@amritk/nish-x86_64-linux 0.31.0 → 0.33.0

package/docs/AI.md

@@ -49,7 +49,7 @@ stdout, nothing on stderr, every field 1-based with `endLine`/`endColumn`
 exclusive:
 
 ```json
-{"file":"p.ts","line":3,"column":17,"endLine":3,"endColumn":20,"severity":"error","code":"NL2249","message":"Unknown method `map` on i32[] (supported: push, pop, indexOf, join, set, fill)"}
+{"file":"p.ts","line":3,"column":17,"endLine":3,"endColumn":20,"severity":"error","code":"NL2249","message":"Unknown method `map` on i32[] (supported: push, pop, indexOf, join, set, fill, sort)"}
 ```
 
 - **Key on `code`, never on `message`.** A code is a promise: `NL2249` means
@@ -159,7 +159,7 @@ rejects. This table is the highest-value part of the page.
 | `x == y` | `Loose equality is forbidden` | `x === y` |
 | `throw new Error(m)` | `` `throw` is forbidden `` | `return Err(m)`, or `panic(m)` to end the process |
 | `try { … } catch { … }` | `` `try`/`catch`/`finally` is forbidden `` | `Result<T, E>` and `isErr()` |
-| `xs.map(f)`, `.filter`, `.reduce`, `.forEach`, `.slice`, `.sort`, `.shift` | `` Unknown method `map` on i32[] (supported: push, pop, indexOf, join, set, fill) `` | a `for` loop, or a top-level `map(xs, f)` with a [function parameter](#function-parameters) |
+| `xs.map(f)`, `.filter`, `.reduce`, `.forEach`, `.slice`, `.shift` | `` Unknown method `map` on i32[] (supported: push, pop, indexOf, join, set, fill, sort) `` | a `for` loop, or a top-level `map(xs, f)` with a [function parameter](#function-parameters) |
 | `s.toUpperCase()`, `s.split()`, `s.trim()`, `s.replace()` | `` Unknown method … on string `` | index bytes with `charCodeAt` / `substring` |
 | `a?.b`, `a ?? b` | `?.` only in a chain that ends in `??`; `??` only on a `T \| null`, a chain or `m.get(k)` | `a?.b ?? d`, `a ?? d`, or `if (a !== null)` first |
 | `x as T`, `<T>x`, `x satisfies T` | `Unsupported expression in Phase 1: AsExpression` (to `any` or `unknown`: `` Type assertion to `any` is forbidden ``); `x!` is a syntax error | there are no casts; `implements` is the only widening |
@@ -852,7 +852,8 @@ export const main = (): i32 => {
   (`` The arrow reads `k`, a `let` of the function it is written in: ... bind the value to a `const` before the call ``),
   read `this` (bind `const self = this`), or read a function parameter of its
   function. An arrow inside another arrow, or given to a method, a
-  constructor, `expose` or `exposeWith`, captures nothing.
+  constructor, `expose` or `exposeWith`, captures nothing; `xs.sort(cmp)`'s
+  comparator is the exception, and captures as an arrow argument does.
 - **The argument's type must match exactly**: `(x: i32) => i64` for a
   `(x: i32) => i32` parameter is refused. A generic function cannot be passed
   by name — write `(x) => identity(x)`.
@@ -2138,7 +2139,12 @@ there is no `undefined` to return), `a.indexOf(v)`, `a.join(sep)` — **`join` i
 `string[]` only** — and, on an array of numbers only, `dst.set(src[, offset])`
 (one `memmove`; a range past the end panics) and `a.fill(v[, start[, end]])`
 (ends clamped and counted back from the end when negative, as in JavaScript;
-never panics). Both are statements. That is every array method there is. A
+never panics). Both are statements. `a.sort(cmp)` sorts in place, stably, and
+answers `a` — the same order Node gives; the comparator is required (`a.sort()`
+is refused, since JavaScript would compare strings), a readonly array and
+`process.argv` are refused, `a - b` panics on `i32` values a full range apart
+(compare with `a > b ? 1 : a < b ? -1 : 0` there), and the comparator may read the caller's `const` locals and parameters but not
+a `let`, as any arrow argument may. That is every array method there is. A
 window into a buffer is `(buf, offset, length)`; there is no view type.
 
 **Strings.** `s.length` (**bytes**), `s.charCodeAt(i)` (the byte, bounds-checked),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amritk/nish-x86_64-linux",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "description": "The nish native compiler for Linux on x86_64",
   "license": "MIT",
   "os": [

package/std/README.md

@@ -12,6 +12,7 @@ whatever program imports it, and subject to the same rules as `examples/` or
 | [`testing.ts`](./testing.ts) | a test runner: a `Suite` a program drives with straight-line assertions, printing the `PASS` / `FAIL` / `SKIP` lines the repository's own harness prints, and answering the exit code |
 | [`text.ts`](./text.ts) | the string operations a program would otherwise write inline: `splitLines`, `splitWhitespace`, `trim` and its halves, `contains`, `replaceAll`, `firstDifference` over two arrays of lines, `codePointLength`, the number of Unicode code points (what JSON Schema's `minLength` counts, where `.length` counts UTF-8 bytes natively and UTF-16 units under Node; it answers the same on both by asking which it is reading), and `indexOfAny(text, bytes, from)`, the first index at or after `from` whose byte is one of 1 to 16 ASCII `bytes`. Its walker is the meaning and what runs under Node; natively the compiler replaces the one call to it with the runtime kernel `nish_str_index_of_any`, which reads 16 or 32 bytes at a time and is variable-time ([`docs/LANGUAGE.md`](../docs/LANGUAGE.md#byte-search-indexofany-in-nishtext)). `tests/link/std_text_index_of_any*` are its programs |
 | [`math.ts`](./math.ts) | `Math.tan`, `Math.atan2` and `Math.hypot` on `f64`, ported from fdlibm (`LICENSE-fdlibm`) so that every target, wasm included, answers alike without libm. A program never imports it: a call to one of the three loads it, and the compiler copies the functions the call reaches into the calling module as `internal` ones. JavaScript's answer for every NaN, signed zero and infinity, and within one ulp elsewhere (0.83, 0.84 and 0.93 ulp measured against mpmath). `tests/cases/math_std_edges` pins the special values |
+| [`sort.ts`](./sort.ts) | `xs.sort(cmp)` on any array: `sortWith`, a stable merge sort over runs of 32 sorted by insertion — one scratch array released before it returns, a pair of runs already in order copied without merging, no bounds check left in it — so its order is element for element Node's `Array.prototype.sort`. Like `math.ts` it is one the compiler knows about: a program never imports it, a `.sort(cmp)` call loads it, the checker rewrites the call to `sortWith`, and each comparator's instantiation — the comparator called directly, no function pointer — is copied into the module that sorts. Under Node the call stays the platform's own. `tests/cases/arr_sort_cmp*` are its programs, a 10,000-element sort with ties among them |
 | [`regex.ts`](./regex.ts) | Regular expressions in JavaScript's syntax with the `u` flag's strictness, matched by a Pike VM in time linear in the input whatever the pattern; finding every match is one search per match, so `findAll` and its kin can be quadratic when a long branch is preferred to a short one that wins ([`docs/security/regex.md`](../docs/security/regex.md)). `regexCompile(pattern, flags)` answers a `Regex` or the error text; `test`, `exec` into a reused `RegexMatch`, `find`, `findAll`, `count`, `replace` and `replaceAll` with `$&`, `$1` and `$<name>`, and `split`. Flags `i`, `m`, `s` and `u`; `i` folds by Unicode's simple case folding, ASCII letters only to ASCII. `\p{…}` and `\P{…}` take Unicode 16.0's General_Category, Script, Script_Extensions and binary properties by JavaScript's names, from tables `scripts/gen-regex-unicode.mjs` generates into the module and checks against Node's `RegExp`; backreferences and lookaround are refused at compile time. Offsets are UTF-8 bytes. A search allocates nothing beyond its answer: the thread lists and capture tables are the `Regex`'s, so one `Regex` serves one thread at a time. A leading literal is found with `indexOf`, a small leading set with `indexOfAny`. `tests/link/std_regex` and `tests/link/std_regex_unicode` check it against JavaScript's own answers |
 | [`json.ts`](./json.ts) | `jsonField(object, name)`: the value of one field of one flat JSON object, which is the shape the compiler's own `--json` diagnostics have. A reader and not a parser — it answers text, answers `null` for a field that is not there, and does not validate. `JsonWriter` is the other direction: any JSON value written into a caller-owned `u8[]`, commas and colons included, byte for byte what `JSON.stringify` writes, and allocating nothing per call except an `f64`'s digits, a temporary string the call gives back before it returns (`text()` and `jsonStringifyString` build strings by design); misuse and a full buffer set a sticky negative `JSON_WRITE_*` code in `failed` rather than panicking. `setIndent(n)` and `setIndentTab()` write what `JSON.stringify(v, null, n)` or `(v, null, "\t")` writes, with no allocation for the indent, and `setStrict(true)` makes NaN and the infinities the sticky `JSON_WRITE_NON_FINITE` instead of `null`; both modes are off by default and kept by `reset`. `jsonStringifyString(s)` is the string rule answered as a string. `stringBytes(bytes, off, len)` and `keyBytes(bytes, off, len)` write a window of a byte array as `string` and `key` write a string of those bytes, allocating nothing, and refuse a window outside the array with `JSON_WRITE_BAD_WINDOW` |
 | [`json-tokenizer.ts`](./json-tokenizer.ts) | `JsonTokenizer`: a validating, streaming tokenizer for RFC 8259 JSON held in a window of a `u8[]`. `next()` answers one `JSON_TOK_*` token at a time — object and array openers and closers, keys, strings, numbers and the three literals — then `JSON_TOK_END`, or a negative `JSON_TOK_ERR_*` code that sticks in `failed`, with the byte in `errorAt`. Strings are checked as UTF-8 and a lone surrogate escape is refused; `stringInto` decodes the current string into the caller's array and `keyEquals` compares it with a name, neither allocating. `numberF64` is correctly rounded; `isInteger` and `numberI64` read an integer that fits an `i64`, and `isU64` and `numberU64` one that fits a `u64`. `isIntegral` asks whether a number's value is whole however it is written (`1.0`, `1e2`, `1e400`), JSON Schema's "integer", from the text and at any exponent. `skipValue` steps over a value. `JsonLimits` caps nesting depth, string, number and total bytes, each with its own code; `reset` reuses the tokenizer, so a reused body keeps the arena flat. Duplicate keys are reported as tokens. No input panics and no byte outside the window is read; [`docs/security/json.md`](../docs/security/json.md) is its record, and `tests/link/std_json_tokenizer` runs JSONTestSuite and a seeded fuzz |
@@ -95,6 +96,7 @@ is listed in [`SECURITY.md`](../SECURITY.md#threat-model).
 | [`crypto/jwt.ts`](./crypto/jwt.ts) | JSON Web Tokens in the JWS compact form. `JwtVerifier(maxToken)` holds its buffers, sized once, and `verify` / `verifyString(key, token, now)` answer `JWT_OK` or a `JWT_ERR_*` code: the key decides the algorithm (`alg` must name it exactly, so `none` and an HS header in front of an RSA key are refused), the header holds `alg` once and no `crit` or `b64`, base64url is strict, the signature is checked before the payload is read, and then `exp`, `nbf` and `iat` with a leeway, and `iss`, `aud` and `sub`, are checked. Keys: `jwtHmacKey` (HS256/384/512, keyed once through `HmacKey`), `jwtRsaKey` / `jwtRsaKeyParts` (RS256/384/512, 2048 bits or more), `jwtEcKey` (ES256, ES384), `jwtEd25519Key` (EdDSA), and the signing `jwtEs256SigningKey` / `jwtEd25519SigningKey`, each from a `Secret<u8[]>` it copies; `JwtKey.wipe()` zeroes the copy. `jwtSign` / `jwtSignString` / `jwtSignKid` mint a token under an HS, ES256 or EdDSA key. `peekKid` reads the unauthenticated `kid`, to choose a key | RFC 7515 Appendix A, RFC 7519, RFC 7518, RFC 8037 A.4, RFC 8725 |
 | [`crypto/ct.ts`](./crypto/ct.ts) | `timingSafeEqual(a, b)`, which reads every byte whatever it holds, and `timingSafeEqualAt(a, aOff, b, bOff, len)` over two windows, which answers `false` for a window outside its array. Two lengths that differ answer `false` at once, because a length is public, and so does an array longer than 2^31 − 1 bytes | — |
 | [`crypto/bcrypt.ts`](./crypto/bcrypt.ts) | `bcryptHash(password, salt, cost)`, the 60-character `$2b$` hash of a `Secret<u8[]>` password under a 16-byte salt and a cost of 4 to 31, and `bcryptVerify(password, hash)`, which reads `$2a$`, `$2b$` and `$2y$` hashes, refuses `$2x$`, and compares in constant time. The first 72 bytes of a password count, up to its first NUL, as under libxcrypt's `crypt_r` (where other implementations differ: [the interoperability table](../docs/security/crypto-bcrypt.md#interoperability)); the Blowfish state is wiped before either returns. `bcryptHash4(p0, p1, p2, p3, salts, cost)` and `bcryptVerify4(p0, p1, p2, p3, hashes)` do up to four at once, interleaved (four in the time of about 1.2 single hashes on one core), each lane the single path's answer; verify groups lanes by cost, and a malformed lane makes the whole call an `Err` naming it. `BCRYPT_MAX_PASSWORD`, `BCRYPT_HASH_LENGTH`, `BCRYPT_SALT_SIZE`, `BCRYPT_MIN_COST`, `BCRYPT_MAX_COST`. A `std/threads` task may call all four ([BCRYPT-9](../docs/security/crypto-bcrypt.md#findings)) | OpenBSD `bcrypt(3)`; crypt_blowfish 1.3 for `$2a$` and `$2y$` |
+| [`crypto/bcrypt-batch.ts`](./crypto/bcrypt-batch.ts) | `bcryptBatcher({ width, holdNanos, cores, cost })`, a login batcher: `verify(password, hash, now)` and `hash(password, salt, now)` queue a request and answer its ticket, `waitNanos(now)` says when a run is due (a full batch, or the oldest request held `holdNanos`), and `run(now)` sends up to `width × cores` requests as `bcryptVerifyN` / `bcryptHashN` batches on one `std/threads` task per core and answers a `BcryptAnswer` (`ticket`, `ok`, `hash`, `error`) for each. It keeps and wipes its own copy of each password; a damaged stored hash answers its `Err` on its own row ([the record](../docs/security/crypto-bcrypt.md#the-login-batcher)) | — |
 | [`crypto/base64url.ts`](./crypto/base64url.ts) | `base64urlEncode(data)` and `base64urlDecode(text)`, unpadded; `base64StdPadEncode(data)` and `base64StdPadDecode(text)`, the padded standard alphabet that SCRAM and PEM use, constant-time in both directions. These are not `nish/base64`, which encodes only, is not constant-time and is for pixels; the names differ because std modules share the program's one namespace. Decoding is strict, so every byte string has one spelling. `base64urlDecode` answers `null` for any `=`, a character outside the alphabet, a length of 1 mod 4 or nonzero unused low bits; `base64StdPadDecode` requires the padding, answering `null` unless the text is whole four-character groups with `=` only as the last one or two characters, every other character in the alphabet and the unused bits zero. Both refuse a text longer than 2^31 − 1 bytes, and `base64urlEncode` panics on such an array | RFC 4648 §4, §5, §10 (`tests/link/std_base64_padded`) |
 | [`crypto/sha1.ts`](./crypto/sha1.ts) | `sha1(data)`, a fresh 20-byte digest, and `SHA1_SIZE` and `SHA1_BLOCK`. **Not for security**: SHA-1 is broken for collisions, and it is here only because RFC 6455 §4.2.2's `Sec-WebSocket-Accept` is defined on it (`nish/net/websocket` is its importer). One-shot only; it panics on an array longer than 2^31 − 1 bytes. It came after the #363 audit and has no record in `docs/security/` | FIPS 180-4 §6.1 |
 | [`crypto/x25519.ts`](./crypto/x25519.ts) | `x25519(scalar, u)`, the shared secret as a `Secret<u8[]>`, and `x25519Base(scalar)`, the public key, each from a `Secret<u8[]>` scalar, on ten 25.5-bit limbs in `i64`. Either answers `null` unless its arguments are `X25519_SIZE` (32) bytes; the scalar is clamped on a copy, which is wiped | RFC 7748 §5.2, §6.1, Wycheproof `x25519_test` |

package/std/crypto/bcrypt-batch.ts

@@ -0,0 +1,702 @@
+/**
+ * `nish/crypto/bcrypt-batch` — a login batcher: it queues bcrypt verifies and
+ * hashes as they arrive, sends them as `bcryptVerifyN` / `bcryptHashN`
+ * batches, and runs the batches on `std/threads` tasks, one per core.
+ *
+ *     import { bcryptCalibrate } from "nish/crypto/bcrypt"
+ *     import { BcryptAnswer, BcryptBatcher, bcryptBatcher } from "nish/crypto/bcrypt-batch"
+ *     import { availableParallelism, monotonicNanos } from "nish:process"
+ *
+ *     const noHold: i64 = 0
+ *     const made = bcryptBatcher({ width: bcryptCalibrate(), holdNanos: noHold, cores: availableParallelism(), cost: 10 })
+ *     const batcher: BcryptBatcher = made.value
+ *     // In the server's loop, for each login that arrives:
+ *     const ticket: i32 = batcher.verify(password, storedHash, monotonicNanos())
+ *     // ... wait at most batcher.waitNanos(now) for the next readiness event, then:
+ *     for (const a of batcher.run(monotonicNanos())) { reply(a.ticket, a.ok) }
+ *
+ * **Why.** How full a batch is moves the time per password by more than any
+ * instruction-set work does: on one core a full six-lane cost-10 batch takes
+ * 15.7 ms per hash and a lone hash 56.9 ms (docs/security/crypto-bcrypt.md,
+ * "Speed"). A server whose logins arrive one at a time never fills a batch by
+ * itself; this module holds them until there are enough, or until a short
+ * window has passed.
+ *
+ * **When a batch is sent.** `run(now)` sends work when the queue holds at
+ * least `width` requests, or when the oldest has waited `holdNanos`; a hold
+ * of 0 sends whatever is queued at every `run`. It takes at most
+ * `width × cores` requests a run, the oldest first, and spreads them evenly
+ * over `min(cores, taken)` tasks, each running its share as one batch, so a
+ * run takes about one batch's time and the event loop gets control back
+ * between runs. Spreading rather than filling is deliberate: while a run is
+ * going nothing else can use the free cores, and a batch of two on each of
+ * three cores ends sooner than one of six on one. Under load the requests
+ * that arrive during a run fill the next one, so the batches fill on their
+ * own; at light load each request runs alone on a core, as a task per login
+ * would. `waitNanos(now)` says how long the loop may sleep before a `run` is
+ * due.
+ *
+ * **`run` blocks.** It opens a scope, runs the shares, one on the calling
+ * thread, and returns once every share has finished: about one batch, 60–95
+ * ms of cost 10 on the core this was measured on. That is the pause the
+ * password-hashing guide describes for a scope on the event loop's thread;
+ * give the batcher a thread of its own to avoid it.
+ *
+ * **The batcher keeps its own copy of each password.** `verify` and `hash`
+ * borrow the caller's `Secret<u8[]>`, as any function taking one does: they
+ * copy it, inside `exposeWith`, into a holder of the batcher's own (a class
+ * with one `readonly` `Secret` field), and the caller wipes its password as
+ * it would after `bcryptVerify`. `run` calls each copy's `wipe()` on the
+ * calling thread once the scope that read it has joined, so no task can
+ * still be reading it. A request that never runs (a batcher dropped with
+ * requests queued) is not wiped: call `run` until `pending()` is 0 before
+ * dropping one. The tasks call only `bcryptVerifyN`, `bcryptHashN` and
+ * `bcryptVerify`, which wipe everything they make
+ * (docs/security/crypto-bcrypt.md, BCRYPT-9, BCRYPT-11).
+ *
+ * **Every request gets its own answer.** A verify against a hash string that
+ * is not one makes `bcryptVerifyN` an `Err` for the whole batch; the share
+ * then verifies each of that batch's lanes alone, so only the damaged row
+ * answers the `Err` and the rest answer as they would have. A `hash` whose
+ * salt is not 16 bytes is answered with its `Err` at the next `run`, without
+ * being batched. The answers of a run come back in the order their requests
+ * were taken; match them to requests by `ticket`.
+ *
+ * Names carry the `bcryptBatch` prefix because a `std/` module's private
+ * functions share the importing program's flat symbol namespace
+ * (`docs/wp26-stdlib.md` §3e).
+ */
+
+import {
+  BCRYPT_MAX_COST,
+  BCRYPT_MIN_COST,
+  bcryptHashN,
+  bcryptVerify,
+  bcryptVerifyN,
+} from "nish/crypto/bcrypt"
+import { Secret, expose, exposeWith, secret, wipe } from "nish:secret"
+import { scope } from "nish/threads"
+
+/** A request's kind: a verify of a password against a stored hash. */
+const BCRYPT_BATCH_VERIFY: i32 = 0
+
+/** A request's kind: a new hash of a password under a salt. */
+const BCRYPT_BATCH_HASH: i32 = 1
+
+/** The most lanes `bcryptVerifyN` and `bcryptHashN` take. */
+const BCRYPT_BATCH_MAX_WIDTH: i32 = 6
+
+/** How a batcher sends its work: see `bcryptBatcher`. */
+export interface BcryptBatchConfig {
+  /** Lanes per batch, 1 to 6: `bcryptCalibrate()`'s answer. */
+  width: i32
+  /** How long the oldest request may wait for a batch to fill, in nanoseconds; 0 never waits. */
+  holdNanos: i64
+  /** How many tasks a run may use, at least 1: `availableParallelism()`. */
+  cores: i32
+  /** The cost `hash` requests are made at, 4 to 31. Verifies take theirs from the hash. */
+  cost: i32
+}
+
+/** What a request answered, under the ticket `verify` or `hash` gave it. */
+export class BcryptAnswer {
+  /** The ticket of the request. */
+  ticket: i32
+  /** A verify: whether the password is the hash's. A hash: whether it was made. False with an error. */
+  ok: boolean
+  /** A hash request's `$2b$` hash; "" for a verify and for an error. */
+  hash: string
+  /** "" unless the request is an `Err`, as `bcryptVerify` or `bcryptHash` words it. */
+  error: string
+
+  constructor(ticket: i32, ok: boolean, hash: string, error: string) {
+    this.ticket = ticket
+    this.ok = ok
+    this.hash = hash
+    this.error = error
+  }
+}
+
+/**
+ * The batcher's copy of one queued password: a holder, so it may sit in the
+ * queue's array, made at the password's length and filled by `bcryptBatchTake`.
+ */
+class BcryptBatchKey {
+  readonly key: Secret<u8[]>
+
+  constructor(length: i32) {
+    this.key = secret(new Array<u8>(length))
+  }
+
+  wipe(): void {
+    wipe(this.key)
+  }
+}
+
+/** A password's length, the one fact about it the batcher reads outside a batch. */
+const bcryptBatchLengthOf = (bytes: u8[]): i32 => toI32(bytes.length)
+
+/** Copies `from` into the exposed key `into`, which has its length. */
+const bcryptBatchCopy = (into: u8[], from: u8[]): i32 => {
+  for (let i: i32 = 0; i < toI32(into.length) && i < toI32(from.length); i++) {
+    into[i] = from[i]
+  }
+  return 0
+}
+
+/** Copies the exposed password `bytes` into `held`'s key. */
+const bcryptBatchFill = (bytes: u8[], held: BcryptBatchKey): i32 =>
+  exposeWith(held.key, bytes, bcryptBatchCopy)
+
+/** A new holder with a copy of `password`; the caller keeps, and wipes, its own. */
+const bcryptBatchTake = (password: Secret<u8[]>): BcryptBatchKey => {
+  const held: BcryptBatchKey = new BcryptBatchKey(expose(password, bcryptBatchLengthOf))
+  exposeWith(password, held, bcryptBatchFill)
+  return held
+}
+
+/**
+ * One task's work: requests in the order the share takes them. The task
+ * reads it and writes none of it; its answer is one string a request, "1"
+ * or "0" for a verify, the hash for a hash, and "!" and the error for an
+ * `Err`.
+ */
+class BcryptBatchShare {
+  passwords: BcryptBatchKey[]
+  kinds: i32[]
+  /** A verify's stored hash, "" for a hash. */
+  hashes: string[]
+  /** 16 bytes a request; a verify's are zeros and are not read. */
+  salts: u8[]
+  cost: i32
+  width: i32
+
+  constructor(cost: i32, width: i32) {
+    this.passwords = []
+    this.kinds = []
+    this.hashes = []
+    this.salts = []
+    this.cost = cost
+    this.width = width
+  }
+}
+
+/** The holder at `list[i]` of `share`, or at `list[0]` past the batch's end (that lane is then passed as null). */
+const bcryptBatchLane = (share: BcryptBatchShare, list: i32[], i: i32): BcryptBatchKey => {
+  const at: i32 = i < toI32(list.length) ? list[i] : list[0]
+  return share.passwords[at]
+}
+
+/** The answer string of one verify alone, for a lane of a batch that answered an `Err`. */
+const bcryptBatchVerifyAlone = (held: BcryptBatchKey, hash: string): string => {
+  const said: Result<boolean, string> = bcryptVerify(held.key, hash)
+  if (said.isErr()) {
+    return `!${said.error}`
+  }
+  return said.value ? "1" : "0"
+}
+
+/**
+ * One `bcryptVerifyN` over the first `n` of `list`: a holder's field is
+ * passed only as a call's argument, so each lane count is its own call.
+ */
+const bcryptBatchVerifyLanes = (
+  share: BcryptBatchShare,
+  list: i32[],
+  n: i32,
+  hashes: string[]
+): Result<boolean[], string> => {
+  const a: BcryptBatchKey = bcryptBatchLane(share, list, 0)
+  const b: BcryptBatchKey = bcryptBatchLane(share, list, 1)
+  const c: BcryptBatchKey = bcryptBatchLane(share, list, 2)
+  const d: BcryptBatchKey = bcryptBatchLane(share, list, 3)
+  const e: BcryptBatchKey = bcryptBatchLane(share, list, 4)
+  const f: BcryptBatchKey = bcryptBatchLane(share, list, 5)
+  if (n <= 1) {
+    return bcryptVerifyN(a.key, null, null, null, null, null, hashes)
+  }
+  if (n === 2) {
+    return bcryptVerifyN(a.key, b.key, null, null, null, null, hashes)
+  }
+  if (n === 3) {
+    return bcryptVerifyN(a.key, b.key, c.key, null, null, null, hashes)
+  }
+  if (n === 4) {
+    return bcryptVerifyN(a.key, b.key, c.key, d.key, null, null, hashes)
+  }
+  if (n === 5) {
+    return bcryptVerifyN(a.key, b.key, c.key, d.key, e.key, null, hashes)
+  }
+  return bcryptVerifyN(a.key, b.key, c.key, d.key, e.key, f.key, hashes)
+}
+
+/** One `bcryptHashN` over the first `n` of `list`, as `bcryptBatchVerifyLanes` is for verifies. */
+const bcryptBatchHashLanes = (
+  share: BcryptBatchShare,
+  list: i32[],
+  n: i32,
+  salts: u8[]
+): Result<string[], string> => {
+  const a: BcryptBatchKey = bcryptBatchLane(share, list, 0)
+  const b: BcryptBatchKey = bcryptBatchLane(share, list, 1)
+  const c: BcryptBatchKey = bcryptBatchLane(share, list, 2)
+  const d: BcryptBatchKey = bcryptBatchLane(share, list, 3)
+  const e: BcryptBatchKey = bcryptBatchLane(share, list, 4)
+  const f: BcryptBatchKey = bcryptBatchLane(share, list, 5)
+  if (n <= 1) {
+    return bcryptHashN(a.key, null, null, null, null, null, salts, share.cost)
+  }
+  if (n === 2) {
+    return bcryptHashN(a.key, b.key, null, null, null, null, salts, share.cost)
+  }
+  if (n === 3) {
+    return bcryptHashN(a.key, b.key, c.key, null, null, null, salts, share.cost)
+  }
+  if (n === 4) {
+    return bcryptHashN(a.key, b.key, c.key, d.key, null, null, salts, share.cost)
+  }
+  if (n === 5) {
+    return bcryptHashN(a.key, b.key, c.key, d.key, e.key, null, salts, share.cost)
+  }
+  return bcryptHashN(a.key, b.key, c.key, d.key, e.key, f.key, salts, share.cost)
+}
+
+/** The verifies of `share` at `list[from..from + n)` as one `bcryptVerifyN`, each lane's answer into `out` at its index. */
+const bcryptBatchVerifyRun = (
+  share: BcryptBatchShare,
+  list: i32[],
+  from: i32,
+  n: i32,
+  out: string[]
+): void => {
+  const lanes: i32[] = []
+  for (let i: i32 = from; i < from + n && i < toI32(list.length); i++) {
+    if (i >= 0) {
+      lanes.push(list[i])
+    }
+  }
+  if (toI32(lanes.length) === 0) {
+    return
+  }
+  const hashes: string[] = ["", "", "", "", "", ""]
+  for (let s: i32 = 0; s < toI32(lanes.length) && s < 6; s++) {
+    const at: i32 = lanes[s]
+    if (at >= 0 && at < toI32(share.hashes.length)) {
+      hashes[s] = share.hashes[at]
+    }
+  }
+  const said: Result<boolean[], string> = bcryptBatchVerifyLanes(share, lanes, toI32(lanes.length), hashes)
+  for (let s: i32 = 0; s < toI32(lanes.length); s++) {
+    const at: i32 = lanes[s]
+    let line: string = "0"
+    if (said.isErr()) {
+      // One damaged hash fails the whole call: answer each lane alone.
+      if (at >= 0 && at < toI32(share.passwords.length) && s < toI32(hashes.length)) {
+        line = bcryptBatchVerifyAlone(share.passwords[at], hashes[s])
+      }
+    } else {
+      const ok: boolean[] = said.value
+      line = s < toI32(ok.length) && ok[s] ? "1" : "0"
+    }
+    if (at >= 0 && at < toI32(out.length)) {
+      out[at] = line
+    }
+  }
+}
+
+/** The hashes of `share` at `list[from..from + n)` as one `bcryptHashN`, each lane's answer into `out` at its index. */
+const bcryptBatchHashRun = (share: BcryptBatchShare, list: i32[], from: i32, n: i32, out: string[]): void => {
+  const lanes: i32[] = []
+  for (let i: i32 = from; i < from + n && i < toI32(list.length); i++) {
+    if (i >= 0) {
+      lanes.push(list[i])
+    }
+  }
+  if (toI32(lanes.length) === 0) {
+    return
+  }
+  const salts: u8[] = new Array<u8>(96)
+  for (let s: i32 = 0; s < toI32(lanes.length) && s < 6; s++) {
+    const at: i32 = lanes[s]
+    for (let j: i32 = 0; j < 16 && 16 * at + j < toI32(share.salts.length); j++) {
+      if (at >= 0) {
+        salts[16 * s + j] = share.salts[16 * at + j]
+      }
+    }
+  }
+  const made: Result<string[], string> = bcryptBatchHashLanes(share, lanes, toI32(lanes.length), salts)
+  for (let s: i32 = 0; s < toI32(lanes.length); s++) {
+    const at: i32 = lanes[s]
+    let line: string = ""
+    if (made.isErr()) {
+      line = `!${made.error}`
+    } else {
+      const all: string[] = made.value
+      line = s < toI32(all.length) ? all[s] : ""
+    }
+    if (at >= 0 && at < toI32(out.length)) {
+      out[at] = line
+    }
+  }
+}
+
+/** The indices of `share`'s requests of `kind`, in order. */
+const bcryptBatchOfKind = (share: BcryptBatchShare, kind: i32): i32[] => {
+  const list: i32[] = []
+  for (let i: i32 = 0; i < toI32(share.kinds.length); i++) {
+    if (share.kinds[i] === kind) {
+      list.push(i)
+    }
+  }
+  return list
+}
+
+/**
+ * One task: every request of `share`, the verifies and then the hashes, in
+ * batches of up to `width`. It reads `share` and writes only arrays it made,
+ * and answers one line a request, joined by "\n": a task hands back a string,
+ * not an array of them. No answer holds a newline: a `$2b$` hash is base-64
+ * and bcrypt's errors are one line.
+ */
+const bcryptBatchShareRun = (share: BcryptBatchShare): string => {
+  const out: string[] = []
+  for (let i: i32 = 0; i < toI32(share.kinds.length); i++) {
+    out.push("")
+  }
+  const width: i32 = share.width < 1 ? 1 : share.width
+  const verifies: i32[] = bcryptBatchOfKind(share, BCRYPT_BATCH_VERIFY)
+  for (let i: i32 = 0; i < toI32(verifies.length); i += width) {
+    bcryptBatchVerifyRun(share, verifies, i, width, out)
+  }
+  const hashes: i32[] = bcryptBatchOfKind(share, BCRYPT_BATCH_HASH)
+  for (let i: i32 = 0; i < toI32(hashes.length); i += width) {
+    bcryptBatchHashRun(share, hashes, i, width, out)
+  }
+  return out.join("\n")
+}
+
+/**
+ * The cost a verify's stored hash names, read from its fourth and fifth
+ * characters, or -1 when they are not two digits; only the order of a run
+ * reads it, so that one cost's verifies share a batch.
+ */
+const bcryptBatchCostOf = (hash: string): i32 => {
+  if (toI32(hash.length) < 7) {
+    return -1
+  }
+  const tens: i32 = toI32(hash.charCodeAt(4)) - 48
+  const ones: i32 = toI32(hash.charCodeAt(5)) - 48
+  if (tens < 0 || tens > 9 || ones < 0 || ones > 9) {
+    return -1
+  }
+  return tens * 10 + ones
+}
+
+/** The lines of a task's answer, split at "\n". */
+const bcryptBatchLines = (joined: string): string[] => {
+  const lines: string[] = []
+  let from: i32 = 0
+  while (from >= 0 && from <= toI32(joined.length)) {
+    const at: i32 = toI32(joined.indexOf("\n", from))
+    if (at < from || at > toI32(joined.length)) {
+      lines.push(joined.slice(from))
+      return lines
+    }
+    lines.push(joined.slice(from, at))
+    from = at + 1
+  }
+  return lines
+}
+
+/** The answer a share's string stands for. */
+const bcryptBatchAnswerOf = (ticket: i32, kind: i32, said: string): BcryptAnswer => {
+  if (said.startsWith("!")) {
+    return new BcryptAnswer(ticket, false, "", said.substring(1))
+  }
+  if (kind === BCRYPT_BATCH_HASH) {
+    return new BcryptAnswer(ticket, said !== "", said, "")
+  }
+  return new BcryptAnswer(ticket, said === "1", "", "")
+}
+
+/**
+ * A queue of bcrypt requests and the policy that sends them: made by
+ * `bcryptBatcher`. `verify` and `hash` queue, `run` sends and answers,
+ * `waitNanos` says when the next `run` is due.
+ */
+export class BcryptBatcher {
+  holdNanos: i64
+  /** The queue, from `head`: each request's copy of its password, kind, stored hash, salt (16 bytes each), ticket and arrival. */
+  passwords: BcryptBatchKey[]
+  kinds: i32[]
+  hashes: string[]
+  salts: u8[]
+  tickets: i32[]
+  arrived: i64[]
+  /** Answers made without a batch (a salt of the wrong length), handed out by the next `run`. */
+  early: BcryptAnswer[]
+  width: i32
+  cores: i32
+  cost: i32
+  head: i32
+  /** The next ticket. */
+  next: i32
+
+  constructor(config: BcryptBatchConfig) {
+    this.width = config.width
+    this.holdNanos = config.holdNanos
+    this.cores = config.cores
+    this.cost = config.cost
+    this.passwords = []
+    this.kinds = []
+    this.hashes = []
+    this.salts = []
+    this.tickets = []
+    this.arrived = []
+    this.head = 0
+    this.early = []
+    this.next = 0
+  }
+
+  /** How many requests are queued or answered and not yet handed out by `run`. */
+  pending(): i32 {
+    return toI32(this.kinds.length) - this.head + toI32(this.early.length)
+  }
+
+  /**
+   * Queues a verify of `password` against `hash`, which arrived at `now`
+   * (`monotonicNanos()`), and answers its ticket. The batcher queues a copy
+   * of `password` and wipes the copy once the verify has run; the caller
+   * wipes its own.
+   */
+  verify(password: Secret<u8[]>, hash: string, now: i64): i32 {
+    const ticket: i32 = this.next
+    this.next = this.next + 1
+    this.enqueue(password, BCRYPT_BATCH_VERIFY, hash, new Array<u8>(16), ticket, now)
+    return ticket
+  }
+
+  /**
+   * Queues a new hash of `password` under `salt` (16 bytes, fresh from
+   * `crypto.getRandomValues`) at the batcher's cost, which arrived at `now`,
+   * and answers its ticket. The batcher queues a copy of `password` and
+   * wipes the copy once the hash is made; a salt of another length is
+   * answered with its `Err` by the next `run`, and no copy is made.
+   */
+  hash(password: Secret<u8[]>, salt: u8[], now: i64): i32 {
+    const ticket: i32 = this.next
+    this.next = this.next + 1
+    if (toI32(salt.length) !== 16) {
+      this.early.push(new BcryptAnswer(ticket, false, "", "bcrypt: the salt is not 16 bytes"))
+      return ticket
+    }
+    this.enqueue(password, BCRYPT_BATCH_HASH, "", salt, ticket, now)
+    return ticket
+  }
+
+  /** Appends one request to the queue. */
+  enqueue(password: Secret<u8[]>, kind: i32, hash: string, salt: u8[], ticket: i32, now: i64): void {
+    this.passwords.push(bcryptBatchTake(password))
+    this.kinds.push(kind)
+    this.hashes.push(hash)
+    for (let j: i32 = 0; j < 16 && j < toI32(salt.length); j++) {
+      this.salts.push(salt[j])
+    }
+    this.tickets.push(ticket)
+    this.arrived.push(now)
+  }
+
+  /**
+   * Nanoseconds from `now` until a `run` is due: 0 when it is due now (a full
+   * batch is queued, the oldest request has waited `holdNanos`, or an answer
+   * is waiting), -1 when nothing is queued.
+   */
+  waitNanos(now: i64): i64 {
+    if (toI32(this.early.length) > 0) {
+      return 0
+    }
+    const queued: i32 = toI32(this.kinds.length) - this.head
+    if (queued <= 0) {
+      return -1
+    }
+    if (queued >= this.width || this.head >= toI32(this.arrived.length)) {
+      return 0
+    }
+    const waited: i64 = now - this.arrived[this.head]
+    return waited >= this.holdNanos ? 0 : this.holdNanos - waited
+  }
+
+  /**
+   * Sends what is due and answers it: nothing (bar answers made without a
+   * batch) until `waitNanos(now)` is 0, then up to `width × cores` of the
+   * oldest requests, spread evenly over up to `cores` tasks, each running
+   * its share as batches of up to `width`. Returns once every task has
+   * finished, with the copy of each password it ran wiped.
+   */
+  run(now: i64): BcryptAnswer[] {
+    const answers: BcryptAnswer[] = []
+    for (const a of this.early) {
+      answers.push(a)
+    }
+    this.early = []
+    if (this.waitNanos(now) !== 0) {
+      return answers
+    }
+    const queued: i32 = toI32(this.kinds.length) - this.head
+    if (queued <= 0) {
+      return answers
+    }
+    const most: i32 = this.width * this.cores
+    const taken: i32 = queued < most ? queued : most
+    const order: i32[] = this.orderOf(taken)
+    const tasks: i32 = taken < this.cores ? taken : this.cores
+    const shares: BcryptBatchShare[] = []
+    // Share k takes order[taken·k/tasks, taken·(k+1)/tasks): contiguous, so one cost's verifies stay together.
+    const owner: i32[] = []
+    for (let k: i32 = 0; k < tasks; k++) {
+      const share: BcryptBatchShare = new BcryptBatchShare(this.cost, this.width)
+      const lo: i32 = (taken * k) / tasks
+      const hi: i32 = (taken * (k + 1)) / tasks
+      for (let i: i32 = lo; i >= 0 && i < hi && i < toI32(order.length); i++) {
+        const at: i32 = order[i]
+        if (at >= 0 && at < toI32(this.passwords.length) && at < toI32(this.kinds.length)) {
+          share.passwords.push(this.passwords[at])
+          share.kinds.push(this.kinds[at])
+          share.hashes.push(at < toI32(this.hashes.length) ? this.hashes[at] : "")
+          for (let j: i32 = 0; j < 16; j++) {
+            share.salts.push(16 * at + j < toI32(this.salts.length) ? this.salts[16 * at + j] : toU8(0))
+          }
+          owner.push(at)
+        }
+      }
+      shares.push(share)
+    }
+    const said: string[] = []
+    for (let k: i32 = 0; k < tasks; k++) {
+      said.push("")
+    }
+    {
+      using s = scope()
+      for (let k: i32 = 0; k < toI32(shares.length); k++) {
+        s.spawn(bcryptBatchShareRun, shares[k], said, k)
+      }
+    }
+    let flat: i32 = 0
+    for (let k: i32 = 0; k < toI32(said.length); k++) {
+      const one: string[] = bcryptBatchLines(said[k])
+      for (let i: i32 = 0; i < toI32(one.length) && flat < toI32(owner.length); i++) {
+        const at: i32 = owner[flat]
+        flat++
+        if (at >= 0 && at < toI32(this.tickets.length) && at < toI32(this.kinds.length)) {
+          answers.push(bcryptBatchAnswerOf(this.tickets[at], this.kinds[at], one[i]))
+        }
+      }
+    }
+    for (const at of order) {
+      if (at >= 0 && at < toI32(this.passwords.length)) {
+        const held: BcryptBatchKey = this.passwords[at]
+        held.wipe()
+      }
+    }
+    this.head = this.head + taken
+    this.compact()
+    return answers
+  }
+
+  /**
+   * The queue indices of the `taken` oldest requests, verifies by the cost
+   * their hash names and then hashes, each group in arrival order.
+   */
+  orderOf(taken: i32): i32[] {
+    const keyed: i32[] = []
+    const keys: i32[] = []
+    for (let i: i32 = this.head; i < this.head + taken && i < toI32(this.kinds.length); i++) {
+      keyed.push(i)
+      let key: i32 = 1000
+      if (this.kinds[i] !== BCRYPT_BATCH_HASH) {
+        key = i < toI32(this.hashes.length) ? bcryptBatchCostOf(this.hashes[i]) : -1
+      }
+      keys.push(key)
+    }
+    // Stable: one pass a distinct key, lowest first, each in arrival order.
+    // A run takes at most 36 requests, of a few costs.
+    const sorted: i32[] = []
+    let last: i32 = -2
+    while (toI32(sorted.length) < toI32(keyed.length)) {
+      let low: i32 = 1001
+      for (const key of keys) {
+        if (key > last && key < low) {
+          low = key
+        }
+      }
+      if (low > 1000) {
+        return sorted
+      }
+      for (let i: i32 = 0; i < toI32(keyed.length) && i < toI32(keys.length); i++) {
+        if (keys[i] === low) {
+          sorted.push(keyed[i])
+        }
+      }
+      last = low
+    }
+    return sorted
+  }
+
+  /** Drops the requests before `head` once they are most of the queue, so a long-lived batcher's arrays stay small. */
+  compact(): void {
+    if (this.head < 64 || this.head * 2 < toI32(this.kinds.length)) {
+      return
+    }
+    const passwords: BcryptBatchKey[] = []
+    const kinds: i32[] = []
+    const hashes: string[] = []
+    const salts: u8[] = []
+    const tickets: i32[] = []
+    const arrived: i64[] = []
+    for (let i: i32 = this.head; i < toI32(this.kinds.length); i++) {
+      if (
+        i < toI32(this.passwords.length) &&
+        i < toI32(this.hashes.length) &&
+        i < toI32(this.tickets.length) &&
+        i < toI32(this.arrived.length)
+      ) {
+        passwords.push(this.passwords[i])
+        kinds.push(this.kinds[i])
+        hashes.push(this.hashes[i])
+        for (let j: i32 = 0; j < 16; j++) {
+          salts.push(16 * i + j < toI32(this.salts.length) ? this.salts[16 * i + j] : toU8(0))
+        }
+        tickets.push(this.tickets[i])
+        arrived.push(this.arrived[i])
+      }
+    }
+    this.passwords = passwords
+    this.kinds = kinds
+    this.hashes = hashes
+    this.salts = salts
+    this.tickets = tickets
+    this.arrived = arrived
+    this.head = 0
+  }
+}
+
+/**
+ * A new batcher for `config`, or an `Err` naming the field out of range: a
+ * width outside 1 to 6, a negative hold, fewer than one core, or a cost
+ * outside 4 to 31.
+ */
+export const bcryptBatcher = (config: BcryptBatchConfig): Result<BcryptBatcher, string> => {
+  if (config.width < 1 || config.width > BCRYPT_BATCH_MAX_WIDTH) {
+    return Err("bcrypt: the batch width is outside 1 to 6")
+  }
+  if (config.holdNanos < 0) {
+    return Err("bcrypt: the hold is negative")
+  }
+  if (config.cores < 1) {
+    return Err("bcrypt: a batcher needs at least one core")
+  }
+  if (config.cost < BCRYPT_MIN_COST || config.cost > BCRYPT_MAX_COST) {
+    return Err("bcrypt: the cost is outside 4 to 31")
+  }
+  return Ok(new BcryptBatcher(config))
+}

package/std/crypto/bcrypt.ts

@@ -1024,7 +1024,9 @@ const bcryptLoadSlot = (state: Secret<u32[]>, password: Secret<u8[]>, slot: i32)
 // the lane count changed (bench/crypto/bcrypt/gen-body.mjs writes them), not
 // one loop over a lane count: the lanes' l and r must live in registers and
 // their loads be scheduled together, which a loop over an array of lanes
-// does not give.
+// does not give. Two lanes take each byte by its own shift and write every
+// lane's bytes before any lane's update, the form all widths had before the
+// rotated copy, which measured slower there.
 
 /** `bcryptBody4`'s interleave on two lanes. */
 const bcryptBody2 = (st: u32[]): void => {
@@ -1089,35 +1091,41 @@ const bcryptBody3 = (st: u32[]): void => {
     l1 ^= st[1042]
     l2 ^= st[2084]
     for (let n: i32 = 1; n < 17; n += 2) {
+      const l0e: u32 = ctSelect((l0 >>> 8) | (l0 << 24), 0xffffffff, 0)
       const l0a: i32 = toI32(l0 >>> 24) & 0xff
-      const l0b: i32 = toI32(l0 >>> 16) & 0xff
-      const l0c: i32 = toI32(l0 >>> 8) & 0xff
+      const l0b: i32 = toI32(l0e >>> 8) & 0xff
+      const l0c: i32 = toI32(l0e) & 0xff
       const l0d: i32 = toI32(l0) & 0xff
+      r0 ^= st[n] ^ (((st[18 + l0a] + st[274 + l0b]) ^ st[530 + l0c]) + st[786 + l0d])
+      const l1e: u32 = ctSelect((l1 >>> 8) | (l1 << 24), 0xffffffff, 0)
       const l1a: i32 = toI32(l1 >>> 24) & 0xff
-      const l1b: i32 = toI32(l1 >>> 16) & 0xff
-      const l1c: i32 = toI32(l1 >>> 8) & 0xff
+      const l1b: i32 = toI32(l1e >>> 8) & 0xff
+      const l1c: i32 = toI32(l1e) & 0xff
       const l1d: i32 = toI32(l1) & 0xff
+      r1 ^= st[1042 + n] ^ (((st[1060 + l1a] + st[1316 + l1b]) ^ st[1572 + l1c]) + st[1828 + l1d])
+      const l2e: u32 = ctSelect((l2 >>> 8) | (l2 << 24), 0xffffffff, 0)
       const l2a: i32 = toI32(l2 >>> 24) & 0xff
-      const l2b: i32 = toI32(l2 >>> 16) & 0xff
-      const l2c: i32 = toI32(l2 >>> 8) & 0xff
+      const l2b: i32 = toI32(l2e >>> 8) & 0xff
+      const l2c: i32 = toI32(l2e) & 0xff
       const l2d: i32 = toI32(l2) & 0xff
-      r0 ^= st[n] ^ (((st[18 + l0a] + st[274 + l0b]) ^ st[530 + l0c]) + st[786 + l0d])
-      r1 ^= st[1042 + n] ^ (((st[1060 + l1a] + st[1316 + l1b]) ^ st[1572 + l1c]) + st[1828 + l1d])
       r2 ^= st[2084 + n] ^ (((st[2102 + l2a] + st[2358 + l2b]) ^ st[2614 + l2c]) + st[2870 + l2d])
+      const r0e: u32 = ctSelect((r0 >>> 8) | (r0 << 24), 0xffffffff, 0)
       const r0a: i32 = toI32(r0 >>> 24) & 0xff
-      const r0b: i32 = toI32(r0 >>> 16) & 0xff
-      const r0c: i32 = toI32(r0 >>> 8) & 0xff
+      const r0b: i32 = toI32(r0e >>> 8) & 0xff
+      const r0c: i32 = toI32(r0e) & 0xff
       const r0d: i32 = toI32(r0) & 0xff
+      l0 ^= st[n + 1] ^ (((st[18 + r0a] + st[274 + r0b]) ^ st[530 + r0c]) + st[786 + r0d])
+      const r1e: u32 = ctSelect((r1 >>> 8) | (r1 << 24), 0xffffffff, 0)
       const r1a: i32 = toI32(r1 >>> 24) & 0xff
-      const r1b: i32 = toI32(r1 >>> 16) & 0xff
-      const r1c: i32 = toI32(r1 >>> 8) & 0xff
+      const r1b: i32 = toI32(r1e >>> 8) & 0xff
+      const r1c: i32 = toI32(r1e) & 0xff
       const r1d: i32 = toI32(r1) & 0xff
+      l1 ^= st[1042 + n + 1] ^ (((st[1060 + r1a] + st[1316 + r1b]) ^ st[1572 + r1c]) + st[1828 + r1d])
+      const r2e: u32 = ctSelect((r2 >>> 8) | (r2 << 24), 0xffffffff, 0)
       const r2a: i32 = toI32(r2 >>> 24) & 0xff
-      const r2b: i32 = toI32(r2 >>> 16) & 0xff
-      const r2c: i32 = toI32(r2 >>> 8) & 0xff
+      const r2b: i32 = toI32(r2e >>> 8) & 0xff
+      const r2c: i32 = toI32(r2e) & 0xff
       const r2d: i32 = toI32(r2) & 0xff
-      l0 ^= st[n + 1] ^ (((st[18 + r0a] + st[274 + r0b]) ^ st[530 + r0c]) + st[786 + r0d])
-      l1 ^= st[1042 + n + 1] ^ (((st[1060 + r1a] + st[1316 + r1b]) ^ st[1572 + r1c]) + st[1828 + r1d])
       l2 ^= st[2084 + n + 1] ^ (((st[2102 + r2a] + st[2358 + r2b]) ^ st[2614 + r2c]) + st[2870 + r2d])
     }
     const t0: u32 = r0
@@ -1143,6 +1151,19 @@ const bcryptBody3 = (st: u32[]): void => {
  * place, the four encryption chains interleaved round by round so that one
  * lane's S-box loads overlap the others' instead of waiting on their own. The
  * hot loop of the batch: 2^(cost+1) calls of 521 blocks per lane.
+ *
+ * Each lane's half-round is written whole, its bytes and then its update,
+ * before the next lane's. The two middle index bytes come from one copy of the
+ * word rotated right by 8 (`e`: byte 1 is its low byte, byte 2 its second),
+ * behind the value barrier: `ctSelect(v, 0xffffffff, 0)` is `v`, opaque, so
+ * LLVM cannot fold the two bytes back into two shifts of the word, and copies
+ * it once instead of twice; on a BMI2 target the copy is one `rorx`. Three
+ * and five lanes rotate the copy the same way; six shift it right by 8, which
+ * has the same two low bytes and measured faster there. On a
+ * Xeon Platinum 8260 that is 6% less time a hash at the best width, 9% under
+ * `--cpu x86-64-v3` (docs/security/crypto-bcrypt.md, "Cascade Lake"). The
+ * barrier is an identity on a register: it adds no branch and no load, and
+ * the round reads the same four S-box words.
  */
 const bcryptBody4 = (st: u32[]): void => {
   if (st.length < 4168) {
@@ -1162,45 +1183,53 @@ const bcryptBody4 = (st: u32[]): void => {
     l2 ^= st[2084]
     l3 ^= st[3126]
     for (let n: i32 = 1; n < 17; n += 2) {
+      const l0e: u32 = ctSelect((l0 >>> 8) | (l0 << 24), 0xffffffff, 0)
       const l0a: i32 = toI32(l0 >>> 24) & 0xff
-      const l0b: i32 = toI32(l0 >>> 16) & 0xff
-      const l0c: i32 = toI32(l0 >>> 8) & 0xff
+      const l0b: i32 = toI32(l0e >>> 8) & 0xff
+      const l0c: i32 = toI32(l0e) & 0xff
       const l0d: i32 = toI32(l0) & 0xff
+      r0 ^= st[n] ^ (((st[18 + l0a] + st[274 + l0b]) ^ st[530 + l0c]) + st[786 + l0d])
+      const l1e: u32 = ctSelect((l1 >>> 8) | (l1 << 24), 0xffffffff, 0)
       const l1a: i32 = toI32(l1 >>> 24) & 0xff
-      const l1b: i32 = toI32(l1 >>> 16) & 0xff
-      const l1c: i32 = toI32(l1 >>> 8) & 0xff
+      const l1b: i32 = toI32(l1e >>> 8) & 0xff
+      const l1c: i32 = toI32(l1e) & 0xff
       const l1d: i32 = toI32(l1) & 0xff
+      r1 ^= st[1042 + n] ^ (((st[1060 + l1a] + st[1316 + l1b]) ^ st[1572 + l1c]) + st[1828 + l1d])
+      const l2e: u32 = ctSelect((l2 >>> 8) | (l2 << 24), 0xffffffff, 0)
       const l2a: i32 = toI32(l2 >>> 24) & 0xff
-      const l2b: i32 = toI32(l2 >>> 16) & 0xff
-      const l2c: i32 = toI32(l2 >>> 8) & 0xff
+      const l2b: i32 = toI32(l2e >>> 8) & 0xff
+      const l2c: i32 = toI32(l2e) & 0xff
       const l2d: i32 = toI32(l2) & 0xff
+      r2 ^= st[2084 + n] ^ (((st[2102 + l2a] + st[2358 + l2b]) ^ st[2614 + l2c]) + st[2870 + l2d])
+      const l3e: u32 = ctSelect((l3 >>> 8) | (l3 << 24), 0xffffffff, 0)
       const l3a: i32 = toI32(l3 >>> 24) & 0xff
-      const l3b: i32 = toI32(l3 >>> 16) & 0xff
-      const l3c: i32 = toI32(l3 >>> 8) & 0xff
+      const l3b: i32 = toI32(l3e >>> 8) & 0xff
+      const l3c: i32 = toI32(l3e) & 0xff
       const l3d: i32 = toI32(l3) & 0xff
-      r0 ^= st[n] ^ (((st[18 + l0a] + st[274 + l0b]) ^ st[530 + l0c]) + st[786 + l0d])
-      r1 ^= st[1042 + n] ^ (((st[1060 + l1a] + st[1316 + l1b]) ^ st[1572 + l1c]) + st[1828 + l1d])
-      r2 ^= st[2084 + n] ^ (((st[2102 + l2a] + st[2358 + l2b]) ^ st[2614 + l2c]) + st[2870 + l2d])
       r3 ^= st[3126 + n] ^ (((st[3144 + l3a] + st[3400 + l3b]) ^ st[3656 + l3c]) + st[3912 + l3d])
+      const r0e: u32 = ctSelect((r0 >>> 8) | (r0 << 24), 0xffffffff, 0)
       const r0a: i32 = toI32(r0 >>> 24) & 0xff
-      const r0b: i32 = toI32(r0 >>> 16) & 0xff
-      const r0c: i32 = toI32(r0 >>> 8) & 0xff
+      const r0b: i32 = toI32(r0e >>> 8) & 0xff
+      const r0c: i32 = toI32(r0e) & 0xff
       const r0d: i32 = toI32(r0) & 0xff
+      l0 ^= st[n + 1] ^ (((st[18 + r0a] + st[274 + r0b]) ^ st[530 + r0c]) + st[786 + r0d])
+      const r1e: u32 = ctSelect((r1 >>> 8) | (r1 << 24), 0xffffffff, 0)
       const r1a: i32 = toI32(r1 >>> 24) & 0xff
-      const r1b: i32 = toI32(r1 >>> 16) & 0xff
-      const r1c: i32 = toI32(r1 >>> 8) & 0xff
+      const r1b: i32 = toI32(r1e >>> 8) & 0xff
+      const r1c: i32 = toI32(r1e) & 0xff
       const r1d: i32 = toI32(r1) & 0xff
+      l1 ^= st[1042 + n + 1] ^ (((st[1060 + r1a] + st[1316 + r1b]) ^ st[1572 + r1c]) + st[1828 + r1d])
+      const r2e: u32 = ctSelect((r2 >>> 8) | (r2 << 24), 0xffffffff, 0)
       const r2a: i32 = toI32(r2 >>> 24) & 0xff
-      const r2b: i32 = toI32(r2 >>> 16) & 0xff
-      const r2c: i32 = toI32(r2 >>> 8) & 0xff
+      const r2b: i32 = toI32(r2e >>> 8) & 0xff
+      const r2c: i32 = toI32(r2e) & 0xff
       const r2d: i32 = toI32(r2) & 0xff
+      l2 ^= st[2084 + n + 1] ^ (((st[2102 + r2a] + st[2358 + r2b]) ^ st[2614 + r2c]) + st[2870 + r2d])
+      const r3e: u32 = ctSelect((r3 >>> 8) | (r3 << 24), 0xffffffff, 0)
       const r3a: i32 = toI32(r3 >>> 24) & 0xff
-      const r3b: i32 = toI32(r3 >>> 16) & 0xff
-      const r3c: i32 = toI32(r3 >>> 8) & 0xff
+      const r3b: i32 = toI32(r3e >>> 8) & 0xff
+      const r3c: i32 = toI32(r3e) & 0xff
       const r3d: i32 = toI32(r3) & 0xff
-      l0 ^= st[n + 1] ^ (((st[18 + r0a] + st[274 + r0b]) ^ st[530 + r0c]) + st[786 + r0d])
-      l1 ^= st[1042 + n + 1] ^ (((st[1060 + r1a] + st[1316 + r1b]) ^ st[1572 + r1c]) + st[1828 + r1d])
-      l2 ^= st[2084 + n + 1] ^ (((st[2102 + r2a] + st[2358 + r2b]) ^ st[2614 + r2c]) + st[2870 + r2d])
       l3 ^= st[3126 + n + 1] ^ (((st[3144 + r3a] + st[3400 + r3b]) ^ st[3656 + r3c]) + st[3912 + r3d])
     }
     const t0: u32 = r0
@@ -1248,55 +1277,65 @@ const bcryptBody5 = (st: u32[]): void => {
     l3 ^= st[3126]
     l4 ^= st[4168]
     for (let n: i32 = 1; n < 17; n += 2) {
+      const l0e: u32 = ctSelect((l0 >>> 8) | (l0 << 24), 0xffffffff, 0)
       const l0a: i32 = toI32(l0 >>> 24) & 0xff
-      const l0b: i32 = toI32(l0 >>> 16) & 0xff
-      const l0c: i32 = toI32(l0 >>> 8) & 0xff
+      const l0b: i32 = toI32(l0e >>> 8) & 0xff
+      const l0c: i32 = toI32(l0e) & 0xff
       const l0d: i32 = toI32(l0) & 0xff
+      r0 ^= st[n] ^ (((st[18 + l0a] + st[274 + l0b]) ^ st[530 + l0c]) + st[786 + l0d])
+      const l1e: u32 = ctSelect((l1 >>> 8) | (l1 << 24), 0xffffffff, 0)
       const l1a: i32 = toI32(l1 >>> 24) & 0xff
-      const l1b: i32 = toI32(l1 >>> 16) & 0xff
-      const l1c: i32 = toI32(l1 >>> 8) & 0xff
+      const l1b: i32 = toI32(l1e >>> 8) & 0xff
+      const l1c: i32 = toI32(l1e) & 0xff
       const l1d: i32 = toI32(l1) & 0xff
+      r1 ^= st[1042 + n] ^ (((st[1060 + l1a] + st[1316 + l1b]) ^ st[1572 + l1c]) + st[1828 + l1d])
+      const l2e: u32 = ctSelect((l2 >>> 8) | (l2 << 24), 0xffffffff, 0)
       const l2a: i32 = toI32(l2 >>> 24) & 0xff
-      const l2b: i32 = toI32(l2 >>> 16) & 0xff
-      const l2c: i32 = toI32(l2 >>> 8) & 0xff
+      const l2b: i32 = toI32(l2e >>> 8) & 0xff
+      const l2c: i32 = toI32(l2e) & 0xff
       const l2d: i32 = toI32(l2) & 0xff
+      r2 ^= st[2084 + n] ^ (((st[2102 + l2a] + st[2358 + l2b]) ^ st[2614 + l2c]) + st[2870 + l2d])
+      const l3e: u32 = ctSelect((l3 >>> 8) | (l3 << 24), 0xffffffff, 0)
       const l3a: i32 = toI32(l3 >>> 24) & 0xff
-      const l3b: i32 = toI32(l3 >>> 16) & 0xff
-      const l3c: i32 = toI32(l3 >>> 8) & 0xff
+      const l3b: i32 = toI32(l3e >>> 8) & 0xff
+      const l3c: i32 = toI32(l3e) & 0xff
       const l3d: i32 = toI32(l3) & 0xff
+      r3 ^= st[3126 + n] ^ (((st[3144 + l3a] + st[3400 + l3b]) ^ st[3656 + l3c]) + st[3912 + l3d])
+      const l4e: u32 = ctSelect((l4 >>> 8) | (l4 << 24), 0xffffffff, 0)
       const l4a: i32 = toI32(l4 >>> 24) & 0xff
-      const l4b: i32 = toI32(l4 >>> 16) & 0xff
-      const l4c: i32 = toI32(l4 >>> 8) & 0xff
+      const l4b: i32 = toI32(l4e >>> 8) & 0xff
+      const l4c: i32 = toI32(l4e) & 0xff
       const l4d: i32 = toI32(l4) & 0xff
-      r0 ^= st[n] ^ (((st[18 + l0a] + st[274 + l0b]) ^ st[530 + l0c]) + st[786 + l0d])
-      r1 ^= st[1042 + n] ^ (((st[1060 + l1a] + st[1316 + l1b]) ^ st[1572 + l1c]) + st[1828 + l1d])
-      r2 ^= st[2084 + n] ^ (((st[2102 + l2a] + st[2358 + l2b]) ^ st[2614 + l2c]) + st[2870 + l2d])
-      r3 ^= st[3126 + n] ^ (((st[3144 + l3a] + st[3400 + l3b]) ^ st[3656 + l3c]) + st[3912 + l3d])
       r4 ^= st[4168 + n] ^ (((st[4186 + l4a] + st[4442 + l4b]) ^ st[4698 + l4c]) + st[4954 + l4d])
+      const r0e: u32 = ctSelect((r0 >>> 8) | (r0 << 24), 0xffffffff, 0)
       const r0a: i32 = toI32(r0 >>> 24) & 0xff
-      const r0b: i32 = toI32(r0 >>> 16) & 0xff
-      const r0c: i32 = toI32(r0 >>> 8) & 0xff
+      const r0b: i32 = toI32(r0e >>> 8) & 0xff
+      const r0c: i32 = toI32(r0e) & 0xff
       const r0d: i32 = toI32(r0) & 0xff
+      l0 ^= st[n + 1] ^ (((st[18 + r0a] + st[274 + r0b]) ^ st[530 + r0c]) + st[786 + r0d])
+      const r1e: u32 = ctSelect((r1 >>> 8) | (r1 << 24), 0xffffffff, 0)
       const r1a: i32 = toI32(r1 >>> 24) & 0xff
-      const r1b: i32 = toI32(r1 >>> 16) & 0xff
-      const r1c: i32 = toI32(r1 >>> 8) & 0xff
+      const r1b: i32 = toI32(r1e >>> 8) & 0xff
+      const r1c: i32 = toI32(r1e) & 0xff
       const r1d: i32 = toI32(r1) & 0xff
+      l1 ^= st[1042 + n + 1] ^ (((st[1060 + r1a] + st[1316 + r1b]) ^ st[1572 + r1c]) + st[1828 + r1d])
+      const r2e: u32 = ctSelect((r2 >>> 8) | (r2 << 24), 0xffffffff, 0)
       const r2a: i32 = toI32(r2 >>> 24) & 0xff
-      const r2b: i32 = toI32(r2 >>> 16) & 0xff
-      const r2c: i32 = toI32(r2 >>> 8) & 0xff
+      const r2b: i32 = toI32(r2e >>> 8) & 0xff
+      const r2c: i32 = toI32(r2e) & 0xff
       const r2d: i32 = toI32(r2) & 0xff
+      l2 ^= st[2084 + n + 1] ^ (((st[2102 + r2a] + st[2358 + r2b]) ^ st[2614 + r2c]) + st[2870 + r2d])
+      const r3e: u32 = ctSelect((r3 >>> 8) | (r3 << 24), 0xffffffff, 0)
       const r3a: i32 = toI32(r3 >>> 24) & 0xff
-      const r3b: i32 = toI32(r3 >>> 16) & 0xff
-      const r3c: i32 = toI32(r3 >>> 8) & 0xff
+      const r3b: i32 = toI32(r3e >>> 8) & 0xff
+      const r3c: i32 = toI32(r3e) & 0xff
       const r3d: i32 = toI32(r3) & 0xff
+      l3 ^= st[3126 + n + 1] ^ (((st[3144 + r3a] + st[3400 + r3b]) ^ st[3656 + r3c]) + st[3912 + r3d])
+      const r4e: u32 = ctSelect((r4 >>> 8) | (r4 << 24), 0xffffffff, 0)
       const r4a: i32 = toI32(r4 >>> 24) & 0xff
-      const r4b: i32 = toI32(r4 >>> 16) & 0xff
-      const r4c: i32 = toI32(r4 >>> 8) & 0xff
+      const r4b: i32 = toI32(r4e >>> 8) & 0xff
+      const r4c: i32 = toI32(r4e) & 0xff
       const r4d: i32 = toI32(r4) & 0xff
-      l0 ^= st[n + 1] ^ (((st[18 + r0a] + st[274 + r0b]) ^ st[530 + r0c]) + st[786 + r0d])
-      l1 ^= st[1042 + n + 1] ^ (((st[1060 + r1a] + st[1316 + r1b]) ^ st[1572 + r1c]) + st[1828 + r1d])
-      l2 ^= st[2084 + n + 1] ^ (((st[2102 + r2a] + st[2358 + r2b]) ^ st[2614 + r2c]) + st[2870 + r2d])
-      l3 ^= st[3126 + n + 1] ^ (((st[3144 + r3a] + st[3400 + r3b]) ^ st[3656 + r3c]) + st[3912 + r3d])
       l4 ^= st[4168 + n + 1] ^ (((st[4186 + r4a] + st[4442 + r4b]) ^ st[4698 + r4c]) + st[4954 + r4d])
     }
     const t0: u32 = r0
@@ -1352,65 +1391,77 @@ const bcryptBody6 = (st: u32[]): void => {
     l4 ^= st[4168]
     l5 ^= st[5210]
     for (let n: i32 = 1; n < 17; n += 2) {
+      const l0e: u32 = ctSelect(l0 >>> 8, 0xffffffff, 0)
       const l0a: i32 = toI32(l0 >>> 24) & 0xff
-      const l0b: i32 = toI32(l0 >>> 16) & 0xff
-      const l0c: i32 = toI32(l0 >>> 8) & 0xff
+      const l0b: i32 = toI32(l0e >>> 8) & 0xff
+      const l0c: i32 = toI32(l0e) & 0xff
       const l0d: i32 = toI32(l0) & 0xff
+      r0 ^= st[n] ^ (((st[18 + l0a] + st[274 + l0b]) ^ st[530 + l0c]) + st[786 + l0d])
+      const l1e: u32 = ctSelect(l1 >>> 8, 0xffffffff, 0)
       const l1a: i32 = toI32(l1 >>> 24) & 0xff
-      const l1b: i32 = toI32(l1 >>> 16) & 0xff
-      const l1c: i32 = toI32(l1 >>> 8) & 0xff
+      const l1b: i32 = toI32(l1e >>> 8) & 0xff
+      const l1c: i32 = toI32(l1e) & 0xff
       const l1d: i32 = toI32(l1) & 0xff
+      r1 ^= st[1042 + n] ^ (((st[1060 + l1a] + st[1316 + l1b]) ^ st[1572 + l1c]) + st[1828 + l1d])
+      const l2e: u32 = ctSelect(l2 >>> 8, 0xffffffff, 0)
       const l2a: i32 = toI32(l2 >>> 24) & 0xff
-      const l2b: i32 = toI32(l2 >>> 16) & 0xff
-      const l2c: i32 = toI32(l2 >>> 8) & 0xff
+      const l2b: i32 = toI32(l2e >>> 8) & 0xff
+      const l2c: i32 = toI32(l2e) & 0xff
       const l2d: i32 = toI32(l2) & 0xff
+      r2 ^= st[2084 + n] ^ (((st[2102 + l2a] + st[2358 + l2b]) ^ st[2614 + l2c]) + st[2870 + l2d])
+      const l3e: u32 = ctSelect(l3 >>> 8, 0xffffffff, 0)
       const l3a: i32 = toI32(l3 >>> 24) & 0xff
-      const l3b: i32 = toI32(l3 >>> 16) & 0xff
-      const l3c: i32 = toI32(l3 >>> 8) & 0xff
+      const l3b: i32 = toI32(l3e >>> 8) & 0xff
+      const l3c: i32 = toI32(l3e) & 0xff
       const l3d: i32 = toI32(l3) & 0xff
+      r3 ^= st[3126 + n] ^ (((st[3144 + l3a] + st[3400 + l3b]) ^ st[3656 + l3c]) + st[3912 + l3d])
+      const l4e: u32 = ctSelect(l4 >>> 8, 0xffffffff, 0)
       const l4a: i32 = toI32(l4 >>> 24) & 0xff
-      const l4b: i32 = toI32(l4 >>> 16) & 0xff
-      const l4c: i32 = toI32(l4 >>> 8) & 0xff
+      const l4b: i32 = toI32(l4e >>> 8) & 0xff
+      const l4c: i32 = toI32(l4e) & 0xff
       const l4d: i32 = toI32(l4) & 0xff
+      r4 ^= st[4168 + n] ^ (((st[4186 + l4a] + st[4442 + l4b]) ^ st[4698 + l4c]) + st[4954 + l4d])
+      const l5e: u32 = ctSelect(l5 >>> 8, 0xffffffff, 0)
       const l5a: i32 = toI32(l5 >>> 24) & 0xff
-      const l5b: i32 = toI32(l5 >>> 16) & 0xff
-      const l5c: i32 = toI32(l5 >>> 8) & 0xff
+      const l5b: i32 = toI32(l5e >>> 8) & 0xff
+      const l5c: i32 = toI32(l5e) & 0xff
       const l5d: i32 = toI32(l5) & 0xff
-      r0 ^= st[n] ^ (((st[18 + l0a] + st[274 + l0b]) ^ st[530 + l0c]) + st[786 + l0d])
-      r1 ^= st[1042 + n] ^ (((st[1060 + l1a] + st[1316 + l1b]) ^ st[1572 + l1c]) + st[1828 + l1d])
-      r2 ^= st[2084 + n] ^ (((st[2102 + l2a] + st[2358 + l2b]) ^ st[2614 + l2c]) + st[2870 + l2d])
-      r3 ^= st[3126 + n] ^ (((st[3144 + l3a] + st[3400 + l3b]) ^ st[3656 + l3c]) + st[3912 + l3d])
-      r4 ^= st[4168 + n] ^ (((st[4186 + l4a] + st[4442 + l4b]) ^ st[4698 + l4c]) + st[4954 + l4d])
       r5 ^= st[5210 + n] ^ (((st[5228 + l5a] + st[5484 + l5b]) ^ st[5740 + l5c]) + st[5996 + l5d])
+      const r0e: u32 = ctSelect(r0 >>> 8, 0xffffffff, 0)
       const r0a: i32 = toI32(r0 >>> 24) & 0xff
-      const r0b: i32 = toI32(r0 >>> 16) & 0xff
-      const r0c: i32 = toI32(r0 >>> 8) & 0xff
+      const r0b: i32 = toI32(r0e >>> 8) & 0xff
+      const r0c: i32 = toI32(r0e) & 0xff
       const r0d: i32 = toI32(r0) & 0xff
+      l0 ^= st[n + 1] ^ (((st[18 + r0a] + st[274 + r0b]) ^ st[530 + r0c]) + st[786 + r0d])
+      const r1e: u32 = ctSelect(r1 >>> 8, 0xffffffff, 0)
       const r1a: i32 = toI32(r1 >>> 24) & 0xff
-      const r1b: i32 = toI32(r1 >>> 16) & 0xff
-      const r1c: i32 = toI32(r1 >>> 8) & 0xff
+      const r1b: i32 = toI32(r1e >>> 8) & 0xff
+      const r1c: i32 = toI32(r1e) & 0xff
       const r1d: i32 = toI32(r1) & 0xff
+      l1 ^= st[1042 + n + 1] ^ (((st[1060 + r1a] + st[1316 + r1b]) ^ st[1572 + r1c]) + st[1828 + r1d])
+      const r2e: u32 = ctSelect(r2 >>> 8, 0xffffffff, 0)
       const r2a: i32 = toI32(r2 >>> 24) & 0xff
-      const r2b: i32 = toI32(r2 >>> 16) & 0xff
-      const r2c: i32 = toI32(r2 >>> 8) & 0xff
+      const r2b: i32 = toI32(r2e >>> 8) & 0xff
+      const r2c: i32 = toI32(r2e) & 0xff
       const r2d: i32 = toI32(r2) & 0xff
+      l2 ^= st[2084 + n + 1] ^ (((st[2102 + r2a] + st[2358 + r2b]) ^ st[2614 + r2c]) + st[2870 + r2d])
+      const r3e: u32 = ctSelect(r3 >>> 8, 0xffffffff, 0)
       const r3a: i32 = toI32(r3 >>> 24) & 0xff
-      const r3b: i32 = toI32(r3 >>> 16) & 0xff
-      const r3c: i32 = toI32(r3 >>> 8) & 0xff
+      const r3b: i32 = toI32(r3e >>> 8) & 0xff
+      const r3c: i32 = toI32(r3e) & 0xff
       const r3d: i32 = toI32(r3) & 0xff
+      l3 ^= st[3126 + n + 1] ^ (((st[3144 + r3a] + st[3400 + r3b]) ^ st[3656 + r3c]) + st[3912 + r3d])
+      const r4e: u32 = ctSelect(r4 >>> 8, 0xffffffff, 0)
       const r4a: i32 = toI32(r4 >>> 24) & 0xff
-      const r4b: i32 = toI32(r4 >>> 16) & 0xff
-      const r4c: i32 = toI32(r4 >>> 8) & 0xff
+      const r4b: i32 = toI32(r4e >>> 8) & 0xff
+      const r4c: i32 = toI32(r4e) & 0xff
       const r4d: i32 = toI32(r4) & 0xff
+      l4 ^= st[4168 + n + 1] ^ (((st[4186 + r4a] + st[4442 + r4b]) ^ st[4698 + r4c]) + st[4954 + r4d])
+      const r5e: u32 = ctSelect(r5 >>> 8, 0xffffffff, 0)
       const r5a: i32 = toI32(r5 >>> 24) & 0xff
-      const r5b: i32 = toI32(r5 >>> 16) & 0xff
-      const r5c: i32 = toI32(r5 >>> 8) & 0xff
+      const r5b: i32 = toI32(r5e >>> 8) & 0xff
+      const r5c: i32 = toI32(r5e) & 0xff
       const r5d: i32 = toI32(r5) & 0xff
-      l0 ^= st[n + 1] ^ (((st[18 + r0a] + st[274 + r0b]) ^ st[530 + r0c]) + st[786 + r0d])
-      l1 ^= st[1042 + n + 1] ^ (((st[1060 + r1a] + st[1316 + r1b]) ^ st[1572 + r1c]) + st[1828 + r1d])
-      l2 ^= st[2084 + n + 1] ^ (((st[2102 + r2a] + st[2358 + r2b]) ^ st[2614 + r2c]) + st[2870 + r2d])
-      l3 ^= st[3126 + n + 1] ^ (((st[3144 + r3a] + st[3400 + r3b]) ^ st[3656 + r3c]) + st[3912 + r3d])
-      l4 ^= st[4168 + n + 1] ^ (((st[4186 + r4a] + st[4442 + r4b]) ^ st[4698 + r4c]) + st[4954 + r4d])
       l5 ^= st[5210 + n + 1] ^ (((st[5228 + r5a] + st[5484 + r5b]) ^ st[5740 + r5c]) + st[5996 + r5d])
     }
     const t0: u32 = r0

package/std/sort.ts

@@ -0,0 +1,178 @@
+/**
+ * `std/sort` — `xs.sort(cmp)` on an array, in Nish: a stable merge sort,
+ * compiled once per comparator.
+ *
+ * A program does not import this module. A `.sort(cmp)` call is what loads it
+ * (the checker's `importSort`), and the checker routes the call to `sortWith`
+ * here. `cmp` is a compile-time function parameter, so each comparator is an
+ * instantiation of its own whose body calls the comparator directly — there is
+ * no function pointer. Under Node and `tsc` the call is the platform's
+ * `Array.prototype.sort`, so nothing here runs there.
+ *
+ * **Same order as Node.** `Array.prototype.sort` is stable (ES2019), so for a
+ * comparator that is a consistent total preorder there is exactly one answer,
+ * and any stable sort gives it. A comparator's result is read only as "greater
+ * than zero or not": a later element moves before an earlier one only when
+ * the comparator answers a positive number for (earlier, later), so a negative
+ * zero and NaN are zero, as Node treats them.
+ *
+ * **Shape.** The array is copied once into a scratch array of the same
+ * length, the only allocation, which the function's arena scope gives back
+ * before it returns, so a sort leaves `Arena.used()` where it was. Runs of
+ * `RUN` are sorted by insertion from the scratch into the array (a strictly
+ * descending run is copied reversed instead), then merged
+ * bottom-up, alternating between the two, and copied back once if the last
+ * pass ended in the scratch. A pair of runs already in order is copied without
+ * a merge. Every merge takes from the left run on a tie, which is what makes
+ * it stable.
+ *
+ * **No element is held across a write.** An `interface` element is stored
+ * inline, and `const v = xs[i]` is a pointer into the array, so an insertion
+ * sort in place would overwrite the element it is inserting. Every step here
+ * reads from one array and writes the other, and moves a whole slot, which for
+ * an inline record is one copy of its bytes.
+ *
+ * **Proofs.** Every index is proven in range by the guard written beside it,
+ * so no access keeps its bounds check. The run arithmetic wraps only where
+ * the operands are proven to lie in `0..n`, so it cannot wrap: a difference
+ * of two of them, or a sum taken only when it stays below `n`.
+ */
+
+import { wrappingAdd, wrappingSub } from "nish:unsafe"
+
+/** The length of the runs insertion sort makes before the first merge. */
+const RUN: i32 = 32
+
+/**
+ * `lo + step`, or `n` when that is not below `n`. Every caller has
+ * `0 <= lo <= n`, so `n - lo` cannot wrap, and the sum is taken only below `n`.
+ */
+const stepTo = (lo: i32, step: i32, n: i32): i32 => (wrappingSub(n, lo) > step ? wrappingAdd(lo, step) : n)
+
+/**
+ * `src[lo..hi)` sorted by insertion into `dst[lo..hi)`. The comparator call
+ * forgets every array length, so each access after it repeats its guard.
+ */
+const insertionRun = <T>(src: T[], dst: T[], cmp: (a: T, b: T) => number, lo: i32, hi: i32): void => {
+  // A strictly descending run is copied reversed: no two of its elements are
+  // equal, so reversing it keeps the sort stable, and costs one comparison each.
+  // `lo < hi`, and `d` steps only while below `hi`, so neither `+ 1` wraps.
+  let d = wrappingAdd(lo, 1)
+  while (d > 0 && d < hi && d < toI32(src.length)) {
+    const p = d - 1
+    if (!(cmp(src[p], src[d]) > 0)) {
+      break
+    }
+    d = wrappingAdd(d, 1)
+  }
+  if (d >= hi) {
+    // `hi > lo >= 0`, so `hi - 1` does not wrap, and `r` steps down only from `r >= 0`.
+    let r = wrappingSub(hi, 1)
+    for (let k: i32 = lo; k >= 0 && k < hi && k < toI32(dst.length) && r >= 0 && r < toI32(src.length); k++) {
+      dst[k] = src[r]
+      r = wrappingSub(r, 1)
+    }
+    return
+  }
+  for (let i: i32 = lo; i >= 0 && i < hi; i++) {
+    let j = i
+    while (j > lo && j > 0 && j < toI32(dst.length) && i < toI32(src.length)) {
+      const k = j - 1
+      if (!(cmp(dst[k], src[i]) > 0) || k < 0 || k >= toI32(dst.length) || j >= toI32(dst.length)) {
+        break
+      }
+      dst[j] = dst[k]
+      j = k
+    }
+    if (i < toI32(src.length) && j >= 0 && j < toI32(dst.length)) {
+      dst[j] = src[i]
+    }
+  }
+}
+
+/** `src[lo..hi)` copied into `dst[lo..hi)`. */
+const copyRun = <T>(src: T[], dst: T[], lo: i32, hi: i32): void => {
+  for (let k: i32 = lo; k >= 0 && k < hi && k < toI32(src.length) && k < toI32(dst.length); k++) {
+    dst[k] = src[k]
+  }
+}
+
+/**
+ * The sorted runs `src[lo..mid)` and `src[mid..hi)` merged into `dst[lo..hi)`,
+ * or copied when the last of the left run is not after the first of the right.
+ */
+const mergeRuns = <T>(src: T[], dst: T[], cmp: (a: T, b: T) => number, lo: i32, mid: i32, hi: i32): void => {
+  if (mid > 0 && mid < hi && mid < toI32(src.length)) {
+    const last = mid - 1
+    if (last < toI32(src.length) && !(cmp(src[last], src[mid]) > 0)) {
+      copyRun(src, dst, lo, hi)
+      return
+    }
+  }
+  let i = lo
+  let j = mid
+  for (let k: i32 = lo; k >= 0 && k < hi; k++) {
+    let right = i >= mid
+    if (!right && j < hi && i >= 0 && i < toI32(src.length) && j >= 0 && j < toI32(src.length)) {
+      right = cmp(src[i], src[j]) > 0
+    }
+    if (right) {
+      if (j >= 0 && j < toI32(src.length) && k < toI32(dst.length)) {
+        dst[k] = src[j]
+      }
+      // `j` steps at most `hi - mid` times from `mid`, so it stays at most `hi`.
+      j = wrappingAdd(j, 1)
+    } else {
+      if (i >= 0 && i < toI32(src.length) && k < toI32(dst.length)) {
+        dst[k] = src[i]
+      }
+      // `i` steps at most `mid - lo` times from `lo`, so it stays at most `mid`.
+      i = wrappingAdd(i, 1)
+    }
+  }
+}
+
+/** One bottom-up pass: every pair of adjacent `width`-runs of `src` merged into `dst`. */
+const mergePass = <T>(src: T[], dst: T[], cmp: (a: T, b: T) => number, n: i32, width: i32): void => {
+  let lo: i32 = 0
+  while (lo >= 0 && lo < n) {
+    const mid = stepTo(lo, width, n)
+    const hi = stepTo(mid, width, n)
+    mergeRuns(src, dst, cmp, lo, mid, hi)
+    lo = hi
+  }
+}
+
+/** `xs` sorted in place by `cmp`, stably, and answered: what `xs.sort(cmp)` compiles to. */
+export const sortWith = <T>(xs: T[], cmp: (a: T, b: T) => number): T[] => {
+  const n: i32 = toI32(xs.length)
+  if (n < 2) {
+    return xs
+  }
+  // One allocation at full size, every slot written before any is read: the
+  // checker lets this `new Array<T>(n)` hold any `T`, and neither emitter
+  // zero-fills it (`isSortInstance`).
+  const tmp = new Array<T>(n)
+  copyRun(xs, tmp, 0, n)
+  let lo: i32 = 0
+  while (lo >= 0 && lo < n) {
+    const hi = stepTo(lo, RUN, n)
+    insertionRun(tmp, xs, cmp, lo, hi)
+    lo = hi
+  }
+  let inTmp = false
+  let width: i32 = RUN
+  while (width > 0 && width < n) {
+    if (inTmp) {
+      mergePass(tmp, xs, cmp, n, width)
+    } else {
+      mergePass(xs, tmp, cmp, n, width)
+    }
+    inTmp = !inTmp
+    width = stepTo(width, width, n)
+  }
+  if (inTmp) {
+    copyRun(tmp, xs, 0, n)
+  }
+  return xs
+}