jz 0.1.1 → 0.2.1

package/module/core.js

@@ -2,21 +2,22 @@
  * Core module — NaN-boxing, bump allocator, property dispatch.
  *
  * Foundation for all heap types. Every module depends on this.
- * NaN-boxing: quiet NaN (0x7FF8) + 51-bit payload [type:4][aux:15][offset:32]
+ * NaN-boxing: see LAYOUT in src/ctx.js for the canonical bit layout.
  *
  * Auto-included by array/object/string modules.
  *
  * @module core
  */
 
-import { typed, asF64, asI32, NULL_NAN, UNDEF_NAN, temp, usesDynProps, ptrOffsetIR, isNullish } from '../src/ir.js'
+import { typed, asF64, asI32, asI64, NULL_NAN, UNDEF_NAN, temp, usesDynProps, ptrOffsetIR, isNullish } from '../src/ir.js'
 import { emit } from '../src/emit.js'
-import { valTypeOf, lookupValType, VAL, T, repOf, updateRep } from '../src/analyze.js'
-import { err, inc, PTR } from '../src/ctx.js'
+import { valTypeOf, lookupValType, VAL, T, repOf, updateRep, shapeOf } from '../src/analyze.js'
+import { err, inc, PTR, LAYOUT } from '../src/ctx.js'
 import { initSchema } from './schema.js'
 import { strHashLiteral } from './collection.js'
 
-const NAN_PREFIX = 0x7FF8
+// Pre-shifted NaN prefix as a full i64 mask, for `(i64.const ${NAN_BITS})` use.
+const NAN_BITS = '0x' + LAYOUT.NAN_PREFIX_BITS.toString(16).toUpperCase().padStart(16, '0')
 
 const PTR_BY_VAL = {
   [VAL.ARRAY]: PTR.ARRAY,
@@ -36,91 +37,81 @@ export default (ctx) => {
     __typed_data: ['__ptr_offset', '__ptr_aux'],
     __ptr_offset: [],
     __is_str_key: ['__ptr_type'],
-    __str_len: ['__ptr_type', '__ptr_offset'],
+    __str_len: ['__ptr_type', '__ptr_offset', '__ptr_aux'],
     __set_len: [],
-    __length: () => {
-      const d = ['__ptr_type', '__ptr_offset', '__str_len', '__len']
-      if (ctx.features.sso) d.push('__ptr_aux')
-      return d
-    },
+    __length: ['__ptr_type', '__ptr_offset', '__str_len', '__len'],
     __typeof: ['__ptr_type', '__is_nullish'],
     __alloc_hdr: ['__alloc'],
   })
 
-  ctx.core.stdlib['__is_nullish'] = `(func $__is_nullish (param $v f64) (result i32)
+  ctx.core.stdlib['__is_nullish'] = `(func $__is_nullish (param $v i64) (result i32)
     (i32.or
-      (i64.eq (i64.reinterpret_f64 (local.get $v)) (i64.const ${NULL_NAN}))
-      (i64.eq (i64.reinterpret_f64 (local.get $v)) (i64.const ${UNDEF_NAN}))))`
+      (i64.eq (local.get $v) (i64.const ${NULL_NAN}))
+      (i64.eq (local.get $v) (i64.const ${UNDEF_NAN}))))`
 
-  ctx.core.stdlib['__eq'] = `(func $__eq (param $a f64) (param $b f64) (result i32)
-    (local $ra i64) (local $rb i64) (local $ta i32) (local $tb i32)
+  ctx.core.stdlib['__eq'] = `(func $__eq (param $a i64) (param $b i64) (result i32)
+    (local $fa f64) (local $fb f64) (local $ta i32) (local $tb i32)
     ;; Fast path: bit equality covers identical pointers AND interned/SSO strings (same content
     ;; → same bits). Failing universal-NaN test catches NaN===NaN→false. Saves the NaN-check
     ;; pair (4 f64.eq) on the hottest case in watr (op === 'literal-string').
-    (local.set $ra (i64.reinterpret_f64 (local.get $a)))
-    (local.set $rb (i64.reinterpret_f64 (local.get $b)))
-    (if (result i32) (i64.eq (local.get $ra) (local.get $rb))
-      (then (i64.ne (local.get $ra) (i64.const 0x7FF8000000000000)))
+    (if (result i32) (i64.eq (local.get $a) (local.get $b))
+      (then (i64.ne (local.get $a) (i64.const ${NAN_BITS})))
       (else
         ;; Bits differ. Numeric path covers -0/+0 and any normal numeric inequality.
+        (local.set $fa (f64.reinterpret_i64 (local.get $a)))
+        (local.set $fb (f64.reinterpret_i64 (local.get $b)))
         (if (result i32)
           (i32.and
-            (f64.eq (local.get $a) (local.get $a))
-            (f64.eq (local.get $b) (local.get $b)))
-          (then (f64.eq (local.get $a) (local.get $b)))
+            (f64.eq (local.get $fa) (local.get $fa))
+            (f64.eq (local.get $fb) (local.get $fb)))
+          (then (f64.eq (local.get $fa) (local.get $fb)))
           (else
-            ;; ≥1 is a NaN-box. Heap-allocated STRING with same content can have different
-            ;; offsets — fall through to byte-wise __str_eq.
-            (local.set $ta (i32.wrap_i64 (i64.and (i64.shr_u (local.get $ra) (i64.const 47)) (i64.const 0xF))))
-            (local.set $tb (i32.wrap_i64 (i64.and (i64.shr_u (local.get $rb) (i64.const 47)) (i64.const 0xF))))
+            ;; At least one operand is a NaN-box. Both STRING (heap or SSO) → __str_eq
+            ;; handles content compare and SSO fast-fail internally.
+            (local.set $ta (i32.wrap_i64 (i64.and (i64.shr_u (local.get $a) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
+            (local.set $tb (i32.wrap_i64 (i64.and (i64.shr_u (local.get $b) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
             (if (result i32)
               (i32.and
-                (i32.or
-                  (i32.eq (local.get $ta) (i32.const ${PTR.STRING}))
-                  (i32.eq (local.get $ta) (i32.const ${PTR.SSO})))
-                (i32.or
-                  (i32.eq (local.get $tb) (i32.const ${PTR.STRING}))
-                  (i32.eq (local.get $tb) (i32.const ${PTR.SSO}))))
+                (i32.eq (local.get $ta) (i32.const ${PTR.STRING}))
+                (i32.eq (local.get $tb) (i32.const ${PTR.STRING})))
               (then (call $__str_eq (local.get $a) (local.get $b)))
               (else (i32.const 0))))))))`
 
-  ctx.core.stdlib['__is_null'] = `(func $__is_null (param $v f64) (result i32)
-    (i64.eq (i64.reinterpret_f64 (local.get $v)) (i64.const ${NULL_NAN})))`
+  ctx.core.stdlib['__is_null'] = `(func $__is_null (param $v i64) (result i32)
+    (i64.eq (local.get $v) (i64.const ${NULL_NAN})))`
 
   // Truthy check: handles regular numbers AND NaN-boxed pointers
   // Falsy: 0, -0, NaN, null, undefined, "" (empty SSO)
-  ctx.core.stdlib['__is_truthy'] = `(func $__is_truthy (param $v f64) (result i32)
-    (local $bits i64)
-    (if (result i32) (f64.eq (local.get $v) (local.get $v))
-      (then (f64.ne (local.get $v) (f64.const 0)))
+  ctx.core.stdlib['__is_truthy'] = `(func $__is_truthy (param $v i64) (result i32)
+    (local $f f64)
+    (local.set $f (f64.reinterpret_i64 (local.get $v)))
+    (if (result i32) (f64.eq (local.get $f) (local.get $f))
+      (then (f64.ne (local.get $f) (f64.const 0)))
       (else
-        (local.set $bits (i64.reinterpret_f64 (local.get $v)))
         (i32.and
           (i32.and
-            (i64.ne (local.get $bits) (i64.const 0x7FF8000000000000))
-            (i64.ne (local.get $bits) (i64.const ${NULL_NAN})))
+            (i64.ne (local.get $v) (i64.const ${NAN_BITS}))
+            (i64.ne (local.get $v) (i64.const ${NULL_NAN})))
           (i32.and
-            (i64.ne (local.get $bits) (i64.const ${UNDEF_NAN}))
-            (i64.ne (local.get $bits) (i64.const 0x7FFA800000000000)))))))`
+            (i64.ne (local.get $v) (i64.const ${UNDEF_NAN}))
+            (i64.ne (local.get $v) (i64.const 0x7FFA400000000000)))))))`
 
-  ctx.core.stdlib['__is_str_key'] = `(func $__is_str_key (param $v f64) (result i32)
-    (local $t i32)
-    (if (result i32) (f64.eq (local.get $v) (local.get $v))
+  ctx.core.stdlib['__is_str_key'] = `(func $__is_str_key (param $v i64) (result i32)
+    (local $f f64)
+    (local.set $f (f64.reinterpret_i64 (local.get $v)))
+    (if (result i32) (f64.eq (local.get $f) (local.get $f))
       (then (i32.const 0))
       (else
-        (local.set $t (call $__ptr_type (local.get $v)))
-        (i32.or
-          (i32.eq (local.get $t) (i32.const ${PTR.STRING}))
-          (i32.eq (local.get $t) (i32.const ${PTR.SSO}))))))`
+        (i32.eq (call $__ptr_type (i64.reinterpret_f64 (local.get $f))) (i32.const ${PTR.STRING})))))`
 
 
   // Default dynamic-property helpers are harmless stubs. The collection module
   // overrides them with the real sidecar-property implementation.
-  ctx.core.stdlib['__dyn_get'] = `(func $__dyn_get (param $obj f64) (param $key f64) (result f64)
-    (f64.const nan:${UNDEF_NAN}))`
-  ctx.core.stdlib['__dyn_get_or'] = `(func $__dyn_get_or (param $obj f64) (param $key f64) (param $fallback f64) (result f64)
+  ctx.core.stdlib['__dyn_get'] = `(func $__dyn_get (param $obj i64) (param $key i64) (result i64)
+    (i64.const ${UNDEF_NAN}))`
+  ctx.core.stdlib['__dyn_get_or'] = `(func $__dyn_get_or (param $obj i64) (param $key i64) (param $fallback i64) (result i64)
     (local.get $fallback))`
-  ctx.core.stdlib['__dyn_set'] = `(func $__dyn_set (param $obj f64) (param $key f64) (param $val f64) (result f64)
+  ctx.core.stdlib['__dyn_set'] = `(func $__dyn_set (param $obj i64) (param $key i64) (param $val i64) (result i64)
     (local.get $val))`
   ctx.core.stdlib['__dyn_move'] = `(func $__dyn_move (param $oldOff i32) (param $newOff i32))`
 
@@ -130,22 +121,22 @@ export default (ctx) => {
 
   ctx.core.stdlib['__mkptr'] = `(func $__mkptr (param $type i32) (param $aux i32) (param $offset i32) (result f64)
     (f64.reinterpret_i64 (i64.or
-      (i64.shl (i64.const ${NAN_PREFIX}) (i64.const 48))
+      (i64.const ${NAN_BITS})
       (i64.or
-        (i64.shl (i64.and (i64.extend_i32_u (local.get $type)) (i64.const 0xF)) (i64.const 47))
+        (i64.shl (i64.and (i64.extend_i32_u (local.get $type)) (i64.const ${LAYOUT.TAG_MASK})) (i64.const ${LAYOUT.TAG_SHIFT}))
         (i64.or
-          (i64.shl (i64.and (i64.extend_i32_u (local.get $aux)) (i64.const 0x7FFF)) (i64.const 32))
-          (i64.and (i64.extend_i32_u (local.get $offset)) (i64.const 0xFFFFFFFF)))))))`
+          (i64.shl (i64.and (i64.extend_i32_u (local.get $aux)) (i64.const ${LAYOUT.AUX_MASK})) (i64.const ${LAYOUT.AUX_SHIFT}))
+          (i64.and (i64.extend_i32_u (local.get $offset)) (i64.const ${LAYOUT.OFFSET_MASK})))))))`
 
-  ctx.core.stdlib['__ptr_offset'] = `(func $__ptr_offset (param $ptr f64) (result i32)
+  ctx.core.stdlib['__ptr_offset'] = `(func $__ptr_offset (param $ptr i64) (result i32)
     (local $bits i64) (local $off i32)
-    (local.set $bits (i64.reinterpret_f64 (local.get $ptr)))
-    (local.set $off (i32.wrap_i64 (i64.and (local.get $bits) (i64.const 0xFFFFFFFF))))
+    (local.set $bits (local.get $ptr))
+    (local.set $off (i32.wrap_i64 (i64.and (local.get $bits) (i64.const ${LAYOUT.OFFSET_MASK}))))
     ;; Arrays can be reallocated during growth; follow forwarding pointer (cap=-1 sentinel).
     ;; Bounds are checked inside the loop so non-array ptrs skip them entirely, and well-formed
     ;; ARRAY ptrs without forwarding still pay only one bounds check before the cap load.
     (if (i32.eq
-          (i32.wrap_i64 (i64.and (i64.shr_u (local.get $bits) (i64.const 47)) (i64.const 0xF)))
+          (i32.wrap_i64 (i64.and (i64.shr_u (local.get $bits) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK})))
           (i32.const ${PTR.ARRAY}))
       (then
         (block $done
@@ -157,14 +148,19 @@ export default (ctx) => {
             (br $follow)))))
     (local.get $off))`
 
-  ctx.core.stdlib['__ptr_aux'] = `(func $__ptr_aux (param $ptr f64) (result i32)
-    (i32.wrap_i64 (i64.and (i64.shr_u (i64.reinterpret_f64 (local.get $ptr)) (i64.const 32)) (i64.const 0x7FFF))))`
+  ctx.core.stdlib['__ptr_aux'] = `(func $__ptr_aux (param $ptr i64) (result i32)
+    (i32.wrap_i64 (i64.and (i64.shr_u (local.get $ptr) (i64.const ${LAYOUT.AUX_SHIFT})) (i64.const ${LAYOUT.AUX_MASK}))))`
 
-  ctx.core.stdlib['__ptr_type'] = `(func $__ptr_type (param $ptr f64) (result i32)
-    (i32.wrap_i64 (i64.and (i64.shr_u (i64.reinterpret_f64 (local.get $ptr)) (i64.const 47)) (i64.const 0xF))))`
+  ctx.core.stdlib['__ptr_type'] = `(func $__ptr_type (param $ptr i64) (result i32)
+    (i32.wrap_i64 (i64.and (i64.shr_u (local.get $ptr) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))`
 
   // === Bump allocator ===
 
+  // Heap-base watermark: gates header-backed propsPtr fast paths so static-data
+  // OBJECT slots (offsets < heap base) don't misread arbitrary memory at off-16.
+  // Updated by optimizeModule() when data segment exceeds 1024 bytes.
+  ctx.scope.globals.set('__heap_start', '(global $__heap_start (mut i32) (i32.const 1024))')
+
   if (ctx.memory.shared) {
     // Shared memory: heap offset stored at memory[1020] (i32), just before heap start at 1024
     ctx.core.stdlib['__alloc'] = `(func $__alloc (param $bytes i32) (result i32)
@@ -172,7 +168,7 @@ export default (ctx) => {
       (local.set $ptr (i32.load (i32.const 1020)))
       (i32.store (i32.const 1020) (i32.and (i32.add (i32.add (local.get $ptr) (local.get $bytes)) (i32.const 7)) (i32.const -8)))
       (local.get $ptr))`
-    ctx.core.stdlib['__reset'] = `(func $__reset
+    ctx.core.stdlib['__clear'] = `(func $__clear
       (i32.store (i32.const 1020) (i32.const 1024)))`
   } else {
     // Own memory: heap offset in a global, auto-grow when needed
@@ -189,7 +185,7 @@ export default (ctx) => {
           (i32.const -1)) (then (unreachable)))))
       (global.set $__heap (local.get $next))
       (local.get $ptr))`
-    ctx.core.stdlib['__reset'] = `(func $__reset
+    ctx.core.stdlib['__clear'] = `(func $__clear
       (global.set $__heap (i32.const 1024)))`
   }
 
@@ -211,7 +207,7 @@ export default (ctx) => {
         (else (i32.shr_u (local.get $et) (i32.const 1)))))))`
 
   // Real data address for any TYPED ptr: owned → offset, view → [offset+4].
-  ctx.core.stdlib['__typed_data'] = `(func $__typed_data (param $ptr f64) (result i32)
+  ctx.core.stdlib['__typed_data'] = `(func $__typed_data (param $ptr i64) (result i32)
     (local $off i32)
     (local.set $off (call $__ptr_offset (local.get $ptr)))
     (if (result i32) (i32.and (call $__ptr_aux (local.get $ptr)) (i32.const 8))
@@ -220,11 +216,11 @@ export default (ctx) => {
 
   // Hot (~85M calls in watr self-host). Type/offset extraction inlined; forwarding
   // loop only entered for ARRAY. ARRAY fast path dominates (nodes?.length, out.length …).
-  ctx.core.stdlib['__len'] = `(func $__len (param $ptr f64) (result i32)
+  ctx.core.stdlib['__len'] = `(func $__len (param $ptr i64) (result i32)
     (local $bits i64) (local $t i32) (local $off i32) (local $aux i32)
-    (local.set $bits (i64.reinterpret_f64 (local.get $ptr)))
-    (local.set $t (i32.wrap_i64 (i64.and (i64.shr_u (local.get $bits) (i64.const 47)) (i64.const 0xF))))
-    (local.set $off (i32.wrap_i64 (i64.and (local.get $bits) (i64.const 0xFFFFFFFF))))
+    (local.set $bits (local.get $ptr))
+    (local.set $t (i32.wrap_i64 (i64.and (i64.shr_u (local.get $bits) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
+    (local.set $off (i32.wrap_i64 (i64.and (local.get $bits) (i64.const ${LAYOUT.OFFSET_MASK}))))
     ;; ARRAY fast path: follow forwarding inline, then load len at off-8.
     (if (result i32)
       (i32.and (i32.eq (local.get $t) (i32.const 1)) (i32.ge_u (local.get $off) (i32.const 8)))
@@ -248,16 +244,16 @@ export default (ctx) => {
           (then
             (if (result i32) (i32.eq (local.get $t) (i32.const 3))
               (then
-                (local.set $aux (i32.wrap_i64 (i64.and (i64.shr_u (local.get $bits) (i64.const 32)) (i64.const 0x7FFF))))
+                (local.set $aux (i32.wrap_i64 (i64.and (i64.shr_u (local.get $bits) (i64.const ${LAYOUT.AUX_SHIFT})) (i64.const ${LAYOUT.AUX_MASK}))))
                 (if (result i32) (i32.and (local.get $aux) (i32.const 8))
                   (then (i32.shr_u (i32.load (local.get $off))
                                    (call $__typed_shift (i32.and (local.get $aux) (i32.const 7)))))
                   (else (i32.shr_u (i32.load (i32.sub (local.get $off) (i32.const 8)))
-                                   (call $__typed_shift (local.get $aux))))))
+                                   (call $__typed_shift (i32.and (local.get $aux) (i32.const 7)))))))
               (else (i32.load (i32.sub (local.get $off) (i32.const 8))))))
           (else (i32.const 0))))))`
 
-  ctx.core.stdlib['__cap'] = `(func $__cap (param $ptr f64) (result i32)
+  ctx.core.stdlib['__cap'] = `(func $__cap (param $ptr i64) (result i32)
     (local $t i32) (local $off i32) (local $aux i32)
     (local.set $t (call $__ptr_type (local.get $ptr)))
     (local.set $off (call $__ptr_offset (local.get $ptr)))
@@ -279,28 +275,30 @@ export default (ctx) => {
               (then (i32.shr_u (i32.load (local.get $off))
                                (call $__typed_shift (i32.and (local.get $aux) (i32.const 7)))))
               (else (i32.shr_u (i32.load (i32.sub (local.get $off) (i32.const 4)))
-                               (call $__typed_shift (local.get $aux))))))
+                               (call $__typed_shift (i32.and (local.get $aux) (i32.const 7)))))))
           (else (i32.load (i32.sub (local.get $off) (i32.const 4))))))
       (else (i32.const 0))))`
 
-  // String (heap): [-4:len(i32)][chars...]
-  ctx.core.stdlib['__str_len'] = `(func $__str_len (param $ptr f64) (result i32)
-    (local $off i32)
+  // String length (UTF-8 byte count). Heap: [-4:len(i32)][chars...]; SSO: aux & 7.
+  ctx.core.stdlib['__str_len'] = `(func $__str_len (param $ptr i64) (result i32)
+    (local $off i32) (local $aux i32)
+    (if (i32.ne (call $__ptr_type (local.get $ptr)) (i32.const ${PTR.STRING}))
+      (then (return (i32.const 0))))
+    (local.set $aux (call $__ptr_aux (local.get $ptr)))
+    (if (i32.and (local.get $aux) (i32.const ${LAYOUT.SSO_BIT}))
+      (then (return (i32.and (local.get $aux) (i32.const 7)))))
     (local.set $off (call $__ptr_offset (local.get $ptr)))
-    (if (result i32)
-      (i32.and
-        (i32.eq (call $__ptr_type (local.get $ptr)) (i32.const ${PTR.STRING}))
-        (i32.ge_u (local.get $off) (i32.const 4)))
+    (if (result i32) (i32.ge_u (local.get $off) (i32.const 4))
       (then (i32.load (i32.sub (local.get $off) (i32.const 4))))
       (else (i32.const 0))))`
 
   // Set len in memory (for push/pop). Hot (~42M calls in watr self-host).
   // Type/offset extraction inlined; forwarding loop only entered for ARRAY.
-  ctx.core.stdlib['__set_len'] = `(func $__set_len (param $ptr f64) (param $len i32)
+  ctx.core.stdlib['__set_len'] = `(func $__set_len (param $ptr i64) (param $len i32)
     (local $bits i64) (local $t i32) (local $off i32)
-    (local.set $bits (i64.reinterpret_f64 (local.get $ptr)))
-    (local.set $t (i32.wrap_i64 (i64.and (i64.shr_u (local.get $bits) (i64.const 47)) (i64.const 0xF))))
-    (local.set $off (i32.wrap_i64 (i64.and (local.get $bits) (i64.const 0xFFFFFFFF))))
+    (local.set $bits (local.get $ptr))
+    (local.set $t (i32.wrap_i64 (i64.and (i64.shr_u (local.get $bits) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
+    (local.set $off (i32.wrap_i64 (i64.and (local.get $bits) (i64.const ${LAYOUT.OFFSET_MASK}))))
     ;; Only ARRAY (1), TYPED (3), HASH (7), SET (8), MAP (9) carry an 8-byte header.
     ;; Of those, only ARRAY can be forwarded — follow the chain inline.
     (if
@@ -322,20 +320,25 @@ export default (ctx) => {
                 (br $follow)))))
         (i32.store (i32.sub (local.get $off) (i32.const 8)) (local.get $len)))))`
 
-  // Alloc header(8) + data(cap*stride), store len+cap, return data offset (past header)
+  // Alloc header(16) + data(cap*stride). Layout: [propsPtr@-16(f64=0), len@-8, cap@-4],
+  // data starts at returned offset. propsPtr at -16 holds a per-object dynamic-property hash
+  // (NaN-boxed PTR.HASH) for ARRAY/HASH/MAP/SET; 0 means "no dyn props yet". This lets
+  // __dyn_get_t / __dyn_set sidestep the global __dyn_props lookup on the hot path.
+  // Read offsets relative to the returned data ptr stay unchanged (-8 len, -4 cap).
   ctx.core.stdlib['__alloc_hdr'] = `(func $__alloc_hdr (param $len i32) (param $cap i32) (param $stride i32) (result i32)
     (local $ptr i32)
-    (local.set $ptr (call $__alloc (i32.add (i32.const 8) (i32.mul (local.get $cap) (local.get $stride)))))
-    (i32.store (local.get $ptr) (local.get $len))
-    (i32.store (i32.add (local.get $ptr) (i32.const 4)) (local.get $cap))
-    (i32.add (local.get $ptr) (i32.const 8)))`
+    (local.set $ptr (call $__alloc (i32.add (i32.const 16) (i32.mul (local.get $cap) (local.get $stride)))))
+    (i64.store (local.get $ptr) (i64.const 0))
+    (i32.store (i32.add (local.get $ptr) (i32.const 8)) (local.get $len))
+    (i32.store (i32.add (local.get $ptr) (i32.const 12)) (local.get $cap))
+    (i32.add (local.get $ptr) (i32.const 16)))`
 
   // Allocator + exports are deferred: only included when memory is actually needed.
   // Any module using allocPtr/inc('__alloc') pulls these in via ctx.core.stdlibDeps.
-  // compile.js emits _alloc/_reset exports + memory section only when __alloc is in includes.
+  // compile.js emits _alloc/_clear exports + memory section only when __alloc is in includes.
   ctx.core._allocRawFuncs = [
     '(func (export "_alloc") (param $bytes i32) (result i32) (call $__alloc (local.get $bytes)))',
-    '(func (export "_reset") (call $__reset))',
+    '(func (export "_clear") (call $__clear))',
   ]
 
   // Not-nullish check: f64 WAT node is neither NULL_NAN nor UNDEF_NAN.
@@ -343,11 +346,12 @@ export default (ctx) => {
   // apply — otherwise this would always emit a __is_nullish call even for provable cases.
   const notNullish = v => ['i32.eqz', isNullish(v)]
 
-  // Optional-chain wrapper: eval guard, if non-nullish emit access, else NULL_NAN.
+  // Optional-chain wrapper: eval guard, if non-nullish emit access, else `undefined`.
+  // Per spec, `null?.a` and `undefined?.a` both short-circuit to undefined, not null.
   const emitNullishGuarded = (guard, access) => typed(['if', ['result', 'f64'],
     notNullish(guard),
     ['then', access],
-    ['else', ['f64.const', `nan:${NULL_NAN}`]]], 'f64')
+    ['else', ['f64.const', `nan:${UNDEF_NAN}`]]], 'f64')
 
   // === Shared dispatch helpers ===
 
@@ -362,11 +366,11 @@ export default (ctx) => {
       return typed(['f64.convert_i32_s', ['i32.load', ['i32.sub', off, ['i32.const', 8]]]], 'f64')
     }
     if (vt === VAL.TYPED)
-      return typed(['f64.convert_i32_s', ['call', '$__len', va]], 'f64')
+      return typed(['f64.convert_i32_s', ['call', '$__len', ['i64.reinterpret_f64', va]]], 'f64')
     // Known string → byteLen (handles SSO + heap)
     if (vt === VAL.STRING) {
       inc('__str_byteLen')
-      return typed(['f64.convert_i32_s', ['call', '$__str_byteLen', va]], 'f64')
+      return typed(['f64.convert_i32_s', ['call', '$__str_byteLen', ['i64.reinterpret_f64', va]]], 'f64')
     }
     // Unknown → runtime dispatch via stdlib. Set/Map dispatch arms are pulled
     // only when user code actually constructs Set/Map (collection.js sets the
@@ -375,7 +379,7 @@ export default (ctx) => {
     // commonly passed from JS via jz.memory.* without an in-program constructor.
     inc('__length')
     ctx.features.typedarray = true
-    return typed(['call', '$__length', va], 'f64')
+    return typed(['call', '$__length', ['i64.reinterpret_f64', va]], 'f64')
   }
 
   // Known-schema fields live in the object payload. Dynamic sidecars are only
@@ -389,8 +393,8 @@ export default (ctx) => {
 
   function emitHashGetLocalConst(base, key, prop) {
     inc('__hash_get_local_h')
-    const receiver = base?.type ? asF64(base) : typed(base, 'f64')
-    return typed(['call', '$__hash_get_local_h', receiver, key, ['i32.const', strHashLiteral(prop)]], 'f64')
+    const receiver = asI64(base?.type ? base : typed(base, 'f64'))
+    return typed(['f64.reinterpret_i64', ['call', '$__hash_get_local_h', receiver, key, ['i32.const', strHashLiteral(prop)]]], 'f64')
   }
 
   function emitTypeTag(receiver, vt) {
@@ -402,20 +406,82 @@ export default (ctx) => {
 
   function emitDynGetExprTyped(base, key, vt) {
     inc('__dyn_get_expr_t')
-    const receiver = base?.type ? asF64(base) : typed(base, 'f64')
-    return typed(['call', '$__dyn_get_expr_t', receiver, key, emitTypeTag(receiver, vt)], 'f64')
+    const receiver = asI64(base?.type ? base : typed(base, 'f64'))
+    return typed(['f64.reinterpret_i64', ['call', '$__dyn_get_expr_t', receiver, key, emitTypeTag(receiver, vt)]], 'f64')
   }
 
   function emitDynGetAnyTyped(base, key, vt) {
     inc('__dyn_get_any_t')
-    const receiver = base?.type ? asF64(base) : typed(base, 'f64')
-    return typed(['call', '$__dyn_get_any_t', receiver, key, emitTypeTag(receiver, vt)], 'f64')
+    const receiver = asI64(base?.type ? base : typed(base, 'f64'))
+    return typed(['f64.reinterpret_i64', ['call', '$__dyn_get_any_t', receiver, key, emitTypeTag(receiver, vt)]], 'f64')
+  }
+
+  // Walk an AST expression that may resolve to an OBJECT literal at compile
+  // time. Returns the literal `['{}', ...]` node, or null. Handles direct
+  // literals and `.prop` chains over them. Spread props are unsupported —
+  // they shift slot positions and would need their own resolution.
+  function literalAst(obj) {
+    if (Array.isArray(obj) && obj[0] === '{}') {
+      // Bail on spreads — they change effective slot ordering.
+      const props = obj.slice(1)
+      const flat = props.length === 1 && Array.isArray(props[0]) && props[0][0] === ','
+        ? props[0].slice(1) : props
+      for (const p of flat) if (Array.isArray(p) && p[0] === '...') return null
+      return obj
+    }
+    if (Array.isArray(obj) && obj[0] === '.' && typeof obj[2] === 'string') {
+      const inner = literalAst(obj[1])
+      if (!inner) return null
+      const innerProps = inner.slice(1)
+      const innerFlat = innerProps.length === 1 && Array.isArray(innerProps[0]) && innerProps[0][0] === ','
+        ? innerProps[0].slice(1) : innerProps
+      for (const p of innerFlat) {
+        if (Array.isArray(p) && p[0] === ':' && p[1] === obj[2]) return literalAst(p[2])
+      }
+    }
+    return null
+  }
+
+  // Slot index of `prop` within a literal-resolved expression, or -1.
+  function literalSlot(obj, prop) {
+    const lit = literalAst(obj)
+    if (!lit) return -1
+    const props = lit.slice(1)
+    const flat = props.length === 1 && Array.isArray(props[0]) && props[0][0] === ','
+      ? props[0].slice(1) : props
+    for (let i = 0; i < flat.length; i++) {
+      const p = flat[i]
+      if (Array.isArray(p) && p[0] === ':' && p[1] === prop) return i
+    }
+    return -1
   }
 
   /** Emit .prop access for a WASM f64 node using schema or HASH fallback. */
   function emitPropAccess(va, obj, prop) {
-    const schemaIdx = typeof obj === 'string' ? ctx.schema.find(obj, prop) : ctx.schema.find(null, prop)
-    const key = asF64(emit(['str', prop]))
+    // Anonymous-literal fast path: when `obj` resolves at compile time to an
+    // object literal `{...}` (either directly, or through a `.prop` chain
+    // walked back to one), use the literal's slot index instead of falling
+    // through to `__dyn_get_expr`. Fresh OBJECT literals carry no off-16
+    // propsPtr so the dispatcher reads NULL_NAN. The varName-bound path
+    // (`let o = {a:1}; o.a`) already works via `ctx.schema.idOf(varName)`;
+    // this extends the same shape resolution to `({a:1}).a` and chains like
+    // `({a:{b:1}}).a.b` where the receiver is anonymous. Spread sources
+    // (`{...x}`) shift slot ordering and would need their own resolution.
+    const slot = literalSlot(obj, prop)
+    if (slot >= 0) return emitSchemaSlotRead(asF64(va), slot)
+    let schemaIdx = typeof obj === 'string' ? ctx.schema.find(obj, prop) : ctx.schema.find(null, prop)
+    // Chain receiver (e.g. `o.meta.bias`): when the chain resolves to a known
+    // OBJECT shape via JSON-shape propagation, the parent shape's `names`
+    // gives the slot directly. Avoids the structural ambiguity of
+    // ctx.schema.find(null, prop) when multiple registered schemas share a key.
+    if (schemaIdx < 0 && typeof obj !== 'string') {
+      const sh = shapeOf(obj)
+      if ((sh?.vt === VAL.OBJECT || sh?.vt === VAL.HASH) && sh.names) {
+        const i = sh.names.indexOf(prop)
+        if (i >= 0) schemaIdx = i
+      }
+    }
+    const key = asI64(emit(['str', prop]))
     if (schemaIdx >= 0) return emitSchemaSlotRead(asF64(va), schemaIdx)
     if (typeof obj === 'string') {
       const vt = lookupValType(obj)
@@ -425,12 +491,21 @@ export default (ctx) => {
       if (vt === VAL.HASH) {
         return emitHashGetLocalConst(va, key, prop)
       }
+      // OBJECT off-schema prop: __dyn_get_expr_t reads the per-OBJECT propsPtr
+      // at off-16 (set by __dyn_set). __hash_get assumes HASH bucket layout
+      // and would mis-read OBJECT memory.
+      if (vt === VAL.OBJECT) {
+        return emitDynGetExprTyped(va, key, vt)
+      }
       if (vt == null) {
+        // In WASI mode, values are always JSON-derived (never PTR.EXTERNAL host objects).
+        // Skip the external branch and dispatch through the typed HASH/OBJECT path.
+        if (ctx.transform.host === 'wasi') return emitDynGetExprTyped(va, key, vt)
         ctx.features.external = true
         return emitDynGetAnyTyped(va, key, vt)
       }
       inc('__hash_get', '__str_hash', '__str_eq')
-      return typed(['call', '$__hash_get', asF64(va), key], 'f64')
+      return typed(['f64.reinterpret_i64', ['call', '$__hash_get', asI64(va), key]], 'f64')
     }
     // Non-string receiver: route through HASH fast path when valTypeOf can
     // resolve the chain to a known HASH (e.g. `o.meta.bias` where `o.meta` is
@@ -440,13 +515,13 @@ export default (ctx) => {
       return emitHashGetLocalConst(va, key, prop)
     }
     inc('__dyn_get_expr')
-    return typed(['call', '$__dyn_get_expr', asF64(va), key], 'f64')
+    return typed(['f64.reinterpret_i64', ['call', '$__dyn_get_expr', asI64(va), key]], 'f64')
   }
 
   // Runtime .length dispatch — factory elides branches for types that can't exist in
   // this program (features.* + hash-stdlib presence). ARRAY is always live; STRING and
-  // number are always dispatched. SSO branch elided when features.sso is off. The __len
-  // disjunction collapses to whichever of ARRAY/TYPED/HASH/SET/MAP are reachable.
+  // number are always dispatched. The __len disjunction collapses to whichever of
+  // ARRAY/TYPED/HASH/SET/MAP are reachable. STRING covers both heap and SSO via __str_len.
   ctx.core.stdlib['__length'] = () => {
     const types = [PTR.ARRAY]
     if (ctx.features.typedarray) types.push(PTR.TYPED)
@@ -464,24 +539,17 @@ export default (ctx) => {
                   (else (f64.const nan:${UNDEF_NAN}))))
               (else (f64.const nan:${UNDEF_NAN})))`
     const stringArm = `(if (result f64) (i32.eq (local.get $t) (i32.const ${PTR.STRING}))
-            (then
-              (if (result f64) (i32.ge_u (local.get $off) (i32.const 4))
-                (then (f64.convert_i32_s (call $__str_len (local.get $v))))
-                (else (f64.const nan:${UNDEF_NAN}))))
+            (then (f64.convert_i32_s (call $__str_len (local.get $v))))
             (else ${lenArm}))`
-    const afterNumber = ctx.features.sso
-      ? `(if (result f64) (i32.eq (local.get $t) (i32.const ${PTR.SSO}))
-          (then (f64.convert_i32_s (call $__ptr_aux (local.get $v))))
-          (else ${stringArm}))`
-      : stringArm
-    return `(func $__length (param $v f64) (result f64)
-    (local $t i32) (local $off i32)
-    (if (result f64) (f64.eq (local.get $v) (local.get $v))
+    return `(func $__length (param $v i64) (result f64)
+    (local $f f64) (local $t i32) (local $off i32)
+    (local.set $f (f64.reinterpret_i64 (local.get $v)))
+    (if (result f64) (f64.eq (local.get $f) (local.get $f))
       (then (f64.const nan:${UNDEF_NAN}))
       (else
         (local.set $t (call $__ptr_type (local.get $v)))
         (local.set $off (call $__ptr_offset (local.get $v)))
-        ${afterNumber})))`
+        ${stringArm})))`
   }
 
   // === Property dispatch (.length, .prop) ===
@@ -491,7 +559,7 @@ export default (ctx) => {
     if (typeof obj === 'string' && ctx.schema.isBoxed(obj)) {
       if (prop === 'length') {
         const inner = ctx.schema.emitInner(obj)
-        return typed(['f64.convert_i32_s', ['call', '$__len', inner]], 'f64')
+        return typed(['f64.convert_i32_s', ['call', '$__len', ['i64.reinterpret_f64', inner]]], 'f64')
       }
       const idx = ctx.schema.find(obj, prop)
       if (idx >= 0) return emitSchemaSlotRead(asF64(emit(obj)), idx)
@@ -518,6 +586,12 @@ export default (ctx) => {
           return typed(['f64.convert_i32_s', lenI32], 'f64')
         }
       }
+      // String literal: fold to its UTF-8 byte length. jz strings are stored as
+      // UTF-8 and __str_byteLen returns byte count, so this matches the runtime
+      // semantics. Skips the call + NaN-unbox round-trip entirely.
+      if (Array.isArray(obj) && (obj[0] === 'str' || obj[0] == null) && typeof obj[1] === 'string') {
+        return typed(['f64.const', Buffer.byteLength(obj[1], 'utf8')], 'f64')
+      }
       const vt = typeof obj === 'string' ? repOf(obj)?.val : valTypeOf(obj)
       return emitLengthAccess(asF64(emit(obj)), vt)
     }
@@ -544,21 +618,25 @@ export default (ctx) => {
         if (typeof obj === 'string') {
           const objType = lookupValType(obj)
           if (usesDynProps(objType)) {
-            access = emitDynGetExprTyped(['local.get', `$${t}`], asF64(emit(['str', prop])), objType)
+            access = emitDynGetExprTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), objType)
           } else if (objType === VAL.HASH) {
-            access = emitHashGetLocalConst(['local.get', `$${t}`], asF64(emit(['str', prop])), prop)
+            access = emitHashGetLocalConst(['local.get', `$${t}`], asI64(emit(['str', prop])), prop)
           } else if (objType == null) {
-            ctx.features.external = true
-            access = emitDynGetAnyTyped(['local.get', `$${t}`], asF64(emit(['str', prop])), objType)
+            // Unknown receiver — in WASI mode use typed dispatch (no PTR.EXTERNAL values).
+            // In JS host mode use __dyn_get_any_t but don't force features.external here
+            // since ?.prop short-circuits on nullish (EXTERNAL arm is dead unless already on).
+            access = ctx.transform.host === 'wasi'
+              ? emitDynGetExprTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), objType)
+              : emitDynGetAnyTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), objType)
           } else {
             inc('__hash_get', '__str_hash', '__str_eq')
-            access = ['call', '$__hash_get', ['local.get', `$${t}`], asF64(emit(['str', prop]))]
+            access = ['f64.reinterpret_i64', ['call', '$__hash_get', ['i64.reinterpret_f64', ['local.get', `$${t}`]], asI64(emit(['str', prop]))]]
           }
         } else {
           if (valTypeOf(obj) === VAL.HASH) {
-            access = emitHashGetLocalConst(['local.get', `$${t}`], asF64(emit(['str', prop])), prop)
+            access = emitHashGetLocalConst(['local.get', `$${t}`], asI64(emit(['str', prop])), prop)
           } else {
-            access = emitDynGetExprTyped(['local.get', `$${t}`], asF64(emit(['str', prop])), valTypeOf(obj))
+            access = emitDynGetExprTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), valTypeOf(obj))
           }
         }
       }
@@ -583,6 +661,22 @@ export default (ctx) => {
 
   // Optional call: fn?.(...args) → null if fn is null, else call fn
   ctx.core.emit['?.()'] = (callee, ...args) => {
+    // Method-reference callee: `recv.m(...)` or `recv?.m(...)` form. Methods are
+    // statically registered emitters and aren't real closure values, so route them
+    // as a direct method call. The outer optional short-circuits when the receiver
+    // is nullish — the method itself is statically known to exist.
+    if (Array.isArray(callee) && (callee[0] === '.' || callee[0] === '?.') && typeof callee[2] === 'string') {
+      const methodEmit = ctx.core.emit[`.${callee[2]}`]
+      if (methodEmit) {
+        const recv = callee[1]
+        const t = temp()
+        const va = asF64(emit(recv))
+        const vt = typeof recv === 'string' ? repOf(recv)?.val : valTypeOf(recv)
+        if (vt) updateRep(t, { val: vt })
+        const callResult = methodEmit(t, ...args)
+        return emitNullishGuarded(['local.tee', `$${t}`, va], asF64(callResult))
+      }
+    }
     const t = temp()
     const va = asF64(emit(callee))
     // If nullish → return NULL_NAN, else call via fn.call
@@ -596,6 +690,7 @@ export default (ctx) => {
   // initialized in __start (see compile.js). Comparison patterns (typeof x === 'string') are optimized
   // in prepare.js (resolveTypeof) and emitted as direct type checks via emitTypeofCmp, bypassing this path.
   ctx.core.emit['typeof'] = (a) => {
+    if (valTypeOf(a) === VAL.BIGINT) return emit(['str', 'bigint'])
     if (!ctx.runtime.typeofStrs) {
       ctx.runtime.typeofStrs = ['number', 'undefined', 'string', 'function', 'symbol', 'object']
       for (const s of ctx.runtime.typeofStrs)
@@ -604,20 +699,27 @@ export default (ctx) => {
     inc('__typeof')
     // Receiver type unknown; enable branches that wouldn't otherwise be reachable.
     ctx.features.closure = true
-    return typed(['call', '$__typeof', asF64(emit(a))], 'f64')
+    return typed(['call', '$__typeof', asI64(emit(a))], 'f64')
   }
 
   ctx.core.stdlib['__typeof'] = () => {
-    const stringTest = ctx.features.sso
-      ? `(i32.or (i32.eq (local.get $t) (i32.const ${PTR.STRING})) (i32.eq (local.get $t) (i32.const ${PTR.SSO})))`
-      : `(i32.eq (local.get $t) (i32.const ${PTR.STRING}))`
+    const stringTest = `(i32.eq (local.get $t) (i32.const ${PTR.STRING}))`
     const closureArm = ctx.features.closure
       ? `(if (i32.eq (local.get $t) (i32.const ${PTR.CLOSURE}))
       (then (return (global.get $__tof_function))))`
       : ''
-    return `(func $__typeof (param $v f64) (result f64)
-    (local $t i32)
-    (if (f64.eq (local.get $v) (local.get $v))
+    return `(func $__typeof (param $v i64) (result f64)
+    (local $f f64) (local $t i32)
+    (local.set $f (f64.reinterpret_i64 (local.get $v)))
+    (if (f64.eq (local.get $f) (local.get $f))
+      (then (return (global.get $__tof_number))))
+    ;; Canonical JS NaN (0x7FF8000000000000) overlaps ATOM tag=0 aux=0 offset=0.
+    ;; That bit pattern is the math NaN value, not a tagged pointer — treat as "number".
+    ;; Negative-NaN bit patterns (sign bit set) don't match NAN_PREFIX so are uniquely numeric.
+    (if (i32.or
+          (i64.eq (local.get $v) (i64.const 0x7FF8000000000000))
+          (i64.eq (i64.and (local.get $v) (i64.const 0xFFF0000000000000))
+                  (i64.const 0xFFF0000000000000)))
       (then (return (global.get $__tof_number))))
     (if (call $__is_nullish (local.get $v))
       (then (return (global.get $__tof_undefined))))
@@ -635,9 +737,9 @@ export default (ctx) => {
 
   // Low-level pointer helpers callable from jz code
   ctx.core.emit['__mkptr'] = (t, a, o) => typed(['call', '$__mkptr', asI32(emit(t)), asI32(emit(a)), asI32(emit(o))], 'f64')
-  ctx.core.emit['__ptr_type'] = (p) => typed(['f64.convert_i32_s', ['call', '$__ptr_type', asF64(emit(p))]], 'f64')
-  ctx.core.emit['__ptr_aux'] = (p) => typed(['f64.convert_i32_s', ['call', '$__ptr_aux', asF64(emit(p))]], 'f64')
-  ctx.core.emit['__ptr_offset'] = (p) => typed(['f64.convert_i32_s', ['call', '$__ptr_offset', asF64(emit(p))]], 'f64')
+  ctx.core.emit['__ptr_type'] = (p) => typed(['f64.convert_i32_s', ['call', '$__ptr_type', asI64(emit(p))]], 'f64')
+  ctx.core.emit['__ptr_aux'] = (p) => typed(['f64.convert_i32_s', ['call', '$__ptr_aux', asI64(emit(p))]], 'f64')
+  ctx.core.emit['__ptr_offset'] = (p) => typed(['f64.convert_i32_s', ['call', '$__ptr_offset', asI64(emit(p))]], 'f64')
 
   // Error(msg) — passthrough (throw handles any value)
   ctx.core.emit['Error'] = (msg) => asF64(emit(msg))