jz 0.5.0 → 0.6.0

package/module/string.js

@@ -12,16 +12,15 @@
  * @module string
  */
 
-import { typed, asF64, asI32, asI64, NULL_NAN, UNDEF_NAN, mkPtrIR, temp, tempI32, toNumF64, toStrI64 } from '../src/ir.js'
-import { emit, emitBoolStr } from '../src/emit.js'
-import { valTypeOf, VAL } from '../src/analyze.js'
-import { inc, emitter, PTR, LAYOUT } from '../src/ctx.js'
+import { typed, asF64, asI32, asI64, NULL_NAN, UNDEF_NAN, FALSE_NAN, TRUE_NAN, mkPtrIR, temp, tempI32, toNumF64, toStrI64 } from '../src/ir.js'
+import { emit, bool, method, deps, wat, bind } from '../src/bridge.js'
+import { valTypeOf } from '../src/kind.js'
+import { VAL } from '../src/reps.js'
+import { ctx, inc, PTR, LAYOUT, err, declGlobal } from '../src/ctx.js'
+import { ssoBitI64Hex, sliceBitI64Hex, ptrNanHex, STR_INTERN_BIT } from '../layout.js'
 
-// SSO discriminator bit pre-shifted to its slot in the full i64 ptr (bit 46).
-// Used as `i64.and ptr SSO_BIT_I64` for branch-without-extracting-aux.
-const SSO_BIT_I64 = '0x' + (BigInt(LAYOUT.SSO_BIT) << BigInt(LAYOUT.AUX_SHIFT)).toString(16).toUpperCase().padStart(16, '0')
-// Slice/view discriminator bit, pre-shifted to bit 45 — same branch-without-aux trick.
-const SLICE_BIT_I64 = '0x' + (BigInt(LAYOUT.SLICE_BIT) << BigInt(LAYOUT.AUX_SHIFT)).toString(16).toUpperCase().padStart(16, '0')
+const SSO_BIT_I64 = ssoBitI64Hex()
+const SLICE_BIT_I64 = sliceBitI64Hex()
 
 // WAT (no-locals expression): byte length of a heap STRING given its raw $-local
 // names for the offset and the i64 ptr. A view (SLICE_BIT) carries its length in
@@ -38,15 +37,86 @@ const heapLenExpr = (ptrLocal, offLocal) => `(if (result i32)
     (else (i32.const 0)))))`
 
 
+
+// SSO-pack a ≤4-byte slice straight from the source bytes (both SSO and
+// memory-backed parents) — no allocation, and equal short tokens become
+// bit-equal (SSO content IS the bits). Bails to the caller's heap path on a
+// non-ASCII byte (SSO is ASCII-only). Locals: $sb scratch byte, $sp packed.
+const sliceSsoPackWat = () => `
+    (if (i32.le_u (local.get $nlen) (i32.const 4))
+      (then (block $heap8
+        (local.set $srcOff (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK}))))
+        (local.set $isSso (i32.wrap_i64 (i64.shr_u
+          (i64.and (local.get $ptr) (i64.const ${SSO_BIT_I64}))
+          (i64.const ${LAYOUT.AUX_SHIFT}))))
+        (local.set $i (i32.const 0)) (local.set $sp (i32.const 0))
+        (loop $pk8
+          (if (i32.lt_u (local.get $i) (local.get $nlen))
+            (then
+              (local.set $sb (if (result i32) (local.get $isSso)
+                (then (i32.and
+                  (i32.shr_u (local.get $srcOff) (i32.shl (i32.add (local.get $start) (local.get $i)) (i32.const 3)))
+                  (i32.const 0xFF)))
+                (else (i32.load8_u (i32.add (i32.add (local.get $srcOff) (local.get $start)) (local.get $i))))))
+              (br_if $heap8 (i32.ge_u (local.get $sb) (i32.const 0x80)))
+              (local.set $sp (i32.or (local.get $sp) (i32.shl (local.get $sb) (i32.shl (local.get $i) (i32.const 3)))))
+              (local.set $i (i32.add (local.get $i) (i32.const 1)))
+              (br $pk8))))
+        (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.or (i32.const ${LAYOUT.SSO_BIT}) (local.get $nlen)) (local.get $sp))))))`
+
+// Probe the static intern index (buildInternTable, compile/index.js): a 5..32
+// byte slice whose content equals a static literal returns the CANONICAL
+// static pointer, making every later comparison a bit-eq hit. Emitted only
+// when the table exists ($__internBase declared — the stdlib body is a thunk
+// evaluated at pullStdlib, after buildInternTable). FNV-1a must match
+// __str_hash's heap branch. Locals: $ip src ptr, $h, $j, $slot, $cand, $k.
+const internProbeWat = (ipExpr, guard = '(i32.const 1)') => ctx.scope.globals.has('__internBase') ? `
+    (if (i32.and (i32.le_u (local.get $nlen) (i32.const 32)) ${guard})
+      (then
+        (local.set $ip ${ipExpr})
+        (local.set $h (i32.const 0x811c9dc5))
+        (local.set $j (i32.const 0))
+        (block $hd (loop $hl
+          (br_if $hd (i32.ge_u (local.get $j) (local.get $nlen)))
+          (local.set $h (i32.mul
+            (i32.xor (local.get $h) (i32.load8_u (i32.add (local.get $ip) (local.get $j))))
+            (i32.const 0x01000193)))
+          (local.set $j (i32.add (local.get $j) (i32.const 1)))
+          (br $hl)))
+        (if (i32.le_s (local.get $h) (i32.const 1))
+          (then (local.set $h (i32.add (local.get $h) (i32.const 2)))))
+        (local.set $j (i32.and (local.get $h) (global.get $__internMask)))
+        (block $missI (loop $plI
+          (block $nextI
+            (local.set $slot (i32.add (global.get $__internBase) (i32.shl (local.get $j) (i32.const 3))))
+            (local.set $cand (i32.load (i32.add (local.get $slot) (i32.const 4))))
+            (br_if $missI (i32.eqz (local.get $cand)))
+            (br_if $nextI (i32.ne (i32.load (local.get $slot)) (local.get $h)))
+            (br_if $nextI (i32.ne (i32.load (i32.sub (local.get $cand) (i32.const 4))) (local.get $nlen)))
+            (local.set $k (i32.const 0))
+            (block $vd (loop $vl
+              (br_if $vd (i32.ge_u (local.get $k) (local.get $nlen)))
+              (br_if $nextI (i32.ne
+                (i32.load8_u (i32.add (local.get $ip) (local.get $k)))
+                (i32.load8_u (i32.add (local.get $cand) (local.get $k)))))
+              (local.set $k (i32.add (local.get $k) (i32.const 1)))
+              (br $vl)))
+            (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.const ${STR_INTERN_BIT}) (local.get $cand))))
+          (local.set $j (i32.and (i32.add (local.get $j) (i32.const 1)) (global.get $__internMask)))
+          (br $plI)))))` : ''
+
+
 export default (ctx) => {
-  Object.assign(ctx.core.stdlibDeps, {
-    __str_concat: ['__to_str', '__str_byteLen', '__alloc', '__mkptr', '__str_copy'],
-    __str_concat_raw: ['__str_byteLen', '__alloc', '__mkptr', '__str_copy'],
-    __str_append_byte: ['__str_byteLen', '__alloc', '__mkptr', '__str_copy'],
+  deps({
+    __str_concat: ['__to_str', '__str_byteLen', '__alloc', '__memgrow', '__mkptr', '__str_copy'],
+    __str_concat_raw: ['__str_byteLen', '__alloc', '__memgrow', '__mkptr', '__str_copy'],
+    __str_append_byte: ['__str_byteLen', '__alloc', '__memgrow', '__mkptr', '__str_copy'],
     __str_copy: [],
     __str_slice: ['__str_byteLen', '__alloc'],
     __str_slice_view: ['__str_byteLen', '__mkptr', '__str_slice'],
     __str_indexof: ['__str_byteLen', '__to_str'],
+    __str_lastindexof: ['__str_byteLen', '__to_str'],
+    __wrap1: ['__alloc', '__mkptr'],
     __str_substring: ['__str_slice'],
     __str_startswith: ['__str_byteLen'],
     __str_endswith: ['__str_byteLen'],
@@ -59,7 +129,8 @@ export default (ctx) => {
     __str_replaceall: ['__str_indexof', '__str_slice', '__str_concat'],
     __str_split: ['__str_slice', '__str_byteLen', '__char_at', '__alloc'],
     __str_idx: [],
-    __str_eq: ['__char_at', '__str_byteLen'],
+    __str_eq: ['__str_eq_cold'],
+    __str_eq_cold: ['__char_at', '__str_byteLen'],
     __str_cmp: ['__char_at', '__str_byteLen'],
     __str_range_eq: ['__char_at', '__str_byteLen'],
     __str_substring_eq: ['__str_byteLen', '__str_range_eq'],
@@ -78,7 +149,7 @@ export default (ctx) => {
 
   // === String literal: "abc" → SSO if ≤4 ASCII, else heap ===
 
-  ctx.core.emit['str'] = (str) => {
+  bind('str', (str) => {
     const MAX_SSO = 4
     if (ctx.features.sso && str.length <= MAX_SSO && /^[\x00-\x7f]*$/.test(str)) {
       let packed = 0
@@ -88,16 +159,33 @@ export default (ctx) => {
     const bytes = new TextEncoder().encode(str)
     const len = bytes.length
     if (!ctx.memory.shared) {
-      // Own memory: place in static data segment (no runtime allocation)
+      // Own memory: place in static data segment (no runtime allocation).
+      // Under internStrings the layout is [hash u32][len u32][bytes] and the
+      // pointer carries STR_INTERN_BIT: statics are CANONICAL (deduped), so
+      // unequal canonicals are bit-unequal (__str_eq short-circuit) and
+      // __str_hash loads the cached FNV at -8 instead of re-hashing. The len
+      // header stays at -4 either way — no other reader changes.
+      const interned = !!ctx.transform.optimize?.internStrings
+      const hdr = interned ? 8 : 4
+      const aux = interned ? STR_INTERN_BIT : 0
       if (!ctx.runtime.data) ctx.runtime.data = ''
       const prior = ctx.runtime.dataDedup.get(str)
-      if (prior !== undefined) return mkPtrIR(PTR.STRING, 0, prior + 4)
+      if (prior !== undefined) return mkPtrIR(PTR.STRING, aux, prior + hdr)
       while (ctx.runtime.data.length % 4 !== 0) ctx.runtime.data += '\0'
       const offset = ctx.runtime.data.length
+      if (interned) {
+        // byte-FNV + clamp — must equal __str_hash's output exactly (it hashes
+        // UTF-8 bytes, then clamps ≤1 → +2 for the empty/tombstone sentinels)
+        let h = 0x811c9dc5 | 0
+        for (let i = 0; i < len; i++) h = Math.imul(h ^ bytes[i], 0x01000193) | 0
+        if (h <= 1) h = (h + 2) | 0
+        h = h >>> 0
+        ctx.runtime.data += String.fromCharCode(h & 0xFF, (h >> 8) & 0xFF, (h >> 16) & 0xFF, (h >> 24) & 0xFF)
+      }
       ctx.runtime.data += String.fromCharCode(len & 0xFF, (len >> 8) & 0xFF, (len >> 16) & 0xFF, (len >> 24) & 0xFF)
       for (let i = 0; i < len; i++) ctx.runtime.data += String.fromCharCode(bytes[i])
       ctx.runtime.dataDedup.set(str, offset)
-      return mkPtrIR(PTR.STRING, 0, offset + 4)
+      return mkPtrIR(PTR.STRING, aux, offset + hdr)
     }
     // Shared memory: pack all string literals into one passive data segment with 4-byte
     // length prefixes. At __start, alloc the whole pool once and memory.init it in a single
@@ -105,7 +193,7 @@ export default (ctx) => {
     // use, independent of string length AND reused across uses.
     if (!ctx.runtime.strPool) {
       ctx.runtime.strPool = ''
-      ctx.scope.globals.set('__strBase', '(global $__strBase (mut i32) (i32.const 0))')
+      declGlobal('__strBase', 'i32')
     }
     let off = ctx.runtime.strPoolDedup.get(str)
     if (off === undefined) {
@@ -116,23 +204,23 @@ export default (ctx) => {
       ctx.runtime.strPoolDedup.set(str, off)
     }
     return mkPtrIR(PTR.STRING, 0, ['i32.add', ['global.get', '$__strBase'], ['i32.const', off]])
-  }
+  })
 
   // === WAT: char extraction ===
 
   // SSO/STRING ptrs never have forwarding pointers (only ARRAY does), so we extract
   // the raw offset directly instead of paying the __ptr_offset function-call overhead.
-  ctx.core.stdlib['__sso_char'] = `(func $__sso_char (param $ptr i64) (param $i i32) (result i32)
+  wat('__sso_char', `(func $__sso_char (param $ptr i64) (param $i i32) (result i32)
     (i32.and
       (i32.shr_u
         (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK})))
         (i32.mul (local.get $i) (i32.const 8)))
-      (i32.const 0xFF)))`
+      (i32.const 0xFF)))`)
 
-  ctx.core.stdlib['__str_char'] = `(func $__str_char (param $ptr i64) (param $i i32) (result i32)
+  wat('__str_char', `(func $__str_char (param $ptr i64) (param $i i32) (result i32)
     (i32.load8_u (i32.add
       (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK})))
-      (local.get $i))))`
+      (local.get $i))))`)
 
   // Hot (~37M calls in watr self-host, ~40k/scan in tokenizer bench). Caller
   // guarantees $ptr is a STRING; SSO bit picks inline-byte-extract vs heap memory
@@ -149,7 +237,7 @@ export default (ctx) => {
   // load+bounds-check, beating call-site overhead. Repeated `i32.wrap_i64 +
   // i64.and OFFSET_MASK` subexpressions rely on CSE in the consumer; both
   // V8/TurboFan and watr's own propagate pass handle this.
-  ctx.core.stdlib['__char_at'] = `(func $__char_at (param $ptr i64) (param $i i32) (result i32)
+  wat('__char_at', `(func $__char_at (param $ptr i64) (param $i i32) (result i32)
     (if (result i32)
       (i64.ne (i64.and (local.get $ptr) (i64.const ${SSO_BIT_I64})) (i64.const 0))
       (then
@@ -190,9 +278,9 @@ export default (ctx) => {
             (i32.load8_u
               (i32.add
                 (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK})))
-                (local.get $i)))))))))`
+                (local.get $i)))))))))`)
 
-  ctx.core.stdlib['__str_idx'] = `(func $__str_idx (param $ptr i64) (param $i i32) (result f64)
+  wat('__str_idx', `(func $__str_idx (param $ptr i64) (param $i i32) (result f64)
     (local $t i32) (local $off i32) (local $len i32) (local $isSso i32)
     (local.set $t (i32.wrap_i64 (i64.and (i64.shr_u (local.get $ptr) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
     (local.set $off (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK}))))
@@ -221,21 +309,58 @@ export default (ctx) => {
         (f64.reinterpret_i64
           (i64.or
             ;; mkptr(STRING, SSO_BIT|1, 0) = NAN_PREFIX | (STRING<<TAG_SHIFT) | ((SSO_BIT|1)<<AUX_SHIFT)
-            (i64.const ${'0x' + (LAYOUT.NAN_PREFIX_BITS | (BigInt(PTR.STRING) << BigInt(LAYOUT.TAG_SHIFT)) | ((BigInt(LAYOUT.SSO_BIT) | 1n) << BigInt(LAYOUT.AUX_SHIFT))).toString(16).toUpperCase().padStart(16, '0')})
+            (i64.const ${ptrNanHex(PTR.STRING, LAYOUT.SSO_BIT | 1)})
             (i64.extend_i32_u
               (if (result i32) (local.get $isSso)
                 (then (i32.and (i32.shr_u (local.get $off) (i32.mul (local.get $i) (i32.const 8))) (i32.const 0xFF)))
-                (else (i32.load8_u (i32.add (local.get $off) (local.get $i)))))))))))`
+                (else (i32.load8_u (i32.add (local.get $off) (local.get $i)))))))))))`)
 
   // Hot: ~53M calls in watr self-host. Bit-eq covers identity. SSO/SSO with !bit-eq
   // guarantees content differs (high 32 bits encode type+len; both equal → low 32 differs
   // ⇒ bytes differ). Heap/heap uses raw load8_u — no per-byte function calls.
   // Mixed SSO×heap is rare; falls back to __char_at.
-  ctx.core.stdlib['__str_eq'] = `(func $__str_eq (param $a i64) (param $b i64) (result i32)
+  // Hot/cold split: the prefix every comparison runs (bit-eq, both-SSO,
+  // both-canonical, heap length mismatch) is LOOP-FREE and small enough for
+  // the engine's wasm inliner — the call overhead disappears at every site
+  // while the byte-walk lives in __str_eq_cold. Mirrors the __ptr_offset_fwd
+  // split; a body containing a loop is excluded from V8's inliner.
+  wat('__str_eq', `(func $__str_eq (param $a i64) (param $b i64) (result i32)
+    (local $axA i32) (local $axB i32) (local $offA i32) (local $offB i32)
+    (if (i64.eq (local.get $a) (local.get $b))
+      (then (return (i32.const 1))))
+    (local.set $axA (i32.wrap_i64 (i64.shr_u (local.get $a) (i64.const ${LAYOUT.AUX_SHIFT}))))
+    (local.set $axB (i32.wrap_i64 (i64.shr_u (local.get $b) (i64.const ${LAYOUT.AUX_SHIFT}))))
+    ;; both SSO ⇒ bit-ne already decided content-ne
+    (if (i32.and
+          (i32.and (local.get $axA) (i32.const ${LAYOUT.SSO_BIT}))
+          (i32.and (local.get $axB) (i32.const ${LAYOUT.SSO_BIT})))
+      (then (return (i32.const 0))))
+    ;; both CANONICAL interned heap strings ⇒ bit-ne ⇒ content-ne
+    (if (i32.and
+          (i32.eq (i32.and (local.get $axA) (i32.const ${LAYOUT.SSO_BIT | LAYOUT.SLICE_BIT | 0x1})) (i32.const 0x1))
+          (i32.eq (i32.and (local.get $axB) (i32.const ${LAYOUT.SSO_BIT | LAYOUT.SLICE_BIT | 0x1})) (i32.const 0x1)))
+      (then (return (i32.const 0))))
+    ;; both PLAIN heap (not SSO, not slice): length mismatch exits without bytes
+    (if (i32.eqz (i32.or
+          (i32.and (i32.or (local.get $axA) (local.get $axB)) (i32.const ${LAYOUT.SSO_BIT | LAYOUT.SLICE_BIT}))
+          (i32.const 0)))
+      (then
+        (local.set $offA (i32.wrap_i64 (i64.and (local.get $a) (i64.const ${LAYOUT.OFFSET_MASK}))))
+        (local.set $offB (i32.wrap_i64 (i64.and (local.get $b) (i64.const ${LAYOUT.OFFSET_MASK}))))
+        (if (i32.and (i32.ge_u (local.get $offA) (i32.const 4)) (i32.ge_u (local.get $offB) (i32.const 4)))
+          (then
+            (if (i32.ne
+                  (i32.load (i32.sub (local.get $offA) (i32.const 4)))
+                  (i32.load (i32.sub (local.get $offB) (i32.const 4))))
+              (then (return (i32.const 0))))))))
+    (call $__str_eq_cold (local.get $a) (local.get $b)))`)
+
+  wat('__str_eq_cold', `(func $__str_eq_cold (param $a i64) (param $b i64) (result i32)
     (local $len i32) (local $lenB i32) (local $i i32)
     (local $ta i32) (local $tb i32)
     (local $offA i32) (local $offB i32)
     (local $ssoA i32) (local $ssoB i32)
+    (local $axA i32) (local $axB i32)
     (if (i64.eq (local.get $a) (local.get $b))
       (then (return (i32.const 1))))
     (local.set $ta (i32.wrap_i64 (i64.and (i64.shr_u (local.get $a) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
@@ -251,6 +376,19 @@ export default (ctx) => {
     ;; Both SSO with !bit-eq ⇒ content differs (high 32 bits hold tag+aux; both equal here).
     (if (i32.and (local.get $ssoA) (local.get $ssoB))
       (then (return (i32.const 0))))
+    ;; Both CANONICAL interned heap strings (STR_INTERN_BIT, SSO/SLICE clear):
+    ;; canonicals are deduped, so bit-ne ⇒ content-ne — the V8 pointer-compare
+    ;; equivalent. This is the dominant unequal case in tag-dispatch chains
+    ;; (op === 'literal' ladders over static literals).
+    (local.set $axA (i32.wrap_i64 (i64.shr_u (local.get $a) (i64.const ${LAYOUT.AUX_SHIFT}))))
+    (local.set $axB (i32.wrap_i64 (i64.shr_u (local.get $b) (i64.const ${LAYOUT.AUX_SHIFT}))))
+    (if (i32.and
+          (i32.and (i32.eq (local.get $ta) (i32.const ${PTR.STRING}))
+                   (i32.eq (local.get $tb) (i32.const ${PTR.STRING})))
+          (i32.and
+            (i32.eq (i32.and (local.get $axA) (i32.const ${LAYOUT.SSO_BIT | LAYOUT.SLICE_BIT | STR_INTERN_BIT})) (i32.const ${STR_INTERN_BIT}))
+            (i32.eq (i32.and (local.get $axB) (i32.const ${LAYOUT.SSO_BIT | LAYOUT.SLICE_BIT | STR_INTERN_BIT})) (i32.const ${STR_INTERN_BIT}))))
+      (then (return (i32.const 0))))
     ;; Both heap STRING fast path: inline len from header. Chunk by 4 bytes via unaligned
     ;; i32.load (wasm guarantees unaligned-OK), then byte-tail. Most string comparisons fail
     ;; early on the first 4-byte word, so this collapses the per-byte branch overhead into a
@@ -296,7 +434,7 @@ export default (ctx) => {
         (then (return (i32.const 0))))
       (local.set $i (i32.add (local.get $i) (i32.const 1)))
       (br $lm)))
-    (i32.const 1))`
+    (i32.const 1))`)
 
   // Three-way byte-wise compare: -1 if a < b, 0 if equal, +1 if a > b. Returns
   // i32 so callers can `i32.lt_s 0`, `i32.gt_s 0`, etc. without coercion.
@@ -305,7 +443,7 @@ export default (ctx) => {
   // codepoint order for code points < 0x80 and well-formed strings. NOT locale-
   // aware: this is the byte-wise variant suitable for sort-stability use cases,
   // not human-language collation.
-  ctx.core.stdlib['__str_cmp'] = `(func $__str_cmp (param $a i64) (param $b i64) (result i32)
+  wat('__str_cmp', `(func $__str_cmp (param $a i64) (param $b i64) (result i32)
     (local $lenA i32) (local $lenB i32) (local $minLen i32) (local $i i32)
     (local $ca i32) (local $cb i32)
     ;; Bit-equal pointers (including same SSO inline form) ⇒ identical strings.
@@ -326,11 +464,11 @@ export default (ctx) => {
     ;; Common prefix matches — shorter string sorts first.
     (if (i32.lt_s (local.get $lenA) (local.get $lenB)) (then (return (i32.const -1))))
     (if (i32.gt_s (local.get $lenA) (local.get $lenB)) (then (return (i32.const 1))))
-    (i32.const 0))`
+    (i32.const 0))`)
 
   // === WAT: unified byte length (SSO → aux low bits, heap → header) ===
 
-  ctx.core.stdlib['__str_byteLen'] = `(func $__str_byteLen (param $ptr i64) (result i32)
+  wat('__str_byteLen', `(func $__str_byteLen (param $ptr i64) (result i32)
     (local $t i32) (local $off i32) (local $aux i32)
     (local.set $t (i32.wrap_i64 (i64.and (i64.shr_u (local.get $ptr) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
     (if (result i32) (i32.eq (local.get $t) (i32.const ${PTR.STRING}))
@@ -349,15 +487,16 @@ export default (ctx) => {
                 (if (result i32) (i32.ge_u (local.get $off) (i32.const 4))
                   (then (i32.load (i32.sub (local.get $off) (i32.const 4))))
                   (else (i32.const 0))))))))
-      (else (i32.const 0))))`
+      (else (i32.const 0))))`)
 
   // === WAT: string methods ===
 
   // SSO source uses an unrolled byte-extract loop (len ≤ 4); heap source uses memory.copy
   // (single bulk op instead of nlen × __char_at).
-  ctx.core.stdlib['__str_slice'] = `(func $__str_slice (param $ptr i64) (param $start i32) (param $end i32) (result f64)
+  wat('__str_slice', () => `(func $__str_slice (param $ptr i64) (param $start i32) (param $end i32) (result f64)
     (local $len i32) (local $nlen i32) (local $off i32) (local $i i32)
-    (local $srcOff i32) (local $isSso i32)
+    (local $srcOff i32) (local $isSso i32) (local $sb i32) (local $sp i32)
+    (local $ip i32) (local $h i32) (local $j i32) (local $slot i32) (local $cand i32) (local $k i32)
     (local.set $len (call $__str_byteLen (local.get $ptr)))
     (if (i32.lt_s (local.get $start) (i32.const 0))
       (then (local.set $start (i32.add (local.get $len) (local.get $start)))))
@@ -374,6 +513,8 @@ export default (ctx) => {
     (if (i32.ge_s (local.get $start) (local.get $end))
       (then (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.const ${LAYOUT.SSO_BIT}) (i32.const 0)))))
     (local.set $nlen (i32.sub (local.get $end) (local.get $start)))
+    ${sliceSsoPackWat()}
+    ${internProbeWat('(i32.add (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ' + LAYOUT.OFFSET_MASK + '))) (local.get $start))', '(i32.eqz (local.get $isSso))')}
     (local.set $off (call $__alloc (i32.add (i32.const 4) (local.get $nlen))))
     (i32.store (local.get $off) (local.get $nlen))
     (local.set $off (i32.add (local.get $off) (i32.const 4)))
@@ -393,7 +534,7 @@ export default (ctx) => {
           (br $loop))))
       (else
         (memory.copy (local.get $off) (i32.add (local.get $srcOff) (local.get $start)) (local.get $nlen))))
-    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`
+    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`)
 
   // No-copy slice: returns a VIEW into the receiver's buffer instead of copying
   // bytes. Only emitted when escape analysis proves the result never outlives the
@@ -403,8 +544,9 @@ export default (ctx) => {
   // (__str_slice) when the parent is SSO (no buffer to point into) or the result
   // is longer than SLICE_LEN_MASK (aux can't hold the length). Clamping mirrors
   // __str_slice; the fallback re-clamps idempotently.
-  ctx.core.stdlib['__str_slice_view'] = `(func $__str_slice_view (param $ptr i64) (param $start i32) (param $end i32) (result f64)
+  wat('__str_slice_view', () => `(func $__str_slice_view (param $ptr i64) (param $start i32) (param $end i32) (result f64)
     (local $len i32) (local $nlen i32) (local $srcOff i32) (local $tag i32)
+    (local $ip i32) (local $h i32) (local $j i32) (local $slot i32) (local $cand i32) (local $k i32)
     (local.set $len (call $__str_byteLen (local.get $ptr)))
     (if (i32.lt_s (local.get $start) (i32.const 0))
       (then (local.set $start (i32.add (local.get $len) (local.get $start)))))
@@ -422,22 +564,26 @@ export default (ctx) => {
       (then (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.const ${LAYOUT.SSO_BIT}) (i32.const 0)))))
     (local.set $nlen (i32.sub (local.get $end) (local.get $start)))
     (local.set $tag (i32.wrap_i64 (i64.and (i64.shr_u (local.get $ptr) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
-    ;; View-eligible: STRING parent, not SSO, length fits aux[12:0].
+    ;; View-eligible: STRING parent, not SSO, length fits aux[12:0]. ≤4-byte
+    ;; results route to __str_slice's SSO pack instead (bit-equal short tokens).
     (if (i32.and
           (i32.and
-            (i32.eq (local.get $tag) (i32.const ${PTR.STRING}))
+            (i32.and
+              (i32.eq (local.get $tag) (i32.const ${PTR.STRING}))
+              (i32.gt_u (local.get $nlen) (i32.const 4)))
             (i64.eqz (i64.and (local.get $ptr) (i64.const ${SSO_BIT_I64}))))
           (i32.le_u (local.get $nlen) (i32.const ${LAYOUT.SLICE_LEN_MASK})))
       (then
         (local.set $srcOff (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK}))))
+        ${internProbeWat('(i32.add (local.get $srcOff) (local.get $start))')}
         (return (call $__mkptr
           (i32.const ${PTR.STRING})
           (i32.or (i32.const ${LAYOUT.SLICE_BIT}) (local.get $nlen))
           (i32.add (local.get $srcOff) (local.get $start))))))
     ;; Fallback: copy (SSO parent, or slice too long for the aux length field).
-    (call $__str_slice (local.get $ptr) (local.get $start) (local.get $end)))`
+    (call $__str_slice (local.get $ptr) (local.get $start) (local.get $end)))`)
 
-  ctx.core.stdlib['__str_substring'] = `(func $__str_substring (param $ptr i64) (param $start i32) (param $end i32) (result f64)
+  wat('__str_substring', `(func $__str_substring (param $ptr i64) (param $start i32) (param $end i32) (result f64)
     (local $len i32) (local $tmp i32)
     (local.set $len (call $__str_byteLen (local.get $ptr)))
     (if (i32.lt_s (local.get $start) (i32.const 0))
@@ -453,7 +599,7 @@ export default (ctx) => {
         (local.set $tmp (local.get $start))
         (local.set $start (local.get $end))
         (local.set $end (local.get $tmp))))
-    (call $__str_slice (local.get $ptr) (local.get $start) (local.get $end)))`
+    (call $__str_slice (local.get $ptr) (local.get $start) (local.get $end)))`)
 
   // === WAT: fused substring-equality ===
   //
@@ -468,7 +614,7 @@ export default (ctx) => {
   // returns one) and type-checks only `other`, mirroring __eq's STRING-vs-?
   // arm: a genuine number never equals a string, and a NaN-boxed non-STRING
   // never does either (jz `==` is strict).
-  ctx.core.stdlib['__str_range_eq'] = `(func $__str_range_eq (param $ptr i64) (param $start i32) (param $end i32) (param $other i64) (result i32)
+  wat('__str_range_eq', `(func $__str_range_eq (param $ptr i64) (param $start i32) (param $end i32) (param $other i64) (result i32)
     (local $n i32) (local $i i32) (local $fb f64)
     ;; A genuine number reinterprets to a non-NaN f64 (equals itself) — never a string.
     (local.set $fb (f64.reinterpret_i64 (local.get $other)))
@@ -492,10 +638,10 @@ export default (ctx) => {
         (then (return (i32.const 0))))
       (local.set $i (i32.add (local.get $i) (i32.const 1)))
       (br $next)))
-    (i32.const 1))`
+    (i32.const 1))`)
 
   // Clamp mirrors __str_substring (negatives floor to 0, swap when start>end).
-  ctx.core.stdlib['__str_substring_eq'] = `(func $__str_substring_eq (param $ptr i64) (param $start i32) (param $end i32) (param $other i64) (result i32)
+  wat('__str_substring_eq', `(func $__str_substring_eq (param $ptr i64) (param $start i32) (param $end i32) (param $other i64) (result i32)
     (local $len i32) (local $tmp i32)
     (local.set $len (call $__str_byteLen (local.get $ptr)))
     (if (i32.lt_s (local.get $start) (i32.const 0))
@@ -511,11 +657,11 @@ export default (ctx) => {
         (local.set $tmp (local.get $start))
         (local.set $start (local.get $end))
         (local.set $end (local.get $tmp))))
-    (call $__str_range_eq (local.get $ptr) (local.get $start) (local.get $end) (local.get $other)))`
+    (call $__str_range_eq (local.get $ptr) (local.get $start) (local.get $end) (local.get $other)))`)
 
   // Clamp mirrors __str_slice (negatives count from the end; __str_range_eq
   // floors a negative span to an empty match).
-  ctx.core.stdlib['__str_slice_eq'] = `(func $__str_slice_eq (param $ptr i64) (param $start i32) (param $end i32) (param $other i64) (result i32)
+  wat('__str_slice_eq', `(func $__str_slice_eq (param $ptr i64) (param $start i32) (param $end i32) (param $other i64) (result i32)
     (local $len i32)
     (local.set $len (call $__str_byteLen (local.get $ptr)))
     (if (i32.lt_s (local.get $start) (i32.const 0))
@@ -530,11 +676,11 @@ export default (ctx) => {
       (then (local.set $end (i32.const 0))))
     (if (i32.gt_s (local.get $end) (local.get $len))
       (then (local.set $end (local.get $len))))
-    (call $__str_range_eq (local.get $ptr) (local.get $start) (local.get $end) (local.get $other)))`
+    (call $__str_range_eq (local.get $ptr) (local.get $start) (local.get $end) (local.get $other)))`)
 
   // Hoist SSO/heap dispatch for hay and ndl out of the inner byte loop. Inner
   // loop becomes (load8_u OR sso byte-extract) per side — no per-byte calls.
-  ctx.core.stdlib['__str_indexof'] = `(func $__str_indexof (param $hay i64) (param $ndl i64) (param $from i32) (result i32)
+  wat('__str_indexof', `(func $__str_indexof (param $hay i64) (param $ndl i64) (param $from i32) (result i32)
     (local $hlen i32) (local $nlen i32) (local $i i32) (local $j i32) (local $match i32)
     (local $hoff i32) (local $noff i32)
     (local $hsso i32) (local $nsso i32) (local $hb i32) (local $nb i32) (local $k i32)
@@ -573,10 +719,63 @@ export default (ctx) => {
       (if (local.get $match) (then (return (local.get $i))))
       (local.set $i (i32.add (local.get $i) (i32.const 1)))
       (br $outer)))
-    (i32.const -1))`
+    (i32.const -1))`)
+
+  // Mirror of __str_indexof but searches from the end. Returns the last byte-offset
+  // of `ndl` in `hay` at or before `from` (-1 if not found). Per JS spec step 4,
+  // ToString(searchValue) is applied first. SSO/heap dispatch hoisted exactly as
+  // in __str_indexof so the inner loop is cheap byte-fetches.
+  wat('__str_lastindexof', `(func $__str_lastindexof (param $hay i64) (param $ndl i64) (param $from i32) (result i32)
+    (local $hlen i32) (local $nlen i32) (local $i i32) (local $j i32) (local $match i32)
+    (local $hoff i32) (local $noff i32)
+    (local $hsso i32) (local $nsso i32) (local $hb i32) (local $nb i32) (local $k i32)
+    ;; ToString the search value (21.1.3.10 step 4)
+    (local.set $ndl (call $__to_str (local.get $ndl)))
+    (local.set $hlen (call $__str_byteLen (local.get $hay)))
+    (local.set $nlen (call $__str_byteLen (local.get $ndl)))
+    ;; Empty needle always matches at the clamp(from,0,hlen) position
+    (if (i32.eqz (local.get $nlen))
+      (then (return (select
+        (select (local.get $from) (local.get $hlen) (i32.lt_s (local.get $from) (local.get $hlen)))
+        (i32.const 0)
+        (i32.ge_s (local.get $from) (i32.const 0))))))
+    (if (i32.gt_s (local.get $nlen) (local.get $hlen)) (then (return (i32.const -1))))
+    (local.set $hoff (i32.wrap_i64 (i64.and (local.get $hay) (i64.const ${LAYOUT.OFFSET_MASK}))))
+    (local.set $noff (i32.wrap_i64 (i64.and (local.get $ndl) (i64.const ${LAYOUT.OFFSET_MASK}))))
+    (local.set $hsso (i32.and
+      (i32.wrap_i64 (i64.shr_u (local.get $hay) (i64.const ${LAYOUT.AUX_SHIFT})))
+      (i32.const ${LAYOUT.SSO_BIT})))
+    (local.set $nsso (i32.and
+      (i32.wrap_i64 (i64.shr_u (local.get $ndl) (i64.const ${LAYOUT.AUX_SHIFT})))
+      (i32.const ${LAYOUT.SSO_BIT})))
+    ;; clamp start position: from defaults to hlen-nlen, capped at that ceiling
+    (local.set $i (i32.sub (local.get $hlen) (local.get $nlen)))
+    (if (i32.and (i32.ge_s (local.get $from) (i32.const 0)) (i32.lt_s (local.get $from) (local.get $i)))
+      (then (local.set $i (local.get $from))))
+    (block $done (loop $outer
+      (br_if $done (i32.lt_s (local.get $i) (i32.const 0)))
+      (local.set $match (i32.const 1))
+      (local.set $j (i32.const 0))
+      (block $nomatch (loop $inner
+        (br_if $nomatch (i32.ge_s (local.get $j) (local.get $nlen)))
+        (local.set $k (i32.add (local.get $i) (local.get $j)))
+        (local.set $hb (if (result i32) (local.get $hsso)
+          (then (i32.and (i32.shr_u (local.get $hoff) (i32.shl (local.get $k) (i32.const 3))) (i32.const 0xFF)))
+          (else (i32.load8_u (i32.add (local.get $hoff) (local.get $k))))))
+        (local.set $nb (if (result i32) (local.get $nsso)
+          (then (i32.and (i32.shr_u (local.get $noff) (i32.shl (local.get $j) (i32.const 3))) (i32.const 0xFF)))
+          (else (i32.load8_u (i32.add (local.get $noff) (local.get $j))))))
+        (if (i32.ne (local.get $hb) (local.get $nb))
+          (then (local.set $match (i32.const 0)) (br $nomatch)))
+        (local.set $j (i32.add (local.get $j) (i32.const 1)))
+        (br $inner)))
+      (if (local.get $match) (then (return (local.get $i))))
+      (local.set $i (i32.sub (local.get $i) (i32.const 1)))
+      (br $outer)))
+    (i32.const -1))`)
 
   // SSO/heap dispatch hoisted; inner loop is two inlined byte-fetches and a compare.
-  ctx.core.stdlib['__str_startswith'] = `(func $__str_startswith (param $str i64) (param $pfx i64) (result i32)
+  wat('__str_startswith', `(func $__str_startswith (param $str i64) (param $pfx i64) (result i32)
     (local $plen i32) (local $i i32)
     (local $soff i32) (local $poff i32) (local $ssso i32) (local $psso i32)
     (local.set $plen (call $__str_byteLen (local.get $pfx)))
@@ -602,9 +801,9 @@ export default (ctx) => {
         (then (return (i32.const 0))))
       (local.set $i (i32.add (local.get $i) (i32.const 1)))
       (br $loop)))
-    (i32.const 1))`
+    (i32.const 1))`)
 
-  ctx.core.stdlib['__str_endswith'] = `(func $__str_endswith (param $str i64) (param $sfx i64) (result i32)
+  wat('__str_endswith', `(func $__str_endswith (param $str i64) (param $sfx i64) (result i32)
     (local $slen i32) (local $flen i32) (local $off i32) (local $i i32) (local $k i32)
     (local $soff i32) (local $foff i32) (local $ssso i32) (local $fsso i32)
     (local.set $slen (call $__str_byteLen (local.get $str)))
@@ -633,10 +832,10 @@ export default (ctx) => {
         (then (return (i32.const 0))))
       (local.set $i (i32.add (local.get $i) (i32.const 1)))
       (br $loop)))
-    (i32.const 1))`
+    (i32.const 1))`)
 
   // Source SSO/heap dispatch hoisted out of the byte loop (was a per-byte __char_at).
-  ctx.core.stdlib['__str_case'] = `(func $__str_case (param $ptr i64) (param $lo i32) (param $hi i32) (param $delta i32) (result f64)
+  wat('__str_case', `(func $__str_case (param $ptr i64) (param $lo i32) (param $hi i32) (param $delta i32) (result f64)
     (local $len i32) (local $off i32) (local $i i32) (local $c i32)
     (local $srcOff i32)
     (local.set $len (call $__str_byteLen (local.get $ptr)))
@@ -667,9 +866,9 @@ export default (ctx) => {
           (i32.store8 (i32.add (local.get $off) (local.get $i)) (local.get $c))
           (local.set $i (i32.add (local.get $i) (i32.const 1)))
           (br $lh)))))
-    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`
+    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`)
 
-  ctx.core.stdlib['__str_trim'] = `(func $__str_trim (param $ptr i64) (result f64)
+  wat('__str_trim', `(func $__str_trim (param $ptr i64) (result f64)
     (local $len i32) (local $start i32) (local $end i32)
     (local.set $len (call $__str_byteLen (local.get $ptr)))
     (local.set $start (i32.const 0))
@@ -684,9 +883,9 @@ export default (ctx) => {
       (br_if $d2 (i32.gt_u (call $__char_at (local.get $ptr) (i32.sub (local.get $end) (i32.const 1))) (i32.const 32)))
       (local.set $end (i32.sub (local.get $end) (i32.const 1)))
       (br $l2)))
-    (call $__str_slice (local.get $ptr) (local.get $start) (local.get $end)))`
+    (call $__str_slice (local.get $ptr) (local.get $start) (local.get $end)))`)
 
-  ctx.core.stdlib['__str_trimStart'] = `(func $__str_trimStart (param $ptr i64) (result f64)
+  wat('__str_trimStart', `(func $__str_trimStart (param $ptr i64) (result f64)
     (local $len i32) (local $start i32)
     (local.set $len (call $__str_byteLen (local.get $ptr)))
     (local.set $start (i32.const 0))
@@ -695,9 +894,9 @@ export default (ctx) => {
       (br_if $done (i32.gt_u (call $__char_at (local.get $ptr) (local.get $start)) (i32.const 32)))
       (local.set $start (i32.add (local.get $start) (i32.const 1)))
       (br $loop)))
-    (call $__str_slice (local.get $ptr) (local.get $start) (local.get $len)))`
+    (call $__str_slice (local.get $ptr) (local.get $start) (local.get $len)))`)
 
-  ctx.core.stdlib['__str_trimEnd'] = `(func $__str_trimEnd (param $ptr i64) (result f64)
+  wat('__str_trimEnd', `(func $__str_trimEnd (param $ptr i64) (result f64)
     (local $len i32) (local $end i32)
     (local.set $len (call $__str_byteLen (local.get $ptr)))
     (local.set $end (local.get $len))
@@ -706,11 +905,11 @@ export default (ctx) => {
       (br_if $done (i32.gt_u (call $__char_at (local.get $ptr) (i32.sub (local.get $end) (i32.const 1))) (i32.const 32)))
       (local.set $end (i32.sub (local.get $end) (i32.const 1)))
       (br $loop)))
-    (call $__str_slice (local.get $ptr) (i32.const 0) (local.get $end)))`
+    (call $__str_slice (local.get $ptr) (i32.const 0) (local.get $end)))`)
 
   // Materialize source bytes once via __str_copy (handles SSO/heap), then memory.copy
   // each subsequent repetition (single bulk op vs len byte stores per copy).
-  ctx.core.stdlib['__str_repeat'] = `(func $__str_repeat (param $ptr i64) (param $n i32) (result f64)
+  wat('__str_repeat', `(func $__str_repeat (param $ptr i64) (param $n i32) (result f64)
     (local $len i32) (local $total i32) (local $off i32) (local $i i32)
     (local.set $len (call $__str_byteLen (local.get $ptr)))
     (if (i32.or (i32.eqz (local.get $n)) (i32.eqz (local.get $len)))
@@ -729,11 +928,11 @@ export default (ctx) => {
         (local.get $len))
       (local.set $i (i32.add (local.get $i) (i32.const 1)))
       (br $loop)))
-    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`
+    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`)
 
   // Coerce value to string: numbers → __ftoa, nullish → static strings,
   // plain NaN → "NaN", arrays → join(","), other string-like pointers pass through.
-  ctx.core.stdlib['__to_str'] = `(func $__to_str (param $val i64) (result i64)
+  wat('__to_str', `(func $__to_str (param $val i64) (result i64)
     (local $type i32) (local $f f64)
     (local.set $f (f64.reinterpret_i64 (local.get $val)))
     ;; Not NaN → number, convert
@@ -743,6 +942,10 @@ export default (ctx) => {
       (then (return (i64.reinterpret_f64 (call $__static_str (i32.const 5))))))
     (if (i64.eq (local.get $val) (i64.const ${UNDEF_NAN}))
       (then (return (i64.reinterpret_f64 (call $__static_str (i32.const 6))))))
+    (if (i64.eq (local.get $val) (i64.const ${FALSE_NAN}))
+      (then (return (i64.reinterpret_f64 (call $__static_str (i32.const 4))))))
+    (if (i64.eq (local.get $val) (i64.const ${TRUE_NAN}))
+      (then (return (i64.reinterpret_f64 (call $__static_str (i32.const 3))))))
     (local.set $type (call $__ptr_type (local.get $val)))
     ;; Plain NaN (type=0) → "NaN" string
     (if (i32.eqz (local.get $type))
@@ -751,11 +954,11 @@ export default (ctx) => {
     (if (i32.eq (local.get $type) (i32.const ${PTR.ARRAY}))
       (then (return (i64.reinterpret_f64 (call $__str_join (local.get $val)
         (i64.reinterpret_f64 (call $__mkptr (i32.const ${PTR.STRING}) (i32.const ${LAYOUT.SSO_BIT | 1}) (i32.const 44))))))))
-    (local.get $val))`
+    (local.get $val))`)
 
   // Copy bytes of a string (SSO or heap) into memory at dst. Uses memory.copy for
   // heap strings (single native op); unpacks SSO offset-packed bytes inline.
-  ctx.core.stdlib['__str_copy'] = `(func $__str_copy (param $src i64) (param $dst i32) (param $len i32)
+  wat('__str_copy', `(func $__str_copy (param $src i64) (param $dst i32) (param $len i32)
     (local $w i32)
     (if (i64.ne (i64.and (local.get $src) (i64.const ${SSO_BIT_I64})) (i64.const 0))
       (then
@@ -775,7 +978,7 @@ export default (ctx) => {
         ;; Heap STRING: memory.copy directly from string data
         (memory.copy (local.get $dst)
           (i32.wrap_i64 (i64.and (local.get $src) (i64.const ${LAYOUT.OFFSET_MASK})))
-          (local.get $len)))))`
+          (local.get $len)))))`)
 
   // Bump-extend fast path: when `a` is a heap STRING sitting at the top of the
   // bump allocator, extend its allocation in place instead of copying. Mutates
@@ -826,10 +1029,7 @@ export default (ctx) => {
       (then
         (local.set $newHeap
           (i32.and (i32.add (i32.add (local.get $aoff) (local.get $total)) (i32.const 7)) (i32.const -8)))
-        (if (i32.gt_u (local.get $newHeap) (i32.mul (memory.size) (i32.const 65536)))
-          (then (if (i32.eq (memory.grow
-            (i32.shr_u (i32.add (i32.sub (local.get $newHeap) (i32.mul (memory.size) (i32.const 65536))) (i32.const 65535)) (i32.const 16)))
-            (i32.const -1)) (then (unreachable)))))
+        (call $__memgrow (local.get $newHeap))
         (call $__str_copy (local.get $b)
           (i32.add (local.get $aoff) (local.get $alen))
           (local.get $blen))
@@ -841,7 +1041,7 @@ export default (ctx) => {
   // VAL.STRING and the rhs is a string-index. Skips __str_idx's 1-char SSO
   // construction and __str_concat's type-dispatch — byte goes directly from
   // __char_at to memory. Bump-extends in place when `a` is at heap top.
-  ctx.core.stdlib['__str_append_byte'] = `(func $__str_append_byte (param $a i64) (param $byte i32) (result f64)
+  wat('__str_append_byte', `(func $__str_append_byte (param $a i64) (param $byte i32) (result f64)
     (local $ta i32) (local $aoff i32) (local $alen i32)
     (local $newHeap i32) (local $off i32) (local $total i32)
     (local.set $ta (i32.wrap_i64 (i64.and (i64.shr_u (local.get $a) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
@@ -863,10 +1063,7 @@ export default (ctx) => {
           (then
             (local.set $newHeap
               (i32.and (i32.add (i32.add (local.get $aoff) (local.get $alen)) (i32.const 8)) (i32.const -8)))
-            (if (i32.gt_u (local.get $newHeap) (i32.mul (memory.size) (i32.const 65536)))
-              (then (if (i32.eq (memory.grow
-                (i32.shr_u (i32.add (i32.sub (local.get $newHeap) (i32.mul (memory.size) (i32.const 65536))) (i32.const 65535)) (i32.const 16)))
-                (i32.const -1)) (then (unreachable)))))
+            (call $__memgrow (local.get $newHeap))
             (i32.store8 (i32.add (local.get $aoff) (local.get $alen)) (local.get $byte))
             (i32.store (i32.sub (local.get $aoff) (i32.const 4)) (i32.add (local.get $alen) (i32.const 1)))
             (global.set $__heap (local.get $newHeap))
@@ -899,9 +1096,9 @@ export default (ctx) => {
     (local.set $off (i32.add (local.get $off) (i32.const 4)))
     (call $__str_copy (local.get $a) (local.get $off) (local.get $alen))
     (i32.store8 (i32.add (local.get $off) (local.get $alen)) (local.get $byte))
-    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`
+    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`)
 
-  ctx.core.stdlib['__str_concat'] = `(func $__str_concat (param $a i64) (param $b i64) (result f64)
+  wat('__str_concat', `(func $__str_concat (param $a i64) (param $b i64) (result f64)
     (local $alen i32) (local $blen i32) (local $total i32) (local $off i32)
     (local $ta i32) (local $aoff i32) (local $newHeap i32)
     ;; Coerce operands to strings if needed
@@ -919,9 +1116,9 @@ export default (ctx) => {
     (local.set $off (i32.add (local.get $off) (i32.const 4)))
     (call $__str_copy (local.get $a) (local.get $off) (local.get $alen))
     (call $__str_copy (local.get $b) (i32.add (local.get $off) (local.get $alen)) (local.get $blen))
-    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`
+    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`)
 
-  ctx.core.stdlib['__str_concat_raw'] = `(func $__str_concat_raw (param $a i64) (param $b i64) (result f64)
+  wat('__str_concat_raw', `(func $__str_concat_raw (param $a i64) (param $b i64) (result f64)
     (local $alen i32) (local $blen i32) (local $total i32) (local $off i32)
     (local $ta i32) (local $aoff i32) (local $newHeap i32)
     (local.set $alen (call $__str_byteLen (local.get $a)))
@@ -936,9 +1133,9 @@ export default (ctx) => {
     (local.set $off (i32.add (local.get $off) (i32.const 4)))
     (call $__str_copy (local.get $a) (local.get $off) (local.get $alen))
     (call $__str_copy (local.get $b) (i32.add (local.get $off) (local.get $alen)) (local.get $blen))
-    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`
+    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`)
 
-  ctx.core.stdlib['__str_replace'] = `(func $__str_replace (param $str i64) (param $search i64) (param $repl i64) (result f64)
+  wat('__str_replace', `(func $__str_replace (param $str i64) (param $search i64) (param $repl i64) (result f64)
     (local $idx i32) (local $slen i32)
     (local.set $idx (call $__str_indexof (local.get $str) (local.get $search) (i32.const 0)))
     (if (result f64) (i32.lt_s (local.get $idx) (i32.const 0))
@@ -950,9 +1147,9 @@ export default (ctx) => {
             (i64.reinterpret_f64 (call $__str_slice (local.get $str) (i32.const 0) (local.get $idx)))
             (local.get $repl)))
           (i64.reinterpret_f64 (call $__str_slice (local.get $str) (i32.add (local.get $idx) (local.get $slen))
-            (call $__str_byteLen (local.get $str))))))))`
+            (call $__str_byteLen (local.get $str))))))))`)
 
-  ctx.core.stdlib['__str_replaceall'] = `(func $__str_replaceall (param $str i64) (param $search i64) (param $repl i64) (result f64)
+  wat('__str_replaceall', `(func $__str_replaceall (param $str i64) (param $search i64) (param $repl i64) (result f64)
     (local $idx i32) (local $slen i32) (local $pos i32) (local $result i64)
     (local.set $slen (call $__str_byteLen (local.get $search)))
     (local.set $result (local.get $str))
@@ -968,33 +1165,48 @@ export default (ctx) => {
           (call $__str_byteLen (local.get $result)))))))
       (local.set $pos (i32.add (local.get $idx) (call $__str_byteLen (local.get $repl))))
       (br $next)))
-    (f64.reinterpret_i64 (local.get $result)))`
-
-  // Empty separator: per JS spec, split into individual byte-chars
-  // ("abc".split("") -> ["a","b","c"], "".split("") -> []). Without this
-  // guard the main loop advances by plen=0 and spins forever.
-  ctx.core.stdlib['__str_split'] = `(func $__str_split (param $str i64) (param $sep i64) (result f64)
+    (f64.reinterpret_i64 (local.get $result)))`)
+
+  // $limit ≥ 0: honour JS's optional limit arg. 0x7fffffff = "no limit"
+  // (sentinel passed by the no-limit call site). limit=0 → []. limit=N → at
+  // most N elements; the (N+1)th and later pieces are DISCARDED (not appended
+  // as a remainder). Empty separator: split into individual byte-chars, up to
+  // $limit chars ("abc".split("") → ["a","b","c"], "".split("") → []).
+  wat('__str_split', `(func $__str_split (param $str i64) (param $sep i64) (param $limit i32) (result f64)
     (local $slen i32) (local $plen i32) (local $count i32)
     (local $i i32) (local $j i32) (local $match i32)
-    (local $arr i32) (local $piece_start i32) (local $piece_idx i32)
+    (local $arr i32) (local $piece_start i32) (local $piece_idx i32) (local $hitlim i32)
     (local.set $slen (call $__str_byteLen (local.get $str)))
     (local.set $plen (call $__str_byteLen (local.get $sep)))
+    ;; limit=0 → empty array
+    (if (i32.eqz (local.get $limit)) (then
+      (local.set $arr (call $__alloc (i32.const 8)))
+      (i32.store (local.get $arr) (i32.const 0))
+      (i32.store (i32.add (local.get $arr) (i32.const 4)) (i32.const 0))
+      (return (call $__mkptr (i32.const 1) (i32.const 0) (i32.add (local.get $arr) (i32.const 8))))))
     (if (i32.eqz (local.get $plen)) (then
-      (local.set $arr (call $__alloc (i32.add (i32.const 8) (i32.shl (local.get $slen) (i32.const 3)))))
-      (i32.store (local.get $arr) (local.get $slen))
-      (i32.store (i32.add (local.get $arr) (i32.const 4)) (local.get $slen))
+      ;; Empty-separator: split into individual byte-chars, up to $limit
+      (local.set $count (select (local.get $limit) (local.get $slen) (i32.lt_u (local.get $limit) (local.get $slen))))
+      (local.set $arr (call $__alloc (i32.add (i32.const 8) (i32.shl (local.get $count) (i32.const 3)))))
+      (i32.store (local.get $arr) (local.get $count))
+      (i32.store (i32.add (local.get $arr) (i32.const 4)) (local.get $count))
       (local.set $arr (i32.add (local.get $arr) (i32.const 8)))
       (block $de (loop $le
-        (br_if $de (i32.ge_s (local.get $i) (local.get $slen)))
+        (br_if $de (i32.ge_s (local.get $i) (local.get $count)))
         (f64.store (i32.add (local.get $arr) (i32.shl (local.get $i) (i32.const 3)))
           (call $__str_slice (local.get $str) (local.get $i) (i32.add (local.get $i) (i32.const 1))))
         (local.set $i (i32.add (local.get $i) (i32.const 1)))
         (br $le)))
       (return (call $__mkptr (i32.const 1) (i32.const 0) (local.get $arr)))))
+    ;; Count pass: tally pieces = separators+1, capped at $limit.
+    ;; We stop incrementing count once count reaches $limit (last sep found
+    ;; at that point produces piece #limit — a separator *after* piece limit-1,
+    ;; meaning we've already found all limit pieces and don't count more).
     (local.set $count (i32.const 1))
     (local.set $i (i32.const 0))
     (block $d1 (loop $l1
       (br_if $d1 (i32.gt_s (local.get $i) (i32.sub (local.get $slen) (local.get $plen))))
+      (br_if $d1 (i32.ge_u (local.get $count) (local.get $limit)))
       (local.set $match (i32.const 1))
       (local.set $j (i32.const 0))
       (block $n1 (loop $c1
@@ -1017,6 +1229,11 @@ export default (ctx) => {
     (local.set $piece_start (i32.const 0))
     (local.set $piece_idx (i32.const 0))
     (local.set $i (i32.const 0))
+    ;; Fill pass: write pieces separated by $sep, up to $count total pieces.
+    ;; When a separator is found and piece_idx+1 reaches count, write that
+    ;; piece (before the sep) and exit WITHOUT appending the tail — this
+    ;; correctly discards the remainder when $limit truncates the result.
+    (local.set $hitlim (i32.const 0))
     (block $d2 (loop $l2
       (br_if $d2 (i32.gt_s (local.get $i) (i32.sub (local.get $slen) (local.get $plen))))
       (local.set $match (i32.const 1))
@@ -1034,14 +1251,27 @@ export default (ctx) => {
         (local.set $piece_idx (i32.add (local.get $piece_idx) (i32.const 1)))
         (local.set $i (i32.add (local.get $i) (local.get $plen)))
         (local.set $piece_start (local.get $i))
+        ;; If we've emitted all $count pieces, mark limit-hit and stop (discard tail)
+        (if (i32.ge_s (local.get $piece_idx) (local.get $count))
+          (then (local.set $hitlim (i32.const 1)) (br $d2)))
         (br $l2)))
       (local.set $i (i32.add (local.get $i) (i32.const 1)))
       (br $l2)))
-    (f64.store (i32.add (local.get $arr) (i32.shl (local.get $piece_idx) (i32.const 3)))
-      (call $__str_slice (local.get $str) (local.get $piece_start) (local.get $slen)))
-    (call $__mkptr (i32.const 1) (i32.const 0) (local.get $arr)))`
-
-  ctx.core.stdlib['__str_join'] = `(func $__str_join (param $arr i64) (param $sep i64) (result f64)
+    ;; Write tail only when the scan ended naturally (not truncated by limit)
+    (if (i32.eqz (local.get $hitlim)) (then
+      (f64.store (i32.add (local.get $arr) (i32.shl (local.get $piece_idx) (i32.const 3)))
+        (call $__str_slice (local.get $str) (local.get $piece_start) (local.get $slen)))))
+    (call $__mkptr (i32.const 1) (i32.const 0) (local.get $arr)))`)
+
+  // Array (type=1) → join(",") like JS Array.toString().
+  // When the typedarray module is loaded, also handles PTR.TYPED (type=3) arrays:
+  // promoteIntArrayLiterals rewrites [int,...] → new Int32Array([...]) internally,
+  // so a.map(fn).join() may receive a PTR.TYPED result. Use __typed_idx to load
+  // each element correctly (it returns f64 for any element type / stride).
+  wat('__str_join', () => {
+    if (!ctx.module.modules.typedarray) {
+      // ARRAY-only fast path — no __typed_idx overhead.
+      return `(func $__str_join (param $arr i64) (param $sep i64) (result f64)
     (local $off i32) (local $len i32) (local $i i32) (local $result f64)
     (local.set $off (call $__ptr_offset (local.get $arr)))
     (local.set $len (call $__len (local.get $arr)))
@@ -1057,13 +1287,48 @@ export default (ctx) => {
       (local.set $i (i32.add (local.get $i) (i32.const 1)))
       (br $loop)))
     (local.get $result))`
+    }
+    // ARRAY + TYPED path: runtime dispatch on ptr type.
+    // PTR.TYPED (type=3): elements have typed-array stride; __typed_idx reads correctly.
+    // PTR.ARRAY (type=1): elements are 8-byte NaN-boxed f64 slots; i64.load is correct.
+    return `(func $__str_join (param $arr i64) (param $sep i64) (result f64)
+    (local $off i32) (local $len i32) (local $i i32) (local $result f64) (local $isTyped i32)
+    (local.set $isTyped
+      (i32.eq
+        (i32.and (i32.wrap_i64 (i64.shr_u (local.get $arr) (i64.const ${LAYOUT.TAG_SHIFT})))
+                 (i32.const ${LAYOUT.TAG_MASK}))
+        (i32.const ${PTR.TYPED})))
+    (local.set $off (call $__ptr_offset (local.get $arr)))
+    (local.set $len (call $__len (local.get $arr)))
+    (if (i32.eqz (local.get $len))
+      (then (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.const ${LAYOUT.SSO_BIT}) (i32.const 0)))))
+    (local.set $result
+      (f64.reinterpret_i64
+        (call $__to_str
+          (if (result i64) (local.get $isTyped)
+            (then (i64.reinterpret_f64 (call $__typed_idx (local.get $arr) (i32.const 0))))
+            (else (i64.load (local.get $off)))))))
+    (local.set $i (i32.const 1))
+    (block $done (loop $loop
+      (br_if $done (i32.ge_s (local.get $i) (local.get $len)))
+      (local.set $result (call $__str_concat (i64.reinterpret_f64 (local.get $result)) (local.get $sep)))
+      (local.set $result
+        (call $__str_concat
+          (i64.reinterpret_f64 (local.get $result))
+          (if (result i64) (local.get $isTyped)
+            (then (i64.reinterpret_f64 (call $__typed_idx (local.get $arr) (local.get $i))))
+            (else (i64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3))))))))
+      (local.set $i (i32.add (local.get $i) (i32.const 1)))
+      (br $loop)))
+    (local.get $result))`
+  })
 
   // Source string copied via __str_copy (handles SSO/heap with memory.copy where possible).
   // Pad fill loops a single tile of pad bytes — hoist pad dispatch out of the byte loop.
-  ctx.core.stdlib['__str_pad'] = `(func $__str_pad (param $str i64) (param $target i32) (param $pad i64) (param $before i32) (result f64)
+  wat('__str_pad', `(func $__str_pad (param $str i64) (param $target i32) (param $pad i64) (param $before i32) (result f64)
     (local $slen i32) (local $plen i32) (local $fill i32) (local $off i32) (local $i i32)
     (local $str_off i32) (local $pad_off i32)
-    (local $pbits i64) (local $poff i32) (local $psso i32)
+    (local $pbits i64) (local $poff i32) (local $psso i32) (local $sp i32) (local $sb i32)
     (local.set $slen (call $__str_byteLen (local.get $str)))
     (if (i32.ge_s (local.get $slen) (local.get $target))
       (then (return (f64.reinterpret_i64 (local.get $str)))))
@@ -1090,7 +1355,25 @@ export default (ctx) => {
           (else (i32.load8_u (i32.add (local.get $poff) (i32.rem_u (local.get $i) (local.get $plen)))))))
       (local.set $i (i32.add (local.get $i) (i32.const 1)))
       (br $l2)))
-    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`
+    ${!ctx.memory.shared ? `
+    ;; SSO + reclaim for ≤4 ASCII results: pack into the pointer and free this pad
+    ;; allocation (at heap top) so padStart in a builder loop is allocation-neutral
+    ;; — the accumulator stays at heap top and keeps bump-extending (O(n)).
+    (if (i32.le_u (local.get $target) (i32.const 4))
+      (then
+        (block $heap
+          (local.set $i (i32.const 0)) (local.set $sp (i32.const 0))
+          (loop $pk
+            (if (i32.lt_u (local.get $i) (local.get $target))
+              (then
+                (local.set $sb (i32.load8_u (i32.add (local.get $off) (local.get $i))))
+                (br_if $heap (i32.ge_u (local.get $sb) (i32.const 0x80)))
+                (local.set $sp (i32.or (local.get $sp) (i32.shl (local.get $sb) (i32.shl (local.get $i) (i32.const 3)))))
+                (local.set $i (i32.add (local.get $i) (i32.const 1)))
+                (br $pk))))
+          (global.set $__heap (i32.sub (local.get $off) (i32.const 4)))
+          (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.or (i32.const ${LAYOUT.SSO_BIT}) (local.get $target)) (local.get $sp))))))` : ''}
+    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`)
 
   // Base helpers (__sso_char/__str_char/__char_at/__str_byteLen) are referenced
   // from other helpers' WAT bodies and from emit sites; their `stdlibDeps`
@@ -1103,16 +1386,16 @@ export default (ctx) => {
   // (21.1.3.27/28). Typed forms cover the static-string case; generic forms
   // pair with them so the dispatcher can pick a runtime ptr-type branch when
   // the receiver type can't be statically inferred (e.g. a callback param).
-  ctx.core.emit['.string:toString'] = (str) => asF64(emit(str))
-  ctx.core.emit['.string:valueOf'] = (str) => asF64(emit(str))
-  ctx.core.emit['.toString'] = (val) => {
+  bind('.string:toString', (str) => asF64(emit(str)))
+  bind('.string:valueOf', (str) => asF64(emit(str)))
+  bind('.toString', (val) => {
     inc('__to_str')
     return typed(['f64.reinterpret_i64', ['call', '$__to_str', asI64(emit(val))]], 'f64')
-  }
+  })
   // Object.prototype.valueOf returns the receiver (per ES2024 20.1.3.7).
   // Array/Object inherit this; only primitive wrappers (Number/Boolean/String)
   // override to return the primitive — strings already covered by .string:valueOf.
-  ctx.core.emit['.valueOf'] = (val) => asF64(emit(val))
+  bind('.valueOf', (val) => asF64(emit(val)))
 
   // `.slice` lowering, parametrised on the backing helper: __str_slice copies
   // bytes; __str_slice_view returns a no-copy SLICE_BIT view — used only when
@@ -1130,8 +1413,8 @@ export default (ctx) => {
       ['call', `$${fn}`, ['i64.reinterpret_f64', ['local.get', `$${t}`]], startIR,
         ['call', '$__str_byteLen', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]]], 'f64')
   }
-  ctx.core.emit['.string:slice'] = sliceEmitter('__str_slice')
-  ctx.core.emit['.string:slice#view'] = sliceEmitter('__str_slice_view')
+  bind('.string:slice', sliceEmitter('__str_slice'))
+  bind('.string:slice#view', sliceEmitter('__str_slice_view'))
 
   // ToIntegerOrInfinity for a string-method position argument: ToNumber (so
   // string / boolean / null / undefined positions coerce per spec) then trunc.
@@ -1148,14 +1431,25 @@ export default (ctx) => {
   // a BOOL rides the 0/1 carrier (→ "0"/"1" not "true"/"false"), and an OBJECT
   // needs compile-time ToPrimitive(string) (__to_str can't invoke user toString).
   const searchArg = (search) =>
-    valTypeOf(search) === VAL.BOOL ? asI64(emitBoolStr(search)) :
+    valTypeOf(search) === VAL.BOOL ? asI64(bool(search)) :
     valTypeOf(search) === VAL.OBJECT ? toStrI64(search, emit(search)) : asI64(emit(search))
 
-  ctx.core.emit['.string:indexOf'] = (str, search, from) => {
+  bind('.string:indexOf', (str, search, from) => {
     inc('__str_indexof')
     const hay = asI64(emit(str)), ndl = searchArg(search)
     return typed(['f64.convert_i32_s', ['call', '$__str_indexof', hay, ndl, posIndex(from)]], 'f64')
-  }
+  })
+
+  // String.prototype.lastIndexOf: search from the end, returning the last
+  // byte-offset of `search` in `str` at or before `fromIndex` (or -1).
+  // Per spec the `from` default is +∞ (search from the very end), which we
+  // map to 0x7fffffff — __str_lastindexof clamps it to hlen-nlen anyway.
+  bind('.string:lastIndexOf', (str, search, from) => {
+    inc('__str_lastindexof')
+    const hay = asI64(emit(str)), ndl = searchArg(search)
+    const fromIR = from == null ? ['i32.const', 0x7fffffff] : asI32(emit(from))
+    return typed(['f64.convert_i32_s', ['call', '$__str_lastindexof', hay, ndl, fromIR]], 'f64')
+  })
 
   // String.prototype.{includes,startsWith,endsWith} run IsRegExp(searchString)
   // and throw a TypeError when it is a RegExp. Detect a regex-typed search arg
@@ -1166,16 +1460,16 @@ export default (ctx) => {
     return typed(['block', ['result', 'f64'], ['throw', '$__jz_err', ['f64.const', 0]]], 'f64')
   }
 
-  ctx.core.emit['.string:includes'] = (str, search, from) => {
+  bind('.string:includes', (str, search, from) => {
     const guard = regexpSearchGuard(search); if (guard) return guard
     inc('__str_indexof')
     const hay = asI64(emit(str)), ndl = searchArg(search)
     return typed(['f64.convert_i32_s',
       ['i32.ge_s', ['call', '$__str_indexof', hay, ndl, posIndex(from)], ['i32.const', 0]]], 'f64')
-  }
+  })
 
   // Generic (no collision)
-  ctx.core.emit['.substring'] = (str, start, end) => {
+  bind('.substring', (str, start, end) => {
     inc('__str_substring')
     if (end != null) return typed(['call', '$__str_substring', asI64(emit(str)), asI32(emit(start)), asI32(emit(end))], 'f64')
     const t = temp('t')
@@ -1183,13 +1477,13 @@ export default (ctx) => {
       ['local.set', `$${t}`, asF64(emit(str))],
       ['call', '$__str_substring', ['i64.reinterpret_f64', ['local.get', `$${t}`]], asI32(emit(start)),
         ['call', '$__str_byteLen', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]]], 'f64')
-  }
+  })
 
   // .substr(start, length) — Annex B / legacy. Equivalent to substring(start, start+length).
   // __str_substring clamps end to byteLen and start/end to [0, byteLen], so negative
   // values are floored to 0 (matches v8 for length<0 → empty; for start<0 spec wants
   // max(0, len+start), which we don't implement — rare in practice).
-  ctx.core.emit['.substr'] = (str, start, length) => {
+  bind('.substr', (str, start, length) => {
     inc('__str_substring')
     if (length != null) {
       const s = tempI32('substrS')
@@ -1205,15 +1499,6 @@ export default (ctx) => {
       ['local.set', `$${t}`, asF64(emit(str))],
       ['call', '$__str_substring', ['i64.reinterpret_f64', ['local.get', `$${t}`]], asI32(emit(start)),
         ['call', '$__str_byteLen', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]]], 'f64')
-  }
-
-  // Declarative emitter for regular `(recv, ...args) → call($stdlib, coerced...)` methods.
-  // `coerce` is a per-argument code string ('I' i64 · 'F' f64 · 'i' i32); index 0 is the receiver.
-  // `ret` is the helper's result type — 'f64' is returned directly, 'i32' is widened to the f64 ABI.
-  const CO = { I: asI64, F: asF64, i: asI32 }
-  const method = (stdlib, coerce, ret = 'f64') => emitter([stdlib], (...nodes) => {
-    const c = ['call', `$${stdlib}`, ...nodes.map((n, i) => CO[coerce[i]](emit(n)))]
-    return typed(ret === 'i32' ? ['f64.convert_i32_s', c] : c, 'f64')
   })
 
   // Search args go through ToString per spec — coerce non-string-typed args
@@ -1231,30 +1516,87 @@ export default (ctx) => {
     }
     return typed(['f64.convert_i32_s', ['call', `$${name}`, asI64(emit(str)), sfxArg]], 'f64')
   }
-  ctx.core.emit['.startsWith'] = stringSearchMethod('__str_startswith')
-  ctx.core.emit['.endsWith'] = stringSearchMethod('__str_endswith')
-  ctx.core.emit['.trim']       = method('__str_trim',       'I')
-  ctx.core.emit['.trimStart']  = method('__str_trimStart',  'I')
-  ctx.core.emit['.trimEnd']    = method('__str_trimEnd',    'I')
-  ctx.core.emit['.repeat']     = method('__str_repeat',     'Ii')
-  ctx.core.emit['.split']      = method('__str_split',      'II')
-  ctx.core.emit['.replace']    = method('__str_replace',    'III')
-  ctx.core.emit['.replaceAll'] = method('__str_replaceall', 'III')
-
-  ctx.core.emit['.toUpperCase'] = (str) => {
-    inc('__str_case')
-    return typed(['call', '$__str_case', asI64(emit(str)), ['i32.const', 97], ['i32.const', 122], ['i32.const', -32]], 'f64')
-  }
+  bind('.startsWith', stringSearchMethod('__str_startswith'))
+  bind('.endsWith', stringSearchMethod('__str_endswith'))
+  bind('.trim', method('__str_trim',       'I'))
+  bind('.trimStart', method('__str_trimStart',  'I'))
+  bind('.trimEnd', method('__str_trimEnd',    'I'))
+  bind('.repeat', method('__str_repeat',     'Ii'))
+  // split(sep, limit): both args are optional.
+  // - No args (undefined sep) → [str]: JS spec step 3 treats undefined separator
+  //   as returning a single-element array of the whole string (not splitting at all).
+  // - 1 arg → no limit (sentinel 0x7fffffff = MAX_I32).
+  // - 2 args → honour limit: 0 → [], N → at most N pieces.
+  bind('.split', (str, sep, limit) => {
+    if (sep === undefined) {
+      // split() → [str]: wrap the whole string in a 1-element array
+      inc('__wrap1')
+      return typed(['call', '$__wrap1', asI64(emit(str))], 'f64')
+    }
+    inc('__str_split')
+    const limitIR = limit === undefined
+      ? ['i32.const', 0x7fffffff]
+      : ['i32.trunc_sat_f64_u', asF64(emit(limit))]
+    return typed(['call', '$__str_split', asI64(emit(str)), asI64(emit(sep)), limitIR], 'f64')
+  })
+
+  // replace(search, replacement). When `replacement` is a function, replace the
+  // FIRST occurrence of the (string) search with ToString(fn(match)) — per spec a
+  // string search matches once and the callback receives the matched substring.
+  // (A regex search routes to `.string:replace` in the regex module, which also
+  // handles the /g loop.) Without a closure runtime we can't invoke the callback,
+  // so fall back to a clear error rather than silent data loss.
+  bind('.replace', (str, search, repl) => {
+    if (valTypeOf(repl) === VAL.CLOSURE) {
+      if (!ctx.closure?.call) err('.replace(search, fn): no closure runtime available for the callback form')
+      inc('__str_indexof', '__str_slice', '__str_concat', '__str_byteLen', '__to_str')
+      const s = temp('rps'), q = temp('rpq'), fnL = temp('rpf')
+      const idx = tempI32('rpi'), mlen = tempI32('rpm')
+      const sI64 = () => ['i64.reinterpret_f64', ['local.get', `$${s}`]]
+      const match = typed(['call', '$__str_slice', sI64(), ['local.get', `$${idx}`],
+        ['i32.add', ['local.get', `$${idx}`], ['local.get', `$${mlen}`]]], 'f64')
+      const repIR = ['call', '$__to_str', asI64(ctx.closure.call(typed(['local.get', `$${fnL}`], 'f64'), [match]))]
+      const head = typed(['call', '$__str_slice', sI64(), ['i32.const', 0], ['local.get', `$${idx}`]], 'f64')
+      const tail = typed(['call', '$__str_slice', sI64(),
+        ['i32.add', ['local.get', `$${idx}`], ['local.get', `$${mlen}`]],
+        ['call', '$__str_byteLen', sI64()]], 'f64')
+      return typed(['block', ['result', 'f64'],
+        ['local.set', `$${s}`, asF64(emit(str))],
+        ['local.set', `$${q}`, asF64(emit(search))],
+        ['local.set', `$${fnL}`, asF64(emit(repl))],
+        ['local.set', `$${mlen}`, ['call', '$__str_byteLen', ['i64.reinterpret_f64', ['local.get', `$${q}`]]]],
+        ['local.set', `$${idx}`, ['call', '$__str_indexof', sI64(), ['i64.reinterpret_f64', ['local.get', `$${q}`]], ['i32.const', 0]]],
+        ['if', ['result', 'f64'], ['i32.lt_s', ['local.get', `$${idx}`], ['i32.const', 0]],
+          ['then', ['local.get', `$${s}`]],
+          ['else', typed(['call', '$__str_concat',
+            asI64(typed(['call', '$__str_concat', asI64(head), repIR], 'f64')),
+            asI64(tail)], 'f64')]]], 'f64')
+    }
+    inc('__str_replace')
+    return typed(['call', '$__str_replace', asI64(emit(str)), asI64(emit(search)), asI64(emit(repl))], 'f64')
+  })
+  bind('.replaceAll', method('__str_replaceall', 'III'))
 
-  ctx.core.emit['.toLowerCase'] = (str) => {
+  const caseMethod = (lo, hi, delta) => (str) => {
     inc('__str_case')
-    return typed(['call', '$__str_case', asI64(emit(str)), ['i32.const', 65], ['i32.const', 90], ['i32.const', 32]], 'f64')
+    return typed(['call', '$__str_case', asI64(emit(str)), ['i32.const', lo], ['i32.const', hi], ['i32.const', delta]], 'f64')
   }
+  bind('.toUpperCase', caseMethod(97, 122, -32))
+  const _toLowerCase = caseMethod(65, 90, 32)
+  bind('.toLowerCase', _toLowerCase)
 
   // Locale-specific casing needs ICU/CLDR data. jz intentionally has no
   // runtime, so this follows the existing ASCII-only lowercase helper and
   // ignores optional locale arguments.
-  ctx.core.emit['.toLocaleLowerCase'] = ctx.core.emit['.toLowerCase']
+  bind('.toLocaleLowerCase', _toLowerCase)
+
+  const padMethod = (start) => (str, len, pad) => {
+    inc('__str_pad')
+    const vpad = pad != null ? asI64(emit(pad)) : ['i64.reinterpret_f64', mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT | 1, 32)]
+    return typed(['call', '$__str_pad', asI64(emit(str)), asI32(emit(len)), vpad, ['i32.const', start]], 'f64')
+  }
+  bind('.padStart', padMethod(1))
+  bind('.padEnd', padMethod(0))
 
   // Byte-wise variant of String.prototype.localeCompare. Returns -1/0/1 from
   // an unsigned byte-by-byte compare with shorter-string-sorts-first tiebreak.
@@ -1263,21 +1605,21 @@ export default (ctx) => {
   // the spec exactly; for non-ASCII it follows UTF-8 byte order, which is
   // codepoint order for well-formed strings — close enough for sort-stability
   // use cases, wrong for human-language collation.
-  ctx.core.emit['.localeCompare'] = method('__str_cmp', 'II', 'i32')
+  bind('.localeCompare', method('__str_cmp', 'II', 'i32'))
 
-  ctx.core.emit['.string:concat'] = (str, ...others) => {
+  bind('.string:concat', (str, ...others) => {
     inc('__str_concat')
     let result = asF64(emit(str))
     for (const other of others) result = typed(['call', '$__str_concat', ['i64.reinterpret_f64', result], asI64(emit(other))], 'f64')
     return result
-  }
+  })
 
   // A VAL.BOOL part rides the 0/1 carrier, so __to_str would render "1"/"0".
-  // emitBoolStr selects the interned "true"/"false" literal (constant-folded
+  // bool selects the interned "true"/"false" literal (constant-folded
   // when the operand is known); every other part goes through __to_str.
-  const partStrI64 = (p) => valTypeOf(p) === VAL.BOOL ? asI64(emitBoolStr(p)) : toStrI64(p, emit(p))
+  const partStrI64 = (p) => valTypeOf(p) === VAL.BOOL ? asI64(bool(p)) : toStrI64(p, emit(p))
 
-  ctx.core.emit['strcat'] = (...parts) => {
+  bind('strcat', (...parts) => {
     inc('__to_str', '__str_byteLen', '__alloc', '__mkptr', '__str_copy')
     if (!parts.length) return mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT, 0)
     if (parts.length === 1) return typed(['f64.reinterpret_i64', partStrI64(parts[0])], 'f64')
@@ -1311,29 +1653,33 @@ export default (ctx) => {
       ['then', mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT, 0)],
       ['else', ['block', ['result', 'f64'], ...alloc]]])
     return typed(['block', ['result', 'f64'], ...ir], 'f64')
-  }
-
-  ctx.core.emit['.padStart'] = (str, len, pad) => {
-    inc('__str_pad')
-    const vpad = pad != null ? asI64(emit(pad)) : ['i64.reinterpret_f64', mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT | 1, 32)]
-    return typed(['call', '$__str_pad', asI64(emit(str)), asI32(emit(len)), vpad, ['i32.const', 1]], 'f64')
-  }
-
-  ctx.core.emit['.padEnd'] = (str, len, pad) => {
-    inc('__str_pad')
-    const vpad = pad != null ? asI64(emit(pad)) : ['i64.reinterpret_f64', mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT | 1, 32)]
-    return typed(['call', '$__str_pad', asI64(emit(str)), asI32(emit(len)), vpad, ['i32.const', 0]], 'f64')
-  }
+  })
 
-  // .charAt(i) → 1-char string from char code at index i
-  ctx.core.emit['.charAt'] = (str, idx) => {
-    inc('__char_at')
-    const t = tempI32('ch')
-    // Get char code, create SSO string with 1 byte
+  // Shared: `$iLocal` in `[0, lenIR)` → a 1-byte SSO string of the char at that
+  // index; otherwise `oobIR`. Without the bounds check `__char_at` returns 0 for an
+  // out-of-range index, which would wrap to a bogus `"\x00"` string (charAt → "",
+  // at → undefined). `sLocal` is the receiver as an f64 local.
+  const charAtOr = (sLocal, iLocal, lenIR, oobIR) =>
+    ['if', ['result', 'f64'],
+      ['i32.and',
+        ['i32.ge_s', ['local.get', iLocal], ['i32.const', 0]],
+        ['i32.lt_s', ['local.get', iLocal], lenIR]],
+      ['then', mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT | 1,
+        ['call', '$__char_at', ['i64.reinterpret_f64', ['local.get', sLocal]], ['local.get', iLocal]])],
+      ['else', oobIR]]
+  const emptyStr = mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT, 0)
+
+  // .charAt(i) → 1-char string at index i, or "" when out of range (JS spec: no
+  // negative-index wraparound — a negative or >=length index yields "").
+  bind('.charAt', (str, idx) => {
+    inc('__char_at', '__str_byteLen')
+    const s = temp('cs'), i = tempI32('ci')
     return typed(['block', ['result', 'f64'],
-      ['local.set', `$${t}`, ['call', '$__char_at', asI64(emit(str)), asI32(emit(idx))]],
-      mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT | 1, ['local.get', `$${t}`])], 'f64')
-  }
+      ['local.set', `$${s}`, asF64(emit(str))],
+      ['local.set', `$${i}`, asI32(emit(idx))],
+      charAtOr(`$${s}`, `$${i}`,
+        ['call', '$__str_byteLen', ['i64.reinterpret_f64', ['local.get', `$${s}`]]], emptyStr)], 'f64')
+  })
 
   // .charCodeAt(i) → JS-spec char code: the UTF-16 code unit at `i`, or NaN
   // when `i` is out of range (`i < 0 || i >= length`). Result is f64 because
@@ -1342,32 +1688,50 @@ export default (ctx) => {
   // loop `while ((cc = s.charCodeAt(i++)) <= 32) {}` would never terminate
   // (`0 <= 32` is true, `NaN <= 32` is false). The narrower may re-narrow the
   // result to i32 where it can prove the index in-bounds.
-  ctx.core.emit['.charCodeAt'] = (str, idx) =>
-    typed(ctx.abi.string.ops.charCodeAt(asF64(emit(str)), asI32(emit(idx)), ctx, true), 'f64')
+  bind('.charCodeAt', (str, idx) =>
+    typed(ctx.abi.string.ops.charCodeAt(asF64(emit(str)), asI32(emit(idx)), ctx, true), 'f64'))
+
+  // String.prototype.codePointAt(i) — byte-indexed.
+  // jz strings are UTF-8 byte-arrays; `i` is a byte offset, not a UTF-16 code-unit
+  // index. For ASCII inputs (U+0000..U+007F) the result is the exact Unicode code
+  // point. For multi-byte sequences the result is the value of the leading byte only
+  // (not a full code-point decode). Out-of-range → undefined (NaN-boxed). This is a
+  // documented byte-semantics limitation; it keeps the implementation allocation-free
+  // and consistent with jz's byte-indexed string model throughout.
+  bind('.codePointAt', (str, idx) =>
+    typed(ctx.abi.string.ops.charCodeAt(asF64(emit(str)), asI32(emit(idx)), ctx, true), 'f64'))
 
   // String.fromCharCode(code) → 1-char SSO string
-  ctx.core.emit['String'] = (value) => {
+  bind('String', (value) => {
     if (value === undefined) return emit(['str', ''])
     if (valTypeOf(value) === VAL.STRING) return emit(value)
-    if (valTypeOf(value) === VAL.BOOL) return emitBoolStr(value)
+    if (valTypeOf(value) === VAL.BOOL) return bool(value)
     if (valTypeOf(value) === VAL.NUMBER) {
       inc('__ftoa')
       return typed(['call', '$__ftoa', asF64(emit(value)), ['i32.const', 0], ['i32.const', 0]], 'f64')
     }
     return typed(['f64.reinterpret_i64', toStrI64(value, emit(value))], 'f64')
-  }
+  })
 
-  ctx.core.emit['String.fromCharCode'] = (code) => {
-    if (code === undefined) return emit(['str', ''])
+  // String.fromCharCode(...codes) — variadic; each arg is ToUint16(ToNumber(code))
+  // → a 1-byte string, concatenated left to right (mirrors String.fromCodePoint).
+  bind('String.fromCharCode', (...codes) => {
+    if (codes.length === 0) return emit(['str', ''])
     // ToUint16(ToNumber(code)): `toNumF64` performs ToPrimitive on an object
     // argument, so a throwing valueOf/toString propagates per spec.
-    return mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT | 1, asI32(toNumF64(code, emit(code))))
-  }
+    const one = (node) => mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT | 1, asI32(toNumF64(node, emit(node))))
+    let r = one(codes[0])
+    for (let i = 1; i < codes.length; i++) {
+      inc('__str_concat_raw')
+      r = typed(['call', '$__str_concat_raw', asI64(r), asI64(one(codes[i]))], 'f64')
+    }
+    return r
+  })
 
   // String.fromCodePoint(cp) → UTF-8 encoded string for one code point.
   // Param is f64 (already ToNumber-coerced); throws RangeError ($__jz_err) when
   // the value is not an integer in [0, 0x10FFFF] (22.1.2.2 step 5.d).
-  ctx.core.stdlib['__fromCodePoint'] = `(func $__fromCodePoint (param $cpf f64) (result f64)
+  wat('__fromCodePoint', `(func $__fromCodePoint (param $cpf f64) (result f64)
     (local $cp i32) (local $off i32) (local $len i32)
     (if (i32.or
           (i32.or
@@ -1398,11 +1762,11 @@ export default (ctx) => {
         (i32.or (i32.const 0xF0) (i32.shr_u (local.get $cp) (i32.const 18)))
         (i32.shl (i32.or (i32.const 0x80) (i32.and (i32.shr_u (local.get $cp) (i32.const 12)) (i32.const 0x3F))) (i32.const 8)))
         (i32.shl (i32.or (i32.const 0x80) (i32.and (i32.shr_u (local.get $cp) (i32.const 6)) (i32.const 0x3F))) (i32.const 16)))
-        (i32.shl (i32.or (i32.const 0x80) (i32.and (local.get $cp) (i32.const 0x3F))) (i32.const 24))))))`
+        (i32.shl (i32.or (i32.const 0x80) (i32.and (local.get $cp) (i32.const 0x3F))) (i32.const 24))))))`)
 
   // String.fromCodePoint(...codePoints) — variadic; each arg is ToNumber-coerced
   // then validated/encoded by __fromCodePoint, results concatenated left to right.
-  ctx.core.emit['String.fromCodePoint'] = (...codes) => {
+  bind('String.fromCodePoint', (...codes) => {
     if (codes.length === 0) return emit(['str', ''])
     ctx.runtime.throws = true
     inc('__fromCodePoint')
@@ -1414,9 +1778,9 @@ export default (ctx) => {
       r = typed(['call', '$__str_concat_raw', asI64(r), asI64(one(codes[i]))], 'f64')
     }
     return r
-  }
+  })
 
-  ctx.core.stdlib['__encodeURIComponent'] = `(func $__encodeURIComponent (param $val i64) (result f64)
+  wat('__encodeURIComponent', `(func $__encodeURIComponent (param $val i64) (result f64)
     (local $str i64) (local $slen i32) (local $base i32) (local $out i32)
     (local $i i32) (local $j i32) (local $c i32) (local $hi i32) (local $lo i32)
     (local.set $str (call $__to_str (local.get $val)))
@@ -1458,24 +1822,24 @@ export default (ctx) => {
       (local.set $i (i32.add (local.get $i) (i32.const 1)))
       (br $loop)))
     (i32.store (local.get $base) (local.get $j))
-    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $out)))`
+    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $out)))`)
 
-  ctx.core.emit['encodeURIComponent'] = (value) => {
+  bind('encodeURIComponent', (value) => {
     inc('__encodeURIComponent')
     const input = value === undefined ? ['i64.const', UNDEF_NAN] : asI64(emit(value))
     return typed(['call', '$__encodeURIComponent', input], 'f64')
-  }
+  })
 
-  ctx.core.stdlib['__uri_hex'] = `(func $__uri_hex (param $c i32) (result i32)
+  wat('__uri_hex', `(func $__uri_hex (param $c i32) (result i32)
     (if (result i32) (i32.and (i32.ge_u (local.get $c) (i32.const 48)) (i32.le_u (local.get $c) (i32.const 57)))
       (then (i32.sub (local.get $c) (i32.const 48)))
       (else (if (result i32) (i32.and (i32.ge_u (local.get $c) (i32.const 65)) (i32.le_u (local.get $c) (i32.const 70)))
         (then (i32.sub (local.get $c) (i32.const 55)))
         (else (if (result i32) (i32.and (i32.ge_u (local.get $c) (i32.const 97)) (i32.le_u (local.get $c) (i32.const 102)))
           (then (i32.sub (local.get $c) (i32.const 87)))
-          (else (i32.const -1))))))))`
+          (else (i32.const -1))))))))`)
 
-  ctx.core.stdlib['__decodeURIComponent'] = `(func $__decodeURIComponent (param $v i64) (result f64)
+  wat('__decodeURIComponent', `(func $__decodeURIComponent (param $v i64) (result f64)
     (local $s i64) (local $len i32) (local $i i32)
     (local $base i32) (local $dst i32) (local $outLen i32)
     (local $c i32) (local $hi i32) (local $lo i32)
@@ -1551,38 +1915,40 @@ export default (ctx) => {
           (local.set $outLen (i32.add (local.get $outLen) (i32.const 1)))))
       (br $loop)))
     (i32.store (local.get $base) (local.get $outLen))
-    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $dst)))`
+    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $dst)))`)
 
-  ctx.core.emit['decodeURIComponent'] = (value) => {
+  bind('decodeURIComponent', (value) => {
     ctx.runtime.throws = true
     inc('__decodeURIComponent')
     return typed(['call', '$__decodeURIComponent',
       value === undefined ? ['i64.const', UNDEF_NAN] : asI64(emit(value))], 'f64')
-  }
+  })
 
-  // .at(i) → charAt with negative index support
-  ctx.core.emit['.string:at'] = (str, idx) => {
+  // .at(i) → 1-char string at index i with negative-index support, or undefined
+  // when out of range (JS spec: `i += length` for negative, then OOB → undefined).
+  bind('.string:at', (str, idx) => {
     inc('__char_at', '__str_byteLen')
-    const t = tempI32('at'), s = temp('as')
+    const t = tempI32('at'), s = temp('as'), len = tempI32('al')
     return typed(['block', ['result', 'f64'],
       ['local.set', `$${s}`, asF64(emit(str))],
+      ['local.set', `$${len}`, ['call', '$__str_byteLen', ['i64.reinterpret_f64', ['local.get', `$${s}`]]]],
       ['local.set', `$${t}`, asI32(emit(idx))],
       // Negative index: t += length
       ['if', ['i32.lt_s', ['local.get', `$${t}`], ['i32.const', 0]],
-        ['then', ['local.set', `$${t}`, ['i32.add', ['local.get', `$${t}`],
-          ['call', '$__str_byteLen', ['i64.reinterpret_f64', ['local.get', `$${s}`]]]]]]],
-      mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT | 1, ['call', '$__char_at', ['i64.reinterpret_f64', ['local.get', `$${s}`]], ['local.get', `$${t}`]])], 'f64')
-  }
+        ['then', ['local.set', `$${t}`, ['i32.add', ['local.get', `$${t}`], ['local.get', `$${len}`]]]]],
+      charAtOr(`$${s}`, `$${t}`, ['local.get', `$${len}`],
+        ['f64.reinterpret_i64', ['i64.const', UNDEF_NAN]])], 'f64')
+  })
 
   // .search(str) → indexOf (same as indexOf for string args)
-  ctx.core.emit['.search'] = (str, search) => {
+  bind('.search', (str, search) => {
     inc('__str_indexof')
     return typed(['f64.convert_i32_s', ['call', '$__str_indexof', asI64(emit(str)), asI64(emit(search)), ['i32.const', 0]]], 'f64')
-  }
+  })
 
   // .match(str) → [match] array if found, or 0 (null) if not
   // For string args, returns single-element array with the matched substring
-  ctx.core.emit['.match'] = (str, search) => {
+  bind('.match', (str, search) => {
     inc('__str_indexof', '__str_slice', '__wrap1')
     const s = temp('ms'), q = temp('mq'), idx = tempI32('mi')
     // indexOf, then if >= 0, create 1-element array with the match slice
@@ -1599,24 +1965,24 @@ export default (ctx) => {
               ['call', '$__str_slice', ['i64.reinterpret_f64', ['local.get', `$${s}`]],
                 ['local.get', `$${idx}`],
                 ['i32.add', ['local.get', `$${idx}`], ['call', '$__str_byteLen', ['i64.reinterpret_f64', ['local.get', `$${q}`]]]]]]]]]], 'f64')
-  }
+  })
 
   // __wrap1(val: i64) → f64 — create 1-element array [val]
-  ctx.core.stdlib['__wrap1'] = `(func $__wrap1 (param $val i64) (result f64)
+  wat('__wrap1', `(func $__wrap1 (param $val i64) (result f64)
     (local $ptr i32)
     (local.set $ptr (call $__alloc (i32.const 16)))
     (i32.store (local.get $ptr) (i32.const 1))
     (i32.store (i32.add (local.get $ptr) (i32.const 4)) (i32.const 1))
     (i64.store (i32.add (local.get $ptr) (i32.const 8)) (local.get $val))
-    (call $__mkptr (i32.const 1) (i32.const 0) (i32.add (local.get $ptr) (i32.const 8))))`
+    (call $__mkptr (i32.const 1) (i32.const 0) (i32.add (local.get $ptr) (i32.const 8))))`)
 
   // TextEncoder() / TextDecoder() → dummy values (methods do the work)
-  ctx.core.emit['TextEncoder'] = () => typed(['f64.const', 1], 'f64')
-  ctx.core.emit['TextDecoder'] = () => typed(['f64.const', 2], 'f64')
+  bind('TextEncoder', () => typed(['f64.const', 1], 'f64'))
+  bind('TextDecoder', () => typed(['f64.const', 2], 'f64'))
 
   // .encode(str) → Uint8Array of string's UTF-8 bytes
   // Copies bytes from string (SSO or heap) into a new Uint8Array
-  ctx.core.stdlib['__str_encode'] = `(func $__str_encode (param $str i64) (result f64)
+  wat('__str_encode', `(func $__str_encode (param $str i64) (result f64)
     (local $len i32) (local $dst i32)
     (local.set $len (call $__str_byteLen (local.get $str)))
     (local.set $dst (call $__alloc (i32.add (i32.const 8) (local.get $len))))
@@ -1624,15 +1990,20 @@ export default (ctx) => {
     (i32.store (i32.add (local.get $dst) (i32.const 4)) (local.get $len))
     (local.set $dst (i32.add (local.get $dst) (i32.const 8)))
     (call $__str_copy (local.get $str) (local.get $dst) (local.get $len))
-    (call $__mkptr (i32.const 3) (i32.const 1) (local.get $dst)))`
+    (call $__mkptr (i32.const 3) (i32.const 1) (local.get $dst)))`)
 
-  ctx.core.emit['.encode'] = (obj, str) => {
+  bind('.encode', (obj, str) => {
     inc('__str_encode')
+    // .encode() yields a runtime PTR.TYPED/u8 array (see __mkptr above). Downstream
+    // indexing/spread dispatch through __typed_idx, whose element-unaware fallback
+    // (f64.load, stride 8) is only valid when no typed array can flow in. Enabling
+    // the feature pulls the element-aware variant — same invariant `.length` follows.
+    ctx.features.typedarray = true
     return typed(['call', '$__str_encode', asI64(emit(str))], 'f64')
-  }
+  })
 
   // .decode(uint8arr) → string from byte data
-  ctx.core.stdlib['__bytes_decode'] = `(func $__bytes_decode (param $arr i64) (result f64)
+  wat('__bytes_decode', `(func $__bytes_decode (param $arr i64) (result f64)
     (local $off i32) (local $len i32) (local $dst i32)
     (local.set $off (call $__ptr_offset (local.get $arr)))
     (local.set $len (call $__len (local.get $arr)))
@@ -1640,10 +2011,10 @@ export default (ctx) => {
     (i32.store (local.get $dst) (local.get $len))
     (local.set $dst (i32.add (local.get $dst) (i32.const 4)))
     (memory.copy (local.get $dst) (local.get $off) (local.get $len))
-    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $dst)))`
+    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $dst)))`)
 
-  ctx.core.emit['.decode'] = (obj, arr) => {
+  bind('.decode', (obj, arr) => {
     inc('__bytes_decode')
     return typed(['call', '$__bytes_decode', asI64(emit(arr))], 'f64')
-  }
+  })
 }