jz 0.1.0 → 0.2.0

package/src/compile.js

@@ -26,19 +26,13 @@
  */
 
 import { parse as parseWat } from 'watr'
-import { ctx, err, inc, resolveIncludes, PTR } from './ctx.js'
+import { ctx, err, inc, resolveIncludes, PTR, LAYOUT } from './ctx.js'
 import {
-  T, VAL, valTypeOf, lookupValType, analyzeValTypes, analyzeIntCertain, analyzeLocals, analyzeBody, analyzePtrUnboxable, typedElemAux, exprType, invalidateLocalsCache, invalidateValTypesCache,
-  extractParams, classifyParam, collectParamNames,
-  findFreeVars, analyzeBoxedCaptures, analyzeDynKeys, typedElemCtor,
-  repOf, updateRep, repOfGlobal, updateGlobalRep,
-  staticObjectProps, mergeParamFact, ensureParamRep, callerParamFactMap, clearStickyNull,
-  inferArgType, inferArgSchema, inferArgArrElemSchema, inferArgArrElemValType, inferArgTypedCtor,
-  ctorFromElemAux, collectProgramFacts, observeProgramSlots, narrowReturnArrayElems,
-  isBlockBody, alwaysReturns, hasBareReturn, returnExprs, collectReturnExprs,
-  findMutations,
+  T, VAL, analyzeValTypes, analyzeIntCertain, analyzeLocals,
+  analyzePtrUnboxable, typedElemAux, invalidateLocalsCache,
+  analyzeBoxedCaptures, updateRep, inferStringParams,
 } from './analyze.js'
-import { optimizeFunc, hoistConstantPool, specializeMkptr, specializePtrBase, sortStrPoolByFreq, treeshake } from './optimize.js'
+import { optimizeFunc, hoistConstantPool, specializeMkptr, specializePtrBase, sortStrPoolByFreq, treeshake, arenaRewindModule } from './optimize.js'
 import { emit, emitter, emitFlat, emitBody } from './emit.js'
 import {
   typed, asF64, asI32, asPtrOffset, asParamType, toI32, asI64, fromI64,
@@ -48,39 +42,27 @@ import {
   isLit, litVal, isNullishLit, isPureIR, isPostfix, emitNum,
   temp, tempI32, tempI64, f64rem, toNumF64, truthyIR, toBoolFromEmitted,
   keyValType, usesDynProps, needsDynShadow,
-  isGlobal, isConst, boxedAddr, readVar, writeVar, isNullish,
+  isGlobal, isConst, boxedAddr, readVar, writeVar, isNullish, isUndef,
   slotAddr, elemLoad, elemStore, arrayLoop, allocPtr,
   multiCount, loopTop, flat, reconstructArgsWithSpreads,
   valKindToPtr,
 } from './ir.js'
+import plan from './plan.js'
 
-// Re-export for backward compatibility (modules import from compile.js)
-export { T, VAL, valTypeOf, lookupValType, extractParams, classifyParam, collectParamNames, repOf, updateRep, repOfGlobal, updateGlobalRep }
-export { emit, emitter, emitFlat }
-// IR helpers — re-export from ir.js so module/*.js keep their existing import paths.
-export {
-  typed, asF64, asI32, asParamType, toI32, asI64, fromI64,
-  NULL_NAN, UNDEF_NAN, NULL_WAT, UNDEF_WAT, NULL_IR, UNDEF_IR, nullExpr, undefExpr,
-  MAX_CLOSURE_ARITY, MEM_OPS, WASM_OPS, SPREAD_MUTATORS, BOXED_MUTATORS,
-  mkPtrIR, ptrOffsetIR, ptrTypeIR, extractF64Bits, appendStaticSlots,
-  isLit, litVal, isNullishLit, isPureIR, isPostfix, emitNum,
-  temp, tempI32, tempI64, f64rem, toNumF64, truthyIR, toBoolFromEmitted,
-  keyValType, usesDynProps, needsDynShadow,
-  isGlobal, isConst, boxedAddr, readVar, writeVar, isNullish,
-  slotAddr, elemLoad, elemStore, arrayLoop, allocPtr,
-  multiCount, loopTop, flat, reconstructArgsWithSpreads,
-}
-// Emit-dependent helpers (emitTypeofCmp, toBool, materializeMulti, emitDecl,
-// buildArrayWithSpreads) live in emit.js and are re-exported there for modules.
-export { emitTypeofCmp, toBool, materializeMulti, emitDecl, buildArrayWithSpreads } from './emit.js'
+const timePhase = (profiler, name, fn) => profiler ? profiler.time(name, fn) : fn()
 
 // Per-compile func name set + map live on ctx.func.names / ctx.func.map,
 // populated at compile() entry. Both reset by ctx.js reset() and re-filled here.
 
-// NaN-box high-bits mask: used by the static-prefix-strip pass below to
-// identify pointer slots in the data segment. Kept local (ir.js owns the
-// runtime packing via mkPtrIR).
-const NAN_PREFIX_BITS = 0x7FF8n
+// NaN-prefix top-13-bits as BigInt — used by the static-prefix-strip pass
+// below to identify pointer slots in the data segment.
+const NAN_PREFIX = BigInt(LAYOUT.NAN_PREFIX)
+const TAG_MASK_BIG = BigInt(LAYOUT.TAG_MASK)
+const AUX_MASK_BIG = BigInt(LAYOUT.AUX_MASK)
+const OFFSET_MASK_BIG = BigInt(LAYOUT.OFFSET_MASK)
+const TAG_SHIFT_BIG = BigInt(LAYOUT.TAG_SHIFT)
+const AUX_SHIFT_BIG = BigInt(LAYOUT.AUX_SHIFT)
+const SSO_BIT_BIG = BigInt(LAYOUT.SSO_BIT)
 
 // Low-level IR helpers previously lived here. Pure ones moved to src/ir.js;
 // emit-calling ones (toBool, emitTypeofCmp, emitDecl, materializeMulti,
@@ -163,911 +145,120 @@ const tcoTailRewrite = (ir, resultType) => {
   return ir
 }
 
-// === Module compilation ===
+const ARENA_SAFE_CALLS = new Set([
+  '$__alloc', '$__alloc_hdr', '$__mkptr',
+  '$__ptr_offset', '$__ptr_type', '$__ptr_aux',
+  '$__len', '$__cap', '$__typed_shift', '$__typed_data',
+])
 
-/**
- * Phase: signature narrowing.
- *
- * Reads programFacts.callSites + valueUsed; mutates each user func's `sig`:
- *   - param types  (f64 → i32 / pointer-ABI i32+ptrKind, when call sites agree)
- *   - param schemas (per-arg schemaId, recorded into programFacts.paramReps[k].schemaId)
- *   - result type  (f64 → i32, when body always returns i32)
- *   - result valType (`func.valResult`) and pointer narrowing (sig.ptrKind)
- *
- * Pure w.r.t. the AST — only the function `sig` records change. The unified
- * paramReps record is populated here (per-field lattice) and consumed by the
- * per-function emit phase below.
- *
- * Encoded structurally as a phase so future S3 work can move it into a
- * pipeline runner without re-deriving the in/out contract from comments.
- */
-function narrowSignatures(programFacts, ast) {
-  const { callSites, valueUsed, paramReps } = programFacts
-
-  // Reachability filter: dead callerFuncs (e.g. unused stdlib helpers from bundled
-  // modules) shouldn't poison narrowing of live functions. Without this, a never-
-  // executed call like `checksumF64 → mix(h, u[i])` would force mix's `x` rep to
-  // bimorphic (f64 ∪ i32) and block i32 narrowing of mix's hot caller (runKernel).
-  // Live = exported ∪ value-used ∪ transitively reached from those + top-level.
-  // Top-level call sites have callerFunc === null and are unconditionally live.
-  if (callSites.length) {
-    const live = new Set()
-    for (const f of ctx.func.list) {
-      if (f.exported || valueUsed.has(f.name)) live.add(f.name)
-    }
-    let changed = true
-    while (changed) {
-      changed = false
-      for (const cs of callSites) {
-        if (cs.callerFunc === null || live.has(cs.callerFunc.name)) {
-          if (!live.has(cs.callee)) { live.add(cs.callee); changed = true }
-        }
-      }
-    }
-    // Mutate in place — every later phase reads the same array.
-    let w = 0
-    for (let r = 0; r < callSites.length; r++) {
-      const cs = callSites[r]
-      if (cs.callerFunc === null || live.has(cs.callerFunc.name)) callSites[w++] = cs
-    }
-    callSites.length = w
-  }
-
-  // D: Call-site type propagation — infer param types from how functions are called.
-  // Drives off `callSites` collected during the ProgramFacts walk; no AST re-walking.
-  // For non-exported internal functions, if all call sites agree on a param's type,
-  // seed the param's val rep (ctx.func.repByLocal) during per-function compilation.
-  // Also infer i32/f64 WASM type — when all call sites pass i32 for a param, specialize
-  // sig.params[k].type to i32 (no default, no rest, not exported, not value-used).
-  // Also propagate schema ID — when all call sites pass objects with the same schema,
-  // bind the callee's param to that schema so `p.x` becomes a direct slot load.
-  // Inference helpers (inferArgType/inferArgSchema/inferArgArr*/inferArgTypedCtor)
-  // live in analyze.js — pure AST→fact resolvers shared across fixpoint phases.
-  // Per-caller analysis is stable across fixpoint iterations — precompute once.
-  // callerCtx[null] (top-level) uses module globals for both locals and valTypes.
-  const callerCtx = new Map()  // funcObj | null → { callerLocals, callerValTypes }
-  callerCtx.set(null, { callerLocals: ctx.scope.globalTypes, callerValTypes: ctx.scope.globalValTypes })
-  for (const func of ctx.func.list) {
-    if (!func.body || func.raw) continue
-    // Single unified walk — locals + valTypes from the same traversal.
-    const facts = analyzeBody(func.body)
-    for (const p of func.sig.params) if (!facts.locals.has(p.name)) facts.locals.set(p.name, p.type)
-    callerCtx.set(func, { callerLocals: facts.locals, callerValTypes: facts.valTypes })
-  }
-  // Per-caller arr-elem observations. Recomputed each fixpoint iteration so
-  // newly-narrowed func.arrayElemSchema/.arrayElemValType results propagate
-  // from `const rows = initRows()` observations. Two-pass fixpoint: first
-  // pass learns from literals + module vars; second pass forwards through
-  // chained helpers (f → addXY → {getX, getY}).
-  const buildCallerElems = (sliceKey) => {
-    const m = new Map()
-    m.set(null, new Map())
-    for (const func of ctx.func.list) {
-      if (!func.body || func.raw) continue
-      m.set(func, analyzeBody(func.body)[sliceKey])
-    }
-    return m
-  }
-  let callerArrElemsCtx = buildCallerElems('arrElemSchemas')
-  const rebuildArrElems = () => { callerArrElemsCtx = buildCallerElems('arrElemSchemas') }
-  let callerArrElemValsCtx = buildCallerElems('arrElemValTypes')
-  const rebuildArrElemVals = () => { callerArrElemValsCtx = buildCallerElems('arrElemValTypes') }
-  const runFixpoint = () => {
-    for (let s = 0; s < callSites.length; s++) {
-      const { callee, argList, callerFunc } = callSites[s]
-      const func = ctx.func.map.get(callee)
-      if (!func || func.exported || valueUsed.has(callee)) continue
-      const ctxEntry = callerCtx.get(callerFunc)
-      if (!ctxEntry) continue
-      const { callerLocals, callerValTypes } = ctxEntry
-      const callerSchemas = callerParamFactMap(paramReps, callerFunc, 'schemaId')
-      const restIdx = func.rest ? func.sig.params.length - 1 : -1
-      for (let k = 0; k < func.sig.params.length; k++) {
-        const r = ensureParamRep(paramReps, callee, k)
-        if (k < argList.length) {
-          if (r.val !== null) mergeParamFact(r, 'val', inferArgType(argList[k], callerValTypes))
-          // Wasm-type lattice: exprType always returns 'i32'|'f64' — no null sentinel.
-          if (r.wasm !== null) {
-            const wt = exprType(argList[k], callerLocals)
-            if (r.wasm === undefined) r.wasm = wt
-            else if (r.wasm !== wt) r.wasm = null
-          }
-          if (r.schemaId !== null) mergeParamFact(r, 'schemaId', inferArgSchema(argList[k], callerSchemas))
-          // intConst lattice: bare-integer literal at every site → param has fixed value.
-          // Skip rest position — argList[restIdx] is just the first packed arg, not the
-          // whole array. Drop intConst for the rest param so it's never substituted.
-          if (k === restIdx) r.intConst = null
-          else if (r.intConst !== null) {
-            // Literal forms after prepare: bare number, `[null, n]` (literal wrap),
-            // or `['u-', n]` (negative literal). A bare string referencing a known
-            // module-scope `const NAME = <int-literal>` resolves through ctx.scope.constInts.
-            // Anything else → no-consensus.
-            const a = argList[k]
-            let raw = null
-            if (typeof a === 'number') raw = a
-            else if (Array.isArray(a) && a[0] == null && typeof a[1] === 'number') raw = a[1]
-            else if (Array.isArray(a) && a[0] === 'u-' && typeof a[1] === 'number') raw = -a[1]
-            else if (typeof a === 'string' && ctx.scope.constInts?.has(a)) raw = ctx.scope.constInts.get(a)
-            const v = (raw != null && Number.isInteger(raw) && raw >= -2147483648 && raw <= 2147483647) ? raw : null
-            mergeParamFact(r, 'intConst', v)
-          }
-        } else {
-          // Missing arg — call pads with nullExpr (f64). Prevents narrowing.
-          r.val = null; r.wasm = null; r.schemaId = null; r.intConst = null
-        }
-      }
-    }
-  }
-  // Generic arr-elem fixpoint: same shape for arrayElemSchema (schema-id),
-  // arrayElemValType (VAL.*), and typedCtor. `field` selects which fact;
-  // `inferFn` and `elemsCtxMap` provide per-callee inference.
-  const runArrElemFixpoint = (field, inferFn, elemsCtxMap) => {
-    for (let s = 0; s < callSites.length; s++) {
-      const { callee, argList, callerFunc } = callSites[s]
-      const func = ctx.func.map.get(callee)
-      if (!func || func.exported || valueUsed.has(callee)) continue
-      if (!callerCtx.get(callerFunc)) continue
-      const callerParams = callerParamFactMap(paramReps, callerFunc, field)
-      const callerElems = elemsCtxMap.get(callerFunc)
-      for (let k = 0; k < func.sig.params.length; k++) {
-        const r = ensureParamRep(paramReps, callee, k)
-        if (k >= argList.length) { r[field] = null; continue }
-        if (r[field] === null) continue
-        mergeParamFact(r, field, inferFn(argList[k], callerElems, callerParams))
-      }
-    }
-  }
-  const runArrFixpoint = () => runArrElemFixpoint('arrayElemSchema', inferArgArrElemSchema, callerArrElemsCtx)
-  const runArrValTypeFixpoint = () => runArrElemFixpoint('arrayElemValType', inferArgArrElemValType, callerArrElemValsCtx)
-  runFixpoint()
-  runFixpoint()
-
-  // Apply i32 specialization: for non-value-used funcs with consistent i32 call
-  // sites and no defaults/rest at that position, narrow sig.params[k].type.
-  // Exports too — boundary wrapper handles the f64→i32 truncation at the JS edge.
-  for (const func of ctx.func.list) {
-    if (func.raw || valueUsed.has(func.name)) continue
-    const reps = paramReps.get(func.name)
-    if (!reps) continue
-    const restIdx = func.rest ? func.sig.params.length - 1 : -1
-    for (const [k, r] of reps) {
-      if (r.wasm !== 'i32' || k === restIdx) continue
-      const pname = func.sig.params[k].name
-      if (func.defaults?.[pname] != null) continue  // defaults need nullish-sentinel f64
-      func.sig.params[k].type = 'i32'
-    }
-  }
-
-  // intConst validation: a param marked with a unanimous integer literal at every call
-  // site is only safe to substitute if the body never reassigns it. Clear intConst on any
-  // param whose name appears on the LHS of an assignment / `++` / `--`. Skip exported
-  // (callable from JS with arbitrary value), value-used (closure callees), raw, defaulted,
-  // and rest params — same exclusions as the wasm-narrowing pass above.
-  for (const func of ctx.func.list) {
-    if (func.exported || func.raw || valueUsed.has(func.name)) continue
-    if (!func.body) continue
-    const reps = paramReps.get(func.name)
-    if (!reps) continue
-    const restIdx = func.rest ? func.sig.params.length - 1 : -1
-    let candidates = null
-    for (const [k, r] of reps) {
-      if (r.intConst == null || k === restIdx) continue
-      if (k >= func.sig.params.length) { r.intConst = null; continue }
-      const pname = func.sig.params[k].name
-      if (func.defaults?.[pname] != null) { r.intConst = null; continue }
-      ;(candidates ||= new Map()).set(pname, r)
-    }
-    if (!candidates) continue
-    const mutated = new Set()
-    findMutations(func.body, new Set(candidates.keys()), mutated)
-    for (const name of mutated) candidates.get(name).intConst = null
-  }
-
-  // Pointer-ABI specialization: for non-forwarding pointer params consistent across
-  // call sites, narrow from NaN-boxed f64 to i32 offset. Eliminates per-call __ptr_offset
-  // extraction + f64→i64→i32 reinterpret chains that dominate watr-style compilers.
-  // Safety:
-  //   - exclude ARRAY (forwards on realloc — f64 NaN-box is a stable identity) and
-  //     STRING (SSO vs heap dual encoding depends on ptr-type bits we'd drop).
-  //   - exclude CLOSURE/TYPED (aux bits carry schema/element-type, lost with offset).
-  //   - exclude params with defaults (nullish sentinel needs the f64 NaN space).
-  //   - exclude rest position (array pack/unpack stays f64).
-  const PTR_ABI_KINDS = new Set([VAL.OBJECT, VAL.SET, VAL.MAP, VAL.BUFFER])
-  for (const func of ctx.func.list) {
-    if (func.exported || func.raw || valueUsed.has(func.name)) continue
-    const reps = paramReps.get(func.name)
-    if (!reps) continue
-    const restIdx = func.rest ? func.sig.params.length - 1 : -1
-    for (const [k, r] of reps) {
-      if (!PTR_ABI_KINDS.has(r.val)) continue
-      if (k === restIdx) continue
-      if (k >= func.sig.params.length) continue
-      const p = func.sig.params[k]
-      if (p.type === 'i32') continue  // already narrowed by numeric pass
-      if (func.defaults?.[p.name] != null) continue
-      p.type = 'i32'
-      p.ptrKind = r.val
-    }
-  }
-
-  // E: Result-type monomorphization — narrow sig.results[0] to 'i32' when body only
-  // produces i32 values. Fixpoint: a call to another narrowed func now contributes i32;
-  // iterate until stable so chains of i32-only helpers all narrow together.
-  // Safety: skip exported (JS boundary preserves number semantics), value-used (closure
-  // trampolines assume f64 result), raw WAT, multi-value. `undefined` return = skip.
-  // exprType already consults ctx.func.map for narrowed user-function results
-  // (analyze.js exprType `()` branch), plus the Math.imul/Math.clz32/charCodeAt
-  // stdlib subset and primitive-op rules. Earlier we had a local shim here that
-  // shadowed exprType's stdlib rules with `return 'f64'` for any non-user call;
-  // unifying through exprType lets a single rule (math.imul → i32) flow through
-  // to mix-style helpers (`(h, x) => Math.imul(h ^ (x|0), C)`) and unblocks the
-  // E-phase result narrowing on every call site that consumes them.
-  const exprTypeWithCalls = exprType
-  // Body-driven: safe for exports — the result type is determined by what the body
-  // computes, not by what JS callers might pass. JS-visible f64 ABI is restored at
-  // the boundary via a synthesized wrapper (see synthesizeBoundaryWrappers below).
-  // Shared pool for E (numeric), E2 (valType) and E3 (ptr) narrowing — same predicate.
-  const narrowableFuncs = ctx.func.list.filter(f =>
-    !f.raw && !valueUsed.has(f.name) && f.sig.results.length === 1
-  )
-  let changed = true
-  while (changed) {
-    changed = false
-    for (const func of narrowableFuncs) {
-      if (func.sig.results[0] === 'i32') continue
-      const body = func.body
-      // Bare `return;` produces undef (f64) — narrowing to i32 would lose that.
-      if (isBlockBody(body) && hasBareReturn(body)) continue
-      const exprs = returnExprs(body)
-      if (!exprs.length) continue
-      // Skip narrowing when any return-tail is `>>>` (unsigned uint32). Narrowing to i32
-      // loses the unsigned interpretation: the wrapper rebox via `f64.convert_i32_s` would
-      // sign-flip values with bit 31 set, breaking the canonical `(x >>> 0)` uint32 idiom.
-      // A future pass could track sig.unsignedResult and emit `f64.convert_i32_u` instead.
-      if (exprs.some(e => Array.isArray(e) && e[0] === '>>>')) continue
-      const savedCurrent = ctx.func.current
-      ctx.func.current = func.sig
-      const locals = isBlockBody(body) ? analyzeLocals(body) : new Map()
-      for (const p of func.sig.params) if (!locals.has(p.name)) locals.set(p.name, p.type)
-      const allI32 = exprs.every(e => exprTypeWithCalls(e, locals) === 'i32')
-      ctx.func.current = savedCurrent
-      if (allI32) { func.sig.results = ['i32']; changed = true }
-    }
-  }
-
-  // E2: VAL-type result inference — if a function always returns the same VAL kind,
-  // record it so callers inherit that type (enables static dispatch on .length, .[],
-  // .prop through a call chain). Fixpoint propagates through helper chains.
-  // Safety: skip exported (host sees raw f64), value-used (indirect call signature).
-  // Shim so calls to already-typed funcs contribute their result type.
-  const valTypeOfWithCalls = (expr, localValTypes) => {
-    if (expr == null) return null
-    if (typeof expr === 'string') return localValTypes?.get(expr) || ctx.scope.globalValTypes?.get(expr) || null
-    if (!Array.isArray(expr)) return valTypeOf(expr)
-    const [op, ...args] = expr
-    if (op === '()' && typeof args[0] === 'string') {
-      const f = ctx.func.map.get(args[0])
-      if (f?.valResult) return f.valResult
-    }
-    if (op === '?:') {
-      const a = valTypeOfWithCalls(args[1], localValTypes), b = valTypeOfWithCalls(args[2], localValTypes)
-      return a && a === b ? a : null
-    }
-    if (op === '&&' || op === '||') {
-      const a = valTypeOfWithCalls(args[0], localValTypes), b = valTypeOfWithCalls(args[1], localValTypes)
-      return a && a === b ? a : null
-    }
-    return valTypeOf(expr)
-  }
-  // Body-driven valResult inference: same safety analysis as numeric narrowing
-  // above — exports OK because boundary wrapper restores f64 ABI for JS callers.
-  changed = true
-  while (changed) {
-    changed = false
-    for (const func of narrowableFuncs) {
-      if (func.valResult) continue
-      const body = func.body
-      const isBlock = isBlockBody(body)
-      if (isBlock && hasBareReturn(body)) continue
-      const exprs = returnExprs(body)
-      if (!exprs.length) continue
-      const localValTypes = isBlock ? analyzeBody(body).valTypes : new Map()
-      // Params of this function contribute no known VAL type yet (paramReps may help later).
-      const vt0 = valTypeOfWithCalls(exprs[0], localValTypes)
-      if (!vt0) continue
-      const allSame = exprs.every(e => valTypeOfWithCalls(e, localValTypes) === vt0)
-      if (allSame) { func.valResult = vt0; changed = true }
-    }
-  }
-
-  // Now that E2 set `valResult` on funcs, narrow per-func `arrayElemSchema` for
-  // VAL.ARRAY-returning funcs (via push observations + call chains). Then re-run the
-  // D-pass arrayElemSchema/val fixpoints so `const rows = initRows()` in main
-  // resolves to VAL.ARRAY (lets runKernel pick up r.val=ARRAY) and its arr-elem
-  // schema (sets paramReps[runKernel][0].arrayElemSchema=sid).
-  // Cache invalidation: analyzeBody.valTypes is body-keyed, and entries cached
-  // during the first D pass have stale (null) `valTypeOf(call)` results because
-  // valResult was unset back then.
-  narrowReturnArrayElems('arrayElemSchema', paramReps, valueUsed)
-  narrowReturnArrayElems('arrayElemValType', paramReps, valueUsed)
-  for (const func of ctx.func.list) {
-    if (func.body && !func.raw) invalidateValTypesCache(func.body)
-  }
-  for (const func of ctx.func.list) {
-    if (!func.body || func.raw) continue
-    const entry = callerCtx.get(func)
-    if (entry) entry.callerValTypes = analyzeBody(func.body).valTypes
-  }
-  // Re-observe schema slot val-types now that E2 has set `valResult` on user
-  // funcs. First pass runs in collectProgramFacts before valResult is known, so
-  // a slot like `cs` in `{ ..., cs }` (where `cs = checksum(out)`) gets observed
-  // as null. observeSlot's first-wins-then-clash rule lets a later precise
-  // observation upgrade `undefined` → NUMBER without poisoning earlier
-  // monomorphic observations.
-  observeProgramSlots(ast)
-  rebuildArrElems()
-  rebuildArrElemVals()
-  // Clear sticky-null on val/schemaId — first 2 passes ran with valResult unset, so
-  // call args resolving via `f.valResult` returned null and got stuck. Re-running
-  // with refreshed callerValTypes lets these flow.
-  clearStickyNull(paramReps, 'val')
-  clearStickyNull(paramReps, 'schemaId')
-  runFixpoint()
-  // Now that .val is refreshed, dedicated arr-elem-schema fixpoint.
-  runArrFixpoint()
-  runArrFixpoint()
-  // Parallel arr-elem-val fixpoint (NUMBER/STRING/…). Twice for transitive closure
-  // through helper chains: `init()→main→runKernel`.
-  runArrValTypeFixpoint()
-  runArrValTypeFixpoint()
-  // E3: Result-type pointer narrowing — when valResult is a non-ambiguous pointer kind
-  // with constant aux, narrow sig.results[0] from f64 to i32 and tag sig.ptrKind/.ptrAux.
-  // Eliminates the f64.reinterpret_i64+i64.or rebox at every return and the
-  // i32.wrap_i64+i64.reinterpret_f64 unbox at every callsite that uses the value as a
-  // pointer (load .[], .length, .prop slot dispatch).
-  //   - SET/MAP/BUFFER: aux always 0 — no per-callsite aux preservation needed.
-  //   - OBJECT: aux is schema-id; narrow only when all return exprs share a constant
-  //     schema (literal `{a,b,c}`, schemaId-bound param, module-bound var, or call to
-  //     another OBJECT-narrowed func). Caller picks aux up via callIR.ptrAux → readVar →
-  //     repByLocal.schemaId, restoring property-slot dispatch through the call boundary.
-  // Safety: ARRAY forwards on realloc (no narrowing). STRING dual-encoded SSO/heap.
-  // CLOSURE/TYPED also carry meaningful aux — TYPED narrowing is a follow-up. Body must
-  // be a guaranteed-return form — fallthrough fallback i32.const 0 would be a valid
-  // offset 0 of the narrowed kind, not undefined.
-  const PTR_RESULT_KINDS_NOAUX = new Set([VAL.SET, VAL.MAP, VAL.BUFFER])
-  // Schema-id inference for a return expression. Returns id (number), or null if unknown
-  // / not constant. Mirrors inferArgSchema but extends with calls to already-narrowed
-  // OBJECT-result funcs (fixpoint propagation through helper chains).
-  const schemaIdOfReturn = (expr, paramSchemasMap) => {
-    if (typeof expr === 'string') {
-      if (paramSchemasMap?.has(expr)) return paramSchemasMap.get(expr)
-      if (ctx.schema.vars.has(expr)) return ctx.schema.vars.get(expr)
-      return null
-    }
-    if (!Array.isArray(expr)) return null
-    const [op, ...args] = expr
-    if (op === '{}') {
-      // Object literal: bail to null on block body, dynamic key, or spread.
-      const parsed = staticObjectProps(args)
-      return parsed ? ctx.schema.register(parsed.names) : null
-    }
-    if (op === '()' && typeof args[0] === 'string') {
-      const f = ctx.func.map.get(args[0])
-      if (f?.valResult === VAL.OBJECT && f.sig.ptrAux != null) return f.sig.ptrAux
-      return null
-    }
-    if (op === '?:') {
-      const a = schemaIdOfReturn(args[1], paramSchemasMap)
-      const b = schemaIdOfReturn(args[2], paramSchemasMap)
-      return a != null && a === b ? a : null
-    }
-    if (op === '&&' || op === '||') {
-      const a = schemaIdOfReturn(args[0], paramSchemasMap)
-      const b = schemaIdOfReturn(args[1], paramSchemasMap)
-      return a != null && a === b ? a : null
-    }
-    return null
-  }
-  // Per-body local elemAux map: scans `let/const x = new TypedArray(...)` decls so
-  // a return like `let a = new Float64Array(...); return a` resolves to a constant
-  // aux. Result calls + ?: are handled inline in typedAuxOfReturn.
-  const localElemAuxMap = (body) => {
-    const m = new Map()
-    const walk = (n) => {
-      if (!Array.isArray(n)) return
-      const op = n[0]
-      if (op === '=>') return
-      if ((op === 'let' || op === 'const') && n.length > 1) {
-        for (let i = 1; i < n.length; i++) {
-          const a = n[i]
-          if (Array.isArray(a) && a[0] === '=' && typeof a[1] === 'string') {
-            const aux = typedElemAux(typedElemCtor(a[2]))
-            if (aux != null) m.set(a[1], aux)
-          }
-        }
-      }
-      for (let i = 1; i < n.length; i++) walk(n[i])
-    }
-    walk(body)
-    return m
-  }
-  const typedAuxOfReturn = (expr, localElemMap) => {
-    if (typeof expr === 'string') return localElemMap?.get(expr) ?? null
-    if (!Array.isArray(expr)) return null
-    const [op, ...args] = expr
-    if (op === '()' && typeof args[0] === 'string') {
-      if (args[0].startsWith('new.')) {
-        const ctor = typedElemCtor(expr)
-        return ctor != null ? typedElemAux(ctor) : null
-      }
-      const f = ctx.func.map.get(args[0])
-      if (f?.valResult === VAL.TYPED && f.sig.ptrAux != null) return f.sig.ptrAux
-      return null
-    }
-    if (op === '?:') {
-      const a = typedAuxOfReturn(args[1], localElemMap)
-      const b = typedAuxOfReturn(args[2], localElemMap)
-      return a != null && a === b ? a : null
-    }
-    if (op === '&&' || op === '||') {
-      const a = typedAuxOfReturn(args[0], localElemMap)
-      const b = typedAuxOfReturn(args[1], localElemMap)
-      return a != null && a === b ? a : null
-    }
-    return null
-  }
-  // Fixpoint: a chain `outer → inner → {a,b}` needs inner to narrow first so outer's
-  // call to inner contributes a known schema-id.
-  let narrowChanged = true
-  while (narrowChanged) {
-    narrowChanged = false
-    for (const func of narrowableFuncs) {
-      if (!func.valResult) continue
-      if (func.sig.results[0] !== 'f64') continue
-      const isBlock = isBlockBody(func.body)
-      if (isBlock && !alwaysReturns(func.body)) continue
-      if (PTR_RESULT_KINDS_NOAUX.has(func.valResult)) {
-        func.sig.results = ['i32']
-        func.sig.ptrKind = func.valResult
-        narrowChanged = true
-        continue
-      }
-      const exprs = returnExprs(func.body)
-      if (!exprs.length) continue
-      if (func.valResult === VAL.OBJECT) {
-        const paramSchemasMap = callerParamFactMap(paramReps, func, 'schemaId')
-        const sid0 = schemaIdOfReturn(exprs[0], paramSchemasMap)
-        if (sid0 == null) continue
-        if (!exprs.every(e => schemaIdOfReturn(e, paramSchemasMap) === sid0)) continue
-        func.sig.results = ['i32']
-        func.sig.ptrKind = VAL.OBJECT
-        func.sig.ptrAux = sid0
-        narrowChanged = true
-      } else if (func.valResult === VAL.TYPED) {
-        const localMap = isBlock ? localElemAuxMap(func.body) : null
-        const aux0 = typedAuxOfReturn(exprs[0], localMap)
-        if (aux0 == null) continue
-        if (!exprs.every(e => typedAuxOfReturn(e, localMap) === aux0)) continue
-        func.sig.results = ['i32']
-        func.sig.ptrKind = VAL.TYPED
-        func.sig.ptrAux = aux0
-        narrowChanged = true
-      }
-    }
-  }
-
-  // F: Cross-call typed-array element ctor propagation. Runs AFTER E3 so that
-  // calls to user functions returning a TYPED-narrowed pointer (with constant
-  // ptrAux, e.g. mkInput → Float64Array) contribute their element type to the
-  // caller's local typedElem map. Result: callees pick up `ctx.types.typedElem`
-  // for their own params and `arr[i]` reads emit a direct `f64.load` instead of
-  // the runtime `__is_str_key + __typed_idx` dispatch — closes the largest
-  // chunk of the JS→wasm gap on f64-heavy hot loops.
-  // (Helpers `inferArgTypedCtor`/`ctorFromElemAux` live in analyze.js so the
-  //  bimorphic-typed specialization pass below can reuse them.)
-  // Per-caller typed-elem map, recomputed now that E3 has tagged helper sigs.
-  // Cache invalidation: analyzeBody.typedElems reads `ctx.func.map.get(...).sig.ptrKind`
-  // for `let x = mkInput(...)` decls; entries cached during the initial walk
-  // (before E3 ran) are stale (mkInput's ptrKind was unset then).
-  for (const func of ctx.func.list) {
-    if (func.body && !func.raw) invalidateValTypesCache(func.body)
-  }
-  const callerTypedCtx = new Map()
-  callerTypedCtx.set(null, ctx.scope.globalTypedElem || new Map())
-  for (const func of ctx.func.list) {
-    if (!func.body || func.raw) continue
-    callerTypedCtx.set(func, analyzeBody(func.body).typedElems)
-  }
-  // Two-pass fixpoint: lets a caller's params, once typed, propagate further to
-  // its own callees (e.g. if `outer(buf)` calls `inner(buf)` and we learn `buf`
-  // for outer, the second pass picks it up for inner). Reuses runArrElemFixpoint
-  // (same shape — field/inferFn/elemsCtxMap parameterization).
-  const runTypedFixpoint = () => runArrElemFixpoint('typedCtor', inferArgTypedCtor, callerTypedCtx)
-  runTypedFixpoint()
-  runTypedFixpoint()
-
-  // G: TYPED pointer-ABI narrowing — once .typedCtor agrees on a single
-  // ctor across all call sites, narrow the param from NaN-boxed f64 to raw
-  // i32 offset (with ptrAux carrying the elem-type bits). Eliminates the
-  // per-read `i32.wrap_i64 (i64.reinterpret_f64 (local.get $arr))` unbox dance
-  // that today dominates hot loops dominated by typed-array indexing.
-  // Call sites coerce via emitArgForParam → ptrOffsetIR(arg, VAL.TYPED).
-  // Safety: same exclusions as the OBJECT/SET/MAP/BUFFER narrowing above —
-  // exported, value-used, raw, defaults, rest position.
-  for (const func of ctx.func.list) {
-    if (func.exported || func.raw || valueUsed.has(func.name)) continue
-    const reps = paramReps.get(func.name)
-    if (!reps) continue
-    const restIdx = func.rest ? func.sig.params.length - 1 : -1
-    for (const [k, r] of reps) {
-      const ctor = r.typedCtor
-      if (ctor == null) continue
-      if (k === restIdx) continue
-      if (k >= func.sig.params.length) continue
-      const p = func.sig.params[k]
-      if (p.type === 'i32') continue
-      if (func.defaults?.[p.name] != null) continue
-      const aux = typedElemAux(ctor)
-      if (aux == null) continue
-      p.type = 'i32'
-      p.ptrKind = VAL.TYPED
-      p.ptrAux = aux
-    }
-  }
-
-  // H: Post-F/G re-fixpoint — propagates VAL kinds through bimorphic call sites
-  // where ptrKind narrowed but ptrAux disagreed (e.g. `sum(f64arr)` and `sum(i32arr)`
-  // → both VAL.TYPED, different ctors). Without this, callerValTypes carries no entry
-  // for caller's params, so inferArgType returns null and paramReps[callee][k].val is
-  // sticky null. With ptrKind enriching callerValTypes, sum's arr gets val=TYPED in
-  // its rep, letting array.js skip __is_str_key + __str_idx dispatch on `arr[i]`.
-  for (const func of ctx.func.list) {
-    if (!func.body || func.raw) continue
-    const entry = callerCtx.get(func)
-    if (!entry) continue
-    for (const p of func.sig.params) {
-      if (p.ptrKind == null) continue
-      if (entry.callerValTypes.has(p.name)) continue
-      entry.callerValTypes.set(p.name, p.ptrKind)
-    }
-  }
-  clearStickyNull(paramReps, 'val')
-  runFixpoint()
-
-  // I: Post-E re-narrow of numeric (i32) params. The first numeric narrowing pass
-  // ran before E narrowed any result types, so callerLocals saw `let h = mix(...)`
-  // as f64 (mix's result was f64 then). After E narrowed mix's result to i32,
-  // exprType (which now consults func.sig.results for user calls) sees `h` as i32.
-  // Refresh callerLocals + clear sticky-null wasm + re-run fixpoint + re-apply
-  // numeric narrowing to propagate i32 through chains of i32-only helpers
-  // (callback bench: mix is FNV — params and result all i32-shaped, but inferred
-  // only after E phase narrowed mix's result).
-  for (const func of ctx.func.list) {
-    if (!func.body || func.raw) continue
-    invalidateLocalsCache(func.body)
-    const fresh = analyzeLocals(func.body)
-    for (const p of func.sig.params) if (!fresh.has(p.name)) fresh.set(p.name, p.type)
-    callerCtx.get(func).callerLocals = fresh
-  }
-  // Reset wasm field unconditionally — first pass populated it from stale callerLocals
-  // (where `let h = mix(...)` widened h to f64 because mix's result wasn't narrowed
-  // yet). clearStickyNull only resets null; here we need to reset f64-observed too
-  // so the refreshed exprType view propagates.
-  for (const m of paramReps.values()) for (const r of m.values()) r.wasm = undefined
-  runFixpoint()
-  for (const func of ctx.func.list) {
-    if (func.raw || valueUsed.has(func.name)) continue
-    const reps = paramReps.get(func.name)
-    if (!reps) continue
-    const restIdx = func.rest ? func.sig.params.length - 1 : -1
-    for (const [k, r] of reps) {
-      if (r.wasm !== 'i32' || k === restIdx) continue
-      if (k >= func.sig.params.length) continue
-      const p = func.sig.params[k]
-      if (p.type === 'i32') continue                  // already narrowed (incl. ptr-ABI)
-      if (func.defaults?.[p.name] != null) continue
-      // Don't steal typed-array params from specializeBimorphicTyped: F phase parks
-      // bimorphic typed params at type='f64' with sticky-null typedCtor (two distinct
-      // ctors at call sites). Their callers post-F pass them as i32 (pointer ABI),
-      // so r.wasm flips to 'i32' here — but narrowing now breaks the clone path
-      // that still needs to mint per-ctor sigs with ptrKind=TYPED, ptrAux=ctor-aux.
-      if (r.val === VAL.TYPED) continue
-      p.type = 'i32'
-    }
+const findFuncBodyStart = (fn) => {
+  for (let i = 2; i < fn.length; i++) {
+    const n = fn[i]
+    if (Array.isArray(n) && (n[0] === 'param' || n[0] === 'result' || n[0] === 'local' || n[0] === 'export')) continue
+    return i
   }
+  return fn.length
 }
 
-/**
- * Phase: bimorphic typed-array param specialization.
- *
- * For each non-exported user function with a typed-array param that F/G-phase
- * left bimorphic (paramReps[name][k].typedCtor === null because two or more call sites
- * disagreed on the elem-ctor — e.g. `sum(f64)` and `sum(i32)`), clone the
- * function once per concrete ctor seen at the call sites, narrow each clone's
- * sig.params[k] to a monomorphic typed pointer ABI (type='i32', ptrKind=TYPED,
- * ptrAux=ctor's aux), and rewrite the call AST nodes to dispatch to the right
- * clone. The original survives as a fallback for any non-static call sites
- * (e.g. inside arrow bodies); treeshake removes it if every site got rewritten.
- *
- * Why this matters: without specialization, `arr[i]` inside `sum` falls into
- * the runtime `__typed_idx` path on every iteration — V8 can't inline a wasm
- * call dominated by a switch on elem type. After specialization, each clone's
- * `arr[i]` lowers to a direct `f64.load` (or `i32.load + f64.convert`) with
- * the elem-ctor known at compile time. On poly bench this is the difference
- * between ~5 ms and matching AS at ~1 ms.
- *
- * Safety mirrors G-phase: skip exported, raw, value-used, defaulted, rest, or
- * already-i32 params. Bounded by MAX_CLONES_PER_FN to guard against polymorphic
- * blow-up (≥5 distinct ctors at one site → no specialization).
- */
-function specializeBimorphicTyped(programFacts) {
-  const { callSites, valueUsed, paramReps } = programFacts
-  const MAX_CLONES_PER_FN = 4
-
-  // Per-callee static-call-site index. Built once; cheap.
-  const sitesByCallee = new Map()
-  for (const cs of callSites) {
-    const list = sitesByCallee.get(cs.callee)
-    if (list) list.push(cs); else sitesByCallee.set(cs.callee, [cs])
-  }
-
-  // Per-caller typedElem map (literal `new TypedArray(N)` bindings inside body).
-  const callerTypedCtx = new Map()
-  callerTypedCtx.set(null, ctx.scope.globalTypedElem || new Map())
-  for (const func of ctx.func.list) {
-    if (!func.body || func.raw) continue
-    callerTypedCtx.set(func, analyzeBody(func.body).typedElems)
-  }
-  // Per-caller typed-param map: caller's own params that F/G already narrowed
-  // (so transitive `sum(arr)` inside a func that took `arr` from above resolves).
-  const callerTypedParamsCtx = new Map()
-  for (const func of ctx.func.list) {
-    const m = callerParamFactMap(paramReps, func, 'typedCtor') || null
-    let acc = m
-    if (func.sig?.params) for (const p of func.sig.params) {
-      if (p.ptrKind === VAL.TYPED && p.ptrAux != null) {
-        acc ||= new Map()
-        if (!acc.has(p.name)) acc.set(p.name, ctorFromElemAux(p.ptrAux))
-      }
-    }
-    if (acc) callerTypedParamsCtx.set(func, acc)
-  }
-
-  // Snapshot ctx.func.list — we'll be appending clones during the loop.
-  const originals = ctx.func.list.slice()
-  for (const func of originals) {
-    if (func.exported || func.raw || valueUsed.has(func.name)) continue
-    if (!func.body) continue
-    if (func.rest) continue
-    const reps = paramReps.get(func.name)
-    if (!reps) continue
-    const sites = sitesByCallee.get(func.name)
-    if (!sites || sites.length < 2) continue
-
-    // Find sticky-bimorphic typed-param positions left by F-phase.
-    const bimorphic = []
-    for (let k = 0; k < func.sig.params.length; k++) {
-      if (reps.get(k)?.typedCtor !== null) continue
-      const p = func.sig.params[k]
-      if (p.type === 'i32') continue
-      if (func.defaults?.[p.name] != null) continue
-      bimorphic.push(k)
-    }
-    if (bimorphic.length === 0) continue
-
-    // For each site, infer the ctor combination across bimorphic positions.
-    // Abort if any site has unknown ctor at any bimorphic position — we can't
-    // route that call to a specific clone without it.
-    const siteCombos = []
-    let abort = false
-    for (const site of sites) {
-      const callerTypedElems = callerTypedCtx.get(site.callerFunc)
-      const callerTypedParams = callerTypedParamsCtx.get(site.callerFunc)
-      const combo = []
-      for (const k of bimorphic) {
-        if (k >= site.argList.length) { abort = true; break }
-        const c = inferArgTypedCtor(site.argList[k], callerTypedElems, callerTypedParams)
-        if (c == null || typedElemAux(c) == null) { abort = true; break }
-        combo.push(c)
-      }
-      if (abort) break
-      siteCombos.push(combo)
-    }
-    if (abort) continue
-
-    // Distinct combos seen across call sites.
-    const distinct = new Map()
-    for (const combo of siteCombos) {
-      const key = combo.join('|')
-      if (!distinct.has(key)) distinct.set(key, combo)
-    }
-    if (distinct.size < 2) continue          // F-phase already mono — nothing to do
-    if (distinct.size > MAX_CLONES_PER_FN) continue  // polymorphic blow-up
-
-    // Build one clone per distinct combo.
-    const cloneByKey = new Map()
-    for (const [key, combo] of distinct) {
-      const suffix = combo.map(c => c.replace(/^new\./, '').replace(/\./g, '_')).join('$')
-      let cloneName = `${func.name}$${suffix}`
-      let n = 0
-      while (ctx.func.names.has(cloneName)) cloneName = `${func.name}$${suffix}$${++n}`
-
-      const cloneSig = {
-        ...func.sig,
-        params: func.sig.params.map(p => ({ ...p })),
-        results: [...func.sig.results],
-      }
-      for (let i = 0; i < bimorphic.length; i++) {
-        const k = bimorphic[i]
-        const aux = typedElemAux(combo[i])
-        const p = cloneSig.params[k]
-        p.type = 'i32'
-        p.ptrKind = VAL.TYPED
-        p.ptrAux = aux
-      }
-      const clone = { ...func, name: cloneName, sig: cloneSig }
-      ctx.func.list.push(clone)
-      ctx.func.map.set(cloneName, clone)
-      ctx.func.names.add(cloneName)
-
-      // Mirror per-param reps under the clone's name with mono ctors at bimorphic
-      // positions. emitFunc's preseed reads typedCtor → seeds typedElem map →
-      // `arr[i]` lowers to direct typed load.
-      const cloneReps = new Map()
-      for (const [k, r] of reps) cloneReps.set(k, { ...r })
-      for (let i = 0; i < bimorphic.length; i++) {
-        const k = bimorphic[i]
-        const r = cloneReps.get(k) || {}
-        r.typedCtor = combo[i]
-        r.val = VAL.TYPED
-        cloneReps.set(k, r)
+const heapGetIR = () => ctx.memory.shared
+  ? ['i32.load', ['i32.const', 1020]]
+  : ['global.get', '$__heap']
+
+const heapSetIR = value => ctx.memory.shared
+  ? ['i32.store', ['i32.const', 1020], value]
+  : ['global.set', '$__heap', value]
+
+function applyArenaRewind(func, fn, safeCallees) {
+  if (ctx.transform.optimize?.arenaRewind === false) return false
+  if (func.raw || func.sig.params.length !== 0 || func.sig.results.length !== 1) return false
+  if (func.sig.ptrKind != null) return false
+  if (func.sig.results[0] === 'f64' && func.valResult !== VAL.NUMBER) return false
+  if (func.sig.results[0] !== 'f64' && func.sig.results[0] !== 'i32') return false
+
+  const bodyStart = findFuncBodyStart(fn)
+  let hasAlloc = false
+  let unsafe = false
+  const scan = node => {
+    if (unsafe || !Array.isArray(node)) return
+    const op = node[0]
+    if (op === 'global.set' || op === 'return_call' || op === 'call_indirect' || op === 'call_ref') {
+      unsafe = true
+      return
+    }
+    if (op === 'call') {
+      const name = node[1]
+      if (name === '$__alloc' || name === '$__alloc_hdr') hasAlloc = true
+      if (!(safeCallees ?? ARENA_SAFE_CALLS).has(name)) {
+        unsafe = true
+        return
       }
-      paramReps.set(cloneName, cloneReps)
-
-      cloneByKey.set(key, clone)
-    }
-
-    // Rewrite each site's call AST to point at the matching clone.
-    for (let i = 0; i < sites.length; i++) {
-      const clone = cloneByKey.get(siteCombos[i].join('|'))
-      sites[i].node[1] = clone.name
     }
-  }
+    for (let i = 1; i < node.length; i++) scan(node[i])
+  }
+  for (let i = bodyStart; i < fn.length; i++) scan(fn[i])
+  if (unsafe || !hasAlloc) return false
+
+  let id = 0
+  const hasLocal = name => fn.some(n => Array.isArray(n) && n[0] === 'local' && n[1] === name)
+  while (hasLocal(`$${T}heap_save${id}`) || hasLocal(`$${T}arena_ret${id}`)) id++
+  const save = `$${T}heap_save${id}`
+  const ret = `$${T}arena_ret${id}`
+  const restore = () => heapSetIR(['local.get', save])
+  const resultType = func.sig.results[0]
+
+  const rewriteReturns = node => {
+    if (!Array.isArray(node)) return node
+    if (node[0] === 'return' && node.length > 1) {
+      return ['block',
+        ['result', resultType],
+        ['local.set', ret, node[1]],
+        restore(),
+        ['return', ['local.get', ret]],
+        ['unreachable']]
+    }
+    for (let i = 1; i < node.length; i++) node[i] = rewriteReturns(node[i])
+    return node
+  }
+
+  const endsWithReturn = fn.at(-1)?.[0] === 'return' || fn.at(-1)?.[0] === 'return_call'
+  for (let i = bodyStart; i < fn.length; i++) fn[i] = rewriteReturns(fn[i])
+  const newBodyStart = findFuncBodyStart(fn)
+  fn.splice(newBodyStart, 0,
+    ['local', save, 'i32'],
+    ['local', ret, resultType],
+    ['local.set', save, heapGetIR()])
+  if (!endsWithReturn) {
+    const last = fn.pop()
+    fn.push(['local.set', ret, last], restore(), ['local.get', ret])
+  }
+  return true
 }
 
-/**
- * Phase: refine ctx.types.anyDynKey using post-narrowSignatures type info.
- *
- * collectProgramFacts conservatively flags `anyDynKey=true` whenever it sees
- * `obj[idx]` with a non-literal-string index — but typed-array / array /
- * string `[]` is element access (sound for that base type), not a true
- * dyn-key lookup that needs the hash-table shadow on object literals.
- *
- * After narrowSignatures populates paramReps (call-site fixpoint), we can
- * type each `obj` in `obj[idx]` and skip the ones that are provably non-object.
- * If no genuine dyn-key access remains program-wide, drop anyDynKey to false
- * — object literals then skip the __dyn_set shadow loop (large code + perf win,
- * especially on hot allocators like aos.initRows).
- *
- * Live-function gate: walking dead funcs (e.g. unused benchlib helpers) would
- * pollute analysis with `out` params we never narrowed. Restrict to functions
- * reachable from exports / first-class value uses.
- */
-const NON_DYN_VTS = new Set([VAL.TYPED, VAL.ARRAY, VAL.STRING, VAL.BUFFER])
-const TYPED_ARRAY_CTOR = /^(Float|Int|Uint|BigInt|BigUint)(8|16|32|64)(Clamped)?Array$/
-
-function refineDynKeys(programFacts) {
-  if (!ctx.types.anyDynKey) return
-  const { paramReps, valueUsed } = programFacts
-  const isLitStr = idx => Array.isArray(idx) && idx[0] === 'str' && typeof idx[1] === 'string'
-
-  // Per-function type map: param vtypes from paramReps, plus locals
-  // we can prove are typed arrays from `let v = new TypedArray(...)`. After
-  // prepare, that node is `['()', 'new.Float64Array', ...args]`.
-  const buildTypeMap = (funcName, body, params) => {
-    const map = new Map()
-    if (params) {
-      const reps = paramReps.get(funcName)
-      if (reps) for (let i = 0; i < params.length; i++) {
-        const t = reps.get(i)?.val
-        if (t != null) map.set(params[i].name, t)
-      }
-    }
-    const walk = (node) => {
-      if (!Array.isArray(node)) return
-      const op = node[0]
-      if (op === 'let' || op === 'const') {
-        for (let i = 1; i < node.length; i++) {
-          const d = node[i]
-          if (!Array.isArray(d) || d[0] !== '=' || typeof d[1] !== 'string') continue
-          const init = d[2]
-          let ctor = null
-          if (Array.isArray(init) && init[0] === '()' && typeof init[1] === 'string' && init[1].startsWith('new.'))
-            ctor = init[1].slice(4)
-          if (ctor && TYPED_ARRAY_CTOR.test(ctor)) map.set(d[1], VAL.TYPED)
-          else if (typeof init === 'string' && map.has(init)) map.set(d[1], map.get(init))
-        }
-      }
-      if (op === '=>') return  // don't cross into nested arrows; they're separate funcs
-      for (let i = 1; i < node.length; i++) walk(node[i])
-    }
-    walk(body)
-    return map
-  }
-
-  let real = false
-  const visit = (typeMap, node) => {
-    if (real || !Array.isArray(node)) return
-    const op = node[0]
-    if (op === '[]') {
-      const idx = node[2]
-      if (!isLitStr(idx)) {
-        const obj = node[1]
-        const vt = typeof obj === 'string' ? typeMap.get(obj) : null
-        if (!NON_DYN_VTS.has(vt)) real = true
-      }
-    } else if (op === 'for-in') real = true
-    if (op === '=>') return
-    for (let i = 1; i < node.length; i++) visit(typeMap, node[i])
-  }
-
-  // Live: anything reachable from exports/first-class value uses. Skipping
-  // dead helpers (unused benchlib imports) keeps their generic params from
-  // pretending to be dyn-key access.
-  const isLive = f => f.exported || paramReps.has(f.name) || (valueUsed && valueUsed.has(f.name))
+// === Module compilation ===
 
-  const topMap = buildTypeMap(null, null, null)
-  for (const f of ctx.func.list) {
-    if (real) break
-    if (!f.body || !isLive(f)) continue
-    visit(buildTypeMap(f.name, f.body, f.sig?.params), f.body)
-  }
-  if (!real && ctx.module.moduleInits) for (const mi of ctx.module.moduleInits) {
-    if (real) break
-    visit(topMap, mi)
-  }
+const cloneRepMap = map => map ? new Map([...map].map(([k, v]) => [k, { ...v }])) : null
 
-  if (!real) ctx.types.anyDynKey = false
+function enterFunc(func) {
+  ctx.func.stack = []
+  ctx.func.uniq = 0
+  ctx.func.current = func.sig
+  ctx.func.body = func.body
+  ctx.func.directClosures = null
+  ctx.func.localProps = null
 }
 
-/**
- * Phase: emit one user function to WAT IR.
- *
- * Reads the (already-narrowed) `func.sig` and `programFacts.paramReps[name]`
- * to seed per-param val reps / schema bindings; emits body via emit / emitBody.
- *
- * Mutates ctx.func.* per-function state (locals, boxed, repByLocal, …) and
- * ctx.schema.vars (restored on exit so bindings don't leak across functions).
- */
-function emitFunc(func, programFacts) {
+function analyzeFuncForEmit(func, programFacts) {
   const { paramReps } = programFacts
+  if (func.raw) return null
 
-  // Raw WAT functions (e.g., _alloc, _reset from memory module)
-  if (func.raw) return parseWat(func.raw)
+  const { name, body, sig } = func
+  enterFunc(func)
 
-  const { name, body, exported, sig } = func
-  const multi = sig.results.length > 1
-
-  // Reset per-function state
-  ctx.func.stack = []
-  ctx.func.uniq = 0
-  ctx.func.current = sig
-  ctx.func.body = body
-  ctx.func.directClosures = null
-
-  // Pre-analyze local types from body
-  // Block body vs object literal: object has ':' property nodes
   const block = Array.isArray(body) && body[0] === '{}' && body[1]?.[0] !== ':'
-  ctx.func.boxed = new Map()  // variable name → cell local name (i32) for mutable capture
-  ctx.func.localProps = null  // reset per function
-  ctx.func.repByLocal = null  // Map<name, ValueRep> — populated lazily; reset per function
+  ctx.func.boxed = new Map()
+  ctx.func.repByLocal = null
   ctx.types.typedElem = ctx.scope.globalTypedElem ? new Map(ctx.scope.globalTypedElem) : null
-  // Pre-seed cross-call param facts BEFORE analyzeLocals/analyzeValTypes(body) so that
-  // when the walker sees `const b0 = arr[i]` or `let n = arr.length`, lookupValType(arr)
-  // already resolves to VAL.TYPED — letting valTypeOf's `[]` rule propagate VAL.NUMBER
-  // to b0 (skips __to_num) and exprType's `.length` rule keep n as i32 (skips per-iter
-  // f64.convert_i32_s + i32.trunc_sat_f64_s on the loop counter). Without this seed,
-  // params don't gain VAL.TYPED until after analyzeLocals freezes counter widths.
+
   const _reps = paramReps.get(name)
   if (_reps) {
     for (const [k, r] of _reps) {
@@ -1089,20 +280,39 @@ function emitFunc(func, programFacts) {
   // cached widths reflect the pre-narrow state. Re-walk now with reps in place.
   invalidateLocalsCache(body)
   ctx.func.locals = block ? analyzeLocals(body) : new Map()
+  // Usage-based VAL.STRING inference for params not already typed by paramReps.
+  // Descends into nested closures so a param used as STRING only inside an inner
+  // arrow (e.g. parseLevel's `str` capture in watr) still gets seeded — the
+  // closure capture path then propagates VAL.STRING via captureValTypes.
+  if (block) {
+    const candidates = sig.params
+      .filter(p => !ctx.func.repByLocal?.get(p.name)?.val)
+      .map(p => p.name)
+    if (candidates.length) {
+      const inferred = inferStringParams(body, candidates)
+      for (const [n, vt] of inferred) updateRep(n, { val: vt })
+    }
+  }
   if (block) {
     analyzeValTypes(body)
     analyzeIntCertain(body)
     analyzeBoxedCaptures(body)
     // Lower provably-monomorphic pointer locals to i32 offset storage.
+    // VAL.TYPED unbox requires a known element ctor (aux byte) — without it,
+    // the use site can't pick the right i32.store{8,16}/i32.store width and
+    // the rebox path can't reconstruct the NaN-box. Heterogeneous decls (two
+    // `let arr = ...` with different ctors, or a multi-ctor ternary) leave
+    // typedElem unset; skip unbox so reads/writes go through `__typed_set_idx`.
     const unbox = analyzePtrUnboxable(body, ctx.func.locals, ctx.func.boxed)
     if (unbox.size > 0) {
       for (const [n, kind] of unbox) {
-        ctx.func.locals.set(n, 'i32')
         const fields = { ptrKind: kind }
         if (kind === VAL.TYPED) {
           const aux = typedElemAux(ctx.types.typedElem?.get(n))
-          if (aux != null) fields.ptrAux = aux
+          if (aux == null) continue
+          fields.ptrAux = aux
         }
+        ctx.func.locals.set(n, 'i32')
         updateRep(n, fields)
       }
     }
@@ -1117,6 +327,39 @@ function emitFunc(func, programFacts) {
     if (p.ptrAux != null) fields.ptrAux = p.ptrAux
     updateRep(p.name, fields)
   }
+
+  return {
+    block,
+    locals: new Map(ctx.func.locals),
+    boxed: new Map(ctx.func.boxed),
+    typedElem: ctx.types.typedElem ? new Map(ctx.types.typedElem) : null,
+    repByLocal: cloneRepMap(ctx.func.repByLocal),
+  }
+}
+
+/**
+ * Phase: emit one user function to WAT IR.
+ *
+ * Reads precomputed `funcFacts` and the narrowed `func.sig`; applies scoped
+ * schema param bindings during emission so they cannot leak between functions.
+ */
+function emitFunc(func, funcFacts, programFacts) {
+  const { paramReps } = programFacts
+
+  // Raw WAT functions (e.g., _alloc, _clear from memory module)
+  if (func.raw) return parseWat(func.raw)
+
+  const { name, body, exported, sig } = func
+  const multi = sig.results.length > 1
+  const _reps = paramReps.get(name)
+
+  enterFunc(func)
+  const block = funcFacts.block
+  ctx.func.locals = new Map(funcFacts.locals)
+  ctx.func.boxed = new Map(funcFacts.boxed)
+  ctx.func.repByLocal = cloneRepMap(funcFacts.repByLocal)
+  ctx.types.typedElem = funcFacts.typedElem ? new Map(funcFacts.typedElem) : null
+
   // D: Apply call-site param facts (only if body analysis didn't already set them).
   // Schema bindings additionally write into ctx.schema.vars so prop-access dispatch
   // hits the slot map. ctx.schema.vars is saved/restored so bindings don't leak.
@@ -1145,24 +388,28 @@ function emitFunc(func, programFacts) {
   fn.push(...sig.params.map(p => ['param', `$${p.name}`, p.type]))
   fn.push(...sig.results.map(t => ['result', t]))
 
-  // Default params: missing JS args become canonical NaN (0x7FF8000000000000) in WASM f64 params.
-  // Check for canonical NaN specifically — NaN-boxed pointers are also NaN but have non-zero payload.
+  // Default params: ES spec says default applies only when arg is `undefined`
+  // (or missing). `null`, `0`, `false`, etc. all skip the default.
   const defaults = func.defaults || {}
   const defaultInits = []
   for (const [pname, defVal] of Object.entries(defaults)) {
     const p = sig.params.find(p => p.name === pname)
     const t = p?.type || 'f64'
     defaultInits.push(
-      ['if', isNullish(typed(['local.get', `$${pname}`], 'f64')),
+      ['if', isUndef(typed(['local.get', `$${pname}`], 'f64')),
         ['then', ['local.set', `$${pname}`, t === 'f64' ? asF64(emit(defVal)) : asI32(emit(defVal))]]])
   }
 
   // Box params that are mutably captured: allocate cell, copy param value
   const boxedParamInits = []
+  const preboxedLocalInits = []
+  ctx.func.preboxed = new Set()
+  const paramNames = new Set(sig.params.map(p => p.name))
   for (const p of sig.params) {
     if (ctx.func.boxed.has(p.name)) {
       const cell = ctx.func.boxed.get(p.name)
       ctx.func.locals.set(cell, 'i32')
+      ctx.func.preboxed.add(p.name)
       const lget = typed(['local.get', `$${p.name}`], p.type)
       if (p.ptrKind != null) lget.ptrKind = p.ptrKind
       boxedParamInits.push(
@@ -1170,6 +417,14 @@ function emitFunc(func, programFacts) {
         ['f64.store', ['local.get', `$${cell}`], asF64(lget)])
     }
   }
+  for (const [name, cell] of ctx.func.boxed) {
+    if (paramNames.has(name)) continue
+    ctx.func.locals.set(cell, 'i32')
+    ctx.func.preboxed.add(name)
+    preboxedLocalInits.push(
+      ['local.set', `$${cell}`, ['call', '$__alloc', ['i32.const', 8]]],
+      ['f64.store', ['local.get', `$${cell}`], nullExpr()])
+  }
 
   if (block) {
     const stmts = emitBody(body)
@@ -1177,16 +432,16 @@ function emitFunc(func, programFacts) {
     // I: Skip trailing fallback when last statement is return (unreachable code)
     const lastStmt = stmts.at(-1)
     const endsWithReturn = lastStmt && (lastStmt[0] === 'return' || lastStmt[0] === 'return_call')
-    fn.push(...defaultInits, ...boxedParamInits, ...stmts, ...(endsWithReturn ? [] : sig.results.map(t => [`${t}.const`, 0])))
+    fn.push(...defaultInits, ...boxedParamInits, ...preboxedLocalInits, ...stmts, ...(endsWithReturn ? [] : sig.results.map(t => [`${t}.const`, 0])))
   } else if (multi && body[0] === '[') {
     const values = body.slice(1).map(e => asF64(emit(e)))
     for (const [l, t] of ctx.func.locals) fn.push(['local', `$${l}`, t])
-    fn.push(...boxedParamInits, ...values)
+    fn.push(...boxedParamInits, ...preboxedLocalInits, ...values)
   } else {
     const ir = emit(body)
     for (const [l, t] of ctx.func.locals) fn.push(['local', `$${l}`, t])
     const finalIR = sig.ptrKind != null ? asPtrOffset(ir, sig.ptrKind) : asParamType(ir, sig.results[0])
-    fn.push(...defaultInits, ...boxedParamInits, tcoTailRewrite(finalIR, sig.results[0]))
+    fn.push(...defaultInits, ...boxedParamInits, ...preboxedLocalInits, tcoTailRewrite(finalIR, sig.results[0]))
   }
 
   // Restore schema.vars so param bindings don't leak to next function.
@@ -1199,18 +454,22 @@ function emitFunc(func, programFacts) {
  *
  * For each `isBoundaryWrapped(func)`, emit a sibling `$${name}$exp` that:
  *   - holds the (export "name") attribute (JS sees the wrapper)
- *   - takes f64 params always (JS calling convention via host.js wrap)
+ *   - takes i64 params always — JS-side carrier is BigInt that reinterprets to
+ *     f64 NaN-box bits. i64 dodges V8's spec-permitted NaN canonicalization at
+ *     the wasm↔JS boundary (see ToJSValue / ToWebAssemblyValue). Host wrap()
+ *     in src/host.js pairs by converting BigInt↔f64 via reinterpret bits.
  *   - converts each narrowed param at the call: f64 → i32 (truncate-sat) for
  *     numeric narrowed, f64 → i32-offset (`i32.wrap_i64 + i64.reinterpret_f64`)
- *     for pointer narrowed
+ *     for pointer narrowed. The reinterpret happens once at param decode and
+ *     once at result encode; numeric exports without narrowing skip wrapping
+ *     entirely (no NaN-class values).
  *   - forwards args to the inner $${name}
- *   - reboxes the narrowed result back to f64 so JS sees Number / NaN-boxed ptr
+ *   - reboxes the narrowed result and reinterprets to i64 for the boundary
  *
- * Param convert cases (each narrowed inner-param):
- *   - p.type = 'i32', no ptrKind  → i32.trunc_sat_f64_s(local.get $p)
- *   - p.type = 'i32', ptrKind set → i32.wrap_i64(i64.reinterpret_f64(local.get $p))
+ * Param decode (i64 → f64): each param gets `f64.reinterpret_i64` before the
+ * existing narrowing convert. f64 inner params just need the reinterpret.
  *
- * Result rebox cases:
+ * Result rebox cases (then reinterpret to i64 at the boundary):
  *   - sig.ptrKind != null  → mkPtrIR(ptrKind, ptrAux ?? 0, callIR)
  *   - sig.results[0] = i32 → f64.convert_i32_s(callIR)
  *   - sig.results[0] = f64 → callIR (some params narrowed but result stayed f64)
@@ -1220,18 +479,23 @@ function synthesizeBoundaryWrappers() {
   for (const func of ctx.func.list) {
     if (!isBoundaryWrapped(func)) continue
     const { name, sig } = func
+    // Per-position i64 carrier: only swap to i64 where a NaN-boxed pointer
+    // actually crosses the boundary (param.ptrKind set, or result with
+    // sig.ptrKind set). Numeric narrowing (i32 trunc-sat / convert) keeps f64
+    // so callers seeing the raw export get a plain Number for numerics.
+    const paramI64 = sig.params.map(p => p.ptrKind != null)
+    const resultI64 = sig.ptrKind != null
     const wrapNode = ['func', `$${name}$exp`, ['export', `"${name}"`]]
-    // External ABI: every param is f64 (JS Number / NaN-boxed ptr).
-    for (const p of sig.params) wrapNode.push(['param', `$${p.name}`, 'f64'])
-    wrapNode.push(['result', 'f64'])
-    const args = sig.params.map(p => {
+    sig.params.forEach((p, i) => wrapNode.push(['param', `$${p.name}`, paramI64[i] ? 'i64' : 'f64']))
+    wrapNode.push(['result', resultI64 ? 'i64' : 'f64'])
+    const args = sig.params.map((p, i) => {
       const get = ['local.get', `$${p.name}`]
-      if (p.type === 'f64') return get
       if (p.ptrKind != null) {
-        // NaN-boxed f64 → raw i32 offset
-        return ['i32.wrap_i64', ['i64.reinterpret_f64', get]]
+        // ptrKind: i64 carrier carries NaN-box bits → wrap to i32 offset
+        return ['i32.wrap_i64', get]
       }
-      // Numeric i32 — JS Number → i32 truncation (matches `n | 0` for integers).
+      if (p.type === 'f64') return get
+      // Numeric narrowing: f64 → i32 truncate
       return ['i32.trunc_sat_f64_s', get]
     })
     const callIR = ['call', `$${name}`, ...args]
@@ -1244,7 +508,9 @@ function synthesizeBoundaryWrappers() {
     } else {
       body = callIR
     }
-    wrapNode.push(body)
+    wrapNode.push(resultI64 ? ['i64.reinterpret_f64', body] : body)
+    func._exportUsesI64 = resultI64 || paramI64.some(Boolean)
+    func._exportI64Sig = { params: paramI64, result: resultI64 }
     wrappers.push(wrapNode)
   }
   return wrappers
@@ -1268,6 +534,7 @@ function emitClosureBody(cb) {
   // Reset per-function state for closure body
   ctx.func.locals = new Map()
   ctx.func.repByLocal = null
+  if (cb.intConsts) for (const [name, v] of cb.intConsts) updateRep(name, { intConst: v })
   if (cb.valTypes) for (const [name, vt] of cb.valTypes) updateRep(name, { val: vt })
   if (cb.schemaVars) {
     ctx.schema.vars = new Map([...prevSchemaVars, ...cb.schemaVars])
@@ -1283,6 +550,8 @@ function emitClosureBody(cb) {
   }
   // In closure bodies, boxed captures use the original name as both var and cell local
   ctx.func.boxed = cb.boxed ? new Map([...cb.boxed].map(v => [v, v])) : new Map()
+  const parentBoxedCaptures = new Set(cb.boxed || [])
+  ctx.func.preboxed = new Set()
   ctx.func.stack = []
   ctx.func.uniq = Math.max(ctx.func.uniq, 100) // avoid label collisions
   ctx.func.body = cb.body
@@ -1315,11 +584,35 @@ function emitClosureBody(cb) {
   const block = Array.isArray(cb.body) && cb.body[0] === '{}' && cb.body[1]?.[0] !== ':'
   let bodyIR
   if (block) {
+    invalidateLocalsCache(cb.body)
     for (const [k, v] of analyzeLocals(cb.body)) if (!ctx.func.locals.has(k)) ctx.func.locals.set(k, v)
+    // Usage-based STRING inference for closure params not seeded by captureValTypes.
+    // (Captures already have their parent's val type via cb.valTypes above.)
+    {
+      const candidates = cb.params.filter(p => !ctx.func.repByLocal?.get(p)?.val)
+      if (candidates.length) {
+        const inferred = inferStringParams(cb.body, candidates)
+        for (const [n, vt] of inferred) updateRep(n, { val: vt })
+      }
+    }
+    analyzeValTypes(cb.body)
+    analyzeIntCertain(cb.body)
     // Detect captures from deeper nested arrows that mutate this body's locals/params/captures
     analyzeBoxedCaptures(cb.body)
     for (const name of ctx.func.boxed.keys()) {
-      if (ctx.func.locals.get(name) === 'f64') ctx.func.locals.set(name, 'i32')
+      if (parentBoxedCaptures.has(name) && ctx.func.locals.get(name) === 'f64') ctx.func.locals.set(name, 'i32')
+    }
+    const unbox = analyzePtrUnboxable(cb.body, ctx.func.locals, ctx.func.boxed)
+    for (const [name, kind] of unbox) {
+      if (cb.params.includes(name) || cb.captures.includes(name)) continue
+      const fields = { ptrKind: kind }
+      if (kind === VAL.TYPED) {
+        const aux = typedElemAux(ctx.types.typedElem?.get(name))
+        if (aux == null) continue
+        fields.ptrAux = aux
+      }
+      ctx.func.locals.set(name, 'i32')
+      updateRep(name, fields)
     }
     bodyIR = emitBody(cb.body)
   } else {
@@ -1339,6 +632,28 @@ function emitClosureBody(cb) {
     inc('__alloc_hdr', '__mkptr')
   }
 
+  const boxedCaptureNames = new Set(cb.captures.filter(name => parentBoxedCaptures.has(name)))
+  for (const name of boxedCaptureNames) ctx.func.preboxed.add(name)
+  const boxedValueCaptureNames = new Set(cb.captures.filter(name => ctx.func.boxed.has(name) && !parentBoxedCaptures.has(name)))
+  for (const name of boxedValueCaptureNames) {
+    ctx.func.locals.set(ctx.func.boxed.get(name), 'i32')
+    ctx.func.preboxed.add(name)
+  }
+  const boxedParamNames = new Set(cb.params.filter(name => ctx.func.boxed.has(name)))
+  for (const name of boxedParamNames) {
+    ctx.func.locals.set(ctx.func.boxed.get(name), 'i32')
+    ctx.func.preboxed.add(name)
+  }
+  const preboxedLocalInits = []
+  for (const [name, cell] of ctx.func.boxed) {
+    if (boxedCaptureNames.has(name) || boxedValueCaptureNames.has(name) || boxedParamNames.has(name)) continue
+    ctx.func.locals.set(cell, 'i32')
+    ctx.func.preboxed.add(name)
+    preboxedLocalInits.push(
+      ['local.set', `$${cell}`, ['call', '$__alloc', ['i32.const', 8]]],
+      ['f64.store', ['local.get', `$${cell}`], nullExpr()])
+  }
+
   // Insert locals (captures + params + declared)
   for (const [l, t] of ctx.func.locals) fn.push(['local', `$${l}`, t])
 
@@ -1351,8 +666,15 @@ function emitClosureBody(cb) {
     for (let i = 0; i < cb.captures.length; i++) {
       const name = cb.captures[i]
       const addr = ['i32.add', ['local.get', `$${envBase}`], ['i32.const', i * 8]]
-      fn.push(['local.set', `$${name}`,
-        ctx.func.boxed.has(name) ? ['i32.load', addr] : ['f64.load', addr]])
+      if (parentBoxedCaptures.has(name)) {
+        fn.push(['local.set', `$${name}`, ['i32.load', addr]])
+      } else if (boxedValueCaptureNames.has(name)) {
+        fn.push(
+          ['local.set', `$${ctx.func.boxed.get(name)}`, ['call', '$__alloc', ['i32.const', 8]]],
+          ['f64.store', boxedAddr(name), ['f64.load', addr]])
+      } else {
+        fn.push(['local.set', `$${name}`, ['f64.load', addr]])
+      }
     }
   }
 
@@ -1360,7 +682,14 @@ function emitClosureBody(cb) {
   // Rest name (if present) is last in cb.params — handled separately below.
   const fixedParamN = cb.params.length - (cb.rest ? 1 : 0)
   for (let i = 0; i < fixedParamN && i < W; i++) {
-    fn.push(['local.set', `$${cb.params[i]}`, ['local.get', `$__a${i}`]])
+    const pname = cb.params[i]
+    if (boxedParamNames.has(pname)) {
+      fn.push(
+        ['local.set', `$${ctx.func.boxed.get(pname)}`, ['call', '$__alloc', ['i32.const', 8]]],
+        ['f64.store', boxedAddr(pname), ['local.get', `$__a${i}`]])
+    } else {
+      fn.push(['local.set', `$${pname}`, ['local.get', `$__a${i}`]])
+    }
   }
 
   // Rest param: pack slots a[fixedParams..argc-1] into fresh array.
@@ -1386,20 +715,34 @@ function emitClosureBody(cb) {
           ['i32.add', ['local.get', `$${restOff}`], ['i32.const', i * 8]],
           ['local.get', `$__a${fixedN + i}`]]]])
     }
-    fn.push(['local.set', `$${cb.rest}`,
-      ['call', '$__mkptr', ['i32.const', PTR.ARRAY], ['i32.const', 0], ['local.get', `$${restOff}`]]])
+    const restValue = ['call', '$__mkptr', ['i32.const', PTR.ARRAY], ['i32.const', 0], ['local.get', `$${restOff}`]]
+    if (boxedParamNames.has(cb.rest)) {
+      fn.push(
+        ['local.set', `$${ctx.func.boxed.get(cb.rest)}`, ['call', '$__alloc', ['i32.const', 8]]],
+        ['f64.store', boxedAddr(cb.rest), restValue])
+    } else {
+      fn.push(['local.set', `$${cb.rest}`, restValue])
+    }
   }
 
   // Default params for closures (check sentinel after unpack)
+  // Only `undefined` triggers default per spec — `null`/`0`/`false` pass through.
   if (cb.defaults) {
     for (const [pname, defVal] of Object.entries(cb.defaults)) {
-      fn.push(['if', isNullish(['local.get', `$${pname}`]),
-        ['then', ['local.set', `$${pname}`, asF64(emit(defVal))]]])
+      if (boxedParamNames.has(pname)) {
+        fn.push(['if', isUndef(['f64.load', boxedAddr(pname)]),
+          ['then', ['f64.store', boxedAddr(pname), asF64(emit(defVal))]]])
+      } else {
+        fn.push(['if', isUndef(['local.get', `$${pname}`]),
+          ['then', ['local.set', `$${pname}`, asF64(emit(defVal))]]])
+      }
     }
   }
+  fn.push(...preboxedLocalInits)
   fn.push(...bodyIR)
   // I: Skip trailing fallback when last statement is return
-  if (block && !(bodyIR.at(-1)?.[0] === 'return' || bodyIR.at(-1)?.[0] === 'return_call')) fn.push(['f64.const', 0])
+  // Implicit fall-through return is `undefined` per JS spec, not 0.
+  if (block && !(bodyIR.at(-1)?.[0] === 'return' || bodyIR.at(-1)?.[0] === 'return_call')) fn.push(undefExpr())
   ctx.schema.vars = prevSchemaVars
   ctx.types.typedElem = prevTypedElems
   return fn
@@ -1452,9 +795,9 @@ function buildStartFn(ast, sec, closureFuncs, compilePendingClosures) {
     const bt = `${T}box`
     ctx.func.locals.set(bt, 'i32')
     for (const [name, { schemaId, schema }] of ctx.schema.autoBox) {
-      inc('__alloc', '__mkptr')
+      inc('__alloc_hdr', '__mkptr')
       boxInit.push(
-        ['local.set', `$${bt}`, ['call', '$__alloc', ['i32.const', schema.length * 8]]],
+        ['local.set', `$${bt}`, ['call', '$__alloc_hdr', ['i32.const', 0], ['i32.const', Math.max(1, schema.length)], ['i32.const', 8]]],
         ['f64.store', ['local.get', `$${bt}`],
           ctx.func.names.has(name) ? ['f64.const', 0] : ['global.get', `$${name}`]],
         ...schema.slice(1).map((_, i) =>
@@ -1472,7 +815,12 @@ function buildStartFn(ast, sec, closureFuncs, compilePendingClosures) {
   // __dyn_get (set transitively by resolveIncludes() later) are listed
   // explicitly here because the dep graph hasn't been expanded yet at
   // start-fn build time.
-  const needsSchemaTbl = ctx.schema.list.length && (
+  // __jp_obj registers schemas at runtime, so the table must be allocated
+  // (and __schema_next initialized) even with zero compile-time schemas.
+  // __jp pulls __jp_obj transitively via the include-graph but resolveIncludes
+  // runs after buildStartFn, so check the top-level __jp parser as a proxy.
+  const hasJpObj = ctx.core.includes.has('__jp_obj') || ctx.core.includes.has('__jp')
+  const needsSchemaTbl = (ctx.schema.list.length && (
     ctx.core.includes.has('__stringify') ||
     ctx.core.includes.has('__dyn_get') ||
     ctx.core.includes.has('__dyn_get_t') ||
@@ -1480,17 +828,24 @@ function buildStartFn(ast, sec, closureFuncs, compilePendingClosures) {
     ctx.core.includes.has('__dyn_get_any_t') ||
     ctx.core.includes.has('__dyn_get_expr') ||
     ctx.core.includes.has('__dyn_get_expr_t') ||
-    ctx.core.includes.has('__dyn_get_or'))
+    ctx.core.includes.has('__dyn_get_or'))) ||
+    hasJpObj
   if (needsSchemaTbl) {
     const nSchemas = ctx.schema.list.length
+    // Reserve trailing slots for runtime-registered schemas (used by JSON.parse
+    // shape caching). __schema_next tracks the first free runtime slot.
+    const runtimeReserve = hasJpObj ? 256 : 0
     const stbl = `${T}stbl`
     const sarr = `${T}sarr`
     ctx.func.locals.set(stbl, 'i32')
     ctx.func.locals.set(sarr, 'i32')
     inc('__alloc', '__alloc_hdr', '__mkptr')
     schemaInit.push(
-      ['local.set', `$${stbl}`, ['call', '$__alloc', ['i32.const', nSchemas * 8]]],
+      ['local.set', `$${stbl}`, ['call', '$__alloc', ['i32.const', (nSchemas + runtimeReserve) * 8]]],
       ['global.set', '$__schema_tbl', ['local.get', `$${stbl}`]])
+    if (runtimeReserve) {
+      schemaInit.push(['global.set', '$__schema_next', ['i32.const', nSchemas]])
+    }
     for (let s = 0; s < nSchemas; s++) {
       const keys = ctx.schema.list[s]
       const n = keys.length
@@ -1521,12 +876,15 @@ function buildStartFn(ast, sec, closureFuncs, compilePendingClosures) {
     for (const s of ctx.runtime.typeofStrs)
       typeofInit.push(['global.set', `$__tof_${s}`, emit(['str', s])])
   }
-  if (moduleInits.length || init?.length || boxInit.length || schemaInit.length || typeofInit.length || strPoolInit.length || ctx.features.timers) {
+  // WASI timer queue needs an init call in __start; JS-host mode delegates
+  // scheduling to the host so no init/loop is needed.
+  const wasiTimers = ctx.features.timers && ctx.transform.host === 'wasi'
+  if (moduleInits.length || init?.length || boxInit.length || schemaInit.length || typeofInit.length || strPoolInit.length || wasiTimers) {
     const initIR = normalizeIR(init)
     const startFn = ['func', '$__start']
     for (const [l, t] of ctx.func.locals) startFn.push(['local', `$${l}`, t])
     startFn.push(...strPoolInit, ...typeofInit, ...boxInit, ...schemaInit,
-      ...(ctx.features.timers ? [['call', '$__timer_init']] : []),
+      ...(wasiTimers ? [['call', '$__timer_init']] : []),
       ...moduleInits, ...initIR,
       ...(ctx.features.blockingTimers ? [['call', '$__timer_loop']] : []),
     )
@@ -1591,12 +949,21 @@ function dedupClosureBodies(closureFuncs, sec) {
     else { hashToName.set(key, name); keepSet.add(name) }
   }
   if (!redirect.size) return
-  ctx.closure.table = ctx.closure.table.map(n => redirect.get(n) || n)
+  // Remove duplicate declarations BEFORE rewriting references — otherwise redirectRefs
+  // renames the declaration itself and the filter can't find the original name.
   const kept = sec.funcs.filter(fn => {
     if (!Array.isArray(fn) || fn[0] !== 'func') return true
     const name = typeof fn[1] === 'string' && fn[1][0] === '$' ? fn[1].slice(1) : null
     return !name || !redirect.has(name)
   })
+  const redirectRefs = node => {
+    if (typeof node === 'string') return node[0] === '$' && redirect.has(node.slice(1)) ? `$${redirect.get(node.slice(1))}` : node
+    if (!Array.isArray(node)) return node
+    for (let i = 0; i < node.length; i++) node[i] = redirectRefs(node[i])
+    return node
+  }
+  for (const fn of kept) redirectRefs(fn)
+  ctx.closure.table = ctx.closure.table.map(n => redirect.get(n) || n)
   sec.funcs.length = 0
   sec.funcs.push(...kept)
 }
@@ -1622,8 +989,7 @@ function dedupClosureBodies(closureFuncs, sec) {
  *      Both `call` and `return_call` (tail call) sites are rewritten in the same walk.
  */
 function finalizeClosureTable(sec) {
-  if (!ctx.closure.table?.length) return
-  let indirectUsed = false
+  let indirectUsed = ctx.transform.host === 'wasi'
   const scan = (n) => {
     if (!Array.isArray(n) || indirectUsed) return
     if (n[0] === 'call_indirect') { indirectUsed = true; return }
@@ -1637,8 +1003,9 @@ function finalizeClosureTable(sec) {
   }
   // Keep table if call_indirect is used (closures, timer dispatch, etc.)
   if (indirectUsed) {
+    if (!ctx.closure.table) ctx.closure.table = []
     sec.table = [['table', ['export', '"__jz_table"'], ctx.closure.table.length, 'funcref']]
-    sec.elem = [['elem', ['i32.const', 0], 'func', ...ctx.closure.table.map(n => `$${n}`)]]
+    sec.elem = ctx.closure.table.length ? [['elem', ['i32.const', 0], 'func', ...ctx.closure.table.map(n => `$${n}`)]] : []
     return
   }
   sec.table = []
@@ -1702,7 +1069,7 @@ function finalizeClosureTable(sec) {
  *   1. resolveIncludes() — close the include set under stdlib dependencies.
  *   2. Emit memory section ONLY when some included helper uses memory ops
  *      (G optimization: pure scalar programs ship without memory + __heap).
- *      When memory is needed, the allocator (__alloc + __alloc_hdr + __reset)
+ *      When memory is needed, the allocator (__alloc + __alloc_hdr + __clear)
  *      is force-included since stdlib funcs may call into it.
  *   3. Pull external (host) stdlibs into sec.extStdlib (must precede normal
  *      imports in the module byte order).
@@ -1718,11 +1085,11 @@ function pullStdlib(sec) {
   const needsMemory = [...ctx.core.includes].some(n => ctx.core.stdlib[n] && MEM_OPS.test(ctx.core.stdlib[n]))
   if (!needsMemory) ctx.scope.globals.delete('__heap')
   if (needsMemory && ctx.module.modules.core) {
-    for (const fn of ['__alloc', '__alloc_hdr', '__reset']) if (!ctx.core.includes.has(fn)) ctx.core.includes.add(fn)
+    for (const fn of ['__alloc', '__alloc_hdr', '__clear']) if (!ctx.core.includes.has(fn)) ctx.core.includes.add(fn)
     const pages = ctx.memory.pages || 1
     if (ctx.memory.shared) sec.imports.push(['import', '"env"', '"memory"', ['memory', pages]])
     else sec.memory.push(['memory', ['export', '"memory"'], pages])
-    if (ctx.transform.runtimeExports !== false && ctx.core._allocRawFuncs)
+    if (ctx.transform.alloc !== false && ctx.core._allocRawFuncs)
       sec.funcs.push(...ctx.core._allocRawFuncs.map(s => parseWat(s)))
   }
 
@@ -1730,10 +1097,15 @@ function pullStdlib(sec) {
     const v = ctx.core.stdlib[name]
     return typeof v === 'function' ? v() : v
   }
+  // Track __ext_* names emitted to host imports. The cleanup below deletes them
+  // from ctx.core.includes (moved into sec.extStdlib instead), so any post-compile
+  // audit (e.g. host: 'wasi') needs to read this list rather than the includes set.
+  ctx.core.extImports ??= new Set()
   for (const name of Object.keys(ctx.core.stdlib)) {
     if (name.startsWith('__ext_') && ctx.core.includes.has(name)) {
       const parsed = parseWat(stdlibStr(name))
       sec.extStdlib.push(parsed[0] === "module" ? parsed[1] : parsed)
+      ctx.core.extImports.add(name)
       ctx.core.includes.delete(name)
     }
   }
@@ -1741,6 +1113,12 @@ function pullStdlib(sec) {
   sec.stdlib.push(...[...ctx.core.includes].map(n => parseWat(stdlibStr(n))))
 }
 
+function syncImports(sec) {
+  for (const imp of ctx.module.imports) {
+    if (!sec.imports.some(i => i[1] === imp[1] && i[2] === imp[2])) sec.imports.push(imp)
+  }
+}
+
 /**
  * Phase: whole-module + per-function optimization passes.
  *
@@ -1774,6 +1152,19 @@ function optimizeModule(sec) {
     ctx.runtime.strPool = poolRef.pool
   }
   for (const s of [...sec.funcs, ...sec.stdlib, ...sec.start]) optimizeFunc(s, cfg)
+  if (!cfg || cfg.arenaRewind !== false) {
+    const safeCallees = arenaRewindModule([...sec.funcs, ...sec.stdlib, ...sec.start])
+    // Build name → WAT IR map for user functions
+    const fnByName = new Map()
+    for (const fn of sec.funcs) {
+      if (Array.isArray(fn) && fn[0] === 'func' && typeof fn[1] === 'string')
+        fnByName.set(fn[1], fn)
+    }
+    for (const func of ctx.func.list) {
+      const fn = fnByName.get(`$${func.name}`)
+      if (fn) applyArenaRewind(func, fn, safeCallees)
+    }
+  }
   if (!cfg || cfg.hoistConstantPool !== false)
     hoistConstantPool([...sec.funcs, ...sec.stdlib, ...sec.start], (name, wat) => ctx.scope.globals.set(name, wat))
 
@@ -1781,8 +1172,10 @@ function optimizeModule(sec) {
   if (dataLen > 1024 && !ctx.memory.shared) {
     const heapBase = (dataLen + 7) & ~7
     ctx.scope.globals.set('__heap', `(global $__heap (mut i32) (i32.const ${heapBase}))`)
+    if (ctx.scope.globals.has('__heap_start'))
+      ctx.scope.globals.set('__heap_start', `(global $__heap_start (mut i32) (i32.const ${heapBase}))`)
     for (const s of sec.stdlib)
-      if (s[0] === 'func' && s[1] === '$__reset')
+      if (s[0] === 'func' && s[1] === '$__clear')
         for (let i = 2; i < s.length; i++)
           if (Array.isArray(s[i]) && s[i][0] === 'global.set' && Array.isArray(s[i][2]) && s[i][2][0] === 'i32.const')
             s[i][2][1] = `${heapBase}`
@@ -1812,12 +1205,14 @@ function stripStaticDataPrefix(sec) {
     for (const slotOff of ctx.runtime.staticPtrSlots) {
       if (slotOff < prefix) continue
       const bits = dv.getBigUint64(slotOff, true)
-      if (((bits >> 48n) & 0xFFF8n) !== NAN_PREFIX_BITS) continue
-      const ty = Number((bits >> 47n) & 0xFn)
+      if (((bits >> 48n) & 0xFFF8n) !== NAN_PREFIX) continue
+      const ty = Number((bits >> TAG_SHIFT_BIG) & TAG_MASK_BIG)
       if (!SHIFTABLE.has(ty)) continue
-      const off = Number(bits & 0xFFFFFFFFn)
+      // SSO STRING: "offset" holds packed bytes, not a heap address — never shift.
+      if (ty === PTR.STRING && ((bits >> AUX_SHIFT_BIG) & SSO_BIT_BIG)) continue
+      const off = Number(bits & OFFSET_MASK_BIG)
       if (off < prefix) continue
-      const hi = bits & ~0xFFFFFFFFn
+      const hi = bits & ~OFFSET_MASK_BIG
       dv.setBigUint64(slotOff, hi | BigInt(off - prefix), true)
     }
   }
@@ -1835,16 +1230,21 @@ function stripStaticDataPrefix(sec) {
         Array.isArray(child[2]) && SHIFTABLE.has(child[2][1]) &&
         Array.isArray(child[4]) && child[4][0] === 'i32.const' &&
         typeof child[4][1] === 'number' && child[4][1] >= prefix) {
-        child[4][1] -= prefix
+        // SSO STRING: aux carries SSO_BIT, "offset" holds packed bytes — don't shift.
+        const isSsoString = child[2][1] === PTR.STRING &&
+          Array.isArray(child[3]) && child[3][0] === 'i32.const' &&
+          typeof child[3][1] === 'number' && (child[3][1] & LAYOUT.SSO_BIT)
+        if (!isSsoString) child[4][1] -= prefix
       } else if (child[0] === 'f64.const' &&
         typeof child[1] === 'string' && child[1].startsWith('nan:0x')) {
         const bits = BigInt(child[1].slice(4)) | 0x7FF0000000000000n
-        if (((bits >> 48n) & 0xFFF8n) === NAN_PREFIX_BITS) {
-          const ty = Number((bits >> 47n) & 0xFn)
-          if (SHIFTABLE.has(ty)) {
-            const off = Number(bits & 0xFFFFFFFFn)
+        if (((bits >> 48n) & 0xFFF8n) === NAN_PREFIX) {
+          const ty = Number((bits >> TAG_SHIFT_BIG) & TAG_MASK_BIG)
+          if (SHIFTABLE.has(ty) &&
+              !(ty === PTR.STRING && ((bits >> AUX_SHIFT_BIG) & SSO_BIT_BIG))) {
+            const off = Number(bits & OFFSET_MASK_BIG)
             if (off >= prefix) {
-              const hi = bits & ~0xFFFFFFFFn
+              const hi = bits & ~OFFSET_MASK_BIG
               const newBits = hi | BigInt(off - prefix)
               child[1] = 'nan:0x' + newBits.toString(16).toUpperCase().padStart(16, '0')
             }
@@ -1862,14 +1262,29 @@ function stripStaticDataPrefix(sec) {
  * @param {import('./prepare.js').ASTNode} ast - Prepared AST
  * @returns {Array} Complete WASM module as S-expression
  */
-export default function compile(ast) {
+export default function compile(ast, profiler) {
   // Populate known function names + lookup map on ctx.func for direct call detection
   ctx.func.names.clear()
   ctx.func.map.clear()
   for (const f of ctx.func.list) { ctx.func.names.add(f.name); ctx.func.map.set(f.name, f) }
-  // Include imported functions for call resolution (e.g. template interpolations)
-  for (const imp of ctx.module.imports)
-    if (imp[3]?.[0] === 'func') ctx.func.names.add(imp[3][1].replace(/^\$/, ''))
+  // Include imported functions for call resolution (e.g. template interpolations).
+  // Also register a synthesized sig in func.map so emit's arity-aware branches see
+  // the import's declared param count — needed for arg pad/truncate to match it.
+  for (const imp of ctx.module.imports) {
+    if (imp[3]?.[0] !== 'func') continue
+    const fname = imp[3][1].replace(/^\$/, '')
+    ctx.func.names.add(fname)
+    if (!ctx.func.map.has(fname)) {
+      const params = []
+      let result = 'f64'
+      for (let k = 2; k < imp[3].length; k++) {
+        const part = imp[3][k]
+        if (Array.isArray(part) && part[0] === 'param') params.push({ type: part[1] || 'f64' })
+        else if (Array.isArray(part) && part[0] === 'result') result = part[1] || 'f64'
+      }
+      ctx.func.map.set(fname, { name: fname, sig: { params, results: [result] } })
+    }
+  }
 
   // Check user globals don't conflict with runtime globals (modules loaded after user decls)
   for (const name of ctx.scope.userGlobals)
@@ -1918,105 +1333,11 @@ export default function compile(ast) {
     }
   }
 
-  // Pre-scan module-scope value types so functions can dispatch methods on globals.
-  // Also scan moduleInits so cross-module imports (e.g. regex literals from util.js)
-  // resolve to the correct static dispatch path.
-  const scanStmts = (root) => {
-    if (!root) return
-    const stmts = Array.isArray(root) && root[0] === ';' ? root.slice(1) : [root]
-    for (const s of stmts) {
-      if (!Array.isArray(s) || (s[0] !== 'const' && s[0] !== 'let')) continue
-      for (const decl of s.slice(1)) {
-        if (!Array.isArray(decl) || decl[0] !== '=' || typeof decl[1] !== 'string') continue
-        const vt = valTypeOf(decl[2])
-        if (vt) {
-          if (!ctx.scope.globalValTypes) ctx.scope.globalValTypes = new Map()
-          ctx.scope.globalValTypes.set(decl[1], vt)
-          if (vt === VAL.REGEX && ctx.runtime.regex) ctx.runtime.regex.vars.set(decl[1], decl[2])
-        }
-        const ctor = typedElemCtor(decl[2])
-        if (ctor) {
-          if (!ctx.scope.globalTypedElem) ctx.scope.globalTypedElem = new Map()
-          ctx.scope.globalTypedElem.set(decl[1], ctor)
-        }
-      }
-    }
-  }
-  scanStmts(ast)
-  if (ctx.module.moduleInits) for (const init of ctx.module.moduleInits) scanStmts(init)
-
-  // Unbox const TYPED globals: change `(mut f64)` slot to `(mut i32)` and store the raw
-  // pointer offset. Reads tag the global.get with ptrKind=TYPED + ptrAux=elemType so
-  // typed-array consumers (.[]/.buffer/…) can resolve through ptrOffsetIR without ever
-  // calling __ptr_offset on a NaN-box. Init still flows through emit.js, but the assign
-  // coerces via asPtrOffset(val, VAL.TYPED) — one bit-extract at startup, then every
-  // hot read is a plain `global.get` of an i32.
-  if (ctx.scope.globalTypedElem && ctx.scope.consts) {
-    for (const [name, ctor] of ctx.scope.globalTypedElem) {
-      if (!ctx.scope.consts.has(name)) continue
-      if (ctx.scope.globalValTypes?.get(name) !== VAL.TYPED) continue
-      const aux = typedElemAux(ctor)
-      if (aux == null) continue
-      const decl = ctx.scope.globals.get(name)
-      if (typeof decl !== 'string' || !decl.includes('mut f64')) continue
-      ctx.scope.globals.set(name, `(global $${name} (mut i32) (i32.const 0))`)
-      ctx.scope.globalTypes.set(name, 'i32')
-      updateGlobalRep(name, { ptrKind: VAL.TYPED, ptrAux: aux })
-    }
-  }
+  const programFacts = timePhase(profiler, 'plan', () => plan(ast))
 
-  // === ProgramFacts: single whole-program walk over ast + user funcs + moduleInits ===
-  // See collectProgramFacts (top of file) for the contract. ctx.types.* mirrors are
-  // kept here because ir.js consumes them at emit time (will be replaced when emit
-  // takes facts explicitly — S3).
-  const programFacts = collectProgramFacts(ast)
-  ctx.types.dynKeyVars = programFacts.dynVars
-  ctx.types.anyDynKey = programFacts.anyDyn
-
-  // Materialize auto-box schemas from collected propMap
-  if (ast && ctx.schema.register) {
-    for (const [name, props] of programFacts.propMap) {
-      if (ctx.schema.vars.has(name)) {
-        const existing = ctx.schema.resolve(name)
-        const newProps = [...props].filter(p => !existing.includes(p))
-        if (newProps.length) {
-          const merged = [...existing, ...newProps]
-          const mergedId = ctx.schema.register(merged)
-          ctx.schema.vars.set(name, mergedId)
-        }
-        continue
-      }
-      const valueProps = [...props].filter(p => !ctx.func.names.has(`${name}$${p}`))
-      if (!valueProps.length) continue
-      const allProps = [...props]
-      const schema = ['__inner__', ...allProps]
-      const schemaId = ctx.schema.register(schema)
-      ctx.schema.vars.set(name, schemaId)
-      if (ctx.func.names.has(name) && !ctx.scope.globals.has(name))
-        ctx.scope.globals.set(name, `(global $${name} (mut f64) (f64.const 0))`)
-      if (!ctx.schema.autoBox) ctx.schema.autoBox = new Map()
-      ctx.schema.autoBox.set(name, { schemaId, schema })
-    }
-  }
-
-  // Dynamic closure ABI width: max param count (`=>` defs), max call arity, rest/spread
-  // accumulated by walkFacts above. $ftN type, call-site padding, and body slot decls
-  // use this instead of the static MAX_CLOSURE_ARITY cap. hasRest adds +1 for rest
-  // overflow. hasSpread + hasRest together force MAX (spread expands unknown element
-  // count at runtime, and any rest receiver may consume them).
-  if (ctx.closure.make) {
-    const { hasSpread, hasRest, maxCall, maxDef } = programFacts
-    const floor = ctx.closure.floor ?? 0
-    ctx.closure.width = (hasSpread && hasRest)
-      ? MAX_CLOSURE_ARITY
-      : Math.min(MAX_CLOSURE_ARITY, Math.max(maxCall, maxDef + (hasRest ? 1 : 0), floor))
-  }
-
-  narrowSignatures(programFacts, ast)
-  specializeBimorphicTyped(programFacts)
-  refineDynKeys(programFacts)
-
-  const funcs = ctx.func.list.map(func => emitFunc(func, programFacts))
+  const funcFacts = new Map()
+  for (const func of ctx.func.list) if (!func.raw) funcFacts.set(func, analyzeFuncForEmit(func, programFacts))
+  const funcs = ctx.func.list.map(func => emitFunc(func, funcFacts.get(func), programFacts))
   funcs.push(...synthesizeBoundaryWrappers())
 
   const closureFuncs = []
@@ -2070,11 +1391,33 @@ export default function compile(ast) {
 
   sec.funcs.push(...closureFuncs, ...funcs)
 
+  // WASI command-mode entries (`run`, `_start`) must export as () -> ();
+  // wasmtime/wasmer reject f64-returning functions under those names.
+  // Parametric entries skip this — a CLI invocation has no way to supply args.
+  if (ctx.transform.host === 'wasi') {
+    const WASI_ENTRIES = new Set(['run', '_start'])
+    for (const func of ctx.func.list) {
+      if (!func.exported || !WASI_ENTRIES.has(func.name)) continue
+      if (func.sig.params.length) continue
+      const inner = isBoundaryWrapped(func) ? `$${func.name}$exp` : `$${func.name}`
+      for (const f of sec.funcs) {
+        if (f[1] === inner || f[1] === `$${func.name}`) {
+          const expIdx = f.findIndex(n => Array.isArray(n) && n[0] === 'export')
+          if (expIdx >= 0) f.splice(expIdx, 1)
+        }
+      }
+      sec.funcs.push(['func', `$${func.name}$wasi`, ['export', `"${func.name}"`],
+        ['drop', ['call', inner]]])
+    }
+  }
+
   if (ctx.closure.table?.length)
     sec.elem.push(['elem', ['i32.const', 0], 'func', ...ctx.closure.table.map(n => `$${n}`)])
 
   buildStartFn(ast, sec, closureFuncs, compilePendingClosures)
 
+  syncImports(sec)
+
   dedupClosureBodies(closureFuncs, sec)
 
   finalizeClosureTable(sec)
@@ -2128,6 +1471,28 @@ export default function compile(ast) {
   if (restParamFuncs.length)
     sec.customs.push(['@custom', '"jz:rest"', `"${JSON.stringify(restParamFuncs).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`])
 
+  // Custom section: per-export i64 ABI map. Each entry describes an export
+  // whose boundary wrapper carries NaN-boxed pointers via i64 (rather than
+  // f64) to dodge V8's NaN canonicalization. Format: { name, p, r } where p
+  // is an array of i64 param indices and r is 1 if result is i64. host.js
+  // wrap() reinterprets BigInt↔f64 at i64 positions; numeric f64 positions
+  // stay as Numbers on the JS side.
+  const i64Exports = []
+  for (const f of ctx.func.list) {
+    if (!f.exported || !isBoundaryWrapped(f) || !f._exportUsesI64) continue
+    const p = []
+    f._exportI64Sig.params.forEach((b, i) => { if (b) p.push(i) })
+    const r = f._exportI64Sig.result ? 1 : 0
+    i64Exports.push({ name: f.name, p, r })
+    // Aliases (export { foo as bar }) re-export the same wrapper under a
+    // different JS-visible name; list each alias too so wrap() finds it.
+    for (const [alias, val] of Object.entries(ctx.func.exports)) {
+      if (val === f.name && alias !== f.name) i64Exports.push({ name: alias, p, r })
+    }
+  }
+  if (i64Exports.length)
+    sec.customs.push(['@custom', '"jz:i64exp"', `"${JSON.stringify(i64Exports).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`])
+
   // Named export aliases: export { name } or export { source as alias }
   for (const [name, val] of Object.entries(ctx.func.exports)) {
     if (val === true) {