jz 0.4.0 → 0.5.1

package/src/emit.js

@@ -2,7 +2,7 @@
  * AST → WASM IR emission.
  *
  * # Stage contract
- *   IN:  prepared AST node + ctx state (func.locals, func.repByLocal, types.typedElem, etc.)
+ *   IN:  prepared AST node + ctx state (func.locals, func.localReps, types.typedElem, etc.)
  *   OUT: IR node (array) with `.type` ('i32' | 'f64' | 'void'). For statements, a flat
  *        list of WASM instructions (no type tag).
  *   NO-MUTATE: emit does not rewrite the AST. Side effects go to ctx.runtime.*,
@@ -23,32 +23,50 @@
  */
 
 import { ctx, err, inc, PTR } from './ctx.js'
-import { T, VAL, nonNegIntLiteral, valTypeOf, lookupValType, extractParams, classifyParam, findFreeVars, STMT_OPS, repOf, updateRep, repOfGlobal, staticPropertyKey } from './analyze.js'
 import {
+  T, VAL, nonNegIntLiteral, valTypeOf, lookupValType, extractParams, classifyParam, findFreeVars, STMT_OPS, repOf, updateRep, repOfGlobal, staticPropertyKey,
+  // AST predicates (formerly in src/ast.js)
   isReassigned, hasOwnContinue, hasOwnBreakOrContinue, containsNestedClosure,
   containsNestedLoop, nestedSmallLoopBudget, containsDeclOf, cloneWithSubst,
   containsKnownTypedArrayIndex, smallConstForTripCount, isTerminator,
+  inBoundsCharCodeAt,
   MAX_SMALL_FOR_UNROLL, MAX_NESTED_FOR_UNROLL,
-} from './ast.js'
+} from './analyze.js'
 import {
   typed, asF64, asI32, asI64, asPtrOffset, asParamType, toI32, fromI64,
   NULL_IR, nullExpr, undefExpr, MAX_CLOSURE_ARITY,
   WASM_OPS, SPREAD_MUTATORS, BOXED_MUTATORS,
   mkPtrIR, ptrOffsetIR, ptrTypeIR,
-  isLit, litVal, isNullishLit, isPureIR, emitNum, f64rem, toNumF64,
+  isLit, litVal, isNullishLit, isPureIR, emitNum, f64rem, toNumF64, toStrI64,
   truthyIR, toBoolFromEmitted, isPostfix,
   isGlobal, isConst, keyValType, usesDynProps, needsDynShadow,
   temp, tempI32, tempI64, allocPtr,
-  boxedAddr, readVar, writeVar, isNullish,
+  boxedAddr, readVar, writeVar, isNullish, isBoolAtom,
   isLiteralStr, resolveValType, isFuncRef,
   multiCount, loopTop, flat,
-  reconstructArgsWithSpreads,
+  reconstructArgsWithSpreads, tcoTailRewrite,
 } from './ir.js'
+import { typeofPredicate } from './infer.js'
 
 // Current emission "expect" mode ('void' or null); set by emit(), read by compound-assignment emitters
 // to decide whether to emit a value-returning or side-effect-only form.
 let _expect = null
 
+// A genuine i32 *number* — safe for the i32 fast path in arithmetic/bitwise
+// operators. An unboxed pointer (object/array/string/closure local kept as a
+// raw i32 handle) is *also* i32-typed but carries `.ptrKind`; treating it as a
+// number would compute on raw pointer bits. A ptrKind-carrying operand must
+// instead route through ToNumber (`toNumF64`), which performs ToPrimitive.
+const isI32Num = (v) => v.type === 'i32' && v.ptrKind == null
+
+// An operand whose uint32 value can be *observed as a JS number* — a `>>>`
+// result, an `unsignedResult` call, or an unsigned i32.const. Its magnitude can
+// exceed signed-i32 range, so wrapping i32 arithmetic would corrupt it; widen to
+// f64 instead. A `.wrapSafe` operand is also unsigned but is a `narrowUint32`
+// accumulator read proven to be re-truncated by a `>>>` (ToUint32) sink at every
+// use — wrapping is exactly its intended semantics, so it stays on the i32 path.
+const widensUnsigned = (v) => v.unsigned && !v.wrapSafe
+
 const FIRST_CLASS_UNARY_MATH = {
   'math.abs': 'f64.abs',
   'math.sqrt': 'f64.sqrt',
@@ -80,14 +98,30 @@ function builtinFunctionValue(name) {
 const emitNeg = (a) => {
   if (valTypeOf(a) === VAL.BIGINT) return fromI64(['i64.sub', ['i64.const', 0], asI64(emit(a))])
   const v = emit(a)
-  return isLit(v) ? emitNum(-litVal(v)) : v.type === 'i32'
+  return isLit(v) ? emitNum(-litVal(v)) : isI32Num(v)
     ? typed(['i32.sub', typed(['i32.const', 0], 'i32'), v], 'i32')
     : typed(['f64.neg', toNumF64(a, v)], 'f64')
 }
 
 /** Try constant-folding binary arith: returns emitNum(result) or null. */
+// `.unsigned` literals carry a uint32 value whose i32 `litVal` is its *signed* bit
+// pattern (e.g. `-1` for 4294967295), so folding them through `fn` numerically would
+// be wrong. Bail to the runtime path — the arithmetic handlers widen unsigned operands
+// to f64 (convert_i32_u), reproducing the JS-spec result.
 const foldConst = (va, vb, fn, guard) =>
-  isLit(va) && isLit(vb) && (!guard || guard(litVal(vb))) ? emitNum(fn(litVal(va), litVal(vb))) : null
+  isLit(va) && isLit(vb) && !va.unsigned && !vb.unsigned && (!guard || guard(litVal(vb)))
+    ? emitNum(fn(litVal(va), litVal(vb))) : null
+
+// JS `*` is an f64 multiply; `i32.mul` yields only the exact product mod 2^32.
+// Those agree under a ToInt32/ToUint32 sink (and as plain numbers) while the
+// exact product stays f64-exact, i.e. |product| <= 2^53. Two i32 operands can
+// reach 2^62, so `i32.mul` is sound only when one side is a literal small
+// enough that, against the full i32 range (2^31) of the other, the product
+// holds within 2^53 — i.e. |literal| <= 2^22. Keeps index arithmetic (`i*4`,
+// `row*16`) on `i32.mul` while routing hash-mix-scale products to `f64.mul`.
+const mulFitsI32 = (va, vb) =>
+  (isLit(va) && Math.abs(litVal(va)) <= 0x400000) ||
+  (isLit(vb) && Math.abs(litVal(vb)) <= 0x400000)
 
 /** Emit typeof comparison: typeof x == typeCode → type-aware check. */
 export function emitTypeofCmp(a, b, cmpOp) {
@@ -102,6 +136,10 @@ export function emitTypeofCmp(a, b, cmpOp) {
   const eq = cmpOp === 'eq'
 
   if (code === -1) {
+    // A VAL.BOOL value rides in the f64 0/1 carrier, so it would pass the
+    // `v===v` number test — but it is typeof "boolean", not "number".
+    if (resolveValType(typeofExpr, valTypeOf, lookupValType) === VAL.BOOL)
+      return typed(['i32.const', eq ? 0 : 1], 'i32')
     return typed(eq
       ? ['f64.eq', ['local.tee', `$${t}`, va], ['local.get', `$${t}`]]
       : ['f64.ne', ['local.tee', `$${t}`, va], ['local.get', `$${t}`]], 'i32')
@@ -118,7 +156,12 @@ export function emitTypeofCmp(a, b, cmpOp) {
     return typed(eq ? check : ['i32.eqz', check], 'i32')
   }
   if (code === -4) {
-    return typed(['i32.const', eq ? 0 : 1], 'i32')
+    // boolean. Statically VAL.BOOL → true; any other known type → false.
+    const vt = resolveValType(typeofExpr, valTypeOf, lookupValType)
+    if (vt) return typed(['i32.const', (vt === VAL.BOOL) === eq ? 1 : 0], 'i32')
+    // Unknown static type: boolean iff the carrier is a boxed-boolean atom.
+    const isBool = isBoolAtom(['local.tee', `$${t}`, va])
+    return typed(eq ? isBool : ['i32.eqz', isBool], 'i32')
   }
   if (code === -5) {
     inc('__ptr_type')
@@ -157,9 +200,22 @@ export function emitTypeofCmp(a, b, cmpOp) {
   return null
 }
 
+/** Stringify a VAL.BOOL operand to "true"/"false" (f64 string pointer). The
+ *  boolean rides the cheap 0/1 carrier, so we runtime-select between the two
+ *  interned literals; a constant operand folds to a single literal downstream. */
+export const emitBoolStr = (node) =>
+  typed(['select', asF64(emit(['str', 'true'])), asF64(emit(['str', 'false'])), truthyIR(emit(node))], 'f64')
+
 const CMP_SET = new Set(['>', '<', '>=', '<=', '==', '!=', '!'])
 const isCmp = n => Array.isArray(n) && CMP_SET.has(n[0])
 
+// Map/Set methods whose generic (`.${method}`) emitter assumes a collection
+// receiver and dereferences a key/value argument. Every one needs ≥1 argument
+// (`.get(k)` / `.has(v)` / `.add(v)` / `.delete(v)` / `.set(k[,v])`), so a
+// zero-arg call on a not-proven-collection receiver cannot be the collection
+// op — it is a user/closure method and must not reach the collection emitter.
+const COLLECTION_METHODS = new Set(['get', 'set', 'has', 'add', 'delete'])
+
 // Pointer kinds for which JS `==` / `!=` is pure reference equality — i.e. i64 bit
 // compare of the NaN-box is equivalent to __eq. Excludes STRING (content compare for
 // heap strings) and BIGINT (content compare).
@@ -174,6 +230,23 @@ function stringLiteral(node) {
   return null
 }
 
+// Index expressions where peepholing `s[k] === 'X'` to char-byte compare is
+// semantics-preserving: must produce a non-negative *integer* at run time so
+// `__str_byteLen u> k` bounds-checks the same range JS would. Out-of-range
+// (negative or ≥ len) falls into the `else 0` arm — matches `undefined === 'X'`.
+function intIndexIR(key) {
+  const lit = nonNegIntLiteral(key)
+  if (lit != null) return ['i32.const', lit]
+  // intCertain name: forward-prop says every defining RHS is integer-shaped.
+  // Captures loop variables (`for(let i=0;;i++)`), `let k = j + 1`, etc.
+  if (typeof key === 'string' && repOf(key)?.intCertain) return asI32(emit(key))
+  // intCertain schema slot read `o.x`: every observed write is integer-shaped,
+  // so the loaded f64 represents an int — fold into the byte-compare fast path.
+  if (Array.isArray(key) && key[0] === '.' && typeof key[1] === 'string' && typeof key[2] === 'string' &&
+      ctx.schema.slotIntCertainAt?.(key[1], key[2]) === true) return asI32(emit(key))
+  return null
+}
+
 function emitSingleCharIndexCmp(a, b, negate = false) {
   const leftLit = stringLiteral(a)
   const rightLit = stringLiteral(b)
@@ -188,8 +261,8 @@ function emitSingleCharIndexCmp(a, b, negate = false) {
   if ([...lit].some(c => c.charCodeAt(0) > 0x7F)) return null
 
   const [, obj, key] = indexed
-  const idx = nonNegIntLiteral(key)
-  if (idx == null) return null
+  const idxIR = intIndexIR(key)
+  if (idxIR == null) return null
 
   const vt = typeof obj === 'string' ? lookupValType(obj) : valTypeOf(obj)
   if (vt && vt !== VAL.STRING) return null
@@ -202,30 +275,102 @@ function emitSingleCharIndexCmp(a, b, negate = false) {
   // Single-char literal: compare byte directly, skipping __str_idx allocation.
   if (lit.length !== 1 || !ctx.core.stdlib['__char_at'] || !ctx.core.stdlib['__str_byteLen']) return null
 
-  const ptr = temp('sc'), idxIR = ['i32.const', idx]
+  // Stash the index in a local when it isn't a constant — bounds + load both reference it.
+  const isConstIdx = Array.isArray(idxIR) && idxIR[0] === 'i32.const'
+  let idxRefIR = idxIR, idxBindIR = null
+  if (!isConstIdx) {
+    const idxTmp = tempI32('si')
+    idxBindIR = ['local.set', `$${idxTmp}`, idxIR]
+    idxRefIR = ['local.get', `$${idxTmp}`]
+  }
+
+  const ptr = temp('sc')
   inc('__str_byteLen', '__char_at')
   const charEq = ['if', ['result', 'i32'],
-    ['i32.gt_u', ['call', '$__str_byteLen', ['i64.reinterpret_f64', ['local.get', `$${ptr}`]]], idxIR],
-    ['then', ['i32.eq', ['call', '$__char_at', ['i64.reinterpret_f64', ['local.get', `$${ptr}`]], idxIR], ['i32.const', lit.charCodeAt(0)]]],
+    ['i32.gt_u', ['call', '$__str_byteLen', ['i64.reinterpret_f64', ['local.get', `$${ptr}`]]], idxRefIR],
+    ['then', ['i32.eq', ['call', '$__char_at', ['i64.reinterpret_f64', ['local.get', `$${ptr}`]], idxRefIR], ['i32.const', lit.charCodeAt(0)]]],
     ['else', ['i32.const', 0]]]
 
+  const prelude = idxBindIR ? [['local.set', `$${ptr}`, asF64(emit(obj))], idxBindIR] : [['local.set', `$${ptr}`, asF64(emit(obj))]]
+
   if (vt === VAL.STRING) {
-    return typed(['block', ['result', 'i32'],
-      ['local.set', `$${ptr}`, asF64(emit(obj))],
-      finish(charEq)], 'i32')
+    return typed(['block', ['result', 'i32'], ...prelude, finish(charEq)], 'i32')
   }
 
   inc('__ptr_type', '__typed_idx', '__eq')
   const genericEq = ['call', '$__eq',
-    ['i64.reinterpret_f64', ['call', '$__typed_idx', ['i64.reinterpret_f64', ['local.get', `$${ptr}`]], idxIR]],
+    ['i64.reinterpret_f64', ['call', '$__typed_idx', ['i64.reinterpret_f64', ['local.get', `$${ptr}`]], idxRefIR]],
     asI64(emit(['str', lit]))]
   const cmp = ['if', ['result', 'i32'],
     ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${ptr}`]]], ['i32.const', PTR.STRING]],
     ['then', charEq],
     ['else', genericEq]]
+  return typed(['block', ['result', 'i32'], ...prelude, finish(cmp)], 'i32')
+}
+
+// `<str>.{substr,substring,slice}(...) === <other>` whose substring is consumed
+// only by the equality: materialising it (an __alloc + byte copy) is pure waste.
+// Fuse to __str_{substring,slice}_eq, which clamp the range like the method then
+// byte-compare it against `other` in place. Sibling to emitSingleCharIndexCmp,
+// tried at the same `==`/`!=` sites. Motivating hot path: the parser keyword
+// scan, `cur.substr(i,l) === keyword`.
+function emitSubstringEqCmp(a, b, negate = false) {
+  // Post-prepare a multi-arg call keeps its args as one comma list; a single
+  // arg sits bare. Normalise either (and a flat tail, defensively) to a list.
+  const callInfo = node => {
+    if (!Array.isArray(node) || node[0] !== '()') return null
+    const callee = node[1]
+    if (!Array.isArray(callee) || callee[0] !== '.') return null
+    const method = callee[2]
+    if (method !== 'substr' && method !== 'substring' && method !== 'slice') return null
+    let args = node.slice(2)
+    if (args.length === 1 && Array.isArray(args[0]) && args[0][0] === ',') args = args[0].slice(1)
+    while (args.length && args[args.length - 1] == null) args = args.slice(0, -1)
+    return { recv: callee[1], method, args }
+  }
+
+  let info = callInfo(a), other = b, callIsLeft = true
+  if (!info) { info = callInfo(b); other = a; callIsLeft = false }
+  if (!info) return null
+  const { recv, method, args } = info
+  if (args.length > 2) return null
+  if (!ctx.core.stdlib['__char_at'] || !ctx.core.stdlib['__str_byteLen']) return null
+
+  // The receiver must be a string. `substr`/`substring` name string-only methods,
+  // so an unknown receiver is safe — the normal `.substr`/`.substring` emitter
+  // assumes a string too. `slice` is also Array.prototype.slice — require a
+  // statically-known STRING there. A known non-string receiver bails always.
+  const vt = resolveValType(recv, valTypeOf, lookupValType)
+  if (vt && vt !== VAL.STRING) return null
+  if (method === 'slice' && vt !== VAL.STRING) return null
+
+  const helper = method === 'slice' ? '__str_slice_eq' : '__str_substring_eq'
+  inc(helper)
+
+  // Absent end → byteLen: pass i32 max — every clamp arm floors it to the length.
+  const TO_END = ['i32.const', 0x7FFFFFFF]
+  let startIR, endIR
+  if (method === 'substr' && args[1] != null) {
+    // substr's 2nd arg is a length: end = start + length, so start reads twice.
+    const s = tempI32('subS')
+    startIR = ['local.tee', `$${s}`, args[0] == null ? ['i32.const', 0] : asI32(emit(args[0]))]
+    endIR = ['i32.add', ['local.get', `$${s}`], asI32(emit(args[1]))]
+  } else {
+    startIR = args[0] == null ? ['i32.const', 0] : asI32(emit(args[0]))
+    endIR = args[1] == null ? TO_END : asI32(emit(args[1]))
+  }
+
+  const finish = expr => negate ? ['i32.eqz', expr] : expr
+
+  if (callIsLeft)
+    return typed(finish(['call', `$${helper}`, asI64(emit(recv)), startIR, endIR, asI64(emit(other))]), 'i32')
+
+  // `other` is the source-left operand — evaluate it first to preserve order.
+  const o = temp('subO')
   return typed(['block', ['result', 'i32'],
-    ['local.set', `$${ptr}`, asF64(emit(obj))],
-    finish(cmp)], 'i32')
+    ['local.set', `$${o}`, asF64(emit(other))],
+    finish(['call', `$${helper}`, asI64(emit(recv)), startIR, endIR,
+      ['i64.reinterpret_f64', ['local.get', `$${o}`]]])], 'i32')
 }
 
 // === Flow-sensitive type refinement ===
@@ -235,7 +380,7 @@ const TYPEOF_CODE_TO_VAL = { [-1]: VAL.NUMBER, [-2]: VAL.STRING, [-6]: VAL.CLOSU
 
 /** Extract refinements from a boolean condition AST.
  *  `sense`: true = refine for then-branch, false = refine for else-branch (i.e. cond inverted).
- *  Returns a Map<name, VAL>. Walks && / || / ! accordingly. */
+ *  Returns a Map<name, {val?: VAL, notString?: true}>. Walks && / || / ! accordingly. */
 function extractRefinements(cond, out, sense = true) {
   if (!Array.isArray(cond)) return out
   const op = cond[0]
@@ -247,29 +392,51 @@ function extractRefinements(cond, out, sense = true) {
   if (op === '||' && !sense) { extractRefinements(cond[1], out, false); extractRefinements(cond[2], out, false); return out }
   // typeof x == 'number' | 'string' | 'function' — sense must be positive for "==", negative for "!="
   if ((op === '==' || op === '===' || op === '!=' || op === '!==')) {
-    const eq = (op === '==' || op === '===')
-    const wantPositive = eq ? sense : !sense
-    if (!wantPositive) return out
-    const a = cond[1], b = cond[2]
-    const pair = Array.isArray(a) && a[0] === 'typeof' ? [a[1], b]
-      : Array.isArray(b) && b[0] === 'typeof' ? [b[1], a] : null
-    if (pair && typeof pair[0] === 'string' && Array.isArray(pair[1]) && pair[1][0] == null) {
-      const val = TYPEOF_CODE_TO_VAL[pair[1][1]]
-      if (val) out.set(pair[0], val)
+    const tp = typeofPredicate(cond)
+    if (tp) {
+      const wantPositive = tp.eq ? sense : !sense
+      if (wantPositive) {
+        const val = TYPEOF_CODE_TO_VAL[tp.code]
+        if (val) mergeRefinement(out, tp.name, { val })
+      } else if (tp.code === 'string' || tp.code === -2) {
+        // Negative branch of typeof-string guard (e.g. post `if (typeof x === 'string') return`)
+        // proves the binding is not a primitive string in the suffix scope — feeds B4's
+        // length / subscript dispatch elision the same way write-shape evidence does.
+        mergeRefinement(out, tp.name, { notString: true })
+      }
     }
     return out
   }
-  // Array.isArray(x) — only refines under positive sense.
-  // Callee may be the flattened string 'Array.isArray' or the raw ['.', 'Array', 'isArray'] pair.
+  // Type-predicate calls under positive sense — refine by the asserted VAL.
+  // Callee may be the flattened string 'Array.isArray' or the raw ['.', 'Array',
+  // 'isArray'] pair; __is_map / __is_set / __is_typed come from jzify's
+  // instanceof lowering as a bare string callee.
   if (op === '()' && sense && typeof cond[2] === 'string') {
     const callee = cond[1]
-    const isArr = callee === 'Array.isArray'
-      || (Array.isArray(callee) && callee[0] === '.' && callee[1] === 'Array' && callee[2] === 'isArray')
-    if (isArr) { out.set(cond[2], VAL.ARRAY); return out }
+    const val = predicateRefinement(callee)
+    if (val != null) { mergeRefinement(out, cond[2], { val }); return out }
   }
   return out
 }
 
+/** Map a call-callee shape to the VAL kind it asserts under positive sense, or null. */
+function predicateRefinement(callee) {
+  if (callee === 'Array.isArray') return VAL.ARRAY
+  if (Array.isArray(callee) && callee[0] === '.' && callee[1] === 'Array' && callee[2] === 'isArray')
+    return VAL.ARRAY
+  if (callee === '__is_map') return VAL.MAP
+  if (callee === '__is_set') return VAL.SET
+  if (callee === '__is_typed') return VAL.TYPED
+  return null
+}
+
+/** Merge a refinement fact into the per-name slot. Later facts override; non-overlapping
+ *  fields union. Keeps the call-side simple (always assign through this). */
+function mergeRefinement(out, name, fact) {
+  const cur = out.get(name)
+  out.set(name, cur ? { ...cur, ...fact } : fact)
+}
+
 function unrollSmallConstFor(init, cond, step, body) {
   const end = smallConstForTripCount(init, cond, step)
   if (end == null) return null
@@ -294,19 +461,31 @@ function canThrow(body, seen = new Set()) {
   if (op === '=>') return false
   if (op === '()') {
     const callee = body[1]
-    if (typeof callee === 'string') {
-      const bodyName = ctx.func.directClosures?.get(callee)
-      const f = ctx.func.map?.get(bodyName || callee)
-      if (f?.body && !f.raw && !seen.has(f.name)) {
-        seen.add(f.name)
-        if (canThrow(f.body, seen)) return true
-      }
+    // A call can throw unless we can see the whole callee and prove it can't:
+    // only direct calls into a resolvable, non-raw function body are traceable.
+    // Indirect/method/builtin calls (callee not a plain name, or a name we can't
+    // resolve) are conservatively throwing — a user `try` must wrap them.
+    if (typeof callee !== 'string') return true
+    const bodyName = ctx.func.directClosures?.get(callee)
+    const f = ctx.func.map?.get(bodyName || callee)
+    if (!f?.body || f.raw) return true
+    if (!seen.has(f.name)) {
+      seen.add(f.name)
+      if (canThrow(f.body, seen)) return true
     }
   }
   for (let i = 1; i < body.length; i++) if (canThrow(body[i], seen)) return true
   return false
 }
 
+const isBoundName = name =>
+  ctx.func.locals?.has(name) || ctx.func.current?.params?.some(p => p.name === name)
+
+// A source-defined function (carries a body) — as opposed to an imported name,
+// which `ctx.func.names` also holds but which has no body and may legitimately
+// share a name with a built-in emitter (e.g. an imported `parseInt`).
+const isUserFunc = name => !!ctx.func.map.get(name)?.body
+
 /** Emit pending `finally` cleanups for an abrupt control-flow exit.
  *  Inner cleanups run before outer cleanups. While emitting each cleanup, remove
  *  it from the active stack so `return` inside `finally` does not re-enter it. */
@@ -423,6 +602,19 @@ export function emitDecl(...inits) {
     const [, name, init] = i
     if (typeof name !== 'string' || init == null) continue
 
+    // SRoA flat object: `let o = {a:1, b:2}` — dissolve fields into `o#i`
+    // locals, no heap alloc. Each field local ← asF64(value). Reads/writes are
+    // rewritten by the `.`/`[]` flat hooks. See scanFlatObjects (analyze.js).
+    // Monotonic-extension fields (`o.newProp = …`) carry no literal value —
+    // they init to undefined so a read before the write matches JS.
+    const flatDecl = ctx.func.flatObjects?.get(name)
+    if (flatDecl && Array.isArray(init) && init[0] === '{}') {
+      for (let j = 0; j < flatDecl.names.length; j++)
+        result.push(['local.set', `$${name}#${j}`,
+          flatDecl.values[j] === undefined ? undefExpr() : asF64(emit(flatDecl.values[j]))])
+      continue
+    }
+
     // Multi-value ephemeral destructuring — skip heap alloc when temp is
     // assigned from a multi-value call then immediately destructured element-by-element.
     if (name.startsWith(T) && Array.isArray(init) && init[0] === '()' && typeof init[1] === 'string'
@@ -457,9 +649,28 @@ export function emitDecl(...inits) {
         }
       }
     }
+    // No-copy slice view: `let t = s.slice(...)` whose result scanSliceViews
+    // proved never escapes — lower the initializer to a SLICE_BIT view instead
+    // of a copying slice. Everything downstream treats `t` as an ordinary
+    // string. Gated here (not in the analysis) on a statically-known STRING
+    // receiver — param types are settled only by emit time — and on plain-local
+    // carriers (boxed/global escape); any miss falls back to the copying slice.
+    let viewInit = null
+    if (ctx.func.sliceViews?.has(name) && !ctx.func.boxed.has(name) && !isGlobal(name)
+        && Array.isArray(init) && init[0] === '()'
+        && Array.isArray(init[1]) && init[1][0] === '.' && init[1][2] === 'slice') {
+      const recv = init[1][1]
+      const recvVt = typeof recv === 'string' ? keyValType(recv) : valTypeOf(recv)
+      if (recvVt === VAL.STRING) {
+        const raw = init[2]
+        const sa = raw == null ? [] : Array.isArray(raw) && raw[0] === ',' ? raw.slice(1) : [raw]
+        viewInit = ctx.core.emit['.string:slice#view'](recv, sa[0], sa[1])
+      }
+    }
+
     const isObjLit = Array.isArray(init) && init[0] === '{}'
     if (isObjLit) ctx.schema.targetStack.push({ name, active: true })
-    const val = emit(init)
+    const val = viewInit || emit(init)
     if (isObjLit) ctx.schema.targetStack.pop()
     // Direct-call dispatch for const-bound, non-escaping local closures: skip call_indirect.
     // Gate: not boxed (no mutable cross-fn capture), not global, not reassigned in this body.
@@ -492,10 +703,12 @@ export function emitDecl(...inits) {
     }
     const localType = ctx.func.locals.get(name) || 'f64'
     let ptrKind = repOf(name)?.ptrKind
+    // Emit-time rep mutation (lifecycle: analysis → emit transition).
     // Inherit ptrKind from a pointer-ABI RHS: destructure temps (`__d0 = v`) and other
     // fresh let-bindings whose init is already an unboxed pointer. Without this, readVar
     // returns an untyped i32 local.get and later `asF64` emits a numeric convert instead
-    // of a ptr-rebox. Safe because emitDecl runs once per let/const binding.
+    // of a ptr-rebox. Safe because emitDecl runs once per let/const binding — no prior
+    // emit-time read could have observed the unset rep.
     if (ptrKind == null && val.ptrKind != null && localType === 'i32' && !ctx.func.boxed?.has(name)) {
       updateRep(name, { ptrKind: val.ptrKind })
       ptrKind = val.ptrKind
@@ -515,12 +728,13 @@ export function emitDecl(...inits) {
       // Unboxed pointer local — extract i32 offset from NaN-boxed f64 via reinterpret, not numeric trunc.
       // CLOSURE init carries funcIdx in val.closureFuncIdx; persist it on the rep so a later
       // asF64 (escape: store, return, indirect-call rebox) reconstructs the correct table slot.
+      // Emit-time mutation — analyzeValTypes never sees closureFuncIdx.
       if (ptrKind === VAL.CLOSURE && val.closureFuncIdx != null && repOf(name)?.ptrAux == null)
         updateRep(name, { ptrAux: val.closureFuncIdx })
       coerced = val.ptrKind === ptrKind ? val
         : typed(['i32.wrap_i64', ['i64.reinterpret_f64', asF64(val)]], 'i32')
     } else {
-      coerced = localType === 'f64' ? asF64(val) : asI32(val)
+      coerced = localType === 'f64' ? asF64(val) : val.type === 'i32' ? val : toI32(val)
     }
     if (!(isLit(coerced) && coerced[1] === 0 && !Object.is(coerced[1], -0) && !ctx.func.stack.length))
       result.push(['local.set', `$${name}`, coerced])
@@ -547,6 +761,56 @@ export function emitDecl(...inits) {
   return result.length === 0 ? null : result.length === 1 ? result[0] : result
 }
 
+/**
+ * Copy a spread source's elements into a destination array.
+ *
+ * `dest` is the destination data-base i32 local; `posLocal` the element index to
+ * start writing at — advanced by the source length on exit. An ARRAY source is a
+ * contiguous block of f64 NaN-boxes, so it copies with a single `memory.copy`; a
+ * string/typed source needs a per-element decode. The source's *type* is
+ * loop-invariant — it cannot change while the spread runs — so when it is not
+ * statically known it is resolved exactly once (one `__ptr_type`) and branched,
+ * never re-checked per element. Returns a list of IR instructions.
+ */
+function emitSpreadCopy(dest, posLocal, srcLocal, srcLenLocal, staticVT) {
+  const srcI64 = () => ['i64.reinterpret_f64', ['local.get', `$${srcLocal}`]]
+  const destAddr = idx => ['i32.add', ['local.get', `$${dest}`], ['i32.shl', idx, ['i32.const', 3]]]
+  const arrCopy = () => (inc('__ptr_offset'),
+    ['memory.copy', destAddr(['local.get', `$${posLocal}`]),
+      ['call', '$__ptr_offset', srcI64()],
+      ['i32.shl', ['local.get', `$${srcLenLocal}`], ['i32.const', 3]]])
+  const scalarLoop = () => {
+    const sidx = `${T}sidx${ctx.func.uniq++}`
+    ctx.func.locals.set(sidx, 'i32')
+    const loopId = ctx.func.uniq++
+    const elem = ctx.module.modules['string']
+      ? ['if', ['result', 'f64'],
+          ['i32.eq', ['call', '$__ptr_type', srcI64()], ['i32.const', PTR.STRING]],
+          ['then', (inc('__str_idx'), ['call', '$__str_idx', srcI64(), ['local.get', `$${sidx}`]])],
+          ['else', (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])]]
+      : (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])
+    // Reset the counter on each entry — WASM zeroes locals once at function
+    // entry, but this loop re-executes when the spread sits inside a JS loop;
+    // a stale `sidx` (= prior srcLen) would skip the copy entirely.
+    return ['block', `$break${loopId}`,
+      ['local.set', `$${sidx}`, ['i32.const', 0]],
+      ['loop', `$loop${loopId}`,
+        ['br_if', `$break${loopId}`, ['i32.ge_s', ['local.get', `$${sidx}`], ['local.get', `$${srcLenLocal}`]]],
+        ['f64.store', destAddr(['i32.add', ['local.get', `$${posLocal}`], ['local.get', `$${sidx}`]]), elem],
+        ['local.set', `$${sidx}`, ['i32.add', ['local.get', `$${sidx}`], ['i32.const', 1]]],
+        ['br', `$loop${loopId}`]]]
+  }
+  const advance = ['local.set', `$${posLocal}`,
+    ['i32.add', ['local.get', `$${posLocal}`], ['local.get', `$${srcLenLocal}`]]]
+  if (staticVT === VAL.ARRAY) return [arrCopy(), advance]
+  if (staticVT === VAL.STRING || staticVT === VAL.TYPED) return [scalarLoop(), advance]
+  inc('__ptr_type')
+  return [['if',
+    ['i32.eq', ['call', '$__ptr_type', srcI64()], ['i32.const', PTR.ARRAY]],
+    ['then', arrCopy()],
+    ['else', scalarLoop()]], advance]
+}
+
 /**
  * Build an array from items, handling ['__spread', expr] markers.
  * Split into sections (normal arrays and spreads), then copy all into result.
@@ -581,9 +845,12 @@ export function buildArrayWithSpreads(items) {
     sections.push({ type: 'array', items: currentArray })
   }
 
-  if (sections.length === 1) {
-    const sec = sections[0]
-    return emit(sec.type === 'array' ? ['[', ...sec.items] : sec.expr)
+  // A single all-normal section is a plain literal — defer to the `[` emitter.
+  // A single *spread* section is NOT shortcut to `emit(sec.expr)`: that would
+  // alias the source, but `[...x]` must yield a fresh array. It falls through
+  // to the alloc + emitSpreadCopy path below, which copies.
+  if (sections.length === 1 && sections[0].type === 'array') {
+    return emit(['[', ...sections[0].items])
   }
 
   const len = tempI32('len')
@@ -591,35 +858,39 @@ export function buildArrayWithSpreads(items) {
   const out = allocPtr({ type: 1, len: ['local.get', `$${len}`], tag: 'arr' })
   const result = out.local
 
-  const ir = [
-    ['local.set', `$${len}`, ['i32.const', 0]],
-  ]
+  const ir = []
+  inc('__len')
 
-  inc('__len', '__ptr_offset')
+  // Pass 1 — evaluate every section IN SOURCE ORDER into temps. JS spread keeps
+  // strict left-to-right order: a later spread whose source mutates an earlier
+  // element's input must still observe the pre-mutation value. Array items
+  // become per-item f64 temps; spreads become a ptr temp + a cached __len.
   for (const sec of sections) {
-    if (sec.type === 'spread') {
+    if (sec.type === 'array') {
+      sec.itemLocals = []
+      for (let i = 0; i < sec.items.length; i++) {
+        const it = `${T}ai${ctx.func.uniq++}`
+        ctx.func.locals.set(it, 'f64')
+        sec.itemLocals.push(it)
+        ir.push(['local.set', `$${it}`, asF64(emit(sec.items[i]))])
+      }
+    } else {
       sec.local = `${T}sp${ctx.func.uniq++}`
       ctx.func.locals.set(sec.local, 'f64')
       sec.lenLocal = `${T}spl${ctx.func.uniq++}`
       ctx.func.locals.set(sec.lenLocal, 'i32')
-      sec.vt = valTypeOf(sec.expr)
-      // ARRAY-known source: hoist data base and inline len/load (skip per-iter dispatch).
-      if (sec.vt === VAL.ARRAY && !multiCount(sec.expr)) {
-        sec.baseLocal = `${T}spb${ctx.func.uniq++}`
-        ctx.func.locals.set(sec.baseLocal, 'i32')
-      }
+      // A materialized multi-value is not a statically-typed pointer — let
+      // emitSpreadCopy resolve its kind at runtime via its one-time __ptr_type branch.
+      sec.val = multiCount(sec.expr) ? undefined : valTypeOf(sec.expr)
       const n = multiCount(sec.expr)
       ir.push(['local.set', `$${sec.local}`, n ? materializeMulti(sec.expr) : asF64(emit(sec.expr))])
-      if (sec.baseLocal) {
-        ir.push(['local.set', `$${sec.baseLocal}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${sec.local}`]]]])
-        ir.push(['local.set', `$${sec.lenLocal}`, ['i32.load', ['i32.sub', ['local.get', `$${sec.baseLocal}`], ['i32.const', 8]]]])
-      } else {
-        // Cache __len once per spread; reused below for total-len sum and inner copy bound.
-        ir.push(['local.set', `$${sec.lenLocal}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${sec.local}`]]]])
-      }
+      // Cache __len once per spread; reused below for total-len sum and the copy.
+      ir.push(['local.set', `$${sec.lenLocal}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${sec.local}`]]]])
     }
   }
 
+  // Pass 2 — total length (array sections statically sized, spreads cached above).
+  ir.push(['local.set', `$${len}`, ['i32.const', 0]])
   for (const sec of sections) {
     if (sec.type === 'array') {
       ir.push(['local.set', `$${len}`, ['i32.add', ['local.get', `$${len}`], ['i32.const', sec.items.length]]])
@@ -628,41 +899,20 @@ export function buildArrayWithSpreads(items) {
     }
   }
 
+  // Pass 3 — allocate exact, then store the pre-evaluated temps.
   ir.push(out.init, ['local.set', `$${pos}`, ['i32.const', 0]])
-
   for (const sec of sections) {
     if (sec.type === 'array') {
-      for (let i = 0; i < sec.items.length; i++) {
+      for (const it of sec.itemLocals) {
         ir.push(
           ['f64.store',
             ['i32.add', ['local.get', `$${result}`], ['i32.shl', ['local.get', `$${pos}`], ['i32.const', 3]]],
-            asF64(emit(sec.items[i]))],
+            ['local.get', `$${it}`]],
           ['local.set', `$${pos}`, ['i32.add', ['local.get', `$${pos}`], ['i32.const', 1]]]
         )
       }
     } else {
-      const slen = sec.lenLocal, sidx = `${T}sidx${ctx.func.uniq++}`
-      ctx.func.locals.set(sidx, 'i32')
-      const loopId = ctx.func.uniq++
-      const elemLoad = sec.baseLocal
-        ? ['f64.load', ['i32.add', ['local.get', `$${sec.baseLocal}`], ['i32.shl', ['local.get', `$${sidx}`], ['i32.const', 3]]]]
-        : ctx.module.modules['string']
-          ? ['if', ['result', 'f64'],
-            ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${sec.local}`]]], ['i32.const', PTR.STRING]],
-            ['then', (inc('__str_idx'), ['call', '$__str_idx', ['i64.reinterpret_f64', ['local.get', `$${sec.local}`]], ['local.get', `$${sidx}`]])],
-            ['else', (inc('__typed_idx'), ['call', '$__typed_idx', ['i64.reinterpret_f64', ['local.get', `$${sec.local}`]], ['local.get', `$${sidx}`]])]]
-          : (inc('__typed_idx'), ['call', '$__typed_idx', ['i64.reinterpret_f64', ['local.get', `$${sec.local}`]], ['local.get', `$${sidx}`]])
-      ir.push(
-        ['local.set', `$${sidx}`, ['i32.const', 0]],
-        ['block', `$break${loopId}`, ['loop', `$loop${loopId}`,
-          ['br_if', `$break${loopId}`, ['i32.ge_s', ['local.get', `$${sidx}`], ['local.get', `$${slen}`]]],
-          ['f64.store',
-            ['i32.add', ['local.get', `$${result}`], ['i32.shl', ['local.get', `$${pos}`], ['i32.const', 3]]],
-            elemLoad],
-          ['local.set', `$${pos}`, ['i32.add', ['local.get', `$${pos}`], ['i32.const', 1]]],
-          ['local.set', `$${sidx}`, ['i32.add', ['local.get', `$${sidx}`], ['i32.const', 1]]],
-          ['br', `$loop${loopId}`]]]
-      )
+      ir.push(...emitSpreadCopy(result, pos, sec.local, sec.lenLocal, sec.val))
     }
   }
 
@@ -698,13 +948,17 @@ export function emitBody(node) {
     // Skip names that are reassigned later — refinement would be unsound past the assignment.
     if (Array.isArray(s) && s[0] === 'if' && s[3] == null && isTerminator(s[2])) {
       const refs = extractRefinements(s[1], new Map(), false)
-      for (const [name, val] of refs) {
+      for (const [name, fact] of refs) {
         let reassigned = false
         for (let j = i + 1; j < stmts.length; j++)
           if (isReassigned(stmts[j], name)) { reassigned = true; break }
         if (reassigned) continue
-        accumulated.push([name, ctx.func.refinements.get(name)])
-        ctx.func.refinements.set(name, val)
+        const cur = ctx.func.refinements.get(name)
+        accumulated.push([name, cur])
+        // Merge so sibling early-returns layering on the same name compose
+        // (e.g. `if (typeof x === 'string') return; if (Array.isArray(x)) return;`
+        // leaves both `notString: true` and would-be array exclusion stacked).
+        ctx.func.refinements.set(name, cur ? { ...cur, ...fact } : fact)
       }
     }
   }
@@ -716,23 +970,86 @@ export function emitBody(node) {
   return out
 }
 
+// A VAL.BOOL value rides the cheap 0/1 numeric carrier, and `ToNumber(bool)` is
+// exactly that carrier — so for relational / loose-equality coercion a boolean
+// behaves identically to a number. Normalize it before the type-directed compare
+// dispatch (the BOOL fact still drives typeof / String / boundary boxing; only
+// these arithmetic-shaped operators read it as numeric).
+const numericVal = vt => vt === VAL.BOOL ? VAL.NUMBER : vt
+
+// Primitive value-type classes for strict-equality type-mismatch folding. Two
+// operands of different known classes — when at least one is a primitive — can
+// never be `===` (number/boolean/string/bigint don't cross-coerce under `===`).
+// Two *reference* kinds (array vs object, …) fall through to the shared ref-eq
+// path instead, which already resolves distinct pointers to `false`.
+const STRICT_PRIM = new Set([VAL.NUMBER, VAL.BOOL, VAL.STRING, VAL.BIGINT])
+
+/**
+ * Strict `===`/`!==`. Unlike loose `==`, no coercion: a statically-known type
+ * mismatch folds to a constant (`true === 1` → false, `"1" === 1` → false). When
+ * the types match — or one side is statically unknown — the result is bit-for-bit
+ * identical to loose `==` on same-type operands, so we delegate to it.
+ *
+ * Two carrier-level limitations remain (documented gaps, not regressions):
+ *  • booleans and numbers share the 0/1 carrier, so `1 === trueDynamic` can only
+ *    be told apart when the boolean's type is statically known;
+ *  • jz unifies `null` and `undefined` into one NaN-boxed sentinel, so
+ *    `null === undefined` is `true` (same as `==`).
+ */
+function emitStrictEq(a, b, negate) {
+  // `typeof x === 'type'` (prepare rewrote the literal to a numeric code) — typeof
+  // always yields a string, so strict and loose agree; reuse the loose lowering.
+  const tc = emitTypeofCmp(a, b, negate ? 'ne' : 'eq'); if (tc) return tc
+  // Known, differing primitive classes can never be strictly equal.
+  const rawA = resolveValType(a, valTypeOf, lookupValType)
+  const rawB = resolveValType(b, valTypeOf, lookupValType)
+  if (rawA && rawB && rawA !== rawB && (STRICT_PRIM.has(rawA) || STRICT_PRIM.has(rawB)))
+    return emitNum(negate ? 1 : 0)
+  // Same type (or dynamic-unknown): identical bits to loose `==`/`!=`.
+  return emitter[negate ? '!=' : '=='](a, b)
+}
+
 /** Comparison op factory with constant folding. */
 const cmpOp = (i32op, f64op, fn) => (a, b) => {
   const va = emit(a), vb = emit(b)
-  if (isLit(va) && isLit(vb)) return emitNum(fn(litVal(va), litVal(vb)) ? 1 : 0)
+  // Skip the const-fold for `.unsigned` operands: `litVal` is the signed bit pattern
+  // (-1, not 4294967295), so folding the order would be wrong. Fall through to the
+  // f64 widen path below, which converts each operand by its own signedness.
+  if (isLit(va) && isLit(vb) && !va.unsigned && !vb.unsigned) return emitNum(fn(litVal(va), litVal(vb)) ? 1 : 0)
   // String compare: NaN-boxed string pointers compare as NaN under f64.lt/gt
   // (always false), so without this the spec-correct `"a" < "b"` returns 0.
   // Route both-STRING operands through __str_cmp's three-way result, then apply
   // the same i32 sign op as numeric (lt_s/gt_s/le_s/ge_s vs 0).
-  const vta = resolveValType(a, valTypeOf, lookupValType)
-  const vtb = resolveValType(b, valTypeOf, lookupValType)
+  const vta = numericVal(resolveValType(a, valTypeOf, lookupValType))
+  const vtb = numericVal(resolveValType(b, valTypeOf, lookupValType))
   if (vta === VAL.BIGINT || vtb === VAL.BIGINT) {
     const op = bigintUnsignedBound(a) || bigintUnsignedBound(b) ? i32op.replace('_s', '_u') : i32op
     return typed([`i64.${op}`, asI64(va), asI64(vb)], 'i32')
   }
   if (vta === VAL.STRING && vtb === VAL.STRING) {
-    inc('__str_cmp')
-    return typed([`i32.${i32op}`, ['call', '$__str_cmp', asI64(va), asI64(vb)], ['i32.const', 0]], 'i32')
+    return typed([`i32.${i32op}`, ctx.abi.string.ops.cmp(asF64(va), asF64(vb), ctx), ['i32.const', 0]], 'i32')
+  }
+  // Exactly one operand is a known string; the other has no static type, so it
+  // may hold a string pointer at runtime (e.g. `c >= '0'` where `c` came from
+  // `s[i]` on an untyped receiver). JS relational compare is lexicographic only
+  // when *both* sides are strings, else it ToNumbers both. The f64 path below
+  // would compare the unknown side's NaN-boxed string bits as a float (NaN ⇒
+  // always false), so dispatch at runtime on the unknown side: string → __str_cmp
+  // three-way; else ToNumber both. Mirrors `+`'s __is_str_key string dispatch.
+  // Gated on a *known-string* counterpart, so numeric loops (`i < n`) never pay
+  // the check — comparing against a string literal signals string intent.
+  if (((vta === VAL.STRING && vtb == null) || (vtb === VAL.STRING && vta == null)) && ctx.abi.string?.ops?.cmp) {
+    const unkIsA = vta == null
+    const ta = temp('cmp'), tb = temp('cmp')
+    inc('__is_str_key')
+    const getA = typed(['local.get', `$${ta}`], 'f64'), getB = typed(['local.get', `$${tb}`], 'f64')
+    const check = ['call', '$__is_str_key', ['i64.reinterpret_f64', ['local.get', `$${unkIsA ? ta : tb}`]]]
+    const strCmp = [`i32.${i32op}`, ctx.abi.string.ops.cmp(getA, getB, ctx), ['i32.const', 0]]
+    const numCmp = [`f64.${f64op}`, toNumF64(a, getA), toNumF64(b, getB)]
+    return typed(['block', ['result', 'i32'],
+      ['local.set', `$${ta}`, asF64(va)],
+      ['local.set', `$${tb}`, asF64(vb)],
+      ['if', ['result', 'i32'], check, ['then', strCmp], ['else', numCmp]]], 'i32')
   }
   if (vta === VAL.DATE || vtb === VAL.DATE) {
     const dateNum = (node, v, vt) => {
@@ -748,11 +1065,17 @@ const cmpOp = (i32op, f64op, fn) => (a, b) => {
     return typed([`f64.${f64op}`, toNumF64(a, va), asF64(vb)], 'i32')
   if (vta === VAL.NUMBER && needsRelationalToNumber(b, vtb))
     return typed([`f64.${f64op}`, asF64(va), toNumF64(b, vb)], 'i32')
-  const ai = intConstValue(a), bi = intConstValue(b)
-  if (va.type === 'i32' && bi != null) return typed([`i32.${i32op}`, va, ['i32.const', bi]], 'i32')
-  if (vb.type === 'i32' && ai != null) return typed([`i32.${i32op}`, ['i32.const', ai], vb], 'i32')
-  return va.type === 'i32' && vb.type === 'i32'
-    ? typed([`i32.${i32op}`, va, vb], 'i32') : typed([`f64.${f64op}`, asF64(va), asF64(vb)], 'i32')
+  // An `.unsigned` i32 operand ([0, 2^32)) can't share a signed i32 compare with a
+  // possibly-signed one: mixed sign inverts the order (3 < 0xFFFFFFFF unsigned, but
+  // 3 > -1 signed). Widen to f64, where asF64 converts each operand by its own
+  // signedness (convert_i32_u for unsigned, _s otherwise) to its true numeric value.
+  if (!va.unsigned && !vb.unsigned) {
+    const ai = intConstValue(a), bi = intConstValue(b)
+    if (va.type === 'i32' && bi != null) return typed([`i32.${i32op}`, va, ['i32.const', bi]], 'i32')
+    if (vb.type === 'i32' && ai != null) return typed([`i32.${i32op}`, ['i32.const', ai], vb], 'i32')
+    if (va.type === 'i32' && vb.type === 'i32') return typed([`i32.${i32op}`, va, vb], 'i32')
+  }
+  return typed([`f64.${f64op}`, asF64(va), asF64(vb)], 'i32')
 }
 
 function needsRelationalToNumber(expr, vt) {
@@ -885,7 +1208,7 @@ export const emitter = {
   },
 
   'throw': expr => {
-    ctx.runtime.throws = true
+    ctx.runtime.throws = ctx.runtime.userThrows = true
     const thrown = temp()
     return typed(['block',
       ['local.set', `$${thrown}`, asF64(emit(expr))],
@@ -896,7 +1219,7 @@ export const emitter = {
   'catch': (body, errName, handler) => {
     if (!canThrow(body)) return emitFlat(body)
 
-    ctx.runtime.throws = true
+    ctx.runtime.throws = ctx.runtime.userThrows = true
     const id = ctx.func.uniq++
     ctx.func.locals.set(errName, 'f64')
     const prev = ctx.func.inTry; ctx.func.inTry = true
@@ -922,7 +1245,7 @@ export const emitter = {
       return [...bodyIR, ...cleanupIR]
     }
 
-    ctx.runtime.throws = true
+    ctx.runtime.throws = ctx.runtime.userThrows = true
     const id = ctx.func.uniq++
     const errLocal = temp('err')
     const parentStack = ctx.func.finallyStack || []
@@ -966,19 +1289,20 @@ export const emitter = {
     const rt = ctx.func.current?.results[0] || 'f64'
     const pk = ctx.func.current?.ptrKind
     const ir = pk != null ? asPtrOffset(emit(expr), pk) : asParamType(emit(expr), rt)
-    if (!ctx.func.inTry && !ctx.transform.noTailCall &&
-        Array.isArray(ir) && ir[0] === 'call' && typeof ir[1] === 'string')
-      return typed(['return_call', ...ir.slice(1)], 'void')
+    const ty = pk != null ? 'i32' : rt
+    const tcoed = tcoTailRewrite(ir, ty)
+    if (Array.isArray(tcoed) && tcoed[0] === 'return_call' && finalizers.length === 0) {
+      return typed(tcoed, 'void')
+    }
     if (finalizers.length > 0) {
-      const ty = pk != null ? 'i32' : rt
       const name = ty === 'i32' ? tempI32('ret') : ty === 'i64' ? tempI64('ret') : temp('ret')
       return [
-        ['local.set', `$${name}`, ir],
+        ['local.set', `$${name}`, tcoed],
         ...finalizerBlock(),
         typed(['return', ['local.get', `$${name}`]], 'void'),
       ]
     }
-    return typed(['return', ir], 'void')
+    return typed(['return', tcoed], 'void')
   },
 
   // === Assignment ===
@@ -990,7 +1314,15 @@ export const emitter = {
     if (Array.isArray(name) && name[0] === '[]') {
       const [, arr, idx] = name
       const keyType = keyValType(idx)
-      const useRuntimeKeyDispatch = keyType == null || (typeof idx === 'string' && keyType !== VAL.STRING)
+      // A provably-numeric index name — an int-certain loop counter or a
+      // NUMBER-typed local — can never be a string key, so the runtime
+      // `__is_str_key` → `__dyn_set` dispatch is dead. Mirrors the index *read*
+      // path (`intIndexIR`), closing the read/write asymmetry on `arr[i] = …`
+      // inside refined-array loops (e.g. watr's recursive AST walkers).
+      const idxNumericName = typeof idx === 'string' &&
+        (repOf(idx)?.intCertain === true || repOf(idx)?.val === VAL.NUMBER)
+      const useRuntimeKeyDispatch = !idxNumericName &&
+        (keyType == null || (typeof idx === 'string' && keyType !== VAL.STRING))
       const keyExpr = asF64(emit(idx))
       const valueExpr = asF64(emit(val))
       const storeArrayValue = (arrExpr, idxNode, persist) => {
@@ -1031,15 +1363,25 @@ export const emitter = {
       const litKey = isLiteralStr(idx) ? idx[1]
         : typeof arr === 'string' && lookupValType(arr) === VAL.OBJECT ? staticPropertyKey(idx)
         : null
+      // SRoA flat object: `o['k'] = x` → `local.set $o#i` (no heap store).
+      if (litKey != null && typeof arr === 'string' && ctx.func.flatObjects?.has(arr)) {
+        const fo = ctx.func.flatObjects.get(arr)
+        const fi = fo.names.indexOf(litKey)
+        if (fi >= 0) {
+          const t = temp()
+          return typed(['block', ['result', 'f64'],
+            ['local.set', `$${t}`, valueExpr],
+            ['local.set', `$${arr}#${fi}`, ['local.get', `$${t}`]],
+            ['local.get', `$${t}`]], 'f64')
+        }
+      }
       if (litKey != null && typeof arr === 'string' && ctx.schema.find) {
         const slot = ctx.schema.find(arr, litKey)
         if (slot >= 0) {
           const t = temp()
           return typed(['block', ['result', 'f64'],
             ['local.set', `$${t}`, valueExpr],
-            ['f64.store',
-              ['i32.add', ptrOffsetIR(asF64(emit(arr)), lookupValType(arr) || VAL.OBJECT), ['i32.const', slot * 8]],
-              ['local.get', `$${t}`]],
+            ctx.abi.object.ops.store(ptrOffsetIR(asF64(emit(arr)), lookupValType(arr) || VAL.OBJECT), slot, ['local.get', `$${t}`]),
             ['local.get', `$${t}`]], 'f64')
         }
       }
@@ -1188,6 +1530,18 @@ export const emitter = {
     // Object property assignment: obj.prop = x
     if (Array.isArray(name) && name[0] === '.') {
       const [, obj, prop] = name
+      // SRoA flat object: `o.prop = x` → `local.set $o#i` (no heap store).
+      const flatW = typeof obj === 'string' ? ctx.func.flatObjects?.get(obj) : null
+      if (flatW) {
+        const fi = flatW.names.indexOf(prop)
+        if (fi >= 0) {
+          const t = temp()
+          return typed(['block', ['result', 'f64'],
+            ['local.set', `$${t}`, asF64(emit(val))],
+            ['local.set', `$${obj}#${fi}`, ['local.get', `$${t}`]],
+            ['local.get', `$${t}`]], 'f64')
+        }
+      }
       // Schema-based object → f64.store at fixed offset.
       if (typeof obj === 'string' && ctx.schema.find) {
         const idx = ctx.schema.find(obj, prop)
@@ -1197,7 +1551,7 @@ export const emitter = {
           if (shadow) inc('__dyn_set')
           const stmts = [
             ['local.set', `$${t}`, vv],
-            ['f64.store', ['i32.add', ptrOffsetIR(asF64(va), lookupValType(obj) || VAL.OBJECT), ['i32.const', idx * 8]], ['local.get', `$${t}`]],
+            ctx.abi.object.ops.store(ptrOffsetIR(asF64(va), lookupValType(obj) || VAL.OBJECT), idx, ['local.get', `$${t}`]),
           ]
           if (shadow)
             stmts.push(['drop', ['call', '$__dyn_set', asI64(va), asI64(emit(['str', prop])), ['i64.reinterpret_f64', ['local.get', `$${t}`]]]])
@@ -1350,16 +1704,21 @@ export const emitter = {
           inc('__str_append_byte', '__char_at')
           return typed(['call', '$__str_append_byte',
             asI64(emit(a)),
-            ['call', '$__char_at', asI64(emit(b[1])), asI32(emit(b[2]))],
+            ctx.abi.string.ops.charCodeAt(asF64(emit(b[1])), asI32(emit(b[2])), ctx),
           ], 'f64')
         }
       }
-      inc('__str_concat_raw')
-      return typed(['call', '$__str_concat_raw', asI64(emit(a)), asI64(emit(b))], 'f64')
+      return typed(ctx.abi.string.ops.concatRaw(asF64(emit(a)), asF64(emit(b)), ctx), 'f64')
     }
     if (vtA === VAL.STRING || vtB === VAL.STRING) {
-      inc('__str_concat')
-      return typed(['call', '$__str_concat', asI64(emit(a)), asI64(emit(b))], 'f64')
+      // An OBJECT operand coerces via ToPrimitive(string) at compile time —
+      // __str_concat's runtime __to_str cannot invoke a user-defined toString.
+      // A BOOL operand renders "true"/"false" rather than its 0/1 carrier.
+      const strOperand = (vt, n) => vt === VAL.OBJECT ? typed(['f64.reinterpret_i64', toStrI64(n, emit(n))], 'f64')
+        : vt === VAL.BOOL ? emitBoolStr(n) : asF64(emit(n))
+      const ea = strOperand(vtA, a)
+      const eb = strOperand(vtB, b)
+      return typed(ctx.abi.string.ops.concat(ea, eb, ctx), 'f64')
     }
     if (vtA === VAL.BIGINT || vtB === VAL.BIGINT)
       return fromI64(['i64.add', asI64(emit(a)), asI64(emit(b))])
@@ -1386,10 +1745,15 @@ export const emitter = {
     }
     const va = emit(a), vb = emit(b), _f = foldConst(va, vb, (a, b) => a + b)
     if (_f) return _f
-    if (isLit(vb) && litVal(vb) === 0) return va
-    if (isLit(va) && litVal(va) === 0) return vb
-    if (va.type === 'i32' && vb.type === 'i32') return typed(['i32.add', va, vb], 'i32')
-    return typed(['f64.add', asF64(va), asF64(vb)], 'f64')
+    // Neither side is a string here (string paths handled above), but either may
+    // still be null/undefined/pointer — numeric `+` performs ToNumber like `-`/`*`.
+    if (isLit(vb) && litVal(vb) === 0) return toNumF64(a, va)
+    if (isLit(va) && litVal(va) === 0) return toNumF64(b, vb)
+    // An `.unsigned` operand is a uint32 (range [0, 2^32)); JS `+` is a float
+    // op whose result can exceed i32, so `i32.add` would wrap (4294967295+1→0).
+    // Widen to f64 — never wrap — matching spec. Only `>>>0`/`|0`/imul wrap.
+    if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb)) return typed(['i32.add', va, vb], 'i32')
+    return typed(['f64.add', toNumF64(a, va), toNumF64(b, vb)], 'f64')
   },
   '-': (a, b) => {
     if (_expect === 'void' && isPostfix(a, '++', b)) return emit(a, 'void')
@@ -1401,7 +1765,9 @@ export const emitter = {
     const va = emit(a), vb = emit(b), _f = foldConst(va, vb, (a, b) => a - b)
     if (_f) return _f
     if (isLit(vb) && litVal(vb) === 0) return toNumF64(a, va)
-    if (va.type === 'i32' && vb.type === 'i32') return typed(['i32.sub', va, vb], 'i32')
+    // Unsigned uint32 operand: JS `-` is float (can go negative / exceed i32),
+    // so avoid the wrapping i32.sub fast-path. See `+` above.
+    if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb)) return typed(['i32.sub', va, vb], 'i32')
     return typed(['f64.sub', toNumF64(a, va), toNumF64(b, vb)], 'f64')
   },
   'u+': a => {
@@ -1423,7 +1789,9 @@ export const emitter = {
     if (isLit(va) && litVal(va) === 1) return toNumF64(b, vb)
     if (isLit(vb) && litVal(vb) === 0) return isLit(va) ? vb : typed(['block', ['result', vb.type], va, 'drop', vb], vb.type)
     if (isLit(va) && litVal(va) === 0) return isLit(vb) ? va : typed(['block', ['result', va.type], vb, 'drop', va], va.type)
-    if (va.type === 'i32' && vb.type === 'i32') return typed(['i32.mul', va, vb], 'i32')
+    // `.unsigned` operand is a uint32 ([0, 2^32)); its product can exceed i32, so
+    // `i32.mul` would wrap ((2^32-1)*2 → -2). Widen to f64 — see `+` above.
+    if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb) && mulFitsI32(va, vb)) return typed(['i32.mul', va, vb], 'i32')
     return typed(['f64.mul', toNumF64(a, va), toNumF64(b, vb)], 'f64')
   },
   '/': (a, b) => {
@@ -1439,7 +1807,12 @@ export const emitter = {
       return fromI64(['i64.rem_s', asI64(emit(a)), asI64(emit(b))])
     const va = emit(a), vb = emit(b), _f = foldConst(va, vb, (a, b) => a % b, b => b !== 0)
     if (_f) return _f
-    if (va.type === 'i32' && vb.type === 'i32') return typed(['i32.rem_s', va, vb], 'i32')
+    // ES remainder by zero is NaN; only the f64 path yields that (a - trunc(a/0)*0).
+    // The i32.rem_s fast path traps on a zero divisor, so divert a literal-zero divisor.
+    if (isLit(vb) && litVal(vb) === 0) return emitNum(NaN)
+    // `.unsigned` operand: `i32.rem_s` reads the uint32 as a negative signed value
+    // ((2^32-1)%7 → rem_s(-1,7) = -1, not 3). Widen to f64 — see `+` above.
+    if (isI32Num(va) && isI32Num(vb) && !va.unsigned && !vb.unsigned) return typed(['i32.rem_s', va, vb], 'i32')
     return f64rem(toNumF64(a, va), toNumF64(b, vb))
   },
   // === Comparisons (always i32 result) ===
@@ -1447,6 +1820,8 @@ export const emitter = {
   '==': (a, b) => {
     const charCmp = emitSingleCharIndexCmp(a, b)
     if (charCmp) return charCmp
+    const subCmp = emitSubstringEqCmp(a, b)
+    if (subCmp) return subCmp
     // JS loose nullish equality: x == null / x == undefined.
     // If the non-literal side has a known non-null VAL type, fold to 0.
     if (isNullishLit(a)) {
@@ -1465,8 +1840,8 @@ export const emitter = {
     // of the other side: jz's `==` is strict (prepare.js:868), and every NaN-boxed pointer
     // reinterprets to a quiet NaN (0x7FF8… prefix) so f64.eq with any normal float is false.
     // Catches `closureVar === 34` in jzified hot loops where the unknown side has no VAL.
-    const vta = resolveValType(a, valTypeOf, lookupValType)
-    const vtb = resolveValType(b, valTypeOf, lookupValType)
+    const vta = numericVal(resolveValType(a, valTypeOf, lookupValType))
+    const vtb = numericVal(resolveValType(b, valTypeOf, lookupValType))
     if (vta === VAL.NUMBER && needsLooseEqualityToNumber(b, vtb)) return looseNumberEq(va, b, vb)
     if (vtb === VAL.NUMBER && needsLooseEqualityToNumber(a, vta)) return looseNumberEq(vb, a, va)
     if (vta === VAL.NUMBER || vtb === VAL.NUMBER) return typed(['f64.eq', asF64(va), asF64(vb)], 'i32')
@@ -1483,6 +1858,8 @@ export const emitter = {
   '!=': (a, b) => {
     const charCmp = emitSingleCharIndexCmp(a, b, true)
     if (charCmp) return charCmp
+    const subCmp = emitSubstringEqCmp(a, b, true)
+    if (subCmp) return subCmp
     if (isNullishLit(a)) {
       if (valTypeOf(b)) return emitNum(1)
       return typed(['i32.eqz', isNullish(asF64(emit(b)))], 'i32')
@@ -1494,8 +1871,8 @@ export const emitter = {
     const tc = emitTypeofCmp(a, b, 'ne'); if (tc) return tc
     const va = emit(a), vb = emit(b)
     if (va.type === 'i32' && vb.type === 'i32') return typed(['i32.ne', va, vb], 'i32')
-    const vta = resolveValType(a, valTypeOf, lookupValType)
-    const vtb = resolveValType(b, valTypeOf, lookupValType)
+    const vta = numericVal(resolveValType(a, valTypeOf, lookupValType))
+    const vtb = numericVal(resolveValType(b, valTypeOf, lookupValType))
     if (vta === VAL.NUMBER && needsLooseEqualityToNumber(b, vtb)) return looseNumberEq(va, b, vb, true)
     if (vtb === VAL.NUMBER && needsLooseEqualityToNumber(a, vta)) return looseNumberEq(vb, a, va, true)
     if (vta === VAL.NUMBER || vtb === VAL.NUMBER) return typed(['f64.ne', asF64(va), asF64(vb)], 'i32')
@@ -1505,6 +1882,8 @@ export const emitter = {
     inc('__eq')
     return typed(['i32.eqz', ['call', '$__eq', asI64(va), asI64(vb)]], 'i32')
   },
+  '===': (a, b) => emitStrictEq(a, b, false),
+  '!==': (a, b) => emitStrictEq(a, b, true),
   '<':  cmpOp('lt_s', 'lt', (a, b) => a < b),
   '>':  cmpOp('gt_s', 'gt', (a, b) => a > b),
   '<=': cmpOp('le_s', 'le', (a, b) => a <= b),
@@ -1519,7 +1898,9 @@ export const emitter = {
     if (v.ptrKind != null) return typed(['i32.eqz', v], 'i32')
     // Known pointer-kinded operand: `!x` is just `x is nullish` (null/undefined).
     // Excludes STRING — empty string '' is a valid (non-null) pointer but is falsy.
-    const vt = resolveValType(a, valTypeOf, lookupValType)
+    // VAL.BOOL rides the 0/1 numeric carrier (not a pointer), so normalize it to
+    // NUMBER and let it fall to the truthy path — `!false` must be `true`.
+    const vt = numericVal(resolveValType(a, valTypeOf, lookupValType))
     if (vt && vt !== VAL.NUMBER && vt !== VAL.BIGINT && vt !== VAL.STRING) {
       return isNullish(asF64(v))
     }
@@ -1586,11 +1967,23 @@ export const emitter = {
 
   '&&': (a, b) => {
     const va = emit(a)
-    if (isLit(va)) { const v = litVal(va); return (v !== 0 && v === v) ? emit(b) : va }
+    // Constant-folded literal: pre-bind under truthy refinements (b runs only when a was truthy).
+    if (isLit(va)) {
+      const v = litVal(va)
+      if (v !== 0 && v === v) {
+        const refs = extractRefinements(a, new Map(), true)
+        return withRefinements(refs, b, () => emit(b))
+      }
+      return va
+    }
+    // a is truthy in the right-arm — narrow b accordingly. Matches `?:`'s then-arm threading
+    // (`Array.isArray(x) && x[0]` → x[0] sees x as ARRAY, eliding union-rep fallbacks).
+    const rightRefs = extractRefinements(a, new Map(), true)
+    const emitRight = () => withRefinements(rightRefs, b, () => emit(b))
     // i32 fast path: use i32 tee as cond directly (nonzero=truthy in wasm `if`),
     // skip f64 round-trip and __is_truthy call entirely.
     if (va.type === 'i32') {
-      const vb = emit(b)
+      const vb = emitRight()
       const t = tempI32()
       if (vb.type === 'i32') {
         return typed(['if', ['result', 'i32'],
@@ -1607,15 +2000,25 @@ export const emitter = {
     const teed = typed(['local.tee', `$${t}`, asF64(va)], 'f64')
     return typed(['if', ['result', 'f64'],
       toBoolFromEmitted(teed),
-      ['then', asF64(emit(b))],
+      ['then', asF64(emitRight())],
       ['else', ['local.get', `$${t}`]]], 'f64')
   },
 
   '||': (a, b) => {
     const va = emit(a)
-    if (isLit(va)) { const v = litVal(va); return (v !== 0 && v === v) ? va : emit(b) }
+    // Constant-folded literal: pre-bind under falsy refinements (b runs only when a was falsy).
+    if (isLit(va)) {
+      const v = litVal(va)
+      if (v !== 0 && v === v) return va
+      const refs = extractRefinements(a, new Map(), false)
+      return withRefinements(refs, b, () => emit(b))
+    }
+    // a is falsy in the right-arm — `x == null || ...` proves x is null/undefined in b;
+    // De Morgan'd via the sense=false branch of extractRefinements (mirrors the ?: else-arm).
+    const rightRefs = extractRefinements(a, new Map(), false)
+    const emitRight = () => withRefinements(rightRefs, b, () => emit(b))
     if (va.type === 'i32') {
-      const vb = emit(b)
+      const vb = emitRight()
       const t = tempI32()
       if (vb.type === 'i32') {
         return typed(['if', ['result', 'i32'],
@@ -1633,7 +2036,7 @@ export const emitter = {
     return typed(['if', ['result', 'f64'],
       toBoolFromEmitted(teed),
       ['then', ['local.get', `$${t}`]],
-      ['else', asF64(emit(b))]], 'f64')
+      ['else', asF64(emitRight())]], 'f64')
   },
 
   // a ?? b: returns b only if a is nullish
@@ -1669,7 +2072,16 @@ export const emitter = {
   // i32 / lit values are already numeric — the toNumF64 wrap is skipped to keep
   // the numeric fast path at one wasm instruction. Non-numeric (NaN-boxed string,
   // unknown type) routes through __to_num so "2026" | 0 === 2026.
-  '~':   a => { const v = emit(a); return isLit(v) ? emitNum(~litVal(v)) : typed(['i32.xor', toI32(v.type === 'i32' ? v : toNumF64(a, v)), typed(['i32.const', -1], 'i32')], 'i32') },
+  // `~~x` is the idiomatic int32 truncation: the two xor-with-(-1) cancel, leaving
+  // a single toI32 (whose NaN/Infinity guard runs once, unchanged). Fold it here so
+  // DSP/bytebeat `~~` doesn't emit a dead double-xor watr won't remove.
+  '~':   a => {
+    if (Array.isArray(a) && a[0] === '~') {
+      const inner = a[1], iv = emit(inner)
+      return isLit(iv) ? emitNum(~~litVal(iv)) : typed(toI32(isI32Num(iv) ? iv : toNumF64(inner, iv)), 'i32')
+    }
+    const v = emit(a); return isLit(v) ? emitNum(~litVal(v)) : typed(['i32.xor', toI32(isI32Num(v) ? v : toNumF64(a, v)), typed(['i32.const', -1], 'i32')], 'i32')
+  },
   ...Object.fromEntries([
     ['&', 'and'], ['|', 'or'], ['^', 'xor'], ['<<', 'shl'], ['>>', 'shr_s'],
   ].map(([op, fn]) => [op, (a, b) => {
@@ -1682,19 +2094,28 @@ export const emitter = {
       if (op === '^') return emitNum(la ^ lb); if (op === '<<') return emitNum(la << lb)
       if (op === '>>') return emitNum(la >> lb)
     }
-    const ca = va.type === 'i32' || isLit(va) ? va : toNumF64(a, va)
-    const cb = vb.type === 'i32' || isLit(vb) ? vb : toNumF64(b, vb)
+    const ca = isI32Num(va) || isLit(va) ? va : toNumF64(a, va)
+    const cb = isI32Num(vb) || isLit(vb) ? vb : toNumF64(b, vb)
     return typed([`i32.${fn}`, toI32(ca), toI32(cb)], 'i32')
   }])),
   '>>>': (a, b) => {
-    const va = emit(a), vb = emit(b), _f = foldConst(va, vb, (a, b) => a >>> b)
-    if (_f) return _f
+    const va = emit(a), vb = emit(b)
+    if (isLit(va) && isLit(vb)) {
+      const r = litVal(va) >>> litVal(vb) // JS uint32 result ∈ [0, 2^32)
+      // ≥ 2^31 doesn't fit signed i32: materialize the wrapped bits as an i32 const
+      // tagged `.unsigned` so `asF64` lifts via `convert_i32_u`. Emitting `f64.const r`
+      // here (the old foldConst path) would `trunc_sat_f64_s`-saturate to INT32_MAX
+      // when the enclosing function narrows to an i32 result. Values < 2^31 fold to a
+      // plain i32 const (signed == unsigned, stays foldable downstream).
+      if (r >= 0x80000000) { const node = typed(['i32.const', r | 0], 'i32'); node.unsigned = true; return node }
+      return emitNum(r)
+    }
     // F: Mark unsigned so `asF64` lifts via `f64.convert_i32_u` (preserving the
     // [0, 2^32) value range). Without this, `(s >>> 0) / 4294967296` would convert
     // signed for negative-high-bit s values, flipping sign and breaking the
     // canonical "uint32 → f64" idiom used in PRNGs and bit-manipulation code.
-    const ca = va.type === 'i32' || isLit(va) ? va : toNumF64(a, va)
-    const cb = vb.type === 'i32' || isLit(vb) ? vb : toNumF64(b, vb)
+    const ca = isI32Num(va) || isLit(va) ? va : toNumF64(a, va)
+    const cb = isI32Num(vb) || isLit(vb) ? vb : toNumF64(b, vb)
     const node = typed(['i32.shr_u', toI32(ca), toI32(cb)], 'i32')
     node.unsigned = true
     return node
@@ -1773,8 +2194,24 @@ export const emitter = {
   },
 
   'while': (cond, body) => emitter['for'](null, cond, null, body),
-  'break': () => [...emitFinalizers(), ['br', loopTop().brk]],
-  'continue': () => [...emitFinalizers(), ['br', loopTop().loop]],
+  'label': (name, body) => {
+    const brk = `$label${ctx.func.uniq++}`
+    ctx.func.stack.push({ label: name, brk })
+    const result = ['block', brk, ...emitFlat(body)]
+    ctx.func.stack.pop()
+    return result
+  },
+  'break': (label) => {
+    const target = label == null
+      ? loopTop().brk
+      : ctx.func.stack.findLast(frame => frame.label === label)?.brk
+    if (!target) err(`break label '${label}' is not in scope`)
+    return [...emitFinalizers(), ['br', target]]
+  },
+  'continue': (label) => {
+    if (label != null) err(`continue label '${label}' is not supported`)
+    return [...emitFinalizers(), ['br', loopTop().loop]]
+  },
 
   // === Call ===
 
@@ -1823,8 +2260,6 @@ export const emitter = {
     let argList = Array.isArray(callArgs)
       ? (callArgs[0] === ',' ? callArgs.slice(1) : [callArgs])
       : callArgs ? [callArgs] : []
-    // Trailing comma in call: parser emits a trailing null sentinel — drop it
-    while (argList.length && argList[argList.length - 1] == null) argList.pop()
 
     // Helper: expand spread arguments into flat list of normal arguments + spread markers
     // Returns { normal: [...], spreads: [(pos, expr), ...] }
@@ -1844,6 +2279,13 @@ export const emitter = {
 
     const parsed = parseArgs(argList)
 
+    // Closure devirtualization: a callee that is a module global proven (by
+    // plan.js) to hold one statically-known function for the whole post-init
+    // program rewrites to that function — the known-top-level-function branch
+    // below then emits a direct `call`, dropping the indirect/trampoline path.
+    if (typeof callee === 'string' && ctx.func.globalDevirt?.has(callee))
+      callee = ctx.func.globalDevirt.get(callee)
+
     // Optional method call: obj?.method(args) — null if obj is nullish, else
     // obj.method(args). The parser shapes this as ['()', ['?.', obj, method], args],
     // distinct from the regular method call's ['.', obj, method] callee. Receiver
@@ -1868,8 +2310,27 @@ export const emitter = {
     if (Array.isArray(callee) && callee[0] === '.') {
       const [, obj, method] = callee
 
-      // Function property call: fn.prop(args) → direct call to fn$prop
-      if (typeof obj === 'string' && ctx.func.names.has(obj)) {
+      // charCodeAt with a statically in-bounds index — emit the i32
+      // (OOB-impossible) contract directly; the generic path keeps the
+      // f64/NaN JS-spec result. See analyze.js inBoundsCharCodeAt.
+      if (method === 'charCodeAt' && !parsed.hasSpread && parsed.normal.length === 1
+          && ctx.abi.string?.ops?.charCodeAt && inBoundsCharCodeAt(ctx).has(callee)) {
+        const recv = emit(obj)
+        // jsstring carrier: receiver is an externref boundary param. Route to
+        // `wasm:js-string.charCodeAt` directly — the in-bounds proof rules out
+        // the OOB trap the builtin would otherwise raise.
+        if (recv?.type === 'externref') {
+          ctx.core.jsstring.add('charCodeAt')
+          return typed(['call', '$__jss_charCodeAt', recv, asI32(emit(parsed.normal[0]))], 'i32')
+        }
+        return typed(ctx.abi.string.ops.charCodeAt(
+          asF64(recv), asI32(emit(parsed.normal[0])), ctx, false), 'i32')
+      }
+
+      // Function property call: fn.prop(args) → direct call to fn$prop.
+      // Skipped when the property was reassigned (wrapper composition) — then
+      // it is a mutable slot and must be read dynamically before the call.
+      if (typeof obj === 'string' && ctx.func.names.has(obj) && !ctx.func.multiProp.has(`${obj}.${method}`)) {
         const fname = `${obj}$${method}`
         if (ctx.func.names.has(fname)) {
           const func = ctx.func.map.get(fname)
@@ -1885,9 +2346,19 @@ export const emitter = {
       }
 
       let vt = keyValType(obj)
+      // A reassigned slice/concat receiver may carry a stale `vt` — a reassignment
+      // inside a nested closure escapes analyzeValTypes' poisoning (its walk stops
+      // at `=>`). Drop to runtime dispatch, but only for guessy types: STRING/ARRAY
+      // dispatch correctly either way, and BUFFER/TYPED are construction proofs
+      // (`new ArrayBuffer`/`new XxxArray`) — the runtime String/Array fallback has
+      // no branch for them, so nulling `vt` would miscompile `ab.slice()` into an
+      // f64-array copy. jzify also splits every `var x = init` into `let x; x = init`,
+      // marking single-assignment vars "reassigned"; keeping definite BUFFER/TYPED
+      // is what keeps `var`-declared buffers correct.
       if (typeof obj === 'string' && isReassigned(ctx.func.body, obj)
         && (method === 'slice' || method === 'concat')
-        && vt !== VAL.STRING && vt !== VAL.ARRAY) vt = null
+        && vt !== VAL.STRING && vt !== VAL.ARRAY
+        && vt !== VAL.BUFFER && vt !== VAL.TYPED) vt = null
 
       // Helper to call method with arguments (handles spread expansion)
       const callMethod = (objArg, methodEmitter) => {
@@ -1915,22 +2386,14 @@ export const emitter = {
           ctx.func.locals.set(si, 'i32'); ctx.func.locals.set(base, 'i32')
 
           const objIsArr = lookupValType(objArg) === VAL.ARRAY
-          // Spread source: if statically known ARRAY, inline len/load via hoisted srcBase
-          // (skip per-iteration __arr_idx call + dispatch).
-          const srcVT = valTypeOf(spreadExpr)
-          const srcIsArr = !multiCount(spreadExpr) && srcVT === VAL.ARRAY
-          const srcBase = srcIsArr ? `${T}psb${ctx.func.uniq++}` : null
-          if (srcIsArr) ctx.func.locals.set(srcBase, 'i32')
+          // A materialized multi-value is not a statically-typed pointer — let
+          // emitSpreadCopy resolve its kind once at runtime.
+          const srcVT = multiCount(spreadExpr) ? undefined : valTypeOf(spreadExpr)
           const n = multiCount(spreadExpr)
           const ir = []
           ir.push(['local.set', `$${o}`, asF64(emit(objArg))])
           ir.push(['local.set', `$${sa}`, n ? materializeMulti(spreadExpr) : asF64(emit(spreadExpr))])
-          if (srcIsArr) {
-            ir.push(['local.set', `$${srcBase}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${sa}`]]]])
-            ir.push(['local.set', `$${sl}`, ['i32.load', ['i32.sub', ['local.get', `$${srcBase}`], ['i32.const', 8]]]])
-          } else {
-            ir.push(['local.set', `$${sl}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${sa}`]]]])
-          }
+          ir.push(['local.set', `$${sl}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${sa}`]]]])
           // Old length: inline as `i32.load (off-8)` if obj is known ARRAY (matches .push handler).
           if (objIsArr) {
             ir.push(['local.set', `$${ol}`,
@@ -1943,20 +2406,9 @@ export const emitter = {
             ['i32.add', ['local.get', `$${ol}`], ['local.get', `$${sl}`]]]])
           // base captured AFTER grow (grow may relocate the array).
           ir.push(['local.set', `$${base}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${o}`]]]])
-          // Tight store loop.
-          ir.push(['local.set', `$${si}`, ['i32.const', 0]])
-          const loopId = ctx.func.uniq++
-          const srcLoad = srcIsArr
-            ? ['f64.load', ['i32.add', ['local.get', `$${srcBase}`], ['i32.shl', ['local.get', `$${si}`], ['i32.const', 3]]]]
-            : asF64(emit(['[]', sa, si]))
-          ir.push(['block', `$break${loopId}`, ['loop', `$continue${loopId}`,
-            ['br_if', `$break${loopId}`, ['i32.ge_u', ['local.get', `$${si}`], ['local.get', `$${sl}`]]],
-            ['f64.store',
-              ['i32.add', ['local.get', `$${base}`],
-                ['i32.shl', ['i32.add', ['local.get', `$${ol}`], ['local.get', `$${si}`]], ['i32.const', 3]]],
-              srcLoad],
-            ['local.set', `$${si}`, ['i32.add', ['local.get', `$${si}`], ['i32.const', 1]]],
-            ['br', `$continue${loopId}`]]])
+          // Bulk-copy the spread: an ARRAY source is a contiguous f64 block → memory.copy.
+          ir.push(['local.set', `$${si}`, ['local.get', `$${ol}`]])
+          ir.push(...emitSpreadCopy(base, si, sa, sl, srcVT))
           // Single set_len for the full spread.
           ir.push(['call', '$__set_len', ['i64.reinterpret_f64', ['local.get', `$${o}`]],
             ['i32.add', ['local.get', `$${ol}`], ['local.get', `$${sl}`]]])
@@ -1978,6 +2430,9 @@ export const emitter = {
           const acc = `${T}acc${ctx.func.uniq++}`, arr = `${T}sp${ctx.func.uniq++}`, len = `${T}splen${ctx.func.uniq++}`, idx = `${T}spidx${ctx.func.uniq++}`
           ctx.func.locals.set(acc, 'f64'); ctx.func.locals.set(arr, 'f64')
           ctx.func.locals.set(len, 'i32'); ctx.func.locals.set(idx, 'i32')
+          // Emit-time rep seeding for a fresh spread-staging local (no prior reader).
+          // Without this, the loop body's `[]` read on `arr` falls back to polymorphic
+          // dispatch — VAL.* on the rep elides STRING gate for ARRAY/TYPED spreads.
           const spreadVT = valTypeOf(spreadExpr)
           if (spreadVT) updateRep(arr, { val: spreadVT })
 
@@ -2042,6 +2497,7 @@ export const emitter = {
               const spreadExpr = item[1]
               const arrL = `${T}sp${ctx.func.uniq++}`, lenL = `${T}splen${ctx.func.uniq++}`, idxL = `${T}spidx${ctx.func.uniq++}`
               ctx.func.locals.set(arrL, 'f64'); ctx.func.locals.set(lenL, 'i32'); ctx.func.locals.set(idxL, 'i32')
+              // Emit-time rep seeding for fresh spread-staging local (see arr-spread comment above).
               const spreadVT = valTypeOf(spreadExpr)
               if (spreadVT) updateRep(arrL, { val: spreadVT })
               const n = multiCount(spreadExpr)
@@ -2117,11 +2573,11 @@ export const emitter = {
           // Boxed handle is OBJECT-kind, never ARRAY — skip forwarding.
           const loadInner = [
             ['local.set', `$${boxBase}`, ptrOffsetIR(asF64(emit(obj)), lookupValType(obj) || VAL.OBJECT)],
-            ['local.set', `$${innerName}`, ['f64.load', ['local.get', `$${boxBase}`]]]]
+            ['local.set', `$${innerName}`, ctx.abi.object.ops.load(['local.get', `$${boxBase}`], 0)]]
           const result = callMethod(innerName, emitter)
           // Mutating methods may reallocate; writeback inner value to boxed slot
           if (BOXED_MUTATORS.has(method)) {
-            const wb = ['f64.store', ['local.get', `$${boxBase}`], ['local.get', `$${innerName}`]]
+            const wb = ctx.abi.object.ops.store(['local.get', `$${boxBase}`], 0, ['local.get', `$${innerName}`])
             return typed(['block', ['result', 'f64'], ...loadInner, asF64(result), wb], 'f64')
           }
           // Non-mutating: just load inner and call
@@ -2129,6 +2585,35 @@ export const emitter = {
         }
       }
 
+      // valueOf/toString are ToPrimitive hooks (ES2024 7.1.1) that an own data
+      // property shadows. An assigned `obj.valueOf`/`obj.toString` must win over
+      // the builtin emitter for any receiver that can carry a dynamic-prop
+      // sidecar — a sidecar-bearing static type (array/typed/object) OR a
+      // statically-unknown receiver (e.g. an array-element read `arr[0]`, whose
+      // type is only known at runtime). Probe the sidecar and call it when it
+      // holds a closure, else fall back to the builtin (generic when untyped:
+      // `.valueOf` returns the receiver, `.toString` runs type-aware __to_str).
+      // Parallels the member-READ check in module/core.js emitPropAccess (which
+      // stays scoped to known sidecar types). (watr's `str()` attaches
+      // `bytes.valueOf = () => s`, recovered via `.valueOf()`.)
+      if ((method === 'valueOf' || method === 'toString') && ctx.closure.call
+          && !parsed.hasSpread && parsed.normal.length === 0
+          && (vt === VAL.ARRAY || vt === VAL.TYPED || vt === VAL.OBJECT || !vt)) {
+        const builtin = (vt && ctx.core.emit[`.${vt}:${method}`]) || ctx.core.emit[`.${method}`]
+        if (builtin) {
+          const objTmp = temp('vobj'), propTmp = temp('vprop')
+          inc('__dyn_get_expr', '__ptr_type')
+          return typed(['block', ['result', 'f64'],
+            ['local.set', `$${objTmp}`, asF64(emit(obj))],
+            ['local.set', `$${propTmp}`, ['f64.reinterpret_i64',
+              ['call', '$__dyn_get_expr', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]], asI64(emit(['str', method]))]]],
+            ['if', ['result', 'f64'],
+              ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${propTmp}`]]], ['i32.const', PTR.CLOSURE]],
+              ['then', ctx.closure.call(typed(['local.get', `$${propTmp}`], 'f64'), [])],
+              ['else', asF64(callMethod(objTmp, builtin))]]], 'f64')
+        }
+      }
+
       // Known type → static dispatch
       if (vt && ctx.core.emit[`.${vt}:${method}`]) {
         return callMethod(obj, ctx.core.emit[`.${vt}:${method}`])
@@ -2158,7 +2643,7 @@ export const emitter = {
       if (typeof obj === 'string' && ctx.schema.find && ctx.closure.call) {
         const idx = ctx.schema.find(obj, method)
         if (idx >= 0 && !ctx.schema.isBoxed?.(obj)) {
-          const propRead = typed(['f64.load', ['i32.add', ptrOffsetIR(asF64(emit(obj)), lookupValType(obj) || VAL.OBJECT), ['i32.const', idx * 8]]], 'f64')
+          const propRead = typed(ctx.abi.object.ops.load(ptrOffsetIR(asF64(emit(obj)), lookupValType(obj) || VAL.OBJECT), idx), 'f64')
           if (parsed.hasSpread) {
             const combined = reconstructArgsWithSpreads(parsed.normal, parsed.spreads)
             return ctx.closure.call(propRead, [buildArrayWithSpreads(combined)], true)
@@ -2171,13 +2656,21 @@ export const emitter = {
       if (typeof obj === 'string' && ctx.schema.find && ctx.closure.call && ctx.schema.isBoxed?.(obj)) {
         const idx = ctx.schema.find(obj, method)
         if (idx >= 0) {
-          const propRead = typed(['f64.load', ['i32.add', ptrOffsetIR(asF64(emit(obj)), lookupValType(obj) || VAL.OBJECT), ['i32.const', idx * 8]]], 'f64')
+          const propRead = typed(ctx.abi.object.ops.load(ptrOffsetIR(asF64(emit(obj)), lookupValType(obj) || VAL.OBJECT), idx), 'f64')
           return ctx.closure.call(propRead, parsed.normal)
         }
       }
 
-      // Generic only
-      if (ctx.core.emit[genKey]) {
+      // Generic only — but a collection emitter (`.get`/`.set`/`.has`/`.add`/
+      // `.delete`) assumes a Map/Set receiver: a proven collection already
+      // dispatched via `.${vt}:${method}` above, so reaching here means the
+      // receiver is not a proven collection. A zero-arg call then cannot be the
+      // collection op (each needs ≥1 key/value arg) — it is a user/closure
+      // method (e.g. `new C().get()`). Skip the collection emitter so it falls
+      // through to closure/dynamic dispatch instead of crashing on `emit(key)`.
+      const collectionMisfit = COLLECTION_METHODS.has(method) &&
+        !parsed.hasSpread && parsed.normal.length === 0
+      if (ctx.core.emit[genKey] && !collectionMisfit) {
         return callMethod(obj, ctx.core.emit[genKey])
       }
 
@@ -2233,6 +2726,10 @@ export const emitter = {
       // Unknown callee - assume external method
       if (ctx.transform.strict)
         err(`strict mode: method call \`${typeof obj === 'string' ? obj : '<expr>'}.${method}(...)\` on a value of unknown type falls through to host \`__ext_call\`. Annotate the receiver type or pass { strict: false }.`)
+      // Under wasi there is no host `__ext_call` — the call lowers to a
+      // no-op returning `undefined`. This is by-design so polymorphic code
+      // can target js and wasi from one source; users who want fail-fast
+      // pass `strict: true` (handled above).
       if (ctx.transform.host === 'wasi') return undefExpr()
       inc('__ext_call')
       ctx.features.external = true
@@ -2244,7 +2741,7 @@ export const emitter = {
         ['i64.reinterpret_f64', arrayIR]]], 'f64');
     }
 
-    if (ctx.core.emit[callee]) {
+    if (typeof callee === 'string' && ctx.core.emit[callee] && !isBoundName(callee) && !isUserFunc(callee)) {
       // Pass spread args through to emitter (e.g. Math.max(...arr))
       if (parsed.hasSpread) {
         const allArgs = []
@@ -2260,7 +2757,7 @@ export const emitter = {
     }
 
     // Direct call if callee is a known top-level function
-    if (typeof callee === 'string' && ctx.func.names.has(callee) && !ctx.func.locals?.has(callee)) {
+    if (typeof callee === 'string' && ctx.func.names.has(callee) && !isBoundName(callee)) {
       const func = ctx.func.map.get(callee)
 
       // Rest param case: collect all args (including expanded spreads) into array
@@ -2429,15 +2926,19 @@ export function emit(node, expect) {
     if (node.loc != null) ctx.error.loc = node.loc
   }
   if (node == null) return null
-  if (node === true) return typed(['i32.const', 1], 'i32')
-  if (node === false) return typed(['i32.const', 0], 'i32')
+  // Boolean literals carry VAL.BOOL for type observation (valTypeOf reads the
+  // AST), but their working representation is the plain number 0/1 — identical
+  // codegen to the pre-carrier `[, 1]`/`[, 0]` folding, so no perf is paid.
+  if (node === true) return emitNum(1)
+  if (node === false) return emitNum(0)
   if (typeof node === 'symbol') // JZ_NULL sentinel → null NaN
     return nullExpr()
   if (typeof node === 'bigint') {
-    // Wrap to unsigned i64 range — emit as positive hex so downstream BigInt() parsers
-    // (e.g. watr's optimize.js getConst) don't choke on "-0x..." strings.
-    const n = node & 0xFFFFFFFFFFFFFFFFn
-    return typed(['f64.reinterpret_i64', ['i64.const', '0x' + n.toString(16)]], 'f64')
+    // Truncate to 64 bits — `BigInt.asUintN(64, …)` semantics, same as the
+    // explicit mask `node & 0xFFFFFFFFFFFFFFFFn`. Decimal form (vs. the prior
+    // unsigned-hex dance) is enough now that watr's optimize.js getConst
+    // handles signed strings correctly (4.6.8 W5 fix).
+    return typed(['f64.reinterpret_i64', ['i64.const', BigInt.asUintN(64, node).toString()]], 'f64')
   }
   if (typeof node === 'number') return emitNum(node)
   if (typeof node === 'string') {
@@ -2473,7 +2974,15 @@ export function emit(node, expect) {
           ctx.core.stdlib[trampolineName] = `(func $${trampolineName} ${paramDecls.join(' ')} (result f64) (local $${arr} i32) ${tempLocals} (call $${node} ${fwd}) ${capture} (local.set $${arr} (call $__alloc (i32.const ${n * 8 + 8}))) (i32.store (local.get $${arr}) (i32.const ${n})) (i32.store (i32.add (local.get $${arr}) (i32.const 4)) (i32.const ${n})) (local.set $${arr} (i32.add (local.get $${arr}) (i32.const 8))) ${stores} (call $__mkptr (i32.const 1) (i32.const 0) (local.get $${arr})))`
           inc(trampolineName, '__alloc', '__mkptr')
         } else {
-          ctx.core.stdlib[trampolineName] = `(func $${trampolineName} ${paramDecls.join(' ')} (result f64) (call $${node} ${fwd}))`
+          // Convert i32/i64 results back to f64 — uniform closure ABI returns f64.
+          const resType = func?.sig.results[0]
+          const callExpr = `(call $${node} ${fwd})`
+          const wrapped = resType === 'i32'
+            ? (func.sig.unsignedResult ? `(f64.convert_i32_u ${callExpr})` : `(f64.convert_i32_s ${callExpr})`)
+            : resType === 'i64'
+              ? `(f64.reinterpret_i64 ${callExpr})`
+              : callExpr
+          ctx.core.stdlib[trampolineName] = `(func $${trampolineName} ${paramDecls.join(' ')} (result f64) ${wrapped})`
           inc(trampolineName)
         }
       }