jz 0.1.1 → 0.2.0

package/src/analyze.js

@@ -24,6 +24,7 @@
  */
 
 import { ctx, err } from './ctx.js'
+import { isLiteralStr, isFuncRef } from './ir.js'
 
 export const T = '\uE000'
 
@@ -89,7 +90,7 @@ export const VAL = {
   NUMBER: 'number', ARRAY: 'array', STRING: 'string',
   OBJECT: 'object', HASH: 'hash', SET: 'set', MAP: 'map',
   CLOSURE: 'closure', TYPED: 'typed', REGEX: 'regex',
-  BIGINT: 'bigint', BUFFER: 'buffer',
+  BIGINT: 'bigint', BUFFER: 'buffer', DATE: 'date',
 }
 
 /**
@@ -233,6 +234,7 @@ export function valTypeOf(expr) {
     // Literal forms: [] = undefined, [null, null] = null, [null, n] = number/bigint
     if (args.length === 0) return null              // undefined literal
     if (args[0] == null) return null                // null literal
+    if (typeof args[0] === 'symbol') return null    // prepared null sentinel
     return typeof args[0] === 'bigint' ? VAL.BIGINT : VAL.NUMBER
   }
 
@@ -241,16 +243,22 @@ export function valTypeOf(expr) {
   if (op === '=>') return VAL.CLOSURE
   if (op === '//') return VAL.REGEX
   if (op === '{}' && args[0]?.[0] === ':') return VAL.OBJECT
+  if (op === '?:') {
+    const ta = valTypeOf(args[1]), tb = valTypeOf(args[2])
+    return ta && ta === tb ? ta : null
+  }
   // `[]` op covers both array literals (1 arg) and index access (2 args).
   // Array literal: `[]` → ['[]', null]; `[1,2]` → ['[]', [',', ...]]; `[x]` → ['[]', x].
   // Index access:  `arr[i]` → ['[]', arr, i].
   if (op === '[]') {
     if (args.length < 2) return VAL.ARRAY
-    // Indexed read on a known typed-array receiver yields a number (BigInt64/BigUint64Array
-    // would yield BigInt, but they're rare and we don't track per-elem type here — the
-    // .typed:[] emit path already handles their f64-cast correctly; this only affects
-    // arithmetic-time __to_num elision, where assuming Number is safe-by-construction).
-    if (typeof args[0] === 'string' && lookupValType(args[0]) === VAL.TYPED) return VAL.NUMBER
+    // Indexed read on a known typed-array receiver yields Number except for
+    // BigInt64Array/BigUint64Array, whose i64 carriers must stay BigInt-typed.
+    if (typeof args[0] === 'string' && lookupValType(args[0]) === VAL.TYPED)
+      return typedCtorElemValType(ctx.types.typedElem?.get(args[0])) || VAL.NUMBER
+    // Indexed read on a STRING returns a 1-char string (SSO at runtime).
+    if (typeof args[0] === 'string' && lookupValType(args[0]) === VAL.STRING) return VAL.STRING
+    if (Array.isArray(args[0]) && valTypeOf(args[0]) === VAL.STRING) return VAL.STRING
     // Indexed read on a known Array<VAL> receiver: bind by rep.arrayElemValType.
     // Set by analyzeValTypes from body observations + emitFunc preseed for params.
     if (typeof args[0] === 'string') {
@@ -267,12 +275,12 @@ export function valTypeOf(expr) {
     const slotVT = ctx.schema.slotVT(args[0], args[1])
     if (slotVT) return slotVT
   }
-  // VAL.HASH `.prop` propagation: when the receiver chain roots at a binding
+  // OBJECT `.prop` propagation: when the receiver chain roots at a binding
   // sourced from `JSON.parse(stringConst)`, walk the shape tree to recover the
   // child's val-type. Generic for any compile-time-known JSON literal.
   if (op === '.' && typeof args[1] === 'string') {
     const sh = shapeOf(args[0])
-    if (sh?.vt === VAL.HASH) {
+    if (sh?.vt === VAL.OBJECT || sh?.vt === VAL.HASH) {
       const child = sh.props[args[1]]
       if (child) return child.vt
     }
@@ -301,6 +309,7 @@ export function valTypeOf(expr) {
     if (typeof callee === 'string') {
       if (callee === 'new.Set') return VAL.SET
       if (callee === 'new.Map') return VAL.MAP
+      if (callee === 'new.Date') return VAL.DATE
       if (callee === 'new.ArrayBuffer') return VAL.BUFFER
       if (callee === 'new.DataView') return VAL.BUFFER
       if (callee.startsWith('new.')) return VAL.TYPED
@@ -310,7 +319,10 @@ export function valTypeOf(expr) {
         const src = jsonConstString(args[1])
         if (src != null) {
           const c = src.trimStart()[0]
-          if (c === '{') return VAL.HASH
+          // Objects emit as fixed-shape OBJECT (slot-based) — see
+          // module/json.js:emitJsonConstValue. The downstream `.prop` reads
+          // hit emitSchemaSlotRead via ctx.schema.find, bypassing hash probes.
+          if (c === '{') return VAL.OBJECT
           if (c === '[') return VAL.ARRAY
           if (c === '"') return VAL.STRING
           if (c === 't' || c === 'f' || c === '-' || (c >= '0' && c <= '9')) return VAL.NUMBER
@@ -340,16 +352,21 @@ export function valTypeOf(expr) {
         return null
       }
       if (method === 'push') return VAL.ARRAY
+      if ((method === 'shift' || method === 'pop') && typeof obj === 'string') {
+        const elemVt = ctx.func.repByLocal?.get(obj)?.arrayElemValType
+        if (elemVt) return elemVt
+      }
       if (method === 'add' || method === 'delete') return VAL.SET
       if (method === 'set') return VAL.MAP
       // String-returning methods
       if (['toUpperCase', 'toLowerCase', 'trim', 'trimStart', 'trimEnd',
-        'repeat', 'padStart', 'padEnd', 'replace', 'charAt', 'substring'].includes(method)) return VAL.STRING
+        'repeat', 'padStart', 'padEnd', 'replace', 'replaceAll', 'charAt', 'substring'].includes(method)) return VAL.STRING
+      if (method === 'split') return VAL.ARRAY
       // slice/concat preserve caller type (string.slice → string, array.slice → array)
       if (method === 'slice' || method === 'concat') {
         const objType = valTypeOf(obj)
-        if (objType) return objType
-        return VAL.ARRAY // default to array when unknown
+        if (objType === VAL.STRING || objType === VAL.ARRAY || objType === VAL.TYPED) return objType
+        return null
       }
     }
   }
@@ -359,7 +376,22 @@ export function valTypeOf(expr) {
 function jsonConstString(expr) {
   if (Array.isArray(expr) && expr[0] === 'str' && typeof expr[1] === 'string') return expr[1]
   if (Array.isArray(expr) && expr[0] == null && typeof expr[1] === 'string') return expr[1]
-  if (typeof expr === 'string') return ctx.scope.constStrs?.get(expr) ?? null
+  if (typeof expr === 'string') {
+    // Prefer shapeStrs (broader: includes effectively-const `let` string literals
+    // at module scope) over constStrs (const-only). Module/json's static-fold
+    // path uses its own constStrs-only resolver to avoid folding `let`-bound
+    // initializers — preserving the user-controlled distinction. Shape
+    // inference is sound either way: an effectively-const literal's value is
+    // invariant, so the parsed shape it produces is too.
+    return ctx.scope.shapeStrs?.get(expr) ?? ctx.scope.constStrs?.get(expr) ?? null
+  }
+  return null
+}
+
+function jsonShapeStrings(expr) {
+  const single = jsonConstString(expr)
+  if (single != null) return [single]
+  if (Array.isArray(expr) && expr[0] === '[]' && typeof expr[1] === 'string') return ctx.scope.shapeStrArrays?.get(expr[1]) ?? null
   return null
 }
 
@@ -384,18 +416,19 @@ function shapeOfJsonValue(v) {
   }
   if (typeof v === 'object') {
     const props = Object.create(null)
-    for (const k of Object.keys(v)) {
+    const names = Object.keys(v)
+    for (const k of names) {
       const s = shapeOfJsonValue(v[k])
       if (s) props[k] = s
     }
-    return { vt: VAL.HASH, props }
+    return { vt: VAL.OBJECT, props, names }
   }
   return null
 }
 
 function shapeUnifies(a, b) {
   if (!a || !b || a.vt !== b.vt) return false
-  if (a.vt === VAL.HASH) {
+  if (a.vt === VAL.OBJECT || a.vt === VAL.HASH) {
     const ak = Object.keys(a.props), bk = Object.keys(b.props)
     if (ak.length !== bk.length) return false
     for (const k of ak) {
@@ -409,6 +442,16 @@ function shapeUnifies(a, b) {
   return true
 }
 
+function shapeLayoutUnifies(a, b) {
+  if (!shapeUnifies(a, b)) return false
+  if (a.vt === VAL.OBJECT || a.vt === VAL.HASH) {
+    if (a.names?.length !== b.names?.length) return false
+    for (let i = 0; i < a.names.length; i++) if (a.names[i] !== b.names[i]) return false
+  }
+  if (a.vt === VAL.ARRAY && a.elem) return shapeLayoutUnifies(a.elem, b.elem)
+  return true
+}
+
 const _jsonShapeCache = new WeakMap()
 function parseJsonShape(src) {
   if (typeof src !== 'string') return null
@@ -420,6 +463,18 @@ function parseJsonShape(src) {
   return sh
 }
 
+function parseUnifiedJsonShape(srcs) {
+  if (!srcs?.length) return null
+  let out = null
+  for (const src of srcs) {
+    const sh = parseJsonShape(src)
+    if (!sh) return null
+    if (!out) out = sh
+    else if (!shapeLayoutUnifies(out, sh)) return null
+  }
+  return out
+}
+
 /** Resolve the json shape for an expression by walking name → rep.jsonShape and
  *  `.prop` / `[i]` indirection. Returns null when shape is unknown at this site. */
 export function shapeOf(expr) {
@@ -427,12 +482,12 @@ export function shapeOf(expr) {
   if (!Array.isArray(expr)) return null
   const [op, ...args] = expr
   if (op === '()' && args[0] === 'JSON.parse') {
-    const src = jsonConstString(args[1])
-    if (src != null) return parseJsonShape(src)
+    const srcs = jsonShapeStrings(args[1])
+    if (srcs) return parseUnifiedJsonShape(srcs)
   }
   if (op === '.' && typeof args[1] === 'string') {
     const parent = shapeOf(args[0])
-    if (parent?.vt === VAL.HASH) return parent.props[args[1]] || null
+    if (parent?.vt === VAL.OBJECT || parent?.vt === VAL.HASH) return parent.props[args[1]] || null
   }
   if (op === '[]' && args.length === 2) {
     const parent = shapeOf(args[0])
@@ -442,6 +497,84 @@ export function shapeOf(expr) {
 }
 
 
+/** Static property-key evaluation for computed member names: folds a node into
+ *  its constant value (numeric, string, boolean, null) and stringifies it. Returns
+ *  null if any sub-expression isn't statically known. Handles literals, named
+ *  string constants, String()/Number() casts, ternaries, short-circuit ops, and
+ *  unary/binary arithmetic and bit ops. */
+const NO_VALUE = Symbol('no-static-property-key')
+
+export function staticPropertyKey(node) {
+  const value = staticValue(node)
+  return value === NO_VALUE ? null : String(value)
+}
+
+function staticValue(node) {
+  if (node === undefined) return undefined
+  if (node === null || typeof node === 'number' || typeof node === 'boolean') return node
+  if (typeof node === 'string') return ctx.scope.constStrs?.get(node) ?? NO_VALUE
+  if (!Array.isArray(node)) return NO_VALUE
+
+  const [op, ...args] = node
+  if (op == null) return args.length ? args[0] : undefined
+  if (op === 'str') return args[0]
+  if (op === '[]' && args.length === 1) return staticValue(args[0])
+  if (op === '()' && args[0] === 'String' && args.length === 2) {
+    const value = staticValue(args[1])
+    return value === NO_VALUE ? NO_VALUE : String(value)
+  }
+  if (op === '()' && args[0] === 'Number' && args.length === 2) {
+    const value = staticValue(args[1])
+    return value === NO_VALUE ? NO_VALUE : Number(value)
+  }
+  if (op === '?:' || op === '?') {
+    const cond = staticValue(args[0])
+    return cond === NO_VALUE ? NO_VALUE : staticValue(cond ? args[1] : args[2])
+  }
+  if (op === '&&' || op === '||') {
+    const left = staticValue(args[0])
+    if (left === NO_VALUE) return NO_VALUE
+    return op === '&&' ? (left ? staticValue(args[1]) : left) : (left ? left : staticValue(args[1]))
+  }
+  if (op === '??') {
+    const left = staticValue(args[0])
+    return left === NO_VALUE ? NO_VALUE : left == null ? staticValue(args[1]) : left
+  }
+
+  if (args.length === 1) {
+    const value = staticValue(args[0])
+    if (value === NO_VALUE) return NO_VALUE
+    if (op === 'u+') return +value
+    if (op === 'u-') return -value
+    if (op === '!') return !value
+    if (op === '~') return ~value
+    return NO_VALUE
+  }
+
+  if (args.length === 2) {
+    const left = staticValue(args[0])
+    const right = staticValue(args[1])
+    if (left === NO_VALUE || right === NO_VALUE) return NO_VALUE
+    switch (op) {
+      case '+': return typeof left === 'string' || typeof right === 'string' ? String(left) + String(right) : Number(left) + Number(right)
+      case '-': return Number(left) - Number(right)
+      case '*': return Number(left) * Number(right)
+      case '/': return Number(left) / Number(right)
+      case '%': return Number(left) % Number(right)
+      case '**': return Number(left) ** Number(right)
+      case '&': return Number(left) & Number(right)
+      case '|': return Number(left) | Number(right)
+      case '^': return Number(left) ^ Number(right)
+      case '<<': return Number(left) << Number(right)
+      case '>>': return Number(left) >> Number(right)
+      case '>>>': return Number(left) >>> Number(right)
+      default: return NO_VALUE
+    }
+  }
+
+  return NO_VALUE
+}
+
 /** Decode a `['{}', ...]` AST's children into `{names, values}`, or null if any
  *  property is non-static-key (computed key, spread, shorthand). Matches the
  *  emitter's flatten rule for comma-grouped props. Used by collectProgramFacts,
@@ -457,6 +590,15 @@ export function staticObjectProps(args) {
   return names.length ? { names, values } : null
 }
 
+function staticArrayElems(expr) {
+  if (!Array.isArray(expr)) return null
+  if (expr[0] === '[') return expr.slice(1)
+  if (expr[0] !== '[]' || expr.length >= 3) return null
+  const arg = expr[1]
+  if (arg == null) return []
+  return Array.isArray(arg) && arg[0] === ',' ? arg.slice(1) : [arg]
+}
+
 /** Schema-id for an object literal expression. Returns null on dynamic keys, spread, shorthand. */
 function objLiteralSchemaId(expr) {
   if (!Array.isArray(expr) || expr[0] !== '{}' || !ctx.schema?.register) return null
@@ -508,7 +650,7 @@ export function typedElemCtor(rhs) {
 const _ELEM_AUX = {
   Int8Array: 0, Uint8Array: 1, Int16Array: 2, Uint16Array: 3,
   Int32Array: 4, Uint32Array: 5, Float32Array: 6, Float64Array: 7,
-  BigInt64Array: 7, BigUint64Array: 7,
+  BigInt64Array: 23, BigUint64Array: 23,
 }
 /** Encode a `typedElemCtor` string ('new.Int32Array' | 'new.Int32Array.view') to the 4-bit
  *  aux value used in PTR.TYPED NaN-boxing. Returns null for unknown ctors (ArrayBuffer/DataView). */
@@ -529,11 +671,41 @@ const _ELEM_NAMES = ['Int8Array', 'Uint8Array', 'Int16Array', 'Uint16Array',
 export function ctorFromElemAux(aux) {
   if (aux == null) return null
   const isView = (aux & 8) !== 0
-  const name = _ELEM_NAMES[aux & 7]
+  const name = (aux & 16) !== 0 ? 'BigInt64Array' : _ELEM_NAMES[aux & 7]
   if (!name) return null
   return isView ? `new.${name}.view` : `new.${name}`
 }
 
+/** Sentinel returned by `ternaryCtorOfRhs` when ternary branches resolve to
+ *  different typed-array ctors — caller should drop any cached entry rather
+ *  than leave a stale ctor (which would lock the wrong store width). */
+export const MIXED_CTORS = Symbol('MIXED_CTORS')
+
+const typedCtorElemValType = (ctor) => {
+  if (!ctor) return null
+  const isView = ctor.endsWith('.view')
+  const name = isView ? ctor.slice(4, -5) : ctor.slice(4)
+  return name === 'BigInt64Array' || name === 'BigUint64Array' ? VAL.BIGINT : VAL.NUMBER
+}
+
+/** A `?:`/`&&`/`||` expression — value depends on a condition, so its ctor
+ *  must be derived by walking branches (handled by `ternaryCtorOfRhs`). */
+const isCondExpr = e => Array.isArray(e) && (e[0] === '?:' || e[0] === '&&' || e[0] === '||')
+
+/** Walk a `?:`/`&&`/`||` expression and return:
+ *  - a single ctor string when every branch resolves to the same ctor,
+ *  - MIXED_CTORS when branches resolve to different ctors,
+ *  - null when no branch resolves (caller's behavior unchanged). */
+export function ternaryCtorOfRhs(rhs) {
+  if (!Array.isArray(rhs)) return null
+  const op = rhs[0]
+  const lo = op === '?:' ? 2 : (op === '&&' || op === '||') ? 1 : 0
+  if (!lo) return null
+  const a = ternaryCtorOfRhs(rhs[lo]) ?? typedElemCtor(rhs[lo])
+  const b = ternaryCtorOfRhs(rhs[lo + 1]) ?? typedElemCtor(rhs[lo + 1])
+  return a && b ? (a === b ? a : MIXED_CTORS) : (a || b || null)
+}
+
 // === Cross-call argument inference helpers (used by narrowSignatures fixpoint) ===
 // Each `inferArg*(expr, ...callerCtx)` resolves an argument expression to a single
 // fact (val/schemaId/elem*/typedCtor) using caller-local observations and program
@@ -668,7 +840,7 @@ export function analyzeBody(body) {
   // for any slice and can't be WeakMap-keyed. Return empty maps without caching.
   if (body === null || typeof body !== 'object') return {
     locals: new Map(), valTypes: new Map(), arrElemSchemas: new Map(),
-    arrElemValTypes: new Map(), typedElems: new Map(),
+    arrElemValTypes: new Map(), typedElems: new Map(), escapes: new Map(),
   }
   const hit = _bodyFactsCache.get(body)
   if (hit) return hit
@@ -678,6 +850,8 @@ export function analyzeBody(body) {
   const arrElemSchemas = new Map()
   const arrElemValTypes = new Map()
   const typedElems = new Map()
+  const escapes = new Map() // name → bool: local holds allocation, true if it escapes
+  const valPoison = new Set()
 
   const doSchemas = !!ctx.schema?.register
   // Per-walk local schema map for chained `arr.push(name)` resolution.
@@ -725,16 +899,48 @@ export function analyzeBody(body) {
     return valTypeOf(expr)
   }
 
+  const typedPoison = new Set()
+  const trackVal = (name, vt) => {
+    if (valPoison.has(name)) return
+    const prev = valTypes.get(name)
+    if (!vt) {
+      if (prev) valPoison.add(name)
+      valTypes.delete(name)
+      return
+    }
+    if (prev && prev !== vt) {
+      valPoison.add(name)
+      valTypes.delete(name)
+      return
+    }
+    valTypes.set(name, vt)
+  }
+  const invalidateTyped = (name) => {
+    typedPoison.add(name)
+    typedElems.delete(name)
+  }
   const trackTyped = (name, rhs) => {
+    if (typedPoison.has(name)) return
+    const setOrInvalidate = (c) => {
+      if (c === MIXED_CTORS) return invalidateTyped(name)
+      const prev = typedElems.get(name)
+      if (prev && prev !== c) invalidateTyped(name)
+      else typedElems.set(name, c)
+    }
     const ctor = typedElemCtor(rhs)
-    if (ctor) { typedElems.set(name, ctor); return }
+    if (ctor) return setOrInvalidate(ctor)
     if (Array.isArray(rhs) && rhs[0] === '()' && typeof rhs[1] === 'string') {
       const f = ctx.func.map?.get(rhs[1])
       if (f?.sig?.ptrKind === VAL.TYPED && f.sig.ptrAux != null) {
         const c = ctorFromElemAux(f.sig.ptrAux)
-        if (c) typedElems.set(name, c)
+        if (c) setOrInvalidate(c)
       }
+      return
     }
+    // Heterogeneous ternary: ctors that don't unify must invalidate so a sibling
+    // decl (jz hoists `let` to function scope) can't lock in the wrong width.
+    const tc = ternaryCtorOfRhs(rhs)
+    if (tc) setOrInvalidate(tc)
   }
 
   // === Per-decl observation (called for each `let`/`const` `name = rhs`) ===
@@ -745,8 +951,7 @@ export function analyzeBody(body) {
     else if (locals.get(name) === 'i32' && wt === 'f64') locals.set(name, 'f64')
 
     // val type (valTypes slice)
-    const vt = valTypeOf(rhs)
-    if (vt) valTypes.set(name, vt); else valTypes.delete(name)
+    trackVal(name, valTypeOf(rhs))
 
     // typed-array element ctor (typedElems slice)
     trackTyped(name, rhs)
@@ -755,14 +960,17 @@ export function analyzeBody(body) {
     if (doSchemas) {
       const sid = exprSchemaId(rhs, localSchemaMap)
       if (sid != null) localSchemaMap.set(name, sid)
-      if (Array.isArray(rhs) && rhs[0] === '[]') {
-        const elems = rhs.slice(1).filter(e => e != null)
-        if (elems.length) {
-          let common = exprSchemaId(elems[0], localSchemaMap)
-          for (let k = 1; k < elems.length && common != null; k++) {
-            if (exprSchemaId(elems[k], localSchemaMap) !== common) common = null
+      {
+        const rawElems = staticArrayElems(rhs)
+        if (rawElems) {
+          const elems = rawElems.filter(e => e != null)
+          if (elems.length && elems.length === rawElems.length) {
+            let common = exprSchemaId(elems[0], localSchemaMap)
+            for (let k = 1; k < elems.length && common != null; k++) {
+              if (exprSchemaId(elems[k], localSchemaMap) !== common) common = null
+            }
+            if (common != null) observeArrSchema(name, common)
           }
-          if (common != null) observeArrSchema(name, common)
         }
       }
       if (Array.isArray(rhs) && rhs[0] === '()' && typeof rhs[1] === 'string') {
@@ -780,14 +988,17 @@ export function analyzeBody(body) {
     }
 
     // arr-elem val type (arrElemValTypes slice) — array-literal init + call return + alias + .map/.filter/.slice/.concat chain
-    if (Array.isArray(rhs) && rhs[0] === '[]') {
-      const elems = rhs.slice(1).filter(e => e != null)
-      if (elems.length) {
-        let common = exprElemSourceVal(elems[0])
-        for (let k = 1; k < elems.length && common != null; k++) {
-          if (exprElemSourceVal(elems[k]) !== common) common = null
+    {
+      const rawElems = staticArrayElems(rhs)
+      if (rawElems) {
+        const elems = rawElems.filter(e => e != null)
+        if (elems.length && elems.length === rawElems.length) {
+          let common = exprElemSourceVal(elems[0])
+          for (let k = 1; k < elems.length && common != null; k++) {
+            if (exprElemSourceVal(elems[k]) !== common) common = null
+          }
+          if (common != null) observeArrValType(name, common)
         }
-        if (common != null) observeArrValType(name, common)
       }
     }
     if (Array.isArray(rhs) && rhs[0] === '()' && typeof rhs[1] === 'string') {
@@ -805,6 +1016,8 @@ export function analyzeBody(body) {
       if (method === 'filter' || method === 'slice' || method === 'concat') {
         const v = elemValOf(recvName)
         if (v) observeArrValType(name, v)
+      } else if (method === 'split' && valTypeOf(recvName) === VAL.STRING) {
+        observeArrValType(name, VAL.STRING)
       } else if (method === 'map') {
         const arrowFn = rhs[2]
         const recvVt = elemValOf(recvName)
@@ -830,14 +1043,47 @@ export function analyzeBody(body) {
         }
       }
     }
+    if (Array.isArray(rhs) && rhs[0] === '()' &&
+        Array.isArray(rhs[1]) && rhs[1][0] === '.' && rhs[1][2] === 'split' &&
+        valTypeOf(rhs[1][1]) === VAL.STRING) {
+      observeArrValType(name, VAL.STRING)
+    }
   }
 
   // arrElem invalidation rule — fires on `=` reassign of tracked name to non-array
   const isArrayProducingRhs = (rhs) =>
-    Array.isArray(rhs) && (rhs[0] === '[]' ||
+    Array.isArray(rhs) && (staticArrayElems(rhs) != null ||
       (rhs[0] === '()' && Array.isArray(rhs[1]) && rhs[1][0] === '.' &&
        (rhs[1][2] === 'slice' || rhs[1][2] === 'concat')))
 
+  const markEscape = (name) => { if (escapes.has(name)) escapes.set(name, true) }
+
+  const isStaticIndex = (key) =>
+    typeof key === 'number' || typeof key === 'string' ||
+    (Array.isArray(key) && ((key[0] == null && Number.isInteger(key[1])) || key[0] === 'str')) ||
+    staticPropertyKey(key) != null
+
+  const markEscapeValue = (expr) => {
+    if (typeof expr === 'string') { markEscape(expr); return }
+    if (!Array.isArray(expr)) return
+    const op = expr[0]
+    if (op === 'str') return
+    if (op === ':') { markEscapeValue(expr[2]); return }
+    if ((op === '.' || op === '?.') && typeof expr[1] === 'string' && escapes.has(expr[1])) return
+    if (op === '[]' && typeof expr[1] === 'string' && escapes.has(expr[1])) {
+      if (!isStaticIndex(expr[2])) markEscape(expr[1])
+      markEscapeValue(expr[2])
+      return
+    }
+    for (let i = 1; i < expr.length; i++) markEscapeValue(expr[i])
+  }
+
+  const markEscapeArgs = (args) => {
+    if (args == null) return
+    const list = Array.isArray(args) && args[0] === ',' ? args.slice(1) : [args]
+    for (const a of list) markEscapeValue(Array.isArray(a) && a[0] === '...' ? a[1] : a)
+  }
+
   // === Single walk ===
   function walk(node) {
     if (!Array.isArray(node)) return
@@ -858,6 +1104,10 @@ export function analyzeBody(body) {
         }
         const name = a[1], rhs = a[2]
         processDecl(name, rhs)
+        if (Array.isArray(rhs) && (rhs[0] === '[' || rhs[0] === '{}')) {
+          escapes.set(name, false)
+        }
+        markEscapeValue(rhs)
         // Walk rhs only — never enter the `=` node so the reassignment-invalidation
         // rule won't misfire on the binding's own initializer.
         walk(rhs)
@@ -865,6 +1115,14 @@ export function analyzeBody(body) {
       return
     }
 
+    if (op === 'return' && node[1] != null) {
+      markEscapeValue(node[1])
+    }
+
+    if (op === '()' && node.length > 2) {
+      markEscapeArgs(node[2])
+    }
+
     // arr.push(...) — observe both schemas and val types in one pass
     if (op === '()' && Array.isArray(node[1]) && node[1][0] === '.' && node[1][2] === 'push' && typeof node[1][1] === 'string') {
       const arr = node[1][1]
@@ -884,13 +1142,16 @@ export function analyzeBody(body) {
     // arrElemSchemas/ValTypes invalidate when rhs isn't array-producing.
     if (op === '=' && typeof node[1] === 'string') {
       const name = node[1], rhs = node[2]
+      walk(rhs)
+      markEscape(name)
+      markEscapeValue(rhs)
       const wt = exprType(rhs, locals)
       if (locals.has(name) && locals.get(name) === 'i32' && wt === 'f64') locals.set(name, 'f64')
-      const vt = valTypeOf(rhs)
-      if (vt) valTypes.set(name, vt); else valTypes.delete(name)
+      trackVal(name, valTypeOf(rhs))
       trackTyped(name, rhs)
       if (arrElemSchemas.has(name) && !isArrayProducingRhs(rhs)) observeArrSchema(name, null)
       if (arrElemValTypes.has(name) && !isArrayProducingRhs(rhs)) observeArrValType(name, null)
+      return
     }
 
     // compound-assign widening (locals slice)
@@ -903,6 +1164,28 @@ export function analyzeBody(body) {
       if (locals.has(node[1])) locals.set(node[1], 'f64')
     }
 
+    if (op === 'for' || op === 'for-in' || op === 'for-of') {
+      if (node[1] != null) markEscapeValue(node[1])
+    }
+
+    if (op === '[' || op === '{}') {
+      for (let i = 1; i < node.length; i++) {
+        const c = node[i]
+        if (Array.isArray(c) && c[0] === ',') {
+          for (let j = 1; j < c.length; j++) {
+            if (Array.isArray(c[j]) && c[j][0] === '...') markEscapeValue(c[j][1])
+          }
+        } else if (Array.isArray(c) && c[0] === '...') {
+          markEscapeValue(c[1])
+        }
+      }
+    }
+
+    if (op === '[]' && typeof node[1] === 'string' && escapes.has(node[1])) {
+      const key = node[2]
+      if (!isStaticIndex(key)) markEscape(node[1])
+    }
+
     for (let i = 1; i < node.length; i++) walk(node[i])
   }
 
@@ -910,8 +1193,13 @@ export function analyzeBody(body) {
   // resolve chains (`const a = new TypedArr(); const b = a[0]` → b: NUMBER)
   // and shorthand-bound `{a}` props see a's type. Restored after walk completes.
   const prevOverlay = ctx.func.localValTypesOverlay
+  const prevTypedOverlay = ctx.func.localTypedElemsOverlay
   ctx.func.localValTypesOverlay = valTypes
-  try { walk(body) } finally { ctx.func.localValTypesOverlay = prevOverlay }
+  ctx.func.localTypedElemsOverlay = typedElems
+  try { walk(body) } finally {
+    ctx.func.localValTypesOverlay = prevOverlay
+    ctx.func.localTypedElemsOverlay = prevTypedOverlay
+  }
 
   // Second pass: widen i32 locals compared against f64.
   const CMP_OPS = new Set(['<', '>', '<=', '>=', '==', '!='])
@@ -928,7 +1216,36 @@ export function analyzeBody(body) {
   }
   widenPass(body)
 
-  const result = { locals, valTypes, arrElemSchemas, arrElemValTypes, typedElems }
+  // Re-resolve let-decl RHS types now that widenPass has widened. A `let x2 =
+  // zx*zx` declared at i32 because zx was i32 at scan time must widen if zx
+  // was later re-typed to f64. Without this, integer-init locals shadowed
+  // by f64-arithmetic RHSs end up with `i32.trunc_sat_f64_s` truncating the
+  // fractional value (e.g. mandelbrot escape: `x2 = zx*zx` losing 3.515 → 3).
+  // Monotonic: only widens i32 → f64. Bound by locals count so no infinite loop.
+  let widened = true
+  while (widened) {
+    widened = false
+    const recheck = (node) => {
+      if (!Array.isArray(node)) return
+      const op = node[0]
+      if (op === '=>') return
+      if (op === 'let' || op === 'const') {
+        for (let i = 1; i < node.length; i++) {
+          const a = node[i]
+          if (Array.isArray(a) && a[0] === '=' && typeof a[1] === 'string') {
+            const name = a[1], rhs = a[2]
+            if (locals.get(name) === 'i32' && exprType(rhs, locals) === 'f64') {
+              locals.set(name, 'f64'); widened = true
+            }
+          }
+        }
+      }
+      for (let i = 1; i < node.length; i++) recheck(node[i])
+    }
+    recheck(body)
+  }
+
+  const result = { locals, valTypes, arrElemSchemas, arrElemValTypes, typedElems, escapes }
   _bodyFactsCache.set(body, result)
   return result
 }
@@ -941,6 +1258,69 @@ export function invalidateLocalsCache(body) {
   if (body && typeof body === 'object') _bodyFactsCache.delete(body)
 }
 
+// String-only methods: presence of `name.method(...)` is definite evidence that
+// `name` is VAL.STRING. Excludes ambiguous methods (length, slice, indexOf, [],
+// concat) that strings share with arrays/typed-arrays.
+const STRING_ONLY_METHODS = new Set([
+  'charCodeAt', 'charAt', 'codePointAt', 'startsWith', 'endsWith',
+  'toUpperCase', 'toLowerCase', 'normalize', 'localeCompare',
+  'padStart', 'padEnd', 'repeat', 'trimStart', 'trimEnd', 'trim',
+  'matchAll', 'match', 'replace', 'replaceAll', 'split',
+])
+// Array-only methods: presence rules out STRING.
+const ARRAY_ONLY_METHODS = new Set([
+  'push', 'pop', 'shift', 'unshift', 'splice', 'sort', 'fill', 'reverse',
+  'flat', 'flatMap', 'copyWithin',
+])
+
+/** Infer VAL.STRING for `names` from method-call evidence in `body`.
+ *  Descends into nested closures (captured names retain shape) but respects
+ *  shadowing: a param of a nested `=>` removes that name from the inference
+ *  scope inside that closure. Returns Map<name, VAL.STRING> for names that
+ *  have at least one string-only method call and no array-only conflicts. */
+export function inferStringParams(body, names) {
+  if (!names || names.length === 0) return new Map()
+  const evidence = new Map() // name → 'string' | 'conflict'
+  function walk(node, scope) {
+    if (!Array.isArray(node) || scope.size === 0) return
+    const op = node[0]
+    if (op === '=>') {
+      const shadowed = collectParamNames([node[1]])
+      let inner = scope
+      for (const s of shadowed) {
+        if (inner.has(s)) {
+          if (inner === scope) inner = new Set(scope)
+          inner.delete(s)
+        }
+      }
+      walk(node[2], inner)
+      return
+    }
+    // `name.method` — observe positive/negative evidence
+    if (op === '.' && typeof node[1] === 'string' && scope.has(node[1])) {
+      const m = node[2]
+      if (typeof m === 'string') {
+        if (STRING_ONLY_METHODS.has(m)) {
+          if (evidence.get(node[1]) !== 'conflict') evidence.set(node[1], 'string')
+        } else if (ARRAY_ONLY_METHODS.has(m)) {
+          evidence.set(node[1], 'conflict')
+        }
+      }
+    }
+    // Reassignment to an unambiguously non-string RHS poisons the inference
+    if (op === '=' && typeof node[1] === 'string' && scope.has(node[1])) {
+      const rhs = node[2]
+      const vt = valTypeOf(rhs)
+      if (vt && vt !== VAL.STRING) evidence.set(node[1], 'conflict')
+    }
+    for (let i = 1; i < node.length; i++) walk(node[i], scope)
+  }
+  walk(body, new Set(names))
+  const out = new Map()
+  for (const [n, ev] of evidence) if (ev === 'string') out.set(n, VAL.STRING)
+  return out
+}
+
 /** Drop the cached analyzeBody entry. Used after E2-phase valResult narrowing
  *  so the next walk re-evaluates `valTypeOf(call)` with up-to-date `f.valResult`
  *  — required for the D-pass paramReps val/arrayElemSchema re-fixpoint to see
@@ -955,7 +1335,22 @@ export function invalidateValTypesCache(body) {
  * and schema resolution.
  */
 export function analyzeValTypes(body) {
-  const setVal = (name, vt) => updateRep(name, { val: vt || undefined })
+  const valPoison = new Set()
+  const setVal = (name, vt) => {
+    if (valPoison.has(name)) return
+    const prev = ctx.func.repByLocal?.get(name)?.val
+    if (!vt) {
+      if (prev) valPoison.add(name)
+      updateRep(name, { val: undefined })
+      return
+    }
+    if (prev && prev !== vt) {
+      valPoison.add(name)
+      updateRep(name, { val: undefined })
+      return
+    }
+    updateRep(name, { val: vt })
+  }
   const getVal = name => ctx.func.repByLocal?.get(name)?.val
   // Pre-walk: observe Array<schema> facts so `const p = arr[i]` can bind a schemaId
   // on `p`, unlocking schema slot reads + skipping str_key dispatch on `.prop` access.
@@ -967,6 +1362,13 @@ export function analyzeValTypes(body) {
   for (const [name, vt] of facts.arrElemValTypes) {
     if (vt != null) updateRep(name, { arrayElemValType: vt })
   }
+  // Propagate body-observed array-elem schemas to repByLocal so analyzePtrUnboxable's
+  // `let p = arr[i]` rule (which only consults rep) sees the schema and can unbox `p`
+  // to an i32 offset. Without this, `arr.push({x,y,z})` followed by `arr[i].x` reads
+  // pay an i64.reinterpret/i32.wrap on every slot access (no aliasing → CSE can't fold).
+  for (const [name, sid] of arrElems) {
+    if (sid != null) updateRep(name, { arrayElemSchema: sid })
+  }
   // Resolve a name's array-elem-schema, preferring rep.arrayElemSchema (set from
   // paramReps[k].arrayElemSchema at emit start) over local body observations.
   const arrElemSchemaOf = (name) => {
@@ -979,20 +1381,42 @@ export function analyzeValTypes(body) {
   function trackRegex(name, rhs) {
     if (ctx.runtime.regex && Array.isArray(rhs) && rhs[0] === '//') ctx.runtime.regex.vars.set(name, rhs)
   }
+  // Names whose decls disagree on element ctor (e.g. two `let arr = ...` decls
+  // in different scopes — jz hoists `let` to function scope so they share a name).
+  // Once invalidated, no later setter can re-establish a definite ctor.
+  const typedPoison = new Set()
+  const invalidate = (name) => {
+    typedPoison.add(name)
+    ctx.types.typedElem?.delete(name)
+  }
   function trackTyped(name, rhs) {
     if (!ctx.types.typedElem) ctx.types.typedElem = new Map() // first use in this function scope
+    if (typedPoison.has(name)) return
+    const setOrInvalidate = (c) => {
+      if (c === MIXED_CTORS) return invalidate(name)
+      const prev = ctx.types.typedElem.get(name)
+      if (prev && prev !== c) invalidate(name)
+      else ctx.types.typedElem.set(name, c)
+    }
     const ctor = typedElemCtor(rhs)
-    if (ctor) { ctx.types.typedElem.set(name, ctor); return }
+    if (ctor) return setOrInvalidate(ctor)
     // TYPED-narrowed call result carries elem aux on f.sig.ptrAux — reverse-map it
     // back to a canonical ctor string so analyzePtrUnboxable's typedElemAux lookup
     // (compile.js) restores the same aux on the unboxed local's rep.
     if (Array.isArray(rhs) && rhs[0] === '()' && typeof rhs[1] === 'string') {
       const f = ctx.func.map?.get(rhs[1])
       if (f?.sig?.ptrKind === VAL.TYPED && f.sig.ptrAux != null) {
-        const ctor = ctorFromElemAux(f.sig.ptrAux)
-        if (ctor) ctx.types.typedElem.set(name, ctor)
+        const c = ctorFromElemAux(f.sig.ptrAux)
+        if (c) setOrInvalidate(c)
       }
+      return
     }
+    // Heterogeneous ternary (e.g. `n === 16 ? new Uint8Array(16) : new Uint16Array(8)`):
+    // typedElemCtor returns null for `?:`. When branches don't unify to the same ctor,
+    // poison the name so a later sibling-scope decl (jz hoists `let` to function scope)
+    // can't lock in the wrong store width.
+    const tc = ternaryCtorOfRhs(rhs)
+    if (tc) setOrInvalidate(tc)
   }
   function walk(node) {
     if (!Array.isArray(node)) return
@@ -1018,7 +1442,10 @@ export function analyzeValTypes(body) {
         const vt = valTypeOf(a[2])
         setVal(a[1], vt)
         if (vt === VAL.REGEX) trackRegex(a[1], a[2])
-        if (vt === VAL.TYPED || vt === VAL.BUFFER) trackTyped(a[1], a[2])
+        // VAL gate covers definite-typed RHS; `?:`/`&&`/`||` slip through valTypeOf
+        // returning null but may still need ctor unification (or poisoning when
+        // branches disagree, since jz hoists `let` to function scope).
+        if (vt === VAL.TYPED || vt === VAL.BUFFER || isCondExpr(a[2])) trackTyped(a[1], a[2])
         propagateTyped(a[1], a[2])
         // JSON-shape propagation. When the RHS resolves to a known JSON shape
         // (root: `JSON.parse(literal)`; nested: `o.meta`, `items[j]` from a known
@@ -1030,6 +1457,17 @@ export function analyzeValTypes(body) {
           updateRep(a[1], { jsonShape: sh })
           if (sh.vt === VAL.ARRAY && sh.elem?.vt) {
             updateRep(a[1], { arrayElemValType: sh.elem.vt })
+            // Array of fixed-shape OBJECTs: register elem schema so `it = items[j]`
+            // → `it.prop` lowers to slot read via the existing arr-elem-schema path.
+            if (sh.elem.vt === VAL.OBJECT && sh.elem.names && ctx.schema.register) {
+              const elemSid = ctx.schema.register(sh.elem.names)
+              updateRep(a[1], { arrayElemSchema: elemSid })
+            }
+          }
+          if (sh.vt === VAL.OBJECT && sh.names && ctx.schema.register) {
+            const sid = ctx.schema.register(sh.names)
+            updateRep(a[1], { schemaId: sid })
+            ctx.schema.vars.set(a[1], sid)
           }
         }
         // Propagate schemaId from a narrowed call result so subsequent valTypeOf
@@ -1055,11 +1493,13 @@ export function analyzeValTypes(body) {
       }
     }
     if (op === '=' && typeof args[0] === 'string') {
+      walk(args[1])
       const vt = valTypeOf(args[1])
       setVal(args[0], vt)
       if (vt === VAL.REGEX) trackRegex(args[0], args[1])
-      if (vt === VAL.TYPED || vt === VAL.BUFFER) trackTyped(args[0], args[1])
+      if (vt === VAL.TYPED || vt === VAL.BUFFER || isCondExpr(args[1])) trackTyped(args[0], args[1])
       propagateTyped(args[0], args[1])
+      return
     }
     // Track property assignments for auto-boxing: x.prop = val
     if (op === '=' && Array.isArray(args[0]) && args[0][0] === '.' && typeof args[0][1] === 'string') {
@@ -1163,15 +1603,19 @@ export function analyzeIntCertain(body) {
   for (const name of defs.keys()) intCertain.set(name, true)
 
   const isIntExpr = (expr) => {
-    if (typeof expr === 'number') return Number.isInteger(expr)
+    // -0 is integer-valued mathematically but i32 has no signed zero — must stay f64.
+    if (typeof expr === 'number') return Number.isInteger(expr) && !Object.is(expr, -0)
     if (typeof expr === 'boolean') return true
     if (typeof expr === 'string') return intCertain.get(expr) === true
     if (!Array.isArray(expr)) return false
+    // Statically evaluable to -0 (e.g. -1 * 0, 0 / -1) — i32 would lose the sign.
+    const sv = staticValue(expr)
+    if (sv !== NO_VALUE && typeof sv === 'number' && Object.is(sv, -0)) return false
     const [op, ...args] = expr
     if (op == null) {
       // `[, value]` / `[null, value]` literal form
       const v = args[0]
-      if (typeof v === 'number') return Number.isInteger(v)
+      if (typeof v === 'number') return Number.isInteger(v) && !Object.is(v, -0)
       if (typeof v === 'boolean') return true
       return false
     }
@@ -1228,11 +1672,19 @@ export function analyzeIntCertain(body) {
 export function exprType(expr, locals) {
   if (expr == null) return 'f64'
   if (typeof expr === 'number')
-    return Number.isInteger(expr) && expr >= -2147483648 && expr <= 2147483647 ? 'i32' : 'f64'
+    return Number.isInteger(expr) && expr >= -2147483648 && expr <= 2147483647 && !Object.is(expr, -0) ? 'i32' : 'f64'
   if (typeof expr === 'string') {
     if (locals?.has?.(expr)) return locals.get(expr)
     const paramType = ctx.func.current?.params?.find(p => p.name === expr)?.type
     if (paramType) return paramType
+    // Module-level numeric consts (top-level `const N = 128`) are emitted as
+    // wasm globals with a known wasm type. Without this lookup, references to
+    // them inside functions fall back to f64, widening counters bounded by the
+    // const (`for (let r = 0; r < N_ROUNDS; r++)`) to f64 via the comparison
+    // pass. Only propagate primitive numeric kinds — i64 globals are reserved
+    // for the NaN-box carrier ABI and shouldn't influence local typing.
+    const gt = ctx.scope?.globalTypes?.get?.(expr)
+    if (gt === 'i32' || gt === 'f64') return gt
     return 'f64'
   }
   if (!Array.isArray(expr)) return 'f64'
@@ -1240,8 +1692,26 @@ export function exprType(expr, locals) {
   const [op, ...args] = expr
   if (op == null) return exprType(args[0], locals) // literal [, value]
 
+  // Statically evaluable to -0 (e.g. -1 * 0) — i32 would lose the sign.
+  const sv = staticValue(expr)
+  if (sv !== NO_VALUE && typeof sv === 'number' && Object.is(sv, -0)) return 'f64'
+
   // Always f64
-  if (op === '/' || op === '**' || op === '[' || op === '[]' || op === '{}' || op === 'str') return 'f64'
+  if (op === '/' || op === '**' || op === '[' || op === '{}' || op === 'str') return 'f64'
+  // arr[i] — typed integer arrays return i32. Only Int8/Uint8/Int16/Uint16/Int32
+  // (every value fits in signed i32). Skip Uint32: 0..2^32-1 overflows signed.
+  // During analyzeBody the in-progress typedElems is in localTypedElemsOverlay;
+  // post-analyze passes read from ctx.types.typedElem.
+  if (op === '[]') {
+    if (typeof args[0] === 'string') {
+      const ctor = ctx.func.localTypedElemsOverlay?.get(args[0]) ?? ctx.types.typedElem?.get(args[0])
+      if (ctor) {
+        const aux = typedElemAux(ctor)
+        if (aux != null && (aux & 7) <= 4) return 'i32'
+      }
+    }
+    return 'f64'
+  }
   // `.length` on a known sized receiver returns i32 directly (__len/__str_byteLen
   // both return i32). Letting it stay i32 lets analyzeLocals keep the counter
   // local i32 too, eliminating the per-iteration `f64.convert_i32_s` widen and
@@ -1339,7 +1809,7 @@ export function analyzePtrUnboxable(body, locals, boxed) {
   const disqualified = new Set()
   const valOf = name => ctx.func.repByLocal?.get(name)?.val
 
-  const UNBOXABLE_KINDS = new Set([VAL.OBJECT, VAL.SET, VAL.MAP, VAL.BUFFER, VAL.TYPED, VAL.CLOSURE])
+  const UNBOXABLE_KINDS = new Set([VAL.OBJECT, VAL.SET, VAL.MAP, VAL.BUFFER, VAL.TYPED, VAL.CLOSURE, VAL.DATE])
 
   // RHS must produce a fresh, non-null pointer of the declared VAL kind.
   //   OBJECT  ← `{…}`
@@ -1376,6 +1846,7 @@ export function analyzePtrUnboxable(body, locals, boxed) {
       if (callee.startsWith('new.')) {
         if (kind === VAL.SET) return callee === 'new.Set'
         if (kind === VAL.MAP) return callee === 'new.Map'
+        if (kind === VAL.DATE) return callee === 'new.Date'
         if (kind === VAL.BUFFER) return callee === 'new.ArrayBuffer' || callee === 'new.DataView'
         if (kind === VAL.TYPED) return callee.endsWith('Array') && callee !== 'new.ArrayBuffer'
       }
@@ -1503,6 +1974,38 @@ export function collectParamNames(raw, out = new Set()) {
   return out
 }
 
+/** Observe shared AST facts on a single node (dyn, schema, arity).
+ *  Mutates `f`: { anyDyn, dynVars:Set, hasSchemaLiterals, maxDef, maxCall, hasRest, hasSpread }.
+ *  Used by both prepare.js walk and analyze.js walkFacts. */
+export function observeNodeFacts(node, f) {
+  if (!Array.isArray(node)) return
+  const [op, ...args] = node
+  if (op === '[]') {
+    const [obj, idx] = args
+    if (!isLiteralStr(idx)) { f.anyDyn = true; if (typeof obj === 'string') f.dynVars.add(obj) }
+  } else if (op === '=' && Array.isArray(args[0]) && args[0][0] === '[]') {
+    const [, obj, idx] = args[0]
+    if (!isLiteralStr(idx)) { f.anyDyn = true; if (typeof obj === 'string') f.dynVars.add(obj) }
+  } else if (op === 'for-in') {
+    f.anyDyn = true
+    if (typeof args[1] === 'string') f.dynVars.add(args[1])
+  } else if (op === '{}') {
+    f.hasSchemaLiterals = true
+  } else if (op === '=>') {
+    let fixedN = 0
+    for (const r of extractParams(args[0])) {
+      if (classifyParam(r).kind === 'rest') f.hasRest = true
+      else fixedN++
+    }
+    if (fixedN > f.maxDef) f.maxDef = fixedN
+  } else if (op === '()') {
+    const a = args[1]
+    const callArgs = a == null ? [] : (Array.isArray(a) && a[0] === ',') ? a.slice(1) : [a]
+    if (callArgs.some(x => Array.isArray(x) && x[0] === '...')) f.hasSpread = true
+    if (callArgs.length > f.maxCall) f.maxCall = callArgs.length
+  }
+}
+
 /** Find free variables in AST: referenced in node, not in `bound`, present in `scope`. */
 export function findFreeVars(node, bound, free, scope) {
   if (node == null) return
@@ -1567,7 +2070,6 @@ export function findMutations(node, names, mutated) {
 export function analyzeDynKeys(...roots) {
   const dynVars = new Set()
   let anyDyn = false
-  const isLiteralStr = idx => Array.isArray(idx) && idx[0] === 'str' && typeof idx[1] === 'string'
 
   function walk(node) {
     if (!Array.isArray(node)) return
@@ -1579,6 +2081,13 @@ export function analyzeDynKeys(...roots) {
         if (typeof obj === 'string') dynVars.add(obj)
       }
     }
+    if (op === '=' && Array.isArray(args[0]) && args[0][0] === '[]') {
+      const [, obj, idx] = args[0]
+      if (!isLiteralStr(idx)) {
+        anyDyn = true
+        if (typeof obj === 'string') dynVars.add(obj)
+      }
+    }
     // Runtime for-in (compile-time unroll didn't fire) → walks via shadow
     if (op === 'for-in') {
       anyDyn = true
@@ -1609,34 +2118,55 @@ export function analyzeBoxedCaptures(body) {
     const [op, ...args] = node
     if (op === '=>') return
     if (op === 'let' || op === 'const')
-      for (const a of args)
-        if (Array.isArray(a) && a[0] === '=' && typeof a[1] === 'string') outerScope.add(a[1])
+      collectParamNames(args, outerScope)
     for (const a of args) collectDecls(a)
   })(body)
   if (ctx.func.current?.params) for (const p of ctx.func.current.params) outerScope.add(p.name)
   if (ctx.func.locals) for (const k of ctx.func.locals.keys()) outerScope.add(k)
 
-  ;(function walk(node, assignTarget) {
+  const markArrowCaptures = (node, assignTarget, seen) => {
+    const pnode = node[1]
+    let p = pnode
+    if (Array.isArray(p) && p[0] === '()') p = p[1]
+    const raw = p == null ? [] : Array.isArray(p) ? (p[0] === ',' ? p.slice(1) : [p]) : [p]
+    const paramSet = new Set(raw.map(r => Array.isArray(r) && r[0] === '...' ? r[1] : r))
+    const captures = []
+    findFreeVars(node[2], paramSet, captures, outerScope)
+    if (captures.length === 0) return
+    const captureSet = new Set(captures)
+    const boxed = new Set()
+    findMutations(body, captureSet, boxed)
+    for (const v of captures) if (!seen.has(v)) boxed.add(v)
+    if (assignTarget && captureSet.has(assignTarget)) boxed.add(assignTarget)
+    for (const v of boxed) if (!ctx.func.boxed.has(v)) ctx.func.boxed.set(v, `${T}cell_${v}`)
+  }
+
+  ;(function walk(node, assignTarget, seen = new Set(ctx.func.current?.params?.map(p => p.name) || [])) {
     if (!Array.isArray(node)) return
     const [op, ...args] = node
     if (op === '=>') {
-      let p = args[0]
-      if (Array.isArray(p) && p[0] === '()') p = p[1]
-      const raw = p == null ? [] : Array.isArray(p) ? (p[0] === ',' ? p.slice(1) : [p]) : [p]
-      const paramSet = new Set(raw.map(r => Array.isArray(r) && r[0] === '...' ? r[1] : r))
-      const captures = []
-      findFreeVars(args[1], paramSet, captures, outerScope)
-      if (captures.length === 0) return
-      const captureSet = new Set(captures)
-      const mutated = new Set()
-      findMutations(body, captureSet, mutated)
-      if (assignTarget && captureSet.has(assignTarget)) mutated.add(assignTarget)
-      for (const v of mutated) if (!ctx.func.boxed.has(v)) ctx.func.boxed.set(v, `${T}cell_${v}`)
+      markArrowCaptures(node, assignTarget, seen)
       return
     }
+
+    if (op === ';' || op === '{}') {
+      const blockSeen = new Set(seen)
+      for (const a of args) walk(a, null, blockSeen)
+      return
+    }
+
+    if (op === 'let' || op === 'const') {
+      for (const decl of args) {
+        if (Array.isArray(decl) && decl[0] === '=') walk(decl[2], typeof decl[1] === 'string' ? decl[1] : null, seen)
+        else walk(decl, null, seen)
+        collectParamNames([decl], seen)
+      }
+      return
+    }
+
     if (op === '=' && typeof args[0] === 'string' && Array.isArray(args[1]) && args[1][0] === '=>')
-      return walk(args[1], args[0])
-    for (const a of args) walk(a)
+      return walk(args[1], args[0], seen)
+    for (const a of args) walk(a, null, seen)
   })(body)
 }
 
@@ -1750,56 +2280,24 @@ export function narrowReturnArrayElems(field, paramReps, valueUsed) {
 export function collectProgramFacts(ast) {
   const paramReps = new Map()
   const valueUsed = new Set()
-  const dynVars = new Set()
-  let anyDyn = false
   const propMap = new Map()
   const callSites = []
   const doSchema = ast && ctx.schema.register
   const doArity = !!ctx.closure.make
-  let hasSchemaLiterals = false
-  let maxDef = 0, maxCall = 0, hasRest = false, hasSpread = false
-  const isLiteralStr = idx => Array.isArray(idx) && idx[0] === 'str' && typeof idx[1] === 'string'
+  const f = { dynVars: new Set(), anyDyn: false, hasSchemaLiterals: false, maxDef: 0, maxCall: 0, hasRest: false, hasSpread: false }
   // Slot-type observation lives in the dedicated `observeProgramSlots` pass below;
   // walkFacts only registers schemas (which is local to the AST node).
   const walkFacts = (node, full, inArrow, callerFunc) => {
     if (!Array.isArray(node)) return
     const [op, ...args] = node
-    // dyn-key detection. Strict check deferred to emit time (e.g. `buf[i]` on a
-    // Float64Array uses typed-array load, not __dyn_get — only the actual
-    // dynamic-dispatch fallback should error in strict mode).
-    if (op === '[]') {
-      const [obj, idx] = args
-      if (!isLiteralStr(idx)) { anyDyn = true; if (typeof obj === 'string') dynVars.add(obj) }
-    } else if (op === 'for-in') {
-      if (ctx.transform.strict) err(`strict mode: \`for (... in ...)\` is not allowed (dynamic enumeration). Pass { strict: false } to enable.`)
-      anyDyn = true
-      if (typeof args[1] === 'string') dynVars.add(args[1])
-    }
-    // Object literal: register schema. Slot val-type observation is deferred to a
-    // second pass (observeSlotsIn below) so that shorthand `{x}` (expanded by prepare
-    // to `[':', x, x]`) resolves x's val type via per-function locals, not just globals.
+    // shared dyn/schema/arity facts (duplicated pattern synced with prepare.js)
+    observeNodeFacts(node, f)
+    // strict for-in check
+    if (op === 'for-in' && ctx.transform.strict) err(`strict mode: \`for (... in ...)\` is not allowed (dynamic enumeration). Pass { strict: false } to enable.`)
+    // schema registration (analyze-specific)
     if (op === '{}' && doSchema) {
       const parsed = staticObjectProps(args)
-      if (parsed) {
-        ctx.schema.register(parsed.names)
-        hasSchemaLiterals = true
-      }
-    }
-    // closure ABI arity
-    if (doArity) {
-      if (op === '=>') {
-        let fixedN = 0
-        for (const r of extractParams(args[0])) {
-          if (classifyParam(r).kind === 'rest') hasRest = true
-          else fixedN++
-        }
-        if (fixedN > maxDef) maxDef = fixedN
-      } else if (op === '()') {
-        const a = args[1]
-        const callArgs = a == null ? [] : (Array.isArray(a) && a[0] === ',') ? a.slice(1) : [a]
-        if (callArgs.some(x => Array.isArray(x) && x[0] === '...')) hasSpread = true
-        if (callArgs.length > maxCall) maxCall = callArgs.length
-      }
+      if (parsed) ctx.schema.register(parsed.names)
     }
     // Crossing into a closure body: from now on, no call-site collection (matches the
     // pre-fusion scanCalls bailing at '=>'). Still walks children for arity/dyn.
@@ -1817,26 +2315,22 @@ export function collectProgramFacts(ast) {
         }
       }
       // first-class function-value + static-call-site scan
-      if (op === '()' && typeof args[0] === 'string' && ctx.func.names.has(args[0])) {
+      if (op === '()' && isFuncRef(args[0], ctx.func.names)) {
         if (!inArrow) {
-          // Record call site for the type/schema fixpoint. Filtering by
-          // exported/raw/valueUsed happens later (valueUsed isn't fully populated yet).
-          // `node` is the call AST node itself; specializeBimorphicTyped mutates
-          // node[1] (the callee name) to point at a per-ctor clone.
           const a = args[1]
           const argList = a == null ? [] : (Array.isArray(a) && a[0] === ',') ? a.slice(1) : [a]
           callSites.push({ callee: args[0], argList, callerFunc, node })
         }
         for (let i = 1; i < args.length; i++) {
           const a = args[i]
-          if (typeof a === 'string' && ctx.func.names.has(a)) valueUsed.add(a)
+          if (isFuncRef(a, ctx.func.names)) valueUsed.add(a)
           else walkFacts(a, true, inArrow, callerFunc)
         }
         return
       }
-      if ((op === '.' || op === '?.') && typeof args[0] === 'string' && ctx.func.names.has(args[0])) return
+      if ((op === '.' || op === '?.') && isFuncRef(args[0], ctx.func.names)) return
       for (const a of args) {
-        if (typeof a === 'string' && ctx.func.names.has(a)) valueUsed.add(a)
+        if (isFuncRef(a, ctx.func.names)) valueUsed.add(a)
         else walkFacts(a, true, inArrow, callerFunc)
       }
     } else {
@@ -1848,16 +2342,16 @@ export function collectProgramFacts(ast) {
   const initFacts = ctx.module.initFacts
   if (initFacts) {
     if (initFacts.anyDyn) {
-      anyDyn = true
-      for (const v of initFacts.dynVars) dynVars.add(v)
+      f.anyDyn = true
+      for (const v of initFacts.dynVars) f.dynVars.add(v)
     }
     if (doArity) {
-      if (initFacts.maxDef > maxDef) maxDef = initFacts.maxDef
-      if (initFacts.maxCall > maxCall) maxCall = initFacts.maxCall
-      if (initFacts.hasRest) hasRest = true
-      if (initFacts.hasSpread) hasSpread = true
+      if (initFacts.maxDef > f.maxDef) f.maxDef = initFacts.maxDef
+      if (initFacts.maxCall > f.maxCall) f.maxCall = initFacts.maxCall
+      if (initFacts.hasRest) f.hasRest = true
+      if (initFacts.hasSpread) f.hasSpread = true
     }
-    if (doSchema && initFacts.hasSchemaLiterals) hasSchemaLiterals = true
+    if (doSchema && initFacts.hasSchemaLiterals) f.hasSchemaLiterals = true
   }
 
   // Slot-type observation pass: walk every `{}` literal with the right scope's
@@ -1866,12 +2360,12 @@ export function collectProgramFacts(ast) {
   // through valTypeOf → lookupValType. Skips into closures — they're observed via
   // their own func.list entry. The overlay is the per-function analyzeBody.valTypes
   // map (already populated with the same overlay-aware walk).
-  if (doSchema && hasSchemaLiterals) observeProgramSlots(ast)
+  if (doSchema && f.hasSchemaLiterals) observeProgramSlots(ast)
 
   return {
-    dynVars, anyDyn, propMap, valueUsed, callSites,
-    maxDef, maxCall, hasRest, hasSpread,
-    paramReps, hasSchemaLiterals,
+    dynVars: f.dynVars, anyDyn: f.anyDyn, propMap, valueUsed, callSites,
+    maxDef: f.maxDef, maxCall: f.maxCall, hasRest: f.hasRest, hasSpread: f.hasSpread,
+    paramReps, hasSchemaLiterals: f.hasSchemaLiterals,
   }
 }