@scriptc/cli-darwin-x64 0.2.4 → 0.2.6

package/dist/lib/runtime-sources/src/scr_json.c

@@ -22,6 +22,7 @@
  *   serializers (and the error messages here).
  */
 #include "scr_runtime.h"
+#include "scr_key.h"
 
 static SCR_TL ScrDyn *scr_builtin_object_prototype;
 
@@ -159,7 +160,9 @@ void scr_jb_init(ScrJsonBuf *b) {
 }
 
 static void scr_jb_grow(ScrJsonBuf *b, size_t need) {
-  if (b->len + need <= b->cap) return;
+  if (need > SIZE_MAX - sizeof(ScrStr) - 1 - b->len) scr_json_oom();
+  size_t required = b->len + need;
+  if (required <= b->cap) return;
   if (!b->data) { /* first allocation: len == 0 */
     size_t cap = scr_jb_hint >= need ? scr_jb_hint : need;
     ScrStr *s = scr_str_alloc_raw(0, cap);
@@ -168,7 +171,13 @@ static void scr_jb_grow(ScrJsonBuf *b, size_t need) {
     return;
   }
   size_t cap = b->cap;
-  while (cap < b->len + need) cap *= 2;
+  while (cap < required) {
+    if (cap > (SIZE_MAX - sizeof(ScrStr) - 1) / 2) {
+      cap = required;
+      break;
+    }
+    cap *= 2;
+  }
   ScrStr *s = scr_str_regrow(SCR_JB_STR(b), cap);
   b->data = s->data;
   b->cap = cap;
@@ -186,7 +195,8 @@ void scr_jb_putc(ScrJsonBuf *b, char c) {
   b->data[b->len++] = c;
 }
 
-static void scr_jb_write(ScrJsonBuf *b, const char *s, size_t n) {
+void scr_jb_write(ScrJsonBuf *b, const char *s, size_t n) {
+  if (n == 0) return;
   scr_jb_grow(b, n);
   memcpy(b->data + b->len, s, n);
   b->len += n;
@@ -198,6 +208,12 @@ void scr_jb_put_str(ScrJsonBuf *b, const ScrStr *s) {
 
 void scr_jb_puts(ScrJsonBuf *b, const char *s) { scr_jb_write(b, s, strlen(s)); }
 
+void scr_jb_put_number(ScrJsonBuf *b, double v) {
+  char buf[32];
+  size_t n = scr_f64_to_str(v, buf);
+  scr_jb_write(b, buf, n);
+}
+
 void scr_jb_put_f64(ScrJsonBuf *b, double v) {
   /* JSON.stringify number rules: non-finite → null, -0 → "0" (String(-0)
    * is "0" too, so scr_f64_to_str would agree — the zero test just makes
@@ -210,42 +226,82 @@ void scr_jb_put_f64(ScrJsonBuf *b, double v) {
     scr_jb_putc(b, '0');
     return;
   }
-  char buf[32];
-  size_t n = scr_f64_to_str(v, buf);
-  scr_jb_write(b, buf, n);
-}
-
-void scr_jb_put_json_str(ScrJsonBuf *b, const ScrStr *s) {
-  scr_jb_putc(b, '"');
-  /* Bulk-copy runs of unescaped bytes (UTF-8 passes through verbatim,
-   * like JS); escapes interrupt the run. */
-  size_t i = 0, run = 0;
-  while (i + run < s->len) {
-    unsigned char c = (unsigned char)s->data[i + run];
-    if (c != '"' && c != '\\' && c >= 0x20) {
-      run++;
-      continue;
-    }
-    scr_jb_write(b, s->data + i, run);
+  scr_jb_put_number(b, v);
+}
+
+/* Find the next quote, backslash or control byte. memcpy keeps the word
+ * loads unaligned-safe, and the length guard never reads past the input.
+ * The masks only decide whether to inspect a word byte by byte: borrow
+ * propagation may mark extra lanes, so it must not determine a byte index.
+ * High UTF-8 bytes are ordinary data, independent of host byte order. */
+static size_t scr_json_plain_bytes(const char *data, size_t len) {
+  const uint64_t ones = UINT64_C(0x0101010101010101);
+  const uint64_t high = UINT64_C(0x8080808080808080);
+  size_t i = 0;
+  while (len - i >= sizeof(uint64_t)) {
+    uint64_t word;
+    memcpy(&word, data + i, sizeof word);
+    uint64_t quotes = word ^ (ones * '"');
+    uint64_t slashes = word ^ (ones * '\\');
+    uint64_t special = ((quotes - ones) & ~quotes) |
+                       ((slashes - ones) & ~slashes) |
+                       ((word - ones * 0x20) & ~word);
+    if (special & high) break;
+    i += sizeof word;
+  }
+  while (i < len) {
+    unsigned char c = (unsigned char)data[i];
+    if (c < 0x20 || c == '"' || c == '\\') break;
+    i++;
+  }
+  return i;
+}
+
+static void scr_jb_put_json_span(ScrJsonBuf *b, const char *data, size_t len) {
+  if (len > SIZE_MAX - 2) scr_json_oom();
+  size_t run = scr_json_plain_bytes(data, len);
+  /* The overwhelmingly common unescaped string needs one capacity check,
+   * including both quotes, and no per-byte builder calls. */
+  scr_jb_grow(b, run + 2);
+  b->data[b->len++] = '"';
+  if (run) memcpy(b->data + b->len, data, run);
+  b->len += run;
+  size_t i = run;
+  while (i < len) {
+    unsigned char c = (unsigned char)data[i++];
+    char escaped[6] = {'\\', 0, '0', '0', 0, 0};
+    size_t count = 2;
     switch (c) {
-    case '"': scr_jb_puts(b, "\\\""); break;
-    case '\\': scr_jb_puts(b, "\\\\"); break;
-    case '\n': scr_jb_puts(b, "\\n"); break;
-    case '\r': scr_jb_puts(b, "\\r"); break;
-    case '\t': scr_jb_puts(b, "\\t"); break;
-    case '\b': scr_jb_puts(b, "\\b"); break;
-    case '\f': scr_jb_puts(b, "\\f"); break;
+    case '"': escaped[1] = '"'; break;
+    case '\\': escaped[1] = '\\'; break;
+    case '\n': escaped[1] = 'n'; break;
+    case '\r': escaped[1] = 'r'; break;
+    case '\t': escaped[1] = 't'; break;
+    case '\b': escaped[1] = 'b'; break;
+    case '\f': escaped[1] = 'f'; break;
     default: {
-      char esc[8];
-      snprintf(esc, sizeof esc, "\\u%04x", c);
-      scr_jb_puts(b, esc);
-    }
-    }
-    i += run + 1;
-    run = 0;
+      static const char hex[] = "0123456789abcdef";
+      escaped[1] = 'u';
+      escaped[4] = hex[c >> 4];
+      escaped[5] = hex[c & 15];
+      count = 6;
+    }
+    }
+    run = scr_json_plain_bytes(data + i, len - i);
+    if (run > SIZE_MAX - count) scr_json_oom();
+    scr_jb_grow(b, count + run);
+    memcpy(b->data + b->len, escaped, count);
+    b->len += count;
+    if (run) memcpy(b->data + b->len, data + i, run);
+    b->len += run;
+    i += run;
   }
-  scr_jb_write(b, s->data + i, run);
-  scr_jb_putc(b, '"');
+  scr_jb_grow(b, 1);
+  b->data[b->len++] = '"';
+}
+
+void scr_jb_put_json_str(ScrJsonBuf *b, const ScrStr *s) {
+  scr_jb_put_json_span(b, s->data, s->len);
 }
 
 ScrStr *scr_jb_finish(ScrJsonBuf *b) {
@@ -264,6 +320,81 @@ ScrStr *scr_jb_finish(ScrJsonBuf *b) {
   return s;
 }
 
+/* Write newline and a repeated gap with one reservation. Copies never
+ * overlap: each doubling reads only the already initialized prefix. */
+static void scr_jb_indent(ScrJsonBuf *b, const char *gap, size_t gap_len, size_t depth) {
+  if (gap_len && depth > (SIZE_MAX - 1) / gap_len) scr_json_oom();
+  size_t count = gap_len * depth;
+  scr_jb_grow(b, count + 1);
+  b->data[b->len++] = '\n';
+  if (!count) return;
+  memcpy(b->data + b->len, gap, gap_len);
+  size_t filled = gap_len;
+  while (filled < count) {
+    size_t take = filled < count - filled ? filled : count - filled;
+    memcpy(b->data + b->len + filled, b->data + b->len, take);
+    filled += take;
+  }
+  b->len += count;
+}
+
+ScrStr *scr_json_indent(const ScrStr *compact, const char *gap, size_t gap_len) {
+  if (!gap_len) return scr_str_retain((ScrStr *)compact);
+  /* Node stops copying the gap at its first NUL but still inserts breaks
+   * and colon spaces when the original gap is nonempty. */
+  const char *end = memchr(gap, 0, gap_len);
+  if (end) gap_len = (size_t)(end - gap);
+  ScrJsonBuf b;
+  scr_jb_init(&b);
+  size_t depth = 0, start = 0, i = 0;
+  while (i < compact->len) {
+    char c = compact->data[i];
+    if (c == '"') {
+      /* Quoted punctuation is data. Scan ordinary runs and skip the byte
+       * after each backslash so an escaped quote cannot end this string. */
+      i++;
+      while (i < compact->len) {
+        i += scr_json_plain_bytes(compact->data + i, compact->len - i);
+        if (i == compact->len) break;
+        if (compact->data[i] == '\\') {
+          i += compact->len - i >= 2 ? 2 : 1;
+        } else {
+          i++;
+          break;
+        }
+      }
+      continue;
+    }
+    if (c == '{' || c == '[') {
+      char closer = c == '{' ? '}' : ']';
+      if (i + 1 < compact->len && compact->data[i + 1] == closer) {
+        i += 2;
+        continue;
+      }
+      scr_jb_write(&b, compact->data + start, i + 1 - start);
+      scr_jb_indent(&b, gap, gap_len, ++depth);
+      start = ++i;
+      continue;
+    }
+    if (c == '}' || c == ']') {
+      scr_jb_write(&b, compact->data + start, i - start);
+      scr_jb_indent(&b, gap, gap_len, --depth);
+      start = i++;
+      continue;
+    }
+    if (c == ',' || c == ':') {
+      scr_jb_write(&b, compact->data + start, i + 1 - start);
+      if (c == ',') scr_jb_indent(&b, gap, gap_len, depth);
+      else scr_jb_putc(&b, ' ');
+      start = ++i;
+      continue;
+    }
+    i++;
+  }
+  scr_jb_write(&b, compact->data + start, compact->len - start);
+  return scr_jb_finish(&b);
+}
+
 /* ── circular-structure detection ──────────────────────────────────────
  * RECURSIVE record types permit runtime reference cycles; JSON.stringify
  * of a cyclic value throws V8's exact TypeError. The compiler-emitted
@@ -413,11 +544,110 @@ void scr_dyn_from_leave(void) {
  * strict alloc/free balance.
  */
 static SCR_TL ScrDyn *scr_builtin_array_prototype;
+
+/* Property names are immutable and often repeated across simultaneously live
+ * objects. Entries own references to their bytes; this fixed weak table owns
+ * none. Collisions only reduce sharing, and the final release removes a weak
+ * entry before freeing storage. Long keys bypass lookup entirely. */
+#define SCR_DYN_KEY_SHARE_SLOTS 256
+#define SCR_DYN_KEY_SHARE_LENGTH 64
+typedef struct {
+  size_t rc;
+  char bytes[];
+} ScrDynKey;
+typedef struct {
+  ScrDynKey *key;
+  size_t length;
+} ScrDynKeySlot;
+static SCR_TL ScrDynKeySlot scr_dyn_keys[SCR_DYN_KEY_SHARE_SLOTS];
+#ifdef SCR_RC_AUDIT
+static SCR_TL long scr_live_dyn_keys;
+long scr_dyn_key_live_count(void) { return scr_live_dyn_keys; }
+#endif
+
+static size_t scr_dyn_key_slot(const char *key, size_t length) {
+  size_t hash = length;
+  for (size_t i = 0; i < length; i++) hash = hash * 31 + (unsigned char)key[i];
+  return hash % SCR_DYN_KEY_SHARE_SLOTS;
+}
+
+static char *scr_dyn_key_copy(const char *key, size_t length) {
+  ScrDynKeySlot *slot = length <= SCR_DYN_KEY_SHARE_LENGTH
+    ? &scr_dyn_keys[scr_dyn_key_slot(key, length)] : NULL;
+  if (slot && slot->key && slot->length == length &&
+      !memcmp(slot->key->bytes, key, length)) {
+    slot->key->rc++;
+    return slot->key->bytes;
+  }
+  if (length > SIZE_MAX - sizeof(ScrDynKey) - 1) scr_json_oom();
+  ScrDynKey *owned = malloc(sizeof *owned + length + 1);
+  if (!owned) scr_json_oom();
+#ifdef SCR_RC_AUDIT
+  scr_live_dyn_keys++;
+#endif
+  owned->rc = 1;
+  memcpy(owned->bytes, key, length);
+  owned->bytes[length] = '\0';
+  if (slot) *slot = (ScrDynKeySlot){owned, length};
+  return owned->bytes;
+}
+
+static void scr_dyn_key_release(char *key, size_t length) {
+  if (!key) return;
+  ScrDynKey *owned = (ScrDynKey *)(key - offsetof(ScrDynKey, bytes));
+  if (--owned->rc) return;
+  if (length <= SCR_DYN_KEY_SHARE_LENGTH) {
+    ScrDynKeySlot *slot = &scr_dyn_keys[scr_dyn_key_slot(key, length)];
+    if (slot->key == owned) slot->key = NULL;
+  }
+#ifdef SCR_RC_AUDIT
+  scr_live_dyn_keys--;
+#endif
+  free(owned);
+}
+
 #ifndef SCR_RC_AUDIT
 static SCR_TL ScrDyn *scr_dyn_free_arr, *scr_dyn_free_obj, *scr_dyn_free_misc;
 static SCR_TL size_t scr_dyn_free_count;
 #define SCR_DYN_FREE_MAX 8192
+/* Recycled small objects may retain key bytes, but never values or an
+ * unbounded document's keys. This budget applies across the whole pool. */
+static SCR_TL size_t scr_dyn_cached_key_bytes;
+#define SCR_DYN_KEY_CACHE_MAX ((size_t)64 * 1024)
+#define SCR_DYN_KEY_CACHE_SLOTS 16
+#define SCR_DYN_KEY_CACHE_LENGTH 64
+#endif
+
+static void scr_dyn_obj_drop_keys(ScrDyn *d, bool cache) {
+  for (size_t i = 0; i < d->v.obj.cap; i++) {
+    ScrDynEntry *entry = &d->v.obj.entries[i];
+    if (!entry->key) continue;
+#ifndef SCR_RC_AUDIT
+    if (cache && d->v.obj.cap <= SCR_DYN_KEY_CACHE_SLOTS &&
+        entry->key_len <= SCR_DYN_KEY_CACHE_LENGTH &&
+        sizeof(ScrDynKey) + entry->key_len + 1 <= SCR_DYN_KEY_CACHE_MAX - scr_dyn_cached_key_bytes) {
+      scr_dyn_cached_key_bytes += sizeof(ScrDynKey) + entry->key_len + 1;
+      continue;
+    }
+#else
+    (void)cache;
 #endif
+    scr_dyn_key_release(entry->key, entry->key_len);
+    entry->key = NULL;
+    entry->key_len = 0;
+  }
+}
+
+/* Primitive kinds cannot acquire properties or change kind while live, so
+ * an object property edge to one cannot participate in a cycle. Keep its RC edge
+ * out of trial deletion and release it in collected teardown instead. Other
+ * owners may still trace the same primitive through the uniform header ABI;
+ * our untraced reference keeps it alive until that teardown releases it.
+ * Entry metadata snapshots this decision during trace, before any white node
+ * can be freed. Teardown must never inspect the child's kind again. */
+static bool scr_dyn_member_is_traced(const ScrDyn *value) {
+  return value && value->kind > SCR_DYN_STR && value->kind != SCR_DYN_UNDEF;
+}
 
 /* Checked objects and functions can close over one another. All heap dyn
  * nodes carry a collector header so a captured unknown value has one uniform
@@ -425,19 +655,21 @@ static SCR_TL size_t scr_dyn_free_count;
  * capsules keep their conservative ownership edges. */
 void scr_dyn_trace_v(void *ptr, ScrTraceVisit visit, void *ctx) {
   ScrDyn *d = ptr;
-  visit(d->prototype, ctx);
-  visit(d->symbol_properties, ctx);
-  visit(d->symbol_keys, ctx);
+  if (d->prototype) visit(d->prototype, ctx);
+  if (d->symbol_properties) visit(d->symbol_properties, ctx);
+  if (d->symbol_keys) visit(d->symbol_keys, ctx);
   switch (d->kind) {
   case SCR_DYN_ARR:
     for (size_t i = 0; i < d->v.arr.len; i++) visit(d->v.arr.items[i], ctx);
-    visit(d->v.arr.properties, ctx);
+    if (d->v.arr.properties) visit(d->v.arr.properties, ctx);
     break;
   case SCR_DYN_OBJ:
     for (size_t i = 0; i < d->v.obj.len; i++) {
-      visit(d->v.obj.entries[i].value, ctx);
-      visit(d->v.obj.entries[i].getter, ctx);
-      visit(d->v.obj.entries[i].setter, ctx);
+      ScrDynEntry *entry = &d->v.obj.entries[i];
+      entry->value_traced = scr_dyn_member_is_traced(entry->value);
+      if (entry->value_traced) visit(entry->value, ctx);
+      if (entry->getter) visit(entry->getter, ctx);
+      if (entry->setter) visit(entry->setter, ctx);
     }
     break;
   case SCR_DYN_FUNC: visit(d->v.fn.clo, ctx); break;
@@ -539,6 +771,12 @@ static ScrDyn *scr_dyn_alloc(ScrDynKind kind) {
       d->v.arr.presence = NULL;
     } else if (kind == SCR_DYN_OBJ) {
       d->v.obj.len = 0; /* cap/entries preserved */
+      if (d->v.obj.cap <= SCR_DYN_KEY_CACHE_SLOTS) {
+        for (size_t i = 0; i < d->v.obj.cap; i++) {
+          ScrDynEntry *entry = &d->v.obj.entries[i];
+          if (entry->key) scr_dyn_cached_key_bytes -= sizeof(ScrDynKey) + entry->key_len + 1;
+        }
+      }
       d->v.obj.source_identity = NULL;
       d->v.obj.source_access = NULL;
     } else {
@@ -565,6 +803,10 @@ static void scr_dyn_handle_release(void *h, ScrDynHandleTag tag);
 static bool scr_dyn_to_primitive_result_is_object(const ScrDyn *d);
 
 static void scr_dyn_dispose(ScrDyn *d, bool collected) {
+  if (d->kind == SCR_DYN_OBJ) {
+    free(d->v.obj.index);
+    d->v.obj.index = NULL;
+  }
   if (!collected) scr_dyn_release(d->prototype);
   if (!collected) scr_dyn_release(d->symbol_properties);
   if (!collected) scr_dyn_release(d->symbol_keys);
@@ -592,12 +834,15 @@ static void scr_dyn_dispose(ScrDyn *d, bool collected) {
     break;
   case SCR_DYN_OBJ:
     for (size_t i = 0; i < d->v.obj.len; i++) {
-      free(d->v.obj.entries[i].key);
+      ScrDyn *value = d->v.obj.entries[i].value;
+      if (!collected || !d->v.obj.entries[i].value_traced) scr_dyn_release(value);
       if (!collected) {
-        scr_dyn_release(d->v.obj.entries[i].value);
         scr_dyn_release(d->v.obj.entries[i].getter);
         scr_dyn_release(d->v.obj.entries[i].setter);
       }
+      d->v.obj.entries[i].value = NULL;
+      d->v.obj.entries[i].getter = NULL;
+      d->v.obj.entries[i].setter = NULL;
     }
     if (d->v.obj.source_identity) {
       d->v.obj.source_access(d->v.obj.source_identity, false);
@@ -646,6 +891,7 @@ static void scr_dyn_dispose(ScrDyn *d, bool collected) {
 #endif
 #ifndef SCR_RC_AUDIT
   if (!collected && scr_dyn_free_count < SCR_DYN_FREE_MAX) {
+    if (d->kind == SCR_DYN_OBJ) scr_dyn_obj_drop_keys(d, true);
     /* Pooled blocks retain their headers and count toward the bounded
      * allocated heap, but never remain in a candidate buffer. */
     scr_weak_dispose(d);
@@ -659,12 +905,17 @@ static void scr_dyn_dispose(ScrDyn *d, bool collected) {
   }
 #endif
   if (d->kind == SCR_DYN_ARR) free(d->v.arr.items);
-  else if (d->kind == SCR_DYN_OBJ) free(d->v.obj.entries);
+  else if (d->kind == SCR_DYN_OBJ) {
+    scr_dyn_obj_drop_keys(d, false);
+    free(d->v.obj.entries);
+  }
   scr_cyc_free(d);
 }
 
 static void scr_dyn_gcfree(void *ptr) { scr_dyn_dispose(ptr, true); }
 
+static void scr_dyn_destroy(void *ptr) { scr_dyn_dispose(ptr, false); }
+
 void scr_dyn_release(ScrDyn *d) {
   if (!d || d->rc == SIZE_MAX) return;
   if (--d->rc != 0) {
@@ -675,7 +926,84 @@ void scr_dyn_release(ScrDyn *d) {
     return;
   }
   scr_cyc_on_dead(d);
-  scr_dyn_dispose(d, false);
+  scr_rc_destroy(d, scr_dyn_destroy);
+}
+
+/* Small objects retain their compact linear representation. A wide object
+ * owns a bucket index of entry positions; entries remain insertion ordered.
+ * No key/value ownership lives here, and callbacks never retain its slots. */
+#define SCR_DYN_OBJECT_INDEX_MIN 32
+typedef struct ScrDynObjectIndex {
+  size_t buckets;
+  size_t slots[]; /* zero is empty; occupied slots store entry + 1 */
+} ScrDynObjectIndex;
+
+static void scr_dyn_index_insert(ScrDynObjectIndex *index, const ScrDynEntry *entry, size_t position) {
+  size_t slot = scr_key_hash(entry->key, entry->key_len) & (index->buckets - 1);
+  while (index->slots[slot]) slot = (slot + 1) & (index->buckets - 1);
+  index->slots[slot] = position + 1;
+}
+
+/* Keep index allocation/probing outside compact object insertion and reads. */
+static __attribute__((noinline)) void scr_dyn_index_append(ScrDyn *object) {
+  size_t count = object->v.obj.len;
+  ScrDynObjectIndex *index = object->v.obj.index;
+  if (!index || count > index->buckets / 2) {
+    size_t buckets = index ? index->buckets : 64;
+    while (count > buckets / 2) {
+      if (buckets > (SIZE_MAX - sizeof *index) / sizeof(size_t) / 2) scr_json_oom();
+      buckets *= 2;
+    }
+    free(index);
+    index = calloc(1, sizeof *index + buckets * sizeof(size_t));
+    if (!index) scr_json_oom();
+    index->buckets = buckets;
+    object->v.obj.index = index;
+    for (size_t i = 0; i < count; i++) scr_dyn_index_insert(index, &object->v.obj.entries[i], i);
+  } else {
+    scr_dyn_index_insert(index, &object->v.obj.entries[count - 1], count - 1);
+  }
+}
+
+/* A checked hint avoids repeating a linear walk for recurring property
+ * names. Slots store indices only, never object/key pointers. Every hit
+ * checks the current entry, so different shapes, deletion and reordering
+ * need no invalidation and collisions fall back to the ordinary search. */
+#define SCR_DYN_PROPERTY_HINTS 64
+static SCR_TL size_t scr_dyn_property_hints[SCR_DYN_PROPERTY_HINTS];
+
+static ScrDynEntry *scr_dyn_find_linear_entry(const ScrDyn *object, const char *key, size_t length) {
+  for (size_t i = 0; i < object->v.obj.len; i++) {
+    ScrDynEntry *entry = &object->v.obj.entries[i];
+    if (entry->key_len == length && scr_key_equal(entry->key, key, length)) return entry;
+  }
+  return NULL;
+}
+
+static __attribute__((noinline)) ScrDynEntry *scr_dyn_find_indexed_entry(
+    const ScrDyn *object, const char *key, size_t length) {
+  const ScrDynObjectIndex *index = object->v.obj.index;
+  size_t slot = scr_key_hash(key, length) & (index->buckets - 1);
+  while (index->slots[slot]) {
+    ScrDynEntry *entry = &object->v.obj.entries[index->slots[slot] - 1];
+    if (entry->key_len == length && scr_key_equal(entry->key, key, length)) return entry;
+    slot = (slot + 1) & (index->buckets - 1);
+  }
+  return NULL;
+}
+
+static ScrDynEntry *scr_dyn_find_entry(const ScrDyn *object, const char *key, size_t length) {
+  if (object->kind != SCR_DYN_OBJ) return NULL;
+  if (object->v.obj.index) return scr_dyn_find_indexed_entry(object, key, length);
+  size_t slot = (length + (length ? (unsigned char)key[0] * 7u : 0)) % SCR_DYN_PROPERTY_HINTS;
+  size_t hint = scr_dyn_property_hints[slot];
+  if (hint < object->v.obj.len) {
+    ScrDynEntry *entry = &object->v.obj.entries[hint];
+    if (entry->key_len == length && scr_key_equal(entry->key, key, length)) return entry;
+  }
+  ScrDynEntry *entry = scr_dyn_find_linear_entry(object, key, length);
+  if (entry) scr_dyn_property_hints[slot] = (size_t)(entry - object->v.obj.entries);
+  return entry;
 }
 
 ScrDyn *scr_dyn_obj_get(const ScrDyn *d, const char *key, size_t key_len) {
@@ -683,20 +1011,13 @@ ScrDyn *scr_dyn_obj_get(const ScrDyn *d, const char *key, size_t key_len) {
     scr_dyn_proxy_unsupported("raw object inspection");
     return NULL;
   }
-  if (d->kind != SCR_DYN_OBJ) return NULL;
-  for (size_t i = 0; i < d->v.obj.len; i++) {
-    const ScrDynEntry *e = &d->v.obj.entries[i];
-    if (e->key_len == key_len && memcmp(e->key, key, key_len) == 0) return e->value;
-  }
-  return NULL;
+  ScrDynEntry *entry = scr_dyn_find_entry(d, key, key_len);
+  return entry ? entry->value : NULL;
 }
 
 bool scr_dyn_obj_enumerable(const ScrDyn *d, const char *key, size_t key_len) {
-  for (size_t i = 0; i < d->v.obj.len; i++) {
-    const ScrDynEntry *e = &d->v.obj.entries[i];
-    if (e->key_len == key_len && memcmp(e->key, key, key_len) == 0) return e->enumerable;
-  }
-  return false;
+  ScrDynEntry *entry = scr_dyn_find_entry(d, key, key_len);
+  return entry && entry->enumerable;
 }
 
 static const ScrDyn *scr_dyn_property_owner(const ScrDyn *object, const char *key, size_t length);
@@ -983,29 +1304,27 @@ ScrDyn *scr_dyn_arr_named_get(const ScrDyn *d, const ScrStr *key) {
   return value;
 }
 
-/* Takes ownership of key (malloc'd) and value. Duplicate keys: the LATER
- * value wins (like JS JSON.parse) — the old value is released and the new
- * key buffer freed (the surviving entry keeps its original, equal key). */
-static void scr_dyn_obj_put(ScrDyn *obj, char *key, size_t key_len, ScrDyn *value) {
-  for (size_t i = 0; i < obj->v.obj.len; i++) {
-    ScrDynEntry *e = &obj->v.obj.entries[i];
-    if (e->key_len == key_len && memcmp(e->key, key, key_len) == 0) {
-      if (e->accessor || !e->writable) {
-        free(key);
-        scr_dyn_release(value);
-        static const char message[] = "Cannot assign to read only property";
-        scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
-        return;
-      }
-      ScrDyn *old = e->value;
-      e->value = value;
-      scr_dyn_release(old);
-      free(key);
+/* Borrows key and takes ownership of value. Duplicate keys retain their
+ * original spelling/storage and insertion position; the later value wins.
+ * A recycled entry can reuse equal key bytes without a malloc/free pair. */
+static void scr_dyn_obj_put(ScrDyn *obj, const char *key, size_t key_len, ScrDyn *value) {
+  /* Construction usually appends an absent name. Avoid a read hint that
+   * repeats comparisons on compact objects; wide objects use their index. */
+  ScrDynEntry *existing = obj->v.obj.index ? scr_dyn_find_entry(obj, key, key_len)
+                                          : scr_dyn_find_linear_entry(obj, key, key_len);
+  if (existing) {
+    if (existing->accessor || !existing->writable) {
+      scr_dyn_release(value);
+      static const char message[] = "Cannot assign to read only property";
+      scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
       return;
     }
+    ScrDyn *old = existing->value;
+    existing->value = value;
+    scr_dyn_release(old);
+    return;
   }
   if (obj->non_extensible) {
-    free(key);
     scr_dyn_release(value);
     static const char message[] = "Cannot add property, object is not extensible";
     scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
@@ -1015,11 +1334,16 @@ static void scr_dyn_obj_put(ScrDyn *obj, char *key, size_t key_len, ScrDyn *valu
     size_t cap = obj->v.obj.cap ? obj->v.obj.cap * 2 : 4;
     ScrDynEntry *entries = realloc(obj->v.obj.entries, cap * sizeof *entries);
     if (!entries) scr_json_oom();
+    memset(entries + obj->v.obj.cap, 0, (cap - obj->v.obj.cap) * sizeof *entries);
     obj->v.obj.entries = entries;
     obj->v.obj.cap = cap;
   }
   ScrDynEntry *e = &obj->v.obj.entries[obj->v.obj.len++];
-  e->key = key;
+  if (!e->key || e->key_len != key_len || memcmp(e->key, key, key_len)) {
+    char *owned = scr_dyn_key_copy(key, key_len);
+    scr_dyn_key_release(e->key, e->key_len);
+    e->key = owned;
+  }
   e->key_len = key_len;
   e->value = value;
   e->getter = NULL;
@@ -1028,6 +1352,7 @@ static void scr_dyn_obj_put(ScrDyn *obj, char *key, size_t key_len, ScrDyn *valu
   e->writable = true;
   e->enumerable = true;
   e->configurable = true;
+  if (obj->v.obj.len >= SCR_DYN_OBJECT_INDEX_MIN) scr_dyn_index_append(obj);
 }
 
 /* ── dyn construction (compiler-emitted converters & overflow reads) ───── */
@@ -1088,6 +1413,22 @@ ScrDyn *scr_dyn_symbol_get(const ScrDyn *value, const ScrStr *key) {
 }
 
 ScrDyn *scr_dyn_new_num(double n) {
+  /* Small integers are immutable primitives, just like the boolean and null
+   * singletons. Initialize only touched slots; the table neither grows nor
+   * owns heap references. Preserve negative zero as a distinct payload. */
+  if (n >= -128 && n <= 255) {
+    int value = (int)n;
+    if ((double)value == n && (value != 0 || !signbit(n))) {
+      static SCR_TL ScrDyn values[384];
+      ScrDyn *cached = &values[value + 128];
+      if (cached->rc == 0) {
+        cached->rc = SIZE_MAX;
+        cached->kind = SCR_DYN_NUM;
+        cached->v.num = n;
+      }
+      return cached;
+    }
+  }
   ScrDyn *d = scr_dyn_alloc(SCR_DYN_NUM);
   d->v.num = n;
   return d;
@@ -1927,7 +2268,9 @@ bool scr_dyn_util_type_is(const ScrDyn *value, const ScrStr *probe) {
   if (!value) return false;
   if (value->kind == SCR_DYN_JSVAL) return scr_dyn_jsval_ops()->type_probe(value->v.jsval.cell, probe);
 #define PROBE(name) (probe->len == sizeof(name) - 1 && memcmp(probe->data, name, sizeof(name) - 1) == 0)
-  if (PROBE("isAnyArrayBuffer") || PROBE("isArrayBuffer")) return scr_array_buffer_is(value);
+  if (PROBE("isAnyArrayBuffer")) return scr_buffer_storage_is(value);
+  if (PROBE("isArrayBuffer")) return scr_array_buffer_is(value);
+  if (PROBE("isSharedArrayBuffer")) return scr_shared_array_buffer_is(value);
   if (PROBE("isArrayBufferView")) return value->kind == SCR_DYN_BYTES;
   if (PROBE("isDataView")) return value->kind == SCR_DYN_BYTES && value->v.bytes->is_data_view;
   if (PROBE("isTypedArray")) return value->kind == SCR_DYN_BYTES && !value->v.bytes->is_data_view;
@@ -2165,7 +2508,7 @@ void scr_dyn_chunk_enc(bool utf8) { scr_dyn_chunk_utf8 = utf8; }
  * a Buffer-flavored bytes box, or a string inside a setEncoding window. */
 ScrDyn *scr_dyn_new_chunk(const ScrBytes *b) {
   if (scr_dyn_chunk_utf8) {
-    ScrStr *s = scr_str_new((const char *)b->data, b->len);
+    ScrStr *s = scr_bytes_string(b, 0, b->len);
     ScrDyn *d = scr_dyn_new_str(s);
     scr_str_release(s);
     return d;
@@ -2343,7 +2686,7 @@ ScrDyn *scr_dyn_bind(ScrDyn *target, ScrDyn *const *args, size_t argc) {
  * always-linked core never references gated units. A missing tag at use
  * is an internal error: emitted programs install a unit's ops whenever
  * they can box its handles. */
-static const ScrDynHandleOps *scr_dynh_ops[SCR_DYNH_COUNT];
+static SCR_TL const ScrDynHandleOps *scr_dynh_ops[SCR_DYNH_COUNT];
 
 void scr_dyn_handle_install(ScrDynHandleTag tag, const ScrDynHandleOps *ops) {
   scr_dynh_ops[tag] = ops;
@@ -2590,6 +2933,7 @@ ScrDyn *scr_dyn_new_handle(void *h, ScrDynHandleTag tag) {
   d->v.handle.ptr = scr_dyn_handle_ops(tag)->retain(h);
   d->v.handle.tag = tag;
   d->v.handle.traced = tag == SCR_DYNH_WEAK_MAP || tag == SCR_DYNH_WEAK_SET ||
+      tag == SCR_DYNH_WORKER || tag == SCR_DYNH_MESSAGE_PORT ||
       ((tag == SCR_DYNH_SET || tag == SCR_DYNH_MAP) &&
        (((ScrMap *)h)->key_trace != NULL || ((ScrMap *)h)->val_trace != NULL));
   return d;
@@ -2599,8 +2943,8 @@ ScrDyn *scr_dyn_new_handle(void *h, ScrDynHandleTag tag) {
  * allocator view; the freelist stays private, and the release arm's
  * scr_promise_release edge installs HERE — a promise-free link never
  * references the fiber machinery (the unit-test subset links). */
-void (*scr_dyn_promise_release_fn)(ScrPromise *p) = NULL;
-bool (*scr_dyn_promise_identity_fn)(ScrPromise *a, ScrPromise *b) = NULL;
+SCR_TL void (*scr_dyn_promise_release_fn)(ScrPromise *p) = NULL;
+SCR_TL bool (*scr_dyn_promise_identity_fn)(ScrPromise *a, ScrPromise *b) = NULL;
 
 ScrDyn *scr_dyn_alloc_promise(void (*release_fn)(ScrPromise *p)) {
   scr_dyn_promise_release_fn = release_fn;
@@ -2765,7 +3109,15 @@ typedef struct {
 static SCR_TL ScrDynThisEnt *scr_dyn_this_stack;
 static SCR_TL size_t scr_dyn_this_n, scr_dyn_this_cap;
 
+static void scr_dyn_this_cleanup(void) {
+  while (scr_dyn_this_n) scr_dyn_this_pop();
+  free(scr_dyn_this_stack);
+  scr_dyn_this_stack = NULL;
+  scr_dyn_this_cap = 0;
+}
+
 static ScrDynThisEnt *scr_dyn_this_grow(void) {
+  if (!scr_dyn_this_stack) scr_atexit(scr_dyn_this_cleanup);
   if (scr_dyn_this_n == scr_dyn_this_cap) {
     size_t cap = scr_dyn_this_cap ? scr_dyn_this_cap * 2 : 8;
     ScrDynThisEnt *s = realloc(scr_dyn_this_stack, cap * sizeof *s);
@@ -2827,14 +3179,10 @@ static void scr_dyn_handle_key_set(ScrDyn *recv, ScrStr *key, ScrDyn *value) {
   scr_throw_error(SCR_ERR_ERROR, scr_jb_finish(&b));
 }
 
-/* Public obj insertion: COPIES the key bytes (the internal put takes a
- * malloc'd buffer), owns the value, later duplicate keys win. */
+/* Public obj insertion copies a new key only when needed, owns the value,
+ * and preserves the existing entry for duplicate keys. */
 void scr_dyn_obj_set(ScrDyn *obj, const char *key, size_t key_len, ScrDyn *value) {
-  char *copy = malloc(key_len + 1);
-  if (!copy) scr_json_oom();
-  memcpy(copy, key, key_len);
-  copy[key_len] = '\0';
-  scr_dyn_obj_put(obj, copy, key_len, value);
+  scr_dyn_obj_put(obj, key, key_len, value);
 }
 
 static ScrStr *scr_dyn_property_key(const ScrDyn *key) {
@@ -2842,12 +3190,7 @@ static ScrStr *scr_dyn_property_key(const ScrDyn *key) {
 }
 
 static ScrDynEntry *scr_dyn_entry(ScrDyn *obj, const ScrStr *key) {
-  if (obj->kind != SCR_DYN_OBJ) return NULL;
-  for (size_t i = 0; i < obj->v.obj.len; i++) {
-    ScrDynEntry *entry = &obj->v.obj.entries[i];
-    if (entry->key_len == key->len && memcmp(entry->key, key->data, key->len) == 0) return entry;
-  }
-  return NULL;
+  return scr_dyn_find_entry(obj, key->data, key->len);
 }
 
 static bool scr_dyn_property_same_value(const ScrDyn *a, const ScrDyn *b) {
@@ -3030,6 +3373,7 @@ typedef struct {
   unsigned kind; /* 0: array, 1: string, 2: Map, 3: Set */
   unsigned selection; /* 0: values, 1: keys, 2: entries */
   bool array_like;
+  bool step_done; /* completion of the last compiler-consumed step */
   double limit;
 } ScrNativeIterator;
 
@@ -3071,21 +3415,18 @@ static void scr_native_iterator_release(void *ptr) {
   free(iterator);
 }
 
-static ScrDyn *scr_native_iterator_next(ScrNativeIterator *iterator) {
+/* Produce an owned value without allocating the protocol result. The
+ * compiler uses this only after checking the captured next function; public
+ * next() calls still receive a fresh, independently mutable result object. */
+static ScrDyn *scr_native_iterator_value(ScrNativeIterator *iterator, bool *done_out) {
   ScrDyn *source = iterator->source;
-  if (source && iterator->kind == 4) {
-    ScrDyn *result = scr_dyn_handle_ops_of(source)->iter_step(source->v.handle.ptr, &iterator->index, iterator->selection);
-    if (!result) return NULL;
-    if (scr_dyn_truthy(scr_dyn_obj_get(result, "done", 4))) {
-      iterator->source = NULL;
-      scr_dyn_release(source);
-    }
-    return result;
-  }
+  /* An inherited indexed getter can advance this same iterator recursively.
+   * Keep the source alive even if that nested call exhausts the iterator. */
+  if (source) scr_dyn_retain(source);
   /* Native array capsules retain the live array, so refresh its view at each
    * step rather than iterating a snapshot taken when the iterator opened. */
   ScrDyn *view = source && source->kind == SCR_DYN_TYPED_REF ? scr_dyn_typed_ref_materialize(source) : NULL;
-  if (scr_exc_pending()) { scr_dyn_release(view); return NULL; }
+  if (scr_exc_pending()) { scr_dyn_release(view); scr_dyn_release(source); return NULL; }
   ScrDyn *items = view ? view : source;
   ScrMap *map = source && (iterator->kind == 2 || iterator->kind == 3) ? source->v.handle.ptr : NULL;
   if (map) while (iterator->index < scr_map_iter_count(map) && !scr_map_iter_live(map, iterator->index)) iterator->index++;
@@ -3131,6 +3472,24 @@ static ScrDyn *scr_native_iterator_next(ScrNativeIterator *iterator) {
     scr_str_release(point);
   }
   scr_dyn_release(view);
+  scr_dyn_release(source);
+  *done_out = done;
+  return value;
+}
+
+static ScrDyn *scr_native_iterator_next(ScrNativeIterator *iterator) {
+  ScrDyn *source = iterator->source;
+  if (source && iterator->kind == 4) {
+    ScrDyn *result = scr_dyn_handle_ops_of(source)->iter_step(source->v.handle.ptr, &iterator->index, iterator->selection);
+    if (!result) return NULL;
+    if (scr_dyn_truthy(scr_dyn_obj_get(result, "done", 4))) {
+      iterator->source = NULL;
+      scr_dyn_release(source);
+    }
+    return result;
+  }
+  bool done;
+  ScrDyn *value = scr_native_iterator_value(iterator, &done);
   if (!value) return NULL;
   ScrDyn *result = scr_dyn_new_obj();
   scr_dyn_obj_set(result, "value", 5, value);
@@ -3180,6 +3539,28 @@ static ScrDyn *scr_native_handle_iterator_next_call(ScrClosure *closure, ScrDyn
   return scr_native_iterator_next_checked(4);
 }
 
+bool scr_dyn_iterator_can_step(const ScrDyn *iterator, const ScrDyn *next) {
+  if (iterator->kind != SCR_DYN_HANDLE || iterator->v.handle.tag != SCR_DYNH_ITERATOR) return false;
+  unsigned kind = ((ScrNativeIterator *)iterator->v.handle.ptr)->kind;
+  if (kind > 3) return false;
+  size_t index = kind == 3 ? 8 : kind == 2 ? 7 : kind == 1 ? 5 : 0;
+  return next == scr_iterator_functions[index];
+}
+
+ScrDyn *scr_dyn_iterator_step(const ScrDyn *value) {
+  ScrNativeIterator *iterator = value->v.handle.ptr;
+  bool done = false;
+  ScrDyn *item = scr_native_iterator_value(iterator, &done);
+  /* Publish after getters finish, so recursive steps cannot overwrite this
+   * step's completion. No user code runs between step and step_done. */
+  iterator->step_done = done;
+  return item;
+}
+
+bool scr_dyn_iterator_step_done(const ScrDyn *value) {
+  return ((ScrNativeIterator *)value->v.handle.ptr)->step_done;
+}
+
 static ScrDyn *scr_native_iterator_get(void *ptr, const char *key, size_t len) {
   if (len != 4 || memcmp(key, "next", 4)) return NULL;
   unsigned kind = ((ScrNativeIterator *)ptr)->kind;
@@ -3945,7 +4326,7 @@ ScrStr *scr_dyn_object_tag(const ScrDyn *d) {
   case SCR_DYN_OBJ: tag = "[object Object]"; break;
   case SCR_DYN_HANDLE:
     if ((d->v.handle.tag >= SCR_DYNH_ABORT_SIGNAL &&
-         d->v.handle.tag <= SCR_DYNH_ABORT_CONTROLLER) || d->v.handle.tag == SCR_DYNH_ARRAY_BUFFER ||
+         d->v.handle.tag <= SCR_DYNH_ABORT_CONTROLLER) || d->v.handle.tag == SCR_DYNH_ARRAY_BUFFER || d->v.handle.tag == SCR_DYNH_SHARED_ARRAY_BUFFER ||
         d->v.handle.tag == SCR_DYNH_WEAK_MAP || d->v.handle.tag == SCR_DYNH_WEAK_SET ||
         d->v.handle.tag == SCR_DYNH_SET || d->v.handle.tag == SCR_DYNH_MAP || d->v.handle.tag == SCR_DYNH_REGEXP ||
         d->v.handle.tag == SCR_DYNH_DATE) {
@@ -4438,7 +4819,7 @@ ScrStr *scr_dyn_to_string(const ScrDyn *d, const ScrStr *enc) {
       return out;
     }
     if ((d->v.handle.tag >= SCR_DYNH_ABORT_SIGNAL &&
-         d->v.handle.tag <= SCR_DYNH_ABORT_CONTROLLER) || d->v.handle.tag == SCR_DYNH_ARRAY_BUFFER || d->v.handle.tag == SCR_DYNH_SET || d->v.handle.tag == SCR_DYNH_MAP) {
+         d->v.handle.tag <= SCR_DYNH_ABORT_CONTROLLER) || d->v.handle.tag == SCR_DYNH_ARRAY_BUFFER || d->v.handle.tag == SCR_DYNH_SHARED_ARRAY_BUFFER || d->v.handle.tag == SCR_DYNH_SET || d->v.handle.tag == SCR_DYNH_MAP) {
       ScrJsonBuf b;
       scr_jb_init(&b);
       scr_jb_puts(&b, "[object ");
@@ -5483,10 +5864,7 @@ void scr_jb_put_dyn(ScrJsonBuf *b, const ScrDyn *d) {
       if (e->value->kind == SCR_DYN_JSVAL && scr_dyn_isl_typeof_is(e->value, "function")) continue; /* engine functions drop too */
       if (!first) scr_jb_putc(b, ',');
       first = false;
-      /* Keys escape exactly like string values (put_json_str quotes). */
-      ScrStr *k = scr_str_new(e->key, e->key_len);
-      scr_jb_put_json_str(b, k);
-      scr_str_release(k);
+      scr_jb_put_json_span(b, e->key, e->key_len);
       scr_jb_putc(b, ':');
       scr_jb_put_dyn(b, e->value);
     }
@@ -5647,8 +6025,10 @@ static int32_t scr_json_hex4(ScrJsonP *p) {
  * slow path would produce) and returns -1. */
 static int scr_json_string_span(ScrJsonP *p, const char **span,
                                  size_t *span_len) {
-  size_t i = p->pos + 1;
-  while (i < p->len) {
+  *span = p->s + p->pos + 1;
+  *span_len = scr_json_plain_bytes(*span, p->len - p->pos - 1);
+  size_t i = p->pos + 1 + *span_len;
+  if (i < p->len) {
     unsigned char c = (unsigned char)p->s[i];
     if (c == '"') {
       *span = p->s + p->pos + 1;
@@ -5661,7 +6041,6 @@ static int scr_json_string_span(ScrJsonP *p, const char **span,
       scr_json_throw_pos("Bad control character in string literal", i);
       return -1;
     }
-    i++;
   }
   scr_json_throw_pos("Unterminated string", p->pos);
   return -1;
@@ -5669,11 +6048,13 @@ static int scr_json_string_span(ScrJsonP *p, const char **span,
 
 /* Slow path: parses the string literal at p->pos (the opening quote),
  * decoding escapes, into a +1 ScrStr. NULL on error (thrown). */
-static ScrStr *scr_json_string_slow(ScrJsonP *p) {
+static ScrStr *scr_json_string_slow(ScrJsonP *p, size_t prefix) {
   size_t open = p->pos;
   p->pos++; /* opening quote */
   ScrJsonBuf b;
   scr_jb_init(&b);
+  scr_jb_write(&b, p->s + p->pos, prefix);
+  p->pos += prefix;
   for (;;) {
     if (p->pos >= p->len) {
       scr_jb_dispose(&b);
@@ -5691,8 +6072,9 @@ static ScrStr *scr_json_string_slow(ScrJsonP *p) {
       return NULL;
     }
     if (c != '\\') {
-      scr_jb_putc(&b, (char)c); /* raw UTF-8 passes through */
-      p->pos++;
+      size_t run = scr_json_plain_bytes(p->s + p->pos, p->len - p->pos);
+      scr_jb_write(&b, p->s + p->pos, run);
+      p->pos += run;
       continue;
     }
     p->pos++; /* backslash */
@@ -5767,7 +6149,7 @@ static ScrStr *scr_json_string_scr(ScrJsonP *p) {
   int r = scr_json_string_span(p, &span, &span_len);
   if (r < 0) return NULL;
   if (r > 0) return scr_str_new(span, span_len);
-  return scr_json_string_slow(p);
+  return scr_json_string_slow(p, span_len);
 }
 
 static ScrDyn *scr_json_value(ScrJsonP *p);
@@ -5846,20 +6228,17 @@ static ScrDyn *scr_json_number(ScrJsonP *p) {
     }
     exp10 += eneg ? -ev : ev;
   }
-  ScrDyn *d = scr_dyn_alloc(SCR_DYN_NUM);
   if (precise && exp10 >= -22 && exp10 <= 22) {
     double v = (double)mant; /* exact: mant < 10^15 < 2^53 */
     if (exp10 > 0) v *= scr_json_pow10[exp10];
     else if (exp10 < 0) v /= scr_json_pow10[-exp10];
-    d->v.num = neg ? -v : v;
-    return d;
+    return scr_dyn_new_num(neg ? -v : v);
   }
   /* The validated span re-parses with strtod (correctly rounded, and the
    * grammar above is a strict subset of what strtod accepts). The ScrStr
    * data is NUL-terminated, and strtod stops at the first non-number char,
    * so parsing from `start` reads exactly the validated token. */
-  d->v.num = strtod(p->s + start, NULL);
-  return d;
+  return scr_dyn_new_num(strtod(p->s + start, NULL));
 }
 
 static bool scr_json_lit(ScrJsonP *p, const char *word, size_t n) {
@@ -5926,10 +6305,12 @@ static ScrDyn *scr_json_object(ScrJsonP *p) {
       scr_json_throw_pos("Expected property name or '}'", p->pos);
       return NULL;
     }
-    /* Key: fast span path (no escapes) copies straight into the malloc'd
-     * key buffer; the slow path decodes into a ScrStr first. */
+    /* Keep the key borrowed until insertion determines whether it already
+     * exists or can reuse a recycled slot. Escaped keys own their decoded
+     * string until the value has been parsed and inserted. */
     size_t key_len = 0;
-    char *key;
+    const char *key;
+    ScrStr *decoded_key = NULL;
     {
       const char *span;
       size_t span_len;
@@ -5939,27 +6320,21 @@ static ScrDyn *scr_json_object(ScrJsonP *p) {
         return NULL;
       }
       if (r > 0) {
-        key = malloc(span_len + 1);
-        if (!key) scr_json_oom();
-        memcpy(key, span, span_len);
-        key[span_len] = '\0';
+        key = span;
         key_len = span_len;
       } else {
-        ScrStr *ks = scr_json_string_slow(p);
-        if (!ks) {
+        decoded_key = scr_json_string_slow(p, span_len);
+        if (!decoded_key) {
           scr_dyn_release(obj);
           return NULL;
         }
-        key = malloc(ks->len + 1);
-        if (!key) scr_json_oom();
-        memcpy(key, ks->data, ks->len + 1);
-        key_len = ks->len;
-        scr_str_release(ks);
+        key = decoded_key->data;
+        key_len = decoded_key->len;
       }
     }
     scr_json_ws(p);
     if (p->pos >= p->len || p->s[p->pos] != ':') {
-      free(key);
+      scr_str_release(decoded_key);
       scr_dyn_release(obj);
       if (p->pos >= p->len) scr_json_throw("Unexpected end of JSON input");
       else scr_json_throw_pos("Expected ':' after property name", p->pos);
@@ -5968,11 +6343,12 @@ static ScrDyn *scr_json_object(ScrJsonP *p) {
     p->pos++; /* ':' */
     ScrDyn *value = scr_json_value(p);
     if (!value) {
-      free(key);
+      scr_str_release(decoded_key);
       scr_dyn_release(obj);
       return NULL;
     }
     scr_dyn_obj_put(obj, key, key_len, value); /* later duplicate keys win */
+    scr_str_release(decoded_key);
     scr_json_ws(p);
     if (p->pos >= p->len) {
       scr_dyn_release(obj);
@@ -6121,7 +6497,12 @@ static void scr_json_delete_member(ScrDyn *object, const ScrStr *key) {
     ScrDynEntry removed = *entry;
     memmove(entry, entry + 1, (object->v.obj.len - i - 1) * sizeof *entry);
     object->v.obj.len--;
-    free(removed.key);
+    free(object->v.obj.index);
+    object->v.obj.index = NULL;
+    /* The moved tail aliases a live entry; spare slots own only their own
+     * retained key bytes, never a second pointer to a surviving property. */
+    memset(&object->v.obj.entries[object->v.obj.len], 0, sizeof *entry);
+    scr_dyn_key_release(removed.key, removed.key_len);
     scr_dyn_release(removed.value);
     scr_dyn_release(removed.getter);
     scr_dyn_release(removed.setter);
@@ -6324,8 +6705,71 @@ static bool scr_json_omitted(const ScrDyn *value) {
 
 static void scr_json_gap(ScrJsonBuf *buffer, const ScrStr *gap, size_t depth) {
   if (!gap->len) return;
-  scr_jb_putc(buffer, '\n');
-  for (size_t i = 0; i < depth; i++) scr_jb_write(buffer, gap->data, gap->len);
+  const char *end = memchr(gap->data, 0, gap->len);
+  size_t length = end ? (size_t)(end - gap->data) : gap->len;
+  scr_jb_indent(buffer, gap->data, length, depth);
+}
+
+/* These primitive values cannot invoke toJSON or mutate a containing frame.
+ * BigInts, functions and every reference kind keep the protocol walk. */
+static bool scr_json_plain_value(const ScrDyn *value) {
+  switch (value->kind) {
+  case SCR_DYN_NULL: case SCR_DYN_UNDEF: case SCR_DYN_SYMBOL:
+  case SCR_DYN_BOOL: case SCR_DYN_NUM: case SCR_DYN_STR: return true;
+  default: return false;
+  }
+}
+
+/* Prove the whole immediate container before writing any of it. Without a
+ * replacer or executable children, entries cannot change and borrowed names
+ * need neither a key snapshot nor repeated lookups. Numeric property names
+ * keep the ordinary sorted-key walk; sparse/accessor arrays keep Get. This
+ * proof is repeated per call, so later mutations never leave a stale fact. */
+static bool scr_json_plain_container(const ScrDyn *value) {
+  if (value->kind == SCR_DYN_ARR) {
+    if (value->v.arr.presence || value->v.arr.properties) return false;
+    for (size_t i = 0; i < value->v.arr.len; i++)
+      if (!scr_json_plain_value(value->v.arr.items[i])) return false;
+    return true;
+  }
+  if (value->kind != SCR_DYN_OBJ) return false;
+  for (size_t i = 0; i < value->v.obj.len; i++) {
+    const ScrDynEntry *entry = &value->v.obj.entries[i];
+    if (!entry->enumerable) continue;
+    double index;
+    if (entry->accessor || !scr_json_plain_value(entry->value) ||
+        scr_dyn_key_is_index(entry->key, entry->key_len, &index)) return false;
+  }
+  return true;
+}
+
+static bool scr_json_plain_write(ScrJsonBuf *buffer, const ScrDyn *value,
+                                 const ScrStr *gap, size_t depth) {
+  bool array = value->kind == SCR_DYN_ARR;
+  size_t length = array ? value->v.arr.len : value->v.obj.len;
+  scr_jb_putc(buffer, array ? '[' : '{');
+  bool first = true;
+  for (size_t i = 0; i < length; i++) {
+    const ScrDynEntry *entry = array ? NULL : &value->v.obj.entries[i];
+    if (entry && !entry->enumerable) continue;
+    const ScrDyn *child = array ? value->v.arr.items[i] : entry->value;
+    bool omitted = scr_json_omitted(child);
+    if (!array && omitted) continue;
+    if (!omitted && !scr_json_callback_depth(depth + 1)) return false;
+    if (!first) scr_jb_putc(buffer, ',');
+    first = false;
+    scr_json_gap(buffer, gap, depth + 1);
+    if (entry) {
+      scr_jb_put_json_span(buffer, entry->key, entry->key_len);
+      scr_jb_putc(buffer, ':');
+      if (gap->len) scr_jb_putc(buffer, ' ');
+    }
+    if (omitted) scr_jb_puts(buffer, "null");
+    else scr_dyn_json_write(buffer, child);
+  }
+  if (!first) scr_json_gap(buffer, gap, depth);
+  scr_jb_putc(buffer, array ? ']' : '}');
+  return true;
 }
 
 static bool scr_json_replaced_write(ScrJsonBuf *buffer, const ScrDyn *value,
@@ -6334,6 +6778,8 @@ static bool scr_json_replaced_write(ScrJsonBuf *buffer, const ScrDyn *value,
   ScrDyn *view = value->kind == SCR_DYN_TYPED_REF ? scr_dyn_typed_ref_materialize(value) : NULL;
   const ScrDyn *observed = view ? view : value;
   if (scr_exc_pending()) { scr_dyn_release(view); return false; }
+  if (!view && replacer->kind == SCR_DYN_UNDEF && scr_json_plain_container(value))
+    return scr_json_plain_write(buffer, value, gap, depth);
   if (observed->kind != SCR_DYN_OBJ && observed->kind != SCR_DYN_ARR && observed->kind != SCR_DYN_BYTES) {
     /* Engine objects need an engine callback bridge, not an opaque JSON
      * splice: that would silently skip all their children. */
@@ -6824,9 +7270,8 @@ static ScrDyn *scr_dyn_obj_read_receiver(const ScrDyn *d, const char *key, size_
       continue;
     }
     if (current->kind != SCR_DYN_OBJ) continue;
-    for (size_t i = 0; i < current->v.obj.len; i++) {
-      ScrDynEntry *entry = &current->v.obj.entries[i];
-      if (entry->key_len != key_len || memcmp(entry->key, key, key_len) != 0) continue;
+    ScrDynEntry *entry = scr_dyn_find_entry(current, key, key_len);
+    if (entry) {
       if (!entry->accessor) return scr_dyn_retain(entry->value);
       if (!entry->getter) return scr_dyn_retain(scr_dyn_undefined());
       ScrDyn *getter = scr_dyn_retain(entry->getter);
@@ -7094,15 +7539,9 @@ bool scr_dyn_reflect_set(ScrDyn *target, ScrDyn *raw_key, ScrDyn *value, ScrDyn
 
 /* The array-index test (ECMA: a canonical numeric string < 2^32-1). */
 static bool scr_dyn_key_is_index(const char *key, size_t len, double *out) {
-  if (len == 0 || len > 10) return false;
-  if (key[0] == '0' && len > 1) return false;
-  double v = 0;
-  for (size_t i = 0; i < len; i++) {
-    if (key[i] < '0' || key[i] > '9') return false;
-    v = v * 10 + (key[i] - '0');
-  }
-  if (v > 4294967294.0) return false;
-  *out = v;
+  uint32_t index;
+  if (!scr_key_array_index(key, len, &index)) return false;
+  *out = index;
   return true;
 }
 
@@ -7120,34 +7559,31 @@ static ScrDyn *scr_dyn_objwalk_key(const char *key, size_t key_len) {
 ScrDyn *scr_dyn_obj_own_keys(const ScrDyn *v) {
   size_t n = v->v.obj.len;
   ScrDyn *keys = scr_dyn_new_arr();
-  bool *is_index = malloc(n ? n * sizeof *is_index : 1);
-  double *idx = malloc(n ? n * sizeof *idx : 1);
-  if (!is_index || !idx) scr_trap("scriptc: out of memory\n");
-  size_t index_count = 0;
+  ScrKeyIndex *indices = NULL;
+  size_t count = 0;
   for (size_t i = 0; i < n; i++) {
-    const ScrDynEntry *e = &v->v.obj.entries[i];
-    is_index[i] = scr_dyn_key_is_index(e->key, e->key_len, &idx[i]);
-    if (is_index[i]) index_count++;
-  }
-  double last = -1;
-  for (size_t done = 0; done < index_count; done++) {
-    size_t best = (size_t)-1;
-    for (size_t i = 0; i < n; i++) {
-      if (!is_index[i] || idx[i] <= last) continue;
-      if (best == (size_t)-1 || idx[i] < idx[best]) best = i;
-    }
-    if (best == (size_t)-1) break;
-    last = idx[best];
-    scr_dyn_arr_push(keys, scr_dyn_objwalk_key(v->v.obj.entries[best].key,
-                                                v->v.obj.entries[best].key_len));
-  }
+    const ScrDynEntry *entry = &v->v.obj.entries[i];
+    uint32_t index;
+    if (!scr_key_array_index(entry->key, entry->key_len, &index)) continue;
+    if (!indices) {
+      if (n > SIZE_MAX / sizeof *indices) scr_json_oom();
+      indices = malloc(n * sizeof *indices);
+      if (!indices) scr_json_oom();
+    }
+    indices[count++] = (ScrKeyIndex){index, i};
+  }
+  scr_key_index_sort(indices, count);
+  for (size_t i = 0; i < count; i++) {
+    const ScrDynEntry *entry = &v->v.obj.entries[indices[i].entry];
+    scr_dyn_arr_push(keys, scr_dyn_objwalk_key(entry->key, entry->key_len));
+  }
+  free(indices);
   for (size_t i = 0; i < n; i++) {
-    if (is_index[i]) continue;
-    scr_dyn_arr_push(keys, scr_dyn_objwalk_key(v->v.obj.entries[i].key,
-                                                v->v.obj.entries[i].key_len));
+    const ScrDynEntry *entry = &v->v.obj.entries[i];
+    uint32_t index;
+    if (!scr_key_array_index(entry->key, entry->key_len, &index))
+      scr_dyn_arr_push(keys, scr_dyn_objwalk_key(entry->key, entry->key_len));
   }
-  free(is_index);
-  free(idx);
   return keys;
 }
 
@@ -8310,6 +8746,14 @@ bool scr_array_buffer_is(const ScrDyn *value) {
   return value->kind == SCR_DYN_HANDLE && value->v.handle.tag == SCR_DYNH_ARRAY_BUFFER;
 }
 
+bool scr_shared_array_buffer_is(const ScrDyn *value) {
+  return value->kind == SCR_DYN_HANDLE && value->v.handle.tag == SCR_DYNH_SHARED_ARRAY_BUFFER;
+}
+
+bool scr_buffer_storage_is(const ScrDyn *value) {
+  return scr_array_buffer_is(value) || scr_shared_array_buffer_is(value);
+}
+
 bool scr_array_buffer_is_view(const ScrDyn *value) {
   return value->kind == SCR_DYN_BYTES;
 }
@@ -8318,8 +8762,9 @@ static ScrDyn *scr_array_buffer_get(void *h, const char *key, size_t len) {
   if ((len == 10 && memcmp(key, "byteLength", len) == 0) ||
       (len == 13 && memcmp(key, "maxByteLength", len) == 0))
     return scr_dyn_new_num(scr_bytes_byte_len(h));
-  if ((len == 9 && memcmp(key, "resizable", len) == 0) ||
-      (len == 8 && memcmp(key, "detached", len) == 0)) return scr_dyn_new_bool(false);
+  if (len == 8 && !memcmp(key, "growable", len) && ((ScrBytes *)h)->shared) return scr_dyn_new_bool(false);
+  if (!((ScrBytes *)h)->shared && ((len == 9 && memcmp(key, "resizable", len) == 0) ||
+      (len == 8 && memcmp(key, "detached", len) == 0))) return scr_dyn_new_bool(false);
   return NULL;
 }
 
@@ -8338,6 +8783,7 @@ static ScrDyn *scr_array_buffer_invoke(void *h, ScrDyn *self, const char *method
     ScrBytes *view = scr_bytes_buffer_view(h, SCR_BYTES_U8, 0, false, 0);
     if (!view) return NULL;
     ScrBytes *copy = scr_bytes_slice(view, start, end);
+    if (((ScrBytes *)h)->shared) scr_bytes_make_shared(copy);
     scr_bytes_release(view);
     ScrDyn *result = scr_array_buffer_from_bytes(copy);
     scr_bytes_release(copy);
@@ -8353,8 +8799,13 @@ ScrDyn *scr_array_buffer_from_bytes(ScrBytes *view) {
     "ArrayBuffer", &scr_bytes_retain_v, &scr_bytes_release_v,
     &scr_array_buffer_invoke, &scr_array_buffer_get, &scr_array_buffer_set, NULL,
   };
-  scr_dyn_handle_install(SCR_DYNH_ARRAY_BUFFER, &ops);
-  return scr_dyn_new_handle(view->backing ? view->backing : view, SCR_DYNH_ARRAY_BUFFER);
+  static const ScrDynHandleOps shared_ops = {
+    "SharedArrayBuffer", &scr_bytes_retain_v, &scr_bytes_release_v,
+    &scr_array_buffer_invoke, &scr_array_buffer_get, &scr_array_buffer_set, NULL,
+  };
+  ScrDynHandleTag tag = view->shared ? SCR_DYNH_SHARED_ARRAY_BUFFER : SCR_DYNH_ARRAY_BUFFER;
+  scr_dyn_handle_install(tag, view->shared ? &shared_ops : &ops);
+  return scr_dyn_new_handle(view->backing ? view->backing : view, tag);
 }
 
 static ScrDyn *scr_ffi_fail(const char *message) {
@@ -8385,7 +8836,8 @@ ScrDyn *scr_ffi_argument(ScrDyn *value, ScrStr *type) {
     void *address = NULL;
     bool converted = value->kind == SCR_DYN_NULL || value->kind == SCR_DYN_UNDEF;
     ScrBytes *bytes = value->kind == SCR_DYN_BYTES ? value->v.bytes :
-      scr_array_buffer_is(value) ? value->v.handle.ptr : NULL;
+      scr_buffer_storage_is(value) ? value->v.handle.ptr : NULL;
+    if (bytes && bytes->shared) return scr_ffi_fail("Shared byte storage cannot expose an unmanaged native pointer");
     if (bytes) { address = bytes->data; converted = true; }
     if (value->kind == SCR_DYN_STR) {
       if (memchr(value->v.str->data, 0, value->v.str->len)) {
@@ -8635,6 +9087,7 @@ static ScrDyn *scr_ffi_memory_call(ScrClosure *closure, ScrDyn *const *args, siz
       scr_dyn_arg_type_fail("source", "an ArrayBuffer or ArrayBufferView", value);
       return NULL;
     }
+    if (bytes->shared) return scr_ffi_fail("Shared byte storage cannot expose an unmanaged native pointer");
     ScrBigInt *pointer = scr_bigint_from_pointer(bytes->data);
     ScrDyn *result = scr_dyn_new_bigint(pointer);
     scr_bigint_release(pointer);
@@ -8822,7 +9275,7 @@ static int scr_weak_key(const ScrDyn *key, void **ptr, unsigned *kind) {
     *ptr = key->v.fn.class_obj ? (void *)key->v.fn.class_obj : (void *)key->v.fn.clo;
     *kind = key->v.fn.class_obj ? 3 : 2; return 1;
   case SCR_DYN_HANDLE:
-    if (key->v.handle.tag != SCR_DYNH_ARRAY_BUFFER && key->v.handle.tag != SCR_DYNH_WEAK_MAP &&
+    if (key->v.handle.tag != SCR_DYNH_ARRAY_BUFFER && key->v.handle.tag != SCR_DYNH_SHARED_ARRAY_BUFFER && key->v.handle.tag != SCR_DYNH_WEAK_MAP &&
         key->v.handle.tag != SCR_DYNH_WEAK_SET && key->v.handle.tag != SCR_DYNH_STDIO &&
         key->v.handle.tag != SCR_DYNH_FETCH_REQUEST && key->v.handle.tag != SCR_DYNH_FETCH_RESPONSE &&
         key->v.handle.tag != SCR_DYNH_MAP && key->v.handle.tag != SCR_DYNH_SET) return -1;
@@ -9053,6 +9506,16 @@ ScrDyn *scr_array_buffer_new(ScrDyn *length) {
   return result;
 }
 
+ScrDyn *scr_shared_array_buffer_new(ScrDyn *length) {
+  ScrDyn *buffer = scr_array_buffer_new(length);
+  if (!buffer) return NULL;
+  ScrBytes *storage = buffer->v.handle.ptr;
+  scr_bytes_make_shared(storage);
+  ScrDyn *result = scr_array_buffer_from_bytes(storage);
+  scr_dyn_release(buffer);
+  return result;
+}
+
 double scr_array_buffer_byte_length_getter(void) {
   ScrDyn *receiver = scr_dyn_this_get();
   if (!scr_array_buffer_is(receiver)) {
@@ -9079,7 +9542,7 @@ ScrDyn *scr_array_buffer_byte_length_descriptor(ScrDyn *getter) {
 
 ScrBytes *scr_array_buffer_view(ScrBytesElem elem, const ScrDyn *buffer,
     const ScrDyn *offset, const ScrDyn *length) {
-  if (!scr_array_buffer_is(buffer)) {
+  if (!scr_buffer_storage_is(buffer)) {
     // Non-buffer inputs use the length/iterable/array-like constructor.
     // Their extra arguments are evaluated by the caller, but not coerced.
     return scr_bytes_from_dyn(elem, buffer, false);
@@ -9114,7 +9577,7 @@ SCR_ARRAY_BUFFER_VIEW(f64, SCR_BYTES_F64)
 #undef SCR_ARRAY_BUFFER_VIEW
 
 ScrBytes *scr_array_buffer_view_dv(ScrDyn *buffer, ScrDyn *offset, ScrDyn *length) {
-  if (!scr_array_buffer_is(buffer)) {
+  if (!scr_buffer_storage_is(buffer)) {
     static const char msg[] = "First argument to DataView constructor must be an ArrayBuffer";
     scr_throw_error_msg(SCR_ERR_TYPE, msg, sizeof msg - 1);
     return NULL;