Reaching definitions over Layer-1 facts: which instruction's register write feeds which instruction's register read.

For every use row, the analysis finds the def rows that can have produced the value being read — true def→use edges that respect register reuse, which simple register-name matching cannot.

Control flow

The successor relation comes from the explicit control-transfer facts: next (fallthrough), jump, branch (the fail edge), and select_branch, with labels resolved through label_at. This is deliberately not Argus.Cfg's block-edge relation:

• Exception edges (try_start handlers) are not followed. At the handler the VM materializes the exception class/reason/stacktrace in x0–x2 without any def fact, so following the edge would attribute pre-try writes of those registers to handler reads — a false flow. Handler code instead flows from its own writes (its reads of the VM-materialized registers resolve to nothing, honestly).
• bif_call/bs_start fail edges are not followed; like the generic branch fallthrough, the fail path is reached through the facts that carry it explicitly.

Algorithm

Per function (edges never cross functions): instructions chain into maximal straight-line blocks, each block gets a gen/kill summary, the summaries propagate over the block graph to a fixpoint (classic iterative reaching definitions), and the per-instruction edges fall out of one local walk per block. This is observationally identical to the per-instruction fixpoint, just proportional to blocks rather than instructions.