jz 0.5.1 → 0.7.0

package/module/object.js

@@ -7,12 +7,39 @@
  * @module object
  */
 
-import { typed, asF64, asI64, temp, tempI32, allocPtr, needsDynShadow, mkPtrIR, extractF64Bits, appendStaticSlots, slotAddr, elemLoad, elemStore } from '../src/ir.js'
-import { emit } from '../src/emit.js'
-import { valTypeOf, lookupValType, VAL, repOf, updateRep, shapeOf } from '../src/analyze.js'
-import { ctx, err, inc, PTR, LAYOUT } from '../src/ctx.js'
-import { includeModule } from '../src/autoload.js'
+import { typed, asF64, asI64, NULL_NAN, UNDEF_NAN, temp, tempI32, tempI64, block64, ptrTypeEq, dispatchByPtrType, allocPtr, needsDynShadow, mkPtrIR, extractF64Bits, appendStaticSlots, slotAddr, elemLoad, elemStore, boolBoxIR } from '../src/ir.js'
+import { emit } from '../src/bridge.js'
+import { staticArrayPtr } from './array.js'
+import { valTypeOf, shapeOf } from '../src/kind.js'
+import { VAL, lookupValType, repOf, updateRep } from '../src/reps.js'
+import { ctx, err, inc, PTR, LAYOUT, declGlobal } from '../src/ctx.js'
 
+// Object.prototype.toString tag per value category. Matches what JS engines
+// return for primitive/built-in types; canonicalized from
+// `Object.prototype.toString.call(x)` by jzify (see jzify/bundler.js).
+const OBJECT_TO_STRING_TAGS = {
+  [VAL.NUMBER]:  '[object Number]',
+  [VAL.BIGINT]:  '[object BigInt]',
+  [VAL.BOOL]:    '[object Boolean]',
+  [VAL.STRING]:  '[object String]',
+  [VAL.ARRAY]:   '[object Array]',
+  [VAL.OBJECT]:  '[object Object]',
+  [VAL.HASH]:    '[object Object]',
+  [VAL.SET]:     '[object Set]',
+  [VAL.MAP]:     '[object Map]',
+  [VAL.CLOSURE]: '[object Function]',
+  [VAL.REGEX]:   '[object RegExp]',
+  [VAL.DATE]:    '[object Date]',
+  [VAL.BUFFER]:  '[object ArrayBuffer]',
+  [VAL.TYPED]:   '[object Object]',
+}
+
+const objectToStringTagForVal = (obj) => {
+  const val = typeof obj === 'string' ? lookupValType(obj) : valTypeOf(obj)
+  return val ? OBJECT_TO_STRING_TAGS[val] : null
+}
+
+const storedValue = (node) => valTypeOf(node) === VAL.BOOL ? boolBoxIR(emit(node)) : asF64(emit(node))
 
 export default (ctx) => {
   inc('__mkptr', '__alloc', '__alloc_hdr', '__ptr_offset', '__len', '__ptr_type')
@@ -54,11 +81,21 @@ export default (ctx) => {
       if (Array.isArray(p) && p[0] === ':') { names.push(p[1]); values.push(p[2]) }
     }
 
-    // Use variable's merged schema if available (from Object.assign inference), else register literal schema.
-    let schemaId = ctx.schema.register(names)
+    // Use variable's merged schema if available (from Object.assign inference),
+    // else register the literal's own schema. The merged schema is adopted only
+    // when it is a *superset* of the literal's own fields — a legitimate
+    // accumulation (`let o = {}; o.x = …`) always contains every literal key.
+    // A merged schema missing any literal field is a stale cross-function name
+    // collision (ctx.schema.vars is module-global, keyed by bare name): adopting
+    // it would size the alloc to the wrong schema and overflow the object's
+    // slots, corrupting adjacent heap. The literal is authoritative for its own
+    // shape, so re-bind the variable to it for precise same-function reads.
+    const litId = ctx.schema.register(names)
+    let schemaId = litId
     if (target) {
       const merged = ctx.schema.resolve(target)
-      if (merged) schemaId = ctx.schema.idOf(target)
+      if (merged && names.every(n => merged.includes(n))) schemaId = ctx.schema.idOf(target)
+      else if (names.length) ctx.schema.vars.set(target, litId)
     }
     const schema = ctx.schema.list[schemaId]
     const t = tempI32('obj')
@@ -67,19 +104,35 @@ export default (ctx) => {
     // R: Static data segment for objects of pure-literal property values (own-memory only).
     // Even with shadow needed, we can skip alloc + N stores; just feed literal values to __dyn_set.
     const shadow = needsDynShadow(target)
-    if (values.length >= 2 && values.length === schema.length && !ctx.memory.shared) {
-      const emitted = values.map(emit)
+    // When the literal adopts a superset/merged schema (schemaId !== litId), the
+    // field order in `schema` can differ from the literal's `names`, so each value
+    // must land at its named slot `schema.indexOf(name)` — a positional `slot = i`
+    // store would scatter values into the wrong (or another field's) slots.
+    const slotOf = schemaId === litId ? (i => i) : (i => schema.indexOf(names[i]))
+    // SOUNDNESS GATE: a static literal is ONE shared instance — every evaluation
+    // returns the same pointer. That is only faithful when the object is never
+    // mutated: `let mk = () => ({n:0,m:0}); mk().n++` must not bleed into the
+    // next mk(). writtenProps (program-facts) holds every property name ever
+    // written through ANY receiver — including expression receivers like
+    // `map.get(k).n++` that no alias analysis could attribute — so a literal
+    // whose schema intersects it allocates per-evaluation instead.
+    const neverWritten = names.every(n => !ctx.module.writtenProps?.has(n))
+    if (neverWritten && values.length >= 2 && values.length === schema.length && !ctx.memory.shared) {
+      const emitted = values.map(storedValue)
       // asF64 folds i32.const → f64.const so int-literal values also qualify.
-      const slots = emitted.map(v => extractF64Bits(asF64(v)))
+      const slots = emitted.map(v => extractF64Bits(v))
       if (slots.every(b => b !== null)) {
-        const off = appendStaticSlots(slots)
+        // Reorder into schema-slot order before laying out the static segment.
+        const ordered = emitted.map(() => null), orderedBits = emitted.map(() => null)
+        for (let i = 0; i < values.length; i++) { ordered[slotOf(i)] = emitted[i]; orderedBits[slotOf(i)] = slots[i] }
+        const off = appendStaticSlots(orderedBits)
         const staticPtr = mkPtrIR(PTR.OBJECT, schemaId, off)
         if (!shadow) return staticPtr
         inc('__dyn_set')
         const body = [['local.set', `$${ptr}`, staticPtr]]
         for (let i = 0; i < schema.length; i++)
           body.push(['drop', ['call', '$__dyn_set', ['i64.reinterpret_f64', ['local.get', `$${ptr}`]],
-            asI64(emit(['str', String(schema[i])])), asI64(emitted[i])]])
+            asI64(emit(['str', String(schema[i])])), asI64(ordered[i])]])
         body.push(['local.get', `$${ptr}`])
         return typed(['block', ['result', 'f64'], ...body], 'f64')
       }
@@ -89,7 +142,7 @@ export default (ctx) => {
       ['local.set', `$${t}`, ['call', '$__alloc_hdr', ['i32.const', 0], ['i32.const', ctx.abi.object.ops.allocSlots(schema.length)]]],
     ]
     for (let i = 0; i < values.length; i++)
-      body.push(ctx.abi.object.ops.store(['local.get', `$${t}`], i, asF64(emit(values[i]))))
+      body.push(ctx.abi.object.ops.store(['local.get', `$${t}`], slotOf(i), storedValue(values[i])))
     body.push(['local.set', `$${ptr}`, mkPtrIR(PTR.OBJECT, schemaId, ['local.get', `$${t}`])])
     if (shadow) {
       inc('__dyn_set')
@@ -106,6 +159,15 @@ export default (ctx) => {
 
   ctx.core.emit['Object.freeze'] = (obj) => asF64(emit(obj))
 
+  // Object.is(a, b) — SameValue, which on NaN-boxed f64 values is exact bit
+  // equality. That is precisely why it diverges from `===`: +0 and -0 carry
+  // distinct bit patterns (→ false), and a NaN equals itself bit-for-bit
+  // (→ true). Objects/booleans/null/undefined compare by their fixed boxed
+  // bits, i.e. reference identity, as SameValue requires. (Two distinct heap
+  // strings would compare by pointer rather than content; jz only uses numeric
+  // Object.is — overwhelmingly `Object.is(x, -0)` — so that path never arises.)
+  ctx.core.emit['Object.is'] = (a, b) => typed(['i64.eq', asI64(emit(a)), asI64(emit(b))], 'i32')
+
   // Object.isExtensible / isSealed / isFrozen.
   // jz fixes an object's schema at construction: a `{…}` literal can
   // neither grow nor lose keys, so an OBJECT value is non-extensible and
@@ -147,7 +209,7 @@ export default (ctx) => {
   const arrayValType = (obj) => (typeof obj === 'string' ? lookupValType(obj) : valTypeOf(obj)) === VAL.ARRAY
   // Index-string key array for an array-like receiver. `lenCall` is the
   // length builtin: __len for jz arrays, __str_len for strings.
-  const emitIndexKeys = (obj, lenCall) => {
+  const idxKeys = (obj, lenCall) => {
     inc(lenCall, '__to_str')
     const v = temp('ik'), i = tempI32('iki'), len = tempI32('ikl')
     const vPtr = () => ['i64.reinterpret_f64', ['local.get', `$${v}`]]
@@ -171,16 +233,45 @@ export default (ctx) => {
     const nullish = requireCoercible(obj)
     if (nullish) return nullish
     if (isHashTyped(obj)) return emitHashKeys(obj)
-    if (arrayValType(obj)) return emitIndexKeys(obj, '__len')
-    if (stringValType(obj)) return emitIndexKeys(obj, '__str_len')
+    if (arrayValType(obj)) return idxKeys(obj, '__len')
+    if (stringValType(obj)) return idxKeys(obj, '__str_len')
     const schema = resolveSchema(obj)
-    if (schema) return emitStringArray(schema)
-    // Receiver type unknown at compile time. Dispatch on ptr-type at
-    // runtime: HASH walks the probe table, anything else returns [].
+    // A static schema lists only the literal-known keys; a var that takes
+    // computed writes (`o[k]=v`) also carries props in its per-object dyn HASH
+    // that the schema omits. Enumerate those live (schema ∪ dyn props) — the gap
+    // that blocked metacircularity (the compiler grows dicts then enumerates).
+    if (schema && !mayHaveDynProps(obj)) return emitStringArray(schema)
+    // Unknown receiver, or schema with possible dyn props: dispatch on ptr-type
+    // at runtime (HASH probe table / OBJECT schema+dyn merge / else []).
     return emitRuntimeKeys(obj)
   }
   ctx.core.emit['Object.getOwnPropertyNames'] = ctx.core.emit['Object.keys']
 
+  // for-in's read-only key enumeration (src/prepare for…in lowering). Identical to
+  // Object.keys EXCEPT: when the receiver is a bare variable with a complete static
+  // schema, the key list is a compile-time constant, so it pools ONE static-data
+  // array (no per-evaluation alloc) — eliminating for-in's hot-loop heap-growth
+  // cliff and its unbounded-allocation OOM. The pooled array is shared/read-only,
+  // which is sound because for-in only reads ks[i]/ks.length (Object.keys can't pool:
+  // user code may `.sort()`/`.reverse()` the result in place). Anything not a static
+  // schema bare-var — arrays/strings/HASH/dyn-props/expressions — delegates to
+  // Object.keys (evaluates the receiver, full runtime enumeration).
+  ctx.core.emit['__keys_ro'] = (obj) => {
+    // Pool only when the receiver's enumerable key set is provably the static
+    // schema: a bare var with NO computed-key writes (`o[k]=v`) — those are the
+    // only writes that add enumerable keys (computed reads / dot-adds don't).
+    // `mayHaveDynProps` is too coarse here — it also flags computed-READ receivers,
+    // and for-in's own `o[k]` read would otherwise veto its own pooling.
+    if (typeof obj === 'string' && !ctx.types.dynWriteVars?.has(obj) && !isHashTyped(obj) && !arrayValType(obj) && !stringValType(obj)) {
+      const schema = resolveSchema(obj)
+      if (schema) {
+        const slots = schema.map(name => extractF64Bits(asF64(emit(['str', name]))))
+        if (slots.every(b => b !== null)) return staticArrayPtr(slots)
+      }
+    }
+    return ctx.core.emit['Object.keys'](obj)
+  }
+
   // Object.prototype.hasOwnProperty(key) — own-property presence check.
   // Compile-time fold for literal keys against object literals or variables
   // with known schemas; runtime path delegates to the `in` operator (same
@@ -194,7 +285,7 @@ export default (ctx) => {
           ['drop', asF64(emit(obj))],
           ['f64.const', has ? 1 : 0]], 'f64')
       }
-      if (typeof obj === 'string' && ctx.schema.find?.(obj, litKey) >= 0)
+      if (typeof obj === 'string' && ctx.schema.slotOf?.(obj, litKey) >= 0)
         return typed(['f64.const', 1], 'f64')
     }
     return typed(['f64.convert_i32_s', emit(['in', key, obj])], 'f64')
@@ -208,6 +299,41 @@ export default (ctx) => {
   // Reuses the same own-property emitter; receiver-type variants above apply.
   ctx.core.emit['Object.hasOwn'] = (obj, key) => ctx.core.emit['.hasOwnProperty'](obj, key)
 
+  // __object_toString(value) — canonicalized from `Object.prototype.toString.call(value)`
+  // by jzify. Returns the spec-defined "[object Tag]" string. When the value's category
+  // is known at compile time the tag folds to a static string load; otherwise the
+  // runtime path dispatches on NaN-box bits (NaN→Number, NULL/UNDEF, then PTR type).
+  ctx.core.emit['__object_toString'] = (obj) => {
+    const emitTag = value => asF64(emit(['str', value]))
+    const tag = objectToStringTagForVal(obj)
+    if (tag) return block64(['drop', asF64(emit(obj))], emitTag(tag))
+
+    const value = temp('otag'), type = tempI32('otagt')
+    const bits = ['i64.reinterpret_f64', ['local.get', `$${value}`]]
+    const byType = dispatchByPtrType(type, [
+      [PTR.STRING,  emitTag('[object String]')],
+      [PTR.ARRAY,   emitTag('[object Array]')],
+      [PTR.BUFFER,  emitTag('[object ArrayBuffer]')],
+      [PTR.CLOSURE, emitTag('[object Function]')],
+      [PTR.SET,     emitTag('[object Set]')],
+      [PTR.MAP,     emitTag('[object Map]')],
+    ], emitTag('[object Object]'))
+    const pointerTag = block64(['local.set', `$${type}`, ['call', '$__ptr_type', bits]], byType)
+    const nonNumericTag = ['if', ['result', 'f64'],
+      ['i64.eq', bits, ['i64.const', NULL_NAN]],
+      ['then', emitTag('[object Null]')],
+      ['else', ['if', ['result', 'f64'],
+        ['i64.eq', bits, ['i64.const', UNDEF_NAN]],
+        ['then', emitTag('[object Undefined]')],
+        ['else', pointerTag]]]]
+    return block64(
+      ['local.set', `$${value}`, asF64(emit(obj))],
+      ['if', ['result', 'f64'],
+        ['f64.eq', ['local.get', `$${value}`], ['local.get', `$${value}`]],
+        ['then', emitTag('[object Number]')],
+        ['else', nonNumericTag]])
+  }
+
   // String primitives are coerced to exotic String objects whose own enumerable
   // properties are the indexed characters. Object.values/entries iterate them.
   const stringValType = (obj) => (typeof obj === 'string' ? lookupValType(obj) : valTypeOf(obj)) === VAL.STRING
@@ -236,7 +362,7 @@ export default (ctx) => {
     if (arrayValType(obj)) { inc('__arr_from'); return typed(['call', '$__arr_from', asI64(emit(obj))], 'f64') }
     if (isHashTyped(obj)) return emitHashValues(obj)
     const schema = resolveSchema(obj)
-    if (!schema) return emitRuntimeValues(obj)
+    if (!schema || mayHaveDynProps(obj)) return emitRuntimeValues(obj)
     const va = asF64(emit(obj))
     const n = schema.length
     const t = temp('ov'), base = tempI32('vb')
@@ -299,7 +425,7 @@ export default (ctx) => {
     }
     if (isHashTyped(obj)) return emitHashEntries(obj)
     const schema = resolveSchema(obj)
-    if (!schema) return emitRuntimeEntries(obj)
+    if (!schema || mayHaveDynProps(obj)) return emitRuntimeEntries(obj)
     const va = asF64(emit(obj))
     const n = schema.length
     const t = temp('oe'), pair = tempI32('op'), base = tempI32('eb')
@@ -361,10 +487,18 @@ export default (ctx) => {
     }
     const tSchema = resolveSchema(target)
     const sourceSchemas = sources.map(resolveSchema)
-    if (!tSchema) err('Object.assign: target needs known schema')
+    if (!tSchema) return emitObjectAssignDynamic(target, sources)
     if (sourceSchemas.some(s => !s)) return emitDynamicAssign(target, sources, sourceSchemas)
     const t = temp('at'), s = temp('as')
     const tBase = tempI32('tb'), sBase2 = tempI32('sb')
+    // When the target carries a dynamic-props shadow (needsDynShadow), reads of an
+    // unknown-schema alias (`let r = Object.assign(t, …); r.a`) dispatch through
+    // __dyn_get_any → the hash, not the schema slot. A slot-only write would leave
+    // the hash stale, so mirror each store into __dyn_set, exactly as the object
+    // literal emit does (above). False unless a collection/dyn-key module is live,
+    // so the common fixed-schema assign keeps its slot-only fast path.
+    const shadow = needsDynShadow(target)
+    if (shadow) inc('__dyn_set')
     const body = [['local.set', `$${t}`, asF64(emit(target))],
       ['local.set', `$${tBase}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]]]
     for (let i = 0; i < sources.length; i++) {
@@ -376,6 +510,9 @@ export default (ctx) => {
         const ti = tSchema.indexOf(sSchema[si])
         if (ti < 0) continue
         body.push(ctx.abi.object.ops.store(['local.get', `$${tBase}`], ti, ctx.abi.object.ops.load(['local.get', `$${sBase2}`], si)))
+        if (shadow)
+          body.push(['drop', ['call', '$__dyn_set', ['i64.reinterpret_f64', ['local.get', `$${t}`]],
+            asI64(emit(['str', String(tSchema[ti])])), ctx.abi.object.ops.loadBits(['local.get', `$${tBase}`], ti)]])
       }
     }
     body.push(['local.get', `$${t}`])
@@ -419,6 +556,14 @@ export default (ctx) => {
 
   // Object.create(proto) → shallow copy of object (same schema, copied properties)
   ctx.core.emit['Object.create'] = (proto) => {
+    // Object.create(null) → a fresh, empty, extensible object (no prototype). Without
+    // this it falls to the `protoType == null` runtime path below, which returns the
+    // proto value (null) itself; property writes on null then land in the GLOBAL
+    // __dyn_props table keyed by name, so two such objects collide on same-named keys
+    // (`a=Object.create(null); b=Object.create(null); a.x=1; b.x=2` left a.x===2). Reuse
+    // the empty-`{}` path, whose per-object hash keeps dynamic keys independent. (Native
+    // never hit this — its compiler runs Object.create on the host JS engine.)
+    if (isNullishLiteral(proto)) return ctx.core.emit['{}']()
     const protoType = typeof proto === 'string' ? lookupValType(proto) : valTypeOf(proto)
     if (protoType === VAL.ARRAY) {
       // Clone array data + link named-prop sidecar so for-in/bracket-name lookups
@@ -426,7 +571,7 @@ export default (ctx) => {
       // Header propsPtr lives at $off-16 (current ARRAY layout). We alias src's hash
       // by copying the slot; __dyn_move covers the shifted-array case where props
       // were migrated to the global __dyn_props.
-      includeModule('array')
+      ctx.module.include('array')
       inc('__arr_from', '__dyn_move', '__ptr_offset')
       const src = temp('ocs')
       const dst = temp('ocd')
@@ -449,7 +594,7 @@ export default (ctx) => {
     if (!schema) {
       if (protoType == null) {
         const value = temp('ocr')
-        includeModule('array')
+        ctx.module.include('array')
         inc('__arr_from', '__dyn_move', '__ptr_offset')
         const dst2 = temp('ocd')
         const srcOff2 = tempI32('ocso')
@@ -457,7 +602,7 @@ export default (ctx) => {
         return typed(['block', ['result', 'f64'],
           ['local.set', `$${value}`, asF64(emit(proto))],
           ['if', ['result', 'f64'],
-            ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${value}`]]], ['i32.const', PTR.ARRAY]],
+            ptrTypeEq(['local.get', `$${value}`], PTR.ARRAY),
             ['then', ['block', ['result', 'f64'],
               ['local.set', `$${dst2}`, ['call', '$__arr_from', ['i64.reinterpret_f64', ['local.get', `$${value}`]]]],
               ['local.set', `$${srcOff2}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${value}`]]]],
@@ -495,7 +640,7 @@ export default (ctx) => {
 // Used only after the target schema is known. Unknown HASH targets can grow by
 // returning a new pointer, which would not preserve aliases to the old value.
 function emitDynamicAssign(target, sources, sourceSchemas = sources.map(resolveSchema)) {
-  includeModule('collection')
+  ctx.module.include('collection')
   inc('__hash_set', '__dyn_get_any', '__ptr_offset', '__len')
   const t = temp('adt'), s = temp('ads'), sBase = tempI32('adsb')
   const keys = temp('adk'), keysBase = tempI32('adkb'), len = tempI32('adn')
@@ -543,6 +688,56 @@ function emitDynamicAssign(target, sources, sourceSchemas = sources.map(resolveS
   return typed(['block', ['result', 'f64'], ...body], 'f64')
 }
 
+// Object.assign into a target whose schema is unknown at compile time (e.g.
+// `ctx.core.stdlibDeps` — an empty `{}` grown dynamically). Copy every source
+// key into the target's dynamic props via __dyn_set, which updates the
+// per-object hash in place: the target pointer stays stable, so no write-back
+// to the (possibly member-access) lvalue is needed. Returns the target.
+function emitObjectAssignDynamic(target, sources) {
+  ctx.module.include('collection')
+  inc('__dyn_set', '__dyn_get_any', '__ptr_offset', '__len')
+  const t = temp('oat'), s = temp('oas'), sBase = tempI32('oasb')
+  const keys = temp('oak'), keysBase = tempI32('oakb'), len = tempI32('oan')
+  const i = tempI32('oai'), key = temp('oakey')
+  const id = ctx.func.uniq++
+  const setKey = (keyBits, valBits) =>
+    ['drop', ['call', '$__dyn_set', ['i64.reinterpret_f64', ['local.get', `$${t}`]], keyBits, valBits]]
+  const body = [['local.set', `$${t}`, asF64(emit(target))]]
+
+  for (let si = 0; si < sources.length; si++) {
+    const source = sources[si]
+    const sSchema = resolveSchema(source)
+    body.push(['local.set', `$${s}`, asF64(emit(source))])
+    if (sSchema) {
+      body.push(['local.set', `$${sBase}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${s}`]]]])
+      for (let pi = 0; pi < sSchema.length; pi++)
+        body.push(setKey(asI64(emit(['str', String(sSchema[pi])])), ctx.abi.object.ops.loadBits(['local.get', `$${sBase}`], pi)))
+      continue
+    }
+    body.push(
+      ['local.set', `$${keys}`, runtimeKeysFromTemp(s, 'oak')],
+      ['local.set', `$${keysBase}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${keys}`]]]],
+      ['local.set', `$${len}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${keys}`]]]],
+      ['local.set', `$${i}`, ['i32.const', 0]],
+      ['block', `$oabrk${id}_${si}`, ['loop', `$oaloop${id}_${si}`,
+        ['br_if', `$oabrk${id}_${si}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${len}`]]],
+        ['local.set', `$${key}`, ['f64.load',
+          ['i32.add', ['local.get', `$${keysBase}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]],
+        setKey(['i64.reinterpret_f64', ['local.get', `$${key}`]],
+          ['call', '$__dyn_get_any', ['i64.reinterpret_f64', ['local.get', `$${s}`]], ['i64.reinterpret_f64', ['local.get', `$${key}`]]]),
+        ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
+        ['br', `$oaloop${id}_${si}`]]])
+  }
+  body.push(['local.get', `$${t}`])
+  return typed(['block', ['result', 'f64'], ...body], 'f64')
+}
+
+// A bound var is dynamically keyed when some `obj[k]=v` (non-literal key) wrote
+// to it — program-facts records these in `ctx.types.dynKeyVars`. Such an object
+// can hold props beyond its static schema, so schema-only enumeration would drop
+// them; callers route it through the runtime schema∪dyn-props merge instead.
+const mayHaveDynProps = (obj) => typeof obj === 'string' && !!ctx.types.dynKeyVars?.has(obj)
+
 function resolveSchema(obj) {
   if (typeof obj === 'string') return ctx.schema.resolve(obj)
   if (Array.isArray(obj) && obj[0] === '{}')
@@ -554,6 +749,18 @@ function resolveSchema(obj) {
   return null
 }
 
+// Schema of a spread SOURCE, for the OBJECT-vs-HASH decision. A function
+// parameter's runtime shape is caller-determined — its `resolveSchema` is an
+// inferred/union guess bound only by emit (analysis sees it as unknown). Trusting
+// it would (a) slot-index-copy from a layout the actual argument need not have and
+// (b) make emit build an OBJECT while analysis HASH-typed the binding, so reads
+// misdispatch. Treat params as unknown → dynamic runtime-key spread (always sound),
+// mirroring spreadSchema in src/kind.js so both phases agree.
+function spreadSourceSchema(obj) {
+  if (typeof obj === 'string' && ctx.func.current?.params?.some(p => p.name === obj)) return null
+  return resolveSchema(obj)
+}
+
 /**
  * Emit object literal with spread: {...a, x: 1, ...b, y: 2}
  * Merges schemas from all sources, allocates result, copies in order.
@@ -568,22 +775,27 @@ function takeLiteralTarget() {
 }
 
 function emitObjectSpread(props, spreadTarget = takeLiteralTarget()) {
-  // Collect merged schema: union of all spread source schemas + explicit props
+  // Resolve every spread source's schema. A source with no static schema means
+  // its full key set is unknown at compile time, so the merge result must be a
+  // HASH (dynamic dict) — a fixed schema would silently drop the source's keys
+  // it doesn't list. Only when EVERY source is known do we build the fixed-shape
+  // OBJECT below.
   const allNames = []
   const addName = n => { if (!allNames.includes(n)) allNames.push(n) }
+  let allKnown = true
   for (const p of props) {
     if (Array.isArray(p) && p[0] === '...') {
-      const s = resolveSchema(p[1])
+      const s = spreadSourceSchema(p[1])
       if (s) for (const n of s) addName(n)
+      else allKnown = false
     } else if (Array.isArray(p) && p[0] === ':') addName(p[1])
   }
-  // Pragmatic fallback: single spread source with no resolvable schema
-  // (e.g. `{ ...opts }` where opts is a parameter). Emit source directly.
-  // Alias rather than clone — safe for read-only use; mutation would affect source.
-  if (!allNames.length && props.length === 1 && Array.isArray(props[0]) && props[0][0] === '...') {
+  // Single unknown spread `{ ...opts }` → alias the source directly. Safe for
+  // read-only use; mutation would affect the source (a true clone takes the
+  // dynamic-merge path below).
+  if (!allKnown && props.length === 1 && Array.isArray(props[0]) && props[0][0] === '...')
     return typed(asF64(emit(props[0][1])), 'f64')
-  }
-  if (!allNames.length) err('Object spread: cannot resolve source schema')
+  if (!allKnown) return emitDynamicSpread(props)
 
   const schemaId = ctx.schema.register(allNames)
   const schema = ctx.schema.list[schemaId]
@@ -594,26 +806,9 @@ function emitObjectSpread(props, spreadTarget = takeLiteralTarget()) {
   const body = [['local.set', `$${t}`, ['call', '$__alloc_hdr', ['i32.const', 0], ['i32.const', ctx.abi.object.ops.allocSlots(schema.length)]]]]
 
   // Process props in order — later props override earlier (JS semantics)
-  let srcF
   for (const p of props) {
     if (Array.isArray(p) && p[0] === '...') {
       const sSchema = resolveSchema(p[1])
-      if (!sSchema) {
-        // Unknown-schema source (e.g. parameter). Override each slot via runtime
-        // __dyn_get_or using existing value as fallback.
-        includeModule('collection')
-        inc('__dyn_get_or')
-        srcF ??= temp('ospf')
-        body.push(['local.set', `$${srcF}`, asF64(emit(p[1]))])
-        for (let i = 0; i < schema.length; i++) {
-          const base = ['local.get', `$${t}`]
-          body.push(ctx.abi.object.ops.store(base, i,
-            ['f64.reinterpret_i64', ['call', '$__dyn_get_or', ['i64.reinterpret_f64', ['local.get', `$${srcF}`]],
-              asI64(emit(['str', String(schema[i])])),
-              ctx.abi.object.ops.loadBits(base, i)]]))
-        }
-        continue
-      }
       body.push(['local.set', `$${src}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', asF64(emit(p[1]))]]])
       for (let si = 0; si < sSchema.length; si++) {
         const ti = schema.indexOf(sSchema[si])
@@ -622,7 +817,7 @@ function emitObjectSpread(props, spreadTarget = takeLiteralTarget()) {
       }
     } else if (Array.isArray(p) && p[0] === ':') {
       const ti = schema.indexOf(p[1])
-      if (ti >= 0) body.push(ctx.abi.object.ops.store(['local.get', `$${t}`], ti, asF64(emit(p[2]))))
+      if (ti >= 0) body.push(ctx.abi.object.ops.store(['local.get', `$${t}`], ti, storedValue(p[2])))
     }
   }
 
@@ -637,6 +832,55 @@ function emitObjectSpread(props, spreadTarget = takeLiteralTarget()) {
   return typed(['block', ['result', 'f64'], ...body], 'f64')
 }
 
+// Spread merge when any source schema is unknown: build a fresh HASH and copy
+// every key of each source in order (later overrides earlier — JS semantics),
+// threading explicit `k: v` props at their source position. Mirrors
+// emitDynamicAssign but seeds an empty HASH instead of an existing target.
+function emitDynamicSpread(props) {
+  ctx.module.include('collection')
+  inc('__hash_new', '__hash_set', '__dyn_get_any', '__ptr_offset', '__len')
+  const t = temp('dst'), s = temp('dss'), sBase = tempI32('dssb')
+  const keys = temp('dsk'), keysBase = tempI32('dskb'), len = tempI32('dsn')
+  const i = tempI32('dsi'), key = temp('dskey')
+  const id = ctx.func.uniq++
+  // `__hash_set` may rehash and return a new pointer, so thread it back into $t.
+  const setKey = (keyBits, valBits) =>
+    ['local.set', `$${t}`, ['f64.reinterpret_i64',
+      ['call', '$__hash_set', ['i64.reinterpret_f64', ['local.get', `$${t}`]], keyBits, valBits]]]
+  const body = [['local.set', `$${t}`, ['call', '$__hash_new']]]
+
+  for (let pi = 0; pi < props.length; pi++) {
+    const p = props[pi]
+    if (Array.isArray(p) && p[0] === ':') {
+      body.push(setKey(asI64(emit(['str', String(p[1])])), asI64(emit(p[2]))))
+      continue
+    }
+    const sSchema = spreadSourceSchema(p[1])
+    body.push(['local.set', `$${s}`, asF64(emit(p[1]))])
+    if (sSchema) {
+      body.push(['local.set', `$${sBase}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${s}`]]]])
+      for (let si = 0; si < sSchema.length; si++)
+        body.push(setKey(asI64(emit(['str', String(sSchema[si])])), ctx.abi.object.ops.loadBits(['local.get', `$${sBase}`], si)))
+      continue
+    }
+    body.push(
+      ['local.set', `$${keys}`, runtimeKeysFromTemp(s, 'dsk')],
+      ['local.set', `$${keysBase}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${keys}`]]]],
+      ['local.set', `$${len}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${keys}`]]]],
+      ['local.set', `$${i}`, ['i32.const', 0]],
+      ['block', `$dsbrk${id}_${pi}`, ['loop', `$dsloop${id}_${pi}`,
+        ['br_if', `$dsbrk${id}_${pi}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${len}`]]],
+        ['local.set', `$${key}`, ['f64.load',
+          ['i32.add', ['local.get', `$${keysBase}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]],
+        setKey(['i64.reinterpret_f64', ['local.get', `$${key}`]],
+          ['call', '$__dyn_get_any', ['i64.reinterpret_f64', ['local.get', `$${s}`]], ['i64.reinterpret_f64', ['local.get', `$${key}`]]]),
+        ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
+        ['br', `$dsloop${id}_${pi}`]]])
+  }
+  body.push(['local.get', `$${t}`])
+  return typed(['block', ['result', 'f64'], ...body], 'f64')
+}
+
 function emitStringArray(names) {
   const n = names.length
   const out = allocPtr({ type: PTR.ARRAY, len: n, tag: 'sa' })
@@ -687,9 +931,9 @@ function emitHashEntries(obj) {
 // IR shape from the same source — only difference is whether they enter from
 // a static type guard or a runtime ptr-type check.
 function hashKeysFromTemp(t) {
-  inc('__ptr_offset', '__cap', '__len')
+  inc('__ptr_offset', '__cap', '__len', '__coll_order')
   const off = tempI32('hko'), cap = tempI32('hkc'), n = tempI32('hkn')
-  const i = tempI32('hki'), o = tempI32('hkj'), slot = tempI32('hks')
+  const i = tempI32('hki'), ord = tempI32('hkr'), slot = tempI32('hks')
   const out = allocPtr({ type: PTR.ARRAY, len: ['local.get', `$${n}`], tag: 'hka' })
   const id = ctx.func.uniq++
   return ['block', ['result', 'f64'],
@@ -697,26 +941,23 @@ function hashKeysFromTemp(t) {
     out.init,
     ['local.set', `$${off}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]],
     ['local.set', `$${cap}`, ['call', '$__cap', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]],
+    ['local.set', `$${ord}`, ['call', '$__coll_order', ['local.get', `$${off}`], ['local.get', `$${cap}`], ['i32.const', 24]]],
     ['local.set', `$${i}`, ['i32.const', 0]],
-    ['local.set', `$${o}`, ['i32.const', 0]],
     ['block', `$brk${id}`, ['loop', `$loop${id}`,
-      ['br_if', `$brk${id}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${cap}`]]],
-      ['local.set', `$${slot}`, ['i32.add', ['local.get', `$${off}`],
-        ['i32.mul', ['local.get', `$${i}`], ['i32.const', 24]]]],
-      ['if', ['f64.ne', ['f64.load', ['local.get', `$${slot}`]], ['f64.const', 0]],
-        ['then',
-          elemStore(out.local, o,
-            ['f64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 8]]]),
-          ['local.set', `$${o}`, ['i32.add', ['local.get', `$${o}`], ['i32.const', 1]]]]],
+      ['br_if', `$brk${id}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${n}`]]],
+      ['local.set', `$${slot}`, ['i32.load', ['i32.add', ['local.get', `$${ord}`],
+        ['i32.shl', ['local.get', `$${i}`], ['i32.const', 2]]]]],
+      elemStore(out.local, i,
+        ['f64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 8]]]),
       ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
       ['br', `$loop${id}`]]],
     out.ptr]
 }
 
 function hashValuesFromTemp(t) {
-  inc('__ptr_offset', '__cap', '__len')
+  inc('__ptr_offset', '__cap', '__len', '__coll_order')
   const off = tempI32('hvo'), cap = tempI32('hvc'), n = tempI32('hvn')
-  const i = tempI32('hvi'), o = tempI32('hvj'), slot = tempI32('hvs')
+  const i = tempI32('hvi'), ord = tempI32('hvr'), slot = tempI32('hvs')
   const out = allocPtr({ type: PTR.ARRAY, len: ['local.get', `$${n}`], tag: 'hva' })
   const id = ctx.func.uniq++
   return ['block', ['result', 'f64'],
@@ -724,26 +965,23 @@ function hashValuesFromTemp(t) {
     out.init,
     ['local.set', `$${off}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]],
     ['local.set', `$${cap}`, ['call', '$__cap', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]],
+    ['local.set', `$${ord}`, ['call', '$__coll_order', ['local.get', `$${off}`], ['local.get', `$${cap}`], ['i32.const', 24]]],
     ['local.set', `$${i}`, ['i32.const', 0]],
-    ['local.set', `$${o}`, ['i32.const', 0]],
     ['block', `$vbrk${id}`, ['loop', `$vloop${id}`,
-      ['br_if', `$vbrk${id}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${cap}`]]],
-      ['local.set', `$${slot}`, ['i32.add', ['local.get', `$${off}`],
-        ['i32.mul', ['local.get', `$${i}`], ['i32.const', 24]]]],
-      ['if', ['f64.ne', ['f64.load', ['local.get', `$${slot}`]], ['f64.const', 0]],
-        ['then',
-          elemStore(out.local, o,
-            ['f64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 16]]]),
-          ['local.set', `$${o}`, ['i32.add', ['local.get', `$${o}`], ['i32.const', 1]]]]],
+      ['br_if', `$vbrk${id}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${n}`]]],
+      ['local.set', `$${slot}`, ['i32.load', ['i32.add', ['local.get', `$${ord}`],
+        ['i32.shl', ['local.get', `$${i}`], ['i32.const', 2]]]]],
+      elemStore(out.local, i,
+        ['f64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 16]]]),
       ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
       ['br', `$vloop${id}`]]],
     out.ptr]
 }
 
 function hashEntriesFromTemp(t) {
-  inc('__ptr_offset', '__cap', '__len', '__alloc_hdr')
+  inc('__ptr_offset', '__cap', '__len', '__alloc_hdr', '__coll_order')
   const off = tempI32('heo'), cap = tempI32('hec'), n = tempI32('hen')
-  const i = tempI32('hei'), o = tempI32('hej'), slot = tempI32('hes'), pair = tempI32('hep')
+  const i = tempI32('hei'), ord = tempI32('her'), slot = tempI32('hes'), pair = tempI32('hep')
   const out = allocPtr({ type: PTR.ARRAY, len: ['local.get', `$${n}`], tag: 'hea' })
   const id = ctx.func.uniq++
   return ['block', ['result', 'f64'],
@@ -751,21 +989,18 @@ function hashEntriesFromTemp(t) {
     out.init,
     ['local.set', `$${off}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]],
     ['local.set', `$${cap}`, ['call', '$__cap', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]],
+    ['local.set', `$${ord}`, ['call', '$__coll_order', ['local.get', `$${off}`], ['local.get', `$${cap}`], ['i32.const', 24]]],
     ['local.set', `$${i}`, ['i32.const', 0]],
-    ['local.set', `$${o}`, ['i32.const', 0]],
     ['block', `$ebrk${id}`, ['loop', `$eloop${id}`,
-      ['br_if', `$ebrk${id}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${cap}`]]],
-      ['local.set', `$${slot}`, ['i32.add', ['local.get', `$${off}`],
-        ['i32.mul', ['local.get', `$${i}`], ['i32.const', 24]]]],
-      ['if', ['f64.ne', ['f64.load', ['local.get', `$${slot}`]], ['f64.const', 0]],
-        ['then',
-          ['local.set', `$${pair}`, ['call', '$__alloc_hdr', ['i32.const', 2], ['i32.const', 2]]],
-          ['f64.store', ['local.get', `$${pair}`],
-            ['f64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 8]]]],
-          ['f64.store', ['i32.add', ['local.get', `$${pair}`], ['i32.const', 8]],
-            ['f64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 16]]]],
-          elemStore(out.local, o, mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${pair}`])),
-          ['local.set', `$${o}`, ['i32.add', ['local.get', `$${o}`], ['i32.const', 1]]]]],
+      ['br_if', `$ebrk${id}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${n}`]]],
+      ['local.set', `$${slot}`, ['i32.load', ['i32.add', ['local.get', `$${ord}`],
+        ['i32.shl', ['local.get', `$${i}`], ['i32.const', 2]]]]],
+      ['local.set', `$${pair}`, ['call', '$__alloc_hdr', ['i32.const', 2], ['i32.const', 2]]],
+      ['f64.store', ['local.get', `$${pair}`],
+        ['f64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 8]]]],
+      ['f64.store', ['i32.add', ['local.get', `$${pair}`], ['i32.const', 8]],
+        ['f64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 16]]]],
+      elemStore(out.local, i, mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${pair}`])),
       ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
       ['br', `$eloop${id}`]]],
     out.ptr]
@@ -789,7 +1024,7 @@ function runtimeKeysFromTemp(t, tag) {
   // JSON.parse or compile-time schemas — the OBJECT arm reads it at runtime
   // and the watr resolver requires the symbol to be declared.
   if (!ctx.scope.globals.has('__schema_tbl'))
-    ctx.scope.globals.set('__schema_tbl', '(global $__schema_tbl (mut i32) (i32.const 0))')
+    declGlobal('__schema_tbl', 'i32')
   const tt = tempI32(`${tag}t`)
   const empty = allocPtr({ type: PTR.ARRAY, len: 0, tag: `${tag}e` })
   return ['block', ['result', 'f64'],
@@ -798,9 +1033,7 @@ function runtimeKeysFromTemp(t, tag) {
       ['i32.eq', ['local.get', `$${tt}`], ['i32.const', PTR.HASH]],
       ['then', hashKeysFromTemp(t)],
       ['else', ['if', ['result', 'f64'],
-        ['i32.and',
-          ['i32.eq', ['local.get', `$${tt}`], ['i32.const', PTR.OBJECT]],
-          ['i32.ne', ['global.get', '$__schema_tbl'], ['i32.const', 0]]],
+        ['i32.eq', ['local.get', `$${tt}`], ['i32.const', PTR.OBJECT]],
         ['then', objectKeysFromTemp(t)],
         ['else', ['block', ['result', 'f64'], empty.init, empty.ptr]]]]]]
 }
@@ -808,7 +1041,7 @@ function runtimeKeysFromTemp(t, tag) {
 function emitRuntimeValues(obj) {
   inc('__ptr_type')
   if (!ctx.scope.globals.has('__schema_tbl'))
-    ctx.scope.globals.set('__schema_tbl', '(global $__schema_tbl (mut i32) (i32.const 0))')
+    declGlobal('__schema_tbl', 'i32')
   const t = temp('rv'), tt = tempI32('rvt')
   const empty = allocPtr({ type: PTR.ARRAY, len: 0, tag: 'rve' })
   return typed(['block', ['result', 'f64'],
@@ -818,9 +1051,7 @@ function emitRuntimeValues(obj) {
       ['i32.eq', ['local.get', `$${tt}`], ['i32.const', PTR.HASH]],
       ['then', hashValuesFromTemp(t)],
       ['else', ['if', ['result', 'f64'],
-        ['i32.and',
-          ['i32.eq', ['local.get', `$${tt}`], ['i32.const', PTR.OBJECT]],
-          ['i32.ne', ['global.get', '$__schema_tbl'], ['i32.const', 0]]],
+        ['i32.eq', ['local.get', `$${tt}`], ['i32.const', PTR.OBJECT]],
         ['then', objectValuesFromTemp(t)],
         ['else', ['block', ['result', 'f64'], empty.init, empty.ptr]]]]]], 'f64')
 }
@@ -828,7 +1059,7 @@ function emitRuntimeValues(obj) {
 function emitRuntimeEntries(obj) {
   inc('__ptr_type')
   if (!ctx.scope.globals.has('__schema_tbl'))
-    ctx.scope.globals.set('__schema_tbl', '(global $__schema_tbl (mut i32) (i32.const 0))')
+    declGlobal('__schema_tbl', 'i32')
   const t = temp('re'), tt = tempI32('ret')
   const empty = allocPtr({ type: PTR.ARRAY, len: 0, tag: 'ree' })
   return typed(['block', ['result', 'f64'],
@@ -838,102 +1069,161 @@ function emitRuntimeEntries(obj) {
       ['i32.eq', ['local.get', `$${tt}`], ['i32.const', PTR.HASH]],
       ['then', hashEntriesFromTemp(t)],
       ['else', ['if', ['result', 'f64'],
-        ['i32.and',
-          ['i32.eq', ['local.get', `$${tt}`], ['i32.const', PTR.OBJECT]],
-          ['i32.ne', ['global.get', '$__schema_tbl'], ['i32.const', 0]]],
+        ['i32.eq', ['local.get', `$${tt}`], ['i32.const', PTR.OBJECT]],
         ['then', objectEntriesFromTemp(t)],
         ['else', ['block', ['result', 'f64'], empty.init, empty.ptr]]]]]], 'f64')
 }
 
-// Schema-keyed Object.keys: copy the schema's keys array (a jz Array of
-// STRINGs registered in __schema_tbl[sid]) into a fresh ARRAY so callers can
-// mutate without aliasing the schema substrate.
-function objectKeysFromTemp(t) {
-  inc('__alloc_hdr')
-  const sid = tempI32('oks'), src = tempI32('oksrc'), n = tempI32('okn'), out = tempI32('oko'), i = tempI32('oki')
+// Shared scaffold for Object.{keys,values,entries} on a runtime OBJECT.
+//
+// A plain JS object reports ALL its own keys at enumeration time. jz objects
+// split that surface in two: a static SCHEMA (jz Array of key STRINGs registered
+// in __schema_tbl[sid] + field values inline at base+i*8) and a per-instance
+// HASH of dyn props at base-16 added by computed writes `o[k]=v`. Enumerating
+// only the schema would silently drop dyn keys — the gap that blocked
+// metacircularity (kernel dicts grow via `o[k]=v` then enumerate via Object.keys).
+//
+// All three variants share the entire scaffold — schema lookup, dyn discovery,
+// over-alloc output, two iteration loops, shadow-mirror dedup, length patch,
+// ARRAY ptr boxing. They differ ONLY in per-slot stores:
+//   - keys:    write i64 key
+//   - values:  write f64 value
+//   - entries: alloc 2-slot pair + write boxed ptr
+//
+// Callbacks receive the active locals as named fields so each variant can
+// reference what it needs without knowing the scaffold's layout.
+function emitEnumerateObject(t, emitStaticStore, emitDynStore) {
+  inc('__alloc_hdr', '__ptr_offset', '__coll_order')
+  const sid = tempI32('oes'), src = tempI32('oesrc'), sn = tempI32('oen')
+  const base = tempI32('oebase'), props = tempI64('oepr'), poff = tempI32('oepo')
+  const pcap = tempI32('oepc'), dn = tempI32('oedn'), total = tempI32('oetot')
+  const out = tempI32('oeo'), i = tempI32('oei'), o = tempI32('oej')
+  const slot = tempI32('oesl'), ord = tempI32('oeord')
+  const j = tempI32('oej2'), skip = tempI32('oesk'), pair = tempI32('oep')
   const id = ctx.func.uniq++
+  const env = { out, o, src, base, i, slot, pair }
   return ['block', ['result', 'f64'],
+    // Static schema row: sid (AUX bits) → __schema_tbl[sid] → src offset; n@src-8.
+    // __schema_tbl is omitted when every program schema is empty (dyn-only dicts);
+    // guard the read so empty-table programs see sn=0 here and still enumerate
+    // dyn-props below.
     ['local.set', `$${sid}`, ['i32.wrap_i64', ['i64.and',
       ['i64.shr_u', ['i64.reinterpret_f64', ['local.get', `$${t}`]], ['i64.const', LAYOUT.AUX_SHIFT]],
       ['i64.const', LAYOUT.AUX_MASK]]]],
-    ['local.set', `$${src}`, ['i32.wrap_i64', ['i64.and',
-      ['i64.load', ['i32.add', ['global.get', '$__schema_tbl'], ['i32.shl', ['local.get', `$${sid}`], ['i32.const', 3]]]],
-      ['i64.const', LAYOUT.OFFSET_MASK]]]],
-    ['local.set', `$${n}`, ['i32.load', ['i32.sub', ['local.get', `$${src}`], ['i32.const', 8]]]],
-    ['local.set', `$${out}`, ['call', '$__alloc_hdr',
-      ['local.get', `$${n}`], ['local.get', `$${n}`]]],
-    ['local.set', `$${i}`, ['i32.const', 0]],
-    ['block', `$kbrk${id}`, ['loop', `$kloop${id}`,
-      ['br_if', `$kbrk${id}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${n}`]]],
-      ['i64.store',
-        ['i32.add', ['local.get', `$${out}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]],
-        ['i64.load',
-          ['i32.add', ['local.get', `$${src}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]],
-      ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
-      ['br', `$kloop${id}`]]],
-    mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${out}`])]
-}
-
-function objectValuesFromTemp(t) {
-  inc('__alloc_hdr', '__ptr_offset')
-  const sid = tempI32('ovs'), src = tempI32('ovsrc'), n = tempI32('ovn')
-  const base = tempI32('ovbase'), out = tempI32('ovo'), i = tempI32('ovi')
-  const id = ctx.func.uniq++
-  return ['block', ['result', 'f64'],
-    ['local.set', `$${sid}`, ['i32.wrap_i64', ['i64.and',
-      ['i64.shr_u', ['i64.reinterpret_f64', ['local.get', `$${t}`]], ['i64.const', LAYOUT.AUX_SHIFT]],
-      ['i64.const', LAYOUT.AUX_MASK]]]],
-    ['local.set', `$${src}`, ['i32.wrap_i64', ['i64.and',
-      ['i64.load', ['i32.add', ['global.get', '$__schema_tbl'], ['i32.shl', ['local.get', `$${sid}`], ['i32.const', 3]]]],
-      ['i64.const', LAYOUT.OFFSET_MASK]]]],
-    ['local.set', `$${n}`, ['i32.load', ['i32.sub', ['local.get', `$${src}`], ['i32.const', 8]]]],
+    ['local.set', `$${sn}`, ['i32.const', 0]],
+    ['local.set', `$${src}`, ['i32.const', 0]],
+    ['if', ['i32.ne', ['global.get', '$__schema_tbl'], ['i32.const', 0]],
+      ['then',
+        ['local.set', `$${src}`, ['i32.wrap_i64', ['i64.and',
+          ['i64.load', ['i32.add', ['global.get', '$__schema_tbl'], ['i32.shl', ['local.get', `$${sid}`], ['i32.const', 3]]]],
+          ['i64.const', LAYOUT.OFFSET_MASK]]]],
+        ['local.set', `$${sn}`, ['i32.load', ['i32.sub', ['local.get', `$${src}`], ['i32.const', 8]]]]]],
+    // Dyn-props: heap OBJECTs (base >= __heap_start) carry a HASH propsPtr at
+    // base-16 (0 when none). Static-segment objects have no header, so they
+    // contribute no dyn keys (poff stays 0).
     ['local.set', `$${base}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]],
-    ['local.set', `$${out}`, ['call', '$__alloc_hdr',
-      ['local.get', `$${n}`], ['local.get', `$${n}`]]],
+    ['local.set', `$${dn}`, ['i32.const', 0]],
+    ['local.set', `$${poff}`, ['i32.const', 0]],
+    ['if', ['i32.ge_u', ['local.get', `$${base}`], ['global.get', '$__heap_start']],
+      ['then',
+        ['local.set', `$${props}`, ['i64.load', ['i32.sub', ['local.get', `$${base}`], ['i32.const', 16]]]],
+        ['if', ['i32.eq',
+            ['i32.wrap_i64', ['i64.and', ['i64.shr_u', ['local.get', `$${props}`], ['i64.const', LAYOUT.TAG_SHIFT]], ['i64.const', LAYOUT.TAG_MASK]]],
+            ['i32.const', PTR.HASH]],
+          ['then',
+            // Resolve forward chain — HASH may have forwarded on grow; the raw
+            // propsPtr offset would point at the forward record, not live slots.
+            ['local.set', `$${poff}`, ['call', '$__ptr_offset', ['local.get', `$${props}`]]],
+            ['local.set', `$${pcap}`, ['i32.load', ['i32.sub', ['local.get', `$${poff}`], ['i32.const', 4]]]],
+            ['local.set', `$${dn}`, ['i32.load', ['i32.sub', ['local.get', `$${poff}`], ['i32.const', 8]]]]]]]],
+    // Over-allocate sn+dn; patch length to actual `o` post-dedup so removed
+    // shadow-mirror slots never expose garbage tails.
+    ['local.set', `$${total}`, ['i32.add', ['local.get', `$${sn}`], ['local.get', `$${dn}`]]],
+    ['local.set', `$${out}`, ['call', '$__alloc_hdr', ['local.get', `$${total}`], ['local.get', `$${total}`]]],
+    ['local.set', `$${o}`, ['i32.const', 0]],
+    // Static schema slots — no skip, schema keys are unique by construction.
     ['local.set', `$${i}`, ['i32.const', 0]],
-    ['block', `$ovbrk${id}`, ['loop', `$ovloop${id}`,
-      ['br_if', `$ovbrk${id}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${n}`]]],
-      ['f64.store',
-        ['i32.add', ['local.get', `$${out}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]],
-        ['f64.load',
-          ['i32.add', ['local.get', `$${base}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]],
+    ['block', `$sbrk${id}`, ['loop', `$sloop${id}`,
+      ['br_if', `$sbrk${id}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${sn}`]]],
+      ...emitStaticStore(env),
+      ['local.set', `$${o}`, ['i32.add', ['local.get', `$${o}`], ['i32.const', 1]]],
       ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
-      ['br', `$ovloop${id}`]]],
+      ['br', `$sloop${id}`]]],
+    // Dyn-prop slots in insertion order (__coll_order sorts the dn live 24-byte
+    // slots by packed seq; hash@+0, key@+8, value@+16). Skip entries whose key
+    // is already in the schema — when an object literal has shadow=true (per
+    // needsDynShadow), each schema key is mirrored into propsPtr at construction
+    // so dyn-key reads hit the hash fast path; the mirror is not an enumeration
+    // entity, so we must not emit it twice.
+    ['if', ['i32.ne', ['local.get', `$${poff}`], ['i32.const', 0]],
+      ['then',
+        ['local.set', `$${ord}`, ['call', '$__coll_order', ['local.get', `$${poff}`], ['local.get', `$${pcap}`], ['i32.const', 24]]],
+        ['local.set', `$${i}`, ['i32.const', 0]],
+        ['block', `$dbrk${id}`, ['loop', `$dloop${id}`,
+          ['br_if', `$dbrk${id}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${dn}`]]],
+          ['local.set', `$${slot}`, ['i32.load', ['i32.add', ['local.get', `$${ord}`],
+            ['i32.shl', ['local.get', `$${i}`], ['i32.const', 2]]]]],
+          ['local.set', `$${skip}`, ['i32.const', 0]],
+          ['local.set', `$${j}`, ['i32.const', 0]],
+          ['block', `$skbrk${id}`, ['loop', `$skloop${id}`,
+            ['br_if', `$skbrk${id}`, ['i32.ge_s', ['local.get', `$${j}`], ['local.get', `$${sn}`]]],
+            ['if', ['i64.eq',
+                ['i64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 8]]],
+                ['i64.load', ['i32.add', ['local.get', `$${src}`], ['i32.shl', ['local.get', `$${j}`], ['i32.const', 3]]]]],
+              ['then', ['local.set', `$${skip}`, ['i32.const', 1]], ['br', `$skbrk${id}`]]],
+            ['local.set', `$${j}`, ['i32.add', ['local.get', `$${j}`], ['i32.const', 1]]],
+            ['br', `$skloop${id}`]]],
+          ['if', ['i32.eqz', ['local.get', `$${skip}`]],
+            ['then',
+              ...emitDynStore(env),
+              ['local.set', `$${o}`, ['i32.add', ['local.get', `$${o}`], ['i32.const', 1]]]]],
+          ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
+          ['br', `$dloop${id}`]]]]],
+    ['i32.store', ['i32.sub', ['local.get', `$${out}`], ['i32.const', 8]], ['local.get', `$${o}`]],
     mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${out}`])]
 }
 
-function objectEntriesFromTemp(t) {
-  inc('__alloc_hdr', '__ptr_offset')
-  const sid = tempI32('oes'), src = tempI32('oesrc'), n = tempI32('oen')
-  const base = tempI32('oebase'), out = tempI32('oeo'), i = tempI32('oei'), pair = tempI32('oep')
-  const id = ctx.func.uniq++
-  return ['block', ['result', 'f64'],
-    ['local.set', `$${sid}`, ['i32.wrap_i64', ['i64.and',
-      ['i64.shr_u', ['i64.reinterpret_f64', ['local.get', `$${t}`]], ['i64.const', LAYOUT.AUX_SHIFT]],
-      ['i64.const', LAYOUT.AUX_MASK]]]],
-    ['local.set', `$${src}`, ['i32.wrap_i64', ['i64.and',
-      ['i64.load', ['i32.add', ['global.get', '$__schema_tbl'], ['i32.shl', ['local.get', `$${sid}`], ['i32.const', 3]]]],
-      ['i64.const', LAYOUT.OFFSET_MASK]]]],
-    ['local.set', `$${n}`, ['i32.load', ['i32.sub', ['local.get', `$${src}`], ['i32.const', 8]]]],
-    ['local.set', `$${base}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]],
-    ['local.set', `$${out}`, ['call', '$__alloc_hdr',
-      ['local.get', `$${n}`], ['local.get', `$${n}`]]],
-    ['local.set', `$${i}`, ['i32.const', 0]],
-    ['block', `$oebrk${id}`, ['loop', `$oeloop${id}`,
-      ['br_if', `$oebrk${id}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${n}`]]],
-      ['local.set', `$${pair}`, ['call', '$__alloc_hdr', ['i32.const', 2], ['i32.const', 2]]],
-      ['i64.store',
-        ['local.get', `$${pair}`],
-        ['i64.load',
-          ['i32.add', ['local.get', `$${src}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]],
-      ['f64.store',
-        ['i32.add', ['local.get', `$${pair}`], ['i32.const', 8]],
-        ['f64.load',
-          ['i32.add', ['local.get', `$${base}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]],
-      ['f64.store',
-        ['i32.add', ['local.get', `$${out}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]],
-        mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${pair}`])],
-      ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
-      ['br', `$oeloop${id}`]]],
-    mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${out}`])]
-}
+// Object.keys for an OBJECT — copy schema key (i64@src+i*8) then dyn key (i64@slot+8).
+const objectKeysFromTemp = (t) => emitEnumerateObject(t,
+  ({ out, o, src, i }) => [
+    ['i64.store',
+      ['i32.add', ['local.get', `$${out}`], ['i32.shl', ['local.get', `$${o}`], ['i32.const', 3]]],
+      ['i64.load', ['i32.add', ['local.get', `$${src}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]]],
+  ({ out, o, slot }) => [
+    ['i64.store',
+      ['i32.add', ['local.get', `$${out}`], ['i32.shl', ['local.get', `$${o}`], ['i32.const', 3]]],
+      ['i64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 8]]]]])
+
+// Object.values for an OBJECT — copy schema value (f64@base+i*8) then dyn value (f64@slot+16).
+const objectValuesFromTemp = (t) => emitEnumerateObject(t,
+  ({ out, o, base, i }) => [
+    ['f64.store',
+      ['i32.add', ['local.get', `$${out}`], ['i32.shl', ['local.get', `$${o}`], ['i32.const', 3]]],
+      ['f64.load', ['i32.add', ['local.get', `$${base}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]]],
+  ({ out, o, slot }) => [
+    ['f64.store',
+      ['i32.add', ['local.get', `$${out}`], ['i32.shl', ['local.get', `$${o}`], ['i32.const', 3]]],
+      ['f64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 16]]]]])
+
+// Object.entries for an OBJECT — alloc 2-slot ARRAY pair {key, value} for each
+// schema slot (key from src+i*8, value from base+i*8) then each dyn slot
+// (key@slot+8, value@slot+16) and box the pair into out[o*8].
+const objectEntriesFromTemp = (t) => emitEnumerateObject(t,
+  ({ out, o, src, base, i, pair }) => [
+    ['local.set', `$${pair}`, ['call', '$__alloc_hdr', ['i32.const', 2], ['i32.const', 2]]],
+    ['i64.store', ['local.get', `$${pair}`],
+      ['i64.load', ['i32.add', ['local.get', `$${src}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]],
+    ['f64.store', ['i32.add', ['local.get', `$${pair}`], ['i32.const', 8]],
+      ['f64.load', ['i32.add', ['local.get', `$${base}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]],
+    ['f64.store',
+      ['i32.add', ['local.get', `$${out}`], ['i32.shl', ['local.get', `$${o}`], ['i32.const', 3]]],
+      mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${pair}`])]],
+  ({ out, o, slot, pair }) => [
+    ['local.set', `$${pair}`, ['call', '$__alloc_hdr', ['i32.const', 2], ['i32.const', 2]]],
+    ['i64.store', ['local.get', `$${pair}`],
+      ['i64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 8]]]],
+    ['f64.store', ['i32.add', ['local.get', `$${pair}`], ['i32.const', 8]],
+      ['f64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 16]]]],
+    ['f64.store',
+      ['i32.add', ['local.get', `$${out}`], ['i32.shl', ['local.get', `$${o}`], ['i32.const', 3]]],
+      mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${pair}`])]])