jz 0.4.0 → 0.5.1

package/src/plan.js

@@ -8,7 +8,8 @@
  *        narrowed signatures, finalized global reps, and per-call decisions.
  *
  * # Pipeline (top-level `plan(ast)`)
- *   1. scanGlobalValueFacts / unboxConstTypedGlobals — finalize global storage.
+ *   1. unboxConstTypedGlobals — finalize global storage. (Global value facts
+ *      themselves are seeded by prepare via `infer.recordGlobalRep`.)
  *   2. collectProgramFacts — sweep arrow bodies for typed-elem usage, key sets,
  *      loop depth, control-transfer shapes; rerun if hot inlining changes the AST.
  *   3. materializeAutoBoxSchemas / resolveClosureWidth — settle layout decisions.
@@ -24,9 +25,10 @@
  */
 
 import { ctx } from './ctx.js'
-import { T, VAL, ASSIGN_OPS, analyzeBody, invalidateLocalsCache, staticObjectProps, staticPropertyKey, valTypeOf, typedElemCtor, typedElemAux, updateGlobalRep, collectProgramFacts, extractParams } from './analyze.js'
-import { MAX_CLOSURE_ARITY } from './ir.js'
-import narrowSignatures, { specializeBimorphicTyped, refineDynKeys } from './narrow.js'
+import { T, VAL, ASSIGN_OPS, analyzeBody, invalidateLocalsCache, staticObjectProps, staticPropertyKey, typedElemCtor, typedElemAux, updateGlobalRep, collectProgramFacts, analyzeFuncNamespaces, extractParams, intLiteralValue } from './analyze.js'
+import { includeModule } from './autoload.js'
+import { MAX_CLOSURE_ARITY, UNDEF_WAT } from './ir.js'
+import narrowSignatures, { specializeBimorphicTyped, refineDynKeys, applyJsstringBoundaryCarrierStandalone, narrowBoolResults } from './narrow.js'
 
 const CONTROL_TRANSFER = new Set(['return', 'throw', 'break', 'continue'])
 const LOOP_OPS = new Set(['for', 'while', 'do', 'do-while'])
@@ -199,17 +201,27 @@ const fixedScalarTypedArray = (expr) => {
 
 const ASSIGN_TARGET_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '>>=', '<<=', '>>>=', '||=', '&&=', '??='])
 
-const safeScalarArrayUse = (node, name, parentOp = null) => {
+const safeScalarArrayUse = (node, name, len, parentOp = null) => {
   if (typeof node === 'string') return node !== name
   if (!Array.isArray(node)) return true
   const op = node[0]
   if (ASSIGN_TARGET_OPS.has(op) && node[1] === name) return false
   if ((op === 'let' || op === 'const') && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
   if ((op === '.' || op === '?.') && node[1] === name) return node[2] === 'length'
+  // Element write `name[idx] (op)= v` / `name[idx]++`: an out-of-bounds index
+  // grows the array (sparse-array semantics), which the fixed scalar slot set
+  // can't model — reject unless idx is a literal within the literal's bounds.
+  if ((ASSIGN_TARGET_OPS.has(op) || op === '++' || op === '--')
+      && Array.isArray(node[1]) && node[1][0] === '[]' && node[1][1] === name) {
+    const idx = intLit(node[1][2])
+    if (idx == null || idx < 0 || idx >= len) return false
+    for (let i = 2; i < node.length; i++) if (!safeScalarArrayUse(node[i], name, len, op)) return false
+    return true
+  }
   if (op === '[]' && node[1] === name) return intLit(node[2]) != null
   if (op === '...' && node[1] === name) return parentOp === '['
   for (let i = 1; i < node.length; i++) {
-    if (!safeScalarArrayUse(node[i], name, op)) return false
+    if (!safeScalarArrayUse(node[i], name, len, op)) return false
   }
   return true
 }
@@ -674,7 +686,7 @@ const scalarizeArrayLiteralSeq = (seq) => {
     let ok = true
     for (let j = 0; j < stmts.length && ok; j++) {
       if (j === i) continue
-      ok = safeScalarArrayUse(stmts[j], decl[1])
+      ok = safeScalarArrayUse(stmts[j], decl[1], elems.length)
     }
     if (!ok) continue
     candidates.set(decl[1], { index: i, op: stmt[0], elems })
@@ -804,6 +816,316 @@ const scalarizeFunctionArrayLiterals = () => {
   return changed
 }
 
+// === Int-array → Int32Array auto-promotion =================================
+//
+// A `let xs = [intLit, intLit, …]` binding whose every use is TYPED-compatible
+// is rewritten to `let xs = new Int32Array([intLit, …])`. Downstream analysis
+// then takes over: valTypeOf → VAL.TYPED, methods dispatch through `.typed:`,
+// loops get auto-vectorized via i32x4 (SIMD pass), and the carrier shrinks
+// from 8-byte f64 slots to packed i32. The promotion runs after literal
+// scalarization (so arrays fully scalarized away are already gone) and before
+// typed-array param scalarization (so a freshly-promoted array can still
+// participate in subsequent loop unrolling).
+//
+// Safety: the binding must never appear in a pattern that TYPED can't honor.
+// Disqualifiers (each fires per binding name):
+//   1. reassignment `xs = …` / compound `xs +=` / `++xs` / `--xs` — TYPED has
+//      no value-replacement op; `xs = new TypedArray(…)` would also drop the
+//      promoted view's identity.
+//   2. element write `xs[k] = v` — TYPED's i32-trunc store would lose
+//      fractional/NaN bits that VAL.ARRAY would have preserved.
+//   3. method calls outside the read-safe whitelist (push, pop, shift, …) —
+//      TYPED arrays are fixed-length; mutators don't exist on the carrier.
+//   4. `Array.isArray(xs)` — semantics flip true→false on promotion.
+//   5. `…xs` spread / `xs` as call arg / `xs` as return / bare reference in
+//      any other position — escape; callee may rely on ARRAY layout.
+//   6. captured by a closure / shadowed by an inner decl — same escape
+//      reasoning, plus the inner decl could rebind to a non-array.
+//
+// Elements at init must all be i32-range integer literals. A negative literal
+// arrives as `[null, -n]` after prepare's constant folding; intLiteralValue
+// recognizes that form. Float literals (`[1, 2.5]`) and out-of-range ints
+// (`0x80000000` on the +ve side, etc.) disqualify the array as a whole.
+
+// Methods we promote across. The bar: every entry must have a real `.typed:*`
+// emitter in module/typedarray.js. Receiver-flow into chained methods is also
+// typed-aware now — `.typed:map`/`.typed:filter`/`.typed:slice` all return
+// TYPED carriers, and downstream `.filter`/`.slice`/`.map`/etc. on those
+// re-dispatch via emit.js:2211's `.typed:<m>` lookup (VAL.TYPED ⇒ typed
+// emitter). Methods missing here (.join, .sort, .reverse, .subarray, .fill,
+// .toString, .copyWithin, …) lack a typed emitter — disqualify the candidate.
+const _TYPED_SAFE_METHODS = new Set([
+  'set',
+  'map', 'filter', 'slice',
+  'forEach', 'reduce',
+  'indexOf', 'includes', 'find', 'findIndex', 'some', 'every',
+])
+
+// `.length` is TYPED-aware via core.js:__len (shifts the byte header by
+// __typed_shift on TAG=3). `.byteLength`/`.byteOffset`/`.buffer` are
+// TYPED-only — a user reading those already expects a typed array, so a
+// promotion candidate that hits them is a coincidence we'd rather not
+// rely on; disqualify and let them write the TypedArray construction
+// themselves.
+const _TYPED_SAFE_PROPS = new Set(['length'])
+
+// Returns the i32-range integer payload of an array-literal element, or null
+// if the element isn't a literal integer that fits in i32. Mirrors the shape
+// check used by `intLiteralValue` but without the rep-lookup (we're pre-
+// analysis here, and want a pure syntactic gate).
+const _intArrayLitElems = (expr) => {
+  if (!Array.isArray(expr) || expr[0] !== '[') return null
+  if (expr.length < 2) return null  // empty literal — low value, skip
+  const out = []
+  for (let i = 1; i < expr.length; i++) {
+    const v = intLiteralValue(expr[i])
+    if (v == null) return null
+    out.push(v)
+  }
+  return out
+}
+
+// True iff `name` appears anywhere within `node` as a bare identifier or
+// inside any expression position. Used to detect escape across a closure
+// boundary (where we can't trace the use sites locally).
+const _refsName = (node, name) => {
+  if (typeof node === 'string') return node === name
+  if (!Array.isArray(node)) return false
+  for (let i = 1; i < node.length; i++) if (_refsName(node[i], name)) return true
+  return false
+}
+
+// Walks `node` and disqualifies every candidate name that appears in an
+// unsafe context. `initSet` holds the candidate's own init-decl AST nodes
+// (their LHS reference is the binding being defined, not an escape).
+const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
+  if (initSet.has(node)) {
+    // The init decl itself: only walk the RHS (skip the LHS `name`).
+    return _disqualifyPromotion(node[2], candidates, disqualified, initSet)
+  }
+  if (typeof node === 'string') {
+    // Bare identifier outside any handled parent context — escape.
+    if (candidates.has(node)) disqualified.add(node)
+    return
+  }
+  if (!Array.isArray(node)) return
+  const op = node[0]
+
+  // Closure body — any candidate referenced inside is captured. Bail without
+  // recursing further (we'd otherwise hit the bare-name leaf and disqualify
+  // anyway, but this is explicit and avoids walking the inner closure).
+  if (op === '=>') {
+    for (const n of candidates.keys()) {
+      if (!disqualified.has(n) && _refsName(node, n)) disqualified.add(n)
+    }
+    return
+  }
+
+  // Property access `name.prop` / `name?.prop`. Bare property reads only —
+  // method calls reach here via the `()` handler below (which intercepts
+  // before recursing into its callee).
+  if ((op === '.' || op === '?.') && typeof node[1] === 'string' && candidates.has(node[1])) {
+    if (!_TYPED_SAFE_PROPS.has(node[2])) disqualified.add(node[1])
+    return  // node[2] is the property name (string), not an expression — done
+  }
+
+  // Method or function call. Two shapes carry the candidate:
+  //   `name.method(args)` — receiver at node[1][1]; method whitelist gates.
+  //   `f(…, name, …)` / `Array.isArray(name)` — name appears as a plain arg.
+  if (op === '()') {
+    const callee = node[1]
+    // Method call on a candidate receiver.
+    if (Array.isArray(callee) && (callee[0] === '.' || callee[0] === '?.') &&
+        typeof callee[1] === 'string' && candidates.has(callee[1])) {
+      if (!_TYPED_SAFE_METHODS.has(callee[2])) disqualified.add(callee[1])
+      // Walk method args (skip the receiver — already validated above).
+      for (let i = 2; i < node.length; i++) _disqualifyPromotion(node[i], candidates, disqualified, initSet)
+      return
+    }
+    // Array.isArray flips true→false under promotion.
+    if (callee === 'Array.isArray') {
+      const raw = node[2]
+      const list = raw == null ? [] : (Array.isArray(raw) && raw[0] === ',') ? raw.slice(1) : [raw]
+      for (const a of list) {
+        if (typeof a === 'string' && candidates.has(a)) disqualified.add(a)
+        else _disqualifyPromotion(a, candidates, disqualified, initSet)
+      }
+      return
+    }
+    // Fall through to generic recursion — `name` as a plain arg will hit the
+    // bare-name leaf above and disqualify.
+  }
+
+  // Index read `name[k]` — read access is TYPED-safe. Walk the key in case
+  // it contains references to other candidate names.
+  if (op === '[]' && typeof node[1] === 'string' && candidates.has(node[1])) {
+    _disqualifyPromotion(node[2], candidates, disqualified, initSet)
+    return
+  }
+
+  // Element write: `['=', ['[]', name, k], v]` (and compound forms).
+  // V1 stays read-only after init — element writes would silently truncate.
+  if (ASSIGN_OPS.has(op) && Array.isArray(node[1]) && node[1][0] === '[]' &&
+      typeof node[1][1] === 'string' && candidates.has(node[1][1])) {
+    disqualified.add(node[1][1])
+    _disqualifyPromotion(node[1][2], candidates, disqualified, initSet)
+    _disqualifyPromotion(node[2], candidates, disqualified, initSet)
+    return
+  }
+
+  // Whole-binding reassign: `name = …` / `name += …` / etc.
+  if (ASSIGN_OPS.has(op) && typeof node[1] === 'string' && candidates.has(node[1])) {
+    disqualified.add(node[1])
+    _disqualifyPromotion(node[2], candidates, disqualified, initSet)
+    return
+  }
+
+  // Pre/post-increment on var or element.
+  if (op === '++' || op === '--') {
+    const t = node[1]
+    if (typeof t === 'string' && candidates.has(t)) { disqualified.add(t); return }
+    if (Array.isArray(t) && t[0] === '[]' && typeof t[1] === 'string' && candidates.has(t[1])) {
+      disqualified.add(t[1])
+      _disqualifyPromotion(t[2], candidates, disqualified, initSet)
+      return
+    }
+  }
+
+  // `let`/`const` declaration — the candidate's own init lands here via the
+  // initSet branch at the top. Any *other* decl that names a candidate is a
+  // shadow (impossible after jz hoists, but defensive) and disqualifies.
+  if (op === 'let' || op === 'const') {
+    for (let i = 1; i < node.length; i++) {
+      const d = node[i]
+      if (typeof d === 'string' && candidates.has(d)) disqualified.add(d)
+      else if (Array.isArray(d) && d[0] === '=' && typeof d[1] === 'string' &&
+               candidates.has(d[1]) && !initSet.has(d)) {
+        disqualified.add(d[1])
+        _disqualifyPromotion(d[2], candidates, disqualified, initSet)
+      } else {
+        _disqualifyPromotion(d, candidates, disqualified, initSet)
+      }
+    }
+    return
+  }
+
+  // Spread `…name` — could be in a call, a `[`, or a destructure target.
+  if (op === '...' && typeof node[1] === 'string' && candidates.has(node[1])) {
+    disqualified.add(node[1])
+    return
+  }
+
+  // for-of / for-in iteration: receiver position is `node[2]` (a bare name
+  // there would otherwise trigger escape). TYPED supports iteration, so
+  // allow the receiver but walk the body for other refs.
+  if (op === 'for-of' || op === 'for-in') {
+    // Walk decl (node[1]), iter (node[2]), body (node[3]); receiver as bare
+    // name is fine — only the body matters for further refs to the same name
+    // (but body refs would shadow or escape, which other rules catch).
+    for (let i = 1; i < node.length; i++) {
+      const child = node[i]
+      if (i === 2 && typeof child === 'string' && candidates.has(child)) continue
+      _disqualifyPromotion(child, candidates, disqualified, initSet)
+    }
+    return
+  }
+
+  // Generic — recurse into children. Bare-name refs at unhandled positions
+  // hit the string-leaf branch above and disqualify on contact.
+  for (let i = 1; i < node.length; i++) _disqualifyPromotion(node[i], candidates, disqualified, initSet)
+}
+
+// Walk `body` to collect every `let X = [intLit, …]` candidate. Each entry
+// carries the exact init-decl AST node so the disqualifier can skip the
+// binding's own LHS reference (which would otherwise look like a reassign).
+const _collectIntArrayCandidates = (node, candidates) => {
+  if (!Array.isArray(node)) return
+  const op = node[0]
+  if (op === '=>') return
+  if (op === 'let' || op === 'const') {
+    for (let i = 1; i < node.length; i++) {
+      const d = node[i]
+      if (!Array.isArray(d) || d[0] !== '=' || typeof d[1] !== 'string') continue
+      const elems = _intArrayLitElems(d[2])
+      if (elems == null) continue
+      // jz hoists `let` to function scope — duplicate candidate-name collisions
+      // shouldn't happen, but if they do the second wins (disqualifyPromotion
+      // will mark both via the shadow rule).
+      candidates.set(d[1], { initDecl: d, elems })
+    }
+  }
+  for (let i = 1; i < node.length; i++) _collectIntArrayCandidates(node[i], candidates)
+}
+
+// Rewrite `let name = [...]` → `let name = new Int32Array([...])` for every
+// validated candidate. Preserves the original element AST nodes so the
+// downstream `Int32Array.from` lowering picks up its existing static-data
+// segment / per-element-store fast paths.
+const _rewritePromoted = (node, validated, initSet) => {
+  if (!Array.isArray(node)) return { node, changed: false }
+  const op = node[0]
+  if (op === '=>') {
+    // Closures don't reach validated bindings (we disqualified on capture).
+    // Still recurse — a nested closure may itself hold a promotable.
+    let changed = false
+    const out = [op]
+    for (let i = 1; i < node.length; i++) {
+      const r = _rewritePromoted(node[i], validated, initSet)
+      if (r.changed) changed = true
+      out.push(r.node)
+    }
+    return changed ? { node: out, changed: true } : { node, changed: false }
+  }
+  let changed = false
+  const out = [op]
+  for (let i = 1; i < node.length; i++) {
+    const child = node[i]
+    if ((op === 'let' || op === 'const') && Array.isArray(child) && child[0] === '=' &&
+        typeof child[1] === 'string' && validated.has(child[1]) && initSet.has(child)) {
+      const newRhs = ['()', 'new.Int32Array', child[2]]
+      out.push(['=', child[1], newRhs])
+      changed = true
+      continue
+    }
+    const r = _rewritePromoted(child, validated, initSet)
+    if (r.changed) changed = true
+    out.push(r.node)
+  }
+  return changed ? { node: out, changed: true } : { node, changed: false }
+}
+
+const promoteIntArrayLiteralsInBody = (body) => {
+  const candidates = new Map()
+  _collectIntArrayCandidates(body, candidates)
+  if (!candidates.size) return { node: body, changed: false }
+  const initSet = new Set()
+  for (const { initDecl } of candidates.values()) initSet.add(initDecl)
+  const disqualified = new Set()
+  _disqualifyPromotion(body, candidates, disqualified, initSet)
+  const validated = new Set()
+  for (const name of candidates.keys()) if (!disqualified.has(name)) validated.add(name)
+  if (!validated.size) return { node: body, changed: false }
+  return _rewritePromoted(body, validated, initSet)
+}
+
+// On the first successful promotion, pull in the typedarray module so the
+// emitted `new.Int32Array` callee has a registered emitter. Calling
+// `includeModule('typedarray')` on a no-op (already loaded) is cheap.
+const promoteIntArrayLiterals = () => {
+  let changed = false
+  for (const func of ctx.func.list) {
+    if (!func.body || func.raw) continue
+    const r = promoteIntArrayLiteralsInBody(func.body)
+    if (r.changed) {
+      func.body = r.node
+      invalidateLocalsCache(func.body)
+      if (!changed) includeModule('typedarray')
+      changed = true
+    }
+  }
+  return changed
+}
+
 const scalarizeFunctionObjectLiterals = () => {
   let changed = false
   for (const func of ctx.func.list) {
@@ -1018,13 +1340,20 @@ const inlineHotInternalCalls = (programFacts, ast) => {
   }
 
   const candidates = new Map()
+  // Forwarders — a candidate whose body calls one of its own parameters.
+  // Inlining one replaces that parameter with the call-site argument; when the
+  // argument is a known function name the resulting indirect call collapses to
+  // a direct `call` (devirtualization).
+  const forwarders = new Set()
   for (const func of ctx.func.list) {
     if (func.exported || func.raw || !func.body || func.rest || programFacts.valueUsed.has(func.name)) continue
     if (func.defaults && Object.keys(func.defaults).length) continue
     const sites = sitesByCallee.get(func.name)
     const fixedTypedArraySite = hasFixedTypedArraySites(func, sites)
     const fullyFixedTypedArraySite = hasFullyFixedTypedArraySites(func, sites)
-    if (!sites || sites.length < 1 || (!fixedTypedArraySite && sites.length > 2) || sites.length > 8) continue
+    const hasLoop = scanBody(func.body, n => LOOP_OPS.has(n[0]))
+    const isTinyLeaf = !hasLoop && nodeSize(func.body) <= 15
+    if (!sites || sites.length < 1 || (!isTinyLeaf && !fixedTypedArraySite && sites.length > 2) || sites.length > 8) continue
     const stmts = blockStmts(func.body)
     // Expression-bodied arrow funcs (`(c) => expr`) have no block — body IS the
     // return value. Treat as a "tiny leaf" branch handled below; force hasLoop=false.
@@ -1043,9 +1372,8 @@ const inlineHotInternalCalls = (programFacts, ast) => {
     // The leaf branch catches helpers like `isAlpha(c) => (c>=65 && c<=90) || …`
     // that get hammered from a hot caller's loop — replacing the call with its
     // body saves the per-iteration call+reinterpret overhead (tokenizer hot path).
-    const hasLoop = scanBody(func.body, n => LOOP_OPS.has(n[0]))
     if (!hasLoop) {
-      if (scanBody(func.body, n => n[0] === '()')) continue
+      if (scanBody(func.body, n => n[0] === '()' && typeof n[1] === 'string' && ctx.func.names.has(n[1]))) continue
       if (nodeSize(func.body) > 30) continue
     }
     if (scanBody(func.body, n => n[0] === '()' && n[1] === func.name)) continue
@@ -1061,6 +1389,9 @@ const inlineHotInternalCalls = (programFacts, ast) => {
     // stays at generic f64 ABI with __typed_idx dispatch instead of i32 + f64.load.
     // Keeping the factory as a callable function preserves the call-site type fact.
     if (scanBody(func.body, n => n[0] === '()' && typeof n[1] === 'string' && n[1].startsWith('new.'))) continue
+    const paramNames = new Set((func.sig?.params || []).map(p => p.name))
+    if (paramNames.size && scanBody(func.body, n => n[0] === '()' && typeof n[1] === 'string' && paramNames.has(n[1])))
+      forwarders.add(func.name)
     candidates.set(func.name, func)
   }
   if (!candidates.size) return false
@@ -1077,10 +1408,12 @@ const inlineHotInternalCalls = (programFacts, ast) => {
   const exportedCandidates = new Map()
   for (const [name, func] of candidates) {
     const sites = sitesByCallee.get(name)
-    if (hasFixedTypedArraySites(func, sites) &&
-        !sites.some(site => site.callerFunc?.exported && site.callerFunc.body && containsNode(site.callerFunc.body, site.node))) {
-      exportedCandidates.set(name, func)
-    }
+    const fixedSiteExported = hasFixedTypedArraySites(func, sites) &&
+      !sites.some(site => site.callerFunc?.exported && site.callerFunc.body && containsNode(site.callerFunc.body, site.node))
+    // Forwarders cross into an exported caller too: the tier-up rationale that
+    // keeps candidates out of exports concerns relocated loop kernels, not
+    // these tiny leaves — and inlining one devirtualizes a closure dispatch.
+    if (fixedSiteExported || forwarders.has(name)) exportedCandidates.set(name, func)
   }
   for (const func of ctx.func.list) {
     if (!func.body || func.raw) continue
@@ -1093,7 +1426,16 @@ const inlineHotInternalCalls = (programFacts, ast) => {
     // caller's heap arrays.
     const activeCandidates = func.exported ? exportedCandidates : candidates
     if (func.exported && !activeCandidates.size) continue
-    const r = inlineInStmt(func.body, activeCandidates)
+    // Expression-bodied arrows (`() => expr`) have func.body as the return
+    // value itself — never a `{}` block. inlineInStmt treats its argument as a
+    // statement (discards the return value of any top-level candidate call),
+    // which would turn `() => x()` into an empty block and lose the result.
+    // Route those through inlineInExpr so the call is replaced by the inlined
+    // value expression instead.
+    const isExprBody = !Array.isArray(func.body) || func.body[0] !== '{}'
+    const r = isExprBody
+      ? inlineInExpr(func.body, activeCandidates)
+      : inlineInStmt(func.body, activeCandidates)
     let body = r.changed ? r.node : func.body
     let bodyChanged = r.changed
     if (!func.exported && exprOnlyCandidates.size) {
@@ -1341,28 +1683,86 @@ const specializeFixedRestCalls = (programFacts) => {
   return changed
 }
 
-const scanGlobalValueFacts = (root) => {
-  if (!root) return
-  const stmts = Array.isArray(root) && root[0] === ';' ? root.slice(1) : [root]
-  for (const stmt of stmts) {
-    if (!Array.isArray(stmt) || (stmt[0] !== 'const' && stmt[0] !== 'let')) continue
-    for (const decl of stmt.slice(1)) {
-      if (!Array.isArray(decl) || decl[0] !== '=' || typeof decl[1] !== 'string') continue
-      const vt = valTypeOf(decl[2])
-      if (vt) {
-        if (!ctx.scope.globalValTypes) ctx.scope.globalValTypes = new Map()
-        ctx.scope.globalValTypes.set(decl[1], vt)
-        if (vt === VAL.REGEX && ctx.runtime.regex) ctx.runtime.regex.vars.set(decl[1], decl[2])
-      }
-      const ctor = typedElemCtor(decl[2])
-      if (ctor) {
-        if (!ctx.scope.globalTypedElem) ctx.scope.globalTypedElem = new Map()
-        ctx.scope.globalTypedElem.set(decl[1], ctor)
+// `scanGlobalValueFacts` was deleted — prepare's depth-0 catch (calling
+// `recordGlobalRep` from src/infer.js) is the authoritative pass and a
+// strict superset of what this top-level walker observed.
+
+// Flow-insensitive type inference for module-level `let` bindings whose
+// initial RHS doesn't pin a type (most often `let mem;` followed later by
+// `mem = new TypedArray(...)` inside an init function). Without this the
+// read site has to runtime-check the NaN-box tag on every access — game-of-life's
+// inner step does that 9× per cell, blowing up the hot loop. We union RHS types
+// across every assignment (initial decl + every `name = …` in any function);
+// if every observed RHS is either a typed-array ctor of the same kind, a known
+// VAL.TYPED binding of the same ctor, or null/undefined, the binding is
+// monomorphically VAL.TYPED. Anything else (literal number, non-typed call,
+// mixed ctors) clears the candidacy, keeping the read site polymorphic.
+const inferModuleLetTypes = (ast) => {
+  if (!ctx.scope.userGlobals) return
+  // candidates: name → { ctor: string|null, valid: true } | { valid: false }
+  // valid=true with ctor=null means "still no positive evidence"; we promote
+  // only when ctor is non-null at the end. Assignments to nullish (undef/null)
+  // don't change ctor — they're consistent with any typed-array value.
+  const seen = new Map()
+  for (const name of ctx.scope.userGlobals) seen.set(name, { ctor: null, valid: true })
+
+  const isNullishLit = (e) => e == null || e === 'undefined' || e === 'null'
+    || (Array.isArray(e) && e[0] == null && (e[1] === undefined || e[1] === null))
+
+  const observe = (name, rhs) => {
+    const c = seen.get(name)
+    if (!c || !c.valid) return
+    if (isNullishLit(rhs)) return
+    // Resolve typed-array ctor from `new TypedArrayCtor(...)`, ternary of typed,
+    // or a reference to a name we already know is typed.
+    let ctor = typedElemCtor(rhs) ?? ternaryCtorOfRhs(rhs)
+    if (ctor === MIXED_CTORS) { c.valid = false; return }
+    if (!ctor && typeof rhs === 'string') {
+      if (ctx.scope.globalValTypes?.get(rhs) === VAL.TYPED)
+        ctor = ctx.scope.globalTypedElem?.get(rhs) ?? null
+    }
+    if (!ctor) { c.valid = false; return }
+    if (c.ctor && c.ctor !== ctor) { c.valid = false; return }
+    c.ctor = ctor
+  }
+
+  const walk = (node) => {
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    if (op === '=' && typeof node[1] === 'string' && seen.has(node[1])) observe(node[1], node[2])
+    if ((op === 'let' || op === 'const') && node.length > 1) {
+      for (let i = 1; i < node.length; i++) {
+        const d = node[i]
+        if (Array.isArray(d) && d[0] === '=' && typeof d[1] === 'string' && seen.has(d[1]))
+          observe(d[1], d[2])
       }
     }
+    // Compound-assigns (`+=`, etc.) to a typed-array binding can't preserve
+    // the typed-array kind — invalidate.
+    if (ASSIGN_OPS.has(op) && op !== '=' && typeof node[1] === 'string' && seen.has(node[1])) {
+      const c = seen.get(node[1])
+      if (c) c.valid = false
+    }
+    for (let i = 1; i < node.length; i++) walk(node[i])
+  }
+  walk(ast)
+  for (const f of ctx.func.list) if (f.body && !f.raw) walk(f.body)
+
+  for (const [name, c] of seen) {
+    if (!c.valid || !c.ctor) continue
+    if (ctx.scope.globalValTypes?.get(name) === VAL.TYPED) continue
+    ;(ctx.scope.globalValTypes ||= new Map()).set(name, VAL.TYPED)
+    ;(ctx.scope.globalTypedElem ||= new Map()).set(name, c.ctor)
   }
 }
 
+// `MIXED_CTORS` and `ternaryCtorOfRhs` are not exported from analyze — re-derive
+// the sentinel locally and look up the ctor through `typedElemCtor` alone.
+// `ternaryCtorOfRhs` is purely for ternary RHSs (e.g. `cond ? new Int32Array(N) : new Int32Array(M)`),
+// which game-of-life-style sources don't use; falling back to typedElemCtor is fine.
+const MIXED_CTORS = Symbol('MIXED_CTORS')
+const ternaryCtorOfRhs = () => null
+
 const unboxConstTypedGlobals = () => {
   if (!ctx.scope.globalTypedElem || !ctx.scope.consts) return
   for (const [name, ctor] of ctx.scope.globalTypedElem) {
@@ -1378,6 +1778,254 @@ const unboxConstTypedGlobals = () => {
   }
 }
 
+/**
+ * Function-namespace scalar replacement + devirtualization.
+ *
+ * A property of a user function compiles, by default, as a dynamic object: each
+ * `f.prop` write is a `__dyn_set` into a closure-keyed hash side-table, each
+ * read a `__dyn_get`. But a function's property table can never be observed by
+ * the host (the host receives only the callable; the table lives in jz linear
+ * memory), so jz sees every `f.prop` site — the slot is a closed, fully-known
+ * cell. Per property of a non-escaping namespace:
+ *
+ *   - reassigned (`multiProp`) slot → dissolve into a plain f64 module global:
+ *     `__dyn_get/__dyn_set` → `global.get/global.set`. The indirect call stays
+ *     (a genuinely reassigned function pointer needs `call_indirect`). Pure
+ *     storage relocation: the global inits to `UNDEF_WAT`, exactly mirroring
+ *     "key never set → __dyn_get yields undefined".
+ *   - written once to its lifted `$f$prop` function and only ever *called*
+ *     (never read as a value) → the `__dyn_set` is dead: emit already lowers
+ *     `f.prop()` to a direct `call $f$prop`. Drop the write entirely.
+ *
+ * Disqualified namespaces (`f` escapes as a bare value / is computed-indexed —
+ * an alias could reach the table) keep the dynamic path. Together these can
+ * eliminate the `__dyn_*` machinery from a namespace-only program outright.
+ */
+const flattenFuncNamespaces = (ast) => {
+  const names = ctx.func.names
+  if (!names?.size) return false
+  // Cheap structural gate: a flattenable namespace exists only if some lifted
+  // `f$prop` name's `f` is itself a function (prepare lifts every `f.prop =
+  // arrow` — multiProp slots included). The base `f` may itself carry a module
+  // prefix (`mod$f`), so scan every `$` boundary, not just the first; a
+  // populated `multiProp` registry is itself a direct namespace witness.
+  let hasNs = ctx.func.multiProp.size > 0
+  if (!hasNs) outer: for (const n of names) {
+    for (let i = n.indexOf('$'); i > 0; i = n.indexOf('$', i + 1))
+      if (names.has(n.slice(0, i))) { hasNs = true; break outer }
+  }
+  if (!hasNs) return false
+  const ns = analyzeFuncNamespaces(ast)
+  if (!ns.size) return false
+  // f → Map<prop, decision>; decision is { global } (SROA) or { drop } (dead
+  // write to an only-called single-write slot).
+  const flat = new Map()
+  for (const [f, info] of ns) {
+    if (info.disq) continue
+    let decide
+    const plan = (prop, d) => { if (!decide) flat.set(f, decide = new Map()); decide.set(prop, d) }
+    for (const prop of info.props) {
+      if (ctx.func.multiProp.has(`${f}.${prop}`)) { plan(prop, { global: `${f}${T}${prop}` }); continue }
+      const w = info.writes.get(prop)
+      // Single write of the lifted `$f$prop`, never read as a value → drop it.
+      if (w && w.length === 1 && w[0].atInit && w[0].rhs === `${f}$${prop}` && !info.valRead.has(prop))
+        plan(prop, { drop: true })
+    }
+  }
+  if (!flat.size) return false
+  for (const decide of flat.values())
+    for (const d of decide.values())
+      if (d.global && !ctx.scope.globals.has(d.global)) {
+        ctx.scope.globals.set(d.global, `(global $${d.global} (mut f64) ${UNDEF_WAT})`)
+        ctx.scope.globalTypes.set(d.global, 'f64')
+      }
+  const decisionFor = (obj, prop) =>
+    typeof obj === 'string' && typeof prop === 'string' && flat.has(obj)
+      ? flat.get(obj).get(prop) : undefined
+  const isEmptySeq = (n) => Array.isArray(n) && n.length === 1 && n[0] === ';'
+  const rewrite = (node) => {
+    if (!Array.isArray(node)) return node
+    const op = node[0]
+    if (op === '.' || op === '?.') {
+      const d = decisionFor(node[1], node[2])
+      if (d?.global) return d.global  // drop-decisions leave reads/calls alone
+    }
+    if (op === '=' && Array.isArray(node[1]) && (node[1][0] === '.' || node[1][0] === '?.')) {
+      const d = decisionFor(node[1][1], node[1][2])
+      if (d?.global) return ['=', d.global, rewrite(node[2])]
+      if (d?.drop) return [';']  // dead write — emit nothing
+    }
+    const out = [op]
+    // Filter dropped writes out of statement sequences (an empty `[';']` left in
+    // a body would lower to an unrenderable node).
+    for (let i = 1; i < node.length; i++) {
+      const c = rewrite(node[i])
+      if (op === ';' && isEmptySeq(c)) continue
+      out.push(c)
+    }
+    return out
+  }
+  const newAst = rewrite(ast)
+  ast.length = 0
+  for (let i = 0; i < newAst.length; i++) ast.push(newAst[i])
+  for (const fn of ctx.func.list)
+    if (fn.body && !fn.raw) fn.body = rewrite(fn.body)
+  // The defining `f.prop = …` writes live in moduleInits for bundled programs —
+  // rewrite them too, or reads would resolve to an unwritten global.
+  if (ctx.module.moduleInits)
+    for (let i = 0; i < ctx.module.moduleInits.length; i++)
+      ctx.module.moduleInits[i] = rewrite(ctx.module.moduleInits[i])
+  return true
+}
+
+/**
+ * Closure devirtualization.
+ *
+ * `flattenFuncNamespaces` dissolves a reassigned `f.prop` function slot into a
+ * module global, but the call through it stays a `call_indirect` on a
+ * `global.get`, dispatched via an ABI-adapting trampoline. When that global is
+ * written *only* by unconditional module-init assignments it holds, for the
+ * entire post-init program, one statically-known function — so every call
+ * through it collapses to a direct `call`: no table lookup, no trampoline, no
+ * 8-wide padding ABI, no closure type guard.
+ *
+ * A global G qualifies iff:
+ *   1. every assignment to G is an unconditional module-init statement — none in
+ *      a function body, none nested inside init control flow;
+ *   2. G's final init value resolves (through global aliases) to a top-level
+ *      function F;
+ *   3. G is never *called* by module-init code, nor by any function reachable
+ *      from it — so every call site runs strictly post-init, where G ≡ F.
+ * Devirt then only swaps an indirect call for a direct call to the very same
+ * callee: it cannot change behavior, only drop dispatch overhead. The result is
+ * recorded in `ctx.func.globalDevirt` (`Map<global, fn>`) and consumed by emit.
+ */
+const devirtGlobalCalls = (ast) => {
+  const fnNames = ctx.func.names
+  if (!fnNames?.size || !ctx.scope.globals?.size) return
+
+  // Module-init statement stream, in execution order: moduleInits run first in
+  // `$__start`, then the main module's top-level.
+  const initStmts = []
+  const flatten = (n) => {
+    if (Array.isArray(n) && n[0] === ';') for (let i = 1; i < n.length; i++) flatten(n[i])
+    else if (n != null) initStmts.push(n)
+  }
+  for (const mi of ctx.module.moduleInits || []) flatten(mi)
+  flatten(ast)
+
+  const isGlobal = (s) => typeof s === 'string' && ctx.scope.globals.has(s)
+  // `[target, rhs]` pairs for a `=` / `let` / `const` node assigning a global.
+  const writesOf = (node) => {
+    if (!Array.isArray(node)) return []
+    if (node[0] === '=' && isGlobal(node[1])) return [[node[1], node[2]]]
+    if (node[0] === 'let' || node[0] === 'const') {
+      const out = []
+      for (let i = 1; i < node.length; i++) {
+        const d = node[i]
+        if (Array.isArray(d) && d[0] === '=' && isGlobal(d[1])) out.push([d[1], d[2]])
+      }
+      return out
+    }
+    return []
+  }
+
+  // Poison a global assigned anywhere but an unconditional init statement — in a
+  // function body, or nested in init control flow. Its value is then not a
+  // fixed post-init constant.
+  const poison = new Set()
+  const scanWrites = (node, topInit) => {
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    if (op === 'let' || op === 'const') {
+      // A declarator `=` is part of the declaration, not a nested assignment —
+      // poison only when the declaration itself is non-top-level.
+      for (let i = 1; i < node.length; i++) {
+        const d = node[i]
+        if (Array.isArray(d) && d[0] === '=') {
+          if (!topInit && isGlobal(d[1])) poison.add(d[1])
+          scanWrites(d[2], false)
+        } else scanWrites(d, false)
+      }
+      return
+    }
+    if (op === '=') {
+      if (!topInit && isGlobal(node[1])) poison.add(node[1])
+      scanWrites(node[1], false)
+      scanWrites(node[2], false)
+      return
+    }
+    for (let i = 1; i < node.length; i++) scanWrites(node[i], false)
+  }
+  for (const stmt of initStmts) scanWrites(stmt, true)
+  for (const fn of ctx.func.map.values())
+    if (fn.body && !fn.raw) scanWrites(fn.body, false)
+
+  // Resolve each global's value by a linear pass over init in execution order.
+  const env = new Map()
+  const evalFn = (rhs) =>
+    typeof rhs !== 'string' ? null
+      : fnNames.has(rhs) ? rhs
+      : env.has(rhs) ? env.get(rhs)
+      : null
+  for (const stmt of initStmts)
+    for (const [g, rhs] of writesOf(stmt)) env.set(g, evalFn(rhs))
+
+  const devirt = new Map()
+  for (const [g, fn] of env)
+    if (fn && fnNames.has(fn) && !poison.has(g)) devirt.set(g, fn)
+  if (!devirt.size) return
+
+  // Condition 3: a call through G that runs *during* init would see an
+  // intermediate value. Drop any candidate G called by init code, or by a
+  // function reachable from it.
+  //
+  // `walkStraightLine` follows only straight-line execution: a nested `=>`
+  // literal is a closure *constructed* here, not run here, so its body is
+  // skipped — an IIFE callee `(=> …)()` is the one exception, its body does
+  // run. This is what keeps operator-registration init (`binary('+', 11)`
+  // builds, but does not invoke, a parselet closure) from dragging the parser
+  // into the init-reachable set, and keeps a wrapper body's `space()` call —
+  // which fires at parse time — from counting as an init call. (Soundness
+  // rests on a closure constructed during init not also being invoked during
+  // init: true of function-slot wrappers, which are registered then called at
+  // use time.)
+  const walkStraightLine = (node, onCall) => {
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    if (op === '()') {
+      onCall(node[1])
+      if (Array.isArray(node[1]) && node[1][0] === '=>') walkStraightLine(node[1][2], onCall)
+      for (let i = 2; i < node.length; i++) walkStraightLine(node[i], onCall)
+      return
+    }
+    if (op === '=>' || op === 'function') return
+    for (let i = 1; i < node.length; i++) walkStraightLine(node[i], onCall)
+  }
+  const reachable = new Set()
+  const queue = []
+  const seedCalls = (node) => walkStraightLine(node, (c) => {
+    if (typeof c === 'string' && fnNames.has(c)) queue.push(c)
+  })
+  for (const s of initStmts) seedCalls(s)
+  while (queue.length) {
+    const f = queue.pop()
+    if (reachable.has(f)) continue
+    reachable.add(f)
+    const fn = ctx.func.map.get(f)
+    if (fn?.body && !fn.raw) seedCalls(fn.body)
+  }
+  const calledInInit = new Set()
+  const collectCalled = (node) => walkStraightLine(node, (c) => {
+    if (devirt.has(c)) calledInInit.add(c)
+  })
+  for (const s of initStmts) collectCalled(s)
+  for (const f of reachable) { const fn = ctx.func.map.get(f); if (fn?.body) collectCalled(fn.body) }
+  for (const g of calledInInit) devirt.delete(g)
+
+  if (devirt.size) ctx.func.globalDevirt = devirt
+}
+
 const materializeAutoBoxSchemas = (programFacts) => {
   if (!ctx.schema.register) return
   for (const [name, props] of programFacts.propMap) {
@@ -1434,10 +2082,17 @@ const canSkipWholeProgramNarrowing = (programFacts) =>
   !ctx.closure.make
 
 export default function plan(ast) {
-  scanGlobalValueFacts(ast)
+  inferModuleLetTypes(ast)
   unboxConstTypedGlobals()
 
   let programFacts = collectProgramFacts(ast)
+  // Function-namespace SROA — dissolve reassigned `f.prop` slots into module
+  // globals before inlining/narrowing, so all downstream passes see plain
+  // globals instead of the dynamic property machinery.
+  if (flattenFuncNamespaces(ast)) programFacts = collectProgramFacts(ast)
+  // Devirtualize calls through init-constant function globals (closure
+  // devirtualization) — must follow the SROA above, which creates the globals.
+  devirtGlobalCalls(ast)
   // The call-inlining family (`inlineHotInternalCalls` self-gates on `sourceInline`)
   // is a pure speed optimization — the un-inlined calls emit correctly. Scalar
   // replacement (`scalarize*`) is *not* gated on `sourceInline`: callers turn it on
@@ -1447,13 +2102,27 @@ export default function plan(ast) {
   if (specializeFixedRestCalls(programFacts)) programFacts = collectProgramFacts(ast)
   if (scalarizeFunctionArrayLiterals()) programFacts = collectProgramFacts(ast)
   if (scalarizeFunctionObjectLiterals()) programFacts = collectProgramFacts(ast)
+  // Promotion runs AFTER literal scalarization (those that fully reduce to scalars
+  // are gone) and BEFORE typed-array scalarization (so a freshly-promoted array's
+  // fixed-length-typed-of-known-size variant could still participate in loop
+  // unrolling — currently it can't, since promotion produces the `[...]`-arg
+  // form rather than `new Int32Array(N)`, but the ordering keeps the door open).
+  if (promoteIntArrayLiterals()) programFacts = collectProgramFacts(ast)
   if (scalarizeFunctionTypedArrays(programFacts)) programFacts = collectProgramFacts(ast)
   ctx.types.dynKeyVars = programFacts.dynVars
   ctx.types.anyDynKey = programFacts.anyDyn
 
   materializeAutoBoxSchemas(programFacts)
   resolveClosureWidth(programFacts)
-  if (canSkipWholeProgramNarrowing(programFacts)) return programFacts
+  if (canSkipWholeProgramNarrowing(programFacts)) {
+    // Phase J (jsstring boundary opt-in) is body-local and call-site-independent;
+    // run it even when the rest of narrowing is skipped so simple `export let
+    // f = (s) => s.length` still flips to externref. Likewise the boolean-result
+    // fact, so `export let f = (a) => a > 2` boxes its boundary atom.
+    applyJsstringBoundaryCarrierStandalone(programFacts)
+    narrowBoolResults()
+    return programFacts
+  }
 
   narrowSignatures(programFacts, ast)
   specializeBimorphicTyped(programFacts)