Cleanup public escapesescape-flow

Drop "frozen" public escapes, and recompute in Start/Stop so Opto gets a  precise escape set.
Rename XInt.free -> XInt.alloc
Fix some String tests to not escape by default

23 files changed, 175 insertions, 127 deletions

diff --git a/chapter29/src/main/java/com/seaofnodes/simple/codegen/CodeGen.java b/chapter29/src/main/java/com/seaofnodes/simple/codegen/CodeGen.java
index ba7c0c1d..b4c93e1e 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/codegen/CodeGen.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/codegen/CodeGen.java
@@ -96,80 +96,11 @@ public class CodeGen {
         return null;
     }
 
-    // Frozen after ParseAll: public initializers and function-valued fields.
-    public boolean publicFIDX(int fidx) {
-        return fidx >= GlobalBits.RESERVED && XInt.bit(publicFIDXs(),fidx);
-    }
-
-    private void gatherPublicFields(TypeStruct clz, boolean classFields) {
-        for( Field fld : clz._fields ) {
-            // Private-memory helpers are reached through their allocator.
-            if( fld._fname.charAt(0)=='_' || fld._t==Type.TOP ||
-                clz.hiddenInit(fld) ) continue;
-            if( classFields ) _publicAliases = XInt.make(_publicAliases,fld._alias);
-            if( fld._t instanceof TypeFunPtr tfp )
-                _publicFIDXs = XInt.meet(_publicFIDXs,tfp._fidxs);
-        }
-    }
-
     public static boolean hasUserConstructor(TypeStruct self) {
         Type t = Parser.TYPES.get(TypeStruct.addClzPrefix(self._name));
         return t instanceof TypeStruct clz && clz.field("<ctor>") != null;
     }
 
-    // A forward reference has a placeholder class, not a definition yet.
-    private static boolean resolvedClass(TypeStruct clz) {
-        Type t = Parser.TYPES.get(clz._name.substring(TypeStruct.CLZ.length()));
-        return !(t instanceof TypeStruct ts) || !ts._fref;
-    }
-
-    private int[] _publicFIDXs, _publicAliases;
-    private TypeMem _publicEscapes;
-
-    /**
-     * Snapshot the public interface after ParseAll for interface checks and
-     * the default escapes of opaque external types. This is not an upper
-     * bound on all escapes: a public function can return a private object or
-     * callback. Escape flow preserves those actual values separately.
-     */
-    void freezePublicInterface() {
-        assert _publicFIDXs==null && _publicAliases==null;
-        _publicFIDXs = _publicAliases = XInt.EMPTY;
-        for( Type t : Parser.TYPES.values() )
-            if( t instanceof TypeStruct clz &&
-                TypeStruct.startsClzPrefix(clz._name) &&
-                TypeStruct.isPublicClassName(clz._name) &&
-                resolvedClass(clz) ) {
-                // Gather function pointers from public fields of both class
-                // and instance objects.
-                gatherPublicFields(clz,true);
-                Type self = Parser.TYPES.get(clz._name.substring(TypeStruct.CLZ.length()));
-                if( self instanceof TypeStruct ts ) gatherPublicFields(ts,false);
-            }
-        // Limit broad function types to known FIDXs, excluding reserved bits.
-        // Public class initializers are roots without needing a field reference.
-        int[] fidxs = XInt.EMPTY;
-        for( int fidx = GlobalBits.RESERVED; fidx<_linker._len; fidx++ ) {
-            FunNode fun = _linker.atX(fidx);
-            if( XInt.bit(_publicFIDXs,fidx) || (fun!=null && fun.isClz() && fun.isPublic()) )
-                fidxs = XInt.make(fidxs,fidx);
-        }
-        _publicFIDXs = fidxs;
-        _publicEscapes = TypeMem.START.makeFrom(_publicFIDXs,_publicAliases);
-    }
-
-    public int[] publicFIDXs()  { assert _publicFIDXs !=null; return _publicFIDXs;  }
-    public int[] publicAliases(){ assert _publicAliases!=null; return _publicAliases; }
-    public boolean publicInterfaceFrozen() { return _publicFIDXs != null; }
-
-    // Before Opto upgrades the IR, a forward reference might still name a
-    // local class. Afterwards, unresolved names describe external objects.
-    public TypeMem publicEscapes() {
-        if( _phase==null || _phase.ordinal()<Phase.Opto.ordinal() ) return TypeMem.BOT;
-        assert _publicEscapes!=null;
-        return _publicEscapes;
-    }
-
     // ---------------------------
 
     // Very common nodes, cached here
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/codegen/GlobalBits.java b/chapter29/src/main/java/com/seaofnodes/simple/codegen/GlobalBits.java
index bc9c9d39..acd2eee5 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/codegen/GlobalBits.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/codegen/GlobalBits.java
@@ -1,6 +1,7 @@
 package com.seaofnodes.simple.codegen;
 
 import com.seaofnodes.simple.util.*;
+import com.seaofnodes.simple.type.XInt;
 import java.util.HashMap;
 import java.util.Arrays;
 import java.util.Objects;
@@ -28,6 +29,18 @@ public class GlobalBits {
     // Local dense index
     private int _local;
 
+    // Identities not owned by this compilation. Reserved bits are not foreign.
+    public int[] foreign() {
+        int[] foreign = XInt.alloc((_local>>>5)+2);
+        Arrays.fill(foreign,1,foreign.length,-1);
+        for( int i = 0; i<_local; i++ ) {
+            String owner = _local2Clz.at(i);
+            if( owner==null || !owner.startsWith("C:") )
+                foreign[(i>>>5)+1] &= ~(1<<i);
+        }
+        return XInt.intern(foreign);
+    }
+
     GlobalBits() {
         _local = RESERVED;
         // Reserved null-class bits are global identities and are never
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/codegen/Opto.java b/chapter29/src/main/java/com/seaofnodes/simple/codegen/Opto.java
index 0c37ce39..f841e75b 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/codegen/Opto.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/codegen/Opto.java
@@ -26,6 +26,9 @@ abstract public class Opto {
     // get a fairly precise set of Call Graph edges between CallNodes and
     // FunNodes.
     public static void opto(CodeGen code) {
+        int[] foreign = code._fidxs.foreign();
+        for( int fidx : code._externFunc.keySet() ) foreign = XInt.make(foreign,fidx);
+        code._start._foreign = TypeMem.START.makeFrom(foreign,code._aliases.foreign());
         // Reset Types before running the worklist algorithm
         Ary<Type> oldTypes = new Ary<>(Type.class);
         WorkList<Node> deps = new WorkList<>();
@@ -158,11 +161,9 @@ abstract public class Opto {
     private static void linkCG(CodeGen code, TypeFunPtr tfp, CallNode call) {
         if( tfp.nargs() != call.nargs() ) return; // Error calls hit this
         int[] fidxs = tfp.fidxs();
-        // An unresolved forward call can still carry the infinite, inferred
-        // function set into Opto.  There is no finite call graph to link yet;
-        // type checking will report the unresolved reference afterwards.  This
-        // can yet be valid if the call is eventually dead.
-        //   `if( false ) frefCall(args);`
+        // An infinite target set uses the outside continuation. Escaped local
+        // callbacks are called through Start; their effects feed that same
+        // outside state. Do not attach unrelated same-arity function bodies.
         if( XInt.isHigh(fidxs) ) return;
         for( int fidx = XInt.next(fidxs,0); fidx >=0; fidx = XInt.next(fidxs,fidx) ) {
             // unlinkStart deliberately leaves uncalled functions in a
@@ -185,10 +186,10 @@ abstract public class Opto {
         TypeMem tmem = (TypeMem)tt._types[1];
         int[] fidxs = tmem._escFs;
         if( XInt.isHigh(fidxs) ) {
-            // Unknown values can later refine to private callbacks too.
-            // FULL must cover every live target, just like the finite case.
+            // A cofinite set includes foreign identities but can exclude local
+            // functions. Honor those exclusions just as in the finite case.
             for( FunNode fun : code._linker )
-                if( fun != null && !fun.isDead() )
+                if( fun != null && !fun.isDead() && XInt.bit(fidxs,fun.sig().fidx()) )
                     linkStart(code,fun);
             return;
         }
@@ -200,7 +201,8 @@ abstract public class Opto {
     }
 
     // Function is now reachable by unknown callers through Start.  The
-    // default inputs must therefore use conservative declared types.
+    // Memory and callback defaults read Start's changing outside state.
+    // Scalar defaults remain constants; hidden self uses the owning class.
     static void linkStart( CodeGen code, FunNode fun ) {
         assert !fun.isDead();
         StartCUNode start = fun._compunit._start;
@@ -212,7 +214,9 @@ abstract public class Opto {
             code._iter.add(fun);
             for( Node p : fun._outputs )
                 if( p instanceof ParmNode parm ) {
-                    Node defalt = parm._idx==1 ? start.proj(1) : ConstantNode.seed(parm._declaredType).peephole();
+                    Type t = parm._idx<2 ? parm._declaredType : fun.defaultArg(parm._idx-2);
+                    Node defalt = parm._idx==1 || parm._declaredType instanceof TypeFunPtr
+                        ? start.proj(1) : ConstantNode.seed(t).peephole();
                     parm.insertDef(1,defalt);
                     code.add(parm);
                 }
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/codegen/ParseAll.java b/chapter29/src/main/java/com/seaofnodes/simple/codegen/ParseAll.java
index b77b224c..5f8a0ec0 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/codegen/ParseAll.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/codegen/ParseAll.java
@@ -118,11 +118,6 @@ public abstract class ParseAll {
         for( CompUnit cu : code._compunits.values() )
             if( cu._ext==null )
                 cu._clz = (TypeStruct)Parser.TYPES.get(TypeStruct.addClzPrefix(cu._cname));
-
-        // The complete public interface is now known.  Keep this independent
-        // of later graph/linker liveness so SCCP computations remain local and
-        // monotonic.
-        code.freezePublicInterface();
     }
 
     // Parse one Simple source code file.  Add all the FRefs produced to the worklist.
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/CLInitNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/CLInitNode.java
index f8c1c925..fb762ff3 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/CLInitNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/CLInitNode.java
@@ -84,10 +84,20 @@ public class CLInitNode extends CFGNode implements MultiNode {
             return TypeTuple.make(in(0)._type,mem()._type,mem()._type,Type.XCONTROL);
         Field flag = flag();
         Type slice = flag==null ? TypeMem.BOT : TypeMem.make(flag._alias,TypeInteger.TRUE);
-        // The initializer may write arbitrary public memory. Only its flag
-        // has a guaranteed value on the normal continuation.
-        Type bulk = ready()._type.isHigh() ? TypeMem.TOP :
+        // Before Opto, the initializer has conservative effects. Once linked,
+        // its Return supplies them through the ordinary dependency worklist.
+        // Meet with incoming memory for the path that was already initialized.
+        Type bulk = ready()._type.isHigh() || mem()._type.isHigh() ? TypeMem.TOP :
             ready()._type==TypeInteger.TRUE ? mem()._type : TypeMem.BOT;
+        if( bulk==TypeMem.BOT && ready()._type!=TypeInteger.TRUE &&
+            CodeGen.CODE._phase.ordinal()>=CodeGen.Phase.Opto.ordinal() ) {
+            FunNode target = CodeGen.CODE.link(cu());
+            if( target!=null && target.ret()!=null ) {
+                Type result = addDepForwards(target.ret())._type;
+                Type effects = result instanceof TypeTuple tt ? tt.mem() : result.isHigh() ? TypeMem.TOP : TypeMem.BOT;
+                bulk = mem()._type.meet(effects);
+            }
+        }
         Type call = ready()._type.isHigh() || ready()._type==TypeInteger.TRUE ? Type.XCONTROL : in(0)._type;
         return TypeTuple.make(in(0)._type,bulk,slice,call);
     }
@@ -181,6 +191,10 @@ public class CLInitNode extends CFGNode implements MultiNode {
         // Replace the analysis edge with the ordinary call. Its arguments
         // are the same ones already analyzed before lowering.
         call.link(target);
+        // Publish the linked effects before projections can feed callers.
+        // The unlinked CallEnd's pessimistic seed is not the replacement for
+        // the precise initializer effects already analyzed above.
+        end.setType(end.compute());
         unlink();
         Node called = CodeGen.CODE.add(new CProjNode(end,0,ScopeNode.CTRL).init());
         Node after = CodeGen.CODE.add(new ProjNode(end,1,ScopeNode.MEM0).init());
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/CallEndNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/CallEndNode.java
index 4056e24e..b5156c2d 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/CallEndNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/CallEndNode.java
@@ -86,9 +86,15 @@ public class CallEndNode extends CFGNode implements MultiNode {
         // Mid-fold, just take the inlined callee's return.
         if( _folding ) return in(1)._type;
 
-        // Unknown targets can change any memory and return the declared type.
-        if( XInt.isHigh(tfp.fidxs()) )
-            return TypeTuple.make(Type.CONTROL,TypeMem.BOT,tfp.ret());
+        // The outside continuation reads Start directly: Call can remain
+        // CONTROL while its possible returned identities change.
+        if( XInt.isHigh(tfp.fidxs()) ) {
+            TypeMem outside = CodeGen.CODE._start.outside(this).escapes(call.exposed(this));
+            TypeTuple state = TypeTuple.make(Type.CONTROL,outside,outside.outside(tfp.ret()));
+            for( int i = 1; i<nIns(); i++ )
+                state = (TypeTuple)state.meet(in(i)._type);
+            return state;
+        }
 
         // Check for making a "C" call
         int externs = 0;
@@ -98,7 +104,8 @@ public class CallEndNode extends CFGNode implements MultiNode {
             // C calls have no Return edges. Simple calls have an extra self
             // argument, so the two cannot be targets of the same valid call.
             assert externs==tfp.nfcns();
-            return TypeTuple.make(Type.CONTROL,call.exposed(this),tfp.ret());
+            TypeMem outside = CodeGen.CODE._start.outside(this).escapes(call.exposed(this));
+            return TypeTuple.make(Type.CONTROL,outside,outside.outside(tfp.ret()));
         }
 
         // An unlinked target may have effects, so early conservative return.
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/CallNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/CallNode.java
index 18be3488..552af499 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/CallNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/CallNode.java
@@ -100,7 +100,9 @@ public class CallNode extends CFGNode {
         if( !external() ) return TypeMem.START;
         Type input = dep.addDepForwards(mem())._type;
         TypeMem escaped = input instanceof TypeMem m ? m : input.isHigh() ? TypeMem.TOP : TypeMem.BOT;
-        for( int i = 2; i<nIns()-1; i++ ) escaped = escaped.escapes(dep.addDepForwards(arg(i))._type);
+        TypeMem outside = CodeGen.CODE._start.outside(dep);
+        for( int i = 2; i<nIns()-1; i++ )
+            escaped = escaped.escapesFrom(dep.addDepForwards(arg(i))._type,outside);
         return TypeMem.make(1,Type.BOTTOM,false,false,false,escaped._escFs,escaped._escAs);
     }
 
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ConvertNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ConvertNode.java
index 47c8ecbe..b9fbc4d2 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/ConvertNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ConvertNode.java
@@ -40,8 +40,15 @@ public class ConvertNode extends Node {
         Type src = val()._type;
         if( src.isHigh() ) return Type.TOP;
         if( src==Type.BOTTOM || src==TypeScalar.BOT ) return src;
-        if( _dst instanceof TypeMemPtr ptr ) return ptr.withPartial(TypeMemPtr.mayBePartial(src));
-        if( !(_dst instanceof TypeMemPtr) && src.isa(_dst) ) return src;
+        if( _dst instanceof TypeMemPtr ptr ) {
+            // Assigning to a nullable field does not make a non-null value
+            // null. Keep this fact during SCCP, before idealize removes us.
+            // Shape/access still follow the declaration: switching between
+            // the entire source and destination types is not monotone.
+            if( src instanceof TypeMemPtr actual && actual.notNull() ) ptr = (TypeMemPtr)ptr.nonZero();
+            return ptr.withPartial(TypeMemPtr.mayBePartial(src));
+        }
+        if( src.isa(_dst) ) return src;
         return _dst;
     }
 
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/EscapeNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/EscapeNode.java
index 02f08c19..f7a88df1 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/EscapeNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/EscapeNode.java
@@ -79,7 +79,7 @@ public class EscapeNode extends TypeNode {
         // Keep escapes from the actual private value before narrowing it to
         // the declaration. Selecting its Store from a MemMerge must preserve
         // this result, including Scalar.BOT's unknown pointer escapes.
-        TypeMem defaults = CodeGen.CODE.publicEscapes();
+        TypeMem defaults = CodeGen.CODE._phase.ordinal()<CodeGen.Phase.Opto.ordinal() ? TypeMem.BOT : mpub;
         return TypeMem.make(fld._alias, t, false, false, fld._final, fidxes, aliases)
             .escapesFrom(tpriv,defaults).escapesFrom(t,defaults);
     }
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/FunNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/FunNode.java
index de32bea9..6422f7f1 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/FunNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/FunNode.java
@@ -97,6 +97,17 @@ public class FunNode extends RegionNode {
 
     // Signature can improve over time
     public TypeFunPtr sig() { return _sig; }
+    // A class function's hidden receiver defaults to its owning singleton.
+    // Keep PTR in the signature: it marks the hidden ABI slot and permits
+    // uniform call syntax, including callbacks forwarded by another class.
+    public Type defaultArg(int idx) {
+        Type t = sig().arg(idx);
+        if( idx!=0 || t!=TypePtr.PTR ) return t;
+        TypeStruct clz = (TypeStruct)Parser.TYPES.get(TypeStruct.addClzPrefix(_compunit._cname));
+        assert clz!=null;
+        return TypeMemPtr.make((byte)2,clz,true);
+    }
+
     public void setSig( TypeFunPtr sig ) {
         assert sig.isa(_sig) || resolvesForwardSelf(sig,_sig);
         if( _sig != sig ) {
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/LoadNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/LoadNode.java
index d62152e5..caede11f 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/LoadNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/LoadNode.java
@@ -97,6 +97,13 @@ public class LoadNode extends MemOpNode {
             t = mem._alias==_alias ? mem._t : actual==null ? TypeScalar.BOT : actual._t;
         } else if( mem._alias==_alias )
             t = t.join(mem._t);
+        if( !mem._one ) t = mem.outside(t);
+        // Store forwarding is also a value fact during SCCP. Waiting for the
+        // later rewrite can turn a known non-null stored pointer into a
+        // nullable declaration, then BOTTOM at the next dereference.
+        if( t instanceof TypeMemPtr && pfld._alias>1 &&
+            find(mem(),ptr(),null,null,t) instanceof StoreNode st )
+            t = addDepForwards(st.val())._type;
 
         // A deeply read-only base produces a deeply read-only value.  The
         // generic declared field type must not cast this information away.
@@ -225,38 +232,50 @@ public class LoadNode extends MemOpNode {
     // the unchanged loop memory, or a merge whose every arm folds. Null fails.
     // Register dependencies so a later pointer/offset rewrite retries the query.
     private Node find(Node mem, Node ptr, Node stop, BitSet visit) {
+        return find(mem,ptr,stop,visit,_type);
+    }
+
+    private Node find(Node mem, Node ptr, Node stop, BitSet visit, Type expected) {
         ptr = address(ptr);
-        Field fld;
-        boolean external = ptr._type instanceof TypeMemPtr tmp &&
-            (fld=tmp._obj.field(_name))!=null && fld._extern;
+        Field fld = ptr._type instanceof TypeMemPtr owner ? owner._obj.field(_name) : null;
+        int alias = fld==null ? _alias : fld._alias;
+        boolean external = fld!=null && fld._extern;
         while( mem!=null ) {
             addDep(mem);
             if( mem==stop ) return mem;
             switch( mem ) {
-            case MemMergeNode merge: mem=merge.alias(_alias); break;
+            case MemMergeNode merge: mem=merge.alias(alias); break;
             case StoreNode st:
                 // Alias 1 is still unresolved, not a proven different field.
                 if( st._alias==1 ) return null;
                 addDep(st.ptr());
-                if( _alias==st._alias && (ptr==address(st.ptr()) || ptr==address(st.nnptr())) && off()==st.off() ) {
+                if( alias==st._alias && (ptr==address(st.ptr()) || ptr==address(st.nnptr())) &&
+                    (!_name.equals("[]") && _name.equals(st._name) || off()==st.off() ||
+                     addDep(off())._type.isConstant() && off()._type==addDep(st.off())._type) ) {
                     // Forwarding must preserve the pointer type already seen
                     // by users: completion, read-only view, and recursive shape.
                     // Open declarations can disagree until Opto upgrades them.
-                    if( _type instanceof TypeMemPtr ) {
+                    if( expected instanceof TypeMemPtr ) {
                         Type value = addDep(st.val())._type;
                         if( ptr()._type.isFinal() || declaredType().isFinal() ) value = value.makeRO();
-                        if( !value.isa(_type) ) return null;
+                        if( !value.isa(expected) ) return null;
                     }
                     // A full-width load cannot narrow the forwarded value.
                     if( declaredType() instanceof TypeInteger ti && ti.log_size()==3 &&
-                        !addDep(st.val())._type.isa(_type) ) return null;
+                        !addDep(st.val())._type.isa(expected) ) return null;
                     return st;
                 }
-                if( (external || _alias==st._alias) && (external || !neverAlias(ptr,address(st.ptr()))) &&
+                if( (external || alias==st._alias) && (external || !neverAlias(ptr,address(st.ptr()))) &&
                     !addDep(off())._type.join(addDep(st.off())._type).isHigh() ) return null;
                 mem=st.mem();
                 break;
             case ProjNode proj:
+                if( proj._idx==1 && proj.in(0) instanceof CLInitNode init ) {
+                    Node prior = init.pcopy(1,this);
+                    if( prior==null ) return null;
+                    mem = prior;
+                    break;
+                }
                 // New's memory is private; public memory is joined at Escape.
                 if( external || !(proj.in(0) instanceof NewNode nnn) ) return null;
                 if( declaredType()==Type.BOTTOM ) return null;
@@ -310,6 +329,15 @@ public class LoadNode extends MemOpNode {
     // Type views preserve the address. Keep the actual Load pointer qualified
     // for compute/err; only alias comparisons see through these views.
     private Node address(Node ptr) {
+        // A pointer Load with a proven reaching Store denotes the stored
+        // address even before the later peephole replaces the Load itself.
+        if( ptr instanceof LoadNode ld && addDepForwards(ld)._type instanceof TypeMemPtr &&
+            ld.ptr()._type instanceof TypeMemPtr base && base.notNull() && ld.err()==null &&
+            ld.find(ld.mem(),ld.ptr(),null,null) instanceof StoreNode st )
+            ptr = addDepForwards(st.val());
+        if( ptr instanceof ConvertNode conv && addDep(conv.val())._type instanceof TypeMemPtr src &&
+            src.isa(addDep(conv)._type) && src.accessISA(conv._type) )
+            ptr = conv.val();
         while( ptr instanceof ReadOnlyNode || ptr instanceof ConstructNode con && con._partial ) {
             addDep(ptr);
             ptr = ptr.in(1);
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ParmNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ParmNode.java
index 9c40c75d..1b7aded1 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/ParmNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ParmNode.java
@@ -78,7 +78,12 @@ public class ParmNode extends PhiNode {
             if( ctrl != Type.XCONTROL && ctrl != Type.TOP ) {
                 if( in(i)._type==Type.BOTTOM )
                     return Type.BOTTOM;
-                t = t.meet(in(i)._type);
+                Type arg = in(i)._type;
+                // The unknown-caller callback input is Start's memory
+                // projection, interpreted using this parameter's signature.
+                if( i==1 && r.in(i) instanceof StartNode && _idx>1 && arg instanceof TypeMem outside )
+                    arg = outside.outside(_declaredType);
+                t = t.meet(arg);
             }
         }
         // Recursion is a loop in disguise. A Parm merges the first argument
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/StartNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/StartNode.java
index 78bd8219..36583884 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/StartNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/StartNode.java
@@ -26,6 +26,9 @@ import java.util.HashSet;
 public class StartNode extends LoopNode implements MultiNode {
 
     final Type _arg;
+    // Immutable foreign identity seed, installed with Opto's reset. Actual
+    // local escapes arrive through Stop, not through a frozen public list.
+    public TypeMem _foreign = TypeMem.START;
 
     public StartNode(StartNode start, StopNode stop, Type arg) { super(null,start,stop); _arg = arg;  }
     public StartNode(StartNode start) { super(start); _arg = start==null ? null : start._arg; }
@@ -67,12 +70,22 @@ public class StartNode extends LoopNode implements MultiNode {
         TypeMem tmem = stop._type instanceof TypeTuple tt
             ? tt.mem()
             : stop._type.isHigh() ? TypeMem.START : TypeMem.BOT;
+        if( !(this instanceof StartCUNode) ) tmem = tmem.escapes(_foreign);
+        else if( in(0) instanceof StartNode start ) tmem = tmem.escapes(start.outside(this));
         assert tmem._alias==1 && !tmem._one;
         return TypeTuple.make(Type.CONTROL,tmem,_arg);
     }
 
     @Override public Node idealize() { return null; }
 
+    // Consumers register against the value they read, even when their Call's
+    // control remains unchanged as more identities escape.
+    public TypeMem outside(Node dep) {
+        if( CodeGen.CODE._phase==null || CodeGen.CODE._phase.ordinal()<CodeGen.Phase.Opto.ordinal() ) return TypeMem.BOT;
+        Type t = dep.addDepForwards(this)._type;
+        return t instanceof TypeTuple tt ? tt.mem() : t.isHigh() ? _foreign : TypeMem.BOT;
+    }
+
     // No immediate dominator, and idepth==0
     @Override public int idepth() { return 0; }
     @Override public CFGNode idom(Node dep) { return null; }
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/StopCUNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/StopCUNode.java
index 8a554390..ead635dd 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/StopCUNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/StopCUNode.java
@@ -79,7 +79,7 @@ public class StopCUNode extends StopNode {
                 // Capture (precisely?) all escaping pointer aliases and fidxs.
                 // Escaped fidxs means the linked world can call that function;
                 // escaped aliases means the linked world can R/W those aliases.
-                xmem = xmem.escapes(tret.ret());
+                xmem = xmem.escapesFrom(tret.ret(),start.outside(this));
                 xmem = (TypeMem)xmem.meet(tret.mem());
             }
         }
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/StoreNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/StoreNode.java
index 4114b47c..2574d801 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/StoreNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/StoreNode.java
@@ -98,6 +98,7 @@ public class StoreNode extends MemOpNode {
         // that field again; retain the declared signature instead of unfolding
         // successively sharper copies of its private-memory return type.
         if( mem._one && decl instanceof TypeFunPtr && val instanceof TypeFunPtr ) val = decl;
+        TypeMem outside = TypeMem.opaque(val) ? CodeGen.CODE._start.outside(this) : TypeMem.BOT;
         // A singleton class's final constant field lives in the static image.
         // Its precise memory slice is a constant too; ordinary peepholes can
         // replace this Store before scheduling or instruction selection.
@@ -110,14 +111,14 @@ public class StoreNode extends MemOpNode {
             // This singleton slice contains just the stored value. Copying
             // bulk memory's escapes would freeze a transient FULL bound into
             // the constant, permanently exposing unrelated private functions.
-            return TypeMem.make(_alias,val,true,true,true,null,null).escapesFrom(val);
+            return TypeMem.make(_alias,val,true,true,true,null,null).escapesFrom(val,outside);
 
         // Allocation uses a private TypeMem and nothing else does.  This
         // memory is truly private; a temporary singleton until it escapes -
         // which is never does in a constructor.
         if( !_name.equals("[]") && mem._one )
             // Just track the stored value
-            return TypeMem.make(_alias,val,true,false,fld==null ? _init : fld._final,null,null).escapesFrom(val);
+            return TypeMem.make(_alias,val,true,false,fld==null ? _init : fld._final,null,null).escapesFrom(val,outside);
 
         // Normal aliasing Store.
         assert mem._alias==1 || mem._alias==_alias; // Perfect aliasing
@@ -132,7 +133,7 @@ public class StoreNode extends MemOpNode {
         // Bulk memory's final bit describes its conservative remainder, not
         // this newly precise slice.  Slice finality comes from the field.
         boolean xfinal = fld != null && fld._final;
-        return TypeMem.make(_alias,t,mem._one,mem._clz,xfinal,mem._escFs,mem._escAs).escapesFrom(val);
+        return TypeMem.make(_alias,t,mem._one,mem._clz,xfinal,mem._escFs,mem._escAs).escapesFrom(val,outside);
     }
 
     @Override
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/SummaryNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/SummaryNode.java
index c22b4bdd..483aab89 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/SummaryNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/SummaryNode.java
@@ -26,7 +26,8 @@ public class SummaryNode extends CFGNode implements MultiNode {
         // A library summary does not forget escapes already present in the caller.
         TypeMem mem = in(1)._type instanceof TypeMem m ? m : in(1)._type.isHigh() ? TypeMem.TOP : TypeMem.BOT;
         mem = (TypeMem)mem.meet(_state.mem());
-        for( int i = 2; i<nIns(); i++ ) mem=mem.escapes(in(i)._type);
+        TypeMem outside = CodeGen.CODE._start.outside(this);
+        for( int i = 2; i<nIns(); i++ ) mem = mem.escapesFrom(in(i)._type,outside);
         return TypeTuple.make(_state.ctl(),mem,_state.ret());
     }
     @Override public Node idealize() { return null; }
@@ -34,7 +35,8 @@ public class SummaryNode extends CFGNode implements MultiNode {
         dep.addDepForwards(this);
         if( dep.addDepForwards(in(0))._type.isHigh() ) return TypeMem.START;
         TypeMem mem = (TypeMem)_state.mem();
-        for( int i = 2; i<nIns(); i++ ) mem=mem.escapes(dep.addDepForwards(in(i))._type);
+        TypeMem outside = CodeGen.CODE._start.outside(dep);
+        for( int i = 2; i<nIns(); i++ ) mem = mem.escapesFrom(dep.addDepForwards(in(i))._type,outside);
         return TypeMem.make(1,Type.BOTTOM,false,false,false,mem._escFs,mem._escAs);
     }
     @Override boolean _upgradeType(HashMap<String,Type> types) {
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/parser/Functions.java b/chapter29/src/main/java/com/seaofnodes/simple/parser/Functions.java
index 50775349..5dd66730 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/parser/Functions.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/parser/Functions.java
@@ -291,7 +291,7 @@ final class Functions {
         for( int i = 0; i<ids.length; i++ ) {
             Type t = sig.arg(i);
             // Args take a default input if called from Start/external-world
-            Node parm = new ParmNode(ids[i],i+2,t,fun,ConstantNode.seed(t).peephole()).peephole();
+            Node parm = new ParmNode(ids[i],i+2,t,fun,ConstantNode.seed(fun.defaultArg(i)).peephole()).peephole();
             if( t instanceof TypeMemPtr ptr && ptr._partial ) parm = new ConstructNode(parm).peephole();
             P._scope.define(ids[i], t, (i==0 && ids[0]=="self") || (finals!=null && finals.get(i)), parm, loc);
         }
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/parser/Types.java b/chapter29/src/main/java/com/seaofnodes/simple/parser/Types.java
index 3cb474b1..ffd3a0f4 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/parser/Types.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/parser/Types.java
@@ -146,8 +146,8 @@ final class Types {
         Type t0 = parseType();       // Either return or first arg
         if( t0==null ) return P.posT(old); // Not a function
         Ary<Type> ts = new Ary<>(Type.class);
-        // Always reserve a receiver slot.  Outside constructor scopes it is
-        // broad and unused, so call sites can uniformly pass their self.
+        // Always reserve a receiver slot. Outside constructor scopes the
+        // broad signature also marks the hidden slot for the machine ABI.
         ts.push(implicitSelfType());
         if( P.match("}") )                 // No-arg function { -> type }
             return TypeFunPtr.make(P.match("?"),ts.asAry(),t0);
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/type/Type.java b/chapter29/src/main/java/com/seaofnodes/simple/type/Type.java
index 6c8a3e8d..0f655f49 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/type/Type.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/type/Type.java
@@ -623,11 +623,12 @@ public class Type /*implements Cloneable*/ {
     private static int[] remapBits(GlobalBits fileBits, GlobalBits bits, int[] fileLocals, int firstMapped ) {
         if( fileLocals == XInt.EMPTY || fileLocals == XInt.FULL )
             return fileLocals;
-        assert !XInt.isHigh(fileLocals);
+        boolean complement = XInt.isHigh(fileLocals);
+        if( complement ) fileLocals = XInt.dual(fileLocals);
         int[] locals = XInt.EMPTY;
         for( int fileLocal = XInt.next(fileLocals,-1); fileLocal >=0; fileLocal = XInt.next(fileLocals,fileLocal) )
             locals = XInt.make(locals,fileLocal < firstMapped ? fileLocal : bits.map(fileBits,fileLocal));
-        return locals;
+        return complement ? XInt.dual(locals) : locals;
     }
 
 
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/type/TypeFunPtr.java b/chapter29/src/main/java/com/seaofnodes/simple/type/TypeFunPtr.java
index 56f47bff..19ec5019 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/type/TypeFunPtr.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/type/TypeFunPtr.java
@@ -79,6 +79,10 @@ public class TypeFunPtr extends TypeNil {
     @Override TypeFunPtr makeFrom( byte nil ) { return  nil ==_nil ? this : make(  nil,_open,_sig,_ret, _fidxs); }
     public    TypeFunPtr makeFrom( Type ret ) { return  ret ==_ret ? this : make( _nil,_open,_sig, ret, _fidxs); }
     public    TypeFunPtr makeFrom( int fidx ) { return make1(_nil,_open,_sig,_ret,fidx); }
+    public TypeFunPtr restrictFIDXs(int[] fidxs) {
+        int[] ids = XInt.dual(XInt.meet(XInt.dual(_fidxs),XInt.dual(fidxs)));
+        return ids==_fidxs ? this : make(_nil,_open,_sig,_ret,ids);
+    }
     public    TypeFunPtr makeFrom( Type arg, int idx ) {
         // Alter named arg
         Type[] sig = _sig.clone();
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/type/TypeMem.java b/chapter29/src/main/java/com/seaofnodes/simple/type/TypeMem.java
index 79543e56..5faa7107 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/type/TypeMem.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/type/TypeMem.java
@@ -104,15 +104,24 @@ public class TypeMem extends Type {
     // private definitions here. The caller supplies FULL until local forward
     // types are resolved. Ordinary unknown values still require FULL.
     public TypeMem escapesFrom(Type t, TypeMem defaults) {
-        TypeStruct ts = t instanceof TypeMemPtr ptr ? ptr._obj : t instanceof TypeStruct obj ? obj : null;
-        if( ts!=null && ts._open && ts._fref && !ts.isAry() )
+        if( opaque(t) )
             return makeFrom(XInt.meet(_escFs,defaults._escFs),XInt.meet(_escAs,defaults._escAs));
         return escapesFrom(t);
     }
+    public static boolean opaque(Type t) {
+        TypeStruct ts = t instanceof TypeMemPtr ptr ? ptr._obj : t instanceof TypeStruct obj ? obj : null;
+        return ts!=null && ts._open && ts._fref && !ts.isAry();
+    }
     public TypeMem escapesAliases(Type t) {
         return make(_alias,_t,_one,_clz,_final, _escFs, escapeAlias(_escAs,t));
     }
 
+    // A value supplied by the outside world, bounded by its declared family.
+    // Foreign identities remain possible even when no local function escapes.
+    public Type outside(Type declared) {
+        return declared instanceof TypeFunPtr fun ? fun.restrictFIDXs(_escFs) : declared;
+    }
+
     public static final TypeMem TOP = make(1, Type.TOP   ,true ,true, true , XInt.EMPTY, XInt.EMPTY);
     public static final TypeMem BOT = make(1, Type.BOTTOM,false,false,true , XInt.FULL , XInt.FULL );
     public static final TypeMem START= make(1,Type.BOTTOM,false,false,false, XInt.EMPTY, XInt.EMPTY);
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/type/TypeStruct.java b/chapter29/src/main/java/com/seaofnodes/simple/type/TypeStruct.java
index d699e365..7c9758bd 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/type/TypeStruct.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/type/TypeStruct.java
@@ -99,7 +99,7 @@ public class TypeStruct extends Type {
             maxAlias = Math.max(maxAlias,f._alias);
         int len = XInt.idx(maxAlias)+1;
         if( (maxAlias&31)==31 ) len++;
-        int[] xs = XInt.free(len);
+        int[] xs = XInt.alloc(len);
         for( Field f : _fields )
             if( f._fname.charAt(0) != '_' &&  // Skip private fields.
                 !hiddenInit(f) &&             // Skip private allocation helper.
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/type/XInt.java b/chapter29/src/main/java/com/seaofnodes/simple/type/XInt.java
index 3e74df84..06c9d466 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/type/XInt.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/type/XInt.java
@@ -92,7 +92,7 @@ public abstract class XInt {
         int len = Math.max(xs.length,idx+1);
         if( (x&31)==31 && idx+1==len )
             len++;
-        int[] ys = free(len);
+        int[] ys = alloc(len);
         System.arraycopy(xs,1,ys,1,xs.length-1);
         ys[idx] |= mask(x);
         return intern(ys);
@@ -112,7 +112,7 @@ public abstract class XInt {
             len--;
         // Replace with trimmed
         if( len < xs.length ) {
-            var ys = free(len);
+            var ys = alloc(len);
             System.arraycopy(xs,1,ys,1,len-1);
             xs = _free(xs,ys);
         }
@@ -146,8 +146,9 @@ public abstract class XInt {
             FREES.setX(len, xss = new Ary<>(int[].class));
         return xss;
     }
-    // Pull free array from free list
-    static int[] free(int len) {
+    // Allocate a zeroed mutable array, reusing the free list.
+    // Pass it to intern after filling; do not retain a mutable reference.
+    public static int[] alloc(int len) {
         int[] xs = _xss(len).pop();
         if( xs==null )
             { NEWS++;  xs = new int[len];  }
@@ -176,7 +177,7 @@ public abstract class XInt {
         if( isX ) return xs;
         if( isY ) return ys;
         // Get a free one
-        int[] ms = free(max);
+        int[] ms = alloc(max);
         for( int i=1; i<min; i++ )
             ms[i] = xs[i] | ys[i];
         for( int i=min; i<ms.length; i++ ) {
@@ -189,7 +190,7 @@ public abstract class XInt {
 
     // Dual: flip all the bits
     public static int[] dual(int[] xs) {
-        int[] ds = free(xs.length);
+        int[] ds = alloc(xs.length);
         for( int i=1; i<xs.length; i++ )
             ds[i] = ~xs[i];
         return intern(ds);
@@ -203,7 +204,7 @@ public abstract class XInt {
     }
     public static int[] packed(BAOS bais) {
         int len = bais.packed1();
-        int[] xs = free(len);
+        int[] xs = alloc(len);
         for( int i=1; i<len; i++ )
             xs[i] = bais.packed4();
         return intern(xs);
@@ -230,7 +231,7 @@ public abstract class XInt {
     public static int[] remap( int[] xs, AryInt map ) {
         if( xs==FULL ) return xs;
         assert !isHigh(xs);
-        int[] ys = free(xs.length);
+        int[] ys = alloc(xs.length);
         for( int bit = next(xs,0); bit >=0; bit = next(xs,bit) ) {
             int bat = map.at(bit);
             ys[idx(bat)] |= mask(bat);