() {
+        Type t = in(1)._type;
+        return t instanceof TypeMemPtr tmp ? tmp.makeRO() : t;
+    }
+
+    @Override public Node idealize() {
+        if( in(1)._type instanceof TypeMemPtr tmp && tmp.isFinal() )
+            return in(1);
+        return null;
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/RegionNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/RegionNode.java
new file mode 100644
index 00000000..8d0d56e9
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/RegionNode.java
@@ -0,0 +1,176 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.util.BAOS;
+import java.util.*;
+
+public class RegionNode extends CFGNode {
+    // Source location for late discovered errors
+    public Lexer _loc;
+
+    public RegionNode(Lexer loc, Node...   nodes) { super(nodes); _loc = loc; }
+    public RegionNode(RegionNode r, Lexer loc) { super(r); _loc = loc; }
+    public RegionNode(RegionNode r) { super(r); if( r!=null ) _loc = r._loc; }
+    @Override public Tag serialTag() { return Tag.Region; }
+    public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) { baos.packed1(nIns()); }
+    static Node make( BAOS bais ) { return new RegionNode(null,new Node[bais.packed1()]); }
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        return p.p(label());
+    }
+
+    @Override public boolean blockHead() { return true; }
+
+    @Override
+    public Type compute() {
+        if( inProgress() ) return Type.CONTROL;
+        Type t = Type.XCONTROL;
+        for (int i = 1; i < nIns(); i++)
+            t = t.meet(in(i)._type);
+        return t;
+    }
+
+    @Override
+    public Node idealize() {
+        if( inProgress() ) return null;
+
+        Node progress = deadPath(false);
+        if( progress!=null ) return progress;
+
+        // If down to a single input, become that input
+        if( nIns()==2 && !hasPhi() )
+            return in(1);       // Collapse if no Phis; 1-input Phis will collapse on their own
+
+        // If a CFG diamond with no merging, delete: "if( pred ) {} else {};"
+        if( !hasPhi() && nIns()>3 &&  // No Phi users, just a control user
+                in(1) instanceof CProjNode p1 &&
+                in(2) instanceof CProjNode p2 &&
+                addDepForwards(p1).in(0)==addDepForwards(p2).in(0) &&
+                p1.in(0) instanceof IfNode iff ) {
+            // Replace with the iff.ctrl directly
+            if( nIns()==3 ) return iff.ctrl();
+            // Just delete the path for fat Regions
+            setDef(1,iff.ctrl());
+            return delDef(2);
+        }
+
+        // Flatten stacked regions (no loops involved)
+        if( getClass() == RegionNode.class && nIns()>2 ) {
+            for( int i=1; i<nIns(); i++ )
+                if( cfg(i) instanceof RegionNode region && region.getClass() == RegionNode.class && region.nIns()>2 && !hasMidUser(region) ) {
+                    assert !region.inProgress();
+                    // Fold Phis
+                    for( Node use : _outputs ) {
+                        if( use instanceof PhiNode phi ) {
+                            PhiNode phi2 = phi.in(i) instanceof PhiNode phi2x && phi2x.region()==region ? phi2x : null;
+                            for( int j=1; j<region.nIns(); j++ )
+                                phi.addDef(phi2==null ? phi.in(i) : phi2.in(j));
+                            CodeGen.CODE.add(phi);
+                        }
+                    }
+
+                    // Fold Region
+                    for( int j=1; j<region.nIns(); j++ )
+                        addDef(region.in(j));
+                    setDef(i,CodeGen.CODE.XCTRL);
+                    return this;
+                }
+        }
+
+        return null;
+    }
+
+    Node deadPath(boolean skipStart) {
+        // Delete dead paths into a Region
+        int path = findDeadInput(skipStart ? 2 :1);
+        if( path==0 ) return null;
+
+        // Do not delete the entry path of a loop (ok to remove the back edge
+        // and make the loop a single-entry Region which folds away the Loop).
+        // Folding the entry path confused the loop structure, moving the
+        // backedge to the entry point.
+        if( this instanceof LoopNode loop && loop.entry()==in(path) )
+            return null;
+        return removeDeadPath(path);
+    }
+
+    public Node removeDeadPath(int path) {
+        // Cannot use the obvious output iterator here, because a Phi deleting
+        // an input might recursively delete *itself*.  This shuffles the
+        // output array, and we might miss iterating an unrelated Phi. So on
+        // rare occasions we repeat the loop to get all the Phis.
+        int nouts = 0;
+        while( nouts != nOuts() ) {
+            nouts = nOuts();
+            for( int i=0; i<nOuts(); i++ )
+                if( out(i) instanceof PhiNode phi && phi.nIns()==nIns() ) {
+                    CodeGen.CODE.addAll(phi.in(path)._outputs);
+                    CodeGen.CODE.addAll(phi.delDef(path)._outputs);
+                }
+        }
+        if( !isDead() ) delDef(path);
+        return isDead() ? CodeGen.CODE.XCTRL : this;
+    }
+
+    private int findDeadInput(int startIdx) {
+        for( int i=startIdx; i<nIns(); i++ )
+            if( in(i)._type==Type.XCONTROL )
+                return i;
+        return 0;               // All inputs alive
+    }
+
+    boolean hasPhi() {
+        for( Node phi : _outputs )
+            if( phi instanceof PhiNode )
+                return true;
+        return false;
+    }
+
+    // Is there a value in-between 2 Regions?  Difficult to correctly fuse
+    // without extensive testing, so just ignore.
+    boolean hasMidUser(RegionNode r) {
+        for( Node use : r._outputs ) {
+            if( use==this ) continue;
+            if( use instanceof PhiNode ) {
+                for( Node data : use._outputs ) {
+                    if( !(data instanceof PhiNode phi2) || phi2.region()!=this )
+                    { addDep(use); if( data!=null ) addDep(data); return true; }
+                }
+            } else
+            { addDep(use);  return true; } // Control user
+        }
+        return false;
+    }
+
+
+    // Immediate dominator of Region is a little more complicated.
+    @Override public int idepth() {
+        if( validIDepth() ) return _idepth;
+        int depth=0;
+        for( Node n : _inputs )
+            if( n!=null )
+                depth = Math.max(depth,((CFGNode)n).idepth()+1);
+        return cacheIDepth(depth);
+    }
+
+    @Override public CFGNode idom(Node dep) {
+        CFGNode lca = null;
+        // Recompute from predecessors: CFG edits can change the dominator.
+        for( int i=1; i<nIns(); i++ )
+            if( !cfg(i)._type.isHigh() )
+                lca = cfg(i).domLCA(lca,dep);
+        return lca;
+    }
+
+    // True if last input is null
+    public boolean inProgress() { return nIns()>1 && in(nIns()-1) == null; }
+
+    // Never equal if inProgress
+    @Override public boolean eq( Node n ) { return !inProgress(); }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ReturnNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ReturnNode.java
new file mode 100644
index 00000000..182adb19
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ReturnNode.java
@@ -0,0 +1,135 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+/**
+ * The Return node has two inputs.  The first input is a control node and the
+ * second is the data node that supplies the return value.
+ * <p>
+ * In this presentation, Return functions as a Stop node, since multiple <code>return</code> statements are not possible.
+ * The Stop node will be introduced in Chapter 6 when we implement <code>if</code> statements.
+ * <p>
+ * The Return's output is the value from the data node.
+ */
+public class ReturnNode extends CFGNode {
+
+    public FunNode _fun;
+
+    public ReturnNode(Node ctrl, Node mem, Node data, Node rpc, FunNode fun ) {
+        super(ctrl, mem, data, rpc);
+        _fun = fun;
+    }
+    public ReturnNode( ReturnNode ret, FunNode fun ) { super(ret);  _fun = fun;  }
+    @Override public Tag serialTag() { return Tag.Return; }
+
+    public Node ctrl() { return in(0); }
+    public Node mem () { return in(1); }
+    public Node expr() { return in(2); }
+    public Node rpc () { return in(3); }
+    @Override public FunNode fun() { return _fun; }
+
+    @Override
+    protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        p.p("return ");
+        if( expr()==null ) p.p("----");
+        else p.n(expr());
+        return p.p(";");
+    }
+
+    // No one unique control follows; can be many call end sites
+    @Override public CFGNode uctrl() { return null; }
+
+    @Override
+    public Type compute() {
+        Type ret = expr()._type;
+        // Recursive results can grow around Return -> CallEnd -> Add -> Phi
+        // without crossing Parm's widening point. Widen here, so FunPtr and
+        // CallEnd agree on the result, bounded by the declared signature.
+        if( ret instanceof TypeInteger ti && !ti.isHigh() && !ti.isConstant() )
+            ret = ti.same_but_slightly_wider_than();
+        return TypeTuple.make(ctrl()._type,mem()._type,ret.join(addDep(_fun).sig().ret()));
+    }
+
+    @Override public Node idealize() {
+        if( _fun.isDead() ) return null;
+
+        // Upgrade signature based on return type
+        Type ret = expr()._type;
+        TypeFunPtr fcn = _fun.sig();
+        if( ret != fcn.ret() && ret.isa(fcn.ret()) )
+            _fun.setSig(fcn.makeFrom(ret));
+
+        return null;
+    }
+
+    @Override public Parser.ParseException err() {
+        if( ctrl()._type == Type.CONTROL &&
+            expr()._type == Type.TOP )
+            return Parser.error("No defined return type",null);
+        if( ctrl()._type == Type.CONTROL &&
+            expr()._type == TypeScalar.BOT )
+            return Parser.error("Cannot return generic scalar",null);
+        // With no user constructor, <init> doubles as the public no-arg
+        // constructor.  Required fields remain TOP in its private memory: a
+        // typed parser poison which deliberately emitted no Store or code.
+        if( ctrl()._type == Type.CONTROL && _fun.isInstance() ) {
+            TypeStruct self = ((TypeMemPtr)_fun.sig().arg(0))._obj;
+            if( !CodeGen.hasUserConstructor(self) && expr()._type instanceof TypeMem mem )
+                for( Field fld : self._fields ) {
+                    if( !(fld._t instanceof TypeNil tn && tn.notNull()) ) continue;
+                    Type actual = mem._alias==1 && mem._t instanceof TypeStruct ts
+                        ? ts.field(fld._fname)._t
+                        : mem._alias==fld._alias ? mem._t : Type.TOP;
+                    if( actual==Type.TOP || actual instanceof TypeNil atn && atn.nullable() )
+                        return Parser.error("'"+self._name+"' is not fully initialized, field '"+
+                                            fld._fname+"' is only partially set in the constructor",null);
+                }
+        }
+        return null;
+    }
+
+    @Override public boolean eq( Node n ) {
+        return !_fun.isDead() && !((ReturnNode)n)._fun.isDead();
+    }
+
+    // ------------
+    // MachNode specifics, shared across all CPUs
+    public String op() {
+        return _fun._frameAdjust > 0 ? "epilog" : "ret  ";
+    }
+    // Correct Nodes outside the normal edges
+    public void postSelect(CodeGen code) {
+        _fun.setRet(this);
+    }
+    public RegMask regmap(int i) {
+        return i==2
+            ? CodeGen.CODE._mach.retMask(_fun.sig())
+            : CodeGen.CODE._retMasks[i];
+    }
+    public RegMask outregmap() { return null; }
+    public void encoding( Encoding enc ) { throw Utils.TODO(); }
+    public void asm(CodeGen code, SB sb) {
+        int frameAdjust = fun()._frameAdjust;
+        if( frameAdjust>0 )
+            sb.p("\n").p("rsp += #").p(frameAdjust).p("\nret    ");
+        // Post code-gen, just print the "ret"
+        if( code._phase.ordinal() < CodeGen.Phase.RegAlloc.ordinal() ||
+            (code._phase.ordinal() == CodeGen.Phase.RegAlloc.ordinal() && !code._regAlloc.done()) )
+            // Prints return reg (either RAX or XMM0), RPC and then the
+            // callee-save registers.
+            for( int i=2; i<nIns(); i++ )
+                sb.p(code.reg(in(i))).p("  ");
+        // If we did not get the expected rpc, print which one we got
+        else if( code._regAlloc.regnum(rpc()) != code._mach.rpc() )
+            sb.p("[").p(code.reg(rpc())).p("]");
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/RoundF32Node.java b/chapter29/src/main/java/com/seaofnodes/simple/node/RoundF32Node.java
new file mode 100644
index 00000000..65f10a79
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/RoundF32Node.java
@@ -0,0 +1,33 @@
+package com.seaofnodes.simple.node;
+
+
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeFloat;
+
+
+public class RoundF32Node extends Node {
+    public RoundF32Node(Node lhs) { super(null, lhs); }
+    @Override public Tag serialTag() { return Tag.RoundF32; }
+
+    @Override protected String format() { return "((f32)%1)"; }
+
+    @Override
+    public Type compute() {
+        if (in(1)._type instanceof TypeFloat i0 && i0.isConstant() )
+            return TypeFloat.constant((float)i0.value());
+        if( in(1)._type==TypeFloat.F64 ) return TypeFloat.F32;
+        return in(1)._type;
+    }
+
+    @Override
+    public Node idealize() {
+        Node lhs = in(1);
+        Type t1 = lhs._type;
+
+        // RoundF32 of float
+        if( t1 instanceof TypeFloat tf && tf._sz==32 )
+            return lhs;
+
+        return null;
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/SarNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/SarNode.java
new file mode 100644
index 00000000..2e70f345
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/SarNode.java
@@ -0,0 +1,38 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeInteger;
+
+public class SarNode extends ArithNode {
+    public SarNode(Lexer loc, Node lhs, Node rhs) { super(loc, lhs, rhs, (byte)1); }
+    @Override public Tag serialTag() { return Tag.Sar; }
+
+    @Override public String op() { return ">>"; }
+    @Override long doOp( long x, long y ) { return x >> y; }
+    @Override TypeInteger doOp( TypeInteger x, TypeInteger y ) {
+        if( y.isConstant() ) {
+            int log = (int)y.value();
+            return TypeInteger.make(-1L<<(63-log),(1L<<(63-log))-1);
+        }
+        return TypeInteger.BOT;
+    }
+
+    @Override
+    public Node idealize() {
+        Node lhs = in(1);
+        Node rhs = in(2);
+
+        Type t2 = rhs._type;
+
+        // Sar of 0.
+        if( t2.isConstant() && t2 instanceof TypeInteger i && (i.value()&63)==0 && forceInt(lhs) && lhs._type instanceof TypeInteger )
+            return lhs;
+
+        // TODO: x >> 3 >> (y ? 1 : 2) ==> x >> (y ? 4 : 5)
+
+        return super.idealize();
+    }
+    @Override Node copy(Node lhs, Node rhs) { return new SarNode(_loc,lhs,rhs); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ScopeNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ScopeNode.java
new file mode 100644
index 00000000..ff3d8b4d
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ScopeNode.java
@@ -0,0 +1,720 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.print.ExprPrinter;
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.parser.Var;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.CompUnit;
+import com.seaofnodes.simple.codegen.ParseAll;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.Ary;
+import com.seaofnodes.simple.util.Utils;
+import java.util.*;
+
+/**
+ * The Scope node is purely a parser helper - it tracks names to nodes with a
+ * stack of variables.
+ */
+public class ScopeNode extends MemMergeNode {
+
+    /**
+     * The control is a name that binds to the currently active control
+     * node in the graph
+     */
+    public static final String CTRL = "$ctrl";
+    public static final String ARG0 = "arg";
+    public static final String MEM0 = "$mem";
+
+    // All active/live variables in all nested scopes, all run together.
+    // Maps 1-to-1 to the _inputs array.
+    public final Ary<Var> _vars;
+
+    // Lexical scope is typed:
+    public static class Kind {
+        // Basic block scoping
+        public static class Block extends Kind { }
+        // Constructor/initializer block for an allocated struct.
+        public static class Constructor extends Block {
+            public Constructor(TypeStruct self) { _self = self; }
+            public final TypeStruct _self;
+        }
+        // Function scope
+        public static class Func extends Kind {
+            public final String _name;
+            public final boolean _constructor;
+            public Func(String name) { this(name,false); }
+            public Func(String name, boolean constructor) { _name=name; _constructor=constructor; }
+        }
+
+        public int _lexSize;     // Number of Vars in this scope
+    }
+    public final Ary<Kind> _kinds;
+    // Lexical scope nesting depth
+    public int depth() { return _kinds._len; }
+    public Kind klast() { return _kinds.last(); }
+
+    // Extra guards; tested predicates and cast results
+    private final Ary<Node> _guards;
+
+    // A new ScopeNode
+    public ScopeNode() {
+        super();
+        _vars   = new Ary<>(Var .class);
+        _kinds  = new Ary<>(Kind.class);
+        _guards = new Ary<>(Node.class);
+    }
+
+    @Override public String label() { return "Scope"; }
+
+    @Override
+    protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        p.p("Scope[ ");
+        int j=1;
+        for( int i=0; i<nIns(); i++ ) {
+            if( j < depth() && i == _kinds.at(j)._lexSize ) { p.p("| "); j++; }
+            Var v = var(i);
+            p.p(v._type());
+            p.p(" ");
+            if( v._final ) p.p("!");
+            p.p(v._name);
+            p.p("=");
+            Node n = in(i);
+            while( n instanceof ScopeNode loop ) {
+                p.p("Lazy_");
+                n = loop.in(i);
+            }
+            p.n(n);
+            p.p(", ");
+        }
+        return p.unchar(", ").p("]");
+    }
+
+
+    public Node ctrl() { return in(0); }
+    public Node mem() { return in(1); }
+    public Var var(int i) { return _vars.at(i); }
+
+    /**
+     * The ctrl of a ScopeNode is always bound to the currently active
+     * control node in the graph, via a special name '$ctrl' that is not
+     * a valid identifier in the language grammar and hence cannot be
+     * referenced in Simple code.
+     *
+     * @param n The node to be bound to '$ctrl'
+     *
+     * @return Node that was bound
+     */
+    public <N extends Node> N ctrl(N n) { return setDef(0,n); }
+    public Node mem(Node n) { return setDef(1,n); }
+
+    public void push( Kind kind ) {
+        kind._lexSize = _vars.size();
+        _kinds.push(kind);
+    }
+
+    // Pop a lexical scope
+    public void pop() {
+        promote(null);    // Promote forward references to the next outer scope
+        _pop();
+    }
+    // Pop a scope, no promote FRefs
+    public void _pop() {
+        int n = _kinds.pop()._lexSize;
+        popUntil(n);            // Pop off inputs going out of scope
+        _vars.setLen(n);        // Pop off variables going out of scope
+    }
+
+
+    // Look for forward references in the last lexical scope and promote to the
+    // next outer lexical scope.  At the last scope declare them an error.
+    public void promote(CodeGen code) {
+        Kind kind = klast();
+        int n = kind._lexSize;
+        for( int i=n; i<nIns(); i++ ) {
+            Var v = var(i);
+            Node vn = in(i);
+            if( !v.isFRef() ) continue;
+            // Shuffle vars and inputs to move the forward reference to
+            // *before* the start of the using scope ("as if" it was not
+            // actually a forward reference).
+            for( int j=n; j<=i; j++ ) {
+                Var  vtmp = var(j);
+                Node ntmp = in (j);
+                v._idx = j;
+                _vars  .set(j,v );
+                _inputs.set(j,vn);
+                v  = vtmp;
+                vn = ntmp;
+            }
+            kind._lexSize = ++n;
+        }
+    }
+
+
+    public boolean inFunction   () { return klast() instanceof Kind.Func; }
+    // Is any enclosing scope a constructor?
+    public boolean inConstructor() { return constructorSelf() != null; }
+    // Nearest constructor self type, if any.
+    public TypeStruct constructorSelf() {
+        for( int i=depth()-1; i>=0; i-- )
+            if( _kinds.at(i) instanceof Kind.Constructor ctor )
+                return ctor._self;
+            else if( _kinds.at(i) instanceof Kind.Func func && FunNode.isInstance(func._name) )
+                return ((TypeMemPtr)var(_kinds.at(i)._lexSize).type())._obj;
+        return null;
+    }
+
+    // Find nearest enclosing function scope
+    public int enclosingFunction() {
+        for( int i=depth()-1; i>=0; i-- )
+            if( _kinds.at(i) instanceof Kind.Func func && !FunNode.isInstance(func._name) )
+                return i;
+        throw Utils.TODO("Should not reach here");
+    }
+
+    // Find nearest enclosing function or declaration scope
+    public int enclosingFuncOrDecl() {
+        for( int i=depth()-1; i>=0; i-- )
+            if( _kinds.at(i) instanceof Kind.Func func )
+                return i;
+        throw Utils.TODO("Should not reach here");
+    }
+
+    // Which lexical scope contains this Var?
+    public int kindx( Var v ) {
+        for( int i=depth()-1; i>=0; i-- )
+            if( v._idx >= _kinds.at(i)._lexSize )
+                return i;
+        return -1;
+    }
+
+    // Which lexical scope contains this Var?
+
+
+    public int kindFcnx( Var v ) {
+        for( int i=depth()-1; i>=0; i-- )
+            if( v._idx >= _kinds.at(i)._lexSize && _kinds.at(i) instanceof Kind.Func )
+                return i;
+        throw Utils.TODO("Should not reach here");
+    }
+
+    // Which function scope contains this Var?
+    public Kind kindFcn( Var v ) {
+        int kx = kindFcnx(v);
+        return kx == -1 ? null : _kinds.at(kx);
+    }
+
+    // Final fields are writable local values inside their own initializer or
+    // constructor. Final parameters, local variables, and captured bindings
+    // remain final. Use the same rule when deciding which loop Phis to build.
+    public boolean canInit(Var v) {
+        int fx=enclosingFuncOrDecl();
+        Kind.Func fun=(Kind.Func)_kinds.at(fx);
+        if( !fun._constructor || v._extern!=0 ) return false;
+        int dx=FunNode.isInstance(fun._name) ? fx : fx-1;
+        return dx>=0 && kindx(v)==dx && v._idx>=_kinds.at(dx)._lexSize+2;
+    }
+
+    private boolean loopVar(Var v) {
+        return !v._final || (canInit(v) && !v.type().isHighOrConst());
+    }
+
+    // Find name in reverse, return an index into _vars or -1.  Linear scan
+    // instead of hashtable, but probably doesn't matter until the scan
+    // typically hits many dozens of variables.
+    public int find( String name ) {
+        for( int i=_vars.size()-1; i>=0; i-- )
+            if( var(i)._name.equals(name) )
+                return i;
+        return -1;
+    }
+
+    /**
+     * Create a new variable name in the current scope
+     */
+    public boolean define( String name, Type declaredType, boolean xfinal, Node init, Lexer loc ) {
+        assert _kinds.isEmpty() || name!=MEM0 ; // Later scopes do not define memory
+        if( depth() > 0 )
+            for( int i=_vars.size()-1; i>=klast()._lexSize; i-- ) {
+                Var n = var(i);
+                if( n._name.equals(name) ) {
+                    if( !n.isFRef() ) return false;       // Double define
+                    FRefNode fref = (FRefNode)in(n._idx); // Get forward ref
+                    if( !xfinal || !declaredType.isConstant() ) throw fref.err();  // Must be a final constant
+                    n.defFRef(declaredType,xfinal,loc);   // Declare full correct type, final, source location
+                    setDef(n._idx,fref.addDef(init));     // Set FRef to defined; tell parser also
+                    return true;
+                }
+            }
+        Var v = new Var(nIns(),name,declaredType,xfinal,loc,init==CodeGen.CODE.XCTRL);
+        _vars.add(v);
+        // Creating a forward reference
+        if( init==CodeGen.CODE.XCTRL )
+            //init = new FRefNode(v).init();
+            throw Utils.TODO();
+        addDef(init);
+        return true;
+    }
+
+    // Normal lookup was tried and failed.  Append a forward ref in the current
+    // lexical scope.  Scope pops promote it outwards "as if" the final constant
+    // had been declared before the using scope.
+
+    public Var defineFRef( String id, Type t, boolean xfinal, Lexer loc ) {
+        Var var = new Var(nIns(),id,t,xfinal,loc,true);
+        FRefNode fref = new FRefNode(id,loc).init();
+        fref._type = fref._con = t;
+        _vars.add(var);
+        addDef(fref);
+        return var;
+    }
+
+
+    // Parser state carries one complete, conservative memory value.  Precise
+    // alias partitions belong to the graph and are introduced by peepholes.
+    public Node mem( int alias ) {
+        assert alias == 1;
+        return in(update(var(1),null));
+    }
+    public void mem( int alias, Node st ) {
+        assert alias == 1;
+        update(var(1),st);
+    }
+
+
+    /**
+     * Lookup a name in all scopes starting from most deeply nested.
+     *
+     * @param name Name to be looked up
+     * @return null if not found, or the implementing Node
+     */
+    public Var lookup( String name ) {
+        int idx = find(name);
+        // -1 is missed in all scopes, not found
+        return idx == -1 ? null : update(var(idx),null);
+    }
+
+    /**
+     * Redefine an existing name
+     *
+     * @param name Name being redefined
+     * @param n    The node to bind to the name
+     */
+    public void update( String name, Node n ) {
+        int idx = find(name);
+        assert idx>=0;
+        update(var(idx),n);
+    }
+
+    public Var update( Var v, Node st ) {
+        Node old = in(v._idx);
+        if( old instanceof ScopeNode loop ) {
+            // Lazy Phi!
+            Node def = loop.in(v._idx);
+            old = def instanceof PhiNode phi && loop.ctrl()==phi.region()
+                // Loop already has a real Phi, use it
+                ? def
+                // Set real Phi in the loop head
+                // The phi takes its one input (no backedge yet) from a recursive
+                // lookup, which might have insert a Phi in every loop nest.
+                : loop.setDef(v._idx,PhiNode.make(v._name, v.type(), loop.ctrl(), loop.in(loop.update(v,null)._idx),null).init());
+            setDef(v._idx,old);
+        }
+        //assert !v._final || st==null;
+        if( st!=null ) setDef(v._idx,st); // Set new value
+        return v;
+    }
+
+    /**
+     * Duplicate a ScopeNode; including all levels, up to Nodes.  So this is
+     * neither shallow (would dup the Scope but not the internal HashMap
+     * tables), nor deep (would dup the Scope, the HashMap tables, but then
+     * also the program Nodes).
+     * <p>
+     * If the {@code loop} flag is set, the edges are filled in as the original
+     * Scope, as an indication of Lazy Phis at loop heads.  The goal here is to
+     * not make Phis at loop heads for variables which are never touched in the
+     * loop body.
+     * <p>
+     * The new Scope is a full-fledged Node with proper use<->def edges.
+     */
+    public ScopeNode dup() { return dup(false); }
+    public ScopeNode dup(boolean loop) {
+        ScopeNode dup = new ScopeNode();
+        // Our goals are:
+        // 1) duplicate the name bindings of the ScopeNode across all stack levels
+        // 2) Make the new ScopeNode a user of all the nodes bound
+        // 3) Ensure that the order of defs is the same to allow easy merging
+        dup._vars   .addAll(_vars   );
+        dup._kinds  .addAll(_kinds  );
+        dup._guards .addAll(_guards );
+        // The dup'd guards all need dup'd keepers, to keep proper accounting
+        // when later removing all guards
+        for( Node n : _guards )
+            if( !(n instanceof CFGNode) )
+                n.keep();
+        dup.addDef(ctrl());     // Control input is just copied
+
+        // Memory is one ordinary parser-state value.  At loop heads the
+        // Scope sentinel triggers the same lazy-Phi machinery as variables.
+        dup.addDef(loop ? this : mem());
+
+        // Copy of other inputs
+        for( int i=2; i<nIns(); i++ )
+            // For lazy phis on loops we use a sentinel
+            // that will trigger phi creation on update
+            dup.addDef(loop && loopVar(var(i)) ? this : in(i));
+        return dup;
+    }
+
+    /**
+     * Merges the names whose node bindings differ, by creating Phi node for such names
+     * The names could occur at all stack levels, but a given name can only differ in the
+     * innermost stack level where the name is bound.
+     *
+     * @param that The ScopeNode to be merged into this
+     * @return A new node representing the merge point
+     */
+    public RegionNode mergeScopes(ScopeNode that, Lexer loc) {
+        RegionNode r = ctrl(new RegionNode(loc,null,ctrl(), that.ctrl()).keep());
+        this._merge(that,r);
+        that.kill();            // Kill merged scope
+        CodeGen.CODE.add(r);
+        return r.unkeep();
+    }
+
+    public void _merge(ScopeNode that, RegionNode r) {
+        _merge(that,r,nIns());
+    }
+    public void _merge(ScopeNode that, RegionNode r, int max ) {
+        for( int i = 1; i < max; i++)
+            if( in(i) != that.in(i) ) { // No need for redundant Phis
+                // If we are in lazy phi mode we need to a lookup
+                // by name as it will trigger a phi creation
+                Var v = var(i);
+                Node lhs = this.in(this.update(v,null));
+                Node rhs = that.in(that.update(v,null));
+                setDef(i, PhiNode.make(v._name, v.type(), r, lhs, rhs).peephole());
+            }
+    }
+
+    // Balance arms of an IF.  Extra lonely defs are thrown: "if(pred) int x;".
+    // Forward refs are copied to the other side, "as if" they were there all along.
+    // 'this' scope is the default, 'scope' might have frefs.
+    public void balanceIf( ScopeNode scope ) {
+        if( nIns()==scope.nIns() )
+            return;             // Fast-path cutout
+        int kidx = enclosingFunction();
+        assert _kinds.at(kidx) == scope._kinds.at(kidx);
+        if( kidx==0 ) kidx = 1;
+        for( int i = _kinds.at(kidx-1)._lexSize; i < scope.nIns(); i++ ) {
+            Var n = scope.var(i);
+            if( i<nIns() && var(i)==n ) continue;
+            if( n.isFRef() ) {  // RHS has forward refs
+                _vars.insert(n,i);
+                insertDef(i,scope.in(i));
+            } else
+                throw Parser.error("Cannot define a '"+n._name+"' on one arm of an if",n._loc);
+        }
+    }
+
+    public void balanceLoopFRefs( ScopeNode scope ) {
+        for( int i = nIns(); i < scope.nIns(); i++ ) {
+            Var n = scope.var(i);
+            if( n.isFRef() ) {  // Loop body has forward refs
+                Var v = new Var(nIns(),n._name,n.type(),n._final,n._loc,true);
+                v._uninit = n._uninit;
+                _vars.add(v);
+                addDef(scope.in(i));
+            }
+        }
+    }
+
+
+    // ------------------------------------------------
+    // peephole the backedge scope into this loop head scope
+    // We set the second input to the phi from the back edge (i.e. loop body)
+    public void endLoop(ScopeNode back, ScopeNode exit ) {
+        Node ctrl = ctrl();
+        assert ctrl instanceof LoopNode loop && loop.inProgress();
+        ctrl.setDef(2,back.ctrl());
+
+        this._endLoop( this, back, exit);
+        back.kill();            // Loop backedge is dead
+        // Now one-time do a useless-phi removal
+        this._useless();
+    }
+
+    // Fill in the backedge of any inserted Phis
+    void _endLoop( ScopeNode scope, Node back, Node exit ) {
+        for( int i=1; i<nIns(); i++ ) {
+            if( !loopVar(var(i)) ) continue;
+            Node n = in(i);
+            if( var(i).type().isHighOrConst() && !(n instanceof PhiNode phi && phi.inProgress()) ) { // Cannot lift higher than a constant, so no Phi
+                Node con = ConstantNode.make(var(i).type()).init();
+                n.subsume(con);
+                n = con;
+            } else if( back.in(i) != scope ) {
+                PhiNode phi = (PhiNode)n;
+                assert phi.region()==scope.ctrl() && phi.in(2)==null;
+                phi.setDef(2,back.in(i)); // Fill backedge
+            }
+            if( exit.in(i) == scope ) // Replace a lazy-phi on the exit path also
+                exit.setDef(i,n);
+        }
+    }
+
+    // ------------------------------------------------
+    // Up-casting: using the results of an If to improve a value.
+    // E.g. "if( ptr ) ptr.field;" is legal because ptr is known not-null.
+    //
+    // This operation is lexical, not a full semantic theorem prover, and thus
+    // its behavior changes the language spec.  Optimizations that hide the
+    // lexical structure (e.g. constant folding control flow) can hide what is
+    // guarded or how the guard is applied, making it somewhat fragile.  Several
+    // good use cases are covered here, but not everything you might like.
+    //
+    // Simple lexical facts work well:
+    //
+    //  ```
+    //    if( ptr )
+    //        return ptr.field; // `ptr` is guarded non-null here.
+    //
+    //    if( a && a.ptr )
+    //        return a.ptr.x;   // `a` is guarded while parsing the RHS load,
+    //                          // and remains guarded on the true arm.
+    //  ```
+    //
+    // Short-circuit expressions are lowered as nested Phis.  We recursively
+    // decompose the recognized Phi shape, so chains such as:
+    //
+    //  ```
+    //    if( x && y && z )
+    //        use(x,y,z);
+    //  ```
+    //
+    // discover the nested `x && y` and then `x`, `y`, and `z`; this is not
+    // merely a one-level lookup.  Likewise, nested tests carry lexical guards
+    // inwards:
+    //
+    //  ```
+    //    if( x && y )
+    //        if( z && a )
+    //            if( x.ptr && z.ptr )
+    //                ...
+    //  ```
+    //
+    // Here `x` is already guarded while parsing the outer true arm, `z` while
+    // parsing the inner true arm, and both are available before the matching
+    // loads.  The later post-test decomposition is just a convenience for
+    // values still schedulable at the post-test control.
+    //
+    // The hard limit is that a semantic implication is not always a
+    // schedulable Node.  For `(x && y)`, the true side implies that `y` was
+    // true, but `y` might be a value computed only on the RHS control arm:
+    //
+    //  ```
+    //    val ptr = ...;
+    //    if( ptr && (ptr=fcn() ? 0 : arg ) {}
+    //  ```
+    //
+    // A Guard pinned after the Phi merge and using the branch-local `ptr`
+    // value would give that value a use above its defining arm.  GCM then has
+    // no legal block between the value's early control and the LCA of its
+    // uses.  Thus `_addGuards` first checks that the predicate's effective
+    // early CFG dominates the control where the Guard would be pinned.  If it
+    // does not, we skip that guard even if the fact is semantically true.
+    //
+    // A more complete answer would need a richer logical/proof node, or would
+    // need to rematerialize predicates on the guarded path instead of using
+    // branch-local nodes directly.  Plain GuardNodes are intentionally kept to
+    // facts represented by values already available at the guard control.
+    //
+    // TODO: Make this more robust for shapes like:
+    //  ```
+    //    if( !ary || !ary# ) exit(); // facts about ary are lost, despite the early exit
+    //    for( ...; ary# ) ...;
+    //  ```
+    // Here the guard ends up guarding the whole expression (both ary and ary#
+    // are not-null), but loses that ary is not-null.  A better answer might be
+    // a dedicated logical expression node, or some sort of gather-of-checked
+    // values to Guard post-test.
+
+    public void addGuards( CFGNode ctrl, Node pred, boolean invert ) {
+        _guards.add(ctrl);      // Marker between guard sets
+        // add pred & its cast to the normal input list, with special Vars
+        if( pred==null || pred.isDead() )
+            return;           // Dead, do not add any guards
+        _addGuards(ctrl,pred,invert);
+    }
+
+    private void _addGuards( CFGNode ctrl, Node pred, boolean invert ) {
+        if( pred==null || pred.isDead() )
+            return;
+        CFGNode early = CFGNode.earlyCFG(pred);
+        if( early != null && !early.dominates(ctrl,null) )
+            return;
+        // A single negation is handled below. For !!p (including p != null)
+        // or a negated short-circuit Phi, also discover the underlying facts.
+        if( pred instanceof NotNode not &&
+            (not.in(1) instanceof NotNode || not.in(1) instanceof PhiNode) ) {
+            pred.keep();        // Recursive peepholes may rediscover this Not.
+            _addGuards(ctrl,not.in(1),!invert);
+            pred.unkeep();
+        }
+        // Short-circuit logic is represented by a Phi.  For `a || b` being
+        // false, or `a && b` being true, both individual operands have the
+        // same proven value as the whole expression.  The "skipped RHS" path
+        // is the Region input whose Phi value is the controlling If predicate.
+        if( pred instanceof PhiNode phi && phi.nIns()==3 && phi.region() instanceof RegionNode r && r.nIns()==3 )
+            for( int i=1; i<3; i++ )
+                if( r.in(i) instanceof CProjNode prj && prj.ctrl() instanceof IfNode iff ) {
+                    Node skip = shortCircuitSkippedPred(phi.in(i),iff.pred(),prj,invert);
+                    if( skip != null ) {
+                        _addGuards(ctrl,skip,invert);
+                        _addGuards(ctrl,phi.in(3-i),invert);
+                        break;
+                    }
+                }
+        // Invert the If conditional
+        if( invert )
+            pred = pred instanceof NotNode not ? not.in(1) : CodeGen.CODE.add(new NotNode(pred).peephole());
+        Node zeroPred = pred instanceof NotNode not ? not.in(1) : null;
+        // This is a zero/null test.
+        // Compute the positive test type.
+        _addGuard(true,ctrl,pred);
+
+        // Compute the negative test type.
+        if( zeroPred != null )
+            _addGuard(false,ctrl,zeroPred);
+    }
+
+    private static Node shortCircuitSkippedPred( Node val, Node pred, CProjNode prj, boolean invert ) {
+        if( val == null )
+            return null;
+        if( val == pred )
+            return (prj._idx==0)==invert ? val : null;
+        if( val instanceof NotNode not && not.in(1)==pred )
+            return (prj._idx==1)==invert ? val : null;
+        if( val._type == TypeInteger.TRUE && invert )
+            return prj._idx==0 ? pred : CodeGen.CODE.add(new NotNode(pred).peephole());
+        if( val._type == TypeInteger.FALSE && !invert )
+            return prj._idx==1 ? pred : CodeGen.CODE.add(new NotNode(pred).peephole());
+        return null;
+    }
+
+    private void _addGuard(boolean nonZero, Node ctrl, Node pred) {
+        Node guard = new GuardNode(nonZero,ctrl,pred).peephole();
+        if( guard != pred ) {
+            pred.keep();
+            guard.keep();
+            _guards.add(pred);
+            _guards.add(guard);
+            replace(pred,guard,nonZero);
+        }
+    }
+
+
+    // Remove matching pred/cast pairs from this guarded region.
+    public void removeGuards( Node ctrl ) {
+        assert ctrl instanceof CFGNode;
+        // Pop the guards up to this region's marker.
+        while( true ) {
+            Node g = _guards.pop();
+            if( g == ctrl ) break;
+            if( g instanceof CFGNode ) continue;
+            g            .unkill(); // Pop/kill cast
+            _guards.pop().unkill(); // Pop/kill pred
+        }
+    }
+
+    // If we find a guarded instance of pred, replace with the upcasted version
+    public Node upcastGuard( Node pred ) {
+        // If finding an instanceof pred, replace with cast.
+        // Otherwise, just pred itself.
+        int i = _guards._len;
+        while( i > 0 ) {
+            Node  cast = _guards.at(--i);
+            if( cast instanceof CFGNode ) continue; // Marker between guard sets
+            Node xpred = _guards.at(--i);
+            if( xpred == pred )
+                return cast;
+        }
+        return pred;
+    }
+
+    // Kill guards also
+    @Override public void kill() {
+        for( Node n : _guards )
+            if( !(n instanceof CFGNode) )
+                n.unkill();
+        _guards.clear();
+        // Can have lazy uses remaining
+        if( isUnused() )
+            super.kill();
+    }
+
+
+    private void replace( Node old, Node cast, boolean nonZero ) {
+        assert old!=null && old!=cast;
+        for( int i=0; i<nIns(); i++ )
+            if( in(i)==old || nonZero && nullCheckedPhi(in(i),old) )
+                setDef(i,cast);
+    }
+
+    private static boolean nullCheckedPhi( Node n, Node old ) {
+        if( !(n instanceof PhiNode phi) || phi.nIns()!=3 )
+            return false;
+        if( phi.in(1)==null || phi.in(2)==null )
+            return false;
+        int zero = phi.in(1)._type == phi.in(1)._type.makeZero() ? 1 :
+                   phi.in(2)._type == phi.in(2)._type.makeZero() ? 2 : -1;
+        if( zero == -1 )
+            return false;
+        Node val = phi.in(3-zero);
+        return val==old ||
+            val instanceof GuardNode guard && guard._nonZero && guard.in(1)==old;
+    }
+
+    // ------------------------------------------------------------------------
+    // Insert a top-level public external symbol, "as-if" some #include/import
+    // was executed at the top of tile.
+    public Var insertExtern( ExternNode ext ) {
+        // Size of top-level scope
+        int lexSize = _kinds.at(0)._lexSize;
+        Var var = new Var(lexSize,ext._extern,ext._con,true,null);
+        insert(var,ext,0);
+        return var;
+    }
+
+    // ------------------------------------------------------------------------
+    // Insert a Var with Node n in the lex scope just prior to kidx
+    private void insert( Var var, Node n, int kidx ) {
+        // Insert just prior to scope kidx
+        int nidx = _kinds.at(kidx)._lexSize;
+        _vars.insert(var,nidx);
+        insertDef(nidx,n);
+        // All outer Kinds lexical offsets bump by one
+        for( int i = kidx; i < depth(); i++ )
+            _kinds.at(i)._lexSize++;
+        // All Vars outside the innermost lexical scope bump out one
+        for( int i=nidx+1; i<_vars._len; i++ )
+            var(i)._idx++;
+    }
+
+    // Save the existing Node state to an array
+    public Node[] save() {
+        Node[] olds = new Node[nIns()];
+        for( int i=0; i<nIns(); i++ )
+            olds[i] = in(i)==null ? null : in(i).keep();
+        return olds;
+    }
+
+    // Restore saved Node state back into scope
+    public void restore( Node[] olds ) {
+        assert olds.length<=nIns();
+        for( int i=0; i<olds.length; i++ )
+            setDef(i,olds[i]==null ? null : olds[i].unkeep());
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ShlNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ShlNode.java
new file mode 100644
index 00000000..fffc71f0
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ShlNode.java
@@ -0,0 +1,50 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeInteger;
+
+public class ShlNode extends ArithNode {
+    public ShlNode(Lexer loc, Node lhs, Node rhs) { super(loc, lhs, rhs, (byte)1); }
+    @Override public Tag serialTag() { return Tag.Shl; }
+
+    @Override public String op() { return "<<"; }
+    @Override long doOp( long x, long y ) { return x << y; }
+    @Override TypeInteger doOp( TypeInteger x, TypeInteger y ) {
+        if( x == TypeInteger.ZERO )
+            return TypeInteger.ZERO;
+        if( y.isConstant() ) {
+            int shf = (int)y.value();
+            // If no overflow, shift endpoints
+            if( !(((x._min<<shf)>>shf) != x._min ||
+                  ((x._max<<shf)>>shf) != x._max ) )
+                    return TypeInteger.make(x._min<<shf,x._max<<shf);
+        }
+        return TypeInteger.BOT;
+    }
+
+    @Override
+    public Node idealize() {
+        Node lhs = in(1);
+        Node rhs = in(2);
+
+        if( rhs._type instanceof TypeInteger shl && shl.isConstant() ) {
+            // Shl of 0.
+            if( (shl.value()&63)==0 && forceInt(lhs) && lhs._type instanceof TypeInteger )
+                return lhs;
+            // (x + c) << i  =>  (x << i) + (c << i)
+            if( lhs instanceof AddNode add && addDep(add).in(2)._type instanceof TypeInteger c && c.isConstant() ) {
+                long sum = c.value() << shl.value();
+                if( Integer.MIN_VALUE <= sum  && sum <= Integer.MAX_VALUE )
+                    return new AddNode(new ShlNode(_loc,add.in(1),rhs).peephole(), CodeGen.CODE.con(sum) );
+            }
+        }
+
+        // TODO: x << 3 << (y ? 1 : 2) ==> x << (y ? 4 : 5)
+
+        return super.idealize();
+    }
+    @Override Node copy(Node lhs, Node rhs) { return new ShlNode(_loc,lhs,rhs); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ShrNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ShrNode.java
new file mode 100644
index 00000000..1bf86f90
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ShrNode.java
@@ -0,0 +1,33 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeInteger;
+
+public class ShrNode extends ArithNode {
+    public ShrNode(Lexer loc, Node lhs, Node rhs) { super(loc, lhs, rhs, (byte)1); }
+    @Override public Tag serialTag() { return Tag.Shr; }
+
+    @Override public String op() { return ">>>"; }
+    @Override long doOp( long x, long y ) { return x >>> y; }
+    @Override TypeInteger doOp( TypeInteger x, TypeInteger y ) {
+        return x == TypeInteger.ZERO ? x : TypeInteger.BOT;
+    }
+
+    @Override
+    public Node idealize() {
+        Node lhs = in(1);
+        Node rhs = in(2);
+        Type t2 = rhs._type;
+
+        // Shr of 0.
+        if( t2.isConstant() && t2 instanceof TypeInteger i && (i.value()&63)==0 && forceInt(lhs) && lhs._type instanceof TypeInteger )
+            return lhs;
+
+        // TODO: x >>> 3 >>> (y ? 1 : 2) ==> x >>> (y ? 4 : 5)
+
+        return super.idealize();
+    }
+    @Override Node copy(Node lhs, Node rhs) { return new ShrNode(_loc,lhs,rhs); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/SplitNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/SplitNode.java
new file mode 100644
index 00000000..3042f857
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/SplitNode.java
@@ -0,0 +1,32 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.LRG;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.util.SB;
+
+public abstract class SplitNode extends MachConcreteNode {
+    public final LRG _lrg;      // Live range for split
+    public final String _kind;  // Kind of split
+    public final byte _round;   // Debugging info for which RegAlloc round
+    public SplitNode(LRG lrg,String kind, byte round, Node[] nodes) { super(nodes); _lrg=lrg; _kind = kind; _round = round; }
+    // A register-only transfer may need another split to reach stack storage.
+    public boolean isNonStackSplit() { return false; }
+    @Override public String op() { return "mov"; }
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        p.p("mov(");
+        if( in(1) == null ) p.p("---");
+        else p.n(in(1));
+        return p.close();
+    }
+    public FunNode fun(Encoding enc) { return enc._code._regAlloc.lrg(this)._fun; }
+    @Override public Type compute() { return in(0)._type; }
+    @Override public Node idealize() { return null; }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1)));
+    }
+    @Override public String comment() { return _kind + " #"+ _round; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/StartCUNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/StartCUNode.java
new file mode 100644
index 00000000..cd51f603
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/StartCUNode.java
@@ -0,0 +1,33 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.Serialize;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.util.BAOS;
+
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+// Start of a single compilation unit, distinct from the outer whole-program Start.
+public class StartCUNode extends StartNode {
+    public final String _fname;
+    public StartCUNode(StartNode start, StopCUNode stop, Type arg, String fname) { super(start,stop,arg);  _fname = fname;  }
+    public StartCUNode(StartCUNode start) { super(start); _fname = start._fname; }
+    @Override public Tag serialTag() { return Tag.StartCU; }
+    @Override public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node,Integer> anodes ) {
+        baos.packed2(types.get(_arg));
+        baos.packed2(strs.get(_fname));
+    }
+    static Node make( BAOS bais, String[] strs, Type[] types )  {
+        return new StartCUNode(null,null,types[bais.packed2()],strs[bais.packed2()]);
+    }
+
+    @Override public CFGNode cfg0() { return (CFGNode)in(0); }
+
+    // IDom is cfg0() and depth is always Start+1 which is 0+1 or 1
+    @Override public int idepth() { return 1; }
+    @Override public CFGNode idom(Node dep) { return cfg0(); }
+    @Override public void gather( HashMap<String,Integer> strs ) {
+        Serialize.gather(strs,_fname);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/StartNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/StartNode.java
new file mode 100644
index 00000000..78bd8219
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/StartNode.java
@@ -0,0 +1,81 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.Utils;
+import java.util.Arrays;
+import java.util.HashSet;
+
+/**
+ * The Start node represents the external world calling, be it calling the
+ * entry <clinit> or just some linked caller calling.
+ * <p>
+ * Start initially has 1 input (arg) from outside and the initial control.
+ * In ch10 we also add mem aliases as structs get defined; each field in struct
+ * adds a distinct alias to Start's tuple.
+ * <p>
+ * By ch25, Start is the external world (or linker) calling with everything
+ * that has escaped.  Start is NOT the entry <clinit> itself, which can assume
+ * no memory nor fidxs exist nor escaped.  Start gets escaped things from Stop;
+ * together these close the Grand Cycle between the code we know and the code
+ * we don't.
+ */
+public class StartNode extends LoopNode implements MultiNode {
+
+    final Type _arg;
+
+    public StartNode(StartNode start, StopNode stop, Type arg) { super(null,start,stop); _arg = arg;  }
+    public StartNode(StartNode start) { super(start); _arg = start==null ? null : start._arg; }
+    @Override public Tag serialTag() { return Tag.Start; }
+    public Type arg() { return _arg; }
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        return p.p(label());
+    }
+
+    @Override public CFGNode cfg0() { return null; }
+
+    // Get the one control following; error to call with more than one e.g. an
+    // IfNode or other multi-way branch.  For Start, it's the class init for
+    // this compilation unit.
+    @Override public CFGNode uctrl() {
+        // Find module.<clinit>, it's the start.
+        CFGNode C = null;
+        for( Node use : _outputs )
+            if( use instanceof FunNode fun && CodeGen.CODE.entryClinitName().equals(fun._name) )
+                { assert C==null; C = fun; }
+        if( C==null )
+            for( FunNode fun : CodeGen.CODE._linker )
+                if( fun!=null && !fun.isDead() && CodeGen.CODE.entryClinitName().equals(fun._name) )
+                    { assert C==null; C = fun; }
+        return C;
+    }
+
+    boolean escapedFIDX(int fidx) {
+        if( !(_type instanceof TypeTuple tt) )
+            return !_type.isHigh(); // TOP never escapes, BOTTOM always escapes
+        TypeMem tmem = (TypeMem)tt._types[1];
+        if( tmem == TypeMem.TOP ) return false;
+        return XInt.bit(tmem._escFs,fidx);
+    }
+
+    @Override public TypeTuple compute() {
+        StopNode stop = (StopNode)in(1);
+        TypeMem tmem = stop._type instanceof TypeTuple tt
+            ? tt.mem()
+            : stop._type.isHigh() ? TypeMem.START : TypeMem.BOT;
+        assert tmem._alias==1 && !tmem._one;
+        return TypeTuple.make(Type.CONTROL,tmem,_arg);
+    }
+
+    @Override public Node idealize() { return null; }
+
+    // No immediate dominator, and idepth==0
+    @Override public int idepth() { return 0; }
+    @Override public CFGNode idom(Node dep) { return null; }
+
+    @Override public boolean eq( Node n ) { return true; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/StopCUNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/StopCUNode.java
new file mode 100644
index 00000000..a6116e93
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/StopCUNode.java
@@ -0,0 +1,134 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.BAOS;
+
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+// Stop of a single compilation unit, distinct from the outer whole-program Stop.
+public class StopCUNode extends StopNode {
+    public StopCUNode() { super(); }
+    public StopCUNode(StopNode stop) { super(stop); }
+    @Override public Tag serialTag() { return Tag.StopCU; }
+    @Override public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) { baos.packed1(nIns()); }
+    static Node make( BAOS bais ) {
+        StopCUNode stop = new StopCUNode();
+        stop.setDefX(bais.packed1()-1,null);
+        return stop;
+    }
+
+    public StartCUNode start() {
+        for( Node use : _outputs )
+            if( use instanceof StartCUNode start )
+                return start;
+        return null;
+    }
+
+    @Override
+    public TypeTuple compute() {
+        // During Parsing, new Stops and Returns are being added.  This Stop
+        // cannot know if more are coming, so must assume the worst.
+        if( CodeGen.CODE._phase ==null || CodeGen.CODE._phase == CodeGen.Phase.Parse )
+            return TypeTuple.STATE;
+
+        StartCUNode start = start();
+        // Memory start from all returns
+        TypeMem xmem = priorEscapes(_type instanceof TypeTuple old ? old.mem() : _type);
+
+        for( Node def : _inputs ) {
+            ReturnNode ret = (ReturnNode)def;
+            if( ret._type == Type.TOP ) continue;
+            if( !(ret._type instanceof TypeTuple tret) )
+                return TypeTuple.STATE; // Must be Type.BOTTOM
+
+            FunNode fun = ret.fun();
+            boolean noUserCtor = fun.isInstance() &&
+                !CodeGen.hasUserConstructor(((TypeMemPtr)fun.sig().arg(0))._obj);
+            // Only entry initializers seed escape discovery. Constructors
+            // and methods are discovered through escaping class/instance fields.
+            boolean pub = fun.isRoot();
+            TypeFunPtr sig = fun.sig();
+            // If public init, the function escapes and the related class escapes
+            if( pub ) {
+                xmem = xmem.escapes(sig);
+                // Classes also escape their public clazz pointer, which then
+                // escapes all their public fields.  Private fields do not
+                // escape, and are only available from the local class code.
+                if( fun.isClz() )
+                    xmem = xmem.escapesAliases(sig._sig[0]);
+            }
+
+            // The instance <init> Start edge supplies conservative pre-Opto
+            // inputs, but its private-memory result is consumed only by the
+            // allocation sequence and is never an externally visible return.
+            if( fun.isInstance() && !noUserCtor ) continue;
+
+            // Does this function escape?  If not, then no need to MEET
+            // here as its effects are not visible to the outside world.
+            addDepForwards(start); // Check again if function escapes
+            if( pub || start.escapedFIDX(sig.fidx()) ) {
+                // External callers already hold their object arguments, so
+                // writes through those arguments expose addresses too.
+                for( Node use : fun._outputs )
+                    if( use instanceof ParmNode p && p._idx>=2 )
+                        xmem = publicBottom(xmem.escapes(addDepForwards(p)._type),xmem);
+                if( tret.ctl().isHigh() ) continue; // Return not reachable
+                // Capture (precisely?) all escaping pointer aliases and fidxs.
+                // Escaped fidxs means the linked world can call that function;
+                // escaped aliases means the linked world can R/W those aliases.
+                xmem = publicBottom(xmem.escapes(tret.ret()),xmem);
+                xmem = (TypeMem)xmem.meet(publicBottom(tret.mem(),xmem));
+            }
+        }
+        // All units share escapes from calls and unloaded bodies, including
+        // paths with no Return. Revisit only when that shared result changes.
+        GlobalEscapeNode global = CodeGen.CODE._globalEscapes;
+        if( global!=null && !global.isDead() )
+            xmem = publicBottom(xmem.escapes(addDepForwards(global)._type),xmem);
+        assert xmem._alias==1 && !xmem._one;
+        return TypeTuple.make(Type.CONTROL,xmem,Type.BOTTOM);
+    }
+
+    // FULL escape sets arise from global BOTTOM.  Across a compilation-unit
+    // boundary global BOTTOM exposes every public field, while retaining any
+    // private escapes already discovered precisely.
+    static TypeMem publicBottom(TypeMem mem, TypeMem prior) {
+        // The pessimistic Iter pass naturally lifts transient FULL inputs to
+        // precise finite sets.  Replacing FULL early there would let a later
+        // input refinement add bits, reversing Iter's monotonic direction.
+        // This normalization is needed only for Opto's optimistic grand cycle.
+        if( CodeGen.CODE._phase.ordinal() < CodeGen.Phase.Opto.ordinal() ||
+            CodeGen.CODE._phase.ordinal() > CodeGen.Phase.Lower.ordinal() ) return mem;
+        int[] escFs = XInt.isHigh(mem._escFs)
+            ? XInt.meet(prior._escFs,CodeGen.CODE.publicFIDXs())
+            : mem._escFs;
+        int[] escAs = XInt.isHigh(mem._escAs)
+            ? XInt.meet(prior._escAs,CodeGen.CODE.publicAliases())
+            : mem._escAs;
+        return escFs==mem._escFs && escAs==mem._escAs ? mem : mem.makeFrom(escFs,escAs);
+    }
+
+    // In Opto, a precise escape set can widen to FULL. Public-only
+    // normalization must retain private bits discovered on an earlier step.
+    static TypeMem priorEscapes(Type old) {
+        TypeMem mem = TypeMem.START;
+        if( CodeGen.CODE._phase.ordinal() >= CodeGen.Phase.Opto.ordinal() &&
+            CodeGen.CODE._phase.ordinal() <= CodeGen.Phase.Lower.ordinal() &&
+            old instanceof TypeMem prior )
+            mem = mem.makeFrom(XInt.meet(mem._escFs,prior._escFs),
+                               XInt.meet(mem._escAs,prior._escAs));
+        return mem;
+    }
+
+    @Override
+    public Node idealize() {
+        int len = nIns();
+        for( int i=0; i<nIns(); i++ )
+            if( in(i) instanceof ReturnNode ret && addDep(ret.fun()).isDead() )
+                delDef(i--);
+        if( len != nIns() ) return this;
+        return null;
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/StopNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/StopNode.java
new file mode 100644
index 00000000..6d453324
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/StopNode.java
@@ -0,0 +1,103 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.Serialize;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.BAOS;
+
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+// A collection of function ReturnNodes for a compilation unit.
+public class StopNode extends CFGNode {
+
+    public StopNode() {
+        super();
+        // Edges may still be missing, including when loading a StopCU.
+        _type = TypeTuple.STATE;
+    }
+    public StopNode(StopNode stop) { super(stop); }
+    @Override public Tag serialTag() { return Tag.Stop; }
+    @Override public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) { baos.packed1(Serialize.nIns(this,anodes)); }
+    static Node make( BAOS bais ) {
+        StopNode stop = new StopNode();
+        stop.setDefX(bais.packed1()-1,null);
+        return stop;
+    }
+
+    @Override
+    protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        // For the sake of many old tests, and single value prints as "return val"
+        ReturnNode ret1 = null;
+        for( Node n : _inputs ) {
+            if( n instanceof ReturnNode ret ) {
+                if( ret1 != null ) { ret1=null; break; }
+                ret1 = ret;
+            }
+        }
+        if( ret1!=null ) return p.n(ret1);
+
+        p.p("Stop[ ");
+        for( Node n : _inputs )
+            if( n instanceof ReturnNode ret ) {
+                String name = ret.fun()._name;
+                if( name== null || !name.startsWith("sys.") )
+                    p.n(ret).p(" ");
+            }
+        return p.p("]");
+    }
+
+    @Override public boolean blockHead() { return true; }
+
+
+    // If a single Return, return it.
+    // Otherwise, null because ambiguous.
+    public ReturnNode ret() {
+        ReturnNode ret1 = null;
+        for( Node n : _inputs ) {
+            // TODO: remove isPublic
+            if( n instanceof ReturnNode ret && ret.fun().isPublic() ) {
+                if( ret1 != null ) return null; // Ambiguous
+                ret1 = ret;
+            }
+        }
+        return ret1;
+    }
+
+    @Override
+    public TypeTuple compute() {
+        // During Parsing, new Stops and Returns are being added.  This Stop
+        // cannot know if more are coming, so must assume the worst.
+        if( CodeGen.CODE._phase ==null || CodeGen.CODE._phase == CodeGen.Phase.Parse )
+            return TypeTuple.STATE;
+
+        // Just meet-over-inputs.
+        TypeTuple tt = TypeTuple.STOP_HIGH;
+        for( Node def : _inputs )
+            tt = (TypeTuple)tt.meet(def._type);
+        assert tt.mem()._alias==1 && !tt.mem()._one;
+        return tt;
+    }
+
+    @Override public Node idealize() {
+        int len = nIns();
+        for( int i=0; i<nIns(); i++ )
+            if( in(i).nIns()==0 )
+                delDef(i--);
+        if( len != nIns() ) return this;
+        return null;
+    }
+
+    @Override public int idepth() {
+        if( validIDepth() ) return _idepth;
+        int d=0;
+        for( Node ret : _inputs )
+            // All public results are hooked on the Stop, including data
+            // values, so must check CFG
+            if( ret instanceof CFGNode cfg )
+                d = Math.max(d,cfg.idepth()+1);
+        return cacheIDepth(d);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/StoreNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/StoreNode.java
new file mode 100644
index 00000000..96e15a58
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/StoreNode.java
@@ -0,0 +1,341 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.*;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.GlobalBits;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.BAOS;
+import com.seaofnodes.simple.util.Utils;
+import java.util.HashMap;
+import java.util.IdentityHashMap;
+
+/**
+ * Store represents setting a value to a memory based object, in chapter 10
+ * this means a field inside a struct.
+ */
+public class StoreNode extends MemOpNode {
+
+    final boolean _init; // Initializing writes are allowed to write null
+    // Semantic store width in bytes.  Zero is the sole undecided state;
+    // otherwise hardware and ideal Stores are the 1/2/4/8-byte variants.
+    private byte _size;
+
+    /**
+     * @param name  The struct field we are assigning to
+     * @param mem   The memory alias node - this is updated after a Store
+     * @param ptr   The ptr to the struct base where we will store a value
+     * @param off   The offset inside the struct base
+     * @param value Value to be stored
+     */
+    public StoreNode(Lexer loc, String name, int alias, Type decl, Node ctrl, Node mem, Node ptr, Node off, Node value, boolean init) {
+        this(loc,name,alias,decl,ctrl,mem,ptr,off,value,init,(byte)0);
+    }
+    private StoreNode(Lexer loc, String name, int alias, Type decl, Node ctrl, Node mem, Node ptr, Node off, Node value, boolean init, byte size) {
+        super(loc, name, alias, false, decl, ctrl, mem, ptr, off, value);
+        _init = init;
+        _size = size;
+    }
+    StoreNode( BAOS bais, String[] strs, Type[] types, GlobalBits fileAliases, GlobalBits aliases ) {
+        super(bais,strs,types,fileAliases,aliases,false);
+        addDef(null);
+        _init = bais.read() != 0;
+        _size = (byte)bais.read();
+    }
+    @Override public Tag serialTag() { return Tag.Store; }
+    @Override public void packed( BAOS baos, HashMap<String,Integer> strs, HashMap<Type,Integer> types, IdentityHashMap<Node, Integer> anodes ) {
+        super.packed(baos,strs,types, anodes );
+        baos.write(_init ? 1 : 0);
+        baos.write(_size);
+    }
+
+    @Override boolean canDrop(MemOpNode other, Node dep) {
+        return super.canDrop(other,dep) && _init==((StoreNode)other)._init;
+    }
+
+    // Debugger label
+    @Override public String  label() { return "st_"+mlabel(); }
+    @Override public boolean isMem() { return true; }
+
+    public Node nnptr() {
+        if( !(ptr() instanceof GuardNode cast) ) return ptr();
+        assert cast._nonZero;
+        return cast.in(1);
+    }
+    public Node val() { return in(4); }
+    public int storeSize() { assert _size==1 || _size==2 || _size==4 || _size==8; return _size; }
+    public int log_size() { return Integer.numberOfTrailingZeros(storeSize()); };
+
+    @Override
+    protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        return p.p(".").p(_name).p("=").p( val()).p(";");
+    }
+
+    @Override
+    public Type compute() {
+        Type val  = val()._type;
+        Type mem0 = mem()._type;
+        Type ptr0 = ptr()._type;
+        // Validate argument types
+        if( ptr0.isHigh() )
+            return TypeMem.TOP;
+        if( !(mem0 instanceof TypeMem    mem) ||
+            !(ptr0 instanceof TypeMemPtr ptr) )
+            return mem0.isHigh() || ptr0==Type.NIL ? TypeMem.TOP : TypeMem.BOT;
+
+        // Sharpen memory value; required for narrowing stores where the parser
+        // inserts zero/sign masking and somebody reads the TypeMem type.
+        Type decl = declaredType();
+        if( decl != Type.BOTTOM )
+            { assert decl != Type.TOP; val = val.join(decl); }
+        // A singleton class's final constant field lives in the static image.
+        // Its precise memory slice is a constant too; ordinary peepholes can
+        // replace this Store before scheduling or instruction selection.
+        // A constant runtime value alone is not enough: mutable fields (notably
+        // $init) still need their writes, and instance fields need allocation.
+        Field fld = ptr._obj.field(_name);
+        if( _alias!=1 && ptr._one && Parser.startsClzPrefix(ptr._obj._name) &&
+            fld!=null && fld._final && decl.isConstant() )
+            return TypeMem.make(_alias,val,true,true,true,mem._escFs,mem._escAs).escapesFrom(val);
+
+        // Allocation uses a private TypeMem and nothing else does.  This
+        // memory is truly private; a temporary singleton until it escapes -
+        // which is never does in a constructor.
+        if( !_name.equals("[]") && mem._one )
+            // Just track the stored value
+            return TypeMem.make(_alias,val,true,false,_init,null,null).escapesFrom(val);
+
+        // Normal aliasing Store.
+        assert mem._alias==1 || mem._alias==_alias; // Perfect aliasing
+
+        // Single alias store.  If memory is fat, attempt to get a narrow slice.
+        Type tfld = mem._alias==1 && mem._t instanceof TypeStruct ts
+            ? ts._fields[ts.findAlias(_alias)]._t
+            : mem._t;
+
+        // Same alias, meet into other fields.
+        Type t = val.meet(tfld);
+        // Bulk memory's final bit describes its conservative remainder, not
+        // this newly precise slice.  Slice finality comes from the field.
+        boolean xfinal = fld != null && fld._final;
+        return TypeMem.make(_alias,t,mem._one,mem._clz,xfinal,mem._escFs,mem._escAs).escapesFrom(val);
+    }
+
+    @Override
+    public Node idealize() {
+        // Freeze the semantic Store variant as soon as the pointer exposes a
+        // canonical field declaration.  Waiting until after structural memory
+        // peeps can lose the declaration to a flow-sensitive constant field
+        // state.  Imported Stores already carry a serialized non-zero width.
+        if( _size==0 && (_size= storageType()) != 0 ) {
+            unlock();           // Width participates in the cached hash.
+            return init();
+        }
+
+        assert !(mem()._type instanceof TypeMem mem) || _alias == 1 || mem._alias == 1 || _alias == mem._alias;
+
+        // Simple store-after-MemMerge to a known alias can bypass.  Happens when inlining.
+        Node mem = mem();
+        if( _alias != 1 && mem instanceof MemMergeNode merge ) {
+            setDef(1,merge.alias(_alias));
+            return this;
+        }
+
+        Field fld;
+        if( _alias==1 && ptr()._type instanceof TypeMemPtr tmp && (fld=tmp._obj.field(_name)) != null && _size != 0 ) {
+            // Expand Store(bulkMem,alias#1) into MemMerge(bulkMem,#N:Store(bulkMem,alias#N)).
+
+            // Normally I'd like to just drop in this xform and move on, but
+            // users of the bulk Store memory might nontheless depend on the
+            // sharp memory type (e.g. I64) from the store's memory.  Using the
+            // MemMerge means using the bulk memory which e.g. might be BOT.
+            // Check for store users with the same alias, and use the new store
+            // directly, preserving the sharper graph.
+            Node st = new StoreNode(_loc,_name,fld._alias,fld._t,in(0),mem,ptr(),off(),val(),_init,_size).peephole();
+            for( int i=0; i<nOuts(); i++ ) {
+                Node use = out(i);
+                if( useAlias(use)==fld._alias ) {
+                    int idx = use._inputs.find(this);
+                    assert idx != -1;
+                    CodeGen.CODE.add(use).setDef(idx,st);
+                    i--;        // setDef removed use from this Store's outputs
+                }
+            }
+            MemMergeNode mmm = mem instanceof BulkMemPhiNode bulk
+                ? bulk.aggregate(mem,fld._alias,st)
+                : new MemMergeNode(null,mem);
+            if( !(mem instanceof BulkMemPhiNode) )
+                mmm.alias(fld._alias,st);
+            return mmm.init();
+        }
+
+        // Simple store-after-store on same address.  Should pick up the
+        // required init-store being stomped by a first user store.
+        if( mem instanceof StoreNode st &&
+            ptr()==st.ptr() &&  // Must check same object
+            off()==st.off() &&  // And same offset (could be "same alias" but this handles arrays to same index)
+            ptr()._type instanceof TypeMemPtr && // No bother if weird dead pointers
+            // Must have exactly one use of "this" or you get weird
+            // non-serializable memory effects in the worse case.
+            checkOnlyUse(st) ) {
+            assert _name==st._name; // Equiv class aliasing is perfect
+            setDef(1,st.mem());
+            return this;
+        }
+
+        // Private constructor memory describes the value that the next helper
+        // reads. Keep its conversion, even if a machine store could truncate it.
+        // This is the same rule as in the construction and escape chapters.
+        boolean priv = mem()._type instanceof TypeMem tm && tm._one;
+        // Value is automatically truncated by narrow store
+        if( !priv && _size!=0 && val() instanceof AndNode and && and.in(2)._type.isConstant()  ) {
+            int log = log_size();
+            if( log<3 ) {       // And-mask vs narrow store
+                long mask = ((TypeInteger)and.in(2)._type).value();
+                long bits = (1L<<(8<<log))-1;
+                // Mask does not mask any of the stored bits
+                if( (bits&mask)==bits )
+                    // So and-mask is already covered by the store
+                    { setDef(4,and.in(1)); return this; }
+            }
+        }
+
+        // Store will chop high order bits off; math to change those bits can be dropped.
+        if( !priv && _size!=0 && val() instanceof SarNode shr &&
+            shr.in(1) instanceof ShlNode shl &&
+            shr.in(2)._type.isConstant() &&
+            shl.in(2)._type.isConstant() ) {
+            TypeInteger shrC = (TypeInteger) shr.in(2)._type;
+
+            // size of the thing that sign-extends
+            int base_size = (1 << shr.in(1)._type.log_size()) << 3;
+            int not_affected_bits = base_size - (int) shrC.value();
+            int store_size = (1 << log_size()) << 3;
+            // if the store is unrelated to the shift amount, then get rid of the shift
+            if( shl.in(2)._type == shr.in(2)._type && shrC.value() >= store_size && not_affected_bits >= store_size) {
+                setDef(4, shl.in(1));
+                return this;
+            }
+        }
+
+        return null;
+    }
+
+    // Flow-sensitive pointer types can carry a current field value (e.g. the
+    // constant zero in a u32 field).  Storage width comes from the canonical
+    // struct declaration.  If the pointer/definition is not available yet,
+    // leave the Store undecided instead of consulting the value or `_con`.
+    private byte storageType() {
+        if( !(ptr()._type instanceof TypeMemPtr tmp) )
+            return 0;
+        TypeStruct obj = (TypeStruct)Parser.TYPES.get(tmp._obj._name);
+        Field fld = obj.field(_name);
+        if( fld == null || fld._t == null )
+            return 0;
+        if( fld._t == Type.BOTTOM )
+            return 0; // Store into a final field
+        assert fld._t != Type.TOP;
+        // Freshly parsed field stores retain the declaring structure on their
+        // symbolic offset even after the pointer's flow type sharpens.
+        if( fld._t.isConstant() ) {
+            if( !(off() instanceof ConFldOffNode coff) )
+                return 0;
+            fld = coff._ts.field(_name);
+            if( fld == null || fld._t == null )
+                return 0;
+        }
+        // Compute storage size from field type
+        byte size = (byte)(1 << fld._t.log_size());
+        assert size==1 || size==2 || size==4 || size==8;
+        return size;
+    }
+
+    // Alias required by a direct consumer of this Store's memory result.
+    // Keep in sync with BulkMemPhiNode.outputAlias.
+    private int useAlias(Node use) {
+        return switch( use ) {
+        case MemOpNode mem -> mem._alias;
+        case MemPhiNode phi -> phi._alias;
+        case EscapeNode esc -> esc.pub()==this ? esc.fld()._alias : 0;
+        default -> 0;
+        };
+    }
+
+    // Phi(mem, Store(phi,ptr,off,val)) -> Store(mem,ptr,off,Phi(load(mem),val)).
+    // With no observers of the backedge store, only the last value matters.
+    // The entry load preserves the field even when the loop takes zero trips.
+    Node sink(MemPhiNode phi) {
+        phi.addDepForwards(this);
+        if( nOuts()!=1 || _alias==1 || _size==0 || _init ) return null;
+        phi.addDep(ptr());
+        // Start with a fixed field of an allocation dominating the loop.
+        // In particular, do not sink stores through a loop-varying address.
+        if( !(ptr() instanceof ProjNode p) || !(p.in(0) instanceof NewNode obj) ||
+            !(ptr()._type instanceof TypeMemPtr tmp) || tmp._obj.isAry() ||
+            !(off() instanceof ConstantNode) || err()!=null ) return null;
+        LoopNode loop = (LoopNode)phi.region();
+        // Bulk splitting identifies precise slices by Region/alias. Finish it
+        // before replacing this memory point with a Store.
+        for( Node use : loop._outputs )
+            if( use instanceof BulkMemPhiNode ) {
+                phi.addDepForwards(use);
+                return null;
+            }
+        phi.addDep(obj);
+        CFGNode ctrl = loop.entry();
+        while( ctrl!=null && ctrl!=obj.cfg0() ) {
+            phi.addDep(ctrl);
+            ctrl=ctrl.idom(phi);
+        }
+        if( ctrl==null ) return null;
+
+        Node mem = phi.in(1);
+        Node init = new LoadNode(_loc,_name,_alias,null,mem,ptr(),off()).peephole();
+        Node value = CodeGen.CODE.add(new PhiNode(_name,loop,init,val()).peephole());
+        Node sink = new StoreNode(_loc,_name,_alias,_con,null,mem,ptr(),off(),value,_init,_size);
+        // Break the memory cycle, killing the old store. Keep the Phi alive
+        // even if that store was its last use, until our caller replaces it.
+        phi.keep();
+        phi.setDef(2,mem);
+        phi.unkeep();
+        return sink;
+    }
+
+    // Check that "mem" has no uses except "this"
+    private boolean checkOnlyUse(Node mem) {
+        if( mem.nOuts()==1 ) return true;
+        // Add deps on the other uses (can be e.g. ScopeNode mid-parse) so that
+        // when the other uses go away we can retry.
+        for( Node use : mem._outputs )
+            if( use != this )
+                addDep(use);
+        return false;
+    }
+
+    @Override
+    public Parser.ParseException err() {
+        Parser.ParseException err = super.err();
+        if( err != null ) return err;
+        assert _size>0 || CodeGen.CODE._phase.ordinal() <= CodeGen.Phase.FinalizeIR.ordinal();
+        if( ptr()._type == Type.TOP ) // Dead store?
+            return null;
+        TypeMemPtr tmp = (TypeMemPtr)ptr()._type;
+        Field f = tmp._obj.field(_name);
+        if( f!=null && (tmp._ro || f._final) && !_init )
+            return Parser.error("Cannot modify final field '"+_name+"'",_loc);
+        return null;
+    }
+
+    // Do not GVN Stores. Two equal Stores on two of three paths are the easy
+    // failure: sharing them makes GCM place the Store on all three paths.
+    // Sharing is safe only if every exit path goes through an original Store,
+    // or GCM splits the shared Store to keep it on those paths. Stores must
+    // sink, not run on extra paths. GVN does not check this; GCM does not split.
+    // Identity also disables generic Phi factoring of Stores.
+    // The closed-loop Store sink is a separate peep and still applies.
+    @Override public boolean eq(Node n) { return this == n; }
+    @Override int hash() { return super.hash() ^ _size; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/SubNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/SubNode.java
new file mode 100644
index 00000000..c2e285c9
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/SubNode.java
@@ -0,0 +1,56 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeInteger;
+import java.util.BitSet;
+
+public class SubNode extends ArithNode {
+    @Override boolean allowFloat() { return true; }
+    public SubNode(Node lhs, Node rhs) { super(null, lhs, rhs); }
+    public SubNode(Node lhs, Node rhs, byte mode) { super(null, lhs, rhs,mode); }
+    @Override public Tag serialTag() { return Tag.Sub; }
+
+    @Override public String op() { return "-"; }
+
+    @Override long   doOp( long  x,  long  y ) { return x - y; }
+    @Override double doOp(double x, double y ) { return x - y; }
+    @Override TypeInteger doOp(TypeInteger x, TypeInteger y) {
+        // Sub of same is 0
+        if( in(1)==in(2) )
+            return TypeInteger.ZERO;
+        // Fold ranges like {2-3} - {0-1} into {1-3}.
+        if( !AddNode.overflow(x._min,-y._max) &&
+            !AddNode.overflow(x._max,-y._min) &&
+            y._min != Long.MIN_VALUE  )
+            return TypeInteger.make(x._min-y._max,x._max-y._min);
+
+        return TypeInteger.BOT;
+    }
+
+    @Override
+    public Node idealize() {
+        Node lhs = in(1);
+        Node rhs = in(2);
+        Type t1 = lhs._type;
+        Type t2 = rhs._type;
+
+        // Keep invalid operands and unresolved numeric modes for type checking.
+        if( _mode==1 && t1 instanceof TypeInteger x && t2 instanceof TypeInteger y ) {
+            if( y.isConstant() && y.value()==0 ) return lhs;
+            if( x.isConstant() && x.value()==0 ) return new MinusNode(rhs);
+        }
+
+        // x - (-y) is x+y
+        if( rhs instanceof MinusNode minus )
+            return new AddNode(lhs,minus.in(1));
+
+        // (-x) - y is -(x+y)
+        if( lhs instanceof MinusNode minus )
+            return new MinusNode(new AddNode(minus.in(1),rhs).peephole());
+
+        return super.idealize();
+    }
+
+    @Override Node copy(Node lhs, Node rhs) { return new SubNode(lhs,rhs,_mode); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/SummaryNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/SummaryNode.java
new file mode 100644
index 00000000..c22b4bdd
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/SummaryNode.java
@@ -0,0 +1,67 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.codegen.*;
+import java.util.HashMap;
+
+// Analysis of an imported function whose implementation has not been loaded.
+// This is never an inlineable or executable body.
+public class SummaryNode extends CFGNode implements MultiNode {
+
+    public TypeTuple _state;
+    // Callees and touched class initializers, by FIDX, for class-init cycle checks.
+    public final int[] _classDependencyFIDXs;
+
+    public SummaryNode(TypeTuple state, int[] classDependencyFIDXs, Node... inputs) {
+        super(inputs);
+        _state = state;
+        _classDependencyFIDXs = classDependencyFIDXs;
+        CodeGen.CODE.add(CodeGen.CODE._globalEscapes);
+    }
+
+    @Override public String label() { return "Summary"; }
+    @Override public boolean blockHead() { return true; }
+    @Override public Type compute() {
+        if( in(0)._type.isHigh() ) return TypeTuple.STATE.dual();
+        // A library summary does not forget escapes already present in the caller.
+        TypeMem mem = in(1)._type instanceof TypeMem m ? m : in(1)._type.isHigh() ? TypeMem.TOP : TypeMem.BOT;
+        mem = (TypeMem)mem.meet(_state.mem());
+        for( int i = 2; i<nIns(); i++ ) mem=mem.escapes(in(i)._type);
+        return TypeTuple.make(_state.ctl(),mem,_state.ret());
+    }
+    @Override public Node idealize() { return null; }
+    public TypeMem exposed(Node dep) {
+        dep.addDepForwards(this);
+        if( dep.addDepForwards(in(0))._type.isHigh() ) return TypeMem.START;
+        TypeMem mem = (TypeMem)_state.mem();
+        for( int i = 2; i<nIns(); i++ ) mem=mem.escapes(dep.addDepForwards(in(i))._type);
+        return TypeMem.make(1,Type.BOTTOM,false,false,false,mem._escFs,mem._escAs);
+    }
+    @Override boolean _upgradeType(HashMap<String,Type> types) {
+        TypeTuple state = (TypeTuple)_state.upgradeType(types);
+        if( state==_state ) return false;
+        unlock();
+        _state=state;
+        return true;
+    }
+    // Materialize an object and publish real FIDX targets without rewriting
+    // callers or reoptimizing their active graphs. The evaluator schedules
+    // this object's checked ideal IR before entering any of its functions.
+    public static ElfReader load(CodeGen code, FunNode fun) {
+        assert fun.summary()!=null;
+        ElfReader elf = code.getElf(fun._compunit._obj);
+        assert elf._nodes==null; // Not loaded yet, or we would already have code for `fun`
+        elf.loadSimple(code);    // Load all the IR, including code for `fun`
+        StopNode stop = (StopNode)elf._nodes.last();
+        for( Node n : stop._inputs ) {
+            StopCUNode stopcu = (StopCUNode)n;
+            for( Node r : stopcu._inputs ) {
+                FunNode target = ((ReturnNode)r).fun();
+                target._compunit._start = stopcu.start();
+                target._compunit._stop  = stopcu;
+                code.link(target);
+            }
+        }
+        return elf;
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ToFloatNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ToFloatNode.java
new file mode 100644
index 00000000..151a326e
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ToFloatNode.java
@@ -0,0 +1,26 @@
+package com.seaofnodes.simple.node;
+
+
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeFloat;
+import com.seaofnodes.simple.type.TypeInteger;
+
+
+public class ToFloatNode extends Node {
+    public ToFloatNode(Node lhs) { super(null, lhs); }
+    @Override public Tag serialTag() { return Tag.ToFloat; }
+
+    @Override protected String format() { return "(flt)%1"; }
+
+    @Override
+    public Type compute() {
+        if( in(1)._type.isHigh() ) return TypeFloat.F64.dual();
+        if( in(1)._type == Type.NIL ) return TypeFloat.FZERO;
+        if( in(1)._type instanceof TypeInteger i0 && i0.isConstant() )
+            return TypeFloat.constant(i0.value());
+        return TypeFloat.F64;
+    }
+
+    @Override public Node idealize() { return null; }
+    @Override Node copy(Node lhs, Node rhs) { return new ToFloatNode(lhs); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ToIntegerNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ToIntegerNode.java
new file mode 100644
index 00000000..33806300
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ToIntegerNode.java
@@ -0,0 +1,24 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeFloat;
+import com.seaofnodes.simple.type.TypeInteger;
+
+// Truncate toward zero, saturating overflow; NaN converts to zero.
+public class ToIntegerNode extends Node {
+    public ToIntegerNode(Node lhs) { super(null,lhs); }
+    @Override public Tag serialTag() { return Tag.ToInteger; }
+    @Override public String label() { return "ToInteger"; }
+    @Override protected String format() { return "(int)%1"; }
+
+    @Override public Type compute() {
+        Type t = in(1)._type;
+        if( t.isHigh() ) return TypeInteger.TOP;
+        if( t instanceof TypeFloat tf && tf.isConstant() )
+            return TypeInteger.constant((long)tf.value());
+        return TypeInteger.BOT;
+    }
+
+    @Override public Node idealize() { return null; }
+    @Override Node copy(Node lhs, Node rhs) { return new ToIntegerNode(lhs); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/TypeNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/TypeNode.java
new file mode 100644
index 00000000..38b0b288
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/TypeNode.java
@@ -0,0 +1,33 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.BAOS;
+import com.seaofnodes.simple.util.Utils;
+import java.util.BitSet;
+import java.util.HashMap;
+
+// Node carries an extra internal type
+public abstract class TypeNode extends Node {
+    public Type _con;
+    public TypeNode(Type t, Node... nodes) { super(nodes); assert t!=null; _con = t; }
+    public TypeNode(TypeNode tn) { super(tn); _con = tn._con; }
+    // Copy edges from ideal, but 'this' is a Type-Mach-Node (e.g. MemOpX86) and needs a _con
+    public TypeNode(Node ideal, Type con) { super(ideal); _con = con; }
+
+    // Upgrade the internal type
+    @Override boolean _upgradeType( HashMap<String,Type> TYPES) {
+        return liftType(_con.upgradeType(TYPES));
+    }
+
+    // Lift type
+    public boolean liftType( Type t ) {
+        if( t == _con ) return false;
+        unlock();               // Unlock before changing _con
+        _con = t;
+        return true;
+    }
+
+    @Override public boolean eq(Node n) { return _con==((TypeNode)n)._con; }
+    @Override int hash() { return _con.hashCode(); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/XCtrlNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/XCtrlNode.java
new file mode 100644
index 00000000..d727ce2b
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/XCtrlNode.java
@@ -0,0 +1,16 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.type.Type;
+
+public class XCtrlNode extends CFGNode {
+    public XCtrlNode() { super(new Node[]{CodeGen.CODE._start}); }
+    @Override public Tag serialTag() { return Tag.XCtrl; }
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) { return p.p("Xctrl"); }
+    @Override public boolean isConst() { return true; }
+    @Override  public Type compute() { return Type.XCONTROL; }
+    @Override public Node idealize() { return null; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/XorNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/XorNode.java
new file mode 100644
index 00000000..85fb3259
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/XorNode.java
@@ -0,0 +1,44 @@
+package com.seaofnodes.simple.node;
+
+import com.seaofnodes.simple.parser.Lexer;
+import com.seaofnodes.simple.parser.Parser;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeInteger;
+
+public class XorNode extends ArithNode {
+    public XorNode(Lexer loc, Node lhs, Node rhs) { super(loc, lhs, rhs, (byte)1); }
+    @Override public Tag serialTag() { return Tag.Xor; }
+
+    @Override public String op() { return "^"; }
+    @Override long doOp( long x, long y ) { return x ^ y; }
+    @Override TypeInteger doOp( TypeInteger x, TypeInteger y ) {
+        return TypeInteger.BOT;
+    }
+
+    @Override
+    public Node idealize() {
+        Node lhs = in(1);
+        Node rhs = in(2);
+
+        Type t1 = lhs._type;
+        Type t2 = rhs._type;
+
+        // Xor of 0.  We do not check for (0^x) because this will already
+        // canonicalize to (x^0)
+        if( t2.isConstant() && t2 instanceof TypeInteger i && i.value()==0 && forceInt(lhs) && lhs._type instanceof TypeInteger )
+            return lhs;
+
+        // Move constants to RHS: con*arg becomes arg*con
+        if ( t1.isConstant() && !t2.isConstant() )
+            return swap12();
+
+        // Do we have ((x ^ (phi cons)) ^ con) ?
+        // Do we have ((x ^ (phi cons)) ^ (phi cons)) ?
+        // Push constant up through the phi: x ^ (phi con0^con0 con1^con1...)
+        Node phicon = AddNode.phiCon(this,true);
+        if( phicon!=null ) return phicon;
+
+        return super.idealize();
+    }
+    @Override Node copy(Node lhs, Node rhs) { return new XorNode(_loc,lhs,rhs); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AddARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AddARM.java
new file mode 100644
index 00000000..76e47ca2
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AddARM.java
@@ -0,0 +1,21 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class AddARM extends MachConcreteNode implements MachNode {
+    AddARM( Node add) { super(add); }
+    @Override public String op() { return "add"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+
+    // ADD (shifted register)
+    @Override public void encoding( Encoding enc ) { arm.r_reg(enc,this,Arm64.OP_ADD); }
+    // General form: "rd = rs1 + rs2"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" + ").p(code.reg(in(2)));
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AddFARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AddFARM.java
new file mode 100644
index 00000000..67a10b48
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AddFARM.java
@@ -0,0 +1,23 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class AddFARM extends MachConcreteNode implements MachNode {
+    AddFARM(Node addf) { super(addf); }
+    @Override public String op() { return "addf"; }
+    @Override public RegMask regmap(int i) { return arm.DMASK; }
+    @Override public RegMask outregmap() { return arm.DMASK; }
+
+    //FADD (scalar)
+    @Override public void encoding( Encoding enc ) { arm.f_scalar(enc,this,Arm64.OPF_OP_ADD);}
+
+    // Default on double precision for now(64 bits)
+    // General form: "addf  rd = src1 + src2
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" + ").p(code.reg(in(2)));
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AddIARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AddIARM.java
new file mode 100644
index 00000000..4c635d07
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AddIARM.java
@@ -0,0 +1,28 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+
+public class AddIARM extends MachConcreteNode implements MachNode {
+    final int _imm;
+    AddIARM(Node add, int imm) {
+        super(add);
+        _inputs.pop();
+        _imm = imm;
+    }
+    @Override public String op() {
+        return _imm == 1 ? "inc" : (_imm == -1 ? "dec" : "addi");
+    }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+    //ADD (immediate)
+    @Override public void encoding( Encoding enc ) {
+        arm.imm_inst(enc,this, in(1), Arm64.OPI_ADD,_imm);
+    }
+    // General form: "addi  rd = rs1 + imm"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" + #").p(_imm);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AndARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AndARM.java
new file mode 100644
index 00000000..1a0365ad
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AndARM.java
@@ -0,0 +1,22 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.MachConcreteNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.SB;
+
+public class AndARM extends MachConcreteNode implements MachNode {
+    AndARM(Node and) { super(and); }
+    @Override public String op() { return "and"; }
+    @Override public String glabel() { return "&"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+    // AND (shifted register)
+    @Override public void encoding( Encoding enc ) { arm.r_reg(enc,this,Arm64.OP_AND); }
+    // General form:  #rd = rs1 & rs2
+    @Override public void asm(CodeGen code, SB sb){
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" & ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AndIARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AndIARM.java
new file mode 100644
index 00000000..6292e98e
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AndIARM.java
@@ -0,0 +1,25 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class AndIARM extends MachConcreteNode implements MachNode {
+    final int _imm;
+    AndIARM(Node and, int imm) {
+        super(and);
+        _inputs.pop();
+        _imm = imm;
+    }
+    @Override public String op() { return "andi"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+    @Override public void encoding( Encoding enc ) {
+        arm.imm_inst_n(enc,this, in(1), Arm64.OPI_AND,_imm);
+    }
+    // General form: "andi  rd = rs1 & imm"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" & #").p(Arm64.decodeImm12(_imm));
+    }
+}
\ No newline at end of file
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AsrARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AsrARM.java
new file mode 100644
index 00000000..77f14d4c
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AsrARM.java
@@ -0,0 +1,19 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// Arithmetic Shift Right (register)
+public class AsrARM extends MachConcreteNode implements MachNode {
+    AsrARM(Node asr) {super(asr);}
+    @Override public String op() { return "sar"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.DMASK; }
+    @Override public void encoding( Encoding enc ) { arm.shift_reg(enc,this,Arm64.OP_ASR); }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" >> ").p(code.reg(in(2)));
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AsrIARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AsrIARM.java
new file mode 100644
index 00000000..7cb42eec
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/AsrIARM.java
@@ -0,0 +1,32 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.node.MachConcreteNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.SB;
+
+public class AsrIARM extends MachConcreteNode implements MachNode {
+    final int _imm;
+    AsrIARM(Node asr, int imm) {
+        super(asr);
+        _inputs.pop();
+        _imm = imm;
+    }
+    @Override public String op() { return "asri"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+    @Override public void encoding( Encoding enc ) {
+        short rd = enc.reg(this);
+        short rn = enc.reg(in(1));
+        assert _imm > 0;
+        enc.add4(Arm64.imm_shift(Arm64.OPI_ASR,_imm, 0b111111, rn, rd));
+    }
+    // General form: "asri  rd = rs1 >> imm"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" >> #").p(_imm);
+    }
+}
\ No newline at end of file
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/BranchARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/BranchARM.java
new file mode 100644
index 00000000..31bbde86
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/BranchARM.java
@@ -0,0 +1,80 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+// Jump on flags, uses flags
+public class BranchARM extends IfNode implements MachNode, RIPRelSize {
+    String _bop;
+    final boolean _fp;
+    BranchARM(IfNode iff, String bop, boolean fp ) {
+        super(iff);
+        _bop = bop;
+        _fp = fp;
+    }
+    @Override public String op() { return "j"+_bop; }
+    @Override public String label() { return op(); }
+
+    @Override public void postSelect(CodeGen code) {
+        Node set = in(1);
+        if( set==null ) return; // Never-node cutout
+        Node cmp = set.in(1);
+        // Bypass an expected Set and just reference the cmp directly
+        if( set instanceof SetARM)
+            _inputs.set(1,cmp);
+        else
+            throw Utils.TODO();
+    }
+
+    @Override public RegMask regmap(int i) { assert i==1; return arm.FLAGS_MASK; }
+    @Override public RegMask outregmap() { return null; }
+    @Override public void negate() { _bop = negate(_bop);  }
+
+    @Override public void encoding( Encoding enc ) {
+        // Assuming that condition flags are already set.  These flags are set
+        // by comparison (or sub).  No need for regs because it uses flags
+        if( in(1)!=null ) {
+            // B.cond
+            enc.add4( Arm64.b_cond(Arm64.OP_BRANCH, 0, Arm64.make_condition(_bop, _fp)) );
+        } else {
+            if( _bop=="!=" ) return; // Inverted, no code
+            enc.add4(Arm64.b(Arm64.OP_UJMP, 0));
+        }
+        enc.jump(this,cproj(0));
+    }
+
+    // Delta is from opcode start
+    @Override public byte encSize(int delta) {
+        if( in(1)==null && _bop=="!=" ) return 0; // Inverted never-node, no code
+        if( -(1<<19) <= delta && delta < (1<<19) ) return 4;
+        // 2 word encoding needs a tmp register, must teach RA
+        throw Utils.TODO();
+    }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        assert !( in(1)==null && _bop=="!=" ); // Inverted never-node, no code no patch
+        if( opLen==4 ) {
+            enc.patch4(opStart,Arm64.b_cond(Arm64.OP_BRANCH, delta, Arm64.make_condition(_bop, _fp)));
+        } else {
+            throw Utils.TODO();
+        }
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        if( in(1)!=null ) {     // Never-node
+            String src = code.reg(in(1));
+            if( src!="flags" ) sb.p(src).p(" ");
+        } else if( _bop=="!=" ) {
+            sb.p("never");
+            return;
+        }
+        CFGNode prj = cproj(0).uctrlSkipEmpty();
+        if( !prj.blockHead() ) prj = prj.cfg0();
+        sb.p(label(prj));
+    }
+    @Override public String comment() { return "L"+cproj(1)._nid; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/CallARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/CallARM.java
new file mode 100644
index 00000000..4de28f3a
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/CallARM.java
@@ -0,0 +1,50 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.TypeFunPtr;
+import com.seaofnodes.simple.util.SB;
+
+public class CallARM extends CallNode implements MachNode, RIPRelSize {
+    final TypeFunPtr _tfp;
+    final String _name;
+    CallARM(CallNode call, TypeFunPtr tfp) {
+        super(call);
+        _inputs.pop(); // Pop constant target
+        assert tfp.isConstant();
+        _tfp = tfp;
+        _name = CodeGen.CODE.funcName(tfp.fidx());
+    }
+
+    @Override public String op() { return "call"; }
+    @Override public String label() { return op(); }
+    @Override public String name() { return _name; }
+    @Override public TypeFunPtr tfp() { return _tfp; }
+    @Override public RegMask regmap(int i) { return arm.callInMask(_tfp,i,fun()._maxArgSlot); }
+    @Override public RegMask outregmap() { return null; }
+    @Override public int nargs() { return nIns()-2; } // Minus control, memory, fptr
+
+    @Override public void encoding( Encoding enc ) {
+        FunNode fun = CodeGen.CODE.link(_tfp);
+        if( fun==null ) enc.external(this,_name);
+        else enc.relo(this);
+        // BL
+        enc.add4(Arm64.b(Arm64.OP_CALL,0)); // Target patched at link time
+    }
+
+    // Delta is from opcode start, but X86 measures from the end of the 5-byte encoding
+    @Override public byte encSize(int delta) { return 4; }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        enc.patch4(opStart,Arm64.b(Arm64.OP_CALL,delta));
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(_name).p("  ");
+        for( int i=0; i<nargs(); i++ )
+            sb.p(code.reg(arg(i+2))).p(", ");
+        sb.unchar(2);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/CallRRARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/CallRRARM.java
new file mode 100644
index 00000000..96a64cd0
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/CallRRARM.java
@@ -0,0 +1,36 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.TypeFunPtr;
+import com.seaofnodes.simple.util.SB;
+
+public class CallRRARM extends CallNode implements MachNode {
+    final TypeFunPtr _tfp;
+    CallRRARM(CallNode call) { super(call); _tfp = call.tfp(); }
+    @Override public TypeFunPtr tfp() { return _tfp; }
+    @Override public String op() { return "callr"; }
+    @Override public String label() { return op(); }
+    @Override public RegMask regmap(int i) {
+        return i==_inputs._len-1
+            ? arm.RMASK                // Function call target
+            : arm.callInMask(tfp(),i,fun()._maxArgSlot); // Normal argument
+    }
+    @Override public RegMask outregmap() { return null; }
+
+    @Override public void encoding( Encoding enc ) {
+        // Needs a register, typically a jump-and-link-register opcode
+        // blr
+        short self = enc.reg(fptr());
+        enc.add4(Arm64.blr(Arm64.OP_CALLRARM, self));
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(fptr())).p("  ");
+        for( int i=0; i<nargs(); i++ )
+            sb.p(code.reg(arg(i))).p(", ");
+        sb.unchar(2);
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/CmpARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/CmpARM.java
new file mode 100644
index 00000000..1bd9c372
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/CmpARM.java
@@ -0,0 +1,23 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class CmpARM extends MachConcreteNode implements MachNode {
+    CmpARM( Node cmp ) { super(cmp); }
+    @Override public String op() { return "cmp"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.FLAGS_MASK; }
+
+    // SUBS (shifted register)
+    @Override public void encoding( Encoding enc ) { arm.r_reg_subs(enc,this,Arm64.OP_CMP); }
+
+    // General form: "cmp  rs1, rs2"
+    @Override public void asm(CodeGen code, SB sb) {
+        String dst = code.reg(this);
+        if( dst!="flags" )  sb.p(dst).p(" = ");
+        sb.p(code.reg(in(1))).p(", ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/CmpFARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/CmpFARM.java
new file mode 100644
index 00000000..67ffc27b
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/CmpFARM.java
@@ -0,0 +1,22 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// compare instruction on float regs input(D-registers)
+public class CmpFARM extends MachConcreteNode implements MachNode{
+    CmpFARM(Node cmp) {super(cmp);}
+    @Override public String op() { return "cmpf"; }
+    @Override public RegMask regmap(int i) { return arm.DMASK; }
+    @Override public RegMask outregmap() { return arm.FLAGS_MASK; }
+
+    // FCMP
+    @Override public void encoding( Encoding enc ) { arm.f_cmp(enc,this); }
+    // General form: "cmp  d0, d1"
+    @Override public void asm(CodeGen code, SB sb) {
+        String dst = code.reg(this);
+        if( dst!="flags" )  sb.p(dst).p(" = ");
+        sb.p(code.reg(in(1))).p(", ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/CmpIARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/CmpIARM.java
new file mode 100644
index 00000000..cd4dd9cf
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/CmpIARM.java
@@ -0,0 +1,41 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// Compare with immediate.
+// CMP (immediate) - SUBS
+public class CmpIARM extends MachConcreteNode implements MachNode {
+    final int _imm;
+    final String _bop;
+    CmpIARM(BoolNode bool, int imm) {
+        super(bool);
+        _inputs.pop();
+        _bop = bool.op();
+        _imm = imm;
+    }
+    CmpIARM( CmpIARM cmp ) {
+        super((Node)null);
+        addDef(null);
+        addDef(cmp.in(1));
+        _bop = cmp._bop;
+        _imm = cmp._imm;
+    }
+    @Override public String op() { return _imm==0 ? "test" : "cmp"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.FLAGS_MASK; }
+    @Override public boolean isClone() { return true; }
+    @Override public Node copy() { return new CmpIARM(this); }
+
+    @Override public void encoding( Encoding enc ) { arm.imm_inst_subs(enc,in(1),in(1), Arm64.OPI_CMP,_imm); }
+
+    // General form: "cmp  rs1, 1"
+    @Override public void asm(CodeGen code, SB sb) {
+        String dst = code.reg(this);
+        if( dst!="flags" )  sb.p(dst).p(" = ");
+        sb.p(code.reg(in(1)));
+        if( _imm != 0 ) sb.p(", #").p(_imm);
+    }
+ }
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/DivARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/DivARM.java
new file mode 100644
index 00000000..e94b6491
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/DivARM.java
@@ -0,0 +1,20 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class DivARM extends MachConcreteNode implements MachNode {
+    DivARM( Node div ) { super(div); }
+    @Override public String op() { return "div"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+    // SDIV
+    @Override public void encoding( Encoding enc ) { arm.madd(enc,this,Arm64.OP_DIV,3); }
+    // General form: "div  dst /= src"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" / ").p(code.reg(in(2)));
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/DivFARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/DivFARM.java
new file mode 100644
index 00000000..68ad6047
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/DivFARM.java
@@ -0,0 +1,20 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class DivFARM extends MachConcreteNode implements MachNode {
+    DivFARM( Node divf) { super(divf); }
+    @Override public String op() { return "divf"; }
+    @Override public RegMask regmap(int i) { return arm.DMASK; }
+    @Override public RegMask outregmap() {  return arm.DMASK; }
+
+    // FDIV (scalar)
+    @Override public void encoding( Encoding enc ) { arm.f_scalar(enc,this,Arm64.OPF_DIV); }
+    // General form: "VDIF =  dst /= src"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" / ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/ExtendARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/ExtendARM.java
new file mode 100644
index 00000000..814a82c2
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/ExtendARM.java
@@ -0,0 +1,31 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.util.SB;
+
+// Convert a narrow C return register to Simple's full-width integer value.
+public class ExtendARM extends MachConcreteNode {
+    final int _bits;
+    final boolean _signed;
+    ExtendARM(ProjNode prj, TypeInteger ret) {
+        super(prj);
+        _inputs.set(0,null);
+        _inputs.add(new ProjARM(prj));
+        _bits = 8 << ret.log_size();
+        _signed = ret._min < 0;
+    }
+    @Override public String op() { return (_signed ? "sext" : "zext")+_bits; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+    @Override public void encoding(Encoding enc) {
+        short dst = enc.reg(this), src = enc.reg(in(1));
+        // SBFM/UBFM aliases: sign/zero extend the low byte, short or int.
+        enc.add4(Arm64.imm_shift(_signed ? Arm64.OPI_ASR : Arm64.OPI_LSR,0,_bits-1,src,dst));
+    }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/F8ToIARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/F8ToIARM.java
new file mode 100644
index 00000000..31dcfc36
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/F8ToIARM.java
@@ -0,0 +1,21 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class F8ToIARM extends MachConcreteNode implements MachNode {
+    F8ToIARM(Node f8toi) { super(f8toi); }
+    @Override public String op() { return "cvti"; }
+    @Override public RegMask regmap(int i) { return arm.DMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+    @Override public void encoding( Encoding enc ) {
+        enc.add4(Arm64.floatToInteger(enc.reg(in(1))-arm.D_OFFSET,enc.reg(this)));
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p("(int)").p(code.reg(in(1)));
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/FltARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/FltARM.java
new file mode 100644
index 00000000..db2540f7
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/FltARM.java
@@ -0,0 +1,45 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.ConstantNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+//FMOV (scalar, immediate)
+//Floating-point move immediate.
+public class FltARM extends ConstantNode implements MachNode, RIPRelSize {
+    final String _ext;
+    FltARM( ConstantNode con, String ext ) { super(con); _ext = ext; }
+    @Override public String op() { return "ld8"; }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return arm.DMASK; }
+    @Override public boolean isClone() { return true; }
+    @Override public FltARM copy() { return new FltARM(this,_ext); }
+
+    @Override public void encoding( Encoding enc ) {
+        if( _ext!=null ) throw Utils.TODO();
+        enc.largeConstant(this,_con,0,-1/*TODO: ARM-style ELF patching*/);
+        short dst = (short)(enc.reg(this) - arm.D_OFFSET);
+        enc.add4(Arm64.load_pc(Arm64.OPF_ARM, 0, dst));
+    }
+
+    // Delta is from opcode start.
+    @Override public byte encSize(int delta) { return 4;  }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        short dst = (short)(enc.reg(this) - arm.D_OFFSET);
+        enc.patch4(opStart, Arm64.load_pc(Arm64.OPF_ARM, delta, dst));
+    }
+
+    // Human-readable form appended to the SB.  Things like the encoding,
+    // indentation, leading address or block labels not printed here.
+    // Just something like "ld4\tR17=[R18+12] // Load array base".
+    // General form: "op\tdst=src+src"
+    @Override public void asm(CodeGen code, SB sb) {
+        _con.print(sb.p(code.reg(this)).p(" = #"));
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/FunARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/FunARM.java
new file mode 100644
index 00000000..17cafcde
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/FunARM.java
@@ -0,0 +1,22 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.FunNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class FunARM  extends FunNode implements MachNode {
+    FunARM(FunNode fun) { super(fun); }
+    @Override public void computeFrameAdjust(CodeGen code, int maxReg) {
+        super.computeFrameAdjust(code,maxReg);
+        _frameAdjust = (_frameAdjust+15) & -16; // Keep SP aligned, including leaf spills.
+    }
+    @Override public void encoding( Encoding enc ) {
+        int sz = _frameAdjust;
+        if( sz == 0 ) return;   // Skip if no frame adjust
+        if( sz >= 1L<<12 ) throw Utils.TODO();
+        enc.add4(Arm64.imm_inst(Arm64.OPI_SUB, sz, arm.RSP, arm.RSP));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/I2F8ARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/I2F8ARM.java
new file mode 100644
index 00000000..b1c30afc
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/I2F8ARM.java
@@ -0,0 +1,26 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class I2F8ARM extends MachConcreteNode implements MachNode {
+    I2F8ARM(Node i2f8) { super(i2f8); }
+    @Override public String op() { return "cvt"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.DMASK; }
+    @Override public void encoding( Encoding enc ) {
+        // SCVTF
+        short self = (short)(enc.reg(this )-arm.D_OFFSET);
+        short reg1 = enc.reg(in(1));
+        int body = Arm64.float_cast(Arm64.OP_FLOAT_C, 1, reg1, self);
+        enc.add4(body);
+    }
+
+    // General form: "i2f8 (flt)int_value"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p("(flt)").p(code.reg(in(1)));
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/IntARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/IntARM.java
new file mode 100644
index 00000000..72b76edd
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/IntARM.java
@@ -0,0 +1,39 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.ConstantNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+// Integer constants
+public class IntARM extends ConstantNode implements MachNode {
+    final String _ext;
+    IntARM( ConstantNode con, String ext ) { super(con); _ext = ext; }
+
+    @Override public String op() { return "ldi"; }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+
+    @Override public boolean isClone() { return true; }
+    @Override public IntARM copy() { return new IntARM(this,_ext); }
+
+    @Override public void encoding( Encoding enc ) {
+        if( _ext!=null ) throw Utils.TODO();
+        short self = enc.reg(this);
+        long x = _con==Type.NIL ? 0 : ((TypeInteger)_con).value();
+        Arm64.constant(enc,self,x);
+    }
+
+    // Human-readable form appended to the SB.  Things like the encoding,
+    // indentation, leading address or block labels not printed here.
+    // Just something like "ld4\tR17=[R18+12] // Load array base".
+    // General form: "op\tdst=src+src"
+    @Override public void asm(CodeGen code, SB sb) {
+        String reg = code.reg(this);
+        _con.print(sb.p(reg).p(" = #"));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/LoadARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/LoadARM.java
new file mode 100644
index 00000000..53494092
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/LoadARM.java
@@ -0,0 +1,34 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.LoadNode;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.SB;
+
+// Load memory addressing on ARM
+// Support imm, reg(direct), or reg+off(indirect) addressing
+// Base = base - base pointer, offset is added to base
+// idx  = null
+// off  = off - offset added to base
+
+public class LoadARM extends MemOpARM {
+    LoadARM(LoadNode ld, Node base, Node idx, int off) {
+        super(ld, base, idx, off, 0);
+    }
+    @Override public String op() { return "ld"+_sz; }
+    @Override public RegMask outregmap() { return size() >= 4 ? arm.MEM_MASK : arm.WMASK; }
+
+    private static final int[] OP_LOADS  = new int[]{ Arm64.OP_LOAD_IMM_8,  Arm64.OP_LOAD_IMM_16,  Arm64.OP_LOAD_IMM_32,  Arm64.OP_LOAD_IMM_64, };
+
+    private static final int[] OP_LOAD_RS  = new int[]{ Arm64.OP_LOAD_R_8 , Arm64.OP_LOAD_R_16 , Arm64.OP_LOAD_R_32 , Arm64.OP_LOAD_R_64,  };
+
+    // ldr(immediate - unsigned offset) | ldr(register)
+    @Override public void encoding( Encoding enc ) {
+        ldst_encode(enc, OP_LOADS[Integer.numberOfTrailingZeros(size())], OP_LOAD_RS[_con.log_size()], this, size());
+    }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(",");
+        asm_address(code,sb);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/LslARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/LslARM.java
new file mode 100644
index 00000000..954cfac2
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/LslARM.java
@@ -0,0 +1,20 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// Logical Shift Left (register)
+public class LslARM extends MachConcreteNode implements MachNode {
+    LslARM(Node asr) {super(asr);}
+    @Override public String op() { return "shr"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+
+    @Override public void encoding( Encoding enc ) { arm.shift_reg(enc,this,Arm64.OP_LSL); }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" << ").p(code.reg(in(2)));
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/LslIARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/LslIARM.java
new file mode 100644
index 00000000..b32153ab
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/LslIARM.java
@@ -0,0 +1,34 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.node.MachConcreteNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.SB;
+
+public class LslIARM extends MachConcreteNode implements MachNode {
+    final int _imm;
+    LslIARM(Node lsl, int imm) {
+        super(lsl);
+        _inputs.pop();
+        _imm = imm;
+    }
+    @Override public String op() { return "lsli"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+    @Override public void encoding( Encoding enc ) {
+        short rd = enc.reg(this);
+        short rn = enc.reg(in(1));
+        assert _imm > 0;
+        // UBFM <Xd>, <Xn>, #(-<shift> MOD 64), #(63-<shift>)
+        // immr must be (-<shift> MOD 64) = 64 - shift
+        enc.add4(Arm64.imm_shift(Arm64.OPI_LSL, 64 - _imm, (64 - _imm) - 1, rn, rd));
+    }
+    // General form: "lsli  rd = rs1 << imm"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" << #").p(_imm);
+    }
+}
\ No newline at end of file
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/LsrARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/LsrARM.java
new file mode 100644
index 00000000..91be34e3
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/LsrARM.java
@@ -0,0 +1,20 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// Logical Shift Right (register)
+public class LsrARM extends MachConcreteNode implements MachNode {
+    LsrARM(Node asr) {super(asr);}
+    @Override public String op() { return "shr"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+
+    @Override public void encoding( Encoding enc ) { arm.shift_reg(enc,this,Arm64.OP_LSR); }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" >>> ").p(code.reg(in(2)));
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/LsrIARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/LsrIARM.java
new file mode 100644
index 00000000..243ce968
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/LsrIARM.java
@@ -0,0 +1,29 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// logical right shift immediate
+public class LsrIARM extends MachConcreteNode implements MachNode {
+    final int _imm;
+    LsrIARM(Node lsr, int imm) {
+        super(lsr);
+        _inputs.pop();
+        _imm = imm;
+    }
+    @Override public String op() { return "lsri"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+    @Override public void encoding( Encoding enc ) {
+        short rd = enc.reg(this);
+        short rn = enc.reg(in(1));
+        assert _imm > 0;
+        enc.add4(Arm64.imm_shift(Arm64.OPI_LSR,_imm, 0b111111, rn,rd));
+    }
+    // General form: "lsri  rd = rs1 >>> imm"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" >>> #").p(_imm);
+    }
+}
\ No newline at end of file
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/MemOpARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/MemOpARM.java
new file mode 100644
index 00000000..14eaf510
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/MemOpARM.java
@@ -0,0 +1,81 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.SB;
+import java.lang.StringBuilder;
+
+public abstract class MemOpARM extends MemOpNode implements MachNode {
+    final int _off;             // Limit 9 bits sized, or (13 bits<<logsize) unsigned
+    final int _imm;             // Limit ? bits
+    final int _bytes;
+    final char _sz;
+    MemOpARM(MemOpNode mop, Node ptr, Node idx, int off, int imm) {
+        super(mop,mop);
+        assert ptr._type instanceof TypeMemPtr && !(ptr instanceof AddNode);
+        assert ptr() == ptr;
+        _inputs.setX(2, ptr);
+        _inputs.setX(3, idx);
+        _off = off;
+        _imm = imm;
+        _bytes = mop instanceof StoreNode st ? st.storeSize() : 1<<_con.log_size();
+        _sz = (char)('0'+_bytes);
+    }
+
+    // Store-based flavors have a value edge
+    MemOpARM( MemOpNode mop, Node ptr, Node idx, int off, int imm, Node val ) {
+        this(mop,ptr,idx,off,imm);
+        _inputs.setX(4,val);
+    }
+
+    @Override public String label() { return op();}
+    Node val() { return in(4); } // Only for stores
+
+    @Override protected ExprPrinter<Node> _printMach(ExprPrinter<Node> p) { return p.p(".").p(_name); }
+
+    @Override public Type compute() { throw new AssertionError("Do not call compute on "+getClass().getSimpleName()); }
+    @Override public Node idealize() { throw new AssertionError("Do not call idealize on "+getClass().getSimpleName()); }
+
+    int size() { return _bytes; }
+
+    // Wider mask to store both GPRs and FPRs
+    @Override public RegMask regmap(int i) {
+        // 0 - ctrl
+        if( i==1 ) return null; // memory
+        if( i==2 ) return arm.RMASK; // ptr/base
+        if( i==3 ) return arm.RMASK; // off/index
+        if( i==4 ) return size() >= 4 ? arm.MEM_MASK : arm.RMASK; // value
+        return null; // Anti-dependence
+    }
+
+    // Shared encoding for loads and stores(int and float)
+    public void ldst_encode( Encoding enc, int opcode_imm, int opcode_reg, Node xval, int size) {
+        short ptr = enc.reg(ptr());
+        short off = enc.reg(off());
+        short val = enc.reg(xval);
+        // The allocated register selects integer vs SIMD/FP encoding, even for
+        // bitwise copies. ARM numbers each register bank from zero in the opcode.
+        boolean fp = val >= arm.D0;
+        assert !fp || size >= 4;
+        if( fp ) {
+            opcode_imm |= 1<<4;
+            opcode_reg |= 1<<5;
+            val -= arm.D0;
+        }
+        int body = off() == null
+            ? Arm64.load_str_imm(opcode_imm, _off, ptr, val, size)
+            : Arm64.indr_adr(opcode_reg, off, Arm64.STORE_LOAD_OPTION.SXTX, 0, ptr, val);
+        enc.add4(body);
+    }
+
+    SB asm_address(CodeGen code, SB sb) {
+        sb.p("[").p(code.reg(ptr())).p("+");
+        if( off() != null ) sb.p(code.reg(off()));
+        else sb.p(_off);
+        return sb.p("]");
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/MulARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/MulARM.java
new file mode 100644
index 00000000..f598cefb
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/MulARM.java
@@ -0,0 +1,20 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// mulh signed multiply instruction(no-imm form)
+public class MulARM extends MachConcreteNode implements MachNode {
+    MulARM(Node mul) {super(mul);}
+    @Override public String op() { return "mul"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+
+    @Override public void encoding( Encoding enc ) { arm.madd(enc,this,Arm64.OP_MUL,31); }
+    // General form: "rd = rs1 * rs2"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" * ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/MulFARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/MulFARM.java
new file mode 100644
index 00000000..a4f81fd4
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/MulFARM.java
@@ -0,0 +1,19 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class MulFARM extends MachConcreteNode implements MachNode{
+    MulFARM(Node mulf) {super(mulf);}
+    @Override public String op() { return "mulf"; }
+    @Override public RegMask regmap(int i) { return arm.DMASK; }
+    @Override public RegMask outregmap() { return arm.DMASK; }
+    @Override public void encoding( Encoding enc ) { arm.f_scalar(enc,this,Arm64.OPF_MUL); }
+    // Default on double precision for now(64 bits)
+    // General form: "VMUL.f32  rd = src1 * src2
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" * ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/NegARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/NegARM.java
new file mode 100644
index 00000000..881b41f9
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/NegARM.java
@@ -0,0 +1,25 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.node.MachConcreteNode;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.util.SB;
+
+public class NegARM extends MachConcreteNode implements MachNode {
+    NegARM(Node sub) {
+        super(sub);
+        //_inputs.pop();
+    }
+    @Override public String op() { return "neg"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap()   { return arm.WMASK; }
+    @Override public void encoding( Encoding enc ) {
+        // reverse subtract with immediate 0
+        arm.imm_inst(enc,this, in(1), 0b00100110, 0);
+    }
+    // General form: "subi  rd = rs1 - imm"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = -").p(code.reg(in(1)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/NewARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/NewARM.java
new file mode 100644
index 00000000..8bb8983e
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/NewARM.java
@@ -0,0 +1,39 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class NewARM extends NewNode implements MachNode, RIPRelSize {
+    // A pre-zeroed chunk of memory.
+    NewARM(NewNode nnn) { super(nnn); }
+    @Override public void encoding( Encoding enc ) {
+        // BL(branch with link)
+        enc.external(this,"calloc").
+            add4(Arm64.mov(Arm64.OP_MOVZ, 0, 1, 0)).   // movz x0,#1
+            add4(Arm64.b(Arm64.OP_CALL, 0));
+    }
+
+    // Patch is for running "new" in a JIT.
+    // Delta is from opcode start
+    @Override public byte encSize(int delta) { return 4*2; }
+
+    // Patch is for running "new" in a JIT.
+    // Delta is from opcode start
+    @Override public void patch(Encoding enc, int opStart, int opLen, int delta ) {
+        // Negative patches are JIT emulator targets.
+        if( opStart+delta < 0 ) {
+            enc.patch4(opStart+4, Arm64.b_calloc(Arm64.OP_CALL, delta-4));
+        } else {
+            throw Utils.TODO();
+        }
+    }
+    // General form: "alloc #bytes  PC"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p("\n");             // Multi-op trigger
+        sb.p("ldi   ").p(code._mach.regs()[_arg2Reg]).p(" = #1\n");
+        sb.p("call  #calloc");
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/NotARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/NotARM.java
new file mode 100644
index 00000000..f8e450f6
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/NotARM.java
@@ -0,0 +1,28 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.node.MachConcreteNode;
+import com.seaofnodes.simple.util.SB;
+
+public class NotARM extends MachConcreteNode implements MachNode{
+    NotARM(NotNode not) {super(not);}
+    @Override public String op() { return "not"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK;  }
+    @Override public RegMask killmap() { return arm.FLAGS_MASK; }
+    @Override public void encoding( Encoding enc ) {
+        // subs xzr, rs, #0
+        // cset    rd, eq        // Set rd to 1 if rs == 0 (equal), else 0
+        // subtracting zero from rs will just yield rs, it sets the zero flag and then it's used in cset
+        short self = enc.reg(this );
+        short reg1 = enc.reg(in(1));
+        int subs = Arm64.imm_inst(Arm64.OP_SUBS, 0, reg1, 31);
+        enc.add4(subs);
+        int cset = Arm64.cset(Arm64.OP_CSET, 31, Arm64.COND.EQ, 31, self);
+        enc.add4(cset);
+    }
+
+    @Override public void asm(CodeGen code, SB sb) { sb.p(code.reg(this)); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/OrARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/OrARM.java
new file mode 100644
index 00000000..5b7264ec
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/OrARM.java
@@ -0,0 +1,21 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// Not using the ORRS variant.
+public class OrARM extends MachConcreteNode implements MachNode {
+    OrARM(Node and) { super(and); }
+    @Override public String op() { return "or"; }
+    @Override public String glabel() { return "|"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+    @Override public void encoding( Encoding enc ) { arm.r_reg(enc,this,Arm64.OP_OR); }
+    // General form:  #rd = rs1 & rs2
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" | ").p(code.reg(in(2)));
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/OrIARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/OrIARM.java
new file mode 100644
index 00000000..86d07bee
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/OrIARM.java
@@ -0,0 +1,25 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class OrIARM extends MachConcreteNode implements MachNode {
+    final int _imm;
+    OrIARM(Node or, int imm) {
+        super(or);
+        _inputs.pop();
+        _imm = imm;
+    }
+    @Override public String op() { return "ori"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+    @Override public void encoding( Encoding enc ) {
+        arm.imm_inst_n(enc, this, in(1), Arm64.OPI_OR, _imm);
+    }
+    // General form: "ori  rd = rs1 | imm"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" | #").p(_imm);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/ParmARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/ParmARM.java
new file mode 100644
index 00000000..b419fe0a
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/ParmARM.java
@@ -0,0 +1,17 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.node.ParmNode;
+
+public class ParmARM extends ParmNode implements MachNode {
+    final RegMask _rmask;
+    ParmARM(ParmNode parm) {
+        super(parm);
+        _rmask = arm.callInMask(fun().sig(),_idx,0);
+    }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return _rmask; }
+    @Override public void encoding( Encoding enc ) { }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/ProjARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/ProjARM.java
new file mode 100644
index 00000000..4b7d6f13
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/ProjARM.java
@@ -0,0 +1,15 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.node.ProjNode;
+
+public class ProjARM extends ProjNode implements MachNode {
+    ProjARM( ProjNode p ) { super(p); }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() {
+        return ((MachNode)in(0)).outregmap(_idx);
+    }
+    @Override public void encoding( Encoding enc ) { }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/RetARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/RetARM.java
new file mode 100644
index 00000000..a7ed5073
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/RetARM.java
@@ -0,0 +1,16 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.*;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+
+public class RetARM extends ReturnNode implements MachNode {
+    RetARM(ReturnNode ret, FunNode fun) { super(ret, fun); fun.setRet(this); }
+    @Override public void encoding( Encoding enc ) {
+        int frameAdjust = ((FunARM)fun())._frameAdjust;
+        if( frameAdjust > 0 )
+            enc.add4(Arm64.imm_inst(Arm64.OPI_ADD, frameAdjust, arm.RSP, arm.RSP));
+        enc.add4(Arm64.ret(Arm64.OP_RET));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SetARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SetARM.java
new file mode 100644
index 00000000..e5b06c39
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SetARM.java
@@ -0,0 +1,36 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// conditional set?
+// e.g CSET, stores flag info into GPRS after compare
+public class SetARM extends MachConcreteNode implements MachNode {
+    final String _bop;          // One of <,<=,==
+    final boolean _fp;          // FP compare (unsigned encoding)
+    SetARM(Node cmp, String bop, boolean fp) {
+        super(cmp);
+        _inputs.setLen(1);   // Pop the cmp inputs
+        // Replace with the matched cmp
+        _inputs.push(cmp);
+        _bop = bop;
+        _fp = fp;
+    }
+    @Override public String op() { return "set"+_bop; }
+    @Override public RegMask regmap(int i) { assert i==1; return arm.FLAGS_MASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+
+    @Override public void encoding( Encoding enc ) {
+        // Using RM==RN==31 implies a *zero* value, not R31.
+        int body = Arm64.cset(Arm64.OP_CSET,0b11111, Arm64.make_condition(_bop, _fp), 0b011111, enc.reg(this));
+        enc.add4(body);
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this));
+        String src = code.reg(in(1));
+        if( src!="flags" )  sb.p(" = ").p(src);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SplitARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SplitARM.java
new file mode 100644
index 00000000..dcfeb5d8
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SplitARM.java
@@ -0,0 +1,60 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.FunNode;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.node.SplitNode;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class SplitARM extends SplitNode {
+    SplitARM(LRG lrg, String kind, byte round) { super(lrg,kind,round,new Node[2]);}
+    @Override public RegMask regmap(int i) { return arm.SPLIT_MASK; }
+    @Override public RegMask outregmap() { return arm.SPLIT_MASK; }
+
+    @Override public void encoding( Encoding enc ) {
+        short dst = enc.reg(this );
+        short src = enc.reg(in(1));
+
+        boolean dstX = dst >= arm.D_OFFSET;
+        boolean srcX = src >= arm.D_OFFSET;
+
+        if (dst >= arm.MAX_REG) {
+            // store to sp
+            if(src >= arm.MAX_REG) {
+                throw Utils.TODO();
+            }
+            int off = fun(enc).computeStackOffset(enc._code,dst);
+            if( srcX ) src -= arm.D_OFFSET;
+            enc.add4(Arm64.load_str_imm(Arm64.OP_STORE_IMM_64, off, arm.RSP, src, 8));
+            return;
+        }
+
+        if(src >= arm.MAX_REG) {
+            // Load from SP
+            int off = fun(enc).computeStackOffset(enc._code,src);
+            if( dstX ) dst -= arm.D_OFFSET;
+            enc.add4(Arm64.load_str_imm(Arm64.OP_LOAD_IMM_64, off, arm.RSP, dst, 8));
+            return;
+        }
+
+        // pick opcode based on regs
+        if(!dstX && !srcX) {
+            // GPR->GPR
+            enc.add4(Arm64.mov_reg(Arm64.OP_MOV, src, dst));
+        } else if(dstX && srcX) {
+            // FPR->FPR
+            // fmov reg
+            enc.add4(Arm64.f_mov_reg(Arm64.OP_FMOV_REG, src - arm.D_OFFSET,dst - arm.D_OFFSET));
+        } else if(!srcX && dstX) {
+            // GPR->FPR
+            // FMOV(general) 64 bits to DOUBLE-PRECISION
+            enc.add4(Arm64.f_mov_general(Arm64.OP_FMOV, 0b01, 0, 0b111, src, dst - arm.D_OFFSET));
+        } else if( srcX && !dstX) {
+            //FPF->GPR
+            // FMOV(general) DOUBLE-PRECISION to 64 bits
+            enc.add4(Arm64.f_mov_general(Arm64.OP_FMOV, 0b01, 0, 0b110, src - arm.D_OFFSET, dst));
+        }
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SplitFlagsARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SplitFlagsARM.java
new file mode 100644
index 00000000..25e5d501
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SplitFlagsARM.java
@@ -0,0 +1,21 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+
+// NZCV transfers require a GPR. Further splits can spill that GPR to the stack.
+public class SplitFlagsARM extends SplitARM {
+    private static final RegMask MASK = new RegMask(arm.WR_BITS,1L);
+    SplitFlagsARM(LRG lrg,String kind,byte round) { super(lrg,kind,round); }
+    @Override public boolean isNonStackSplit() { return true; }
+    @Override public RegMask regmap(int i) { return MASK; }
+    @Override public RegMask outregmap() { return MASK; }
+
+    @Override public void encoding(Encoding enc) {
+        short dst=enc.reg(this), src=enc.reg(in(1));
+        if( dst==src ) return;
+        if( src==arm.FLAGS ) enc.add4(Arm64.flags(dst,false));
+        else if( dst==arm.FLAGS ) enc.add4(Arm64.flags(src,true));
+        else super.encoding(enc);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SplitGPRARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SplitGPRARM.java
new file mode 100644
index 00000000..c9b2127a
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SplitGPRARM.java
@@ -0,0 +1,11 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.simple.codegen.*;
+
+// Keep a saved NZCV value in GPRs and stack slots through subsequent spills.
+public class SplitGPRARM extends SplitARM {
+    private static final RegMask MASK = new RegMask(arm.WR_BITS,-2L);
+    SplitGPRARM(LRG lrg,String kind,byte round) { super(lrg,kind,round); }
+    @Override public RegMask regmap(int i) { return MASK; }
+    @Override public RegMask outregmap() { return MASK; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/StoreARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/StoreARM.java
new file mode 100644
index 00000000..0b90ac8b
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/StoreARM.java
@@ -0,0 +1,38 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.node.StoreNode;
+import com.seaofnodes.simple.util.SB;
+
+// Store memory addressing on ARM
+// Support imm, reg(direct), or reg+off(indirect) addressing
+// base - base pointer, offset is added to base
+// null - index never allowed (no [reg+reg] mode)
+// off  - offset added to base
+// imm  - immediate value to store, only if val is null
+// val  - value to store or null
+
+//e.g s.cs[0] =  67; // C
+// base = s.cs, off = 4, imm = 67, val = null
+public class StoreARM extends MemOpARM {
+    StoreARM(StoreNode st, Node base, Node idx, int off, Node val) {
+        super(st, base, idx, off, 0, val);
+    }
+    @Override public String op() { return "st"+_sz; }
+    @Override public RegMask outregmap() { return null; }
+
+    private static final int[] OP_STORES = new int[]{ Arm64.OP_STORE_IMM_8, Arm64.OP_STORE_IMM_16, Arm64.OP_STORE_IMM_32, Arm64.OP_STORE_IMM_64, };
+
+    private static final int[] OP_STORE_RS = new int[]{ Arm64.OP_STORE_R_8, Arm64.OP_STORE_R_16, Arm64.OP_STORE_R_32, Arm64.OP_STORE_R_64, };
+
+    @Override public void encoding( Encoding enc ) {
+        ldst_encode(enc, OP_STORES[Integer.numberOfTrailingZeros(size())], OP_STORE_RS[Integer.numberOfTrailingZeros(_bytes)], val(), size());
+    }
+    @Override public void asm(CodeGen code, SB sb) {
+        asm_address(code,sb).p(",");
+        if( val()==null ) sb.p("#").p(_imm);
+        else sb.p(code.reg(val()));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SubARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SubARM.java
new file mode 100644
index 00000000..fd5cd4de
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SubARM.java
@@ -0,0 +1,20 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class SubARM extends MachConcreteNode implements MachNode {
+    SubARM(Node sub) { super(sub); }
+    @Override public String op() { return "sub"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+
+    @Override public void encoding( Encoding enc ) { arm.r_reg(enc,this,Arm64.OP_SUB); }
+
+    // General form: "sub  # rd = rs1 - rs2"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" - ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SubFARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SubFARM.java
new file mode 100644
index 00000000..1a751434
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SubFARM.java
@@ -0,0 +1,19 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class SubFARM extends MachConcreteNode implements MachNode {
+    SubFARM(Node subf) {super(subf);}
+    @Override public String op() { return "subf"; }
+    @Override public RegMask regmap(int i) { return arm.DMASK; }
+    @Override public RegMask outregmap() { return arm.DMASK; }
+    @Override public void encoding( Encoding enc ) { arm.f_scalar(enc,this,Arm64.OPF_SUB); }
+    // Default on double precision for now(64 bits)
+    // General form: "vsub.f32  rd = src1 + src2
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" - ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SubIARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SubIARM.java
new file mode 100644
index 00000000..b2c0b2ed
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/SubIARM.java
@@ -0,0 +1,29 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.node.MachConcreteNode;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.util.SB;
+
+public class SubIARM extends MachConcreteNode implements MachNode {
+    final int _imm;
+    SubIARM(Node sub, int imm) {
+        super(sub);
+        _inputs.pop();
+        _imm = imm;
+    }
+    @Override public String op() { return _imm == -1 ? "dec" : "subi"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+
+    @Override public void encoding( Encoding enc ) {
+        arm.imm_inst(enc,this, in(1), Arm64.OPI_SUB,_imm);
+    }
+
+    // General form: "subi  rd = rs1 - imm"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" - #").p(_imm);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/TFPARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/TFPARM.java
new file mode 100644
index 00000000..a053ba46
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/TFPARM.java
@@ -0,0 +1,51 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.TypeFunPtr;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class TFPARM extends FunPtrNode implements MachNode, RIPRelSize {
+    final String _ext;
+    // Pointer to a Simple function
+    TFPARM( FunPtrNode fptr ) { super(fptr); _ext = null; }
+    // Pointer to an Extern "C" function
+    TFPARM( TypeFunPtr fptr, String ext ) { super(fptr,CodeGen.CODE._start,null); _type = fptr; _ext = ext; }
+    @Override public String op() { return "ldx"; }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+    @Override public boolean isClone() { return true; }
+    @Override public TFPARM copy() { return new TFPARM((TypeFunPtr)_con,_ext); }
+    @Override public void encoding( Encoding enc ) {
+        if( _ext==null ) enc.relo(this);          // Internal patch
+        else             enc.external(this,_ext); // ELF-file external patch
+        short dst = enc.reg(this);
+        // adrp    x0, 0
+        enc.add4(Arm64.adrp(1,0, Arm64.OP_ADRP, 0,dst));
+        // add     x0, x0, 0
+        arm.imm_inst(enc,Arm64.OPI_ADD,0, dst);
+    }
+
+    @Override public byte encSize(int delta) {
+        return 8;
+    }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        short rpc = enc.reg(this);
+        if(opLen == 8 ) {
+            arm.patch_adrp_add(enc, opStart, delta, rpc);
+        } else {
+            // should not happen as one instruction is 4 byte, and TFP arm encodes 2.
+            throw Utils.TODO();
+        }
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        String reg = code.reg(this);
+        _type.print(sb.p(reg).p(" #"));
+    }
+    @Override public boolean eq(Node n) { return this==n; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/TMPARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/TMPARM.java
new file mode 100644
index 00000000..b2531f97
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/TMPARM.java
@@ -0,0 +1,49 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.ConstantNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.type.TypeMemPtr;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class TMPARM extends ConstantNode implements MachNode, RIPRelSize {
+    final String _ext;
+    TMPARM( ConstantNode con, String ext ) { super(con); _ext = ext; }
+    @Override public String op() { return "ldp"; }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+    @Override public boolean isClone() { return true; }
+    @Override public TMPARM copy() { return new TMPARM(this,_ext); }
+    @Override public void encoding( Encoding enc ) {
+        if( _ext!=null ) enc.externalData(this,_ext);
+        else enc.largeConstant(this,((TypeMemPtr)_con)._obj,0,-1);
+        short dst = enc.reg(this);
+        // adrp    x0, 0
+        enc.add4(Arm64.adrp(1,0, Arm64.OP_ADRP, 0,dst));
+        // add     x0, x0, 0
+        arm.imm_inst(enc,Arm64.OPI_ADD,0, dst);
+    }
+
+    @Override public byte encSize(int delta) {
+        return 8;
+    }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        short dst = enc.reg(this);
+        if(opLen == 8 ) {
+            arm.patch_adrp_add(enc, opStart, delta, dst);
+        } else {
+            throw Utils.TODO();
+        }
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        String reg = code.reg(this);
+        _con.print(sb.p(reg).p(" #"));
+    }
+    @Override public boolean eq(Node n) { return this==n; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/UJmpARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/UJmpARM.java
new file mode 100644
index 00000000..aecd02bb
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/UJmpARM.java
@@ -0,0 +1,48 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+// unconditional jump
+public class UJmpARM extends CFGNode implements MachNode, RIPRelSize {
+    UJmpARM() { }
+    @Override public String op() { return "jmp"; }
+    @Override public String label() { return op(); }
+    @Override protected String format() { return "jmp "; }
+    @Override public RegMask regmap(int i) {return null; }
+    @Override public RegMask outregmap() { return null; }
+    @Override public Type compute() { throw Utils.TODO(); }
+    @Override public Node idealize() { throw Utils.TODO(); }
+    @Override public void encoding( Encoding enc ) {
+        enc.jump(this,uctrl());
+        int body = Arm64.b(Arm64.OP_UJMP, 0);
+        enc.add4(body);
+    }
+
+    // Delta is from opcode start
+    @Override public byte encSize(int delta) {
+        if( -(1<<26) <= delta && delta < (1<<26) ) return 4;
+        // 2 word encoding needs a tmp register, must teach RA
+        throw Utils.TODO();
+    }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        if( opLen==4 ) {
+            enc.patch4(opStart,Arm64.b(Arm64.OP_UJMP, delta));
+        } else {
+            throw Utils.TODO();
+        }
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        CFGNode target = uctrl();
+        //assert target.nOuts() > 1; // Should optimize jmp to empty targets
+        sb.p(label(target));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/XorARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/XorARM.java
new file mode 100644
index 00000000..d56397a3
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/XorARM.java
@@ -0,0 +1,20 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class XorARM extends MachConcreteNode implements MachNode{
+    XorARM(Node xor) {super(xor);}
+    @Override public String op() { return "xor"; }
+    @Override public String glabel() { return "^"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+    @Override public void encoding( Encoding enc ) { arm.r_reg(enc,this,Arm64.OP_XOR); }
+    // General form: "rd = x1 ^ x2"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" ^ ").p(code.reg(in(2)));
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/XorIARM.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/XorIARM.java
new file mode 100644
index 00000000..12143ccd
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/XorIARM.java
@@ -0,0 +1,27 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.node.MachConcreteNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.util.SB;
+
+public class XorIARM extends MachConcreteNode implements MachNode {
+    final int _imm;
+    XorIARM(Node xor, int imm) {
+        super(xor);
+        _inputs.pop();
+        _imm = imm;
+    }
+
+    @Override public String op() { return "xori"; }
+    @Override public RegMask regmap(int i) { return arm.RMASK; }
+    @Override public RegMask outregmap() { return arm.WMASK; }
+
+    // General form: "xori  rd = rs1 ^ imm"
+    @Override public void encoding( Encoding enc ) { arm.imm_inst_n(enc,this, in(1), Arm64.OPI_XOR,_imm); }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" ^ #").p(_imm);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/arm.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/arm.java
new file mode 100644
index 00000000..3c965da5
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/arm/arm.java
@@ -0,0 +1,503 @@
+package com.seaofnodes.simple.node.cpus.arm;
+
+import com.seaofnodes.isa.Arm64;
+import static com.seaofnodes.isa.Arm64.*;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.Utils;
+
+public class arm extends Machine {
+    public arm( CodeGen code ) {
+        if( !"SystemV".equals(code._callingConv) )
+            throw new IllegalArgumentException("Unknown calling convention "+code._callingConv);
+    }
+
+    // ARM64
+    @Override public String name() { return "arm"; }
+
+    // GPR(S)
+    public static final int X0  =  0,  X1  =  1,  X2  =  2,  X3  =  3,  X4  =  4,  X5  =  5,  X6  =  6,  X7  =  7;
+    public static final int X8  =  8,  X9  =  9,  X10 = 10,  X11 = 11,  X12 = 12,  X13 = 13,  X14 = 14,  X15 = 15;
+    public static final int X16 = 16,  X17 = 17,  X18 = 18,  X19 = 19,  X20 = 20,  X21 = 21,  X22 = 22,  X23 = 23;
+    public static final int X24 = 24,  X25 = 25,  X26 = 26,  X27 = 27,  X28 = 28,  X29 = 29,  X30 = 30,  RSP = 31;
+
+    // Floating point registers
+    public static final int D0  = 32,  D1  = 33,  D2  = 34,  D3  = 35,  D4  = 36,  D5  = 37,  D6  = 38,  D7  = 39;
+    public static final int D8  = 40,  D9  = 41,  D10 = 42,  D11 = 43,  D12 = 44,  D13 = 45,  D14 = 46,  D15 = 47;
+    public static final int D16 = 48,  D17 = 49,  D18 = 50,  D19 = 51,  D20 = 52,  D21 = 53,  D22 = 54,  D23 = 55;
+    public static final int D24 = 56,  D25 = 57,  D26 = 58,  D27 = 59,  D28 = 60,  D29 = 61,  D30 = 62,  D31 = 63;
+
+    static final int FLAGS = 64;
+    static final int MAX_REG = 65;
+    public static final int D_OFFSET = 32;
+
+    static final String[] REGS = new String[] {
+        "X0",  "X1",  "X2",  "X3",  "X4",  "X5",  "X6",  "X7",
+        "X8",  "X9",  "X10", "X11", "X12", "X13", "X14", "X15",
+        "X16", "X17", "X18", "X19", "X20", "X21", "X22", "X23",
+        "X24", "X25", "X26", "X27", "X28", "X29", "RPC", "RSP",
+        "D0",  "D1",  "D2",  "D3",  "D4",  "D5",  "D6",  "D7",
+        "D8",  "D9",  "D10", "D11", "D12", "D13", "D14", "D15",
+        "D16", "D17", "D18", "D19", "D20", "D21", "D22", "D23",
+        "D24", "D25", "D26", "D27", "D28", "D29", "D30", "D31",
+        "flags"
+    };
+    @Override public String[] regs() { return REGS; }
+
+    // from (x0-x30)
+    // General purpose register mask: pointers and ints, not floats
+    static final long RD_BITS = 0xFFFFFFFFL;
+    static final RegMask RMASK = new RegMask(RD_BITS);
+    static final long WR_BITS = 0x7FFFFFFFL; // All the GPRs, not RSP
+    static final RegMask WMASK = new RegMask(WR_BITS);
+
+    // Float mask from(d0–d31)
+    static final long FP_BITS = 0xFFFFFFFFL<<D0;
+    static final RegMask DMASK = new RegMask(FP_BITS);
+
+    // Load/store mask; both GPR and FPR
+    static final RegMask MEM_MASK = new RegMask(WR_BITS | FP_BITS);
+
+    static final RegMask SPLIT_MASK = new RegMask(WR_BITS | FP_BITS, -2L/*skip flags*/);
+
+    static final RegMask FLAGS_MASK = new RegMask(FLAGS);
+
+    // Arguments masks
+    static final RegMask X0_MASK = new RegMask(X0);
+    static final RegMask X1_MASK = new RegMask(X1);
+    static final RegMask X2_MASK = new RegMask(X2);
+    static final RegMask X3_MASK = new RegMask(X3);
+    static final RegMask X4_MASK = new RegMask(X4);
+    static final RegMask X5_MASK = new RegMask(X5);
+    static final RegMask X6_MASK = new RegMask(X6);
+    static final RegMask X7_MASK = new RegMask(X7);
+
+    // Arguments(float) masks
+    static final RegMask D0_MASK = new RegMask(D0);
+    static final RegMask D1_MASK = new RegMask(D1);
+    static final RegMask D2_MASK = new RegMask(D2);
+    static final RegMask D3_MASK = new RegMask(D3);
+    static final RegMask D4_MASK = new RegMask(D4);
+    static final RegMask D5_MASK = new RegMask(D5);
+    static final RegMask D6_MASK = new RegMask(D6);
+    static final RegMask D7_MASK = new RegMask(D7);
+
+    // Calling convention; returns a machine-specific register
+    // for incoming argument idx.
+    // index 0 for control, 1 for memory, real args start at index 2
+    static final RegMask[] CALLINMASK = new RegMask[] {
+        X0_MASK,
+        X1_MASK,
+        X2_MASK,
+        X3_MASK,
+        X4_MASK,
+        X5_MASK,
+        X6_MASK,
+        X7_MASK,
+    };
+    static final RegMask[] XMMS = new RegMask[] {
+        D0_MASK,
+        D1_MASK,
+        D2_MASK,
+        D3_MASK,
+        D4_MASK,
+        D5_MASK,
+        D6_MASK,
+        D7_MASK,
+    };
+
+    // ARM ENCODING
+
+    // True if signed 9-bit immediate
+    private static boolean imm9(TypeInteger ti) {
+        // 55 = 64-9
+        return ti.isConstant() && ((ti.value()<<55)>>55) == ti.value();
+    }
+    // True if signed 12-bit immediate
+    private static boolean imm12(TypeInteger ti) {
+        // 52 = 64-12
+        return ti.isConstant() && ((ti.value()<<52)>>52) == ti.value();
+    }
+
+    // Can we encode this in ARM's 12-bit LOGICAL immediate form?
+    // Some combination of shifted bit-masks.
+    private static int imm12Logical(TypeInteger ti) {
+        return ti.isConstant() ? Arm64.logicalImmediate(ti.value()) : -1;
+    }
+
+    public static void imm_inst(Encoding enc, Node n,Node n2,  int opcode, int imm12) {
+        short self = enc.reg(n);
+        short reg1 = enc.reg(n2);
+
+        // ADD/SUB encode an unsigned magnitude; switch operation for a negative addend.
+        if( imm12<0 && (opcode==OPI_ADD || opcode==OPI_SUB) ) {
+            opcode ^= OPI_ADD ^ OPI_SUB;
+            imm12 = -imm12;
+        }
+        int body = Arm64.imm_inst(opcode, imm12&0xFFF, reg1, self);
+        enc.add4(body);
+    }
+
+    public static void imm_inst_subs(Encoding enc, Node n,Node n2,  int opcode, int imm12) {
+        short reg1 = enc.reg(n2);
+        // 31 = 11111
+        int body = Arm64.imm_inst(opcode, imm12&0xFFF, reg1, 31);
+        enc.add4(body);
+    }
+
+    // for cases where rs1 and dst are the same, eg add x0, x0, 1
+    public static void imm_inst(Encoding enc, int opcode, int imm12, int self) {
+        int body = Arm64.imm_inst(opcode, imm12&0xFFF, self, self);
+        enc.add4(body);
+    }
+
+    public static void imm_inst_n(Encoding enc, Node n, Node n2, int opcode, int imm13) {
+        short self = enc.reg(n);
+        short reg1 = enc.reg(n2);
+        int body = Arm64.imm_inst_n(opcode, imm13, reg1, self);
+        enc.add4(body);
+    }
+
+    // for cases where rs1 and dst are the same, eg add x0, x0, 1
+    public static int imm_inst_l(Encoding enc, Node n, int opcode, int imm12) {
+        short self = enc.reg(n);
+        short reg1 = enc.reg(n.in(1));
+        int body = Arm64.imm_inst(opcode, imm12&0xFFF, reg1, self);
+        return body;
+    }
+
+    // for normal add, reg1, reg2 cases (reg-to-reg)
+    // using shifted-reg form
+
+    public static void r_reg(Encoding enc, Node n, int opcode) {
+        short self = enc.reg(n);
+        short reg1 = enc.reg(n.in(1));
+        short reg2 = enc.reg(n.in(2));
+        int body = Arm64.r_reg(opcode, 0, reg2, 0,  reg1, self >= 32 ? reg1: self);
+        enc.add4(body);
+    }
+
+    public static void r_reg_subs(Encoding enc, Node n, int opcode) {
+        short reg1 = enc.reg(n.in(1));
+        short reg2 = enc.reg(n.in(2));
+        // 31 = 11111
+        int body = Arm64.r_reg(opcode, 0, reg2, 0,  reg1, 31);
+        enc.add4(body);
+    }
+
+    public static void shift_reg(Encoding enc, Node n, int op2) {
+        short self = enc.reg(n);
+        short reg1 = enc.reg(n.in(1));
+        short reg2 = enc.reg(n.in(2));
+        int body = Arm64.shift_reg(0b10011010110, reg2, op2, reg1, self);
+        enc.add4(body);
+    }
+
+    //  MUL can be considered an alias for MADD with the third operand Ra being set to 0
+
+    public static void madd(Encoding enc, Node n, int opcode, int ra) {
+        short self = enc.reg(n);
+        short reg1 = enc.reg(n.in(1));
+        short reg2 = enc.reg(n.in(2));
+        int body = Arm64.madd(opcode, reg2, ra,  reg1, self);
+        enc.add4(body);
+    }
+
+    public static void f_scalar(Encoding enc, Node n, int op ) {
+        short self = (short)(enc.reg(n)      -D_OFFSET);
+        short reg1 = (short)(enc.reg(n.in(1))-D_OFFSET);
+        short reg2 = (short)(enc.reg(n.in(2))-D_OFFSET);
+        int body = Arm64.f_scalar(0b00011110, 1, reg2, op,  reg1, self);
+        enc.add4(body);
+    }
+
+    public static void patch_adrp_add(Encoding enc, int opStart, int delta, int rd) {
+        int target = opStart + delta;
+        int pageDelta = ((target & ~0xFFF) - (opStart & ~0xFFF)) >> 12;
+        int imm21 = pageDelta & 0x1FFFFF;
+        enc.patch4(opStart  , Arm64.adrp(1, imm21 & 3, OP_ADRP, imm21 >>> 2, rd));
+        enc.patch4(opStart+4, Arm64.imm_inst_l(OPI_ADD, target & 0xFFF, rd));
+    }
+
+    public static void f_cmp(Encoding enc, Node n) {
+        short reg1 = (short)(enc.reg(n.in(1))-D_OFFSET);
+        short reg2 = (short)(enc.reg(n.in(2))-D_OFFSET);
+        int body = Arm64.f_cmp(0b00011110, 3, reg2,  reg1);
+        enc.add4(body);
+    }
+
+    @Override public RegMask callArgMask(TypeFunPtr tfp, int idx, int maxArgSlot ) { return callInMask(tfp,idx,maxArgSlot); }
+    static RegMask callInMask(TypeFunPtr tfp, int idx, int maxArgSlot ) {
+        if( idx==0 ) return CodeGen.CODE._rpcMask;
+        if( idx==1 ) return null;
+        // Count floats in signature up to index
+        if( idx-2 >= tfp.nargs() ) return null; // Anti-dependence
+        boolean hidden = hiddenSelf(tfp);
+        int sigidx = idx-2;
+        if( hidden ) {
+            if( sigidx==0 ) return null;
+            sigidx--;
+        }
+        // Count floats in signature up to index
+        int fcnt=0;
+        for( int i=hidden ? 1 : 0; i<idx-2; i++ )
+            if( tfp.arg(i) instanceof TypeFloat)
+                fcnt++;
+        // Floats up to XMMS in XMM registers
+        if( tfp.arg(idx-2) instanceof TypeFloat ) {
+            if( fcnt < XMMS.length )
+                return XMMS[fcnt];
+        } else {
+            RegMask[] cargs = CALLINMASK;
+            if( sigidx-fcnt < cargs.length )
+                return cargs[sigidx-fcnt];
+        }
+        // Pass on stack slot (8 and higher)
+        if( maxArgSlot>0 ) throw Utils.TODO();
+        return new RegMask(MAX_REG + 1 + sigidx);
+    }
+
+    // Return the max stack slot used by this signature, or 0
+    @Override public short maxArgSlot( TypeFunPtr tfp ) {
+        int icnt=0, fcnt=0;     // Count of ints, floats
+        for( int i=hiddenSelf(tfp) ? 1 : 0; i<tfp.nargs(); i++ ) {
+            if( tfp.arg(i) instanceof TypeFloat ) fcnt++;
+            else icnt++;
+        }
+        int nstk = Math.max(icnt-8,0)+Math.max(fcnt-8,0);
+        return (short)nstk;
+    }
+    private static boolean hiddenSelf(TypeFunPtr tfp) {
+        return tfp.nargs() > 0 && tfp.arg(0) == TypePtr.PTR;
+    }
+
+    private static final long CALLEE_SAVE =
+        1L<<X19 |
+        1L<<X20 | 1L<<X21 | 1L<<X22 | 1L<<X23 |
+        1L<<X24 | 1L<<X25 | 1L<<X26 | 1L<<X27 |
+        1L<<X28 |
+        1L<<D9  | 1L<<D10 | 1L<<D11 |
+        1L<<D12 | 1L<<D13 | 1L<<D14 | 1L<<D15;
+    static final long CALLER_SAVE = ~CALLEE_SAVE & ~(1L<<RSP);
+    @Override public long callerSave() { return CALLER_SAVE; }
+    @Override public long neverSave() { return 1L<<RSP; }
+    @Override public RegMask retMask( TypeFunPtr tfp ) {
+        return tfp.ret() instanceof TypeFloat ? D0_MASK : X0_MASK;
+    }
+    @Override public int rpc() { return X30; }
+
+    // Create a split op; any register to any register, including stack slots
+    @Override public SplitNode split(LRG lrg, String kind, byte round) {
+        RegMask def = lrg._machDef==null ? null : lrg._machDef.outregmap(), use = lrg.useMask();
+        if( (def!=null && def.size1() && def.test(FLAGS)) ||
+            (use!=null && use.size1() && use.test(FLAGS)) )
+            return new SplitFlagsARM(lrg,kind,round);
+        // Spilling the saved flags requires a GPR between NZCV and the stack.
+        if( lrg._machDef instanceof SplitFlagsARM || lrg._machDef instanceof SplitGPRARM )
+            return new SplitGPRARM(lrg,kind,round);
+        return new SplitARM(lrg,kind,round);
+    }
+
+    // Return a MachNode unconditional branch
+    @Override public CFGNode jump() {
+        return new UJmpARM();
+    }
+
+    // Instruction selection
+    @Override public Node instSelect(Node n ) {
+        return switch( n ) {
+        case AddNode add     -> add(add);
+        case AndNode and     -> and(and);
+        case BoolNode bool   -> cmp(bool);
+        case CallNode call   -> call(call);
+        case PtrToIntNode ptr -> new PtrToIntMach(ptr);
+        case GuardNode guard -> new GuardMach(guard);
+        case CallEndNode cend-> new CallEndMach(cend);
+        case CLInitNode init -> new CLInitNode(init);
+        case CProjNode c     -> new CProjNode(c);
+        case ConstantNode con-> con(con);
+        case DivNode div     -> div.mode()==2 ? new DivFARM(div) : new DivARM(div);
+        case EscapeNode esc  -> new EscapeNode(esc);
+        case FunNode fun     -> new FunARM(fun);
+        case FunPtrNode  fptr -> fptr(fptr);
+        case IfNode iff      -> jmp(iff);
+        case LoadNode ld     -> ld(ld);
+        case MemMergeNode mem-> new MemMergeNode(mem);
+        case MinusNode neg   -> {
+            if( neg.mode()==2 ) throw Utils.TODO();
+            yield new NegARM(neg);
+        }
+        case MulNode mul     -> mul.mode()==2 ? new MulFARM(mul) : new MulARM(mul);
+        case NewNode nnn     -> new NewARM(nnn);
+        case NotNode not     -> new NotARM(not);
+        case OrNode or       -> or(or);
+        case ParmNode parm   -> new ParmARM(parm);
+        case BulkMemPhiNode phi -> new BulkMemPhiNode(phi);
+        case MemPhiNode phi  -> new MemPhiNode(phi);
+        case PhiNode phi     -> new PhiNode(phi);
+        case ProjNode prj    -> prj(prj);
+        case ReadOnlyNode read -> new ReadOnlyMach(read);
+        case ReturnNode ret  -> new RetARM(ret,ret.fun());
+        case SarNode sar     -> asr(sar);
+        case ShlNode shl     -> lsl(shl);
+        case ShrNode shr     -> lsr(shr);
+        case StartCUNode start -> new StartCUNode(start);
+        case StopCUNode stop   -> new StopCUNode(stop);
+        case StartNode start -> new StartNode(start);
+        case StopNode stop   -> new StopNode(stop);
+        case StoreNode st    -> st(st);
+        case SubNode sub     -> sub.mode()==2 ? new SubFARM(sub) : sub(sub);
+        case ToFloatNode tfn -> new I2F8ARM(tfn);
+        case ToIntegerNode cvt -> new F8ToIARM(cvt);
+        case XorNode xor     -> xor(xor);
+
+        case LoopNode loop   -> new LoopNode(loop);
+        case RegionNode region-> new RegionNode(region);
+        default -> throw Utils.TODO();
+        };
+    }
+
+    private Node cmp(BoolNode bool){
+        Node cmp = _cmp(bool);
+        return new SetARM(cmp, bool.op(), cmp instanceof CmpFARM);
+    }
+    private Node _cmp(BoolNode bool) {
+        if( bool.isFloat() )
+            return new CmpFARM(bool);
+        return bool.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti
+                ? new CmpIARM(bool, (int)ti.value())
+                : new CmpARM(bool);
+    }
+
+    private Node ld(LoadNode ld) {
+        return new LoadARM(address(ld), ld.ptr(), idx, off);
+    }
+
+    private Node jmp(IfNode iff) {
+        // If/Bool combos will match to a Cmp/Set which sets flags.
+        // Most general arith ops will also set flags, which the Jmp needs directly.
+        // Loads do not set the flags, and will need an explicit TEST
+        String op = "!=";
+        boolean fp = false;
+        if( iff.in(1) instanceof BoolNode bool ) { op = bool.op(); fp = bool.isFloat(); }
+        else if( iff.in(1)==null ) op = "=="; // Never-node cutout
+        else iff.setDef(1, new BoolNode.NE(iff.in(1),
+                                           ConstantNode.raw(TypeInteger.ZERO),
+                                           (byte)(iff.in(1)._type instanceof TypeFloat ? 2 : 1)));
+        return new BranchARM(iff, op, fp);
+    }
+
+    private Node add(AddNode add) {
+        if( add.mode()==2 )
+            return new AddFARM(add);
+        return add.in(2) instanceof ConstantNode off && off._con instanceof TypeInteger ti && imm12(ti)
+                ? new AddIARM(add, (int)ti.value())
+                : new AddARM(add);
+    }
+
+    private Node sub(SubNode sub) {
+        return sub.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm12(ti)
+                ? new SubIARM(sub, (int)(ti.value()))
+                : new SubARM(sub);
+    }
+
+    private Node con( ConstantNode con ) {
+        if( !con._con.isConstant() )
+            return ConstantNode.raw(con); // Default unknown caller inputs
+        String ext = con instanceof ExternNode ext0 ? ext0._extern : null;
+        return switch( con._con ) {
+        case TypeInteger ti -> new IntARM(con,ext);
+        case TypeFloat   tf -> new FltARM(con,ext);
+        case TypeMemPtr tmp -> new TMPARM(con,ext);
+        case TypeFunPtr tfp -> new TFPARM(tfp,ext);
+        case TypeNil tn  -> throw Utils.TODO();
+        // TOP, BOTTOM, XCtrl, Ctrl, etc.  Never any executable code.
+        case Type t -> t==Type.NIL ? new IntARM(con,ext) : ConstantNode.raw(con);
+        };
+    }
+
+    private Node fptr( FunPtrNode con ) {
+        return new TFPARM(con);
+    }
+
+    private Node call(CallNode call){
+        return call.fptr() instanceof FunPtrNode fptr
+            ? new CallARM(call, (TypeFunPtr)fptr._type)
+            : call.fptr() instanceof ConstantNode con
+            ? new CallARM(call, (TypeFunPtr)con._type)
+            : new CallRRARM(call);
+    }
+
+    private Node or(OrNode or) {
+        int imm12;
+        return or.in(2) instanceof ConstantNode off && off._con instanceof TypeInteger ti && (imm12 = imm12Logical(ti)) != -1
+                ? new OrIARM(or, imm12)
+                : new OrARM(or);
+    }
+
+    private Node xor(XorNode xor) {
+        int imm12;
+        return xor.in(2) instanceof ConstantNode off && off._con instanceof TypeInteger ti && (imm12 = imm12Logical(ti)) != -1
+                ? new XorIARM(xor, imm12)
+                : new XorARM(xor);
+    }
+
+    private Node and(AndNode and) {
+        int imm12;
+        return and.in(2) instanceof ConstantNode off && off._con instanceof TypeInteger ti && (imm12 = imm12Logical(ti)) != -1
+                ? new AndIARM(and, imm12)
+                : new AndARM(and);
+    }
+
+    private Node asr(SarNode asr) {
+        return asr.in(2) instanceof ConstantNode off && off._con instanceof TypeInteger ti && ti.value() >= 0 && ti.value() < 63
+                ? new AsrIARM(asr, (int)ti.value())
+                : new AsrARM(asr);
+    }
+
+    private Node lsl(ShlNode lsl) {
+        return lsl.in(2)  instanceof ConstantNode off && off._con instanceof TypeInteger ti && ti.value() >= 0 && ti.value() < 63
+                ? new LslIARM(lsl, (int)ti.value())
+                : new LslARM(lsl);
+    }
+
+    private Node lsr(ShrNode lsr) {
+        return lsr.in(2)  instanceof ConstantNode off && off._con instanceof TypeInteger ti && ti.value() >= 0 && ti.value() < 63
+                ? new LsrIARM(lsr, (int)ti.value())
+                : new LsrARM(lsr);
+    }
+
+    private Node prj(ProjNode prj) {
+        if( prj.in(0) instanceof CLInitNode ) return new ProjNode(prj);
+        TypeInteger ret = cReturn(prj);
+        if( ret!=null ) return new ExtendARM(prj,ret);
+        return prj.in(0) instanceof StartNode ? new ProjNode(prj) : new ProjARM(prj);
+    }
+
+    private static int off;
+    private static Node idx;
+    private Node st(StoreNode st) {
+        return new StoreARM(address(st),st.ptr(),idx,off,st.val());
+    }
+
+    // Gather addressing mode bits prior to constructing.  This is a builder
+    // pattern, but saving the bits in a *local* *global* here to keep mess
+    // contained.
+    private <N extends MemOpNode> N address(N mop ) {
+        off = 0;  // Reset
+        idx = null;
+        Node base = mop.ptr();
+        // Skip/throw-away a ReadOnly, only used to typecheck
+        if( base instanceof ReadOnlyNode read ) base = read.in(1);
+        assert !(base instanceof AddNode) && base._type instanceof TypeMemPtr; // Base ptr always, not some derived
+        if( mop.off() instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm9(ti) ) {
+            off = (int)ti.value();
+            assert off == ti.value(); // In 32-bit range
+        } else {
+            idx = mop.off();
+        }
+        return mop;
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AUIPC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AUIPC.java
new file mode 100644
index 00000000..59bad64e
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AUIPC.java
@@ -0,0 +1,42 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.node.FunPtrNode;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+// Add upper 20bits to PC.  Immediate comes from the relocation info.
+public class AUIPC extends FunPtrNode implements MachNode, RIPRelSize {
+    AUIPC( FunPtrNode fptr ) { super(fptr); }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public boolean isClone() { return true; }
+    @Override public AUIPC copy() { return new AUIPC(this); }
+    @Override public String op() { return "auipc"; }
+    @Override public void encoding( Encoding enc ) {
+        enc.relo(this);
+        short dst = enc.reg(this);
+        enc.add4(RiscV.u_type(RiscV.OP_AUIPC, dst, 0));
+    }
+
+    // Delta is from opcode start, but X86 measures from the end of the 5-byte encoding
+    @Override public byte encSize(int delta) { return 4; }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        //short rpc = enc.reg(this);
+        //// High half is where the TFP constant used to be, the last input
+        //short auipc = enc.reg(in(_inputs._len-1));
+        //enc.patch4(opStart,RiscV.i_type(0x67, rpc, 0, auipc, delta));
+        throw Utils.TODO();
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        String reg = code.reg(this);
+        sb.p(reg).p(" = PC+#");
+        _type.print(sb);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AddFRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AddFRISC.java
new file mode 100644
index 00000000..d87e49b9
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AddFRISC.java
@@ -0,0 +1,18 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// fadd.d
+public class AddFRISC extends MachConcreteNode implements MachNode {
+    AddFRISC(Node addf) {super(addf);}
+    @Override public String op() { return "addf"; }
+    @Override public RegMask regmap(int i) { assert i==1 || i==2; return riscv.FMASK; }
+    @Override public RegMask outregmap() { return riscv.FMASK; }
+    @Override public void encoding( Encoding enc ) { riscv.rf_type(enc,this,RiscV.RM.RNE,1); }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" + ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AddIRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AddIRISC.java
new file mode 100644
index 00000000..8012b61e
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AddIRISC.java
@@ -0,0 +1,22 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.Utils;
+
+public class AddIRISC extends ImmRISC {
+    // Used to inst-selection as a direct match against an ideal Add/Sub
+    public AddIRISC( Node add, int imm12, boolean pop ) { super(add,imm12,pop); }
+    @Override public String op() { return "addi"; }
+    @Override public String glabel() { return "+"; }
+    @Override int opcode() {  return RiscV.OP_IMM; }
+    @Override int func3() {return 0;}
+    @Override public AddIRISC copy() {
+        // Clone the AddI, using the same inputs-only code used during inst select.
+        // Output edges are missing.
+        AddIRISC add = new AddIRISC(in(1),_imm12,false);
+        // Copys happen when output edges should be valid, so correct missing output edges.
+        in(1)._outputs.add(add);
+        return add;
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AddRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AddRISC.java
new file mode 100644
index 00000000..7010916f
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AddRISC.java
@@ -0,0 +1,21 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class AddRISC extends MachConcreteNode implements MachNode {
+    public AddRISC( Node add ) { super(add); }
+    AddRISC( Node base, Node off ) {
+        super(new Node[3]);
+        _inputs.set(1,base);
+        _inputs.set(2,off );
+    }
+    @Override public String op() { return "add"; }
+    @Override public RegMask regmap(int i) { return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public void encoding( Encoding enc ) { riscv.r_type(enc,this,0,0);  }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" + ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AndIRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AndIRISC.java
new file mode 100644
index 00000000..9fd65e7d
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AndIRISC.java
@@ -0,0 +1,13 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.Utils;
+
+public class AndIRISC extends ImmRISC {
+    public AndIRISC( Node and, int imm) { super(and,imm); }
+    @Override public String op() { return "andi"; }
+    @Override public String glabel() { return "&"; }
+    @Override int opcode() {  return RiscV.OP_IMM; }
+    @Override int func3() {return 7;}
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AndRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AndRISC.java
new file mode 100644
index 00000000..1845985e
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/AndRISC.java
@@ -0,0 +1,16 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class AndRISC extends MachConcreteNode implements MachNode {
+    public AndRISC(Node and) { super(and); }
+    @Override public String op() { return "and"; }
+    @Override public RegMask regmap(int i) { return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public void encoding( Encoding enc ) { riscv.r_type(enc,this,0b111,0);  }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" & ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/BranchRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/BranchRISC.java
new file mode 100644
index 00000000..a9d03da5
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/BranchRISC.java
@@ -0,0 +1,95 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+// Conditional branch such as: BEQ
+public class BranchRISC extends IfNode implements MachNode, RIPRelSize {
+    String _bop;
+    // label is obtained implicitly
+    public BranchRISC( IfNode iff, String bop, Node n1, Node n2 ) {
+        super(iff);
+        _bop = bop;
+        _inputs.setX(1,n1);
+        _inputs.setX(2,n2);
+    }
+
+    @Override public String op() { return "b"+_bop; }
+    @Override public String label() { return op(); }
+    @Override public String comment() { return "L"+cproj(1)._nid; }
+    @Override public RegMask regmap(int i) { return riscv.RMASK; }
+    @Override public RegMask outregmap() { return null; }
+    @Override public void negate() {
+        _bop = negate(_bop);
+        // Cannot encode ">" or "<=", so flip these
+        if( _bop.equals(">") || _bop.equals("<=") ) {
+            swap12();           // Cannot negate the test, so swap the operands
+            _bop = swap(_bop);  // Swap test to match
+        }
+    }
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        p.p("if( ");
+        if( in(1)==null ) p.p("0");
+        else p.n(in(1));
+        p.p(_bop);
+        if( in(2)==null ) p.p("0");
+        else p.n(in(2));
+        return p.p(" )");
+    }
+
+    @Override public void encoding( Encoding enc ) {
+        if( in(1)==null && _bop=="!=" ) return; // Inverted never-node, no code
+        enc.jump(this,cproj(0));
+        if( in(1)==null )       // Never node
+            enc.add4(RiscV.j_type(RiscV.OP_JAL, 0, 0));
+        else {
+            // Todo: relocs (for offset - immf)
+            short src1 = enc.reg(in(1));
+            short src2 = in(2)==null ? (short)riscv.ZERO : enc.reg(in(2));
+            enc.add4(RiscV.b_type(RiscV.OP_BRANCH, RiscV.jumpop(_bop), src1, src2, 0));
+        }
+    }
+
+    // Delta is from opcode start
+    @Override public byte encSize(int delta) {
+        if( in(1)==null && _bop=="!=" ) return 0; // Inverted never-node, no code
+        if( -4*1024 <= delta && delta < 4*1024 ) return 4;
+        // 2 word encoding needs a tmp register, must teach RA
+        throw Utils.TODO();
+    }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        assert !( in(1)==null && _bop=="!=" ); // Inverted never-node, no code no patch
+        if( in(1)==null ) {     // Never node
+            enc.patch4(opStart,RiscV.j_type(RiscV.OP_JAL, 0, delta));
+        } else {
+            short src1 = enc.reg(in(1));
+            short src2 = in(2)==null ? (short)riscv.ZERO : enc.reg(in(2));
+            if( opLen==4 ) {
+                enc.patch4(opStart,RiscV.b_type(RiscV.OP_BRANCH, RiscV.jumpop(_bop), src1, src2, delta));
+            } else {
+                throw Utils.TODO();
+            }
+        }
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        if( in(1)==null && _bop=="!=" ) {
+            sb.p("never");
+            return;
+        }
+        String src1 = in(1)==null ? "#0" : code.reg(in(1));
+        String src2 = in(2)==null ? "#0" : code.reg(in(2));
+        sb.p(src1).p(" ").p(_bop).p(" ").p(src2).p(" ");
+        CFGNode prj = cproj(0).uctrlSkipEmpty();
+        if( !prj.blockHead() ) prj = prj.cfg0();
+        sb.p(label(prj));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/CallRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/CallRISC.java
new file mode 100644
index 00000000..b1426a3f
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/CallRISC.java
@@ -0,0 +1,62 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.TypeFunPtr;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class CallRISC extends CallNode implements MachNode, RIPRelSize {
+    final TypeFunPtr _tfp;
+    final String _name;
+    CallRISC( CallNode call, TypeFunPtr tfp ) {
+        super(call);
+        assert tfp.isConstant();
+        _inputs.pop(); // Pop constant target
+        _tfp = tfp;
+        _name = CodeGen.CODE.funcName(tfp.fidx());
+    }
+
+    @Override public String op() { return "call"; }
+    @Override public String label() { return op(); }
+    @Override public String name() { return _name; }
+    @Override public TypeFunPtr tfp() { return _tfp; }
+    @Override public RegMask regmap(int i) { return riscv.callInMask(_tfp,i,fun()._maxArgSlot); }
+    @Override public RegMask outregmap() { return riscv.RPC_MASK; }
+    @Override public int nargs() { return nIns()-2; } // Minus control, memory, fptr
+
+    @Override public void encoding( Encoding enc ) {
+        // Short form +/-4K:  beq r0,r0,imm12
+        // Long form:  auipc rX,imm20/32; jal r0,[rX+imm12/32]
+        FunNode fun = CodeGen.CODE.link(_tfp);
+        if( fun==null ) enc.external(this,_name);
+        else enc.relo(this);
+        short rpc = enc.reg(this);
+        enc.add4(RiscV.j_type(RiscV.OP_JAL, rpc, 0));
+    }
+
+    // Delta is from opcode start
+    @Override public byte encSize(int delta) {
+        if( -(1L<<20) <= delta && delta < (1L<<20) ) return 4;
+        // 2 word encoding needs a tmp register, must teach RA
+        throw Utils.TODO();
+    }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        short rpc = enc.reg(this);
+        if( opLen==4 ) {
+            enc.patch4(opStart,RiscV.j_type(RiscV.OP_JAL, rpc, delta));
+        } else {
+            throw Utils.TODO();
+        }
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(_name).p("  ");
+        for( int i=0; i<nargs(); i++ )
+            sb.p(code.reg(arg(i+2))).p(", ");
+        sb.unchar(2);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/CallRRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/CallRRISC.java
new file mode 100644
index 00000000..68f1016a
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/CallRRISC.java
@@ -0,0 +1,35 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.TypeFunPtr;
+import com.seaofnodes.simple.util.SB;
+
+public class CallRRISC extends CallNode implements MachNode {
+    final TypeFunPtr _tfp;
+    CallRRISC( CallNode call ) { super(call); _tfp = call.tfp(); }
+    @Override public TypeFunPtr tfp() { return _tfp; }
+    @Override public String op() { return "callr"; }
+    @Override public String label() { return op(); }
+    @Override public RegMask regmap(int i) {
+        return i==_inputs._len-1
+            ? riscv.RMASK                // Function call target
+            : riscv.callInMask(tfp(),i,fun()._maxArgSlot); // Normal argument
+    }
+    @Override public RegMask outregmap() { return riscv.RPC_MASK; }
+
+    @Override public void encoding( Encoding enc ) {
+        short rpc = enc.reg(this);
+        short src = enc.reg(in(_inputs._len-1));
+        int body = RiscV.i_type(RiscV.OP_JALR, rpc, 0, src, 0);
+        enc.add4(body);
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(fptr())).p("  ");
+        for( int i=0; i<nargs(); i++ )
+            sb.p(code.reg(arg(i))).p(", ");
+        sb.unchar(2);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/DivFRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/DivFRISC.java
new file mode 100644
index 00000000..8eb4fb3b
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/DivFRISC.java
@@ -0,0 +1,20 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// fdiv.d
+public class DivFRISC extends MachConcreteNode implements MachNode{
+    DivFRISC(Node divf) {super(divf);}
+    @Override public String op() { return "divf"; }
+    @Override public RegMask regmap(int i) { assert i==1 || i==2; return riscv.FMASK; }
+    @Override public RegMask outregmap() { return riscv.FMASK; }
+    @Override public void encoding( Encoding enc ) { riscv.rf_type(enc,this,RiscV.RM.RUP,13); }
+    // Default on double precision for now(64 bits)
+    // General form: "fdiv.d  rd = src1 / src2
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" / ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/DivRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/DivRISC.java
new file mode 100644
index 00000000..515ffa47
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/DivRISC.java
@@ -0,0 +1,17 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+
+public class DivRISC extends MachConcreteNode implements MachNode{
+    public DivRISC(Node div) {super(div);}
+    @Override public String op() { return "div"; }
+    @Override public RegMask regmap(int i) { return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public void encoding( Encoding enc ) { riscv.r_type(enc,this,4,1);  }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" / ").p(code.reg(in(2)));
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/ExtendRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/ExtendRISC.java
new file mode 100644
index 00000000..5bd3ec1c
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/ExtendRISC.java
@@ -0,0 +1,32 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.util.SB;
+
+// Convert a narrow C return register to Simple's full-width integer value.
+public class ExtendRISC extends MachConcreteNode {
+    final int _bits;
+    final boolean _signed;
+    ExtendRISC(ProjNode prj, TypeInteger ret) {
+        super(prj);
+        _inputs.set(0,null);
+        _inputs.add(new ProjRISC(prj));
+        _bits = 8 << ret.log_size();
+        _signed = ret._min < 0;
+    }
+    @Override public String op() { return (_signed ? "sext" : "zext")+_bits; }
+    @Override public RegMask regmap(int i) { return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public void encoding(Encoding enc) {
+        short dst = enc.reg(this), src = enc.reg(in(1));
+        int shift = 64-_bits;
+        enc.add4(RiscV.i_type(RiscV.OP_IMM,dst,1,src,shift));
+        enc.add4(RiscV.i_type(RiscV.OP_IMM,dst,5,dst,shift | (_signed ? 0x400 : 0)));
+    }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/F8ToIRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/F8ToIRISC.java
new file mode 100644
index 00000000..a56ad216
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/F8ToIRISC.java
@@ -0,0 +1,19 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class F8ToIRISC extends MachConcreteNode implements MachNode {
+    F8ToIRISC(Node f8toi) {super(f8toi);}
+    @Override public String op() { return "cvti"; }
+    @Override public RegMask regmap(int i) { assert i==1; return riscv.FMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public void encoding( Encoding enc ) {
+        RiscV.floatToInteger(enc,enc.reg(this),enc.reg(in(1))-riscv.F_OFFSET);
+    }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p("(int)").p(code.reg(in(1)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/FltRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/FltRISC.java
new file mode 100644
index 00000000..a110d156
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/FltRISC.java
@@ -0,0 +1,48 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.ConstantNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.type.TypeFloat;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class FltRISC extends ConstantNode implements MachNode, RIPRelSize {
+    final String _ext;
+    FltRISC( ConstantNode con, String ext ) { super(con); _ext = ext; }
+    @Override public String op() { return "ld8"; }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return riscv.FMASK; }
+    @Override public boolean isClone() { return true; }
+    @Override public FltRISC copy() { return new FltRISC(this,_ext); }
+
+    @Override public void encoding( Encoding enc ) {
+        enc.largeConstant(this,_con, 0, -1);
+        short dst = (short)(enc.reg(this) - riscv.F_OFFSET);
+        short tmp = (short)riscv.T6;
+        // AUIPC dst,#hi20_constant_pool
+        enc.add4(RiscV.u_type(RiscV.OP_AUIPC, tmp, 0));
+        // Load dst,[dst+#low12_constant_pool]
+        enc.add4(RiscV.i_type(RiscV.OP_LOADFP, dst, 0b11, tmp, 0));
+    }
+    @Override public RegMask killmap() { return new RegMask(riscv.T6); }
+
+    // Delta is from opcode start.
+    @Override public byte encSize(int delta) { return 8;  }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        short dst = (short)(enc.reg(this) - riscv.F_OFFSET);
+        short tmp = (short)riscv.T6;
+        // AUIPC dst,#hi20_constant_pool
+        enc.patch4(opStart  , RiscV.u_type(RiscV.OP_AUIPC, tmp, delta>>12));
+        // Load dst,[dst+#low12_constant_pool]
+        enc.patch4(opStart+4, RiscV.i_type(RiscV.OP_LOADFP, dst, 0b11, tmp, delta & 0xFFF));
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        _con.print(sb.p(code.reg(this)).p(" = #"));
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/FunRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/FunRISC.java
new file mode 100644
index 00000000..d3d64b06
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/FunRISC.java
@@ -0,0 +1,23 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.FunNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class FunRISC extends FunNode implements MachNode {
+    FunRISC(FunNode fun) {super(fun);}
+    @Override public void computeFrameAdjust(CodeGen code, int maxReg) {
+        super.computeFrameAdjust(code,maxReg);
+        if( _hasCalls )         // If non-leaf, pad to 16b
+            _frameAdjust = ((_frameAdjust+8) & -16);
+    }
+    @Override public void encoding( Encoding enc ) {
+        int sz = _frameAdjust;
+        if( sz == 0 ) return; // Skip if no frame adjust
+        if( sz >= 1L<<12 ) throw Utils.TODO();
+        enc.add4(RiscV.i_type(RiscV.OP_IMM, riscv.RSP, 0, riscv.RSP, -sz & 0xFFF));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/I2F8RISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/I2F8RISC.java
new file mode 100644
index 00000000..1b53ab0f
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/I2F8RISC.java
@@ -0,0 +1,24 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// fcvt.d.w
+// Converts a 32-bit signed integer, in integer register rs1 into a double-precision floating-point number in floating-point register rd.
+public class I2F8RISC extends MachConcreteNode implements MachNode {
+    I2F8RISC(Node i2f8) {super(i2f8);}
+    @Override public String op() { return "cvtf"; }
+    @Override public RegMask regmap(int i) { assert i==1; return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.FMASK; }
+    @Override public void encoding( Encoding enc ) {
+        short dst  = (short)(enc.reg(this )-riscv.F_OFFSET);
+        short src1 =         enc.reg(in(1));
+        int body = RiscV.r_type(RiscV.OP_FP,dst,RiscV.RM.RNE.ordinal(),src1,0,0x69);
+        enc.add4(body);
+    }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p("(flt)").p(code.reg(in(1)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/ImmRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/ImmRISC.java
new file mode 100644
index 00000000..ee247c3e
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/ImmRISC.java
@@ -0,0 +1,55 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.util.SB;
+
+abstract public class ImmRISC extends MachConcreteNode implements MachNode {
+    public final int _imm12;
+    ImmRISC( Node add, int imm12, boolean pop ) {
+        super(add);
+        _imm12 = imm12;
+        // If pop, we are moving from an ideal Node to MachNode; the ideal Node
+        // inputs got copied here, but we are absorbing the immediate into the
+        // MachNode and so do not want the constant input.
+        if( pop ) _inputs.pop();
+        // if NOT pop, we are the 2nd-half of a 2-part expansion, reset the
+        // input edges to no-control
+        else { _inputs.set(0,null); _inputs.setX(1,add); }
+    }
+    ImmRISC( Node add, int imm12 ) { this(add,imm12,true); }
+    @Override public RegMask regmap(int i) { return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public boolean isClone() {
+        // Allow cloning of the 2nd half of a 2-part constant; this might
+        // trigger cloning the first part also.
+        return in(1) instanceof LUI || in(1) instanceof AUIPC;
+    }
+
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) {
+        int imm12 = (_imm12<<20)>>20; // Sign extend 12 bits
+        p.p("( ").n(in(1));
+        return p.p(String.format(" %s #%d )",glabel(),imm12));
+    }
+
+    abstract int opcode();
+    abstract int func3();
+
+    @Override public void encoding( Encoding enc ) {
+        short dst = enc.reg(this );
+        short src = enc.reg(in(1));
+        enc.add4(RiscV.i_type(opcode(), dst, func3(), src, _imm12 & 0xFFF));
+    }
+
+    // General form: "addi  rd = rs1 + imm"
+    @Override public void asm(CodeGen code, SB sb) {
+        int imm12 = (_imm12<<20)>>20; // Sign extend 12 bits
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" ").p(glabel()).p(" #").p(imm12);
+        if( in(1) instanceof LUI lui )
+            sb.p(" // #").hex4((int)(((TypeInteger)lui._con).value()) + imm12);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/Int8RISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/Int8RISC.java
new file mode 100644
index 00000000..dd4a02a3
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/Int8RISC.java
@@ -0,0 +1,49 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.ConstantNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+// Special instruction for loading 8 byte constants from the constant pool.
+
+public class Int8RISC extends ConstantNode implements MachNode, RIPRelSize {
+    final String _ext;
+    Int8RISC( ConstantNode con, String ext ) { super(con); _ext = ext; }
+    @Override public String op() { return "ld8"; }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public boolean isClone() { return true; }
+    @Override public Int8RISC copy() { return new Int8RISC(this,_ext); }
+
+    @Override public byte encSize(int delta) { return 8;  }
+
+    @Override public void encoding( Encoding enc ) {
+        if( _ext!=null ) throw Utils.TODO();
+        short dst  = enc.reg(this);
+        short tmp = (short)riscv.T6;
+        enc.largeConstant(this,_con, 0, -1);
+        // AUIPC dst,#hi20_constant_pool
+        enc.add4(RiscV.u_type(RiscV.OP_AUIPC, tmp, 0));
+        // Load dst,[dst+#low12_constant_pool]
+        enc.add4(RiscV.i_type(RiscV.OP_LOAD, dst, 0b11, tmp, 0));
+    }
+    @Override public RegMask killmap() { return new RegMask(riscv.T6); }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        short dst = enc.reg(this);
+        short tmp = (short)riscv.T6;
+        // AUIPC dst,#hi20_constant_pool
+        enc.patch4(opStart  , RiscV.u_type(RiscV.OP_AUIPC, tmp, delta>>12));
+        // Load dst,[dst+#low12_constant_pool]
+        enc.patch4(opStart+4, RiscV.i_type(RiscV.OP_LOAD, dst, 0b11, tmp, delta & 0xFFF));
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        _con.print(sb.p(code.reg(this)).p(" = #"));
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/IntRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/IntRISC.java
new file mode 100644
index 00000000..35d2bc65
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/IntRISC.java
@@ -0,0 +1,31 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.ConstantNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.util.SB;
+
+// 12-bit integer constant.  Larger constants are made up in the instruction
+// selection by adding with a LUI.
+public class IntRISC extends ConstantNode implements MachNode {
+    IntRISC(ConstantNode con) { super(con); }
+    @Override public String op() { return "ldi"; }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public boolean isClone() { return true; }
+    @Override public IntRISC copy() { return new IntRISC(this); }
+    @Override public void encoding( Encoding enc ) {
+        short dst  = enc.reg(this);
+        int val = _con==Type.NIL ? 0 : (int)(((TypeInteger)_con).value() & 0xFFF);
+        // Explicit truncation of larger immediates; this will sign-extend on
+        // load and this is handled during instruction selection.
+        enc.add4(RiscV.i_type(RiscV.OP_IMM, dst, 0, riscv.ZERO, val));
+    }
+    @Override public void asm(CodeGen code, SB sb) {
+        String reg = code.reg(this);
+        _con.print(sb.p(reg).p(" = #"));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/LUI.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/LUI.java
new file mode 100644
index 00000000..aedd8b47
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/LUI.java
@@ -0,0 +1,33 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.ConstantNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.util.SB;
+
+// Load upper 20bits.
+public class LUI extends ConstantNode implements MachNode {
+    public LUI( int imm20 ) {
+        super(TypeInteger.constant(imm20));
+        assert (imm20 & 0xFFF)==0;
+    }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public boolean isClone() { return true; }
+    @Override public LUI copy() { return new LUI((int)((TypeInteger)_con).value()); }
+    @Override public String op() { return "lui"; }
+    @Override public void encoding( Encoding enc ) {
+        long x = ((TypeInteger)_con).value();
+        int imm20 = (int)(x>>12) & 0xFFFFF;
+        short dst = enc.reg(this);
+        int lui = RiscV.u_type(RiscV.OP_LUI, dst, imm20);
+        enc.add4(lui);
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        String reg = code.reg(this);
+        sb.p(reg).p(" = #").hex4((int)(((TypeInteger)_con).value()));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/LoadRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/LoadRISC.java
new file mode 100644
index 00000000..e9f3ec02
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/LoadRISC.java
@@ -0,0 +1,65 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+// Load memory addressing on RISC
+// Support imm, reg(direct), or reg+off(indirect) addressing
+// Base = base - base pointer, offset is added to base
+// idx  = null
+// off  = off - imm12 added to base
+public class LoadRISC extends MemOpRISC {
+    public LoadRISC(LoadNode ld, Node base, int off) { super(ld, base, off, null); }
+    @Override public String op() { return "ld" +_sz; }
+    @Override public RegMask regmap(int i) { return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.MEM_MASK; }
+    @Override public void encoding( Encoding enc ) {
+        short dst = enc.reg(this );
+        short ptr = enc.reg(ptr());
+        int op = dst >= riscv.F_OFFSET ? RiscV.OP_LOADFP  : RiscV.OP_LOAD;
+        if( dst >= riscv.F_OFFSET  ) dst -= riscv.F_OFFSET;
+        enc.add4(RiscV.i_type(op, dst, func3(), ptr, _off));
+    }
+    @Override int func3() {
+        int func3 = -1;
+        // no unsigned flavour for store, so both signed and unsigned trigger the same
+        Type declType = _con;
+        if( declType == TypeInteger. I8 ) func3=0; // LB
+        if( declType == TypeInteger.I16 ) func3=1; // LH
+        if( declType == TypeInteger.I32 ) func3=2; // LW
+        if( declType == TypeInteger.BOT ) func3=3; // LD
+        if( declType == TypeInteger. U8 ) func3=4; // LBU
+        if( declType == TypeInteger.BOOL) func3=4; // LBU
+        if( declType == TypeInteger.U16 ) func3=5; // LHU
+        if( declType == TypeInteger.U32 ) func3=6; // LWU
+        if( declType instanceof TypeInteger ti ) {
+            if( -128 <= ti._min && ti._max < 128 ) func3 = 0; // LB
+        }
+
+        // float
+        if( declType == TypeFloat.F32) func3 = 2; // fLW   fSW
+        if( declType == TypeFloat.F64) func3 = 3; // fLD   fSD
+
+        if( declType instanceof TypeMemPtr) func3 = 3; // 8 byte pointers (pick ld)
+        if( declType instanceof TypeFunPtr) func3 = 3; // 8 byte function pointers
+        if( declType instanceof TypeConAry ary )
+            func3 = switch( ary.log_size() ) {
+            case 0 -> 4;         // LBU
+            case 1 -> 5;         // LHU
+            case 2 -> 2;         // LW
+            case 3 -> 3;         // LD
+            default -> throw Utils.TODO("RISC-V constant-array load for "+declType);
+            };
+        if( func3 == -1 ) throw Utils.TODO("RISC-V load for "+declType);
+        return func3;
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(",");
+        asm_address(code,sb);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/MemOpRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/MemOpRISC.java
new file mode 100644
index 00000000..e0bbc219
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/MemOpRISC.java
@@ -0,0 +1,51 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.*;
+
+public abstract class MemOpRISC extends MemOpNode implements MachNode {
+    final int _off;             // Limit 12 bits
+    final char _sz;
+    final int _bytes;
+    MemOpRISC(MemOpNode mop, Node base, int off, Node val) {
+        super(mop,mop);
+        assert base._type instanceof TypeMemPtr;
+        _inputs.setX(2, base ); // Base can be an Add, is no longer raw object base
+        _inputs.setX(3, null);  // Never an index
+        _inputs.setX(4, val );
+        _off = off;
+        _bytes = mop instanceof StoreNode st ? st.storeSize() : 1<<_con.log_size();
+        _sz = (char)('0'+_bytes);
+    }
+
+    @Override public String label() { return op(); }
+    Node val() { return in(4); } // Only for stores
+
+    @Override protected ExprPrinter<Node> _printMach(ExprPrinter<Node> p) { return p.p(".").p(_name); }
+
+    @Override public Type compute() { throw new AssertionError("Do not call compute on "+getClass().getSimpleName()); }
+    @Override public Node idealize() { throw new AssertionError("Do not call idealize on "+getClass().getSimpleName()); }
+
+    // func3 is based on load/store size and extend
+    abstract int func3();
+
+    // Register mask allowed on input i.
+    @Override public RegMask regmap(int i) {
+        // 0 - ctrl
+        // 1 - memory
+        if( i==2 ) return riscv.RMASK;    // base
+        // 2 - index
+        if( i==4 ) return riscv.MEM_MASK; // value
+        throw Utils.TODO();
+    }
+
+    SB asm_address(CodeGen code, SB sb) {
+        sb.p("[").p(code.reg(ptr())).p("+");
+        return sb.p(_off).p("]");
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/MulFRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/MulFRISC.java
new file mode 100644
index 00000000..dacec2b5
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/MulFRISC.java
@@ -0,0 +1,18 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// fmul.d
+public class MulFRISC extends MachConcreteNode implements MachNode {
+    MulFRISC(Node mulf) {super(mulf);}
+    @Override public String op() { return "mulf"; }
+    @Override public RegMask regmap(int i) { assert i==1 || i==2; return riscv.FMASK; }
+    @Override public RegMask outregmap() { return riscv.FMASK; }
+    @Override public void encoding( Encoding enc ) { riscv.rf_type(enc,this,RiscV.RM.RNE,9); }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" * ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/MulRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/MulRISC.java
new file mode 100644
index 00000000..9cb9ace7
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/MulRISC.java
@@ -0,0 +1,17 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// mulh signed multiply instruction(no-imm form)
+public class MulRISC extends MachConcreteNode implements MachNode{
+    public MulRISC(Node mul) {super(mul);}
+    @Override public String op() { return "mul"; }
+    @Override public RegMask regmap(int i) { assert i==1 || i==2; return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public void encoding( Encoding enc ) { riscv.r_type(enc,this,0,1);  }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" * ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/NegRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/NegRISC.java
new file mode 100644
index 00000000..3070c56c
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/NegRISC.java
@@ -0,0 +1,21 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class NegRISC extends MachConcreteNode implements MachNode {
+    public NegRISC( Node neg ) { super(neg); }
+    @Override public String op() { return "neg"; }
+    @Override public RegMask regmap(int i) { assert i==1; return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public void encoding( Encoding enc ) {
+        short dst = enc.reg(this );
+        short src = enc.reg(in(1));
+        RiscV.r_type(RiscV.OP,dst,0,0,src,0x20);
+    }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = -").p(code.reg(in(1)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/NewRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/NewRISC.java
new file mode 100644
index 00000000..40d0359c
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/NewRISC.java
@@ -0,0 +1,49 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.print.ASMPrinter;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class NewRISC extends NewNode implements MachNode, RIPRelSize {
+    // A pre-zeroed chunk of memory.
+    NewRISC( NewNode nnn ) { super(nnn); }
+    @Override public void encoding( Encoding enc ) {
+        // Generic external encoding; 2 ops.
+        enc.external(this,"calloc");
+        // A1 is a caller-save, allowed to crush building external address
+        // auipc
+        enc.add4(RiscV.i_type(RiscV.OP_IMM  , _arg2Reg , 0, riscv.ZERO, 1));
+        enc.add4(RiscV.u_type(RiscV.OP_AUIPC, riscv.A2 , 0));
+        enc.add4(RiscV.i_type(RiscV.OP_JALR , riscv.RPC, 0, riscv.A2, 0));
+    }
+
+    // Patch is for running "new" in a JIT.
+    // Delta is from opcode start
+    @Override public byte encSize(int delta) { return 4*3; }
+
+    // Patch is for running "new" in a JIT.
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        // Negative patches are JIT emulator targets.
+        if( opStart+delta < 0 ) {
+            delta -= 4;         // Offset from the AUIPC start
+            int imm20 = delta>>12;
+            if( ((delta>>11)&1)==1 ) imm20++; // Correct accidental sign extension
+            int imm12 = delta&0xFFF;
+            enc.patch4(opStart+4,RiscV.u_type(RiscV.OP_AUIPC, riscv.A2 , imm20));
+            enc.patch4(opStart+8,RiscV.i_type(RiscV.OP_JALR , riscv.RPC, 0, riscv.A2, imm12));
+        } else
+            throw Utils.TODO();
+    }
+
+    // General form: "alloc #bytes  PC"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p("\n");             // Multi-op trigger
+        sb.p("ldi   ").p(code._mach.regs()[_arg2Reg]).p(" = #1\n");
+        sb.p("auipc a2=#calloc\n");
+        sb.p("call  a2+#calloc");
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/NotRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/NotRISC.java
new file mode 100644
index 00000000..6f499db1
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/NotRISC.java
@@ -0,0 +1,22 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.MachConcreteNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.node.NotNode;
+import com.seaofnodes.simple.util.SB;
+
+public class NotRISC extends MachConcreteNode implements MachNode {
+    public NotRISC(NotNode not) { super(not); }
+    @Override public String op() { return "not"; }
+    @Override public RegMask regmap(int i) { return riscv.RMASK; }
+    @Override public RegMask outregmap()   { return riscv.WMASK; }
+    @Override public void encoding( Encoding enc ) {
+        short dst = enc.reg(this );
+        short src = enc.reg(in(1));
+        // SEQZ is unsigned: negative nonzero inputs must also produce false.
+        enc.add4(RiscV.i_type(RiscV.OP_IMM, dst, 3, src, 1));
+    }
+    @Override public void asm(CodeGen code, SB sb) { sb.p(code.reg(this)); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/OrIRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/OrIRISC.java
new file mode 100644
index 00000000..937595a3
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/OrIRISC.java
@@ -0,0 +1,13 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.Utils;
+
+public class OrIRISC extends ImmRISC {
+    public OrIRISC( Node and, int imm) { super(and,imm); }
+    @Override int opcode() {  return RiscV.OP_IMM; }
+    @Override int func3() {  return 6; }
+    @Override public String glabel() { return "|"; }
+    @Override public String op() { return "ori"; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/OrRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/OrRISC.java
new file mode 100644
index 00000000..a310a1f4
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/OrRISC.java
@@ -0,0 +1,16 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class OrRISC extends MachConcreteNode implements MachNode {
+    public OrRISC(Node or) { super(or); }
+    @Override public String op() { return "or"; }
+    @Override public RegMask regmap(int i) { return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public void encoding( Encoding enc ) { riscv.r_type(enc,this,6,0);  }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" | ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/ParmRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/ParmRISC.java
new file mode 100644
index 00000000..0f8db4e5
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/ParmRISC.java
@@ -0,0 +1,17 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.node.ParmNode;
+
+public class ParmRISC extends ParmNode implements MachNode {
+    final RegMask _rmask;
+    ParmRISC(ParmNode parm) {
+        super(parm);
+        _rmask = riscv.callInMask(fun().sig(),_idx,0);
+    }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return _rmask; }
+    @Override public void encoding( Encoding enc ) { }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/ProjRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/ProjRISC.java
new file mode 100644
index 00000000..2f9ac469
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/ProjRISC.java
@@ -0,0 +1,15 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.node.ProjNode;
+
+public class ProjRISC extends ProjNode implements MachNode {
+    ProjRISC(ProjNode p) { super(p); }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() {
+        return ((MachNode)in(0)).outregmap(_idx);
+    }
+    @Override public void encoding( Encoding enc ) { }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/RetRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/RetRISC.java
new file mode 100644
index 00000000..33143c6b
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/RetRISC.java
@@ -0,0 +1,22 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.node.FunNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.node.ReturnNode;
+import com.seaofnodes.simple.util.Utils;
+
+public class RetRISC extends ReturnNode implements MachNode {
+    public RetRISC(ReturnNode ret, FunNode fun) { super(ret, fun); fun.setRet(this); }
+    @Override public void encoding( Encoding enc ) {
+        int sz = fun()._frameAdjust;
+        if( sz >= 1L<<12 ) throw Utils.TODO();
+        if( sz != 0 )
+            enc.add4(RiscV.i_type(RiscV.OP_IMM, riscv.RSP, 0, riscv.RSP, sz & 0xFFF));
+        short rpc = enc.reg(rpc());
+        enc.add4(RiscV.i_type(RiscV.OP_JALR, riscv.ZERO, 0, rpc, 0));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SetFRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SetFRISC.java
new file mode 100644
index 00000000..d037dd5c
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SetFRISC.java
@@ -0,0 +1,34 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.BoolNode;
+import com.seaofnodes.simple.node.MachConcreteNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.util.SB;
+
+// corresponds to feq.d = equal
+//                fle.d = less than or equal
+//                flt.d = less than
+public class SetFRISC extends MachConcreteNode implements MachNode {
+    final String _bop;          // One of <,<=,==
+    SetFRISC( BoolNode bool ) {
+        super(bool);
+        assert bool.isFloat();
+        _bop = bool.op();
+    }
+    @Override public String op() { return "set"+_bop; }
+    @Override public RegMask regmap(int i) { return riscv.FMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public void encoding( Encoding enc ) {
+        short dst  =         enc.reg(this );
+        short src1 = (short)(enc.reg(in(1))-riscv.F_OFFSET);
+        short src2 = (short)(enc.reg(in(2))-riscv.F_OFFSET);
+        int body = RiscV.r_type(RiscV.OP_FP,dst,RiscV.fsetop(_bop),src1,src2,0b1010001/*FCMP*/);
+        enc.add4(body);
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" ").p(_bop).p(" ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SetIRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SetIRISC.java
new file mode 100644
index 00000000..9bc86565
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SetIRISC.java
@@ -0,0 +1,21 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.simple.util.Utils;
+import com.seaofnodes.simple.node.Node;
+
+// corresponds to slti,sltiu
+public class SetIRISC extends ImmRISC {
+    final boolean _unsigned;    // slti vs sltiu
+    public SetIRISC( Node src, int imm12, boolean unsigned ) {
+        this(src,imm12,unsigned,true);
+    }
+    public SetIRISC( Node src, int imm12, boolean unsigned, boolean pop ) {
+        super(src,imm12,pop);
+        if( !pop ) _inputs.setLen(2);
+        _unsigned = unsigned;
+    }
+    @Override public String op() { return "slt" + (_unsigned ? "u":"") + "i"; }
+    @Override public String glabel() { return  "<"+ (_unsigned ? "u":""); }
+    @Override int opcode() { return 0b0010011; }
+    @Override int func3() { return _unsigned ? 0b011 : 0b010; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SetRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SetRISC.java
new file mode 100644
index 00000000..848cc59f
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SetRISC.java
@@ -0,0 +1,20 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// corresponds to slt sltu
+public class SetRISC extends MachConcreteNode implements MachNode {
+    final boolean _unsigned;
+    public SetRISC( Node cmp, boolean unsigned ) { super(cmp); _unsigned=unsigned; }
+    @Override public String op() { return "slt" + (_unsigned ? "u":""); }
+    @Override public RegMask regmap(int i) { return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public void encoding( Encoding enc ) {
+        riscv.r_type(enc,this,_unsigned ? 0b011 : 0b010,0);
+    }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" < ").p(code.reg(in(2)));
+    }
+}
\ No newline at end of file
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SllIRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SllIRISC.java
new file mode 100644
index 00000000..1425caa2
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SllIRISC.java
@@ -0,0 +1,13 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.Utils;
+
+public class SllIRISC extends ImmRISC {
+    public SllIRISC( Node and, int imm) { super(and,imm); }
+    @Override int opcode() {  return RiscV.OP_IMM; }
+    @Override int func3() {  return 1; }
+    @Override public String glabel() { return "<<"; }
+    @Override public String op() { return "slli"; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SllRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SllRISC.java
new file mode 100644
index 00000000..5a4d4cc6
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SllRISC.java
@@ -0,0 +1,17 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// Shift left logical
+public class SllRISC extends MachConcreteNode implements MachNode {
+    public SllRISC(Node sll) { super(sll); }
+    @Override public String op() { return "shl"; }
+    @Override public RegMask regmap(int i) { return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public void encoding( Encoding enc ) { riscv.r_type(enc,this,1,0);  }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" << ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SplitRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SplitRISC.java
new file mode 100644
index 00000000..d455337b
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SplitRISC.java
@@ -0,0 +1,61 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.FunNode;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.node.SplitNode;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class SplitRISC extends SplitNode {
+    SplitRISC( LRG lrg, String kind, byte round ) { super(lrg, kind,round, new Node[2]); }
+    @Override public RegMask regmap(int i) { return riscv.SPLIT_MASK; }
+    @Override public RegMask outregmap() { return riscv.SPLIT_MASK; }
+    @Override public void encoding( Encoding enc ) {
+        short dst = enc.reg(this );
+        short src = enc.reg(in(1));
+
+        // Flag for being either XMM or stack
+        boolean dstX = dst >= riscv.F_OFFSET;
+        boolean srcX = src >= riscv.F_OFFSET;
+
+        if( dst >= riscv.MAX_REG ) {
+            // Store to SP
+            if( src >= riscv.MAX_REG ) {
+                throw Utils.TODO(); // Very rare stack-stack move
+            }
+            int off = fun(enc).computeStackOffset(enc._code,dst);
+            int op = srcX ? RiscV.OP_STOREFP : RiscV.OP_STORE;
+            if( srcX ) src -= riscv.F_OFFSET;
+            enc.add4(RiscV.s_type(op, 0b011, riscv.RSP, src, off));
+            return;
+        }
+        if( src >= riscv.MAX_REG ) {
+            // Load from SP
+            int off = fun(enc).computeStackOffset(enc._code,src);
+            int op = dstX ? RiscV.OP_LOADFP : RiscV.OP_LOAD;
+            if( dstX ) dst -= riscv.F_OFFSET;
+            enc.add4(RiscV.i_type(op, dst, 0b011, riscv.RSP, off));
+            return;
+        }
+        // pick opcode based on regs
+        if( !dstX && !srcX ) {
+            // GPR->GPR
+            enc.add4(RiscV.r_type(RiscV.OP,dst,0,src,riscv.ZERO,0));
+        } else if( dstX && srcX ) {
+            // FPR->FPR
+            src -= riscv.F_OFFSET;
+            dst -= riscv.F_OFFSET;
+            enc.add4(RiscV.r_type(RiscV.OP_FP, dst, 0b000, src, src, 0b0010101)); // dst = FMIN(src,src)
+        } else if(!srcX && dstX) {
+            //GPR->FPR
+            // fmv.d.x
+            enc.add4(RiscV.r_type(RiscV.OP_FP, dst - riscv.F_OFFSET, 0, src, 0, 0b1111001));
+        } else if(srcX && !dstX) {
+            //FPR->GPR
+            //fmv.x.d
+            enc.add4(RiscV.r_type(RiscV.OP_FP, dst, 0, src - riscv.F_OFFSET, 0, 0b1110001));
+        }
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SraIRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SraIRISC.java
new file mode 100644
index 00000000..b316b303
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SraIRISC.java
@@ -0,0 +1,15 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.Utils;
+
+public class SraIRISC extends ImmRISC {
+    public SraIRISC( Node and, int imm) {
+        super(and,imm | (0x20 << 5));
+    }
+    @Override int opcode() {  return RiscV.OP_IMM; }
+    @Override int func3() {  return 5;}
+    @Override public String glabel() { return ">>"; }
+    @Override public String op() { return "srai"; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SraRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SraRISC.java
new file mode 100644
index 00000000..e2e34415
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SraRISC.java
@@ -0,0 +1,17 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// Right Shift Arithmetic
+public class SraRISC extends MachConcreteNode implements MachNode {
+    public SraRISC(Node sra) { super(sra); }
+    @Override public String op() { return "sar"; }
+    @Override public RegMask regmap(int i) { return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public void encoding( Encoding enc ) { riscv.r_type(enc,this,0b101,0b00100000);  }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" >> ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SrlIRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SrlIRISC.java
new file mode 100644
index 00000000..d0ea6b18
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SrlIRISC.java
@@ -0,0 +1,13 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.Utils;
+
+public class SrlIRISC extends ImmRISC {
+    public SrlIRISC( Node and, int imm, boolean pop) { super(and,imm,pop); }
+    @Override int opcode() {  return RiscV.OP_IMM; }
+    @Override int func3() {  return 5; }
+    @Override public String glabel() { return ">>>"; }
+    @Override public String op() { return "srli"; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SrlRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SrlRISC.java
new file mode 100644
index 00000000..1eccc1c8
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SrlRISC.java
@@ -0,0 +1,17 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// Right Shift Logical
+public class SrlRISC extends MachConcreteNode implements MachNode {
+    public SrlRISC(Node srli) { super(srli); }
+    @Override public String op() { return "shr"; }
+    @Override public RegMask regmap(int i) { return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public void encoding( Encoding enc ) { riscv.r_type(enc,this,7,0);  }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" >>> ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/StoreRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/StoreRISC.java
new file mode 100644
index 00000000..c3fcf4d3
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/StoreRISC.java
@@ -0,0 +1,56 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+// Store memory addressing on ARM
+// Support imm, reg(direct), or reg+off(indirect) addressing
+// Base = base - base pointer, offset is added to base
+// idx  = null
+// off  = off - offset added to base)
+// imm  = imm - immediate value to store
+// val  = Node of immediate value to store(null if its a constant immediate)
+
+//e.g s.cs[0] =  67; // C
+// base = s.cs, off = 4, imm = 67, val = null
+
+// sw rs2,offset(rs1)
+public class StoreRISC extends MemOpRISC {
+    StoreRISC( StoreNode st, Node base, int off, Node val ) { super(st, base, off, val); }
+    @Override public String op() { return "st"+_sz; }
+    @Override public RegMask regmap(int i) {
+        // 0 - ctrl
+        if( i==1 ) return null; // mem
+        if( i==2 ) return riscv.RMASK; // ptr
+        // 2 - index
+        if( i==4 ) return _bytes >= 4
+                       ? riscv.MEM_MASK   // Word/dword value in GPR or FPR
+                       : riscv.RMASK;     // Byte/short stores require a GPR
+        return null; // Anti-dependence
+    }
+    @Override public RegMask outregmap() { return null; }
+
+    @Override public void encoding( Encoding enc ) {
+        short val = enc.reg(val());
+        short ptr = enc.reg(ptr());
+        int op = val >= riscv.F_OFFSET ? RiscV.OP_STOREFP : RiscV.OP_STORE;
+        if( val >= riscv.F_OFFSET  ) val -= riscv.F_OFFSET;
+        enc.add4(RiscV.s_type(op, func3()&7, ptr, val == -1 ? riscv.ZERO : val, _off));
+    }
+
+    // func3 is based on load/store size and extend
+    @Override int func3() {
+        return Integer.numberOfTrailingZeros(_bytes);
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        asm_address(code,sb).p(",");
+        if( val()==null ) sb.p("#").p("0");
+        else sb.p(code.reg(val()));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SubFRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SubFRISC.java
new file mode 100644
index 00000000..044820cf
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SubFRISC.java
@@ -0,0 +1,18 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// fsub.d
+public class SubFRISC extends MachConcreteNode implements MachNode {
+    SubFRISC(Node subf) {super(subf);}
+    @Override public String op() { return "subf"; }
+    @Override public RegMask regmap(int i) { assert i==1 || i==2; return riscv.FMASK; }
+    @Override public RegMask outregmap() { return riscv.FMASK; }
+    @Override public void encoding( Encoding enc ) { riscv.rf_type(enc,this,RiscV.RM.RNE,5); }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" + ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SubRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SubRISC.java
new file mode 100644
index 00000000..2adfce23
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/SubRISC.java
@@ -0,0 +1,16 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class SubRISC extends MachConcreteNode implements MachNode {
+    public SubRISC( Node sub ) { super(sub); }
+    @Override public String op() { return "sub"; }
+    @Override public RegMask regmap(int i) { assert i==1 || i==2; return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public void encoding( Encoding enc ) { riscv.r_type(enc,this,0,0x20);  }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" - ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/TFPRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/TFPRISC.java
new file mode 100644
index 00000000..44ef1a95
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/TFPRISC.java
@@ -0,0 +1,56 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.TypeFunPtr;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class TFPRISC extends FunPtrNode implements MachNode, RIPRelSize {
+    final String _ext;
+    // Pointer to a Simple function
+    TFPRISC( FunPtrNode fptr ) { super(fptr); _ext = null; }
+    // Pointer to an Extern "C" function
+    TFPRISC( TypeFunPtr fptr, String ext ) { super(fptr,CodeGen.CODE._start,null); _type = fptr; _ext = ext; }
+    @Override public String op() { return "ldx"; }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public boolean isClone() { return true; }
+    @Override public TFPRISC copy() { return new TFPRISC((TypeFunPtr)_con,_ext); }
+    @Override public void encoding( Encoding enc ) {
+        if( _ext==null ) enc.relo(this);          // Internal patch
+        else             enc.external(this,_ext); // ELF-file external patch
+        // TODO: 1 op encoding, plus a TODO if it does not fit
+        short dst = enc.reg(this);
+        // auipc  t0,0
+        enc.add4(RiscV.u_type(RiscV.OP_AUIPC, dst, 0));
+        // addi   t1,t0 + #0
+        enc.add4(RiscV.i_type(RiscV.OP_IMM, dst, 0, dst, 0));
+    }
+
+    @Override public byte encSize(int delta) { return 8; }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        short rpc = enc.reg(this);
+        if( opLen==8 ) {
+            int hi20 = (delta + 0x800) >> 12;
+            int lo12 = delta - (hi20 << 12);
+            // AUIPC (upper 20 bits)
+            // opstart of add
+            enc.patch4(opStart  ,RiscV.u_type(RiscV.OP_AUIPC, rpc, hi20));
+            // addi(low 12 bits)
+            enc.patch4(opStart+4,RiscV.i_type(RiscV.OP_IMM, rpc, 0, rpc, lo12 & 0xFFF));
+            // addi
+        } else {
+             // should not happen as one instruction is 4 byte, and TFP arm encodes 2.
+            throw Utils.TODO();
+        }
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        _type.print(sb.p(code.reg(this)).p(" #"));
+    }
+    @Override public boolean eq(Node n) { return this==n; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/TMPRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/TMPRISC.java
new file mode 100644
index 00000000..a5ff3753
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/TMPRISC.java
@@ -0,0 +1,44 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.ConstantNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.type.TypeMemPtr;
+import com.seaofnodes.simple.util.SB;
+
+public class TMPRISC extends ConstantNode implements MachNode, RIPRelSize {
+    final String _ext;
+    TMPRISC( ConstantNode con, String ext ) { super(con); _ext = ext; }
+    @Override public String op() { return "ldp"; }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public boolean isClone() { return true; }
+    @Override public TMPRISC copy() { return new TMPRISC(this,_ext); }
+    @Override public void encoding( Encoding enc ) {
+        if( _ext!=null ) enc.externalData(this,_ext);
+        else enc.largeConstant(this,((TypeMemPtr)_con)._obj,0,-1);
+        short dst = enc.reg(this);
+        // AUIPC dst,#hi20_constant_pool
+        enc.add4(RiscV.u_type(RiscV.OP_AUIPC, dst, 0));
+        // addi dst,[dst+#low12_constant_pool]
+        enc.add4(RiscV.i_type(RiscV.OP_IMM, dst, 0, dst, 0));
+    }
+
+    @Override public byte encSize(int delta) { return 8; }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        short dst = enc.reg(this);
+        // AUIPC dst,#hi20_constant_pool
+        enc.patch4(opStart  , RiscV.u_type(RiscV.OP_AUIPC, dst, (delta+0x800)>>12));
+        // ADDI's low 12 bits are signed; round the AUIPC page accordingly.
+        enc.patch4(opStart+4, RiscV.i_type(RiscV.OP_IMM, dst, 0, dst, delta & 0xFFF));
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        _con.print(sb.p(code.reg(this)).p(" #"));
+    }
+    @Override public boolean eq(Node n) { return this==n; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/UJmpRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/UJmpRISC.java
new file mode 100644
index 00000000..448d9ec3
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/UJmpRISC.java
@@ -0,0 +1,49 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+// unconditional jump
+public class UJmpRISC extends CFGNode implements MachNode, RIPRelSize {
+    @Override public String op() { return "jmp"; }
+    @Override public String label() { return op(); }
+    @Override protected ExprPrinter<Node> _print1(ExprPrinter<Node> p) { return p.p("jmp "); }
+    @Override public RegMask regmap(int i) {return null; }
+    @Override public RegMask outregmap() { return null; }
+    @Override public Type compute() { throw Utils.TODO(); }
+    @Override public Node idealize() { throw Utils.TODO(); }
+    @Override public void encoding( Encoding enc ) {
+        // Short form +/-4K:  beq r0,r0,imm12
+        // Long form:  auipc rX,imm20/32; jal r0,[rX+imm12/32]
+        enc.jump(this,uctrl());
+        enc.add4(RiscV.j_type(RiscV.OP_JAL, 0, 0));
+    }
+
+    // Delta is from opcode start
+    @Override public byte encSize(int delta) {
+        if( -(1L<<20) <= delta && delta < (1L<<20) ) return 4;
+        // 2 word encoding needs a tmp register, must teach RA
+        throw Utils.TODO();
+    }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        if( opLen==4 ) {
+            enc.patch4(opStart,RiscV.j_type(RiscV.OP_JAL, 0, delta));
+        } else {
+            throw Utils.TODO();
+        }
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        CFGNode target = uctrl();
+        //assert target.nOuts() > 1; // Should optimize jmp to empty targets
+        sb.p(label(target));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/XorIRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/XorIRISC.java
new file mode 100644
index 00000000..f4323cae
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/XorIRISC.java
@@ -0,0 +1,14 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.Utils;
+
+public class XorIRISC extends ImmRISC {
+    public XorIRISC( Node and, int imm) { super(and,imm); }
+    public XorIRISC( Node and, int imm, boolean pop) { super(and,imm,pop); }
+    @Override int opcode() {  return RiscV.OP_IMM; }
+    @Override int func3() {  return 4; }
+    @Override public String glabel() { return "^"; }
+    @Override public String op() { return "xori"; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/XorRISC.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/XorRISC.java
new file mode 100644
index 00000000..413a7c3b
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/XorRISC.java
@@ -0,0 +1,16 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class XorRISC extends MachConcreteNode implements MachNode {
+    public XorRISC(Node or) { super(or); }
+    @Override public String op() { return "xor"; }
+    @Override public RegMask regmap(int i) { return riscv.RMASK; }
+    @Override public RegMask outregmap() { return riscv.WMASK; }
+    @Override public void encoding( Encoding enc ) { riscv.r_type(enc,this,4,0);  }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" ^ ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/riscv.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/riscv.java
new file mode 100644
index 00000000..0195542c
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/riscv/riscv.java
@@ -0,0 +1,450 @@
+package com.seaofnodes.simple.node.cpus.riscv;
+
+import com.seaofnodes.isa.RiscV;
+import static com.seaofnodes.isa.RiscV.*;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.Utils;
+
+public class riscv extends Machine {
+
+    public riscv(CodeGen code) {
+        if( !"SystemV".equals(code._callingConv) )
+            throw new IllegalArgumentException("Unknown calling convention "+code._callingConv);
+    }
+
+    @Override public String name() {return "riscv";}
+
+    // Using ABI names instead of register names
+    public static int ZERO =  0,  RPC=  1,  RSP=  2,  S12=  3,  S13=  4,  T0 =  5,  T1 =  6,  T2 =  7;
+    public static int S0   =  8,  S1 =  9,  A0 = 10,  A1 = 11,  A2 = 12,  A3 = 13,  A4 = 14,  A5 = 15;
+    public static int A6   = 16,  A7 = 17,  S2 = 18,  S3 = 19,  S4 = 20,  S5 = 21,  S6 = 22,  S7 = 23;
+    public static int S8   = 24,  S9 = 25,  S10= 26,  S11= 27,  T3 = 28,  T4 = 29,  T5 = 30,  T6 = 31;
+
+    // FP registers
+    public static int F0   = 32,  F1  = 33,  F2  = 34,  F3  = 35,  F4  = 36,  F5  = 37,  F6  = 38,  F7   = 39;
+    public static int FS0  = 40,  FS1 = 41,  FA0 = 42,  FA1 = 43,  FA2 = 44,  FA3 = 45,  FA4 = 46,  FA5  = 47;
+    public static int FA6  = 48,  FA7 = 49,  FS2 = 50,  FS3 = 51,  FS4 = 52,  FS5 = 53,  FS6 = 54,  FS7  = 55;
+    public static int FS8  = 56,  FS9 = 57,  FS10 = 58, FS11 = 59, FT8 = 60,  FT9 = 61,  FT10 = 62, FT11 = 63;
+
+    static final int MAX_REG = 64;
+
+    public static final int F_OFFSET = 32;
+
+    static final String[] REGS = new String[] {
+        //"zero","rpc"  , "rsp" , "s12" , "s13" , "t0"  , "t1"  , "t2"  ,
+        //"s0"  , "s1"  , "a0"  , "a1"  , "a2"  , "a3"  , "a4"  , "a5"  ,
+        //"a6"  , "a7"  , "s2"  , "s3"  , "s4"  , "s5"  , "s6"  , "s7"  ,
+        //"s8"  , "s9"  , "s10" , "s11" , "t3"  , "t4"  , "t5"  , "t6"  ,
+        //"f0"  , "f1"  , "f2"  , "f3"  , "f4"  , "f5"  , "f6"  , "f7"  ,
+        //"fs0" , "fs1" , "fa0" , "fa1" , "fa2" , "fa3" , "fa4" , "fa5" ,
+        //"fa6" , "fa7" , "fs2" , "fs3" , "fs4" , "fs5" , "fs6" , "fs7" ,
+        //"fs8" , "fs9" , "fs10", "fs11", "ft8" , "ft9" , "ft10", "ft11"
+        // Register-based naming hella easier to debug than "official" register
+        // names when single-stepping in debugger.
+        "zero", "r1"  , "rsp" , "r3" , "r4" , "r5" , "r6" , "r7" ,
+        "r8"  , "r9"  , "r10" , "r11", "r12", "r13", "r14", "r15",
+        "r16" , "r17" , "r18" , "r19", "r20", "r21", "r22", "r23",
+        "r24" , "r25" , "r26" , "r27", "r28", "r29", "r30", "r31",
+        "f0"  , "f1"  , "f2"  , "f3"  , "f4"  , "f5"  , "f6"  , "f7"  ,
+        "fs0" , "fs1" , "fa0" , "fa1" , "fa2" , "fa3" , "fa4" , "fa5" ,
+        "fa6" , "fa7" , "fs2" , "fs3" , "fs4" , "fs5" , "fs6" , "fs7" ,
+        "fs8" , "fs9" , "fs10", "fs11", "ft8" , "ft9" , "ft10", "ft11"
+    };
+    @Override public String[] regs() { return REGS; }
+
+    // General purpose register mask: pointers and ints, not floats
+    static final long RD_BITS = 0b11111111111111111111111111111111L; // All the GPRs
+    static final RegMask RMASK = new RegMask(RD_BITS);
+
+    static final long WR_BITS = 0b11111111111111111111111111111010L; // All the GPRs, minus ZERO and RSP
+    static final RegMask WMASK = new RegMask(WR_BITS);
+    // Float mask from(f0-ft10).  TODO: ft10,ft11 needs a larger RegMask
+    static final long FP_BITS = 0b11111111111111111111111111111111L<<F0;
+    static final RegMask FMASK = new RegMask(FP_BITS);
+
+    // Load/store mask; both GPR and FPR
+    static final RegMask MEM_MASK = new RegMask(WR_BITS | FP_BITS);
+
+    static final RegMask SPLIT_MASK = new RegMask( WR_BITS | FP_BITS, -1L );
+
+    // Arguments masks
+    public static RegMask A0_MASK = new RegMask(A0);
+    public static RegMask A1_MASK = new RegMask(A1);
+    public static RegMask A2_MASK = new RegMask(A2);
+    public static RegMask A3_MASK = new RegMask(A3);
+    public static RegMask A4_MASK = new RegMask(A4);
+    public static RegMask A5_MASK = new RegMask(A5);
+    public static RegMask A6_MASK = new RegMask(A6);
+    public static RegMask A7_MASK = new RegMask(A7);
+
+    public static final RegMask RPC_MASK = new RegMask(RPC);
+
+    // Float arguments masks
+    public static RegMask FA0_MASK = new RegMask(FA0);
+    public static RegMask FA1_MASK = new RegMask(FA1);
+    public static RegMask FA2_MASK = new RegMask(FA2);
+    public static RegMask FA3_MASK = new RegMask(FA3);
+    public static RegMask FA4_MASK = new RegMask(FA4);
+    public static RegMask FA5_MASK = new RegMask(FA5);
+    public static RegMask FA6_MASK = new RegMask(FA6);
+    public static RegMask FA7_MASK = new RegMask(FA7);
+
+    // Int/ptr arguments calling convention
+    static RegMask[] CALLINMASK = new RegMask[] {
+        A0_MASK,
+        A1_MASK,
+        A2_MASK,
+        A3_MASK,
+        A4_MASK,
+        A5_MASK,
+        A6_MASK,
+        A7_MASK
+    };
+
+    static RegMask[] XMMS = new RegMask[] {
+        FA0_MASK,
+        FA1_MASK,
+        FA2_MASK,
+        FA3_MASK,
+        FA4_MASK,
+        FA5_MASK,
+        FA6_MASK,
+        FA7_MASK
+    };
+
+    // Since riscv instructions are fixed we can just or them together
+
+    public static void r_type(Encoding enc, Node n, int func3, int func7) {
+        short dst  = enc.reg(n);
+        short src1 = enc.reg(n.in(1));
+        short src2 = enc.reg(n.in(2));
+        int body = RiscV.r_type(OP,dst,func3,src1,src2,func7);
+        enc.add4(body);
+    }
+
+    public static void rf_type(Encoding enc, Node n, RM func3, int func7) {
+        short dst  = (short)(enc.reg(n      )-F_OFFSET);
+        short src1 = (short)(enc.reg(n.in(1))-F_OFFSET);
+        short src2 = (short)(enc.reg(n.in(2))-F_OFFSET);
+        int body = RiscV.r_type(OP_FP,dst,func3.ordinal(),src1,src2,func7);
+        enc.add4(body);
+    }
+
+    @Override public RegMask callArgMask( TypeFunPtr tfp, int idx, int maxArgSlot ) { return callInMask(tfp,idx,maxArgSlot); }
+    static RegMask callInMask( TypeFunPtr tfp, int idx, int maxArgSlot ) {
+        if( idx==0 ) return RPC_MASK;
+        if( idx==1 ) return null;
+        if( idx-2 >= tfp.nargs() ) return null; // Anti-dependence
+        boolean hidden = hiddenSelf(tfp);
+        int sigidx = idx-2;
+        if( hidden ) {
+            if( sigidx==0 ) return null;
+            sigidx--;
+        }
+        // Count floats in signature up to index
+        int fcnt=0;
+        for( int i=hidden ? 1 : 0; i<idx-2; i++ )
+            if( tfp.arg(i) instanceof TypeFloat )
+                fcnt++;
+        // Floats up to XMMS in XMM registers
+        if( tfp.arg(idx-2) instanceof TypeFloat ) {
+            if( fcnt < XMMS.length )
+                return XMMS[fcnt];
+        } else {
+            RegMask[] cargs = CALLINMASK;
+            if( sigidx-fcnt < cargs.length )
+                return cargs[sigidx-fcnt];
+        }
+        // Pass on stack slot(8 and higher)
+        if( maxArgSlot>0 ) throw Utils.TODO();
+        return new RegMask(MAX_REG + 1 + sigidx);
+    }
+
+    @Override public short maxArgSlot( TypeFunPtr tfp ) {
+        int icnt=0, fcnt=0;     // Count of ints, floats
+        for( int i=hiddenSelf(tfp) ? 1 : 0; i<tfp.nargs(); i++ ) {
+            if( tfp.arg(i) instanceof TypeFloat ) fcnt++;
+            else icnt++;
+        }
+        int nstk = Math.max(icnt-8,0)+Math.max(fcnt-8,0);
+        return (short)nstk;
+    }
+    private static boolean hiddenSelf(TypeFunPtr tfp) {
+        return tfp.nargs() > 0 && tfp.arg(0) == TypePtr.PTR;
+    }
+
+    static final long CALLER_SAVE =
+        (1L<<RPC) |
+        (1L<<A0 ) | (1L<<A1 ) | (1L<<A2 ) | (1L<<A3 ) | (1L<<A4 ) | (1L<<A5 ) | (1L<<A6 ) | (1L<<A7 ) |
+        (1L<<T0 ) | (1L<<T1 ) | (1L<<T2 ) | (1L<<T3 ) | (1L<<T4 ) | (1L<<T5 ) | (1L<<T6 ) |
+        (1L<<FA0) | (1L<<FA1) | (1L<<FA2) | (1L<<FA3) | (1L<<FA4) | (1L<<FA5) | (1L<<FA6) | (1L<<FA7) |
+        (1L<<F0 ) | (1L<<F1 ) | (1L<<F2 ) | (1L<<F3 ) | (1L<<F4 ) | (1L<<F5 ) | (1L<<F6 ) | (1L<<F7 ) |
+        (1L<<FT8) | (1L<<FT9) | (1L<<FT10)| (1L<<FT11);
+
+    @Override public long callerSave() { return CALLER_SAVE; }
+    @Override public long  neverSave() { return (1L<<RSP) | (1L<<ZERO); }
+    @Override public RegMask retMask( TypeFunPtr tfp ) {
+        return tfp.ret() instanceof TypeFloat ? FA0_MASK : A0_MASK;
+    }
+    @Override public int rpc() { return RPC; }
+
+    // Return a MachNode unconditional branch
+    @Override public CFGNode jump() { return new UJmpRISC(); }
+
+    // Create a split op; any register to any register, including stack slots
+    @Override public SplitNode split(LRG lrg, String kind, byte round ) { return new SplitRISC(lrg, kind,round);  }
+
+    // True if signed 12-bit immediate
+    public static boolean imm12(TypeInteger ti) {
+        // 52 = 64-12
+        return ti.isConstant() && ((ti.value()<<52)>>52) == ti.value();
+    }
+    // True if HIGH 20-bit signed immediate, with all zeros low.
+    public static boolean imm20Exact(TypeInteger ti) {
+        // shift left 32 to clear out the upper 32 bits.
+        // shift right SIGNED to sign-extend upper 32 bits; then shift 12 more to clear out lower 12 bits.
+        // shift left 12 to re-center the bits.
+        return ti.isConstant() && (((ti.value()<<32)>>44)<<12) == ti.value();
+    }
+
+    @Override public Node instSelect( Node n ) {
+        return switch (n) {
+        case AddNode      add -> add(add);
+        case AndNode      and -> and(and);
+        case BoolNode    bool -> cmp(bool);
+        case CallNode    call -> call(call);
+        case PtrToIntNode  ptr -> new PtrToIntMach(ptr);
+        case GuardNode guard  -> new GuardMach(guard);
+        case CallEndNode cend -> new CallEndMach(cend);
+        case CLInitNode init -> new CLInitNode(init);
+        case CProjNode      c -> new CProjNode(c);
+        case ConstantNode con -> con(con);
+        case DivNode      div -> div.mode()==2 ? new DivFRISC(div) : new DivRISC(div);
+        case EscapeNode   esc -> new EscapeNode(esc);
+        case FunNode      fun -> new FunRISC(fun);
+        case FunPtrNode  fptr -> fptr(fptr);
+        case IfNode       iff -> jmp(iff);
+        case LoadNode      ld -> ld(ld);
+        case MemMergeNode mem -> new MemMergeNode(mem);
+        case MinusNode    neg -> {
+            if( neg.mode()==2 ) throw Utils.TODO();
+            yield new NegRISC(neg);
+        }
+        case MulNode      mul -> mul.mode()==2 ? new MulFRISC(mul) : new MulRISC(mul);
+        case NewNode      nnn -> nnn(nnn);
+        case NotNode      not -> new NotRISC(not);
+        case OrNode        or -> or(or);
+        case ParmNode    parm -> new ParmRISC(parm);
+        case BulkMemPhiNode phi-> new BulkMemPhiNode(phi);
+        case MemPhiNode  phi  -> new MemPhiNode(phi);
+        case PhiNode      phi -> new PhiNode(phi);
+        case ProjNode     prj -> prj(prj);
+        case ReadOnlyNode read-> new ReadOnlyMach(read);
+        case ReturnNode   ret -> new RetRISC(ret, ret.fun());
+        case SarNode      sar -> sra(sar);
+        case ShlNode      shl -> sll(shl);
+        case ShrNode      shr -> srl(shr);
+        case StartCUNode start -> new StartCUNode(start);
+        case StopCUNode  stop -> new StopCUNode(stop);
+        case StartNode  start -> new StartNode(start);
+        case StopNode    stop -> new StopNode(stop);
+        case StoreNode     st -> st(st);
+        case SubNode      sub -> sub.mode()==2 ? new SubFRISC(sub) : sub(sub);
+        case ToFloatNode  tfn -> i2f8(tfn);
+        case ToIntegerNode cvt -> new F8ToIRISC(cvt);
+        case XorNode      xor -> xor(xor);
+
+        case LoopNode loop -> new LoopNode(loop);
+        case RegionNode region -> new RegionNode(region);
+        default -> throw Utils.TODO();
+        };
+    }
+
+    private Node add(AddNode add) {
+        if( add.mode()==2 )
+            return new AddFRISC(add);
+        if( add.in(2) instanceof ConstantNode off2 && off2._con instanceof TypeInteger ti && imm12(ti) )
+            return new AddIRISC(add, (int)ti.value(),true);
+        return new AddRISC(add);
+    }
+
+    private Node and(AndNode and) {
+        if( and.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti ) {
+            if( imm12(ti) )
+                return new AndIRISC(and, (int)ti.value());
+            // Could be any size low bit mask
+            if( ti.value() == 0xFFFFFFFFL )
+                return new SrlIRISC(new SllIRISC(and,32),32,false);
+        }
+        return new AndRISC(and);
+    }
+
+    private Node call(CallNode call) {
+        return call.fptr() instanceof FunPtrNode fptr
+            ? new CallRISC(call, (TypeFunPtr)fptr._type)
+            : call.fptr() instanceof ConstantNode con
+            ? new CallRISC(call, (TypeFunPtr)con._type)
+            : new CallRRISC(call);
+    }
+    private Node nnn(NewNode nnn) {
+        // TODO: pass in the TFP for alloc
+        return new NewRISC(nnn);
+    }
+
+    private Node cmp(BoolNode bool) {
+        // Float variant directly implemented in hardware
+        if( bool.isFloat() )
+            return new SetFRISC(bool);
+
+        // Only < and <u are implemented in hardware.
+        // x <  y - as-is
+        // x <= y - flip and negate; !(y < x); `slt tmp=y,x; xori dst=tmp,#1`
+        // x == y - sub and vs0 == `sub tmp=x-y; sltu dst=tmp,#1`
+
+        // x >  y - swap; y < x
+        // x >= y - swap and negate; !(x < y); `slt tmp=y,x;` then NOT.
+        // x != y - sub and vs0 == `sub tmp=x-y; sltu dst=tmp,#1` then NOT.
+
+        // The ">", ">=" and "!=" in Simple include a NotNode, which can be
+        // implemented with a XOR.  If one of the above is followed by a NOT
+        // we can remove the double XOR in the encodings.
+
+        return switch( bool.op() ) {
+        case "<" -> bool.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm12(ti)
+            ? new SetIRISC(bool, (int)ti.value(),false)
+            : new  SetRISC(bool, false);
+        // x <= y - flip and negate; !(y < x); `slt tmp=y,x; xori dst=tmp,#1`
+        case "<=" -> new XorIRISC(new SetRISC(bool.swap12(), false),1,false);
+        // x == y - sub and vs0 == `sub tmp=x-y; sltu dst=tmp,#1`
+        case "==" -> new SetIRISC(new SubRISC(bool),1,true,false);
+        default -> throw Utils.TODO();
+        };
+    }
+
+    private Node con( ConstantNode con ) {
+        if( !con._con.isConstant() )
+            return ConstantNode.raw(con); // Default unknown caller inputs
+        String ext = con instanceof ExternNode ext0 ? ext0._extern : null;
+        return switch( con._con ) {
+        case TypeInteger ti -> {
+            // External; without knowing the size assume we have to load something
+            if( ext!=null ) yield new Int8RISC(con,ext);
+            if( imm12(ti) ) yield new IntRISC(con);
+            long x = ti.value();
+            if( imm20Exact(ti) ) yield new LUI((int)x);
+            if( (x<<32)>>32 == x ) { // Signed lower 32-bit immediate
+                // Here, the low 12 bits get sign-extended, which means if
+                // bit11 is set, the value is negative and lowers the LUI
+                // value.  Add a bit 12 to compensate
+                if( ((x>>11)&1)==1 ) x += 0x1000;
+                yield new AddIRISC(new LUI((int)(x & ~0xFFF)), (int)(x & 0xFFF),false);
+            }
+            // Need more complex sequence for larger constants... or a load
+            // from a constant pool, which does not need an extra register
+            yield new Int8RISC(con,null);
+        }
+        // Load from constant pool
+        case TypeFloat   tf  -> new FltRISC(con,ext);
+        case TypeMemPtr  tmp -> new TMPRISC(con,ext);
+        case TypeFunPtr  tfp -> new TFPRISC(tfp,ext);
+        case TypeNil     tn  -> throw Utils.TODO();
+        // TOP, BOTTOM, XCtrl, Ctrl, etc.  Never any executable code.
+        case Type t -> t==Type.NIL ? new IntRISC(con) : ConstantNode.raw(con);
+        };
+    }
+
+    private Node fptr( FunPtrNode con ) {
+        return new TFPRISC(con);
+    }
+
+    private Node jmp( IfNode iff ) {
+        if( iff.in(1) instanceof BoolNode bool && !bool.isFloat() ) {
+            // if less than or equal switch inputs
+            String bop = bool.op();
+            if( bop.equals("<=") || bop.equals(">") )
+                return new BranchRISC(iff, IfNode.swap(bop), bool.in(2), bool.in(1));
+            return new BranchRISC(iff, bop, bool.in(1), bool.in(2));
+        }
+        // Vs zero
+        return new BranchRISC(iff, iff.in(1)==null ? "==" : "!=", iff.in(1), null);
+    }
+
+    private Node or(OrNode or) {
+        if( or.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm12(ti))
+            return new OrIRISC(or, (int)ti.value());
+        return new OrRISC(or);
+    }
+
+    private Node xor(XorNode xor) {
+        if( xor.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm12(ti))
+            return new XorIRISC(xor, (int)ti.value());
+        return new XorRISC(xor);
+    }
+
+    private Node sra(SarNode sar) {
+        if( sar.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm12(ti))
+            return new SraIRISC(sar, (int)ti.value());
+        return new SraRISC(sar);
+    }
+
+    private Node srl(ShrNode shr) {
+        if( shr.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm12(ti))
+            return new SrlIRISC(shr, (int)ti.value(),true);
+        return new SrlRISC(shr);
+    }
+
+    private Node sll(ShlNode sll) {
+        if( sll.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm12(ti))
+            return new SllIRISC(sll, (int)ti.value());
+        return new SllRISC(sll);
+    }
+
+    private Node sub(SubNode sub) {
+        return sub.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm12(ti)
+            ? new AddIRISC(sub, (int)(-ti.value()),true)
+            : new SubRISC(sub);
+    }
+
+    private Node i2f8(ToFloatNode tfn) {
+        assert tfn.in(1)._type instanceof TypeInteger ti;
+        return new I2F8RISC(tfn);
+    }
+
+    private Node prj(ProjNode prj) {
+        if( prj.in(0) instanceof CLInitNode ) return new ProjNode(prj);
+        TypeInteger ret = cReturn(prj);
+        if( ret!=null ) return new ExtendRISC(prj,ret);
+        return prj.in(0) instanceof StartNode ? new ProjNode(prj) : new ProjRISC(prj);
+    }
+
+    private Node ld(LoadNode ld) {
+        return new LoadRISC(ld,address(ld),off);
+    }
+
+    private Node st(StoreNode st) {
+        Node xval = st.val() instanceof ConstantNode con && con._con == TypeInteger.ZERO ? null : st.val();
+        return new StoreRISC(st,address(st), off, xval);
+    }
+
+    // Gather addressing mode bits prior to constructing.  This is a builder
+    // pattern, but saving the bits in a *local* *global* here to keep mess
+    // contained.
+    private static int off;
+    private Node address( MemOpNode mop ) {
+        off = 0;  // Reset
+        Node base = mop.ptr();
+        // Skip/throw-away a ReadOnly, only used to typecheck
+        if( base instanceof ReadOnlyNode read ) base = read.in(1);
+        assert !(base instanceof AddNode) && base._type instanceof TypeMemPtr; // Base ptr always, not some derived
+        if( mop.off() instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm12(ti) ) {
+            off = (int)ti.value();
+        } else {
+            base = new AddRISC(base,mop.off());
+            base._type = mop.ptr()._type;
+        }
+        return base;
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AddFMemX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AddFMemX86.java
new file mode 100644
index 00000000..74af9266
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AddFMemX86.java
@@ -0,0 +1,33 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class AddFMemX86 extends MemOpX86 {
+    AddFMemX86( AddNode add, LoadNode ld , Node base, Node idx, int off, int scale, Node val ) {
+        super(add,ld, base, idx, off, scale, 0, val );
+    }
+    @Override public String op() { return "addf"+_sz; }
+    @Override public RegMask regmap(int i) {
+        if( i==1 ) return null;            // Memory
+        if( i==2 ) return x86_64_v2.RMASK; // base
+        if( i==3 ) return x86_64_v2.RMASK; // index
+        if( i==4 ) return x86_64_v2.XMASK; // value
+        throw Utils.TODO();
+    }
+    @Override public RegMask outregmap() { return x86_64_v2.XMASK; }
+    @Override public int twoAddress() { return 4; }
+    @Override public void encoding( Encoding enc ) {
+        X86.memory(enc,0xF2,0x0F58,false,enc.reg(this)-x86_64_v2.XMM_OFFSET,enc.reg(ptr()),enc.reg(idx()),_off,_scale);
+    }
+
+    // General form: "add  dst = src + [base + idx<<2 + 12]"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ");
+        sb.p(val()==null ? "#"+_imm : code.reg(val())).p(" + ");
+        asm_address(code,sb);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AddFX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AddFX86.java
new file mode 100644
index 00000000..c7d0cf9c
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AddFX86.java
@@ -0,0 +1,24 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class AddFX86 extends MachConcreteNode implements MachNode {
+    AddFX86( Node addf ) { super(addf); }
+    @Override public String op() { return "addf"; }
+    @Override public RegMask regmap(int i) { assert i==1 || i==2; return x86_64_v2.XMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.XMASK; }
+    @Override public int twoAddress() { return 1; }
+    @Override public boolean commutes() { return true; }
+
+    @Override public void encoding( Encoding enc ) {
+        X86.sse(enc,0xF2,0x0F58,false,enc.reg(this)-x86_64_v2.XMM_OFFSET,enc.reg(in(2))-x86_64_v2.XMM_OFFSET);
+    }
+
+    // General form: "addf  dst += src"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" += ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AddIX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AddIX86.java
new file mode 100644
index 00000000..0e652a93
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AddIX86.java
@@ -0,0 +1,23 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class AddIX86 extends ImmX86 {
+    AddIX86( Node add, int imm ) { super(add,imm); }
+    @Override public String op() {
+        return _imm == 1  ? "inc" : (_imm == -1 ? "dec" : "addi");
+    }
+    @Override public String glabel() { return "+"; }
+    @Override int opcode() { return 0x81; }
+    @Override int mod() { return 0; }
+    @Override public final void encoding( Encoding enc ) {
+        if( _imm== 1 || _imm== -1 ) {
+            short dst = enc.reg(this); // Also src1
+            X86.unary(enc,0xFF,_imm==1 ? 0 : 1,dst);
+        } else super.encoding(enc);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AddMemX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AddMemX86.java
new file mode 100644
index 00000000..ed65b0a8
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AddMemX86.java
@@ -0,0 +1,24 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class AddMemX86 extends MemOpX86 {
+    AddMemX86( AddNode add, LoadNode ld , Node base, Node idx, int off, int scale, int imm, Node val ) {
+        super(add,ld, base, idx, off, scale, imm, val );
+    }
+    @Override public String op() { return "add"+_sz; }
+    @Override public RegMask outregmap() { return x86_64_v2.WMASK; }
+    @Override public int twoAddress() { return 4; }
+    @Override public void encoding( Encoding enc ) {
+        X86.memory(enc,0,0x03,true,enc.reg(this),enc.reg(ptr()),enc.reg(idx()),_off,_scale);
+    }
+
+    // General form: "add  dst += [base + idx<<2 + 12]"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" += ");
+        asm_address(code,sb);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AddX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AddX86.java
new file mode 100644
index 00000000..84543e8f
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AddX86.java
@@ -0,0 +1,11 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.simple.node.Node;
+
+public class AddX86 extends RegX86 {
+    AddX86( Node add ) { super(add); }
+    @Override public String op() { return "add"; }
+    @Override public String glabel() { return "+"; }
+    @Override int opcode() { return 0x03; }
+    @Override public boolean commutes() { return true; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AndIX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AndIX86.java
new file mode 100644
index 00000000..3c1b567c
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AndIX86.java
@@ -0,0 +1,11 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.simple.node.Node;
+
+public class AndIX86 extends ImmX86 {
+    AndIX86( Node add, int imm ) { super(add,imm); }
+    @Override public String op() { return "andi"; }
+    @Override public String glabel() { return "&"; }
+    @Override int opcode() { return 0x81; }
+    @Override int mod() { return 4; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AndX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AndX86.java
new file mode 100644
index 00000000..dedbce45
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/AndX86.java
@@ -0,0 +1,11 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.simple.node.Node;
+
+public class AndX86 extends RegX86 {
+    AndX86( Node add ) { super(add); }
+    @Override public String op() { return "and"; }
+    @Override public String glabel() { return "&"; }
+    @Override int opcode() { return 0x23; }
+    @Override public boolean commutes() { return true; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CallRX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CallRX86.java
new file mode 100644
index 00000000..3109df63
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CallRX86.java
@@ -0,0 +1,33 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.CallNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.type.TypeFunPtr;
+import com.seaofnodes.simple.util.SB;
+
+public class CallRX86 extends CallNode implements MachNode {
+    final TypeFunPtr _tfp;
+    CallRX86( CallNode call ) { super(call); _tfp = call.tfp(); }
+    @Override public TypeFunPtr tfp() { return _tfp; }
+    @Override public String op() { return "callr"; }
+    @Override public String label() { return op(); }
+    @Override public RegMask regmap(int i) {
+        return i==_inputs._len-1
+            ? x86_64_v2.WMASK          // Function call target
+            : x86_64_v2.callInMask(tfp(),i,fun()._maxArgSlot); // Normal argument
+    }
+    @Override public RegMask outregmap() { return null; }
+    @Override public void encoding( Encoding enc ) {
+        X86.callRegister(enc,enc.reg(fptr()));
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(fptr())).p("  ");
+        for( int i=0; i<nargs(); i++ )
+            sb.p(code.reg(arg(i))).p("  ");
+        sb.unchar(2);
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CallX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CallX86.java
new file mode 100644
index 00000000..6bafbf37
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CallX86.java
@@ -0,0 +1,55 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.TypeFunPtr;
+import com.seaofnodes.simple.util.SB;
+
+public class CallX86 extends CallNode implements MachNode, RIPRelSize {
+    final TypeFunPtr _tfp;
+    final String _name;
+    final boolean _extern;
+    CallX86( CallNode call, TypeFunPtr tfp ) {
+        super(call);
+        _inputs.pop(); // Pop constant target
+        assert tfp.isConstant();
+        _tfp = tfp;
+        _name = CodeGen.CODE.funcName(tfp.fidx());
+        _extern = CodeGen.CODE.externFunc(tfp.fidx()) != null;
+    }
+    @Override public String op() { return "call"; }
+    @Override public String label() { return op(); }
+    @Override public String name() { return _name; }
+    @Override public TypeFunPtr tfp() { return _tfp; }
+    @Override public RegMask regmap(int i) {
+        return _extern
+            ? x86_64_v2.callInMask(_tfp,i,fun()._maxArgSlot,CodeGen.CODE._cCallingConv)
+            : x86_64_v2.callInMask(_tfp,i,fun()._maxArgSlot);
+    }
+    @Override public RegMask outregmap() { return null; }
+    @Override public int nargs() { return nIns()-2; } // Minus control, memory, fptr
+    @Override public boolean external() { return _extern; }
+
+    @Override public void encoding( Encoding enc ) {
+        FunNode fun = CodeGen.CODE.link(_tfp);
+        if( fun==null ) enc.external(this,_name);
+        else enc.relo(this);
+        X86.call(enc);
+    }
+
+    // Delta is from opcode start, but X86 measures from the end of the 5-byte encoding
+    @Override public byte encSize(int delta) { return 5; }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        enc.patch4(opStart+1, delta-5);
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(_name).p("  ");
+        for( int i=0; i<nargs(); i++ )
+            sb.p(code.reg(in(i+2))).p(", ");
+        sb.unchar(2);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CmpFX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CmpFX86.java
new file mode 100644
index 00000000..5ef7a476
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CmpFX86.java
@@ -0,0 +1,24 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class CmpFX86 extends MachConcreteNode implements MachNode {
+    CmpFX86( Node cmp ) { super(cmp); }
+    @Override public String op() { return "cmpf"; }
+    @Override public RegMask regmap(int i) { return x86_64_v2.XMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.FLAGS_MASK; }
+
+    @Override public void encoding( Encoding enc ) {
+        X86.sse(enc,0x66,0x0F2E,false,enc.reg(in(1))-x86_64_v2.XMM_OFFSET,enc.reg(in(2))-x86_64_v2.XMM_OFFSET);
+    }
+
+    // General form: "cmp src1,src2"
+    @Override public void asm(CodeGen code, SB sb) {
+        String dst = code.reg(this);
+        if( dst!="flags" )  sb.p(dst).p(" = ");
+        sb.p(code.reg(in(1))).p(", ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CmpIX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CmpIX86.java
new file mode 100644
index 00000000..151f8ca8
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CmpIX86.java
@@ -0,0 +1,38 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+// Compare immediate.  Sets flags.
+public class CmpIX86 extends MachConcreteNode implements MachNode {
+    final int _imm;
+    CmpIX86( Node cmp, int imm, boolean swap ) {
+        super(cmp);
+        _inputs.del(swap ? 1 : 2);
+        _imm = imm;
+    }
+    CmpIX86( CmpIX86 cmp ) {
+        super((Node)null);
+        addDef(null);
+        addDef(cmp.in(1));
+        _imm = cmp._imm;
+    }
+
+    @Override public String op() { return _imm==0 ? "test" : "cmp"; }
+    @Override public RegMask regmap(int i) { return x86_64_v2.RMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.FLAGS_MASK; }
+    @Override public boolean isClone() { return true; }
+    @Override public Node copy() { return new CmpIX86(this); }
+
+    @Override public final void encoding( Encoding enc ) {
+        X86.imm(enc,0x81,7,enc.reg(in(1)),_imm);
+    }
+    @Override public void asm(CodeGen code, SB sb) {
+        String dst = code.reg(this);
+        if( dst!="flags" )  sb.p(dst).p(" = ");
+        sb.p(code.reg(in(1)));
+        if( _imm != 0 ) sb.p(", #").p(_imm);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CmpMemX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CmpMemX86.java
new file mode 100644
index 00000000..4014045b
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CmpMemX86.java
@@ -0,0 +1,44 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeFloat;
+import com.seaofnodes.simple.util.SB;
+
+public class CmpMemX86 extends MemOpX86 {
+    final boolean _swap;      // Op switched LHS, RHS
+    CmpMemX86( BoolNode bool, LoadNode ld, Node base, Node idx, int off, int scale, int imm, Node val, boolean swap ) {
+        super(bool,ld, base, idx, off, scale, imm, val );
+        _swap = swap;
+        assert !_swap || val() != null || bool.op()=="==" || bool.op()=="!="; // Cannot swap with immediate
+    }
+    @Override public String op() { return ((val()==null && _imm==0) ? "test" : "cmp") + _sz; }
+    @Override public RegMask outregmap() { return x86_64_v2.FLAGS_MASK; }
+    @Override public void encoding( Encoding enc ) {
+        short ptr=enc.reg(ptr()), idx=enc.reg(idx()), src=enc.reg(val());
+        if( src==-1 ) {
+            assert !_swap;
+            X86.cmpImm(enc,_con.log_size(),_imm,ptr,idx,_off,_scale);
+        } else encVal(enc,_con,ptr,idx,src,_off,_scale,_swap);
+    }
+
+    static void encVal(Encoding enc, Type decl, short ptr, short idx, short src, int off, int scale, boolean _swap) {
+        assert !(decl instanceof TypeFloat); // Selected separately as CmpFX86.
+        X86.cmpMem(enc,decl.log_size(),src,ptr,idx,off,scale,_swap);
+    }
+
+    // General form: "cmp  dst = src, [base + idx<<2 + 12]"
+    @Override public void asm(CodeGen code, SB sb) {
+        String dst = code.reg(this);
+        if( dst!="flags" )  sb.p(dst).p(" = ");
+        if( _swap ) asm_address(code,sb).p(",");
+        if( val()==null ) {
+            if( _imm!=0 )  sb.p("#").p(_imm);
+        } else {
+            sb.p(code.reg(val()));
+        }
+        if( !_swap ) asm_address(code,sb.p(", "));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CmpX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CmpX86.java
new file mode 100644
index 00000000..7faea17b
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/CmpX86.java
@@ -0,0 +1,28 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class CmpX86 extends MachConcreteNode implements MachNode {
+    CmpX86( Node add ) { super(add); }
+    @Override public String op() { return "cmp"; }
+    @Override public RegMask regmap(int i) { return x86_64_v2.RMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.FLAGS_MASK; }
+    // This one is marginal: cloning a Cmp[reg,reg] means stretching the
+    // lifetimes of 2 normal registers in exchange for shortening a flags
+    // register lifetime.  Spilling flags is (probably) relatively expensive
+    // compared to some normal registers - and those normal registers might not
+    // be spilling!
+    @Override public boolean isClone() { return true; }
+
+    @Override public void encoding( Encoding enc ) {
+        X86.reg(enc,0x3B,enc.reg(in(1)),enc.reg(in(2)));
+    }
+    @Override public void asm(CodeGen code, SB sb) {
+        String dst = code.reg(this);
+        if( dst!="flags" )  sb.p(dst).p(" = ");
+        sb.p(code.reg(in(1))).p(", ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/DivFX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/DivFX86.java
new file mode 100644
index 00000000..7bbb5102
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/DivFX86.java
@@ -0,0 +1,24 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class DivFX86 extends MachConcreteNode implements MachNode {
+    DivFX86( Node divf) { super(divf); }
+    @Override public String op() { return "divf"; }
+    @Override public RegMask regmap(int i) { return x86_64_v2.XMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.XMASK; }
+    @Override public int twoAddress() { return 1; }
+
+    @Override public void encoding( Encoding enc ) {
+        X86.sse(enc,0xF2,0x0F5E,false,enc.reg(this)-x86_64_v2.XMM_OFFSET,enc.reg(in(2))-x86_64_v2.XMM_OFFSET);
+    }
+
+
+    // General form: "divf  dst /= src"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" /= ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/DivX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/DivX86.java
new file mode 100644
index 00000000..9f375a80
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/DivX86.java
@@ -0,0 +1,25 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class DivX86 extends MachConcreteNode implements MachNode {
+    DivX86( Node div ) { super(div); }
+    @Override public String op() { return "div"; }
+    @Override public RegMask regmap(int i) {
+        return (i==1) ? x86_64_v2.RAX_MASK : x86_64_v2.DIV_MASK;
+    }
+    @Override public RegMask outregmap() { return x86_64_v2.RAX_MASK; }
+    @Override public RegMask killmap() { return x86_64_v2.RDX_MASK; }
+
+    @Override public void encoding( Encoding enc ) {
+        X86.divide(enc,enc.reg(in(2)));
+    }
+    // General form: "div  dst /= src"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" / ").p(code.reg(in(2)));
+    }
+    @Override public String comment() { return "kill rdx"; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ExtendX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ExtendX86.java
new file mode 100644
index 00000000..1a6ae123
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ExtendX86.java
@@ -0,0 +1,29 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.util.SB;
+
+// Convert a narrow C return register to Simple's full-width integer value.
+public class ExtendX86 extends MachConcreteNode {
+    final int _bits;
+    final boolean _signed;
+    ExtendX86(ProjNode prj, TypeInteger ret) {
+        super(prj);
+        _inputs.set(0,null);
+        _inputs.add(new ProjX86(prj));
+        _bits = 8 << ret.log_size();
+        _signed = ret._min < 0;
+    }
+    @Override public String op() { return (_signed ? "sext" : "zext")+_bits; }
+    @Override public RegMask regmap(int i) { return x86_64_v2.RMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.WMASK; }
+    @Override public void encoding(Encoding enc) {
+        X86.extend(enc,_bits,_signed,enc.reg(this),enc.reg(in(1)));
+    }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/F8ToIX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/F8ToIX86.java
new file mode 100644
index 00000000..a79a1017
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/F8ToIX86.java
@@ -0,0 +1,22 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class F8ToIX86 extends MachConcreteNode implements MachNode {
+    F8ToIX86(Node f8toi ) { super(f8toi); }
+    @Override public String op() { return "cvti"; }
+    @Override public RegMask regmap(int i) { assert i==1; return x86_64_v2.XMASK; }
+    @Override public RegMask killmap() { return x86_64_v2.FLAGS_MASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.WMASK; }
+
+    @Override public void encoding( Encoding enc ) {
+        X86.floatToInteger(enc,enc.reg(this),enc.reg(in(1))-x86_64_v2.XMM_OFFSET);
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p("(int)").p(code.reg(in(1)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/FltX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/FltX86.java
new file mode 100644
index 00000000..59f06341
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/FltX86.java
@@ -0,0 +1,39 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class FltX86 extends ConstantNode implements MachNode, RIPRelSize{
+    private byte _encSize;
+    final String _ext;
+    FltX86( ConstantNode con, String ext ) { super(con); _ext = ext; }
+    @Override public String op() { return "ld8"; }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return x86_64_v2.XMASK; }
+    @Override public boolean isClone() { return true; }
+    @Override public Node copy() { return new FltX86(this,_ext); }
+
+    @Override public void encoding( Encoding enc ) {
+        if( _ext!=null ) throw Utils.TODO();
+        _encSize=X86.rip(enc,0xF2,0x0F10,false,enc.reg(this)-x86_64_v2.XMM_OFFSET);
+        enc.largeConstant(this,_con,_encSize-4,2/*ELF PC32*/);
+    }
+
+    // Delta is from opcode start
+    @Override public byte encSize(int delta) {
+        // TODO: 1-byte RIP offset?
+        return (byte)_encSize;
+    }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        enc.patch4(opStart+opLen-4,delta-opLen);
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        _con.print(sb.p(code.reg(this)).p(" = #"));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/FunX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/FunX86.java
new file mode 100644
index 00000000..0e44aee7
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/FunX86.java
@@ -0,0 +1,32 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.node.FunNode;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.util.SB;
+
+public class FunX86 extends FunNode implements MachNode {
+    FunX86( FunNode fun ) { super(fun); }
+    @Override public void postSelect(CodeGen code) {
+        super.postSelect(code);
+        _maxArgSlot = code._mach.maxArgSlot(sig(),code._callingConv);
+        // One more for RPC pre-pushed; X86 special
+        _maxArgSlot++;
+    }
+
+    @Override public void computeFrameAdjust(CodeGen code, int maxReg) {
+        super.computeFrameAdjust(code,maxReg);
+        // Alignment, but off by RPC
+        if( _hasCalls )         // If non-leaf, pad to 16b
+            _frameAdjust = ((_frameAdjust+8+8) & -16)-8;
+    }
+
+    @Override public void encoding( Encoding enc ) {
+        int sz = _frameAdjust;
+        if( sz == 0 ) return; // Skip if no frame adjust
+        X86.imm(enc,0x81,5,x86_64_v2.RSP,sz);
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/I2f8X86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/I2f8X86.java
new file mode 100644
index 00000000..ee357901
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/I2f8X86.java
@@ -0,0 +1,21 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class I2f8X86 extends MachConcreteNode implements MachNode {
+    I2f8X86(Node i2f8 ) { super(i2f8); }
+    @Override public String op() { return "cvtf"; }
+    @Override public RegMask regmap(int i) { assert i==1; return x86_64_v2.WMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.XMASK; }
+
+    @Override public void encoding( Encoding enc ) {
+        X86.sse(enc,0xF2,0x0F2A,true,enc.reg(this)-x86_64_v2.XMM_OFFSET,enc.reg(in(1)));
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p("(flt)").p(code.reg(in(1)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ImmX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ImmX86.java
new file mode 100644
index 00000000..5a4ff4b2
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ImmX86.java
@@ -0,0 +1,32 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.util.SB;
+
+public abstract class ImmX86 extends MachConcreteNode implements MachNode {
+    final int _imm;
+    ImmX86( Node add, int imm ) {
+        super(add);
+        _inputs.pop();          // Pop constant input off
+        _imm = imm;
+    }
+    @Override public RegMask regmap(int i) { return x86_64_v2.RMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.WMASK; }
+    @Override public int twoAddress() { return 1; }
+    @Override public RegMask killmap() { return x86_64_v2.FLAGS_MASK; }
+
+    abstract int opcode();
+    abstract int mod();
+
+    @Override public void encoding( Encoding enc ) {
+        X86.imm(enc,opcode(),mod(),enc.reg(this),_imm);
+    }
+
+    // General form: "addi  dst += #imm"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" ").p(glabel()).p("= #").p(_imm);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/IntX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/IntX86.java
new file mode 100644
index 00000000..2ffaa3d1
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/IntX86.java
@@ -0,0 +1,43 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+// Integer constants
+public class IntX86 extends ConstantNode implements MachNode {
+    final String _ext;
+    IntX86( ConstantNode con, String ext ) { super(con); _ext = ext; }
+    @Override public String op() {
+        return _con == Type.NIL || _con == TypeInteger.ZERO ? "xor" : "ldi";
+    }
+    @Override public boolean isClone() { return true; }
+    @Override public Node copy() { return new IntX86(this,_ext); }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return x86_64_v2.WMASK; }
+    // Zero-set uses XOR kills flags
+    @Override public RegMask killmap() {
+        return _con == Type.NIL || _con == TypeInteger.ZERO ? x86_64_v2.FLAGS_MASK : null;
+    }
+
+    @Override public void encoding( Encoding enc ) {
+        if( _ext!=null ) throw Utils.TODO();
+        X86.constant(enc,enc.reg(this),_con==Type.NIL ? 0 : ((TypeInteger)_con).value());
+    }
+
+    // Human-readable form appended to the SB.  Things like the encoding,
+    // indentation, leading address or block labels not printed here.
+    // Just something like "ld4\tR17=[R18+12] // Load array base".
+    // General form: "op\tdst=src+src"
+    @Override public void asm(CodeGen code, SB sb) {
+        String reg = code.reg(this);
+        if( _con == Type.NIL || _con == TypeInteger.ZERO )
+            sb.p(reg).p(",").p(reg);
+        else
+            _con.print(sb.p(reg).p(" = #"));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/JmpX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/JmpX86.java
new file mode 100644
index 00000000..10cee059
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/JmpX86.java
@@ -0,0 +1,65 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+// Jump on flags, uses flags
+public class JmpX86 extends IfNode implements MachNode, RIPRelSize {
+    String _bop;
+    JmpX86( IfNode iff, String bop ) {
+        super(iff);
+        _bop = bop;
+    }
+    @Override public String op() { return "j"+_bop; }
+    @Override public String label() { return op(); }
+    @Override public void postSelect(CodeGen code) {
+        Node set = in(1);
+        if( set==null ) return; // Never-node cutout
+        Node cmp = set.in(1);
+        // Bypass an expected Set and just reference the cmp directly
+        if( set instanceof SetX86 setx && (cmp instanceof CmpX86 || cmp instanceof CmpIX86 || cmp instanceof CmpMemX86 || cmp instanceof CmpFX86) ) {
+            _inputs.set( 1, cmp );
+            _bop = setx._bop;
+        } else
+            throw Utils.TODO();
+    }
+    @Override public RegMask regmap(int i) { assert i==1; return x86_64_v2.FLAGS_MASK; }
+    @Override public RegMask outregmap() { return null; }
+    @Override public void negate() { _bop = negate(_bop);  }
+
+    @Override public void encoding( Encoding enc ) {
+        if( in(1)==null && _bop=="!=" ) return;
+        X86.branch(enc,in(1)==null ? -1 : x86_64_v2.jumpop(_bop)&15);
+        enc.jump(this,cproj(0));
+    }
+
+    // Delta is from opcode start, but X86 measures from the end of the 2-byte encoding
+    @Override public byte encSize(int delta) {
+        if( in(1)==null && _bop=="!=" ) return 0;
+        return X86.branchSize(delta,in(1)!=null);
+    }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        assert !(in(1)==null && _bop=="!=");
+        X86.patchBranch(enc.bits(),opStart,opLen,delta,in(1)==null ? -1 : x86_64_v2.jumpop(_bop)&15);
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        if( in(1)!=null ) {     // Never-node
+            String src = code.reg(in(1));
+            if( src!="flags" ) sb.p(src).p(" ");
+        } else if( _bop=="!=" ) {
+            sb.p("never");
+            return;
+        }
+        CFGNode prj = cproj(0).uctrlSkipEmpty(); // 0 is True is jump target
+        if( !prj.blockHead() ) prj = prj.cfg0();
+        sb.p(label(prj));
+    }
+
+    @Override public String comment() { return "L"+cproj(1)._nid; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/LeaX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/LeaX86.java
new file mode 100644
index 00000000..4b00e4dd
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/LeaX86.java
@@ -0,0 +1,38 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class LeaX86 extends MachConcreteNode implements MachNode {
+    final int _scale;
+    final int _offset;
+    LeaX86( Node add, Node base, Node idx, int scale, int offset ) {
+        super(add);
+        assert scale==0 || scale==1 || scale==2 || scale==3;
+        _inputs.pop();
+        _inputs.pop();
+        _inputs.push(base);
+        _inputs.push(idx);
+        _scale = scale;
+        _offset = offset;
+    }
+
+    @Override public String op() { return "lea"; }
+    @Override public RegMask regmap(int i) { assert i==1 || i==2; return x86_64_v2.RMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.WMASK; }
+
+    @Override public void encoding( Encoding enc ) {
+        X86.lea(enc,enc.reg(this),enc.reg(in(1)),enc.reg(in(2)),_offset,_scale);
+    }
+
+    // General form: "lea  dst = base + 4*idx + 12"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ");
+        if( in(1) != null )
+            sb.p(code.reg(in(1))).p(" + ");
+        sb.p(code.reg(in(2))).p("<<").p(_scale);
+        if( _offset!=0 ) sb.p(" + #").p(_offset);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/LoadX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/LoadX86.java
new file mode 100644
index 00000000..5c472dbe
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/LoadX86.java
@@ -0,0 +1,44 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.LoadNode;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class LoadX86 extends MemOpX86 {
+    LoadX86( LoadNode ld, Node base, Node idx, int off, int scale ) {
+        super(ld,ld, base, idx, off, scale, 0);
+    }
+    @Override public String op() { return "ld"+_sz; }
+    @Override public RegMask outregmap() { return _con instanceof TypeFloat ? x86_64_v2.XMASK : x86_64_v2.WMASK; }
+    @Override public void encoding( Encoding enc ) {
+        // REX.W + 8B /r	MOV r64, r/m64
+        // Zero extension for u8, u16 and u32 but sign extension i8, i16, i32
+        // Use movsx and movzx
+        short dst = enc.reg(this );
+        short ptr = enc.reg(ptr());
+        short idx = enc.reg(idx());
+        enc(enc, _con, dst, ptr, idx, _off, _scale);
+    }
+
+    static void enc( Encoding enc, Type decl, short dst, short ptr, short idx, int off, int scale ) {
+        // The chapter chooses the register bank and extension from its own type facts.
+        boolean xmm=dst>=x86_64_v2.XMM_OFFSET;
+        if( xmm && decl.log_size()==3 ) decl=TypeFloat.F64;
+        else if( !xmm && decl instanceof TypeFloat )
+            decl=decl==TypeFloat.F32 ? TypeInteger.U32 : TypeInteger.BOT;
+        boolean signed=decl.isa(TypeInteger.I8) || decl==TypeInteger.I16 || decl==TypeInteger.I32;
+        X86.load(enc,decl.log_size(),signed,xmm,
+                 xmm ? dst-x86_64_v2.XMM_OFFSET : dst,ptr,idx,off,scale);
+    }
+
+
+    // General form: "ldN  dst,[base + idx<<2 + 12]"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(",");
+        asm_address(code,sb);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/MemAddX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/MemAddX86.java
new file mode 100644
index 00000000..2e18a058
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/MemAddX86.java
@@ -0,0 +1,28 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class MemAddX86 extends MemOpX86 {
+    MemAddX86( StoreNode st, Node base, Node idx, int off, int scale, int imm, Node val ) {
+        super(st, st, base, idx, off, scale, imm, val );
+    }
+    @Override public String op() {
+        return (_imm == 1 ? "inc" : (_imm == -1 ? "dec" : "add")) + _sz;
+    }
+    // Register mask allowed as a result.  0 for no register.
+    @Override public RegMask outregmap() { return null; }
+    @Override public RegMask killmap() { return x86_64_v2.FLAGS_MASK; }
+    @Override public void encoding( Encoding enc ) {
+        X86.addMem(enc,enc.reg(val()),_imm,enc.reg(ptr()),enc.reg(idx()),_off,_scale);
+    }
+    // General form: "add  [base + idx<<2 + 12] += src"
+    @Override public void asm(CodeGen code, SB sb) {
+        asm_address(code,sb);
+        if( val()==null ) {
+            if( _imm != 1 && _imm != -1 ) sb.p(" += #").p(_imm);
+        } else sb.p(" += ").p(code.reg(val()));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/MemOpX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/MemOpX86.java
new file mode 100644
index 00000000..fcca7f8f
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/MemOpX86.java
@@ -0,0 +1,89 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.SB;
+import java.lang.StringBuilder;
+
+// Generic X86 memory operand base.
+// inputs:
+//   ctrl     - will appear for possibly RCE (i.e. array ops)
+//   mem      - memory dependence edge
+//   base     - Basic object pointer
+//   idx/null - Scaled index offset, or null if none
+//   val/null - Value to store, as part of an op-to-mem or op-from-mem.  Null for loads, or if an immediate is being used
+// Constants:
+//   offset   - offset added to base.  Can be zero.
+//   scale    - scale on index; only 0,1,2,4,8 allowed, 0 is only when index is null
+//   imm      - immediate value to store or op-to-mem, and only when val is null
+public abstract class MemOpX86 extends MemOpNode implements MachNode {
+    final int _off;             // Limit 32 bits
+    final int _scale;           // Limit 0,1,2,3
+    final int _imm;             // Limit 32 bits
+    final char _sz;             // Handy print name
+    MemOpX86( Node op, MemOpNode mop, Node base, Node idx, int off, int scale, int imm ) {
+        super(op,mop);
+        assert base._type instanceof TypeMemPtr && !(base instanceof AddNode);
+        assert (idx==null && scale==0) || (idx!=null && 0<= scale && scale<=3);
+
+        // Copy memory parts from e.g. the LoadNode over the opcode, e.g. an Add
+        if( op != mop ) {
+            _inputs.set(0,mop.in(0)); // Control from mem op
+            _inputs.set(1,mop.in(1)); // Memory  from mem op
+            _inputs.set(2,base);      // Base handed in
+        }
+
+        assert ptr() == base;
+        _inputs.setX(3,idx);
+        _off = off;
+        _scale = scale;
+        _imm = imm;
+        int size = mop instanceof StoreNode st ? st.storeSize() : 1<<_con.log_size();
+        _sz = (char)('0'+size);
+    }
+
+    // Store-based flavors have a value edge
+    MemOpX86( Node op, MemOpNode mop, Node base, Node idx, int off, int scale, int imm, Node val ) {
+        this(op,mop,base,idx,off,scale,imm);
+        _inputs.setX(4,val);
+    }
+
+    Node idx() { return in(3); }
+    Node val() { return in(4); } // Only for stores, including op-to-memory
+
+    @Override protected ExprPrinter<Node> _printMach(ExprPrinter<Node> p) {
+        return p.p(".").p(_name);
+    }
+
+    @Override public String label() { return op(); }
+    @Override public Type compute() { throw new AssertionError("Do not call compute on "+getClass().getSimpleName()); }
+    @Override public Node idealize() { throw new AssertionError("Do not call idealize on "+getClass().getSimpleName()); }
+
+    // Register mask allowed on input i.
+    @Override public RegMask regmap(int i) {
+        if( i==1 ) return null;               // Memory
+        if( i==2 ) return x86_64_v2.RMASK;    // base  in GPR
+        if( i==3 ) return x86_64_v2.RMASK;    // index in GPR
+        if( i==4 ) return _sz >= '4'
+                       ? x86_64_v2.MEM_MASK   // value in GPR or XMM
+                       : x86_64_v2.RMASK;     // Bytes and shorts in GPR only
+        return null; // Anti-dependence
+    }
+
+    // "[base + idx<<2 + 12]"
+    SB asm_address(CodeGen code, SB sb) {
+        sb.p("[").p(code.reg(ptr()));
+        if( idx() != null ) {
+            sb.p("+").p(code.reg(idx()));
+            if( _scale != 0 )
+                sb.p("*").p((1<<_scale));
+        }
+        if( _off != 0 )
+            sb.p("+").p(_off);
+        return sb.p("]");
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/MulFX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/MulFX86.java
new file mode 100644
index 00000000..74616db7
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/MulFX86.java
@@ -0,0 +1,24 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class MulFX86 extends MachConcreteNode implements MachNode {
+    MulFX86( Node mulf) { super(mulf); }
+    @Override public String op() { return "mulf"; }
+    @Override public RegMask regmap(int i) { assert i==1 || i==2; return x86_64_v2.XMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.XMASK; }
+    @Override public int twoAddress() { return 1; }
+    @Override public boolean commutes() { return true; }
+
+    @Override public void encoding( Encoding enc ) {
+        X86.sse(enc,0xF2,0x0F59,false,enc.reg(this)-x86_64_v2.XMM_OFFSET,enc.reg(in(2))-x86_64_v2.XMM_OFFSET);
+    }
+
+    // General form: "mulf  dst *= src"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" *= ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/MulIX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/MulIX86.java
new file mode 100644
index 00000000..5dcb253d
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/MulIX86.java
@@ -0,0 +1,27 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class MulIX86 extends MachConcreteNode implements MachNode {
+    final int _imm;
+    MulIX86( Node add, int imm ) {
+        super(add);
+        _inputs.pop();          // Pop the constant input
+        _imm = imm;             // Record the constant
+    }
+    @Override public String op() { return "muli"; }
+    @Override public String glabel() { return "*"; }
+    @Override public RegMask regmap(int i) { return x86_64_v2.RMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.WMASK; }
+    // Rare 3-address form
+    @Override public final void encoding( Encoding enc ) {
+        X86.imul(enc,enc.reg(this),enc.reg(in(1)),_imm);
+    }
+    // General form: "addi  dst += #imm"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" * #").p(_imm);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/MulX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/MulX86.java
new file mode 100644
index 00000000..6f3fcdeb
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/MulX86.java
@@ -0,0 +1,24 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class MulX86 extends MachConcreteNode implements MachNode {
+    MulX86( Node mul ) { super(mul); }
+    @Override public String op() { return "mul"; }
+    @Override public RegMask regmap(int i) { assert i==1 || i==2; return x86_64_v2.RMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.WMASK; }
+    @Override public int twoAddress() { return 1; }
+    @Override public boolean commutes() { return true; }
+
+    @Override public void encoding( Encoding enc ) {
+        X86.reg(enc,0x0FAF,enc.reg(this),enc.reg(in(2)));
+    }
+
+    // General form: "mul  dst *= src"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" = ").p(code.reg(in(1))).p(" * ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/NegX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/NegX86.java
new file mode 100644
index 00000000..86610f6d
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/NegX86.java
@@ -0,0 +1,20 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class NegX86 extends MachConcreteNode implements MachNode {
+    NegX86(MinusNode not) { super(not); }
+    @Override public String op() { return "neg"; }
+    @Override public RegMask regmap(int i) { return x86_64_v2.RMASK; }
+    @Override public RegMask outregmap()   { return x86_64_v2.RMASK; }
+    @Override public RegMask killmap()     { return x86_64_v2.FLAGS_MASK; }
+    @Override public int twoAddress() { return 1; }
+
+    @Override public void encoding( Encoding enc ) {
+        X86.unary(enc,0xF7,3,enc.reg(this));
+    }
+    @Override public void asm(CodeGen code, SB sb) { sb.p(code.reg(this)); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/NewX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/NewX86.java
new file mode 100644
index 00000000..d6a06c2f
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/NewX86.java
@@ -0,0 +1,24 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.TypeFunPtr;
+import com.seaofnodes.simple.util.SB;
+
+public class NewX86 extends NewNode implements MachNode {
+    // A pre-zeroed chunk of memory.
+    NewX86( NewNode nnn ) { super(nnn); }
+    @Override public void encoding( Encoding enc ) {
+        enc.external(this,"calloc");
+        X86.constant(enc,_arg2Reg,1);
+        X86.call(enc);
+    }
+    // General form: "alloc #bytes  PC"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p("\n");             // Multi-op trigger
+        sb.p("ldi   ").p(code._mach.regs()[_arg2Reg]).p(" = #1\n");
+        sb.p("call  #calloc");
+    }
+
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/NotX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/NotX86.java
new file mode 100644
index 00000000..1e4e7c26
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/NotX86.java
@@ -0,0 +1,21 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class NotX86 extends MachConcreteNode implements MachNode {
+    NotX86(NotNode not) { super(not); }
+    @Override public String op() { return "not"; }
+    @Override public RegMask regmap(int i) { return x86_64_v2.RMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.RMASK;  }
+    @Override public RegMask killmap() { return x86_64_v2.FLAGS_MASK; }
+
+    @Override public void encoding( Encoding enc ) {
+        assert !(in(1) instanceof NotNode); // Cleared out by peeps
+        assert !(in(1) instanceof BoolNode);
+        X86.not(enc,enc.reg(this),enc.reg(in(1)));
+    }
+    @Override public void asm(CodeGen code, SB sb) { sb.p(code.reg(this)); }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/OrIX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/OrIX86.java
new file mode 100644
index 00000000..15f4824d
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/OrIX86.java
@@ -0,0 +1,11 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.simple.node.Node;
+
+public class OrIX86 extends ImmX86 {
+    OrIX86( Node add, int imm ) { super(add,imm); }
+    @Override public String op() { return "ori"; }
+    @Override public String glabel() { return "|"; }
+    @Override int opcode() { return 0x81; }
+    @Override int mod() { return 1; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/OrX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/OrX86.java
new file mode 100644
index 00000000..bc8f0ea8
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/OrX86.java
@@ -0,0 +1,11 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.simple.node.Node;
+
+public class OrX86 extends RegX86 {
+    OrX86( Node add ) { super(add); }
+    @Override public String op() { return "or"; }
+    @Override public String glabel() { return "|"; }
+    @Override int opcode() { return 0x0B; }
+    @Override public boolean commutes() { return true; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ParmX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ParmX86.java
new file mode 100644
index 00000000..5cfdd804
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ParmX86.java
@@ -0,0 +1,17 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.node.ParmNode;
+
+public class ParmX86 extends ParmNode implements MachNode {
+    final RegMask _rmask;
+    ParmX86( ParmNode parm ) {
+        super(parm);
+        _rmask = x86_64_v2.callInMask(fun().sig(),_idx,1/*RPC*/);
+    }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return _rmask; }
+    @Override public void encoding( Encoding enc ) { }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ProjX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ProjX86.java
new file mode 100644
index 00000000..046c7b4c
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ProjX86.java
@@ -0,0 +1,15 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.node.ProjNode;
+
+public class ProjX86 extends ProjNode implements MachNode {
+    ProjX86( ProjNode p ) { super(p); }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() {
+        return ((MachNode)in(0)).outregmap(_idx);
+    }
+    @Override public void encoding( Encoding enc ) {}
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/RegX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/RegX86.java
new file mode 100644
index 00000000..06755143
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/RegX86.java
@@ -0,0 +1,22 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public abstract class RegX86 extends MachConcreteNode {
+    RegX86( Node add ) { super(add); }
+    @Override public RegMask regmap(int i) { return x86_64_v2.RMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.WMASK; }
+    @Override public RegMask killmap() { return x86_64_v2.FLAGS_MASK; }
+    @Override public int twoAddress() { return 1; }
+    abstract int opcode();
+    @Override public void encoding( Encoding enc ) {
+        X86.reg(enc,opcode(),enc.reg(in(1)),enc.reg(in(2)));
+    }
+    // General form: "add  dst += src"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" ").p(glabel()).p("= ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/RetX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/RetX86.java
new file mode 100644
index 00000000..e4467bb4
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/RetX86.java
@@ -0,0 +1,15 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.*;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+
+public class RetX86 extends ReturnNode implements MachNode {
+    RetX86( ReturnNode ret, FunNode fun ) { super(ret, fun); fun.setRet(this); }
+    @Override public void encoding( Encoding enc ) {
+        int sz = fun()._frameAdjust;
+        if( sz!=0 ) X86.imm(enc,0x81,0,x86_64_v2.RSP,sz);
+        X86.ret(enc);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SarIX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SarIX86.java
new file mode 100644
index 00000000..cf6275dc
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SarIX86.java
@@ -0,0 +1,32 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.codegen.Encoding;
+import com.seaofnodes.simple.codegen.RegMask;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.node.MachNode;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.SB;
+
+// Arithmetic Right Shift
+public class SarIX86 extends MachConcreteNode implements MachNode {
+    final int _imm;
+    SarIX86( Node sari, int imm ) { super(sari); assert x86_64_v2.imm8(imm); _inputs.pop(); _imm = imm; }
+    @Override public String op() { return "sari"; }
+    @Override public String glabel() { return ">>"; }
+    int opcode() { return 0xC1; }
+    int mod() { return 7; }
+
+    @Override public RegMask regmap(int i) { return x86_64_v2.RMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.WMASK; }
+    @Override public int twoAddress() { return 1; }
+
+    @Override public void encoding(Encoding enc) {
+        X86.shift(enc,mod(),enc.reg(this),_imm);
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" ").p(glabel()).p("= #").p(_imm);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SarX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SarX86.java
new file mode 100644
index 00000000..92493712
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SarX86.java
@@ -0,0 +1,21 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.Utils;
+
+public class SarX86 extends RegX86 {
+    SarX86( Node add ) { super(add); }
+    @Override public String op() { return "sar"; }
+    @Override public String glabel() { return ">>"; }
+    @Override public RegMask regmap(int i) {
+        if (i == 1) return x86_64_v2.WMASK;
+        if (i == 2) return x86_64_v2.RCX_MASK;
+        throw Utils.TODO();
+    }
+    @Override int opcode() { return 0xD3; }
+    @Override public void encoding( Encoding enc ) {
+        X86.unary(enc,opcode(),7,enc.reg(this));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SetX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SetX86.java
new file mode 100644
index 00000000..864c1b55
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SetX86.java
@@ -0,0 +1,44 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+// Corresponds to the x86 instruction "sete && setne".
+// Use result of comparison without jump.
+public class SetX86 extends MachConcreteNode implements MachNode {
+    final String _bop;          // One of <,<=,==
+    final boolean _unsigned;
+    // Constructor expects input is an X86 and not an Ideal node.
+    SetX86( Node cmp, String bop, boolean unsigned ) {
+        super(cmp);
+        _inputs.setLen(1);   // Pop the cmp inputs
+        // Replace with the matched cmp
+        _inputs.push(cmp);
+        _bop = bop;
+        _unsigned = unsigned;
+    }
+    @Override public String op() { return "set"+_bop; }
+    @Override public RegMask regmap(int i) { assert i==1; return x86_64_v2.FLAGS_MASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.WMASK; }
+
+    @Override public void encoding( Encoding enc ) {
+        int op=switch (_bop) {
+            case "==" -> 0x94;  // SETE
+            case "<"  -> _unsigned ? 0x92 : 0x9C;  // SETB /SETL
+            case "<=" -> _unsigned ? 0x96 : 0x9E;  // SETBE/SETLE
+            case ">=" -> _unsigned ? 0x93 : 0x9D;  // SETAE/SETGE
+            case ">"  -> _unsigned ? 0x97 : 0x9F;  // SETA /SETG
+            default -> throw Utils.TODO();
+            };
+        X86.set(enc,op&15,enc.reg(this));
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this));
+        String src = code.reg(in(1));
+        if( src!="flags" )  sb.p(" = ").p(src);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ShlIX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ShlIX86.java
new file mode 100644
index 00000000..1e62243e
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ShlIX86.java
@@ -0,0 +1,32 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.SB;
+
+public class ShlIX86 extends MachConcreteNode implements MachNode {
+    final int _imm;
+    ShlIX86( Node shli, int imm ) {
+        super(shli);
+        assert x86_64_v2.imm8(imm);
+        _inputs.pop();          // Pop constant input off
+        _imm = imm;
+    }
+    public int opcode() { return 0xC1; }
+    public int mod() { return 4; }
+
+    @Override public RegMask regmap(int i) { return x86_64_v2.RMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.WMASK; }
+    @Override public int twoAddress() { return 1; }
+
+    @Override public String op() { return "shli"; }
+    @Override public String glabel() { return "<<"; }
+    @Override public void encoding(Encoding enc) {
+        X86.shift(enc,mod(),enc.reg(this),_imm);
+    }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" ").p(glabel()).p("= #").p(_imm);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ShlX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ShlX86.java
new file mode 100644
index 00000000..768d97e7
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ShlX86.java
@@ -0,0 +1,21 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.Utils;
+
+public class ShlX86 extends RegX86 {
+    ShlX86( Node add ) { super(add); }
+    @Override public String op() { return "shl"; }
+    @Override public String glabel() { return "<<"; }
+    @Override public RegMask regmap(int i) {
+        if (i == 1) return x86_64_v2.WMASK;
+        if (i == 2) return x86_64_v2.RCX_MASK;
+        throw Utils.TODO();
+    }
+    @Override int opcode() { return 0xD3; }
+    @Override public final void encoding( Encoding enc ) {
+        X86.unary(enc,opcode(),4,enc.reg(this));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ShrIX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ShrIX86.java
new file mode 100644
index 00000000..8a0d1b58
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ShrIX86.java
@@ -0,0 +1,27 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.SB;
+
+public class ShrIX86 extends MachConcreteNode implements MachNode {
+    final int _imm;
+    ShrIX86( Node shri, int imm ) { super(shri); assert x86_64_v2.imm8(imm); _inputs.pop(); _imm = imm; }
+    @Override public String op() { return "shri"; }
+    @Override public String glabel() { return ">>>"; }
+    int opcode() { return 0xC1; }
+    int mod() { return 5; }
+
+    @Override public RegMask regmap(int i) { return x86_64_v2.RMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.WMASK; }
+    @Override public int twoAddress() { return 1; }
+
+    @Override public void encoding(Encoding enc) {
+        X86.shift(enc,mod(),enc.reg(this),_imm);
+    }
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" ").p(glabel()).p("= #").p(_imm);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ShrX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ShrX86.java
new file mode 100644
index 00000000..1ba20fee
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/ShrX86.java
@@ -0,0 +1,21 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.util.Utils;
+
+public class ShrX86 extends RegX86 {
+    ShrX86( Node add ) { super(add); }
+    @Override public String op() { return "shr"; }
+    @Override public String glabel() { return ">>>"; }
+    @Override public RegMask regmap(int i) {
+        if (i == 1) return x86_64_v2.WMASK;
+        if (i == 2) return x86_64_v2.RCX_MASK;
+        throw Utils.TODO();
+    }
+    @Override int opcode() { return 0xD3; }
+    @Override public final void encoding( Encoding enc ) {
+        X86.unary(enc,opcode(),5,enc.reg(this));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SplitFlagsX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SplitFlagsX86.java
new file mode 100644
index 00000000..cb7694f9
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SplitFlagsX86.java
@@ -0,0 +1,25 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+
+// Flag snapshots can use GPRs or stack slots, but never XMM registers.
+public class SplitFlagsX86 extends SplitX86 {
+    private static final RegMask MASK = new RegMask(x86_64_v2.WR_BITS | (1L<<x86_64_v2.FLAGS) | x86_64_v2.SPILLS,-1L);
+    SplitFlagsX86(LRG lrg,String kind,byte round) { super(lrg,kind,round); }
+    @Override public RegMask regmap(int i) { return MASK; }
+    @Override public RegMask outregmap() { return MASK; }
+
+    @Override public void encoding(Encoding enc) {
+        short dst=enc.reg(this), src=enc.reg(in(1));
+        if( dst==src ) return;
+        if( dst==x86_64_v2.FLAGS || src==x86_64_v2.FLAGS ) {
+            boolean toFlags = dst==x86_64_v2.FLAGS;
+            int reg = toFlags ? src : dst;
+            if( reg>=x86_64_v2.MAX_REG )
+                X86.flagsStack(enc,fun(enc).computeStackOffset(enc._code,reg),toFlags);
+            else
+                X86.flags(enc,reg,toFlags);
+        } else super.encoding(enc);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SplitX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SplitX86.java
new file mode 100644
index 00000000..46f2cb16
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SplitX86.java
@@ -0,0 +1,45 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.FunNode;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.node.SplitNode;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeFloat;
+import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+public class SplitX86 extends SplitNode {
+    SplitX86( LRG lrg, String kind, byte round ) { super(lrg,kind,round, new Node[2]); }
+    @Override public RegMask regmap(int i) { return x86_64_v2.SPLIT_MASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.SPLIT_MASK; }
+
+    // Moves among GPRs, XMM registers, and stack slots.
+    @Override public void encoding( Encoding enc ) {
+        short dst=enc.reg(this), src=enc.reg(in(1));
+        assert dst!=x86_64_v2.FLAGS && src!=x86_64_v2.FLAGS;
+        boolean dstX=dst>=x86_64_v2.XMM_OFFSET, srcX=src>=x86_64_v2.XMM_OFFSET;
+        // Stack spills
+        if( dst >= x86_64_v2.MAX_REG ) {
+            int off = fun(enc).computeStackOffset(enc._code,dst);
+            if( src >= x86_64_v2.MAX_REG ) {
+                // Rare stack-stack move.  push [RSP+soff]; pop [RSP+doff]
+                int soff = fun(enc).computeStackOffset(enc._code,src);
+                X86.stackCopy(enc,soff,off);
+                return;
+            }
+            StoreX86.encVal(enc, srcX ? TypeFloat.F64 : TypeInteger.BOT, (short)x86_64_v2.RSP, (short)-1/*index*/, src, off, 0);
+            return;
+        }
+        if( src >= x86_64_v2.MAX_REG ) {
+            int off = fun(enc).computeStackOffset(enc._code,src);
+            LoadX86.enc(enc, dstX ? TypeFloat.F64 : TypeInteger.BOT, dst, (short)x86_64_v2.RSP, (short)-1, off, 0);
+            return;
+        }
+
+        X86.move(enc,dstX,srcX,dstX ? dst-x86_64_v2.XMM_OFFSET : dst,
+                 srcX ? src-x86_64_v2.XMM_OFFSET : src);
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/StoreX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/StoreX86.java
new file mode 100644
index 00000000..9ffa25fc
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/StoreX86.java
@@ -0,0 +1,48 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.print.ExprPrinter;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.ConstantNode;
+import com.seaofnodes.simple.node.Node;
+import com.seaofnodes.simple.node.StoreNode;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeFloat;
+import com.seaofnodes.simple.util.SB;
+
+public class StoreX86 extends MemOpX86 {
+    StoreX86( StoreNode st, Node base, Node idx, int off, int scale, int imm, Node val ) {
+        super(st,st, base, idx, off, scale, imm, val);
+    }
+    @Override public String op() { return "st"+_sz; }
+    @Override protected ExprPrinter<Node> _printMach(ExprPrinter<Node> p) {
+        Node val = val();
+        p.p(".").p(_name).p("=");
+        if( val==null ) p.p(_imm);
+        else p.n(val);
+        return p.p(";");
+    }
+    // Register mask allowed as a result.  0 for no register.
+    @Override public RegMask outregmap() { return null; }
+    @Override public void encoding( Encoding enc ) {
+        short ptr=enc.reg(ptr()), idx=enc.reg(idx()), src=enc.reg(val());
+        if( src==-1 ) X86.storeImm(enc,Integer.numberOfTrailingZeros(_sz-'0'),_imm,ptr,idx,_off,_scale);
+        else encVal(enc,_con,ptr,idx,src,_off,_scale);
+    }
+
+    // Non-immediate encoding
+    static void encVal( Encoding enc, Type decl, short ptr, short idx, short src, int off, int scale ) {
+        boolean xmm=src>=x86_64_v2.XMM_OFFSET;
+        X86.store(enc,decl.log_size(),xmm,
+                  xmm ? src-x86_64_v2.XMM_OFFSET : src,ptr,idx,off,scale);
+    }
+
+
+    // General form: "stN  [base + idx<<2 + 12],val"
+    @Override public void asm(CodeGen code, SB sb) {
+        asm_address(code,sb).p(",");
+        if( val()==null ) sb.p("#").p(_imm);
+        else sb.p(code.reg(val()));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SubFX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SubFX86.java
new file mode 100644
index 00000000..29f0033a
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SubFX86.java
@@ -0,0 +1,23 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.util.SB;
+
+public class SubFX86 extends MachConcreteNode implements MachNode {
+    SubFX86( Node subf) {  super(subf); }
+    @Override public String op() { return "subf"; }
+    @Override public RegMask regmap(int i) { assert i==1 || i==2; return x86_64_v2.XMASK; }
+    @Override public RegMask outregmap() { return x86_64_v2.XMASK; }
+    @Override public int twoAddress() { return 1; }
+
+    @Override public void encoding( Encoding enc ) {
+        X86.sse(enc,0xF2,0x0F5C,false,enc.reg(this)-x86_64_v2.XMM_OFFSET,enc.reg(in(2))-x86_64_v2.XMM_OFFSET);
+    }
+
+    // General form: "subf  dst -= src"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this)).p(" -= ").p(code.reg(in(2)));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SubX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SubX86.java
new file mode 100644
index 00000000..8da34bf5
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/SubX86.java
@@ -0,0 +1,10 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.simple.node.Node;
+
+public class SubX86 extends RegX86 {
+    SubX86( Node add ) { super(add); }
+    @Override public String op() { return "sub"; }
+    @Override public String glabel() { return "-"; }
+    @Override int opcode() { return 0x2B; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/TFPX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/TFPX86.java
new file mode 100644
index 00000000..e3563713
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/TFPX86.java
@@ -0,0 +1,51 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.type.TypeFunPtr;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+// Function constants
+public class TFPX86 extends FunPtrNode implements MachNode, RIPRelSize {
+    private byte _opLen;
+    final String _ext;          // External name
+    // Pointer to a Simple function
+    TFPX86( FunPtrNode fptr ) { this((TypeFunPtr)fptr._type,null); }
+    // Spill clone: copy inputs without registering their reverse edges;
+    // insertBefore will place and register the clone in its use block.
+    private TFPX86( TFPX86 fptr ) { super(fptr); _ext = fptr._ext; }
+    // Pointer to an Extern "C" function
+    TFPX86( TypeFunPtr fptr, String ext ) { super(fptr,CodeGen.CODE._start,null); _type = fptr; _ext = ext; }
+    @Override public String op() { return "ldx"; }
+    @Override public String label() { return op(); }
+    @Override public boolean isClone() { return true; }
+    @Override public TFPX86 copy() { return new TFPX86(this); }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return x86_64_v2.WMASK; }
+    @Override public void encoding( Encoding enc ) {
+        if( _ext==null ) enc.relo(this);
+        else enc.external(this,_ext);
+        _opLen=X86.rip(enc,0,0x8D,true,enc.reg(this));
+    }
+
+    @Override public byte encSize(int delta) { return _opLen; }
+
+    // Delta is from opcode start, X86 expects it from opcode end
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        enc.patch4(opStart + opLen - 4, delta - opLen);
+    }
+
+    // Human-readable form appended to the SB.  Things like the encoding,
+    // indentation, leading address or block labels not printed here.
+    // Just something like "ld4\tR17=[R18+12] // Load array base".
+    // General form: "op\tdst=src+src"
+    @Override public void asm(CodeGen code, SB sb) {
+        sb.p(code.reg(this));
+        if( _ext == null ) _type.print(sb.p(" #"));
+        else sb.p(_ext);
+    }
+    @Override public boolean eq(Node n) { return this==n; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/TMPX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/TMPX86.java
new file mode 100644
index 00000000..682597f4
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/TMPX86.java
@@ -0,0 +1,39 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.TypeMemPtr;
+import com.seaofnodes.simple.util.SB;
+
+public class TMPX86 extends ConstantNode implements MachNode, RIPRelSize{
+    private byte _opLen;
+    final String _ext;
+    TMPX86( ConstantNode con, String ext ) { super(con); _ext = ext; }
+    @Override public String op() { return "ldp"; }
+    @Override public RegMask regmap(int i) { return null; }
+    @Override public RegMask outregmap() { return x86_64_v2.WMASK; }
+    @Override public boolean isClone() { return true; }
+    @Override public Node copy() { return new TMPX86(this,_ext); }
+
+    @Override public void encoding( Encoding enc ) {
+        short dst = enc.reg(this);
+        // 0 or 1 for REX depending on the dst.
+        _opLen = X86.rip(enc,0,0x8D,true,dst);
+        if( _ext!=null ) enc.externalData(this,_ext);
+        else enc.largeConstant(this,((TypeMemPtr)_con)._obj, _opLen-4, 2/*ELF encoding PC32*/);
+    }
+
+    // Delta is from opcode start
+    @Override public byte encSize(int delta) { return _opLen; }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        enc.patch4(opStart + opLen - 4, delta - opLen);
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        _con.print(sb.p(code.reg(this)).p(" = #"));
+    }
+    @Override public boolean eq(Node n) { return this==n; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/UJmpX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/UJmpX86.java
new file mode 100644
index 00000000..591a51c3
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/UJmpX86.java
@@ -0,0 +1,41 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.isa.X86;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.Type;
+import com.seaofnodes.simple.util.SB;
+import com.seaofnodes.simple.util.Utils;
+
+// unconditional jump
+public class UJmpX86 extends CFGNode implements MachNode, RIPRelSize {
+    UJmpX86() { }
+    @Override public String op() { return "jmp"; }
+    @Override public String label() { return op(); }
+    @Override protected String format() { return "jmp "; }
+    @Override public RegMask regmap(int i) {return null; }
+    @Override public RegMask outregmap() { return null; }
+    @Override public Type compute() { throw Utils.TODO(); }
+    @Override public Node idealize() { throw Utils.TODO(); }
+    @Override public void encoding( Encoding enc ) {
+        enc.jump(this,uctrl());
+        X86.branch(enc,-1);
+    }
+
+    // Delta is from opcode start, but X86 measures from the end of the 2-byte encoding
+    @Override public byte encSize(int delta) {
+        return X86.branchSize(delta,false);
+    }
+
+    // Delta is from opcode start
+    @Override public void patch( Encoding enc, int opStart, int opLen, int delta ) {
+        X86.patchBranch(enc.bits(),opStart,opLen,delta,-1);
+    }
+
+    @Override public void asm(CodeGen code, SB sb) {
+        CFGNode target = uctrl();
+        //assert target.nOuts() > 1; // Should optimize jmp to empty targets
+        sb.p(label(target));
+    }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/XorIX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/XorIX86.java
new file mode 100644
index 00000000..2d989a50
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/XorIX86.java
@@ -0,0 +1,11 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.simple.node.Node;
+
+public class XorIX86 extends ImmX86 {
+    XorIX86( Node add, int imm ) { super(add,imm); }
+    @Override public String op() { return "xori"; }
+    @Override public String glabel() { return "^"; }
+    @Override int opcode() { return 0x81; }
+    @Override int mod() { return 6; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/XorX86.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/XorX86.java
new file mode 100644
index 00000000..86703903
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/XorX86.java
@@ -0,0 +1,11 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.simple.node.Node;
+
+public class XorX86 extends RegX86 {
+    XorX86( Node add ) { super(add); }
+    @Override public String op() { return "xor"; }
+    @Override public String glabel() { return "^"; }
+    @Override int opcode() { return 0x33; }
+    @Override public boolean commutes() { return true; }
+}
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/x86_64_v2.java b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/x86_64_v2.java
new file mode 100644
index 00000000..3dc93bf6
--- /dev/null
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/cpus/x86_64_v2/x86_64_v2.java
@@ -0,0 +1,596 @@
+package com.seaofnodes.simple.node.cpus.x86_64_v2;
+
+import com.seaofnodes.simple.codegen.*;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.*;
+import com.seaofnodes.simple.util.Utils;
+
+public class x86_64_v2 extends Machine {
+    public x86_64_v2( CodeGen code ) {}
+    // X86-64 V2.  Includes e.g. SSE4.2 and POPCNT.
+    @Override public String name() { return "x86_64_v2"; }
+    @Override public int defaultOpSize() { return 5; }
+
+    public static final int RAX = 0, RCX = 1, RDX =  2, RBX =  3, RSP =  4, RBP =  5, RSI =  6, RDI =  7;
+    public static final int R08 = 8, R09 = 9, R10 = 10, R11 = 11, R12 = 12, R13 = 13, R14 = 14, R15 = 15;
+
+    public static final int XMM0  = 16, XMM1  = 17, XMM2  = 18, XMM3  = 19, XMM4  = 20, XMM5  = 21, XMM6  = 22, XMM7  = 23;
+    public static final int XMM8  = 24, XMM9  = 25, XMM10 = 26, XMM11 = 27, XMM12 = 28, XMM13 = 29, XMM14 = 30, XMM15 = 31;
+    public static final int FLAGS = 32;
+    public static final int MAX_REG = 33;
+    public static final int RPC = 33;
+
+    // Human-readable name for a register number, e.g. "RAX".
+    public static final String[] REGS = new String[]{
+            "rax", "rcx", "rdx", "rbx", "rsp", "rbp", "rsi", "rdi",
+            "r8" , "r9" , "r10", "r11", "r12", "r13", "r14", "r15",
+            "xmm0", "xmm1", "xmm2" , "xmm3" , "xmm4" , "xmm5" , "xmm6" , "xmm7" ,
+            "xmm8", "xmm9", "xmm10", "xmm11", "xmm12", "xmm13", "xmm14", "xmm15",
+            "flags",
+    };
+    // Hard crash for bad register number, fix yer bugs!
+    @Override public String[] regs() { return REGS; }
+
+    public static int XMM_OFFSET = 16;
+    // General purpose register mask: pointers and ints, not floats
+    static final long RD_BITS = 0b1111111111111111L; // All the GPRs
+    static RegMask RMASK = new RegMask(RD_BITS);
+    // No RSP in the *write* general set.
+    static final long WR_BITS = 0b1111111111101111L; // All the GPRs minus RSP
+    static RegMask WMASK = new RegMask(WR_BITS);
+    // Xmm register mask
+    static final long FP_BITS = 0b1111111111111111L << XMM0; // All the XMMs
+    static RegMask XMASK = new RegMask(FP_BITS);
+    static RegMask FLAGS_MASK = new RegMask(FLAGS);
+    static RegMask RPC_MASK = new RegMask(RPC);
+    // Divide mask: exclude RDX:RAX
+    static RegMask DIV_MASK = new RegMask(RD_BITS & ~(1L<<RAX) & ~(1L<<RDX));
+
+    static final long SPILLS = -(1L << MAX_REG);
+    static final RegMask SPLIT_MASK = new RegMask(WR_BITS | FP_BITS | SPILLS, -1L );
+
+    // Load/store mask; both GPR and FPR
+    static RegMask MEM_MASK = new RegMask(WR_BITS | FP_BITS);
+
+    public static RegMask RAX_MASK = new RegMask(RAX);
+    public static RegMask RCX_MASK = new RegMask(RCX);
+    public static RegMask RDX_MASK = new RegMask(RDX);
+    public static RegMask RDI_MASK = new RegMask(RDI);
+    public static RegMask R08_MASK = new RegMask(R08);
+    public static RegMask R09_MASK = new RegMask(R09);
+    public static RegMask RSI_MASK = new RegMask(RSI);
+
+    public static RegMask XMM0_MASK = new RegMask(XMM0);
+
+    // Encoding
+    public static int REX    = 0x40;
+    public static int REX_W  = 0x48;
+    public static int REX_WR = 0x4C;
+    public static int REX_WRB= 0x4D;
+    public static int REX_WB = 0x49;
+
+    // opcode included here
+    // 0F 84 cd	JE  rel32
+    // 0F 85 cd	JNE rel32
+    // 0F 8F cd	JG  rel32
+    // 0F 8C cd	JL  rel32
+    // 0F 8E cd	JLE rel32
+    // 0F 8D cd	JGE rel32
+    static public int jumpop(String op) {
+        return switch (op) {
+        case "==" -> 0x84;
+        case "!=" -> 0x85;
+        case ">"  -> 0x8F;
+        case "<"  -> 0x8C;
+        case "<=" -> 0x8E;
+        case ">=" -> 0x8D;
+        default -> throw new IllegalArgumentException("Too many arguments");
+        };
+    }
+
+    // Limit of float args passed in registers
+    static RegMask[] XMMS8 = new RegMask[]{
+        new RegMask(XMM0), new RegMask(XMM1), new RegMask(XMM2), new RegMask(XMM3),
+        new RegMask(XMM4), new RegMask(XMM5), new RegMask(XMM6), new RegMask(XMM7),
+    };
+
+    // Map from function signature and argument index to register.
+    // Used to set input registers to CallNodes, and ParmNode outputs.
+    @Override public RegMask callArgMask( TypeFunPtr tfp, int idx, int maxArgSlot ) { return callInMask(tfp,idx,maxArgSlot); }
+    @Override public RegMask callArgMask( TypeFunPtr tfp, int idx, int maxArgSlot, String conv ) { return callInMask(tfp,idx,maxArgSlot,conv); }
+    static RegMask callInMask( TypeFunPtr tfp, int idx, int maxArgSlot ) {
+        return callInMask(tfp,idx,maxArgSlot,CodeGen.CODE._callingConv);
+    }
+    static RegMask callInMask( TypeFunPtr tfp, int idx, int maxArgSlot, String conv ) {
+        if( idx==0 ) return RPC_MASK;
+        if( idx==1 ) return null;
+        if( idx-2 >= tfp.nargs() ) return null; // Anti-dependence
+        return switch( conv ) {
+        case "SystemV" -> callSys5 (tfp,idx,maxArgSlot);
+        case "win64"   -> callWin64(tfp,idx,maxArgSlot);
+        default -> throw Utils.TODO();
+        };
+    }
+
+    // Maximum stack args used by this signature
+    @Override public short maxArgSlot( TypeFunPtr tfp ) {
+        return maxArgSlot(tfp,CodeGen.CODE._callingConv);
+    }
+    @Override public short maxArgSlot( TypeFunPtr tfp, String conv ) {
+        return switch( conv ) {
+        case "SystemV" -> maxArgSlotSys5 (tfp);
+        case "win64"   -> maxArgSlotWin64(tfp);
+        default -> throw Utils.TODO();
+        };
+    }
+
+    // Win64 - max *4* args in registers of all kinds; after that on stack.
+    // Stack args land in increasing memory order with empty/mirror slots for
+    // every register.
+    //
+    // foo( int i0, flt f1, int i2, flt f3, int i4, flt f5, int i6, ... )
+    //
+    // -- Prior Frame --
+    // i6
+    // f5
+    // i4
+    // empty mirror, XMM3= f3
+    // empty mirror, R08 = i2
+    // empty mirror, XMM1= f1
+    // empty mirror, RCX = i0
+    // -- Caller Frame; 16b align --
+    // RPC
+    // PAD/ALIGN
+    // -- Callee Frame; 16b align --
+    static RegMask[] WIN64_CALL = new RegMask[] {
+        RCX_MASK,
+        RDX_MASK,
+        R08_MASK,
+        R09_MASK,
+    };
+
+    static RegMask callWin64(TypeFunPtr tfp, int idx, int maxArgSlot ) {
+        // idx 2,3,4,5 passed in registers, with stack slot mirrors.
+        // idx >= 6 passed on stack, starting at slot#1 (#0 reserved for RPC).
+        int sigidx = idx-2;
+        if( hiddenSelf(tfp) ) {
+            if( sigidx==0 ) return null;
+            sigidx--;
+        }
+        if( sigidx >= 4 )
+            return new RegMask(MAX_REG+maxArgSlot+sigidx);
+        return tfp.arg(idx-2) instanceof TypeFloat
+            ? XMMS8     [sigidx]
+            : WIN64_CALL[sigidx];
+    }
+    static short maxArgSlotWin64(TypeFunPtr tfp) {
+        return (short)Math.max(4,tfp.nargs() - (hiddenSelf(tfp) ? 1 : 0));
+    }
+    static short maxIncomingArgSlotWin64(TypeFunPtr tfp) {
+        return (short)Math.max(0,tfp.nargs() - (hiddenSelf(tfp) ? 1 : 0) - 4);
+    }
+
+    // Sys5: max 6 GPRs and 8 FPRS filled first.  Extra args land in increasing
+    // memory order as needed - no mirror space.
+    //
+    // foo( int i0, flt f1, int i2, flt f3, int i4, flt f5, int i6, ... )
+    // RDI =i0, RSI =i2, RDX =i4, RCX =i6, R08 =i8, R09 =i10
+    // XMM0=f1, XMM1=f3, XMM2=f5, XMM3=f7, XMM4=f9, XMM5=f11, XMM6=f13, XMM7=f15
+    //
+    // -- Prior Frame --
+    // f18
+    // i18
+    // f17
+    // i16
+    // i14
+    // i12
+    // -- Caller Frame; 16b align --
+    // RPC
+    // PAD/ALIGN
+    // -- Callee Frame; 16b align --
+    // SystemV(param passing)
+    static RegMask[] SYS5_CALL = new RegMask[] {
+        RDI_MASK,
+        RSI_MASK,
+        RDX_MASK,
+        RCX_MASK,
+        R08_MASK,
+        R09_MASK,
+    };
+
+    static RegMask callSys5(TypeFunPtr tfp, int idx, int maxArgSlot ) {
+        // First 6 integers passed in registers: rdi,rsi,rdx,rcx,r08,r09
+        // First 8 floats passed in registers: xmm0-xmm7
+        int sigidx = idx-2;
+        if( hiddenSelf(tfp) ) {
+            if( sigidx==0 ) return null;
+            sigidx--;
+        }
+        int icnt=0, fcnt=0;     // Count of ints, floats
+        for( int i=hiddenSelf(tfp) ? 1 : 0; i<idx-2; i++ ) {
+            if( tfp.arg(i) instanceof TypeFloat ) fcnt++;
+            else icnt++;
+        }
+        int nstk = Math.max(icnt-6,0)+Math.max(fcnt-8,0);
+        return tfp.arg(idx-2) instanceof TypeFloat
+            ? fcnt<8 ? XMMS8    [fcnt] : new RegMask(MAX_REG+maxArgSlot+nstk)
+            : icnt<6 ? SYS5_CALL[icnt] : new RegMask(MAX_REG+maxArgSlot+nstk);
+    }
+    static short maxArgSlotSys5(TypeFunPtr tfp) {
+        int icnt=0, fcnt=0;     // Count of ints, floats
+        for( int i=hiddenSelf(tfp) ? 1 : 0; i<tfp.nargs(); i++ ) {
+            if( tfp.arg(i) instanceof TypeFloat ) fcnt++;
+            else icnt++;
+        }
+        int nstk = Math.max(icnt-6,0)+Math.max(fcnt-8,0);
+        return (short)nstk;
+    }
+    private static boolean hiddenSelf(TypeFunPtr tfp) {
+        return tfp.nargs() > 0 && tfp.arg(0) == TypePtr.PTR;
+    }
+
+    static final long SYSTEM5_CALLER_SAVE =
+        (1L << RAX) | (1L << RCX) | (1L << RDX) |
+        (1L << RDI) | (1L << RSI) |
+        (1L << R08) | (1L << R09) | (1L << R10) | (1L << R11) |
+        (1L << FLAGS) |           // Flags are killed
+        // All FP regs are killed
+        FP_BITS;
+
+    static final long WIN64_CALLER_SAVE =
+        (1L<< RAX) | (1L<< RCX) | (1L<< RDX) |
+        (1L<< R08) | (1L<< R09) | (1L<< R10) | (1L<< R11) |
+        (1L<<FLAGS)|           // Flags are killed
+        // Only XMM0-XMM5 are killed; XMM6-XMM15 are preserved
+        (1L<<XMM0) | (1L<<XMM1) | (1L<<XMM2) | (1L<<XMM3) |
+        (1L<<XMM4) | (1L<<XMM5) ;
+
+    @Override public long callerSave() {
+        return callerSave(CodeGen.CODE._callingConv);
+    }
+    @Override public long callerSave(String conv) {
+        return switch (conv) {
+        case "SystemV" -> SYSTEM5_CALLER_SAVE;
+        case "win64"   ->   WIN64_CALLER_SAVE;
+        default -> throw new IllegalArgumentException("Unknown calling convention: " + conv);
+        };
+    }
+    @Override public String cCallingConv(String callingConv) {
+        return callingConv;
+    }
+    @Override public long neverSave() { return 1L<<RSP; }
+    @Override public RegMask retMask( TypeFunPtr tfp ) {
+        return tfp.ret() instanceof TypeFloat ? XMM0_MASK : RAX_MASK;
+    }
+    @Override public int rpc() { return RPC; }
+
+
+    // Create a split op; any register to any register, including stack slots
+    @Override public SplitNode split(LRG lrg, String kind, byte round ) {
+        return lrg._machDef!=null && lrg._machDef.outregmap().test(FLAGS)
+            ? new SplitFlagsX86(lrg,kind,round)
+            : new SplitX86(lrg,kind,round);
+    }
+
+    // Return a MachNode unconditional branch
+    @Override public CFGNode jump() {
+        return new UJmpX86();
+    }
+
+    // Instruction selection
+    @Override
+    public Node instSelect(Node n) {
+        return switch (n) {
+        case AddNode      add -> add(add);
+        case AndNode      and -> and(and);
+        case BoolNode    bool -> cmp(bool);
+        case CLInitNode  init -> new CLInitNode(init);
+        case CProjNode      c -> new CProjNode(c);
+        case CallEndNode cend -> new CallEndMach(cend);
+        case CallNode    call -> call(call);
+        case PtrToIntNode  ptr -> new PtrToIntMach(ptr);
+        case GuardNode  guard -> new GuardMach(guard);
+        case ConstantNode con -> con(con);
+        case DivNode      div -> div.mode()==2 ? new DivFX86(div) : new DivX86(div);
+        case EscapeNode   esc -> new EscapeNode(esc);
+        case FunNode      fun -> new FunX86(fun);
+        case FunPtrNode  fptr -> fptr(fptr);
+        case IfNode       iff -> jmp(iff);
+        case LoadNode      ld -> ld(ld);
+        case MemMergeNode mem -> new MemMergeNode(mem);
+        case MinusNode    neg -> {
+            if( neg.mode()==2 ) throw Utils.TODO();
+            yield new NegX86(neg);
+        }
+        case MulNode      mul -> mul.mode()==2 ? new MulFX86(mul) : mul(mul);
+        case NewNode      nnn -> new NewX86(nnn);
+        case NotNode      not -> new NotX86(not);
+        case OrNode        or -> or(or);
+        case ParmNode    parm -> new ParmX86(parm);
+        case BulkMemPhiNode phi-> new BulkMemPhiNode(phi);
+        case MemPhiNode  phi  -> new MemPhiNode(phi);
+        case PhiNode      phi -> new PhiNode(phi);
+        case ProjNode     prj -> prj(prj);
+        case ReadOnlyNode read-> new ReadOnlyMach(read);
+        case ReturnNode   ret -> new RetX86(ret, ret.fun());
+        case SarNode      sar -> sar(sar);
+        case ShlNode      shl -> shl(shl);
+        case ShrNode      shr -> shr(shr);
+        case StartCUNode start -> new StartCUNode(start);
+        case StopCUNode  stop -> new StopCUNode(stop);
+        case StartNode  start -> new StartNode(start);
+        case StopNode    stop -> new StopNode(stop);
+        case StoreNode     st -> st(st);
+        case SubNode      sub -> sub.mode()==2 ? new SubFX86(sub) : sub(sub);
+        case ToFloatNode  tfn -> i2f8(tfn);
+        case ToIntegerNode cvt -> new F8ToIX86(cvt);
+        case XCtrlNode      x -> ConstantNode.raw(Type.XCONTROL);
+        case XorNode      xor -> xor(xor);
+
+        case LoopNode loop -> new LoopNode(loop);
+        case RegionNode region -> new RegionNode(region);
+        default -> throw Utils.TODO();
+        };
+    }
+
+    public static boolean imm8( long imm ) { return -128 <= imm && imm <= 127; }
+
+    public static boolean imm32( long imm ) { return (int)imm==imm; }
+
+    // Attempt a full LEA-style break down.
+    private Node add(AddNode add) {
+        if( add.mode()==2 )
+            return new AddFX86(add);
+        Node lhs = add.in(1);
+        Node rhs = add.in(2);
+        if( lhs instanceof LoadNode ld && ld.nOuts() == 1 && ld.declaredType().log_size() >= 3)
+            return new AddMemX86(add, address(ld), ld.ptr(), idx, off, scale, 0, rhs);
+        // Attempt a full LEA-style break down.
+        // Returns one of AddX86, AddIX86, LeaX86, or LHS
+        if( rhs instanceof ConstantNode off2 && off2._con instanceof TypeInteger toff ) {
+            long imm = toff.value();
+            assert imm!=0;        // Folded in peeps
+            if( (int)imm != imm ) // Full 64bit immediate
+                return new AddX86(add);
+            // Now imm <= 32bits
+            if( lhs instanceof AddNode ladd )
+                // ((base + (idx << scale)) + off)
+                return _lea(add, ladd.in(1), ladd.in(2), (int)imm);
+            if( lhs instanceof ShlNode shift )
+                // (idx << scale) + off; no base
+                return _lea(add, null, shift, (int)imm);
+
+            // lhs + rhs1
+            return new AddIX86(add, (int)imm);
+        }
+        return _lea(add, lhs, rhs, 0);
+    }
+
+
+    private Node _lea(Node add, Node base, Node idx, int off) {
+        int scale = 0;
+        if( base instanceof ShlNode && !(idx instanceof ShlNode) )
+            throw Utils.TODO(); // Bug in canonicalization, should on RHS
+        if( idx instanceof ShlNode shift && shift.in(2) instanceof ConstantNode shfcon &&
+            shfcon._con instanceof TypeInteger tscale && 0 <= tscale.value() && tscale.value() <= 3 ) {
+            idx = shift.in(1);
+            scale = ((int) tscale.value());
+        }
+        // (base + idx) + off
+        return off == 0 && scale == 0
+            ? new AddX86(add)
+            : new LeaX86(add, base, idx, scale, off);
+    }
+
+
+    private Node and(AndNode and) {
+        if( and.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm32(ti.value()) )
+            return new AndIX86(and, (int)ti.value());
+        return new AndX86(and);
+    }
+
+    private Node call(CallNode call) {
+        return call.fptr() instanceof FunPtrNode con
+            ? new CallX86(call, (TypeFunPtr)con._type)
+            : call.fptr() instanceof ConstantNode con && con._type instanceof TypeFunPtr
+            ? new CallX86(call, (TypeFunPtr)con._type)
+            : new CallRX86(call);
+    }
+
+    // Because X86 flags, a normal ideal Bool is 2 X86 ops: a "cmp" and at "setz".
+    // Ideal If reading from a setz will skip it and use the "cmp" instead.
+    private static boolean swap, unsigned;
+    private Node cmp( BoolNode bool ) {
+        swap = unsigned = false;
+        Node cmp = _cmp(bool);
+        return new SetX86(cmp, swap ? IfNode.swap(bool.op()) : bool.op(), unsigned);
+    }
+
+    private Node _cmp(BoolNode bool) {
+        // Float variant
+        if( bool.isFloat() ) {
+            unsigned = true;
+            return new CmpFX86(bool);
+        }
+        Node lhs = bool.in(1);
+        Node rhs = bool.in(2);
+
+        // Since cmp does not record a BOP, SetX/Jmp need to know if the CMP is swapped.
+
+        // Vs memory
+        if( lhs instanceof LoadNode ld && ld.nOuts() == 1 && rhs._type.isa(ld.declaredType()) )
+            return new CmpMemX86(bool, address(ld), ld.ptr(), idx, off, scale, imm(rhs), val, false);
+
+        // Operands swap in the encoding directly, no need for Set/Jmp to swap `bop`
+        if( rhs instanceof LoadNode ld && ld.nOuts() == 1 && lhs._type.isa(ld.declaredType()) &&
+            (!(lhs instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm32(ti.value())) ||
+             bool.op()=="==" || bool.op()=="!=") )
+            return new CmpMemX86(bool, address(ld), ld.ptr(), idx, off, scale, imm(lhs), val, true );
+
+        // Vs immediate
+        if( rhs instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm32(ti.value()) )
+            return new CmpIX86(bool, (int)ti.value(), false);
+
+        // Operand swap compare; Set and Jmp need to swap `bop`
+        if( lhs instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm32(ti.value()) )
+            return new CmpIX86(bool, (int)ti.value(), swap=true);
+
+        // x vs y
+        return new CmpX86(bool);
+    }
+
+    private Node con( ConstantNode con ) {
+        if( !con._con.isConstant() )
+            return ConstantNode.raw(con); // Default unknown caller inputs
+        String ext = con instanceof ExternNode ext0 ? ext0._extern : null;
+        return switch (con._con) {
+        case TypeInteger ti -> new IntX86(con,ext);
+        case TypeFloat   tf -> new FltX86(con,ext);
+        case TypeMemPtr tmp -> new TMPX86(con,ext);
+        case TypeFunPtr tfp -> new TFPX86(tfp,ext);
+        case TypeNil tn -> throw Utils.TODO();
+        // TOP, BOTTOM, XCtrl, Ctrl, etc.  Never any executable code.
+        case Type t -> t == Type.NIL ? new IntX86(con,null) : ConstantNode.raw(con);
+        };
+    }
+
+    private Node fptr( FunPtrNode con ) {
+        return new TFPX86(con);
+    }
+
+    private Node i2f8(ToFloatNode tfn) {
+        assert tfn.in(1)._type instanceof TypeInteger ti;
+        return new I2f8X86(tfn);
+    }
+
+    private Node jmp(IfNode iff) {
+        // If/Bool combos will match to a Cmp/Set which sets flags.
+        // Most general arith ops will also set flags, which the Jmp needs directly.
+        // Loads do not set the flags, and will need an explicit TEST
+        String op = "!=";
+        if( iff.in(1) instanceof BoolNode bool ) op = swap ? IfNode.swap(bool.op()) : bool.op();
+        else if( iff.in(1)==null ) op = "=="; // Never-node cutout
+        else iff.setDef(1, new BoolNode.NE(iff.in(1),
+                                           ConstantNode.raw(TypeInteger.ZERO),
+                                           (byte)(iff.in(1)._type instanceof TypeFloat ? 2 : 1)));
+        return new JmpX86(iff, op);
+    }
+
+    private Node ld(LoadNode ld) {
+        return new LoadX86(address(ld), ld.ptr(), idx, off, scale);
+    }
+
+    private Node mul(MulNode mul) {
+        if( mul.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm32(ti.value()) )
+            return new MulIX86(mul, (int)ti.value());
+        return new MulX86(mul);
+    }
+
+    private Node or(OrNode or) {
+        if( or.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm32(ti.value()) )
+            return new OrIX86(or, (int)ti.value());
+        return new OrX86(or);
+    }
+
+    private Node prj( ProjNode prj ) {
+        if( prj.in(0) instanceof CLInitNode ) return new ProjNode(prj);
+        TypeInteger ret = cReturn(prj);
+        if( ret!=null ) return new ExtendX86(prj,ret);
+        return prj.in(0) instanceof StartNode ? new ProjNode(prj) : new ProjX86(prj);
+    }
+
+    private Node sar(SarNode sar) {
+        if( sar.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm8(ti.value()))
+            return new SarIX86(sar, (int)(ti.value() & 0xff) );
+        return new SarX86(sar);
+    }
+
+    private Node shl(ShlNode shl) {
+        if( shl.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm8(ti.value()))
+            return new ShlIX86(shl, (int)(ti.value() & 0xff) );
+        return new ShlX86(shl);
+    }
+
+    private Node shr( ShrNode shr ) {
+        if( shr.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm8(ti.value()) )
+            return new ShrIX86(shr, (int)(ti.value() & 0xff) );
+        return new ShrX86(shr);
+    }
+
+    private Node st( StoreNode st ) {
+        // Look for "*ptr op= val"
+        Node op = st.val();
+        if( op instanceof AddNode ) {
+            if( op.in(1) instanceof LoadNode ld && stld_match(st,ld) )
+                return new MemAddX86(address(st), st.ptr(), idx, off, scale, imm(op.in(2)), val);
+            if( op.in(2) instanceof LoadNode ld && stld_match(st,ld) )
+                return new MemAddX86(address(st), st.ptr(), idx, off, scale, imm(op.in(1)), val);
+        }
+        return new StoreX86(address(st), st.ptr(), idx, off, scale, imm(st.val()), val);
+    }
+    private static boolean stld_match(StoreNode st, LoadNode ld ) {
+        return
+            ld.in(0) == st.in(0) &&
+            ld.mem() == st.mem() &&
+            ld.ptr() == st.ptr() &&
+            ld.off() == st.off();
+    }
+
+
+    private Node sub (SubNode sub ){
+        return sub.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti
+            ? new AddIX86(sub, (int)-ti.value())
+            : new SubX86(sub);
+    }
+
+    private Node xor (XorNode xor){
+        if( xor.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti && imm32(ti.value()) )
+            return new XorIX86(xor, (int)ti.value());
+        return new XorX86(xor);
+    }
+
+    // Gather X86 addressing mode bits prior to constructing.  This is a
+    // builder pattern, but saving the bits in a *local* *global* here to keep
+    // mess contained.
+    private static int off, scale, imm;
+    private static Node idx, val;
+    private <N extends MemOpNode > N address(N mop) {
+        off = scale = imm = 0;  // Reset
+        idx = val = null;
+        Node base = mop.ptr();
+        // Skip/throw-away a ReadOnly, only used to typecheck
+        if(base instanceof ReadOnlyNode read) base = read.in(1);
+        assert !(base instanceof AddNode) && base._type instanceof TypeMemPtr; // Base ptr always, not some derived
+        if(mop.off() instanceof AddNode add && add.in(2) instanceof ConstantNode con && con._con instanceof TypeInteger ti) {
+            off = (int) ti.value();
+            assert off == ti.value(); // In 32-bit range
+            idx = add.in(1);
+            if(idx instanceof ShlNode shift && shift.in(2) instanceof ConstantNode shfcon &&
+                    shfcon._con instanceof TypeInteger tscale && 0 <= tscale.value() && tscale.value() <= 3) {
+                idx = shift.in(1);
+                scale = (int) tscale.value();
+            }
+        } else {
+            if(mop.off() instanceof ConstantNode con && con._con instanceof TypeInteger ti) {
+                off = (int) ti.value();
+                assert off == ti.value(); // In 32-bit range
+            } else {
+                idx = mop.off();
+            }
+        }
+        return mop;
+    }
+
+    private int imm( Node xval ) {
+        assert val == null && imm == 0;
+        if( xval instanceof ConstantNode con && con._con instanceof TypeInteger ti && ti.isConstant() && imm32(ti.value()) ) {
+            val = null;
+            imm = (int) ti.value();
+            assert imm == ti.value(); // In 32-bit range
+        } else {
+            val = xval;
+        }
+        return imm;
+    }
+
+}