@sofa-buffers/corelib 0.10.0 → 0.11.0

package/dist/index.js

@@ -10,26 +10,35 @@ __export(public_exports, {
   API_VERSION: () => API_VERSION,
   ARRAY_MAX: () => ARRAY_MAX,
   ArrayKind: () => ArrayKind,
-  Cursor: () => Cursor,
+  BlobSeq: () => BlobSeq,
   DecodeStatus: () => DecodeStatus,
+  ElementSeq: () => ElementSeq,
   FIXLEN_MAX: () => FIXLEN_MAX,
   FixlenSubtype: () => FixlenSubtype,
+  FramedSeq: () => FramedSeq,
   I64_MAX: () => I64_MAX,
   I64_MIN: () => I64_MIN,
   ID_MAX: () => ID_MAX,
   IStream: () => IStream,
   Long: () => Long,
   MAX_DEPTH: () => MAX_DEPTH,
+  MIN_OUTPUT_BUFFER: () => MIN_OUTPUT_BUFFER,
   OStream: () => OStream,
+  PayloadAcc: () => PayloadAcc,
   SofabError: () => SofabError,
   SofabErrorCode: () => SofabErrorCode,
+  StringSeq: () => StringSeq,
   U64_MAX: () => U64_MAX,
+  UNBOUNDED: () => UNBOUNDED,
   WireType: () => WireType,
   decode: () => decode,
+  decodeUtf8: () => decodeUtf8,
+  elementsEqual: () => elementsEqual,
+  fp32RawBytes: () => fp32RawBytes,
   getKernel: () => getKernel,
+  growingOStream: () => growingOStream,
   jsKernel: () => jsKernel,
-  loadNativeKernel: () => loadNativeKernel,
-  loadWasmKernel: () => loadWasmKernel,
+  longElementsEqual: () => longElementsEqual,
   setKernel: () => setKernel
 });
 
@@ -80,6 +89,9 @@ var U64_MAX = 0xffffffffffffffffn;
 var I64_MIN = -0x8000000000000000n;
 var I64_MAX = 0x7fffffffffffffffn;
 var VARINT_MAX_BYTES = 10;
+var MIN_OUTPUT_BUFFER = 1;
+var FP32_HANDLE_MIN = 64;
+var FP64_HANDLE_MIN = 16;
 var MAX_DEPTH = 255;
 var DecodeStatus = {
   /** The bytes ended exactly at a field boundary — a valid message. */
@@ -108,7 +120,8 @@ var SofabErrorCode = {
   /**
    * A receiver-configured decode limit was exceeded — a dynamic array, string or
    * blob on the wire claims more elements / bytes than the caller's
-   * {@link DecodeLimits} (`maxArrayCount` / `maxStringLen` / `maxBlobLen`)
+   * receiver cap (`max_dyn_array_count` / `max_dyn_string_len` /
+   * `max_dyn_blob_len`, §6.2.1 — stated by generated code, never by this codec)
    * allows. Deliberately distinct from {@link SofabErrorCode.InvalidMsg}:
    * exceeding a limit is *policy*, not wire malformation — the identical bytes
    * decode fine under a looser limit — so differential fuzzing must not read it
@@ -141,6 +154,34 @@ function limitExceededError(message) {
   return new SofabError(SofabErrorCode.LimitExceeded, message);
 }
 
+// src/varint/bits64.ts
+var SCRATCH = new ArrayBuffer(8);
+var S_U64 = new BigUint64Array(SCRATCH);
+var S_I64 = new BigInt64Array(SCRATCH);
+var S_U32 = new Uint32Array(SCRATCH);
+S_U64[0] = 0n;
+S_U32[0] = 1;
+var LO = S_U64[0] === 1n ? 0 : 1;
+var HI = LO ^ 1;
+function splitU64(value) {
+  S_U64[0] = value;
+  return S_U64[0] === value;
+}
+function splitI64(value) {
+  S_I64[0] = value;
+  return S_I64[0] === value;
+}
+function joinU64(lo, hi) {
+  S_U32[LO] = lo;
+  S_U32[HI] = hi;
+  return S_U64[0];
+}
+function joinI64(lo, hi) {
+  S_U32[LO] = lo;
+  S_U32[HI] = hi;
+  return S_I64[0];
+}
+
 // src/long.ts
 var _Long = class _Long {
   constructor(low, high) {
@@ -151,9 +192,14 @@ var _Long = class _Long {
   static fromBits(low, high) {
     return new _Long(low, high);
   }
-  /** Split a `bigint` into its low/high 32-bit halves (two's complement). */
+  /**
+   * Split a `bigint` into its low/high 32-bit halves (two's complement). The
+   * `BigInt64Array` store *is* `ToBigInt64` — reduction modulo 2^64 — so an
+   * out-of-range value keeps exactly the halves the masks kept (bits64).
+   */
   static fromBigInt(value) {
-    return new _Long(Number(value & 0xffffffffn) >>> 0, Number(value >> 32n & 0xffffffffn) >>> 0);
+    S_I64[0] = value;
+    return new _Long(S_U32[LO], S_U32[HI]);
   }
   /** From an integer `number` (`|n| < 2^53`); sign handled via `bigint` once. */
   static fromNumber(n) {
@@ -166,9 +212,7 @@ var _Long = class _Long {
   }
   /** Materialise as a `bigint`. `signed` reads the high bit as two's complement. */
   toBigInt(signed = false) {
-    let r = BigInt(this.high >>> 0) << 32n | BigInt(this.low >>> 0);
-    if (signed && (this.high & 2147483648) !== 0) r -= 0x10000000000000000n;
-    return r;
+    return signed ? joinI64(this.low, this.high) : joinU64(this.low, this.high);
   }
   /** Decimal string (`signed` interprets the high bit as two's complement). */
   toString(signed = false) {
@@ -186,50 +230,40 @@ _Long.ZERO = new _Long(0, 0);
 var Long = _Long;
 
 // src/varint/leb128.ts
-function varintSize(value) {
-  let lo = Number(value & 0xffffffffn) >>> 0;
-  let hi = Number(value >> 32n & 0xffffffffn) >>> 0;
-  let n = 0;
-  while (hi !== 0) {
-    n++;
-    const next = (lo >>> 7 | hi << 25) >>> 0;
-    hi >>>= 7;
-    lo = next;
+function varintSizeLoHi(lo, hi) {
+  if (hi === 0) {
+    return lo < 128 ? 1 : lo < 16384 ? 2 : lo < 2097152 ? 3 : lo < 268435456 ? 4 : 5;
   }
-  while (lo > 127) {
-    n++;
-    lo >>>= 7;
-  }
-  return n + 1;
-}
-function encodeVarint(value, out, pos) {
-  let lo = Number(value & 0xffffffffn) >>> 0;
-  let hi = Number(value >> 32n & 0xffffffffn) >>> 0;
-  while (hi !== 0) {
-    out[pos++] = lo & 127 | 128;
-    lo = (lo >>> 7 | hi << 25) >>> 0;
-    hi >>>= 7;
-  }
-  while (lo > 127) {
-    out[pos++] = lo & 127 | 128;
-    lo >>>= 7;
-  }
-  out[pos++] = lo;
-  return pos;
+  const h = hi >>> 3;
+  return h === 0 ? 5 : 5 + (h < 128 ? 1 : h < 16384 ? 2 : h < 2097152 ? 3 : h < 268435456 ? 4 : 5);
 }
 function encodeVarintLoHi(lo, hi, out, pos) {
   lo >>>= 0;
   hi >>>= 0;
-  while (hi !== 0) {
-    out[pos++] = lo & 127 | 128;
-    lo = (lo >>> 7 | hi << 25) >>> 0;
-    hi >>>= 7;
+  if (hi === 0) {
+    while (lo > 127) {
+      out[pos++] = lo & 127 | 128;
+      lo >>>= 7;
+    }
+    out[pos++] = lo;
+    return pos;
+  }
+  out[pos++] = lo & 127 | 128;
+  out[pos++] = lo >>> 7 & 127 | 128;
+  out[pos++] = lo >>> 14 & 127 | 128;
+  out[pos++] = lo >>> 21 & 127 | 128;
+  const b4 = lo >>> 28 | (hi & 7) << 4;
+  let h = hi >>> 3;
+  if (h === 0) {
+    out[pos++] = b4;
+    return pos;
   }
-  while (lo > 127) {
-    out[pos++] = lo & 127 | 128;
-    lo >>>= 7;
+  out[pos++] = b4 | 128;
+  while (h > 127) {
+    out[pos++] = h & 127 | 128;
+    h >>>= 7;
   }
-  out[pos++] = lo;
+  out[pos++] = h;
   return pos;
 }
 function varintSizeNum(value) {
@@ -259,51 +293,78 @@ function encodeVarintNum(value, out, pos) {
 }
 
 // src/varint/num64.ts
-var SCRATCH = new DataView(new ArrayBuffer(8));
+var SCRATCH_BUF = new ArrayBuffer(8);
+var SCRATCH2 = new DataView(SCRATCH_BUF);
+var SCRATCH_BYTES = new Uint8Array(SCRATCH_BUF);
+var SCRATCH_U32 = new Uint32Array(SCRATCH_BUF);
+var SCRATCH_F32 = new Float32Array(SCRATCH_BUF, 0, 1);
+var SCRATCH_F64 = new Float64Array(SCRATCH_BUF);
 function toBigInt(value) {
   if (typeof value === "bigint") return value;
   if (!Number.isInteger(value)) {
-    throw new RangeError(`expected an integer, got ${value}`);
+    throw argumentError(`expected an integer, got ${value}`);
   }
   return BigInt(value);
 }
-function inU64(value) {
-  return value >= 0n && value <= U64_MAX;
-}
-function inI64(value) {
-  return value >= I64_MIN && value <= I64_MAX;
-}
 function packFp32(out, pos, value) {
-  SCRATCH.setFloat32(0, value, true);
-  out[pos] = SCRATCH.getUint8(0);
-  out[pos + 1] = SCRATCH.getUint8(1);
-  out[pos + 2] = SCRATCH.getUint8(2);
-  out[pos + 3] = SCRATCH.getUint8(3);
+  SCRATCH2.setFloat32(0, value, true);
+  out[pos] = SCRATCH_BYTES[0];
+  out[pos + 1] = SCRATCH_BYTES[1];
+  out[pos + 2] = SCRATCH_BYTES[2];
+  out[pos + 3] = SCRATCH_BYTES[3];
   return pos + 4;
 }
 function packFp64(out, pos, value) {
-  SCRATCH.setFloat64(0, value, true);
-  for (let i = 0; i < 8; i++) out[pos + i] = SCRATCH.getUint8(i);
+  SCRATCH2.setFloat64(0, value, true);
+  out[pos] = SCRATCH_BYTES[0];
+  out[pos + 1] = SCRATCH_BYTES[1];
+  out[pos + 2] = SCRATCH_BYTES[2];
+  out[pos + 3] = SCRATCH_BYTES[3];
+  out[pos + 4] = SCRATCH_BYTES[4];
+  out[pos + 5] = SCRATCH_BYTES[5];
+  out[pos + 6] = SCRATCH_BYTES[6];
+  out[pos + 7] = SCRATCH_BYTES[7];
   return pos + 8;
 }
-function unpackFp32(buf, pos) {
-  SCRATCH.setUint8(0, buf[pos]);
-  SCRATCH.setUint8(1, buf[pos + 1]);
-  SCRATCH.setUint8(2, buf[pos + 2]);
-  SCRATCH.setUint8(3, buf[pos + 3]);
-  return SCRATCH.getFloat32(0, true);
+function fp32Bits(value) {
+  SCRATCH2.setFloat32(0, value, true);
+  return SCRATCH2.getUint32(0, true);
+}
+function fp64BitsLo(value) {
+  SCRATCH2.setFloat64(0, value, true);
+  return SCRATCH2.getUint32(0, true);
+}
+function fp64BitsHi(value) {
+  SCRATCH2.setFloat64(0, value, true);
+  return SCRATCH2.getUint32(4, true);
 }
-function unpackFp64(buf, pos) {
-  for (let i = 0; i < 8; i++) SCRATCH.setUint8(i, buf[pos + i]);
-  return SCRATCH.getFloat64(0, true);
+function fp32FromBits(bits) {
+  SCRATCH_U32[0] = bits;
+  return SCRATCH_F32[0];
+}
+function fp32RawBytes(bits) {
+  const out = new Uint8Array(4);
+  out[0] = bits & 255;
+  out[1] = bits >>> 8 & 255;
+  out[2] = bits >>> 16 & 255;
+  out[3] = bits >>> 24 & 255;
+  return out;
+}
+function fp64FromBits(lo, hi) {
+  SCRATCH_U32[LO] = lo;
+  SCRATCH_U32[HI] = hi;
+  return SCRATCH_F64[0];
 }
 
 // src/varint/zigzag.ts
-function zigzagEncode(value) {
-  return (value << 1n ^ value >> 63n) & U64_MAX;
-}
-function zigzagDecode(value) {
-  return value >> 1n ^ -(value & 1n);
+function encodeZigzagVarintLoHi(lo, hi, out, pos) {
+  const sgn = -(hi >>> 31) >>> 0;
+  return encodeVarintLoHi(
+    (lo << 1 >>> 0 ^ sgn) >>> 0,
+    ((hi << 1 | lo >>> 31) >>> 0 ^ sgn) >>> 0,
+    out,
+    pos
+  );
 }
 
 // src/backend/js.ts
@@ -311,36 +372,161 @@ var SIGNED_FAST_MAX = 4503599627370496;
 var jsKernel = {
   name: "js",
   encodeUnsignedVarints(values, out, pos) {
-    for (let i = 0; i < values.length; i++) {
+    const n = values.length;
+    const ctor = values.constructor;
+    if (ctor === BigUint64Array) {
+      const a = values;
+      const h = new Uint32Array(a.buffer, a.byteOffset, a.length * 2);
+      for (let i = 0; i < n; i++) {
+        pos = encodeVarintLoHi(h[i * 2 + LO], h[i * 2 + HI], out, pos);
+      }
+      return pos;
+    }
+    if (ctor === Uint8Array || ctor === Uint16Array || ctor === Uint32Array) {
+      const a = values;
+      for (let i = 0; i < n; i++) {
+        let v = a[i];
+        while (v > 127) {
+          out[pos++] = v & 127 | 128;
+          v >>>= 7;
+        }
+        out[pos++] = v;
+      }
+      return pos;
+    }
+    for (let i = 0; i < n; i++) {
       const v = values[i];
       if (typeof v === "number" && v >= 0 && v <= Number.MAX_SAFE_INTEGER && Number.isInteger(v)) {
         pos = encodeVarintNum(v, out, pos);
-      } else {
-        pos = encodeVarint(toBigInt(v), out, pos);
+        continue;
+      }
+      const b = toBigInt(v);
+      if (!splitU64(b)) throw argumentError(`unsigned value ${b} out of range`);
+      let lo = S_U32[LO];
+      const hi = S_U32[HI];
+      if (hi === 0) {
+        while (lo > 127) {
+          out[pos++] = lo & 127 | 128;
+          lo >>>= 7;
+        }
+        out[pos++] = lo;
+        continue;
       }
+      out[pos++] = lo & 127 | 128;
+      out[pos++] = lo >>> 7 & 127 | 128;
+      out[pos++] = lo >>> 14 & 127 | 128;
+      out[pos++] = lo >>> 21 & 127 | 128;
+      const b4 = lo >>> 28 | (hi & 7) << 4;
+      let h = hi >>> 3;
+      if (h === 0) {
+        out[pos++] = b4;
+        continue;
+      }
+      out[pos++] = b4 | 128;
+      while (h > 127) {
+        out[pos++] = h & 127 | 128;
+        h >>>= 7;
+      }
+      out[pos++] = h;
     }
     return pos;
   },
   encodeSignedVarints(values, out, pos) {
+    const ctorS = values.constructor;
+    if (ctorS === BigInt64Array) {
+      const a = values;
+      const h = new Uint32Array(a.buffer, a.byteOffset, a.length * 2);
+      for (let i = 0; i < a.length; i++) {
+        pos = encodeZigzagVarintLoHi(h[i * 2 + LO], h[i * 2 + HI], out, pos);
+      }
+      return pos;
+    }
+    if (ctorS === Int8Array || ctorS === Int16Array || ctorS === Int32Array) {
+      const a = values;
+      const n = a.length;
+      for (let i = 0; i < n; i++) {
+        const x = a[i];
+        let z = (x << 1 ^ x >> 31) >>> 0;
+        while (z > 127) {
+          out[pos++] = z & 127 | 128;
+          z >>>= 7;
+        }
+        out[pos++] = z;
+      }
+      return pos;
+    }
     for (let i = 0; i < values.length; i++) {
       const v = values[i];
       if (typeof v === "number" && v >= -SIGNED_FAST_MAX && v <= SIGNED_FAST_MAX && Number.isInteger(v)) {
         pos = encodeVarintNum(v >= 0 ? v * 2 : -v * 2 - 1, out, pos);
       } else {
-        pos = encodeVarint(zigzagEncode(toBigInt(v)), out, pos);
+        const b = toBigInt(v);
+        if (!splitI64(b)) throw argumentError(`signed value ${b} out of range`);
+        pos = encodeZigzagVarintLoHi(S_U32[LO], S_U32[HI], out, pos);
       }
     }
     return pos;
   },
+  // Both float packers take one `DataView` over the destination *once the run is
+  // long enough to pay for it* — the language-forced handle of CORELIB_PLAN §6.6.2,
+  // and the only way to place an IEEE-754 value at a byte offset. It carries no
+  // message bytes (the storage is the caller's) and no wire number sizes it.
+  //
+  // The threshold is arithmetic, not taste. Measured on Node 24:
+  // `new DataView(buf.buffer, off, len)` costs **129 ns**, while the handle saves
+  // 1.9 ns per `fp32` (4.11 -> 2.23) and 7.3 ns per `fp64` (10.48 -> 3.20). So it
+  // breaks even at ~68 `fp32` and ~18 `fp64` elements; below that the scratch route
+  // wins, and a two-element array through a handle is a pessimisation.
   packFp32Array(values, out, pos) {
-    for (let i = 0; i < values.length; i++) {
-      pos = packFp32(out, pos, values[i]);
+    const n = values.length;
+    if (values instanceof Float32Array) {
+      if (n < FP32_HANDLE_MIN) {
+        let w2 = null;
+        for (let i = 0; i < n; i++) {
+          const v = values[i];
+          if (v === v) {
+            pos = packFp32(out, pos, v);
+            continue;
+          }
+          if (w2 === null) w2 = new Uint32Array(values.buffer, values.byteOffset, n);
+          const x = w2[i];
+          out[pos] = x;
+          out[pos + 1] = x >>> 8;
+          out[pos + 2] = x >>> 16;
+          out[pos + 3] = x >>> 24;
+          pos += 4;
+        }
+        return pos;
+      }
+      const w = new Uint32Array(values.buffer, values.byteOffset, n);
+      const dv2 = new DataView(out.buffer, out.byteOffset, out.byteLength);
+      for (let i = 0; i < n; i++) {
+        dv2.setUint32(pos, w[i], true);
+        pos += 4;
+      }
+      return pos;
+    }
+    if (n < FP32_HANDLE_MIN) {
+      for (let i = 0; i < n; i++) pos = packFp32(out, pos, values[i]);
+      return pos;
+    }
+    const dv = new DataView(out.buffer, out.byteOffset, out.byteLength);
+    for (let i = 0; i < n; i++) {
+      dv.setFloat32(pos, values[i], true);
+      pos += 4;
     }
     return pos;
   },
   packFp64Array(values, out, pos) {
-    for (let i = 0; i < values.length; i++) {
-      pos = packFp64(out, pos, values[i]);
+    const n = values.length;
+    if (n < FP64_HANDLE_MIN) {
+      for (let i = 0; i < n; i++) pos = packFp64(out, pos, values[i]);
+      return pos;
+    }
+    const dv = new DataView(out.buffer, out.byteOffset, out.byteLength);
+    for (let i = 0; i < n; i++) {
+      dv.setFloat64(pos, values[i], true);
+      pos += 8;
     }
     return pos;
   }
@@ -370,19 +556,18 @@ function validateKernel(kernel) {
 }
 
 // src/encode/fixlen.ts
-var UTF8 = new TextEncoder();
 function unpairedSurrogate(index) {
   return argumentError(
     `unpaired surrogate at index ${index}: string value is not valid UTF-8`
   );
 }
-function encodeUtf8(text) {
-  utf8Length(text);
-  return UTF8.encode(text);
-}
 function utf8Length(text) {
-  let len = 0;
-  for (let i = 0; i < text.length; i++) {
+  const n = text.length;
+  let a = 0;
+  while (a < n && text.charCodeAt(a) < 128) a++;
+  if (a === n) return n;
+  let len = a;
+  for (let i = a; i < n; i++) {
     const c = text.charCodeAt(i);
     if (c < 128) {
       len += 1;
@@ -405,7 +590,17 @@ function utf8Length(text) {
   return len;
 }
 function utf8Write(text, out, pos) {
-  for (let i = 0; i < text.length; i++) {
+  const n = text.length;
+  let a = 0;
+  while (a < n) {
+    const c = text.charCodeAt(a);
+    if (c >= 128) break;
+    out[pos + a] = c;
+    a++;
+  }
+  pos += a;
+  if (a === n) return pos;
+  for (let i = a; i < n; i++) {
     let c = text.charCodeAt(i);
     if (c < 128) {
       out[pos++] = c;
@@ -434,68 +629,139 @@ function utf8Write(text, out, pos) {
   }
   return pos;
 }
+function utf8WriteSink(text, sink) {
+  const n = text.length;
+  for (let i = 0; i < n; i++) {
+    let c = text.charCodeAt(i);
+    if (c < 128) {
+      sink.putByte(c);
+    } else if (c < 2048) {
+      sink.putByte(192 | c >> 6);
+      sink.putByte(128 | c & 63);
+    } else if (c >= 55296 && c <= 56319) {
+      const c2 = i + 1 < n ? text.charCodeAt(i + 1) : 0;
+      if (c2 >= 56320 && c2 <= 57343) {
+        i++;
+        c = 65536 + (c - 55296 << 10) + (c2 - 56320);
+        sink.putByte(240 | c >> 18);
+        sink.putByte(128 | c >> 12 & 63);
+        sink.putByte(128 | c >> 6 & 63);
+        sink.putByte(128 | c & 63);
+      } else {
+        throw unpairedSurrogate(i);
+      }
+    } else if (c >= 56320 && c <= 57343) {
+      throw unpairedSurrogate(i);
+    } else {
+      sink.putByte(224 | c >> 12);
+      sink.putByte(128 | c >> 6 & 63);
+      sink.putByte(128 | c & 63);
+    }
+  }
+}
 
 // src/encode/ostream.ts
-var DEFAULT_CAPACITY = 256;
 var SIGNED_FAST_MAX2 = 4503599627370496;
+function checkHandover(buffer, offset, streaming, carried) {
+  if (offset < 0 || offset > buffer.length) {
+    throw argumentError(`offset ${offset} out of range`);
+  }
+  if (!Number.isInteger(carried) || carried < 0 || carried > offset) {
+    throw argumentError(`carried ${carried} out of range 0..${offset}`);
+  }
+  if (streaming && buffer.length - offset < MIN_OUTPUT_BUFFER) {
+    throw argumentError(
+      `output buffer with a flush sink has ${buffer.length - offset} usable byte(s), below MIN_OUTPUT_BUFFER (${MIN_OUTPUT_BUFFER})`
+    );
+  }
+}
 var OStream = class {
+  /**
+   * Encoder over a caller buffer, optionally draining to `flush` as it fills.
+   *
+   * Those are the only two buffer models there are (CORELIB_PLAN §5.1.1): the
+   * buffer the caller hands over, and whatever a sink installs in its place
+   * (§5.1.5). There is no third parameter through which the encoder could be
+   * given something to enlarge — growing a destination from a write path is what
+   * §6.6's second violation row names, whoever owns the allocator.
+   *
+   * Constructing one is the only allocating step (§6.6): it sizes the hold-back
+   * run from `MAX_DEPTH` and reads the active kernel once. No `write*` call after
+   * that allocates anything.
+   */
   constructor(buffer, offset = 0, flush) {
     this.depth = 0;
-    /**
-     * Ids of the innermost open sequences whose header has not been written yet
-     * (MESSAGE_SPEC §2 lazy framing, {@link OStream.writeSequenceBeginLazy}).
-     * Always a contiguous suffix of the open sequences: writing any field commits
-     * the whole run at once, so {@link OStream.writeSequenceEnd} can drop the
-     * innermost one by dropping the last entry. Held-back ids are encoder state,
-     * never buffer content, so a flush can never split a run.
-     *
-     * Storage plus an explicit count rather than `push`/`pop`, so the slots are
-     * reused across messages (no allocation on a pooled encoder) and so
-     * {@link OStream.commitPending} can zero the count *before* it writes.
-     *
-     * The array grows on demand and is bounded only by `MAX_DEPTH` — there is no
-     * fixed hold-back window and hence no eager-framing fallback, which is what
-     * CORELIB_PLAN §6 ("How deep the hold-back reaches") demands of an
-     * implementation that can allocate: canonical output at *every* depth.
-     */
-    this.pending = [];
     /** Valid entries in {@link OStream.pending}. */
     this.nPending = 0;
+    /**
+     * How many buffer installations {@link OStream.setBuffer} has made. Only ever
+     * compared for equality across the flush callback, which is how
+     * {@link OStream.flush} tells "the sink copied and returned" from "the sink
+     * took the buffer and installed a replacement" — the one distinction §5.1
+     * rests the handover contract on, and the one that decides whether the start
+     * offset was consumed or re-armed.
+     */
+    this.installs = 0;
     this.kernel = getKernel();
-    if (buffer === void 0) {
-      this.buf = new Uint8Array(DEFAULT_CAPACITY);
-      this.start = 0;
-      this.pos = 0;
-      this.flushSink = void 0;
-      this.canGrow = true;
-    } else {
-      if (offset < 0 || offset > buffer.length) {
-        throw argumentError(`offset ${offset} out of range`);
-      }
-      this.buf = buffer;
-      this.start = offset;
-      this.pos = offset;
-      this.flushSink = flush;
-      this.canGrow = false;
-    }
+    this.pending = new Array(MAX_DEPTH);
+    checkHandover(buffer, offset, flush !== void 0, 0);
+    this.buf = buffer;
+    this.start = offset;
+    this.origin = offset;
+    this.pos = offset;
+    this.flushSink = flush;
   }
-  /** Bytes currently held in the buffer (since construction or the last flush). */
+  /** Bytes of the message currently held in the buffer (see {@link bytes}). */
   get bytesUsed() {
-    return this.pos - this.start;
+    return this.pos - this.origin;
   }
   /**
-   * The encoded message so far, as a view into the working buffer.
-   * Meaningful for the in-memory mode; in streaming mode it is only the
-   * not-yet-flushed tail. The view is valid until the next write.
+   * The encoded message so far, as a view into the working buffer: everything
+   * written since construction, the last {@link reset}, or the last flush the
+   * sink returned from without installing a buffer. With a flush sink that is
+   * normally only the not-yet-flushed tail; on a stream whose sink hands back a
+   * replacement carrying the earlier bytes — the accumulator `growingOStream`
+   * builds — it is the whole message. The view is valid until the next write.
    */
   bytes() {
-    return this.buf.subarray(this.start, this.pos);
+    return this.buf.subarray(this.origin, this.pos);
   }
-  /** Drain buffered bytes to the flush sink (no-op without one). */
+  /**
+   * Drain buffered bytes to the flush sink (no-op without one).
+   *
+   * A sink that returns **without** installing a buffer has copied what it was
+   * handed, so the encoder keeps writing into the same buffer — resuming at
+   * offset **0**. The start offset belongs to the *installation*, not to the
+   * buffer (CORELIB_PLAN §5.1): the buffer-set that armed it — the constructor
+   * or {@link OStream.setBuffer} — reserved room in the unit it began, and
+   * handing that unit over consumes the reservation. A sink that wants header
+   * room in *every* unit re-arms it by calling `setBuffer(buf, offset)` from
+   * inside the callback, a new installation like any other; a bare return must
+   * not do it implicitly, or the leading bytes would be capacity the rest of the
+   * stream could never use and the two shapes would be indistinguishable.
+   */
   flush() {
+    this.drain(0);
+  }
+  /**
+   * {@link flush}, plus the number of contiguous bytes the caller wants at the
+   * cursor afterwards — `0` when it wants none in particular.
+   *
+   * Split out from the public `flush` so the figure cannot be invented by a
+   * caller: it is the encoder's own reserve request, and a sink that sizes a
+   * replacement from it (`growingOStream`) has to be able to trust it. Everything
+   * else is identical, including that a sink which returns without installing has
+   * *copied* and the cursor resumes at `0`.
+   */
+  drain(needed) {
     if (this.flushSink && this.pos > this.start) {
-      this.flushSink(this.buf.subarray(this.start, this.pos));
-      this.pos = this.start;
+      const installed = this.installs;
+      this.flushSink(this.buf, this.start, this.pos, needed);
+      if (this.installs === installed) {
+        this.start = 0;
+        this.origin = 0;
+        this.pos = 0;
+      }
     }
   }
   /**
@@ -505,14 +771,42 @@ var OStream = class {
    * without interruption. `offset` reserves space at the front of the new
    * buffer. Any not-yet-flushed bytes in the old buffer are dropped, so
    * {@link flush} first (the flush callback fires before you swap).
+   *
+   * Every call is a **new installation**, and its `offset` applies to the unit
+   * it begins and is consumed when that unit is flushed (CORELIB_PLAN §5.1).
+   * Passing the buffer the encoder already has is an installation like any
+   * other: that is how a sink gets header room in *every* flushed unit — one
+   * framing header per packet — where returning bare would resume at `0`.
+   *
+   * On a stream that has a flush sink the new buffer must leave at least
+   * {@link MIN_OUTPUT_BUFFER} usable bytes (`buffer.length - offset`); a smaller
+   * one is rejected here, with {@link SofabErrorCode.Argument}, leaving the
+   * encoder on the buffer it already had. A sink-less stream has no minimum.
+   *
+   * `carried` says how many bytes **immediately before `offset`** the
+   * replacement already holds of *this* message — normally `0`, because a fresh
+   * buffer holds none. A caller that keeps the whole message in one growing
+   * store passes the length it copied across, so {@link bytes} keeps reporting
+   * the message rather than only the piece written after the swap. It changes
+   * nothing on the wire and nothing about flushing: the next flush still begins
+   * at `offset`. `growingOStream` is the caller this exists for; it is the
+   * §5.1.5 handover, not a growth hook inside the encoder (§6.6).
+   *
+   * The accumulating stream `growingOStream` builds is an ordinary streaming
+   * stream, so this works on it too, and means exactly what it means anywhere
+   * else: the not-yet-flushed bytes in the old buffer are dropped, encoding
+   * continues into yours, and its sink takes over growing *that* one from the
+   * next flush — reserve offset included, since what it copies out is the
+   * message rather than the buffer. Encode into a plain
+   * `new OStream(buffer, offset, flush?)` to keep the buffer yours instead.
    */
-  setBuffer(buffer, offset = 0) {
-    if (offset < 0 || offset > buffer.length) {
-      throw argumentError(`offset ${offset} out of range`);
-    }
+  setBuffer(buffer, offset = 0, carried = 0) {
+    checkHandover(buffer, offset, this.flushSink !== void 0, carried);
     this.buf = buffer;
     this.start = offset;
+    this.origin = offset - carried;
     this.pos = offset;
+    this.installs++;
   }
   /**
    * Rewind the encoder to empty, reusing the existing buffer. Lets a caller pool
@@ -520,7 +814,8 @@ var OStream = class {
    * encode. Any view previously returned by {@link bytes} is invalidated.
    */
   reset() {
-    this.pos = this.start;
+    this.pos = this.origin;
+    this.start = this.origin;
     this.depth = 0;
     this.nPending = 0;
   }
@@ -533,9 +828,11 @@ var OStream = class {
       return;
     }
     const v = toBigInt(value);
-    if (!inU64(v)) throw argumentError(`unsigned value ${v} out of 64-bit range`);
+    if (!splitU64(v)) throw argumentError(`unsigned value ${v} out of 64-bit range`);
+    const lo = S_U32[LO];
+    const hi = S_U32[HI];
     this.header(id, WireType.Unsigned);
-    this.putVarint(v);
+    this.putVarintLoHi(lo, hi);
   }
   /** Write a signed integer field (zig-zag encoded). */
   writeSigned(id, value) {
@@ -545,9 +842,44 @@ var OStream = class {
       return;
     }
     const v = toBigInt(value);
-    if (!inI64(v)) throw argumentError(`signed value ${v} out of 64-bit range`);
+    if (!splitI64(v)) throw argumentError(`signed value ${v} out of 64-bit range`);
+    const lo = S_U32[LO];
+    const hi = S_U32[HI];
+    const sgn = -(hi >>> 31) >>> 0;
+    const zLo = (lo << 1 >>> 0 ^ sgn) >>> 0;
+    const zHi = ((hi << 1 | lo >>> 31) >>> 0 ^ sgn) >>> 0;
+    this.header(id, WireType.Signed);
+    this.putVarintLoHi(zLo, zHi);
+  }
+  /**
+   * Write an unsigned 64-bit scalar from a {@link Long} — the `bigint`-free twin
+   * of {@link writeUnsigned}, and the scalar counterpart of
+   * {@link writeUnsignedArrayLong}. Produces the identical wire.
+   *
+   * There is no range check and no scratch round-trip: a `Long` *is* two 32-bit
+   * halves, so it is in the `uint64` domain by construction — which is the whole
+   * of what `splitU64` decides for a `number | bigint`. The halves go straight
+   * into the varint writer, so nothing is allocated per value. Nothing needs
+   * copying out ahead of `header` either, for the same reason the array writers
+   * do not: the halves come off a caller-owned immutable `Long`, not the shared
+   * scratch a re-entrant flush sink could overwrite.
+   */
+  writeUnsignedLong(id, value) {
+    this.header(id, WireType.Unsigned);
+    this.putVarintLoHi(value.low, value.high);
+  }
+  /**
+   * Write a signed 64-bit scalar (zig-zag) from a {@link Long} — the
+   * `bigint`-free twin of {@link writeSigned}, and the scalar counterpart of
+   * {@link writeSignedArrayLong}. Zig-zag `(n << 1) ^ (n >> 63)` is computed on
+   * the lo/hi pair, so the varint goes out at its exact size (a fixed caller
+   * buffer must not see a 10-byte demand for a 2-byte field) and no `bigint` is
+   * created. A `Long` carries exactly 64 bits, so as in {@link writeUnsignedLong}
+   * there is nothing left to range-check.
+   */
+  writeSignedLong(id, value) {
     this.header(id, WireType.Signed);
-    this.putVarint(zigzagEncode(v));
+    this.putZigzagVarintLoHi(value.low, value.high);
   }
   /** Write a boolean field (encoded as the unsigned value 0 or 1). */
   writeBoolean(id, value) {
@@ -557,69 +889,161 @@ var OStream = class {
   /** Write an IEEE-754 32-bit float field. */
   writeFp32(id, value) {
     this.fixlenHead(id, 4, FixlenSubtype.Fp32);
-    this.ensure(4);
-    this.pos = packFp32(this.buf, this.pos, value);
+    this.putFp32(value);
+  }
+  /**
+   * Write an fp32 field from its raw wire bits — the 4 little-endian payload
+   * bytes as one 32-bit word, which is exactly what {@link Visitor.fp32} delivers
+   * as `bits`.
+   *
+   * This is the re-encode half of the bit-exactness rule (CORELIB_PLAN §6.5). A JS
+   * `number` is a 64-bit double, and widening an fp32 **signaling** NaN into one
+   * quiets it, so re-encoding through {@link writeFp32} cannot reproduce such a
+   * payload; the bits go out verbatim here, so decode → re-encode is byte-for-byte
+   * for every fp32 value, sNaN included. §6.5 requires this path of every
+   * double-only target, and names it: "a 32-bit bits accessor".
+   */
+  writeFp32Bits(id, bits) {
+    this.fixlenHead(id, 4, FixlenSubtype.Fp32);
+    this.putFp32Bits(bits >>> 0);
   }
   /** Write an IEEE-754 64-bit double field. */
   writeFp64(id, value) {
     this.fixlenHead(id, 8, FixlenSubtype.Fp64);
-    this.ensure(8);
-    this.pos = packFp64(this.buf, this.pos, value);
+    this.putFp64(value);
   }
   /** Write a UTF-8 string field. */
   writeString(id, text) {
-    if (this.canGrow) {
-      const byteLen = utf8Length(text);
-      if (byteLen > FIXLEN_MAX) {
-        throw argumentError(`fixlen length ${byteLen} exceeds ${FIXLEN_MAX}`);
+    const n = text.length;
+    let a = 0;
+    while (a < n && text.charCodeAt(a) < 128) a++;
+    if (a === n) {
+      if (n > FIXLEN_MAX) {
+        throw argumentError(`fixlen length ${n} exceeds ${FIXLEN_MAX}`);
+      }
+      this.fixlenHead(id, n, FixlenSubtype.String);
+      if (this.reserveBulk(n)) {
+        const buf = this.buf;
+        const p = this.pos;
+        for (let k = 0; k < n; k++) buf[p + k] = text.charCodeAt(k);
+        this.pos = p + n;
+        return;
       }
-      this.fixlenHead(id, byteLen, FixlenSubtype.String);
-      this.ensure(byteLen);
+      utf8WriteSink(text, this);
+      return;
+    }
+    const byteLen = utf8Length(text);
+    if (byteLen > FIXLEN_MAX) {
+      throw argumentError(`fixlen length ${byteLen} exceeds ${FIXLEN_MAX}`);
+    }
+    this.fixlenHead(id, byteLen, FixlenSubtype.String);
+    if (this.reserveBulk(byteLen)) {
       this.pos = utf8Write(text, this.buf, this.pos);
       return;
     }
-    this.writeFixlen(id, encodeUtf8(text), FixlenSubtype.String);
+    utf8WriteSink(text, this);
   }
   /** Write a blob (arbitrary bytes) field. */
   writeBlob(id, data) {
     this.writeFixlen(id, data, FixlenSubtype.Blob);
   }
-  /** Write a fixed-length field of the given subtype from raw bytes. */
+  /**
+   * Write a fixed-length field of the given subtype from raw bytes.
+   *
+   * This is the byte-level entry point — the one writer that takes the subtype
+   * from the caller rather than picking it — so the payload is checked
+   * **against that subtype** before a byte is written, and it cannot emit a
+   * `fixlen_word` a conformant decoder must reject (`ARGUMENT`, §6.3):
+   *
+   * * subtypes `0x4`–`0x7` are **reserved** — a decoder must treat a field
+   *   carrying one as malformed (`INVALID`, §4.6/§5.2);
+   * * `Fp32` / `Fp64` payloads are **exactly** 4 / 8 bytes — any other declared
+   *   length for those subtypes is malformed, rejected the moment the word is
+   *   read (§4.6);
+   * * `String` / `Blob` take any length up to `FIXLEN_MAX`.
+   *
+   * The typed writers ({@link writeFp32}, {@link writeFp64},
+   * {@link writeString}) are correct by construction and go straight to the
+   * header; only {@link writeBlob}, whose subtype is unconstrained anyway,
+   * shares this path.
+   */
   writeFixlen(id, data, subtype) {
-    if (data.length > FIXLEN_MAX) {
+    if (subtype >>> 0 > FixlenSubtype.Blob || !Number.isInteger(subtype)) {
+      throw argumentError(`fixlen subtype ${subtype} is reserved (\xA74.6: 0x0..0x3)`);
+    }
+    if (subtype === FixlenSubtype.Fp32 || subtype === FixlenSubtype.Fp64) {
+      const want = subtype === FixlenSubtype.Fp32 ? 4 : 8;
+      if (data.length !== want) {
+        throw argumentError(
+          `fixlen ${subtype === FixlenSubtype.Fp32 ? "fp32" : "fp64"} payload must be exactly ${want} bytes, got ${data.length}`
+        );
+      }
+    } else if (data.length > FIXLEN_MAX) {
       throw argumentError(`fixlen length ${data.length} exceeds ${FIXLEN_MAX}`);
     }
     this.fixlenHead(id, data.length, subtype);
     this.writeRaw(data);
   }
   // --- arrays -------------------------------------------------------------
-  /** Write an array of unsigned integers (each a varint). */
+  /**
+   * Write an array of unsigned integers (each a varint).
+   *
+   * **The bulk kernel writes a whole array in one pass and cannot flush**, so it
+   * runs only where everything is known to fit. Three cases, and none of them
+   * asks the source how wide its elements are:
+   *
+   * * **block mode** (no sink) — the buffer is meant to hold the whole message,
+   *   so the kernel always runs and the buffer's length is the bound, checked
+   *   after the fact. A message that does not fit is `BUFFER_FULL`, which is
+   *   precisely this mode's answer.
+   * * **a stream with room** — `VARINT_MAX_BYTES` per element is the true
+   *   worst case for any 64-bit value, and a *growing* stream always satisfies
+   *   it because it grows to whatever is asked.
+   * * **a chunk too small for that** — fill it to the last byte, hand it over,
+   *   carry on, splitting an element where it falls. That is not a fallback but
+   *   the mode's contract: `MIN_OUTPUT_BUFFER` is 1.
+   *
+   * What is gone is the fourth case, which asked `values.constructor` for a
+   * narrower bound so the kernel would run on a tightly-sized chunk. `constructor`
+   * is an ordinary property, an `ArrayLike` can claim any width, and a wrong
+   * answer silently truncated the message — §5.1's "partial output handed back as
+   * complete". The block mode now reaches the kernel without needing the number
+   * at all, which is where a tightly-sized buffer actually lives.
+   */
   writeUnsignedArray(id, values) {
     this.arrayHead(id, WireType.ArrayUnsigned, values.length);
-    if (this.canGrow) {
-      this.ensure(values.length * VARINT_MAX_BYTES);
+    if (this.flushSink === void 0) {
+      this.pos = this.bulkEnd(
+        this.kernel.encodeUnsignedVarints(values, this.buf, this.pos),
+        values.length
+      );
+    } else if (this.reserveBulk(values.length * VARINT_MAX_BYTES)) {
       this.pos = this.kernel.encodeUnsignedVarints(values, this.buf, this.pos);
     } else {
       for (let i = 0; i < values.length; i++) {
         const v = toBigInt(values[i]);
-        if (!inU64(v)) throw argumentError(`unsigned value ${v} out of range`);
-        this.ensure(VARINT_MAX_BYTES);
-        this.pos = encodeVarint(v, this.buf, this.pos);
+        if (!splitU64(v)) throw argumentError(`unsigned value ${v} out of range`);
+        const lo = S_U32[LO];
+        const hi = S_U32[HI];
+        this.putVarintLoHi(lo, hi);
       }
     }
   }
-  /** Write an array of signed integers (each zig-zag + varint). */
+  /** Write an array of signed integers (each zig-zag + varint). See {@link writeUnsignedArray}. */
   writeSignedArray(id, values) {
     this.arrayHead(id, WireType.ArraySigned, values.length);
-    if (this.canGrow) {
-      this.ensure(values.length * VARINT_MAX_BYTES);
+    if (this.flushSink === void 0) {
+      this.pos = this.bulkEnd(
+        this.kernel.encodeSignedVarints(values, this.buf, this.pos),
+        values.length
+      );
+    } else if (this.reserveBulk(values.length * VARINT_MAX_BYTES)) {
       this.pos = this.kernel.encodeSignedVarints(values, this.buf, this.pos);
     } else {
       for (let i = 0; i < values.length; i++) {
         const v = toBigInt(values[i]);
-        if (!inI64(v)) throw argumentError(`signed value ${v} out of range`);
-        this.ensure(VARINT_MAX_BYTES);
-        this.pos = encodeVarint(zigzagEncode(v), this.buf, this.pos);
+        if (!splitI64(v)) throw argumentError(`signed value ${v} out of range`);
+        this.putZigzagVarintLoHi(S_U32[LO], S_U32[HI]);
       }
     }
   }
@@ -630,14 +1054,20 @@ var OStream = class {
    */
   writeUnsignedArrayLong(id, values) {
     this.arrayHead(id, WireType.ArrayUnsigned, values.length);
-    this.ensure(values.length * VARINT_MAX_BYTES);
-    let pos = this.pos;
-    const buf = this.buf;
-    for (let i = 0; i < values.length; i++) {
-      const v = values[i];
-      pos = encodeVarintLoHi(v.low, v.high, buf, pos);
+    if (this.reserveBulk(values.length * VARINT_MAX_BYTES)) {
+      let pos = this.pos;
+      const buf = this.buf;
+      for (let i = 0; i < values.length; i++) {
+        const v = values[i];
+        pos = encodeVarintLoHi(v.low, v.high, buf, pos);
+      }
+      this.pos = pos;
+    } else {
+      for (let i = 0; i < values.length; i++) {
+        const v = values[i];
+        this.putVarintLoHi(v.low, v.high);
+      }
     }
-    this.pos = pos;
   }
   /**
    * Write a signed 64-bit array (zig-zag) from {@link Long}[] — the `bigint`-free
@@ -645,32 +1075,33 @@ var OStream = class {
    */
   writeSignedArrayLong(id, values) {
     this.arrayHead(id, WireType.ArraySigned, values.length);
-    this.ensure(values.length * VARINT_MAX_BYTES);
-    let pos = this.pos;
-    const buf = this.buf;
-    for (let i = 0; i < values.length; i++) {
-      const v = values[i];
-      const lo = v.low;
-      const hi = v.high;
-      const sgn = -(hi >>> 31) >>> 0;
-      const zLo = (lo << 1 >>> 0 ^ sgn) >>> 0;
-      const zHi = ((hi << 1 | lo >>> 31) >>> 0 ^ sgn) >>> 0;
-      pos = encodeVarintLoHi(zLo, zHi, buf, pos);
+    if (this.reserveBulk(values.length * VARINT_MAX_BYTES)) {
+      let pos = this.pos;
+      const buf = this.buf;
+      for (let i = 0; i < values.length; i++) {
+        const v = values[i];
+        pos = encodeZigzagVarintLoHi(v.low, v.high, buf, pos);
+      }
+      this.pos = pos;
+    } else {
+      for (let i = 0; i < values.length; i++) {
+        const v = values[i];
+        this.putZigzagVarintLoHi(v.low, v.high);
+      }
     }
-    this.pos = pos;
   }
   /** Write an array of IEEE-754 32-bit floats. */
   writeFp32Array(id, values) {
+    if (values instanceof Float32Array) {
+      this.writeFp32Words(id, values);
+      return;
+    }
     this.arrayHead(id, WireType.ArrayFixlen, values.length);
     this.putVarintNum(4 * 8 + FixlenSubtype.Fp32);
-    if (this.canGrow) {
-      this.ensure(values.length * 4);
+    if (this.reserveBulk(values.length * 4)) {
       this.pos = this.kernel.packFp32Array(values, this.buf, this.pos);
     } else {
-      for (let i = 0; i < values.length; i++) {
-        this.ensure(4);
-        this.pos = packFp32(this.buf, this.pos, values[i]);
-      }
+      for (let i = 0; i < values.length; i++) this.putFp32(values[i]);
     }
   }
   /**
@@ -694,14 +1125,10 @@ var OStream = class {
   writeFp64Array(id, values) {
     this.arrayHead(id, WireType.ArrayFixlen, values.length);
     this.putVarintNum(8 * 8 + FixlenSubtype.Fp64);
-    if (this.canGrow) {
-      this.ensure(values.length * 8);
+    if (this.reserveBulk(values.length * 8)) {
       this.pos = this.kernel.packFp64Array(values, this.buf, this.pos);
     } else {
-      for (let i = 0; i < values.length; i++) {
-        this.ensure(8);
-        this.pos = packFp64(this.buf, this.pos, values[i]);
-      }
+      for (let i = 0; i < values.length; i++) this.putFp64(values[i]);
     }
   }
   // --- sequences ----------------------------------------------------------
@@ -725,7 +1152,7 @@ var OStream = class {
     if (this.depth >= MAX_DEPTH) {
       throw argumentError(`nesting exceeds MAX_DEPTH (${MAX_DEPTH})`);
     }
-    if (id < 0 || id > ID_MAX || !Number.isInteger(id)) {
+    if (id >>> 0 !== id || id > ID_MAX) {
       throw argumentError(`field id ${id} out of range 0..${ID_MAX}`);
     }
     this.pending[this.nPending++] = id;
@@ -783,15 +1210,230 @@ var OStream = class {
     if (this.depth > 0) this.depth--;
   }
   // --- internals ----------------------------------------------------------
-  /** Ensure exactly `value`'s varint size, then write it (bigint path). */
-  putVarint(value) {
-    this.ensure(varintSize(value));
-    this.pos = encodeVarint(value, this.buf, this.pos);
-  }
   /** Ensure exactly `value`'s varint size, then write it (number fast path). */
   putVarintNum(value) {
-    this.ensure(varintSizeNum(value));
-    this.pos = encodeVarintNum(value, this.buf, this.pos);
+    const pos = this.pos;
+    if (value < 128 && pos < this.buf.length) {
+      this.buf[pos] = value;
+      this.pos = pos + 1;
+      return;
+    }
+    this.putVarintNumSlow(value);
+  }
+  /**
+   * The multi-byte / needs-room tail of {@link putVarintNum}, kept in its own
+   * method so the single-byte test above stays small enough for the JIT to
+   * inline into every `header` / `fixlenHead` / `arrayHead` call site.
+   */
+  putVarintNumSlow(value) {
+    if (this.tryEnsure(varintSizeNum(value))) {
+      this.pos = encodeVarintNum(value, this.buf, this.pos);
+      return;
+    }
+    while (value > 127) {
+      this.putByte(value % 128 | 128);
+      value = Math.floor(value / 128);
+    }
+    this.putByte(value);
+  }
+  /**
+   * Write a 64-bit value, held as two 32-bit halves, as a varint.
+   *
+   * Deliberately just a bounds check and two calls: this is what the array
+   * loops call per element, and it only pays its way while it is small enough
+   * for the JIT to inline. Spelling the drain case out here instead — three
+   * more lines — cost 16-19% on an array streamed through a 32/64-byte buffer,
+   * where most elements take the fast path and want it inlined.
+   */
+  putVarintLoHi(lo, hi) {
+    if (this.buf.length - this.pos >= VARINT_MAX_BYTES) {
+      this.pos = encodeVarintLoHi(lo, hi, this.buf, this.pos);
+      return;
+    }
+    this.putVarintLoHiSlow(lo, hi);
+  }
+  /**
+   * A full buffer that is nonetheless wide enough to hold any varint: drain it
+   * and retry the worst case, which is exactly what `ensure(VARINT_MAX_BYTES)`
+   * did before §5.1 and is still the common streaming case. Sizing the value
+   * first instead — the narrow-buffer path in {@link putVarintLoHiTight} — cost
+   * +125 instructions on every element of an array streamed through a
+   * one-element-wide buffer.
+   */
+  putVarintLoHiSlow(lo, hi) {
+    if (this.buf.length - this.start >= VARINT_MAX_BYTES) {
+      this.flush();
+      if (this.buf.length - this.pos >= VARINT_MAX_BYTES) {
+        this.pos = encodeVarintLoHi(lo, hi, this.buf, this.pos);
+        return;
+      }
+    }
+    this.putVarintLoHiTight(lo, hi);
+  }
+  /**
+   * Zig-zag {@link putVarintLoHi}: `(n << 1) ^ (n >> 63)` on the halves. Keeps
+   * its own worst-case fast path so the signed array loop reaches the combined
+   * zig-zag-and-encode writer directly, exactly as it did before; the drain and
+   * narrow-buffer cases are the same for both signs, so they are shared.
+   */
+  putZigzagVarintLoHi(lo, hi) {
+    if (this.buf.length - this.pos >= VARINT_MAX_BYTES) {
+      this.pos = encodeZigzagVarintLoHi(lo, hi, this.buf, this.pos);
+      return;
+    }
+    const sgn = -(hi >>> 31) >>> 0;
+    this.putVarintLoHi(
+      (lo << 1 >>> 0 ^ sgn) >>> 0,
+      ((hi << 1 | lo >>> 31) >>> 0 ^ sgn) >>> 0
+    );
+  }
+  /**
+   * The narrow-buffer tail of {@link putVarintLoHi}: the buffer could not hold a
+   * worst-case varint even empty. Sizing the value exactly keeps such a buffer
+   * from flushing for room it does not need; only when it cannot hold the varint
+   * *at all* does the value get split across flushes, seven bits at a time.
+   */
+  putVarintLoHiTight(lo, hi) {
+    lo >>>= 0;
+    hi >>>= 0;
+    if (this.tryEnsure(varintSizeLoHi(lo, hi))) {
+      this.pos = encodeVarintLoHi(lo, hi, this.buf, this.pos);
+      return;
+    }
+    for (; ; ) {
+      const more = hi !== 0 || lo > 127;
+      this.putByte(more ? lo & 127 | 128 : lo);
+      if (!more) return;
+      lo = (lo >>> 7 | hi << 25) >>> 0;
+      hi >>>= 7;
+    }
+  }
+  /**
+   * Write the 4 little-endian bytes of an fp32 (§4.6).
+   *
+   * Through the shared scratch, not a `DataView` over the buffer: building that
+   * handle costs ~129 ns against the ~2 ns it saves on one value (§6.6.2 allows the
+   * handle, arithmetic forbids it here). The bulk array path amortizes one over the
+   * whole run instead — see the kernel.
+   */
+  putFp32(value) {
+    if (this.buf.length - this.pos >= 4) {
+      this.pos = packFp32(this.buf, this.pos, value);
+      return;
+    }
+    this.putFp32Slow(value);
+  }
+  putFp32Slow(value) {
+    if (this.tryEnsure(4)) {
+      this.pos = packFp32(this.buf, this.pos, value);
+      return;
+    }
+    this.putFp32Bits(fp32Bits(value));
+  }
+  /**
+   * Write the 4 little-endian bytes of an fp32 held as a 32-bit word (§4.6) — the
+   * path {@link OStream.writeFp32Bits} takes, and the tail of
+   * {@link OStream.putFp32Slow}.
+   */
+  putFp32Bits(bits) {
+    if (this.buf.length - this.pos >= 4) {
+      const buf = this.buf;
+      let p = this.pos;
+      buf[p++] = bits & 255;
+      buf[p++] = bits >>> 8 & 255;
+      buf[p++] = bits >>> 16 & 255;
+      buf[p++] = bits >>> 24;
+      this.pos = p;
+      return;
+    }
+    this.putByte(bits & 255);
+    this.putByte(bits >>> 8 & 255);
+    this.putByte(bits >>> 16 & 255);
+    this.putByte(bits >>> 24);
+  }
+  /**
+   * {@link writeFp32Array} for a `Float32Array` source: its own 32-bit words go
+   * out, never a `number`, which is what keeps a signaling NaN intact (§6.5) —
+   * on the bulk path (the kernel copies words too) and on the streamed one alike,
+   * so a small buffer produces the one-shot bytes (§5.1.4).
+   *
+   * Kept to the header and the bulk call, the streaming loop in its own method:
+   * with the loop in this body an 8-element one-shot array cost +416 Ir/op
+   * (+8.8%) over the pre-#185 encoder, split like this +1.1% (Callgrind).
+   */
+  writeFp32Words(id, values) {
+    this.arrayHead(id, WireType.ArrayFixlen, values.length);
+    this.putVarintNum(4 * 8 + FixlenSubtype.Fp32);
+    if (this.reserveBulk(values.length * 4)) {
+      this.pos = this.kernel.packFp32Array(values, this.buf, this.pos);
+    } else {
+      this.putFp32Words(values);
+    }
+  }
+  /**
+   * The streamed half of {@link writeFp32Words}: one `Uint32Array` over the
+   * source per call, the same handle the bulk kernel takes (§6.6.2); reading it gives each word's value whatever the
+   * host byte order, and the shifts below store it little-endian. The words go
+   * out one run per stretch of free buffer, with `buf`/`pos` in locals, and the
+   * split points are {@link putFp32}'s: drain when fewer than 4 bytes are free,
+   * split an element byte by byte only when the buffer itself is narrower than 4.
+   */
+  putFp32Words(values) {
+    const w = new Uint32Array(values.buffer, values.byteOffset, values.length);
+    const n = w.length;
+    let i = 0;
+    while (i < n) {
+      if (this.buf.length - this.pos < 4 && !this.tryEnsure(4)) {
+        this.putFp32Bits(w[i++]);
+        continue;
+      }
+      const buf = this.buf;
+      let p = this.pos;
+      const end = Math.min(n, i + (buf.length - p >> 2));
+      for (; i < end; i++) {
+        const b = w[i];
+        buf[p] = b & 255;
+        buf[p + 1] = b >>> 8 & 255;
+        buf[p + 2] = b >>> 16 & 255;
+        buf[p + 3] = b >>> 24;
+        p += 4;
+      }
+      this.pos = p;
+    }
+  }
+  /** Write the 8 little-endian bytes of an fp64 (§4.6) — see {@link putFp32}. */
+  putFp64(value) {
+    if (this.buf.length - this.pos >= 8) {
+      this.pos = packFp64(this.buf, this.pos, value);
+      return;
+    }
+    this.putFp64Slow(value);
+  }
+  putFp64Slow(value) {
+    if (this.tryEnsure(8)) {
+      this.pos = packFp64(this.buf, this.pos, value);
+      return;
+    }
+    const lo = fp64BitsLo(value);
+    const hi = fp64BitsHi(value);
+    this.putByte(lo & 255);
+    this.putByte(lo >>> 8 & 255);
+    this.putByte(lo >>> 16 & 255);
+    this.putByte(lo >>> 24);
+    this.putByte(hi & 255);
+    this.putByte(hi >>> 8 & 255);
+    this.putByte(hi >>> 16 & 255);
+    this.putByte(hi >>> 24);
+  }
+  /**
+   * Append one byte, draining to the sink first when the buffer is full.
+   *
+   * @internal Public only because {@link utf8WriteSink} writes through it — the
+   * narrow-buffer string path (§5.1.3). Not part of the field-writing API.
+   */
+  putByte(b) {
+    if (this.pos === this.buf.length) this.ensureSome(1);
+    this.buf[this.pos++] = b;
   }
   /**
    * Write a field header, the `(id << 3) | wireType` tag, as a varint.
@@ -810,7 +1452,7 @@ var OStream = class {
    * {@link OStream.writeSequenceBeginLazy}, which writes no byte at all.
    */
   header(id, type) {
-    if (id < 0 || id > ID_MAX || !Number.isInteger(id)) {
+    if (id >>> 0 !== id || id > ID_MAX) {
       throw argumentError(`field id ${id} out of range 0..${ID_MAX}`);
     }
     if (this.nPending !== 0) this.commitPending();
@@ -827,8 +1469,9 @@ var OStream = class {
   commitPending() {
     const n = this.nPending;
     this.nPending = 0;
+    const pending = this.pending;
     for (let i = 0; i < n; i++) {
-      this.putVarintNum(this.pending[i] * 8 + WireType.SequenceStart);
+      this.putVarintNum(pending[i] * 8 + WireType.SequenceStart);
     }
   }
   fixlenHead(id, length, subtype) {
@@ -842,332 +1485,335 @@ var OStream = class {
     this.header(id, type);
     this.putVarintNum(count);
   }
-  /** Copy `data` out, flushing/growing as needed (large payloads stay chunked). */
+  /**
+   * Copy `data` out, flushing/growing as needed (large payloads stay chunked).
+   *
+   * The whole-payload case — the common one, and the only one on a buffer sized
+   * from `MAX_SIZE` or on the accumulator — is a single `set` of the caller's
+   * array: a `memcpy`, and no view at all.
+   *
+   * **A payload split across flushes takes a per-piece view: a language-forced
+   * handle under CORELIB_PLAN §6.6.2.** `TypedArray.set` is the only `memcpy`
+   * this language exposes and it takes a *typed array* as its source, so copying a
+   * *range* of one needs a `subarray` — §6.6.2's "the only way to name a region of
+   * the caller's buffer is a wrapper over it". It has the two properties that
+   * clause requires: it carries no message bytes (the storage is the caller's, on
+   * both ends) and no wire number sizes it (a handle over a thousand bytes costs
+   * what a handle over ten costs). The allocation-free alternative is a byte loop,
+   * measured at 358 MB/s against 10,963 MB/s for `set`.
+   *
+   * It never leaves this method: `set` consumes it and no caller can reach it, so
+   * §6.7's ban on exposing a value that outlives its callback is untouched — and so
+   * is §5.1.6, which is why the copy happens at all rather than the payload being
+   * handed to the sink. §6.6.2 asks the port to make such handles visible rather
+   * than invisible: the README itemises it (§9.6) and `heap-free-codec.test.ts`
+   * pins its count and kind.
+   */
   writeRaw(data) {
+    const total = data.length;
     let off = 0;
-    while (off < data.length) {
-      const room = this.ensureSome(data.length - off);
-      this.buf.set(data.subarray(off, off + room), this.pos);
+    while (off < total) {
+      const room = this.ensureSome(total - off);
+      if (off === 0 && room === total) {
+        this.buf.set(data, this.pos);
+      } else {
+        this.buf.set(data.subarray(off, off + room), this.pos);
+      }
       this.pos += room;
       off += room;
     }
   }
-  /** Ensure `n` contiguous bytes are free at `pos`; returns `pos` for chaining. */
-  ensure(n) {
-    if (this.buf.length - this.pos >= n) return this.pos;
-    this.flush();
-    if (this.buf.length - this.pos >= n) return this.pos;
-    if (this.canGrow) {
-      this.growTo(this.pos + n);
-      return this.pos;
-    }
-    throw bufferFullError(
-      `output buffer full: need ${n} more bytes, have ${this.buf.length - this.pos}`
-    );
+  /**
+   * Make room for `n` contiguous bytes at `pos` if the buffer can hold them at
+   * all: `true` when it can (flushing or growing as needed), `false` when a
+   * fixed caller buffer is simply smaller than `n` and the value must be split
+   * across flushes instead — CORELIB_PLAN §5.1 puts the floor on the output
+   * buffer at a single byte, so no write may demand a contiguous run.
+   *
+   * The one case that still fails is a buffer with no sink to drain to: there is
+   * nowhere for a split to put the earlier bytes, so it reports BufferFull here,
+   * before anything is written, exactly as {@link ensure} did.
+   */
+  tryEnsure(n) {
+    if (this.buf.length - this.pos >= n) return true;
+    this.drain(n);
+    if (this.buf.length - this.pos >= n) return true;
+    if (this.flushSink === void 0) {
+      throw bufferFullError(
+        `output buffer full: need ${n} more bytes, have ${this.buf.length - this.pos}`
+      );
+    }
+    return false;
   }
-  /** Ensure *some* room (up to `want`); returns how many bytes are available. */
-  ensureSome(want) {
-    let room = this.buf.length - this.pos;
-    if (room === 0) {
-      this.flush();
-      room = this.buf.length - this.pos;
-      if (room === 0) {
-        if (this.canGrow) {
-          this.growTo(this.pos + want);
-          room = this.buf.length - this.pos;
-        } else {
-          throw bufferFullError("output buffer full");
-        }
-      }
-    }
-    return Math.min(room, want);
-  }
-  growTo(needed) {
-    let cap = this.buf.length * 2;
-    if (cap < needed) cap = needed;
-    const next = new Uint8Array(cap);
-    next.set(this.buf.subarray(0, this.pos));
-    this.buf = next;
+  /**
+   * Reserve `n` contiguous bytes for a bulk write — the whole payload of an
+   * array or a string, written in one pass into a buffer that cannot move under
+   * it. Every caller has an element-at-a-time route to fall back on when this
+   * says no, producing the identical bytes, so a `false` here is never an error.
+   *
+   * The room already at the cursor counts on **any** buffer, which is what makes
+   * the one-shot `new OStream(buf)` case — a caller buffer sized from the
+   * schema's `MAX_SIZE`, the shape CORELIB_PLAN §5.1 puts first — the fast one:
+   * without it a message encoded into a caller's own buffer took `TextEncoder`
+   * for every string and the element loop for every array, measured at 1.9 µs
+   * against 0.16 µs for the same five-field message.
+   *
+   * Beyond that room only a **sink** may be asked, and only by draining. Emptying
+   * the buffer is the one thing that can produce room without an allocation
+   * anywhere (§6.6), and it is legal wherever this is called — every caller has
+   * just written a complete header, so the cursor is on a boundary between atomic
+   * units (§5.1.3). A sink that installs a larger replacement (§5.1.5) therefore
+   * re-opens the bulk route by itself, which is how the accumulating helper keeps
+   * it. Nothing is *demanded*: a `false` sends the caller down its
+   * element-at-a-time route, which produces the identical bytes, so a fixed
+   * buffer too narrow for the worst case never turns into a spurious
+   * `BUFFER_FULL`.
+   */
+  reserveBulk(n) {
+    if (this.buf.length - this.pos >= n) return true;
+    if (this.flushSink === void 0) return false;
+    this.drain(n);
+    return this.buf.length - this.pos >= n;
   }
-};
-
-// src/decode/fast.ts
-var TWO32 = 4294967296;
-function decodeContiguous(buf, root, limits) {
-  new FastDecoder(buf, limits).run(root);
-}
-var FastDecoder = class {
-  constructor(buf, limits) {
-    this.p = 0;
-    // Last varint, as two unsigned 32-bit halves (see readVarint).
-    this.lo = 0;
-    this.hi = 0;
-    this.buf = buf;
-    this.n = buf.length;
-    this.view = new DataView(buf.buffer, buf.byteOffset, buf.length);
-    this.maxArrayCount = limits?.maxArrayCount ?? Infinity;
-    this.maxStringLen = limits?.maxStringLen ?? Infinity;
-    this.maxBlobLen = limits?.maxBlobLen ?? Infinity;
-  }
-  run(root) {
-    const stack = [root];
-    let top = root;
-    while (this.p < this.n) {
-      this.readVarint();
-      const type = this.lo & 7;
-      if (type === WireType.SequenceEnd) {
-        if (stack.length <= 1) throw invalidMsgError("unbalanced sequence end");
-        top.sequenceEnd?.();
-        stack.pop();
-        top = stack[stack.length - 1];
-        continue;
-      }
-      const id = this.upper();
-      if (id > ID_MAX) throw invalidMsgError(`field id ${id} out of range`);
-      switch (type) {
-        case WireType.Unsigned: {
-          this.readVarint();
-          top.unsigned?.(id, this.unsignedValue());
-          break;
-        }
-        case WireType.Signed: {
-          this.readVarint();
-          top.signed?.(id, this.signedValue());
-          break;
-        }
-        case WireType.Fixlen: {
-          this.readVarint();
-          const sub = this.lo & 7;
-          const len = this.upper();
-          if (sub > FixlenSubtype.Blob) throw invalidMsgError(`invalid fixlen subtype ${sub}`);
-          if (len > FIXLEN_MAX) throw invalidMsgError("fixlen length out of range");
-          if (sub === FixlenSubtype.String && len > this.maxStringLen) {
-            throw limitExceededError(`string length ${len} exceeds maxStringLen ${this.maxStringLen}`);
-          }
-          if (sub === FixlenSubtype.Blob && len > this.maxBlobLen) {
-            throw limitExceededError(`blob length ${len} exceeds maxBlobLen ${this.maxBlobLen}`);
-          }
-          if (sub === FixlenSubtype.Fp32 || sub === FixlenSubtype.Fp64) {
-            const want = sub === FixlenSubtype.Fp32 ? 4 : 8;
-            if (len !== want) throw invalidMsgError("fixlen float length mismatch");
-            if (sub === FixlenSubtype.Fp32) {
-              const p = this.p;
-              const value = this.readFp32();
-              top.fp32?.(id, value, top.fp32Raw ? this.buf.subarray(p, p + 4) : void 0);
-            } else {
-              const value = this.readFp64();
-              top.fp64?.(id, value);
-            }
-          } else {
-            const chunk = this.take(len);
-            if (sub === FixlenSubtype.String) top.string?.(id, len, 0, chunk);
-            else top.blob?.(id, len, 0, chunk);
-          }
-          break;
-        }
-        case WireType.ArrayUnsigned: {
-          const count = this.arrayCount();
-          top.arrayBegin?.(id, ArrayKind.Unsigned, count);
-          for (let i = 0; i < count; i++) {
-            this.readVarint();
-            top.arrayUnsigned?.(id, i, this.unsignedValue());
-          }
-          top.arrayEnd?.(id);
-          break;
-        }
-        case WireType.ArraySigned: {
-          const count = this.arrayCount();
-          top.arrayBegin?.(id, ArrayKind.Signed, count);
-          for (let i = 0; i < count; i++) {
-            this.readVarint();
-            top.arraySigned?.(id, i, this.signedValue());
-          }
-          top.arrayEnd?.(id);
-          break;
-        }
-        case WireType.ArrayFixlen: {
-          const count = this.arrayCount();
-          this.readVarint();
-          const sub = this.lo & 7;
-          const size = this.upper();
-          let kind;
-          if (sub === FixlenSubtype.Fp32 && size === 4) kind = ArrayKind.Fp32;
-          else if (sub === FixlenSubtype.Fp64 && size === 8) kind = ArrayKind.Fp64;
-          else throw invalidMsgError("invalid fixlen array element type");
-          top.arrayBegin?.(id, kind, count);
-          if (kind === ArrayKind.Fp32) {
-            const wantRaw = top.fp32Raw === true;
-            for (let i = 0; i < count; i++) {
-              const p = this.p;
-              const value = this.readFp32();
-              top.arrayFp32?.(id, i, value, wantRaw ? this.buf.subarray(p, p + 4) : void 0);
-            }
-          } else {
-            for (let i = 0; i < count; i++) {
-              const value = this.readFp64();
-              top.arrayFp64?.(id, i, value);
-            }
-          }
-          top.arrayEnd?.(id);
-          break;
-        }
-        case WireType.SequenceStart: {
-          if (stack.length - 1 >= MAX_DEPTH) {
-            throw invalidMsgError(`nesting exceeds MAX_DEPTH (${MAX_DEPTH})`);
-          }
-          const child = top.sequenceBegin?.(id);
-          top = child ?? top;
-          stack.push(top);
-          break;
-        }
-        default:
-          throw invalidMsgError(`invalid wire type ${type}`);
-      }
-    }
-    if (stack.length > 1) throw incompleteError("truncated message: unbalanced sequence");
-  }
-  // --- field helpers ------------------------------------------------------
-  /** Read and validate an array count word (0..ARRAY_MAX; §4.7/§4.8). */
-  arrayCount() {
-    this.readVarint();
-    const count = this.num();
-    if (count > ARRAY_MAX) throw invalidMsgError("array count out of range");
-    if (count > this.maxArrayCount) {
-      throw limitExceededError(`array count ${count} exceeds maxArrayCount ${this.maxArrayCount}`);
-    }
-    return count;
-  }
-  /** Hand back a zero-copy view of the next `len` bytes, advancing the cursor. */
-  take(len) {
-    const start = this.p;
-    const end = start + len;
-    if (end > this.n) throw incompleteError("truncated fixlen payload");
-    this.p = end;
-    return this.buf.subarray(start, end);
-  }
-  readFp32() {
-    const p = this.p;
-    if (p + 4 > this.n) throw incompleteError("truncated fp32");
-    this.p = p + 4;
-    return this.view.getFloat32(p, true);
-  }
-  readFp64() {
-    const p = this.p;
-    if (p + 8 > this.n) throw incompleteError("truncated fp64");
-    this.p = p + 8;
-    return this.view.getFloat64(p, true);
-  }
-  // --- varint reading -----------------------------------------------------
-  /** The last varint's full value as a `bigint` (64-bit fidelity). */
-  big() {
-    return this.hi === 0 ? BigInt(this.lo >>> 0) : BigInt(this.hi >>> 0) << 32n | BigInt(this.lo >>> 0);
-  }
-  /**
-   * The last varint as an unsigned value, number-first: a `number` when it fits
-   * exactly (`≤ 2^53-1` — all ids, u8..u32 and small u64s), a `bigint` only
-   * beyond that. Skips the per-value bigint allocation on the common path.
-   */
-  unsignedValue() {
-    const hi = this.hi >>> 0;
-    return hi <= 2097151 ? hi * TWO32 + (this.lo >>> 0) : this.big();
-  }
-  /** The last zig-zag varint as a signed value, number-first (see {@link unsignedValue}). */
-  signedValue() {
-    const hi = this.hi >>> 0;
-    if (hi <= 2097151) {
-      const r = hi * TWO32 + (this.lo >>> 0);
-      return r % 2 === 0 ? r / 2 : -(r + 1) / 2;
+  /**
+   * Commit the position a bulk kernel returned, in the **block** mode.
+   *
+   * Nothing reserves room in front of that kernel, and nothing could: the bytes an
+   * array takes are only known once it is encoded, and the estimate that used to
+   * stand in — the source's own `constructor`, which any object can set — silently
+   * truncated the message when it was wrong (§5.1). Here the bound is the buffer's
+   * own length, applied afterwards. The varint kernels stop writing at
+   * `out.length` and keep counting (see {@link Kernel}), so a `pos` past the end
+   * is the exact shortfall and nothing was written outside the buffer.
+   *
+   * This is the block mode's error and only its: the buffer is meant to hold the
+   * whole message, so one that does not fit is exactly what `BUFFER_FULL` means.
+   * The streaming mode never gets here, and `BUFFER_FULL` is unreachable there by
+   * contract.
+   */
+  bulkEnd(pos, count) {
+    if (pos > this.buf.length) {
+      throw bufferFullError(
+        `output buffer full: an array of ${count} elements needs ${pos - this.buf.length} more bytes`
+      );
     }
-    return zigzagDecode(this.big());
-  }
-  /** The last varint's value as a JS number — exact for ids/lengths/counts. */
-  num() {
-    return this.hi * TWO32 + (this.lo >>> 0);
-  }
-  /** The last varint with its low 3 tag bits stripped (`value >> 3`). */
-  upper() {
-    return (this.hi >>> 0) * (TWO32 / 8) + (this.lo >>> 3);
+    return pos;
   }
   /**
-   * Decode one LEB128 varint at the cursor into {@link lo} / {@link hi} (each an
-   * unsigned 32-bit half), advancing {@link p}. Throws on truncation or a value
-   * spilling past 64 bits (>10 bytes). Unrolled, number-only — no `bigint`.
+   * Ensure `n` contiguous bytes are free at `pos`; returns `pos` for chaining.
+   *
+   * The only remaining caller is the one-byte sequence-end marker, which is
+   * indivisible: there is no smaller piece to split it into, so a buffer that
+   * cannot take it has nothing left to report but `BUFFER_FULL`.
    */
-  readVarint() {
-    const buf = this.buf;
-    const n = this.n;
-    let p = this.p;
-    let b;
-    let lo;
-    let hi = 0;
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    lo = b & 127;
-    if (b < 128) return this.set(lo, 0, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    lo |= (b & 127) << 7;
-    if (b < 128) return this.set(lo, 0, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    lo |= (b & 127) << 14;
-    if (b < 128) return this.set(lo, 0, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    lo |= (b & 127) << 21;
-    if (b < 128) return this.set(lo, 0, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    lo |= (b & 15) << 28;
-    hi = b >> 4 & 7;
-    if (b < 128) return this.set(lo, hi, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    hi |= (b & 127) << 3;
-    if (b < 128) return this.set(lo, hi, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    hi |= (b & 127) << 10;
-    if (b < 128) return this.set(lo, hi, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    hi |= (b & 127) << 17;
-    if (b < 128) return this.set(lo, hi, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    hi |= (b & 127) << 24;
-    if (b < 128) return this.set(lo, hi, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    if ((b & 127) >> 1 !== 0) throw invalidMsgError("varint overflow");
-    hi |= (b & 127) << 31;
-    if (b < 128) return this.set(lo, hi, p);
-    throw invalidMsgError("varint overflow");
+  ensure(n) {
+    if (!this.tryEnsure(n)) {
+      throw bufferFullError(
+        `output buffer full: need ${n} more bytes, have ${this.buf.length - this.pos}`
+      );
+    }
+    return this.pos;
   }
-  set(lo, hi, p) {
-    this.lo = lo;
-    this.hi = hi;
-    this.p = p;
+  /** Ensure *some* room (up to `want`); returns how many bytes are available. */
+  ensureSome(want) {
+    let room = this.buf.length - this.pos;
+    if (room === 0) {
+      this.flush();
+      room = this.buf.length - this.pos;
+      if (room === 0) throw bufferFullError("output buffer full");
+    }
+    return Math.min(room, want);
   }
 };
 
+// src/encode/accumulate.ts
+var DEFAULT_CAPACITY = 256;
+var MIN_WINDOW = 16;
+var SLAB_BYTES = 8192;
+var SLAB_MAX_TAKE = SLAB_BYTES >>> 1;
+var slab = null;
+var slabUsed = 0;
+function accumulatorBuffer(n) {
+  if (n > SLAB_MAX_TAKE) return new Uint8Array(n);
+  let s = slab;
+  if (s === null || s.length - slabUsed < n) {
+    s = slab = new Uint8Array(SLAB_BYTES);
+    slabUsed = 0;
+  }
+  const from = slabUsed;
+  slabUsed = from + n;
+  return s.subarray(from, slabUsed);
+}
+var ACCUMULATE = function(buffer, _start, end, needed = 0) {
+  const used = this.bytesUsed;
+  const window = needed > MIN_WINDOW ? needed : MIN_WINDOW;
+  if (buffer.length - end >= window) {
+    this.setBuffer(buffer, end, used);
+    return;
+  }
+  let cap = buffer.length * 2;
+  const want = used + window;
+  if (cap < want) cap = want;
+  const next = accumulatorBuffer(cap);
+  next.set(buffer.subarray(end - used, end));
+  this.setBuffer(next, used, used);
+};
+function growingOStream(initialCapacity = DEFAULT_CAPACITY) {
+  if (!Number.isInteger(initialCapacity) || initialCapacity < 1) {
+    throw argumentError(`initial capacity ${initialCapacity} must be a positive integer`);
+  }
+  return new OStream(accumulatorBuffer(initialCapacity), 0, ACCUMULATE);
+}
+
+// src/decode/skip.ts
+var SKIP = Object.freeze({});
+
 // src/decode/state.ts
-var TWO322 = 4294967296;
+var TWO32 = 4294967296;
+var TYPED_CAPACITY = /* @__PURE__ */ new Map([
+  [Uint8Array, { min: 0, max: 255 }],
+  [Uint16Array, { min: 0, max: 65535 }],
+  [Uint32Array, { min: 0, max: 4294967295 }],
+  [Int8Array, { min: -128, max: 127 }],
+  [Int16Array, { min: -32768, max: 32767 }],
+  [Int32Array, { min: -2147483648, max: 2147483647 }],
+  // The 64-bit pair is the accumulator's own range on both sides, so any bound a
+  // caller can state fits: `min`/`max` here are the sentinels the fit test needs,
+  // not numbers anything is compared against (the fill writes raw halves).
+  [BigUint64Array, { min: 0, max: Number.POSITIVE_INFINITY }],
+  [BigInt64Array, { min: Number.NEGATIVE_INFINITY, max: Number.POSITIVE_INFINITY }]
+]);
+function typedCapacity(ctor) {
+  if (ctor === Uint8Array) return CAP_U8;
+  if (ctor === Int8Array) return CAP_I8;
+  if (ctor === Uint16Array) return CAP_U16;
+  if (ctor === Int16Array) return CAP_I16;
+  if (ctor === Uint32Array) return CAP_U32;
+  if (ctor === Int32Array) return CAP_I32;
+  return TYPED_CAPACITY.get(ctor);
+}
+var CAP_U8 = TYPED_CAPACITY.get(Uint8Array);
+var CAP_I8 = TYPED_CAPACITY.get(Int8Array);
+var CAP_U16 = TYPED_CAPACITY.get(Uint16Array);
+var CAP_I16 = TYPED_CAPACITY.get(Int16Array);
+var CAP_U32 = TYPED_CAPACITY.get(Uint32Array);
+var CAP_I32 = TYPED_CAPACITY.get(Int32Array);
+function is64(d) {
+  return d instanceof BigUint64Array || d instanceof BigInt64Array;
+}
 var DecoderState = class {
-  constructor(limits) {
+  constructor(visitor = SKIP) {
+    /**
+     * Depth at which the current skipped subtree was opened, or `-1` when nothing
+     * is being skipped. The scope that returned `false` from
+     * {@link Visitor.sequenceBegin} closes at this depth, and skipping ends there.
+     */
+    this.skipFrom = -1;
+    /**
+     * **No receiver cap lives here** (§6.2.1). This decoder used to hold
+     * `maxArrayCount` / `maxStringLen` / `maxBlobLen`, defaulted to the format
+     * ceilings when the caller supplied none — which is precisely the shape §6.2.1
+     * forbids: "a codec **MUST NOT** hold a limit of its own, **MUST NOT** supply a
+     * default for one it was not given, **MUST NOT** read an omitted argument as
+     * *unlimited*, and **MUST NOT** clamp to one", and "a format ceiling (§6.2)
+     * reached because no cap was stated is the **format's** bound, not a receiver
+     * cap, and a port **MUST NOT** present it as one". Reporting `LimitExceeded`
+     * against `ARRAY_MAX`/`FIXLEN_MAX` did exactly that.
+     *
+     * The caps now have **one implementation** and it is not here: generated code
+     * compares them in its own flat visitor, at `arrayBegin` / `fixlenBegin` — both
+     * of which this decoder raises at the count / length header, before a byte of
+     * payload is emitted and behind the MESSAGE_SPEC §7.3 tag test — and a wrapper
+     * array's elements, which reach no visitor callback, are capped by the
+     * `StringSeq` / `BlobSeq` collectors from bounds passed to their
+     * constructors. §6.2.1: "A port whose codec offers the check **MUST NOT** also
+     * emit it into the generated layer, and a port that enforces it in generated
+     * code **MUST NOT** ask the codec to enforce it too."
+     *
+     * The format ceilings below (`ARRAY_MAX`, `FIXLEN_MAX`, `MAX_DEPTH`, the varint
+     * bound) are *not* receiver caps and stay here: they bound what the wire may
+     * express, and exceeding one is `INVALID` (§6.2).
+     */
+    /**
+     * The id of every open sequence, indexed by the depth it was opened at, so a
+     * scope close can name the sequence it closes. Fixed size, sized from
+     * {@link MAX_DEPTH} at construction — the "fixed-size parse stack" §6.6.2
+     * allows, and the reason nothing here grows a stack per message.
+     *
+     * A plain array rather than an `Int32Array`, and the difference is 3 µs: V8
+     * keeps a typed array's bytes inside the JS heap only up to 64 bytes, so a
+     * 255-slot one is an *external* allocation — measured at ~3.1 µs on Node 24,
+     * against ~5 ns for this. That is paid per decoder, and the one-shot
+     * {@link decode} builds a decoder per message, so it was the whole cost of
+     * decoding a small one. Slots are written before they are read (a scope is
+     * opened before it closes), so the array is never read holey.
+     */
+    this.seqIds = new Array(MAX_DEPTH);
+    /** Number of nested sequences currently open — 0 at the root scope. */
+    this.depth = 0;
     this.state = 0 /* Header */;
-    this.stack = [];
-    // current field
+    /**
+     * The terminal-refusal latch: the rejection this stream was stopped by, or
+     * `null` while it is still healthy. **One latch, two codes** — §5.3.1 gives the
+     * rule one implementation, and §6.3 makes both of these rejections terminal:
+     *
+     * - `INVALID_MSG` (§5.2.1: "malformed **regardless of what follows** … no —
+     *   terminal") — no later bytes can make malformed input valid;
+     * - `LIMIT_EXCEEDED` (§6.3: "A **terminal**, receiver-local **policy**
+     *   rejection") — well-formed bytes the receiver's cap refuses.
+     *
+     * They are latched together and **kept apart by their code**, which is the
+     * distinction §6.3 requires: a limit rejection "**MUST NOT** be reported as
+     * `InvalidMessage`", so the code is re-raised as itself and each stays the
+     * refusal it was.
+     *
+     * Latching is not bookkeeping, it is the terminality: both rejections are
+     * raised *mid-field* — the UTF-8 check inside a payload piece, a cap inside the
+     * count or length callback — so the machine is left at a position the visitor
+     * never finished. Resume it and the refused field's own bytes are re-read as
+     * headers, delivering fields that were never on the wire.
+     *
+     * The rejection is written here by {@link latch} and nowhere else: this
+     * machine's own malformation findings arrive through {@link fail}, and the ones
+     * raised above it — the §6.4.5 UTF-8 verdict, and the receiver caps §6.2.1
+     * keeps out of this codec — arrive as a throw out of a visitor callback, caught
+     * once in {@link push}.
+     */
+    this.refusal = null;
+    /**
+     * A `DataView` over the chunk currently being fed, and the chunk it addresses —
+     * the **language-forced handle** of CORELIB_PLAN §6.6.2, and the only way
+     * JavaScript lets a reader take an IEEE-754 value from a byte offset. Without it
+     * a float costs four or eight byte loads, a shift ladder and a round trip
+     * through a scratch word; with it, one call.
+     *
+     * It qualifies because it carries no message bytes (it addresses the *caller's*
+     * chunk) and no wire number sizes it (its extent is the chunk's). Built lazily
+     * and only where it pays: a float **array** whose remaining run inside this chunk
+     * clears {@link FP32_HANDLE_MIN} / {@link FP64_HANDLE_MIN}. A scalar float, a
+     * short array, a message with no float at all, and a byte-at-a-time feed each
+     * build none. Once built it is kept while the same chunk is being fed, and it
+     * never leaves this class.
+     */
+    this.view = null;
+    this.viewOf = null;
+    /** The current field's id. */
     this.id = 0;
-    // Resumable varint accumulator, as two unsigned 32-bit halves (vLo / vHi)
-    // plus the byte count so far. Number-only: a `bigint` is built once, at the
-    // end, and only for full 64-bit *values* (not ids, lengths or counts).
+    // Resumable varint accumulator, as two unsigned 32-bit halves (vLo / vHi) plus
+    // the byte count so far. Number-only: a `bigint` is built once, at the end, and
+    // only for full 64-bit *values* (never for ids, lengths or counts).
     this.vLo = 0;
     this.vHi = 0;
     this.vBytes = 0;
     this.vComplete = false;
-    // fixlen / fp scratch
-    this.scratch = new Uint8Array(8);
+    /**
+     * Resumable fp32 / fp64 accumulator, as two little-endian 32-bit words rather
+     * than a byte array: a typed array would be a per-decoder allocation, and two
+     * number fields hold the same 8 bytes. Byte `k` lands in bits `8*k` of `fpLo`
+     * (k < 4) or of `fpHi`, so the pair is already in wire (little-endian) order.
+     */
+    this.fpLo = 0;
+    this.fpHi = 0;
     this.need = 0;
     this.have = 0;
     // fixlen string/blob streaming
@@ -1179,98 +1825,249 @@ var DecoderState = class {
     this.arrIsFixlen = false;
     this.arrCount = 0;
     this.arrIndex = 0;
-    this.maxArrayCount = limits?.maxArrayCount ?? Infinity;
-    this.maxStringLen = limits?.maxStringLen ?? Infinity;
-    this.maxBlobLen = limits?.maxBlobLen ?? Infinity;
+    /**
+     * The destination the visitor handed over for the array being decoded, or
+     * `null` while no hand-off is in force — which is every array the visitor
+     * declined, and every array at all for a visitor that declares no
+     * {@link Visitor.arrayBulk}.
+     *
+     * **The one reference this machine keeps into the caller's storage between
+     * `feed` calls.** Everything else it holds past a callback is its own (§6.6):
+     * a payload is reported as coordinates into the caller's chunk and never
+     * retained. An array that straddles chunks has to remember where its elements
+     * go, so this lives from the hand-off to `arrayEnd` — and is dropped there,
+     * by {@link endArray}, and by {@link release} for a machine going back to the
+     * pool.
+     */
+    this.bulk = null;
+    /** Which destination {@link bulk} named; meaningless while it is `null`. */
+    this.bulkMode = 0 /* Values */;
+    /**
+     * The `Uint32Array` over a 64-bit typed destination (see {@link BM.Typed64}),
+     * or over an `f32` destination once it has taken a NaN (see {@link f32StoreWord}).
+     */
+    this.bulk64 = null;
+    this.root = visitor;
+    this.cur = visitor;
+    this.begin(visitor);
   }
-  /** Feed `input` to the machine, dispatching to `root` and its sub-visitors. */
-  push(input, root) {
-    if (this.stack.length === 0) this.stack.push(root);
-    let i = 0;
+  /**
+   * (Re)bind this machine to a visitor, clearing every trace of whatever it
+   * decoded before.
+   *
+   * Constructing a decoder is the one allocating step (§6.6), and the one-shot
+   * {@link decode} would otherwise pay it per message — which on a 37-byte message
+   * is most of the cost. So {@link decode} keeps one machine and re-binds it here;
+   * this method is what makes that indistinguishable from a fresh one.
+   *
+   * **Only the fields a fresh decode can *read* are cleared**, and the list is
+   * exhaustive by construction rather than by inspection: every other field is
+   * written before it is read, on every path that reads it — `id` at each header,
+   * `vLo`/`vHi` by whichever varint reader ran (a fresh accumulation starts from
+   * zero because `vBytes` is 0), `vComplete` by the `varintStep` whose result is
+   * being tested, `fpLo`/`fpHi`/`need` by {@link fpBegin}, `fix*` by
+   * {@link fixlenWord}, `arrKind`/`arrIsFixlen` by {@link dispatch} and
+   * `arrCount`/`arrIndex` by the count word and `bulkMode` by the hand-off the
+   * same word makes (`bulk` *is* cleared: it is the caller's storage, and a
+   * machine that starts a fresh decode must not still be pointing at the last
+   * one's), `seqIds[d]` when the scope at `d`
+   * opens. `have` is the one exception and *is* cleared: the `S.ArrayFp` bulk loop
+   * reads it to decide whether an element is half-arrived.
+   *
+   * `view`/`viewOf` are not cleared either, and deliberately: {@link dataView}
+   * keys the cached handle on the chunk it addresses, so a stale one is rebuilt the
+   * moment a different chunk arrives and reused — correctly — when the same buffer
+   * is decoded again. {@link release} still drops it, which is where it matters:
+   * a pooled machine must not keep the caller's last chunk alive between calls.
+   *
+   * Clearing them all anyway cost 5573 → 5324 Ir/op on `decode: typical message`
+   * (~4.5%), which is what a 21-field wipe costs when the message is 37 bytes. The
+   * invariant is held by `pooled-decoder-state.test.ts`, which aborts a decode in
+   * every construct and then reuses the machine.
+   */
+  begin(visitor) {
+    this.root = visitor;
+    this.cur = visitor;
+    this.skipFrom = -1;
+    this.depth = 0;
+    this.state = 0 /* Header */;
+    this.refusal = null;
+    this.vBytes = 0;
+    this.have = 0;
+    this.bulk = null;
+    this.bulk64 = null;
+  }
+  /**
+   * Drop the references a pooled machine would otherwise keep alive: the caller's
+   * visitor, and the handle onto the caller's chunk.
+   */
+  release() {
+    this.root = SKIP;
+    this.cur = SKIP;
+    this.view = null;
+    this.viewOf = null;
+    this.bulk = null;
+    this.bulk64 = null;
+  }
+  /** Feed `input` to the machine, dispatching to the bound visitor. */
+  push(input) {
+    const latched = this.refusal;
+    if (latched !== null) throw new SofabError(latched.code, latched.message);
+    try {
+      this.run(input);
+    } catch (e) {
+      if (this.refusal === null && e instanceof SofabError && (e.code === SofabErrorCode.InvalidMsg || e.code === SofabErrorCode.LimitExceeded || e.code === SofabErrorCode.Argument)) {
+        this.latch(e);
+      }
+      throw e;
+    }
+  }
+  /**
+   * The decode loop itself. {@link push} wraps it, so the terminal-refusal latch
+   * is applied in exactly one place — including to a rejection the visitor raised
+   * — and this stays the plain state machine.
+   */
+  run(input) {
     const n = input.length;
+    let i = 0;
     while (i < n) {
+      if (this.state === 0 /* Header */ && this.vBytes === 0) {
+        let h;
+        const hb = input[i];
+        if (hb < 128) {
+          this.vLo = hb;
+          this.vHi = 0;
+          h = i + 1;
+        } else h = this.varintQuick(input, i, n);
+        if (h >= 0) {
+          i = h;
+          const type = this.vLo & 7;
+          const id = this.vHi === 0 ? this.vLo >>> 3 : this.vUpper();
+          if (id > ID_MAX) this.fail(`field id ${id} out of range`);
+          if (type === WireType.SequenceEnd) {
+            this.endSequence();
+            continue;
+          }
+          this.id = id;
+          this.cur.fieldBegin?.(id, type);
+          if (type === WireType.Unsigned) {
+            let v;
+            const b0 = i < n ? input[i] : 128;
+            if (b0 < 128) {
+              this.vLo = b0;
+              this.vHi = 0;
+              v = i + 1;
+            } else v = this.varintQuick(input, i, n);
+            if (v < 0) {
+              this.state = 1 /* ScalarU */;
+              continue;
+            }
+            i = v;
+            const lo = this.vLo >>> 0;
+            const hi = this.vHi >>> 0;
+            this.cur.unsigned?.(
+              id,
+              hi <= 2097151 ? hi * TWO32 + lo : joinU64(lo, hi),
+              lo,
+              hi
+            );
+            continue;
+          }
+          if (type === WireType.Signed) {
+            let v;
+            const b0 = i < n ? input[i] : 128;
+            if (b0 < 128) {
+              this.vLo = b0;
+              this.vHi = 0;
+              v = i + 1;
+            } else v = this.varintQuick(input, i, n);
+            if (v < 0) {
+              this.state = 2 /* ScalarS */;
+              continue;
+            }
+            i = v;
+            const lo = this.vLo >>> 0;
+            const hi = this.vHi >>> 0;
+            const mask = -(lo & 1) >>> 0;
+            this.cur.signed?.(
+              id,
+              this.vSigned(),
+              ((lo >>> 1 | hi << 31) >>> 0 ^ mask) >>> 0,
+              (hi >>> 1 ^ mask) >>> 0
+            );
+            continue;
+          }
+          if (type === WireType.Fixlen) {
+            const w = this.varintQuick(input, i, n);
+            if (w < 0) {
+              this.state = 3 /* FixlenWord */;
+              continue;
+            }
+            i = this.fixlenWord(input, w, n);
+            continue;
+          }
+          this.dispatch(type);
+          continue;
+        }
+      }
       switch (this.state) {
         case 0 /* Header */: {
           i = this.varintStep(input, i);
           if (!this.vComplete) return;
-          const type = this.vTag();
+          const type = this.vLo & 7;
+          const id = this.vUpper();
+          if (id > ID_MAX) this.fail(`field id ${id} out of range`);
           if (type === WireType.SequenceEnd) {
-            this.resetVarint();
             this.endSequence();
             break;
           }
-          const id = this.vUpper();
-          this.resetVarint();
-          if (id > ID_MAX) throw invalidMsgError(`field id ${id} out of range`);
           this.id = id;
+          this.cur.fieldBegin?.(id, type);
           this.dispatch(type);
           break;
         }
         case 1 /* ScalarU */: {
           i = this.varintStep(input, i);
           if (!this.vComplete) return;
-          const value = this.vUnsigned();
-          this.resetVarint();
-          this.top().unsigned?.(this.id, value);
           this.state = 0 /* Header */;
+          this.cur.unsigned?.(this.id, this.vUnsigned(), this.vLo >>> 0, this.vHi >>> 0);
           break;
         }
         case 2 /* ScalarS */: {
           i = this.varintStep(input, i);
           if (!this.vComplete) return;
-          const value = this.vSigned();
-          this.resetVarint();
-          this.top().signed?.(this.id, value);
           this.state = 0 /* Header */;
+          const lo = this.vLo >>> 0;
+          const hi = this.vHi >>> 0;
+          const mask = -(lo & 1) >>> 0;
+          this.cur.signed?.(
+            this.id,
+            this.vSigned(),
+            ((lo >>> 1 | hi << 31) >>> 0 ^ mask) >>> 0,
+            (hi >>> 1 ^ mask) >>> 0
+          );
           break;
         }
-        case 3 /* FixlenLen */: {
+        case 3 /* FixlenWord */: {
           i = this.varintStep(input, i);
           if (!this.vComplete) return;
-          const sub = this.vTag();
-          const len = this.vUpper();
-          this.resetVarint();
-          if (sub > FixlenSubtype.Blob) throw invalidMsgError(`invalid fixlen subtype ${sub}`);
-          if (len > FIXLEN_MAX) throw invalidMsgError("fixlen length out of range");
-          if (sub === FixlenSubtype.String && len > this.maxStringLen) {
-            throw limitExceededError(`string length ${len} exceeds maxStringLen ${this.maxStringLen}`);
-          }
-          if (sub === FixlenSubtype.Blob && len > this.maxBlobLen) {
-            throw limitExceededError(`blob length ${len} exceeds maxBlobLen ${this.maxBlobLen}`);
-          }
-          this.fixSub = sub;
-          this.fixLen = len;
-          this.fixOff = 0;
-          if (sub === FixlenSubtype.Fp32 || sub === FixlenSubtype.Fp64) {
-            const want = sub === FixlenSubtype.Fp32 ? 4 : 8;
-            if (this.fixLen !== want) throw invalidMsgError("fixlen float length mismatch");
-            this.need = want;
-            this.have = 0;
-            this.state = 4 /* FixlenFp */;
-          } else {
-            if (this.fixLen === 0) {
-              this.emitBytes(input.subarray(0, 0));
-              this.state = 0 /* Header */;
-            } else {
-              this.state = 5 /* FixlenBytes */;
-            }
-          }
+          i = this.fixlenWord(input, i, n);
           break;
         }
         case 4 /* FixlenFp */: {
-          i = this.fpStep(input, i);
+          i = this.fpStep(input, i, n);
           if (this.have < this.need) return;
-          const value = this.fixSub === FixlenSubtype.Fp32 ? unpackFp32(this.scratch, 0) : unpackFp64(this.scratch, 0);
-          if (this.fixSub === FixlenSubtype.Fp32) {
-            const top = this.top();
-            top.fp32?.(this.id, value, top.fp32Raw ? this.scratch.subarray(0, 4) : void 0);
-          } else this.top().fp64?.(this.id, value);
           this.state = 0 /* Header */;
+          if (this.fixSub === FixlenSubtype.Fp32) {
+            this.cur.fp32?.(this.id, fp32FromBits(this.fpLo), this.fpLo >>> 0);
+          } else {
+            this.cur.fp64?.(this.id, fp64FromBits(this.fpLo, this.fpHi));
+          }
           break;
         }
         case 5 /* FixlenBytes */: {
           const take = Math.min(n - i, this.fixLen - this.fixOff);
-          this.emitBytes(input.subarray(i, i + take));
+          this.emitBytes(input, i, i + take);
           i += take;
           this.fixOff += take;
           if (this.fixOff === this.fixLen) this.state = 0 /* Header */;
@@ -1280,77 +2077,95 @@ var DecoderState = class {
           i = this.varintStep(input, i);
           if (!this.vComplete) return;
           const count = this.vNum();
-          this.resetVarint();
-          if (count > ARRAY_MAX) throw invalidMsgError("array count out of range");
-          if (count > this.maxArrayCount) {
-            throw limitExceededError(`array count ${count} exceeds maxArrayCount ${this.maxArrayCount}`);
-          }
+          if (count > ARRAY_MAX) this.fail("array count out of range");
           this.arrCount = count;
           this.arrIndex = 0;
           if (this.arrIsFixlen) {
-            this.state = 9 /* ArrayElemLen */;
+            this.state = 8 /* ArrayElemWord */;
           } else if (count === 0) {
-            this.top().arrayBegin?.(this.id, this.arrKind, 0);
-            this.top().arrayEnd?.(this.id);
-            this.state = 0 /* Header */;
+            this.cur.arrayBegin?.(this.id, this.arrKind, 0);
+            this.askBulk(this.arrKind, 0);
+            this.endArray();
           } else {
-            this.top().arrayBegin?.(this.id, this.arrKind, this.arrCount);
-            this.state = this.arrKind === ArrayKind.Unsigned ? 7 /* ArrayUElem */ : 8 /* ArraySElem */;
+            this.state = 7 /* ArrayElem */;
+            this.cur.arrayBegin?.(this.id, this.arrKind, count);
+            this.askBulk(this.arrKind, count);
           }
           break;
         }
-        case 7 /* ArrayUElem */: {
-          i = this.varintStep(input, i);
-          if (!this.vComplete) return;
-          const value = this.vUnsigned();
-          this.resetVarint();
-          this.top().arrayUnsigned?.(this.id, this.arrIndex, value);
-          this.advanceArray();
-          break;
-        }
-        case 8 /* ArraySElem */: {
+        case 7 /* ArrayElem */: {
+          const count = this.arrCount;
+          const safeEnd = n - VARINT_MAX_BYTES;
+          if (this.bulk !== null) {
+            i = this.arrKind === ArrayKind.Unsigned ? this.uBulkArm(input, i, n, count, safeEnd) : this.sBulkArm(input, i, n, count, safeEnd);
+            break;
+          }
+          let idx = this.arrIndex;
+          if (this.vBytes === 0) {
+            while (idx < count && i <= safeEnd) {
+              i = this.varintFull(input, i);
+              idx++;
+            }
+            this.arrIndex = idx;
+          }
+          if (idx === count) {
+            this.state = 0 /* Header */;
+            this.cur.arrayEnd?.(this.id);
+            break;
+          }
+          if (i >= n) break;
           i = this.varintStep(input, i);
           if (!this.vComplete) return;
-          const value = this.vSigned();
-          this.resetVarint();
-          this.top().arraySigned?.(this.id, this.arrIndex, value);
           this.advanceArray();
           break;
         }
-        case 9 /* ArrayElemLen */: {
+        case 8 /* ArrayElemWord */: {
           i = this.varintStep(input, i);
           if (!this.vComplete) return;
-          const sub = this.vTag();
+          const sub = this.vLo & 7;
           const size = this.vUpper();
-          this.resetVarint();
           if (sub === FixlenSubtype.Fp32 && size === 4) {
             this.arrKind = ArrayKind.Fp32;
-            this.need = 4;
+            this.fpBegin(4);
           } else if (sub === FixlenSubtype.Fp64 && size === 8) {
             this.arrKind = ArrayKind.Fp64;
-            this.need = 8;
+            this.fpBegin(8);
           } else {
-            throw invalidMsgError("invalid fixlen array element type");
+            this.fail("invalid fixlen array element type");
           }
-          this.top().arrayBegin?.(this.id, this.arrKind, this.arrCount);
           if (this.arrCount === 0) {
-            this.top().arrayEnd?.(this.id);
-            this.state = 0 /* Header */;
+            this.cur.arrayBegin?.(this.id, this.arrKind, 0);
+            this.askBulk(this.arrKind, 0);
+            this.endArray();
           } else {
-            this.have = 0;
-            this.state = 10 /* ArrayFp */;
+            this.state = 9 /* ArrayFp */;
+            this.cur.arrayBegin?.(this.id, this.arrKind, this.arrCount);
+            this.askBulk(this.arrKind, this.arrCount);
           }
           break;
         }
-        case 10 /* ArrayFp */: {
-          i = this.fpStep(input, i);
+        case 9 /* ArrayFp */: {
+          const count = this.arrCount;
+          const size = this.need;
+          if (this.bulk !== null) {
+            const is32 = this.arrKind === ArrayKind.Fp32;
+            i = this.fpBulkArm(input, i, n, count, size, is32);
+            break;
+          }
+          if (this.have === 0) {
+            const run = Math.min(count - this.arrIndex, (n - i) / size | 0);
+            i += run * size;
+            this.arrIndex += run;
+          }
+          if (this.arrIndex === count) {
+            this.state = 0 /* Header */;
+            this.cur.arrayEnd?.(this.id);
+            break;
+          }
+          if (i >= n) break;
+          i = this.fpStep(input, i, n);
           if (this.have < this.need) return;
-          const value = this.arrKind === ArrayKind.Fp32 ? unpackFp32(this.scratch, 0) : unpackFp64(this.scratch, 0);
-          if (this.arrKind === ArrayKind.Fp32) {
-            const top = this.top();
-            top.arrayFp32?.(this.id, this.arrIndex, value, top.fp32Raw ? this.scratch.subarray(0, 4) : void 0);
-          } else this.top().arrayFp64?.(this.id, this.arrIndex, value);
-          this.have = 0;
+          this.fpBegin(size);
           this.advanceArray();
           break;
         }
@@ -1358,20 +2173,104 @@ var DecoderState = class {
     }
   }
   /**
-   * Report the terminal decode outcome (MESSAGE_SPEC §7) *without* promoting it
-   * to an error. Returns {@link DecodeStatus.Complete} when the stream ended
-   * exactly at a field boundary, or {@link DecodeStatus.Incomplete} when it
-   * ended inside a field (a partial varint, an unfinished payload / array, or a
-   * still-open nested sequence). This is a pure accessor — the finish-less spec
-   * has no finalize step, and a trailing `Incomplete` is a truncation the caller
-   * decides how to treat, not an error this machine raises. A genuinely
-   * malformed message has already thrown from {@link push}.
+   * Where the decode stands (§5.2.1), *without* promoting it to an error:
+   * {@link DecodeStatus.Complete} when the stream ended exactly at a field
+   * boundary, {@link DecodeStatus.Incomplete} when it ended inside a field (a
+   * partial varint, an unfinished payload / array, or a still-open nested
+   * sequence). A trailing `Incomplete` is a truncation the caller decides how to
+   * treat (§5.2.4), not an error this machine raises.
+   *
+   * **Only these two, and only on a healthy machine.** This is read in exactly
+   * one place — after a {@link push} that returned — and a push that met a
+   * terminal refusal does not return: it throws, this call is never reached, and
+   * the verdict travels out on the error it threw. So `Invalid` is not a value
+   * this can produce, and neither is the "refused by a cap" state the outcome
+   * triple cannot name (§6.3). Nothing here re-reports a latched refusal, because
+   * nothing needs to: the throw is the whole report, and a report with one
+   * carrier has nothing to drift out of step with.
+   *
+   * The cursor's own answer would be wrong for a refused stream, which is why the
+   * refusal must not fall through to it: a cap is compared in `arrayBegin` /
+   * `fixlenBegin`, raised with the header and the count / length word consumed and
+   * the payload not yet entered — a cursor that reads as a clean field boundary,
+   * and so as `Complete`. {@link push}'s latch is what keeps that unreachable.
    */
-  finish() {
-    const atBoundary = this.state === 0 /* Header */ && this.vBytes === 0 && this.stack.length <= 1;
+  outcome() {
+    const atBoundary = this.state === 0 /* Header */ && this.vBytes === 0 && this.depth === 0;
     return atBoundary ? DecodeStatus.Complete : DecodeStatus.Incomplete;
   }
   // --- helpers ------------------------------------------------------------
+  /**
+   * Reject the input as malformed: latch the terminal `INVALID` verdict and throw
+   * `INVALID_MSG`. Every malformation *this machine* finds goes through here, so
+   * none of them can be caught and then decoded past — §5.2.1's "no — terminal".
+   * Declared `never` so a call ends control flow exactly like the `throw` it
+   * replaced.
+   */
+  fail(message) {
+    throw this.latch(invalidMsgError(message));
+  }
+  /**
+   * Record `e` as the terminal refusal that stopped this stream, and hand it back
+   * to be thrown. The only writer of {@link refusal} — §5.3.1's one
+   * implementation of the rule — for a rejection raised here and for one raised
+   * above this machine and caught in {@link push} alike. The error is stored, not
+   * its text: the code travels with it, so `INVALID_MSG` and `LIMIT_EXCEEDED`
+   * each stay themselves (§6.3).
+   */
+  latch(e) {
+    this.refusal = e;
+    this.bulk = null;
+    this.bulk64 = null;
+    return e;
+  }
+  /**
+   * Act on a complete `fixlen_word` sitting in the varint accumulator: validate
+   * it, announce the field, and either read the float inline (when its bytes are
+   * in this chunk) or set up the resumable payload state. Shared by the fast lane
+   * and the `S.FixlenWord` arm, so the §4.6 rules exist once.
+   */
+  fixlenWord(input, i, n) {
+    const sub = this.vLo & 7;
+    const len = this.vUpper();
+    if (sub > FixlenSubtype.Blob) this.fail(`invalid fixlen subtype ${sub}`);
+    if (len > FIXLEN_MAX) this.fail("fixlen length out of range");
+    if (sub === FixlenSubtype.Fp32 || sub === FixlenSubtype.Fp64) {
+      const want = sub === FixlenSubtype.Fp32 ? 4 : 8;
+      if (len !== want) this.fail("fixlen float length mismatch");
+      this.fixSub = sub;
+      if (n - i >= want) {
+        this.state = 0 /* Header */;
+        const lo = u32le(input, i);
+        if (want === 4) {
+          this.cur.fp32?.(this.id, fp32FromBits(lo), lo);
+        } else {
+          this.cur.fp64?.(this.id, fp64FromBits(lo, u32le(input, i + 4)));
+        }
+        return i + want;
+      }
+      this.fpBegin(want);
+      this.state = 4 /* FixlenFp */;
+      return i;
+    }
+    this.fixSub = sub;
+    this.fixLen = len;
+    this.fixOff = 0;
+    this.cur.fixlenBegin?.(this.id, this.fixSub, len);
+    if (len === 0) {
+      this.emitBytes(input, i, i);
+      this.state = 0 /* Header */;
+      return i;
+    }
+    const take = Math.min(n - i, len);
+    if (take > 0) {
+      this.emitBytes(input, i, i + take);
+      this.fixOff = take;
+      i += take;
+    }
+    this.state = this.fixOff === len ? 0 /* Header */ : 5 /* FixlenBytes */;
+    return i;
+  }
   dispatch(type) {
     switch (type) {
       case WireType.Unsigned:
@@ -1381,7 +2280,7 @@ var DecoderState = class {
         this.state = 2 /* ScalarS */;
         break;
       case WireType.Fixlen:
-        this.state = 3 /* FixlenLen */;
+        this.state = 3 /* FixlenWord */;
         break;
       case WireType.ArrayUnsigned:
         this.arrKind = ArrayKind.Unsigned;
@@ -1397,755 +2296,1261 @@ var DecoderState = class {
         this.arrIsFixlen = true;
         this.state = 6 /* ArrayCount */;
         break;
-      case WireType.SequenceStart: {
-        if (this.stack.length - 1 >= MAX_DEPTH) {
-          throw invalidMsgError(`nesting exceeds MAX_DEPTH (${MAX_DEPTH})`);
-        }
-        const child = this.top().sequenceBegin?.(this.id);
-        this.stack.push(child ?? this.top());
-        this.state = 0 /* Header */;
+      case WireType.SequenceStart:
+        this.beginSequence();
         break;
-      }
       default:
-        throw invalidMsgError(`invalid wire type ${type}`);
+        this.fail(`invalid wire type ${type}`);
+    }
+  }
+  /**
+   * Open a nested sequence: offer it to the visitor, note its id, and descend.
+   *
+   * A visitor that answers `false` declines the whole subtree — no callback of
+   * any kind fires inside it, its own {@link Visitor.sequenceEnd} included, and a
+   * scope opened within it is never offered either. The subtree is still *parsed*
+   * (a sequence is framed by markers, not by a length, so its end has to be
+   * found) and every format ceiling still applies; what stops is delivery.
+   */
+  beginSequence() {
+    const d = this.depth;
+    if (d >= MAX_DEPTH) this.fail(`nesting exceeds MAX_DEPTH (${MAX_DEPTH})`);
+    if (this.cur !== SKIP && this.root.sequenceBegin?.(this.id, d + 1) === false) {
+      this.skipFrom = d;
+      this.cur = SKIP;
     }
+    this.seqIds[d] = this.id;
+    this.depth = d + 1;
+    this.state = 0 /* Header */;
   }
   endSequence() {
-    if (this.stack.length <= 1) throw invalidMsgError("unbalanced sequence end");
-    this.top().sequenceEnd?.();
-    this.stack.pop();
+    const d = this.depth;
+    if (d === 0) this.fail("unbalanced sequence end");
     this.state = 0 /* Header */;
+    const closed = d - 1;
+    this.depth = closed;
+    if (this.skipFrom >= 0) {
+      if (this.skipFrom === closed) {
+        this.skipFrom = -1;
+        this.cur = this.root;
+      }
+      return;
+    }
+    this.root.sequenceEnd?.(this.seqIds[closed], d);
   }
   advanceArray() {
-    this.arrIndex++;
-    if (this.arrIndex === this.arrCount) {
-      this.top().arrayEnd?.(this.id);
+    if (++this.arrIndex === this.arrCount) {
       this.state = 0 /* Header */;
+      this.cur.arrayEnd?.(this.id);
     }
   }
-  emitBytes(chunk) {
-    const v = this.top();
-    if (this.fixSub === FixlenSubtype.String) v.string?.(this.id, this.fixLen, this.fixOff, chunk);
-    else v.blob?.(this.id, this.fixLen, this.fixOff, chunk);
+  /**
+   * Close an array delivered through the hand-off: back to the header state, drop
+   * the visitor's destination, announce the end. Every bulk array ends here, so
+   * the reference into the caller's storage cannot outlive the array it was made
+   * for (§6.6; see {@link bulk}).
+   *
+   * The per-element arms keep their own two lines instead of calling this: they
+   * can never hold a destination — the hand-off's arms have already taken over
+   * before they run — and the call showed up on `decode: typical`.
+   */
+  endArray() {
+    this.state = 0 /* Header */;
+    const t = this.bulk;
+    if (t !== null) this.trimPlain(t, this.arrIndex);
+    this.bulk = null;
+    this.bulk64 = null;
+    this.cur.arrayEnd?.(this.id);
+  }
+  /**
+   * Cut a plain-array destination to the `written` elements this array actually
+   * put in it, so a destination reused across arrays — the shape the hand-off
+   * exists for — can never hand back the previous array's tail, and its `length`
+   * always means "elements of *this* array".
+   *
+   * At the end rather than at the hand-off, and that is measured: clearing it up
+   * front turns every element write into a grow (`array<u16>` 181 583 -> 231 815
+   * Ir/op, worse than the per-element path it replaces), where one length store
+   * per array costs nothing. A pre-sized destination — the fast shape, every write
+   * in bounds — is left exactly as it was.
+   *
+   * The typed destinations are not trimmed and cannot be: their length is the
+   * caller's allocation, checked against `count` at the hand-off, and `count` is
+   * how far this fill wrote.
+   */
+  trimPlain(t, written) {
+    const mode = this.bulkMode;
+    if (mode !== 0 /* Values */ && mode !== 1 /* Values32 */ && mode !== 5 /* Longs */) return;
+    const out = mode === 5 /* Longs */ ? t.longs : t.values;
+    if (out.length > written) out.length = written;
   }
-  top() {
-    return this.stack[this.stack.length - 1];
+  /**
+   * Offer the bulk hand-off for the array that just began, and resolve the answer
+   * once (CORELIB_PLAN §5.3.1's one implementation, and {@link ArrayTarget}'s
+   * contract): after this, the element loops know which destination to write to
+   * from {@link bulkMode} and re-decide nothing per element.
+   *
+   * Raised after `arrayBegin` and before the first element, so a receiver cap on
+   * the count (§6.2.1) is still compared in `arrayBegin` and a rejected array is
+   * never offered. A visitor that declares no `arrayBulk` pays one short-circuited
+   * optional call per array.
+   *
+   * **An empty array is offered too**, with `count` of 0. There is nothing to
+   * write, but there is something to say: a destination held across fields would
+   * otherwise still be holding the last array's elements, and its length is the
+   * only place this one's emptiness could show up (see {@link trimPlain}).
+   */
+  askBulk(kind, count) {
+    const t = this.cur.arrayBulk?.(this.id, kind, count) ?? null;
+    if (t === null) {
+      this.bulk = null;
+      this.bulk64 = null;
+      return;
+    }
+    this.bulk64 = null;
+    this.bulkMode = this.resolveTarget(t, kind, count);
+    this.bulk = t;
   }
   /**
-   * Consume varint bytes from `input` at `i` into the {@link vLo} / {@link vHi}
-   * accumulator, resuming across chunk boundaries; sets {@link vComplete} when a
-   * terminator byte arrives. Number-only — no per-byte `bigint`.
+   * Which destination `t` names — or an `Argument` refusal if it names none, more
+   * than one, one that contradicts the array's element kind, or one too short to
+   * hold `count` elements.
+   *
+   * These are caller mistakes rather than message verdicts, so they are
+   * `InvalidArgument` (§6.3) and not `INVALID_MSG`: the same bytes decode fine for
+   * a visitor that hands over a destination it can actually fill. Checked once per
+   * array, which is why the fill loops need no guard of their own.
    */
-  varintStep(input, i) {
-    let lo = this.vLo;
-    let hi = this.vHi;
-    let k = this.vBytes;
-    const n = input.length;
-    while (i < n) {
-      if (k >= VARINT_MAX_BYTES) throw invalidMsgError("varint overflow");
-      const b = input[i++];
-      if (k < 4) lo |= (b & 127) << 7 * k;
-      else if (k === 4) {
-        lo |= (b & 15) << 28;
-        hi |= b >> 4 & 7;
-      } else {
-        if (k === 9 && (b & 127) >> 1 !== 0) throw invalidMsgError("varint overflow");
-        hi |= (b & 127) << 7 * k - 32;
+  resolveTarget(t, kind, count) {
+    if (kind === ArrayKind.Fp32 || kind === ArrayKind.Fp64) {
+      const f = t;
+      const is32 = kind === ArrayKind.Fp32;
+      const dest = is32 ? f.f32 ?? f.bits : f.f64;
+      const named2 = (f.f32 !== void 0 ? 1 : 0) + (f.bits !== void 0 ? 1 : 0) + (f.f64 !== void 0 ? 1 : 0) + (t.bool !== void 0 ? 1 : 0);
+      const want = is32 ? "f32 or bits" : "f64";
+      if (dest === void 0 || named2 !== 1) {
+        throw argumentError(
+          `array ${this.id}: an ${is32 ? "fp32" : "fp64"} array needs exactly the ${want} destination`
+        );
       }
-      k++;
-      if ((b & 128) === 0) {
-        this.vLo = lo;
-        this.vHi = hi;
-        this.vBytes = k;
-        this.vComplete = true;
-        return i;
+      if (dest.length < count) {
+        throw argumentError(
+          `array ${this.id}: ${is32 ? "fp32" : "fp64"} destination holds ${dest.length} of ${count} elements`
+        );
       }
+      if (!is32) return 9 /* F64 */;
+      return f.bits !== void 0 ? 8 /* F32Bits */ : 7 /* F32 */;
     }
-    this.vLo = lo;
-    this.vHi = hi;
-    this.vBytes = k;
-    this.vComplete = false;
-    return i;
+    const bt = t;
+    if (bt.bool !== void 0) {
+      const other = t;
+      const float = t;
+      if (other.values !== void 0 || other.longs !== void 0 || other.typed !== void 0 || other.lo !== void 0 || other.hi !== void 0 || float.f32 !== void 0 || float.bits !== void 0 || float.f64 !== void 0) {
+        throw argumentError(`array ${this.id}: an array target needs exactly one destination`);
+      }
+      if (kind !== ArrayKind.Unsigned) {
+        throw argumentError(`array ${this.id}: a bool destination needs an unsigned array`);
+      }
+      if (bt.bool.length < count) {
+        throw argumentError(
+          `array ${this.id}: bool destination holds ${bt.bool.length} of ${count} elements`
+        );
+      }
+      return 4 /* Bool */;
+    }
+    const it = t;
+    const halves = it.lo !== void 0 || it.hi !== void 0;
+    const named = (it.values !== void 0 ? 1 : 0) + (it.longs !== void 0 ? 1 : 0) + (it.typed !== void 0 ? 1 : 0) + (halves ? 1 : 0);
+    if (named !== 1) {
+      throw argumentError(
+        `array ${this.id}: an integer array target needs exactly one destination (values, typed, longs, or lo+hi), got ${named}`
+      );
+    }
+    if (it.minLo >>> 0 !== it.minLo || it.minHi >>> 0 !== it.minHi || it.maxLo >>> 0 !== it.maxLo || it.maxHi >>> 0 !== it.maxHi) {
+      throw argumentError(
+        `array ${this.id}: the element bound must be four unsigned 32-bit halves`
+      );
+    }
+    const signed = kind === ArrayKind.Signed;
+    const minHi = signed ? it.minHi | 0 : it.minHi;
+    const maxHi = signed ? it.maxHi | 0 : it.maxHi;
+    if (minHi > maxHi || minHi === maxHi && it.minLo > it.maxLo) {
+      throw argumentError(
+        `array ${this.id}: the element bound is empty (min ${it.minHi}:${it.minLo} > max ${it.maxHi}:${it.maxLo})`
+      );
+    }
+    if (it.typed !== void 0) {
+      return kind === ArrayKind.Signed ? this.typedModeS(it, it.typed, kind, count) : this.typedModeU(it, it.typed, kind, count);
+    }
+    if (halves) {
+      const lo = it.lo;
+      const hi = it.hi;
+      if (lo === void 0 || hi === void 0) {
+        throw argumentError(`array ${this.id}: the halves destination needs both lo and hi`);
+      }
+      if (lo.length < count || hi.length < count) {
+        throw argumentError(
+          `array ${this.id}: halves destination holds ${Math.min(lo.length, hi.length)} of ${count} elements`
+        );
+      }
+      return 6 /* Halves */;
+    }
+    if (it.longs !== void 0) {
+      if (!Array.isArray(it.longs)) {
+        throw argumentError(`array ${this.id}: the longs destination must be an Array`);
+      }
+      return 5 /* Longs */;
+    }
+    if (!Array.isArray(it.values)) {
+      throw argumentError(`array ${this.id}: the values destination must be an Array`);
+    }
+    return it.minHi === 0 && it.maxHi === 0 ? 1 /* Values32 */ : 0 /* Values */;
   }
-  resetVarint() {
-    this.vLo = 0;
-    this.vHi = 0;
-    this.vBytes = 0;
+  /** The typed-destination check of {@link resolveTarget} for an unsigned array. */
+  typedModeU(it, d, kind, count) {
+    if (d.length < count) {
+      throw argumentError(
+        `array ${this.id}: typed destination holds ${d.length} of ${count} elements`
+      );
+    }
+    const cap = typedCapacity(d.constructor);
+    const signed = kind === ArrayKind.Signed;
+    if ((cap === void 0 || cap.max === Number.POSITIVE_INFINITY) && is64(d)) {
+      if (signed !== d instanceof BigInt64Array) {
+        throw argumentError(
+          `array ${this.id}: a 64-bit typed destination must match the array's signedness`
+        );
+      }
+      this.bulk64 = new Uint32Array(d.buffer, d.byteOffset, d.length * 2);
+      return 3 /* Typed64 */;
+    }
+    const minV = signed ? (it.minHi | 0) * TWO32 + it.minLo : it.minHi * TWO32 + it.minLo;
+    const maxV = signed ? (it.maxHi | 0) * TWO32 + it.maxLo : it.maxHi * TWO32 + it.maxLo;
+    if (cap === void 0) {
+      throw argumentError(`array ${this.id}: unsupported typed destination`);
+    }
+    if (minV < cap.min || maxV > cap.max) {
+      throw argumentError(
+        `array ${this.id}: the element bound ${minV}..${maxV} does not fit the typed destination (${cap.min}..${cap.max})`
+      );
+    }
+    return 2 /* Typed */;
+  }
+  /** The signed twin of {@link typedModeU}: textually identical, for its own inline caches. */
+  typedModeS(it, d, kind, count) {
+    if (d.length < count) {
+      throw argumentError(
+        `array ${this.id}: typed destination holds ${d.length} of ${count} elements`
+      );
+    }
+    const cap = typedCapacity(d.constructor);
+    const signed = kind === ArrayKind.Signed;
+    if ((cap === void 0 || cap.max === Number.POSITIVE_INFINITY) && is64(d)) {
+      if (signed !== d instanceof BigInt64Array) {
+        throw argumentError(
+          `array ${this.id}: a 64-bit typed destination must match the array's signedness`
+        );
+      }
+      this.bulk64 = new Uint32Array(d.buffer, d.byteOffset, d.length * 2);
+      return 3 /* Typed64 */;
+    }
+    const minV = signed ? (it.minHi | 0) * TWO32 + it.minLo : it.minHi * TWO32 + it.minLo;
+    const maxV = signed ? (it.maxHi | 0) * TWO32 + it.maxLo : it.maxHi * TWO32 + it.maxLo;
+    if (cap === void 0) {
+      throw argumentError(`array ${this.id}: unsupported typed destination`);
+    }
+    if (minV < cap.min || maxV > cap.max) {
+      throw argumentError(
+        `array ${this.id}: the element bound ${minV}..${maxV} does not fit the typed destination (${cap.min}..${cap.max})`
+      );
+    }
+    return 2 /* Typed */;
+  }
+  /**
+   * The whole `S.ArrayUElem` arm for an array whose destination was handed over:
+   * drain what this chunk holds, store a straddling tail element, close the array
+   * when it ends. Returns the new read position; the caller's `break` then either
+   * re-enters this state for the next chunk or leaves it, exactly as before.
+   *
+   * **Out of line, for the reason {@link fpDrain} already gives.** Everything
+   * written into {@link push}'s switch is paid for by every decode that never
+   * reaches it, so this arm is three lines at the call site and a method here.
+   * Carrying its body in the switch instead cost `decode: typical` 5092 -> 5099
+   * Ir/op and `decode: u64 array` 705.0k -> 708.5k; giving each bulk arm a state
+   * of its own — which keeps the per-element arms untouched but adds three labels
+   * — cost 5163 on `typical`, worse than either. What is left is what the
+   * hand-off costs a decode that never takes it: 0.34% (5075 -> 5092, 702.5k ->
+   * 705.0k), in the loop's own size.
+   *
+   * Suspension needs no signal of its own: a varint that did not complete consumed
+   * the chunk to its end, so the returned position is `n` and the decode loop exits
+   * on its own condition.
+   *
+   * **One loop per destination**, chosen once (see {@link bulkMode}) rather than
+   * branched on per element: the shapes differ only in what a stored element *is*,
+   * and a loop deciding that per element would give back what the hand-off saves.
+   * `arrIndex` is likewise written once per drain instead of once per element,
+   * which is part of why a bulk fill costs less than *discarding* the same
+   * elements. A refusal mid-loop leaves it at the last committed value; nothing
+   * reads it afterwards, because that verdict is terminal (§5.2.1).
+   */
+  uBulkArm(input, i, n, count, safeEnd) {
+    const t = this.bulk;
+    const mode = this.bulkMode;
+    const minLo = t.minLo;
+    const minHi = t.minHi;
+    const maxLo = t.maxLo;
+    const maxHi = t.maxHi;
+    for (; ; ) {
+      if (this.vBytes === 0) {
+        let idx = this.arrIndex;
+        if (mode === 1 /* Values32 */) {
+          const out = t.values;
+          while (idx < count && i <= safeEnd) {
+            i = this.varintFull(input, i);
+            const lo = this.vLo >>> 0;
+            if (this.vHi !== 0 || lo < minLo || lo > maxLo) this.outOfBound(idx);
+            out[idx++] = lo;
+          }
+        } else if (mode === 2 /* Typed */) {
+          const out = t.typed;
+          while (idx < count && i <= safeEnd) {
+            i = this.varintFull(input, i);
+            const lo = this.vLo >>> 0;
+            if (this.vHi !== 0 || lo < minLo || lo > maxLo) this.outOfBound(idx);
+            out[idx++] = lo;
+          }
+        } else if (mode === 3 /* Typed64 */) {
+          const out = this.bulk64;
+          while (idx < count && i <= safeEnd) {
+            i = this.varintFull(input, i);
+            const lo = this.vLo >>> 0;
+            const hi = this.vHi >>> 0;
+            if (hi < minHi || hi === minHi && lo < minLo || hi > maxHi || hi === maxHi && lo > maxLo) {
+              this.outOfBound(idx);
+            }
+            out[idx * 2 + LO] = lo;
+            out[idx * 2 + HI] = hi;
+            idx++;
+          }
+        } else if (mode === 4 /* Bool */) {
+          const out = this.bulk.bool;
+          while (idx < count && i <= safeEnd) {
+            i = this.varintFull(input, i);
+            out[idx++] = this.vLo !== 0 || this.vHi !== 0 ? 1 : 0;
+          }
+        } else if (mode === 0 /* Values */) {
+          const out = t.values;
+          while (idx < count && i <= safeEnd) {
+            i = this.varintFull(input, i);
+            const lo = this.vLo >>> 0;
+            const hi = this.vHi >>> 0;
+            if (hi < minHi || hi === minHi && lo < minLo || hi > maxHi || hi === maxHi && lo > maxLo) {
+              this.outOfBound(idx);
+            }
+            out[idx++] = hi <= 2097151 ? hi * TWO32 + lo : joinU64(lo, hi);
+          }
+        } else if (mode === 5 /* Longs */) {
+          const out = t.longs;
+          while (idx < count && i <= safeEnd) {
+            i = this.varintFull(input, i);
+            const lo = this.vLo >>> 0;
+            const hi = this.vHi >>> 0;
+            if (hi < minHi || hi === minHi && lo < minLo || hi > maxHi || hi === maxHi && lo > maxLo) {
+              this.outOfBound(idx);
+            }
+            out[idx++] = new Long(lo, hi);
+          }
+        } else {
+          const oLo = t.lo;
+          const oHi = t.hi;
+          while (idx < count && i <= safeEnd) {
+            i = this.varintFull(input, i);
+            const lo = this.vLo >>> 0;
+            const hi = this.vHi >>> 0;
+            if (hi < minHi || hi === minHi && lo < minLo || hi > maxHi || hi === maxHi && lo > maxLo) {
+              this.outOfBound(idx);
+            }
+            oLo[idx] = lo;
+            oHi[idx] = hi;
+            idx++;
+          }
+        }
+        this.arrIndex = idx;
+      }
+      if (this.arrIndex === count) {
+        this.endArray();
+        return i;
+      }
+      if (i >= n) return i;
+      i = this.varintStep(input, i);
+      if (!this.vComplete) return i;
+      this.bulkStoreU(this.arrIndex, this.vLo >>> 0, this.vHi >>> 0);
+      if (++this.arrIndex === count) {
+        this.endArray();
+        return i;
+      }
+    }
+  }
+  /** The signed twin of {@link uBulkArm}: the same shape, with the zig-zag undone. */
+  sBulkArm(input, i, n, count, safeEnd) {
+    const t = this.bulk;
+    const mode = this.bulkMode;
+    const minLo = t.minLo;
+    const minHi = t.minHi | 0;
+    const maxLo = t.maxLo;
+    const maxHi = t.maxHi | 0;
+    for (; ; ) {
+      if (this.vBytes === 0) {
+        let idx = this.arrIndex;
+        while (idx < count && i <= safeEnd) {
+          i = this.varintFull(input, i);
+          const raw = this.vLo >>> 0;
+          const rawHi = this.vHi >>> 0;
+          const mask = -(raw & 1) >>> 0;
+          const lo = ((raw >>> 1 | rawHi << 31) >>> 0 ^ mask) >>> 0;
+          const hi = (rawHi >>> 1 ^ mask) >>> 0;
+          const shi = hi | 0;
+          if (shi < minHi || shi === minHi && lo < minLo || shi > maxHi || shi === maxHi && lo > maxLo) {
+            this.outOfBound(idx);
+          }
+          if (mode === 2 /* Typed */) {
+            t.typed[idx] = lo | 0;
+          } else if (mode === 3 /* Typed64 */) {
+            const o = this.bulk64;
+            o[idx * 2 + LO] = lo;
+            o[idx * 2 + HI] = hi;
+          } else if (mode === 0 /* Values */ || mode === 1 /* Values32 */) {
+            let v;
+            if (rawHi <= 2097151) {
+              const r = rawHi * TWO32 + raw;
+              v = r % 2 === 0 ? r / 2 : -(r + 1) / 2;
+            } else {
+              v = joinI64(lo, hi);
+            }
+            t.values[idx] = v;
+          } else if (mode === 5 /* Longs */) {
+            t.longs[idx] = new Long(lo, hi);
+          } else {
+            t.lo[idx] = lo;
+            t.hi[idx] = hi;
+          }
+          idx++;
+        }
+        this.arrIndex = idx;
+      }
+      if (this.arrIndex === count) {
+        this.endArray();
+        return i;
+      }
+      if (i >= n) return i;
+      i = this.varintStep(input, i);
+      if (!this.vComplete) return i;
+      this.bulkStoreS(this.arrIndex, this.vLo >>> 0, this.vHi >>> 0);
+      if (++this.arrIndex === count) {
+        this.endArray();
+        return i;
+      }
+    }
+  }
+  /** The float twin of {@link uBulkArm}; a straddling element resumes through {@link fpStep}. */
+  fpBulkArm(input, i, n, count, size, isFp32) {
+    if (this.have === 0 && this.arrIndex < count && n - i >= size) {
+      const t = this.bulk;
+      const run = Math.min(count - this.arrIndex, (n - i) / size | 0);
+      let idx = this.arrIndex;
+      const bitsOut = this.bulkMode === 8 /* F32Bits */ ? t.bits : null;
+      if (run >= (isFp32 ? FP32_HANDLE_MIN : FP64_HANDLE_MIN)) {
+        const dv = this.dataView(input);
+        if (bitsOut !== null) {
+          for (let k = 0; k < run; k++) {
+            bitsOut[idx++] = dv.getUint32(i, true);
+            i += 4;
+          }
+        } else if (isFp32) {
+          const out = t.f32;
+          for (let k = 0; k < run; k++) {
+            const v = dv.getFloat32(i, true);
+            if (v === v) out[idx] = v;
+            else this.f32StoreWord(out, idx, dv.getUint32(i, true));
+            idx++;
+            i += 4;
+          }
+        } else {
+          const out = t.f64;
+          for (let k = 0; k < run; k++) {
+            out[idx++] = dv.getFloat64(i, true);
+            i += 8;
+          }
+        }
+      } else if (bitsOut !== null) {
+        for (let k = 0; k < run; k++) {
+          bitsOut[idx++] = u32le(input, i);
+          i += 4;
+        }
+      } else if (isFp32) {
+        const out = t.f32;
+        for (let k = 0; k < run; k++) {
+          const w = u32le(input, i);
+          if ((w & 2147483647) > 2139095040) this.f32StoreWord(out, idx, w);
+          else out[idx] = fp32FromBits(w);
+          idx++;
+          i += 4;
+        }
+      } else {
+        const out = t.f64;
+        for (let k = 0; k < run; k++) {
+          out[idx++] = fp64FromBits(u32le(input, i), u32le(input, i + 4));
+          i += 8;
+        }
+      }
+      this.arrIndex = idx;
+    }
+    if (this.arrIndex === count) {
+      this.endArray();
+      return i;
+    }
+    if (i >= n) return i;
+    i = this.fpStep(input, i, n);
+    if (this.have < this.need) return i;
+    const lo = this.fpLo;
+    const hi = this.fpHi;
+    this.fpBegin(size);
+    this.bulkStoreFp(this.arrIndex, lo, hi, isFp32);
+    if (++this.arrIndex === count) this.endArray();
+    return i;
+  }
+  /**
+   * Store an fp32 NaN into a `Float32Array` destination by its wire word (§4.6).
+   * Widening a NaN to a double quiets a signaling one (and an engine may purify
+   * the payload of any NaN it reads from a typed array), so a NaN never goes
+   * through a value: it is written through a word view over the destination's own
+   * storage. Every other fp32 survives the double exactly, which is why the view
+   * is built lazily, on the array's first NaN, and never on the common path —
+   * touching `.buffer` moves a small typed array's storage off the heap. It is
+   * kept in {@link bulk64} for the rest of the array, so the count is one per
+   * array however many NaNs the wire carries (§6.6.2).
+   */
+  f32StoreWord(out, idx, word) {
+    let w = this.bulk64;
+    if (w === null) w = this.bulk64 = new Uint32Array(out.buffer, out.byteOffset, out.length);
+    w[idx] = word;
+  }
+  /** Store one float element that straddled a chunk boundary (see {@link bulkStoreU}). */
+  bulkStoreFp(idx, lo, hi, isFp32) {
+    const t = this.bulk;
+    if (!isFp32) t.f64[idx] = fp64FromBits(lo, hi);
+    else if (this.bulkMode === 8 /* F32Bits */) t.bits[idx] = lo >>> 0;
+    else if ((lo & 2147483647) > 2139095040) this.f32StoreWord(t.f32, idx, lo >>> 0);
+    else t.f32[idx] = fp32FromBits(lo);
+  }
+  /**
+   * Store one unsigned element that straddled a chunk boundary — the tail a drain
+   * loop cannot take, resumed from the varint accumulator. At most one per chunk,
+   * so it re-decides the destination rather than duplicating three loops.
+   */
+  bulkStoreU(idx, lo, hi) {
+    const t = this.bulk;
+    if (hi < t.minHi || hi === t.minHi && lo < t.minLo || hi > t.maxHi || hi === t.maxHi && lo > t.maxLo) {
+      this.outOfBound(idx);
+    }
+    if (this.bulkMode === 0 /* Values */ || this.bulkMode === 1 /* Values32 */) {
+      t.values[idx] = this.vUnsigned();
+    } else if (this.bulkMode === 2 /* Typed */) {
+      t.typed[idx] = lo;
+    } else if (this.bulkMode === 3 /* Typed64 */) {
+      const o = this.bulk64;
+      o[idx * 2 + LO] = lo;
+      o[idx * 2 + HI] = hi;
+    } else if (this.bulkMode === 4 /* Bool */) {
+      this.bulk.bool[idx] = lo !== 0 || hi !== 0 ? 1 : 0;
+    } else if (this.bulkMode === 5 /* Longs */) {
+      t.longs[idx] = new Long(lo, hi);
+    } else {
+      t.lo[idx] = lo;
+      t.hi[idx] = hi;
+    }
+  }
+  /** The signed twin of {@link bulkStoreU}; `raw`/`rawHi` are the zig-zag halves. */
+  bulkStoreS(idx, raw, rawHi) {
+    const t = this.bulk;
+    const mask = -(raw & 1) >>> 0;
+    const lo = ((raw >>> 1 | rawHi << 31) >>> 0 ^ mask) >>> 0;
+    const hi = (rawHi >>> 1 ^ mask) >>> 0;
+    const shi = hi | 0;
+    if (shi < (t.minHi | 0) || shi === (t.minHi | 0) && lo < t.minLo || shi > (t.maxHi | 0) || shi === (t.maxHi | 0) && lo > t.maxLo) {
+      this.outOfBound(idx);
+    }
+    if (this.bulkMode === 0 /* Values */ || this.bulkMode === 1 /* Values32 */) {
+      t.values[idx] = this.vSigned();
+    } else if (this.bulkMode === 2 /* Typed */) t.typed[idx] = lo | 0;
+    else if (this.bulkMode === 3 /* Typed64 */) {
+      const o = this.bulk64;
+      o[idx * 2 + LO] = lo;
+      o[idx * 2 + HI] = hi;
+    } else if (this.bulkMode === 5 /* Longs */) t.longs[idx] = new Long(lo, hi);
+    else {
+      t.lo[idx] = lo;
+      t.hi[idx] = hi;
+    }
+  }
+  /**
+   * Refuse an element outside the bound its target declared (§7.3): the message
+   * says a thing the schema does not allow, so it is `INVALID` and terminal, the
+   * same verdict at the same point as a generated per-element guard raises today.
+   * The destination keeps everything written before this element — see
+   * {@link ArrayTarget}.
+   */
+  outOfBound(index) {
+    const t = this.bulk;
+    if (t !== null) this.trimPlain(t, index);
+    this.fail(`array ${this.id}: element ${index} outside the schema bound`);
+  }
+  /**
+   * Report one payload piece: the caller's own fed chunk plus the coordinates of
+   * the piece inside it (§6.6.3). No view is created — this decoder allocates
+   * nothing (§6.6) and exposes no borrowed slice of its own (§6.7); `src` is the
+   * very array the caller passed to `feed`, so whoever wants the bytes copies
+   * them out of memory it already owns, during the call.
+   */
+  emitBytes(src, start, end) {
+    const v = this.cur;
+    if (this.fixSub === FixlenSubtype.String) {
+      v.string?.(this.id, this.fixLen, this.fixOff, src, start, end);
+    } else {
+      v.blob?.(this.id, this.fixLen, this.fixOff, src, start, end);
+    }
+  }
+  /**
+   * Consume varint bytes from `input` at `i` into the {@link vLo} / {@link vHi}
+   * accumulator, resuming across chunk boundaries; sets {@link vComplete} when a
+   * terminator byte arrives. Number-only — no per-byte `bigint`.
+   */
+  varintStep(input, i) {
+    if (this.vBytes === 0) {
+      const n0 = input.length;
+      const b0 = input[i];
+      if (b0 < 128) {
+        this.vLo = b0;
+        this.vHi = 0;
+        this.vComplete = true;
+        return i + 1;
+      }
+      if (i + 1 < n0) {
+        const b1 = input[i + 1];
+        if (b1 < 128) {
+          this.vLo = b0 & 127 | b1 << 7;
+          this.vHi = 0;
+          this.vComplete = true;
+          return i + 2;
+        }
+        if (i + 2 < n0) {
+          const b2 = input[i + 2];
+          if (b2 < 128) {
+            this.vLo = b0 & 127 | (b1 & 127) << 7 | b2 << 14;
+            this.vHi = 0;
+            this.vComplete = true;
+            return i + 3;
+          }
+        }
+      }
+      if (n0 - i >= VARINT_MAX_BYTES) return this.varintFull(input, i);
+    }
+    const k0 = this.vBytes;
+    let lo = k0 === 0 ? 0 : this.vLo;
+    let hi = k0 === 0 ? 0 : this.vHi;
+    let k = k0;
+    const n = input.length;
+    while (i < n) {
+      if (k >= VARINT_MAX_BYTES) this.fail("varint overflow");
+      const b = input[i++];
+      if (k < 4) lo |= (b & 127) << 7 * k;
+      else if (k === 4) {
+        lo |= (b & 15) << 28;
+        hi |= b >> 4 & 7;
+      } else {
+        if (k === 9 && (b & 127) >> 1 !== 0) this.fail("varint overflow");
+        hi |= (b & 127) << 7 * k - 32;
+      }
+      k++;
+      if ((b & 128) === 0) {
+        this.vLo = lo;
+        this.vHi = hi;
+        this.vBytes = 0;
+        this.vComplete = true;
+        return i;
+      }
+    }
+    if (k >= VARINT_MAX_BYTES) this.fail("varint overflow");
+    this.vLo = lo;
+    this.vHi = hi;
+    this.vBytes = k;
     this.vComplete = false;
+    return i;
   }
-  /** The accumulated varint as a `bigint` (full 64-bit fidelity). */
-  vBig() {
-    return this.vHi === 0 ? BigInt(this.vLo >>> 0) : BigInt(this.vHi >>> 0) << 32n | BigInt(this.vLo >>> 0);
+  /**
+   * Decode the varint at `i` **if that needs no resume bookkeeping**, returning
+   * the index past it, or `-1` when it does (leaving the accumulator untouched,
+   * so the resumable ladder starts the word from scratch).
+   *
+   * Three cases, in the order they are worth testing:
+   *
+   * * ten bytes in hand — the unrolled {@link varintFull}, no bounds checks at
+   *   all;
+   * * a one-byte varint — every small id, length, count and scalar;
+   * * a two-byte one — every id past 15, and mid-sized lengths and counts.
+   *
+   * Past that the word may straddle the chunk, and only the ladder can carry the
+   * state across `feed` calls.
+   */
+  varintQuick(input, i, n) {
+    if (n - i >= VARINT_MAX_BYTES) return this.varintFull(input, i);
+    if (i >= n) return -1;
+    const b0 = input[i];
+    if (b0 < 128) return this.setVarint(b0, 0, i + 1);
+    if (i + 1 < n) {
+      const b1 = input[i + 1];
+      if (b1 < 128) return this.setVarint(b0 & 127 | b1 << 7, 0, i + 2);
+      if (i + 2 < n) {
+        const b2 = input[i + 2];
+        if (b2 < 128) {
+          return this.setVarint(b0 & 127 | (b1 & 127) << 7 | b2 << 14, 0, i + 3);
+        }
+      }
+    }
+    return -1;
   }
   /**
-   * The accumulated varint as an unsigned value, number-first: a `number` when
-   * it fits exactly (`≤ 2^53-1`, which covers all ids, u8..u32 and small u64s),
-   * a `bigint` only beyond that. Avoids a bigint allocation on the common path.
+   * Decode one varint that is **guaranteed** to lie wholly within `input` — the
+   * caller has checked that {@link VARINT_MAX_BYTES} bytes remain — into
+   * {@link vLo} / {@link vHi}, returning the index past it.
+   *
+   * Unrolled and branch-per-byte: with the bytes known to be present there is no
+   * bounds check, no resume counter and no `k`-dispatch per byte, which is the
+   * whole per-byte cost of the resumable loop above. Reports the same `>64-bit`
+   * overflow as that loop.
+   */
+  varintFull(input, i) {
+    let b = input[i];
+    let lo = b & 127;
+    let hi = 0;
+    if (b < 128) return this.setVarint(lo, 0, i + 1);
+    b = input[i + 1];
+    lo |= (b & 127) << 7;
+    if (b < 128) return this.setVarint(lo, 0, i + 2);
+    b = input[i + 2];
+    lo |= (b & 127) << 14;
+    if (b < 128) return this.setVarint(lo, 0, i + 3);
+    b = input[i + 3];
+    lo |= (b & 127) << 21;
+    if (b < 128) return this.setVarint(lo, 0, i + 4);
+    b = input[i + 4];
+    lo |= (b & 15) << 28;
+    hi = b >> 4 & 7;
+    if (b < 128) return this.setVarint(lo, hi, i + 5);
+    b = input[i + 5];
+    hi |= (b & 127) << 3;
+    if (b < 128) return this.setVarint(lo, hi, i + 6);
+    b = input[i + 6];
+    hi |= (b & 127) << 10;
+    if (b < 128) return this.setVarint(lo, hi, i + 7);
+    b = input[i + 7];
+    hi |= (b & 127) << 17;
+    if (b < 128) return this.setVarint(lo, hi, i + 8);
+    b = input[i + 8];
+    hi |= (b & 127) << 24;
+    if (b < 128) return this.setVarint(lo, hi, i + 9);
+    b = input[i + 9];
+    if ((b & 127) >> 1 !== 0) this.fail("varint overflow");
+    hi |= (b & 127) << 31;
+    if (b < 128) return this.setVarint(lo, hi, i + 10);
+    this.fail("varint overflow");
+  }
+  /** Publish a fully-decoded varint and the cursor past it (see {@link varintFull}). */
+  setVarint(lo, hi, i) {
+    this.vLo = lo;
+    this.vHi = hi;
+    this.vBytes = 0;
+    this.vComplete = true;
+    return i;
+  }
+  /**
+   * The accumulated varint as an unsigned value, number-first: a `number` when it
+   * fits exactly (`≤ 2^53-1`, which covers all ids, u8..u32 and small u64s), a
+   * `bigint` only beyond that.
    */
   vUnsigned() {
     const hi = this.vHi >>> 0;
-    return hi <= 2097151 ? hi * TWO322 + (this.vLo >>> 0) : this.vBig();
+    return hi <= 2097151 ? hi * TWO32 + (this.vLo >>> 0) : joinU64(this.vLo >>> 0, hi);
   }
   /** The accumulated zig-zag varint as a signed value, number-first (see {@link vUnsigned}). */
   vSigned() {
     const hi = this.vHi >>> 0;
     if (hi <= 2097151) {
-      const r = hi * TWO322 + (this.vLo >>> 0);
+      const r = hi * TWO32 + (this.vLo >>> 0);
       return r % 2 === 0 ? r / 2 : -(r + 1) / 2;
     }
-    return zigzagDecode(this.vBig());
+    const lo = this.vLo >>> 0;
+    const mask = -(lo & 1) >>> 0;
+    return joinI64(
+      ((lo >>> 1 | hi << 31) >>> 0 ^ mask) >>> 0,
+      (hi >>> 1 ^ mask) >>> 0
+    );
   }
-  /** The accumulated varint as a JS number — exact for ids/lengths/counts. */
+  /**
+   * The accumulated varint as a JS number — exact for ids/lengths/counts.
+   *
+   * The `>>> 0` is load-bearing: `vHi` is accumulated with 32-bit bitwise ops, so
+   * bit 63 of the varint lands on its sign bit and the value reads back negative,
+   * sliding past the `count > ARRAY_MAX` guard.
+   */
   vNum() {
-    return this.vHi * TWO322 + (this.vLo >>> 0);
-  }
-  /** The accumulated varint's low 3 tag bits (the wire type / fixlen subtype). */
-  vTag() {
-    return this.vLo & 7;
+    return (this.vHi >>> 0) * TWO32 + (this.vLo >>> 0);
   }
   /** The accumulated varint with its low 3 tag bits stripped (`value >> 3`). */
   vUpper() {
-    return (this.vHi >>> 0) * (TWO322 / 8) + (this.vLo >>> 3);
+    return (this.vHi >>> 0) * (TWO32 / 8) + (this.vLo >>> 3);
   }
-  /** Accumulate `need` raw bytes into {@link scratch}. */
-  fpStep(input, i) {
-    while (this.have < this.need && i < input.length) {
-      this.scratch[this.have++] = input[i++];
+  /**
+   * The handle over `input`, built on demand and reused while the same chunk is
+   * being fed (see {@link view}).
+   */
+  dataView(input) {
+    if (this.viewOf !== input) {
+      this.view = new DataView(input.buffer, input.byteOffset, input.byteLength);
+      this.viewOf = input;
     }
+    return this.view;
+  }
+  /** Accumulate up to `need` raw float bytes into {@link fpLo} / {@link fpHi}. */
+  fpStep(input, i, n) {
+    let have = this.have;
+    const need = this.need;
+    while (have < need && i < n) {
+      const b = input[i++];
+      if (have < 4) this.fpLo |= b << (have << 3);
+      else this.fpHi |= b << (have - 4 << 3);
+      have++;
+    }
+    this.have = have;
     return i;
   }
+  /** Start a fresh fp accumulation of `need` bytes. */
+  fpBegin(need) {
+    this.need = need;
+    this.have = 0;
+    this.fpLo = 0;
+    this.fpHi = 0;
+  }
 };
+function u32le(b, i) {
+  return (b[i] | b[i + 1] << 8 | b[i + 2] << 16 | b[i + 3] << 24) >>> 0;
+}
 
 // src/decode/istream.ts
 var IStream = class {
   /**
-   * @param limits Optional opt-in decode caps ({@link DecodeLimits}). An
-   * over-limit array count or string / blob length throws {@link SofabError}
-   * (`LIMIT_EXCEEDED`) from {@link feed}, at the offending field's header and
-   * before any of its payload is streamed to the visitor. Omit for no caps.
-   */
-  constructor(limits) {
-    this.state = new DecoderState(limits);
-  }
-  /**
-   * Feed a chunk of bytes, dispatching decoded fields to `visitor`. Throws
-   * {@link SofabError} (`INVALID_MSG`) only if the bytes are *malformed*;
-   * running out of bytes mid-field is not an error — it simply suspends until
-   * the next chunk (see {@link end}).
+   * @param visitor The field handler this stream drives, for its whole life — and
+   * the layer that holds the receiver caps, if any (§6.2.1; see the class doc).
    */
-  feed(chunk, visitor) {
-    this.state.push(chunk, visitor);
+  constructor(visitor) {
+    this.state = new DecoderState(visitor);
   }
   /**
-   * Report whether the stream ended exactly at a field boundary. Call after the
-   * final {@link feed}: returns {@link DecodeStatus.Complete} at a clean field
-   * boundary, or {@link DecodeStatus.Incomplete} if the last chunk ended inside
-   * a field (a partial varint, an unfinished payload / array, or a still-open
-   * nested sequence).
+   * Feed a chunk of bytes, dispatching decoded fields to the bound visitor, and
+   * **return** where the decode stands after them (§5.2.1):
+   * {@link DecodeStatus.Complete} when they end exactly at a field boundary,
+   * {@link DecodeStatus.Incomplete} when they end *inside* a field (a partial
+   * varint, an unfinished payload / array, or a still-open nested sequence).
+   * Running out of bytes mid-field is not an error — the decode merely suspends
+   * until the next chunk, and the caller owns end-of-input.
    *
-   * Per the finish-less spec (MESSAGE_SPEC §7) this is a pure accessor: it never
-   * throws and never promotes an incomplete decode to an error — the caller owns
-   * end-of-input and decides whether a trailing `Incomplete` is a truncation
-   * error. (A *malformed* message has already thrown from {@link feed}.)
+   * **This call is the only place the answer is.** There is no finish / finalize
+   * step (§5.2.4) and no status accessor: what this returns, or throws, is the
+   * whole of what the stream has to say, so a caller is never one question short
+   * after it and never has two answers to reconcile. Feeding an empty chunk
+   * re-reads the same value without consuming anything, for a caller that wants
+   * the outcome again without holding on to it.
+   *
+   * The chunk is borrowed **only for the duration of this call** (§6.0): once it
+   * returns, the caller may reuse, overwrite or free that memory, and the decoded
+   * message is unaffected — the decoder retains nothing that points into it.
+   *
+   * `INVALID` travels on the error channel — this port's idiomatic surfacing of
+   * it: *malformed* bytes throw {@link SofabError} (`INVALID_MSG`) instead of
+   * returning a status, which is why the return type names only the other two.
+   * That verdict is **terminal** (§5.2.1): the stream latches it, so a caller that
+   * catches the throw and feeds on gets the same error again from every later
+   * call — no further byte is consumed and no visitor method is invoked. A caller
+   * that caught it already holds the verdict, in the code on the error it caught.
+   *
+   * A receiver-limit rejection (`LIMIT_EXCEEDED`, §6.2.1) travels the same
+   * channel — thrown out of the visitor callback that compared the cap — but it
+   * is **not** the `INVALID` outcome and never becomes one: the bytes are
+   * well-formed and the same message decodes under a looser cap, so it is a
+   * policy rejection (§6.2.1, §6.3). The two stay distinguishable by their code,
+   * which is what §6.3 requires; §6.3 leaves the surfacing open between "a fourth
+   * decode outcome" and "a terminal failure carrying the `LimitExceeded` code on
+   * the error channel", and this port takes the second. **Terminal** is the other
+   * half of that sentence and holds exactly as it does for `INVALID`: the stream
+   * latches the rejection, so every later call re-throws it under the same code,
+   * consumes no byte and drives no visitor method. It is *only* on the error
+   * channel — the three-valued outcome has no value for "valid, but more than I am
+   * configured to accept", so there is nothing about it to read back as a status,
+   * and nothing that has to be kept in step with the throw.
    */
-  end() {
-    return this.state.finish();
+  feed(chunk) {
+    this.state.push(chunk);
+    return this.state.outcome();
   }
 };
-function decode(bytes, visitor, limits) {
-  decodeContiguous(bytes, visitor, limits);
+function decode(bytes, visitor) {
+  const state = pooled ?? new DecoderState();
+  pooled = null;
+  try {
+    state.begin(visitor);
+    state.push(bytes);
+    if (state.outcome() !== DecodeStatus.Complete) {
+      throw incompleteError("truncated message: input ends inside a field");
+    }
+  } finally {
+    state.release();
+    pooled = state;
+  }
 }
+var pooled = null;
 
-// src/decode/cursor.ts
-var TWO323 = 4294967296;
+// src/decode/text.ts
 var _utf8 = new TextDecoder("utf-8", { fatal: true });
-var Cursor = class {
-  constructor(buf, limits) {
-    /** Field id of the header last accepted by {@link readHeader}. */
-    this.id = 0;
-    /** Wire type of the header last accepted by {@link readHeader}. */
-    this.wire = 0;
-    /**
-     * Fixlen subtype of the header last accepted by {@link readHeader} — one of
-     * {@link FixlenSubtype} — when its {@link wire} is {@link WireType.Fixlen} or
-     * {@link WireType.ArrayFixlen}; `-1` otherwise (a non-fixlen field, or a
-     * fixlen field whose subtype word is truncated away).
-     *
-     * The four fixlen subtypes (`fp32`, `fp64`, `string`, `blob`) all share one
-     * {@link wire} type, so {@link wire} alone cannot separate them. This is the
-     * companion accessor that can: a generated guard reads it right after
-     * {@link readHeader} to skip a field whose delivered subtype contradicts the
-     * schema (MESSAGE_SPEC §7.3), exactly as it already does on {@link wire} for
-     * the other kinds:
-     *
-     * ```ts
-     * case 9: if (c.wire !== WireType.Fixlen || c.fixSub !== FixlenSubtype.Fp64) {
-     *   c.skip(c.wire); break;
-     * } o.somefp64 = c.readFp64(); break;
-     * ```
-     *
-     * It is *peeked* — the subtype word is not consumed — so the matching typed
-     * reader (or {@link skip}) still reads and validates it, and a malformed or
-     * truncated word surfaces `INVALID` / `INCOMPLETE` there as before.
-     */
-    this.fixSub = -1;
-    this.p = 0;
-    // Last varint, as two unsigned 32-bit halves (see readVarint).
-    this.lo = 0;
-    this.hi = 0;
-    // Number of nested sequences currently open (0 = root). Incremented when
-    // readHeader accepts a SequenceStart, decremented when it consumes the matching
-    // SequenceEnd (or when skip() discards a whole nested sequence). Lets the pull
-    // parser tell a root-level dangling sequence-end (INVALID) and an unclosed
-    // sequence at end-of-buffer (INCOMPLETE) apart from a clean boundary.
-    this.depth = 0;
-    this.buf = buf;
-    this.n = buf.length;
-    this.view = new DataView(buf.buffer, buf.byteOffset, buf.length);
-    this.maxArrayCount = limits?.maxArrayCount ?? Infinity;
-    this.maxStringLen = limits?.maxStringLen ?? Infinity;
-    this.maxBlobLen = limits?.maxBlobLen ?? Infinity;
-  }
-  /**
-   * Advance to the next field header. Returns `true` and sets {@link id} /
-   * {@link wire} when a field follows; returns `false` — consuming the marker —
-   * at the end of the buffer *or* at the sequence-end that closes the sequence
-   * this decoder is reading. So a generated per-type decoder loops uniformly:
-   *
-   * ```ts
-   * while (c.readHeader()) {
-   *   switch (c.id) {
-   *     case 4: this.u32 = Number(c.readUnsigned()); break;
-   *     case 10: this.child = Child.decodeFrom(c); break; // nested sequence
-   *     default: c.skip(c.wire); break;                   // unknown field
-   *   }
-   * }
-   * ```
-   *
-   * At the root the loop ends at end-of-buffer; inside a nested sequence it ends
-   * at the matching {@link WireType.SequenceEnd} (which is consumed). A field
-   * whose id is out of range throws {@link SofabError} (`INVALID_MSG`).
-   */
-  readHeader() {
-    if (this.p >= this.n) {
-      if (this.depth > 0) {
-        throw incompleteError("truncated message: unbalanced sequence");
+var FLAT_MAX = 16;
+function decodeUtf8(buf, start = 0, end = buf.length) {
+  const n = end - start;
+  if (n <= 0) return "";
+  if (n <= FLAT_MAX) {
+    let ascii = true;
+    for (let k = start; k < end; k++) {
+      if (buf[k] & 128) {
+        ascii = false;
+        break;
       }
-      return false;
     }
-    this.readVarint();
-    const wire = this.lo & 7;
-    if (wire === WireType.SequenceEnd) {
-      if (this.depth === 0) {
-        throw invalidMsgError("unbalanced sequence end");
-      }
-      this.depth--;
-      return false;
-    }
-    const id = this.upper();
-    if (id > ID_MAX) throw invalidMsgError(`field id ${id} out of range`);
-    if (wire === WireType.SequenceStart) {
-      if (this.depth >= MAX_DEPTH) {
-        throw invalidMsgError(`nesting exceeds MAX_DEPTH (${MAX_DEPTH})`);
+    if (ascii) {
+      switch (n) {
+        case 1:
+          return String.fromCharCode(buf[start]);
+        case 2:
+          return String.fromCharCode(buf[start], buf[start + 1]);
+        case 3:
+          return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2]);
+        case 4:
+          return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3]);
+        case 5:
+          return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4]);
+        case 6:
+          return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5]);
+        case 7:
+          return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6]);
+        case 8:
+          return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7]);
+        case 9:
+          return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8]);
+        case 10:
+          return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8], buf[start + 9]);
+        case 11:
+          return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8], buf[start + 9], buf[start + 10]);
+        case 12:
+          return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8], buf[start + 9], buf[start + 10], buf[start + 11]);
+        case 13:
+          return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8], buf[start + 9], buf[start + 10], buf[start + 11], buf[start + 12]);
+        case 14:
+          return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8], buf[start + 9], buf[start + 10], buf[start + 11], buf[start + 12], buf[start + 13]);
+        case 15:
+          return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8], buf[start + 9], buf[start + 10], buf[start + 11], buf[start + 12], buf[start + 13], buf[start + 14]);
+        case 16:
+          return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8], buf[start + 9], buf[start + 10], buf[start + 11], buf[start + 12], buf[start + 13], buf[start + 14], buf[start + 15]);
       }
-      this.depth++;
-    }
-    this.id = id;
-    this.wire = wire;
-    this.fixSub = this.peekFixSub(wire);
-    return true;
-  }
-  /** Read an unsigned scalar (wire {@link WireType.Unsigned}), number-first. */
-  readUnsigned() {
-    this.readVarint();
-    return this.unsignedValue();
-  }
-  /** Read a signed scalar (wire {@link WireType.Signed}), zig-zag, number-first. */
-  readSigned() {
-    this.readVarint();
-    return this.signedValue();
-  }
-  /** Read a 32-bit float scalar (wire {@link WireType.Fixlen}, subtype fp32). */
-  readFp32() {
-    this.fixlenHeader(FixlenSubtype.Fp32, 4);
-    return this.rawFp32();
-  }
-  /**
-   * Read a 32-bit float scalar as its raw 4 wire bytes (little-endian), zero-copy
-   * — the bit-preserving companion to {@link readFp32}.
-   *
-   * {@link readFp32} returns a JS `number` (a 64-bit double), and widening an
-   * fp32 *signaling* NaN into a double quiets it (0x7F800001 → 0x7FC00001), so a
-   * value consumer can never round-trip one bit-for-bit (§4.6). Generated
-   * bit-exact decode reads the bytes here instead and re-emits them verbatim with
-   * {@link OStream.writeFixlen} (subtype fp32) — mirroring the visitor `raw`
-   * channel on the push paths (fast.ts / state.ts), which the pull path was
-   * missing (corelib-ts#66).
-   *
-   * The header (subtype fp32, length 4) is validated exactly as in
-   * {@link readFp32}; the returned view aliases the source buffer, valid only
-   * until it is reused, like {@link readBlob}.
-   */
-  readFp32Raw() {
-    this.fixlenHeader(FixlenSubtype.Fp32, 4);
-    return this.take(4);
-  }
-  /** Read a 64-bit float scalar (wire {@link WireType.Fixlen}, subtype fp64). */
-  readFp64() {
-    this.fixlenHeader(FixlenSubtype.Fp64, 8);
-    return this.rawFp64();
-  }
-  /**
-   * Read a UTF-8 string scalar (wire {@link WireType.Fixlen}, subtype string).
-   * Pass the schema `maxlen` (byte length) for a bounded string so an
-   * over-length is rejected as `INVALID` at the header, before the payload is
-   * taken (see {@link fixlenLen}); the wire length is exactly the UTF-8 byte
-   * length, so the check is exact. Omit for an unbounded string.
-   */
-  readString(schemaMaxlen) {
-    const len = this.fixlenLen(FixlenSubtype.String, schemaMaxlen);
-    const bytes = this.take(len);
-    try {
-      return _utf8.decode(bytes);
-    } catch {
-      throw invalidMsgError("invalid UTF-8 in string");
-    }
-  }
-  /**
-   * Read a blob scalar (wire {@link WireType.Fixlen}, subtype blob) as a
-   * zero-copy {@link Uint8Array} view into the source buffer.
-   */
-  readBlob(schemaMaxlen) {
-    const len = this.fixlenLen(FixlenSubtype.Blob, schemaMaxlen);
-    return this.take(len);
-  }
-  /**
-   * Read an unsigned array (wire {@link WireType.ArrayUnsigned}), number-first
-   * per element. Pass the schema `count` for a bounded array so an over-count is
-   * rejected as `INVALID` at the header (see {@link arrayCount}); omit it for an
-   * unbounded array (today's behavior).
-   */
-  readUnsignedArray(schemaCount) {
-    const count = this.arrayCount(schemaCount);
-    const out = new Array(count);
-    for (let i = 0; i < count; i++) {
-      this.readVarint();
-      out[i] = this.unsignedValue();
-    }
-    return out;
-  }
-  /** Read a signed array (wire {@link WireType.ArraySigned}), zig-zag, number-first per element. */
-  readSignedArray(schemaCount) {
-    const count = this.arrayCount(schemaCount);
-    const out = new Array(count);
-    for (let i = 0; i < count; i++) {
-      this.readVarint();
-      out[i] = this.signedValue();
-    }
-    return out;
-  }
-  /**
-   * Read an unsigned 64-bit array into {@link Long}[] — the `bigint`-free path.
-   * Each element keeps the raw lo/hi halves; call {@link Long.toBigInt} to
-   * materialise only the values the caller actually needs.
-   */
-  readUnsignedArrayLong(schemaCount) {
-    const count = this.arrayCount(schemaCount);
-    const out = new Array(count);
-    for (let i = 0; i < count; i++) {
-      this.readVarint();
-      out[i] = new Long(this.lo, this.hi);
-    }
-    return out;
-  }
-  /** Read a signed 64-bit array (zig-zag) into {@link Long}[] — the `bigint`-free path. */
-  readSignedArrayLong(schemaCount) {
-    const count = this.arrayCount(schemaCount);
-    const out = new Array(count);
-    for (let i = 0; i < count; i++) {
-      this.readVarint();
-      const lo = this.lo >>> 0;
-      const hi = this.hi >>> 0;
-      const mask = -(lo & 1) >>> 0;
-      out[i] = new Long((lo >>> 1 | hi << 31) >>> 0 ^ mask, hi >>> 1 >>> 0 ^ mask);
-    }
-    return out;
-  }
-  /** Read an fp32 array (wire {@link WireType.ArrayFixlen}, element subtype fp32). */
-  readFp32Array(schemaCount) {
-    const count = this.arrayFixlenHeader(FixlenSubtype.Fp32, 4, schemaCount);
-    const out = new Array(count);
-    for (let i = 0; i < count; i++) out[i] = this.rawFp32();
-    return out;
-  }
-  /**
-   * Read an fp32 array as its raw little-endian element payload (`count * 4`
-   * bytes), zero-copy — the bit-preserving companion to {@link readFp32Array}.
-   * Widening each element to a JS `number` quiets an fp32 *signaling* NaN just as
-   * on the scalar path (§4.6; see {@link readFp32Raw}), so bit-exact decode reads
-   * the whole payload here and re-emits it with {@link OStream.writeFp32ArrayRaw}
-   * (corelib-ts#66). The header (element subtype fp32, size 4) is validated
-   * exactly as in {@link readFp32Array}; the returned view aliases the source
-   * buffer, like {@link readBlob}.
-   */
-  readFp32ArrayRaw(schemaCount) {
-    const count = this.arrayFixlenHeader(FixlenSubtype.Fp32, 4, schemaCount);
-    return this.take(count * 4);
-  }
-  /** Read an fp64 array (wire {@link WireType.ArrayFixlen}, element subtype fp64). */
-  readFp64Array(schemaCount) {
-    const count = this.arrayFixlenHeader(FixlenSubtype.Fp64, 8, schemaCount);
-    const out = new Array(count);
-    for (let i = 0; i < count; i++) out[i] = this.rawFp64();
-    return out;
-  }
-  /**
-   * Consume the value of the field whose header {@link readHeader} just accepted,
-   * discarding it — for a `default:` branch that keeps the cursor in sync on an
-   * unknown id. Pass {@link wire}. A {@link WireType.SequenceStart} skips the
-   * whole nested sequence.
-   */
-  skip(wire) {
-    if (wire === WireType.SequenceStart) {
-      this.skipSequence();
-      this.depth--;
-      return;
     }
-    this.skipValue(wire);
   }
-  // --- value skipping -----------------------------------------------------
-  skipValue(wire) {
-    switch (wire) {
-      case WireType.Unsigned:
-      case WireType.Signed:
-        this.readVarint();
-        return;
-      case WireType.Fixlen: {
-        this.readVarint();
-        const sub = this.lo & 7;
-        const len = this.upper();
-        if (sub > FixlenSubtype.Blob) throw invalidMsgError(`invalid fixlen subtype ${sub}`);
-        if (sub === FixlenSubtype.Fp32 || sub === FixlenSubtype.Fp64) {
-          if (len !== (sub === FixlenSubtype.Fp32 ? 4 : 8)) {
-            throw invalidMsgError("fixlen float length mismatch");
-          }
-        } else if (len > FIXLEN_MAX) {
-          throw invalidMsgError("fixlen length out of range");
-        }
-        this.take(len);
-        return;
-      }
-      case WireType.ArrayUnsigned:
-      case WireType.ArraySigned: {
-        const count = this.arrayCount();
-        for (let i = 0; i < count; i++) this.readVarint();
-        return;
-      }
-      case WireType.ArrayFixlen: {
-        this.readVarint();
-        const count = this.num();
-        if (count > ARRAY_MAX) throw invalidMsgError("array count out of range");
-        if (count > this.maxArrayCount) {
-          throw limitExceededError(
-            `array count ${count} exceeds maxArrayCount ${this.maxArrayCount}`
-          );
-        }
-        this.readVarint();
-        const sub = this.lo & 7;
-        const size = this.upper();
-        const ok = sub === FixlenSubtype.Fp32 && size === 4 || sub === FixlenSubtype.Fp64 && size === 8;
-        if (!ok) throw invalidMsgError("invalid fixlen array element type");
-        this.take(count * size);
-        return;
-      }
-      default:
-        throw invalidMsgError(`invalid wire type ${wire}`);
-    }
+  try {
+    return _utf8.decode(buf.subarray(start, end));
+  } catch {
+    throw invalidMsgError("invalid UTF-8 in string");
   }
-  skipSequence() {
-    let depth = 1;
-    while (depth > 0) {
-      if (this.p >= this.n) throw incompleteError("truncated message: unbalanced sequence");
-      this.readVarint();
-      const wire = this.lo & 7;
-      if (wire === WireType.SequenceEnd) {
-        depth--;
-        continue;
-      }
-      const id = this.upper();
-      if (id > ID_MAX) throw invalidMsgError(`field id ${id} out of range`);
-      if (wire === WireType.SequenceStart) {
-        if (this.depth + depth - 1 >= MAX_DEPTH) {
-          throw invalidMsgError(`nesting exceeds MAX_DEPTH (${MAX_DEPTH})`);
-        }
-        depth++;
-      } else {
-        this.skipValue(wire);
-      }
-    }
+}
+
+// src/decode/acc.ts
+var PayloadAcc = class {
+  constructor() {
+    this.buf = null;
+    this.len = 0;
   }
-  // --- field helpers ------------------------------------------------------
   /**
-   * Peek the delivered fixlen subtype of the field {@link readHeader} just
-   * accepted, **without advancing the cursor** — the readers / {@link skip}
-   * still re-read and validate the word. Returns one of {@link FixlenSubtype}
-   * (0..3), a reserved value (4..7), or `-1` when the wire is not a fixlen kind
-   * or the subtype word is truncated away.
+   * Contribute one piece — the bytes `src[start..end)` at `offset` of a
+   * `total`-byte payload — and return the **whole** payload once it is complete,
+   * or `null` while bytes are still outstanding.
+   *
+   * `offset === 0` starts a payload — and *resets* the accumulator, so a decode
+   * that was abandoned mid-payload (an `INVALID` field, a declined subtree) leaves
+   * nothing behind to corrupt the next one.
    *
-   * The subtype is the low 3 bits of the fixlen sub-header word, and the low
-   * bits of a LEB128 word live entirely in its **first** byte — so this only
-   * reads one byte, it never decodes a varint.
+   * A late piece with no payload in progress returns `null` rather than writing
+   * anywhere: the accumulator has no buffer to append to, and inventing one would
+   * fabricate a payload out of a fragment.
    */
-  peekFixSub(wire) {
-    if (wire === WireType.Fixlen) {
-      return this.p < this.n ? this.buf[this.p] & 7 : -1;
+  take(total, offset, src, start, end) {
+    if (offset === 0) {
+      this.buf = new Uint8Array(total);
+      this.len = 0;
     }
-    if (wire === WireType.ArrayFixlen) {
-      let p = this.p;
-      while (p < this.n && this.buf[p] >= 128) p++;
-      p++;
-      return p < this.n ? this.buf[p] & 7 : -1;
+    const b = this.buf;
+    if (b === null) return null;
+    let n = end - start;
+    const room = total - this.len;
+    if (n > room) n = room;
+    if (n > 0) {
+      b.set(src.subarray(start, start + n), this.len);
+      this.len += n;
     }
-    return -1;
+    if (this.len < total) return null;
+    this.buf = null;
+    return b;
+  }
+};
+
+// src/decode/seq.ts
+var NO_BYTES = new Uint8Array(0);
+var UNBOUNDED = -1;
+function requireReceiverBound(schemaBound, receiver, what, name) {
+  if (schemaBound >= 0) return;
+  if (Number.isFinite(receiver) && receiver >= 0) return;
+  throw argumentError(
+    `${name}: ${what} is ${receiver}, which states no cap \u2014 the schema left this field unbounded, and \xA76.2.1 admits no unset state and no unlimited mode. The number is generated code's to supply.`
+  );
+}
+function indexBound(cap, receiverCap) {
+  return cap >= 0 ? cap : receiverCap;
+}
+function rejectIndex(id, cap, receiverCap, name) {
+  if (cap >= 0) {
+    throw invalidMsgError(`${name}: array index above schema capacity ${cap}`);
+  }
+  throw limitExceededError(`${name}: array index ${id} exceeds the receiver cap ${receiverCap}`);
+}
+var ElementSeq = class {
+  constructor(out, def, cap, name, receiverCap) {
+    this.out = out;
+    this.def = def;
+    this.cap = cap;
+    this.name = name;
+    this.receiverCap = receiverCap;
+    if (cap < 0) requireReceiverBound(cap, receiverCap, "the receiver array-index cap", name);
+    this.bound = indexBound(cap, receiverCap);
   }
   /**
-   * Read and validate an array count word (0..ARRAY_MAX; §4.7/§4.8). When a
-   * `schemaCount` is given, a count above it is a schema-bound violation and is
-   * rejected as `INVALID` — see the check below.
+   * Bound-check `id` and grow `out` to `id + 1`, filling any gap — and the slot
+   * itself — with the element default.
+   *
+   * The check runs **before** the growth, which is the whole of §7.2 item 8's
+   * "after a rejected id the container is not left partially extended": a
+   * rejection leaves `out` exactly as it was, so a lower id delivered afterwards
+   * still lands at its own index.
    */
-  arrayCount(schemaCount) {
-    this.readVarint();
-    const count = this.num();
-    if (count > ARRAY_MAX) throw invalidMsgError("array count out of range");
-    if (schemaCount !== void 0 && count > schemaCount) {
-      throw invalidMsgError("array count above schema capacity");
-    }
-    if (count > this.maxArrayCount) {
-      throw limitExceededError(
-        `array count ${count} exceeds maxArrayCount ${this.maxArrayCount}`
-      );
-    }
-    if (count > this.n - this.p) throw incompleteError("truncated array");
-    return count;
-  }
-  /** Read a scalar fixlen sub-header, asserting subtype and exact byte length (floats). */
-  fixlenHeader(wantSub, wantLen) {
-    this.readVarint();
-    const sub = this.lo & 7;
-    const len = this.upper();
-    if (sub !== wantSub) throw invalidMsgError(`invalid fixlen subtype ${sub}`);
-    if (len !== wantLen) throw invalidMsgError("fixlen float length mismatch");
-  }
-  /**
-   * Read a scalar fixlen sub-header for a string/blob, asserting subtype;
-   * returns the byte length. When a `schemaMaxlen` is given, a length above it
-   * is a schema-bound violation and is rejected as `INVALID` — see below.
-   */
-  fixlenLen(wantSub, schemaMaxlen) {
-    this.readVarint();
-    const sub = this.lo & 7;
-    const len = this.upper();
-    if (sub !== wantSub) throw invalidMsgError(`invalid fixlen subtype ${sub}`);
-    if (len > FIXLEN_MAX) throw invalidMsgError("fixlen length out of range");
-    if (schemaMaxlen !== void 0 && len > schemaMaxlen) {
-      throw invalidMsgError("fixlen length above schema maxlen");
-    }
-    const limit = wantSub === FixlenSubtype.String ? this.maxStringLen : this.maxBlobLen;
-    if (len > limit) {
-      const what = wantSub === FixlenSubtype.String ? "string" : "blob";
-      const name = wantSub === FixlenSubtype.String ? "maxStringLen" : "maxBlobLen";
-      throw limitExceededError(
-        `${what} length ${len} exceeds ${name} ${limit}`
-      );
-    }
-    return len;
+  reserve(id) {
+    if (id >= this.bound) rejectIndex(id, this.cap, this.receiverCap, this.name);
+    while (this.out.length <= id) this.out.push(this.def);
   }
   /**
-   * Read an array fixlen element header (count + element type); returns the
-   * count. When a `schemaCount` is given, a count above it is a schema-bound
-   * violation and is rejected as `INVALID` — see below.
+   * The two index bounds, without growing: the schema `count` as validity
+   * (`INVALID`) or, where the schema left the array open, the receiver cap as
+   * capacity (`LIMIT_EXCEEDED`). Never both — §6.2.1 keeps a cap off a field the
+   * schema already bounds, which is why one `bound` can stand for both.
+   *
+   * Split out from {@link reserve} because a leaf element is bound-checked at its
+   * length word, before its payload has arrived and so before there is anything to
+   * place ({@link StringSeq.begin}).
    */
-  arrayFixlenHeader(wantSub, wantSize, schemaCount) {
-    this.readVarint();
-    const count = this.num();
-    if (count > ARRAY_MAX) throw invalidMsgError("array count out of range");
-    if (schemaCount !== void 0 && count > schemaCount) {
-      throw invalidMsgError("array count above schema capacity");
-    }
-    if (count > this.maxArrayCount) {
-      throw limitExceededError(
-        `array count ${count} exceeds maxArrayCount ${this.maxArrayCount}`
-      );
-    }
-    this.readVarint();
-    const sub = this.lo & 7;
-    const size = this.upper();
-    if (sub !== wantSub || size !== wantSize) {
-      throw invalidMsgError("invalid fixlen array element type");
-    }
-    if (count > (this.n - this.p) / wantSize) {
-      throw incompleteError("truncated fixlen array");
-    }
-    return count;
-  }
-  /** Hand back a zero-copy view of the next `len` bytes, advancing the cursor. */
-  take(len) {
-    const start = this.p;
-    const end = start + len;
-    if (end > this.n) throw incompleteError("truncated fixlen payload");
-    this.p = end;
-    return this.buf.subarray(start, end);
+  checkIndex(id) {
+    if (id >= this.bound) rejectIndex(id, this.cap, this.receiverCap, this.name);
   }
-  rawFp32() {
-    const p = this.p;
-    if (p + 4 > this.n) throw incompleteError("truncated fp32");
-    this.p = p + 4;
-    return this.view.getFloat32(p, true);
+  /**
+   * What {@link reserve} does, then `value` written into the slot. A repeat
+   * replaces (§7.4).
+   *
+   * Written out rather than delegating to {@link reserve}: on the baseline tier a
+   * call is not free, and this is the per-element path. The check still precedes
+   * the growth, which is the property §7.2 item 8 asks for.
+   */
+  place(id, value) {
+    if (id >= this.bound) rejectIndex(id, this.cap, this.receiverCap, this.name);
+    while (this.out.length <= id) this.out.push(this.def);
+    this.out[id] = value;
   }
-  rawFp64() {
-    const p = this.p;
-    if (p + 8 > this.n) throw incompleteError("truncated fp64");
-    this.p = p + 8;
-    return this.view.getFloat64(p, true);
+};
+var FramedSeq = class {
+  constructor(out, make, cap, name, receiverCap) {
+    this.out = out;
+    this.make = make;
+    this.cap = cap;
+    this.name = name;
+    this.receiverCap = receiverCap;
+    if (cap < 0) requireReceiverBound(cap, receiverCap, "the receiver array-index cap", name);
+    this.bound = indexBound(cap, receiverCap);
   }
-  // --- varint reading (shared verbatim with ./fast) -----------------------
   /**
-   * The last varint's full value as a `bigint` (64-bit fidelity). Only ever
-   * called from {@link unsignedValue} / {@link signedValue} on the `hi` overflow
-   * path (`this.hi >>> 0 > 0x1fffff`), so `hi` is always non-zero here.
+   * The two index bounds, without growing — see {@link ElementSeq.checkIndex}.
+   *
+   * Split out for the same reason it is there: a caller may have a second bound
+   * to take before anything is allocated. A native matrix row is that case in this
+   * port — its element `count` is rejected at the array header, and §7.2 item 8
+   * wants that rejection to leave the row container exactly as it was.
    */
-  big() {
-    return BigInt(this.hi >>> 0) << 32n | BigInt(this.lo >>> 0);
+  checkIndex(id) {
+    if (id >= this.bound) rejectIndex(id, this.cap, this.receiverCap, this.name);
   }
   /**
-   * The last varint as an unsigned value, number-first: a `number` when it fits
-   * exactly (`≤ 2^53-1`), a `bigint` only beyond that.
+   * Bound-check `id`, **then** grow `out` to `id + 1`, each new slot its own
+   * `make()`.
+   *
+   * The order is §7.2 item 8's "after a rejected id the container is not left
+   * partially extended": a rejection leaves `out` exactly as it was, so a lower id
+   * delivered afterwards still lands at its own index. A slot already present is
+   * left alone — a re-opened `struct` / `union` element merges into the object it
+   * already built, which is what §7.4's last-occurrence-wins means for a scope
+   * whose value *is* the scope.
    */
-  unsignedValue() {
-    const hi = this.hi >>> 0;
-    return hi <= 2097151 ? hi * TWO323 + (this.lo >>> 0) : this.big();
+  reserve(id) {
+    if (id >= this.bound) rejectIndex(id, this.cap, this.receiverCap, this.name);
+    while (this.out.length <= id) this.out.push(this.make());
   }
-  /** The last zig-zag varint as a signed value, number-first. */
-  signedValue() {
-    const hi = this.hi >>> 0;
-    if (hi <= 2097151) {
-      const r = hi * TWO323 + (this.lo >>> 0);
-      return r % 2 === 0 ? r / 2 : -(r + 1) / 2;
-    }
-    return zigzagDecode(this.big());
-  }
-  /** The last varint's value as a JS number — exact for ids/lengths/counts. */
-  num() {
-    return this.hi * TWO323 + (this.lo >>> 0);
+  /**
+   * Bound-check `id`, fill the gap below it, then write `value` into the slot —
+   * what a nested **row** needs, an array wrapper *replacing* whatever an earlier
+   * opening built at that index (§7.4) rather than merging into it.
+   *
+   * The gap fill stops one short of `id` on purpose: the slot is about to be
+   * overwritten, so calling `make()` for it would allocate an element default
+   * nobody ever reads. Assigning at `out.length` extends the array by exactly one,
+   * which is the same array a {@link reserve} would have left.
+   */
+  place(id, value) {
+    if (id >= this.bound) rejectIndex(id, this.cap, this.receiverCap, this.name);
+    while (this.out.length < id) this.out.push(this.make());
+    this.out[id] = value;
   }
-  /** The last varint with its low 3 tag bits stripped (`value >> 3`). */
-  upper() {
-    return (this.hi >>> 0) * (TWO323 / 8) + (this.lo >>> 3);
+};
+var StringSeq = class {
+  constructor(out, acc, cap, elemMax, name, receiverCap, receiverElemMax) {
+    this.out = out;
+    this.acc = acc;
+    this.cap = cap;
+    this.elemMax = elemMax;
+    this.name = name;
+    this.receiverCap = receiverCap;
+    this.receiverElemMax = receiverElemMax;
+    requireReceiverBound(elemMax, receiverElemMax, "the receiver element-length cap", name);
+    this.slots = new ElementSeq(out, "", cap, name, receiverCap);
   }
   /**
-   * Decode one LEB128 varint at the cursor into {@link lo} / {@link hi} (each an
-   * unsigned 32-bit half), advancing {@link p}. Throws on truncation or a value
-   * spilling past 64 bits (>10 bytes). Unrolled, number-only — no `bigint`.
+   * The element's fixlen length word ({@link Visitor.fixlenBegin}).
+   *
+   * The bounds are decided by this word, so they are checked here — before any
+   * payload byte — and again in {@link element} below.
+   *
+   * That is not redundancy for its own sake: a message that ends *inside* an
+   * over-long element must still be `INVALID`, and only this event runs early
+   * enough to say so. Without it the verdict would degrade to `INCOMPLETE`, which
+   * §5.2.3 forbids for input already known to be malformed and which §6.4 forbids
+   * a chunk boundary from changing.
+   *
+   * An element of the wrong fixlen subtype is left alone: §7.3 requires it to be
+   * *skipped*, not rejected, and it is skipped by this class simply ignoring it.
    */
-  readVarint() {
-    const buf = this.buf;
-    const n = this.n;
-    let p = this.p;
-    let b;
-    let lo;
-    let hi = 0;
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    lo = b & 127;
-    if (b < 128) return this.set(lo, 0, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    lo |= (b & 127) << 7;
-    if (b < 128) return this.set(lo, 0, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    lo |= (b & 127) << 14;
-    if (b < 128) return this.set(lo, 0, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    lo |= (b & 127) << 21;
-    if (b < 128) return this.set(lo, 0, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    lo |= (b & 15) << 28;
-    hi = b >> 4 & 7;
-    if (b < 128) return this.set(lo, hi, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    hi |= (b & 127) << 3;
-    if (b < 128) return this.set(lo, hi, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    hi |= (b & 127) << 10;
-    if (b < 128) return this.set(lo, hi, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    hi |= (b & 127) << 17;
-    if (b < 128) return this.set(lo, hi, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    hi |= (b & 127) << 24;
-    if (b < 128) return this.set(lo, hi, p);
-    if (p >= n) throw incompleteError("truncated varint");
-    b = buf[p++];
-    if ((b & 127) >> 1 !== 0) throw invalidMsgError("varint overflow");
-    hi |= (b & 127) << 31;
-    if (b < 128) return this.set(lo, hi, p);
-    throw invalidMsgError("varint overflow");
-  }
-  set(lo, hi, p) {
-    this.lo = lo;
-    this.hi = hi;
-    this.p = p;
+  begin(id, subtype, total) {
+    if (subtype !== FixlenSubtype.String) return;
+    this.check(id, total);
+  }
+  /** One payload piece of element `id` ({@link Visitor.string}). */
+  element(id, total, offset, src, start, end) {
+    this.check(id, total);
+    const text = offset === 0 && end - start === total ? decodeUtf8(src, start, end) : decodeStringPiece(this.acc, total, offset, src, start, end);
+    if (text === null) return;
+    this.slots.place(id, text);
+  }
+  /** Every bound for one element. Rejects **before** the destination grows. */
+  check(id, total) {
+    this.slots.checkIndex(id);
+    if (this.elemMax >= 0) {
+      if (total > this.elemMax) {
+        throw invalidMsgError(
+          `${this.name} element: string byte length above schema maxlen ${this.elemMax}`
+        );
+      }
+    } else if (total > this.receiverElemMax) {
+      throw limitExceededError(
+        `${this.name} element: string byte length ${total} exceeds the receiver cap ${this.receiverElemMax}`
+      );
+    }
   }
 };
-
-// src/backend/native.ts
-var NATIVE_PACKAGE = "@sofa-buffers/corelib-native";
-function isNode() {
-  return typeof process !== "undefined" && !!process.versions?.node;
-}
-async function loadNativeKernel() {
-  if (!isNode()) return false;
-  try {
-    const { createRequire } = await import('module');
-    const require2 = createRequire(import.meta.url);
-    const mod = require2(NATIVE_PACKAGE);
-    const kernel = mod.kernel ?? mod;
-    setKernel(kernel);
-    return true;
-  } catch {
-    return false;
+var BlobSeq = class {
+  constructor(out, acc, cap, elemMax, name, receiverCap, receiverElemMax) {
+    this.out = out;
+    this.acc = acc;
+    this.cap = cap;
+    this.elemMax = elemMax;
+    this.name = name;
+    this.receiverCap = receiverCap;
+    this.receiverElemMax = receiverElemMax;
+    requireReceiverBound(elemMax, receiverElemMax, "the receiver element-length cap", name);
+    this.slots = new ElementSeq(out, NO_BYTES, cap, name, receiverCap);
+  }
+  /** See {@link StringSeq.begin} — the early bound check, for subtype `blob`. */
+  begin(id, subtype, total) {
+    if (subtype !== FixlenSubtype.Blob) return;
+    this.check(id, total);
+  }
+  /** One payload piece of element `id` ({@link Visitor.blob}). */
+  element(id, total, offset, src, start, end) {
+    this.check(id, total);
+    const payload = this.acc.take(total, offset, src, start, end);
+    if (payload === null) return;
+    this.slots.place(id, payload);
+  }
+  /** Every bound for one element. Rejects **before** the destination grows. */
+  check(id, total) {
+    this.slots.checkIndex(id);
+    if (this.elemMax >= 0) {
+      if (total > this.elemMax) {
+        throw invalidMsgError(
+          `${this.name} element: blob byte length above schema maxlen ${this.elemMax}`
+        );
+      }
+    } else if (total > this.receiverElemMax) {
+      throw limitExceededError(
+        `${this.name} element: blob byte length ${total} exceeds the receiver cap ${this.receiverElemMax}`
+      );
+    }
   }
+};
+function decodeStringPiece(acc, total, offset, src, start, end) {
+  const payload = acc.take(total, offset, src, start, end);
+  return payload === null ? null : decodeUtf8(payload);
 }
 
-// src/backend/wasm.ts
-async function loadWasmKernel(source, factory, imports = {}) {
-  let instance;
-  if (source instanceof WebAssembly.Module) {
-    instance = await WebAssembly.instantiate(source, imports);
-  } else if (typeof Response !== "undefined" && (source instanceof Response || isThenable(source))) {
-    const result = await WebAssembly.instantiateStreaming(
-      source,
-      imports
-    );
-    instance = result.instance;
-  } else {
-    const result = await WebAssembly.instantiate(source, imports);
-    instance = result.instance;
-  }
-  setKernel(factory(instance.exports));
+// src/encode/equal.ts
+function elementsEqual(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
   return true;
 }
-function isThenable(x) {
-  return typeof x === "object" && x !== null && typeof x.then === "function";
+function longElementsEqual(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i].low !== b[i].low || a[i].high !== b[i].high) return false;
+  }
+  return true;
 }
 
-export { API_VERSION, ARRAY_MAX, ArrayKind, Cursor, DecodeStatus, FIXLEN_MAX, FixlenSubtype, I64_MAX, I64_MIN, ID_MAX, IStream, Long, MAX_DEPTH, OStream, SofabError, SofabErrorCode, U64_MAX, WireType, decode, getKernel, jsKernel, loadNativeKernel, loadWasmKernel, setKernel, public_exports as sofab };
+export { API_VERSION, ARRAY_MAX, ArrayKind, BlobSeq, DecodeStatus, ElementSeq, FIXLEN_MAX, FixlenSubtype, FramedSeq, I64_MAX, I64_MIN, ID_MAX, IStream, Long, MAX_DEPTH, MIN_OUTPUT_BUFFER, OStream, PayloadAcc, SofabError, SofabErrorCode, StringSeq, U64_MAX, UNBOUNDED, WireType, decode, decodeUtf8, elementsEqual, fp32RawBytes, getKernel, growingOStream, jsKernel, longElementsEqual, setKernel, public_exports as sofab };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map