@scriptc/compiler 0.3.4 → 0.3.6

package/dist/backend/llvm/emitter.js

@@ -6,13 +6,14 @@ import { CYC_BUF, CYC_HDR, FIRST_EMITTED_CYC_KIND, inlineAllocSupported } from "
 import { hasLoneSurrogate, llvmBytes as llBytes, wtf8Bytes } from "../literals.js";
 import { InternalCompilerError } from "../../errors.js";
 import { createHash } from "node:crypto";
-import { endsWithJump, matchStringSelfConcat, streamTypedRefEligible, undefinedArmTag, } from "../../ir/analysis.js";
+import { endsWithJump, matchFieldSelfConcat, matchStringSelfConcat, readsArraySlot, streamTypedRefEligible, undefinedArmTag, } from "../../ir/analysis.js";
 import { emitLibraryIdentityLines } from "../library-identity-markers.js";
 import { loopTestsEveryIteration } from "../loop-polls.js";
 import { CAUGHT, ffiCallbackType, isDynTypedRefType, isFfiContextParam, isRefCounted, isUnitType, POINTER_KINDS, RUNTIME_EMITTER_CLASS, RUNTIME_EVENT_CLASS, RUNTIME_EVENT_TARGET_CLASS, RUNTIME_ERROR_CLASSES, RUNTIME_STREAM_CLASSES, typeEquals, typeKey, STRING, VOID, } from "../../ir/ir.js";
 import { moduleRuntimeFeatures } from "../../ir/runtime-features.js";
 import { matchIntegerArrayForLoop, matchIntegerBytesForLoop, matchIntegerCountedForLoop, } from "../../ir/integer-loops.js";
 import { emitCountedLoopLimit } from "./counted-loops.js";
+import { emitSafeIntegerCheck, emitSpeculativeInteger, planSpeculativeLoop, speculativeReads, speculativeWriteTarget, SPECULATIVE_RANGE, } from "./speculative-integers.js";
 import { emitLiteralSwitch } from "./switch-dispatch.js";
 import { findBytesBounds } from "./bytes-bounds.js";
 import { emitByteWindowGuard, findInitializedByteLoopBindings, matchByteWindow, } from "./byte-windows.js";
@@ -21,16 +22,21 @@ import { scalarizeNumericRecords } from "../../ir/scalar-records.js";
 import { RESULT_ENTRY_PREFIX, addRecordResultEntries } from "./record-results.js";
 import { specializeNumericCalls } from "../../ir/numeric-call-specialization.js";
 import { everyExpr, everyExprChild, everyStmtChild, everyStmtList } from "../../ir/traverse.js";
-import { analyzeIntegerRanges, INT32_RANGE } from "../../ir/integer-ranges.js";
+import { analyzeIntegerRanges, INT32_RANGE, } from "../../ir/integer-ranges.js";
 import { unshareNodes } from "../../ir/unshare.js";
-import { analyzeInt32Slots } from "../../ir/int32-slots.js";
+import { copyStableCaptures } from "../../ir/capture-values.js";
+import { analyzeInt32Slots, dynamicFieldStores } from "../../ir/int32-slots.js";
 import { analyzeFinalFields, constructorClass } from "../../ir/final-fields.js";
 import { foldConstantGlobals } from "../../ir/constant-globals.js";
+import { dropUnwrittenPropertyBags } from "../../ir/property-bags.js";
+import { freezeInitOnlyGlobals } from "../../ir/init-only-globals.js";
+import { hoistFinalFieldReads } from "../../ir/field-values.js";
 import { findIntegerViews } from "./integer-views.js";
 import { findInt32Abis, INT32_ABI_SUFFIX, SCALAR_UNION_DUMMY, SCALAR_UNION_RESULT, } from "./int32-abi.js";
 import { findInt32Locals } from "./int32-locals.js";
+import { emitIntegerClone, emitIntegerDispatcher, findIntegerClones, NO_INTEGER_CLONES, } from "./integer-clones.js";
 import { exactInteger, narrowInteger } from "./integer-values.js";
-import { findInitializerBindings, withInitializerBindings } from "../../ir/initializer-bindings.js";
+import { conditionalLoopWrites, findInitializerBindings, initializerLocalCandidates, withInitializerBindings, withInitializerLocals, } from "../../ir/initializer-bindings.js";
 import { findConstantNumericTables } from "../../ir/constant-tables.js";
 import { allocateFfiCallbackAdapters, hasForeignFfiCallback, hasRetainedFfiCallback, } from "../ffi-callbacks.js";
 import { RUNTIME_ABI_MARKER } from "../runtime-abi.js";
@@ -45,8 +51,9 @@ import { NullableRefFields } from "./nullable-fields.js";
 import { InlineUnionFields, loadInlineUnion, presentBits, stackUnionBox, storeInlineUnion, unionBoxBits, } from "./inline-unions.js";
 import { emitLocalArrayRead, emitProjectedArrayRead, emitBorrowedArrayRead, findLocalArrayReads, findCallArrayReads, OptionalArrayReads, } from "./local-array-reads.js";
 import { CheckedNarrows, emitCheckedNarrowReceiver } from "./checked-narrows.js";
-import { emitDenseArrayGet, emitDenseArraySet } from "./dense-array-access.js";
+import { emitDenseArrayGet, emitDenseArraySet, emitDenseSlotUnlink } from "./dense-array-access.js";
 import { emitStackMapRead, findMapReadLifetimes, findReadNumberMapWrites, matchMapRead, } from "./map-read-lifetimes.js";
+import { findMapEntryFusions } from "./map-entry-fusion.js";
 import { emitBorrowedFieldSequence, guardedValue } from "./borrowed-receivers.js";
 import { borrowableInputs, emitBorrowedInput, emitBorrowedInputs } from "./borrowed-inputs.js";
 import { analyzeWalks, findWalkBorrows } from "./walk-borrows.js";
@@ -72,7 +79,7 @@ import { PublishWalkers } from "./publish.js";
 import { computeImmutableFields, stableGlobals } from "../immutability.js";
 import { computePublishedTypes } from "../publication.js";
 import { emitExpr } from "./expr-dispatch.js";
-import { dynKind, raceAdapterFor, genResultThunkFor, childExitThunkFor, childExitSignalThunkFor, childDataThunkFor, execFileThunkFor, ipcMessageThunkFor, ipcSendThunkFor, emitterFixedAdapter, wrapEmitterListener, unwrapNullableClosure, closeBindThunkFor, closeOverrideWrapFor, } from "./expr-callbacks.js";
+import { dynKind, raceAdapterFor, genResultThunkFor, childExitThunkFor, childExitSignalThunkFor, childDataThunkFor, execFileThunkFor, ipcMessageThunkFor, ipcSendThunkFor, emitterFixedAdapter, emitterOnceAdapter, wrapEmitterListener, unwrapNullableClosure, closeBindThunkFor, closeOverrideWrapFor, } from "./expr-callbacks.js";
 import { streamDataAdapter, streamDoneFnFor, cryptoBytesThunkFor, cryptoIntThunkFor, fsRenameThunkFor, streamCbThunkFor, zlibBytesThunkFor, } from "./expr-stream-callbacks.js";
 import { emitStableReceiver, resolveThunkFor, tagInSet, arrPush, emitArrayCopyLoop, emitStrIntrinsic, emitArrIntrinsic, emitDiscardedSplice, wrapNullable, emitMapNew, mapSet, emitMapLikeIntrinsic, emitSetNew, } from "./expr-containers.js";
 import { emitIntegerLoopIndex, emitBytesIndex, emitBytesData, emitBytesLength, emitBytesGet, emitToUint32, emitBytesSet, emitBytesIntrinsic, } from "./expr-bytes.js";
@@ -95,7 +102,7 @@ import { literalCapWord, literalCapWord32 } from "./string-key-hash.js";
 import { MAP_ITER_DECL, NUMBER_MAP_ENTRY_DECL, STRING_MAP_ENTRY_DECL, } from "./map-number-lookup.js";
 import { STRING_READ_HELPERS, stringScanDecl } from "./string-reads.js";
 import { emitConcatInputs, emitMixedConcat, numberPart, stringParts, } from "./string-construction.js";
-import { arrNewCall, boxAccess, boxNewCall, boxReleaseSym, computeTraced, elemAccess, emitInlineRcHelpers, emitNullableRetainWrappers, FN_ATTRS, inlineRcDecls, limitInlineDynReleases, llFieldType, releaseSym, retainSym, traceArg, typedRefConstructor, vAdapters, } from "./shapes.js";
+import { arrNewCall, boxAccess, boxNewCall, boxReleaseSym, computeTraced, elemAccess, emitInlineRcHelpers, emitNullableRetainWrappers, FN_ATTRS, inlineRcDecls, limitInlineDynReleases, llFieldType, mapFlagsOffset, releaseSym, retainSym, traceArg, typedRefConstructor, vAdapters, } from "./shapes.js";
 import { INLINE_LITERAL_BYTES, literalEqualityDefinition } from "./string-literal-equality.js";
 export { LlvmUnsupportedError } from "./unsupported.js";
 function ffiCallbackDummyLl(callback) {
@@ -129,14 +136,14 @@ export function emitLlvmModule(input, options = {}) {
     const mod = unshareNodes(input);
     // Keep source storage intact for debugger inspection in dev builds.
     return new LlEmitter(options.debugSources === undefined
-        ? addRecordResultEntries(scalarizeNumericRecords(specializeNumericCalls(foldConstantGlobals(mod), mangleFunction)))
+        ? addRecordResultEntries(scalarizeNumericRecords(specializeNumericCalls(foldConstantGlobals(copyStableCaptures(hoistFinalFieldReads(freezeInitOnlyGlobals(dropUnwrittenPropertyBags(mod))))), mangleFunction)))
         : mod, options).emit();
 }
 /** Keep large translation units below the host's single-string limit. */
 export function emitLlvmModuleSource(input, options = {}) {
     const mod = unshareNodes(input);
     const parts = new LlEmitter(options.debugSources === undefined
-        ? addRecordResultEntries(scalarizeNumericRecords(specializeNumericCalls(foldConstantGlobals(mod), mangleFunction)))
+        ? addRecordResultEntries(scalarizeNumericRecords(specializeNumericCalls(foldConstantGlobals(copyStableCaptures(hoistFinalFieldReads(freezeInitOnlyGlobals(dropUnwrittenPropertyBags(mod))))), mangleFunction)))
         : mod, options).emitParts();
     const length = parts.reduce((total, part) => total + part.length, Math.max(0, parts.length - 1));
     if (length <= 256 * 1024 * 1024)
@@ -147,6 +154,9 @@ function llStrBytes(text) {
     return llBytes(wtf8Bytes(text));
 }
 const NO_BORROWED = new Set();
+/** ScrExcKind tags of a generator slot holding a number or a boolean. */
+const SCR_EXC_F64 = 1;
+const SCR_EXC_BOOL = 2;
 /** Whether any node of `e` names the local (reads, writes, declarations,
  * captures). */
 function mentionsLocal(e, localId) {
@@ -226,6 +236,12 @@ export class LlEmitter {
         }
         return `, !tbaa !${tag}`;
     }
+    /** The `!range` attachment of an array length load: a length is at most
+     * 2^32 - 1 (the runtime's SCR_ARR_MAX_LENGTH), so conversions to double
+     * and back fold. 32-bit targets load the full range anyway. */
+    get arrayLengthRange() {
+        return this.sizeType === "i64" ? ", !range !{i64 0, i64 4294967296}" : "";
+    }
     fieldAliasAttachment(ptr) {
         const tag = this.fieldPointerTags.get(ptr);
         return tag === undefined ? "" : `, !tbaa !${tag}`;
@@ -312,6 +328,8 @@ export class LlEmitter {
     /** Interned NUL-terminated C-string constants (scr_jb_puts labels, the
      * stringify indent text): UTF-8 text → { symbol, byte length }. */
     cstrs = new Map();
+    /** Interned ScrMapOps descriptors (scr_map.h): initializer → symbol. */
+    mapOpsConsts = new Map();
     /** Type-directed walker functions (JSON serializers, the indent
      * rewriter, union ToString/join) — interned per typeKey/unionId, defs
      * flushed with the shape helpers. */
@@ -355,6 +373,8 @@ export class LlEmitter {
     callArrayReads = new Map();
     mapReadLifetimes = { locals: new Map(), arguments: new Map() };
     readNumberMapWrites = new Set();
+    /** The current function's fused string-key Map get-then-set pairs (map-entry-fusion.ts). */
+    mapEntryFusion = null;
     callLifetimes;
     constantCallbacks;
     currentConstantCallbacks = new Map();
@@ -402,6 +422,9 @@ export class LlEmitter {
     stableGlobals = new Set();
     tdzGlobals = new Map();
     constantNumericTables;
+    /** Constant-key reads on checked-dynamic objects, each with its own
+     * zero-initialized ScrDynReadIc (scr_runtime.h). */
+    dynReadIcSites = 0;
     /** May-throw analysis (computeMayThrow): pending
      * checks are emitted only after calls that can actually raise. */
     mayThrow;
@@ -518,8 +541,20 @@ export class LlEmitter {
     initializerBindings;
     /** Whole-program int32 storage and parameter/result facts. */
     int32Slots;
+    /** The program has no runtime store into a checked-dynamic value
+     * (dynamicFieldStores), so live views of classes and records never
+     * commit back into their objects. Library builds keep their commits:
+     * their values cross a native boundary. */
+    liveViewsReadOnly;
     /** Functions whose direct calls use i32 parameters or results. */
     int32Abis;
+    /** Pure number functions with speculative integer clones. */
+    integerClones;
+    /** The IR function being emitted. */
+    currentFunctionName = "";
+    integerParamRange(fnName, localId) {
+        return this.int32Slots.facts(fnName).params?.get(localId) ?? null;
+    }
     /** Immutable module constants (contract types) whose graphs become
      * immortal once initialized: their reads need no reference counting. */
     immortalGlobals;
@@ -531,6 +566,17 @@ export class LlEmitter {
     /** Active induction bindings retain their width independently of size_t. */
     integerLoopBindings = new Map();
     countedLoopsEnabled = false;
+    /** Speculative integer loops (speculative-integers.ts) run in this function. */
+    speculativeLoopsEnabled = false;
+    /** The fast copy of a speculative integer loop being emitted: its
+     * integer-computed writes and where each resumes in the ordinary copy. */
+    speculation = null;
+    /** The ordinary copy being emitted: resume labels still to place. */
+    speculationResume = null;
+    /** The function being emitted, for speculative globals. */
+    speculativeFunction = "";
+    /** Every function that writes each number global (computed on demand). */
+    globalWriters = null;
     /** Whole-program final reference fields (ir/final-fields.ts). */
     finalFields;
     /** The current function may borrow final fields of borrowable objects:
@@ -543,6 +589,9 @@ export class LlEmitter {
     byteWindowEntries = new Map();
     bytesBounds = new Set();
     integerViews = new Map();
+    /** Module globals the current function owns outright (initializer
+     * bindings): their function-local slot, which stands in for the global. */
+    privateGlobalSlots = new Map();
     /** Number locals of the current function stored only as an i32
      * (int32-locals.ts); their slots are `alloca i32`. */
     int32Locals = new Map();
@@ -576,6 +625,9 @@ export class LlEmitter {
      * switched-coroutine intrinsics (wasm32 async bodies and generators,
      * native synchronous generators; see coroLowered). */
     currentCoro = null;
+    /** Inline generator slot accesses need the %ScrGenHead/%ScrGenSlot
+     * mirrors in the module header. */
+    usesGenSlots = false;
     /** The generator channels of the function being emitted (null outside
      * generator bodies): yieldExpr emission reads them, and emitTryCatch's
      * catch prologue emits the GENRET sentinel re-unwind exactly here. */
@@ -600,6 +652,9 @@ export class LlEmitter {
         this.constantNumericTables = findConstantNumericTables(mod);
         this.initializerBindings = findInitializerBindings(mod);
         this.int32Slots = analyzeInt32Slots(mod);
+        const dynamicStores = dynamicFieldStores(mod);
+        this.liveViewsReadOnly =
+            mod.lib === undefined && !dynamicStores.all && dynamicStores.names.size === 0;
         this.int32Abis = this.debug === null ? findInt32Abis(mod, this.int32Slots) : new Map();
         this.immortalGlobals = new Set(mod.contracts?.immortalGlobals ?? []);
         this.programLifetime = new Set(mod.contracts?.programLifetime ?? []);
@@ -743,6 +798,20 @@ export class LlEmitter {
             return shape !== undefined && !recordDynKeepsIdentity(shape);
         });
         this.constantCallbacks = findConstantCallbacks(mod, this.callLifetimes);
+        // Integer clones signal a stack overflow through their result, which
+        // needs the single-threaded guard; worker programs also poll for
+        // termination, and debug builds and stack traces keep every frame.
+        // Clones read number arrays their function borrows (64-bit layouts).
+        this.integerClones =
+            this.debug === null &&
+                this.stackChecks !== null &&
+                mod.workers !== true &&
+                mod.lib === undefined &&
+                !this.stackTraces
+                ? findIntegerClones(mod, this.sizeType === "i64"
+                    ? (fn, index) => this.callLifetimes.borrowed.get(fn)?.has(index) === true
+                    : undefined)
+                : NO_INTEGER_CLONES;
         this.stackCallbacks = new StackCallbacks(this.fnByName);
         this.receiverReaders = new AmbientReceiverReaders(this.fnByName);
         this.stackCaptures = new StackCaptures(this.fnByName, this.callLifetimes, this.stackCallbacks);
@@ -780,6 +849,7 @@ export class LlEmitter {
             needBadTag: () => this.needBadTag(),
             internLiteral: (text) => this.internLiteral(text),
             cstr: (text) => this.cstr(text),
+            mapOps: (operands) => this.mapOps(operands),
             unitInstanceRef: (unionId, tag) => this.unitInstanceRef(unionId, tag),
             retypeGuardRef: (unionId) => this.retypeGuardRef(unionId),
             fieldAbsentTestIn: (B, value, unionId) => this.fieldAbsentTestIn(B, value, unionId),
@@ -880,6 +950,10 @@ export class LlEmitter {
     virtualSlotBorrowed(rootName, slotIndex) {
         return this.virtualBorrows.slot(rootName, slotIndex);
     }
+    /** Optimized emission: no debug-info (dev) posture. */
+    get optimizing() {
+        return this.debug === null;
+    }
     /** The vtable entry for one implementation (VirtualBorrows.entry). */
     virtualEntry(implFn) {
         return this.virtualBorrows.entry(implFn);
@@ -1376,7 +1450,25 @@ export class LlEmitter {
                 `  call void @scr_run_exit_listeners(double %${prefix}hd)`,
             ];
         };
-        const globalReleases = globalReleaseLines("g");
+        // The entry's exits release the module globals only where the thread
+        // frees its heap when its script ends (scr_exit_frees: workers, and
+        // builds that check for leaks); the main thread of other builds leaves
+        // it to the operating system.
+        const exitReleaseLines = (prefix) => {
+            const releases = globalReleaseLines(prefix);
+            if (releases.length === 0)
+                return releases;
+            this.declare(`declare zeroext i1 @scr_exit_frees()`);
+            return [
+                `  %${prefix}.frees = call zeroext i1 @scr_exit_frees()`,
+                `  br i1 %${prefix}.frees, label %${prefix}.release, label %${prefix}.kept`,
+                `${prefix}.release:`,
+                ...releases,
+                `  br label %${prefix}.kept`,
+                `${prefix}.kept:`,
+            ];
+        };
+        const globalReleases = exitReleaseLines("g");
         const asyncEntry = this.fnByName.get(this.mod.entry)?.async === true;
         const entryMayThrow = this.mayThrow.has(this.mod.entry);
         // The event loop runs when timers appeared OR any async/generator
@@ -1388,12 +1480,12 @@ export class LlEmitter {
         const runsLoop = this.usesTimers ||
             this.ffiHasForeignCallback ||
             this.mod.functions.some((f) => f.async === true || f.generator !== undefined);
-        const uncaughtReleases = entryMayThrow && !asyncEntry ? globalReleaseLines("gu") : [];
-        const loopReleasesU = runsLoop ? globalReleaseLines("gl") : [];
-        const loopReleasesR = runsLoop ? globalReleaseLines("gr") : [];
-        const topRejectReleases = asyncEntry ? globalReleaseLines("gt") : [];
-        const topPendingReleases = asyncEntry ? globalReleaseLines("gp") : [];
-        const loopReportedReleases = runsLoop ? globalReleaseLines("gq") : [];
+        const uncaughtReleases = entryMayThrow && !asyncEntry ? exitReleaseLines("gu") : [];
+        const loopReleasesU = runsLoop ? exitReleaseLines("gl") : [];
+        const loopReleasesR = runsLoop ? exitReleaseLines("gr") : [];
+        const topRejectReleases = asyncEntry ? exitReleaseLines("gt") : [];
+        const topPendingReleases = asyncEntry ? exitReleaseLines("gp") : [];
+        const loopReportedReleases = runsLoop ? exitReleaseLines("gq") : [];
         // main's epilogues read the flag / the loop entry points — declared
         // HERE, before the extern block flushes. They run once, so they keep
         // the out-of-line scr_exc_pending call; per-call checks inline the
@@ -1519,22 +1611,20 @@ export class LlEmitter {
             // preserving the target object's identity.
             `%ScrArr = type { ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, i8, i8, i16, i32, ptr, ptr, ptr, ptr }`,
             `%ScrArrOps = type { ptr, ptr, ptr }`,
-            // The ScrMap prefix { rc, key_kind, val_kind, val_retain, val_release,
-            // val_trace, key_retain, key_release, key_trace } — the inline RC
-            // fast paths test the two trace slots (shapes.ts).
-            ...(this.rcHelpers === null
-                ? []
-                : [`%ScrMapRc = type { ${this.sizeType}, i32, i32, ptr, ptr, ptr, ptr, ptr, ptr }`]),
+            // The ScrMap prefix { rc, key_kind, val_kind, traced } — the inline
+            // RC fast paths test the traced byte (shapes.ts).
+            ...(this.rcHelpers === null ? [] : [`%ScrMapRc = type { ${this.sizeType}, i8, i8, i8 }`]),
             // The complete ScrMap and its { key, val, hash } entry, read by the
             // inline number-key lookup (sc_map_entry_f64) and the inline
-            // iteration steps (sc_map_iter_entry): field 9 is the entry count,
-            // field 11 the i64 absent-key filter, entries is field 13, the direct
-            // index and its length fields 19 and 20.
+            // iteration steps (sc_map_iter_entry): field 8 is the i32 entry
+            // count, field 10 the i64 absent-key filter, entries is field 11,
+            // nbuckets and buckets fields 13 and 14, the direct index and its i32
+            // length fields 15 and 16.
             ...(this.decls.has(NUMBER_MAP_ENTRY_DECL) ||
                 this.decls.has(STRING_MAP_ENTRY_DECL) ||
                 this.decls.has(MAP_ITER_DECL)
                 ? [
-                    `%ScrMapIx = type { ${this.sizeType}, i32, i32, ptr, ptr, ptr, ptr, ptr, ptr, ${this.sizeType}, ${this.sizeType}, i64, ${this.sizeType}, ptr, ${this.sizeType}, ptr, ${this.sizeType}, ptr, ptr, ptr, ${this.sizeType} }`,
+                    `%ScrMapIx = type { ${this.sizeType}, i8, i8, i8, i8, i32, ptr, ptr, i32, i32, i64, ptr, i32, i32, ptr, ptr, i32, i32 }`,
                 ]
                 : []),
             // String-keyed reference reads load the value slot of the entry
@@ -1572,7 +1662,7 @@ export class LlEmitter {
             // typed-array access GEPs through this directly: the IR type already
             // fixes elem, so the hot path needs neither a runtime kind load nor
             // the generic scr_bytes_get/set call.
-            `%ScrBytes = type { ${this.sizeType}, ${this.sizeType}, i32, ptr, ptr, i8, i8, i8, ptr }`,
+            `%ScrBytes = type { ${this.sizeType}, ${this.sizeType}, i32, ptr, ptr, i8, i8, i8, i8, ptr }`,
             // The capture box { rc, kind, obj_retain, obj_release, obj_trace,
             // slot } — TDZ reads peek the payload slot (offset 40) directly.
             `%ScrBox = type { ${this.sizeType}, i32, ptr, ptr, ptr, i64 }`,
@@ -1583,6 +1673,15 @@ export class LlEmitter {
             `%ScrDynPath = type { ptr, ptr, ${this.sizeType} }`,
             `%ScrIslandModule = type { ptr, ptr, ${this.sizeType}, ${this.sizeType}, i32, ptr, ${this.sizeType}, ${this.sizeType} }`,
             `%ScrIslandEdge = type { ptr, ptr, ptr, i32 }`,
+            // A generator's prefix { rc, receiver, fiber, state, out } and its
+            // value slot { kind, f64, b, payload, release_fn } (scr_async.c pins
+            // both): number and boolean yields and drives address OUT directly.
+            ...(this.usesGenSlots
+                ? [
+                    `%ScrGenSlot = type { i32, double, i8, ptr, ptr }`,
+                    `%ScrGenHead = type { ${this.sizeType}, ptr, ptr, i32, %ScrGenSlot }`,
+                ]
+                : []),
         ];
         for (const line of shapes.typeDefs)
             out.push(line);
@@ -1607,6 +1706,11 @@ export class LlEmitter {
             out.push(d);
         out.push(``);
         const flushedDecls = new Set(this.decls);
+        {
+            const tl = this.mod.workers === true || this.mod.lib?.threadInstances === true ? "thread_local " : "";
+            for (let site = 0; site < this.dynReadIcSites; site++)
+                out.push(`@sc_dyn_read_ic_${site} = internal ${tl}global { ptr, ${this.sizeType}, ${this.sizeType}, ptr } zeroinitializer`);
+        }
         for (const table of this.constantNumericTables.values()) {
             const n = table.values.length;
             let tableTmp = 0;
@@ -1720,6 +1824,11 @@ export class LlEmitter {
         }
         if (this.cstrs.size > 0)
             out.push(``);
+        for (const [body, sym] of this.mapOpsConsts) {
+            out.push(`@${sym} = internal constant { ptr, ptr, ptr, ptr, ptr, ptr, ptr } { ${body} }`);
+        }
+        if (this.mapOpsConsts.size > 0)
+            out.push(``);
         for (const line of ffiCallbacks.globals)
             out.push(line);
         if (ffiCallbacks.globals.length > 0)
@@ -2196,19 +2305,25 @@ export class LlEmitter {
             const sz = this.sizeType;
             let mapTmp = 0;
             const mapIndex = exactIndexLines("%k", "%nd", sz, () => `%ix${mapTmp++}`);
-            defs.push(`define internal ptr @sc_map_entry_f64(ptr %m, double %k) ${FN_ATTRS} {`, `entry:`, `  %ndp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 20`, `  %nd = load ${sz}, ptr %ndp`, 
+            defs.push(`define internal ptr @sc_map_entry_f64(ptr %m, double %k) ${FN_ATTRS} {`, `entry:`, `  %ndp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 16`, ...(sz === "i64"
+                ? [`  %nd32 = load i32, ptr %ndp`, `  %nd = zext i32 %nd32 to i64`]
+                : [`  %nd = load i32, ptr %ndp`]), 
             // A non-integral key inside the table is as absent as one outside it.
             ...mapIndex.lines.map((line) => `  ${line}`), `  br i1 ${mapIndex.ok}, label %slot, label %outside`, `slot:`, sz === "i64"
                 ? `  %i = add i64 ${mapIndex.wide}, 0`
-                : `  %i = trunc i64 ${mapIndex.wide} to ${sz}`, `  %dp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 19`, `  %dense = load ptr, ptr %dp`, `  %sp = getelementptr inbounds i32, ptr %dense, ${sz} %i`, `  %s = load i32, ptr %sp`, `  %empty = icmp eq i32 %s, 0`, `  br i1 %empty, label %miss, label %hit`, `hit:`, `  %e32 = sub i32 %s, 1`, sz === "i32" ? `  %e = add i32 %e32, 0` : `  %e = zext i32 %e32 to ${sz}`, `  %ep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 13`, `  %entries = load ptr, ptr %ep`, `  %found = getelementptr inbounds %ScrMapEntry, ptr %entries, ${sz} %e`, `  ret ptr %found`, `miss:`, `  ret ptr null`, `outside:`, `  %dense.any = icmp ne ${sz} %nd, 0`, `  br i1 %dense.any, label %miss, label %slow`, `slow:`, `  %hashed = call ptr @sc_map_entry_f64_hashed(ptr %m, double %k)`, `  ret ptr %hashed`, `}`, ``, 
+                : `  %i = trunc i64 ${mapIndex.wide} to ${sz}`, `  %dp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 15`, `  %dense = load ptr, ptr %dp`, `  %sp = getelementptr inbounds i32, ptr %dense, ${sz} %i`, `  %s = load i32, ptr %sp`, `  %empty = icmp eq i32 %s, 0`, `  br i1 %empty, label %miss, label %hit`, `hit:`, `  %e32 = sub i32 %s, 1`, sz === "i32" ? `  %e = add i32 %e32, 0` : `  %e = zext i32 %e32 to ${sz}`, `  %ep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 11`, `  %entries = load ptr, ptr %ep`, `  %found = getelementptr inbounds %ScrMapEntry, ptr %entries, ${sz} %e`, `  ret ptr %found`, `miss:`, `  ret ptr null`, `outside:`, `  %dense.any = icmp ne ${sz} %nd, 0`, `  br i1 %dense.any, label %miss, label %slow`, `slow:`, `  %hashed = call ptr @sc_map_entry_f64_hashed(ptr %m, double %k)`, `  ret ptr %hashed`, `}`, ``, 
             // Hashing (scr_map_find_f64): the SameValueZero key word, its
             // scr_key_mix hash (zero remapped to one) and the absent-key filter.
-            `define internal ptr @sc_map_entry_f64_hashed(ptr %m, double %k) noinline ${FN_ATTRS} {`, `entry:`, `  %nan = fcmp uno double %k, %k`, `  %zero = fcmp oeq double %k, 0.0`, `  %kz = select i1 %zero, double 0.0, double %k`, `  %kzb = bitcast double %kz to i64`, `  %kb = select i1 %nan, i64 9221120237041090560, i64 %kzb`, `  %x1s = lshr i64 %kb, 30`, `  %x1 = xor i64 %kb, %x1s`, `  %x2 = mul i64 %x1, -4658895280553007687`, `  %x3s = lshr i64 %x2, 27`, `  %x3 = xor i64 %x2, %x3s`, `  %x4 = mul i64 %x3, -7723592293110705685`, `  %x5s = lshr i64 %x4, 31`, `  %x5 = xor i64 %x4, %x5s`, `  %hz = icmp eq i64 %x5, 0`, `  %h = select i1 %hz, i64 1, i64 %x5`, `  %f1s = lshr i64 %h, 44`, `  %f1a = and i64 %f1s, 63`, `  %f1 = shl i64 1, %f1a`, `  %f2s = lshr i64 %h, 50`, `  %f2a = and i64 %f2s, 63`, `  %f2 = shl i64 1, %f2a`, `  %fb = or i64 %f1, %f2`, `  %fp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 11`, `  %filter = load i64, ptr %fp`, `  %fm = and i64 %filter, %fb`, `  %fin = icmp eq i64 %fm, %fb`, `  br i1 %fin, label %table, label %miss`, `table:`, `  %nbp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 14`, `  %nb = load ${sz}, ptr %nbp`, `  %eps = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 13`, `  %ents = load ptr, ptr %eps`, `  %linear = icmp eq ${sz} %nb, 0`, `  br i1 %linear, label %scan, label %buckets`, 
+            `define internal ptr @sc_map_entry_f64_hashed(ptr %m, double %k) noinline ${FN_ATTRS} {`, `entry:`, `  %nan = fcmp uno double %k, %k`, `  %zero = fcmp oeq double %k, 0.0`, `  %kz = select i1 %zero, double 0.0, double %k`, `  %kzb = bitcast double %kz to i64`, `  %kb = select i1 %nan, i64 9221120237041090560, i64 %kzb`, `  %x1s = lshr i64 %kb, 30`, `  %x1 = xor i64 %kb, %x1s`, `  %x2 = mul i64 %x1, -4658895280553007687`, `  %x3s = lshr i64 %x2, 27`, `  %x3 = xor i64 %x2, %x3s`, `  %x4 = mul i64 %x3, -7723592293110705685`, `  %x5s = lshr i64 %x4, 31`, `  %x5 = xor i64 %x4, %x5s`, `  %hz = icmp eq i64 %x5, 0`, `  %h = select i1 %hz, i64 1, i64 %x5`, `  %f1s = lshr i64 %h, 44`, `  %f1a = and i64 %f1s, 63`, `  %f1 = shl i64 1, %f1a`, `  %f2s = lshr i64 %h, 50`, `  %f2a = and i64 %f2s, 63`, `  %f2 = shl i64 1, %f2a`, `  %fb = or i64 %f1, %f2`, `  %fp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 10`, `  %filter = load i64, ptr %fp`, `  %fm = and i64 %filter, %fb`, `  %fin = icmp eq i64 %fm, %fb`, `  br i1 %fin, label %table, label %miss`, `table:`, `  %nbp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 13`, ...(sz === "i64"
+                ? [`  %nb32 = load i32, ptr %nbp`, `  %nb = zext i32 %nb32 to i64`]
+                : [`  %nb = load i32, ptr %nbp`]), `  %eps = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 11`, `  %ents = load ptr, ptr %eps`, `  %linear = icmp eq ${sz} %nb, 0`, `  br i1 %linear, label %scan, label %buckets`, 
             // Small maps keep no bucket table: scan the cached entry hashes.
-            `scan:`, `  %nep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 9`, `  %ne = load ${sz}, ptr %nep`, `  br label %scan.loop`, `scan.loop:`, `  %si = phi ${sz} [ 0, %scan ], [ %si.next, %scan.next ]`, `  %sdone = icmp eq ${sz} %si, %ne`, `  br i1 %sdone, label %miss, label %scan.entry`, `scan.entry:`, `  %se = getelementptr inbounds %ScrMapEntry, ptr %ents, ${sz} %si`, `  %seh = getelementptr inbounds %ScrMapEntry, ptr %se, i32 0, i32 2`, `  %sh = load i64, ptr %seh`, `  %sk = load i64, ptr %se`, `  %shq = icmp eq i64 %sh, %h`, `  %skq = icmp eq i64 %sk, %kb`, `  %sq = and i1 %shq, %skq`, `  br i1 %sq, label %scan.found, label %scan.next`, `scan.found:`, `  ret ptr %se`, `scan.next:`, `  %si.next = add ${sz} %si, 1`, `  br label %scan.loop`, 
+            `scan:`, `  %nep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 8`, ...(sz === "i64"
+                ? [`  %ne32 = load i32, ptr %nep`, `  %ne = zext i32 %ne32 to i64`]
+                : [`  %ne = load i32, ptr %nep`]), `  br label %scan.loop`, `scan.loop:`, `  %si = phi ${sz} [ 0, %scan ], [ %si.next, %scan.next ]`, `  %sdone = icmp eq ${sz} %si, %ne`, `  br i1 %sdone, label %miss, label %scan.entry`, `scan.entry:`, `  %se = getelementptr inbounds %ScrMapEntry, ptr %ents, ${sz} %si`, `  %seh = getelementptr inbounds %ScrMapEntry, ptr %se, i32 0, i32 2`, `  %sh = load i64, ptr %seh`, `  %sk = load i64, ptr %se`, `  %shq = icmp eq i64 %sh, %h`, `  %skq = icmp eq i64 %sk, %kb`, `  %sq = and i1 %shq, %skq`, `  br i1 %sq, label %scan.found, label %scan.next`, `scan.found:`, `  ret ptr %se`, `scan.next:`, `  %si.next = add ${sz} %si, 1`, `  br label %scan.loop`, 
             // Compact tables tag each 24-bit entry index (+1) with the hash's
             // top byte; wider tables take the runtime lookup.
-            `buckets:`, `  %wide = icmp ugt ${sz} %nb, 16777216`, `  br i1 %wide, label %runtime, label %probe`, `probe:`, `  %bp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 15`, `  %bk = load ptr, ptr %bp`, `  %mask = sub ${sz} %nb, 1`, `  %ht = lshr i64 %h, 32`, `  %ht32 = trunc i64 %ht to i32`, `  %tag = and i32 %ht32, -16777216`, sz === "i64" ? `  %hi = add i64 %h, 0` : `  %hi = trunc i64 %h to ${sz}`, `  %i0 = and ${sz} %hi, %mask`, `  br label %probe.loop`, `probe.loop:`, `  %pi = phi ${sz} [ %i0, %probe ], [ %pi.next, %probe.next ]`, `  %bep = getelementptr inbounds i32, ptr %bk, ${sz} %pi`, `  %b = load i32, ptr %bep`, `  %bempty = icmp eq i32 %b, 0`, `  br i1 %bempty, label %miss, label %probe.tag`, `probe.tag:`, `  %bt = and i32 %b, -16777216`, `  %btq = icmp eq i32 %bt, %tag`, `  br i1 %btq, label %probe.entry, label %probe.next`, `probe.entry:`, `  %bix = and i32 %b, 16777215`, `  %bix1 = sub i32 %bix, 1`, sz === "i32" ? `  %bi = add i32 %bix1, 0` : `  %bi = zext i32 %bix1 to ${sz}`, `  %pe = getelementptr inbounds %ScrMapEntry, ptr %ents, ${sz} %bi`, `  %peh = getelementptr inbounds %ScrMapEntry, ptr %pe, i32 0, i32 2`, `  %ph = load i64, ptr %peh`, `  %pk = load i64, ptr %pe`, `  %phq = icmp eq i64 %ph, %h`, `  %pkq = icmp eq i64 %pk, %kb`, `  %pq = and i1 %phq, %pkq`, `  br i1 %pq, label %probe.found, label %probe.next`, `probe.found:`, `  ret ptr %pe`, `probe.next:`, `  %pi.inc = add ${sz} %pi, 1`, `  %pi.next = and ${sz} %pi.inc, %mask`, `  br label %probe.loop`, `miss:`, `  ret ptr null`, `runtime:`, `  %r = call ptr @scr_map_entry_f64(ptr %m, double %k) memory(read) nounwind willreturn`, `  ret ptr %r`, `}`, ``);
+            `buckets:`, `  %wide = icmp ugt ${sz} %nb, 16777216`, `  br i1 %wide, label %runtime, label %probe`, `probe:`, `  %bp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 14`, `  %bk = load ptr, ptr %bp`, `  %mask = sub ${sz} %nb, 1`, `  %ht = lshr i64 %h, 32`, `  %ht32 = trunc i64 %ht to i32`, `  %tag = and i32 %ht32, -16777216`, sz === "i64" ? `  %hi = add i64 %h, 0` : `  %hi = trunc i64 %h to ${sz}`, `  %i0 = and ${sz} %hi, %mask`, `  br label %probe.loop`, `probe.loop:`, `  %pi = phi ${sz} [ %i0, %probe ], [ %pi.next, %probe.next ]`, `  %bep = getelementptr inbounds i32, ptr %bk, ${sz} %pi`, `  %b = load i32, ptr %bep`, `  %bempty = icmp eq i32 %b, 0`, `  br i1 %bempty, label %miss, label %probe.tag`, `probe.tag:`, `  %bt = and i32 %b, -16777216`, `  %btq = icmp eq i32 %bt, %tag`, `  br i1 %btq, label %probe.entry, label %probe.next`, `probe.entry:`, `  %bix = and i32 %b, 16777215`, `  %bix1 = sub i32 %bix, 1`, sz === "i32" ? `  %bi = add i32 %bix1, 0` : `  %bi = zext i32 %bix1 to ${sz}`, `  %pe = getelementptr inbounds %ScrMapEntry, ptr %ents, ${sz} %bi`, `  %peh = getelementptr inbounds %ScrMapEntry, ptr %pe, i32 0, i32 2`, `  %ph = load i64, ptr %peh`, `  %pk = load i64, ptr %pe`, `  %phq = icmp eq i64 %ph, %h`, `  %pkq = icmp eq i64 %pk, %kb`, `  %pq = and i1 %phq, %pkq`, `  br i1 %pq, label %probe.found, label %probe.next`, `probe.found:`, `  ret ptr %pe`, `probe.next:`, `  %pi.inc = add ${sz} %pi, 1`, `  %pi.next = and ${sz} %pi.inc, %mask`, `  br label %probe.loop`, `miss:`, `  ret ptr null`, `runtime:`, `  %r = call ptr @scr_map_entry_f64(ptr %m, double %k) memory(read) nounwind willreturn`, `  ret ptr %r`, `}`, ``);
         }
         // Map/Set iteration steps read the entries array inline: an index is
         // live when it is below the entry count and its entry's cached hash is
@@ -2217,7 +2332,7 @@ export class LlEmitter {
         // the iteration are visited.
         if (this.decls.has(MAP_ITER_DECL)) {
             const sz = this.sizeType;
-            defs.push(`define internal ptr @sc_map_iter_entry(ptr %m, double %i) ${FN_ATTRS} {`, `entry:`, `  %np = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 9`, `  %n = load ${sz}, ptr %np`, `  %nf = uitofp ${sz} %n to double`, `  %lo = fcmp oge double %i, 0.0`, `  %hi = fcmp olt double %i, %nf`, `  %in = and i1 %lo, %hi`, `  br i1 %in, label %load, label %none`, `load:`, `  %ix = fptoui double %i to ${sz}`, `  %ep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 13`, `  %entries = load ptr, ptr %ep`, `  %e = getelementptr inbounds %ScrMapEntry, ptr %entries, ${sz} %ix`, `  %hp = getelementptr inbounds %ScrMapEntry, ptr %e, i32 0, i32 2`, `  %h = load i64, ptr %hp`, `  %live = icmp ne i64 %h, 0`, `  br i1 %live, label %yes, label %none`, `yes:`, `  ret ptr %e`, `none:`, `  ret ptr null`, `}`, ``, `define internal double @sc_map_iter_count(ptr %m) ${FN_ATTRS} {`, `entry:`, `  %np = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 9`, `  %n = load ${sz}, ptr %np`, `  %nf = uitofp ${sz} %n to double`, `  ret double %nf`, `}`, ``);
+            defs.push(`define internal ptr @sc_map_iter_entry(ptr %m, double %i) ${FN_ATTRS} {`, `entry:`, `  %np = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 8`, `  %n = load i32, ptr %np`, `  %nf = uitofp i32 %n to double`, `  %lo = fcmp oge double %i, 0.0`, `  %hi = fcmp olt double %i, %nf`, `  %in = and i1 %lo, %hi`, `  br i1 %in, label %load, label %none`, `load:`, `  %ix = fptoui double %i to ${sz}`, `  %ep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 11`, `  %entries = load ptr, ptr %ep`, `  %e = getelementptr inbounds %ScrMapEntry, ptr %entries, ${sz} %ix`, `  %hp = getelementptr inbounds %ScrMapEntry, ptr %e, i32 0, i32 2`, `  %h = load i64, ptr %hp`, `  %live = icmp ne i64 %h, 0`, `  br i1 %live, label %yes, label %none`, `yes:`, `  ret ptr %e`, `none:`, `  ret ptr null`, `}`, ``, `define internal double @sc_map_iter_count(ptr %m) ${FN_ATTRS} {`, `entry:`, `  %np = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 8`, `  %n = load i32, ptr %np`, `  %nf = uitofp i32 %n to double`, `  ret double %nf`, `}`, ``);
         }
         // String-key Map/Set lookups test the map's absent-key filter inline
         // (scr_map.c scr_map_filter_bits): a key whose two filter bits are not
@@ -2230,7 +2345,7 @@ export class LlEmitter {
         if (this.decls.has(STRING_MAP_ENTRY_DECL)) {
             defs.push(`define internal ptr @sc_map_entry_str(ptr %m, ptr %k) ${FN_ATTRS} {`, `entry:`, ...(this.sizeType === "i64"
                 ? [
-                    `  %fp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 11`,
+                    `  %fp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 10`,
                     `  %filter = load i64, ptr %fp`,
                     `  %capp = getelementptr inbounds %ScrStr, ptr %k, i32 0, i32 2`,
                     `  %cap = load i64, ptr %capp`,
@@ -3036,6 +3151,18 @@ export class LlEmitter {
     needBadTag() {
         this.needsBadTag = true;
     }
+    /** The ScrMapOps descriptor holding these operands (ShapeHost.mapOps). */
+    mapOps(operands) {
+        if (operands.every((op) => op === "null"))
+            return "null";
+        const body = operands.map((op) => `ptr ${op}`).join(", ");
+        let sym = this.mapOpsConsts.get(body);
+        if (!sym) {
+            sym = this.contentSymbol("sc_map_ops_", body);
+            this.mapOpsConsts.set(body, sym);
+        }
+        return `@${sym}`;
+    }
     /** The interned immortal instance for a UNIT arm of a union — asserts
      * the arm really is payload-less (undefined/null). Public: class
      * emission initializes undefined-admitting fields through it
@@ -3616,6 +3743,259 @@ export class LlEmitter {
         this.B.line(`store i32 0, ptr ${slot}`);
         return slot;
     }
+    /** Emit a loop's condition, body and update through `emitCopy`, twice
+     * when speculative-integers.ts plans a fast integer copy. Both copies
+     * share the loop's setup and exit; the ordinary copy comes first so the
+     * fast copy is only emitted when every resume point exists. */
+    emitLoopCopies(loop, allowed, exit, emitCopy) {
+        const plan = allowed &&
+            this.speculativeLoopsEnabled &&
+            this.speculation === null &&
+            this.speculationResume === null
+            ? planSpeculativeLoop(loop, (id) => this.speculativeLocal(id), (id) => this.integerLoopBindings.has(id) || this.int32Locals.has(id), (e) => {
+                const range = this.integerRanges.get(e);
+                return (range !== undefined &&
+                    range !== null &&
+                    range.min >= -Number.MAX_SAFE_INTEGER &&
+                    range.max <= Number.MAX_SAFE_INTEGER);
+            }, (id) => this.speculativeLocal(id) || this.speculativeInvariantGlobal(id))
+            : null;
+        if (!plan) {
+            emitCopy(exit);
+            return;
+        }
+        const B = this.B;
+        const entries = new Map();
+        let ok = "true";
+        for (const [id, live] of plan.locals) {
+            if (!live)
+                continue;
+            const value = B.tmp();
+            B.line(`${value} = load double, ptr ${this.binding(id).slot}`);
+            const [integer, exact] = emitSafeIntegerCheck(this, value);
+            entries.set(id, integer);
+            if (ok === "true")
+                ok = exact;
+            else {
+                const both = B.tmp();
+                B.line(`${both} = and i1 ${ok}, ${exact}`);
+                ok = both;
+            }
+        }
+        const fast = B.newLabel("spec.fast"), slow = B.newLabel("spec.slow");
+        B.condBr(ok, fast, slow);
+        const resume = new Map();
+        for (const s of plan.writes)
+            resume.set(s, { label: B.newLabel("spec.resume"), placed: false });
+        B.startBlock(slow);
+        this.speculationResume = resume;
+        try {
+            emitCopy(exit);
+        }
+        finally {
+            this.speculationResume = null;
+        }
+        B.startBlock(fast);
+        if (![...resume.values()].every((r) => r.placed)) {
+            B.br(slow);
+            return;
+        }
+        for (const id of plan.locals.keys()) {
+            const shadow = B.slot();
+            B.entryAllocas.push(`${shadow} = alloca i64 ; speculative integer ${this.currentLocals.get(id)?.name ?? id}`);
+            const entry = entries.get(id);
+            if (entry !== undefined) {
+                // The same double, now visibly an integer conversion: the double
+                // phis of the fast copy fold into integer phis.
+                const exact = B.tmp();
+                B.line(`store i64 ${entry}, ptr ${shadow}`);
+                B.line(`${exact} = sitofp i64 ${entry} to double`);
+                B.line(`store double ${exact}, ptr ${this.binding(id).slot}`);
+            }
+            else
+                B.line(`store i64 0, ptr ${shadow}`);
+            this.integerLoopBindings.set(id, {
+                slot: shadow,
+                type: "i64",
+                signed: true,
+                range: SPECULATIVE_RANGE,
+            });
+        }
+        // A global's store stays in the loop (calls may read it). When nothing
+        // in the loop can observe it, its double is written once on leaving the
+        // copy instead, so the loop keeps it in a register as the double copy
+        // would.
+        const deferred = new Set();
+        // Worker loops also leave through their cancellation poll.
+        if (plan.observerFree && !this.mod.workers)
+            for (const s of plan.writes) {
+                const id = speculativeWriteTarget(s).localId;
+                if (!this.currentLocals.has(id))
+                    deferred.add(id);
+            }
+        this.speculation = {
+            writes: plan.writes,
+            resume: new Map([...resume].map(([s, r]) => [s, r.label])),
+            deferred,
+        };
+        try {
+            if (deferred.size === 0)
+                emitCopy(exit);
+            else {
+                const leave = B.newLabel("spec.leave");
+                emitCopy(leave);
+                B.startBlock(leave);
+                this.writeBackSpeculativeGlobals(deferred);
+                B.br(exit);
+            }
+        }
+        finally {
+            this.speculation = null;
+            for (const id of plan.locals.keys())
+                this.integerLoopBindings.delete(id);
+        }
+    }
+    writeBackSpeculativeGlobals(deferred) {
+        const B = this.B;
+        for (const id of deferred) {
+            const integer = B.tmp(), number = B.tmp();
+            B.line(`${integer} = load i64, ptr ${this.integerLoopBindings.get(id).slot}`);
+            B.line(`${number} = sitofp i64 ${integer} to double`);
+            B.line(`store double ${number}, ptr ${this.binding(id).slot}`);
+        }
+    }
+    /** A number local whose only storage is its own double slot, so an i64
+     * shadow beside it can stand for it within one loop. */
+    speculativeLocal(id) {
+        const local = this.currentLocals.get(id);
+        if (!local)
+            return this.speculativeGlobal(id);
+        if (local.type.kind !== "f64" || local.boxed || local.tdz)
+            return false;
+        return !(this.captureIds.has(id) ||
+            this.int32Locals.has(id) ||
+            this.integerLoopBindings.has(id) ||
+            this.integerViews.has(id) ||
+            this.localUnionStorage.has(id) ||
+            this.reboundOwnerSlots.has(id) ||
+            this.lazyCaptureBoxes.has(id) ||
+            this.privateSplitLocals.has(id));
+    }
+    /** A module-level number written only by the file's top-level code that
+     * is emitting this loop. Calls may still read it: the fast copy keeps its
+     * double current. An init function runs once and is never re-entered, so
+     * no call from the loop can write the global behind the shadow. */
+    speculativeGlobal(id) {
+        if (!this.speculativeFunction.startsWith("%init."))
+            return false;
+        const writers = this.numberGlobalWriters(id);
+        return (writers !== null &&
+            (writers.size === 0 || (writers.size === 1 && writers.has(this.speculativeFunction))));
+    }
+    /** A module-level number a loop of any function only reads, written by
+     * nothing but top-level code: an init function never runs during a loop
+     * of another function, so the entry value stays its value. */
+    speculativeInvariantGlobal(id) {
+        const writers = this.numberGlobalWriters(id);
+        return writers !== null && [...writers].every((name) => name.startsWith("%init."));
+    }
+    /** The functions writing a number global a shadow may stand for, or null
+     * when the global is not such a number. */
+    numberGlobalWriters(id) {
+        if (this.globalTypes.get(id)?.kind !== "f64")
+            return null;
+        if (this.tdzGlobals.has(id) || this.integerViews.has(id))
+            return null;
+        if (!this.globalWriters) {
+            const writers = new Map();
+            for (const fn of this.mod.functions) {
+                const note = (localId) => {
+                    if (!localId.startsWith("%g."))
+                        return;
+                    const set = writers.get(localId) ?? new Set();
+                    set.add(fn.name);
+                    writers.set(localId, set);
+                };
+                everyStmtList(fn.body, {
+                    stmt: (s) => {
+                        if (s.kind === "assign" || s.kind === "varDecl")
+                            note(s.localId);
+                        return true;
+                    },
+                    expr: (e) => {
+                        if (e.kind === "assignExpr" || e.kind === "incDec")
+                            note(e.localId);
+                        return true;
+                    },
+                });
+            }
+            this.globalWriters = writers;
+        }
+        return this.globalWriters.get(id) ?? new Set();
+    }
+    /** A speculated write in the fast copy: compute the value as a safe
+     * integer, store it to the shadow and its exact double to the local.
+     * Any failed check re-executes the statement in the ordinary copy. */
+    emitSpeculativeWrite(s, resume) {
+        const B = this.B;
+        const target = speculativeWriteTarget(s);
+        const binding = this.integerLoopBindings.get(target.localId);
+        const failed = B.newLabel("spec.bail");
+        let bails = false;
+        this.declare("declare i1 @llvm.expect.i1(i1, i1)");
+        const bail = (condition) => {
+            if (condition === "false")
+                return;
+            bails = true;
+            const expected = B.tmp();
+            B.line(`${expected} = call i1 @llvm.expect.i1(i1 ${condition}, i1 false)`);
+            const next = B.newLabel("spec.ok");
+            B.condBr(expected, failed, next);
+            B.startBlock(next);
+        };
+        // Heap reads come first, before any check, and release their temporaries
+        // at once: a bailing path then owns nothing, and reads have no effect
+        // whose reordering before the arithmetic could be observed.
+        const reads = new Map();
+        if (target.value !== null) {
+            this.frames.push([]);
+            for (const read of speculativeReads(target.value))
+                reads.set(read, this.emitExpr(read));
+            this.releaseFrame(this.frames.pop());
+        }
+        this.frames.push([]);
+        let result;
+        if (target.value === null) {
+            const old = B.tmp();
+            result = B.tmp();
+            B.line(`${old} = load i64, ptr ${binding.slot}`);
+            B.line(`${result} = ${target.op === "+" ? "add" : "sub"} nsw i64 ${old}, 1`);
+            const biased = B.tmp(), outside = B.tmp();
+            B.line(`${biased} = add i64 ${result}, ${Number.MAX_SAFE_INTEGER}`);
+            B.line(`${outside} = icmp ugt i64 ${biased}, ${2 * Number.MAX_SAFE_INTEGER}`);
+            bail(outside);
+        }
+        else
+            result = emitSpeculativeInteger(this, target.value, bail, reads);
+        // Speculable values read only numbers past this point.
+        if (this.frames.pop().length > 0)
+            throw new InternalCompilerError("llvm emitter bug: speculative write owns a temporary");
+        B.line(`store i64 ${result}, ptr ${binding.slot}`);
+        const deferred = this.speculation.deferred;
+        if (!deferred.has(target.localId)) {
+            const number = B.tmp();
+            B.line(`${number} = sitofp i64 ${result} to double`);
+            B.line(`store double ${number}, ptr ${this.binding(target.localId).slot}`);
+        }
+        if (!bails)
+            return;
+        const done = B.newLabel("spec.done");
+        B.br(done);
+        B.startBlock(failed);
+        this.writeBackSpeculativeGlobals(deferred);
+        B.br(resume);
+        B.startBlock(done);
+    }
     /** The amortized cancellation poll, emitted on the loop's back edge (the
      * continue target), after the body. A poll in the header would be a loop
      * exit ahead of the body; LLVM then cannot rotate the loop, so loads that
@@ -4054,6 +4434,14 @@ export class LlEmitter {
         this.B.line(`${v} = load ptr, ptr ${p}`);
         return v;
     }
+    /** The pointer to ScrMap.flags of an index-signature record's overflow
+     * map (byte offset sizeof(size_t) + 3; SCR_MAP_NULL_PROTO is bit 0). */
+    recordMapFlagsPtr(objName, shapeId) {
+        const ovf = this.recordOvfPtr(objName, shapeId);
+        const p = this.B.tmp();
+        this.B.line(`${p} = getelementptr inbounds i8, ptr ${ovf}, i64 ${mapFlagsOffset(this.sizeType)}`);
+        return p;
+    }
     /** Loads a record field (i8-stored bools trunc to i1). An inline union
      * field answers a private stack box with the slot's own bits, ABSENT
      * included: it may only be borrowed. */
@@ -4172,7 +4560,11 @@ export class LlEmitter {
         const g = this.globalTypes.get(id);
         if (!g)
             throw new InternalCompilerError(`llvm emitter bug: unknown binding ${id}`);
-        return { kind: "global", slot: `@${mangleGlobal(id)}`, type: g };
+        return {
+            kind: "global",
+            slot: this.privateGlobalSlots.get(id) ?? `@${mangleGlobal(id)}`,
+            type: g,
+        };
     }
     emitDebugLocal(local, slot, arg = 0, captured = false) {
         const debug = this.debug?.local(local, this.debugScope, arg, captured);
@@ -4435,6 +4827,55 @@ export class LlEmitter {
         }
         this.emitCoroSuspendPrepared();
     }
+    /** A native generator's OUT slot (scr_async.c's ScrGen.out, mirrored by
+     * %ScrGenHead and %ScrGenSlot { kind, f64, b, payload, release_fn }). */
+    genOutSlot(gen) {
+        this.usesGenSlots = true;
+        const slot = this.B.tmp();
+        this.B.line(`${slot} = getelementptr inbounds %ScrGenHead, ptr ${gen}, i32 0, i32 4`);
+        return slot;
+    }
+    /** A yield on a number or boolean channel: scr_gen_slot_f64/bool inline.
+     * Such a body's OUT never holds a reference at a yield (only its final
+     * completion can park one), so the slot needs no release first. */
+    emitGenSlotStore(slot, kind, value) {
+        const B = this.B;
+        const field = B.tmp();
+        if (kind === "f64") {
+            B.line(`store i32 ${SCR_EXC_F64}, ptr ${slot}`);
+            B.line(`${field} = getelementptr inbounds %ScrGenSlot, ptr ${slot}, i32 0, i32 1`);
+            B.line(`store double ${value}, ptr ${field}`);
+        }
+        else {
+            const byte = B.tmp();
+            B.line(`store i32 ${SCR_EXC_BOOL}, ptr ${slot}`);
+            B.line(`${field} = getelementptr inbounds %ScrGenSlot, ptr ${slot}, i32 0, i32 2`);
+            B.line(`${byte} = zext i1 ${value} to i8`);
+            B.line(`store i8 ${byte}, ptr ${field}`);
+        }
+    }
+    /** scr_gen_take_out_f64/bool inline: the slot's value when it holds that
+     * kind (otherwise 0 or false), leaving the slot empty. */
+    emitGenSlotTake(slot, kind) {
+        const B = this.B;
+        const tag = B.tmp(), matches = B.tmp(), field = B.tmp(), raw = B.tmp(), out = B.tmp();
+        B.line(`${tag} = load i32, ptr ${slot}`);
+        B.line(`${matches} = icmp eq i32 ${tag}, ${kind === "f64" ? SCR_EXC_F64 : SCR_EXC_BOOL}`);
+        if (kind === "f64") {
+            B.line(`${field} = getelementptr inbounds %ScrGenSlot, ptr ${slot}, i32 0, i32 1`);
+            B.line(`${raw} = load double, ptr ${field}`);
+            B.line(`${out} = select i1 ${matches}, double ${raw}, double 0.0`);
+        }
+        else {
+            const bit = B.tmp();
+            B.line(`${field} = getelementptr inbounds %ScrGenSlot, ptr ${slot}, i32 0, i32 2`);
+            B.line(`${raw} = load i8, ptr ${field}`);
+            B.line(`${bit} = trunc i8 ${raw} to i1`);
+            B.line(`${out} = select i1 ${matches}, i1 ${bit}, i1 false`);
+        }
+        B.line(`store i32 0, ptr ${slot}`);
+        return out;
+    }
     /** Suspend after a target-specific runtime helper already queued the
      * continuation (used by module awaits, which skip the hop when settled). */
     emitCoroSuspendPrepared() {
@@ -4509,9 +4950,25 @@ export class LlEmitter {
             }
         }
     }
+    /** Number locals declared as a copy of a capture or of a lazily boxed
+     * parameter, at the top of the body. */
+    doubleCopies(fn) {
+        const copies = [];
+        for (const s of fn.body) {
+            if (s.kind !== "varDecl")
+                break;
+            if (s.init?.kind !== "varRef" || s.init.type.kind !== "f64")
+                continue;
+            const source = s.init.localId;
+            if (this.captureIds.has(source) || this.lazyCaptureBoxes.has(source))
+                copies.push(s.localId);
+        }
+        return copies;
+    }
     emitFunction(fn) {
         const B = new BlockBuilder();
         this.B = B;
+        this.currentFunctionName = fn.name;
         // Fiber switches restore the active exception cell before control
         // returns to a synchronous frame (emitPendingCheck).
         B.excCellInvariant = fn.async !== true && fn.generator === undefined;
@@ -4564,11 +5021,20 @@ export class LlEmitter {
                     !this.reboundByFunction.get(fn.name)?.has(fn.params[index].localId))
                     this.borrowedParameters.add(fn.params[index].localId);
         }
+        // A generator frame owns its unchanged parameters across suspensions.
+        const generatorParameters = this.callLifetimes.generatorParameters.get(fn.name);
+        if (generatorParameters !== undefined)
+            for (const id of generatorParameters)
+                this.borrowedParameters.add(id);
         this.captureIds = new Set([...(fn.captures ?? []), ...(fn.classCaptures ?? [])].map((c) => c.localId));
         this.stableCaptureIds =
             fn.captures !== undefined ? this.lazyCaptures.stableCaptures(fn.name) : new Set();
         this.integerLoopBindings.clear();
         this.countedLoopsEnabled = this.debug === null && !fn.async && !fn.generator;
+        this.speculativeLoopsEnabled = this.countedLoopsEnabled;
+        this.speculativeFunction = fn.name;
+        this.speculation = null;
+        this.speculationResume = null;
         this.finalFieldBorrows =
             !fn.async && !fn.generator && constructorClass(fn.name) === null && this.finalFields.size > 0;
         this.byteWindowsEnabled = this.countedLoopsEnabled;
@@ -4589,6 +5055,7 @@ export class LlEmitter {
             this.debug === null ? findScalarStringSlices(fn, this.callLifetimes) : new Map();
         this.mapReadLifetimes = findMapReadLifetimes(fn, this.boxedUnionsById, this.callLifetimes);
         this.readNumberMapWrites = findReadNumberMapWrites(fn);
+        this.mapEntryFusion = this.debug === null ? findMapEntryFusions(fn) : null;
         this.localStackUnions = findLocalStackUnions(fn, this.callLifetimes, this.boxedUnionsById);
         this.localStackObjects = this.stackObjects
             ? findLocalStackObjects(this, fn, this.callLifetimes)
@@ -4604,12 +5071,30 @@ export class LlEmitter {
         this.bytesBounds = findBytesBounds(numericFn, this.integerRanges);
         // Debug builds keep every number local a double for the debugger's
         // variable view. Lazily boxed captured parameters keep their double,
-        // which the box is created from.
+        // which the box is created from, and so do plain copies of a capture or
+        // such a parameter (copyStableCaptures): the source already holds the
+        // double, which an i32 copy would convert and widen again on every call.
+        // Initializer bindings proven int32 move into an i32 local of their
+        // initializer: no other code observes the global, so the loop-carried
+        // value never round-trips through the double slot.
+        const initializerLocals = initializerLocalCandidates(initializerBindings);
         const int32Locals = this.debug === null
-            ? findInt32Locals(fn, this.integerRanges, this.int32Slots.facts(fn.name), new Set(this.lazyCaptureBoxes.keys()))
+            ? findInt32Locals(withInitializerLocals(fn, initializerLocals), this.integerRanges, this.int32Slots.facts(fn.name), new Set([...this.lazyCaptureBoxes.keys(), ...this.doubleCopies(fn)]))
             : null;
         this.int32Locals = int32Locals?.locals ?? new Map();
         this.int32LocalWrites = int32Locals?.values ?? new Set();
+        const localizedGlobals = new Set();
+        for (const global of initializerLocals) {
+            if (!this.int32Locals.has(global.id))
+                continue;
+            localizedGlobals.add(global.id);
+            this.currentLocals.set(global.id, {
+                id: global.id,
+                name: global.name,
+                type: global.type,
+                mutable: global.mutable,
+            });
+        }
         this.chainSlots.clear();
         this.finallyStack = [];
         this.tryStack = [];
@@ -4651,6 +5136,18 @@ export class LlEmitter {
             B.line(`${handle} = call ptr @llvm.coro.begin(token ${id}, ptr ${mem})`);
             B.line(`call void @${started}(ptr ${handle})`);
             B.line(`${self} = call ptr @scr_fiber_self()`);
+            // A native synchronous body owns its generator for the whole run (the
+            // ScrGen owns the frame), so its OUT slot address is fixed.
+            let out = null;
+            const yieldKind = fn.generator?.yieldT.kind;
+            if (!this.wasi &&
+                fn.async !== true &&
+                (yieldKind === "f64" || yieldKind === "date" || yieldKind === "bool")) {
+                this.declare(`declare ptr @scr_gen_of_fiber(ptr)`);
+                const gen = B.tmp();
+                B.line(`${gen} = call ptr @scr_gen_of_fiber(ptr ${self})`);
+                out = this.genOutSlot(gen);
+            }
             this.currentCoro = {
                 kind: fn.generator !== undefined ? "generator" : "async",
                 id,
@@ -4659,6 +5156,7 @@ export class LlEmitter {
                 finalLabel: B.newLabel("coro.final"),
                 cleanupLabel: B.newLabel("coro.cleanup"),
                 suspendLabel: B.newLabel("coro.suspend"),
+                out,
             };
         }
         const paramIds = new Set(fn.params.map((p) => p.localId));
@@ -4679,6 +5177,32 @@ export class LlEmitter {
             B.line(`${value} = load double, ptr @${mangleGlobal(global.id)}`);
             this.storeIntegerView(global.id, { name: value, type: global.type });
         }
+        // A number global only its guarded, synchronous initializer reads or
+        // writes (findInitializerBindings) is invisible to every other function,
+        // and reentry returns before reaching it, so a local slot can stand in
+        // for it: LLVM keeps it in a register across calls and loops that would
+        // otherwise force a store and reload per iteration. The global's
+        // storage is never read again, so nothing writes the slot back. Bindings
+        // proven int32 already live in an i32 local (localizedGlobals above);
+        // this covers the remaining doubles.
+        this.privateGlobalSlots.clear();
+        if (this.debug === null && this.currentCoro === null && !fn.async && !fn.generator) {
+            const conditional = initializerLocals.length ? conditionalLoopWrites(fn.body) : null;
+            for (const global of initializerLocals) {
+                if (localizedGlobals.has(global.id))
+                    continue;
+                // A conditional update in a loop stays a memory update (see
+                // conditionalLoopWrites).
+                if (conditional?.has(global.id))
+                    continue;
+                const slot = B.slot();
+                const value = B.tmp();
+                B.entryAllocas.push(`${slot} = alloca double ; module binding ${global.name}`);
+                B.line(`${value} = load double, ptr @${mangleGlobal(global.id)}`);
+                B.line(`store double ${value}, ptr ${slot}`);
+                this.privateGlobalSlots.set(global.id, slot);
+            }
+        }
         for (const local of this.currentLocals.values()) {
             // Boxed locals' slots hold their capture BOX (a ptr); captured
             // (env-borrowed) locals bind the incoming box below. A caught-typed
@@ -4691,6 +5215,9 @@ export class LlEmitter {
                     : this.llType(local.type);
             B.entryAllocas.push(`%${mangleLocal(local.id)} = alloca ${slotTy} ; ${local.name}`);
             this.emitDebugLocal(local, `%${mangleLocal(local.id)}`, fn.params.findIndex((p) => p.localId === local.id) + 1, this.captureIds.has(local.id));
+            // A localized initializer binding starts at its global's zero value.
+            if (localizedGlobals.has(local.id))
+                B.line(`store i32 0, ptr %${mangleLocal(local.id)}`);
             // Refcounted/boxed locals start NULL (the C prologue's `= NULL`):
             // scope-exit releases run whether or not an assign ever did.
             if (paramIds.has(local.id) || this.captureIds.has(local.id))
@@ -4910,9 +5437,17 @@ export class LlEmitter {
             attrs = `inlinehint ${attrs}`;
         const debug = this.debugScope === null ? "" : ` !dbg ${this.debugScope}`;
         const symbol = borrowed ? mangleBorrowedFunction(fn.name) : mangleFunction(fn.name);
+        this.privateGlobalSlots.clear();
         let body = `define internal ${ret} @${symbol}${int32Abi ? INT32_ABI_SUFFIX : ""}(${params.join(", ")}) ${attrs}${debug} { ; ${fn.name}\n${B.render()}\n}`;
         if (int32Abi)
             body += "\n" + this.emitInt32AbiWrapper(fn, symbol, int32Abi);
+        if (this.integerClones.members.has(fn.name)) {
+            body += "\n" + emitIntegerClone(fn, this, this.stackChecks?.has(fn.name) === true);
+            if (this.integerClones.dispatched.has(fn.name))
+                body +=
+                    "\n" +
+                        emitIntegerDispatcher(fn, this, `${symbol}${int32Abi ? INT32_ABI_SUFFIX : ""}`, int32Abi?.params ?? [], int32Abi?.result === true);
+        }
         if (!borrowed)
             return body;
         const slot = this.implSlotBorrowed(fn.name);
@@ -5477,6 +6012,17 @@ export class LlEmitter {
             this.releaseScope(scope);
     }
     emitStmt(s) {
+        const resume = this.speculationResume?.get(s);
+        if (resume && !resume.placed && !this.B.isTerminated()) {
+            // The fast copy's failed checks re-execute this statement here.
+            resume.placed = true;
+            this.B.br(resume.label);
+            this.B.startBlock(resume.label);
+        }
+        if (this.speculation?.writes.has(s)) {
+            this.emitSpeculativeWrite(s, this.speculation.resume.get(s));
+            return;
+        }
         const previous = this.B.debugLocation;
         this.B.debugLocation = this.debug?.location(s.loc, this.debugScope) ?? null;
         const loop = s.kind === "while" || s.kind === "doWhile" || s.kind === "for" || s.kind === "forOf";
@@ -5779,6 +6325,8 @@ export class LlEmitter {
                 // the replaced element itself). A local receiver that the index and
                 // value cannot rebind is read in place, as for field stores; the
                 // released element cannot reach that binding.
+                if (this.emitArraySelfConcat(s))
+                    break;
                 const arr = this.emitStableReceiver(s.arr, [s.index, s.value]);
                 const idx = this.emitExpr(s.index);
                 const v = this.emitExpr(s.value);
@@ -5813,7 +6361,7 @@ export class LlEmitter {
                 const resize = B.newLabel("arr.len.set"), done = B.newLabel("arr.len.done");
                 B.line(`${lenPtr} = getelementptr inbounds %ScrArr, ptr ${arr.name}, i32 0, i32 1`);
                 this.markMemoryPointer(lenPtr, "array:header");
-                B.line(`${len} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}`);
+                B.line(`${len} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}${this.arrayLengthRange}`);
                 B.line(`${lenNumber} = ${sizeToDouble(this.sizeType)} ${this.sizeType} ${len} to double`);
                 B.line(`${same} = fcmp oeq double ${length.name}, ${lenNumber}`);
                 B.condBr(same, done, resize);
@@ -5877,6 +6425,8 @@ export class LlEmitter {
                     this.storeInt32Field(ptr, v, s.value);
                     break;
                 }
+                if (this.emitFieldSelfConcat(s))
+                    break;
                 const obj = this.emitStableReceiver(s.obj, [s.value]);
                 const v = this.emitFieldValue(s.value, s.kind === "recordSet"
                     ? this.recordFieldInline(s.shapeId, s.field)
@@ -6103,57 +6653,61 @@ export class LlEmitter {
             }
             case "while": {
                 const workerBudget = this.workerLoopBudget(s);
-                const lc = B.newLabel("loop.c");
-                const lb = B.newLabel("loop.b");
                 const le = B.newLabel("loop.e");
-                const lp = workerBudget !== null ? B.newLabel("loop.p") : lc;
-                B.br(lc);
-                B.startBlock(lc);
-                B.condBr(this.emitCondition(s.cond), lb, le);
-                B.startBlock(lb);
-                this.jumpTargets.push({
-                    kind: "loop",
-                    brkLabel: le,
-                    contLabel: lp,
-                    labels: s.labels,
-                    frameDepth: this.frames.length,
-                    scopeDepth: this.scopes.length,
-                    finallyDepth: this.finallyStack.length,
-                });
-                this.emitBlock(s.body);
-                this.jumpTargets.pop();
-                B.br(lp);
-                if (lp !== lc) {
-                    B.startBlock(lp);
-                    this.emitWorkerLoopCheck(workerBudget);
+                this.emitLoopCopies(s, true, le, (exit) => {
+                    const lc = B.newLabel("loop.c");
+                    const lb = B.newLabel("loop.b");
+                    const lp = workerBudget !== null ? B.newLabel("loop.p") : lc;
                     B.br(lc);
-                }
+                    B.startBlock(lc);
+                    B.condBr(this.emitCondition(s.cond), lb, exit);
+                    B.startBlock(lb);
+                    this.jumpTargets.push({
+                        kind: "loop",
+                        brkLabel: exit,
+                        contLabel: lp,
+                        labels: s.labels,
+                        frameDepth: this.frames.length,
+                        scopeDepth: this.scopes.length,
+                        finallyDepth: this.finallyStack.length,
+                    });
+                    this.emitBlock(s.body);
+                    this.jumpTargets.pop();
+                    B.br(lp);
+                    if (lp !== lc) {
+                        B.startBlock(lp);
+                        this.emitWorkerLoopCheck(workerBudget);
+                        B.br(lc);
+                    }
+                });
                 B.startBlock(le);
                 break;
             }
             case "doWhile": {
                 const workerBudget = this.workerLoopBudget(s);
                 // Body first (runs at least once); continue jumps to the CONDITION.
-                const lb = B.newLabel("loop.b");
-                const lc = B.newLabel("loop.c");
                 const le = B.newLabel("loop.e");
-                B.br(lb);
-                B.startBlock(lb);
-                this.jumpTargets.push({
-                    kind: "loop",
-                    brkLabel: le,
-                    contLabel: lc,
-                    labels: s.labels,
-                    frameDepth: this.frames.length,
-                    scopeDepth: this.scopes.length,
-                    finallyDepth: this.finallyStack.length,
+                this.emitLoopCopies(s, true, le, (exit) => {
+                    const lb = B.newLabel("loop.b");
+                    const lc = B.newLabel("loop.c");
+                    B.br(lb);
+                    B.startBlock(lb);
+                    this.jumpTargets.push({
+                        kind: "loop",
+                        brkLabel: exit,
+                        contLabel: lc,
+                        labels: s.labels,
+                        frameDepth: this.frames.length,
+                        scopeDepth: this.scopes.length,
+                        finallyDepth: this.finallyStack.length,
+                    });
+                    this.emitBlock(s.body);
+                    this.jumpTargets.pop();
+                    B.br(lc);
+                    B.startBlock(lc);
+                    this.emitWorkerLoopCheck(workerBudget);
+                    B.condBr(this.emitCondition(s.cond), lb, exit);
                 });
-                this.emitBlock(s.body);
-                this.jumpTargets.pop();
-                B.br(lc);
-                B.startBlock(lc);
-                this.emitWorkerLoopCheck(workerBudget);
-                B.condBr(this.emitCondition(s.cond), lb, le);
                 B.startBlock(le);
                 break;
             }
@@ -6285,8 +6839,6 @@ export class LlEmitter {
                     for (const initializer of initializers)
                         this.emitStmt(initializer);
                 }
-                const lc = B.newLabel("loop.c");
-                const lb = B.newLabel("loop.b");
                 const le = B.newLabel("loop.e");
                 // JS `for (let i ...)`: each iteration gets a FRESH binding holding
                 // a copy of the previous one (closures made in iteration k keep
@@ -6313,70 +6865,76 @@ export class LlEmitter {
                     }
                 };
                 const workerBudget = this.workerLoopBudget(s);
-                const lu = s.update || capturedLets.length > 0 || workerBudget !== null ? B.newLabel("loop.u") : lc;
                 freshenBindings();
-                B.br(lc);
-                B.startBlock(lc);
-                if (integerLoop && integerSlot) {
-                    const receiver = this.emitStableReceiver(integerLoop.limitReceiver, []);
-                    const lenPtr = B.tmp();
-                    const len = B.tmp();
-                    const index = B.tmp();
-                    const inBounds = B.tmp();
-                    B.line(`${lenPtr} = getelementptr inbounds %${integerArrayLoop ? "ScrArr" : "ScrBytes"}, ptr ${receiver.name}, i64 0, i32 1`);
-                    if (integerArrayLoop)
-                        this.markMemoryPointer(lenPtr, "array:header");
-                    B.line(`${len} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}`);
-                    B.line(`${index} = load ${this.sizeType}, ptr ${integerSlot}`);
-                    B.line(`${inBounds} = icmp ult ${this.sizeType} ${index}, ${len}`);
-                    B.condBr(inBounds, lb, le);
-                }
-                else if (countedLoop && integerSlot && countedLimit) {
-                    const index = B.tmp();
-                    const inBounds = B.tmp();
-                    B.line(`${index} = load i64, ptr ${integerSlot}`);
-                    B.line(`${inBounds} = icmp ${countedLoop.step > 0 ? "slt" : "sgt"} i64 ${index}, ${countedLimit}`);
-                    B.condBr(inBounds, lb, le);
-                }
-                else if (s.cond)
-                    B.condBr(this.emitCondition(s.cond), lb, le);
-                else
-                    B.br(lb);
-                B.startBlock(lb);
-                this.jumpTargets.push({
-                    kind: "loop",
-                    brkLabel: le,
-                    contLabel: lu,
-                    labels: s.labels,
-                    frameDepth: this.frames.length,
-                    scopeDepth: this.scopes.length,
-                    finallyDepth: this.finallyStack.length,
-                });
-                this.emitBlock(s.body);
-                this.jumpTargets.pop();
-                B.br(lu);
-                if (lu !== lc) {
-                    B.startBlock(lu);
-                    this.emitWorkerLoopCheck(workerBudget);
-                    freshenBindings();
+                this.emitLoopCopies(s, capturedLets.length === 0, le, (exit) => {
+                    const lc = B.newLabel("loop.c");
+                    const lb = B.newLabel("loop.b");
+                    const lu = s.update || capturedLets.length > 0 || workerBudget !== null
+                        ? B.newLabel("loop.u")
+                        : lc;
+                    B.br(lc);
+                    B.startBlock(lc);
                     if (integerLoop && integerSlot) {
-                        const old = B.tmp();
-                        const next = B.tmp();
-                        B.line(`${old} = load ${this.sizeType}, ptr ${integerSlot}`);
-                        B.line(`${next} = add nuw ${this.sizeType} ${old}, 1`);
-                        B.line(`store ${this.sizeType} ${next}, ptr ${integerSlot}`);
+                        const receiver = this.emitStableReceiver(integerLoop.limitReceiver, []);
+                        const lenPtr = B.tmp();
+                        const len = B.tmp();
+                        const index = B.tmp();
+                        const inBounds = B.tmp();
+                        B.line(`${lenPtr} = getelementptr inbounds %${integerArrayLoop ? "ScrArr" : "ScrBytes"}, ptr ${receiver.name}, i64 0, i32 1`);
+                        if (integerArrayLoop)
+                            this.markMemoryPointer(lenPtr, "array:header");
+                        B.line(`${len} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}`);
+                        B.line(`${index} = load ${this.sizeType}, ptr ${integerSlot}`);
+                        B.line(`${inBounds} = icmp ult ${this.sizeType} ${index}, ${len}`);
+                        B.condBr(inBounds, lb, exit);
                     }
-                    else if (countedLoop && integerSlot) {
-                        const old = B.tmp();
-                        const next = B.tmp();
-                        B.line(`${old} = load i64, ptr ${integerSlot}`);
-                        B.line(`${next} = add nsw i64 ${old}, ${countedLoop.step}`);
-                        B.line(`store i64 ${next}, ptr ${integerSlot}`);
+                    else if (countedLoop && integerSlot && countedLimit) {
+                        const index = B.tmp();
+                        const inBounds = B.tmp();
+                        B.line(`${index} = load i64, ptr ${integerSlot}`);
+                        B.line(`${inBounds} = icmp ${countedLoop.step > 0 ? "slt" : "sgt"} i64 ${index}, ${countedLimit}`);
+                        B.condBr(inBounds, lb, exit);
                     }
-                    else if (s.update)
-                        this.emitStmt(s.update);
-                    B.br(lc);
-                }
+                    else if (s.cond)
+                        B.condBr(this.emitCondition(s.cond), lb, exit);
+                    else
+                        B.br(lb);
+                    B.startBlock(lb);
+                    this.jumpTargets.push({
+                        kind: "loop",
+                        brkLabel: exit,
+                        contLabel: lu,
+                        labels: s.labels,
+                        frameDepth: this.frames.length,
+                        scopeDepth: this.scopes.length,
+                        finallyDepth: this.finallyStack.length,
+                    });
+                    this.emitBlock(s.body);
+                    this.jumpTargets.pop();
+                    B.br(lu);
+                    if (lu !== lc) {
+                        B.startBlock(lu);
+                        this.emitWorkerLoopCheck(workerBudget);
+                        freshenBindings();
+                        if (integerLoop && integerSlot) {
+                            const old = B.tmp();
+                            const next = B.tmp();
+                            B.line(`${old} = load ${this.sizeType}, ptr ${integerSlot}`);
+                            B.line(`${next} = add nuw ${this.sizeType} ${old}, 1`);
+                            B.line(`store ${this.sizeType} ${next}, ptr ${integerSlot}`);
+                        }
+                        else if (countedLoop && integerSlot) {
+                            const old = B.tmp();
+                            const next = B.tmp();
+                            B.line(`${old} = load i64, ptr ${integerSlot}`);
+                            B.line(`${next} = add nsw i64 ${old}, ${countedLoop.step}`);
+                            B.line(`store i64 ${next}, ptr ${integerSlot}`);
+                        }
+                        else if (s.update)
+                            this.emitStmt(s.update);
+                        B.br(lc);
+                    }
+                });
                 B.startBlock(le);
                 this.releaseScope(this.scopes.pop());
                 if (integerLoop)
@@ -6439,7 +6997,7 @@ export class LlEmitter {
                     // The inline form of scr_arr_len, like the `length` intrinsic.
                     B.line(`${lenPtr} = getelementptr inbounds %ScrArr, ptr ${arr.name}, i32 0, i32 1`);
                     this.markMemoryPointer(lenPtr, "array:header");
-                    B.line(`${rawLen} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}`);
+                    B.line(`${rawLen} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}${this.arrayLengthRange}`);
                     B.line(`${len} = ${sizeToDouble(this.sizeType)} ${this.sizeType} ${rawLen} to double`);
                     B.line(`${inBounds} = fcmp olt double ${i}, ${len}`);
                     cur = i;
@@ -7146,6 +7704,118 @@ export class LlEmitter {
             return null;
         return this.emitExpr(packed.elems[0]);
     }
+    /**
+     * Lower `recv.f = recv.f + suffix` on a plain string field like
+     * emitStringSelfConcatAssign does for locals. The field's old value is
+     * snapshotted (+1) and the suffix evaluated in JavaScript order; then the
+     * field unlinks and releases its CURRENT value, so the snapshot is unique
+     * unless a real alias exists and the concat appends in place instead of
+     * copying the whole string on every append. Returns false (emitting
+     * nothing) for every other store.
+     */
+    emitFieldSelfConcat(s) {
+        const suffix = matchFieldSelfConcat(s);
+        if (!suffix || s.value.kind !== "strConcat")
+            return false;
+        let fieldType;
+        if (s.kind === "fieldSet") {
+            if (this.inlineUnions.classField(s.className, s.field) ||
+                this.classMeta.get(s.className)?.root.def.name === "%Error")
+                return false;
+            fieldType = classFieldIndex(this.classMetaOf(s.className), s.field).type;
+        }
+        else {
+            fieldType = this.recordShape(s.shapeId).fields.find((f) => f.name === s.field)?.type;
+        }
+        if (fieldType?.kind !== "string")
+            return false;
+        const B = this.B;
+        const obj = this.emitStableReceiver(s.obj, [s.value]);
+        const snapshot = this.emitExpr(s.value.left);
+        const parts = stringParts(suffix);
+        const mixed = parts.length > 1 || numberPart(parts[0]) !== null;
+        const inputs = mixed ? emitConcatInputs(this, parts) : [];
+        const right = mixed ? null : this.emitExpr(suffix);
+        if (s.kind === "fieldSet")
+            this.emitStoreGuard(obj.name, s);
+        else if (this.publishedTypes?.recordGuarded(s.shapeId) === true)
+            this.emitPublishedFieldGuard(obj.name, null, s.field);
+        const { ptr } = s.kind === "fieldSet"
+            ? this.classFieldPtr(obj.name, s.className, s.field)
+            : this.recordFieldPtr(obj.name, s.shapeId, s.field);
+        // Unlink, then release: nothing between here and the store below can
+        // run user code or observe the field (the concat only traps on OOM).
+        // Only an owned snapshot may survive the field's release.
+        const owned = this.ownsSnapshot(snapshot.name);
+        if (owned) {
+            const old = this.loadField(ptr, fieldType, false);
+            this.storeField(ptr, fieldType, "null", false);
+            this.releaseValue(old, fieldType);
+        }
+        let raw;
+        if (right === null) {
+            raw = emitMixedConcat(this, snapshot.name, inputs);
+        }
+        else {
+            this.declare(`declare ptr @scr_str_concat(ptr, ptr)`);
+            raw = B.tmp();
+            B.line(`${raw} = call ptr @scr_str_concat(ptr ${snapshot.name}, ptr ${right.name})`);
+        }
+        // The +1 result moves straight into the (now empty) field.
+        if (owned)
+            this.storeField(ptr, fieldType, raw, false);
+        else
+            this.replaceField(ptr, fieldType, false, this.own({ name: raw, type: fieldType }));
+        return true;
+    }
+    /** A snapshot the current statement frames own (+1), or an immortal
+     * value: it stays valid after its container releases the same string. */
+    ownsSnapshot(name) {
+        return (this.isImmortal(name) || this.frames.some((f) => f.some((v) => v.name === name && !v.slot)));
+    }
+    /**
+     * `a[i] = a[i] + suffix` on a string array (the canonical statement form
+     * of `a[i] += suffix`): the old element is snapshotted (+1) and the
+     * suffix evaluated in JavaScript order; then, when the slot still holds
+     * the snapshot, the array lets go of it (emitDenseSlotUnlink) so the
+     * concat can append in place, and the result is stored as usual.
+     */
+    emitArraySelfConcat(s) {
+        const value = s.value;
+        if (value.kind !== "strConcat" ||
+            value.type.kind !== "string" ||
+            value.left.type.kind !== "string" ||
+            value.right.type.kind !== "string" ||
+            s.arr.type.kind !== "array" ||
+            s.arr.type.elem.kind !== "string" ||
+            s.arr.kind !== "varRef" ||
+            s.index.kind !== "varRef" ||
+            !readsArraySlot(value.left, s.arr.localId, s.index.localId))
+            return false;
+        const elem = s.arr.type.elem;
+        const B = this.B;
+        const arr = this.emitStableReceiver(s.arr, [s.index, s.value]);
+        const idx = this.emitExpr(s.index);
+        const snapshot = this.emitExpr(value.left);
+        const parts = stringParts(value.right);
+        const mixed = parts.length > 1 || numberPart(parts[0]) !== null;
+        const inputs = mixed ? emitConcatInputs(this, parts) : [];
+        const right = mixed ? null : this.emitExpr(value.right);
+        this.emitPublishedArrayGuard(arr.name, s.arr.type, 0, idx.name);
+        if (this.ownsSnapshot(snapshot.name))
+            emitDenseSlotUnlink(this, arr.name, idx, s.index, snapshot.name, this.internLiteral(""), elem);
+        let raw;
+        if (right === null) {
+            raw = emitMixedConcat(this, snapshot.name, inputs);
+        }
+        else {
+            this.declare(`declare ptr @scr_str_concat(ptr, ptr)`);
+            raw = B.tmp();
+            B.line(`${raw} = call ptr @scr_str_concat(ptr ${snapshot.name}, ptr ${right.name})`);
+        }
+        emitDenseArraySet(this, arr.name, idx, s.index, "ref", elem, raw);
+        return true;
+    }
     /** `local = local + suffix` when the suffix cannot read or write the
      * local (an unboxed binding is only reachable through this function's own
      * expressions): reading the binding after the suffix gives the value the
@@ -7373,6 +8043,7 @@ export class LlEmitter {
             declare: (decl) => this.declare(decl),
             cstr: (text) => this.cstr(text),
             sizeType: this.sizeType,
+            rcAudit: this.shapeHost.objectAudit !== false,
             tracedShapes: this.tracedShapes,
             unionsById: this.unionsById,
             recordsById: this.recordsById,
@@ -8057,6 +8728,10 @@ export class LlEmitter {
     emitExpr(e) {
         return emitExpr(this, e);
     }
+    /** A fresh read-site cache for one constant-key dyn read. */
+    dynReadIcSite() {
+        return `@sc_dyn_read_ic_${this.dynReadIcSites++}`;
+    }
     dynKind(d) {
         return dynKind(this, d);
     }
@@ -8087,6 +8762,9 @@ export class LlEmitter {
     emitterFixedAdapter(cbT) {
         return emitterFixedAdapter(this, cbT);
     }
+    emitterOnceAdapter(boxerT) {
+        return emitterOnceAdapter(this, boxerT);
+    }
     wrapEmitterListener(target, adapterFn) {
         return wrapEmitterListener(this, target, adapterFn);
     }