[zhoubot]

Fused element loops that read input and update a separate histogram were rejected after outlining because ordinary helper pointers lost caller alias facts. Prove whole-object separation across every direct caller of closed local helpers, including forwarding and argument/global roots, and attach scoped metadata only to proven access pairs. Unknown, exported, address-taken, recursive and mixed-alias contexts remain fail-closed. Identical zero stores may commute only when full-width alignment excludes partial overlap; conflicting loads/atomics and nonzero stores retain the original legality checks.

Preserve exact reduction result descriptors, runtime geometry and queue publications through mixed Tile/element code. Marked regions require generic masked Tile lowering and reject unsupported effects or residual annotations; no scalar fallback, implicit restrict, forced inlining or forced unrolling is introduced.

Add explicit PE-domain boundaries with closed-callgraph specialization. Preserve domain metadata across compression, every MC pseudo expansion and assembly roundtrip; validate nondefault masks as subsets. Unprocessed mixed translation units, unknown calls, raw/escaping asm, unsupported Shared operations and Tile-pointer domain crossings reject. Default-domain linked helpers remain available alongside specialized clones.

Integrate upstream dev-llvm15_56 at 78b74f4a614e61b8992abeb315da9c3bd058aa86, including canonical reuse families and standalone TLSU/CUBE headers. Retain Local source operands for the generic masked profile, including copies created late by queue normalization; legacy finalization only changes generated descriptor copies. Explicit legacy lifetimes and descriptor/capacity/defined-source checks remain intact. This fixes actual gather, MegaMoE and issue130 failures without relaxing the model.

Qualified on frozen LLVM a08e1c228dbe8b5fe45a6c613fec6a78499ab920, API 1f72e918fcbb72569d8e28dda11f7c579a06dab2, benchmark code 693d25349b9e17bad57fe7d281be258140d649ba, and unchanged gfrun 0a237ccfe8404d73d92dd144a6af539b2b0ebc5a. The subsequent benchmark documentation commit records these exact code pins. All runtime cases keep the 120-second gfrun timeout and original resource limits.

• Element suite 64/64 (455 memory segments), core TopK 777 9/9 segments, solution regressions 21/21.
• QLI key48 / histogram72 / norm13 / popn18 / static TopK7 / original5 / dynamic4; additionally original four-PE4 and upstream four-PE2, each comparing 18 memory segments.
• Original low-precision matmul7/7; predicate original and edge cases; MoE boundary driver with 11 lengths and repeated calls; D6 C48 and issue130 C16.
• Nested PE-domain assembly/view/TMOV/element chain: two segments, 16,768 bytes, all 21 B.IOT binders use PE0 mask1000.
• Focused API6 + native adapter42 + PE-domain7 + exact descriptor glob24 + upstream lifetime/header16 = 95/95; three additional late-copy/legacy tests pass. Issue60 remains a separately recorded negative, not feature closure.
• Independent final audit: PASS, 3,795 hash records verified, zero errors/pending. Local report /tmp/pto-element-fusion-20261019/final-v19-audit.json (SHA256 ec21921ce2f554e78131ee12be39e9ebc151d7a62d999f1093a51aa814eed0c4).

This qualifies the declared gfrun profiles. gfsim/timing, forced Tile spill runtime, and lifetime retirement semantics are not qualified. The original application inventory remains 17/21 with four pending profiles, distinct from solution21/21. LLVM still has 28 legacy pragma fixtures outside this closure and a valid guard-correlated issue60 proof gap. Broad MC accounting is 82 PASS, 1 XFAIL, and three historical failures (CUBE_Mamulb, MTC_Tloadstore, pto-tileop-macro-ranges); no all-LLVM-tests-green claim.

Companion PRs: LLVM #131, TileOP API #281, SuperNPUBench #252, gfrun #949.