jz 0.4.0 → 0.5.0

package/src/analyze.js

@@ -3,7 +3,7 @@
  *
  * # Stage contract
  *   IN:  prepared AST + ctx.func.list (from prepare).
- *   OUT: per-function populated `ctx.func.repByLocal` (val field) + `ctx.func.locals` + `ctx.func.boxed`,
+ *   OUT: per-function populated `ctx.func.localReps` (val field) + `ctx.func.locals` + `ctx.func.boxed`,
  *        module-global `ctx.scope.globalValTypes`, type-analysis `ctx.types.typedElem` /
  *        `.dynKeyVars` / `.anyDynKey`.
  *
@@ -13,18 +13,17 @@
  *   - analyzeBody:         single unified walk — body-keyed cache, returns
  *                          { locals, valTypes, arrElemSchemas, arrElemValTypes, typedElems }
  *   - analyzeValTypes:     ctx-mutating pass — writes types + tracks regex/typed + localProps
- *   - analyzeLocals:       thin clone-and-extend facade over analyzeBody().locals
- *   - analyzeDynKeys:      cross-function scan for `obj[runtimeKey]` → sets ctx.types.dynKeyVars
- *   - analyzeBoxedCaptures:detect mutably-captured vars → ctx.func.boxed cells
+ *   - boxedCaptures:       detect mutably-captured vars → ctx.func.boxed cells
  *   - extractParams/classifyParam/collectParamNames: arrow param AST normalization helpers
  *
- * Ordering: analyzeDynKeys runs once per compile; others run per function during compile().
+ * Ordering: all passes run per function during compile(). plan.js owns the
+ * cross-function dynKey scan via programFacts (results land in ctx.types.dynKeyVars).
  *
  * @module analyze
  */
 
 import { ctx, err } from './ctx.js'
-import { isLiteralStr, isFuncRef } from './ir.js'
+import { isLiteralStr, isFuncRef, I32_MIN, I32_MAX, isI32 } from './ir.js'
 
 export const T = '\uE000'
 
@@ -48,7 +47,7 @@ export function intLiteralValue(expr) {
   else if (Array.isArray(expr) && expr[0] == null && typeof expr[1] === 'number') v = expr[1]
   else if (Array.isArray(expr) && expr[0] === 'u-' && typeof expr[1] === 'number') v = -expr[1]
   else if (typeof expr === 'string') v = repOf(expr)?.intConst ?? ctx.scope.constInts?.get(expr) ?? null
-  return v != null && Number.isInteger(v) && v >= -2147483648 && v <= 2147483647 ? v : null
+  return v != null && Number.isInteger(v) && v >= I32_MIN && v <= I32_MAX ? v : null
 }
 
 /** Non-negative integer literal — used for string/typed-array index bounds. */
@@ -57,7 +56,7 @@ export const nonNegIntLiteral = (node) => { const n = intLiteralValue(node); ret
 /** Collect all `return X` expressions (X != null) from a function body, skipping nested arrow funcs.
  *  Pushes into `out`. Non-returning paths are silently skipped — pair with `alwaysReturns` if total
  *  coverage matters, or with `hasBareReturn` to detect `return;` (undef result). */
-export const collectReturnExprs = (node, out) => {
+const collectReturnExprs = (node, out) => {
   if (!Array.isArray(node)) return
   const [op, ...args] = node
   if (op === '=>') return
@@ -107,13 +106,20 @@ export const VAL = {
   OBJECT: 'object', HASH: 'hash', SET: 'set', MAP: 'map',
   CLOSURE: 'closure', TYPED: 'typed', REGEX: 'regex',
   BIGINT: 'bigint', BUFFER: 'buffer', DATE: 'date',
+  // BOOL is a *type fact* only: the working representation stays i32/f64 0/1
+  // (so branches, arithmetic and the optimizer are untouched). The boxed-atom
+  // carrier (TRUE_NAN/FALSE_NAN, see src/ir.js) is materialized lazily, only at
+  // observation/escape sites — `typeof`, `String`, `JSON.stringify`, the host
+  // return boundary — where boolean identity must survive. Everywhere else a
+  // VAL.BOOL value is just a 0/1 number, so no perf is paid for the distinction.
+  BOOL: 'boolean',
 }
 
 /**
  * ValueRep — unified per-local + per-param representation record. (S2.)
  *
  * One shape, two storages:
- *   - per-local (current func):  ctx.func.repByLocal: Map<name, ValueRep>
+ *   - per-local (current func):  ctx.func.localReps: Map<name, ValueRep>
  *   - per-param (cross-call):    programFacts.paramReps: Map<funcName, Map<paramIdx, ValueRep>>
  *
  * Lattice per field: undefined = unobserved, null = sticky-poison
@@ -129,7 +135,7 @@ export const VAL = {
  *   schemaId:         i32   — schema binding for known-shape OBJECTs
  *   arrayElemSchema:  i32   — Array<schemaId> element shape
  *   arrayElemValType: VAL.* — Array<VAL.*> element val-kind
- *   jsonShape:        obj   — { vt, props?, elem? } for HASH/ARRAY trees parsed
+ *   jsonShape:        obj   — { val, props?, elem? } for HASH/ARRAY trees parsed
  *                             from a compile-time JSON.parse source. Propagates
  *                             through `.prop` and `[i]` so nested chains stay typed.
  *   typedCtor:        str   — TypedArray ctor name (`Float64Array`, …)
@@ -144,37 +150,33 @@ export const VAL = {
  *                             (or `f64.const N`), letting the WAT optimizer fold guards,
  *                             unroll fixed-bound loops, and treeshake the read entirely.
  *                             Cleared if the param is written inside the body.
+ *   notString:        bool   — write-shape evidence proves the binding isn't a primitive
+ *                             string. Gates STRING-vs-typed dispatch elision at `.length`
+ *                             and `xs[i]` reads. Body-walk source: `notStringEvidence` in
+ *                             src/infer.js. Flow-scoped overlay: see `lookupNotString`.
  *
- * Future (S2 stage 4 follow-ups): boxed, intLikely, nullable.
+ * Out-of-band tracking (not rep fields):
+ *   - boxed captures: `ctx.func.boxed: Map<name, cellName>` — set by boxedCaptures
+ *     for mutably-captured locals. Parallel to rep because the cell-based storage is a
+ *     storage decision, not a value-shape fact.
+ *   - flow-sensitive refinements: `ctx.func.refinements: Map<name, {val?, notString?}>` —
+ *     set by emitBody's post-terminator narrowing for the duration of a syntactic suffix.
  */
 
 // === ParamReps lattice helpers (cross-call fixpoint) ===
 // programFacts.paramReps: Map<funcName, Map<paramIdx, ValueRep>>. Per-field lattice:
 // undefined unobserved, null sticky-poison (cross-site disagreement), value = consensus.
 
-/** Per-call-site fact merge into a param's ValueRep field, with sticky-null poison
- *  on disagreement. undefined→observed (set); same value→stay; conflict→null (sticky).
- *  null is "no consensus" — readers treat it as missing. */
-export const mergeParamFact = (rep, key, observed) => {
-  if (rep[key] === null) return                        // sticky poison
-  if (observed == null) { rep[key] = null; return }    // unknown → poison
-  if (rep[key] === undefined) rep[key] = observed
-  else if (rep[key] !== observed) rep[key] = null
-}
-
-/** Get-or-create per-param rep at (funcName, paramIdx) on a paramReps map. */
-export const ensureParamRep = (paramReps, funcName, k) => {
-  let m = paramReps.get(funcName)
-  if (!m) { m = new Map(); paramReps.set(funcName, m) }
-  let r = m.get(k)
-  if (!r) { r = {}; m.set(k, r) }
-  return r
-}
+// Lattice primitives for `paramReps` (`mergeParamFact`, `ensureParamRep`,
+// `clearStickyNull`) live in src/infer.js with the call-site evidence
+// extractors that produce facts for them. `paramFactsOf` (next) stays
+// here because `narrowReturnArrayElems` below consumes it; moving it would
+// invert the analyze.js↔infer.js import direction.
 
 /** Build `paramName → fact` lookup for a caller's already-narrowed param facts.
  *  Used to flow caller's param info into its callees during the cross-call
  *  fixpoint (transitive propagation). Returns null if caller has no facts. */
-export const callerParamFactMap = (paramReps, callerFunc, key) => {
+export const paramFactsOf = (paramReps, callerFunc, key) => {
   if (!callerFunc) return null
   const m = paramReps.get(callerFunc.name)
   if (!m) return null
@@ -189,22 +191,13 @@ export const callerParamFactMap = (paramReps, callerFunc, key) => {
   return out
 }
 
-/** Reset sticky-null on a single field across all params program-wide.
- *  Used between fixpoint phases when newly-narrowed facts unblock previously-
- *  poisoned observations (e.g. valResult set after first pass). */
-export const clearStickyNull = (paramReps, key) => {
-  for (const m of paramReps.values()) for (const r of m.values()) {
-    if (r[key] === null) r[key] = undefined
-  }
-}
-
 /** Get the rep for a local name, or undefined if not tracked. */
-export const repOf = name => ctx.func.repByLocal?.get(name)
+export const repOf = name => ctx.func.localReps?.get(name)
 
 /** Merge fields into a local's rep. Lazily allocates the map and the rep.
  *  Field set to `undefined` removes that field; empty rep is dropped from the map. */
 export const updateRep = (name, fields) => {
-  const m = ctx.func.repByLocal ||= new Map()
+  const m = ctx.func.localReps ||= new Map()
   const prev = m.get(name) || {}
   const next = { ...prev, ...fields }
   for (const k of Object.keys(next)) if (next[k] === undefined) delete next[k]
@@ -213,11 +206,11 @@ export const updateRep = (name, fields) => {
 }
 
 /** Get the rep for a global name, or undefined if not tracked. */
-export const repOfGlobal = name => ctx.scope.repByGlobal?.get(name)
+export const repOfGlobal = name => ctx.scope.globalReps?.get(name)
 
 /** Merge fields into a global's rep. Lazily allocates the map and the rep. */
 export const updateGlobalRep = (name, fields) => {
-  const m = ctx.scope.repByGlobal ||= new Map()
+  const m = ctx.scope.globalReps ||= new Map()
   const prev = m.get(name)
   m.set(name, prev ? { ...prev, ...fields } : { ...fields })
 }
@@ -227,33 +220,50 @@ export const updateGlobalRep = (name, fields) => {
  *  Refinements are pushed by the 'if' emitter when the condition is a type guard
  *  (typeof x === 't', Array.isArray(x), etc.) and popped after the then-branch.
  *  The overlay (`ctx.func.localValTypesOverlay`) is set by analyzeBody/observeSlots passes
- *  pre-emit, when `repByLocal` isn't populated yet but a local Map<name, VAL.*> is
+ *  pre-emit, when `localReps` isn't populated yet but a local Map<name, VAL.*> is
  *  available — lets `const x = new Float64Array(); const y = x[0]` resolve y as NUMBER. */
 export const lookupValType = name => {
   const r = ctx.func.refinements
-  if (r && r.size) { const v = r.get(name); if (v) return v }
+  if (r && r.size) { const v = r.get(name)?.val; if (v) return v }
   const ov = ctx.func.localValTypesOverlay
   if (ov) { const v = ov.get(name); if (v) return v }
-  return ctx.func.repByLocal?.get(name)?.val || ctx.scope.globalValTypes?.get(name) || null
+  return ctx.func.localReps?.get(name)?.val || ctx.scope.globalValTypes?.get(name) || null
+}
+
+/** Resolve `notString` for a binding, overlaying flow-sensitive refinements
+ *  on top of the function-global rep proof. Mirrors `lookupValType`'s precedence:
+ *  refinement first (scope-local), then rep (whole-function). */
+export const lookupNotString = name => {
+  const r = ctx.func.refinements
+  if (r && r.size && r.get(name)?.notString) return true
+  return ctx.func.localReps?.get(name)?.notString === true
 }
 
 /** Infer value type of an AST expression (without emitting). */
 export function valTypeOf(expr) {
   if (expr == null) return null
   if (typeof expr === 'number') return VAL.NUMBER
+  if (typeof expr === 'boolean') return VAL.BOOL
   if (typeof expr === 'bigint') return VAL.BIGINT
   if (typeof expr === 'string') return lookupValType(expr)
   if (!Array.isArray(expr)) return null
 
   const [op, ...args] = expr
   if (op == null) {
-    // Literal forms: [] = undefined, [null, null] = null, [null, n] = number/bigint
+    // Literal forms: [] = undefined, [null, null] = null, [null, n] = number/bigint, [, bool] = boolean
     if (args.length === 0) return null              // undefined literal
     if (args[0] == null) return null                // null literal
+    if (typeof args[0] === 'boolean') return VAL.BOOL
     if (typeof args[0] === 'symbol') return null    // prepared null sentinel
     return typeof args[0] === 'bigint' ? VAL.BIGINT : VAL.NUMBER
   }
 
+  // Boolean-result operators: relational/equality compares and logical-not always
+  // yield a boolean. (`&&`/`||` are value-preserving, not boolean — excluded.)
+  if (op === '!' || op === '<' || op === '<=' || op === '>' || op === '>=' ||
+      op === '==' || op === '!=' || op === '===' || op === '!==' || op === 'in' || op === 'instanceof')
+    return VAL.BOOL
+
   if (op === '[') return VAL.ARRAY
   if (op === 'str' || op === 'strcat') return VAL.STRING
   if (op === '=>') return VAL.CLOSURE
@@ -278,7 +288,7 @@ export function valTypeOf(expr) {
     // Indexed read on a known Array<VAL> receiver: bind by rep.arrayElemValType.
     // Set by analyzeValTypes from body observations + emitFunc preseed for params.
     if (typeof args[0] === 'string') {
-      const elemVt = ctx.func.repByLocal?.get(args[0])?.arrayElemValType
+      const elemVt = ctx.func.localReps?.get(args[0])?.arrayElemValType
       if (elemVt) return elemVt
     }
   }
@@ -296,9 +306,9 @@ export function valTypeOf(expr) {
   // child's val-type. Generic for any compile-time-known JSON literal.
   if (op === '.' && typeof args[1] === 'string') {
     const sh = shapeOf(args[0])
-    if (sh?.vt === VAL.OBJECT || sh?.vt === VAL.HASH) {
+    if (sh?.val === VAL.OBJECT || sh?.val === VAL.HASH) {
       const child = sh.props[args[1]]
-      if (child) return child.vt
+      if (child) return child.val
     }
   }
   // Arithmetic expressions: BigInt if either operand is BigInt, else number
@@ -313,6 +323,23 @@ export function valTypeOf(expr) {
     if (ta === VAL.BIGINT || tb === VAL.BIGINT) return VAL.BIGINT
     return VAL.NUMBER
   }
+  // Assignment & compound-assign expressions return the rhs value. Without this,
+  // `(a = x*x) + (b = y*y)` falls through to null and `+` emits the polymorphic
+  // string-concat dispatch on two pure-numeric subexpressions.
+  if (op === '=') return valTypeOf(args[1])
+  if (op === '+=') {
+    const ta = typeof args[0] === 'string' ? lookupValType(args[0]) : null
+    const tb = valTypeOf(args[1])
+    if (ta === VAL.STRING || tb === VAL.STRING) return VAL.STRING
+    if (ta === VAL.BIGINT || tb === VAL.BIGINT) return VAL.BIGINT
+    return VAL.NUMBER
+  }
+  if (['-=', '*=', '/=', '%=', '**=', '&=', '|=', '^=', '<<=', '>>=', '>>>='].includes(op)) {
+    const ta = typeof args[0] === 'string' ? lookupValType(args[0]) : null
+    const tb = valTypeOf(args[1])
+    if (ta === VAL.BIGINT || tb === VAL.BIGINT) return VAL.BIGINT
+    return VAL.NUMBER
+  }
 
   if (op === '()') {
     const callee = args[0]
@@ -327,9 +354,16 @@ export function valTypeOf(expr) {
       if (callee === 'new.Map') return VAL.MAP
       if (callee === 'new.Date') return VAL.DATE
       if (callee === 'new.ArrayBuffer') return VAL.BUFFER
-      if (callee === 'new.DataView') return VAL.BUFFER
+      // `new Array(...)` is a plain growable Array, not a TypedArray — index
+      // stores must route through __arr_set_idx_ptr (grow + persist), so it
+      // must NOT fall into the new.* → VAL.TYPED catch-all below.
+      if (callee === 'new.Array') return VAL.ARRAY
+      // `new DataView(...)` falls through to VAL.TYPED: a DataView is a proper
+      // view object (TYPED|view ptr over a 16-byte descriptor), same shape as a
+      // typed-array subview — see module/typedarray.js `new.DataView`.
       if (callee.startsWith('new.')) return VAL.TYPED
       if (callee === 'String.fromCharCode' || callee === 'String') return VAL.STRING
+      if (callee === 'Boolean') return VAL.BOOL
       if (callee === 'BigInt' || callee === 'BigInt.asIntN' || callee === 'BigInt.asUintN') return VAL.BIGINT
       if (callee === 'JSON.parse') {
         const src = jsonConstString(args[1])
@@ -369,7 +403,7 @@ export function valTypeOf(expr) {
       }
       if (method === 'push') return VAL.ARRAY
       if ((method === 'shift' || method === 'pop') && typeof obj === 'string') {
-        const elemVt = ctx.func.repByLocal?.get(obj)?.arrayElemValType
+        const elemVt = ctx.func.localReps?.get(obj)?.arrayElemValType
         if (elemVt) return elemVt
       }
       if (method === 'add' || method === 'delete') return VAL.SET
@@ -377,6 +411,12 @@ export function valTypeOf(expr) {
       // String-returning methods
       if (['toUpperCase', 'toLowerCase', 'toLocaleLowerCase', 'trim', 'trimStart', 'trimEnd',
         'repeat', 'padStart', 'padEnd', 'replace', 'replaceAll', 'charAt', 'substring'].includes(method)) return VAL.STRING
+      // `charCodeAt`/`codePointAt` always yield a number (a UTF-16 code unit or
+      // NaN for an out-of-range index — both VAL.NUMBER). Without this, the f64
+      // OOB-NaN result has an unknown val-type and any reader (`+`, `-`, ...)
+      // wraps it in a runtime `__to_num` coercion, pulling the whole number↔
+      // string stdlib tree (`__ftoa`/`__str_concat`/…) for nothing.
+      if (method === 'charCodeAt' || method === 'codePointAt') return VAL.NUMBER
       if (method === 'split') return VAL.ARRAY
       // slice/concat preserve caller type (string.slice → string, array.slice → array)
       if (method === 'slice' || method === 'concat') {
@@ -389,128 +429,8 @@ export function valTypeOf(expr) {
   return null
 }
 
-function jsonConstString(expr) {
-  if (Array.isArray(expr) && expr[0] === 'str' && typeof expr[1] === 'string') return expr[1]
-  if (Array.isArray(expr) && expr[0] == null && typeof expr[1] === 'string') return expr[1]
-  if (typeof expr === 'string') {
-    // Prefer shapeStrs (broader: includes effectively-const `let` string literals
-    // at module scope) over constStrs (const-only). Module/json's static-fold
-    // path uses its own constStrs-only resolver to avoid folding `let`-bound
-    // initializers — preserving the user-controlled distinction. Shape
-    // inference is sound either way: an effectively-const literal's value is
-    // invariant, so the parsed shape it produces is too.
-    return ctx.scope.shapeStrs?.get(expr) ?? ctx.scope.constStrs?.get(expr) ?? null
-  }
-  return null
-}
-
-function jsonShapeStrings(expr) {
-  const single = jsonConstString(expr)
-  if (single != null) return [single]
-  if (Array.isArray(expr) && expr[0] === '[]' && typeof expr[1] === 'string') return ctx.scope.shapeStrArrays?.get(expr[1]) ?? null
-  return null
-}
-
-/** Build a structural shape tree from a parsed JSON value. Each node is
- *  `{ vt, props?, elem? }`. Lets `valTypeOf` propagate VAL kinds through
- *  `.prop` chains and `[i]` reads on bindings sourced from `JSON.parse`
- *  of a compile-time-known string. Polymorphic arrays drop their `elem`. */
-function shapeOfJsonValue(v) {
-  if (v === null || v === undefined) return null
-  if (typeof v === 'number') return { vt: VAL.NUMBER }
-  if (typeof v === 'string') return { vt: VAL.STRING }
-  if (typeof v === 'boolean') return { vt: VAL.NUMBER }
-  if (Array.isArray(v)) {
-    let elem = null
-    for (const x of v) {
-      const s = shapeOfJsonValue(x)
-      if (!s) { elem = null; break }
-      if (!elem) elem = s
-      else if (!shapeUnifies(elem, s)) { elem = null; break }
-    }
-    return { vt: VAL.ARRAY, elem }
-  }
-  if (typeof v === 'object') {
-    const props = Object.create(null)
-    const names = Object.keys(v)
-    for (const k of names) {
-      const s = shapeOfJsonValue(v[k])
-      if (s) props[k] = s
-    }
-    return { vt: VAL.OBJECT, props, names }
-  }
-  return null
-}
-
-function shapeUnifies(a, b) {
-  if (!a || !b || a.vt !== b.vt) return false
-  if (a.vt === VAL.OBJECT || a.vt === VAL.HASH) {
-    const ak = Object.keys(a.props), bk = Object.keys(b.props)
-    if (ak.length !== bk.length) return false
-    for (const k of ak) {
-      if (!b.props[k] || !shapeUnifies(a.props[k], b.props[k])) return false
-    }
-  }
-  if (a.vt === VAL.ARRAY) {
-    if ((a.elem == null) !== (b.elem == null)) return false
-    if (a.elem && !shapeUnifies(a.elem, b.elem)) return false
-  }
-  return true
-}
-
-function shapeLayoutUnifies(a, b) {
-  if (!shapeUnifies(a, b)) return false
-  if (a.vt === VAL.OBJECT || a.vt === VAL.HASH) {
-    if (a.names?.length !== b.names?.length) return false
-    for (let i = 0; i < a.names.length; i++) if (a.names[i] !== b.names[i]) return false
-  }
-  if (a.vt === VAL.ARRAY && a.elem) return shapeLayoutUnifies(a.elem, b.elem)
-  return true
-}
-
-const _jsonShapeCache = new WeakMap()
-function parseJsonShape(src) {
-  if (typeof src !== 'string') return null
-  if (_jsonShapeCache.has(src)) return _jsonShapeCache.get(src)
-  let parsed
-  try { parsed = JSON.parse(src) } catch { _jsonShapeCache.set(Object(src), null); return null }
-  const sh = shapeOfJsonValue(parsed)
-  // WeakMap requires object keys; cache via a wrapper. Skip caching for cold path.
-  return sh
-}
-
-function parseUnifiedJsonShape(srcs) {
-  if (!srcs?.length) return null
-  let out = null
-  for (const src of srcs) {
-    const sh = parseJsonShape(src)
-    if (!sh) return null
-    if (!out) out = sh
-    else if (!shapeLayoutUnifies(out, sh)) return null
-  }
-  return out
-}
-
-/** Resolve the json shape for an expression by walking name → rep.jsonShape and
- *  `.prop` / `[i]` indirection. Returns null when shape is unknown at this site. */
-export function shapeOf(expr) {
-  if (typeof expr === 'string') return ctx.func.repByLocal?.get(expr)?.jsonShape || null
-  if (!Array.isArray(expr)) return null
-  const [op, ...args] = expr
-  if (op === '()' && args[0] === 'JSON.parse') {
-    const srcs = jsonShapeStrings(args[1])
-    if (srcs) return parseUnifiedJsonShape(srcs)
-  }
-  if (op === '.' && typeof args[1] === 'string') {
-    const parent = shapeOf(args[0])
-    if (parent?.vt === VAL.OBJECT || parent?.vt === VAL.HASH) return parent.props[args[1]] || null
-  }
-  if (op === '[]' && args.length === 2) {
-    const parent = shapeOf(args[0])
-    if (parent?.vt === VAL.ARRAY) return parent.elem || null
-  }
-  return null
-}
+// JSON-shape inference (formerly in src/shape.js) — `shapeOf` + `jsonConstString`
+// are defined further down in this file and exported for module consumers.
 
 
 /** Static property-key evaluation for computed member names: folds a node into
@@ -560,8 +480,10 @@ function staticValue(node) {
   if (args.length === 1) {
     const value = staticValue(args[0])
     if (value === NO_VALUE) return NO_VALUE
-    if (op === 'u+') return +value
-    if (op === 'u-') return -value
+    // Parser emits raw `-`/`+` for both unary and binary; prep later normalizes
+    // unary to `u-`/`u+`, but staticPropertyKey runs on raw parser AST.
+    if (op === 'u+' || op === '+') return +value
+    if (op === 'u-' || op === '-') return -value
     if (op === '!') return !value
     if (op === '~') return ~value
     return NO_VALUE
@@ -616,7 +538,7 @@ function staticArrayElems(expr) {
 }
 
 /** Schema-id for an object literal expression. Returns null on dynamic keys, spread, shorthand. */
-function objLiteralSchemaId(expr) {
+export function objLiteralSchemaId(expr) {
   if (!Array.isArray(expr) || expr[0] !== '{}' || !ctx.schema?.register) return null
   const parsed = staticObjectProps(expr.slice(1))
   return parsed ? ctx.schema.register(parsed.names) : null
@@ -695,7 +617,7 @@ export function ctorFromElemAux(aux) {
 /** Sentinel returned by `ternaryCtorOfRhs` when ternary branches resolve to
  *  different typed-array ctors — caller should drop any cached entry rather
  *  than leave a stale ctor (which would lock the wrong store width). */
-export const MIXED_CTORS = Symbol('MIXED_CTORS')
+const MIXED_CTORS = Symbol('MIXED_CTORS')
 
 const typedCtorElemValType = (ctor) => {
   if (!ctor) return null
@@ -712,7 +634,7 @@ const isCondExpr = e => Array.isArray(e) && (e[0] === '?:' || e[0] === '&&' || e
  *  - a single ctor string when every branch resolves to the same ctor,
  *  - MIXED_CTORS when branches resolve to different ctors,
  *  - null when no branch resolves (caller's behavior unchanged). */
-export function ternaryCtorOfRhs(rhs) {
+function ternaryCtorOfRhs(rhs) {
   if (!Array.isArray(rhs)) return null
   const op = rhs[0]
   const lo = op === '?:' ? 2 : (op === '&&' || op === '||') ? 1 : 0
@@ -722,99 +644,358 @@ export function ternaryCtorOfRhs(rhs) {
   return a && b ? (a === b ? a : MIXED_CTORS) : (a || b || null)
 }
 
-// === Cross-call argument inference helpers (used by narrowSignatures fixpoint) ===
-// Each `inferArg*(expr, ...callerCtx)` resolves an argument expression to a single
-// fact (val/schemaId/elem*/typedCtor) using caller-local observations and program
-// facts, returning null when the fact can't be determined at this call site.
+// Cross-call argument inference helpers (`infer*`) live in src/infer.js —
+// they're the call-site mirror of the body-walk evidence sources and pair
+// naturally with that registry. Consumed by src/narrow.js' signature fixpoint.
 
-/** Infer arg val type using caller's body-local valTypes and module globals. */
-export function inferArgType(expr, callerValTypes) {
-  if (typeof expr === 'string') return callerValTypes?.get(expr) || ctx.scope.globalValTypes?.get(expr) || null
-  return valTypeOf(expr)
-}
+// Per-body memoization: analyzeBody is a pure function of `body` plus a small
+// set of ctx fields (func.locals, func.localReps, func.map[*][field]). compile.js
+// calls slices of it many times per function (scan-fixpoint, narrowing, final
+// lowering); the unified cache absorbs that traffic. Caller-mutation safety is
+// preserved by cloning every Map on read (entry value stored once, copies handed out).
+// Invalidation: emitFunc calls `invalidateLocalsCache` after seeding cross-call
+// param facts; compile.js' E2 pass calls `invalidateValTypesCache` after valResult
+// narrowing; narrowReturnArrayElems clears entries between fixpoint iters.
 
-/** Infer arg schemaId. Sources: caller's per-param schemaId map, module-level
- *  ctx.schema.vars binding, or a static-key object literal. */
-export function inferArgSchema(expr, callerSchemas) {
-  if (typeof expr === 'string') {
-    if (callerSchemas?.has(expr)) return callerSchemas.get(expr)
-    const id = ctx.schema.vars.get(expr)
-    return id != null ? id : null
-  }
-  if (Array.isArray(expr) && expr[0] === '{}') {
-    const parsed = staticObjectProps(expr.slice(1))
-    return parsed ? ctx.schema.register(parsed.names) : null
-  }
-  return null
+/**
+ * Per-binding use-summary — the substrate the representation analyses share.
+ *
+ * One traversal classifies every mention of each `let`/`const` binding into a
+ * closed taxonomy of use-kinds (`USE.*`). The eligibility analyses below
+ * (`scanFlatObjects`, `scanSliceViews`, `unboxablePtrs`) are then *policies* —
+ * subset predicates over this summary — rather than three independent body
+ * re-walks. The classification logic is the union of those walks; a use-kind
+ * exists for every distinction at least one consumer needs.
+ *
+ * Deliberately NOT a consumer: `analyzeBody`'s `escapes` map. It looks like a
+ * fourth escape analysis but is not — it is context-sensitive *taint* over
+ * value-expression positions (member access short-circuits, a static index
+ * does not escape but a dynamic one does), woven into the main typing walk it
+ * shares with six other facts. Re-expressing it here would need `BARE` split
+ * by enclosing construct (a plain `name;` statement vs `return name`) and a
+ * second traversal — adding a walk, not removing one. It stays where it is.
+ *
+ * Returns `Map<name, { decls, initRhs, uses }>` for every name the body
+ * `let`/`const`-declares. `uses` is a `UseRecord[]`; a record is
+ * `{ kind, key?, optional?, computed?, compound?, nullCmp?, callee?, argIndex? }`.
+ *
+ * Scoping: decls are collected only outside closures (a `let` inside a nested
+ * `=>` is a different scope), but uses ARE collected inside closures — every
+ * mention there becomes a `CAPTURE`, which every policy treats as
+ * disqualifying. A binding shadowed by an inner closure decl is conservatively
+ * still flagged `CAPTURE`; sound, since it only ever forfeits an optimization.
+ *
+ * Order-independent: uses bucket by name, so a mention before its decl is fine.
+ */
+const USE = {
+  MEMBER_R: 1,       // receiver of a `.`/`?.`/`[]` READ   — {key, optional, computed}
+  MEMBER_W: 2,       // base of a `.`/`[]` WRITE           — {key, computed, compound}
+  REASSIGN: 3,       // `=`(non-init) / `++` / `--` / compound-assign of the name
+  CALL_ARG: 4,       // passed as a call argument          — {callee, argIndex}
+  CALL_CALLEE: 5,    // invoked: `name(...)`
+  RETURN: 6,         // `return name`
+  CAPTURE: 7,        // mentioned inside a nested `=>`
+  COMPARE: 8,        // operand of a comparison            — {nullCmp}
+  CONCAT: 9,         // operand of `+`
+  BOOL_TEST: 10,     // operand of `!`/`typeof`/`void`, or an `if`/`while`/`?:` test
+  DELETE_MEMBER: 11, // `delete name.member`
+  BARE: 12,          // any other value position — the conservative catch-all
 }
+const _bindingUsesCache = new WeakMap()
+const _CMP_OPS = new Set(['==', '!=', '===', '!==', '<', '>', '<=', '>='])
+const _isNullishLit = (e) =>
+  e === 'null' || e === 'undefined' ||
+  (Array.isArray(e) && e[0] == null && (e[1] === null || e[1] === undefined))
+
+function scanBindingUses(body) {
+  const hit = _bindingUsesCache.get(body)
+  if (hit) return hit
 
-/** Infer arg arr-elem-schema. Sources: caller's body-local arr-elem map, caller's
- *  per-param arr-elem (transitive), or a call to an arr-narrowed user fn. */
-export function inferArgArrElemSchema(expr, callerArrElems, callerArrParams) {
-  if (typeof expr === 'string') {
-    if (callerArrElems?.has(expr)) {
-      const v = callerArrElems.get(expr)
-      if (v != null) return v
+  const summary = new Map()                    // name → { decls, initRhs, uses }
+  const slot = (name) => {
+    let s = summary.get(name)
+    if (!s) { s = { decls: 0, initRhs: undefined, uses: [] }; summary.set(name, s) }
+    return s
+  }
+  const use = (name, kind, extra) => slot(name).uses.push(extra ? { kind, ...extra } : { kind })
+
+  // Static string key of a `[]` index node, else null (computed).
+  const litKey = (k) => (Array.isArray(k) && k[0] === 'str' && typeof k[1] === 'string') ? k[1] : null
+
+  // A child sitting in a value position. A bare string there is a real use —
+  // `walk` alone silently drops non-array children, so every value-position
+  // child (let-rhs, assign-rhs, call/index args, closure body, …) must route
+  // through here or its use goes unrecorded (a latent miscompile: the binding
+  // looks unused and an optimization fires unsoundly).
+  const val = (child, inClosure) => {
+    if (typeof child === 'string') use(child, inClosure ? USE.CAPTURE : USE.BARE)
+    else walk(child, inClosure)
+  }
+
+  // Classify the target of an assignment-like node (`=`, compound, `++`, `--`).
+  const assignTarget = (t, compound) => {
+    if (typeof t === 'string') { use(t, USE.REASSIGN); return }
+    if (!Array.isArray(t)) return
+    const o = t[0]
+    if ((o === '.' || o === '?.') && typeof t[1] === 'string') {
+      use(t[1], USE.MEMBER_W, { key: typeof t[2] === 'string' ? t[2] : null, computed: false, compound })
+      return
     }
-    if (callerArrParams?.has(expr)) {
-      const v = callerArrParams.get(expr)
-      if (v != null) return v
+    if (o === '[]' && typeof t[1] === 'string') {
+      const k = litKey(t[2])
+      use(t[1], USE.MEMBER_W, { key: k, computed: k == null, compound })
+      if (t[2] != null) val(t[2])
+      return
     }
-    return null
-  }
-  if (Array.isArray(expr) && expr[0] === '()' && typeof expr[1] === 'string') {
-    const f = ctx.func.map?.get(expr[1])
-    if (f?.arrayElemSchema != null) return f.arrayElemSchema
+    walk(t)                                     // some other LHS shape — generic
   }
-  return null
-}
 
-/** Infer arg arr-elem-VAL. Mirrors inferArgArrElemSchema but tracks VAL.* element kind. */
-export function inferArgArrElemValType(expr, callerArrElemVals, callerArrValParams) {
-  if (typeof expr === 'string') {
-    if (callerArrElemVals?.has(expr)) {
-      const v = callerArrElemVals.get(expr)
-      if (v != null) return v
+  function walk(node, inClosure) {
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    if (typeof op !== 'string') return          // literal node `[null, value]`
+    if (op === 'str') return                    // string literal
+    if (op === '=>') { for (let i = 1; i < node.length; i++) val(node[i], true); return }
+
+    if (op === 'let' || op === 'const') {
+      for (let i = 1; i < node.length; i++) {
+        const d = node[i]
+        if (typeof d === 'string') { if (!inClosure) slot(d).decls++; continue }
+        if (Array.isArray(d) && d[0] === '=') {
+          const lhs = d[1], rhs = d[2]
+          if (typeof lhs === 'string') {
+            if (!inClosure) { const s = slot(lhs); s.decls++; if (s.initRhs === undefined) s.initRhs = rhs }
+          } else {
+            walk(lhs, inClosure)                // pattern — computed keys/defaults are real uses
+          }
+          val(rhs, inClosure)
+        } else walk(d, inClosure)
+      }
+      return
+    }
+
+    if (inClosure) {                            // every mention here is a CAPTURE
+      for (let i = 1; i < node.length; i++) {
+        const c = node[i]
+        if (typeof c === 'string') use(c, USE.CAPTURE)
+        else walk(c, true)
+      }
+      return
     }
-    if (callerArrValParams?.has(expr)) {
-      const v = callerArrValParams.get(expr)
-      if (v != null) return v
+
+    // === precise classification (outside any closure) ===
+    if (ASSIGN_OPS.has(op)) { assignTarget(node[1], op !== '='); val(node[2]); return }
+    if (op === '++' || op === '--') { assignTarget(node[1], true); return }
+    if (op === 'delete') {
+      const t = node[1]
+      if (Array.isArray(t) && (t[0] === '.' || t[0] === '?.' || t[0] === '[]') && typeof t[1] === 'string') {
+        use(t[1], USE.DELETE_MEMBER)
+        if (t[0] === '[]' && t[2] != null) val(t[2])
+      } else val(t)
+      return
+    }
+    if (op === '.' || op === '?.') {
+      const recv = node[1]
+      if (typeof recv === 'string')
+        use(recv, USE.MEMBER_R, { key: typeof node[2] === 'string' ? node[2] : null, optional: op === '?.', computed: false })
+      else walk(recv)
+      return                                    // node[2] is the property name
+    }
+    if (op === '[]') {
+      const recv = node[1], k = litKey(node[2])
+      if (typeof recv === 'string') use(recv, USE.MEMBER_R, { key: k, optional: false, computed: k == null })
+      else walk(recv)
+      if (node[2] != null) val(node[2])
+      return
+    }
+    if (op === ':') {                           // object property `{k:v}` / labeled statement
+      if (Array.isArray(node[1])) walk(node[1]) // computed key `{[expr]:v}` — a real use
+      val(node[2])                              // property value (or the labeled statement)
+      return                                    // string node[1] = plain key / label — not a use
+    }
+    if (op === 'return') {
+      const e = node[1]
+      if (typeof e === 'string') use(e, USE.RETURN)
+      else walk(e)
+      return
+    }
+    if (op === '()') {
+      const callee = node[1]
+      if (typeof callee === 'string') use(callee, USE.CALL_CALLEE)
+      else walk(callee)
+      const argNode = node[2]
+      if (argNode != null) {
+        const args = (Array.isArray(argNode) && argNode[0] === ',') ? argNode.slice(1) : [argNode]
+        for (let ai = 0; ai < args.length; ai++) {
+          const a = args[ai]
+          if (Array.isArray(a) && a[0] === '...') { val(a[1]); continue }
+          if (typeof a === 'string') use(a, USE.CALL_ARG, { callee: typeof callee === 'string' ? callee : null, argIndex: ai })
+          else walk(a)
+        }
+      }
+      return
+    }
+    if (_CMP_OPS.has(op) && node.length === 3) {
+      for (let i = 1; i <= 2; i++) {
+        const side = node[i]
+        if (typeof side === 'string') use(side, USE.COMPARE, { nullCmp: _isNullishLit(node[3 - i]) })
+        else walk(side)
+      }
+      return
+    }
+    if (op === '+') {
+      for (let i = 1; i < node.length; i++) {
+        const c = node[i]
+        if (typeof c === 'string') use(c, USE.CONCAT)
+        else walk(c)
+      }
+      return
+    }
+    if (op === '!' || op === 'typeof' || op === 'void') {
+      const c = node[1]
+      if (typeof c === 'string') use(c, USE.BOOL_TEST)
+      else walk(c)
+      return
+    }
+    if (op === 'if' || op === 'while' || op === '?:') {  // `prepare` normalizes `?` → `?:`
+      const c = node[1]
+      if (typeof c === 'string') use(c, USE.BOOL_TEST)
+      else walk(c)
+      for (let i = 2; i < node.length; i++) val(node[i])
+      return
+    }
+
+    // generic — every string child is a BARE value use
+    for (let i = 1; i < node.length; i++) {
+      const c = node[i]
+      if (typeof c === 'string') use(c, USE.BARE)
+      else walk(c)
     }
-    return null
-  }
-  if (Array.isArray(expr) && expr[0] === '()' && typeof expr[1] === 'string') {
-    const f = ctx.func.map?.get(expr[1])
-    if (f?.arrayElemValType != null) return f.arrayElemValType
   }
-  return null
+
+  walk(body, false)
+
+  for (const [name, s] of summary) if (s.decls === 0) summary.delete(name)
+  _bindingUsesCache.set(body, summary)
+  return summary
 }
 
-/** Infer typed-array ctor (`new.Float64Array` etc.) of an arg expression at a call site.
- *  Sources: caller's body-local typedElems, caller's typed params, literal `new TypedArray(...)`,
- *  calls to typed-narrowed user funcs. Returns null when the ctor can't be determined. */
-export function inferArgTypedCtor(expr, callerTypedElems, callerTypedParams) {
-  if (typeof expr === 'string') {
-    if (callerTypedElems?.has(expr)) return callerTypedElems.get(expr)
-    if (callerTypedParams?.has(expr)) return callerTypedParams.get(expr)
-    return null
-  }
-  const ctor = typedElemCtor(expr)
-  if (ctor) return ctor
-  if (Array.isArray(expr) && expr[0] === '()' && typeof expr[1] === 'string') {
-    const f = ctx.func.map?.get(expr[1])
-    if (f?.sig?.ptrKind === VAL.TYPED && f.sig.ptrAux != null) return ctorFromElemAux(f.sig.ptrAux)
+/**
+ * SRoA eligibility scan — which `let/const o = {staticLiteral}` bindings can
+ * have their fields dissolved into plain WASM locals (`flat` carrier): no heap
+ * alloc, no field load/store, `o.prop` becomes `local.get`.
+ *
+ * A binding is flat-eligible iff `o` appears ONLY as a literal-key `.`/`[]`
+ * READ of an in-schema prop, or the member LHS of a literal-key `.`/`[]` WRITE
+ * of an in-schema prop. Any other mention — bare ref, dynamic/numeric key,
+ * off-schema prop, `?.`, reassignment, compound assign, `++`/`--`, `delete`,
+ * closure capture, self-referential initializer, duplicate keys, or a second
+ * declaration — disqualifies it. A non-escaping object is never observed by
+ * any object walk (keys/values/entries/assign/spread/JSON/for-in/dyn), so the
+ * transform is additive and sound. Conservative: any doubt → not flat.
+ *
+ * A policy over `scanBindingUses`: the shared traversal classifies every
+ * mention; this scan keeps a binding only if its initializer is a self-
+ * contained static literal and every use is an in-schema literal-key access.
+ *
+ * Returns `Map<name, {names, values}>` — the literal's parallel prop arrays.
+ * Field `i` of binding `o` lives in WASM local `o#${i}` (`#` cannot occur in a
+ * jz identifier, so the name is collision-free).
+ */
+function scanFlatObjects(body) {
+  const cand = new Map()                 // name → {names, values}
+
+  // A binding referenced as a value inside `node` (skips `:`/`.` property-name
+  // slots). Used only to reject a self-referential initializer — a literal
+  // whose own field values mention the binding is not a self-contained object.
+  const referencesName = (node, name) => {
+    if (typeof node === 'string') return node === name
+    if (!Array.isArray(node)) return false
+    const op = node[0]
+    if (op === 'str') return false
+    if (op === ':') return referencesName(node[2], name)
+    if (op === '.' || op === '?.') return referencesName(node[1], name)
+    for (let i = 1; i < node.length; i++) if (referencesName(node[i], name)) return true
+    return false
   }
-  return null
+
+  for (const [name, s] of scanBindingUses(body)) {
+    // Candidate: exactly one `let/const name = {staticLiteral}` decl, unique
+    // keys, and an initializer that does not reference the binding itself.
+    if (s.decls !== 1 || !Array.isArray(s.initRhs) || s.initRhs[0] !== '{}') continue
+    const props = staticObjectProps(s.initRhs.slice(1))
+    if (!props || new Set(props.names).size !== props.names.length) continue
+    if (props.values.some(v => referencesName(v, name))) continue
+
+    // Schema = literal keys ∪ plain literal-key member writes. Such a write
+    // monotonically extends the static field universe (the new field reads
+    // `undefined` until the write runs, exactly as JS does); the schema stays
+    // closed because any computed/off-schema access disqualifies below.
+    const schema = new Set(props.names)
+    for (const u of s.uses)
+      if (u.kind === USE.MEMBER_W && !u.compound && !u.computed && u.key != null)
+        schema.add(u.key)
+
+    // Flat iff every mention is an in-schema literal-key `.`/`[]` READ, or an
+    // in-schema literal-key plain `.`/`[]` WRITE. Any other use kind — `?.`,
+    // computed/off-schema key, reassignment, compound or `delete` member write,
+    // `++`/`--`, call arg, closure capture, bare ref — leaves the object live.
+    const flat = s.uses.every(u =>
+      (u.kind === USE.MEMBER_R && !u.optional && !u.computed && schema.has(u.key)) ||
+      (u.kind === USE.MEMBER_W && !u.compound && !u.computed && schema.has(u.key)))
+    if (!flat) continue
+
+    // Materialize the parallel {names, values}: literal props first, then each
+    // extension field (value `undefined`), in first-write order.
+    const names = props.names.slice(), values = props.values.slice()
+    for (const k of schema)
+      if (!names.includes(k)) { names.push(k); values.push(undefined) }
+    cand.set(name, { names, values })
+  }
+  return cand
 }
 
-// Per-body memoization: analyzeBody is a pure function of `body` plus a small
-// set of ctx fields (func.locals, func.repByLocal, func.map[*][field]). compile.js
-// calls slices of it many times per function (scan-fixpoint, narrowing, final
-// lowering); the unified cache absorbs that traffic. Caller-mutation safety is
-// preserved by cloning every Map on read (entry value stored once, copies handed out).
-// Invalidation: emitFunc calls `invalidateLocalsCache` after seeding cross-call
-// param facts; compile.js' E2 pass calls `invalidateValTypesCache` after valResult
-// narrowing; narrowReturnArrayElems clears entries between fixpoint iters.
+/**
+ * No-copy slice scan — which `let/const t = s.slice(...)` bindings can be a
+ * VIEW (a SLICE_BIT pointer straight into `s`'s buffer) instead of a fresh
+ * byte copy.
+ *
+ * jz rewinds the bump arena only at function exit, so every string the
+ * function can observe stays alive until it returns. A view is therefore sound
+ * exactly when its binding does NOT escape the function: `t` must never be
+ * returned, passed as a call argument, stored into a heap object/array,
+ * captured by a closure, aliased to another binding, reassigned, or
+ * compound-assigned. The permitted uses — receiver of a `.`/`[]`, operand of a
+ * comparison or `+`, a boolean test — read `t` synchronously and never persist
+ * it past the function.
+ *
+ * Declared exactly once as `let/const`. The result is purely structural —
+ * whether the receiver is actually a string (so `.slice` lowers to the string
+ * view) is settled later, at emit time, when param types are known; emitDecl
+ * keeps the ordinary copying slice for any non-string receiver. Conservative:
+ * any unrecognised position disqualifies the binding.
+ *
+ * Returns `Set<name>` of view-eligible binding names.
+ */
+// Permitted use-kinds for a slice view — the value is read synchronously and
+// never persisted past the function. `MEMBER_R`/`MEMBER_W` cover any `.`/`[]`
+// receiver; `COMPARE` any comparison; `CONCAT`/`BOOL_TEST` the copy / test
+// positions. Any other kind (reassign, call arg, return, capture, bare alias)
+// escapes and disqualifies the binding.
+const _SLICE_VIEW_OK = new Set([USE.MEMBER_R, USE.MEMBER_W, USE.COMPARE, USE.CONCAT, USE.BOOL_TEST])
+
+function scanSliceViews(body) {
+  const isSliceCall = (n) =>
+    Array.isArray(n) && n[0] === '()' && Array.isArray(n[1])
+    && n[1][0] === '.' && n[1][2] === 'slice'
+
+  const views = new Set()
+  for (const [name, s] of scanBindingUses(body)) {
+    if (s.decls !== 1 || !isSliceCall(s.initRhs)) continue
+    if (s.uses.every(u => _SLICE_VIEW_OK.has(u.kind))) views.add(name)
+  }
+  return views
+}
 
 /**
  * Unified per-body analysis. Single AST traversal producing every per-binding
@@ -845,11 +1026,89 @@ export function inferArgTypedCtor(expr, callerTypedElems, callerTypedParams) {
  */
 const _bodyFactsCache = new WeakMap()
 
+/**
+ * Narrow uint32 accumulator locals to unsigned i32. A local qualifies when its
+ * initializer is a non-negative integer literal in [0, 2^32), every
+ * reassignment is `name = (…) >>> k` (so it always holds a canonical uint32),
+ * and every read sits inside a `>>>` (ToUint32) sink reached only through
+ * bit-faithful operators (`^ & | ~ << >> + - *`). Under those constraints the
+ * raw i32 bit pattern reproduces JS semantics exactly — every observable use is
+ * funnelled through ToUint32 — so the f64 round-trip on the hot path is pure
+ * overhead. Names that escape (closures, bare `return`, signed-sensitive
+ * operands) keep their wider type. Returns the qualifying set; callers retype
+ * `locals` to 'i32' and tag `readVar` reads `.unsigned` for convert_i32_u.
+ */
+function narrowUint32(body, locals) {
+  const TRANSPARENT = new Set(['^', '&', '|', '~', '<<', '>>', '+', '-', '*'])
+  const initLit = new Set()   // names with a valid u32-literal initializer
+  const disq = new Set()      // names disqualified by an unsafe occurrence
+  const seen = new Set()
+  const isU32Lit = e => {
+    const v = typeof e === 'number' ? e
+      : Array.isArray(e) && e[0] == null && typeof e[1] === 'number' ? e[1] : NaN
+    return Number.isInteger(v) && v >= 0 && v < 4294967296
+  }
+  const isAssignOp = op => op[op.length - 1] === '=' &&
+    op !== '==' && op !== '===' && op !== '!=' && op !== '!==' && op !== '<=' && op !== '>='
+  const banNames = n => {
+    if (typeof n === 'string') disq.add(n)
+    else if (Array.isArray(n)) for (let i = 1; i < n.length; i++) banNames(n[i])
+  }
+  const walk = (node, underShr, inClosure) => {
+    if (typeof node === 'string') { if (inClosure) disq.add(node); return }
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    if (typeof op !== 'string') {
+      for (let i = 1; i < node.length; i++) walk(node[i], false, inClosure)
+      return
+    }
+    if (op === '=>') { for (let i = 1; i < node.length; i++) walk(node[i], false, true); return }
+    if (op === 'let' || op === 'const') {
+      for (let i = 1; i < node.length; i++) {
+        const d = node[i]
+        if (Array.isArray(d) && d[0] === '=' && typeof d[1] === 'string') {
+          const nm = d[1]
+          if (seen.has(nm) || inClosure || !isU32Lit(d[2])) disq.add(nm)
+          else initLit.add(nm)
+          seen.add(nm)
+          walk(d[2], false, inClosure)
+        } else if (typeof d === 'string') { disq.add(d); seen.add(d) }
+        else if (Array.isArray(d) && d[0] === '=') { banNames(d[1]); walk(d[2], false, inClosure) }
+      }
+      return
+    }
+    if ((op === '++' || op === '--') && typeof node[1] === 'string') { disq.add(node[1]); return }
+    if (isAssignOp(op)) {
+      const lhs = node[1]
+      if (typeof lhs === 'string') {
+        if (op !== '=' || inClosure || !(Array.isArray(node[2]) && node[2][0] === '>>>')) disq.add(lhs)
+      } else banNames(lhs)
+      walk(node[2], false, inClosure)
+      return
+    }
+    const childShr = op === '>>>' ? true : TRANSPARENT.has(op) ? underShr : false
+    for (let i = 1; i < node.length; i++) {
+      const c = node[i]
+      if (typeof c === 'string') { if (inClosure || !childShr) disq.add(c) }
+      else walk(c, childShr, inClosure)
+    }
+  }
+  walk(body, false, false)
+  const result = new Set()
+  for (const nm of initLit) {
+    if (disq.has(nm)) continue
+    const t = locals.get(nm)
+    if (t !== 'i32' && t !== 'f64') continue
+    locals.set(nm, 'i32')
+    result.add(nm)
+  }
+  return result
+}
+
 /**
  * Returns the cached facts object directly — DO NOT MUTATE the returned maps.
- * Callers that need to extend (e.g. add params to locals) must clone explicitly.
- * `analyzeLocals` is the canonical clone-then-extend facade; everywhere else
- * reads slices via `analyzeBody(body).<slice>`.
+ * Callers that need to extend (e.g. add params to locals) must clone explicitly
+ * before mutating. Slice reads via `analyzeBody(body).<slice>`.
  */
 export function analyzeBody(body) {
   // Non-object bodies (`() => 0`, `() => x`, missing) have nothing to observe
@@ -857,6 +1116,7 @@ export function analyzeBody(body) {
   if (body === null || typeof body !== 'object') return {
     locals: new Map(), valTypes: new Map(), arrElemSchemas: new Map(),
     arrElemValTypes: new Map(), typedElems: new Map(), escapes: new Map(),
+    flatObjects: new Map(),
   }
   const hit = _bodyFactsCache.get(body)
   if (hit) return hit
@@ -901,14 +1161,14 @@ export function analyzeBody(body) {
 
   const elemValOf = (name) => {
     if (typeof name !== 'string') return null
-    const repVt = ctx.func.repByLocal?.get(name)?.arrayElemValType
+    const repVt = ctx.func.localReps?.get(name)?.arrayElemValType
     if (repVt) return repVt
     return arrElemValTypes.get(name) || null
   }
 
   const exprElemSourceVal = (expr) => {
     if (typeof expr === 'string') {
-      const repVt = ctx.func.repByLocal?.get(expr)?.val
+      const repVt = ctx.func.localReps?.get(expr)?.val
       if (repVt) return repVt
       return ctx.scope.globalValTypes?.get(expr) || null
     }
@@ -998,7 +1258,7 @@ export function analyzeBody(body) {
         if (sid2 != null) observeArrSchema(name, sid2)
       }
       if (typeof rhs === 'string') {
-        const repSid = ctx.func.repByLocal?.get(rhs)?.arrayElemSchema
+        const repSid = ctx.func.localReps?.get(rhs)?.arrayElemSchema
         if (repSid != null) observeArrSchema(name, repSid)
       }
     }
@@ -1047,7 +1307,7 @@ export function analyzeBody(body) {
           const refs = ctx.func.refinements
           const hadParam = refs?.has(paramName)
           const prev = hadParam ? refs.get(paramName) : undefined
-          if (refs && recvVt) refs.set(paramName, recvVt)
+          if (refs && recvVt) refs.set(paramName, { val: recvVt })
           let bodyVt = null
           try { bodyVt = valTypeOf(exprBody) }
           finally {
@@ -1109,10 +1369,10 @@ export function analyzeBody(body) {
     if (op === 'let' || op === 'const') {
       for (let i = 1; i < node.length; i++) {
         const a = node[i]
-        // analyzeLocals: bare-name decl
+        // analyzeBody: bare-name decl
         if (typeof a === 'string') { if (!locals.has(a)) locals.set(a, 'f64'); continue }
         if (!Array.isArray(a) || a[0] !== '=') continue
-        // analyzeLocals: destructuring decl — set destructured names to f64, walk rhs only
+        // analyzeBody: destructuring decl — set destructured names to f64, walk rhs only
         if (typeof a[1] !== 'string') {
           for (const n of collectParamNames([a[1]])) if (!locals.has(n)) locals.set(n, 'f64')
           walk(a[2])
@@ -1212,12 +1472,11 @@ export function analyzeBody(body) {
   const prevTypedOverlay = ctx.func.localTypedElemsOverlay
   ctx.func.localValTypesOverlay = valTypes
   ctx.func.localTypedElemsOverlay = typedElems
-  try { walk(body) } finally {
-    ctx.func.localValTypesOverlay = prevOverlay
-    ctx.func.localTypedElemsOverlay = prevTypedOverlay
-  }
+  let unsignedLocals
+  try {
+    walk(body)
 
-  // Second pass: widen i32 locals compared against f64.
+    // Second pass: widen i32 locals compared against f64.
   const CMP_OPS = new Set(['<', '>', '<=', '>=', '==', '!='])
   function widenPass(node) {
     if (!Array.isArray(node)) return
@@ -1237,6 +1496,10 @@ export function analyzeBody(body) {
   // was later re-typed to f64. Without this, integer-init locals shadowed
   // by f64-arithmetic RHSs end up with `i32.trunc_sat_f64_s` truncating the
   // fractional value (e.g. mandelbrot escape: `x2 = zx*zx` losing 3.515 → 3).
+  // Also re-checks `=` and compound-assign reassignments — single-pass walk
+  // visits each assign once with stale operand types, missing widens through
+  // back-edges (`iy = 2.0 * ix * iy + 1.0` where `ix` widens later in the loop
+  // body, demanding `iy` widen on the next iteration).
   // Monotonic: only widens i32 → f64. Bound by locals count so no infinite loop.
   let widened = true
   while (widened) {
@@ -1256,87 +1519,64 @@ export function analyzeBody(body) {
           }
         }
       }
+      if (op === '=' && typeof node[1] === 'string') {
+        const name = node[1], rhs = node[2]
+        if (locals.get(name) === 'i32' && exprType(rhs, locals) === 'f64') {
+          locals.set(name, 'f64'); widened = true
+        }
+      }
+      if ((op === '+=' || op === '-=' || op === '*=' || op === '%=') && typeof node[1] === 'string') {
+        const name = node[1]
+        if (locals.get(name) === 'i32' && exprType([op[0], name, node[2]], locals) === 'f64') {
+          locals.set(name, 'f64'); widened = true
+        }
+      }
+      if (op === '/=' && typeof node[1] === 'string') {
+        const name = node[1]
+        if (locals.get(name) === 'i32') { locals.set(name, 'f64'); widened = true }
+      }
       for (let i = 1; i < node.length; i++) recheck(node[i])
     }
     recheck(body)
   }
 
-  const result = { locals, valTypes, arrElemSchemas, arrElemValTypes, typedElems, escapes }
+  // Narrow proven uint32 accumulator locals to unsigned i32. Runs post-widen so
+  // a local already demoted to f64 above (e.g. compared against an f64) is
+  // reconsidered with final types — and stays f64, since a relational compare
+  // is a non-transparent read that disqualifies narrowing anyway.
+  unsignedLocals = narrowUint32(body, locals)
+} finally {
+    ctx.func.localValTypesOverlay = prevOverlay
+    ctx.func.localTypedElemsOverlay = prevTypedOverlay
+  }
+
+  // SRoA: dissolve non-escaping object-literal bindings into field locals.
+  // The dead `o` local is dropped — every `o` reference is rewritten by the
+  // codegen flat hooks, so a stray `local.get $o` becomes a loud wasm
+  // validation error instead of a silent miscompile.
+  const flatObjects = doSchemas ? scanFlatObjects(body) : new Map()
+  for (const [name, props] of flatObjects) {
+    for (let i = 0; i < props.names.length; i++) locals.set(`${name}#${i}`, 'f64')
+    locals.delete(name)
+  }
+
+  // No-copy slice views — `let t = s.slice(...)` bindings proven non-escaping.
+  // Consumed by emitDecl, which lowers the initializer to a SLICE_BIT view.
+  const sliceViews = doSchemas ? scanSliceViews(body) : new Set()
+
+  const result = { locals, valTypes, arrElemSchemas, arrElemValTypes, typedElems, escapes, flatObjects, sliceViews, unsignedLocals }
   _bodyFactsCache.set(body, result)
   return result
 }
 
 /** Drop the cached analyzeBody entry for this body. Used by emitFunc after
  *  seeding cross-call param VAL facts so the next walk picks up fresh
- *  `ctx.func.repByLocal` (drives exprType receiver-type lookups).
+ *  `ctx.func.localReps` (drives exprType receiver-type lookups).
  *  Same hook as `invalidateValTypesCache` — split names preserve caller intent. */
 export function invalidateLocalsCache(body) {
   if (body && typeof body === 'object') _bodyFactsCache.delete(body)
 }
 
-// String-only methods: presence of `name.method(...)` is definite evidence that
-// `name` is VAL.STRING. Excludes ambiguous methods (length, slice, indexOf, [],
-// concat) that strings share with arrays/typed-arrays.
-const STRING_ONLY_METHODS = new Set([
-  'charCodeAt', 'charAt', 'codePointAt', 'startsWith', 'endsWith',
-  'toUpperCase', 'toLowerCase', 'toLocaleLowerCase', 'normalize', 'localeCompare',
-  'padStart', 'padEnd', 'repeat', 'trimStart', 'trimEnd', 'trim',
-  'matchAll', 'match', 'replace', 'replaceAll', 'split',
-])
-// Array-only methods: presence rules out STRING.
-const ARRAY_ONLY_METHODS = new Set([
-  'push', 'pop', 'shift', 'unshift', 'splice', 'sort', 'fill', 'reverse',
-  'flat', 'flatMap', 'copyWithin',
-])
-
-/** Infer VAL.STRING for `names` from method-call evidence in `body`.
- *  Descends into nested closures (captured names retain shape) but respects
- *  shadowing: a param of a nested `=>` removes that name from the inference
- *  scope inside that closure. Returns Map<name, VAL.STRING> for names that
- *  have at least one string-only method call and no array-only conflicts. */
-export function inferStringParams(body, names) {
-  if (!names || names.length === 0) return new Map()
-  const evidence = new Map() // name → 'string' | 'conflict'
-  function walk(node, scope) {
-    if (!Array.isArray(node) || scope.size === 0) return
-    const op = node[0]
-    if (op === '=>') {
-      const shadowed = collectParamNames([node[1]])
-      let inner = scope
-      for (const s of shadowed) {
-        if (inner.has(s)) {
-          if (inner === scope) inner = new Set(scope)
-          inner.delete(s)
-        }
-      }
-      walk(node[2], inner)
-      return
-    }
-    // `name.method` — observe positive/negative evidence
-    if (op === '.' && typeof node[1] === 'string' && scope.has(node[1])) {
-      const m = node[2]
-      if (typeof m === 'string') {
-        if (STRING_ONLY_METHODS.has(m)) {
-          if (evidence.get(node[1]) !== 'conflict') evidence.set(node[1], 'string')
-        } else if (ARRAY_ONLY_METHODS.has(m)) {
-          evidence.set(node[1], 'conflict')
-        }
-      }
-    }
-    // Reassignment to an unambiguously non-string RHS poisons the inference
-    if (op === '=' && typeof node[1] === 'string' && scope.has(node[1])) {
-      const rhs = node[2]
-      const vt = valTypeOf(rhs)
-      if (vt && vt !== VAL.STRING) evidence.set(node[1], 'conflict')
-    }
-    for (let i = 1; i < node.length; i++) walk(node[i], scope)
-  }
-  walk(body, new Set(names))
-  const out = new Map()
-  for (const [n, ev] of evidence) if (ev === 'string') out.set(n, VAL.STRING)
-  return out
-}
-
 /** Drop the cached analyzeBody entry. Used after E2-phase valResult narrowing
  *  so the next walk re-evaluates `valTypeOf(call)` with up-to-date `f.valResult`
  *  — required for the D-pass paramReps val/arrayElemSchema re-fixpoint to see
@@ -1347,14 +1587,14 @@ export function invalidateValTypesCache(body) {
 
 /**
  * Analyze all local value types from declarations and assignments.
- * Writes the per-name `val` field of `ctx.func.repByLocal` for method dispatch
+ * Writes the per-name `val` field of `ctx.func.localReps` for method dispatch
  * and schema resolution.
  */
 export function analyzeValTypes(body) {
   const valPoison = new Set()
   const setVal = (name, vt) => {
     if (valPoison.has(name)) return
-    const prev = ctx.func.repByLocal?.get(name)?.val
+    const prev = ctx.func.localReps?.get(name)?.val
     if (!vt) {
       if (prev) valPoison.add(name)
       updateRep(name, { val: undefined })
@@ -1367,7 +1607,7 @@ export function analyzeValTypes(body) {
     }
     updateRep(name, { val: vt })
   }
-  const getVal = name => ctx.func.repByLocal?.get(name)?.val
+  const getVal = name => ctx.func.localReps?.get(name)?.val
   // Pre-walk: observe Array<schema> facts so `const p = arr[i]` can bind a schemaId
   // on `p`, unlocking schema slot reads + skipping str_key dispatch on `.prop` access.
   // Parallel arrElemValTypes walk records VAL.* element kinds into
@@ -1378,7 +1618,7 @@ export function analyzeValTypes(body) {
   for (const [name, vt] of facts.arrElemValTypes) {
     if (vt != null) updateRep(name, { arrayElemValType: vt })
   }
-  // Propagate body-observed array-elem schemas to repByLocal so analyzePtrUnboxable's
+  // Propagate body-observed array-elem schemas to localReps so unboxablePtrs's
   // `let p = arr[i]` rule (which only consults rep) sees the schema and can unbox `p`
   // to an i32 offset. Without this, `arr.push({x,y,z})` followed by `arr[i].x` reads
   // pay an i64.reinterpret/i32.wrap on every slot access (no aliasing → CSE can't fold).
@@ -1389,7 +1629,7 @@ export function analyzeValTypes(body) {
   // paramReps[k].arrayElemSchema at emit start) over local body observations.
   const arrElemSchemaOf = (name) => {
     if (typeof name !== 'string') return null
-    const repSid = ctx.func.repByLocal?.get(name)?.arrayElemSchema
+    const repSid = ctx.func.localReps?.get(name)?.arrayElemSchema
     if (repSid != null) return repSid
     const localSid = arrElems.get(name)
     return localSid != null ? localSid : null
@@ -1417,7 +1657,7 @@ export function analyzeValTypes(body) {
     const ctor = typedElemCtor(rhs)
     if (ctor) return setOrInvalidate(ctor)
     // TYPED-narrowed call result carries elem aux on f.sig.ptrAux — reverse-map it
-    // back to a canonical ctor string so analyzePtrUnboxable's typedElemAux lookup
+    // back to a canonical ctor string so unboxablePtrs's typedElemAux lookup
     // (compile.js) restores the same aux on the unboxed local's rep.
     if (Array.isArray(rhs) && rhs[0] === '()' && typeof rhs[1] === 'string') {
       const f = ctx.func.map?.get(rhs[1])
@@ -1434,6 +1674,44 @@ export function analyzeValTypes(body) {
     const tc = ternaryCtorOfRhs(rhs)
     if (tc) setOrInvalidate(tc)
   }
+  // Total write count for `name` across the whole body, recursing into nested
+  // closures so a closure that reassigns the var is also counted. Capped at 2 —
+  // callers only need the "exactly one write" verdict.
+  function writeCount(node, name, n) {
+    if (n > 1 || !Array.isArray(node)) return n
+    const o = node[0]
+    if ((ASSIGN_OPS.has(o) || o === '++' || o === '--') && node[1] === name) n++
+    if (o === 'let' || o === 'const') {
+      for (let i = 1; i < node.length && n <= 1; i++) {
+        const d = node[i]
+        if (Array.isArray(d) && d[0] === '=' && d[2] != null) n = writeCount(d[2], name, n)
+      }
+      return n
+    }
+    for (let i = 1; i < node.length && n <= 1; i++) n = writeCount(node[i], name, n)
+    return n
+  }
+  // Bind an object-literal's schemaId onto its holding local's rep so that
+  // `o.prop` / `o.method()` dispatch is precise instead of falling back to
+  // structural subtyping (which mis-resolves when another in-scope object
+  // shares a member at a different slot). `shapeOf` already covers plain-data
+  // literals on a direct `let o = {…}` decl, but not literals with
+  // function-valued props — and `var o = {…}` is rewritten by jzify into
+  // `let o; o = {…}`, so the schemaId never reaches `o` either way.
+  // `expectWrites` is the reassignment count that marks `o` single-assignment:
+  // 1 for the jzify `=` form (the synthesized assignment IS the only write),
+  // 0 for a direct `let`/`const` decl (the initializer is not counted as a
+  // write). A polymorphically reassigned holder keeps dynamic dispatch.
+  // A name already in `ctx.schema.vars` carries a prepare-phase schema
+  // (Object.assign merge via `inferAssignSchema`, destructure tracking) that
+  // supersedes the bare-literal one — binding here would shadow the merged
+  // schema (rep schemaId wins over `ctx.schema.vars` in `idOf`).
+  function bindObjSchema(name, rhs, expectWrites = 1) {
+    if (ctx.func.current?.params?.some(p => p.name === name)) return
+    if (ctx.schema.vars?.has(name)) return
+    const sid = objLiteralSchemaId(rhs)
+    if (sid != null && writeCount(body, name, 0) === expectWrites) updateRep(name, { schemaId: sid })
+  }
   function walk(node) {
     if (!Array.isArray(node)) return
     const [op, ...args] = node
@@ -1471,26 +1749,30 @@ export function analyzeValTypes(body) {
         const sh = shapeOf(a[2])
         if (sh) {
           updateRep(a[1], { jsonShape: sh })
-          if (sh.vt === VAL.ARRAY && sh.elem?.vt) {
-            updateRep(a[1], { arrayElemValType: sh.elem.vt })
+          if (sh.val === VAL.ARRAY && sh.elem?.val) {
+            updateRep(a[1], { arrayElemValType: sh.elem.val })
             // Array of fixed-shape OBJECTs: register elem schema so `it = items[j]`
             // → `it.prop` lowers to slot read via the existing arr-elem-schema path.
-            if (sh.elem.vt === VAL.OBJECT && sh.elem.names && ctx.schema.register) {
+            if (sh.elem.val === VAL.OBJECT && sh.elem.names && ctx.schema.register) {
               const elemSid = ctx.schema.register(sh.elem.names)
               updateRep(a[1], { arrayElemSchema: elemSid })
             }
           }
-          if (sh.vt === VAL.OBJECT && sh.names && ctx.schema.register) {
+          if (sh.val === VAL.OBJECT && sh.names && ctx.schema.register) {
             const sid = ctx.schema.register(sh.names)
             updateRep(a[1], { schemaId: sid })
             ctx.schema.vars.set(a[1], sid)
           }
         }
+        // `shapeOf` misses object literals with function-valued props; bind
+        // their schemaId here so number-hint ToPrimitive (valueOf/toString slot
+        // dispatch) resolves. expectWrites=0: a decl initializer is not a write.
+        if (vt === VAL.OBJECT) bindObjSchema(a[1], a[2], 0)
         // Propagate schemaId from a narrowed call result so subsequent valTypeOf
         // calls in this function body see the precise schema. emitDecl rebinds
         // this at emission time too — analyze-time binding is what unlocks the
         // slotVT lookup chain in `analyzeValTypes`'s own walk + per-func emit
-        // dispatch reading repByLocal.
+        // dispatch reading localReps.
         if (vt === VAL.OBJECT && Array.isArray(a[2]) && a[2][0] === '()' && typeof a[2][1] === 'string') {
           const f = ctx.func.map?.get(a[2][1])
           if (f?.sig?.ptrAux != null) updateRep(a[1], { schemaId: f.sig.ptrAux })
@@ -1515,6 +1797,7 @@ export function analyzeValTypes(body) {
       if (vt === VAL.REGEX) trackRegex(args[0], args[1])
       if (vt === VAL.TYPED || vt === VAL.BUFFER || isCondExpr(args[1])) trackTyped(args[0], args[1])
       propagateTyped(args[0], args[1])
+      if (vt === VAL.OBJECT) bindObjSchema(args[0], args[1])
       return
     }
     // Track property assignments for auto-boxing: x.prop = val
@@ -1568,8 +1851,11 @@ const INT_MATH_FNS = new Set(['imul', 'clz32', 'floor', 'ceil', 'round', 'trunc'
  *     `&= |= ^= <<= >>= >>>=` (always int by op result type);
  *     `/=` `**=` poison.
  *
- * Writes `intCertain: true` on `ctx.func.repByLocal[name]`. No emit impact —
- * codegen extensions consume this in follow-up passes.
+ * Writes `intCertain: true` on `ctx.func.localReps[name]`. Consumers:
+ *   • `toNumF64` (src/ir.js) — skips the `__to_num` wrapper since an intCertain
+ *     local never carries a NaN-boxed pointer.
+ *   • `Math.floor/ceil/trunc/round` (module/math.js) — short-circuits to the
+ *     identity, eliding the wasm rounding op on an already-integer operand.
  */
 export function analyzeIntCertain(body) {
   // Pass 1: collect every defining RHS per binding name. Compound assignments
@@ -1680,6 +1966,17 @@ export function analyzeIntCertain(body) {
   }
 }
 
+// A directly-uint32 expression: `x >>> 0` (zero-fill shift) or a call to a function
+// already proven `unsignedResult`. Such a value lives in i32 but ranges [0, 2^32),
+// so signed i32 ops on it are wrong — exprType widens its arithmetic to f64 to
+// match emit (which reboxes via `f64.convert_i32_u`). Unsignedness through a local
+// assignment is intentionally not tracked here — kept in lockstep with narrow.js's
+// `isUnsignedTail`, so emit and exprType agree (no trunc_sat saturation).
+const isUnsignedI32Expr = (e) => Array.isArray(e) && (
+  e[0] === '>>>' ||
+  (e[0] === '()' && typeof e[1] === 'string' && ctx.func.map?.get(e[1])?.sig?.unsignedResult === true)
+)
+
 /**
  * Infer expression result type from AST (without emitting).
  * Used to determine local variable types before compilation.
@@ -1688,7 +1985,7 @@ export function analyzeIntCertain(body) {
 export function exprType(expr, locals) {
   if (expr == null) return 'f64'
   if (typeof expr === 'number')
-    return Number.isInteger(expr) && expr >= -2147483648 && expr <= 2147483647 && !Object.is(expr, -0) ? 'i32' : 'f64'
+    return isI32(expr) ? 'i32' : 'f64'
   if (typeof expr === 'string') {
     if (locals?.has?.(expr)) return locals.get(expr)
     const paramType = ctx.func.current?.params?.find(p => p.name === expr)?.type
@@ -1729,7 +2026,7 @@ export function exprType(expr, locals) {
     return 'f64'
   }
   // `.length` on a known sized receiver returns i32 directly (__len/__str_byteLen
-  // both return i32). Letting it stay i32 lets analyzeLocals keep the counter
+  // both return i32). Letting it stay i32 lets analyzeBody keep the counter
   // local i32 too, eliminating the per-iteration `f64.convert_i32_s` widen and
   // the matching `i32.trunc_sat_f64_s` truncs at every `arr[i]` / `i*k` site.
   // Only safe when receiver type is statically known to expose an integer length.
@@ -1751,10 +2048,32 @@ export function exprType(expr, locals) {
   // Always i32
   if (['>', '<', '>=', '<=', '==', '!=', '!', '&', '|', '^', '~', '<<', '>>', '>>>'].includes(op)) return 'i32'
   // Preserve i32 if both operands i32
-  if (['+', '-', '*', '%'].includes(op)) {
+  if (op === '+' || op === '-' || op === '%') {
     const ta = exprType(args[0], locals)
     const tb = args[1] != null ? exprType(args[1], locals) : ta // unary: inherit
-    return ta === 'i32' && tb === 'i32' ? 'i32' : 'f64'
+    if (ta !== 'i32' || tb !== 'i32') return 'f64'
+    // A uint32 operand ([0, 2^32)) makes the result exceed signed i32 range, so
+    // emit widens to f64 (see emit.js `+`/`-`/`%`). exprType must agree — else
+    // narrowing the result back to i32 would trunc_sat-saturate the f64 to INT32_MAX.
+    if (isUnsignedI32Expr(args[0]) || (args[1] != null && isUnsignedI32Expr(args[1]))) return 'f64'
+    return 'i32'
+  }
+  // `*` — a JS multiply is an f64 operation; `i32.mul` reproduces it faithfully
+  // only while the exact product is f64-exact. Stay i32 when both operands are
+  // i32 *and* the product provably fits: a fully-static product checked
+  // directly, otherwise a literal operand small enough that |literal|·2^31 ≤
+  // 2^53 (mirrors emit.js `mulFitsI32` — keeps `i*4` i32, widens `h*16777619`).
+  if (op === '*') {
+    const ta = exprType(args[0], locals), tb = exprType(args[1], locals)
+    if (ta !== 'i32' || tb !== 'i32') return 'f64'
+    // uint32 operand: product can exceed i32; emit widens to f64 (see emit.js `*`).
+    if (isUnsignedI32Expr(args[0]) || isUnsignedI32Expr(args[1])) return 'f64'
+    if (sv !== NO_VALUE && typeof sv === 'number') return isI32(sv) ? 'i32' : 'f64'
+    const small = e => {
+      const v = staticValue(e)
+      return v !== NO_VALUE && typeof v === 'number' && Math.abs(v) <= 0x400000
+    }
+    return small(args[0]) || small(args[1]) ? 'i32' : 'f64'
   }
   // Unary preserves type
   if (op === 'u-' || op === 'u+') return exprType(args[0], locals)
@@ -1771,12 +2090,13 @@ export function exprType(expr, locals) {
   // through, instead of widening the local to f64 because exprType defaulted.
   if (op === '()') {
     if (args[0] === 'math.imul' || args[0] === 'math.clz32') return 'i32'
-    // Method calls returning i32: charCodeAt → byte (0..255). Lets tokenizer-shape
-    // hot loops keep `c` as i32 across `c >= 48 && c <= 57`, `c - 48`, etc.,
-    // skipping the f64.convert_i32_u widen at every char read.
-    if (Array.isArray(args[0]) && args[0][0] === '.' && args[0][2] === 'charCodeAt') return 'i32'
+    // charCodeAt: i32 when the index is provably in `[0, recv.length)` (an
+    // induction variable bounded by `recv.length` — OOB impossible). Otherwise
+    // f64: the JS-spec OOB result is NaN, which is not representable as i32.
+    if (Array.isArray(args[0]) && args[0][0] === '.' && args[0][2] === 'charCodeAt'
+        && inBoundsCharCodeAt(ctx).has(args[0])) return 'i32'
     // User-function call: consult the callee's narrowed result type. By the time
-    // analyzeLocals runs in emitFunc, narrowSignatures has set sig.results[0]='i32'
+    // analyzeBody runs in emitFunc, narrowSignatures has set sig.results[0]='i32'
     // on every body-i32-only func. Propagating this lets `let h = userFn(...)`
     // (mix in callback bench: i32-FNV) keep h as an i32 local instead of widening
     // to f64 and round-tripping i32↔f64 every iteration.
@@ -1788,15 +2108,9 @@ export function exprType(expr, locals) {
   return 'f64'
 }
 
-/**
- * Analyze all local declarations and assignments to determine types.
- * A local is i32 if ALL assignments produce i32. Any f64 widens to f64.
- *
- * Thin slice of `analyzeBody` (single unified walk).
- */
-export function analyzeLocals(body) {
-  return analyzeBody(body).locals
-}
+// `analyzeBody` was inlined to `analyzeBody(body).locals` at its three real
+// call sites in src/compile.js and src/narrow.js — the one-line facade existed
+// only as a historical surface and obscured the unified-walk relationship.
 
 /**
  * Identify locals that can be stored as an unboxed i32 pointer offset instead of
@@ -1813,18 +2127,16 @@ export function analyzeLocals(body) {
  *       SET    ← `new Set(...)`
  *       MAP    ← `new Map(...)`
  *       CLOSURE← `=>` literal
- *       BUFFER ← `new ArrayBuffer(...)` / `new DataView(...)`
+ *       BUFFER ← `new ArrayBuffer(...)`
  *       TYPED  ← `new XxxArray(...)` / method returning typed array
+ *                (`new DataView(...)` is TYPED but stays boxed — no elem aux)
  *   - not captured in boxed storage (boxed locals stay f64 for the heap slot)
  *   - never compared to null/undefined (we lose the nullish NaN representation)
  *
  * Returns Map<name, VAL> of locals to unbox.
  */
-export function analyzePtrUnboxable(body, locals, boxed) {
-  const candidates = new Set()
-  const disqualified = new Set()
-  const valOf = name => ctx.func.repByLocal?.get(name)?.val
-
+export function unboxablePtrs(body, locals, boxed) {
+  const valOf = name => ctx.func.localReps?.get(name)?.val
   const UNBOXABLE_KINDS = new Set([VAL.OBJECT, VAL.SET, VAL.MAP, VAL.BUFFER, VAL.TYPED, VAL.CLOSURE, VAL.DATE])
 
   // RHS must produce a fresh, non-null pointer of the declared VAL kind.
@@ -1851,7 +2163,7 @@ export function analyzePtrUnboxable(body, locals, boxed) {
       // subsequent `p.x` reads then become direct `f64.load offset=K (local.get $p)`
       // (since ptrOffsetIR sees ptrKind=OBJECT and skips the per-access wrap).
       if (expr[0] === '[]' && typeof expr[1] === 'string') {
-        const repSid = ctx.func.repByLocal?.get(expr[1])?.arrayElemSchema
+        const repSid = ctx.func.localReps?.get(expr[1])?.arrayElemSchema
         return repSid != null
       }
       return false
@@ -1863,7 +2175,7 @@ export function analyzePtrUnboxable(body, locals, boxed) {
         if (kind === VAL.SET) return callee === 'new.Set'
         if (kind === VAL.MAP) return callee === 'new.Map'
         if (kind === VAL.DATE) return callee === 'new.Date'
-        if (kind === VAL.BUFFER) return callee === 'new.ArrayBuffer' || callee === 'new.DataView'
+        if (kind === VAL.BUFFER) return callee === 'new.ArrayBuffer'
         if (kind === VAL.TYPED) return callee.endsWith('Array') && callee !== 'new.ArrayBuffer'
       }
       // Call to narrow-ABI'd helper of matching VAL kind.
@@ -1884,77 +2196,165 @@ export function analyzePtrUnboxable(body, locals, boxed) {
     }
     return false
   }
-  const isNullishLit = (expr) =>
-    expr === 'null' || expr === 'undefined' ||
-    (Array.isArray(expr) && expr[0] == null &&
-      (expr[1] === null || expr[1] === undefined))
+  // A policy over `scanBindingUses`: an UNBOXABLE-kind `let/const` local with a
+  // fresh-pointer initializer stays unboxable unless some use forbids it. The
+  // only forbidding uses are a reassignment (`=`/compound/`++`/`--`) or a
+  // null/undefined comparison (an unboxed pointer has no nullish NaN form).
+  // Closure captures do not disqualify — a capture-*mutated* local is already
+  // in `boxed`, and a capture-*read* leaves the pointer in its own slot.
+  const result = new Map()
+  for (const [name, s] of scanBindingUses(body)) {
+    const vt = valOf(name)
+    if (!UNBOXABLE_KINDS.has(vt)) continue
+    if (locals.get(name) !== 'f64') continue
+    if (boxed?.has(name)) continue
+    if (!isFreshInit(s.initRhs, vt)) continue
+    const ok = s.uses.every(u =>
+      u.kind !== USE.REASSIGN && !(u.kind === USE.COMPARE && u.nullCmp))
+    if (ok) result.set(name, vt)
+  }
+  return result
+}
+
+/**
+ * CSE-safe load bases — `let/const` pointer locals whose `(f64.load offset=K $X)`
+ * reads `cseScalarLoad` (src/optimize.js) may scalar-replace without a store
+ * clobbering them. `cseScalarLoad` is module-wide disabled because it scanned
+ * *every* i32 local; a store through an i32 local legitimately aliasing the load
+ * base returned stale bytes. This pass is the missing soundness gate: a
+ * per-function whitelist, each entry proven non-aliasing — guarantee, not guess.
+ *
+ * `X` qualifies iff ALL hold:
+ *  (a) X is an unboxed pointer — `localReps.get(X).ptrKind` set, `locals[X]==='i32'`.
+ *  (b) X is bound exactly once (no re-decl, no `=`/`++`/`--`/compound reassign).
+ *  (c) Every occurrence of X is the receiver of a `.`/`?.`/`[]` *read* — never a
+ *      write target, never a bare value (alias / arg / return / stored element),
+ *      never captured by a closure. So X's pointer lives only in `$X`; nothing
+ *      else holds it, and no store names it.
+ *  (d) The allocation X's bytes live in is disjoint from every store target.
+ *      jz allocations carry one kind each and distinct kinds never share bytes,
+ *      so X is store-safe when every store's base has a determinable kind ≠ X's
+ *      source kind. Any indeterminable store target disqualifies the whole set
+ *      (a store through unknown memory could alias anything).
+ *
+ * (c)+(d): no store in the function can touch a cell reachable via `$X + K`, so
+ * a load on `$X` is invariant between two control-flow boundaries — exactly
+ * `cseScalarLoad`'s straight-line region model. Method-call mutations (`.push`,
+ * …) need no accounting here: the pass already flushes its table on every call.
+ *
+ * Returns `Set<name>` — names only, no `$` prefix (the caller stamps it).
+ */
+export function cseSafeLoadBases(body, locals, localReps) {
+  if (body === null || typeof body !== 'object') return new Set()
 
-  function collect(node) {
+  // Allocation kind a pointer name's bytes live in: ptrKind (unboxed) wins,
+  // else value-kind, else an array-schema'd binding is an ARRAY, else unknown.
+  const kindOf = (name) => {
+    if (typeof name !== 'string') return null
+    const r = localReps?.get(name)
+    return r?.ptrKind || r?.val || (r?.arrayElemSchema != null ? VAL.ARRAY : null) ||
+      ctx.scope.globalValTypes?.get(name) || null
+  }
+  // X's bytes live in: the array/object an element read drew it from
+  // (`X = src[i]` / `X = src.f`), else a fresh `{}`/`new` (X's own kind).
+  const srcKind = (rhs) =>
+    Array.isArray(rhs) && (rhs[0] === '[]' || rhs[0] === '.' || rhs[0] === '?.') &&
+      typeof rhs[1] === 'string' ? kindOf(rhs[1]) : valTypeOf(rhs)
+
+  // Pass 1 — bound-once unboxed-pointer candidates; record each source kind.
+  const cand = new Map()                 // name → source allocation kind
+  const declCount = new Map()
+  const collect = (node) => {
     if (!Array.isArray(node)) return
-    const [op, ...args] = node
+    const op = node[0]
     if (op === '=>') return
     if (op === 'let' || op === 'const') {
-      for (const a of args) {
-        if (!Array.isArray(a) || a[0] !== '=' || typeof a[1] !== 'string') continue
-        const name = a[1]
-        const vt = valOf(name)
-        if (!UNBOXABLE_KINDS.has(vt)) continue
-        if (locals.get(name) !== 'f64') continue
-        if (boxed?.has(name)) continue
-        if (!isFreshInit(a[2], vt)) continue
-        candidates.add(name)
+      for (let i = 1; i < node.length; i++) {
+        const a = node[i]
+        if (typeof a === 'string') { declCount.set(a, (declCount.get(a) || 0) + 1); continue }
+        if (Array.isArray(a) && a[0] === '=' && typeof a[1] === 'string') {
+          const name = a[1]
+          declCount.set(name, (declCount.get(name) || 0) + 1)
+          if (localReps?.get(name)?.ptrKind != null && locals.get(name) === 'i32')
+            cand.set(name, srcKind(a[2]))
+          collect(a[2])
+        } else collect(a)
       }
+      return
     }
-    for (const a of args) collect(a)
+    for (let i = 1; i < node.length; i++) collect(node[i])
   }
+  collect(body)
+  for (const [n, c] of declCount) if (c > 1) cand.delete(n)
+  if (!cand.size) return new Set()
 
-  const NULL_CMP_OPS = new Set(['==', '!=', '===', '!=='])
-
-  function check(node) {
+  // Pass 2 — every occurrence must be a `.`/`?.`/`[]` read receiver (c).
+  const live = new Set(cand.keys())
+  const walk = (node, inClosure) => {
     if (!Array.isArray(node)) return
-    const [op, ...args] = node
-    if (op === '=>') return
-    if (ASSIGN_OPS.has(op) && typeof args[0] === 'string' && candidates.has(args[0])) {
-      if (op !== '=') disqualified.add(args[0])
-      // Initial `let x = {…}` arrives here too as op='='; the `let` pass already vetted it.
-      // A later `x = …` in the same body is a re-assignment — disqualify unless it's the init.
-      // We detect by tracking count: if we see '=' twice for the same name, disqualify.
-    }
-    if ((op === '++' || op === '--') && typeof args[0] === 'string' && candidates.has(args[0]))
-      disqualified.add(args[0])
-    if (NULL_CMP_OPS.has(op)) {
-      for (let i = 0; i < 2; i++) {
-        const side = args[i], other = args[1 - i]
-        if (typeof side === 'string' && candidates.has(side) && isNullishLit(other)) disqualified.add(side)
+    const op = node[0]
+    if (op === 'str') return
+    const closured = inClosure || op === '=>'
+    if (op === 'let' || op === 'const') {        // decl `=` — bound name is not a use
+      for (let i = 1; i < node.length; i++) {
+        const a = node[i]
+        if (typeof a === 'string') continue
+        if (Array.isArray(a) && a[0] === '=') {
+          if (typeof a[1] !== 'string') walk(a[1], closured)
+          walk(a[2], closured)
+        } else walk(a, closured)
       }
+      return
+    }
+    if (op === '.' || op === '?.' || op === '[]') {   // member READ — receiver is safe
+      const o = node[1]
+      if (typeof o === 'string') { if (inClosure && cand.has(o)) live.delete(o) }
+      else walk(o, closured)
+      if (op === '[]' && node[2] != null) walk(node[2], closured)
+      return
+    }
+    if (ASSIGN_OPS.has(op) || op === '++' || op === '--' || op === 'delete') {
+      const t = node[1]                            // write target — X here disqualifies
+      if (typeof t === 'string') { if (cand.has(t)) live.delete(t) }
+      else if (Array.isArray(t) && (t[0] === '.' || t[0] === '?.' || t[0] === '[]') &&
+               typeof t[1] === 'string' && cand.has(t[1])) live.delete(t[1])
+      else walk(t, closured)
+      for (let i = 2; i < node.length; i++) walk(node[i], closured)
+      return
+    }
+    for (let i = 1; i < node.length; i++) {        // any other position — bare X escapes
+      const c = node[i]
+      if (typeof c === 'string') { if (cand.has(c)) live.delete(c) }
+      else walk(c, closured)
     }
-    for (const a of args) check(a)
   }
+  walk(body, false)
+  if (!live.size) return live
 
-  // Count bare `=` assignments per candidate. Init `let x = …` is NOT parsed as `['=', x, …]`
-  // at the statement level — it's inside `['let', ['=', x, …]]`. A standalone `['=', x, …]`
-  // at statement level IS a reassignment.
-  const assignCount = new Map()
-  function countAssigns(node, inLet) {
+  // Pass 3 — store-target disjointness (d). A store lands in `base`'s allocation.
+  let unknownStore = false
+  const storeKinds = new Set()
+  const scanStores = (node) => {
     if (!Array.isArray(node)) return
-    const [op, ...args] = node
-    if (op === '=>') return
-    if (op === '=' && !inLet && typeof args[0] === 'string' && candidates.has(args[0])) {
-      assignCount.set(args[0], (assignCount.get(args[0]) || 0) + 1)
+    const op = node[0]
+    if ((ASSIGN_OPS.has(op) || op === '++' || op === '--') && Array.isArray(node[1]) &&
+        (node[1][0] === '.' || node[1][0] === '?.' || node[1][0] === '[]') &&
+        typeof node[1][1] === 'string') {
+      const k = kindOf(node[1][1])
+      if (k == null) unknownStore = true
+      else storeKinds.add(k)
     }
-    const childInLet = op === 'let' || op === 'const'
-    for (const a of args) countAssigns(a, childInLet)
+    for (let i = 1; i < node.length; i++) scanStores(node[i])
   }
+  scanStores(body)
+  if (unknownStore) return new Set()
 
-  collect(body)
-  check(body)
-  countAssigns(body, false)
-
-  for (const [name, count] of assignCount) if (count > 0) disqualified.add(name)
-
-  const result = new Map()
-  for (const name of candidates) if (!disqualified.has(name)) result.set(name, valOf(name))
-  return result
+  const safe = new Set()
+  for (const name of live) {
+    const k = cand.get(name)
+    if (k != null && !storeKinds.has(k)) safe.add(name)
+  }
+  return safe
 }
 
 // === Param / closure helpers ===
@@ -2038,6 +2438,17 @@ export function findFreeVars(node, bound, free, scope) {
     findFreeVars(args[1], innerBound, free, scope)
     return
   }
+  if (op === 'catch') {
+    // ['catch', tryBody, errName, handler] — errName is a binding occurrence,
+    // not a reference, and is in scope only inside the handler. Recursing into
+    // it as a plain string would mis-capture an outer var of the same name.
+    findFreeVars(args[0], bound, free, scope)
+    const errName = args[1]
+    const handlerBound = typeof errName === 'string' && errName
+      ? new Set(bound).add(errName) : bound
+    findFreeVars(args[2], handlerBound, free, scope)
+    return
+  }
   if (op === 'let' || op === 'const') {
     collectParamNames(args, bound)
     if (scope) collectParamNames(args, scope)
@@ -2065,65 +2476,11 @@ export function findMutations(node, names, mutated) {
   for (const a of args) findMutations(a, names, mutated)
 }
 
-/**
- * Pre-scan AST for variables that need a `__dyn_props` shadow sidecar.
- *
- * The shadow exists so `obj[runtimeKey]` can read a value via `__dyn_get`,
- * and `obj.prop = v` keeps the sidecar in sync. Most object literals are only
- * accessed via `.prop` or `obj['lit']`, both of which resolve through the
- * schema directly and bypass the shadow. Allocating + populating the sidecar
- * for those literals is pure waste.
- *
- * Populates:
- *  - ctx.types.dynKeyVars: Set<string> — names accessed via runtime key
- *  - ctx.types.anyDynKey: boolean — any dynamic key access exists in program
- *    (used for escaping literals where no target var is known)
- */
-export function analyzeDynKeys(...roots) {
-  const dynVars = new Set()
-  let anyDyn = false
-
-  function walk(node) {
-    if (!Array.isArray(node)) return
-    const [op, ...args] = node
-    if (op === '[]') {
-      const [obj, idx] = args
-      if (!isLiteralStr(idx)) {
-        anyDyn = true
-        if (typeof obj === 'string') dynVars.add(obj)
-      }
-    }
-    if (op === '=' && Array.isArray(args[0]) && args[0][0] === '[]') {
-      const [, obj, idx] = args[0]
-      if (!isLiteralStr(idx)) {
-        anyDyn = true
-        if (typeof obj === 'string') dynVars.add(obj)
-      }
-    }
-    // Runtime for-in (compile-time unroll didn't fire) → walks via shadow
-    if (op === 'for-in') {
-      anyDyn = true
-      if (typeof args[1] === 'string') dynVars.add(args[1])
-    }
-    for (const a of args) walk(a)
-  }
-  for (const r of roots) walk(r)
-  if (ctx.func.list) for (const f of ctx.func.list) if (f.body) walk(f.body)
-  const initFacts = ctx.module.initFacts
-  if (initFacts?.anyDyn) {
-    anyDyn = true
-    for (const v of initFacts.dynVars) dynVars.add(v)
-  }
-
-  ctx.types.dynKeyVars = dynVars
-  ctx.types.anyDynKey = anyDyn
-}
-
 /**
  * Pre-scan function body for captured variables that are mutated.
  * Marks mutably-captured vars in ctx.func.boxed for cell-based capture.
  */
-export function analyzeBoxedCaptures(body) {
+export function boxedCaptures(body) {
   const outerScope = new Set()
   ;(function collectDecls(node) {
     if (!Array.isArray(node)) return
@@ -2225,7 +2582,7 @@ export function narrowReturnArrayElems(field, paramReps, valueUsed) {
       for (const p of func.sig.params) if (!ctx.func.locals.has(p.name)) ctx.func.locals.set(p.name, p.type)
       const localElems = facts[sliceKey]
       ctx.func.locals = savedLocals
-      const paramElemMap = callerParamFactMap(paramReps, func, field) || new Map()
+      const paramElemMap = paramFactsOf(paramReps, func, field) || new Map()
       const resolveExpr = (expr) => {
         if (typeof expr === 'string') {
           if (localElems.has(expr)) {
@@ -2258,6 +2615,452 @@ export function narrowReturnArrayElems(field, paramReps, valueUsed) {
   }
 }
 
+/**
+ * Whole-program SRoA eligibility — decides which object schemas may back an
+ * `Array<S>` with the `structInline` carrier (the K f64 schema fields inlined
+ * per element, no per-row heap object). Writes `ctx.schema.inlineArray:
+ * Set<sid>`, read by the array push / index / length codegen.
+ *
+ * Default-disqualify: a schema is inlinable only when *every* observed use of
+ * every `Array<S>` binding — across all user functions and module inits — is
+ * one the structInline codegen handles. A missed or unrecognized use poisons
+ * the schema, so the worst outcome is a lost optimization, never a stride
+ * mismatch (miscompile).
+ *
+ * Handled uses of an `Array<S>` binding `a`:
+ *   - decl/reassign from `[]` (empty), a call returning `Array<S>`, or an alias
+ *   - `a.push({S-literal})`        — struct push (K-cell store)
+ *   - `a.length`                  — physical len / K
+ *   - `a[i]` consumed as `const p = a[i]` cursor, or directly `a[i].field`
+ *   - `a` passed where the callee param is `Array<S>` (paramReps agreement)
+ *   - `return a` when the enclosing function returns `Array<S>`
+ * A cursor `p` (`const p = a[i]`) may only be read/written as `p.field`.
+ * Anything else — bare ref, value escape, other array method, `a[i] = …`
+ * element-replace — poisons S.
+ *
+ * Reads codegen truth: a binding is `Array<S>` iff its settled rep
+ * (`funcFacts.get(func).localReps`) carries `arrayElemSchema = S` — the exact
+ * map the emitter consults — so the analysis and the emitter never disagree on
+ * which bindings are inline-carried.
+ *
+ * Conservative corners (sound, give up the optimization): closures and module
+ * inits are not walked in detail — any schema reachable as a `.push({S})`
+ * argument, an `Array<S>`-returning call, an `[{S}, …]` literal, or a captured
+ * tracked array inside one is poisoned.
+ */
+export function analyzeStructInline(funcFacts, programFacts) {
+  const inlineArray = ctx.schema?.inlineArray
+  if (!inlineArray || !ctx.schema?.list) return
+  const { paramReps } = programFacts
+  const cand = new Set()      // sids observed as an `Array<S>` element schema
+  const black = new Set()     // sids disqualified by some use
+
+  const propsOf = (sid) => ctx.schema.list[sid] || []
+  const inSchema = (sid, p) => typeof p === 'string' && propsOf(sid).includes(p)
+  const isStrLit = (k) => Array.isArray(k) && k[0] === 'str' && typeof k[1] === 'string'
+
+  // Argument list of a `['()', callee, argNode]` call node.
+  const argsOf = (node) => {
+    const a = node[2]
+    return a == null ? [] : (Array.isArray(a) && a[0] === ',') ? a.slice(1) : [a]
+  }
+
+  // `name` referenced anywhere as a value (skips `:`/`.` property-name slots).
+  const mentions = (node, name) => {
+    if (typeof node === 'string') return node === name
+    if (!Array.isArray(node)) return false
+    const op = node[0]
+    if (op === 'str') return false
+    if (op === ':') return mentions(node[2], name)
+    if (op === '.' || op === '?.') return mentions(node[1], name)
+    for (let i = 1; i < node.length; i++) if (mentions(node[i], name)) return true
+    return false
+  }
+
+  // Poison every schema whose `Array<S>` could materialize inside an un-walked
+  // subtree (closure body / module init): `.push({S})` args, `Array<S>`-returning
+  // calls, `[{S}, …]` array literals. Standalone `{S}` objects are independent
+  // of array layout and intentionally left alone.
+  const poisonAll = (node) => {
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    if (op === '()') {
+      const callee = node[1]
+      if (typeof callee === 'string') {
+        const sid = ctx.func.map?.get(callee)?.arrayElemSchema
+        if (sid != null) black.add(sid)
+      } else if (Array.isArray(callee) && callee[0] === '.' && callee[2] === 'push') {
+        for (const a of argsOf(node)) {
+          const sid = objLiteralSchemaId(a)
+          if (sid != null) black.add(sid)
+        }
+      }
+    } else if (op === '[' || op === '[]') {
+      for (const el of staticArrayElems(node) || []) {
+        const sid = objLiteralSchemaId(el)
+        if (sid != null) black.add(sid)
+      }
+    }
+    for (let i = 1; i < node.length; i++) poisonAll(node[i])
+  }
+
+  for (const [func, facts] of funcFacts) {
+    const body = func?.body
+    const reps = facts?.localReps
+    if (func?.raw || !reps || body == null || typeof body !== 'object') continue
+
+    // `Array<S>` bindings of this function (codegen truth) and their schemas.
+    const arrName = new Map()       // name → sid
+    for (const [name, r] of reps) {
+      const sid = r?.arrayElemSchema
+      if (sid == null) continue
+      if ((propsOf(sid).length || 0) < 1) continue   // K=0 — not inlinable
+      cand.add(sid)
+      arrName.set(name, sid)
+    }
+    if (!arrName.size) continue
+
+    // A structInline `Array<S>` value is only ever born from an empty `[]`
+    // grown by structInline `.push`. `expr` is such a producer of `Array<sid>`
+    // iff it is: a tracked `Array<sid>` alias, an empty `[]` literal, or a call
+    // to a user function (whose returned array is structInline whenever sid
+    // survives this whole-program pass). Every other source — a non-empty
+    // `[{S},…]` literal, a builtin call (`JSON.parse`, `Object.values`, `.map`,
+    // `.slice`, a member access onto a parsed object) — yields a taggedLinear
+    // array and must poison sid.
+    const safeArrSource = (expr, sid) => {
+      if (typeof expr === 'string') return arrName.get(expr) === sid
+      if (!Array.isArray(expr)) return false
+      const elems = staticArrayElems(expr)
+      if (elems) return elems.length === 0
+      return expr[0] === '()' && typeof expr[1] === 'string' && !!ctx.func.map?.has(expr[1])
+    }
+
+    // Pass 1 — collect `const p = a[i]` cursors; drop on name clash / re-decl.
+    const cursor = new Map()        // name → sid
+    const declSeen = new Set()
+    const collectCursors = (node) => {
+      if (!Array.isArray(node) || node[0] === '=>') return
+      if (node[0] === 'let' || node[0] === 'const') {
+        for (let i = 1; i < node.length; i++) {
+          const d = node[i]
+          if (!Array.isArray(d) || d[0] !== '=' || typeof d[1] !== 'string') continue
+          const name = d[1], rhs = d[2]
+          if (declSeen.has(name)) { const s = cursor.get(name); if (s != null) black.add(s) }
+          declSeen.add(name)
+          if (Array.isArray(rhs) && rhs[0] === '[]' && rhs.length === 3 &&
+              typeof rhs[1] === 'string' && arrName.has(rhs[1]) && !isStrLit(rhs[2])) {
+            const sid = arrName.get(rhs[1])
+            if (cursor.has(name) || arrName.has(name)) black.add(sid)
+            else cursor.set(name, sid)
+          }
+        }
+      }
+      for (let i = 1; i < node.length; i++) collectCursors(node[i])
+    }
+    collectCursors(body)
+
+    // A `['[]', arrName, idx]` element read of a tracked array → its sid.
+    const elemArrSid = (n) =>
+      Array.isArray(n) && n[0] === '[]' && n.length === 3 &&
+      typeof n[1] === 'string' && arrName.has(n[1]) && !isStrLit(n[2])
+        ? arrName.get(n[1]) : null
+
+    // Pass 2 — verify every occurrence is a structInline-handled use.
+    const flag = (c) => {
+      if (typeof c !== 'string') return false
+      if (arrName.has(c)) { black.add(arrName.get(c)); return true }
+      if (cursor.has(c)) { black.add(cursor.get(c)); return true }
+      return false
+    }
+    const visitChild = (c) => { if (!flag(c)) verify(c) }
+
+    function verify(node) {
+      if (!Array.isArray(node)) return
+      const op = node[0]
+      if (op === 'str') return
+      if (op === '=>') {                       // closure — un-walked, poison
+        for (const n of arrName.keys()) if (mentions(node, n)) black.add(arrName.get(n))
+        for (const [n, s] of cursor) if (mentions(node, n)) black.add(s)
+        poisonAll(node)
+        return
+      }
+      if (op === ':') { visitChild(node[2]); return }
+
+      if (op === '.' || op === '?.') {
+        const o = node[1], p = node[2]
+        if (typeof o === 'string') {
+          if (arrName.has(o)) { if (!(op === '.' && p === 'length')) black.add(arrName.get(o)) }
+          else if (cursor.has(o)) { if (!(op === '.' && inSchema(cursor.get(o), p))) black.add(cursor.get(o)) }
+          return
+        }
+        const esid = elemArrSid(o)
+        if (esid != null) {
+          if (!(op === '.' && inSchema(esid, p))) black.add(esid)
+          visitChild(o[2])
+          return
+        }
+        visitChild(o)
+        return
+      }
+
+      if (op === '[]') {
+        const o = node[1], k = node[2]
+        if (typeof o === 'string') {
+          if (arrName.has(o)) black.add(arrName.get(o))   // element value escape
+          else if (cursor.has(o)) { if (!(isStrLit(k) && inSchema(cursor.get(o), k[1]))) black.add(cursor.get(o)) }
+          if (k != null) visitChild(k)
+          return
+        }
+        const esid = elemArrSid(o)
+        if (esid != null) {
+          if (!(isStrLit(k) && inSchema(esid, k[1]))) black.add(esid)
+          visitChild(o[2])
+        } else if (o != null) visitChild(o)
+        if (k != null) visitChild(k)
+        return
+      }
+
+      // Reassignment of the array binding — the rhs must be a structInline
+      // `Array<S>` producer; an alias is left un-walked (flagging it would
+      // self-poison), other producers are walked to verify their subtree.
+      if (op === '=' && typeof node[1] === 'string' && arrName.has(node[1])) {
+        const sid = arrName.get(node[1])
+        if (!safeArrSource(node[2], sid)) black.add(sid)
+        else if (typeof node[2] !== 'string') visitChild(node[2])
+        return
+      }
+
+      if (op === '()') {
+        const callee = node[1]
+        if (Array.isArray(callee) && callee[0] === '.') {
+          const recv = callee[1], method = callee[2]
+          if (typeof recv === 'string' && arrName.has(recv)) {
+            const sid = arrName.get(recv)
+            const args = argsOf(node)
+            if (method !== 'push' || !args.length) black.add(sid)
+            else for (const arg of args) {
+              if (Array.isArray(arg) && arg[0] === '{}' && objLiteralSchemaId(arg) === sid) {
+                for (let i = 1; i < arg.length; i++) {
+                  const pr = arg[i]
+                  visitChild(Array.isArray(pr) && pr[0] === ':' ? pr[2] : pr)
+                }
+              } else black.add(sid)
+            }
+            return
+          }
+          if (typeof recv === 'string' && cursor.has(recv)) { black.add(cursor.get(recv)); return }
+          const esid = elemArrSid(recv)
+          if (esid != null) { black.add(esid); visitChild(recv[2]) }
+          else visitChild(recv)
+          for (const a of argsOf(node)) visitChild(a)
+          return
+        }
+        if (typeof callee === 'string') {
+          const args = argsOf(node)
+          const known = ctx.func.map?.has(callee)
+          const cParams = paramReps?.get(callee)
+          for (let k = 0; k < args.length; k++) {
+            const arg = args[k]
+            if (typeof arg === 'string' && arrName.has(arg)) {
+              const sid = arrName.get(arg)
+              if (!(known && cParams?.get(k)?.arrayElemSchema === sid)) black.add(sid)
+            } else if (!flag(arg)) verify(arg)
+          }
+          return
+        }
+        visitChild(callee)
+        for (const a of argsOf(node)) visitChild(a)
+        return
+      }
+
+      if (op === 'return') {
+        const e = node[1]
+        if (typeof e === 'string') {
+          if (arrName.has(e)) { if (func.arrayElemSchema !== arrName.get(e)) black.add(arrName.get(e)) }
+          else flag(e)
+          return
+        }
+        // A function typed `Array<S>` must return a structInline producer —
+        // a non-empty literal / builtin call here yields a taggedLinear array.
+        if (func.arrayElemSchema != null && !safeArrSource(e, func.arrayElemSchema))
+          black.add(func.arrayElemSchema)
+        const esid = elemArrSid(e)
+        if (esid != null) { black.add(esid); visitChild(e[2]); return }
+        if (e != null) visitChild(e)
+        return
+      }
+
+      if (op === 'let' || op === 'const') {
+        for (let i = 1; i < node.length; i++) {
+          const d = node[i]
+          if (!Array.isArray(d) || d[0] !== '=') { if (Array.isArray(d)) visitChild(d); continue }
+          const name = d[1], rhs = d[2]
+          if (typeof name === 'string' && cursor.has(name) &&
+              Array.isArray(rhs) && rhs[0] === '[]') {
+            if (rhs[2] != null) visitChild(rhs[2])   // cursor decl — verify index only
+            continue
+          }
+          if (typeof name === 'string' && arrName.has(name)) {
+            const sid = arrName.get(name)
+            if (!safeArrSource(rhs, sid)) black.add(sid)               // non-structInline producer
+            else if (typeof rhs !== 'string') visitChild(rhs)          // [] / user-call — verify subtree
+            continue
+          }
+          if (typeof name !== 'string') visitChild(name)
+          visitChild(rhs)
+        }
+        return
+      }
+
+      for (let i = 1; i < node.length; i++) visitChild(node[i])
+    }
+    verify(body)
+  }
+
+  // Module inits are not walked in detail — poison any schema whose array form
+  // could appear there (struct-array consumed/built at module scope).
+  if (ctx.module?.moduleInits) for (const mi of ctx.module.moduleInits) poisonAll(mi)
+
+  for (const sid of cand) if (!black.has(sid)) inlineArray.add(sid)
+}
+
+/** Schema id when `name` is bound (codegen truth) to a structInline `Array<S>`,
+ *  else null. `ctx.func.localReps` is the per-function rep map the emitter
+ *  consults for element-schema facts; `ctx.schema.inlineArray` is the
+ *  whole-program eligibility set filled by `analyzeStructInline`. Read together
+ *  so the emitter never inline-carries a binding the analysis rejected. */
+export function inlineArraySid(name) {
+  if (typeof name !== 'string') return null
+  const sid = ctx.func.localReps?.get(name)?.arrayElemSchema
+  return sid != null && ctx.schema.inlineArray?.has(sid) ? sid : null
+}
+
+/**
+ * Whole-program function-namespace SRoA analysis.
+ *
+ * A user function used as a property bag — `parse.space = …; parse.step()` —
+ * is otherwise compiled as a dynamic object: each `f.prop` write becomes a
+ * `__dyn_set` into a hash side-table keyed by the closure pointer, each read a
+ * `__dyn_get`. But a function's property table can never be observed by the
+ * host (the host gets only the callable; the table lives in jz linear memory),
+ * so the property set is statically closed — jz sees every `f.PROP` site. When
+ * `f` never escapes as a bare value, each property dissolves:
+ *   - written once, at module top level, to a known function → the property is
+ *     constant: every `f.PROP` site rewrites straight to that function name
+ *     (direct calls, no storage at all).
+ *   - otherwise → a mutable f64 module global (`global.get` / `global.set`).
+ *
+ * Returns `Map<funcName, { disq, props:Set, valRead:Set,
+ * writes:Map<prop,[{rhs,atInit}]> }>` — `valRead` is the subset of props read
+ * as a value (not merely called). `flattenFuncNamespaces` (plan.js) turns it
+ * into the rewrite. A name carrying `disq` escapes / is reassigned / is
+ * computed-indexed and must not be touched.
+ */
+export function analyzeFuncNamespaces(ast) {
+  const funcNames = ctx.func.names
+  if (!funcNames || !funcNames.size) return new Map()
+
+  const ns = new Map()
+  const rec = (name) => {
+    let r = ns.get(name)
+    if (!r) ns.set(name, r = { disq: false, props: new Set(), valRead: new Set(), writes: new Map() })
+    return r
+  }
+  // `['.'|'?.', f, P]` member where f is a known function and P a string key.
+  const memberOf = (n) =>
+    Array.isArray(n) && (n[0] === '.' || n[0] === '?.') &&
+    isFuncRef(n[1], funcNames) && typeof n[2] === 'string' ? n : null
+
+  // `atInit` — node is a direct top-level statement (constant-fold candidate);
+  // read only at the `=` handler, never propagated into sub-expressions.
+  function visit(node, atInit) {
+    if (typeof node === 'string') {
+      // Bare mention of a known function in value position — it escapes; an
+      // alias could reach its property table. Disqualify.
+      if (funcNames.has(node)) rec(node).disq = true
+      return
+    }
+    if (!Array.isArray(node)) return
+    const op = node[0]
+
+    if (op === 'let' || op === 'const') {
+      for (let i = 1; i < node.length; i++) {
+        const d = node[i]
+        if (Array.isArray(d) && d[0] === '=') {
+          if (!isFuncRef(d[1], funcNames)) visit(d[1], false)  // skip f's own decl
+          // `let f = f` is prepare's self-name placeholder for a lifted function —
+          // skip it (a bare visit would falsely disqualify f). Any other funcRef
+          // rhs (`let g = f`) is a real alias and must disqualify f.
+          if (!(isFuncRef(d[2], funcNames) && d[2] === d[1])) visit(d[2], false)
+        } else visit(d, false)
+      }
+      return
+    }
+
+    if (op === 'export') {
+      // Exporting the function value is safe — the host gets the callable,
+      // never the linear-memory property table. Skip bare function children.
+      for (let i = 1; i < node.length; i++)
+        if (!isFuncRef(node[i], funcNames)) visit(node[i], false)
+      return
+    }
+
+    if (op === '=') {
+      const m = memberOf(node[1])
+      if (m) {
+        const r = rec(m[1]); r.props.add(m[2])
+        let w = r.writes.get(m[2]); if (!w) r.writes.set(m[2], w = [])
+        w.push({ rhs: node[2], atInit })
+        visit(node[2], false)
+        return
+      }
+      if (isFuncRef(node[1], funcNames)) rec(node[1]).disq = true  // reassignment
+      else visit(node[1], false)
+      visit(node[2], false)
+      return
+    }
+
+    if (op === '()') {
+      const m = memberOf(node[1])
+      if (m) rec(m[1]).props.add(m[2])
+      else if (!isFuncRef(node[1], funcNames)) visit(node[1], false)  // bare f(...) ok
+      for (let i = 2; i < node.length; i++) visit(node[i], false)
+      return
+    }
+
+    // `f.PROP` / `f?.PROP` as a plain value (read) — not the callee of a call
+    // (those are handled by the `()` branch above). A value-read means the
+    // property's stored value must stay retrievable; devirt cannot drop it.
+    const m = memberOf(node)
+    if (m) { const r = rec(m[1]); r.props.add(m[2]); r.valRead.add(m[2]); return }
+
+    // Computed `f[k]` — the key set is no longer static.
+    if (op === '[]' && isFuncRef(node[1], funcNames)) {
+      rec(node[1]).disq = true
+      for (let i = 2; i < node.length; i++) visit(node[i], false)
+      return
+    }
+
+    for (let i = 1; i < node.length; i++) visit(node[i], false)
+  }
+
+  const visitTop = (n) => {
+    if (Array.isArray(n) && n[0] === ';')
+      for (let i = 1; i < n.length; i++) visit(n[i], true)
+    else visit(n, true)
+  }
+  visitTop(ast)
+  // Bundled multi-module programs keep each module's top-level statements in
+  // moduleInits, not `ast` — the `f.prop = …` writes that define a namespace
+  // live there. Walk them at init scope so writes are recorded and an escape
+  // inside init code still disqualifies.
+  for (const mi of ctx.module.moduleInits || []) visitTop(mi)
+  for (const fn of ctx.func.list) if (fn.body && !fn.raw) visit(fn.body, false)
+
+  return ns
+}
+
 /**
  * Phase: program-fact collection.
  *
@@ -2372,7 +3175,16 @@ export function collectProgramFacts(ast) {
   // through valTypeOf → lookupValType. Skips into closures — they're observed via
   // their own func.list entry. The overlay is the per-function analyzeBody.valTypes
   // map (already populated with the same overlay-aware walk).
-  if (doSchema && f.hasSchemaLiterals) observeProgramSlots(ast)
+  if (doSchema && f.hasSchemaLiterals) {
+    observeProgramSlots(ast)
+    // Per-slot intCertain mirror of the per-binding lattice. Runs after slot
+    // type observation (which it does not depend on) — same trigger gate so
+    // programs without schema literals skip both. Re-runnable: subsequent
+    // collectProgramFacts invocations (E2 phase) overwrite the same map; the
+    // analysis is monotone-down so re-running can only widen poisoning, never
+    // un-poison — safe.
+    analyzeSchemaSlotIntCertain(ast)
+  }
 
   return {
     dynVars: f.dynVars, anyDyn: f.anyDyn, propMap, valueUsed, callSites,
@@ -2431,3 +3243,576 @@ export function observeProgramSlots(ast) {
   }
   ctx.func.localValTypesOverlay = prevOverlay
 }
+
+/** Whole-program slot intCertain observation.
+ *
+ *  A schema slot `(sid, idx)` is `intCertain` iff every write to it across the
+ *  program is integer-shaped (literal int, bitwise op, intCertain local read,
+ *  …). Mirrors `analyzeIntCertain`'s `isIntExpr` rules but works at module
+ *  scope: each body gets a local `intCertain` fixpoint over its own bindings,
+ *  then schema writes within that body are reduced against the fixpoint.
+ *
+ *  Global poison semantics: any non-int write to a slot — in any body —
+ *  permanently flips it false. Slots never observed stay `undefined`.
+ *
+ *  Cross-function flow (slot written from a call's return value) is **not**
+ *  tracked — those writes count as non-int and poison the slot. Conservative:
+ *  produces only false negatives, never false positives. */
+export function analyzeSchemaSlotIntCertain(ast) {
+  if (!ctx.schema?.register) return
+  const slotIntCertain = ctx.schema.slotIntCertain
+  const poisonSlot = (sid, idx) => {
+    let arr = slotIntCertain.get(sid)
+    if (!arr) { arr = []; slotIntCertain.set(sid, arr) }
+    while (arr.length <= idx) arr.push(undefined)
+    arr[idx] = false
+  }
+  const observeSlot = (sid, idx, isInt) => {
+    let arr = slotIntCertain.get(sid)
+    if (!arr) { arr = []; slotIntCertain.set(sid, arr) }
+    while (arr.length <= idx) arr.push(undefined)
+    if (arr[idx] === false) return
+    if (!isInt) { arr[idx] = false; return }
+    if (arr[idx] === undefined) arr[idx] = true
+  }
+
+  // Per-body fixpoint: replicates analyzeIntCertain's two-pass collect/iterate
+  // but stays local to the body so it can run during collectProgramFacts
+  // (before emit-time inferLocals sets per-function intCertain reps).
+  const analyzeBodyLocally = (body) => {
+    const defs = new Map()
+    const pushDef = (name, rhs) => {
+      let list = defs.get(name)
+      if (!list) { list = []; defs.set(name, list) }
+      list.push(rhs)
+    }
+    const collect = (node) => {
+      if (!Array.isArray(node)) return
+      const [op, ...args] = node
+      if (op === '=>') return
+      if (op === 'let' || op === 'const') {
+        for (const a of args)
+          if (Array.isArray(a) && a[0] === '=' && typeof a[1] === 'string') pushDef(a[1], a[2])
+      } else if (op === '=' && typeof args[0] === 'string') {
+        pushDef(args[0], args[1])
+      } else if (typeof op === 'string' && op.length > 1 && op.endsWith('=') &&
+                 !INT_CMP_OPS.has(op) && op !== '=>' && typeof args[0] === 'string') {
+        pushDef(args[0], [op.slice(0, -1), args[0], args[1]])
+      } else if ((op === '++' || op === '--') && typeof args[0] === 'string') {
+        pushDef(args[0], [op === '++' ? '+' : '-', args[0], [null, 1]])
+      }
+      for (const a of args) collect(a)
+    }
+    collect(body)
+    const intCertain = new Map()
+    for (const name of defs.keys()) intCertain.set(name, true)
+    const isIntExpr = (expr) => {
+      if (typeof expr === 'number') return Number.isInteger(expr) && !Object.is(expr, -0)
+      if (typeof expr === 'boolean') return true
+      if (typeof expr === 'string') return intCertain.get(expr) === true
+      if (!Array.isArray(expr)) return false
+      const sv = staticValue(expr)
+      if (sv !== NO_VALUE && typeof sv === 'number' && Object.is(sv, -0)) return false
+      const [op, ...args] = expr
+      if (op == null) {
+        const v = args[0]
+        if (typeof v === 'number') return Number.isInteger(v) && !Object.is(v, -0)
+        if (typeof v === 'boolean') return true
+        return false
+      }
+      if (INT_BIT_OPS.has(op) || INT_CMP_OPS.has(op)) return true
+      if (op === '.') {
+        if ((args[1] === 'length' || args[1] === 'byteLength') && typeof args[0] === 'string') {
+          const vt = lookupValType(args[0])
+          return vt === VAL.TYPED || vt === VAL.ARRAY || vt === VAL.STRING || vt === VAL.BUFFER
+        }
+        if (args[1] === 'size' && typeof args[0] === 'string') {
+          const vt = lookupValType(args[0])
+          return vt === VAL.SET || vt === VAL.MAP
+        }
+        return false
+      }
+      if (INT_CLOSED_OPS.has(op)) {
+        const a = isIntExpr(args[0])
+        const b = args[1] != null ? isIntExpr(args[1]) : a
+        return a && b
+      }
+      if (op === 'u-' || op === 'u+') return isIntExpr(args[0])
+      if (op === '?:') return isIntExpr(args[1]) && isIntExpr(args[2])
+      if (op === '&&' || op === '||') return isIntExpr(args[0]) && isIntExpr(args[1])
+      if (op === '()') {
+        const c = args[0]
+        if (typeof c === 'string' && c.startsWith('math.') && INT_MATH_FNS.has(c.slice(5))) return true
+        if (Array.isArray(c) && c[0] === '.' && c[1] === 'Math' && INT_MATH_FNS.has(c[2])) return true
+      }
+      return false
+    }
+    let changed = true
+    while (changed) {
+      changed = false
+      for (const [name, rhsList] of defs) {
+        if (!intCertain.get(name)) continue
+        if (!rhsList.every(isIntExpr)) { intCertain.set(name, false); changed = true }
+      }
+    }
+    return isIntExpr
+  }
+
+  // Body walker: for each `{}` literal observe per-slot intCertain; for each
+  // `obj.prop = expr` write, poison-or-confirm the slot resolved via the
+  // schema attached to `obj` (ValueRep `schemaId` or `ctx.schema.vars`).
+  const visit = (node, isInt) => {
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    if (op === '=>') return
+    if (op === '{}') {
+      const parsed = staticObjectProps(node.slice(1))
+      if (parsed) {
+        const sid = ctx.schema.register(parsed.names)
+        for (let i = 0; i < parsed.values.length; i++) observeSlot(sid, i, isInt(parsed.values[i]))
+      }
+    } else if (op === '=' && Array.isArray(node[1]) && node[1][0] === '.') {
+      const [, obj, prop] = node[1]
+      if (typeof obj === 'string') {
+        // Same precise-path resolution as ctx.schema.slotVT — no structural
+        // fallback (slot index could differ across schemas with the same prop).
+        const sid = repOf(obj)?.schemaId ?? ctx.schema.vars.get(obj)
+        if (sid != null) {
+          const idx = ctx.schema.list[sid]?.indexOf(prop)
+          if (idx >= 0) observeSlot(sid, idx, isInt(node[2]))
+          else if (idx < 0) {/* off-schema write — irrelevant to existing slots */}
+        }
+      }
+    }
+    for (let i = 1; i < node.length; i++) visit(node[i], isInt)
+  }
+
+  if (ast) visit(ast, analyzeBodyLocally(ast))
+  for (const func of ctx.func.list) {
+    if (!func.body || func.raw) continue
+    visit(func.body, analyzeBodyLocally(func.body))
+  }
+  if (ctx.module.initFacts?.hasSchemaLiterals && ctx.module.moduleInits) {
+    for (const mi of ctx.module.moduleInits) visit(mi, analyzeBodyLocally(mi))
+  }
+}
+
+// =============================================================================
+// AST predicate helpers — pure functions over jz AST arrays
+// =============================================================================
+// AST nodes are strings (identifiers), numbers (literals), or arrays where [0]
+// is the operator tag (e.g. ['+', a, b], ['=>', params, body]). [null, value]
+// denotes a parenthesized/boxed literal.
+
+export const MAX_SMALL_FOR_UNROLL = 8
+export const MAX_NESTED_FOR_UNROLL = 64
+
+/** Detect whether `name` is written to (=, +=, ++, --, etc.) anywhere within `body`.
+ *  Conservative over-reject: if unsure, treat as written.
+ *  `let`/`const` declarations are NOT reassignments — only the initializer expressions
+ *  inside them are scanned. */
+export function isReassigned(body, name) {
+  if (!Array.isArray(body)) return false
+  const op = body[0]
+  if (ASSIGN_OPS.has(op) && body[1] === name) return true
+  if ((op === '++' || op === '--') && body[1] === name) return true
+  if (op === 'let' || op === 'const') {
+    for (let i = 1; i < body.length; i++) {
+      const d = body[i]
+      if (Array.isArray(d) && d[0] === '=' && d[2] != null && isReassigned(d[2], name)) return true
+    }
+    return false
+  }
+  for (let i = 1; i < body.length; i++) if (isReassigned(body[i], name)) return true
+  return false
+}
+
+/** Does `body` contain a `continue` that targets THIS loop?
+ *  A `continue` inside a nested `for`/`while`/`do` targets the inner loop, so we don't count it. */
+export function hasOwnContinue(body) {
+  if (!Array.isArray(body)) return false
+  const op = body[0]
+  if (op === 'continue') return true
+  if (op === 'for' || op === 'while' || op === 'do') return false
+  for (let i = 1; i < body.length; i++) if (hasOwnContinue(body[i])) return true
+  return false
+}
+
+export function hasOwnBreakOrContinue(body) {
+  if (!Array.isArray(body)) return false
+  const op = body[0]
+  if (op === 'break' || op === 'continue') return true
+  if (op === 'for' || op === 'while' || op === 'do' || op === '=>') return false
+  for (let i = 1; i < body.length; i++) if (hasOwnBreakOrContinue(body[i])) return true
+  return false
+}
+
+export function containsNestedClosure(body) {
+  if (!Array.isArray(body)) return false
+  if (body[0] === '=>') return true
+  for (let i = 1; i < body.length; i++) if (containsNestedClosure(body[i])) return true
+  return false
+}
+
+export function containsNestedLoop(body) {
+  if (!Array.isArray(body)) return false
+  const op = body[0]
+  if (op === 'for' || op === 'while' || op === 'do') return true
+  if (op === '=>') return false
+  for (let i = 1; i < body.length; i++) if (containsNestedLoop(body[i])) return true
+  return false
+}
+
+/** Recursive loop size estimator — product of trip counts for nested `for (let i=0; i<N; i++)` loops. */
+export function nestedSmallLoopBudget(body) {
+  if (!Array.isArray(body)) return 1
+  if (body[0] === '=>') return 1
+  if (body[0] === 'for') {
+    const [, init, cond, step, loopBody] = body
+    const n = smallConstForTripCount(init, cond, step)
+    return n == null ? MAX_NESTED_FOR_UNROLL + 1 : n * nestedSmallLoopBudget(loopBody)
+  }
+  let max = 1
+  for (let i = 1; i < body.length; i++) max = Math.max(max, nestedSmallLoopBudget(body[i]))
+  return max
+}
+
+export function containsDeclOf(body, name) {
+  if (!Array.isArray(body)) return false
+  const op = body[0]
+  if (op === '=>') return false
+  if (op === 'let' || op === 'const') {
+    for (let i = 1; i < body.length; i++) {
+      const d = body[i]
+      if (d === name) return true
+      if (Array.isArray(d) && d[0] === '=' && d[1] === name) return true
+    }
+  }
+  for (let i = 1; i < body.length; i++) if (containsDeclOf(body[i], name)) return true
+  return false
+}
+
+/** Clone AST node, substituting bare-name matches with [null, value]. Skips into closures. */
+export function cloneWithSubst(node, name, value) {
+  if (node === name) return [null, value]
+  if (!Array.isArray(node)) return node
+  if (node[0] === '=>') return node
+  return node.map(x => cloneWithSubst(x, name, value))
+}
+
+/** Does `body` access a typed-array element by string name known to the type system? */
+export function containsKnownTypedArrayIndex(body) {
+  if (!Array.isArray(body)) return false
+  if (body[0] === '=>') return false
+  if (body[0] === '[]' && typeof body[1] === 'string' && ctx.types.typedElem?.has(body[1])) return true
+  for (let i = 1; i < body.length; i++) if (containsKnownTypedArrayIndex(body[i])) return true
+  return false
+}
+
+/** Analyze `for (let i=0; i<N; i++)` trip count. Returns N if structurally matches, else null. */
+export function smallConstForTripCount(init, cond, step) {
+  if (!Array.isArray(init) || init[0] !== 'let' || init.length !== 2) return null
+  const decl = init[1]
+  if (!Array.isArray(decl) || decl[0] !== '=' || typeof decl[1] !== 'string') return null
+  const name = decl[1]
+  const start = intLiteralValue(decl[2])
+  if (start !== 0) return null
+
+  if (!Array.isArray(cond) || cond[0] !== '<' || cond[1] !== name) return null
+  const end = intLiteralValue(cond[2])
+  if (end == null || end < 0 || end > MAX_SMALL_FOR_UNROLL) return null
+
+  const stepOk = Array.isArray(step) && (
+    (step[0] === '++' && step[1] === name) ||
+    (step[0] === '-' && Array.isArray(step[1]) && step[1][0] === '++' && step[1][1] === name && intLiteralValue(step[2]) === 1)
+  )
+  return stepOk ? end : null
+}
+
+// =============================================================================
+// charCodeAt in-bounds proof
+// =============================================================================
+// `String.prototype.charCodeAt` returns NaN for an out-of-range index, so the
+// generic codegen contract is an f64 result (see module/string.js). When the
+// index is the induction variable of a `for (let i = C; i < recv.length; i++)`
+// loop, every `recv.charCodeAt(i)` in the loop body is statically inside
+// `[0, recv.length)` — OOB is impossible — so the call may use the cheaper i32
+// (raw-byte) contract instead. This is a static guarantee, not a guess.
+
+/** Step expression of a `for` that increments `name` by exactly 1. */
+function isUnitIncrement(step, name) {
+  if (!Array.isArray(step)) return false
+  if (step[0] === '++' && step[1] === name) return true
+  // postfix `i++` in value position lowers to `(++i) - 1`
+  if (step[0] === '-' && Array.isArray(step[1]) && step[1][0] === '++'
+      && step[1][1] === name && intLiteralValue(step[2]) === 1) return true
+  return false
+}
+
+/** `let`/`const` re-declaration of `name` within `node` — does not cross `=>`
+ *  (a closure has its own scope; collection already stops at closure boundaries). */
+function redeclaresName(node, name) {
+  if (!Array.isArray(node) || node[0] === '=>') return false
+  if (node[0] === 'let' || node[0] === 'const') {
+    for (let k = 1; k < node.length; k++) {
+      const d = node[k]
+      if (d === name) return true
+      if (Array.isArray(d) && d[0] === '=' && d[1] === name) return true
+    }
+  }
+  for (let k = 1; k < node.length; k++) if (redeclaresName(node[k], name)) return true
+  return false
+}
+
+/** Collect `recv.charCodeAt(idxVar)` callee nodes within `node`. Stops at `=>`:
+ *  a closure may run after the loop, when `idxVar` has reached `recv.length`. */
+function collectBoundedCC(node, recv, idxVar, set) {
+  if (!Array.isArray(node) || node[0] === '=>') return
+  if (node[0] === '()' && node.length === 3 && node[2] === idxVar
+      && Array.isArray(node[1]) && node[1][0] === '.'
+      && node[1][1] === recv && node[1][2] === 'charCodeAt')
+    set.add(node[1])
+  for (let k = 1; k < node.length; k++) collectBoundedCC(node[k], recv, idxVar, set)
+}
+
+/** Receiver of a `.length` expression, possibly wrapped in `(… | 0)` — the
+ *  shape `prepare` produces when it hoists a for-cond bound. */
+function lengthRecv(expr) {
+  if (Array.isArray(expr) && expr[0] === '|' && intLiteralValue(expr[2]) === 0) expr = expr[1]
+  if (Array.isArray(expr) && expr[0] === '.' && expr[2] === 'length'
+      && typeof expr[1] === 'string') return expr[1]
+  return null
+}
+
+/** Flatten `let`/`const` declarations (incl. `;`-joined groups) into `out`,
+ *  mapping each declared name to its initializer expression. */
+function collectDecls(node, out) {
+  if (!Array.isArray(node)) return
+  if (node[0] === ';') { for (let k = 1; k < node.length; k++) collectDecls(node[k], out); return }
+  if (node[0] === 'let' || node[0] === 'const') {
+    for (let k = 1; k < node.length; k++) {
+      const d = node[k]
+      if (Array.isArray(d) && d[0] === '=' && typeof d[1] === 'string') out.set(d[1], d[2])
+    }
+  }
+}
+
+/** Walk `node`, recording in `set` the `charCodeAt` callee nodes proven in-bounds
+ *  by an enclosing canonical induction loop `for (let i = C; i < recv.length; i++)`.
+ *  Matches the post-`prepare` shape, where the `.length` bound is hoisted into a
+ *  temp (`cond` becomes `i < lenTmp`, `lenTmp` declared in `init`). */
+export function scanBoundedLoops(node, set) {
+  if (!Array.isArray(node)) return
+  if (node[0] === 'for' && node.length === 5) {
+    const [, init, cond, step, body] = node
+    let idx = null, recv = null, boundVar = null
+    if (Array.isArray(cond) && cond[0] === '<' && typeof cond[1] === 'string') {
+      const decls = new Map()
+      collectDecls(init, decls)
+      idx = cond[1]
+      // index must be declared in `init` as `let i = C`, C an integer literal ≥ 0
+      const start = decls.has(idx) ? intLiteralValue(decls.get(idx)) : null
+      if (start == null || start < 0) idx = null
+      // bound is `recv.length`, directly or via a hoisted temp declared in `init`
+      let bound = cond[2]
+      if (typeof bound === 'string') { boundVar = bound; bound = decls.get(bound) }
+      recv = lengthRecv(bound)
+    }
+    // step `i++`; body never writes `i`/`recv`/the bound temp (incl. via
+    // closures) and never re-declares `i`. Then every bare `i` in the body
+    // satisfies `0 ≤ C ≤ i < recv.length`.
+    if (idx && recv && idx !== recv && isUnitIncrement(step, idx)
+        && !isReassigned(body, idx) && !isReassigned(body, recv)
+        && (boundVar == null || !isReassigned(body, boundVar))
+        && !redeclaresName(body, idx))
+      collectBoundedCC(body, recv, idx, set)
+  }
+  for (let k = 1; k < node.length; k++) scanBoundedLoops(node[k], set)
+}
+
+const NO_BOUNDED_CC = new Set()  // shared immutable empty result
+
+/** Set of `['.', recv, 'charCodeAt']` callee nodes in the current function whose
+ *  index argument is provably within `[0, recv.length)`. Memoised per body. */
+export function inBoundsCharCodeAt(ctx) {
+  const body = ctx.func?.body
+  if (!Array.isArray(body)) return NO_BOUNDED_CC
+  if (ctx.func._ccBody === body) return ctx.func.ccInBounds
+  const set = new Set()
+  scanBoundedLoops(body, set)
+  ctx.func.ccInBounds = set
+  ctx.func._ccBody = body
+  return set
+}
+
+/** Does `body` always exit the enclosing scope (return / throw / break / continue)? */
+export function isTerminator(body) {
+  if (!Array.isArray(body)) return false
+  const op = body[0]
+  if (op === 'return' || op === 'throw' || op === 'break' || op === 'continue') return true
+  if (op === '{}' || op === ';') {
+    for (let i = body.length - 1; i >= 1; i--) {
+      const s = body[i]
+      if (s == null) continue
+      return isTerminator(s)
+    }
+    return false
+  }
+  return false
+}
+
+// =============================================================================
+// JSON-shape inference
+// =============================================================================
+// What a binding looks like when its provenance is a compile-time-known
+// `JSON.parse(stringConst)`. Building this tree at compile time lets
+// `.prop` and `[i]` reads on the result recover their VAL kind without a
+// runtime probe.
+
+/** Resolve a string-constant source for an expression: literal forms, or a
+ *  binding the scope tracker has recorded as effectively-const. Module/json's
+ *  static-fold path keeps a constStrs-only resolver to avoid folding `let`-bound
+ *  initializers; shape inference is sound on the broader shapeStrs because an
+ *  effectively-const literal's value is invariant. */
+export function jsonConstString(expr) {
+  if (Array.isArray(expr) && expr[0] === 'str' && typeof expr[1] === 'string') return expr[1]
+  if (Array.isArray(expr) && expr[0] == null && typeof expr[1] === 'string') return expr[1]
+  if (typeof expr === 'string') {
+    return ctx.scope.shapeStrs?.get(expr) ?? ctx.scope.constStrs?.get(expr) ?? null
+  }
+  return null
+}
+
+function jsonShapeStrings(expr) {
+  const single = jsonConstString(expr)
+  if (single != null) return [single]
+  if (Array.isArray(expr) && expr[0] === '[]' && typeof expr[1] === 'string') return ctx.scope.shapeStrArrays?.get(expr[1]) ?? null
+  return null
+}
+
+/** Build a structural shape tree from a parsed JSON value. Each node is
+ *  `{ val, props?, elem? }` — `val` is the inferred VAL kind (matches
+ *  rep.val in localReps entries). Lets `valTypeOf` propagate VAL kinds
+ *  through `.prop` chains and `[i]` reads on bindings sourced from
+ *  `JSON.parse` of a compile-time-known string. Polymorphic arrays drop
+ *  their `elem`. */
+function shapeOfJsonValue(v) {
+  if (v === null || v === undefined) return null
+  if (typeof v === 'number') return { val: VAL.NUMBER }
+  if (typeof v === 'string') return { val: VAL.STRING }
+  if (typeof v === 'boolean') return { val: VAL.NUMBER }
+  if (Array.isArray(v)) {
+    let elem = null
+    for (const x of v) {
+      const s = shapeOfJsonValue(x)
+      if (!s) { elem = null; break }
+      if (!elem) elem = s
+      else if (!shapeUnifies(elem, s)) { elem = null; break }
+    }
+    return { val: VAL.ARRAY, elem }
+  }
+  if (typeof v === 'object') {
+    const props = Object.create(null)
+    const names = Object.keys(v)
+    for (const k of names) {
+      const s = shapeOfJsonValue(v[k])
+      if (s) props[k] = s
+    }
+    return { val: VAL.OBJECT, props, names }
+  }
+  return null
+}
+
+function shapeUnifies(a, b) {
+  if (!a || !b || a.val !== b.val) return false
+  if (a.val === VAL.OBJECT || a.val === VAL.HASH) {
+    const ak = Object.keys(a.props), bk = Object.keys(b.props)
+    if (ak.length !== bk.length) return false
+    for (const k of ak) {
+      if (!b.props[k] || !shapeUnifies(a.props[k], b.props[k])) return false
+    }
+  }
+  if (a.val === VAL.ARRAY) {
+    if ((a.elem == null) !== (b.elem == null)) return false
+    if (a.elem && !shapeUnifies(a.elem, b.elem)) return false
+  }
+  return true
+}
+
+function shapeLayoutUnifies(a, b) {
+  if (!shapeUnifies(a, b)) return false
+  if (a.val === VAL.OBJECT || a.val === VAL.HASH) {
+    if (a.names?.length !== b.names?.length) return false
+    for (let i = 0; i < a.names.length; i++) if (a.names[i] !== b.names[i]) return false
+  }
+  if (a.val === VAL.ARRAY && a.elem) return shapeLayoutUnifies(a.elem, b.elem)
+  return true
+}
+
+function parseJsonShape(src) {
+  if (typeof src !== 'string') return null
+  let parsed
+  try { parsed = JSON.parse(src) } catch { return null }
+  return shapeOfJsonValue(parsed)
+}
+
+function parseUnifiedJsonShape(srcs) {
+  if (!srcs?.length) return null
+  let out = null
+  for (const src of srcs) {
+    const sh = parseJsonShape(src)
+    if (!sh) return null
+    if (!out) out = sh
+    else if (!shapeLayoutUnifies(out, sh)) return null
+  }
+  return out
+}
+
+/** Resolve the json shape for an expression by walking name → rep.jsonShape and
+ *  `.prop` / `[i]` indirection. Returns null when shape is unknown at this site. */
+export function shapeOf(expr) {
+  if (typeof expr === 'string')
+    return ctx.func.localReps?.get(expr)?.jsonShape
+        ?? ctx.scope.globalReps?.get(expr)?.jsonShape
+        ?? null
+  if (!Array.isArray(expr)) return null
+  const [op, ...args] = expr
+  if (op === '()' && args[0] === 'JSON.parse') {
+    const srcs = jsonShapeStrings(args[1])
+    if (srcs) return parseUnifiedJsonShape(srcs)
+  }
+  if (op === '.' && typeof args[1] === 'string') {
+    const parent = shapeOf(args[0])
+    if (parent?.val === VAL.OBJECT || parent?.val === VAL.HASH) return parent.props[args[1]] || null
+  }
+  if (op === '[]' && args.length === 2) {
+    const parent = shapeOf(args[0])
+    if (parent?.val === VAL.ARRAY) return parent.elem || null
+  }
+  return null
+}
+
+/** Build a structural shape from a `{}` AST node — recursive for nested
+ *  object/array literals + propagating shapes through identifier references
+ *  (so `let G = {…}; let H = {x: G}` carries G's shape under H.x). Returns
+ *  null when any property breaks the static-shape contract (computed key,
+ *  spread, non-shape value). Only called from `recordGlobalRep` — local
+ *  bindings keep relying on `shapeOf` whose narrower contract (JSON.parse /
+ *  traversal only) lets `Object.assign(a, …)` extend `a`'s schema without
+ *  locking a static jsonShape onto it. */
+export function shapeOfObjectLiteralAst(expr) {
+  if (typeof expr === 'string') return shapeOf(expr)
+  if (!Array.isArray(expr) || expr[0] !== '{}') return shapeOf(expr)
+  const raw = expr.length === 2 && Array.isArray(expr[1]) && expr[1][0] === ','
+    ? expr[1].slice(1)
+    : expr.slice(1)
+  const props = Object.create(null)
+  const names = []
+  for (const p of raw) {
+    if (!Array.isArray(p) || p[0] !== ':' || typeof p[1] !== 'string') return null
+    names.push(p[1])
+    const child = shapeOfObjectLiteralAst(p[2])
+    if (child) props[p[1]] = child
+  }
+  return names.length ? { val: VAL.OBJECT, props, names } : null
+}