@scriptc/compiler 0.2.7 → 0.2.8

package/dist/ir/int32-slots.js

@@ -0,0 +1,837 @@
+import { analyzeIntegerRanges, INT32_RANGE, withinInt32, } from "./integer-ranges.js";
+import { findInitializerBindings, withInitializerBindings } from "./initializer-bindings.js";
+import { everyExprChild, everyStmtChild, everyTypeChild } from "./traverse.js";
+/** Whole-program int32 specialization of numeric storage.
+ *
+ * A class field typed `number` whose every write provably stores an int32
+ * (never -0, never NaN, never a fraction or an out-of-range integer) can be
+ * stored as an i32: reading it back as a double is exact, so every program
+ * observation is unchanged. The same proof seeds parameters of functions
+ * that are only ever called directly (every call site passes an int32) and
+ * results of functions whose every return is an int32. Parameter and result
+ * ABIs stay double; only the facts reach the callee and the call sites.
+ *
+ * The analysis is optimistic: every candidate slot starts as int32, each
+ * function is analyzed by analyzeIntegerRanges under the current facts, and
+ * any write the analysis cannot prove disqualifies its slot. Functions that
+ * read a disqualified slot are analyzed again, until no write fails. At the
+ * fixpoint every assumption was proven against every write.
+ *
+ * Writes the IR does not show disqualify a slot up front. Instances that
+ * reach checked-dynamic code get live views whose runtime stores commit
+ * back into the fields; a field of such a class stays a double when any
+ * dynamic store in the program can name it (literal-keyed stores name one
+ * property, every other store any property, islands everything). Classes
+ * with runtime-provided ancestors, generic families, fields under
+ * `++`/`--`, and parameters of functions that escape as values, are
+ * constructed through class values, or are virtual-dispatch targets are
+ * excluded as well. Library builds keep ordinary storage: their instances
+ * cross a native boundary. Worker builds do not: instances reach another
+ * thread only through postMessage/workerData, whose dyn views read (and
+ * commit) fields like every other dynamic reader. Reads are never
+ * restricted: every reader (static code, dyn views, JSON, inspect) widens
+ * the i32 exactly. */
+export class Int32Slots {
+    classes;
+    /** Field families (topmost declaring class and field) stored as i32. */
+    fields = new Set();
+    familyOf = new Map();
+    paramFacts = new Map();
+    returns = new Set();
+    /** Captured-binding groups (one shared box) that hold an int32, and the
+     * group of each `function\0local` member. */
+    boxes = new Set();
+    boxGroupOf = new Map();
+    /** Field write values proven int32 by the final analysis. */
+    provenWrites = new Set();
+    /** Disqualified candidates and the first reason, for tests. */
+    reasons = new Map();
+    constructor(classes = new Map()) {
+        this.classes = classes;
+    }
+    /** The family key of a class field: the topmost class in the base chain
+     * that declares a field of that name (all subclasses share its slot). */
+    family(className, field) {
+        const key = `${className}\0${field}`;
+        const cached = this.familyOf.get(key);
+        if (cached !== undefined)
+            return cached;
+        let owner = this.classes.get(className);
+        let result = null;
+        if (owner?.fields.some((f) => f.name === field)) {
+            for (;;) {
+                const base = owner.base ? this.classes.get(owner.base) : undefined;
+                if (!base?.fields.some((f) => f.name === field))
+                    break;
+                owner = base;
+            }
+            result = `${owner.name}\0${field}`;
+        }
+        this.familyOf.set(key, result);
+        return result;
+    }
+    isField(className, field) {
+        if (this.fields.size === 0)
+            return false;
+        const family = this.family(className, field);
+        return family !== null && this.fields.has(family);
+    }
+    /** The facts analyzeIntegerRanges may assume inside one function. */
+    facts(fnName) {
+        if (this.fields.size === 0 &&
+            this.returns.size === 0 &&
+            this.paramFacts.size === 0 &&
+            this.boxes.size === 0)
+            return {};
+        const result = {
+            field: (className, field) => (this.isField(className, field) ? INT32_RANGE : null),
+            call: (callee) => (this.returns.has(callee) ? INT32_RANGE : null),
+            boxed: (localId) => (this.hasBox(this.boxGroup(fnName, localId)) ? INT32_RANGE : null),
+        };
+        const params = this.paramFacts.get(fnName);
+        if (params)
+            result.params = params;
+        return result;
+    }
+    boxGroup(fnName, localId) {
+        return this.boxGroupOf.get(`${fnName}\0${localId}`) ?? null;
+    }
+    /* ── construction (analyzeInt32Slots only) ── */
+    addBox(group, members) {
+        this.boxes.add(group);
+        for (const member of members)
+            this.boxGroupOf.set(member, group);
+    }
+    dropBox(group) {
+        return this.boxes.delete(group);
+    }
+    hasBox(group) {
+        return group !== null && this.boxes.has(group);
+    }
+    addField(family) {
+        this.fields.add(family);
+    }
+    dropField(family) {
+        return this.fields.delete(family);
+    }
+    hasFamily(family) {
+        return this.fields.has(family);
+    }
+    addParam(fnName, localId) {
+        let params = this.paramFacts.get(fnName);
+        if (!params)
+            this.paramFacts.set(fnName, (params = new Map()));
+        params.set(localId, INT32_RANGE);
+    }
+    dropParam(fnName, localId) {
+        const params = this.paramFacts.get(fnName);
+        if (!params?.delete(localId))
+            return false;
+        if (params.size === 0)
+            this.paramFacts.delete(fnName);
+        return true;
+    }
+    hasParam(fnName, localId) {
+        return this.paramFacts.get(fnName)?.has(localId) ?? false;
+    }
+    addReturn(fnName) {
+        this.returns.add(fnName);
+    }
+    dropReturn(fnName) {
+        return this.returns.delete(fnName);
+    }
+    hasReturn(fnName) {
+        return this.returns.has(fnName);
+    }
+    get fieldCount() {
+        return this.fields.size;
+    }
+    get returnCount() {
+        return this.returns.size;
+    }
+    get paramCount() {
+        let count = 0;
+        for (const params of this.paramFacts.values())
+            count += params.size;
+        return count;
+    }
+}
+const DYN_KINDS = new Set(["dyn", "jsval", "caught"]);
+/** Expressions that hand their operands (or produce results) to runtime
+ * helpers, reflection, promises or other code the IR does not show. */
+const BOUNDARY_KINDS = new Set([
+    "libCall",
+    "intrinsic",
+    "jsonStringify",
+    "ffiCall",
+    "jsOp",
+    "jsExit",
+    "jsBridgePromise",
+    "jsMarshal",
+    "dynCall",
+    "dynInvoke",
+    "dynFrom",
+    "dynFromJsval",
+    "dynCheck",
+    "dynObjLit",
+    "dynArrLit",
+    "caughtToDyn",
+    "caughtNarrow",
+    "caughtCheck",
+]);
+/** Runtime helpers that receive dynamic values but never store a property
+ * into a live class capsule (verified against the runtime's call graph:
+ * none of them reaches scr_dyn_typed_ref_commit with a caller-supplied
+ * target). Any other helper that receives a dynamic value may store any
+ * property, except literal-keyed `dyn.keySet`/`dyn.keyDelete`. */
+const DYN_READ_ONLY = new Set([
+    "arrayBuffer.new",
+    "arrayBuffer.viewF32",
+    "arrayBuffer.viewF64",
+    "arrayBuffer.viewI16",
+    "arrayBuffer.viewI32",
+    "arrayBuffer.viewI8",
+    "arrayBuffer.viewU16",
+    "arrayBuffer.viewU32",
+    "arrayBuffer.viewU8",
+    "arrayBuffer.viewU8C",
+    "date.nativeNew",
+    "dyn.arrAt",
+    "dyn.arrLen",
+    "dyn.bagGet",
+    "dyn.compare",
+    "dyn.hasKey",
+    "dyn.iterator",
+    "dyn.iteratorCanStep",
+    "dyn.iteratorResult",
+    "dyn.iteratorStep",
+    "dyn.iteratorStepDone",
+    "dyn.mapSeedEntries",
+    "dyn.mapSeedEntry",
+    "dyn.numberConstructor",
+    "dyn.packPush",
+    "dyn.packPushSpread",
+    "dyn.stringConstructor",
+    "dyn.this",
+    "dyn.toStringCoerce",
+    "dyn.typedRefIs",
+    "error.new",
+    "error.newOptions",
+    "fs.utimesSync",
+    "json.stringifyReplacer",
+    "json.stringifyValue",
+    "num.toStringRadix",
+    "sharedArrayBuffer.new",
+    "text.decodeStream",
+    "worker.new",
+]);
+const ISLAND_KINDS = new Set([
+    "jsOp",
+    "jsMarshal",
+    "jsExit",
+    "jsBridgePromise",
+    "dynFromJsval",
+]);
+/** IR metadata keys whose strings never name a function. */
+const NON_REFERENCE_KEYS = new Set([
+    "loc",
+    "source",
+    "name",
+    "sourceName",
+    "jsName",
+    "localId",
+    "type",
+    "returnType",
+]);
+function walkFunction(fn, visit) {
+    const expr = (e) => {
+        visit.expr?.(e);
+        return everyExprChild(e, expr, stmt);
+    };
+    const stmt = (s) => {
+        visit.stmt?.(s);
+        return everyStmtChild(s, expr, stmt);
+    };
+    for (const s of fn.body)
+        stmt(s);
+}
+export function analyzeInt32Slots(mod) {
+    const classes = new Map((mod.classes ?? []).map((c) => [c.name, c]));
+    const slots = new Int32Slots(classes);
+    if (mod.lib)
+        return slots;
+    const reason = (key, why) => {
+        if (!slots.reasons.has(key))
+            slots.reasons.set(key, why);
+    };
+    /* ── candidate fields ── */
+    const children = new Map();
+    for (const cls of classes.values())
+        if (cls.base) {
+            const list = children.get(cls.base);
+            if (list)
+                list.push(cls.name);
+            else
+                children.set(cls.base, [cls.name]);
+        }
+    const subtree = (name) => {
+        const out = [];
+        const stack = [name];
+        while (stack.length) {
+            const next = stack.pop();
+            out.push(next);
+            for (const child of children.get(next) ?? [])
+                stack.push(child);
+        }
+        return out;
+    };
+    const genericFamilies = new Set();
+    for (const cls of classes.values())
+        if (cls.genericOf !== undefined) {
+            genericFamilies.add(cls.name);
+            genericFamilies.add(cls.genericOf);
+        }
+    const plainClass = (cls) => {
+        for (let c = cls; c; c = c.base ? classes.get(c.base) : undefined) {
+            if (c.runtime || genericFamilies.has(c.name))
+                return false;
+            if (c.base && !classes.has(c.base))
+                return false;
+        }
+        return true;
+    };
+    const dropFamily = (family, why) => {
+        reason(`field:${family}`, why);
+        slots.dropField(family);
+    };
+    for (const cls of classes.values())
+        for (const field of cls.fields) {
+            if (field.type.kind !== "f64" || field.name.startsWith("%"))
+                continue;
+            const family = slots.family(cls.name, field.name);
+            if (plainClass(cls)) {
+                if (!slots.reasons.has(`field:${family}`))
+                    slots.addField(family);
+            }
+            else
+                dropFamily(family, "runtime-provided or generic class");
+        }
+    /* ── dynamic, reflective and runtime exposure ── */
+    const records = new Map((mod.records ?? []).map((r) => [r.id, r]));
+    const unions = new Map((mod.unions ?? []).map((u) => [u.id, u]));
+    const exposedClasses = new Set();
+    const seenNamed = new Set();
+    let exposeAll = false;
+    const expose = (type) => {
+        if (exposeAll)
+            return;
+        switch (type.kind) {
+            case "object":
+            case "classval":
+                // A live dyn view of an instance materializes its fields as live
+                // views in turn: everything reachable from an exposed class is exposed.
+                for (const name of subtree(type.className)) {
+                    if (exposedClasses.has(name))
+                        continue;
+                    exposedClasses.add(name);
+                    for (const field of classes.get(name)?.fields ?? [])
+                        expose(field.type);
+                }
+                return;
+            case "moduleNs":
+                exposeAll = true;
+                return;
+            case "record": {
+                if (seenNamed.has(`r:${type.shapeId}`))
+                    return;
+                seenNamed.add(`r:${type.shapeId}`);
+                const shape = records.get(type.shapeId);
+                for (const field of shape?.fields ?? [])
+                    expose(field.type);
+                if (shape?.indexValue)
+                    expose(shape.indexValue);
+                return;
+            }
+            case "union": {
+                if (seenNamed.has(`u:${type.unionId}`))
+                    return;
+                seenNamed.add(`u:${type.unionId}`);
+                for (const arm of unions.get(type.unionId)?.arms ?? [])
+                    expose(arm);
+                return;
+            }
+            default:
+                everyTypeChild(type, (child) => {
+                    expose(child);
+                    return true;
+                });
+        }
+    };
+    // A live dyn view (typed-ref capsule) of an instance writes back into
+    // its fields only after a runtime store into the capsule; the commit then
+    // writes every field from the view, which holds the exact snapshot value
+    // of any property no store named. So reaching dynamic code disqualifies
+    // exactly the field names some dynamic store in the program can name.
+    const dynTypes = new Map();
+    const dynNamed = new Map();
+    const dynish = (type) => {
+        if (DYN_KINDS.has(type.kind))
+            return true;
+        const cached = dynTypes.get(type);
+        if (cached !== undefined)
+            return cached;
+        let result = false;
+        const named = type.kind === "record"
+            ? `r:${type.shapeId}`
+            : type.kind === "union"
+                ? `u:${type.unionId}`
+                : null;
+        if (named) {
+            const known = dynNamed.get(named);
+            if (known !== undefined)
+                return known;
+            dynNamed.set(named, false);
+            const members = type.kind === "record"
+                ? [
+                    ...(records.get(type.shapeId)?.fields.map((f) => f.type) ?? []),
+                    ...(records.get(type.shapeId)?.indexValue
+                        ? [records.get(type.shapeId).indexValue]
+                        : []),
+                ]
+                : type.kind === "union"
+                    ? (unions.get(type.unionId)?.arms ?? [])
+                    : [];
+            result = members.some(dynish);
+            dynNamed.set(named, result);
+        }
+        else
+            everyTypeChild(type, (child) => !(result = dynish(child)));
+        dynTypes.set(type, result);
+        return result;
+    };
+    const dynWritten = new Set();
+    let dynWritesAll = false;
+    for (const fn of mod.functions)
+        walkFunction(fn, {
+            expr: (e) => {
+                if (dynWritesAll)
+                    return;
+                if (ISLAND_KINDS.has(e.kind) || e.type.kind === "jsval")
+                    dynWritesAll = true;
+                else if (e.kind === "libCall" &&
+                    !DYN_READ_ONLY.has(e.fn) &&
+                    e.args.some((a) => dynish(a.type))) {
+                    const key = e.args[1];
+                    if ((e.fn === "dyn.keySet" || e.fn === "dyn.keyDelete") && key?.kind === "strLit")
+                        dynWritten.add(key.value);
+                    else
+                        dynWritesAll = true;
+                }
+            },
+        });
+    for (const fn of mod.functions)
+        walkFunction(fn, {
+            expr: (e) => {
+                const dynResult = DYN_KINDS.has(e.type.kind);
+                const boundary = BOUNDARY_KINDS.has(e.kind);
+                let dynChild = false;
+                everyExprChild(e, (child) => {
+                    const dyn = DYN_KINDS.has(child.type.kind);
+                    dynChild ||= dyn;
+                    if (boundary || (dynResult && !dyn))
+                        expose(child.type);
+                    return true;
+                }, () => true);
+                // Error helpers construct runtime errors or always throw: their
+                // class-typed result is an Error instance or an unreachable dummy.
+                const errorHelper = e.kind === "libCall" && e.fn.startsWith("error.");
+                if ((boundary && !errorHelper) || (dynChild && !dynResult))
+                    expose(e.type);
+            },
+            stmt: (s) => {
+                if (s.kind === "throw")
+                    expose(s.value.type);
+            },
+        });
+    for (const cls of classes.values()) {
+        if (!exposeAll && !exposedClasses.has(cls.name))
+            continue;
+        for (const field of cls.fields)
+            if (field.type.kind === "f64" &&
+                !field.name.startsWith("%") &&
+                (dynWritesAll || dynWritten.has(field.name)))
+                dropFamily(slots.family(cls.name, field.name), "dynamic stores can name the field");
+    }
+    /* ── functions: escapes, parameter and return candidates ── */
+    const functions = new Map(mod.functions.map((fn) => [fn.name, fn]));
+    const escaped = new Set();
+    const seenObjects = new Set();
+    const scan = (value, key, parent) => {
+        if (typeof value === "string") {
+            if (functions.has(value)) {
+                const direct = key === "callee" && parent?.kind === "call"
+                    ? true
+                    : key === "value" && parent?.kind === "strLit";
+                if (!direct)
+                    escaped.add(value);
+            }
+            return;
+        }
+        if (value === null || typeof value !== "object" || seenObjects.has(value))
+            return;
+        seenObjects.add(value);
+        if (Array.isArray(value)) {
+            for (const item of value)
+                scan(item, null, null);
+            return;
+        }
+        const record = value;
+        for (const [k, v] of Object.entries(record))
+            if (!NON_REFERENCE_KEYS.has(k))
+                scan(v, k, record);
+    };
+    scan(mod, null, null);
+    if (typeof mod.entry === "string")
+        escaped.add(mod.entry);
+    // Virtual dispatch: a `virtualCall` can reach the method's implementation
+    // in any class of the receiver's subtree or the one it inherits. Classes
+    // under a runtime-provided root keep every method escaped: the runtime
+    // calls their vtable entries directly.
+    const runtimeRooted = (name) => {
+        for (let c = classes.get(name); c; c = c.base ? classes.get(c.base) : undefined)
+            if (c.runtime || (c.base && !classes.has(c.base)))
+                return true;
+        return false;
+    };
+    const runtimePrefixes = [];
+    for (const cls of classes.values())
+        if (runtimeRooted(cls.name))
+            runtimePrefixes.push(`%${cls.name}.`);
+    for (const fn of mod.functions)
+        walkFunction(fn, {
+            expr: (e) => {
+                if (e.kind !== "virtualCall")
+                    return;
+                for (const name of subtree(e.className))
+                    escaped.add(`%${name}.${e.method}`);
+                for (let c = classes.get(e.className); c; c = c.base ? classes.get(c.base) : undefined)
+                    escaped.add(`%${c.name}.${e.method}`);
+            },
+        });
+    // A class value can reach `new` through its construct thunk; one that
+    // only feeds an instanceof interval check cannot.
+    const testedOnly = new Set();
+    for (const fn of mod.functions) {
+        // Direct operands, and unboxed locals bound once to a class reference
+        // and read only as instanceof operands (the lowering's temporary).
+        const bound = new Map();
+        const reads = new Map();
+        const tests = new Map();
+        const writes = new Map();
+        const count = (map, id) => {
+            map.set(id, (map.get(id) ?? 0) + 1);
+        };
+        walkFunction(fn, {
+            expr: (e) => {
+                if (e.kind === "instanceOfValue") {
+                    if (e.classValue.kind === "classRef")
+                        testedOnly.add(e.classValue);
+                    else if (e.classValue.kind === "varRef")
+                        count(tests, e.classValue.localId);
+                }
+                else if (e.kind === "varRef")
+                    count(reads, e.localId);
+                else if (e.kind === "assignExpr" || e.kind === "incDec")
+                    count(writes, e.localId);
+            },
+            stmt: (s) => {
+                if (s.kind === "varDecl" && s.init?.kind === "classRef")
+                    bound.set(s.localId, s.init);
+                if (s.kind === "assign" || s.kind === "forOf" || s.kind === "varDecl")
+                    count(writes, s.localId);
+            },
+        });
+        const boxed = new Set(fn.locals.filter((l) => l.boxed).map((l) => l.id));
+        for (const [id, ref] of bound)
+            if (!boxed.has(id) && writes.get(id) === 1 && reads.get(id) === tests.get(id))
+                testedOnly.add(ref);
+    }
+    for (const fn of mod.functions)
+        walkFunction(fn, {
+            expr: (e) => {
+                if (e.kind === "classRef" && !testedOnly.has(e))
+                    escaped.add(`%${e.className}.constructor`);
+            },
+        });
+    const virtual = (name) => runtimePrefixes.some((prefix) => name.startsWith(prefix));
+    const paramKey = (fnName, localId) => `param:${fnName}\0${localId}`;
+    const dropParam = (fnName, localId, why) => {
+        reason(paramKey(fnName, localId), why);
+        return slots.dropParam(fnName, localId);
+    };
+    const dropAllParams = (fn, why) => {
+        for (const param of fn.params)
+            dropParam(fn.name, param.localId, why);
+    };
+    // Only functions some IR call reaches directly get parameter facts: one
+    // the backend invokes by convention has no call site to prove against.
+    const called = new Set();
+    for (const fn of mod.functions)
+        walkFunction(fn, {
+            expr: (e) => {
+                if (e.kind === "call")
+                    called.add(e.callee);
+                else if (e.kind === "new")
+                    called.add(`%${e.className}.constructor`);
+            },
+        });
+    for (const fn of mod.functions) {
+        if (fn.returnType.kind === "f64" && !fn.async && !fn.generator)
+            slots.addReturn(fn.name);
+        if (fn.async ||
+            fn.generator ||
+            !called.has(fn.name) ||
+            escaped.has(fn.name) ||
+            virtual(fn.name))
+            continue;
+        for (const param of fn.params)
+            if (param.type.kind === "f64")
+                slots.addParam(fn.name, param.localId);
+    }
+    const arityChecked = (fn, args, offset) => {
+        if (fn && fn.params.length !== args + offset)
+            dropAllParams(fn, "call arity differs");
+    };
+    for (const fn of mod.functions)
+        walkFunction(fn, {
+            expr: (e) => {
+                if (e.kind === "call")
+                    arityChecked(functions.get(e.callee), e.args.length, 0);
+                else if (e.kind === "new")
+                    arityChecked(functions.get(`%${e.className}.constructor`), e.args.length, 1);
+            },
+        });
+    /* ── captured bindings ── */
+    // A captured local lives in one box shared by its declaring function and
+    // every closure that captures it (closure.captures[i] is the lifted
+    // function's captures[i]). The box holds an int32 when every write to it
+    // anywhere is proven and it starts from a proven parameter or an
+    // initialized declaration. Class-captured bindings stay unknown.
+    const boxParent = new Map();
+    const boxRoot = (key) => {
+        let root = key;
+        while (boxParent.has(root))
+            root = boxParent.get(root);
+        if (root !== key)
+            boxParent.set(key, root);
+        return root;
+    };
+    const boxKey = (fnName, localId) => `${fnName}\0${localId}`;
+    const boxMembers = new Set();
+    const unstableBoxes = new Set();
+    for (const fn of mod.functions) {
+        for (const local of fn.locals)
+            if (local.boxed) {
+                const key = boxKey(fn.name, local.id);
+                boxMembers.add(key);
+                if (local.type.kind !== "f64" || local.tdz)
+                    unstableBoxes.add(key);
+            }
+        for (const capture of fn.classCaptures ?? [])
+            unstableBoxes.add(boxKey(fn.name, capture.localId));
+        walkFunction(fn, {
+            expr: (e) => {
+                if (e.kind === "closure") {
+                    const lifted = functions.get(e.fnName);
+                    e.captures.forEach((id, i) => {
+                        const inner = lifted?.captures?.[i];
+                        const outer = boxKey(fn.name, id);
+                        if (!inner)
+                            unstableBoxes.add(outer);
+                        else {
+                            const a = boxRoot(outer), b = boxRoot(boxKey(lifted.name, inner.localId));
+                            if (a !== b)
+                                boxParent.set(a, b);
+                        }
+                    });
+                }
+                else if (e.kind === "classRef")
+                    for (const id of e.captures ?? [])
+                        unstableBoxes.add(boxKey(fn.name, id));
+                else if (e.kind === "incDec")
+                    unstableBoxes.add(boxKey(fn.name, e.localId));
+            },
+            stmt: (s) => {
+                if (s.kind === "forOf")
+                    unstableBoxes.add(boxKey(fn.name, s.localId));
+                if (s.kind === "tryCatch" && s.catchLocalId)
+                    unstableBoxes.add(boxKey(fn.name, s.catchLocalId));
+            },
+        });
+    }
+    const groups = new Map();
+    for (const key of boxMembers) {
+        const root = boxRoot(key);
+        const list = groups.get(root);
+        if (list)
+            list.push(key);
+        else
+            groups.set(root, [key]);
+    }
+    const boxOrigin = new Map();
+    for (const [group, members] of groups) {
+        if (members.some((key) => unstableBoxes.has(key)))
+            continue;
+        // The origin is the one member that is not a capture of its function.
+        const origins = members.filter((key) => {
+            const [fnName, localId] = key.split("\0");
+            return !functions.get(fnName)?.captures?.some((c) => c.localId === localId);
+        });
+        if (origins.length !== 1)
+            continue;
+        const [fnName, localId] = origins[0].split("\0");
+        const origin = functions.get(fnName);
+        if (origin.params.some((p) => p.localId === localId)) {
+            if (!slots.hasParam(fnName, localId))
+                continue;
+        }
+        else {
+            let initialized = false;
+            walkFunction(origin, {
+                stmt: (s) => {
+                    if (s.kind === "varDecl" && s.localId === localId && s.init)
+                        initialized = true;
+                },
+            });
+            if (!initialized)
+                continue;
+        }
+        boxOrigin.set(`param:${fnName}\0${localId}`, group);
+        slots.addBox(group, members);
+    }
+    const dropBox = (group, why) => {
+        if (group === null)
+            return false;
+        reason(`box:${group}`, why);
+        return slots.dropBox(group);
+    };
+    /* ── readers: which functions depend on which slot facts ── */
+    const readers = new Map();
+    const reads = (slot, fnName) => {
+        const set = readers.get(slot);
+        if (set)
+            set.add(fnName);
+        else
+            readers.set(slot, new Set([fnName]));
+    };
+    for (const fn of mod.functions)
+        walkFunction(fn, {
+            expr: (e) => {
+                if (e.kind === "fieldGet") {
+                    const family = slots.family(e.className, e.field);
+                    if (family)
+                        reads(`field:${family}`, fn.name);
+                }
+                else if (e.kind === "call")
+                    reads(`ret:${e.callee}`, fn.name);
+                else if (e.kind === "varRef") {
+                    const group = slots.boxGroup(fn.name, e.localId);
+                    if (group !== null)
+                        reads(`box:${group}`, fn.name);
+                }
+                else if (e.kind === "fieldIncDec") {
+                    const family = slots.family(e.className, e.field);
+                    if (family)
+                        dropFamily(family, "++/-- on the field");
+                }
+            },
+        });
+    /* ── the optimistic fixpoint ── */
+    const bindings = findInitializerBindings(mod);
+    const numeric = (fn) => withInitializerBindings(fn, bindings.get(fn.name) ?? []);
+    const queue = mod.functions.map((fn) => fn.name);
+    const queued = new Set(queue);
+    const invalidate = (slot) => {
+        const dependents = readers.get(slot);
+        if (dependents)
+            for (const fnName of dependents)
+                if (!queued.has(fnName)) {
+                    queued.add(fnName);
+                    queue.push(fnName);
+                }
+    };
+    const provenByFunction = new Map();
+    while (queue.length) {
+        const fn = functions.get(queue.pop());
+        queued.delete(fn.name);
+        const params = slots.facts(fn.name).params;
+        if (params)
+            for (const id of params.keys())
+                reads(`param:${fn.name}\0${id}`, fn.name);
+        const ranges = analyzeIntegerRanges(numeric(fn), slots.facts(fn.name));
+        const proven = [];
+        const int32 = (e) => withinInt32(ranges.get(e));
+        const args = (callee, list, offset) => {
+            if (!callee)
+                return;
+            list.forEach((arg, i) => {
+                const param = callee.params[i + offset];
+                if (!param || !slots.hasParam(callee.name, param.localId) || int32(arg))
+                    return;
+                const slot = `param:${callee.name}\0${param.localId}`;
+                if (dropParam(callee.name, param.localId, `argument in ${fn.name} is not int32`))
+                    invalidate(slot);
+                const group = boxOrigin.get(slot) ?? null;
+                if (dropBox(group, `parameter ${param.localId} is not int32`))
+                    invalidate(`box:${group}`);
+            });
+        };
+        const boxWrite = (localId, value) => {
+            const group = slots.boxGroup(fn.name, localId);
+            if (!slots.hasBox(group) || int32(value))
+                return;
+            if (dropBox(group, `write in ${fn.name} is not int32`))
+                invalidate(`box:${group}`);
+        };
+        walkFunction(fn, {
+            stmt: (s) => {
+                if (s.kind === "assign")
+                    boxWrite(s.localId, s.value);
+                else if (s.kind === "varDecl" && s.init)
+                    boxWrite(s.localId, s.init);
+                if (s.kind === "fieldSet") {
+                    const family = slots.family(s.className, s.field);
+                    if (!family || !slots.hasFamily(family))
+                        return;
+                    if (int32(s.value))
+                        proven.push(s.value);
+                    else {
+                        dropFamily(family, `write in ${fn.name} is not int32`);
+                        invalidate(`field:${family}`);
+                    }
+                }
+                else if (s.kind === "return" && slots.hasReturn(fn.name)) {
+                    if (s.value && int32(s.value))
+                        return;
+                    reason(`ret:${fn.name}`, "return is not int32");
+                    slots.dropReturn(fn.name);
+                    invalidate(`ret:${fn.name}`);
+                }
+            },
+            expr: (e) => {
+                if (e.kind === "call")
+                    args(functions.get(e.callee), e.args, 0);
+                else if (e.kind === "new")
+                    args(functions.get(`%${e.className}.constructor`), e.args, 1);
+                else if (e.kind === "assignExpr")
+                    boxWrite(e.localId, e.value);
+            },
+        });
+        provenByFunction.set(fn.name, proven);
+    }
+    for (const proven of provenByFunction.values())
+        for (const value of proven)
+            slots.provenWrites.add(value);
+    return slots;
+}
+//# sourceMappingURL=int32-slots.js.map