jz 0.5.0 → 0.6.0

package/src/{compile.js → compile/index.js}

@@ -25,18 +25,20 @@
  * @module compile
  */
 
-import { parse as parseWat } from 'watr'
-import { ctx, err, inc, resolveIncludes, PTR, LAYOUT } from './ctx.js'
+import parseWat from 'watr/parse'
+import { ctx, err, inc, resolveIncludes, PTR, LAYOUT, declGlobal } from '../ctx.js'
+import { T, isBlockBody, isReassigned, refsName, REFS_IN_EXPR } from '../ast.js'
+import { intLiteralValue } from '../static.js'
 import {
-  T, VAL, analyzeBody,
-  unboxablePtrs, cseSafeLoadBases, typedElemAux, invalidateLocalsCache,
-  boxedCaptures, updateRep,
-  isBlockBody, analyzeStructInline,
+  analyzeBody, unboxablePtrs, cseSafeLoadBases, boxedCaptures,
+  analyzeStructInline, invalidateLocalsCache,
 } from './analyze.js'
+import { typedElemAux } from '../../layout.js'
+import { VAL, updateRep, REP_FIELDS } from '../reps.js'
 import { inferLocals } from './infer.js'
-import { optimizeFunc, treeshake } from './optimize.js'
-import { emit, emitter, emitFlat, emitBody } from './emit.js'
-import { emitCharDecompPrologue, JSS_IMPORT_SIGS } from './abi/string.js'
+import { optimizeFunc, treeshake } from '../optimize/index.js'
+import { emit, emitter, emitVoid, emitBlockBody } from './emit.js'
+import { emitCharDecompPrologue, JSS_IMPORT_SIGS } from '../abi/string.js'
 import {
   typed, asF64, asI32, asPtrOffset, asParamType, toI32, asI64, fromI64,
   NULL_NAN, UNDEF_NAN, NULL_WAT, UNDEF_WAT, NULL_IR, UNDEF_IR, nullExpr, undefExpr,
@@ -49,13 +51,13 @@ import {
   multiCount, loopTop, flat, reconstructArgsWithSpreads,
   valKindToPtr, findBodyStart, tcoTailRewrite,
   boolBoxIR,
-  I32_MIN, I32_MAX,
-} from './ir.js'
-import plan from './plan.js'
+  I32_MIN, I32_MAX, dollar,
+} from '../ir.js'
+import plan from './plan/index.js'
 import {
   buildStartFn, dedupClosureBodies, finalizeClosureTable,
   pullStdlib, syncImports, optimizeModule, stripStaticDataPrefix,
-} from './assemble.js'
+} from '../wat/assemble.js'
 
 // =============================================================================
 // Single-source export semantics
@@ -94,17 +96,18 @@ const isExported = f => {
   return false
 }
 
-/** Iterate JS-visible export names that resolve to `funcName`. Used to emit
- *  per-export ABI metadata in custom sections — one entry per JS-visible name,
- *  since the host (interop.js wrap) keys by export name. */
-function* exportNamesOf(funcName) {
+/** Collect JS-visible export names that resolve to `funcName` (as an array).
+ *  Used to emit per-export ABI metadata in custom sections — one entry per
+ *  JS-visible name, since the host (interop.js wrap) keys by export name. */
+function exportNamesOf(funcName) {
+  const names = []
   for (const [key, val] of Object.entries(ctx.func.exports)) {
-    if (val === true && key === funcName) yield key
-    else if (val === funcName) yield key
+    if ((val === true && key === funcName) || val === funcName) names.push(key)
   }
+  return names
 }
 
-const timePhase = (profiler, name, fn) => profiler ? profiler.time(name, fn) : fn()
+const timePhase = (profiler, name, fn) => profiler?.time ? profiler.time(name, fn) : fn()
 
 // Per-compile func name set + map live on ctx.func.names / ctx.func.map,
 // populated at compile() entry. Both reset by ctx.js reset() and re-filled here.
@@ -113,8 +116,7 @@ const timePhase = (profiler, name, fn) => profiler ? profiler.time(name, fn) : f
 // emit-calling ones (toBool, emitTypeofCmp, emitDecl, materializeMulti,
 // buildArrayWithSpreads) moved to src/emit.js.
 
-// AST-analysis primitives (staticObjectProps, paramReps lattice helpers,
-// infer* cross-call inference, collectProgramFacts) moved to src/analyze.js.
+// AST-analysis primitives live in kind.js, type.js, static.js, program-facts.js.
 
 /**
  * Boundary-wrap predicate: exports whose body-driven result OR any param narrowed
@@ -133,9 +135,62 @@ const isBoundaryWrapped = (func) => {
   // A boolean result rides the 0/1 number carrier internally; the export thunk
   // boxes it to the TRUE_NAN/FALSE_NAN atom so the host sees a real boolean.
   if (func.valResult === VAL.BOOL) return true
+  // A bigint result rides the i64-reinterpreted-f64 carrier internally; the export thunk converts
+  // it to a real Number so a JS host doesn't see raw i64 bits (`() => 100n` was returning 4.94e-322).
+  if (func.valResult === VAL.BIGINT) return true
   return func.sig.params.some(p => p.type !== 'f64' || p.ptrKind != null)
 }
 
+// Static-string intern index (the `internStrings` pass). Open-addressing table
+// over the deduped static string literals (5–32 bytes): [hash u32][ptr u32]
+// pairs appended to the data segment, FNV-1a matching __str_hash's heap branch.
+// __str_slice/__str_slice_view probe it so a runtime substring whose content
+// equals any source literal returns the CANONICAL static pointer — string
+// equality then short-circuits on bit-eq instead of walking bytes (a compiler
+// or parser compares each token against tag literals many times; ~25% of
+// self-host compile time was __str_eq/__eq/__str_hash volume). Built before
+// pullStdlib (the slice thunks emit the probe only when `__internBase` exists);
+// stripStaticDataPrefix shifts the stored ptr slots like every other static
+// reference. Misses cost one FNV + one probe per slice; the table is read-only.
+function buildInternTable() {
+  const cfg = ctx.transform.optimize
+  if (!cfg || cfg.internStrings === false) return
+  if (ctx.memory.shared || !ctx.runtime.dataDedup?.size) return
+  const enc = new TextEncoder()
+  const entries = []
+  for (const [str, off] of ctx.runtime.dataDedup) {
+    const b = enc.encode(str)
+    if (b.length < 5 || b.length > 32) continue
+    let h = 0x811c9dc5 | 0
+    for (let i = 0; i < b.length; i++) h = Math.imul(h ^ b[i], 0x01000193) | 0
+    if (h <= 1) h = (h + 2) | 0   // mirror __str_hash's empty/tombstone clamp
+    entries.push([h >>> 0, off + 8])
+  }
+  if (!entries.length) return
+  let size = 4
+  while (size < entries.length * 2) size = (size * 2) | 0
+  const mask = size - 1
+  const slots = new Uint32Array(size * 2)
+  for (let e = 0; e < entries.length; e++) {
+    const h = entries[e][0], off = entries[e][1]
+    let i = h & mask
+    while (slots[i * 2 + 1] !== 0) i = (i + 1) & mask
+    slots[i * 2] = h
+    slots[i * 2 + 1] = off
+  }
+  while (ctx.runtime.data.length % 8 !== 0) ctx.runtime.data += '\0'
+  const base = ctx.runtime.data.length
+  let s = ''
+  for (let i = 0; i < slots.length; i++) {
+    const v = slots[i]
+    s += String.fromCharCode(v & 0xFF, (v >>> 8) & 0xFF, (v >>> 16) & 0xFF, (v >>> 24) & 0xFF)
+  }
+  ctx.runtime.data += s
+  ctx.runtime.internTable = { base, size }
+  declGlobal('__internBase', 'i32', base, { mut: false })
+  declGlobal('__internMask', 'i32', mask, { mut: false })
+}
+
 const ensureThrowRuntime = (sec) => {
   // A pulled stdlib helper may throw $__jz_err even when no user `throw` set the
   // flag (e.g. __to_num on a Symbol). Detect it from the included stdlib bodies
@@ -147,7 +202,7 @@ const ensureThrowRuntime = (sec) => {
   if (!ctx.runtime.throws) return
 
   if (!ctx.scope.globals.has('__jz_last_err_bits'))
-    ctx.scope.globals.set('__jz_last_err_bits', '(global $__jz_last_err_bits (mut i64) (i64.const 0))')
+    declGlobal('__jz_last_err_bits', 'i64')
   if (!sec.tags.some(t => Array.isArray(t) && t[0] === 'tag' && t[1] === '$__jz_err'))
     sec.tags.push(['tag', '$__jz_err', ['param', 'f64']])
   if (!sec.tags.some(t => Array.isArray(t) && t[0] === 'export' && t[1] === '"__jz_last_err_bits"'))
@@ -181,13 +236,12 @@ const pruneUnusedThrowRuntime = (sec) => {
 const cloneRepMap = map => map ? new Map([...map].map(([k, v]) => [k, { ...v }])) : null
 
 /** Serialize a ValueRep entry into a plain object for inspect output.
- *  Omits undefined fields so consumers can JSON-stringify without noise. */
+ *  Omits undefined fields so consumers can JSON-stringify without noise.
+ *  Iterates REP_FIELDS (the closed shape in reps.js) so it can't drift. */
 const repView = (rep) => {
   if (!rep) return null
   const out = {}
-  for (const k of ['val', 'ptrKind', 'ptrAux', 'schemaId', 'intConst', 'intCertain', 'notString', 'arrayElemSchema', 'arrayElemValType', 'typedCtor', 'jsonShape', 'wasm']) {
-    if (rep[k] != null) out[k] = rep[k]
-  }
+  for (const k of REP_FIELDS) if (rep[k] != null) out[k] = rep[k]
   return Object.keys(out).length ? out : null
 }
 
@@ -230,18 +284,79 @@ function captureFuncInspect(func, facts, programFacts) {
   }
 }
 
+function scanAndTagNonEscapingClosures(body) {
+  if (!body) return
+  const onlyCalledNotReferenced = (node, name) => {
+    if (typeof node === 'string') return node !== name
+    if (!Array.isArray(node)) return true
+    const op = node[0]
+    if (op === 'str') return true
+    if (op === '=>') {
+      return !refsName(node[1], name, REFS_IN_EXPR) && !refsName(node[2], name, REFS_IN_EXPR)
+    }
+    if (op === '=' && node[1] === name) {
+      return onlyCalledNotReferenced(node[2], name)
+    }
+    if (op === '()' && node[1] === name) {
+      for (let i = 2; i < node.length; i++) {
+        if (!onlyCalledNotReferenced(node[i], name)) return false
+      }
+      return true
+    }
+    if (op === '.' || op === '?.') return onlyCalledNotReferenced(node[1], name)
+    if (op === ':') return onlyCalledNotReferenced(node[2], name)
+    for (let i = 1; i < node.length; i++) {
+      if (!onlyCalledNotReferenced(node[i], name)) return false
+    }
+    return true
+  }
+
+  const walk = (node) => {
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    if (op === 'let' || op === 'const') {
+      for (const decl of node.slice(1)) {
+        if (Array.isArray(decl) && decl[0] === '=' && typeof decl[1] === 'string') {
+          const name = decl[1]
+          const init = decl[2]
+          if (Array.isArray(init) && init[0] === '=>') {
+            const arrow_body = init[2]
+            if (arrow_body && typeof arrow_body === 'object' && !ctx.func.boxed?.has(name) && !isGlobal(name) && !isReassigned(body, name) && onlyCalledNotReferenced(body, name)) {
+              arrow_body._nonEscaping = name
+            }
+          }
+        }
+      }
+    } else if (op === '=' && typeof node[1] === 'string' && Array.isArray(node[2]) && node[2][0] === '=>') {
+      const name = node[1]
+      const init = node[2]
+      const arrow_body = init[2]
+      if (arrow_body && typeof arrow_body === 'object' && !ctx.func.boxed?.has(name) && !isGlobal(name) && !isReassigned(body, name) && onlyCalledNotReferenced(body, name)) {
+        arrow_body._nonEscaping = name
+      }
+    }
+    for (let i = 1; i < node.length; i++) walk(node[i])
+  }
+  walk(body)
+}
+
 // Reset per-function emit-frame state — the single source of frame entry.
 // `emitFunc`, `analyzeFuncForEmit`, and `emitClosureBody` all route through
 // here. Top-level funcs start `uniq` at 0; closures pass a higher base so
 // their synthetic labels can't collide with the parent frame's.
 function enterFunc(sig, body, { uniq = 0, directClosures = null } = {}) {
   ctx.func.stack = []
+  ctx.func.maybeNullish = new Set()   // bindings assigned a nullish literal → coerce in arithmetic (null-flow)
+  ctx.func.pendingLabel = null        // label awaiting its loop, for `continue <label>`
   ctx.func.uniq = uniq
   ctx.func.current = sig
   ctx.func.body = body
   ctx.func.directClosures = directClosures
   ctx.func.localProps = null
   ctx.func.charDecomp = null
+  if (ctx.transform.optimize) {
+    scanAndTagNonEscapingClosures(body)
+  }
 }
 
 // Allocate + null-init a heap cell for every boxed local that isn't seeded
@@ -288,6 +403,27 @@ function analyzeFuncForEmit(func, programFacts) {
       if (r.intConst != null) updateRep(pname, { intConst: r.intConst })
     }
   }
+  // Trust numeric export params. An exported f64 param used only in numeric
+  // positions is marked VAL.NUMBER so its uses skip the `__to_num` coercion
+  // entirely (not just hoist it). External callers reach jz through interop's
+  // `mem.wrapVal`, which passes a JS number straight to f64 — so the coercion
+  // only ever fired for a *string* arg to a numeric param (a type misuse). When
+  // that lone coercion is the only `__to_num` consumer, dropping it lets the whole
+  // ToNumber string-parse dep tree (`__to_str`→`__itoa`/`__toExp`/`__mkstr`/…)
+  // treeshake away — a ~4× module shrink that, decisively, lets V8 tier the hot
+  // fill loop up properly (the bloated module JITs the *identical* loop ~2× slower).
+  if (func.exported && block) {
+    for (const p of sig.params) {
+      if (p.type === 'f64' && p.ptrKind == null && !p.jsstring
+          && !func.defaults?.[p.name] && !ctx.func.boxed?.has(p.name)
+          && !ctx.func.localReps?.get(p.name)?.val
+          && paramAllUsesNumeric(body, p.name))
+        updateRep(p.name, { val: VAL.NUMBER })
+    }
+  }
+  if (block) {
+    seedLocalIntConsts(body)
+  }
   // Drop any earlier-cached analyzeBody.locals slice for this body —
   // narrowSignatures called it before our pre-seed, when params still had no
   // inferred VAL.TYPED, so the cached widths reflect the pre-narrow state.
@@ -295,6 +431,9 @@ function analyzeFuncForEmit(func, programFacts) {
   invalidateLocalsCache(body)
   const bodyFacts = block ? analyzeBody(body) : null
   ctx.func.locals = bodyFacts ? bodyFacts.locals : new Map()
+  if (bodyFacts?.valTypes) {
+    for (const [name, vt] of bodyFacts.valTypes) updateRep(name, { val: vt })
+  }
   // Proven uint32 accumulator locals — readVar tags reads `.unsigned` so the
   // f64 round-trip widens with convert_i32_u (not _s).
   if (bodyFacts?.unsignedLocals) for (const n of bodyFacts.unsignedLocals) updateRep(n, { unsigned: true })
@@ -351,6 +490,9 @@ function analyzeFuncForEmit(func, programFacts) {
     if (p.ptrAux != null) fields.ptrAux = p.ptrAux
     updateRep(p.name, fields)
   }
+  for (const p of sig.params) {
+    if (p.jsstring) updateRep(p.name, { carrier: 'jsstring', val: VAL.STRING })
+  }
 
   // CSE-safe load bases — pointer locals whose memory reads `cseScalarLoad`
   // may scalar-replace. Computed last: needs every `let`/param ptrKind in place.
@@ -358,10 +500,23 @@ function analyzeFuncForEmit(func, programFacts) {
     ? cseSafeLoadBases(body, ctx.func.locals, ctx.func.localReps)
     : new Set()
 
+  // Closure-capture narrowing: a boxed var whose every defining RHS — owner
+  // body AND nested arrows, the narrower's intCertain contract — is integer-
+  // valued keeps its CELL in i32, so readVar/writeVar skip the f64↔i32
+  // round-trip per access. Params are excluded: their cell is seeded from the
+  // raw f64 param value, which would desync an i32-read cell. Same asm.js-style
+  // range contract as plain intCertain locals.
+  const cellTypes = new Set()
+  for (const name of ctx.func.boxed.keys()) {
+    if (sig.params.some(p => p.name === name)) continue
+    if (ctx.func.localReps?.get(name)?.intCertain === true) cellTypes.add(name)
+  }
+
   return {
     block,
     locals: new Map(ctx.func.locals),
     boxed: new Map(ctx.func.boxed),
+    cellTypes,
     flatObjects: new Map(ctx.func.flatObjects),
     sliceViews: new Set(ctx.func.sliceViews),
     cseLoadBases,
@@ -370,6 +525,156 @@ function analyzeFuncForEmit(func, programFacts) {
   }
 }
 
+function seedLocalIntConsts(body) {
+  const walk = (node) => {
+    if (!Array.isArray(node)) return
+    const [op, ...args] = node
+    if (op === '=>') return
+    if (op === 'let' || op === 'const') {
+      for (const decl of args) {
+        if (!Array.isArray(decl) || decl[0] !== '=' || typeof decl[1] !== 'string') continue
+        const value = intLiteralValue(decl[2])
+        if (value != null && !isReassigned(body, decl[1])) updateRep(decl[1], { intConst: value })
+      }
+      return
+    }
+    for (const arg of args) walk(arg)
+  }
+  walk(body)
+}
+
+// ── Loop-invariant exported-param coercion hoist ────────────────────────────
+//
+// An exported numeric param arrives as a NaN-box (jz's value ABI), so each use
+// in an arithmetic context emits `__to_num(p)`. When the param is never
+// reassigned and *every* use is an unconditional-ToNumber arithmetic operand,
+// the coercion is loop-invariant: do it once at entry and let every use read the
+// already-unboxed f64. This flips a serial recurrence like the de Jong attractor
+// (4 `__to_num`/iter × millions) from ~parity to a clear win over V8.
+//
+// Self-gating: the rewrite only fires when the emitted body ALREADY contains
+// `__to_num(p)` calls — meaning the helper is loaded for other reasons (global
+// typed-array assigns, strings, …). A provably-numeric program (`(a,b)=>a*b`)
+// never loads the helper, has no pattern to match, and is left byte-for-byte
+// alone, preserving the minimal-bundle / golden-size guarantee.
+
+// `=`/`+=`/`++`/… targets — reassigning the param breaks the coerce-once premise.
+const PARAM_REASSIGN_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=',
+  '^=', '>>=', '<<=', '>>>=', '||=', '&&=', '??=', '++', '--'])
+// Binary ops that unconditionally ToNumber BOTH operands, so a bare param operand
+// is a pure numeric use. `+` is excluded (may concatenate); comparisons / `===`
+// are excluded (they branch on type, never coerce a string operand to number).
+const NUM_BIN_OPS = new Set(['*', '/', '%', '**', '&', '|', '^', '<<', '>>', '>>>'])
+
+/** True iff every use of param `name` in `body` is an unconditional-numeric
+ *  operand, so coercing it to a number once at entry is observationally exact.
+ *  Rejects conservatively: reassignment and any appearance outside a numeric
+ *  operator (member/index/call-arg/return/compare/concat). Two transparencies:
+ *   - copy aliases: `let x = name` makes `x` carry the same value, so `x`'s uses
+ *     must be numeric too (fixpoint-collected). Catches `let T = t` then `…T…`.
+ *   - captured closures: a non-shadowing inner arrow captures the binding by
+ *     reference, so its body's uses count — we recurse instead of rejecting.
+ *     Catches floatbeat helpers `let s=(f)=>…t…` that read the param numerically. */
+function paramAllUsesNumeric(body, name) {
+  if (body == null) return false
+  // Fixpoint-collect copy aliases: `let/const x = <name-or-alias>`.
+  const names = new Set([name])
+  for (let grew = true; grew;) {
+    grew = false
+    const collect = (node) => {
+      if (!Array.isArray(node)) return
+      if ((node[0] === 'let' || node[0] === 'const') && node.length === 2
+          && Array.isArray(node[1]) && node[1][0] === '=' && typeof node[1][1] === 'string'
+          && typeof node[1][2] === 'string' && names.has(node[1][2]) && !names.has(node[1][1])) {
+        names.add(node[1][1]); grew = true
+      }
+      for (let i = 1; i < node.length; i++) collect(node[i])
+    }
+    collect(body)
+  }
+  let ok = true
+  const walk = (node) => {
+    if (!ok) return
+    if (typeof node === 'string') { if (names.has(node)) ok = false; return }  // bare use → reject
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    // single `let/const x = init`: x is a binding (not a use). A pure copy of an
+    // alias is consumed (already in `names`); otherwise the init must be numeric.
+    if ((op === 'let' || op === 'const') && node.length === 2
+        && Array.isArray(node[1]) && node[1][0] === '=' && typeof node[1][1] === 'string') {
+      const init = node[1][2]
+      if (typeof init === 'string' && names.has(init)) return
+      walk(init)
+      return
+    }
+    if (op === '=>') {                                  // closure capture: recurse unless shadowed
+      const ps = node[1]
+      const shadowed = Array.isArray(ps)
+        ? ps.some(p => names.has(p) || (Array.isArray(p) && names.has(p[1])))
+        : names.has(ps)
+      if (!shadowed) { walk(node[1]); walk(node[2]) }   // defaults + body; param names aren't in `names`
+      return
+    }
+    if (PARAM_REASSIGN_OPS.has(op) && names.has(node[1])) { ok = false; return }
+    if (NUM_BIN_OPS.has(op) && node.length === 3) {     // numeric binary: operands are ToNumber'd
+      if (!names.has(node[1])) walk(node[1])
+      if (!names.has(node[2])) walk(node[2])
+      return
+    }
+    if (op === '-' && node.length === 2) { if (!names.has(node[1])) walk(node[1]); return }  // unary negate
+    if (op === '-' && node.length === 3) { if (!names.has(node[1])) walk(node[1]); if (!names.has(node[2])) walk(node[2]); return }
+    // `u-`/`u+` are the normalized unary minus/plus (prepare rewrites `-x`/`+x`); both ToNumber.
+    if ((op === 'u-' || op === 'u+') && node.length === 2) { if (!names.has(node[1])) walk(node[1]); return }
+    if (op === '+' && node.length === 2) { if (!names.has(node[1])) walk(node[1]); return }  // unary + = ToNumber
+    if (op === '~' && node.length === 2) { if (!names.has(node[1])) walk(node[1]); return }
+    for (let i = 1; i < node.length; i++) walk(node[i])  // bare param reaching here → rejected above
+  }
+  walk(body)
+  return ok
+}
+
+/** Hoist each eligible param's `__to_num` coercion to a single entry `local.set`,
+ *  rewriting per-use calls in `stmts` to a bare typed `local.get`. Mutates
+ *  `stmts` in place; returns the prologue inits to splice ahead of the body.
+ *  Only fires for params whose coercion appears inside a loop (or ≥2×) — a lone
+ *  straight-line coercion isn't worth the rebind. */
+function hoistInvariantParamCoercions(stmts, func) {
+  const inits = []
+  const defaults = func.defaults || {}
+  for (const p of func.sig.params) {
+    if (p.type !== 'f64' || p.ptrKind != null || p.jsstring) continue
+    if (ctx.func.boxed?.has(p.name)) continue
+    if (p.name in defaults) continue
+    if (!paramAllUsesNumeric(func.body, p.name)) continue
+    const pat = (n) => Array.isArray(n) && n[0] === 'call' && n[1] === '$__to_num'
+      && Array.isArray(n[2]) && n[2][0] === 'i64.reinterpret_f64'
+      && Array.isArray(n[2][1]) && n[2][1][0] === 'local.get' && n[2][1][1] === `$${p.name}`
+    let total = 0, inLoop = 0
+    const count = (node, depth) => {
+      if (!Array.isArray(node)) return
+      const d = node[0] === 'loop' ? depth + 1 : depth
+      for (let i = 1; i < node.length; i++) {
+        if (pat(node[i])) { total++; if (d > 0) inLoop++ }
+        else count(node[i], d)
+      }
+    }
+    for (const s of stmts) count(s, 0)
+    if (total === 0 || (inLoop === 0 && total < 2)) continue
+    const strip = (node) => {
+      if (!Array.isArray(node)) return
+      for (let i = 1; i < node.length; i++) {
+        if (pat(node[i])) node[i] = typed(['local.get', `$${p.name}`], 'f64')
+        else strip(node[i])
+      }
+    }
+    for (const s of stmts) strip(s)
+    inits.push(['local.set', `$${p.name}`,
+      typed(['call', '$__to_num', ['i64.reinterpret_f64', typed(['local.get', `$${p.name}`], 'f64')]], 'f64')])
+    inc('__to_num')
+  }
+  return inits
+}
+
 /**
  * Phase: emit one user function to WAT IR.
  *
@@ -390,6 +695,7 @@ function emitFunc(func, funcFacts, programFacts) {
   const block = funcFacts.block
   ctx.func.locals = new Map(funcFacts.locals)
   ctx.func.boxed = new Map(funcFacts.boxed)
+  ctx.func.cellTypes = new Set(funcFacts.cellTypes)
   ctx.func.flatObjects = new Map(funcFacts.flatObjects)
   ctx.func.sliceViews = new Set(funcFacts.sliceViews)
   ctx.func.localReps = cloneRepMap(funcFacts.localReps)
@@ -431,7 +737,7 @@ function emitFunc(func, funcFacts, programFacts) {
   // Boundary-wrapped exports also defer the attribute to the synthesized
   // wrapper ($${name}$exp) that reboxes the narrowed result back to f64.
   if (exported && !isBoundaryWrapped(func)) fn.push(['export', `"${name}"`])
-  fn.push(...sig.params.map(p => ['param', `$${p.name}`, p.type]))
+  fn.push(...sig.params.map(p => ['param', dollar(p.name), p.type]))
   fn.push(...sig.results.map(t => ['result', t]))
 
   // Default params: ES spec says default applies only when arg is `undefined`
@@ -497,9 +803,11 @@ function emitFunc(func, funcFacts, programFacts) {
   }
 
   if (block) {
-    const stmts = emitBody(body)
+    const stmts = emitBlockBody(body)
+    // Hoist loop-invariant `__to_num(param)` coercions to a single entry rebind.
+    const numCoerceInits = hoistInvariantParamCoercions(stmts, func)
     const paramInits = collectParamInits()
-    for (const [l, t] of ctx.func.locals) fn.push(['local', `$${l}`, t])
+    for (const [l, t] of ctx.func.locals) fn.push(['local', dollar(l), t])
     // I: Skip trailing fallback when last statement is return (unreachable code)
     const lastStmt = stmts.at(-1)
     const endsWithReturn = lastStmt && (lastStmt[0] === 'return' || lastStmt[0] === 'return_call')
@@ -510,16 +818,16 @@ function emitFunc(func, funcFacts, programFacts) {
     const fallthrough = endsWithReturn ? []
       : sig.results.length === 1 && sig.results[0] === 'f64' ? [undefExpr()]
       : sig.results.map(t => [`${t}.const`, 0])
-    fn.push(...paramInits, ...boxedParamInits, ...preboxedLocalInits, ...stmts, ...fallthrough)
+    fn.push(...paramInits, ...boxedParamInits, ...preboxedLocalInits, ...numCoerceInits, ...stmts, ...fallthrough)
   } else if (multi && body[0] === '[') {
     const values = body.slice(1).map(e => asF64(emit(e)))
     const paramInits = collectParamInits()
-    for (const [l, t] of ctx.func.locals) fn.push(['local', `$${l}`, t])
+    for (const [l, t] of ctx.func.locals) fn.push(['local', dollar(l), t])
     fn.push(...paramInits, ...boxedParamInits, ...preboxedLocalInits, ...values)
   } else {
     const ir = emit(body)
     const paramInits = collectParamInits()
-    for (const [l, t] of ctx.func.locals) fn.push(['local', `$${l}`, t])
+    for (const [l, t] of ctx.func.locals) fn.push(['local', dollar(l), t])
     const finalIR = sig.ptrKind != null ? asPtrOffset(ir, sig.ptrKind) : asParamType(ir, sig.results[0])
     fn.push(...paramInits, ...boxedParamInits, ...preboxedLocalInits, tcoTailRewrite(finalIR, sig.results[0]))
   }
@@ -560,17 +868,17 @@ function synthesizeBoundaryWrappers() {
   for (const func of ctx.func.list) {
     if (!isBoundaryWrapped(func)) continue
     const { name, sig } = func
-    // Per-position i64 carrier: only swap to i64 where a NaN-boxed pointer
-    // actually crosses the boundary (param.ptrKind set, or result with
-    // sig.ptrKind set). Numeric narrowing (i32 trunc-sat / convert) keeps f64
-    // so callers seeing the raw export get a plain Number for numerics.
-    // jsstring params bypass both i64 and f64 — they flow as externref end-to-end.
-    const paramI64 = sig.params.map(p => p.ptrKind != null)
-    // A VAL.BOOL result is boxed to a NaN-box atom here, so it crosses as i64
-    // (same carrier as a pointer result), even though the inner func returns the
-    // plain 0/1 number carrier.
+    // Quiet NaN-box ABI: every boundary value is f64. A number is a plain f64; a
+    // tagged value (heap pointer, null/undef/bool atom) is an f64 whose quiet-NaN
+    // (0x7FF8…) payload carries the tag. Quiet-NaN payloads are preserved across the
+    // JS↔wasm call boundary by every real engine (and non-JS hosts don't canonicalize
+    // at all), so no i64 carrier is needed — the wasm signature is self-describing
+    // (f64 everywhere) and a consumer discriminates a tagged value by the NaN prefix.
+    // Env requirement: a non-canonicalizing NaN boundary. To support a canonicalizing
+    // engine, a per-position i64 carrier would re-enter here (param/result type i64 +
+    // `i64.reinterpret_f64`) plus a `jz:i64exp` section for interop.js.
     const resultBool = func.valResult === VAL.BOOL && sig.ptrKind == null
-    const resultI64 = sig.ptrKind != null || resultBool
+    const resultBigint = func.valResult === VAL.BIGINT && sig.ptrKind == null
     // Inline `(export ...)` attribute only when the func decl carried the
     // inline-export keyword (`export function foo`). For re-exports
     // (`function foo; export { foo as bar }`) the `name` is the *internal*
@@ -580,19 +888,17 @@ function synthesizeBoundaryWrappers() {
     const wrapNode = func.exported
       ? ['func', `$${name}$exp`, ['export', `"${name}"`]]
       : ['func', `$${name}$exp`]
-    sig.params.forEach((p, i) => {
-      const t = p.jsstring ? 'externref' : (paramI64[i] ? 'i64' : 'f64')
-      wrapNode.push(['param', `$${p.name}`, t])
+    // jsstring params flow as externref end-to-end; every other boundary value is f64.
+    sig.params.forEach((p) => {
+      wrapNode.push(['param', `$${p.name}`, p.jsstring ? 'externref' : 'f64'])
     })
-    wrapNode.push(['result', resultI64 ? 'i64' : 'f64'])
-    const args = sig.params.map((p, i) => {
+    wrapNode.push(['result', resultBigint ? 'i64' : 'f64'])
+    const args = sig.params.map((p) => {
       const get = ['local.get', `$${p.name}`]
       // jsstring: externref flows through unchanged — inner func also takes externref.
       if (p.jsstring) return get
-      if (p.ptrKind != null) {
-        // ptrKind: i64 carrier carries NaN-box bits → wrap to i32 offset
-        return ['i32.wrap_i64', get]
-      }
+      // ptrKind param: the f64 NaN-box carries the pointer — extract the i32 offset.
+      if (p.ptrKind != null) return ['i32.wrap_i64', ['i64.reinterpret_f64', get]]
       if (p.type === 'f64') return get
       // Numeric narrowing: f64 → i32 truncate
       return ['i32.trunc_sat_f64_s', get]
@@ -603,17 +909,26 @@ function synthesizeBoundaryWrappers() {
       const ptrType = valKindToPtr(sig.ptrKind)
       body = mkPtrIR(ptrType, sig.ptrAux ?? 0, callIR)
     } else if (resultBool) {
-      // boolBoxIR's truthy extraction depends on the carrier type, so the bare
-      // call node must declare it (f64 0/1, or i32 when the result narrowed).
-      body = boolBoxIR(typed(callIR, sig.results[0]))   // 0/1 carrier → TRUE_NAN/FALSE_NAN atom
+      // The inner func returns a clean 0/1 boolean carrier — never NaN. The i32
+      // carrier already takes truthyIR's identity path; the f64 carrier would
+      // otherwise fall through to the full __is_truthy NaN-discrimination, every
+      // arm of which is dead for a boolean. Pull the bit out with one f64.ne so
+      // boolBoxIR boxes `4|bit` straight into the TRUE_NAN/FALSE_NAN atom.
+      const carrier = sig.results[0] === 'i32'
+        ? typed(callIR, 'i32')
+        : typed(['f64.ne', callIR, ['f64.const', 0]], 'i32')
+      body = boolBoxIR(carrier)
+    } else if (resultBigint) {
+      // BigInt rides the i64-reinterpret-f64 carrier internally; expose the raw i64 at the JS
+      // boundary so the host receives a real, lossless BigInt (wasm i64 <-> JS BigInt). Internal
+      // callers use `$name` (the f64 carrier) untouched; only the `$exp` export result is i64.
+      body = ['i64.reinterpret_f64', callIR]
     } else if (sig.results[0] === 'i32') {
       body = [sig.unsignedResult ? 'f64.convert_i32_u' : 'f64.convert_i32_s', callIR]
     } else {
       body = callIR
     }
-    wrapNode.push(resultI64 ? ['i64.reinterpret_f64', body] : body)
-    func._exportUsesI64 = resultI64 || paramI64.some(Boolean)
-    func._exportI64Sig = { params: paramI64, result: resultI64 }
+    wrapNode.push(body)
     // Track externref param positions so interop.js can pass JS values
     // raw (skipping `mem.wrapVal`) at those slots. Today this only fires
     // for `jsstring`-tagged params; future externref carriers wire here too.
@@ -649,6 +964,7 @@ function emitClosureBody(cb) {
   ctx.func.localReps = null
   if (cb.intConsts) for (const [name, v] of cb.intConsts) updateRep(name, { intConst: v })
   if (cb.intCertain) for (const name of cb.intCertain) updateRep(name, { intCertain: true })
+  if (cb.nullables) for (const name of cb.nullables) updateRep(name, { nullable: true })
   if (cb.valTypes) for (const [name, vt] of cb.valTypes) updateRep(name, { val: vt })
   if (cb.schemaVars) {
     ctx.schema.vars = new Map([...prevSchemaVars, ...cb.schemaVars])
@@ -664,6 +980,9 @@ function emitClosureBody(cb) {
   }
   // In closure bodies, boxed captures use the original name as both var and cell local
   ctx.func.boxed = cb.boxed ? new Map([...cb.boxed].map(v => [v, v])) : new Map()
+  // i32-narrowed cells: the owner decided the cell width (funcFacts.cellTypes);
+  // every body sharing the cell must read/write it at that width.
+  ctx.func.cellTypes = new Set(cb.cellI32 || [])
   const parentBoxedCaptures = new Set(cb.boxed || [])
   ctx.func.preboxed = new Set()
   // Bare `;`-sequence bodies (no enclosing `{}`) reach us when callers built a
@@ -693,6 +1012,19 @@ function emitClosureBody(cb) {
 
   // Params are locals, assigned directly from inline slots
   for (const p of cb.params) ctx.func.locals.set(p, 'f64')
+  // Mark params that every direct call site passed a number (seeded by
+  // tryDirectClosureCall) VAL.NUMBER — their body uses then skip the __to_num
+  // coercion. All direct calls were emitted before this body (module end), so the
+  // lattice is complete; a `false`/unobserved slot leaves the param boxed.
+  const ptRow = ctx.closure.paramTypes?.get(cb.name)
+  // A param numeric at every call site is typed NUMBER so its body uses skip __to_num. If some
+  // call omits it (index ≥ minArgc) it can hold UNDEF_NAN, so also flag it nullable — that keeps
+  // the boxing win yet stops `x === undefined` mis-folding to false (it bit-compares instead).
+  const minArgc = ctx.closure.minArgc?.get(cb.name) ?? 0
+  if (ptRow) for (let i = 0; i < cb.params.length; i++) {
+    if (ptRow[i] === true && !ctx.func.localReps?.get(cb.params[i])?.val)
+      updateRep(cb.params[i], i < minArgc ? { val: VAL.NUMBER } : { val: VAL.NUMBER, nullable: true })
+  }
 
   // Register captured variable locals: boxed = i32 cell pointer, otherwise f64 value
   for (let i = 0; i < cb.captures.length; i++) {
@@ -726,7 +1058,7 @@ function emitClosureBody(cb) {
       ctx.func.locals.set(name, 'i32')
       updateRep(name, fields)
     }
-    bodyIR = emitBody(cb.body)
+    bodyIR = emitBlockBody(cb.body)
   } else {
     bodyIR = [asF64(emit(cb.body))]
   }
@@ -734,13 +1066,15 @@ function emitClosureBody(cb) {
   // Pre-allocate cache locals for env unpacking
   const envBase = cb.captures.length > 0 ? `${T}envBase${ctx.func.uniq++}` : null
   if (envBase) ctx.func.locals.set(envBase, 'i32')
-  // Rest param: allocate helper locals (len + offset) before emitting decls
-  let restOff, restLen
+  // Rest param: allocate helper locals (len + offset + spill loop index) before emitting decls
+  let restOff, restLen, restIdx
   if (cb.rest) {
     restOff = `${T}restOff${ctx.func.uniq++}`
     restLen = `${T}restLen${ctx.func.uniq++}`
+    restIdx = `${T}restIdx${ctx.func.uniq++}`
     ctx.func.locals.set(restOff, 'i32')
     ctx.func.locals.set(restLen, 'i32')
+    ctx.func.locals.set(restIdx, 'i32')
     inc('__alloc_hdr', '__mkptr')
   }
 
@@ -777,7 +1111,7 @@ function emitClosureBody(cb) {
     }
   }
 
-  for (const [l, t] of ctx.func.locals) fn.push(['local', `$${l}`, t])
+  for (const [l, t] of ctx.func.locals) fn.push(['local', dollar(l), t])
 
   // Load captures from env: boxed → i32.load (raw cell pointer), immutable → f64.load value.
   // env is the CLOSURE pointer (PTR.CLOSURE) — never an ARRAY, no forwarding chain.
@@ -814,20 +1148,20 @@ function emitClosureBody(cb) {
     }
   }
 
-  // Rest param: pack slots a[fixedParams..argc-1] into fresh array.
-  // len = clamp(argc - fixedParams, 0, restSlots). Rest-param closures receive
-  // at most (width - fixedParams) rest args — spread callers with
-  // more dynamic elements lose the overflow (documented limitation).
+  // Rest param: pack args a[fixedParams..argc-1] into a fresh array.
+  // len = max(argc - fixedParams, 0). The first `restSlots = width - fixedParams`
+  // come from the inline arg slots; any overflow (argc > width, only reachable via a
+  // spread call) is read straight from the caller's full args array, whose offset the
+  // spread path published in $__closure_spill. This gives unbounded variadic arity.
   if (cb.rest) {
     const fixedN = fixedParamN
     const restSlots = W - fixedN
+    declGlobal('__closure_spill', 'i32')
     fn.push(['local.set', `$${restLen}`,
       ['select',
         ['i32.sub', ['local.get', '$__argc'], ['i32.const', fixedN]],
         ['i32.const', 0],
         ['i32.gt_s', ['local.get', '$__argc'], ['i32.const', fixedN]]]])
-    fn.push(['if', ['i32.gt_s', ['local.get', `$${restLen}`], ['i32.const', restSlots]],
-      ['then', ['local.set', `$${restLen}`, ['i32.const', restSlots]]]])
     fn.push(['local.set', `$${restOff}`,
       ['call', '$__alloc_hdr',
         ['local.get', `$${restLen}`], ['local.get', `$${restLen}`]]])
@@ -837,6 +1171,21 @@ function emitClosureBody(cb) {
           ['i32.add', ['local.get', `$${restOff}`], ['i32.const', i * 8]],
           ['local.get', `$__a${fixedN + i}`]]]])
     }
+    // Overflow beyond the inline slots: copy args[width..argc-1] from the spill array
+    // (set by the spread-call site). rest[i] = spill[(fixedN+i)*8] for i in [restSlots, restLen).
+    const rid = ctx.func.uniq++
+    fn.push(['if', ['i32.gt_s', ['local.get', `$${restLen}`], ['i32.const', restSlots]],
+      ['then',
+        ['local.set', `$${restIdx}`, ['i32.const', restSlots]],
+        ['block', `$restEnd${rid}`,
+          ['loop', `$restLoop${rid}`,
+            ['br_if', `$restEnd${rid}`, ['i32.ge_s', ['local.get', `$${restIdx}`], ['local.get', `$${restLen}`]]],
+            ['f64.store',
+              ['i32.add', ['local.get', `$${restOff}`], ['i32.mul', ['local.get', `$${restIdx}`], ['i32.const', 8]]],
+              ['f64.load', ['i32.add', ['global.get', '$__closure_spill'],
+                ['i32.mul', ['i32.add', ['local.get', `$${restIdx}`], ['i32.const', fixedN]], ['i32.const', 8]]]]],
+            ['local.set', `$${restIdx}`, ['i32.add', ['local.get', `$${restIdx}`], ['i32.const', 1]]],
+            ['br', `$restLoop${rid}`]]]]])
     const restValue = ['call', '$__mkptr', ['i32.const', PTR.ARRAY], ['i32.const', 0], ['local.get', `$${restOff}`]]
     if (boxedParamNames.has(cb.rest)) {
       fn.push(
@@ -866,6 +1215,9 @@ function emitClosureBody(cb) {
  * @returns {Array} Complete WASM module as S-expression
  */
 export default function compile(ast, profiler) {
+  // Contract: callers (jzCompileInner / scripts/self.js compileSelf) must set
+  // ctx.transform.optimize before reaching here — every optimize-gated pass below
+  // reads `cfg && cfg.x === false`, so a null cfg silently runs every pass.
   // Populate known function names + lookup map on ctx.func for direct call detection
   ctx.func.names.clear()
   ctx.func.map.clear()
@@ -891,7 +1243,7 @@ export default function compile(ast, profiler) {
 
   // Check user globals don't conflict with runtime globals (modules loaded after user decls)
   for (const name of ctx.scope.userGlobals)
-    if (!ctx.scope.globals.get(name)?.includes('mut f64'))
+    if (!(ctx.scope.globals.get(name)?.mut && ctx.scope.globals.get(name)?.type === 'f64'))
       err(`'${name}' conflicts with a compiler internal — choose a different name`)
 
   // Pre-fold const globals: evaluate constant initializers before function compilation
@@ -903,6 +1255,12 @@ export default function compile(ast, profiler) {
   if (ast) {
     const evalConst = n => {
       if (typeof n === 'number') return n
+      // A reference to an already-folded integer const (`const NEW = CALL + 1`):
+      // resolve it from constInts so const-referencing-const initializers fold too.
+      // Without this they stay unfolded → decl defaults to 0 AND emitDecl skips the
+      // (const) runtime init → the binding reads 0 (e.g. subscript's NEW=CALL+1 → the
+      // `new` keyword registers with precedence 0 and never dispatches).
+      if (typeof n === 'string') return ctx.scope.constInts?.get(n) ?? null
       if (Array.isArray(n) && n[0] == null && typeof n[1] === 'number') return n[1]
       if (!Array.isArray(n)) return null
       const [op, a, b] = n
@@ -922,27 +1280,35 @@ export default function compile(ast, profiler) {
       : Array.isArray(n) && n[0] === 'const' ? [n] : []
     const stmts = [...topStmts(ast)]
     for (const mi of ctx.module.moduleInits || []) stmts.push(...topStmts(mi))
-    for (const s of stmts) {
-      if (!Array.isArray(s) || s[0] !== 'const') continue
-      for (const decl of s.slice(1)) {
-        if (!Array.isArray(decl) || decl[0] !== '=' || typeof decl[1] !== 'string') continue
-        const [, name, init] = decl
-        if (!ctx.scope.globals.has(name) || !ctx.scope.consts?.has(name)) continue
-        const v = evalConst(init)
-        if (v == null || !isFinite(v)) continue
-        const isInt = Number.isInteger(v) && v >= I32_MIN && v <= I32_MAX
-        ctx.scope.globals.set(name, isInt
-          ? `(global $${name} i32 (i32.const ${v}))`
-          : `(global $${name} f64 (f64.const ${v}))`)
-        ctx.scope.globalTypes.set(name, isInt ? 'i32' : 'f64')
-        // Cache integer values for cross-call const-arg propagation: `f(N)` where
-        // `const N = 8` should observe the param as intConst=8.
-        if (isInt) (ctx.scope.constInts ||= new Map()).set(name, v)
+    // Fixpoint: a const may reference one declared later or in another module
+    // (`NEW = CALL + 1`). Each pass folds every now-resolvable initializer (its refs
+    // already in constInts); repeat until none change so order/cross-module refs resolve.
+    const foldedDecls = new Set()
+    let changed = true
+    while (changed) {
+      changed = false
+      for (const s of stmts) {
+        if (!Array.isArray(s) || s[0] !== 'const') continue
+        for (const decl of s.slice(1)) {
+          if (!Array.isArray(decl) || decl[0] !== '=' || typeof decl[1] !== 'string') continue
+          const [, name, init] = decl
+          if (foldedDecls.has(name)) continue
+          if (!ctx.scope.globals.has(name) || !ctx.scope.consts?.has(name)) continue
+          const v = evalConst(init)
+          if (v == null || !isFinite(v)) continue
+          foldedDecls.add(name)
+          changed = true
+          const isInt = Number.isInteger(v) && v >= I32_MIN && v <= I32_MAX
+          declGlobal(name, isInt ? 'i32' : 'f64', v, { mut: false })
+          // Cache integer values for cross-call const-arg propagation: `f(N)` where
+          // `const N = 8` should observe the param as intConst=8.
+          if (isInt) (ctx.scope.constInts ||= new Map()).set(name, v)
+        }
       }
     }
   }
 
-  const programFacts = timePhase(profiler, 'plan', () => plan(ast))
+  const programFacts = timePhase(profiler, 'plan', () => plan(ast, profiler))
 
   // Inspect sink: editor hosts opt in via { inspect: true } to read inferred shapes.
   // Initialized here (post-plan) so paramReps and schema.list are stable, populated
@@ -950,28 +1316,30 @@ export default function compile(ast, profiler) {
   if (ctx.transform.inspect) ctx.inspect = { functions: {}, schemas: ctx.schema.list.map(s => s.slice()) }
 
   const funcFacts = new Map()
-  for (const func of ctx.func.list) {
-    if (func.raw) continue
-    const facts = analyzeFuncForEmit(func, programFacts)
-    funcFacts.set(func, facts)
-    captureFuncInspect(func, facts, programFacts)
-  }
+  timePhase(profiler, 'analyzeFuncs', () => {
+    for (const func of ctx.func.list) {
+      if (func.raw) continue
+      const facts = analyzeFuncForEmit(func, programFacts)
+      funcFacts.set(func, facts)
+      captureFuncInspect(func, facts, programFacts)
+    }
+  })
   // Whole-program SRoA: pick the schemas whose `Array<S>` instances use the
   // `structInline` carrier. Runs once the per-function reps have settled (they
   // are codegen truth) and before any function is emitted.
-  analyzeStructInline(funcFacts, programFacts)
-  const funcs = ctx.func.list.map(func => emitFunc(func, funcFacts.get(func), programFacts))
+  timePhase(profiler, 'structInline', () => analyzeStructInline(funcFacts, programFacts))
+  const funcs = timePhase(profiler, 'emitFuncs', () => ctx.func.list.map(func => emitFunc(func, funcFacts.get(func), programFacts)))
   funcs.push(...synthesizeBoundaryWrappers())
 
   const closureFuncs = []
   let compiledBodyCount = 0
-  const compilePendingClosures = () => {
+  const compilePendingClosures = () => timePhase(profiler, 'emitClosures', () => {
     const bodies = ctx.closure.bodies || []
     for (let bodyIndex = compiledBodyCount; bodyIndex < bodies.length; bodyIndex++) {
       closureFuncs.push(emitClosureBody(bodies[bodyIndex]))
     }
     compiledBodyCount = bodies.length
-  }
+  })
   compilePendingClosures()
 
   // `wasm:js-string` imports — drained from `ctx.core.jsstring`, one
@@ -1055,7 +1423,15 @@ export default function compile(ast, profiler) {
   if (ctx.closure.table?.length)
     sec.elem.push(['elem', ['i32.const', 0], 'func', ...ctx.closure.table.map(n => `$${n}`)])
 
-  buildStartFn(ast, sec, closureFuncs, compilePendingClosures)
+  timePhase(profiler, 'buildStart', () => buildStartFn(ast, sec, closureFuncs, compilePendingClosures))
+
+  // Host globals (globalThis/process/WebAssembly/…) referenced as values are
+  // recorded in ctx.core.hostGlobals during emit; register them as env imports
+  // now (assembly owns ctx.module.imports). Drained after buildStartFn so a
+  // host global first used in a top-level statement (emitted into __start) is
+  // captured; syncImports below merges them into sec.imports.
+  for (const name of ctx.core.hostGlobals)
+    ctx.module.imports.push(['import', '"env"', `"${name}"`, ['global', `$${name}`, 'i64']])
 
   syncImports(sec)
 
@@ -1063,16 +1439,22 @@ export default function compile(ast, profiler) {
 
   finalizeClosureTable(sec)
 
-  pullStdlib(sec)
+  buildInternTable()
+
+  timePhase(profiler, 'pullStdlib', () => pullStdlib(sec))
 
   stripStaticDataPrefix(sec)
 
   ensureThrowRuntime(sec)
 
-  optimizeModule(sec)
+  timePhase(profiler, 'optimizeModule', () => optimizeModule(sec, profiler))
 
-  // Populate globals (after __start — const folding may update declarations)
-  sec.globals.push(...[...ctx.scope.globals.values()].filter(g => g).map(g => parseWat(g)))
+  // Populate globals (after __start — const folding may update declarations).
+  // Records build IR directly — no WAT-text parse-back.
+  sec.globals.push(...[...ctx.scope.globals].filter(([, g]) => g).map(([n, g]) => ['global', `$${n}`,
+    ...(g.export ? [['export', `"${g.export}"`]] : []),
+    g.mut ? ['mut', g.type] : g.type,
+    [`${g.type}.const`, g.init]]))
 
   // Data segments (after emit — string literals append to ctx.runtime.data / strPool during emit)
   // Active segment at address 0 — skipped for shared memory (would collide across modules)
@@ -1124,26 +1506,6 @@ export default function compile(ast, profiler) {
   if (restParamFuncs.length)
     sec.customs.push(['@custom', '"jz:rest"', `"${JSON.stringify(restParamFuncs).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`])
 
-  // Custom section: per-export i64 ABI map. Each entry describes an export
-  // whose boundary wrapper carries NaN-boxed pointers via i64 (rather than
-  // f64) to dodge V8's NaN canonicalization. Format: { name, p, r } where p
-  // is an array of i64 param indices and r is 1 if result is i64. host.js
-  // wrap() reinterprets BigInt↔f64 at i64 positions; numeric f64 positions
-  // stay as Numbers on the JS side.
-  const i64Exports = []
-  for (const f of ctx.func.list) {
-    if (!isExported(f) || !isBoundaryWrapped(f) || !f._exportUsesI64) continue
-    const p = []
-    f._exportI64Sig.params.forEach((b, i) => { if (b) p.push(i) })
-    const r = f._exportI64Sig.result ? 1 : 0
-    // One entry per JS-visible export name (inline + non-aliased + aliased
-    // re-exports). `exportNamesOf` yields every name that resolves to f —
-    // wrap() looks up by export name, not by internal symbol.
-    for (const exportName of exportNamesOf(f.name)) i64Exports.push({ name: exportName, p, r })
-  }
-  if (i64Exports.length)
-    sec.customs.push(['@custom', '"jz:i64exp"', `"${JSON.stringify(i64Exports).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`])
-
   // Custom section: per-export externref param positions. interop.js reads
   // this to pass JS arguments straight through at those positions (no
   // `mem.wrapVal`, no SSO encoding). Format: { name, p, d? } where p lists
@@ -1158,12 +1520,22 @@ export default function compile(ast, profiler) {
     f._exportExtParams.forEach((b, i) => {
       if (!b) return
       p.push(i)
-      if (typeof b === 'object' && b.def != null) d[i] = b.def
+      // String-key the index: object property keys are conceptually strings (JSON renders
+      // `{"0":…}` either way), and the self-host kernel's objects don't enumerate a numeric
+      // key — `d[0]=…` stores but Object.keys(d) misses it, so the `d` map would read empty
+      // and the default never reach the jz:extparam section. Same coercion as the optimize
+      // LEVEL_PRESETS lookup. (Native is unaffected: numeric keys auto-stringify.)
+      if (typeof b === 'object' && b.def != null) d[String(i)] = b.def
     })
     if (!p.length) continue
-    const entry = { name: '', p }
-    if (Object.keys(d).length) entry.d = d
-    for (const exportName of exportNamesOf(f.name)) extExports.push({ ...entry, name: exportName })
+    // Build each export entry as a direct literal — no `entry.d = d` after the fact and no
+    // `{...entry, name}` spread. The self-host kernel's fixed-schema objects don't enumerate
+    // a key added to a non-empty literal (JSON.stringify/spread would silently drop a post-hoc
+    // `d`), and spreading a 3-key literal mis-resolves the merged schema there. Constructing
+    // the final shape directly sidesteps both.
+    const hasDefaults = Object.keys(d).length > 0
+    for (const exportName of exportNamesOf(f.name))
+      extExports.push(hasDefaults ? { name: exportName, p, d } : { name: exportName, p })
   }
   if (extExports.length)
     sec.customs.push(['@custom', '"jz:extparam"', `"${JSON.stringify(extExports).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`])