jz 0.3.1 → 0.5.0

package/src/compile.js

@@ -28,12 +28,15 @@
 import { parse as parseWat } from 'watr'
 import { ctx, err, inc, resolveIncludes, PTR, LAYOUT } from './ctx.js'
 import {
-  T, VAL, analyzeValTypes, analyzeIntCertain, analyzeLocals,
-  analyzePtrUnboxable, typedElemAux, invalidateLocalsCache,
-  analyzeBoxedCaptures, updateRep, inferStringParams,
+  T, VAL, analyzeBody,
+  unboxablePtrs, cseSafeLoadBases, typedElemAux, invalidateLocalsCache,
+  boxedCaptures, updateRep,
+  isBlockBody, analyzeStructInline,
 } from './analyze.js'
+import { inferLocals } from './infer.js'
 import { optimizeFunc, treeshake } from './optimize.js'
 import { emit, emitter, emitFlat, emitBody } from './emit.js'
+import { emitCharDecompPrologue, JSS_IMPORT_SIGS } from './abi/string.js'
 import {
   typed, asF64, asI32, asPtrOffset, asParamType, toI32, asI64, fromI64,
   NULL_NAN, UNDEF_NAN, NULL_WAT, UNDEF_WAT, NULL_IR, UNDEF_IR, nullExpr, undefExpr,
@@ -44,7 +47,9 @@ import {
   isGlobal, isConst, boxedAddr, readVar, writeVar, isNullish, isUndef,
   slotAddr, elemLoad, elemStore, arrayLoop, allocPtr,
   multiCount, loopTop, flat, reconstructArgsWithSpreads,
-  valKindToPtr, findBodyStart,
+  valKindToPtr, findBodyStart, tcoTailRewrite,
+  boolBoxIR,
+  I32_MIN, I32_MAX,
 } from './ir.js'
 import plan from './plan.js'
 import {
@@ -52,6 +57,53 @@ import {
   pullStdlib, syncImports, optimizeModule, stripStaticDataPrefix,
 } from './assemble.js'
 
+// =============================================================================
+// Single-source export semantics
+// =============================================================================
+// Two distinct concepts that callers used to conflate:
+//
+//   1. `f.exported`  — *syntactic* inline-export form, snapshot at `defFunc`
+//      time (prepare.js). True iff the func decl carried the inline `export`
+//      keyword AND `ctx.func.exports[name]` was already populated by parent
+//      decl processing. Only the inline-emit gate below (`(func (export "name") ...)`)
+//      should read it — that emit path requires the inline-syntax invariant
+//      to avoid duplicate-export collisions with sec.customs.
+//
+//   2. `isExported(f)` — *semantic* "is this func reachable from JS via any
+//      export?". Covers the four forms equally:
+//        • inline:           `export function foo` → exports[foo]=true
+//        • non-aliased:      `function foo; export { foo }` → exports[foo]='foo'
+//        • aliased:          `function foo; export { foo as bar }` → exports[bar]='foo'
+//        • default-by-name:  `function foo; export default foo` → exports['default']='foo'
+//      Every public-ABI gate (boundary wrap, rest-param packing, i64 ABI,
+//      cross-call signature narrowing) should consult this.
+
+/** Semantic export predicate. Use everywhere the question is "should this
+ *  func behave as part of the public ABI?" — boundary-wrap, rest-pack,
+ *  i64-ABI, sig-narrowing gates.
+ *
+ *  `f.exported` short-circuits the inline-export case (no map walk needed);
+ *  the value-scan picks up `export { f }` / `export { f as g }` / `export
+ *  default f` where the source name appears as a *value* keyed under the
+ *  public name. */
+const isExported = f => {
+  if (f.exported) return true
+  for (const val of Object.values(ctx.func.exports)) {
+    if (val === f.name) return true
+  }
+  return false
+}
+
+/** Iterate JS-visible export names that resolve to `funcName`. Used to emit
+ *  per-export ABI metadata in custom sections — one entry per JS-visible name,
+ *  since the host (interop.js wrap) keys by export name. */
+function* exportNamesOf(funcName) {
+  for (const [key, val] of Object.entries(ctx.func.exports)) {
+    if (val === true && key === funcName) yield key
+    else if (val === funcName) yield key
+  }
+}
+
 const timePhase = (profiler, name, fn) => profiler ? profiler.time(name, fn) : fn()
 
 // Per-compile func name set + map live on ctx.func.names / ctx.func.map,
@@ -62,7 +114,7 @@ const timePhase = (profiler, name, fn) => profiler ? profiler.time(name, fn) : f
 // buildArrayWithSpreads) moved to src/emit.js.
 
 // AST-analysis primitives (staticObjectProps, paramReps lattice helpers,
-// inferArg* cross-call inference, collectProgramFacts) moved to src/analyze.js.
+// infer* cross-call inference, collectProgramFacts) moved to src/analyze.js.
 
 /**
  * Boundary-wrap predicate: exports whose body-driven result OR any param narrowed
@@ -76,79 +128,136 @@ const timePhase = (profiler, name, fn) => profiler ? profiler.time(name, fn) : f
  * fractional Number gets the same truncation it would get from `arr[n]`).
  */
 const isBoundaryWrapped = (func) => {
-  if (!func.exported || func.raw || func.sig.results.length !== 1) return false
+  if (!isExported(func) || func.raw || func.sig.results.length !== 1) return false
   if (func.sig.results[0] !== 'f64' || func.sig.ptrKind != null) return true
+  // A boolean result rides the 0/1 number carrier internally; the export thunk
+  // boxes it to the TRUE_NAN/FALSE_NAN atom so the host sees a real boolean.
+  if (func.valResult === VAL.BOOL) return true
   return func.sig.params.some(p => p.type !== 'f64' || p.ptrKind != null)
 }
 
-/**
- * Tail-call rewrite: walks tail positions of an emitted IR tree and replaces
- * direct `(call $name args...)` ops with `(return_call $name args...)`.
- *
- * Tail positions, recursively from the IR root:
- *   - the root itself (function's terminal value-producing expression)
- *   - both arms of `(if (result T) cond (then ...) (else ...))`
- *   - last instruction of `(block (result T) ...)`
- *
- * Only fires when caller and callee result types match — if they didn't match,
- * `asParamType`/`asPtrOffset` would have wrapped the call in a conversion op,
- * pushing the `call` away from the tail position. We don't recurse into
- * arithmetic / select / loop ops: their results aren't standalone-tail control
- * transfers.
- *
- * Mirrors the existing `'return'` op handler in emit.js (which already does
- * TCO when the return statement is explicit). This pass closes the gap for
- * expression-bodied arrows like `(n, acc) => n <= 0 ? acc : sum(n-1, acc+n)`
- * — the AST has no `return` keyword so the emit-time handler never fires.
- */
-const tcoTailRewrite = (ir, resultType) => {
-  if (ctx.transform.noTailCall || ctx.func.inTry) return ir
-  if (!Array.isArray(ir)) return ir
-  const op = ir[0]
-  if (op === 'call' && typeof ir[1] === 'string') {
-    // IR call name is `$name`; func.map keys are bare `name`.
-    const calleeName = ir[1].startsWith('$') ? ir[1].slice(1) : ir[1]
-    const callee = ctx.func.map.get(calleeName)
-    if (!callee || callee.raw) return ir
-    const calleeRT = callee.sig?.results?.[0] ?? 'f64'
-    if (calleeRT !== resultType) return ir
-    return typed(['return_call', ...ir.slice(1)], resultType)
-  }
-  if (op === 'if' && Array.isArray(ir[1]) && ir[1][0] === 'result') {
-    let changed = false
-    const newIr = ir.slice()
-    for (let i = 3; i < newIr.length; i++) {
-      const arm = newIr[i]
-      if (Array.isArray(arm) && (arm[0] === 'then' || arm[0] === 'else') && arm.length > 1) {
-        const last = arm[arm.length - 1]
-        const rewritten = tcoTailRewrite(last, resultType)
-        if (rewritten !== last) {
-          newIr[i] = [...arm.slice(0, -1), rewritten]
-          changed = true
-        }
-      }
-    }
-    return changed ? typed(newIr, ir.type) : ir
-  }
-  if (op === 'block' && ir.length > 1) {
-    const last = ir[ir.length - 1]
-    const rewritten = tcoTailRewrite(last, resultType)
-    if (rewritten !== last) return typed([...ir.slice(0, -1), rewritten], ir.type)
-  }
-  return ir
+const ensureThrowRuntime = (sec) => {
+  // A pulled stdlib helper may throw $__jz_err even when no user `throw` set the
+  // flag (e.g. __to_num on a Symbol). Detect it from the included stdlib bodies
+  // so the $__jz_err tag is always present when something can raise it.
+  if (!ctx.runtime.throws && [...ctx.core.includes].some(n => {
+    const body = ctx.core.stdlib[n]
+    return typeof body === 'string' && body.includes('(throw ')
+  })) ctx.runtime.throws = true
+  if (!ctx.runtime.throws) return
+
+  if (!ctx.scope.globals.has('__jz_last_err_bits'))
+    ctx.scope.globals.set('__jz_last_err_bits', '(global $__jz_last_err_bits (mut i64) (i64.const 0))')
+  if (!sec.tags.some(t => Array.isArray(t) && t[0] === 'tag' && t[1] === '$__jz_err'))
+    sec.tags.push(['tag', '$__jz_err', ['param', 'f64']])
+  if (!sec.tags.some(t => Array.isArray(t) && t[0] === 'export' && t[1] === '"__jz_last_err_bits"'))
+    sec.tags.push(['export', '"__jz_last_err_bits"', ['global', '$__jz_last_err_bits']])
+}
+
+// Drop the $__jz_err tag + __jz_last_err_bits globals when optimization
+// eliminated every actual throw site. ensureThrowRuntime runs before
+// optimizeModule so dead-throw analysis can see the tag/global as live; once
+// opt has finished, an unused tag still forces consumers (wasmtime, wasm2c) to
+// enable the exceptions proposal just to parse the module. User-written
+// throw/try/catch/finally is an ABI contract (JS-side may inspect
+// __jz_last_err_bits), so `userThrows` keeps the runtime declared regardless;
+// the prune fires only when `throws` was set purely by stdlib pattern matching
+// or compiler-internal coercion sites.
+const pruneUnusedThrowRuntime = (sec) => {
+  if (!ctx.runtime.throws || ctx.runtime.userThrows) return
+  const hasThrow = (n) => Array.isArray(n) && (n[0] === 'throw' || n.some(hasThrow))
+  for (const arr of [sec.funcs, sec.stdlib, sec.start])
+    for (const f of arr) if (hasThrow(f)) return
+  sec.tags = sec.tags.filter(t => !(Array.isArray(t) &&
+    ((t[0] === 'tag' && t[1] === '$__jz_err') ||
+     (t[0] === 'export' && t[1] === '"__jz_last_err_bits"'))))
+  sec.globals = sec.globals.filter(g => !(Array.isArray(g) &&
+    g[0] === 'global' && g[1] === '$__jz_last_err_bits'))
+  ctx.scope.globals.delete('__jz_last_err_bits')
 }
 
 // === Module compilation ===
 
 const cloneRepMap = map => map ? new Map([...map].map(([k, v]) => [k, { ...v }])) : null
 
-function enterFunc(func) {
+/** Serialize a ValueRep entry into a plain object for inspect output.
+ *  Omits undefined fields so consumers can JSON-stringify without noise. */
+const repView = (rep) => {
+  if (!rep) return null
+  const out = {}
+  for (const k of ['val', 'ptrKind', 'ptrAux', 'schemaId', 'intConst', 'intCertain', 'notString', 'arrayElemSchema', 'arrayElemValType', 'typedCtor', 'jsonShape', 'wasm']) {
+    if (rep[k] != null) out[k] = rep[k]
+  }
+  return Object.keys(out).length ? out : null
+}
+
+/** Capture a function's inferred shape into ctx.inspect.functions. Called after
+ *  analyzeFuncForEmit when transform.inspect is set — reads from funcFacts +
+ *  programFacts.paramReps, never from the live ctx.func.* (which churns per emit). */
+function captureFuncInspect(func, facts, programFacts) {
+  if (!ctx.inspect || func.raw) return
+  const { name, sig } = func
+  const reps = facts?.localReps
+  const paramNames = new Set(sig.params.map(p => p.name))
+  const params = sig.params.map(p => ({
+    name: p.name, type: p.type,
+    ...(p.ptrKind != null ? { ptrKind: p.ptrKind } : {}),
+    ...(p.ptrAux != null ? { ptrAux: p.ptrAux } : {}),
+    ...(repView(reps?.get(p.name)) || {}),
+  }))
+  const locals = {}
+  if (facts?.locals) {
+    for (const [lname, ltype] of facts.locals) {
+      if (paramNames.has(lname)) continue
+      const v = repView(reps?.get(lname))
+      locals[lname] = v ? { type: ltype, ...v } : { type: ltype }
+    }
+  }
+  const callerReps = {}
+  const cr = programFacts.paramReps?.get(name)
+  if (cr) for (const [idx, r] of cr) {
+    const v = repView(r)
+    if (v) callerReps[idx] = v
+  }
+  ctx.inspect.functions[name] = {
+    exported: isExported(func),
+    params,
+    results: sig.results.slice(),
+    ...(sig.ptrKind != null ? { resultPtrKind: sig.ptrKind } : {}),
+    ...(sig.ptrAux != null ? { resultPtrAux: sig.ptrAux } : {}),
+    locals,
+    ...(Object.keys(callerReps).length ? { callerReps } : {}),
+  }
+}
+
+// Reset per-function emit-frame state — the single source of frame entry.
+// `emitFunc`, `analyzeFuncForEmit`, and `emitClosureBody` all route through
+// here. Top-level funcs start `uniq` at 0; closures pass a higher base so
+// their synthetic labels can't collide with the parent frame's.
+function enterFunc(sig, body, { uniq = 0, directClosures = null } = {}) {
   ctx.func.stack = []
-  ctx.func.uniq = 0
-  ctx.func.current = func.sig
-  ctx.func.body = func.body
-  ctx.func.directClosures = null
+  ctx.func.uniq = uniq
+  ctx.func.current = sig
+  ctx.func.body = body
+  ctx.func.directClosures = directClosures
   ctx.func.localProps = null
+  ctx.func.charDecomp = null
+}
+
+// Allocate + null-init a heap cell for every boxed local that isn't seeded
+// from an incoming param/capture value. Registers the cell as an i32 local
+// and marks the name preboxed; `isSeeded(name)` skips the already-seeded.
+function emitPreboxedLocalInits(isSeeded) {
+  const inits = []
+  for (const [name, cell] of ctx.func.boxed) {
+    if (isSeeded(name)) continue
+    ctx.func.locals.set(cell, 'i32')
+    ctx.func.preboxed.add(name)
+    inits.push(
+      ['local.set', `$${cell}`, ['call', '$__alloc', ['i32.const', 8]]],
+      ['f64.store', ['local.get', `$${cell}`], nullExpr()])
+  }
+  return inits
 }
 
 function analyzeFuncForEmit(func, programFacts) {
@@ -156,11 +265,11 @@ function analyzeFuncForEmit(func, programFacts) {
   if (func.raw) return null
 
   const { name, body, sig } = func
-  enterFunc(func)
+  enterFunc(sig, body)
 
-  const block = Array.isArray(body) && body[0] === '{}' && body[1]?.[0] !== ':'
+  const block = isBlockBody(body)
   ctx.func.boxed = new Map()
-  ctx.func.repByLocal = null
+  ctx.func.localReps = null
   ctx.types.typedElem = ctx.scope.globalTypedElem ? new Map(ctx.scope.globalTypedElem) : null
 
   const _reps = paramReps.get(name)
@@ -173,41 +282,52 @@ function analyzeFuncForEmit(func, programFacts) {
         if (!ctx.types.typedElem.has(pname)) ctx.types.typedElem.set(pname, r.typedCtor)
         updateRep(pname, { val: VAL.TYPED })
       }
-      if (r.val && !ctx.func.repByLocal?.get(pname)?.val) updateRep(pname, { val: r.val })
+      if (r.val && !ctx.func.localReps?.get(pname)?.val) updateRep(pname, { val: r.val })
       if (r.arrayElemSchema != null) updateRep(pname, { arrayElemSchema: r.arrayElemSchema })
       if (r.arrayElemValType != null) updateRep(pname, { arrayElemValType: r.arrayElemValType })
       if (r.intConst != null) updateRep(pname, { intConst: r.intConst })
     }
   }
-  // Drop any earlier-cached analyzeLocals for this body — narrowSignatures called
-  // it before our pre-seed, when params still had no inferred VAL.TYPED, so the
-  // cached widths reflect the pre-narrow state. Re-walk now with reps in place.
+  // Drop any earlier-cached analyzeBody.locals slice for this body —
+  // narrowSignatures called it before our pre-seed, when params still had no
+  // inferred VAL.TYPED, so the cached widths reflect the pre-narrow state.
+  // Re-walk now with reps in place.
   invalidateLocalsCache(body)
-  ctx.func.locals = block ? analyzeLocals(body) : new Map()
-  // Usage-based VAL.STRING inference for params not already typed by paramReps.
-  // Descends into nested closures so a param used as STRING only inside an inner
-  // arrow (e.g. parseLevel's `str` capture in watr) still gets seeded — the
-  // closure capture path then propagates VAL.STRING via captureValTypes.
-  if (block) {
-    const candidates = sig.params
-      .filter(p => !ctx.func.repByLocal?.get(p.name)?.val)
-      .map(p => p.name)
-    if (candidates.length) {
-      const inferred = inferStringParams(body, candidates)
-      for (const [n, vt] of inferred) updateRep(n, { val: vt })
-    }
-  }
+  const bodyFacts = block ? analyzeBody(body) : null
+  ctx.func.locals = bodyFacts ? bodyFacts.locals : new Map()
+  // Proven uint32 accumulator locals — readVar tags reads `.unsigned` so the
+  // f64 round-trip widens with convert_i32_u (not _s).
+  if (bodyFacts?.unsignedLocals) for (const n of bodyFacts.unsignedLocals) updateRep(n, { unsigned: true })
+  // SRoA flat-object bindings — `let o = {...}` dissolved into `o#i` field
+  // locals. Consumed by the codegen flat hooks (emitDecl, `.`/`[]` read+write).
+  ctx.func.flatObjects = bodyFacts ? bodyFacts.flatObjects : new Map()
+  // No-copy slice views — `let t = s.slice(...)` bindings proven non-escaping.
+  // Consumed by emitDecl to lower the initializer to a SLICE_BIT view.
+  ctx.func.sliceViews = bodyFacts ? bodyFacts.sliceViews : new Set()
+  // Usage-based shape inference (STRING / ARRAY) for params not already typed
+  // by paramReps. Descends into nested closures so a param used in a definite
+  // shape only inside an inner arrow (e.g. parseLevel's `str` capture in watr)
+  // still gets seeded — the closure capture path then propagates the VAL via
+  // captureValTypes.
+  //
+  // `inferLocals` is body-shape-agnostic — it walks any AST node, so we run it
+  // for expression-bodied arrows too (`(s) => s.charCodeAt(0) + s.length` gets
+  // `s: VAL.STRING` via methodEvidence the same way the block-bodied variant
+  // does). Only `boxedCaptures` / `unboxablePtrs` stay gated:
+  // both need `ctx.func.locals` populated, which only block bodies produce.
+  const candidates = sig.params
+    .filter(p => !ctx.func.localReps?.get(p.name)?.val)
+    .map(p => p.name)
+  inferLocals(body, candidates)
   if (block) {
-    analyzeValTypes(body)
-    analyzeIntCertain(body)
-    analyzeBoxedCaptures(body)
+    boxedCaptures(body)
     // Lower provably-monomorphic pointer locals to i32 offset storage.
     // VAL.TYPED unbox requires a known element ctor (aux byte) — without it,
     // the use site can't pick the right i32.store{8,16}/i32.store width and
     // the rebox path can't reconstruct the NaN-box. Heterogeneous decls (two
     // `let arr = ...` with different ctors, or a multi-ctor ternary) leave
     // typedElem unset; skip unbox so reads/writes go through `__typed_set_idx`.
-    const unbox = analyzePtrUnboxable(body, ctx.func.locals, ctx.func.boxed)
+    const unbox = unboxablePtrs(body, ctx.func.locals, ctx.func.boxed)
     if (unbox.size > 0) {
       for (const [n, kind] of unbox) {
         const fields = { ptrKind: kind }
@@ -222,7 +342,7 @@ function analyzeFuncForEmit(func, programFacts) {
     }
   }
   // Pointer-ABI params (from narrowing loop above): params already have type='i32' and
-  // ptrKind set. Register them in ctx.func.repByLocal so readVar tags local.gets correctly.
+  // ptrKind set. Register them in ctx.func.localReps so readVar tags local.gets correctly.
   // Boxed capture still works: the boxed-init path (below) uses a ptrKind-tagged local.get
   // so asF64 reboxes to NaN-form before f64.store to the cell.
   for (const p of sig.params) {
@@ -232,12 +352,21 @@ function analyzeFuncForEmit(func, programFacts) {
     updateRep(p.name, fields)
   }
 
+  // CSE-safe load bases — pointer locals whose memory reads `cseScalarLoad`
+  // may scalar-replace. Computed last: needs every `let`/param ptrKind in place.
+  const cseLoadBases = block
+    ? cseSafeLoadBases(body, ctx.func.locals, ctx.func.localReps)
+    : new Set()
+
   return {
     block,
     locals: new Map(ctx.func.locals),
     boxed: new Map(ctx.func.boxed),
+    flatObjects: new Map(ctx.func.flatObjects),
+    sliceViews: new Set(ctx.func.sliceViews),
+    cseLoadBases,
     typedElem: ctx.types.typedElem ? new Map(ctx.types.typedElem) : null,
-    repByLocal: cloneRepMap(ctx.func.repByLocal),
+    localReps: cloneRepMap(ctx.func.localReps),
   }
 }
 
@@ -257,11 +386,13 @@ function emitFunc(func, funcFacts, programFacts) {
   const multi = sig.results.length > 1
   const _reps = paramReps.get(name)
 
-  enterFunc(func)
+  enterFunc(sig, body)
   const block = funcFacts.block
   ctx.func.locals = new Map(funcFacts.locals)
   ctx.func.boxed = new Map(funcFacts.boxed)
-  ctx.func.repByLocal = cloneRepMap(funcFacts.repByLocal)
+  ctx.func.flatObjects = new Map(funcFacts.flatObjects)
+  ctx.func.sliceViews = new Set(funcFacts.sliceViews)
+  ctx.func.localReps = cloneRepMap(funcFacts.localReps)
   ctx.types.typedElem = funcFacts.typedElem ? new Map(funcFacts.typedElem) : null
 
   // D: Apply call-site param facts (only if body analysis didn't already set them).
@@ -272,11 +403,11 @@ function emitFunc(func, funcFacts, programFacts) {
     for (const [k, r] of _reps) {
       if (k >= sig.params.length) continue
       const pname = sig.params[k].name
-      if (r.val && !ctx.func.repByLocal?.get(pname)?.val) updateRep(pname, { val: r.val })
+      if (r.val && !ctx.func.localReps?.get(pname)?.val) updateRep(pname, { val: r.val })
       if (r.typedCtor) {
         if (!ctx.types.typedElem) ctx.types.typedElem = new Map()
         if (!ctx.types.typedElem.has(pname)) ctx.types.typedElem.set(pname, r.typedCtor)
-        if (!ctx.func.repByLocal?.get(pname)?.val) updateRep(pname, { val: VAL.TYPED })
+        if (!ctx.func.localReps?.get(pname)?.val) updateRep(pname, { val: VAL.TYPED })
       }
       if (r.schemaId != null && !exported && !ctx.schema.vars.has(pname)) {
         ctx.schema.vars.set(pname, r.schemaId)
@@ -286,7 +417,18 @@ function emitFunc(func, funcFacts, programFacts) {
   }
 
   const fn = ['func', `$${name}`]
-  // Boundary-wrapped exports defer the export attribute to a synthesized
+  // Stamp the emit-side CSE soundness whitelist onto the func node (expando —
+  // watr print/compile ignore non-index props). `cseScalarLoad` reads it; absent
+  // it the pass is a no-op. `$`-prefixed to match WAT local names directly.
+  if (funcFacts.cseLoadBases?.size)
+    fn.cseLoadBases = new Set([...funcFacts.cseLoadBases].map(n => `$${n}`))
+  // Inline `(export ...)` attribute only for the syntactic inline-export
+  // form (`export function foo`, snapshot in `func.exported` at defFunc
+  // time). Re-exports (`function foo; export { foo }`) and aliases (`export
+  // { foo as bar }`) flow through sec.customs below — emitting an inline
+  // attribute under the internal symbol would collide with the customs
+  // entry on the same name, or leak the internal symbol publicly.
+  // Boundary-wrapped exports also defer the attribute to the synthesized
   // wrapper ($${name}$exp) that reboxes the narrowed result back to f64.
   if (exported && !isBoundaryWrapped(func)) fn.push(['export', `"${name}"`])
   fn.push(...sig.params.map(p => ['param', `$${p.name}`, p.type]))
@@ -294,19 +436,26 @@ function emitFunc(func, funcFacts, programFacts) {
 
   // Default params: ES spec says default applies only when arg is `undefined`
   // (or missing). `null`, `0`, `false`, etc. all skip the default.
+  // Emitted here (registers any `charCodeAt` decomposition the default's
+  // initializer triggers) but keyed by param name — final ordering vs the
+  // charDecomp prologue is resolved in `collectParamInits` below.
   const defaults = func.defaults || {}
-  const defaultInits = []
+  const defaultInits = new Map()
   for (const [pname, defVal] of Object.entries(defaults)) {
     const p = sig.params.find(p => p.name === pname)
+    // jsstring-carrier params with string-literal defaults skip wasm-side
+    // substitution — the interop wrapper applies the default JS-side (the
+    // value rides through `jz:extparam`). The wasm side never sees a null
+    // externref so no `ref.is_null` branch is needed.
+    if (p?.jsstring && p.jsstringDefault != null) continue
     const t = p?.type || 'f64'
-    defaultInits.push(
+    defaultInits.set(pname,
       ['if', isUndef(typed(['local.get', `$${pname}`], 'f64')),
         ['then', ['local.set', `$${pname}`, t === 'f64' ? asF64(emit(defVal)) : asI32(emit(defVal))]]])
   }
 
   // Box params that are mutably captured: allocate cell, copy param value
   const boxedParamInits = []
-  const preboxedLocalInits = []
   ctx.func.preboxed = new Set()
   const paramNames = new Set(sig.params.map(p => p.name))
   for (const p of sig.params) {
@@ -321,31 +470,58 @@ function emitFunc(func, funcFacts, programFacts) {
         ['f64.store', ['local.get', `$${cell}`], asF64(lget)])
     }
   }
-  for (const [name, cell] of ctx.func.boxed) {
-    if (paramNames.has(name)) continue
-    ctx.func.locals.set(cell, 'i32')
-    ctx.func.preboxed.add(name)
-    preboxedLocalInits.push(
-      ['local.set', `$${cell}`, ['call', '$__alloc', ['i32.const', 8]]],
-      ['f64.store', ['local.get', `$${cell}`], nullExpr()])
+  // Remaining boxed locals (non-params) get a fresh null-init cell.
+  const preboxedLocalInits = emitPreboxedLocalInits(name => paramNames.has(name))
+
+  // Drain `ctx.func.charDecomp` after body emit: any param `charCodeAt` use
+  // registered a decomposition request that needs a function-entry prologue
+  // initialising its four i32 locals (base / len / sso / loadbase). Locals
+  // themselves were already added to `ctx.func.locals` during emit so they
+  // appear in the local-decl block below.
+  //
+  // Interleave with the per-param default inits in `sig.params` order so each
+  // param's prologue runs *after* that param's own default init (the prologue
+  // reads the param's final value) and *before* any later param's default
+  // init — a default like `c = op.charCodeAt(0)` must see `op`'s prologue
+  // locals already populated, else its bounds check reads len=0 and the
+  // in-bounds char wrongly decodes as the OOB NaN.
+  const collectParamInits = () => {
+    const inits = []
+    for (const p of sig.params) {
+      const di = defaultInits.get(p.name)
+      if (di) inits.push(di)
+      const dec = ctx.func.charDecomp?.get(p.name)
+      if (dec) inits.push(...emitCharDecompPrologue(dec))
+    }
+    return inits
   }
 
   if (block) {
     const stmts = emitBody(body)
+    const paramInits = collectParamInits()
     for (const [l, t] of ctx.func.locals) fn.push(['local', `$${l}`, t])
     // I: Skip trailing fallback when last statement is return (unreachable code)
     const lastStmt = stmts.at(-1)
     const endsWithReturn = lastStmt && (lastStmt[0] === 'return' || lastStmt[0] === 'return_call')
-    fn.push(...defaultInits, ...boxedParamInits, ...preboxedLocalInits, ...stmts, ...(endsWithReturn ? [] : sig.results.map(t => [`${t}.const`, 0])))
+    // Implicit fall-through return is `undefined` per JS spec, not 0 — same as
+    // the closure path below. A reachable fall-through forces an f64 result
+    // (it must carry undefined); concretely-typed results keep the `.const 0`
+    // form since they can only be reached via explicit typed returns.
+    const fallthrough = endsWithReturn ? []
+      : sig.results.length === 1 && sig.results[0] === 'f64' ? [undefExpr()]
+      : sig.results.map(t => [`${t}.const`, 0])
+    fn.push(...paramInits, ...boxedParamInits, ...preboxedLocalInits, ...stmts, ...fallthrough)
   } else if (multi && body[0] === '[') {
     const values = body.slice(1).map(e => asF64(emit(e)))
+    const paramInits = collectParamInits()
     for (const [l, t] of ctx.func.locals) fn.push(['local', `$${l}`, t])
-    fn.push(...boxedParamInits, ...preboxedLocalInits, ...values)
+    fn.push(...paramInits, ...boxedParamInits, ...preboxedLocalInits, ...values)
   } else {
     const ir = emit(body)
+    const paramInits = collectParamInits()
     for (const [l, t] of ctx.func.locals) fn.push(['local', `$${l}`, t])
     const finalIR = sig.ptrKind != null ? asPtrOffset(ir, sig.ptrKind) : asParamType(ir, sig.results[0])
-    fn.push(...defaultInits, ...boxedParamInits, ...preboxedLocalInits, tcoTailRewrite(finalIR, sig.results[0]))
+    fn.push(...paramInits, ...boxedParamInits, ...preboxedLocalInits, tcoTailRewrite(finalIR, sig.results[0]))
   }
 
   // Restore schema.vars so param bindings don't leak to next function.
@@ -361,7 +537,7 @@ function emitFunc(func, funcFacts, programFacts) {
  *   - takes i64 params always — JS-side carrier is BigInt that reinterprets to
  *     f64 NaN-box bits. i64 dodges V8's spec-permitted NaN canonicalization at
  *     the wasm↔JS boundary (see ToJSValue / ToWebAssemblyValue). Host wrap()
- *     in src/host.js pairs by converting BigInt↔f64 via reinterpret bits.
+ *     in interop.js pairs by converting BigInt↔f64 via reinterpret bits.
  *   - converts each narrowed param at the call: f64 → i32 (truncate-sat) for
  *     numeric narrowed, f64 → i32-offset (`i32.wrap_i64 + i64.reinterpret_f64`)
  *     for pointer narrowed. The reinterpret happens once at param decode and
@@ -375,7 +551,8 @@ function emitFunc(func, funcFacts, programFacts) {
  *
  * Result rebox cases (then reinterpret to i64 at the boundary):
  *   - sig.ptrKind != null  → mkPtrIR(ptrKind, ptrAux ?? 0, callIR)
- *   - sig.results[0] = i32 → f64.convert_i32_s(callIR)
+ *   - sig.results[0] = i32 → f64.convert_i32_s(callIR), or `_u` when
+ *                            sig.unsignedResult (preserves `(x >>> 0)` ∈ [0, 2³²))
  *   - sig.results[0] = f64 → callIR (some params narrowed but result stayed f64)
  */
 function synthesizeBoundaryWrappers() {
@@ -387,13 +564,31 @@ function synthesizeBoundaryWrappers() {
     // actually crosses the boundary (param.ptrKind set, or result with
     // sig.ptrKind set). Numeric narrowing (i32 trunc-sat / convert) keeps f64
     // so callers seeing the raw export get a plain Number for numerics.
+    // jsstring params bypass both i64 and f64 — they flow as externref end-to-end.
     const paramI64 = sig.params.map(p => p.ptrKind != null)
-    const resultI64 = sig.ptrKind != null
-    const wrapNode = ['func', `$${name}$exp`, ['export', `"${name}"`]]
-    sig.params.forEach((p, i) => wrapNode.push(['param', `$${p.name}`, paramI64[i] ? 'i64' : 'f64']))
+    // A VAL.BOOL result is boxed to a NaN-box atom here, so it crosses as i64
+    // (same carrier as a pointer result), even though the inner func returns the
+    // plain 0/1 number carrier.
+    const resultBool = func.valResult === VAL.BOOL && sig.ptrKind == null
+    const resultI64 = sig.ptrKind != null || resultBool
+    // Inline `(export ...)` attribute only when the func decl carried the
+    // inline-export keyword (`export function foo`). For re-exports
+    // (`function foo; export { foo as bar }`) the `name` is the *internal*
+    // symbol; sec.customs holds the JS-visible export pointing at this
+    // wrapper. Emitting an inline attribute here under the internal name
+    // would leak the symbol publicly and collide with the customs entry.
+    const wrapNode = func.exported
+      ? ['func', `$${name}$exp`, ['export', `"${name}"`]]
+      : ['func', `$${name}$exp`]
+    sig.params.forEach((p, i) => {
+      const t = p.jsstring ? 'externref' : (paramI64[i] ? 'i64' : 'f64')
+      wrapNode.push(['param', `$${p.name}`, t])
+    })
     wrapNode.push(['result', resultI64 ? 'i64' : 'f64'])
     const args = sig.params.map((p, i) => {
       const get = ['local.get', `$${p.name}`]
+      // jsstring: externref flows through unchanged — inner func also takes externref.
+      if (p.jsstring) return get
       if (p.ptrKind != null) {
         // ptrKind: i64 carrier carries NaN-box bits → wrap to i32 offset
         return ['i32.wrap_i64', get]
@@ -407,14 +602,28 @@ function synthesizeBoundaryWrappers() {
     if (sig.ptrKind != null) {
       const ptrType = valKindToPtr(sig.ptrKind)
       body = mkPtrIR(ptrType, sig.ptrAux ?? 0, callIR)
+    } else if (resultBool) {
+      // boolBoxIR's truthy extraction depends on the carrier type, so the bare
+      // call node must declare it (f64 0/1, or i32 when the result narrowed).
+      body = boolBoxIR(typed(callIR, sig.results[0]))   // 0/1 carrier → TRUE_NAN/FALSE_NAN atom
     } else if (sig.results[0] === 'i32') {
-      body = ['f64.convert_i32_s', callIR]
+      body = [sig.unsignedResult ? 'f64.convert_i32_u' : 'f64.convert_i32_s', callIR]
     } else {
       body = callIR
     }
     wrapNode.push(resultI64 ? ['i64.reinterpret_f64', body] : body)
     func._exportUsesI64 = resultI64 || paramI64.some(Boolean)
     func._exportI64Sig = { params: paramI64, result: resultI64 }
+    // Track externref param positions so interop.js can pass JS values
+    // raw (skipping `mem.wrapVal`) at those slots. Today this only fires
+    // for `jsstring`-tagged params; future externref carriers wire here too.
+    // `extParams` is per-slot: false (non-ext) | { def: '...' }-bearing object
+    // for jsstring params with a JS-side default substitution.
+    const extParams = sig.params.map(p => {
+      if (!p.jsstring) return false
+      return p.jsstringDefault != null ? { def: p.jsstringDefault } : true
+    })
+    if (extParams.some(Boolean)) func._exportExtParams = extParams
     wrappers.push(wrapNode)
   }
   return wrappers
@@ -428,7 +637,7 @@ function synthesizeBoundaryWrappers() {
  * so any closure can be invoked via call_indirect on $ftN. This function
  * builds one body fn given the body record (cb) created by ctx.closure.make.
  *
- * Mutates ctx.func.* per-body state (locals, boxed, repByLocal) and
+ * Mutates ctx.func.* per-body state (locals, boxed, localReps) and
  * ctx.schema.vars / ctx.types.typedElem (restored on exit so capture-binding
  * leaks don't poison the next body). Returns the WAT IR for the func node.
  */
@@ -437,8 +646,9 @@ function emitClosureBody(cb) {
   const prevTypedElems = ctx.types.typedElem
   // Reset per-function state for closure body
   ctx.func.locals = new Map()
-  ctx.func.repByLocal = null
+  ctx.func.localReps = null
   if (cb.intConsts) for (const [name, v] of cb.intConsts) updateRep(name, { intConst: v })
+  if (cb.intCertain) for (const name of cb.intCertain) updateRep(name, { intCertain: true })
   if (cb.valTypes) for (const [name, vt] of cb.valTypes) updateRep(name, { val: vt })
   if (cb.schemaVars) {
     ctx.schema.vars = new Map([...prevSchemaVars, ...cb.schemaVars])
@@ -456,18 +666,24 @@ function emitClosureBody(cb) {
   ctx.func.boxed = cb.boxed ? new Map([...cb.boxed].map(v => [v, v])) : new Map()
   const parentBoxedCaptures = new Set(cb.boxed || [])
   ctx.func.preboxed = new Set()
-  ctx.func.stack = []
-  ctx.func.uniq = Math.max(ctx.func.uniq, 100) // avoid label collisions
-  ctx.func.body = cb.body
-  // Seed direct-call dispatch for captured const-bound closures (A3 across capture boundary).
-  // closure.make snapshotted the parent's directClosures for each capture; here we restore
-  // them so calls to a captured `peek` lower to `call $closureN` instead of call_indirect.
-  ctx.func.directClosures = cb.directClosures ? new Map(cb.directClosures) : null
+  // Bare `;`-sequence bodies (no enclosing `{}`) reach us when callers built a
+  // statement list directly — wrap into a block body so the multi-stmt path
+  // runs (otherwise emit returns an untyped list and asF64 wraps it with
+  // `f64.convert_i32_s`, yielding invalid WAT).
+  if (Array.isArray(cb.body) && cb.body[0] === ';') cb.body = ['{}', cb.body]
   // Uniform convention: (env f64, argc i32, a0..a{width-1} f64) → f64
   const W = ctx.closure.width ?? MAX_CLOSURE_ARITY
   const paramDecls = [{ name: '__env', type: 'f64' }, { name: '__argc', type: 'i32' }]
   for (let i = 0; i < W; i++) paramDecls.push({ name: `__a${i}`, type: 'f64' })
-  ctx.func.current = { params: paramDecls, results: ['f64'] }
+  // Enter the closure frame. uniq ≥ 100 keeps synthetic labels from colliding
+  // with the parent. directClosures: closure.make snapshotted the parent's
+  // direct-call map for each capture, so a call to a captured const closure
+  // still lowers to `call $closureN` instead of call_indirect (A3 across the
+  // capture boundary).
+  enterFunc({ params: paramDecls, results: ['f64'] }, cb.body, {
+    uniq: Math.max(ctx.func.uniq, 100),
+    directClosures: cb.directClosures ? new Map(cb.directClosures) : null,
+  })
 
   const fn = ['func', `$${cb.name}`]
   fn.push(['param', '$__env', 'f64'])
@@ -485,28 +701,20 @@ function emitClosureBody(cb) {
   }
 
   // Emit body
-  const block = Array.isArray(cb.body) && cb.body[0] === '{}' && cb.body[1]?.[0] !== ':'
+  const block = isBlockBody(cb.body)
   let bodyIR
   if (block) {
     invalidateLocalsCache(cb.body)
-    for (const [k, v] of analyzeLocals(cb.body)) if (!ctx.func.locals.has(k)) ctx.func.locals.set(k, v)
-    // Usage-based STRING inference for closure params not seeded by captureValTypes.
+    for (const [k, v] of analyzeBody(cb.body).locals) if (!ctx.func.locals.has(k)) ctx.func.locals.set(k, v)
+    // Usage-based shape inference for closure params not seeded by captureValTypes.
     // (Captures already have their parent's val type via cb.valTypes above.)
-    {
-      const candidates = cb.params.filter(p => !ctx.func.repByLocal?.get(p)?.val)
-      if (candidates.length) {
-        const inferred = inferStringParams(cb.body, candidates)
-        for (const [n, vt] of inferred) updateRep(n, { val: vt })
-      }
-    }
-    analyzeValTypes(cb.body)
-    analyzeIntCertain(cb.body)
+    inferLocals(cb.body, cb.params.filter(p => !ctx.func.localReps?.get(p)?.val))
     // Detect captures from deeper nested arrows that mutate this body's locals/params/captures
-    analyzeBoxedCaptures(cb.body)
+    boxedCaptures(cb.body)
     for (const name of ctx.func.boxed.keys()) {
       if (parentBoxedCaptures.has(name) && ctx.func.locals.get(name) === 'f64') ctx.func.locals.set(name, 'i32')
     }
-    const unbox = analyzePtrUnboxable(cb.body, ctx.func.locals, ctx.func.boxed)
+    const unbox = unboxablePtrs(cb.body, ctx.func.locals, ctx.func.boxed)
     for (const [name, kind] of unbox) {
       if (cb.params.includes(name) || cb.captures.includes(name)) continue
       const fields = { ptrKind: kind }
@@ -548,17 +756,27 @@ function emitClosureBody(cb) {
     ctx.func.locals.set(ctx.func.boxed.get(name), 'i32')
     ctx.func.preboxed.add(name)
   }
-  const preboxedLocalInits = []
-  for (const [name, cell] of ctx.func.boxed) {
-    if (boxedCaptureNames.has(name) || boxedValueCaptureNames.has(name) || boxedParamNames.has(name)) continue
-    ctx.func.locals.set(cell, 'i32')
-    ctx.func.preboxed.add(name)
-    preboxedLocalInits.push(
-      ['local.set', `$${cell}`, ['call', '$__alloc', ['i32.const', 8]]],
-      ['f64.store', ['local.get', `$${cell}`], nullExpr()])
-  }
+  // Boxed locals that aren't captures or params get a fresh null-init cell;
+  // captures/params already carry their incoming value.
+  const preboxedLocalInits = emitPreboxedLocalInits(name =>
+    boxedCaptureNames.has(name) || boxedValueCaptureNames.has(name) || boxedParamNames.has(name))
 
   // Insert locals (captures + params + declared)
+  // Build default-param initializer IR before local declarations are emitted:
+  // default expressions can allocate temporaries (for example `param = []`).
+  const defaultParamInits = []
+  if (cb.defaults) {
+    for (const [pname, defVal] of Object.entries(cb.defaults)) {
+      if (boxedParamNames.has(pname)) {
+        defaultParamInits.push(['if', isUndef(['f64.load', boxedAddr(pname)]),
+          ['then', ['f64.store', boxedAddr(pname), asF64(emit(defVal))]]])
+      } else {
+        defaultParamInits.push(['if', isUndef(['local.get', `$${pname}`]),
+          ['then', ['local.set', `$${pname}`, asF64(emit(defVal))]]])
+      }
+    }
+  }
+
   for (const [l, t] of ctx.func.locals) fn.push(['local', `$${l}`, t])
 
   // Load captures from env: boxed → i32.load (raw cell pointer), immutable → f64.load value.
@@ -612,7 +830,7 @@ function emitClosureBody(cb) {
       ['then', ['local.set', `$${restLen}`, ['i32.const', restSlots]]]])
     fn.push(['local.set', `$${restOff}`,
       ['call', '$__alloc_hdr',
-        ['local.get', `$${restLen}`], ['local.get', `$${restLen}`], ['i32.const', 8]]])
+        ['local.get', `$${restLen}`], ['local.get', `$${restLen}`]]])
     for (let i = 0; i < restSlots; i++) {
       fn.push(['if', ['i32.gt_s', ['local.get', `$${restLen}`], ['i32.const', i]],
         ['then', ['f64.store',
@@ -631,17 +849,7 @@ function emitClosureBody(cb) {
 
   // Default params for closures (check sentinel after unpack)
   // Only `undefined` triggers default per spec — `null`/`0`/`false` pass through.
-  if (cb.defaults) {
-    for (const [pname, defVal] of Object.entries(cb.defaults)) {
-      if (boxedParamNames.has(pname)) {
-        fn.push(['if', isUndef(['f64.load', boxedAddr(pname)]),
-          ['then', ['f64.store', boxedAddr(pname), asF64(emit(defVal))]]])
-      } else {
-        fn.push(['if', isUndef(['local.get', `$${pname}`]),
-          ['then', ['local.set', `$${pname}`, asF64(emit(defVal))]]])
-      }
-    }
-  }
+  fn.push(...defaultParamInits)
   fn.push(...preboxedLocalInits)
   fn.push(...bodyIR)
   // I: Skip trailing fallback when last statement is return
@@ -687,7 +895,11 @@ export default function compile(ast, profiler) {
       err(`'${name}' conflicts with a compiler internal — choose a different name`)
 
   // Pre-fold const globals: evaluate constant initializers before function compilation
-  // so functions see the correct global types (i32 vs f64).
+  // so functions see the correct global types (i32 vs f64). Covers the main module
+  // and every bundled sub-module — a sub-module's top-level `const SPACE = 32` lands
+  // in `moduleInits` (emitted from __start), not `ast`, so without this it stays a
+  // `(mut f64)` global. Folding it makes the scanner's char-code constants immutable
+  // globals V8 constant-folds at each read site.
   if (ast) {
     const evalConst = n => {
       if (typeof n === 'number') return n
@@ -706,8 +918,10 @@ export default function compile(ast, profiler) {
       if (op === '>>') return va >> vb; if (op === '>>>') return va >>> vb
       return null
     }
-    const stmts = Array.isArray(ast) && ast[0] === ';' ? ast.slice(1)
-      : Array.isArray(ast) && ast[0] === 'const' ? [ast] : []
+    const topStmts = n => Array.isArray(n) && n[0] === ';' ? n.slice(1)
+      : Array.isArray(n) && n[0] === 'const' ? [n] : []
+    const stmts = [...topStmts(ast)]
+    for (const mi of ctx.module.moduleInits || []) stmts.push(...topStmts(mi))
     for (const s of stmts) {
       if (!Array.isArray(s) || s[0] !== 'const') continue
       for (const decl of s.slice(1)) {
@@ -716,7 +930,7 @@ export default function compile(ast, profiler) {
         if (!ctx.scope.globals.has(name) || !ctx.scope.consts?.has(name)) continue
         const v = evalConst(init)
         if (v == null || !isFinite(v)) continue
-        const isInt = Number.isInteger(v) && v >= -2147483648 && v <= 2147483647
+        const isInt = Number.isInteger(v) && v >= I32_MIN && v <= I32_MAX
         ctx.scope.globals.set(name, isInt
           ? `(global $${name} i32 (i32.const ${v}))`
           : `(global $${name} f64 (f64.const ${v}))`)
@@ -730,8 +944,22 @@ export default function compile(ast, profiler) {
 
   const programFacts = timePhase(profiler, 'plan', () => plan(ast))
 
+  // Inspect sink: editor hosts opt in via { inspect: true } to read inferred shapes.
+  // Initialized here (post-plan) so paramReps and schema.list are stable, populated
+  // per-function below as funcFacts settle. Bytes themselves are unchanged.
+  if (ctx.transform.inspect) ctx.inspect = { functions: {}, schemas: ctx.schema.list.map(s => s.slice()) }
+
   const funcFacts = new Map()
-  for (const func of ctx.func.list) if (!func.raw) funcFacts.set(func, analyzeFuncForEmit(func, programFacts))
+  for (const func of ctx.func.list) {
+    if (func.raw) continue
+    const facts = analyzeFuncForEmit(func, programFacts)
+    funcFacts.set(func, facts)
+    captureFuncInspect(func, facts, programFacts)
+  }
+  // Whole-program SRoA: pick the schemas whose `Array<S>` instances use the
+  // `structInline` carrier. Runs once the per-function reps have settled (they
+  // are codegen truth) and before any function is emitted.
+  analyzeStructInline(funcFacts, programFacts)
   const funcs = ctx.func.list.map(func => emitFunc(func, funcFacts.get(func), programFacts))
   funcs.push(...synthesizeBoundaryWrappers())
 
@@ -746,10 +974,28 @@ export default function compile(ast, profiler) {
   }
   compilePendingClosures()
 
+  // `wasm:js-string` imports — drained from `ctx.core.jsstring`, one
+  // `(import …)` per builtin referenced by emitted code. Engines with
+  // js-string-builtins support intercept the namespace; engines without
+  // fall back to JS-side polyfills wired in interop.js. The import nodes
+  // precede user imports so the host providing them sees them first.
+  const jssImports = []
+  if (ctx.core.jsstring?.size) {
+    for (const name of ctx.core.jsstring) {
+      const sig = JSS_IMPORT_SIGS[name]
+      if (!sig) continue  // unknown builtin — silently skip (defensive)
+      const funcNode = ['func', `$__jss_${name}`,
+        ...sig.params.map(t => ['param', t]),
+        ['result', sig.result],
+      ]
+      jssImports.push(['import', '"wasm:js-string"', `"${name}"`, funcNode])
+    }
+  }
+
   // Build module sections — named slots, assembled at the end (no index bookkeeping)
   const sec = {
     extStdlib: [],  // external stdlib (imports that must precede all other imports)
-    imports: [...ctx.module.imports],
+    imports: [...jssImports, ...ctx.module.imports],
     types: [],      // function types for call_indirect
     memory: [],     // memory declaration
     data: [],       // data segment (filled after emit)
@@ -775,12 +1021,6 @@ export default function compile(ast, profiler) {
 
   // Memory section deferred — emitted after resolveIncludes() when __alloc is needed
 
-  if (ctx.runtime.throws) {
-    ctx.scope.globals.set('__jz_last_err_bits', '(global $__jz_last_err_bits (mut i64) (i64.const 0))')
-    sec.tags.push(['tag', '$__jz_err', ['param', 'f64']])
-    sec.tags.push(['export', '"__jz_last_err_bits"', ['global', '$__jz_last_err_bits']])
-  }
-
   if (ctx.closure.table?.length)
     sec.table.push(['table', ['export', '"__jz_table"'], ctx.closure.table.length, 'funcref'])
 
@@ -827,6 +1067,8 @@ export default function compile(ast, profiler) {
 
   stripStaticDataPrefix(sec)
 
+  ensureThrowRuntime(sec)
+
   optimizeModule(sec)
 
   // Populate globals (after __start — const folding may update declarations)
@@ -866,9 +1108,19 @@ export default function compile(ast, profiler) {
     sec.customs.push(['@custom', '"jz:schema"', bytes])
   }
 
-  // Custom section: rest params for exported functions (JS-side wrapping)
-  const restParamFuncs = ctx.func.list.filter(f => f.exported && f.rest)
-    .map(f => ({ name: f.name, fixed: f.sig.params.length - 1 }))
+  // Custom section: rest params for exported functions (JS-side wrapping).
+  // Entry per JS-visible export name (not per internal func name) — host's
+  // interop.js wrap() keys by export name. Aliased re-export
+  // (`function foo (...rest); export { foo as bar }`) needs `bar` in the
+  // list; otherwise JS pads the missing args with UNDEF_NAN and the
+  // VAL.ARRAY narrow path reads i32 at `__ptr_offset(UNDEF_NAN) - 8`, hitting
+  // OOB instead of the polymorphic length-check fallback's tag-aware return-0.
+  const restParamFuncs = []
+  for (const f of ctx.func.list) {
+    if (!isExported(f) || !f.rest) continue
+    const fixed = f.sig.params.length - 1
+    for (const exportName of exportNamesOf(f.name)) restParamFuncs.push({ name: exportName, fixed })
+  }
   if (restParamFuncs.length)
     sec.customs.push(['@custom', '"jz:rest"', `"${JSON.stringify(restParamFuncs).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`])
 
@@ -880,20 +1132,42 @@ export default function compile(ast, profiler) {
   // stay as Numbers on the JS side.
   const i64Exports = []
   for (const f of ctx.func.list) {
-    if (!f.exported || !isBoundaryWrapped(f) || !f._exportUsesI64) continue
+    if (!isExported(f) || !isBoundaryWrapped(f) || !f._exportUsesI64) continue
     const p = []
     f._exportI64Sig.params.forEach((b, i) => { if (b) p.push(i) })
     const r = f._exportI64Sig.result ? 1 : 0
-    i64Exports.push({ name: f.name, p, r })
-    // Aliases (export { foo as bar }) re-export the same wrapper under a
-    // different JS-visible name; list each alias too so wrap() finds it.
-    for (const [alias, val] of Object.entries(ctx.func.exports)) {
-      if (val === f.name && alias !== f.name) i64Exports.push({ name: alias, p, r })
-    }
+    // One entry per JS-visible export name (inline + non-aliased + aliased
+    // re-exports). `exportNamesOf` yields every name that resolves to f —
+    // wrap() looks up by export name, not by internal symbol.
+    for (const exportName of exportNamesOf(f.name)) i64Exports.push({ name: exportName, p, r })
   }
   if (i64Exports.length)
     sec.customs.push(['@custom', '"jz:i64exp"', `"${JSON.stringify(i64Exports).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`])
 
+  // Custom section: per-export externref param positions. interop.js reads
+  // this to pass JS arguments straight through at those positions (no
+  // `mem.wrapVal`, no SSO encoding). Format: { name, p, d? } where p lists
+  // 0-based externref param indices and d (optional) is a map idx→default
+  // string for jsstring-carrier params whose default-substitution happens
+  // JS-side. Empty list emits nothing.
+  const extExports = []
+  for (const f of ctx.func.list) {
+    if (!isExported(f) || !isBoundaryWrapped(f) || !f._exportExtParams) continue
+    const p = []
+    const d = {}
+    f._exportExtParams.forEach((b, i) => {
+      if (!b) return
+      p.push(i)
+      if (typeof b === 'object' && b.def != null) d[i] = b.def
+    })
+    if (!p.length) continue
+    const entry = { name: '', p }
+    if (Object.keys(d).length) entry.d = d
+    for (const exportName of exportNamesOf(f.name)) extExports.push({ ...entry, name: exportName })
+  }
+  if (extExports.length)
+    sec.customs.push(['@custom', '"jz:extparam"', `"${JSON.stringify(extExports).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`])
+
   // Named export aliases: export { name } or export { source as alias }
   for (const [name, val] of Object.entries(ctx.func.exports)) {
     if (wasiCommandExports.has(name)) continue
@@ -917,10 +1191,12 @@ export default function compile(ast, profiler) {
   const optCfg = ctx.transform.optimize
   const { callCount } = treeshake(
     [{ arr: sec.stdlib }, { arr: sec.funcs }, { arr: sec.start }],
-    [...sec.start, ...sec.elem, ...sec.customs, ...sec.extStdlib, ...sec.imports],
-    { removeDead: !optCfg || optCfg.treeshake !== false }
+    [...sec.start, ...sec.elem, ...sec.customs, ...sec.extStdlib, ...sec.imports, ...sec.tags],
+    { removeDead: !optCfg || optCfg.treeshake !== false, globals: sec.globals }
   )
 
+  pruneUnusedThrowRuntime(sec)
+
   // Reorder non-import funcs by call count: hot callees get low LEB128 indices.
   // `call $f` encodes funcidx as ULEB128 (1 B for idx < 128, 2 B for idx < 16384).
   // On watr self-host this saves ~6 KB (hot specialized helpers migrate to idx < 128).