From ce3b04603d7af995004291d9a7eb668f313e6772 Mon Sep 17 00:00:00 2001
From: Cliff Click <cliffc@acm.org>
Date: Fri, 6 Nov 2026 16:06:02 -0800
Subject: Cleanup public escapes

Drop "frozen" public escapes, and recompute in Start/Stop so Opto gets a  precise escape set.
Rename XInt.free -> XInt.alloc
Fix some String tests to not escape by default
---
 chapter29/README.md                                |   6 +-
 chapter29/docs/deferred-construction.md            |   5 +
 chapter29/docs/escape-flow.md                      | 147 +++++++++++++++++++++
 .../com/seaofnodes/simple/codegen/CodeGen.java     |  69 ----------
 .../com/seaofnodes/simple/codegen/GlobalBits.java  |  13 ++
 .../java/com/seaofnodes/simple/codegen/Opto.java   |  24 ++--
 .../com/seaofnodes/simple/codegen/ParseAll.java    |   5 -
 .../com/seaofnodes/simple/node/CLInitNode.java     |  20 ++-
 .../com/seaofnodes/simple/node/CallEndNode.java    |  15 ++-
 .../java/com/seaofnodes/simple/node/CallNode.java  |   4 +-
 .../com/seaofnodes/simple/node/ConvertNode.java    |  11 +-
 .../com/seaofnodes/simple/node/EscapeNode.java     |   2 +-
 .../java/com/seaofnodes/simple/node/FunNode.java   |  11 ++
 .../java/com/seaofnodes/simple/node/LoadNode.java  |  46 +++++--
 .../java/com/seaofnodes/simple/node/ParmNode.java  |   7 +-
 .../java/com/seaofnodes/simple/node/StartNode.java |  13 ++
 .../com/seaofnodes/simple/node/StopCUNode.java     |   2 +-
 .../java/com/seaofnodes/simple/node/StoreNode.java |   7 +-
 .../com/seaofnodes/simple/node/SummaryNode.java    |   6 +-
 .../com/seaofnodes/simple/parser/Functions.java    |   2 +-
 .../java/com/seaofnodes/simple/parser/Types.java   |   4 +-
 .../main/java/com/seaofnodes/simple/type/Type.java |   5 +-
 .../com/seaofnodes/simple/type/TypeFunPtr.java     |   4 +
 .../java/com/seaofnodes/simple/type/TypeMem.java   |  13 +-
 .../com/seaofnodes/simple/type/TypeStruct.java     |   2 +-
 .../main/java/com/seaofnodes/simple/type/XInt.java |  17 +--
 .../java/com/seaofnodes/simple/Chapter20Test.java  |  23 ++--
 .../java/com/seaofnodes/simple/Chapter21Test.java  |  38 +++---
 .../java/com/seaofnodes/simple/Chapter25Test.java  |  66 ++++++---
 .../simple/ClassInitDependenciesTest.java          |  22 +++
 .../java/com/seaofnodes/simple/EscapeFlowTest.java | 112 ++++++++++++++++
 31 files changed, 547 insertions(+), 174 deletions(-)
 create mode 100644 chapter29/docs/escape-flow.md
 create mode 100644 chapter29/src/test/java/com/seaofnodes/simple/EscapeFlowTest.java

(limited to 'chapter29')

diff --git a/chapter29/README.md b/chapter29/README.md
index 9bd5843e..5dae8de6 100644
--- a/chapter29/README.md
+++ b/chapter29/README.md
@@ -42,7 +42,11 @@ Fresh fields start at `TypeScalar.BOT`, which preserves a missing live arm at a
 merge. Forward memory types supply the initialization proof at Loads and merged
 Returns. Checks run at TypeCheck using the existing optimization passes; there
 is no extra construction solve, initialization walk, or field-state map.
-Known failures are recorded in [the late-check notes](docs/deferred-construction.md).
+The earlier experiments are recorded in [the late-check notes](docs/deferred-construction.md).
+The [outside-world escape flow](docs/escape-flow.md) now restores the four
+recursive-class IR expectations and gives hidden class receivers their owning
+singleton as the unknown-caller default. The frozen public-interface inventory
+is removed; late imported identities remain a precision follow-up.
 Class singleton initialization
 retains its existing store-at-exit path.
 
diff --git a/chapter29/docs/deferred-construction.md b/chapter29/docs/deferred-construction.md
index ff0a2765..104ab9e9 100644
--- a/chapter29/docs/deferred-construction.md
+++ b/chapter29/docs/deferred-construction.md
@@ -1,5 +1,10 @@
 # Deferring construction checks: experiment
 
+The [escape-flow continuation](escape-flow.md) supersedes the frozen-public
+fallback and remaining recursive-test failures described later in these notes.
+All four recursive examples now pass their original printed-IR expectations.
+The older audit below records the evidence that led to this change.
+
 The extra construction pass is removed from the working implementation.
 `Construction.check()`, its retained source-use lists, `Iter.types()`, and the
 separate constructor-Return walk are gone. Errors now belong to the existing
diff --git a/chapter29/docs/escape-flow.md b/chapter29/docs/escape-flow.md
new file mode 100644
index 00000000..8ad49f15
--- /dev/null
+++ b/chapter29/docs/escape-flow.md
@@ -0,0 +1,147 @@
+# Outside-world escape flow
+
+The `escape-flow` branch developed this design in Chapter29 and backported it
+to Chapters 28a/28b. Chapter28a uses `LocalIds` and its existing initializer
+root/lowering protocol; Chapter28b adds saved summaries and cofinite identity
+remapping. Neither port imports Chapter29's deferred-construction model.
+
+## The cycle
+
+The outside world's access to local objects and functions is a value in the
+Start/Stop cycle. Public declarations are not that value. The frozen public
+interface inventory has been removed; public-method and public-alias tests
+check the converged outside escape sets directly.
+
+At Opto setup, the outer Start receives a constant foreign-identity seed:
+
+```
+foreign identities = FULL minus identities owned by this compilation
+outside identities = foreign identities union discovered local escapes
+```
+
+Known native function and storage identities are foreign too. The infinite
+tail permits future foreign functions even when no local callback has escaped.
+The finite exclusions include registered imported identities, including bodies
+represented by summaries. This scans identity tables, not the IR. Opto's
+existing reset/worklist solve discovers the local escapes.
+
+StartCU includes the shared outside state. Infinite FIDX sets must retain their
+exclusions: `Opto.linkStart` checks each local function's membership rather than
+treating every cofinite set as FULL. Serialization remaps a cofinite set by
+remapping its finite exclusions and complementing again.
+
+Before Opto, outside queries remain pessimistic. During SCCP, a consumer can
+read the foreign seed before Start has run: otherwise a temporary finite set
+can turn a generic foreign callback into an unrelated local function with the
+same arity. No previous escape result is accumulated to repair value flow.
+
+## Consumers and dependencies
+
+* Memory and callback defaults for unknown callers use Start's memory
+  projection. Parm applies its declared callback signature to the escaping
+  FIDX set. Defaults whose values do not depend on escapes remain constants.
+* Unknown/native CallEnd results use the outside state and the current call's
+  exposed arguments. Callback results are bounded by their declared signature
+  and the outside FIDX set. Explicit linked Return effects are retained.
+* CallEnd registers a direct dependency on Start. Depending only on Call is
+  insufficient: Call can stay CONTROL while the outside set changes. This
+  first implementation uses `addDepForwards`; it does not change CallEnd's
+  input layout or introduce a synthetic Fun/Return pair.
+* Infinite calls use the outside continuation. Escaped local functions remain
+  callable through Start, and their effects return through Stop. Attaching
+  every same-arity body to an infinite call is incorrect: argument/result
+  families may differ despite the equal arity.
+* Outgoing Call argument exposure is independent of CallEnd, including a call
+  that never returns. The shared fixed point also permits immediate callback
+  round trips and reentrant calls.
+* Opaque external values in Escape, Store, Return, and imported-summary paths
+  use the current outside/input-memory bound. Explicit private values and
+  already accumulated escapes remain included. Arbitrary local BOTTOM values
+  still require FULL.
+* Function-valued Loads use their memory input's FIDX bound, joined with the
+  field declaration. They do not independently manufacture an escape set.
+
+CLInit was another unconditional producer of FULL. During Opto it now depends
+on the known initializer's Return and merges those effects with incoming
+memory. It waits for live memory before publishing effects. Lowering computes
+the replacement CallEnd's linked type before exposing its projections, so a
+temporary unlinked MemBot cannot widen the already analyzed caller.
+
+## Why the recursive tests needed local precision too
+
+All four former Chapter12 printed-IR failures pass their original expectations.
+The problem was not solely an outside-call default:
+
+1. Convert widened a non-null pointer to a nullable declaration until its later
+   identity rewrite. It now preserves non-nullness in compute. Preserving the
+   entire source shape conditionally failed the existing monotonicity test;
+   shape and access still follow the declaration.
+2. A Load could wait until post-SCCP Store forwarding to recover that non-null
+   pointer. In the meantime the next dereference produced BOTTOM, which fed
+   FULL around the memory cycle and revived private constructors.
+3. Forwarded addresses, resolved field aliases, and already-bypassed CLInit
+   projections were also waiting for graph rewrites.
+
+Load's existing forwarding search now supplies pointer value facts during
+compute, without constructing or rewriting nodes. It can recognize a stored
+address through a valid pointer conversion or a proven forwarded Load, use a
+resolved named field before layout, and follow an existing CLInit bypass.
+The same dependency mechanism reruns the search when its evidence changes.
+Nullable/incomplete access checks still precede this sharpening; arbitrary
+memory Phis and unknown stores remain barriers. This adds local queries, not a
+new whole-program pass, analysis map, or second IR.
+
+## Hidden class receivers
+
+A class function's hidden `#self` defaults to its owning class singleton.
+Seeding that input with TypePtr.PTR used to give FULL escapes when forwarded
+to an unknown callback. For example:
+
+```simple
+val _hidden_noInline = { int n -> return n+2; };
+val apply_noInline = { {int->int} f,int n -> return f(n); };
+return apply_noInline;
+```
+
+`FunNode.defaultArg` now supplies the Test class singleton for this receiver,
+both during parsing and when Opto reconnects unknown callers. The callback
+parameter still reads Start dynamically. The printed-IR regression verifies
+that only `<clinit>` and `apply_noInline` escape; `_hidden_noInline` stays private.
+
+The function signature retains TypePtr.PTR in this slot. The backends use it
+to identify the hidden ABI argument, and callback annotations must not bind
+the receiver to the class where the annotation appears. Explicit calls still
+supply their actual receiver; instance methods keep their declared object
+type. This sharpens the default input, not every abstract pointer: a local
+merge of a private object and private callback can also have an abstract
+pointer type, so capping arbitrary TypePtr values at outside escapes is unsound.
+
+## Remaining design question
+
+Late imported identities also deserve further precision work: identities not
+registered when Opto starts lie in the foreign tail. Existing import tests
+exercise correctness, but this can remain conservative when bodies arrive
+later. This limitation is not repaired by resetting the whole IR.
+
+## Validation
+
+The combined `make -k tests CHAPTERS="chapter28a chapter28b chapter29" CTAGS=`
+run passes with assertions: 538 active tests in Chapter28a, 578 in Chapter28b,
+and 601 in Chapter29. Shared printer and ISA checks pass too. The log is saved
+under ignored `build/escape-backport-final.log`.
+
+`EscapeFlowTest` covers opaque wrappers with three worklist seeds, foreign
+callback parameters, private callbacks passed to and returned from native code,
+and a CallEnd dependency that responds when only Start's escape set changes.
+It also checks that public allocators escape while their private-memory helpers
+do not. Class-init tests cover unknown callback cycles; saved-library tests in
+28b/29 verify private-function exclusions survive identity remapping.
+The existing suites cover nonreturning native calls, class-init cycles,
+constructor rejection, serialization, imported callbacks, and three backends.
+The four recursive-class examples also pass a separate 16-case worklist-seed
+check. Backport IR expectations now retain public allocator Returns instead of
+private-memory helper Returns. The String allocation/encoding/export fixtures
+in 28a/28b/29 now declare `_hashCodeString` before the public `hashCode` wrapper,
+so the implicit return exposes the wrapper. Their measured spill expectations
+are 12/8/6 (x86/RISC-V/ARM); native x86 export expects 12. The reordered fixture
+also measures 8 on RISC-V before the backport, versus the old order's 6.
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/codegen/CodeGen.java b/chapter29/src/main/java/com/seaofnodes/simple/codegen/CodeGen.java
index ba7c0c1d..b4c93e1e 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/codegen/CodeGen.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/codegen/CodeGen.java
@@ -96,80 +96,11 @@ public class CodeGen {
         return null;
     }
 
-    // Frozen after ParseAll: public initializers and function-valued fields.
-    public boolean publicFIDX(int fidx) {
-        return fidx >= GlobalBits.RESERVED && XInt.bit(publicFIDXs(),fidx);
-    }
-
-    private void gatherPublicFields(TypeStruct clz, boolean classFields) {
-        for( Field fld : clz._fields ) {
-            // Private-memory helpers are reached through their allocator.
-            if( fld._fname.charAt(0)=='_' || fld._t==Type.TOP ||
-                clz.hiddenInit(fld) ) continue;
-            if( classFields ) _publicAliases = XInt.make(_publicAliases,fld._alias);
-            if( fld._t instanceof TypeFunPtr tfp )
-                _publicFIDXs = XInt.meet(_publicFIDXs,tfp._fidxs);
-        }
-    }
-
     public static boolean hasUserConstructor(TypeStruct self) {
         Type t = Parser.TYPES.get(TypeStruct.addClzPrefix(self._name));
         return t instanceof TypeStruct clz && clz.field("<ctor>") != null;
     }
 
-    // A forward reference has a placeholder class, not a definition yet.
-    private static boolean resolvedClass(TypeStruct clz) {
-        Type t = Parser.TYPES.get(clz._name.substring(TypeStruct.CLZ.length()));
-        return !(t instanceof TypeStruct ts) || !ts._fref;
-    }
-
-    private int[] _publicFIDXs, _publicAliases;
-    private TypeMem _publicEscapes;
-
-    /**
-     * Snapshot the public interface after ParseAll for interface checks and
-     * the default escapes of opaque external types. This is not an upper
-     * bound on all escapes: a public function can return a private object or
-     * callback. Escape flow preserves those actual values separately.
-     */
-    void freezePublicInterface() {
-        assert _publicFIDXs==null && _publicAliases==null;
-        _publicFIDXs = _publicAliases = XInt.EMPTY;
-        for( Type t : Parser.TYPES.values() )
-            if( t instanceof TypeStruct clz &&
-                TypeStruct.startsClzPrefix(clz._name) &&
-                TypeStruct.isPublicClassName(clz._name) &&
-                resolvedClass(clz) ) {
-                // Gather function pointers from public fields of both class
-                // and instance objects.
-                gatherPublicFields(clz,true);
-                Type self = Parser.TYPES.get(clz._name.substring(TypeStruct.CLZ.length()));
-                if( self instanceof TypeStruct ts ) gatherPublicFields(ts,false);
-            }
-        // Limit broad function types to known FIDXs, excluding reserved bits.
-        // Public class initializers are roots without needing a field reference.
-        int[] fidxs = XInt.EMPTY;
-        for( int fidx = GlobalBits.RESERVED; fidx<_linker._len; fidx++ ) {
-            FunNode fun = _linker.atX(fidx);
-            if( XInt.bit(_publicFIDXs,fidx) || (fun!=null && fun.isClz() && fun.isPublic()) )
-                fidxs = XInt.make(fidxs,fidx);
-        }
-        _publicFIDXs = fidxs;
-        _publicEscapes = TypeMem.START.makeFrom(_publicFIDXs,_publicAliases);
-    }
-
-    public int[] publicFIDXs()  { assert _publicFIDXs !=null; return _publicFIDXs;  }
-    public int[] publicAliases(){ assert _publicAliases!=null; return _publicAliases; }
-    public boolean publicInterfaceFrozen() { return _publicFIDXs != null; }
-
-    // Before Opto upgrades the IR, a forward reference might still name a
-    // local class. Afterwards, unresolved names describe external objects.
-    public TypeMem publicEscapes() {
-        if( _phase==null || _phase.ordinal()<Phase.Opto.ordinal() ) return TypeMem.BOT;
-        assert _publicEscapes!=null;
-        return _publicEscapes;
-    }
-
     // ---------------------------
 
     // Very common nodes, cached here
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/codegen/GlobalBits.java b/chapter29/src/main/java/com/seaofnodes/simple/codegen/GlobalBits.java
index bc9c9d39..acd2eee5 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/codegen/GlobalBits.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/codegen/GlobalBits.java
@@ -1,6 +1,7 @@
 package com.seaofnodes.simple.codegen;
 
 import com.seaofnodes.simple.util.*;
+import com.seaofnodes.simple.type.XInt;
 import java.util.HashMap;
 import java.util.Arrays;
 import java.util.Objects;
@@ -28,6 +29,18 @@ public class GlobalBits {
     // Local dense index
     private int _local;
 
+    // Identities not owned by this compilation. Reserved bits are not foreign.
+    public int[] foreign() {
+        int[] foreign = XInt.alloc((_local>>>5)+2);
+        Arrays.fill(foreign,1,foreign.length,-1);
+        for( int i = 0; i<_local; i++ ) {
+            String owner = _local2Clz.at(i);
+            if( owner==null || !owner.startsWith("C:") )
+                foreign[(i>>>5)+1] &= ~(1<<i);
+        }
+        return XInt.intern(foreign);
+    }
+
     GlobalBits() {
         _local = RESERVED;
         // Reserved null-class bits are global identities and are never
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/codegen/Opto.java b/chapter29/src/main/java/com/seaofnodes/simple/codegen/Opto.java
index 0c37ce39..f841e75b 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/codegen/Opto.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/codegen/Opto.java
@@ -26,6 +26,9 @@ abstract public class Opto {
     // get a fairly precise set of Call Graph edges between CallNodes and
     // FunNodes.
     public static void opto(CodeGen code) {
+        int[] foreign = code._fidxs.foreign();
+        for( int fidx : code._externFunc.keySet() ) foreign = XInt.make(foreign,fidx);
+        code._start._foreign = TypeMem.START.makeFrom(foreign,code._aliases.foreign());
         // Reset Types before running the worklist algorithm
         Ary<Type> oldTypes = new Ary<>(Type.class);
         WorkList<Node> deps = new WorkList<>();
@@ -158,11 +161,9 @@ abstract public class Opto {
     private static void linkCG(CodeGen code, TypeFunPtr tfp, CallNode call) {
         if( tfp.nargs() != call.nargs() ) return; // Error calls hit this
         int[] fidxs = tfp.fidxs();
-        // An unresolved forward call can still carry the infinite, inferred
-        // function set into Opto.  There is no finite call graph to link yet;
-        // type checking will report the unresolved reference afterwards.  This
-        // can yet be valid if the call is eventually dead.
-        //   `if( false ) frefCall(args);`
+        // An infinite target set uses the outside continuation. Escaped local
+        // callbacks are called through Start; their effects feed that same
+        // outside state. Do not attach unrelated same-arity function bodies.
         if( XInt.isHigh(fidxs) ) return;
         for( int fidx = XInt.next(fidxs,0); fidx >=0; fidx = XInt.next(fidxs,fidx) ) {
             // unlinkStart deliberately leaves uncalled functions in a
@@ -185,10 +186,10 @@ abstract public class Opto {
         TypeMem tmem = (TypeMem)tt._types[1];
         int[] fidxs = tmem._escFs;
         if( XInt.isHigh(fidxs) ) {
-            // Unknown values can later refine to private callbacks too.
-            // FULL must cover every live target, just like the finite case.
+            // A cofinite set includes foreign identities but can exclude local
+            // functions. Honor those exclusions just as in the finite case.
             for( FunNode fun : code._linker )
-                if( fun != null && !fun.isDead() )
+                if( fun != null && !fun.isDead() && XInt.bit(fidxs,fun.sig().fidx()) )
                     linkStart(code,fun);
             return;
         }
@@ -200,7 +201,8 @@ abstract public class Opto {
     }
 
     // Function is now reachable by unknown callers through Start.  The
-    // default inputs must therefore use conservative declared types.
+    // Memory and callback defaults read Start's changing outside state.
+    // Scalar defaults remain constants; hidden self uses the owning class.
     static void linkStart( CodeGen code, FunNode fun ) {
         assert !fun.isDead();
         StartCUNode start = fun._compunit._start;
@@ -212,7 +214,9 @@ abstract public class Opto {
             code._iter.add(fun);
             for( Node p : fun._outputs )
                 if( p instanceof ParmNode parm ) {
-                    Node defalt = parm._idx==1 ? start.proj(1) : ConstantNode.seed(parm._declaredType).peephole();
+                    Type t = parm._idx<2 ? parm._declaredType : fun.defaultArg(parm._idx-2);
+                    Node defalt = parm._idx==1 || parm._declaredType instanceof TypeFunPtr
+                        ? start.proj(1) : ConstantNode.seed(t).peephole();
                     parm.insertDef(1,defalt);
                     code.add(parm);
                 }
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/codegen/ParseAll.java b/chapter29/src/main/java/com/seaofnodes/simple/codegen/ParseAll.java
index b77b224c..5f8a0ec0 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/codegen/ParseAll.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/codegen/ParseAll.java
@@ -118,11 +118,6 @@ public abstract class ParseAll {
         for( CompUnit cu : code._compunits.values() )
             if( cu._ext==null )
                 cu._clz = (TypeStruct)Parser.TYPES.get(TypeStruct.addClzPrefix(cu._cname));
-
-        // The complete public interface is now known.  Keep this independent
-        // of later graph/linker liveness so SCCP computations remain local and
-        // monotonic.
-        code.freezePublicInterface();
     }
 
     // Parse one Simple source code file.  Add all the FRefs produced to the worklist.
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/CLInitNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/CLInitNode.java
index f8c1c925..fb762ff3 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/CLInitNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/CLInitNode.java
@@ -84,10 +84,20 @@ public class CLInitNode extends CFGNode implements MultiNode {
             return TypeTuple.make(in(0)._type,mem()._type,mem()._type,Type.XCONTROL);
         Field flag = flag();
         Type slice = flag==null ? TypeMem.BOT : TypeMem.make(flag._alias,TypeInteger.TRUE);
-        // The initializer may write arbitrary public memory. Only its flag
-        // has a guaranteed value on the normal continuation.
-        Type bulk = ready()._type.isHigh() ? TypeMem.TOP :
+        // Before Opto, the initializer has conservative effects. Once linked,
+        // its Return supplies them through the ordinary dependency worklist.
+        // Meet with incoming memory for the path that was already initialized.
+        Type bulk = ready()._type.isHigh() || mem()._type.isHigh() ? TypeMem.TOP :
             ready()._type==TypeInteger.TRUE ? mem()._type : TypeMem.BOT;
+        if( bulk==TypeMem.BOT && ready()._type!=TypeInteger.TRUE &&
+            CodeGen.CODE._phase.ordinal()>=CodeGen.Phase.Opto.ordinal() ) {
+            FunNode target = CodeGen.CODE.link(cu());
+            if( target!=null && target.ret()!=null ) {
+                Type result = addDepForwards(target.ret())._type;
+                Type effects = result instanceof TypeTuple tt ? tt.mem() : result.isHigh() ? TypeMem.TOP : TypeMem.BOT;
+                bulk = mem()._type.meet(effects);
+            }
+        }
         Type call = ready()._type.isHigh() || ready()._type==TypeInteger.TRUE ? Type.XCONTROL : in(0)._type;
         return TypeTuple.make(in(0)._type,bulk,slice,call);
     }
@@ -181,6 +191,10 @@ public class CLInitNode extends CFGNode implements MultiNode {
         // Replace the analysis edge with the ordinary call. Its arguments
         // are the same ones already analyzed before lowering.
         call.link(target);
+        // Publish the linked effects before projections can feed callers.
+        // The unlinked CallEnd's pessimistic seed is not the replacement for
+        // the precise initializer effects already analyzed above.
+        end.setType(end.compute());
         unlink();
         Node called = CodeGen.CODE.add(new CProjNode(end,0,ScopeNode.CTRL).init());
         Node after = CodeGen.CODE.add(new ProjNode(end,1,ScopeNode.MEM0).init());
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/CallEndNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/CallEndNode.java
index 4056e24e..b5156c2d 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/CallEndNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/CallEndNode.java
@@ -86,9 +86,15 @@ public class CallEndNode extends CFGNode implements MultiNode {
         // Mid-fold, just take the inlined callee's return.
         if( _folding ) return in(1)._type;
 
-        // Unknown targets can change any memory and return the declared type.
-        if( XInt.isHigh(tfp.fidxs()) )
-            return TypeTuple.make(Type.CONTROL,TypeMem.BOT,tfp.ret());
+        // The outside continuation reads Start directly: Call can remain
+        // CONTROL while its possible returned identities change.
+        if( XInt.isHigh(tfp.fidxs()) ) {
+            TypeMem outside = CodeGen.CODE._start.outside(this).escapes(call.exposed(this));
+            TypeTuple state = TypeTuple.make(Type.CONTROL,outside,outside.outside(tfp.ret()));
+            for( int i = 1; i<nIns(); i++ )
+                state = (TypeTuple)state.meet(in(i)._type);
+            return state;
+        }
 
         // Check for making a "C" call
         int externs = 0;
@@ -98,7 +104,8 @@ public class CallEndNode extends CFGNode implements MultiNode {
             // C calls have no Return edges. Simple calls have an extra self
             // argument, so the two cannot be targets of the same valid call.
             assert externs==tfp.nfcns();
-            return TypeTuple.make(Type.CONTROL,call.exposed(this),tfp.ret());
+            TypeMem outside = CodeGen.CODE._start.outside(this).escapes(call.exposed(this));
+            return TypeTuple.make(Type.CONTROL,outside,outside.outside(tfp.ret()));
         }
 
         // An unlinked target may have effects, so early conservative return.
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/CallNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/CallNode.java
index 18be3488..552af499 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/CallNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/CallNode.java
@@ -100,7 +100,9 @@ public class CallNode extends CFGNode {
         if( !external() ) return TypeMem.START;
         Type input = dep.addDepForwards(mem())._type;
         TypeMem escaped = input instanceof TypeMem m ? m : input.isHigh() ? TypeMem.TOP : TypeMem.BOT;
-        for( int i = 2; i<nIns()-1; i++ ) escaped = escaped.escapes(dep.addDepForwards(arg(i))._type);
+        TypeMem outside = CodeGen.CODE._start.outside(dep);
+        for( int i = 2; i<nIns()-1; i++ )
+            escaped = escaped.escapesFrom(dep.addDepForwards(arg(i))._type,outside);
         return TypeMem.make(1,Type.BOTTOM,false,false,false,escaped._escFs,escaped._escAs);
     }
 
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ConvertNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ConvertNode.java
index 47c8ecbe..b9fbc4d2 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/ConvertNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ConvertNode.java
@@ -40,8 +40,15 @@ public class ConvertNode extends Node {
         Type src = val()._type;
         if( src.isHigh() ) return Type.TOP;
         if( src==Type.BOTTOM || src==TypeScalar.BOT ) return src;
-        if( _dst instanceof TypeMemPtr ptr ) return ptr.withPartial(TypeMemPtr.mayBePartial(src));
-        if( !(_dst instanceof TypeMemPtr) && src.isa(_dst) ) return src;
+        if( _dst instanceof TypeMemPtr ptr ) {
+            // Assigning to a nullable field does not make a non-null value
+            // null. Keep this fact during SCCP, before idealize removes us.
+            // Shape/access still follow the declaration: switching between
+            // the entire source and destination types is not monotone.
+            if( src instanceof TypeMemPtr actual && actual.notNull() ) ptr = (TypeMemPtr)ptr.nonZero();
+            return ptr.withPartial(TypeMemPtr.mayBePartial(src));
+        }
+        if( src.isa(_dst) ) return src;
         return _dst;
     }
 
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/EscapeNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/EscapeNode.java
index 02f08c19..f7a88df1 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/EscapeNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/EscapeNode.java
@@ -79,7 +79,7 @@ public class EscapeNode extends TypeNode {
         // Keep escapes from the actual private value before narrowing it to
         // the declaration. Selecting its Store from a MemMerge must preserve
         // this result, including Scalar.BOT's unknown pointer escapes.
-        TypeMem defaults = CodeGen.CODE.publicEscapes();
+        TypeMem defaults = CodeGen.CODE._phase.ordinal()<CodeGen.Phase.Opto.ordinal() ? TypeMem.BOT : mpub;
         return TypeMem.make(fld._alias, t, false, false, fld._final, fidxes, aliases)
             .escapesFrom(tpriv,defaults).escapesFrom(t,defaults);
     }
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/FunNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/FunNode.java
index de32bea9..6422f7f1 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/FunNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/FunNode.java
@@ -97,6 +97,17 @@ public class FunNode extends RegionNode {
 
     // Signature can improve over time
     public TypeFunPtr sig() { return _sig; }
+    // A class function's hidden receiver defaults to its owning singleton.
+    // Keep PTR in the signature: it marks the hidden ABI slot and permits
+    // uniform call syntax, including callbacks forwarded by another class.
+    public Type defaultArg(int idx) {
+        Type t = sig().arg(idx);
+        if( idx!=0 || t!=TypePtr.PTR ) return t;
+        TypeStruct clz = (TypeStruct)Parser.TYPES.get(TypeStruct.addClzPrefix(_compunit._cname));
+        assert clz!=null;
+        return TypeMemPtr.make((byte)2,clz,true);
+    }
+
     public void setSig( TypeFunPtr sig ) {
         assert sig.isa(_sig) || resolvesForwardSelf(sig,_sig);
         if( _sig != sig ) {
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/LoadNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/LoadNode.java
index d62152e5..caede11f 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/LoadNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/LoadNode.java
@@ -97,6 +97,13 @@ public class LoadNode extends MemOpNode {
             t = mem._alias==_alias ? mem._t : actual==null ? TypeScalar.BOT : actual._t;
         } else if( mem._alias==_alias )
             t = t.join(mem._t);
+        if( !mem._one ) t = mem.outside(t);
+        // Store forwarding is also a value fact during SCCP. Waiting for the
+        // later rewrite can turn a known non-null stored pointer into a
+        // nullable declaration, then BOTTOM at the next dereference.
+        if( t instanceof TypeMemPtr && pfld._alias>1 &&
+            find(mem(),ptr(),null,null,t) instanceof StoreNode st )
+            t = addDepForwards(st.val())._type;
 
         // A deeply read-only base produces a deeply read-only value.  The
         // generic declared field type must not cast this information away.
@@ -225,38 +232,50 @@ public class LoadNode extends MemOpNode {
     // the unchanged loop memory, or a merge whose every arm folds. Null fails.
     // Register dependencies so a later pointer/offset rewrite retries the query.
     private Node find(Node mem, Node ptr, Node stop, BitSet visit) {
+        return find(mem,ptr,stop,visit,_type);
+    }
+
+    private Node find(Node mem, Node ptr, Node stop, BitSet visit, Type expected) {
         ptr = address(ptr);
-        Field fld;
-        boolean external = ptr._type instanceof TypeMemPtr tmp &&
-            (fld=tmp._obj.field(_name))!=null && fld._extern;
+        Field fld = ptr._type instanceof TypeMemPtr owner ? owner._obj.field(_name) : null;
+        int alias = fld==null ? _alias : fld._alias;
+        boolean external = fld!=null && fld._extern;
         while( mem!=null ) {
             addDep(mem);
             if( mem==stop ) return mem;
             switch( mem ) {
-            case MemMergeNode merge: mem=merge.alias(_alias); break;
+            case MemMergeNode merge: mem=merge.alias(alias); break;
             case StoreNode st:
                 // Alias 1 is still unresolved, not a proven different field.
                 if( st._alias==1 ) return null;
                 addDep(st.ptr());
-                if( _alias==st._alias && (ptr==address(st.ptr()) || ptr==address(st.nnptr())) && off()==st.off() ) {
+                if( alias==st._alias && (ptr==address(st.ptr()) || ptr==address(st.nnptr())) &&
+                    (!_name.equals("[]") && _name.equals(st._name) || off()==st.off() ||
+                     addDep(off())._type.isConstant() && off()._type==addDep(st.off())._type) ) {
                     // Forwarding must preserve the pointer type already seen
                     // by users: completion, read-only view, and recursive shape.
                     // Open declarations can disagree until Opto upgrades them.
-                    if( _type instanceof TypeMemPtr ) {
+                    if( expected instanceof TypeMemPtr ) {
                         Type value = addDep(st.val())._type;
                         if( ptr()._type.isFinal() || declaredType().isFinal() ) value = value.makeRO();
-                        if( !value.isa(_type) ) return null;
+                        if( !value.isa(expected) ) return null;
                     }
                     // A full-width load cannot narrow the forwarded value.
                     if( declaredType() instanceof TypeInteger ti && ti.log_size()==3 &&
-                        !addDep(st.val())._type.isa(_type) ) return null;
+                        !addDep(st.val())._type.isa(expected) ) return null;
                     return st;
                 }
-                if( (external || _alias==st._alias) && (external || !neverAlias(ptr,address(st.ptr()))) &&
+                if( (external || alias==st._alias) && (external || !neverAlias(ptr,address(st.ptr()))) &&
                     !addDep(off())._type.join(addDep(st.off())._type).isHigh() ) return null;
                 mem=st.mem();
                 break;
             case ProjNode proj:
+                if( proj._idx==1 && proj.in(0) instanceof CLInitNode init ) {
+                    Node prior = init.pcopy(1,this);
+                    if( prior==null ) return null;
+                    mem = prior;
+                    break;
+                }
                 // New's memory is private; public memory is joined at Escape.
                 if( external || !(proj.in(0) instanceof NewNode nnn) ) return null;
                 if( declaredType()==Type.BOTTOM ) return null;
@@ -310,6 +329,15 @@ public class LoadNode extends MemOpNode {
     // Type views preserve the address. Keep the actual Load pointer qualified
     // for compute/err; only alias comparisons see through these views.
     private Node address(Node ptr) {
+        // A pointer Load with a proven reaching Store denotes the stored
+        // address even before the later peephole replaces the Load itself.
+        if( ptr instanceof LoadNode ld && addDepForwards(ld)._type instanceof TypeMemPtr &&
+            ld.ptr()._type instanceof TypeMemPtr base && base.notNull() && ld.err()==null &&
+            ld.find(ld.mem(),ld.ptr(),null,null) instanceof StoreNode st )
+            ptr = addDepForwards(st.val());
+        if( ptr instanceof ConvertNode conv && addDep(conv.val())._type instanceof TypeMemPtr src &&
+            src.isa(addDep(conv)._type) && src.accessISA(conv._type) )
+            ptr = conv.val();
         while( ptr instanceof ReadOnlyNode || ptr instanceof ConstructNode con && con._partial ) {
             addDep(ptr);
             ptr = ptr.in(1);
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/ParmNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/ParmNode.java
index 9c40c75d..1b7aded1 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/ParmNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/ParmNode.java
@@ -78,7 +78,12 @@ public class ParmNode extends PhiNode {
             if( ctrl != Type.XCONTROL && ctrl != Type.TOP ) {
                 if( in(i)._type==Type.BOTTOM )
                     return Type.BOTTOM;
-                t = t.meet(in(i)._type);
+                Type arg = in(i)._type;
+                // The unknown-caller callback input is Start's memory
+                // projection, interpreted using this parameter's signature.
+                if( i==1 && r.in(i) instanceof StartNode && _idx>1 && arg instanceof TypeMem outside )
+                    arg = outside.outside(_declaredType);
+                t = t.meet(arg);
             }
         }
         // Recursion is a loop in disguise. A Parm merges the first argument
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/StartNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/StartNode.java
index 78bd8219..36583884 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/StartNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/StartNode.java
@@ -26,6 +26,9 @@ import java.util.HashSet;
 public class StartNode extends LoopNode implements MultiNode {
 
     final Type _arg;
+    // Immutable foreign identity seed, installed with Opto's reset. Actual
+    // local escapes arrive through Stop, not through a frozen public list.
+    public TypeMem _foreign = TypeMem.START;
 
     public StartNode(StartNode start, StopNode stop, Type arg) { super(null,start,stop); _arg = arg;  }
     public StartNode(StartNode start) { super(start); _arg = start==null ? null : start._arg; }
@@ -67,12 +70,22 @@ public class StartNode extends LoopNode implements MultiNode {
         TypeMem tmem = stop._type instanceof TypeTuple tt
             ? tt.mem()
             : stop._type.isHigh() ? TypeMem.START : TypeMem.BOT;
+        if( !(this instanceof StartCUNode) ) tmem = tmem.escapes(_foreign);
+        else if( in(0) instanceof StartNode start ) tmem = tmem.escapes(start.outside(this));
         assert tmem._alias==1 && !tmem._one;
         return TypeTuple.make(Type.CONTROL,tmem,_arg);
     }
 
     @Override public Node idealize() { return null; }
 
+    // Consumers register against the value they read, even when their Call's
+    // control remains unchanged as more identities escape.
+    public TypeMem outside(Node dep) {
+        if( CodeGen.CODE._phase==null || CodeGen.CODE._phase.ordinal()<CodeGen.Phase.Opto.ordinal() ) return TypeMem.BOT;
+        Type t = dep.addDepForwards(this)._type;
+        return t instanceof TypeTuple tt ? tt.mem() : t.isHigh() ? _foreign : TypeMem.BOT;
+    }
+
     // No immediate dominator, and idepth==0
     @Override public int idepth() { return 0; }
     @Override public CFGNode idom(Node dep) { return null; }
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/StopCUNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/StopCUNode.java
index 8a554390..ead635dd 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/StopCUNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/StopCUNode.java
@@ -79,7 +79,7 @@ public class StopCUNode extends StopNode {
                 // Capture (precisely?) all escaping pointer aliases and fidxs.
                 // Escaped fidxs means the linked world can call that function;
                 // escaped aliases means the linked world can R/W those aliases.
-                xmem = xmem.escapes(tret.ret());
+                xmem = xmem.escapesFrom(tret.ret(),start.outside(this));
                 xmem = (TypeMem)xmem.meet(tret.mem());
             }
         }
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/StoreNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/StoreNode.java
index 4114b47c..2574d801 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/StoreNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/StoreNode.java
@@ -98,6 +98,7 @@ public class StoreNode extends MemOpNode {
         // that field again; retain the declared signature instead of unfolding
         // successively sharper copies of its private-memory return type.
         if( mem._one && decl instanceof TypeFunPtr && val instanceof TypeFunPtr ) val = decl;
+        TypeMem outside = TypeMem.opaque(val) ? CodeGen.CODE._start.outside(this) : TypeMem.BOT;
         // A singleton class's final constant field lives in the static image.
         // Its precise memory slice is a constant too; ordinary peepholes can
         // replace this Store before scheduling or instruction selection.
@@ -110,14 +111,14 @@ public class StoreNode extends MemOpNode {
             // This singleton slice contains just the stored value. Copying
             // bulk memory's escapes would freeze a transient FULL bound into
             // the constant, permanently exposing unrelated private functions.
-            return TypeMem.make(_alias,val,true,true,true,null,null).escapesFrom(val);
+            return TypeMem.make(_alias,val,true,true,true,null,null).escapesFrom(val,outside);
 
         // Allocation uses a private TypeMem and nothing else does.  This
         // memory is truly private; a temporary singleton until it escapes -
         // which is never does in a constructor.
         if( !_name.equals("[]") && mem._one )
             // Just track the stored value
-            return TypeMem.make(_alias,val,true,false,fld==null ? _init : fld._final,null,null).escapesFrom(val);
+            return TypeMem.make(_alias,val,true,false,fld==null ? _init : fld._final,null,null).escapesFrom(val,outside);
 
         // Normal aliasing Store.
         assert mem._alias==1 || mem._alias==_alias; // Perfect aliasing
@@ -132,7 +133,7 @@ public class StoreNode extends MemOpNode {
         // Bulk memory's final bit describes its conservative remainder, not
         // this newly precise slice.  Slice finality comes from the field.
         boolean xfinal = fld != null && fld._final;
-        return TypeMem.make(_alias,t,mem._one,mem._clz,xfinal,mem._escFs,mem._escAs).escapesFrom(val);
+        return TypeMem.make(_alias,t,mem._one,mem._clz,xfinal,mem._escFs,mem._escAs).escapesFrom(val,outside);
     }
 
     @Override
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/node/SummaryNode.java b/chapter29/src/main/java/com/seaofnodes/simple/node/SummaryNode.java
index c22b4bdd..483aab89 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/node/SummaryNode.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/node/SummaryNode.java
@@ -26,7 +26,8 @@ public class SummaryNode extends CFGNode implements MultiNode {
         // A library summary does not forget escapes already present in the caller.
         TypeMem mem = in(1)._type instanceof TypeMem m ? m : in(1)._type.isHigh() ? TypeMem.TOP : TypeMem.BOT;
         mem = (TypeMem)mem.meet(_state.mem());
-        for( int i = 2; i<nIns(); i++ ) mem=mem.escapes(in(i)._type);
+        TypeMem outside = CodeGen.CODE._start.outside(this);
+        for( int i = 2; i<nIns(); i++ ) mem = mem.escapesFrom(in(i)._type,outside);
         return TypeTuple.make(_state.ctl(),mem,_state.ret());
     }
     @Override public Node idealize() { return null; }
@@ -34,7 +35,8 @@ public class SummaryNode extends CFGNode implements MultiNode {
         dep.addDepForwards(this);
         if( dep.addDepForwards(in(0))._type.isHigh() ) return TypeMem.START;
         TypeMem mem = (TypeMem)_state.mem();
-        for( int i = 2; i<nIns(); i++ ) mem=mem.escapes(dep.addDepForwards(in(i))._type);
+        TypeMem outside = CodeGen.CODE._start.outside(dep);
+        for( int i = 2; i<nIns(); i++ ) mem = mem.escapesFrom(dep.addDepForwards(in(i))._type,outside);
         return TypeMem.make(1,Type.BOTTOM,false,false,false,mem._escFs,mem._escAs);
     }
     @Override boolean _upgradeType(HashMap<String,Type> types) {
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/parser/Functions.java b/chapter29/src/main/java/com/seaofnodes/simple/parser/Functions.java
index 50775349..5dd66730 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/parser/Functions.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/parser/Functions.java
@@ -291,7 +291,7 @@ final class Functions {
         for( int i = 0; i<ids.length; i++ ) {
             Type t = sig.arg(i);
             // Args take a default input if called from Start/external-world
-            Node parm = new ParmNode(ids[i],i+2,t,fun,ConstantNode.seed(t).peephole()).peephole();
+            Node parm = new ParmNode(ids[i],i+2,t,fun,ConstantNode.seed(fun.defaultArg(i)).peephole()).peephole();
             if( t instanceof TypeMemPtr ptr && ptr._partial ) parm = new ConstructNode(parm).peephole();
             P._scope.define(ids[i], t, (i==0 && ids[0]=="self") || (finals!=null && finals.get(i)), parm, loc);
         }
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/parser/Types.java b/chapter29/src/main/java/com/seaofnodes/simple/parser/Types.java
index 3cb474b1..ffd3a0f4 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/parser/Types.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/parser/Types.java
@@ -146,8 +146,8 @@ final class Types {
         Type t0 = parseType();       // Either return or first arg
         if( t0==null ) return P.posT(old); // Not a function
         Ary<Type> ts = new Ary<>(Type.class);
-        // Always reserve a receiver slot.  Outside constructor scopes it is
-        // broad and unused, so call sites can uniformly pass their self.
+        // Always reserve a receiver slot. Outside constructor scopes the
+        // broad signature also marks the hidden slot for the machine ABI.
         ts.push(implicitSelfType());
         if( P.match("}") )                 // No-arg function { -> type }
             return TypeFunPtr.make(P.match("?"),ts.asAry(),t0);
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/type/Type.java b/chapter29/src/main/java/com/seaofnodes/simple/type/Type.java
index 6c8a3e8d..0f655f49 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/type/Type.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/type/Type.java
@@ -623,11 +623,12 @@ public class Type /*implements Cloneable*/ {
     private static int[] remapBits(GlobalBits fileBits, GlobalBits bits, int[] fileLocals, int firstMapped ) {
         if( fileLocals == XInt.EMPTY || fileLocals == XInt.FULL )
             return fileLocals;
-        assert !XInt.isHigh(fileLocals);
+        boolean complement = XInt.isHigh(fileLocals);
+        if( complement ) fileLocals = XInt.dual(fileLocals);
         int[] locals = XInt.EMPTY;
         for( int fileLocal = XInt.next(fileLocals,-1); fileLocal >=0; fileLocal = XInt.next(fileLocals,fileLocal) )
             locals = XInt.make(locals,fileLocal < firstMapped ? fileLocal : bits.map(fileBits,fileLocal));
-        return locals;
+        return complement ? XInt.dual(locals) : locals;
     }
 
 
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/type/TypeFunPtr.java b/chapter29/src/main/java/com/seaofnodes/simple/type/TypeFunPtr.java
index 56f47bff..19ec5019 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/type/TypeFunPtr.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/type/TypeFunPtr.java
@@ -79,6 +79,10 @@ public class TypeFunPtr extends TypeNil {
     @Override TypeFunPtr makeFrom( byte nil ) { return  nil ==_nil ? this : make(  nil,_open,_sig,_ret, _fidxs); }
     public    TypeFunPtr makeFrom( Type ret ) { return  ret ==_ret ? this : make( _nil,_open,_sig, ret, _fidxs); }
     public    TypeFunPtr makeFrom( int fidx ) { return make1(_nil,_open,_sig,_ret,fidx); }
+    public TypeFunPtr restrictFIDXs(int[] fidxs) {
+        int[] ids = XInt.dual(XInt.meet(XInt.dual(_fidxs),XInt.dual(fidxs)));
+        return ids==_fidxs ? this : make(_nil,_open,_sig,_ret,ids);
+    }
     public    TypeFunPtr makeFrom( Type arg, int idx ) {
         // Alter named arg
         Type[] sig = _sig.clone();
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/type/TypeMem.java b/chapter29/src/main/java/com/seaofnodes/simple/type/TypeMem.java
index 79543e56..5faa7107 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/type/TypeMem.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/type/TypeMem.java
@@ -104,15 +104,24 @@ public class TypeMem extends Type {
     // private definitions here. The caller supplies FULL until local forward
     // types are resolved. Ordinary unknown values still require FULL.
     public TypeMem escapesFrom(Type t, TypeMem defaults) {
-        TypeStruct ts = t instanceof TypeMemPtr ptr ? ptr._obj : t instanceof TypeStruct obj ? obj : null;
-        if( ts!=null && ts._open && ts._fref && !ts.isAry() )
+        if( opaque(t) )
             return makeFrom(XInt.meet(_escFs,defaults._escFs),XInt.meet(_escAs,defaults._escAs));
         return escapesFrom(t);
     }
+    public static boolean opaque(Type t) {
+        TypeStruct ts = t instanceof TypeMemPtr ptr ? ptr._obj : t instanceof TypeStruct obj ? obj : null;
+        return ts!=null && ts._open && ts._fref && !ts.isAry();
+    }
     public TypeMem escapesAliases(Type t) {
         return make(_alias,_t,_one,_clz,_final, _escFs, escapeAlias(_escAs,t));
     }
 
+    // A value supplied by the outside world, bounded by its declared family.
+    // Foreign identities remain possible even when no local function escapes.
+    public Type outside(Type declared) {
+        return declared instanceof TypeFunPtr fun ? fun.restrictFIDXs(_escFs) : declared;
+    }
+
     public static final TypeMem TOP = make(1, Type.TOP   ,true ,true, true , XInt.EMPTY, XInt.EMPTY);
     public static final TypeMem BOT = make(1, Type.BOTTOM,false,false,true , XInt.FULL , XInt.FULL );
     public static final TypeMem START= make(1,Type.BOTTOM,false,false,false, XInt.EMPTY, XInt.EMPTY);
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/type/TypeStruct.java b/chapter29/src/main/java/com/seaofnodes/simple/type/TypeStruct.java
index d699e365..7c9758bd 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/type/TypeStruct.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/type/TypeStruct.java
@@ -99,7 +99,7 @@ public class TypeStruct extends Type {
             maxAlias = Math.max(maxAlias,f._alias);
         int len = XInt.idx(maxAlias)+1;
         if( (maxAlias&31)==31 ) len++;
-        int[] xs = XInt.free(len);
+        int[] xs = XInt.alloc(len);
         for( Field f : _fields )
             if( f._fname.charAt(0) != '_' &&  // Skip private fields.
                 !hiddenInit(f) &&             // Skip private allocation helper.
diff --git a/chapter29/src/main/java/com/seaofnodes/simple/type/XInt.java b/chapter29/src/main/java/com/seaofnodes/simple/type/XInt.java
index 3e74df84..06c9d466 100644
--- a/chapter29/src/main/java/com/seaofnodes/simple/type/XInt.java
+++ b/chapter29/src/main/java/com/seaofnodes/simple/type/XInt.java
@@ -92,7 +92,7 @@ public abstract class XInt {
         int len = Math.max(xs.length,idx+1);
         if( (x&31)==31 && idx+1==len )
             len++;
-        int[] ys = free(len);
+        int[] ys = alloc(len);
         System.arraycopy(xs,1,ys,1,xs.length-1);
         ys[idx] |= mask(x);
         return intern(ys);
@@ -112,7 +112,7 @@ public abstract class XInt {
             len--;
         // Replace with trimmed
         if( len < xs.length ) {
-            var ys = free(len);
+            var ys = alloc(len);
             System.arraycopy(xs,1,ys,1,len-1);
             xs = _free(xs,ys);
         }
@@ -146,8 +146,9 @@ public abstract class XInt {
             FREES.setX(len, xss = new Ary<>(int[].class));
         return xss;
     }
-    // Pull free array from free list
-    static int[] free(int len) {
+    // Allocate a zeroed mutable array, reusing the free list.
+    // Pass it to intern after filling; do not retain a mutable reference.
+    public static int[] alloc(int len) {
         int[] xs = _xss(len).pop();
         if( xs==null )
             { NEWS++;  xs = new int[len];  }
@@ -176,7 +177,7 @@ public abstract class XInt {
         if( isX ) return xs;
         if( isY ) return ys;
         // Get a free one
-        int[] ms = free(max);
+        int[] ms = alloc(max);
         for( int i=1; i<min; i++ )
             ms[i] = xs[i] | ys[i];
         for( int i=min; i<ms.length; i++ ) {
@@ -189,7 +190,7 @@ public abstract class XInt {
 
     // Dual: flip all the bits
     public static int[] dual(int[] xs) {
-        int[] ds = free(xs.length);
+        int[] ds = alloc(xs.length);
         for( int i=1; i<xs.length; i++ )
             ds[i] = ~xs[i];
         return intern(ds);
@@ -203,7 +204,7 @@ public abstract class XInt {
     }
     public static int[] packed(BAOS bais) {
         int len = bais.packed1();
-        int[] xs = free(len);
+        int[] xs = alloc(len);
         for( int i=1; i<len; i++ )
             xs[i] = bais.packed4();
         return intern(xs);
@@ -230,7 +231,7 @@ public abstract class XInt {
     public static int[] remap( int[] xs, AryInt map ) {
         if( xs==FULL ) return xs;
         assert !isHigh(xs);
-        int[] ys = free(xs.length);
+        int[] ys = alloc(xs.length);
         for( int bit = next(xs,0); bit >=0; bit = next(xs,bit) ) {
             int bat = map.at(bit);
             ys[idx(bat)] |= mask(bat);
diff --git a/chapter29/src/test/java/com/seaofnodes/simple/Chapter20Test.java b/chapter29/src/test/java/com/seaofnodes/simple/Chapter20Test.java
index 6cf92dc3..f5eb2b36 100644
--- a/chapter29/src/test/java/com/seaofnodes/simple/Chapter20Test.java
+++ b/chapter29/src/test/java/com/seaofnodes/simple/Chapter20Test.java
@@ -242,13 +242,6 @@ val equals = { !String !self, !String s ->
     return true;
 };
 
-// Return the String hashCode (cached, and never 0)
-val hashCode = { !String self ->
-    self._hashCode
-    ?  self._hashCode
-    : (self._hashCode = _hashCodeString(self));
-};
-
 val _hashCodeString = { !String self ->
     int hash=0;
     for( int i=0; i< self.cs#; i++ )
@@ -256,11 +249,19 @@ val _hashCodeString = { !String self ->
     if( !hash ) hash = 123456789;
     return hash;
 };
+
+// Return the String hashCode (cached, and never 0)
+val hashCode = { !String self ->
+    self._hashCode
+    ?  self._hashCode
+    : (self._hashCode = _hashCodeString(self));
+};
+
 """;
-        // The implicit return exposes _hashCodeString, so retain its body too.
-        testCPU(src,"x86_64_v2", "SystemV",21,null);
-        testCPU(src,"riscv"    , "SystemV",9,null);
-        testCPU(src,"arm"      , "SystemV",7,null);
+        // Return the public hashCode wrapper; keep its helper private.
+        testCPU(src,"x86_64_v2", "SystemV",12,null);
+        testCPU(src,"riscv"    , "SystemV",8,null);
+        testCPU(src,"arm"      , "SystemV",6,null);
     }
 
     @Test
diff --git a/chapter29/src/test/java/com/seaofnodes/simple/Chapter21Test.java b/chapter29/src/test/java/com/seaofnodes/simple/Chapter21Test.java
index f1dc54e2..e15c2581 100644
--- a/chapter29/src/test/java/com/seaofnodes/simple/Chapter21Test.java
+++ b/chapter29/src/test/java/com/seaofnodes/simple/Chapter21Test.java
@@ -368,13 +368,6 @@ val equals = { !String !self, !String s ->
     return true;
 };
 
-// Return the String hashCode (cached, and never 0)
-val hashCode = { !String self ->
-    self._hashCode
-    ?  self._hashCode
-    : (self._hashCode = _hashCodeString(self));
-};
-
 val _hashCodeString = { !String self ->
     int hash=0;
     for( int i=0; i< self.cs#; i++ )
@@ -382,11 +375,18 @@ val _hashCodeString = { !String self ->
     if( !hash ) hash = 123456789;
     return hash;
 };
+
+// Return the String hashCode (cached, and never 0)
+val hashCode = { !String self ->
+    self._hashCode
+    ?  self._hashCode
+    : (self._hashCode = _hashCodeString(self));
+};
 """;
-        // The implicit return exposes _hashCodeString, so retain its body too.
-        testCPU(src,"x86_64_v2", "SystemV",21,null);
-        testCPU(src,"riscv"    , "SystemV",9,null);
-        testCPU(src,"arm"      , "SystemV",7,null);
+        // Return the public hashCode wrapper; keep its helper private.
+        testCPU(src,"x86_64_v2", "SystemV",12,null);
+        testCPU(src,"riscv"    , "SystemV",8,null);
+        testCPU(src,"arm"      , "SystemV",6,null);
     }
 
     @Test public void testStringExport() throws IOException {
@@ -408,13 +408,6 @@ val equals = { !String !self, !String s ->
     return true;
 };
 
-// Return the String hashCode (cached, and never 0)
-val hashCode = { !String self ->
-    self._hashCode
-    ?  self._hashCode
-    : (self._hashCode = _hashCodeString(self));
-};
-
 val _hashCodeString = { !String self ->
     int hash=0;
     for( int i=0; i< self.cs#; i++ )
@@ -422,8 +415,15 @@ val _hashCodeString = { !String self ->
     if( !hash ) hash = 123456789;
     return hash;
 };
+
+// Return the String hashCode (cached, and never 0)
+val hashCode = { !String self ->
+    self._hashCode
+    ?  self._hashCode
+    : (self._hashCode = _hashCodeString(self));
+};
 """;
-        TestC.runC(src, "stringHash", "",21);
+        TestC.runC(src, "stringHash", "",12);
     }
 
     @Test public void testLoop2() {
diff --git a/chapter29/src/test/java/com/seaofnodes/simple/Chapter25Test.java b/chapter29/src/test/java/com/seaofnodes/simple/Chapter25Test.java
index f5eba8f5..5f615282 100644
--- a/chapter29/src/test/java/com/seaofnodes/simple/Chapter25Test.java
+++ b/chapter29/src/test/java/com/seaofnodes/simple/Chapter25Test.java
@@ -5,6 +5,7 @@ import com.seaofnodes.isa.eval.EvalRisc5;
 import com.seaofnodes.isa.eval.EvalArm64;
 
 import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.parser.Parser;
 import com.seaofnodes.simple.codegen.RegAllocTestSupport.CheckedCodeGen;
 import com.seaofnodes.simple.codegen.ElfReader;
 import com.seaofnodes.simple.codegen.ParseAll;
@@ -12,6 +13,8 @@ import com.seaofnodes.simple.node.CallNode;
 import com.seaofnodes.simple.node.FunNode;
 import com.seaofnodes.simple.node.LoopNode;
 import com.seaofnodes.simple.type.TypeInteger;
+import com.seaofnodes.simple.type.TypeMem;
+import com.seaofnodes.simple.type.TypeTuple;
 import com.seaofnodes.simple.type.XInt;
 import com.seaofnodes.simple.util.Ary;
 import java.io.File;
@@ -73,21 +76,25 @@ public class Chapter25Test {
         for( long seed : new long[]{1,123,987654321} ) {
             CodeGen code = new CodeGen(src,seed,true).driver(CodeGen.Phase.Parse);
             FunNode visible = null;
+            int[] privateFidxs = XInt.EMPTY;
             int checked = 0;
             for( FunNode fun : code._linker ) {
                 if( fun==null || fun._name==null ) continue;
                 if( fun._name.equals("visible") ) {
-                    assertTrue(code.publicFIDX(fun.sig().fidx()));
                     visible = fun;
                     checked++;
                 }
                 if( fun._name.equals("_hidden") || fun._name.equals("hiddenClassMethod") ) {
-                    assertFalse(code.publicFIDX(fun.sig().fidx()));
+                    privateFidxs = XInt.make(privateFidxs,fun.sig().fidx());
                     checked++;
                 }
             }
             assertEquals(3,checked);
             code.driver(CodeGen.Phase.TypeCheck);
+            TypeMem outside = ((TypeTuple)code._start._type).mem();
+            assertTrue(XInt.bit(outside._escFs,visible.sig().fidx()));
+            for( int fidx = XInt.next(privateFidxs,0); fidx>=0; fidx = XInt.next(privateFidxs,fidx) )
+                assertFalse(XInt.bit(outside._escFs,fidx));
             assertTrue(visible.unknownCallers());
             assertEquals(TypeInteger.U8,visible.parm(3)._type);
             assertEquals("0",Eval2.eval(code,0));
@@ -101,25 +108,52 @@ public class Chapter25Test {
             val _private = { int x -> x+1; };
             return 0;
             """).parse();
-        int checked = 0;
+        int published = -1, unpublished = -1;
         for( FunNode fun : code._linker ) {
             if( fun==null || fun._name==null ) continue;
-            if( fun._name.equals("_hidden") ) {
-                // A public field can publish a privately named function.
-                assertTrue(code.publicFIDX(fun.sig().fidx()));
-                checked++;
-            }
-            if( fun._name.equals("_private") ) {
-                assertFalse(code.publicFIDX(fun.sig().fidx()));
-                checked++;
-            }
+            if( fun._name.equals("_hidden") ) published = fun.sig().fidx();
+            if( fun._name.equals("_private") ) unpublished = fun.sig().fidx();
         }
-        assertEquals(2,checked);
+        assertTrue(published>=0 && unpublished>=0);
         var clz = code.compunit()._clz;
-        assertTrue(XInt.bit(code.publicAliases(),clz.field("visible")._alias));
-        assertFalse(XInt.bit(code.publicAliases(),clz.field("_hidden")._alias));
-        assertFalse(XInt.bit(code.publicAliases(),clz.field("_private")._alias));
         code.driver(CodeGen.Phase.TypeCheck);
+        TypeMem outside = ((TypeTuple)code._start._type).mem();
+        // A public field can publish a privately named function.
+        assertTrue(XInt.bit(outside._escFs,published));
+        assertFalse(XInt.bit(outside._escFs,unpublished));
+        assertTrue(XInt.bit(outside._escAs,clz.field("visible")._alias));
+        assertFalse(XInt.bit(outside._escAs,clz.field("_hidden")._alias));
+        assertFalse(XInt.bit(outside._escAs,clz.field("_private")._alias));
+    }
+
+    @Test public void testImportedEscapeExclusions() throws IOException {
+        Path build=Path.of("build/objs");
+        Files.createDirectories(build);
+        Path dir=Files.createTempDirectory(build,"escape_exclusions_");
+        CodeGen library=new CodeGen(null,dir.toString(),null,"Lib","""
+            val _hidden_noInline={int n -> n+100;};
+            val apply_noInline={{int->int} f,int n -> f(n);};
+            return apply_noInline;
+            """,123,true,TypeInteger.BOT).driver("x86_64_v2","win64",false,false);
+        int savedHidden=((com.seaofnodes.simple.type.TypeFunPtr)
+            library.compunit()._clz.field("_hidden_noInline")._t).fidx();
+        // Allocate unrelated IDs before loading Lib so saved exclusions must
+        // remap by owner/slot, not by their numeric positions in the file.
+        CodeGen code=new CodeGen(null,dir.toString(),new Ary<>(new String[]{dir.toString()}),
+            "Client","""
+                val _other={int n -> n-1;};
+                val inc={int n -> n+1;};
+                return Lib.apply_noInline(inc,arg);
+                """,987654321,true,TypeInteger.BOT).driver(CodeGen.Phase.TypeCheck);
+        var clz=(com.seaofnodes.simple.type.TypeStruct)Parser.TYPES.get("class:Lib");
+        int hidden=((com.seaofnodes.simple.type.TypeFunPtr)clz.field("_hidden_noInline")._t).fidx();
+        assertNotEquals(savedHidden,hidden);
+        TypeMem outside=((TypeTuple)code._start._type).mem();
+        assertTrue(XInt.isHigh(outside._escFs));
+        assertFalse(XInt.bit(outside._escFs,hidden));
+        assertEquals("42",Eval2.eval(code,41));
+        Files.delete(dir.resolve("Lib.o"));
+        Files.delete(dir);
     }
 
     @Test public void testNeverReturnPointerRiscV() {
diff --git a/chapter29/src/test/java/com/seaofnodes/simple/ClassInitDependenciesTest.java b/chapter29/src/test/java/com/seaofnodes/simple/ClassInitDependenciesTest.java
index 88ebb6b7..dae64fb0 100644
--- a/chapter29/src/test/java/com/seaofnodes/simple/ClassInitDependenciesTest.java
+++ b/chapter29/src/test/java/com/seaofnodes/simple/ClassInitDependenciesTest.java
@@ -158,6 +158,28 @@ public class ClassInitDependenciesTest {
         assertTrue(touches(code,deps,"Root/B","Root"));
     }
 
+    @Test public void testUnknownCallbackCycle() throws Exception {
+        for( long seed : new long[]{1,123,987654321} ) {
+            try {
+                compile("A",Map.of(
+                    "A", """
+                        { {int->int} -> {int->int} } bounce="C";
+                        val callback_noInline={int n -> B.value;};
+                        val f=bounce(callback_noInline);
+                        int value=f(1);
+                        """,
+                    "B", "int value=A.value;"),seed);
+                fail("Expected callback initialization cycle");
+            } catch( Parser.ParseException ex ) {
+                String message=ex.getMessage();
+                assertTrue(message,message.startsWith("Cyclic class initialization:"));
+                assertTrue(message,message.contains(" -> unknown call"));
+                assertTrue(message,message.contains("unknown call -> "));
+                assertTrue(message,message.contains("Root.B -> Root.A"));
+            }
+        }
+    }
+
     @Test public void testCycles() throws Exception {
         cycle("A",Map.of("A","val get_noInline={ ->\n  B.value;\n};\nint value=get_noInline();",
                           "B","int value=A.value;"),"A -> B -> A");
diff --git a/chapter29/src/test/java/com/seaofnodes/simple/EscapeFlowTest.java b/chapter29/src/test/java/com/seaofnodes/simple/EscapeFlowTest.java
new file mode 100644
index 00000000..71a281b5
--- /dev/null
+++ b/chapter29/src/test/java/com/seaofnodes/simple/EscapeFlowTest.java
@@ -0,0 +1,112 @@
+package com.seaofnodes.simple;
+
+import com.seaofnodes.simple.codegen.CodeGen;
+import com.seaofnodes.simple.node.*;
+import com.seaofnodes.simple.type.*;
+import org.junit.Test;
+import static org.junit.Assert.*;
+
+public class EscapeFlowTest {
+    // A cofinite outside set must not revive private allocation helpers.
+    @Test public void testOpaqueRoundTrip() {
+        for( long seed : new long[]{1,123,987654321} ) {
+            CodeGen code = new CodeGen("""
+                struct _A { B? !b; new _A = { B? p -> b=p; }; };
+                val wrap = { B? b -> return new _A(b); };
+                return wrap;
+                """,seed,true).driver(CodeGen.Phase.TypeCheck);
+            TypeMem outside = ((TypeTuple)code._start._type).mem();
+            assertTrue(XInt.isHigh(outside._escFs));
+            assertNotSame(XInt.FULL,outside._escFs);
+            for( FunNode fun : code._linker )
+                if( fun!=null && fun._name!=null && fun._name.contains("_A.") )
+                    assertFalse(fun._name,fun.unknownCallers());
+        }
+    }
+
+    // Foreign callbacks remain possible. The default callback argument reads
+    // Start memory rather than a frozen declaration constant.
+    @Test public void testUnknownCallerCallback() {
+        CodeGen code = new CodeGen("""
+            val _hidden_noInline = { int n -> return n+2; };
+            val apply_noInline = { {int->int} f,int n -> return f(n); };
+            return apply_noInline;
+            """).parse();
+        TypeMemPtr self = (TypeMemPtr)named(code,"apply_noInline").parm(2).in(1)._type;
+        assertTrue(self._one);
+        assertEquals("class:Test",self._obj._name);
+        code.driver(CodeGen.Phase.TypeCheck);
+        FunNode apply = named(code,"apply_noInline");
+        assertTrue(apply.unknownCallers());
+        ParmNode callback = apply.parm(3);
+        assertTrue(callback.in(1) instanceof ProjNode);
+        TypeFunPtr type = (TypeFunPtr)callback._type;
+        assertTrue(XInt.isHigh(type.fidxs()));
+        assertSame(TypeInteger.BOT,apply.ret().expr()._type);
+        // Only <clinit> and apply escape; forwarding #self must not expose _hidden.
+        assertEquals("Stop[ return { apply_noInline}; return #2; ]",code.print());
+    }
+
+    @Test public void testNativeCallbackRoundTrip() {
+        CodeGen code = new CodeGen("""
+            val _callback_noInline = { int n -> return n+1; };
+            { {int->int} -> {int->int} } bounce = "C";
+            return bounce(_callback_noInline)(arg);
+            """).driver(CodeGen.Phase.TypeCheck);
+        FunNode callback = named(code,"_callback_noInline");
+        assertTrue(callback.unknownCallers());
+        assertTrue(XInt.bit(((TypeTuple)code._start._type).mem()._escFs,callback.sig().fidx()));
+    }
+
+    // Call remains CONTROL. Changing only the outside set must wake CallEnd
+    // and extend the possible callback returned by the native factory.
+    @Test public void testOutsideReturnDependency() {
+        CodeGen code = new CodeGen("return 0;").parse();
+        code._phase = CodeGen.Phase.Opto;
+        code.externFunc(100,"factory");
+        TypeFunPtr callback = TypeFunPtr.make(false,TypeFunPtr.TEMPTY,TypeInteger.BOT);
+        TypeFunPtr factory = TypeFunPtr.make1((byte)2,true,TypeFunPtr.TEMPTY,callback,100);
+        CallNode call = new CallNode(null,ConstantNode.raw(Type.CONTROL),
+            ConstantNode.raw(TypeMem.START),ConstantNode.raw(factory)).init();
+        CallEndNode end = new CallEndNode(call,TypeRPC.BOT);
+        int[] foreign = XInt.dual(XInt.make(7));
+        code._start._type = TypeTuple.make(Type.CONTROL,TypeMem.START.makeFrom(foreign,XInt.EMPTY),TypeInteger.BOT);
+        TypeTuple before = (TypeTuple)end.compute();
+        assertFalse(XInt.bit(((TypeFunPtr)before.ret()).fidxs(),7));
+        boolean depends = false;
+        for( int i = 0; i<code._start.nDeps(); i++ ) depends |= code._start.dep(i)==end;
+        assertTrue(depends);
+        code._start._type = TypeTuple.make(Type.CONTROL,TypeMem.START.makeFrom(XInt.FULL,XInt.EMPTY),TypeInteger.BOT);
+        TypeTuple after = (TypeTuple)end.compute();
+        assertTrue(before.isa(after));
+        assertTrue(XInt.bit(((TypeFunPtr)after.ret()).fidxs(),7));
+    }
+
+    // Public construction exposes the allocator; private-memory helpers
+    // remain internal and can inline into it.
+    @Test public void testPublicAllocator() {
+        CodeGen code = new CodeGen("""
+            struct Box { int n; new Box = { int x -> n=x; }; };
+            return new Box(arg).n;
+            """).parse();
+        FunNode allocator = named(code,"Test.Box.<new>");
+        int[] helpers = XInt.EMPTY;
+        for( FunNode fun : code._linker )
+            if( fun!=null && fun.sig().ret() instanceof TypeMem )
+                helpers = XInt.make(helpers,fun.sig().fidx());
+        assertNotSame(XInt.EMPTY,helpers);
+        code.driver(CodeGen.Phase.TypeCheck);
+        TypeMem outside = ((TypeTuple)code._start._type).mem();
+        assertTrue(allocator.unknownCallers());
+        assertTrue(XInt.bit(outside._escFs,allocator.sig().fidx()));
+        for( int fidx = XInt.next(helpers,0); fidx>=0; fidx = XInt.next(helpers,fidx) )
+            assertFalse(XInt.bit(outside._escFs,fidx));
+        assertEquals("42",Eval2.eval(code,42));
+    }
+
+    private static FunNode named(CodeGen code, String name) {
+        for( FunNode fun : code._linker )
+            if( fun!=null && name.equals(fun._name) ) return fun;
+        throw new AssertionError("Missing function "+name);
+    }
+}
-- 
cgit v1.2.3