jz 0.0.0 → 0.1.1

package/src/compile.js

@@ -0,0 +1,1211 @@
+/**
+ * Compile prepared AST to WASM module (S-expression arrays for watr).
+ *
+ * # Stage contract
+ *   IN:  prepared AST (from prepare) + `ctx.func.list` with raw bodies.
+ *   OUT: WAT IR `['module', ...sections]` ready for watrCompile/watrPrint.
+ *   FLOW: orchestrator only. Calls analyze passes per function, then emit(body) via
+ *         src/emit.js's dispatch, then optimizeFunc (src/optimize.js) per function,
+ *         finally assembles module sections in canonical order.
+ *
+ * # Core abstraction
+ * Emitter table (ctx.core.emit) maps AST ops → WASM IR generators. Base operators defined
+ * in `emitter` export (src/emit.js); on reset, ctx.core.emit starts as a flat copy of emitter
+ * and modules add/override entries directly. No prototype chain.
+ * emit(node) dispatches: numbers → i32/f64.const, strings → local.get, arrays → ctx.core.emit[op].
+ *
+ * # Type system
+ * Every emitted node carries .type ('i32' | 'f64').
+ * Operators preserve i32 when both operands are i32.
+ * Division/power always produce f64. Bitwise/comparisons always produce i32.
+ * Variables are typed by pre-analysis: if any assignment is f64, local is f64.
+ *
+ * Per-function state on ctx: locals (Map name→type), stack (loop labels), uniq (counter), sig.
+ *
+ * @module compile
+ */
+
+import { parse as parseWat } from 'watr'
+import { ctx, err, inc, resolveIncludes, PTR } from './ctx.js'
+import {
+  T, VAL, analyzeValTypes, analyzeIntCertain, analyzeLocals,
+  analyzePtrUnboxable, typedElemAux, invalidateLocalsCache,
+  analyzeBoxedCaptures, updateRep,
+} from './analyze.js'
+import { optimizeFunc, hoistConstantPool, specializeMkptr, specializePtrBase, sortStrPoolByFreq, treeshake } from './optimize.js'
+import { emit, emitter, emitFlat, emitBody } from './emit.js'
+import {
+  typed, asF64, asI32, asPtrOffset, asParamType, toI32, asI64, fromI64,
+  NULL_NAN, UNDEF_NAN, NULL_WAT, UNDEF_WAT, NULL_IR, UNDEF_IR, nullExpr, undefExpr,
+  MAX_CLOSURE_ARITY, MEM_OPS, WASM_OPS, SPREAD_MUTATORS, BOXED_MUTATORS,
+  mkPtrIR, ptrOffsetIR, ptrTypeIR, extractF64Bits, appendStaticSlots,
+  isLit, litVal, isNullishLit, isPureIR, isPostfix, emitNum,
+  temp, tempI32, tempI64, f64rem, toNumF64, truthyIR, toBoolFromEmitted,
+  keyValType, usesDynProps, needsDynShadow,
+  isGlobal, isConst, boxedAddr, readVar, writeVar, isNullish,
+  slotAddr, elemLoad, elemStore, arrayLoop, allocPtr,
+  multiCount, loopTop, flat, reconstructArgsWithSpreads,
+  valKindToPtr,
+} from './ir.js'
+import plan from './plan.js'
+
+const timePhase = (profiler, name, fn) => profiler ? profiler.time(name, fn) : fn()
+
+// Per-compile func name set + map live on ctx.func.names / ctx.func.map,
+// populated at compile() entry. Both reset by ctx.js reset() and re-filled here.
+
+// NaN-box high-bits mask: used by the static-prefix-strip pass below to
+// identify pointer slots in the data segment. Kept local (ir.js owns the
+// runtime packing via mkPtrIR).
+const NAN_PREFIX_BITS = 0x7FF8n
+
+// Low-level IR helpers previously lived here. Pure ones moved to src/ir.js;
+// emit-calling ones (toBool, emitTypeofCmp, emitDecl, materializeMulti,
+// buildArrayWithSpreads) moved to src/emit.js.
+
+// AST-analysis primitives (staticObjectProps, paramReps lattice helpers,
+// inferArg* cross-call inference, collectProgramFacts) moved to src/analyze.js.
+
+/**
+ * Boundary-wrap predicate: exports whose body-driven result OR any param narrowed
+ * away from the JS-visible f64 ABI need a wrapper that re-/un-boxes at the JS↔WASM
+ * edge so the inner func can keep its raw type while exports preserve Number /
+ * pointer semantics for JS callers.
+ *
+ * Numeric param narrowing on exports IS enabled when all internal call sites pass
+ * i32 — the wrapper does `i32.trunc_sat_f64_s` at the boundary (matches JS i32
+ * coercion `n | 0` semantics for integer-shaped values; a JS caller passing a
+ * fractional Number gets the same truncation it would get from `arr[n]`).
+ */
+const isBoundaryWrapped = (func) => {
+  if (!func.exported || func.raw || func.sig.results.length !== 1) return false
+  if (func.sig.results[0] !== 'f64' || func.sig.ptrKind != null) return true
+  return func.sig.params.some(p => p.type !== 'f64' || p.ptrKind != null)
+}
+
+/**
+ * Tail-call rewrite: walks tail positions of an emitted IR tree and replaces
+ * direct `(call $name args...)` ops with `(return_call $name args...)`.
+ *
+ * Tail positions, recursively from the IR root:
+ *   - the root itself (function's terminal value-producing expression)
+ *   - both arms of `(if (result T) cond (then ...) (else ...))`
+ *   - last instruction of `(block (result T) ...)`
+ *
+ * Only fires when caller and callee result types match — if they didn't match,
+ * `asParamType`/`asPtrOffset` would have wrapped the call in a conversion op,
+ * pushing the `call` away from the tail position. We don't recurse into
+ * arithmetic / select / loop ops: their results aren't standalone-tail control
+ * transfers.
+ *
+ * Mirrors the existing `'return'` op handler in emit.js (which already does
+ * TCO when the return statement is explicit). This pass closes the gap for
+ * expression-bodied arrows like `(n, acc) => n <= 0 ? acc : sum(n-1, acc+n)`
+ * — the AST has no `return` keyword so the emit-time handler never fires.
+ */
+const tcoTailRewrite = (ir, resultType) => {
+  if (ctx.transform.noTailCall || ctx.func.inTry) return ir
+  if (!Array.isArray(ir)) return ir
+  const op = ir[0]
+  if (op === 'call' && typeof ir[1] === 'string') {
+    // IR call name is `$name`; func.map keys are bare `name`.
+    const calleeName = ir[1].startsWith('$') ? ir[1].slice(1) : ir[1]
+    const callee = ctx.func.map.get(calleeName)
+    if (!callee || callee.raw) return ir
+    const calleeRT = callee.sig?.results?.[0] ?? 'f64'
+    if (calleeRT !== resultType) return ir
+    return typed(['return_call', ...ir.slice(1)], resultType)
+  }
+  if (op === 'if' && Array.isArray(ir[1]) && ir[1][0] === 'result') {
+    let changed = false
+    const newIr = ir.slice()
+    for (let i = 3; i < newIr.length; i++) {
+      const arm = newIr[i]
+      if (Array.isArray(arm) && (arm[0] === 'then' || arm[0] === 'else') && arm.length > 1) {
+        const last = arm[arm.length - 1]
+        const rewritten = tcoTailRewrite(last, resultType)
+        if (rewritten !== last) {
+          newIr[i] = [...arm.slice(0, -1), rewritten]
+          changed = true
+        }
+      }
+    }
+    return changed ? typed(newIr, ir.type) : ir
+  }
+  if (op === 'block' && ir.length > 1) {
+    const last = ir[ir.length - 1]
+    const rewritten = tcoTailRewrite(last, resultType)
+    if (rewritten !== last) return typed([...ir.slice(0, -1), rewritten], ir.type)
+  }
+  return ir
+}
+
+// === Module compilation ===
+
+const cloneRepMap = map => map ? new Map([...map].map(([k, v]) => [k, { ...v }])) : null
+
+function enterFunc(func) {
+  ctx.func.stack = []
+  ctx.func.uniq = 0
+  ctx.func.current = func.sig
+  ctx.func.body = func.body
+  ctx.func.directClosures = null
+  ctx.func.localProps = null
+}
+
+function analyzeFuncForEmit(func, programFacts) {
+  const { paramReps } = programFacts
+  if (func.raw) return null
+
+  const { name, body, sig } = func
+  enterFunc(func)
+
+  const block = Array.isArray(body) && body[0] === '{}' && body[1]?.[0] !== ':'
+  ctx.func.boxed = new Map()
+  ctx.func.repByLocal = null
+  ctx.types.typedElem = ctx.scope.globalTypedElem ? new Map(ctx.scope.globalTypedElem) : null
+
+  const _reps = paramReps.get(name)
+  if (_reps) {
+    for (const [k, r] of _reps) {
+      if (k >= sig.params.length) continue
+      const pname = sig.params[k].name
+      if (r.typedCtor) {
+        if (!ctx.types.typedElem) ctx.types.typedElem = new Map()
+        if (!ctx.types.typedElem.has(pname)) ctx.types.typedElem.set(pname, r.typedCtor)
+        updateRep(pname, { val: VAL.TYPED })
+      }
+      if (r.val && !ctx.func.repByLocal?.get(pname)?.val) updateRep(pname, { val: r.val })
+      if (r.arrayElemSchema != null) updateRep(pname, { arrayElemSchema: r.arrayElemSchema })
+      if (r.arrayElemValType != null) updateRep(pname, { arrayElemValType: r.arrayElemValType })
+      if (r.intConst != null) updateRep(pname, { intConst: r.intConst })
+    }
+  }
+  // Drop any earlier-cached analyzeLocals for this body — narrowSignatures called
+  // it before our pre-seed, when params still had no inferred VAL.TYPED, so the
+  // cached widths reflect the pre-narrow state. Re-walk now with reps in place.
+  invalidateLocalsCache(body)
+  ctx.func.locals = block ? analyzeLocals(body) : new Map()
+  if (block) {
+    analyzeValTypes(body)
+    analyzeIntCertain(body)
+    analyzeBoxedCaptures(body)
+    // Lower provably-monomorphic pointer locals to i32 offset storage.
+    const unbox = analyzePtrUnboxable(body, ctx.func.locals, ctx.func.boxed)
+    if (unbox.size > 0) {
+      for (const [n, kind] of unbox) {
+        ctx.func.locals.set(n, 'i32')
+        const fields = { ptrKind: kind }
+        if (kind === VAL.TYPED) {
+          const aux = typedElemAux(ctx.types.typedElem?.get(n))
+          if (aux != null) fields.ptrAux = aux
+        }
+        updateRep(n, fields)
+      }
+    }
+  }
+  // Pointer-ABI params (from narrowing loop above): params already have type='i32' and
+  // ptrKind set. Register them in ctx.func.repByLocal so readVar tags local.gets correctly.
+  // Boxed capture still works: the boxed-init path (below) uses a ptrKind-tagged local.get
+  // so asF64 reboxes to NaN-form before f64.store to the cell.
+  for (const p of sig.params) {
+    if (p.ptrKind == null) continue
+    const fields = { ptrKind: p.ptrKind }
+    if (p.ptrAux != null) fields.ptrAux = p.ptrAux
+    updateRep(p.name, fields)
+  }
+
+  return {
+    block,
+    locals: new Map(ctx.func.locals),
+    boxed: new Map(ctx.func.boxed),
+    typedElem: ctx.types.typedElem ? new Map(ctx.types.typedElem) : null,
+    repByLocal: cloneRepMap(ctx.func.repByLocal),
+  }
+}
+
+/**
+ * Phase: emit one user function to WAT IR.
+ *
+ * Reads precomputed `funcFacts` and the narrowed `func.sig`; applies scoped
+ * schema param bindings during emission so they cannot leak between functions.
+ */
+function emitFunc(func, funcFacts, programFacts) {
+  const { paramReps } = programFacts
+
+  // Raw WAT functions (e.g., _alloc, _reset from memory module)
+  if (func.raw) return parseWat(func.raw)
+
+  const { name, body, exported, sig } = func
+  const multi = sig.results.length > 1
+  const _reps = paramReps.get(name)
+
+  enterFunc(func)
+  const block = funcFacts.block
+  ctx.func.locals = new Map(funcFacts.locals)
+  ctx.func.boxed = new Map(funcFacts.boxed)
+  ctx.func.repByLocal = cloneRepMap(funcFacts.repByLocal)
+  ctx.types.typedElem = funcFacts.typedElem ? new Map(funcFacts.typedElem) : null
+
+  // D: Apply call-site param facts (only if body analysis didn't already set them).
+  // Schema bindings additionally write into ctx.schema.vars so prop-access dispatch
+  // hits the slot map. ctx.schema.vars is saved/restored so bindings don't leak.
+  const schemaVarsPrev = new Map(ctx.schema.vars)
+  if (_reps) {
+    for (const [k, r] of _reps) {
+      if (k >= sig.params.length) continue
+      const pname = sig.params[k].name
+      if (r.val && !ctx.func.repByLocal?.get(pname)?.val) updateRep(pname, { val: r.val })
+      if (r.typedCtor) {
+        if (!ctx.types.typedElem) ctx.types.typedElem = new Map()
+        if (!ctx.types.typedElem.has(pname)) ctx.types.typedElem.set(pname, r.typedCtor)
+        if (!ctx.func.repByLocal?.get(pname)?.val) updateRep(pname, { val: VAL.TYPED })
+      }
+      if (r.schemaId != null && !exported && !ctx.schema.vars.has(pname)) {
+        ctx.schema.vars.set(pname, r.schemaId)
+        updateRep(pname, { schemaId: r.schemaId })
+      }
+    }
+  }
+
+  const fn = ['func', `$${name}`]
+  // Boundary-wrapped exports defer the export attribute to a synthesized
+  // wrapper ($${name}$exp) that reboxes the narrowed result back to f64.
+  if (exported && !isBoundaryWrapped(func)) fn.push(['export', `"${name}"`])
+  fn.push(...sig.params.map(p => ['param', `$${p.name}`, p.type]))
+  fn.push(...sig.results.map(t => ['result', t]))
+
+  // Default params: missing JS args become canonical NaN (0x7FF8000000000000) in WASM f64 params.
+  // Check for canonical NaN specifically — NaN-boxed pointers are also NaN but have non-zero payload.
+  const defaults = func.defaults || {}
+  const defaultInits = []
+  for (const [pname, defVal] of Object.entries(defaults)) {
+    const p = sig.params.find(p => p.name === pname)
+    const t = p?.type || 'f64'
+    defaultInits.push(
+      ['if', isNullish(typed(['local.get', `$${pname}`], 'f64')),
+        ['then', ['local.set', `$${pname}`, t === 'f64' ? asF64(emit(defVal)) : asI32(emit(defVal))]]])
+  }
+
+  // Box params that are mutably captured: allocate cell, copy param value
+  const boxedParamInits = []
+  for (const p of sig.params) {
+    if (ctx.func.boxed.has(p.name)) {
+      const cell = ctx.func.boxed.get(p.name)
+      ctx.func.locals.set(cell, 'i32')
+      const lget = typed(['local.get', `$${p.name}`], p.type)
+      if (p.ptrKind != null) lget.ptrKind = p.ptrKind
+      boxedParamInits.push(
+        ['local.set', `$${cell}`, ['call', '$__alloc', ['i32.const', 8]]],
+        ['f64.store', ['local.get', `$${cell}`], asF64(lget)])
+    }
+  }
+
+  if (block) {
+    const stmts = emitBody(body)
+    for (const [l, t] of ctx.func.locals) fn.push(['local', `$${l}`, t])
+    // I: Skip trailing fallback when last statement is return (unreachable code)
+    const lastStmt = stmts.at(-1)
+    const endsWithReturn = lastStmt && (lastStmt[0] === 'return' || lastStmt[0] === 'return_call')
+    fn.push(...defaultInits, ...boxedParamInits, ...stmts, ...(endsWithReturn ? [] : sig.results.map(t => [`${t}.const`, 0])))
+  } else if (multi && body[0] === '[') {
+    const values = body.slice(1).map(e => asF64(emit(e)))
+    for (const [l, t] of ctx.func.locals) fn.push(['local', `$${l}`, t])
+    fn.push(...boxedParamInits, ...values)
+  } else {
+    const ir = emit(body)
+    for (const [l, t] of ctx.func.locals) fn.push(['local', `$${l}`, t])
+    const finalIR = sig.ptrKind != null ? asPtrOffset(ir, sig.ptrKind) : asParamType(ir, sig.results[0])
+    fn.push(...defaultInits, ...boxedParamInits, tcoTailRewrite(finalIR, sig.results[0]))
+  }
+
+  // Restore schema.vars so param bindings don't leak to next function.
+  ctx.schema.vars = schemaVarsPrev
+  return fn
+}
+
+/**
+ * Phase: synthesize JS-boundary wrappers for narrowed exports.
+ *
+ * For each `isBoundaryWrapped(func)`, emit a sibling `$${name}$exp` that:
+ *   - holds the (export "name") attribute (JS sees the wrapper)
+ *   - takes f64 params always (JS calling convention via host.js wrap)
+ *   - converts each narrowed param at the call: f64 → i32 (truncate-sat) for
+ *     numeric narrowed, f64 → i32-offset (`i32.wrap_i64 + i64.reinterpret_f64`)
+ *     for pointer narrowed
+ *   - forwards args to the inner $${name}
+ *   - reboxes the narrowed result back to f64 so JS sees Number / NaN-boxed ptr
+ *
+ * Param convert cases (each narrowed inner-param):
+ *   - p.type = 'i32', no ptrKind  → i32.trunc_sat_f64_s(local.get $p)
+ *   - p.type = 'i32', ptrKind set → i32.wrap_i64(i64.reinterpret_f64(local.get $p))
+ *
+ * Result rebox cases:
+ *   - sig.ptrKind != null  → mkPtrIR(ptrKind, ptrAux ?? 0, callIR)
+ *   - sig.results[0] = i32 → f64.convert_i32_s(callIR)
+ *   - sig.results[0] = f64 → callIR (some params narrowed but result stayed f64)
+ */
+function synthesizeBoundaryWrappers() {
+  const wrappers = []
+  for (const func of ctx.func.list) {
+    if (!isBoundaryWrapped(func)) continue
+    const { name, sig } = func
+    const wrapNode = ['func', `$${name}$exp`, ['export', `"${name}"`]]
+    // External ABI: every param is f64 (JS Number / NaN-boxed ptr).
+    for (const p of sig.params) wrapNode.push(['param', `$${p.name}`, 'f64'])
+    wrapNode.push(['result', 'f64'])
+    const args = sig.params.map(p => {
+      const get = ['local.get', `$${p.name}`]
+      if (p.type === 'f64') return get
+      if (p.ptrKind != null) {
+        // NaN-boxed f64 → raw i32 offset
+        return ['i32.wrap_i64', ['i64.reinterpret_f64', get]]
+      }
+      // Numeric i32 — JS Number → i32 truncation (matches `n | 0` for integers).
+      return ['i32.trunc_sat_f64_s', get]
+    })
+    const callIR = ['call', `$${name}`, ...args]
+    let body
+    if (sig.ptrKind != null) {
+      const ptrType = valKindToPtr(sig.ptrKind)
+      body = mkPtrIR(ptrType, sig.ptrAux ?? 0, callIR)
+    } else if (sig.results[0] === 'i32') {
+      body = ['f64.convert_i32_s', callIR]
+    } else {
+      body = callIR
+    }
+    wrapNode.push(body)
+    wrappers.push(wrapNode)
+  }
+  return wrappers
+}
+
+
+/**
+ * Phase: emit one closure body to WAT IR.
+ *
+ * Closures share a uniform signature (env f64, argc i32, a0..a{W-1} f64) → f64
+ * so any closure can be invoked via call_indirect on $ftN. This function
+ * builds one body fn given the body record (cb) created by ctx.closure.make.
+ *
+ * Mutates ctx.func.* per-body state (locals, boxed, repByLocal) and
+ * ctx.schema.vars / ctx.types.typedElem (restored on exit so capture-binding
+ * leaks don't poison the next body). Returns the WAT IR for the func node.
+ */
+function emitClosureBody(cb) {
+  const prevSchemaVars = ctx.schema.vars
+  const prevTypedElems = ctx.types.typedElem
+  // Reset per-function state for closure body
+  ctx.func.locals = new Map()
+  ctx.func.repByLocal = null
+  if (cb.valTypes) for (const [name, vt] of cb.valTypes) updateRep(name, { val: vt })
+  if (cb.schemaVars) {
+    ctx.schema.vars = new Map([...prevSchemaVars, ...cb.schemaVars])
+    for (const [name, sid] of cb.schemaVars) updateRep(name, { schemaId: sid })
+  }
+  const globalTE = ctx.scope.globalTypedElem
+  if (cb.typedElems) {
+    ctx.types.typedElem = globalTE ? new Map([...globalTE, ...cb.typedElems]) : new Map(cb.typedElems)
+  } else if (globalTE) {
+    ctx.types.typedElem = new Map(globalTE)
+  } else {
+    ctx.types.typedElem = prevTypedElems
+  }
+  // In closure bodies, boxed captures use the original name as both var and cell local
+  ctx.func.boxed = cb.boxed ? new Map([...cb.boxed].map(v => [v, v])) : new Map()
+  ctx.func.stack = []
+  ctx.func.uniq = Math.max(ctx.func.uniq, 100) // avoid label collisions
+  ctx.func.body = cb.body
+  // Seed direct-call dispatch for captured const-bound closures (A3 across capture boundary).
+  // closure.make snapshotted the parent's directClosures for each capture; here we restore
+  // them so calls to a captured `peek` lower to `call $closureN` instead of call_indirect.
+  ctx.func.directClosures = cb.directClosures ? new Map(cb.directClosures) : null
+  // Uniform convention: (env f64, argc i32, a0..a{width-1} f64) → f64
+  const W = ctx.closure.width ?? MAX_CLOSURE_ARITY
+  const paramDecls = [{ name: '__env', type: 'f64' }, { name: '__argc', type: 'i32' }]
+  for (let i = 0; i < W; i++) paramDecls.push({ name: `__a${i}`, type: 'f64' })
+  ctx.func.current = { params: paramDecls, results: ['f64'] }
+
+  const fn = ['func', `$${cb.name}`]
+  fn.push(['param', '$__env', 'f64'])
+  fn.push(['param', '$__argc', 'i32'])
+  for (let i = 0; i < W; i++) fn.push(['param', `$__a${i}`, 'f64'])
+  fn.push(['result', 'f64'])
+
+  // Params are locals, assigned directly from inline slots
+  for (const p of cb.params) ctx.func.locals.set(p, 'f64')
+
+  // Register captured variable locals: boxed = i32 cell pointer, otherwise f64 value
+  for (let i = 0; i < cb.captures.length; i++) {
+    const name = cb.captures[i]
+    ctx.func.locals.set(name, ctx.func.boxed.has(name) ? 'i32' : 'f64')
+  }
+
+  // Emit body
+  const block = Array.isArray(cb.body) && cb.body[0] === '{}' && cb.body[1]?.[0] !== ':'
+  let bodyIR
+  if (block) {
+    for (const [k, v] of analyzeLocals(cb.body)) if (!ctx.func.locals.has(k)) ctx.func.locals.set(k, v)
+    // Detect captures from deeper nested arrows that mutate this body's locals/params/captures
+    analyzeBoxedCaptures(cb.body)
+    for (const name of ctx.func.boxed.keys()) {
+      if (ctx.func.locals.get(name) === 'f64') ctx.func.locals.set(name, 'i32')
+    }
+    bodyIR = emitBody(cb.body)
+  } else {
+    bodyIR = [asF64(emit(cb.body))]
+  }
+
+  // Pre-allocate cache locals for env unpacking
+  const envBase = cb.captures.length > 0 ? `${T}envBase${ctx.func.uniq++}` : null
+  if (envBase) ctx.func.locals.set(envBase, 'i32')
+  // Rest param: allocate helper locals (len + offset) before emitting decls
+  let restOff, restLen
+  if (cb.rest) {
+    restOff = `${T}restOff${ctx.func.uniq++}`
+    restLen = `${T}restLen${ctx.func.uniq++}`
+    ctx.func.locals.set(restOff, 'i32')
+    ctx.func.locals.set(restLen, 'i32')
+    inc('__alloc_hdr', '__mkptr')
+  }
+
+  // Insert locals (captures + params + declared)
+  for (const [l, t] of ctx.func.locals) fn.push(['local', `$${l}`, t])
+
+  // Load captures from env: boxed → i32.load (raw cell pointer), immutable → f64.load value.
+  // env is the CLOSURE pointer (PTR.CLOSURE) — never an ARRAY, no forwarding chain.
+  // Inline the offset extraction (low 32 bits) instead of calling __ptr_offset per invocation.
+  if (envBase) {
+    fn.push(['local.set', `$${envBase}`,
+      ['i32.wrap_i64', ['i64.reinterpret_f64', ['local.get', '$__env']]]])
+    for (let i = 0; i < cb.captures.length; i++) {
+      const name = cb.captures[i]
+      const addr = ['i32.add', ['local.get', `$${envBase}`], ['i32.const', i * 8]]
+      fn.push(['local.set', `$${name}`,
+        ctx.func.boxed.has(name) ? ['i32.load', addr] : ['f64.load', addr]])
+    }
+  }
+
+  // Unpack fixed params directly from inline slots (caller padded missing with UNDEF_NAN).
+  // Rest name (if present) is last in cb.params — handled separately below.
+  const fixedParamN = cb.params.length - (cb.rest ? 1 : 0)
+  for (let i = 0; i < fixedParamN && i < W; i++) {
+    fn.push(['local.set', `$${cb.params[i]}`, ['local.get', `$__a${i}`]])
+  }
+
+  // Rest param: pack slots a[fixedParams..argc-1] into fresh array.
+  // len = clamp(argc - fixedParams, 0, restSlots). Rest-param closures receive
+  // at most (width - fixedParams) rest args — spread callers with
+  // more dynamic elements lose the overflow (documented limitation).
+  if (cb.rest) {
+    const fixedN = fixedParamN
+    const restSlots = W - fixedN
+    fn.push(['local.set', `$${restLen}`,
+      ['select',
+        ['i32.sub', ['local.get', '$__argc'], ['i32.const', fixedN]],
+        ['i32.const', 0],
+        ['i32.gt_s', ['local.get', '$__argc'], ['i32.const', fixedN]]]])
+    fn.push(['if', ['i32.gt_s', ['local.get', `$${restLen}`], ['i32.const', restSlots]],
+      ['then', ['local.set', `$${restLen}`, ['i32.const', restSlots]]]])
+    fn.push(['local.set', `$${restOff}`,
+      ['call', '$__alloc_hdr',
+        ['local.get', `$${restLen}`], ['local.get', `$${restLen}`], ['i32.const', 8]]])
+    for (let i = 0; i < restSlots; i++) {
+      fn.push(['if', ['i32.gt_s', ['local.get', `$${restLen}`], ['i32.const', i]],
+        ['then', ['f64.store',
+          ['i32.add', ['local.get', `$${restOff}`], ['i32.const', i * 8]],
+          ['local.get', `$__a${fixedN + i}`]]]])
+    }
+    fn.push(['local.set', `$${cb.rest}`,
+      ['call', '$__mkptr', ['i32.const', PTR.ARRAY], ['i32.const', 0], ['local.get', `$${restOff}`]]])
+  }
+
+  // Default params for closures (check sentinel after unpack)
+  if (cb.defaults) {
+    for (const [pname, defVal] of Object.entries(cb.defaults)) {
+      fn.push(['if', isNullish(['local.get', `$${pname}`]),
+        ['then', ['local.set', `$${pname}`, asF64(emit(defVal))]]])
+    }
+  }
+  fn.push(...bodyIR)
+  // I: Skip trailing fallback when last statement is return
+  if (block && !(bodyIR.at(-1)?.[0] === 'return' || bodyIR.at(-1)?.[0] === 'return_call')) fn.push(['f64.const', 0])
+  ctx.schema.vars = prevSchemaVars
+  ctx.types.typedElem = prevTypedElems
+  return fn
+}
+
+/**
+ * Phase: build module-init function `__start`.
+ *
+ * `__start` is the WebAssembly start function: runs once at instantiation, after
+ * imports/globals are bound but before any export is called. It threads together
+ * everything that must happen before user code observes a ready module:
+ *
+ *   1. Reset per-function emit state (locals/repByLocal/boxed/stack) — __start is
+ *      a fresh function context with no params.
+ *   2. analyzeValTypes(ast) so emit sees correct ptrKind on top-level decls.
+ *   3. Sub-module init (foreign module bootstrap) emits first — its globals
+ *      must be assigned before main-module code reads them.
+ *   4. emit(ast) — user top-level statements (let/const, call expressions, …).
+ *   5. boxInit — auto-boxing globals (vars with prop assignments lifted to OBJECT).
+ *   6. schemaInit — runtime schema-name table for JSON.stringify.
+ *   7. strPoolInit — copy passive string-pool segment to heap (shared memory).
+ *   8. typeofInit — preallocate typeof-result string globals.
+ *
+ * Order in the assembled body: strPool → typeof → box → schema → moduleInits → init.
+ *
+ * Late closures (those compiled during __start emit, e.g. arrows declared at
+ * module scope) are flushed via `compilePendingClosures` and prepended to
+ * `sec.funcs` so closure indices stay stable across the table.
+ */
+function buildStartFn(ast, sec, closureFuncs, compilePendingClosures) {
+  ctx.func.locals = new Map()
+  ctx.func.repByLocal = null
+  ctx.func.boxed = new Map()
+  ctx.func.stack = []
+  ctx.func.current = { params: [], results: [] }
+  analyzeValTypes(ast)
+  const normalizeIR = ir => !ir?.length ? [] : Array.isArray(ir[0]) ? ir : [ir]
+
+  const moduleInits = []
+  if (ctx.module.moduleInits) {
+    for (const mi of ctx.module.moduleInits) {
+      analyzeValTypes(mi)
+      moduleInits.push(...normalizeIR(emit(mi)))
+    }
+  }
+  const init = emit(ast)
+
+  const boxInit = []
+  if (ctx.schema.autoBox) {
+    const bt = `${T}box`
+    ctx.func.locals.set(bt, 'i32')
+    for (const [name, { schemaId, schema }] of ctx.schema.autoBox) {
+      inc('__alloc', '__mkptr')
+      boxInit.push(
+        ['local.set', `$${bt}`, ['call', '$__alloc', ['i32.const', schema.length * 8]]],
+        ['f64.store', ['local.get', `$${bt}`],
+          ctx.func.names.has(name) ? ['f64.const', 0] : ['global.get', `$${name}`]],
+        ...schema.slice(1).map((_, i) =>
+          ['f64.store', ['i32.add', ['local.get', `$${bt}`], ['i32.const', (i + 1) * 8]], ['f64.const', 0]]),
+        ['global.set', `$${name}`, mkPtrIR(PTR.OBJECT, schemaId, ['local.get', `$${bt}`])])
+    }
+  }
+
+  const schemaInit = []
+  // Schema name table is needed by JSON.stringify (legacy), and by __dyn_get's
+  // OBJECT-schema fallback for polymorphic-receiver `.prop` access. Lift the
+  // gate to also populate when any __dyn_get* family helper is included so
+  // polymorphic OBJECT patterns (mismatched-schema `?:`, unknown-schema
+  // params) resolve via runtime aux→sid lookup. Direct dependents of
+  // __dyn_get (set transitively by resolveIncludes() later) are listed
+  // explicitly here because the dep graph hasn't been expanded yet at
+  // start-fn build time.
+  const needsSchemaTbl = ctx.schema.list.length && (
+    ctx.core.includes.has('__stringify') ||
+    ctx.core.includes.has('__dyn_get') ||
+    ctx.core.includes.has('__dyn_get_t') ||
+    ctx.core.includes.has('__dyn_get_any') ||
+    ctx.core.includes.has('__dyn_get_any_t') ||
+    ctx.core.includes.has('__dyn_get_expr') ||
+    ctx.core.includes.has('__dyn_get_expr_t') ||
+    ctx.core.includes.has('__dyn_get_or'))
+  if (needsSchemaTbl) {
+    const nSchemas = ctx.schema.list.length
+    const stbl = `${T}stbl`
+    const sarr = `${T}sarr`
+    ctx.func.locals.set(stbl, 'i32')
+    ctx.func.locals.set(sarr, 'i32')
+    inc('__alloc', '__alloc_hdr', '__mkptr')
+    schemaInit.push(
+      ['local.set', `$${stbl}`, ['call', '$__alloc', ['i32.const', nSchemas * 8]]],
+      ['global.set', '$__schema_tbl', ['local.get', `$${stbl}`]])
+    for (let s = 0; s < nSchemas; s++) {
+      const keys = ctx.schema.list[s]
+      const n = keys.length
+      schemaInit.push(
+        ['local.set', `$${sarr}`, ['call', '$__alloc_hdr', ['i32.const', n], ['i32.const', n], ['i32.const', 8]]])
+      for (let k = 0; k < n; k++)
+        schemaInit.push(
+          ['f64.store', ['i32.add', ['local.get', `$${sarr}`], ['i32.const', k * 8]],
+            emit(['str', String(keys[k])])])
+      schemaInit.push(
+        ['f64.store', ['i32.add', ['local.get', `$${stbl}`], ['i32.const', s * 8]],
+          mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${sarr}`])])
+    }
+  }
+
+  const strPoolInit = []
+  if (ctx.runtime.strPool) {
+    const total = ctx.runtime.strPool.length
+    strPoolInit.push(
+      ['global.set', '$__strBase', ['call', '$__alloc', ['i32.const', total]]],
+      ['memory.init', '$__strPool', ['global.get', '$__strBase'], ['i32.const', 0], ['i32.const', total]],
+      ['data.drop', '$__strPool'],
+    )
+  }
+
+  const typeofInit = []
+  if (ctx.runtime.typeofStrs) {
+    for (const s of ctx.runtime.typeofStrs)
+      typeofInit.push(['global.set', `$__tof_${s}`, emit(['str', s])])
+  }
+  if (moduleInits.length || init?.length || boxInit.length || schemaInit.length || typeofInit.length || strPoolInit.length || ctx.features.timers) {
+    const initIR = normalizeIR(init)
+    const startFn = ['func', '$__start']
+    for (const [l, t] of ctx.func.locals) startFn.push(['local', `$${l}`, t])
+    startFn.push(...strPoolInit, ...typeofInit, ...boxInit, ...schemaInit,
+      ...(ctx.features.timers ? [['call', '$__timer_init']] : []),
+      ...moduleInits, ...initIR,
+      ...(ctx.features.blockingTimers ? [['call', '$__timer_loop']] : []),
+    )
+    sec.start.push(startFn, ['start', '$__start'])
+  }
+
+  const beforeLen = closureFuncs.length
+  compilePendingClosures()
+  if (closureFuncs.length > beforeLen)
+    sec.funcs.unshift(...closureFuncs.slice(beforeLen))
+}
+
+/**
+ * Phase: closure-body dedup.
+ *
+ * Two closures with structurally-equal bodies (same shape after alpha-renaming
+ * locals/params) are emitted as a single function — duplicates redirect through
+ * the elem table to the canonical name. Closure bodies often share shape because
+ * the same inner arrow can be instantiated in many places (e.g. parser combinators).
+ *
+ * IN:  closureFuncs (the WAT IR list emitted by emitClosureBody),
+ *      sec.funcs (already contains closureFuncs + regular funcs),
+ *      ctx.closure.table (elem-section names).
+ * OUT: sec.funcs filtered to canonical bodies, ctx.closure.table redirected.
+ *
+ * Runs AFTER all closures (including those compiled during __start emit) are
+ * collected so structural duplicates across batches collapse together.
+ */
+function dedupClosureBodies(closureFuncs, sec) {
+  if (closureFuncs.length <= 1) return
+  const canonicalize = (fn) => {
+    const localNames = new Set()
+    const collect = (node) => {
+      if (!Array.isArray(node)) return
+      if ((node[0] === 'local' || node[0] === 'param') && typeof node[1] === 'string' && node[1][0] === '$')
+        localNames.add(node[1])
+      for (const c of node) collect(c)
+    }
+    collect(fn)
+    let counter = 0
+    const renameMap = new Map()
+    const walk = node => {
+      if (typeof node === 'string') {
+        if (!localNames.has(node)) return node
+        let r = renameMap.get(node)
+        if (!r) { r = `$_c${counter++}`; renameMap.set(node, r) }
+        return r
+      }
+      if (!Array.isArray(node)) return node
+      return node.map(walk)
+    }
+    return JSON.stringify(['func', ...fn.slice(2).map(walk)])
+  }
+  const hashToName = new Map()
+  const redirect = new Map()
+  const keepSet = new Set()
+  for (const fn of closureFuncs) {
+    const key = canonicalize(fn)
+    const name = fn[1].slice(1)
+    const canonical = hashToName.get(key)
+    if (canonical) redirect.set(name, canonical)
+    else { hashToName.set(key, name); keepSet.add(name) }
+  }
+  if (!redirect.size) return
+  ctx.closure.table = ctx.closure.table.map(n => redirect.get(n) || n)
+  const kept = sec.funcs.filter(fn => {
+    if (!Array.isArray(fn) || fn[0] !== 'func') return true
+    const name = typeof fn[1] === 'string' && fn[1][0] === '$' ? fn[1].slice(1) : null
+    return !name || !redirect.has(name)
+  })
+  sec.funcs.length = 0
+  sec.funcs.push(...kept)
+}
+
+/**
+ * Phase: closure-table finalize + ABI shrink.
+ *
+ * Two opportunities, both gated on a post-emit scan for `call_indirect`:
+ *
+ *   1. Drop dead $ftN type / table / elem when the scan finds zero call_indirect
+ *      sites (every closure call was direct-dispatched via A3 + capture-boundary
+ *      propagation, AND no top-level fn was taken as a value). Closure pointers
+ *      still carry funcIdx in their NaN-box aux bits, but those bits become dead
+ *      state with no reader.
+ *
+ *   2. Per-body ABI shrink: with no call_indirect, every closure is direct-only,
+ *      so the uniform `(env, argc, a0..a{W-1})` ABI is no longer required.
+ *      Each body sheds:
+ *        • $__env     when captures.length === 0
+ *        • $__argc    when no rest param (defaults check param value, not argc)
+ *        • $__a{i}    for i ≥ fixedN when no rest (caller's UNDEF padding is dead)
+ *      Rest closures keep all W slots — argc + slot{fixedN..W-1} are how rest packs.
+ *      Both `call` and `return_call` (tail call) sites are rewritten in the same walk.
+ */
+function finalizeClosureTable(sec) {
+  if (!ctx.closure.table?.length) return
+  let indirectUsed = false
+  const scan = (n) => {
+    if (!Array.isArray(n) || indirectUsed) return
+    if (n[0] === 'call_indirect') { indirectUsed = true; return }
+    for (const c of n) if (Array.isArray(c)) scan(c)
+  }
+  for (const fn of sec.funcs) { scan(fn); if (indirectUsed) break }
+  if (!indirectUsed) for (const fn of sec.start) scan(fn)
+  // Also scan raw stdlib strings (pullStdlib hasn't run yet, so stdlib funcs aren't in sec.funcs)
+  if (!indirectUsed) for (const s of Object.keys(ctx.core.stdlib)) {
+    if (ctx.core.stdlib[s]?.includes?.('call_indirect')) { indirectUsed = true; break }
+  }
+  // Keep table if call_indirect is used (closures, timer dispatch, etc.)
+  if (indirectUsed) {
+    sec.table = [['table', ['export', '"__jz_table"'], ctx.closure.table.length, 'funcref']]
+    sec.elem = [['elem', ['i32.const', 0], 'func', ...ctx.closure.table.map(n => `$${n}`)]]
+    return
+  }
+  sec.table = []
+  sec.elem = []
+  sec.types = sec.types.filter(t => !(Array.isArray(t) && t[1] === '$ftN'))
+  const W = ctx.closure.width ?? MAX_CLOSURE_ARITY
+  const abiOf = new Map()
+  for (const cb of (ctx.closure.bodies || [])) {
+    const fixedN = cb.params.length - (cb.rest ? 1 : 0)
+    abiOf.set(cb.name, {
+      needEnv: cb.captures.length > 0,
+      needArgc: !!cb.rest,
+      usedSlots: cb.rest ? W : fixedN,
+      rest: !!cb.rest,
+    })
+  }
+  for (const fn of sec.funcs) {
+    if (!Array.isArray(fn) || fn[0] !== 'func') continue
+    const fnName = typeof fn[1] === 'string' && fn[1][0] === '$' ? fn[1].slice(1) : null
+    const abi = abiOf.get(fnName)
+    if (!abi) continue
+    for (let i = fn.length - 1; i >= 0; i--) {
+      const node = fn[i]
+      if (!Array.isArray(node) || node[0] !== 'param') continue
+      const pname = node[1]
+      if (pname === '$__env' && !abi.needEnv) fn.splice(i, 1)
+      else if (pname === '$__argc' && !abi.needArgc) fn.splice(i, 1)
+      else if (typeof pname === 'string' && pname.startsWith('$__a') && !abi.rest) {
+        const idx = parseInt(pname.slice(4), 10)
+        if (Number.isFinite(idx) && idx >= abi.usedSlots) fn.splice(i, 1)
+      }
+    }
+  }
+  const rewriteCalls = (node) => {
+    if (!Array.isArray(node)) return
+    for (const c of node) if (Array.isArray(c)) rewriteCalls(c)
+    if ((node[0] === 'call' || node[0] === 'return_call') && typeof node[1] === 'string') {
+      const callee = node[1].slice(1)
+      const abi = abiOf.get(callee)
+      if (!abi) return
+      const newArgs = []
+      if (abi.needEnv) newArgs.push(node[2])
+      if (abi.needArgc) newArgs.push(node[3])
+      for (let i = 0; i < abi.usedSlots; i++) newArgs.push(node[4 + i])
+      node.splice(2, node.length - 2, ...newArgs)
+    }
+  }
+  for (const fn of sec.funcs) rewriteCalls(fn)
+  for (const fn of sec.start) rewriteCalls(fn)
+}
+
+/**
+ * Phase: pull stdlib + memory.
+ *
+ * Runs AFTER __start is built — emit calls during __start (e.g. typeofStrs,
+ * boxInit, schemaInit) trigger `inc()` for any helpers they need, and those
+ * additions must be observed before resolveIncludes() expands the dependency
+ * closure.
+ *
+ * Steps:
+ *   1. resolveIncludes() — close the include set under stdlib dependencies.
+ *   2. Emit memory section ONLY when some included helper uses memory ops
+ *      (G optimization: pure scalar programs ship without memory + __heap).
+ *      When memory is needed, the allocator (__alloc + __alloc_hdr + __reset)
+ *      is force-included since stdlib funcs may call into it.
+ *   3. Pull external (host) stdlibs into sec.extStdlib (must precede normal
+ *      imports in the module byte order).
+ *   4. Pull resolved factory stdlibs (those keyed by feature gates) into
+ *      sec.stdlib via parseWat.
+ *
+ * Also reports any unresolved stdlib name (logged, not thrown — keeps test
+ * output readable when a missing helper is the actual bug).
+ */
+function pullStdlib(sec) {
+  resolveIncludes()
+
+  const needsMemory = [...ctx.core.includes].some(n => ctx.core.stdlib[n] && MEM_OPS.test(ctx.core.stdlib[n]))
+  if (!needsMemory) ctx.scope.globals.delete('__heap')
+  if (needsMemory && ctx.module.modules.core) {
+    for (const fn of ['__alloc', '__alloc_hdr', '__reset']) if (!ctx.core.includes.has(fn)) ctx.core.includes.add(fn)
+    const pages = ctx.memory.pages || 1
+    if (ctx.memory.shared) sec.imports.push(['import', '"env"', '"memory"', ['memory', pages]])
+    else sec.memory.push(['memory', ['export', '"memory"'], pages])
+    if (ctx.transform.runtimeExports !== false && ctx.core._allocRawFuncs)
+      sec.funcs.push(...ctx.core._allocRawFuncs.map(s => parseWat(s)))
+  }
+
+  const stdlibStr = (name) => {
+    const v = ctx.core.stdlib[name]
+    return typeof v === 'function' ? v() : v
+  }
+  for (const name of Object.keys(ctx.core.stdlib)) {
+    if (name.startsWith('__ext_') && ctx.core.includes.has(name)) {
+      const parsed = parseWat(stdlibStr(name))
+      sec.extStdlib.push(parsed[0] === "module" ? parsed[1] : parsed)
+      ctx.core.includes.delete(name)
+    }
+  }
+  for (const n of ctx.core.includes) if (!ctx.core.stdlib[n]) console.error("MISSING stdlib:", n)
+  sec.stdlib.push(...[...ctx.core.includes].map(n => parseWat(stdlibStr(n))))
+}
+
+/**
+ * Phase: whole-module + per-function optimization passes.
+ *
+ * Order matters and is non-obvious — fixed deliberately:
+ *
+ *   1. specializeMkptr — replaces `call $__mkptr (T, A, off)` with `$__mkptr_T_A_d`
+ *      for known (T, A) pairs (saves ~4 B/site). Must run BEFORE per-function
+ *      passes so the new variants exist when fusedRewrite folds calls into them.
+ *   2. specializePtrBase — folds `call F (add (global G) const)` to a `_p`
+ *      variant (saves ~3 B/site). After specializeMkptr so mkptr variants
+ *      ($__mkptr_T_A_d) are visible to it.
+ *   3. sortStrPoolByFreq — reorders string-pool entries so hot strings get low
+ *      offsets (shrinking i32.const LEB128). Shared-memory only (passive segment).
+ *   4. optimizeFunc per fn — hoistPtrType + fusedRewrite + sortLocalsByUse.
+ *      Must run after specializeMkptr/specializePtrBase introduce new helpers.
+ *   5. hoistConstantPool — repeated f64 literals → mutable globals.
+ *      Last because earlier passes might fold/eliminate constants.
+ *
+ * Also adjusts $__heap base when data segment exceeds 1024 bytes (default
+ * heap base) — keeps user code at offset 0 from clobbering the data segment.
+ */
+function optimizeModule(sec) {
+  const cfg = ctx.transform.optimize  // null → all on (back-compat for direct compile() callers)
+  if (!cfg || cfg.specializeMkptr !== false)
+    specializeMkptr([...sec.funcs, ...sec.stdlib, ...sec.start], wat => sec.stdlib.push(parseWat(wat)), parseWat)
+  if (!cfg || cfg.specializePtrBase !== false)
+    specializePtrBase([...sec.funcs, ...sec.stdlib, ...sec.start], wat => sec.stdlib.push(parseWat(wat)), parseWat)
+  if (ctx.runtime.strPool && (!cfg || cfg.sortStrPoolByFreq !== false)) {
+    const poolRef = { pool: ctx.runtime.strPool }
+    sortStrPoolByFreq([...sec.funcs, ...sec.stdlib, ...sec.start], poolRef, ctx.runtime.strPoolDedup)
+    ctx.runtime.strPool = poolRef.pool
+  }
+  for (const s of [...sec.funcs, ...sec.stdlib, ...sec.start]) optimizeFunc(s, cfg)
+  if (!cfg || cfg.hoistConstantPool !== false)
+    hoistConstantPool([...sec.funcs, ...sec.stdlib, ...sec.start], (name, wat) => ctx.scope.globals.set(name, wat))
+
+  const dataLen = ctx.runtime.data?.length || 0
+  if (dataLen > 1024 && !ctx.memory.shared) {
+    const heapBase = (dataLen + 7) & ~7
+    ctx.scope.globals.set('__heap', `(global $__heap (mut i32) (i32.const ${heapBase}))`)
+    for (const s of sec.stdlib)
+      if (s[0] === 'func' && s[1] === '$__reset')
+        for (let i = 2; i < s.length; i++)
+          if (Array.isArray(s[i]) && s[i][0] === 'global.set' && Array.isArray(s[i][2]) && s[i][2][0] === 'i32.const')
+            s[i][2][1] = `${heapBase}`
+  }
+}
+
+/**
+ * Phase: strip static-data prefix.
+ *
+ * R: when `__static_str` runtime helper isn't included, the leading prefix of the
+ * data segment (the static string-table header) is dead — strip it and shift all
+ * pointer offsets in user code, embedded data slots, and constant-folded NaN-box
+ * literals down by `prefix` bytes. ATOM/SSO have no offset, so they're unaffected.
+ *
+ * Patches both runtime-call form (`__mkptr(T, A, off)`) and the constant-folded
+ * form (`f64.reinterpret_i64 (i64.const ...)`) when offset >= prefix.
+ */
+function stripStaticDataPrefix(sec) {
+  if (!ctx.runtime.staticDataLen || ctx.core.includes.has('__static_str')) return
+  const prefix = ctx.runtime.staticDataLen
+  const SHIFTABLE = new Set([PTR.STRING, PTR.OBJECT, PTR.ARRAY, PTR.HASH, PTR.SET, PTR.MAP, PTR.BUFFER, PTR.TYPED, PTR.CLOSURE])
+  const data = ctx.runtime.data || ''
+  const buf = new Uint8Array(data.length)
+  for (let i = 0; i < data.length; i++) buf[i] = data.charCodeAt(i)
+  const dv = new DataView(buf.buffer)
+  if (ctx.runtime.staticPtrSlots) {
+    for (const slotOff of ctx.runtime.staticPtrSlots) {
+      if (slotOff < prefix) continue
+      const bits = dv.getBigUint64(slotOff, true)
+      if (((bits >> 48n) & 0xFFF8n) !== NAN_PREFIX_BITS) continue
+      const ty = Number((bits >> 47n) & 0xFn)
+      if (!SHIFTABLE.has(ty)) continue
+      const off = Number(bits & 0xFFFFFFFFn)
+      if (off < prefix) continue
+      const hi = bits & ~0xFFFFFFFFn
+      dv.setBigUint64(slotOff, hi | BigInt(off - prefix), true)
+    }
+  }
+  let s = ''
+  for (let i = prefix; i < buf.length; i++) s += String.fromCharCode(buf[i])
+  ctx.runtime.data = s
+  if (ctx.runtime.staticPtrSlots) ctx.runtime.staticPtrSlots = ctx.runtime.staticPtrSlots
+    .filter(o => o >= prefix).map(o => o - prefix)
+  const shift = (node) => {
+    if (!Array.isArray(node)) return
+    for (let i = 0; i < node.length; i++) {
+      const child = node[i]
+      if (!Array.isArray(child)) continue
+      if (child[0] === 'call' && child[1] === '$__mkptr' &&
+        Array.isArray(child[2]) && SHIFTABLE.has(child[2][1]) &&
+        Array.isArray(child[4]) && child[4][0] === 'i32.const' &&
+        typeof child[4][1] === 'number' && child[4][1] >= prefix) {
+        child[4][1] -= prefix
+      } else if (child[0] === 'f64.const' &&
+        typeof child[1] === 'string' && child[1].startsWith('nan:0x')) {
+        const bits = BigInt(child[1].slice(4)) | 0x7FF0000000000000n
+        if (((bits >> 48n) & 0xFFF8n) === NAN_PREFIX_BITS) {
+          const ty = Number((bits >> 47n) & 0xFn)
+          if (SHIFTABLE.has(ty)) {
+            const off = Number(bits & 0xFFFFFFFFn)
+            if (off >= prefix) {
+              const hi = bits & ~0xFFFFFFFFn
+              const newBits = hi | BigInt(off - prefix)
+              child[1] = 'nan:0x' + newBits.toString(16).toUpperCase().padStart(16, '0')
+            }
+          }
+        }
+      }
+      shift(child)
+    }
+  }
+  for (const s of [...sec.funcs, ...sec.stdlib, ...sec.start]) shift(s)
+}
+
+/**
+ * Compile prepared AST to WASM module IR.
+ * @param {import('./prepare.js').ASTNode} ast - Prepared AST
+ * @returns {Array} Complete WASM module as S-expression
+ */
+export default function compile(ast, profiler) {
+  // Populate known function names + lookup map on ctx.func for direct call detection
+  ctx.func.names.clear()
+  ctx.func.map.clear()
+  for (const f of ctx.func.list) { ctx.func.names.add(f.name); ctx.func.map.set(f.name, f) }
+  // Include imported functions for call resolution (e.g. template interpolations)
+  for (const imp of ctx.module.imports)
+    if (imp[3]?.[0] === 'func') ctx.func.names.add(imp[3][1].replace(/^\$/, ''))
+
+  // Check user globals don't conflict with runtime globals (modules loaded after user decls)
+  for (const name of ctx.scope.userGlobals)
+    if (!ctx.scope.globals.get(name)?.includes('mut f64'))
+      err(`'${name}' conflicts with a compiler internal — choose a different name`)
+
+  // Pre-fold const globals: evaluate constant initializers before function compilation
+  // so functions see the correct global types (i32 vs f64).
+  if (ast) {
+    const evalConst = n => {
+      if (typeof n === 'number') return n
+      if (Array.isArray(n) && n[0] == null && typeof n[1] === 'number') return n[1]
+      if (!Array.isArray(n)) return null
+      const [op, a, b] = n
+      const va = evalConst(a), vb = b !== undefined ? evalConst(b) : null
+      if (va == null) return null
+      if (op === 'u-' || (op === '-' && b === undefined)) return -va
+      if (vb == null) return null
+      if (op === '+') return va + vb; if (op === '-') return va - vb
+      if (op === '*') return va * vb; if (op === '%' && vb) return va % vb
+      if (op === '/' && vb) return va / vb; if (op === '**') return va ** vb
+      if (op === '&') return va & vb; if (op === '|') return va | vb
+      if (op === '^') return va ^ vb; if (op === '<<') return va << vb
+      if (op === '>>') return va >> vb; if (op === '>>>') return va >>> vb
+      return null
+    }
+    const stmts = Array.isArray(ast) && ast[0] === ';' ? ast.slice(1)
+      : Array.isArray(ast) && ast[0] === 'const' ? [ast] : []
+    for (const s of stmts) {
+      if (!Array.isArray(s) || s[0] !== 'const') continue
+      for (const decl of s.slice(1)) {
+        if (!Array.isArray(decl) || decl[0] !== '=' || typeof decl[1] !== 'string') continue
+        const [, name, init] = decl
+        if (!ctx.scope.globals.has(name) || !ctx.scope.consts?.has(name)) continue
+        const v = evalConst(init)
+        if (v == null || !isFinite(v)) continue
+        const isInt = Number.isInteger(v) && v >= -2147483648 && v <= 2147483647
+        ctx.scope.globals.set(name, isInt
+          ? `(global $${name} i32 (i32.const ${v}))`
+          : `(global $${name} f64 (f64.const ${v}))`)
+        ctx.scope.globalTypes.set(name, isInt ? 'i32' : 'f64')
+        // Cache integer values for cross-call const-arg propagation: `f(N)` where
+        // `const N = 8` should observe the param as intConst=8.
+        if (isInt) (ctx.scope.constInts ||= new Map()).set(name, v)
+      }
+    }
+  }
+
+  const programFacts = timePhase(profiler, 'plan', () => plan(ast))
+
+  const funcFacts = new Map()
+  for (const func of ctx.func.list) if (!func.raw) funcFacts.set(func, analyzeFuncForEmit(func, programFacts))
+  const funcs = ctx.func.list.map(func => emitFunc(func, funcFacts.get(func), programFacts))
+  funcs.push(...synthesizeBoundaryWrappers())
+
+  const closureFuncs = []
+  let compiledBodyCount = 0
+  const compilePendingClosures = () => {
+    const bodies = ctx.closure.bodies || []
+    for (let bodyIndex = compiledBodyCount; bodyIndex < bodies.length; bodyIndex++) {
+      closureFuncs.push(emitClosureBody(bodies[bodyIndex]))
+    }
+    compiledBodyCount = bodies.length
+  }
+  compilePendingClosures()
+
+  // Build module sections — named slots, assembled at the end (no index bookkeeping)
+  const sec = {
+    extStdlib: [],  // external stdlib (imports that must precede all other imports)
+    imports: [...ctx.module.imports],
+    types: [],      // function types for call_indirect
+    memory: [],     // memory declaration
+    data: [],       // data segment (filled after emit)
+    tags: [],       // error tags + related exports
+    table: [],      // function table (at most one)
+    globals: [],    // globals (filled after __start)
+    funcs: [],      // closure funcs + regular funcs
+    elem: [],       // element section (table init)
+    start: [],      // __start func + start directive
+    stdlib: [],     // stdlib functions
+    customs: [],    // custom sections + exports
+  }
+
+  // Uniform closure convention: (env f64, argc i32, a0..a{MAX-1} f64) → f64.
+  // argc = actual arg count passed; missing slots padded with UNDEF_NAN at caller.
+  // Rest-param bodies pack slots a[fixedParams..argc-1] into their rest array.
+  // MAX_CLOSURE_ARITY is the fixed inline-slot count; calls with more args error.
+  if (ctx.closure.types) {
+    const params = [['param', 'f64'], ['param', 'i32']] // env + argc
+    for (let i = 0; i < (ctx.closure.width ?? MAX_CLOSURE_ARITY); i++) params.push(['param', 'f64'])
+    sec.types.push(['type', `$ftN`, ['func', ...params, ['result', 'f64']]])
+  }
+
+  // Memory section deferred — emitted after resolveIncludes() when __alloc is needed
+
+  if (ctx.runtime.throws) {
+    ctx.scope.globals.set('__jz_last_err_bits', '(global $__jz_last_err_bits (mut i64) (i64.const 0))')
+    sec.tags.push(['tag', '$__jz_err', ['param', 'f64']])
+    sec.tags.push(['export', '"__jz_last_err_bits"', ['global', '$__jz_last_err_bits']])
+  }
+
+  if (ctx.closure.table?.length)
+    sec.table.push(['table', ['export', '"__jz_table"'], ctx.closure.table.length, 'funcref'])
+
+  sec.funcs.push(...closureFuncs, ...funcs)
+
+  if (ctx.closure.table?.length)
+    sec.elem.push(['elem', ['i32.const', 0], 'func', ...ctx.closure.table.map(n => `$${n}`)])
+
+  buildStartFn(ast, sec, closureFuncs, compilePendingClosures)
+
+  dedupClosureBodies(closureFuncs, sec)
+
+  finalizeClosureTable(sec)
+
+  pullStdlib(sec)
+
+  stripStaticDataPrefix(sec)
+
+  optimizeModule(sec)
+
+  // Populate globals (after __start — const folding may update declarations)
+  sec.globals.push(...[...ctx.scope.globals.values()].filter(g => g).map(g => parseWat(g)))
+
+  // Data segments (after emit — string literals append to ctx.runtime.data / strPool during emit)
+  // Active segment at address 0 — skipped for shared memory (would collide across modules)
+  const escBytes = (s) => {
+    let esc = ''
+    for (let i = 0; i < s.length; i++) {
+      const c = s.charCodeAt(i)
+      if (c >= 32 && c < 127 && c !== 34 && c !== 92) esc += s[i]
+      else esc += '\\' + c.toString(16).padStart(2, '0')
+    }
+    return esc
+  }
+  if (ctx.runtime.data && !ctx.memory.shared)
+    sec.data.push(['data', ['i32.const', 0], '"' + escBytes(ctx.runtime.data) + '"'])
+  // Passive segment for shared-memory string literals (copied via memory.init at runtime)
+  if (ctx.runtime.strPool)
+    sec.data.push(['data', '$__strPool', '"' + escBytes(ctx.runtime.strPool) + '"'])
+
+  // Custom section: embed object schemas for JS-side interop.
+  // Compact binary format: varint(nSchemas); per schema: varint(nProps); per prop:
+  //   0x00=null, 0x01=[null, <prop>], 0x02=<varint len><utf8 bytes>. Runtime decodes.
+  if (ctx.schema.list.length) {
+    const bytes = []
+    const utf8 = new TextEncoder()
+    const varint = (n) => { while (n >= 0x80) { bytes.push((n & 0x7F) | 0x80); n >>>= 7 } bytes.push(n) }
+    const enc = (p) => {
+      if (p === null) bytes.push(0)
+      else if (Array.isArray(p)) { bytes.push(1); enc(p[1]) }
+      else { bytes.push(2); const b = utf8.encode(p); varint(b.length); for (const x of b) bytes.push(x) }
+    }
+    varint(ctx.schema.list.length)
+    for (const s of ctx.schema.list) { varint(s.length); for (const p of s) enc(p) }
+    sec.customs.push(['@custom', '"jz:schema"', bytes])
+  }
+
+  // Custom section: rest params for exported functions (JS-side wrapping)
+  const restParamFuncs = ctx.func.list.filter(f => f.exported && f.rest)
+    .map(f => ({ name: f.name, fixed: f.sig.params.length - 1 }))
+  if (restParamFuncs.length)
+    sec.customs.push(['@custom', '"jz:rest"', `"${JSON.stringify(restParamFuncs).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`])
+
+  // Named export aliases: export { name } or export { source as alias }
+  for (const [name, val] of Object.entries(ctx.func.exports)) {
+    if (val === true) {
+      if (ctx.scope.userGlobals?.has(name)) sec.customs.push(['export', `"${name}"`, ['global', `$${name}`]])
+      continue
+    }
+    if (typeof val !== 'string') continue
+    const func = ctx.func.list.find(f => f.name === val)
+    // Boundary-wrapped funcs export through the synthesized $${val}$exp wrapper
+    // so the JS-visible alias preserves f64 ABI.
+    if (func) sec.customs.push(['export', `"${name}"`, ['func', `$${isBoundaryWrapped(func) ? val + '$exp' : val}`]])
+    else if (ctx.scope.globals.has(val)) sec.customs.push(['export', `"${name}"`, ['global', `$${val}`]])
+  }
+
+  // Whole-module: prune funcs unreachable from entry points (start, exports, elem refs).
+  // Removes orphan top-level consts that never get called (e.g. watr's unused `hoist` = 26 KB).
+  // Also returns callCount Map (computed during the same walk — used below for funcidx sort).
+  // Reachability walk always runs (callCount feeds the sort even when shake is off);
+  // actual removal gated by ctx.transform.optimize.treeshake.
+  const optCfg = ctx.transform.optimize
+  const { callCount } = treeshake(
+    [{ arr: sec.stdlib }, { arr: sec.funcs }, { arr: sec.start }],
+    [...sec.start, ...sec.elem, ...sec.customs, ...sec.extStdlib, ...sec.imports],
+    { removeDead: !optCfg || optCfg.treeshake !== false }
+  )
+
+  // Reorder non-import funcs by call count: hot callees get low LEB128 indices.
+  // `call $f` encodes funcidx as ULEB128 (1 B for idx < 128, 2 B for idx < 16384).
+  // On watr self-host this saves ~6 KB (hot specialized helpers migrate to idx < 128).
+  // callCount was computed inline by treeshake's walk (same set of nodes).
+  const byCalls = (a, b) => (callCount.get(b[1]) || 0) - (callCount.get(a[1]) || 0)
+  const startFn = sec.start.find(n => n[0] === 'func')
+  const startDir = sec.start.find(n => n[0] === 'start')
+  const sortedFuncs = [
+    ...sec.stdlib, ...sec.funcs, ...(startFn ? [startFn] : []),
+  ].sort(byCalls)
+
+  // Assemble: named slots → flat section list.
+  const sections = [
+    ...sec.extStdlib, ...sec.imports, ...sec.types, ...sec.memory, ...sec.data,
+    ...sec.tags, ...sec.table, ...sec.globals, ...sortedFuncs,
+    ...sec.elem, ...(startDir ? [startDir] : []), ...sec.customs,
+  ]
+  return ['module', ...sections]
+}