Since it combines register allocation with instruction spilling is innate - there isn't a special spilling phase. Spilled variables are assigned ram addresses after code generation occurs at link time, with the most frequently used going to zeropage.
Yeah it can reserve specific ZP addresses. I do this to implement the runtime. It can also be used to reserve hardware registers, but since my only target is the NES, I don't have to worry about that.
