jz 0.5.1 → 0.7.0

package/module/array.js

@@ -8,11 +8,15 @@
  * @module array
  */
 
-import { typed, asF64, asI64, asI32, NULL_NAN, UNDEF_NAN, temp, tempI32, allocPtr, multiCount, arrayLoop, elemLoad, elemStore, truthyIR, extractF64Bits, appendStaticSlots, mkPtrIR, slotAddr, isLiteralStr, resolveValType, undefExpr } from '../src/ir.js'
-import { emit, buildArrayWithSpreads } from '../src/emit.js'
-import { valTypeOf, lookupValType, lookupNotString, VAL, extractParams, updateRep, staticPropertyKey, staticObjectProps, inlineArraySid } from '../src/analyze.js'
+import { typed, asF64, asI64, asI32, NULL_NAN, UNDEF_NAN, temp, tempI32, allocPtr, multiCount, arrayLoop, elemLoad, elemStore, truthyIR, extractF64Bits, appendStaticSlots, mkPtrIR, slotAddr, isLiteralStr, resolveValType, undefExpr, ptrTypeEq } from '../src/ir.js'
+import { inBoundsArrIdx } from '../src/type.js'
+import { emit, spread, deps, idx as emitIndex } from '../src/bridge.js'
+import { valTypeOf } from '../src/kind.js'
+import { extractParams, classifyParam, ASSIGN_OPS, refsName, REFS_IN_EXPR } from '../src/ast.js'
+import { staticPropertyKey, staticObjectProps, inlineArraySid, staticIndexKey } from '../src/static.js'
+import { VAL, lookupValType, lookupNotString, updateRep } from '../src/reps.js'
 import { structInline } from '../src/abi/index.js'
-import { ctx, inc, err, PTR, LAYOUT } from '../src/ctx.js'
+import { ctx, inc, err, warnDeopt, PTR, LAYOUT, followForwardingWat } from '../src/ctx.js'
 import { strHashLiteral } from './collection.js'
 
 
@@ -22,17 +26,23 @@ function allocArray(len, cap) {
   return { local: a.local, setup: [a.init], ptr: a.ptr }
 }
 
-/** Pack literal i64 slots as a static ARRAY: writes [len][cap][slots...] into the data segment
- *  and returns a folded ARRAY pointer to the first slot. */
-function staticArrayPtr(slots) {
+/** Pack literal i64 slots as a static ARRAY into the data segment, returning a
+ *  folded ARRAY pointer to the first slot. The 16-byte header MUST match
+ *  __alloc_hdr (core.js): a zeroed dyn-props word at off-16, then len/cap at
+ *  off-8/-4. Heap arrays get that props word zeroed for free; a static array with
+ *  only an 8-byte header left off-16 pointing at adjacent data-segment bytes, so
+ *  for-in / named-prop lookup (which read off-16 as the props-sidecar pointer)
+ *  walked garbage → OOB (test262 built-ins/Object/keys sparse-array). */
+export function staticArrayPtr(slots) {
   if (!ctx.runtime.data) ctx.runtime.data = ''
   while (ctx.runtime.data.length % 8 !== 0) ctx.runtime.data += '\0'
   const headerOff = ctx.runtime.data.length
   const len = slots.length
-  const hdr = new Uint8Array(8); new DataView(hdr.buffer).setInt32(0, len, true); new DataView(hdr.buffer).setInt32(4, len, true)
-  for (let i = 0; i < 8; i++) ctx.runtime.data += String.fromCharCode(hdr[i])
+  const hdr = new Uint8Array(16); const dv = new DataView(hdr.buffer)
+  dv.setInt32(8, len, true); dv.setInt32(12, len, true)  // off-8: len, off-4: cap (props word at 0..7 stays 0)
+  for (let i = 0; i < 16; i++) ctx.runtime.data += String.fromCharCode(hdr[i])
   appendStaticSlots(slots)
-  return mkPtrIR(PTR.ARRAY, 0, headerOff + 8)
+  return mkPtrIR(PTR.ARRAY, 0, headerOff + 16)
 }
 
 function hoistArrayValue(arr) {
@@ -94,16 +104,8 @@ function substExpr(node, mapping) {
   return out
 }
 
-// Check whether a name is referenced inside a pure expression body.
-// Mirrors substExpr's traversal — skips property names on '.'/'?.' and object keys on ':'.
 function exprUses(node, name) {
-  if (typeof node === 'string') return node === name
-  if (!Array.isArray(node)) return false
-  const op = node[0]
-  if (op === '.' || op === '?.') return exprUses(node[1], name)
-  if (op === ':') return exprUses(node[2], name)
-  for (let i = 1; i < node.length; i++) if (exprUses(node[i], name)) return true
-  return false
+  return refsName(node, name, REFS_IN_EXPR)
 }
 
 // Callback factory: returns { setup, call, usedParams } where call(argExprs) emits the invocation.
@@ -239,26 +241,32 @@ const headerPropsToGlobalIR = () => needsArrayDynMove() ? `
             (global.set $__dyn_props (local.get $root)))))) ` : ''
 
 export default (ctx) => {
-  Object.assign(ctx.core.stdlibDeps, {
-    __arr_idx: [],
+  deps({
+    __arr_idx: ['__ptr_offset_fwd'],
     __arr_grow: arrayGrowDeps(false),
     __arr_grow_known: arrayGrowDeps(true),
     __arr_shift: () => [
       '__ptr_offset',
       ...(needsArrayDynMove() ? ['__dyn_move', '__hash_new', '__ihash_set_local'] : []),
     ],
+    __arr_fill: ['__ptr_offset'],
     __arr_set_idx_ptr: ['__arr_grow', '__ptr_offset'],
     __arr_push1: ['__arr_grow_known', '__ptr_offset'],
+    __arr_set_length: ['__arr_grow_known', '__ptr_offset', '__ptr_type'],
     __arr_unshift: ['__arr_grow', '__len', '__ptr_offset'],
+    __arr_splice: ['__arr_grow', '__len', '__ptr_offset', '__alloc_hdr', '__mkptr'],
     __typed_idx: () => ctx.features.typedarray || ctx.features.external
-      ? ['__len']
-      : ['__len', '__ptr_offset'],
+      ? ['__len', '__ptr_offset_fwd']
+      : ['__len', '__ptr_offset', '__ptr_offset_fwd'],
+    __arr_idx_known: ['__ptr_offset_fwd'],
   })
 
-  // Iteration methods (.map/.filter/.reduce/.forEach/...) invoke callbacks with
-  // (item, idx) internally — closure width must accommodate arity 2 even if no
-  // source-level closure has that arity.
-  ctx.closure.floor = Math.max(ctx.closure.floor ?? 0, 2)
+  // Iteration methods invoke callbacks with an implicit trailing index: .map/
+  // .filter/.forEach pass (item, idx); .reduce/.reduceRight pass (acc, item, idx).
+  // The uniform closure width must accommodate the widest of these (arity 3) even
+  // when no source-level closure declares that arity — otherwise a reduce callback
+  // routed through the closure path overflows the call_indirect signature.
+  ctx.closure.floor = Math.max(ctx.closure.floor ?? 0, 3)
 
   inc('__ptr_offset', '__ptr_type', '__len', '__set_len', '__typed_idx', '__is_truthy')
 
@@ -268,7 +276,7 @@ export default (ctx) => {
     const t = temp('t')
     return typed(['i32.and',
       ['f64.ne', ['local.tee', `$${t}`, v], ['local.get', `$${t}`]],
-      ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${t}`]]], ['i32.const', PTR.ARRAY]]], 'i32')
+      ptrTypeEq(['local.get', `$${t}`], PTR.ARRAY)], 'i32')
   }
 
   ctx.core.emit['new.Array'] = (len) => {
@@ -298,13 +306,7 @@ export default (ctx) => {
       (then (f64.const nan:${UNDEF_NAN}))
       (else
         (local.set $off (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK}))))
-        (block $done
-          (loop $follow
-            (br_if $done (i32.lt_u (local.get $off) (i32.const 8)))
-            (br_if $done (i32.gt_u (local.get $off) (i32.shl (memory.size) (i32.const 16))))
-            (br_if $done (i32.ne (i32.load (i32.sub (local.get $off) (i32.const 4))) (i32.const -1)))
-            (local.set $off (i32.load (i32.sub (local.get $off) (i32.const 8))))
-            (br $follow)))
+        ${followForwardingWat('$off', { lowGuard: true })}
         (if (result f64)
           (i32.and
             (i32.ge_u (local.get $off) (i32.const 8))
@@ -317,13 +319,7 @@ export default (ctx) => {
   ctx.core.stdlib['__arr_idx_known'] = `(func $__arr_idx_known (param $ptr i64) (param $i i32) (result f64)
     (local $off i32)
     (local.set $off (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK}))))
-    (block $done
-      (loop $follow
-        (br_if $done (i32.lt_u (local.get $off) (i32.const 8)))
-        (br_if $done (i32.gt_u (local.get $off) (i32.shl (memory.size) (i32.const 16))))
-        (br_if $done (i32.ne (i32.load (i32.sub (local.get $off) (i32.const 4))) (i32.const -1)))
-        (local.set $off (i32.load (i32.sub (local.get $off) (i32.const 8))))
-        (br $follow)))
+    ${followForwardingWat('$off', { lowGuard: true })}
     (if (result f64)
       (i32.and
         (i32.ge_u (local.get $off) (i32.const 8))
@@ -357,12 +353,7 @@ export default (ctx) => {
     ;; ARRAY fast path: follow forwarding inline, bounds-check against header len, f64.load — no $__len call.
     (if (i32.and (i32.eq (local.get $t) (i32.const ${PTR.ARRAY})) (i32.ge_u (local.get $off) (i32.const 8)))
       (then
-        (block $done
-          (loop $follow
-            (br_if $done (i32.gt_u (local.get $off) (i32.shl (memory.size) (i32.const 16))))
-            (br_if $done (i32.ne (i32.load (i32.sub (local.get $off) (i32.const 4))) (i32.const -1)))
-            (local.set $off (i32.load (i32.sub (local.get $off) (i32.const 8))))
-            (br $follow)))
+        ${followForwardingWat('$off', { lowGuard: false })}
         (return (if (result f64)
           (i32.and (i32.ge_s (local.get $i) (i32.const 0)) (i32.lt_u (local.get $i) (i32.load (i32.sub (local.get $off) (i32.const 8)))))
           (then (f64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3)))))
@@ -433,7 +424,7 @@ export default (ctx) => {
     const op = n[0]
     if (op == null) return true                // [null,x] literal — null/number/bigint
     if (op === '=>') return false              // arrow function — callable
-    if (op === '{}' || op === 'str' || op === 'strcat' || op === '//') return true
+    if (op === '{}' || op === 'str' || op === 'strcat' || op === '//' || op === 'bool') return true  // object/string/regexp/boolean literal
     if (op === '[]' && n.length < 3) return true            // array literal
     if (op === '()' && n[1] === 'Symbol') return true       // Symbol(...) result
     return false                               // calls / member access — unknown
@@ -515,11 +506,14 @@ export default (ctx) => {
 
   // Grow array if capacity insufficient. Returns (possibly new) NaN-boxed pointer.
   // Old storage is left behind as a forwarding header so existing aliases keep
-  // seeing the current backing store after growth.
-  ctx.core.stdlib['__arr_grow'] = () => `(func $__arr_grow (param $ptr i64) (param $minCap i32) (result f64)
-    (local $t i32) (local $off i32) (local $oldCap i32) (local $newCap i32) (local $newOff i32) (local $len i32)
+  // seeing the current backing store after growth. `defensive` adds a type/bounds
+  // guard (non-array ptr → fresh 4-cap buffer) for untyped call sites; the `_known`
+  // variant skips it for hot paths that already proved the receiver is an array.
+  // Single source of truth: both stdlib entries share the grow/relocate tail.
+  const arrGrow = (name, defensive) => `(func $${name} (param $ptr i64) (param $minCap i32) (result f64)
+    ${defensive ? '(local $t i32) ' : ''}(local $off i32) (local $oldCap i32) (local $newCap i32) (local $newOff i32) (local $len i32)
     ${needsArrayDynMove() ? '(local $oldProps f64)' : ''}
-    (local.set $t (call $__ptr_type (local.get $ptr)))
+    ${defensive ? `(local.set $t (call $__ptr_type (local.get $ptr)))
     (local.set $off (call $__ptr_offset (local.get $ptr)))
     ;; Defensive path: invalid/non-array pointer -> create fresh array buffer.
     (if
@@ -529,7 +523,7 @@ export default (ctx) => {
       (then
         (local.set $newCap (select (local.get $minCap) (i32.const 4) (i32.gt_s (local.get $minCap) (i32.const 4))))
         (local.set $newOff (call $__alloc_hdr (i32.const 0) (local.get $newCap)))
-        (return (call $__mkptr (i32.const ${PTR.ARRAY}) (i32.const 0) (local.get $newOff)))))
+        (return (call $__mkptr (i32.const ${PTR.ARRAY}) (i32.const 0) (local.get $newOff)))))` : `(local.set $off (call $__ptr_offset (local.get $ptr)))`}
     (local.set $oldCap (i32.load (i32.sub (local.get $off) (i32.const 4))))
     (if (i32.ge_s (local.get $oldCap) (local.get $minCap))
       (then (return (f64.reinterpret_i64 (local.get $ptr)))))
@@ -546,25 +540,8 @@ export default (ctx) => {
     (i32.store (i32.sub (local.get $off) (i32.const 4)) (i32.const -1))
     (call $__mkptr (i32.const ${PTR.ARRAY}) (i32.const 0) (local.get $newOff)))`
 
-  ctx.core.stdlib['__arr_grow_known'] = () => `(func $__arr_grow_known (param $ptr i64) (param $minCap i32) (result f64)
-    (local $off i32) (local $oldCap i32) (local $newCap i32) (local $newOff i32) (local $len i32)
-    ${needsArrayDynMove() ? '(local $oldProps f64)' : ''}
-    (local.set $off (call $__ptr_offset (local.get $ptr)))
-    (local.set $oldCap (i32.load (i32.sub (local.get $off) (i32.const 4))))
-    (if (i32.ge_s (local.get $oldCap) (local.get $minCap))
-      (then (return (f64.reinterpret_i64 (local.get $ptr)))))
-    (local.set $newCap (select
-      (local.get $minCap)
-      (i32.shl (local.get $oldCap) (i32.const 1))
-      (i32.gt_s (local.get $minCap) (i32.shl (local.get $oldCap) (i32.const 1)))))
-    (local.set $len (i32.load (i32.sub (local.get $off) (i32.const 8))))
-    (local.set $newOff (call $__alloc_hdr (local.get $len) (local.get $newCap)))
-    (memory.copy (local.get $newOff) (local.get $off) (i32.shl (local.get $len) (i32.const 3)))
-    ${headerPropsCopyIR()}
-    ${maybeDynMoveIR()}
-    (i32.store (i32.sub (local.get $off) (i32.const 8)) (local.get $newOff))
-    (i32.store (i32.sub (local.get $off) (i32.const 4)) (i32.const -1))
-    (call $__mkptr (i32.const ${PTR.ARRAY}) (i32.const 0) (local.get $newOff)))`
+  ctx.core.stdlib['__arr_grow'] = () => arrGrow('__arr_grow', true)
+  ctx.core.stdlib['__arr_grow_known'] = () => arrGrow('__arr_grow_known', false)
 
   // Hot for arr[i] = val (~18M calls in watr self-host). Compute base via __ptr_offset
   // once and read len from the inline header (i32.load base-8) — avoids __len's separate
@@ -609,6 +586,37 @@ export default (ctx) => {
     (i32.store (i32.sub (local.get $base) (i32.const 8)) (i32.add (local.get $len) (i32.const 1)))
     (local.get $p))`
 
+  // arr.length = N. Truncation (N ≤ len) just rewrites the len word in place — no
+  // relocation, so aliases keep their pointer. Growth past capacity relocates via
+  // __arr_grow_known (old header forward-marked) and undefined-fills the new slots,
+  // matching JS sparse-array semantics. Non-ARRAY receivers are left unchanged so a
+  // mistyped `.length =` cannot corrupt object/collection headers. Returns the
+  // (possibly relocated) pointer; the assignment's value is N (computed at the call site).
+  ctx.core.stdlib['__arr_set_length'] = `(func $__arr_set_length (param $ptr i64) (param $n i32) (result f64)
+    (local $base i32) (local $p f64) (local $oldLen i32) (local $cap i32) (local $k i32)
+    (local.set $p (f64.reinterpret_i64 (local.get $ptr)))
+    (if (i32.ne (call $__ptr_type (local.get $ptr)) (i32.const ${PTR.ARRAY}))
+      (then (return (local.get $p))))
+    (if (i32.lt_s (local.get $n) (i32.const 0)) (then (local.set $n (i32.const 0))))
+    (local.set $base (call $__ptr_offset (local.get $ptr)))
+    (if (i32.lt_u (local.get $base) (i32.const 8)) (then (return (local.get $p))))
+    (local.set $oldLen (i32.load (i32.sub (local.get $base) (i32.const 8))))
+    (local.set $cap (i32.load (i32.sub (local.get $base) (i32.const 4))))
+    (if (i32.gt_s (local.get $n) (local.get $cap))
+      (then
+        (local.set $p (call $__arr_grow_known (local.get $ptr) (local.get $n)))
+        (local.set $base (call $__ptr_offset (i64.reinterpret_f64 (local.get $p))))))
+    (if (i32.gt_u (local.get $n) (local.get $oldLen))
+      (then
+        (local.set $k (local.get $oldLen))
+        (block $fdone (loop $fill
+          (br_if $fdone (i32.ge_u (local.get $k) (local.get $n)))
+          (i64.store (i32.add (local.get $base) (i32.shl (local.get $k) (i32.const 3))) (i64.const ${UNDEF_NAN}))
+          (local.set $k (i32.add (local.get $k) (i32.const 1)))
+          (br $fill)))))
+    (i32.store (i32.sub (local.get $base) (i32.const 8)) (local.get $n))
+    (local.get $p))`
+
   // === Array literal ===
 
   ctx.core.emit['['] = (...elems) => {
@@ -617,8 +625,14 @@ export default (ctx) => {
     if (!hasSpread) {
       const len = elems.length
       // R: Static data segment for arrays of pure-literal elements (own-memory only).
-      // Saves N×(alloc+store) instructions in __start; raw f64 bits embedded directly.
-      if (len >= 4 && !ctx.memory.shared) {
+      // Raw f64 bits embedded directly — a constant array becomes a const pointer with no
+      // alloc and no per-element store. A static array aliases ONE shared data-segment
+      // region, so this is sound only when no caller expects a fresh instance per
+      // evaluation: at module scope the literal runs exactly once. A function-local
+      // literal (which would leak in-place mutations across calls — a latent bug the old
+      // len≥4 gate also had) allocs fresh instead. Module scope lifts the size floor too,
+      // so `const x = [1, 2, 3]` is a data segment, not an alloc.
+      if (ctx.func.atModuleScope && len >= 1 && !ctx.memory.shared) {
         // asF64 folds i32.const → f64.const literally, so int-literal arrays also qualify.
         const slots = elems.map(e => extractF64Bits(asF64(emit(e))))
         if (slots.every(b => b !== null)) return staticArrayPtr(slots)
@@ -633,10 +647,10 @@ export default (ctx) => {
       return typed(['block', ['result', 'f64'], ...body], 'f64')
     }
 
-    // Spread literal: buildArrayWithSpreads pre-sums the total length, allocates
+    // Spread literal: spread pre-sums the total length, allocates
     // exact, and bulk-copies ARRAY sources with a single memory.copy — vs the
     // per-element __arr_set_idx_ptr grow loop. Normalise the parser's `['...', x]`.
-    return buildArrayWithSpreads(elems.map(e =>
+    return spread(elems.map(e =>
       Array.isArray(e) && e[0] === '...' ? ['__spread', e[1]] : e))
   }
 
@@ -668,14 +682,17 @@ export default (ctx) => {
     const litKey = isLiteralStr(idx) ? idx[1]
       : typeof arr === 'string' && lookupValType(arr) === VAL.OBJECT ? staticPropertyKey(idx)
       : null
-    // SRoA flat object: `o['k']` → `local.get $o#i` (analyze.js scanFlatObjects).
-    if (litKey != null && typeof arr === 'string' && ctx.func.flatObjects?.has(arr)) {
+    // SRoA flat object/array: `o['k']` / `a[2]` → `local.get $o#i` (scanFlatObjects).
+    // A bare integer index resolves its slot key here (not via `litKey`, which stays
+    // null for arrays so the heap-array / schema paths below are untouched).
+    if (typeof arr === 'string' && ctx.func.flatObjects?.has(arr)) {
       const fo = ctx.func.flatObjects.get(arr)
-      const fi = fo.names.indexOf(litKey)
+      const flatKey = litKey != null ? litKey : staticIndexKey(idx)
+      const fi = flatKey != null ? fo.names.indexOf(flatKey) : -1
       if (fi >= 0) return typed(['local.get', `$${arr}#${fi}`], 'f64')
     }
-    if (litKey != null && typeof arr === 'string' && ctx.schema.find) {
-      const slot = ctx.schema.find(arr, litKey)
+    if (litKey != null && typeof arr === 'string' && ctx.schema.slotOf) {
+      const slot = ctx.schema.slotOf(arr, litKey)
       if (slot >= 0) {
         inc('__ptr_offset')
         return typed(ctx.abi.object.ops.load(['call', '$__ptr_offset', ['i64.reinterpret_f64', asF64(emit(arr))]], slot), 'f64')
@@ -692,10 +709,24 @@ export default (ctx) => {
     // Multi-value calls are materialized at call site (see '()' handler), so
     // func()[i] works naturally — func() returns a heap array pointer, [i] indexes it.
     const vt = typeof arr === 'string' ? lookupValType(arr) : valTypeOf(arr)
-    const va = emit(arr), vi = asI32(emit(idx))
+    // Literal string key on a receiver that isn't a known array/typed/string:
+    // `x['a']` IS `x.a` — delegate to the dot emitter so an untyped/OBJECT/external
+    // receiver gets the same polymorphic dispatch (__dyn_get_any_t_h, host-external
+    // aware). The local `dynLoad` fallback below calls __dyn_get, which only probes
+    // the internal HASH layout — so `x['a']` on a host object silently returned
+    // undefined while `x.a` worked. (Known ARRAY/TYPED/STRING fall through unchanged:
+    // their string-key semantics differ from a HASH/OBJECT property read.)
+    if (litKey != null && vt !== VAL.ARRAY && vt !== VAL.TYPED && vt !== VAL.STRING)
+      return emit(['.', arr, litKey])
+    // emitIndex (not bare asI32(emit)) narrows integer index arithmetic — incl. a
+    // literal term like the `+1` of `a[i*W + x + 1]` — to i32 ops instead of the
+    // f64 convert/trunc round-trip. Non-i32 keys (string dispatch) fall back to
+    // asI32(emit) inside emitIndex, so this is a strict improvement for every branch.
+    const va = emit(arr), vi = emitIndex(idx)
     const ptrExpr = asF64(va)
     const dynLoad = (objExpr, keyExpr) => {
       if (ctx.transform.strict) err(`strict mode: dynamic property access \`${typeof arr === 'string' ? arr : '<expr>'}[<expr>]\` falls back to __dyn_get. Use a literal key or known typed-array receiver, or pass { strict: false }.`)
+      warnDeopt('deopt-dyn-read', `dynamic property read \`${typeof arr === 'string' ? arr : '<expr>'}[…]\` couldn't resolve a static type — it falls back to a runtime hash lookup (~1.5–2× slower than a typed/slot read, far worse in a hot loop). Use a literal key, a typed-array receiver, or a Map for genuinely dynamic keys.`)
       inc('__dyn_get')
       return ['f64.reinterpret_i64', ['call', '$__dyn_get', ['i64.reinterpret_f64', objExpr], ['i64.reinterpret_f64', keyExpr]]]
     }
@@ -745,6 +776,16 @@ export default (ctx) => {
     if (keyType === VAL.STRING)
       return typed(dynLoad(ptrExpr, asF64(emit(idx))), 'f64')
     if (vt === 'array') {
+      // Base offset of the array's data region. A binding proven never relocated
+      // (scanNeverGrown — a fresh array literal whose every use is a pure read, so no
+      // grow op can ever run) skips the realloc-forwarding follow: its base is the raw
+      // post-header offset `wrap(reinterpret(ptr) & OFFSET_MASK)`, no __ptr_offset call.
+      // Memory-safe ONLY under that proof — a relocated array read through this stale
+      // base would corrupt memory (see scanNeverGrown's default-deny rationale).
+      const neverGrown = typeof arr === 'string' && ctx.func.localReps?.get(arr)?.neverGrown === true
+      const arrBase = () => neverGrown
+        ? ['i32.wrap_i64', ['i64.and', ['i64.reinterpret_f64', ptrExpr], ['i64.const', LAYOUT.OFFSET_MASK]]]
+        : (inc('__ptr_offset'), ['call', '$__ptr_offset', ['i64.reinterpret_f64', ptrExpr]])
       // structInline Array<S>: element i is K consecutive inline f64 schema
       // cells — no per-row heap object, no stored element pointer. `arr[i]` is
       // the byte address of the element's first cell, returned as a first-class
@@ -753,11 +794,10 @@ export default (ctx) => {
       // structInline handles (src/analyze.js analyzeStructInline).
       const inlSid = inlineArraySid(arr)
       if (inlSid != null) {
-        inc('__ptr_offset')
         const baseI32 = tempI32('ab')
         const K = ctx.schema.list[inlSid].length
         const cell = typed(structInline(K).ops.elemAddr(
-          ['local.tee', `$${baseI32}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ptrExpr]]],
+          ['local.tee', `$${baseI32}`, arrBase()],
           vi), 'i32')
         cell.ptrKind = VAL.OBJECT
         cell.ptrAux = inlSid
@@ -767,29 +807,55 @@ export default (ctx) => {
       // not __typed_idx (which does __len + __ptr_offset = two forwarding follows
       // plus type-dispatch overhead irrelevant for plain arrays).
       const keyIsNum = keyType === VAL.NUMBER
-      // Inline fast path: when arr has a known element schema and key is a
-      // known number, the type-tag check and bounds check inside __arr_idx are
-      // dead weight in hot kernels. Emit (f64.load (i32.add base (shl i 3)))
-      // directly. base goes through __ptr_offset (still does forwarding follow),
-      // and hoistAddrBase will CSE the (base, i) pair across the iteration body.
-      // Array<NUMBER>/<STRING>/<OBJECT> all use 8-byte f64 slot layout — direct
-      // f64.load is correct regardless of elem kind (returns raw f64 for NUMBER,
-      // NaN-boxed pointer for OBJECT/STRING; downstream typed() handles both).
-      // Fast path fires on schemaId (Array<{x,y,z}> shapes) OR plain elem-val
-      // (Array<NUMBER> from `.map(x => x*k)` etc.).
-      const rep = typeof arr === 'string' ? ctx.func.localReps?.get(arr) : null
-      const hasElemFact = rep?.arrayElemSchema != null
-      if (hasElemFact && keyIsNum) {
-        inc('__ptr_offset')
-        // __ptr_offset returns i32 — base local must be i32 (not the default
-        // f64 NaN-box temp). Flat tee form so downstream peepholes can fold
+      // Inline fast path for any known plain ARRAY + numeric key: the type-tag
+      // dispatch and bounds check inside __arr_idx(_known) are dead weight in hot
+      // kernels — most visibly AST walkers doing `node[i]` over heterogeneous
+      // arrays, where no element schema/valType is ever inferred. Emit the
+      // f64.load directly. base goes through __ptr_offset (still the forwarding
+      // follow), and hoistAddrBase CSEs the (base, i) pair across the iteration
+      // body. taggedLinear stores every element as one 8-byte f64 cell —
+      // Array<NUMBER>/<STRING>/<OBJECT> alike — so a direct f64.load is correct
+      // regardless of elem kind (raw f64 for NUMBER, NaN-boxed pointer for
+      // OBJECT/STRING; downstream typed() handles both). The load shape is fixed
+      // by the carrier, not by any rep fact, so we do NOT gate on a known element
+      // schema/valType: a bare `let a = [...]` walked by index gets the same
+      // inline load as an Array<{x,y,z}>. (structInline arrays returned above via
+      // inlineArraySid; typed arrays are VAL.TYPED, handled below.)
+      //
+      // Take the UNCHECKED inline load only when the index is proven in-bounds by
+      // an enclosing canonical loop `for (let i=C; i<arr.length; i++)` — a pure
+      // index<length structural proof (scanBoundedArrIdx, src/type.js), itself
+      // element-kind-independent. Skipping the bounds check on an arbitrary numeric
+      // index is unsound: `a[1]` on a length-1 array would read the raw cell instead
+      // of undefined; those fall through to the inline bounds-checked load below.
+      const idxProvenInBounds = keyIsNum
+        && typeof arr === 'string' && typeof idx === 'string'
+        && inBoundsArrIdx(ctx).has(arr + '\x00' + idx)
+      if (idxProvenInBounds) {
+        // base local must be i32. Flat tee form so downstream peepholes can fold
         // `i32.wrap_i64 (i64.reinterpret_f64 (f64.load …))` → `i32.load …`
         // when this load feeds a ptrUnboxed OBJECT field.
         const baseI32 = tempI32('ab')
         return typed(ctx.abi.array.ops.load(
-          ['local.tee', `$${baseI32}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ptrExpr]]],
+          ['local.tee', `$${baseI32}`, arrBase()],
           vi), 'f64')
       }
+      // Known plain array, numeric key, NOT proven in-bounds → inline bounds-checked
+      // load: `idx < len ? load : undefined`. Same semantics as __arr_idx_known but
+      // inline, so watr hoists the loop-invariant len load and CSEs the base — the
+      // residual cost is a single (predictable) compare per access, not a call. Skipping
+      // the check would read raw memory for OOB indices (e.g. `a[1]` on a length-1 array).
+      if (keyIsNum) {
+        const baseI32 = tempI32('ab'), idxI32 = tempI32('ai')
+        return typed(['if', ['result', 'f64'],
+          ['i32.lt_u',
+            ['local.tee', `$${idxI32}`, vi],
+            ['i32.load', ['i32.sub',
+              ['local.tee', `$${baseI32}`, arrBase()],
+              ['i32.const', 8]]]],
+          ['then', ctx.abi.array.ops.load(['local.get', `$${baseI32}`], ['local.get', `$${idxI32}`])],
+          ['else', undefExpr()]], 'f64')
+      }
       const baseTmp = temp()
       // Numeric key (literal or known-NUMBER name) → skip __is_str_key dispatch;
       // arrays don't honor string-key access for numeric keys (keys aren't coerced
@@ -842,7 +908,7 @@ export default (ctx) => {
         const keyI32 = asI32(typed(keyExpr, 'f64'))
         if (ctx.module.modules['string'] && !notString) {
           return ['if', ['result', 'f64'],
-            ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ptrExpr]], ['i32.const', PTR.STRING]],
+            ptrTypeEq(ptrExpr, PTR.STRING),
             ['then', (inc('__str_idx'), ['call', '$__str_idx', ['i64.reinterpret_f64', ptrExpr], keyI32])],
             ['else', (['call', '$__typed_idx', ['i64.reinterpret_f64', ptrExpr], keyI32])]]
         }
@@ -852,7 +918,7 @@ export default (ctx) => {
     if (ctx.module.modules['string'] && !notString)
       return typed(
         ['if', ['result', 'f64'],
-          ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ptrExpr]], ['i32.const', PTR.STRING]],
+          ptrTypeEq(ptrExpr, PTR.STRING),
           ['then', stringLoad()],
           ['else', arrayLoad]],
         'f64')
@@ -1021,6 +1087,42 @@ export default (ctx) => {
                 (i32.store (i32.sub (local.get $rawOff) (i32.const 4)) (i32.const -1))))
             (local.get $val))))))`
 
+  // .fill(value, start?, end?) — overwrite [start, end) with value; mutate + return the
+  // array. start/end default to 0 / length and accept negatives (offset from end). The
+  // INT_MAX end sentinel clamps to length in the helper, which also normalizes negatives.
+  ctx.core.emit['.fill'] = (arr, val, start, end) => {
+    inc('__arr_fill')
+    return typed(['call', '$__arr_fill',
+      asI64(emit(arr)),
+      val == null ? undefExpr() : asF64(emit(val)),
+      start == null ? ['i32.const', 0] : asI32(emit(start)),
+      end == null ? ['i32.const', 0x7FFFFFFF] : asI32(emit(end))], 'f64')
+  }
+
+  ctx.core.stdlib['__arr_fill'] = `(func $__arr_fill (param $arr i64) (param $val f64) (param $start i32) (param $end i32) (result f64)
+    (local $off i32) (local $len i32) (local $i i32)
+    (if (i32.eq
+          (i32.wrap_i64 (i64.and (i64.shr_u (local.get $arr) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK})))
+          (i32.const ${PTR.ARRAY}))
+      (then
+        (local.set $off (call $__ptr_offset (local.get $arr)))
+        (if (i32.ge_u (local.get $off) (i32.const 8))
+          (then
+            (local.set $len (i32.load (i32.sub (local.get $off) (i32.const 8))))
+            (if (i32.lt_s (local.get $start) (i32.const 0)) (then (local.set $start (i32.add (local.get $len) (local.get $start)))))
+            (if (i32.lt_s (local.get $start) (i32.const 0)) (then (local.set $start (i32.const 0))))
+            (if (i32.gt_s (local.get $start) (local.get $len)) (then (local.set $start (local.get $len))))
+            (if (i32.lt_s (local.get $end) (i32.const 0)) (then (local.set $end (i32.add (local.get $len) (local.get $end)))))
+            (if (i32.lt_s (local.get $end) (i32.const 0)) (then (local.set $end (i32.const 0))))
+            (if (i32.gt_s (local.get $end) (local.get $len)) (then (local.set $end (local.get $len))))
+            (local.set $i (local.get $start))
+            (block $done (loop $fill
+              (br_if $done (i32.ge_s (local.get $i) (local.get $end)))
+              (f64.store (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3))) (local.get $val))
+              (local.set $i (i32.add (local.get $i) (i32.const 1)))
+              (br $fill)))))))
+    (f64.reinterpret_i64 (local.get $arr)))`
+
   // .splice(start) | .splice(start, deleteCount) → remove range, return removed as new array
   ctx.core.emit['.splice'] = (arr, start, deleteCount) => {
     const recv = hoistArrayValue(arr)
@@ -1098,59 +1200,111 @@ export default (ctx) => {
     (i32.store (i32.sub (local.get $off) (i32.const 8)) (i32.add (local.get $len) (i32.const 1)))
     (f64.convert_i32_s (i32.add (local.get $len) (i32.const 1))))`
 
-  // .some(fn) → return 1 if any element passes, else 0 (early exit)
-  ctx.core.emit['.some'] = (arr, fn) => {
+  // .splice(start, deleteCount, ...items) with inserts → __arr_splice. Deletes
+  // `del` elements at `s`, inserts the elements of `ins`, returns the removed
+  // elements as a new array. Mutation is in place: a grow relocates the buffer
+  // but leaves a forwarding pointer, so the caller's NaN-box still resolves —
+  // no write-back needed (mirrors __arr_unshift). memory.copy is memmove, so the
+  // tail shift is correct whether the array grew (shift right) or shrank (left).
+  ctx.core.stdlib['__arr_splice'] = `(func $__arr_splice (param $arr i64) (param $start i32) (param $del i32) (param $ins i64) (result f64)
+    (local $off i32) (local $len i32) (local $s i32) (local $cnt i32)
+    (local $m i32) (local $newLen i32) (local $tail i32) (local $out f64) (local $a f64)
+    (local.set $len (call $__len (local.get $arr)))
+    (local.set $off (call $__ptr_offset (local.get $arr)))
+    (local.set $s (local.get $start))
+    (if (i32.lt_s (local.get $s) (i32.const 0))
+      (then
+        (local.set $s (i32.add (local.get $s) (local.get $len)))
+        (if (i32.lt_s (local.get $s) (i32.const 0)) (then (local.set $s (i32.const 0))))))
+    (if (i32.gt_s (local.get $s) (local.get $len)) (then (local.set $s (local.get $len))))
+    (local.set $cnt (local.get $del))
+    (if (i32.lt_s (local.get $cnt) (i32.const 0)) (then (local.set $cnt (i32.const 0))))
+    (if (i32.gt_s (i32.add (local.get $s) (local.get $cnt)) (local.get $len))
+      (then (local.set $cnt (i32.sub (local.get $len) (local.get $s)))))
+    (local.set $m (call $__len (local.get $ins)))
+    (local.set $newLen (i32.add (i32.sub (local.get $len) (local.get $cnt)) (local.get $m)))
+    (local.set $tail (i32.sub (i32.sub (local.get $len) (local.get $s)) (local.get $cnt)))
+    (local.set $out (call $__mkptr (i32.const ${PTR.ARRAY}) (i32.const 0) (call $__alloc_hdr (local.get $cnt) (local.get $cnt))))
+    (memory.copy
+      (call $__ptr_offset (i64.reinterpret_f64 (local.get $out)))
+      (i32.add (local.get $off) (i32.shl (local.get $s) (i32.const 3)))
+      (i32.shl (local.get $cnt) (i32.const 3)))
+    (local.set $a (f64.reinterpret_i64 (local.get $arr)))
+    (if (i32.gt_s (local.get $newLen) (local.get $len))
+      (then (local.set $a (call $__arr_grow (local.get $arr) (local.get $newLen)))))
+    (local.set $off (call $__ptr_offset (i64.reinterpret_f64 (local.get $a))))
+    (memory.copy
+      (i32.add (local.get $off) (i32.shl (i32.add (local.get $s) (local.get $m)) (i32.const 3)))
+      (i32.add (local.get $off) (i32.shl (i32.add (local.get $s) (local.get $cnt)) (i32.const 3)))
+      (i32.shl (local.get $tail) (i32.const 3)))
+    (memory.copy
+      (i32.add (local.get $off) (i32.shl (local.get $s) (i32.const 3)))
+      (call $__ptr_offset (local.get $ins))
+      (i32.shl (local.get $m) (i32.const 3)))
+    (i32.store (i32.sub (local.get $off) (i32.const 8)) (local.get $newLen))
+    (local.get $out))`
+
+  // Early-exit callback iterator: init value, exit test, value on match.
+  const earlyExitMethod = ({ tag, init, test, onMatch, reverse }) => (arr, fn) => {
     const recv = hoistArrayValue(arr)
-    const r = temp('sr')
+    const r = temp(tag)
     const exit = `$exit${ctx.func.uniq++}`
     const cb = makeCallback(fn, callbackArgReps(arr))
     const loop = arrayLoop(recv.value, (_ptr, _len, i, item) => [
-      ['if', truthyIR(cb.call([item, idxArg(cb, i)])),
-        ['then', ['local.set', `$${r}`, ['f64.const', 1]], ['br', exit]]]
-    ])
+      ['if', test(cb, i, item),
+        ['then', ['local.set', `$${r}`, onMatch(cb, i, item)], ['br', exit]]]
+    ], undefined, undefined, reverse)
     return typed(['block', ['result', 'f64'],
       recv.setup,
       cb.setup,
-      ['local.set', `$${r}`, ['f64.const', 0]],
+      ['local.set', `$${r}`, init],
       ['block', exit, ...loop],
       ['local.get', `$${r}`]], 'f64')
   }
 
-  // .every(fn) → return 1 if all elements pass, else 0 (early exit)
-  ctx.core.emit['.every'] = (arr, fn) => {
-    const recv = hoistArrayValue(arr)
-    const r = temp('ev')
-    const exit = `$exit${ctx.func.uniq++}`
-    const cb = makeCallback(fn, callbackArgReps(arr))
-    const loop = arrayLoop(recv.value, (_ptr, _len, i, item) => [
-      ['if', ['i32.eqz', truthyIR(cb.call([item, idxArg(cb, i)]))],
-        ['then', ['local.set', `$${r}`, ['f64.const', 0]], ['br', exit]]]
-    ])
-    return typed(['block', ['result', 'f64'],
-      recv.setup,
-      cb.setup,
-      ['local.set', `$${r}`, ['f64.const', 1]],
-      ['block', exit, ...loop],
-      ['local.get', `$${r}`]], 'f64')
-  }
+  ctx.core.emit['.some'] = earlyExitMethod({
+    tag: 'sr',
+    init: ['f64.const', 0],
+    test: (cb, i, item) => truthyIR(cb.call([item, idxArg(cb, i)])),
+    onMatch: () => ['f64.const', 1],
+  })
 
-  // .findIndex(fn) → return index of first matching element, or -1 (early exit)
-  ctx.core.emit['.findIndex'] = (arr, fn) => {
-    const recv = hoistArrayValue(arr)
-    const r = temp('fi')
-    const exit = `$exit${ctx.func.uniq++}`
-    const cb = makeCallback(fn, callbackArgReps(arr))
-    const loop = arrayLoop(recv.value, (_ptr, _len, i, item) => [
-      ['if', truthyIR(cb.call([item, idxArg(cb, i)])),
-        ['then', ['local.set', `$${r}`, ['f64.convert_i32_s', ['local.get', `$${i}`]]], ['br', exit]]]
-    ])
-    return typed(['block', ['result', 'f64'],
-      recv.setup,
-      cb.setup,
-      ['local.set', `$${r}`, ['f64.const', -1]],
-      ['block', exit, ...loop],
-      ['local.get', `$${r}`]], 'f64')
-  }
+  ctx.core.emit['.every'] = earlyExitMethod({
+    tag: 'ev',
+    init: ['f64.const', 1],
+    test: (cb, i, item) => ['i32.eqz', truthyIR(cb.call([item, idxArg(cb, i)]))],
+    onMatch: () => ['f64.const', 0],
+  })
+
+  ctx.core.emit['.findIndex'] = earlyExitMethod({
+    tag: 'fi',
+    init: ['f64.const', -1],
+    test: (cb, i, item) => truthyIR(cb.call([item, idxArg(cb, i)])),
+    onMatch: (_cb, i) => ['f64.convert_i32_s', ['local.get', `$${i}`]],
+  })
+
+  ctx.core.emit['.find'] = earlyExitMethod({
+    tag: 'ff',
+    init: ['f64.reinterpret_i64', ['i64.const', NULL_NAN]],
+    test: (cb, i, item) => truthyIR(cb.call([item, idxArg(cb, i)])),
+    onMatch: (_cb, _i, item) => item,
+  })
+
+  ctx.core.emit['.findLastIndex'] = earlyExitMethod({
+    tag: 'fli',
+    init: ['f64.const', -1],
+    test: (cb, i, item) => truthyIR(cb.call([item, idxArg(cb, i)])),
+    onMatch: (_cb, i) => ['f64.convert_i32_s', ['local.get', `$${i}`]],
+    reverse: true,
+  })
+
+  ctx.core.emit['.findLast'] = earlyExitMethod({
+    tag: 'fl',
+    init: ['f64.reinterpret_i64', ['i64.const', NULL_NAN]],
+    test: (cb, i, item) => truthyIR(cb.call([item, idxArg(cb, i)])),
+    onMatch: (_cb, _i, item) => item,
+    reverse: true,
+  })
 
   // === Array methods ===
 
@@ -1170,13 +1324,13 @@ export default (ctx) => {
   }
   function isPureCallback(fn) {
     if (!Array.isArray(fn) || fn[0] !== '=>') return false
-    const body = fn[2]
     const params = new Set()
-    const p = fn[1]
-    const raw = p == null ? [] : Array.isArray(p) ? (p[0] === ',' ? p.slice(1) : p[0] === '()' ? (p[1] == null ? [] : Array.isArray(p[1]) && p[1][0] === ',' ? p[1].slice(1) : [p[1]]) : [p]) : [p]
-    for (const r of raw) params.add(Array.isArray(r) && r[0] === '...' ? r[1] : typeof r === 'string' ? r : Array.isArray(r) && r[0] === '=' ? r[1] : null)
+    for (const r of extractParams(fn[1])) {
+      const p = classifyParam(r)
+      if (p.name) params.add(p.name)
+    }
     const locals = new Set(params)
-    collectLocals(body, locals)
+    collectLocals(fn[2], locals)
     let pure = true
     ;(function walk(node) {
       if (!pure || !Array.isArray(node)) return
@@ -1184,13 +1338,13 @@ export default (ctx) => {
       if (op === '=>') return
       if (op === '()' || op === '?.()' || op === 'new') { pure = false; return }
       if (op === '++' || op === '--') { pure = false; return }
-      if (op === '=' || op === '+=' || op === '-=' || op === '*=' || op === '/=' || op === '%=' || op === '&=' || op === '|=' || op === '^=' || op === '>>=' || op === '<<=' || op === '>>>=' || op === '||=' || op === '&&=' || op === '??=') {
+      if (ASSIGN_OPS.has(op)) {
         const t = args[0]
         if (typeof t === 'string') { if (!locals.has(t)) { pure = false; return } }
         else { pure = false; return }
       }
       for (const a of args) walk(a)
-    })(body)
+    })(fn[2])
     return pure
   }
 
@@ -1315,30 +1469,56 @@ export default (ctx) => {
       const acc = temp('ra'), mapped = temp('mv')
       const upReps = callbackArgReps(up.source)
       const mapCb = makeCallback(up.fn, upReps), redCb = makeCallback(fn)
+      const mget = typed(['local.get', `$${mapped}`], 'f64')
+      // map preserves indices → the reduce callback's index is the loop counter.
+      const fold = i => ['local.set', `$${acc}`, asF64(redCb.call([typed(['local.get', `$${acc}`], 'f64'), mget, idxArg(redCb, i, 2)]))]
       const loop = arrayLoop(recv.value, (_p, _l, i, item) => [
         ['local.set', `$${mapped}`, asF64(mapCb.call([item, idxArg(mapCb, i)]))],
-        ['local.set', `$${acc}`, asF64(redCb.call([typed(['local.get', `$${acc}`], 'f64'), typed(['local.get', `$${mapped}`], 'f64')]))]
+        // No-init: seed accumulator with the first mapped element (see base path).
+        init !== undefined ? fold(i)
+          : ['if', ['i32.eqz', ['local.get', `$${i}`]],
+              ['then', ['local.set', `$${acc}`, mget]],
+              ['else', fold(i)]]
       ])
       return typed(['block', ['result', 'f64'],
         recv.setup, mapCb.setup, redCb.setup,
-        ['local.set', `$${acc}`, init ? asF64(emit(init)) : ['f64.const', 0]],
+        ['local.set', `$${acc}`, init !== undefined ? asF64(emit(init)) : ['f64.const', 0]],
         ...loop, ['local.get', `$${acc}`]], 'f64')
     }
     // .filter(f).reduce(g, init) → single loop: test f, accumulate with g if passes
     if (up && up.method === 'filter') {
       const recv = hoistArrayValue(up.source)
       const acc = temp('ra')
+      // No-init: seed is the first *passing* element, whose index isn't known
+      // statically (filter), so track a seeded flag rather than i==0.
+      const seeded = init !== undefined ? null : tempI32('rs')
       const upReps = callbackArgReps(up.source)
       const filterCb = makeCallback(up.fn, upReps)
       // reduce cb signature: (acc, item, idx). Item rep mirrors upstream's item rep.
       const redCb = makeCallback(fn, [null, upReps[0], { val: VAL.NUMBER }])
+      // filter renumbers: the reduce index counts *passing* elements, not the
+      // source position, so track a dedicated filtered-position counter (only when
+      // the callback actually reads its index — else idxArg drops the arg anyway).
+      const usesIdx = redCb.usedParams ? !!redCb.usedParams[2] : true
+      const fpos = usesIdx ? tempI32('rp') : null
+      const fold = item => ['local.set', `$${acc}`, asF64(redCb.call([typed(['local.get', `$${acc}`], 'f64'), item, fpos ? idxArg(redCb, fpos, 2) : null]))]
+      const bump = fpos ? [['local.set', `$${fpos}`, ['i32.add', ['local.get', `$${fpos}`], ['i32.const', 1]]]] : []
+      const accumulate = item => ['block',
+        seeded
+          ? ['if', ['local.get', `$${seeded}`],
+              ['then', fold(item)],
+              ['else', ['block', ['local.set', `$${acc}`, asF64(item)], ['local.set', `$${seeded}`, ['i32.const', 1]]]]]
+          : fold(item),
+        ...bump]
       const loop = arrayLoop(recv.value, (_p, _l, i, item) => [
         ['if', truthyIR(filterCb.call([item, idxArg(filterCb, i)])),
-          ['then', ['local.set', `$${acc}`, asF64(redCb.call([typed(['local.get', `$${acc}`], 'f64'), item]))]]]
+          ['then', accumulate(item)]]
       ])
       return typed(['block', ['result', 'f64'],
         recv.setup, filterCb.setup, redCb.setup,
-        ['local.set', `$${acc}`, init ? asF64(emit(init)) : ['f64.const', 0]],
+        ...(fpos ? [['local.set', `$${fpos}`, ['i32.const', 0]]] : []),
+        ...(seeded ? [['local.set', `$${seeded}`, ['i32.const', 0]]] : []),
+        ['local.set', `$${acc}`, init !== undefined ? asF64(emit(init)) : ['f64.const', 0]],
         ...loop, ['local.get', `$${acc}`]], 'f64')
     }
     const recv = hoistArrayValue(arr)
@@ -1346,13 +1526,47 @@ export default (ctx) => {
     // reduce cb signature: (acc, item, idx). Item rep mirrors recv's elem val type.
     const reps = callbackArgReps(arr)
     const cb = makeCallback(fn, [null, reps[0], { val: VAL.NUMBER }])
-    const loop = arrayLoop(recv.value, (_ptr, _len, _i, item) => [
-      ['local.set', `$${acc}`, asF64(cb.call([typed(['local.get', `$${acc}`], 'f64'), item]))]
+    // No initial value: JS seeds the accumulator with element 0 and folds from
+    // index 1 — NOT a 0 seed folded over every element. A 0 seed is invisible
+    // for `+` (additive identity) but wrong for `*` (→0) and corrupts non-numeric
+    // folds (string reduce emits a bare `0` in the joined result). Seed at i==0.
+    const fold = (item, i) => ['local.set', `$${acc}`, asF64(cb.call([typed(['local.get', `$${acc}`], 'f64'), item, idxArg(cb, i, 2)]))]
+    const loop = arrayLoop(recv.value, (_ptr, _len, i, item) => [
+      init !== undefined ? fold(item, i)
+        : ['if', ['i32.eqz', ['local.get', `$${i}`]],
+            ['then', ['local.set', `$${acc}`, asF64(item)]],
+            ['else', fold(item, i)]]
     ])
     return typed(['block', ['result', 'f64'],
       recv.setup,
       cb.setup,
-      ['local.set', `$${acc}`, init ? asF64(emit(init)) : ['f64.const', 0]],
+      ['local.set', `$${acc}`, init !== undefined ? asF64(emit(init)) : ['f64.const', 0]],
+      ...loop,
+      ['local.get', `$${acc}`]], 'f64')
+  }
+
+  // .reduceRight(fn, init) — same accumulator fold as .reduce but the last
+  // arrayLoop arg (reverse) walks elements len-1→0. No map/filter fusion: the
+  // reverse-fused shapes don't occur in practice and the base case is the only
+  // form jz emits. (Previously absent despite being autoload-declared + test262-
+  // tracked — a phantom builtin that silently returned undefined.)
+  ctx.core.emit['.reduceRight'] = (arr, fn, init) => {
+    const recv = hoistArrayValue(arr)
+    const acc = temp('ra')
+    const reps = callbackArgReps(arr)
+    const cb = makeCallback(fn, [null, reps[0], { val: VAL.NUMBER }])
+    // No-init: reverse walk seeds with the last element (i == len-1), folds down.
+    const fold = (item, i) => ['local.set', `$${acc}`, asF64(cb.call([typed(['local.get', `$${acc}`], 'f64'), item, idxArg(cb, i, 2)]))]
+    const loop = arrayLoop(recv.value, (_ptr, len, i, item) => [
+      init !== undefined ? fold(item, i)
+        : ['if', ['i32.eq', ['local.get', `$${i}`], ['i32.sub', ['local.get', `$${len}`], ['i32.const', 1]]],
+            ['then', ['local.set', `$${acc}`, asF64(item)]],
+            ['else', fold(item, i)]]
+    ], null, null, true)
+    return typed(['block', ['result', 'f64'],
+      recv.setup,
+      cb.setup,
+      ['local.set', `$${acc}`, init !== undefined ? asF64(emit(init)) : ['f64.const', 0]],
       ...loop,
       ['local.get', `$${acc}`]], 'f64')
   }
@@ -1391,23 +1605,6 @@ export default (ctx) => {
     return typed(['block', ['result', 'f64'], recv.setup, cb.setup, ...loop, ['f64.const', 0]], 'f64')
   }
 
-  ctx.core.emit['.find'] = (arr, fn) => {
-    const recv = hoistArrayValue(arr)
-    const result = temp('ff')
-    const exit = `$exit${ctx.func.uniq++}`
-    const cb = makeCallback(fn, callbackArgReps(arr))
-    const loop = arrayLoop(recv.value, (_ptr, _len, i, item) => [
-      ['if', truthyIR(cb.call([item, idxArg(cb, i)])),
-        ['then', ['local.set', `$${result}`, item], ['br', exit]]]
-    ])
-    return typed(['block', ['result', 'f64'],
-      recv.setup,
-      cb.setup,
-      ['local.set', `$${result}`, ['f64.reinterpret_i64', ['i64.const', NULL_NAN]]],
-      ['block', exit, ...loop],
-      ['local.get', `$${result}`]], 'f64')
-  }
-
   // .reverse() → in-place swap arr[i] ↔ arr[len-1-i], returns the array.
   ctx.core.emit['.reverse'] = (arr) => {
     const recv = hoistArrayValue(arr)
@@ -1697,6 +1894,10 @@ export default (ctx) => {
     body.push(out.ptr)
     return typed(['block', ['result', 'f64'], ...body], 'f64')
   }
+  // Unqualified alias so an untyped-receiver `.concat` gets emit's runtime
+  // string-vs-array ptr-type branch (string → `.string:concat`, array → this),
+  // mirroring `.at`. A known-ARRAY receiver still dispatches here directly.
+  ctx.core.emit['.concat'] = ctx.core.emit['.array:concat']
 
   // .flat() → flatten one level of nested arrays
   ctx.core.stdlib['__arr_flat'] = `(func $__arr_flat (param $src i64) (result f64)