jz 0.5.1 → 0.7.0

package/src/{optimize.js → optimize/index.js}

@@ -27,14 +27,21 @@
  * @module optimize
  */
 
-import { LAYOUT, ctx } from './ctx.js'
-import { findBodyStart } from './ir.js'
+import { LAYOUT, ctx } from '../ctx.js'
+import { VAL } from '../reps.js'
+import { findBodyStart, buildRefcount, nextLocalId, verifyFn } from '../ir.js'
+
+// Debug-mode IR structural check (JZ_DEBUG_INVARIANTS=1). Zero production cost.
+const DBG_IR = typeof process !== 'undefined' && process.env?.JZ_DEBUG_INVARIANTS === '1'
+import { T } from '../ast.js'
 import { vectorizeLaneLocal } from './vectorize.js'
+import { nanPrefixHex, atomNanHex, STR_INTERN_BIT } from '../../layout.js'
 
 const MEMOP = /^[fi](32|64)\.(load|store)(\d+(_[su])?)?$/
-const NAN_BITS = '0x' + LAYOUT.NAN_PREFIX_BITS.toString(16).toUpperCase().padStart(16, '0')
-const NULL_BITS = '0x' + (LAYOUT.NAN_PREFIX_BITS | (1n << BigInt(LAYOUT.AUX_SHIFT))).toString(16).toUpperCase().padStart(16, '0')
-const UNDEF_BITS = '0x' + (LAYOUT.NAN_PREFIX_BITS | (2n << BigInt(LAYOUT.AUX_SHIFT))).toString(16).toUpperCase().padStart(16, '0')
+const NAN_BITS = nanPrefixHex()
+const NULL_BITS = atomNanHex(1)
+const UNDEF_BITS = atomNanHex(2)
+const FALSE_BITS = atomNanHex(4)
 
 /**
  * Optimization passes, partitioned by phase. The `level` presets pick which
@@ -52,21 +59,45 @@ const UNDEF_BITS = '0x' + (LAYOUT.NAN_PREFIX_BITS | (2n << BigInt(LAYOUT.AUX_SHI
  *   3 — level 2 + larger array/hash initial caps + `hoistConstantPool` off
  *       (inline `f64.const` over mutable globals); trades size for speed.
  *
- * String aliases (the size↔speed tradeoff lives entirely in the unroll/scalar
- * knobs; watr is on for all three):
- *   'size'     — loop/const unroll + lane vectorization off, tight scalar-replacement
- *                caps. Smallest wasm.
- *   'balanced' — the default (= level 2).
- *   'speed'    — full nested unroll + lane vectorization (= level 3).
+ * String presets (the size↔speed tradeoff lives entirely in the unroll/scalar
+ * knobs; watr is on for both):
+ *   'size'  — loop/const unroll + lane vectorization off, tight scalar-replacement
+ *             caps. Smallest wasm.
+ *   'speed' — full nested unroll + lane vectorization (= level 3).
+ * The default (level 2) has no string name — omit `optimize` or pass `2`.
+ *
+ * # Two-layer contract (this file vs src/wat/optimize.js)
+ * Both layers walk the same S-expression IR; the boundary is KNOWLEDGE, not
+ * representation:
+ *   - THIS layer owns every pass that needs jz semantics — NaN-box layout
+ *     (fusedRewrite's rebox folds, hoistPtrType), emit-side proofs stamped on
+ *     func nodes (cseScalarLoad's cseLoadBases whitelist), loop shapes as emit
+ *     produces them (narrowLoopBound, hoistInvariantLoop, vectorizeLaneLocal),
+ *     and ctx-derived module facts (hoistGlobalPtrOffset's typed-global set).
+ *   - wat/optimize.js owns generic structural rewrites — const folding,
+ *     copy-prop, branch/DCE/vacuum, dedupe, treeshake, and inlineOnce. One
+ *     deliberate exception: guardRefine lives there despite NaN-box knowledge,
+ *     because the dead tag-dispatch shapes it folds only EXIST after that
+ *     layer's inlining, and its output feeds that layer's fold/branch cleanup
+ *     within the same fixpoint rounds.
+ * Sequencing (driven by index.js): optimizeFunc 'pre' → watOptimize →
+ * optimizeFunc 'post'. The 'post' re-run exists because watr-layer inlining
+ * re-introduces rebox/unbox pairs at spliced boundaries that only
+ * fusedRewrite knows how to fold; csePureExprLoop similarly only pays off
+ * over the inlined shape. Passes must stay idempotent — both phases may
+ * see the same function.
  */
 export const PASS_NAMES = [
   'watr',                     // third-party WAT-level CSE/DCE/inlining (heaviest)
+  'devirtIndirect',           // call_indirect w/ known closure consts → guarded direct calls (WAT-level, grows bytes)
   'hoistPtrType',
   'hoistInvariantPtrOffset',
-  'hoistInvariantPtrOffsetLoop',
+  'hoistInvariantLoop',       // unified LICM (subsumes the former ToInt32/PtrOffsetLoop/CellLoads hoists)
+  'narrowLoopBound',          // f64 loop bound → hoisted i32 (unblocks the lane-vectorizer)
+  'splitCharScan',            // charCodeAt scan loops: split at min(N, s.length) → i32 char carrier (plan-level)
+  'hoistGlobalPtrOffset',     // stable typed GLOBALS: __ptr_offset resolve → once per function (post-watr, module-level)
   'fusedRewrite',             // peephole + ptr-helper inline + memarg fold
   'hoistAddrBase',
-  'hoistInvariantCellLoads',
   'cseScalarLoad',
   'csePureExpr',
   'dropDeadZeroInit',
@@ -76,6 +107,7 @@ export const PASS_NAMES = [
   'specializeMkptr',
   'specializePtrBase',
   'sortStrPoolByFreq',
+  'internStrings',            // slice/substring results probe the static-literal pool: equal-content → canonical bits (bit-eq fast paths)
   'hoistConstantPool',
   'sourceInline',
   'smallConstForUnroll',
@@ -111,16 +143,27 @@ const LEVEL_PRESETS = Object.freeze({
   // closures). Inline `f64.const` is the minimal lowering: V8 CSEs identical
   // constants for free. Measured −3% on jessie parse for +14% binary — exactly
   // the size↔speed trade 'speed' exists to make.
-  3: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8 }),
-  // 'balanced' = level 2; 'size' tightens scalar/unroll caps; 'speed' = level 3.
-  balanced: Object.freeze({ ...ALL_ON, nestedSmallConstForUnroll: 'auto' }),
+  3: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8, reduceUnroll: true, relaxedSimd: true, inlineFns: true }),
+  // 'size' tightens scalar/unroll caps; 'speed' = level 3. There is no 'balanced'
+  // preset — it was a pure synonym for the default level 2 (omit `optimize` or pass 2).
   size: Object.freeze({
     ...ALL_ON,
-    smallConstForUnroll: false, nestedSmallConstForUnroll: false, vectorizeLaneLocal: false,
+    smallConstForUnroll: false, nestedSmallConstForUnroll: false, vectorizeLaneLocal: false, splitCharScan: false,
+    devirtIndirect: false,    // guards + duplicated args grow bytes — speed-only trade
+    internStrings: false,     // the intern index costs ~16 B per eligible literal — speed-only trade
     scalarTypedLoopUnroll: 4, scalarTypedNestedUnroll: 8, scalarTypedArrayLen: 8,
   }),
   // 'speed' === level 3: full watr (inlining on) + L3 cap/hash tuning, pool off.
-  speed: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8 }),
+  // reduceUnroll: vectorize reductions with N independent accumulators (ILP/latency
+  // hiding, ~3x on dot/FIR sums) — a size↔speed trade like the pool-off above, so
+  // speed-only; level 2 / balanced / size keep the single-accumulator reduce.
+  // relaxedSimd: fold f64x2 dot-pairs to f64x2.relaxed_madd (single fused VFMADD,
+  // one rounding) — faster + more accurate, but the fused result diverges bit-for-bit
+  // from the non-fused JS/native reference (bench `fma` parity class). speed-only.
+  // (The stencil + outer-strip vectorizers are NOT level-gated here: they're bit-exact pure wins
+  // like the base lane vectorizer, so they run whenever it does — default-on at level 2+ via
+  // `cfg.experimentalStencil !== false` at the call site, not a speed-only size/precision trade.)
+  speed: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8, reduceUnroll: true, relaxedSimd: true, inlineFns: true }),
 })
 
 /**
@@ -129,7 +172,7 @@ const LEVEL_PRESETS = Object.freeze({
  *   resolveOptimize(undefined | true)         → level 2 stable defaults
  *   resolveOptimize(false | 0)                → all off
  *   resolveOptimize(1 | 2 | 3)                → preset for that level
- *   resolveOptimize('size' | 'speed' | 'balanced') → named alias preset
+ *   resolveOptimize('size' | 'speed')         → named preset ('speed' = level 3)
  *   resolveOptimize({ level: 1, watr: true }) → level 1 base, with watr forced on
  *   resolveOptimize({ level: 'size', vectorizeLaneLocal: true }) → 'size' base, override
  *   resolveOptimize({ hoistAddrBase: false }) → level 2 base, hoistAddrBase off
@@ -137,10 +180,15 @@ const LEVEL_PRESETS = Object.freeze({
 export function resolveOptimize(opt) {
   if (opt === false || opt === 0) return { ...ALL_OFF }
   if (opt === true || opt == null) return { ...LEVEL_PRESETS[2] }
-  if (typeof opt === 'number' || typeof opt === 'string') return { ...(LEVEL_PRESETS[opt] || LEVEL_PRESETS[2]) }
+  // String() the level key: LEVEL_PRESETS has integer-literal keys (0..3), and the
+  // self-host kernel's computed member access `obj[numVar]` misreads a numeric VARIABLE
+  // index against an object (returns undefined — literal `obj[2]` is fine), so a bare
+  // `LEVEL_PRESETS[opt]`/`[baseLevel]` would drop the level-2 default to ALL_ON and
+  // (worse, via the partial result) leave `watr` unset — disabling watOptimize.
+  if (typeof opt === 'number' || typeof opt === 'string') return { ...(LEVEL_PRESETS[String(opt)] || LEVEL_PRESETS[2]) }
   if (typeof opt === 'object') {
     const baseLevel = typeof opt.level === 'number' || typeof opt.level === 'string' ? opt.level : 2
-    const base = LEVEL_PRESETS[baseLevel] || ALL_ON
+    const base = LEVEL_PRESETS[String(baseLevel)] || ALL_ON
     const out = { ...base }
     for (const n of PASS_NAMES) {
       if (!(n in opt)) continue
@@ -148,6 +196,7 @@ export function resolveOptimize(opt) {
       // Preserve sentinel value `nestedSmallConstForUnroll: 'auto'`
       // (resolved by a heuristic at emit time).
       if (n === 'nestedSmallConstForUnroll' && v === 'auto') out[n] = 'auto'
+      else if (n === 'watr' && typeof v === 'object') out[n] = v
       else out[n] = !!v
     }
     // Preserve non-pass tuning keys (e.g. plan.js thresholds)
@@ -182,213 +231,76 @@ export function resolveOptimize(opt) {
  * result is unsafe across realloc, so it isn't hoisted here.)
  */
 export function hoistPtrType(fn) {
-  if (!Array.isArray(fn) || fn[0] !== 'func') return
-  const bodyStart = findBodyStart(fn)
-  if (bodyStart < 0) return
-
-  // Per X: array of regions; each region is array of {parent, idx, role: 'tee'|'get'}.
-  const regions = new Map()
-  // Currently-open region per X (X → region array). Presence ⇔ alive.
-  const open = new Map()
-
-  const ensureRegions = (x) => {
-    let arr = regions.get(x)
-    if (!arr) { arr = []; regions.set(x, arr) }
-    return arr
-  }
-
-  const walk = (node, parent, pi) => {
-    if (!Array.isArray(node)) return
-    const op = node[0]
-
-    if (op === 'call' && node[1] === '$__ptr_type' && node.length === 3) {
+  return regionTrackCSE(fn, {
+    matchSite(node) {
+      // (call $__ptr_type (i64.reinterpret_f64 (local.get X))) — key is X, dep is X.
+      if (node[0] !== 'call' || node[1] !== '$__ptr_type' || node.length !== 3) return null
       const arg = node[2]
-      // Post-i64 migration: arg is (i64.reinterpret_f64 (local.get X)). Peel both wrappers.
       const inner = (Array.isArray(arg) && arg[0] === 'i64.reinterpret_f64' && arg.length === 2) ? arg[1] : arg
-      if (Array.isArray(inner) && inner[0] === 'local.get' && typeof inner[1] === 'string') {
-        const x = inner[1]
-        let region = open.get(x)
-        if (!region) {
-          region = []
-          ensureRegions(x).push(region)
-          open.set(x, region)
-          region.push({ parent, idx: pi, role: 'tee' })
-        } else {
-          region.push({ parent, idx: pi, role: 'get' })
-        }
-        return  // don't recurse — local.get inside is a read, not interesting
-      }
-      // Non-trivial arg: walk children normally
-      for (let i = 2; i < node.length; i++) walk(node[i], node, i)
-      return
-    }
-
-    if ((op === 'local.set' || op === 'local.tee') && typeof node[1] === 'string') {
-      const x = node[1]
-      // Walk value first — it may contain __ptr_type X, which sees pre-write X.
-      for (let i = 2; i < node.length; i++) walk(node[i], node, i)
-      // Then close any open region for X.
-      open.delete(x)
-      return
-    }
-
-    if (op === 'if') {
-      // Skip optional `(result T)` siblings to find cond / then / else.
-      let i = 1
-      while (i < node.length && Array.isArray(node[i]) && node[i][0] === 'result') i++
-      if (i < node.length) walk(node[i], node, i)  // cond
-      i++
-      let thenArm = null, elseArm = null
-      for (; i < node.length; i++) {
-        const c = node[i]
-        if (Array.isArray(c)) {
-          if (c[0] === 'then') thenArm = c
-          else if (c[0] === 'else') elseArm = c
-        }
-      }
-      const beforeArms = new Map(open)
-      let afterThen = beforeArms
-      if (thenArm) {
-        for (let j = 1; j < thenArm.length; j++) walk(thenArm[j], thenArm, j)
-        afterThen = new Map(open)
-      }
-      open.clear()
-      for (const [k, v] of beforeArms) open.set(k, v)
-      let afterElse = beforeArms
-      if (elseArm) {
-        for (let j = 1; j < elseArm.length; j++) walk(elseArm[j], elseArm, j)
-        afterElse = new Map(open)
-      }
-      // Merge: alive after if iff alive on BOTH paths with same region ref
-      // (so the same tee was reachable regardless of which arm executed).
-      open.clear()
-      for (const [k, vT] of afterThen) {
-        if (afterElse.get(k) === vT) open.set(k, vT)
-      }
-      return
-    }
-
-    if (op === 'loop') {
-      // Conservative: any tee installed in iter N may not have run in iter N+1
-      // before reaching the same site (back-edge to loop header). Clear before+after.
-      open.clear()
-      for (let i = 1; i < node.length; i++) walk(node[i], node, i)
-      open.clear()
-      return
-    }
-
-    // block / func-body / generic: walk children sequentially.
-    for (let i = 0; i < node.length; i++) walk(node[i], node, i)
-  }
-
-  for (let i = bodyStart; i < fn.length; i++) walk(fn[i], fn, i)
-
-  if (regions.size === 0) return
-
-  // Commit: for each X with ≥1 usable region, allocate one shared local and rewrite.
-  // Per-region threshold ≥2 (a singleton would be pure cost).
-  let hoistId = 0
-  const locals = []
-  for (const [, regs] of regions) {
-    let usable = false
-    for (const r of regs) if (r.length >= 2) { usable = true; break }
-    if (!usable) continue
-    const tLocal = `$__pt${hoistId++}`
-    locals.push(['local', tLocal, 'i32'])
-    for (const r of regs) {
-      if (r.length < 2) continue
-      for (let i = 0; i < r.length; i++) {
-        const { parent, idx, role } = r[i]
-        if (role === 'tee') parent[idx] = ['local.tee', tLocal, parent[idx]]
-        else parent[idx] = ['local.get', tLocal]
-      }
-    }
-  }
-  if (locals.length) fn.splice(bodyStart, 0, ...locals)
+      if (!Array.isArray(inner) || inner[0] !== 'local.get' || typeof inner[1] !== 'string') return null
+      const x = inner[1]
+      return { key: x, deps: [x] }
+    },
+    localPrefix: 'pt',
+    localType: 'i32',
+  })
 }
 
-/**
- * CSE repeated `(i32.add (local.get $A) (i32.shl (local.get $B) (i32.const K)))`
- * — the shape jz emits for `arr[idx + k]` typed-array reads after foldMemargOffsets
- * absorbs the constant K into `offset=`. The remaining base expression is
- * recomputed once per `arr[…]` read; biquad's inner cascade has 9 such reads
- * sharing 2 base shapes per iteration. V8's CSE usually catches this, but emitting
- * the share explicitly avoids relying on tier-up and helps wasm2c / wasm-opt too.
+/** Region-tracking CSE skeleton shared by hoistPtrType and hoistAddrBase.
+ *  Walks `fn`, accumulating "regions" — sequences of structurally-identical
+ *  sites along straight-line control flow where the site's value is invariant
+ *  (no writes to its dependent locals between sites). Per region with ≥2 sites,
+ *  allocates one `$__<prefix><id>` local and rewrites the first site to
+ *  `local.tee` and the rest to `local.get`.
  *
- * Same region-tracking discipline as hoistPtrType: open region per key, closed
- * by re-assignment to either A or B; loop entry/exit clears all open regions.
+ *  Control-flow semantics:
+ *    - `local.set/tee X` closes every region whose dep set includes X.
+ *    - `if`/`else` arms walk independently from the if-entry open set; after
+ *      the if, a region is open iff it was open on BOTH arms (same region ref).
+ *    - `loop` clears open before AND after — back edges may skip the original tee.
+ *    - `block` / func body — sequential walk.
  *
- * Must run AFTER fusedRewrite — relies on shl-distribution + assoc-lift +
- * foldMemargOffsets having normalized the base shape.
- */
-export function hoistAddrBase(fn) {
+ *  `matchSite(node, parent, pi)` returns `{ key, deps }` for a CSE-able site
+ *  (key is a stable string; deps lists locals whose writes invalidate this key)
+ *  or null. Match-arm sites don't recurse into children. */
+function regionTrackCSE(fn, { matchSite, localPrefix, localType }) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
   if (bodyStart < 0) return
 
-  // Per key (`$A|$B|K`): array of regions; region: array of {parent, idx, role}.
+  // Per key: array of regions; each region is array of {parent, idx, role: 'tee'|'get'}.
   const regions = new Map()
-  // Open regions keyed by string key; also indexed by local name → set of keys
-  // depending on it (so `local.set X` can close any region whose key references X).
+  // Currently-open region per key. Presence ⇔ alive.
   const open = new Map()
+  // local-name → keys depending on it (so `local.set X` closes all dependent keys).
   const localToKeys = new Map()
 
-  const ensureRegions = (k) => {
-    let arr = regions.get(k)
-    if (!arr) { arr = []; regions.set(k, arr) }
-    return arr
-  }
-  const addLocalDep = (name, key) => {
+  const addDep = (name, key) => {
     let s = localToKeys.get(name)
     if (!s) { s = new Set(); localToKeys.set(name, s) }
     s.add(key)
   }
-  const closeKey = (key) => {
-    const r = open.get(key)
-    if (!r) return
-    open.delete(key)
-    // Don't bother removing from localToKeys; stale entries are filtered on close.
-  }
   const closeForLocal = (name) => {
     const s = localToKeys.get(name)
     if (!s) return
-    for (const k of s) if (open.has(k)) closeKey(k)
+    for (const k of s) open.delete(k)
     localToKeys.delete(name)
   }
 
-  // Returns { A, B, K } if node matches the pattern, else null.
-  const matchPattern = (node) => {
-    if (!Array.isArray(node) || node[0] !== 'i32.add' || node.length !== 3) return null
-    const a = node[1], b = node[2]
-    // Two orderings: (add (get A) (shl (get B) (const K))) or (add (shl …) (get A))
-    let baseGet, shlNode
-    if (Array.isArray(a) && a[0] === 'local.get' && typeof a[1] === 'string' &&
-        Array.isArray(b) && b[0] === 'i32.shl' && b.length === 3) {
-      baseGet = a; shlNode = b
-    } else if (Array.isArray(b) && b[0] === 'local.get' && typeof b[1] === 'string' &&
-               Array.isArray(a) && a[0] === 'i32.shl' && a.length === 3) {
-      baseGet = b; shlNode = a
-    } else return null
-    const idx = shlNode[1], shamt = shlNode[2]
-    if (!Array.isArray(idx) || idx[0] !== 'local.get' || typeof idx[1] !== 'string') return null
-    if (!Array.isArray(shamt) || shamt[0] !== 'i32.const' || typeof shamt[1] !== 'number') return null
-    return { A: baseGet[1], B: idx[1], K: shamt[1] }
-  }
-
   const walk = (node, parent, pi) => {
     if (!Array.isArray(node)) return
     const op = node[0]
 
-    const m = matchPattern(node)
+    const m = matchSite(node, parent, pi)
     if (m) {
-      const key = `${m.A}|${m.B}|${m.K}`
-      let region = open.get(key)
+      let region = open.get(m.key)
       if (!region) {
         region = []
-        ensureRegions(key).push(region)
-        open.set(key, region)
-        addLocalDep(m.A, key)
-        addLocalDep(m.B, key)
+        let regs = regions.get(m.key)
+        if (!regs) { regs = []; regions.set(m.key, regs) }
+        regs.push(region)
+        open.set(m.key, region)
+        for (const d of m.deps) addDep(d, m.key)
         region.push({ parent, idx: pi, role: 'tee' })
       } else {
         region.push({ parent, idx: pi, role: 'get' })
@@ -398,7 +310,7 @@ export function hoistAddrBase(fn) {
 
     if ((op === 'local.set' || op === 'local.tee') && typeof node[1] === 'string') {
       const x = node[1]
-      // Walk value first — it may match patterns referencing pre-write X.
+      // Walk value first — it may contain a site referencing pre-write X.
       for (let i = 2; i < node.length; i++) walk(node[i], node, i)
       closeForLocal(x)
       return
@@ -430,6 +342,7 @@ export function hoistAddrBase(fn) {
         for (let j = 1; j < elseArm.length; j++) walk(elseArm[j], elseArm, j)
         afterElse = new Map(open)
       }
+      // Merge: alive after if iff alive on BOTH paths with same region ref.
       open.clear()
       for (const [k, vT] of afterThen) {
         if (afterElse.get(k) === vT) open.set(k, vT)
@@ -451,16 +364,15 @@ export function hoistAddrBase(fn) {
 
   if (regions.size === 0) return
 
-  let hoistId = 0
+  // Commit: ≥2 sites per region to be worthwhile (a singleton is pure cost).
+  let hoistId = nextLocalId(fn, localPrefix)
   const locals = []
-  // Find next free $__abN id by scanning existing locals.
-  while (fn.some(n => Array.isArray(n) && n[0] === 'local' && n[1] === `$__ab${hoistId}`)) hoistId++
   for (const [, regs] of regions) {
     let usable = false
     for (const r of regs) if (r.length >= 2) { usable = true; break }
     if (!usable) continue
-    const tLocal = `$__ab${hoistId++}`
-    locals.push(['local', tLocal, 'i32'])
+    const tLocal = `$__${localPrefix}${hoistId++}`
+    locals.push(['local', tLocal, localType])
     for (const r of regs) {
       if (r.length < 2) continue
       for (let i = 0; i < r.length; i++) {
@@ -473,6 +385,44 @@ export function hoistAddrBase(fn) {
   if (locals.length) fn.splice(bodyStart, 0, ...locals)
 }
 
+/**
+ * CSE repeated `(i32.add (local.get $A) (i32.shl (local.get $B) (i32.const K)))`
+ * — the shape jz emits for `arr[idx + k]` typed-array reads after foldMemargOffsets
+ * absorbs the constant K into `offset=`. The remaining base expression is
+ * recomputed once per `arr[…]` read; biquad's inner cascade has 9 such reads
+ * sharing 2 base shapes per iteration. V8's CSE usually catches this, but emitting
+ * the share explicitly avoids relying on tier-up and helps wasm2c / wasm-opt too.
+ *
+ * Same region-tracking discipline as hoistPtrType: open region per key, closed
+ * by re-assignment to either A or B; loop entry/exit clears all open regions.
+ *
+ * Must run AFTER fusedRewrite — relies on shl-distribution + assoc-lift +
+ * foldMemargOffsets having normalized the base shape.
+ */
+export function hoistAddrBase(fn) {
+  return regionTrackCSE(fn, {
+    matchSite(node) {
+      if (node[0] !== 'i32.add' || node.length !== 3) return null
+      const a = node[1], b = node[2]
+      // Two orderings: (add (get A) (shl (get B) (const K))) or (add (shl …) (get A))
+      let baseGet, shlNode
+      if (Array.isArray(a) && a[0] === 'local.get' && typeof a[1] === 'string' &&
+          Array.isArray(b) && b[0] === 'i32.shl' && b.length === 3) {
+        baseGet = a; shlNode = b
+      } else if (Array.isArray(b) && b[0] === 'local.get' && typeof b[1] === 'string' &&
+                 Array.isArray(a) && a[0] === 'i32.shl' && a.length === 3) {
+        baseGet = b; shlNode = a
+      } else return null
+      const idx = shlNode[1], shamt = shlNode[2]
+      if (!Array.isArray(idx) || idx[0] !== 'local.get' || typeof idx[1] !== 'string') return null
+      if (!Array.isArray(shamt) || shamt[0] !== 'i32.const' || typeof shamt[1] !== 'number') return null
+      return { key: `${baseGet[1]}|${idx[1]}|${shamt[1]}`, deps: [baseGet[1], idx[1]] }
+    },
+    localPrefix: 'ab',
+    localType: 'i32',
+  })
+}
+
 /**
  * Hoist `(call $__ptr_offset (local.get $X))` to a function-entry snapshot
  * when X is an f64-NaN-boxed parameter that's never reassigned and only ever
@@ -484,7 +434,31 @@ export function hoistAddrBase(fn) {
  * sound for the duration. The whitelist below is the read-only set
  * (no mutation possible); any other callee touching X invalidates hoisting.
  */
-const SAFE_OFFSET_CALLS = new Set(['$__ptr_offset', '$__ptr_type', '$__ptr_aux', '$__len'])
+// Read-only i32-returning calls: safe to hoist when operands are invariant,
+// and their presence in a loop must not block other hoists (hasUnsafeCall).
+// __jss_* are wasm:js-string host builtins over IMMUTABLE JS strings — pure by
+// the same argument as the __ptr_* helpers (charCodeAt won't itself hoist —
+// its index varies — but whitelisting it keeps hasUnsafeCall false so the
+// loop-invariant __jss_length in the same loop condition CAN hoist).
+const SAFE_OFFSET_CALLS = new Set(['$__ptr_offset', '$__ptr_type', '$__ptr_aux', '$__len', '$__jss_length', '$__jss_charCodeAt'])
+
+// Calls that don't modify EXISTING heap memory: they may allocate (bump the heap
+// pointer) or do tag dispatch, but they never write to an address a hoisted
+// __typed_idx/__str_idx element read would revisit. Their presence must not
+// block readonly-mem-call LICM (else any `s += unknown` — which dispatches via
+// __is_str_key/__str_concat — would pin every invariant array element in-loop:
+// the jagged-array `grid[i][j]` deopt).
+const NON_MUTATING_CALLS = new Set(['$__is_str_key', '$__str_concat', '$__to_num', '$__to_str', '$__str_byteLen'])
+
+// Read-only HEAP-MEMORY calls: like SAFE_OFFSET_CALLS but they read element
+// storage that a direct f64.store/i32.store in the loop could alias. Safe to
+// hoist only when the loop has no mutating call AND no direct store at all (we
+// can't do alias analysis at WAT level). __typed_idx/__str_idx read arr[i] /
+// s[i]; plain-array element writes go through calls (caught by hasUnsafeCall),
+// and typed-array writes are direct stores (caught by hasDirectStore) — so the
+// guard covers both. This is what lets LICM hoist `grid[i]` out of a read-only
+// `for(j) { ... grid[i][j] ... }` inner loop (the jagged-array deopt).
+const READONLY_MEM_CALLS = new Set(['$__typed_idx', '$__str_idx'])
 
 export function hoistInvariantPtrOffset(fn) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
@@ -558,8 +532,7 @@ export function hoistInvariantPtrOffset(fn) {
 
   if (sites.size === 0) return
 
-  let hoistId = 0
-  while (fn.some(n => Array.isArray(n) && n[0] === 'local' && n[1] === `$__po${hoistId}`)) hoistId++
+  let hoistId = nextLocalId(fn, 'po')
 
   const newLocals = []
   const snaps = []
@@ -577,97 +550,310 @@ export function hoistInvariantPtrOffset(fn) {
   if (newLocals.length) fn.splice(bodyStart, 0, ...newLocals, ...snaps)
 }
 
+
+// Non-trapping, side-effect-free ops whose result is a pure function of their
+// operands. Hoisting one to the pre-header is sound iff its operands are loop-
+// invariant: same value every iteration, no traps, no memory/global effects.
+// DELIBERATELY EXCLUDES trapping ops — i32/i64 div_s/u & rem_s/u (trap on 0),
+// non-saturating trunc_f64 (trap on overflow/NaN) — because hoisting a trap to
+// the pre-header would fire it even when the loop runs zero times. Loads and
+// calls are NOT here; they are admitted by `pureGiven` only under the loop's
+// effect-summary barriers (cell loads with no aliasing store/call; the read-only
+// __ptr_* call whitelist with no other call).
+// Boxed-capture cells are `freshLocal`-generated, so the name carries the T
+// (U+E000) prefix: `$<T>cell_<var>`. Built from the constant — a hand-typed
+// `'$cell_'` literal silently omits the invisible T and never matches.
+const CELL_PREFIX = '$' + T + 'cell_'
+
+// Ops V8's wasm tier (TurboFan) will NOT hoist out of a loop itself: saturating
+// f64→int truncation and `select` are not LICM-eligible there, memory loads are
+// blocked by conservative aliasing, and calls are opaque. These are the ONLY
+// things worth hoisting — V8 already does general arithmetic LICM, and hoisting
+// pure arithmetic ourselves only bloats the body and breaks the lane-vectorizer's
+// straight-line pattern match. So a subtree is hoisted only if it contains one.
+const HARD_OPS = new Set([
+  'i64.trunc_sat_f64_s', 'i64.trunc_sat_f64_u', 'i32.trunc_sat_f64_s', 'i32.trunc_sat_f64_u',
+  'select', 'f64.load', 'i32.load', 'call',
+])
+const hasHardOp = (n) => Array.isArray(n) && (HARD_OPS.has(n[0]) || n.some((c, i) => i > 0 && hasHardOp(c)))
+
+// The inline typed-array base decode `(i32.wrap_i64 (i64.and (i64.reinterpret_f64
+// (local|global X)) 0xFFFFFFFF))` — what `typedBase` emits for a NaN-boxed pointer.
+// V8's wasm tier does NOT reliably LICM this i64 reinterpret chain, and it carries no
+// HARD_OP, so without this it stays per-element inside the loop. It is the typed-read
+// equivalent of the `__ptr_offset` call (a HARD_OP) that hoistGlobalPtrOffset hoists at
+// function scope; admitting it here also covers a pointer reassigned ELSEWHERE in the
+// function (the ping-pong double-buffer `a = b` in wireworld / any CA), where the base
+// is invariant within each loop but not function-wide.
+const isPtrBaseDecode = (n) =>
+  Array.isArray(n) && n[0] === 'i32.wrap_i64' && n.length === 2 &&
+  Array.isArray(n[1]) && n[1][0] === 'i64.and' && n[1].length === 3 &&
+  Array.isArray(n[1][2]) && n[1][2][0] === 'i64.const' &&
+  (typeof n[1][2][1] === 'string' ? Number(n[1][2][1]) : n[1][2][1]) === LAYOUT.OFFSET_MASK &&
+  Array.isArray(n[1][1]) && n[1][1][0] === 'i64.reinterpret_f64' && n[1][1].length === 2 &&
+  Array.isArray(n[1][1][1]) && (n[1][1][1][0] === 'local.get' || n[1][1][1][0] === 'global.get')
+
+const PURE_LICM_OPS = new Set([
+  'f64.add', 'f64.sub', 'f64.mul', 'f64.div', 'f64.neg', 'f64.abs', 'f64.sqrt',
+  'f64.min', 'f64.max', 'f64.ceil', 'f64.floor', 'f64.trunc', 'f64.nearest', 'f64.copysign',
+  'i32.add', 'i32.sub', 'i32.mul', 'i32.and', 'i32.or', 'i32.xor',
+  'i32.shl', 'i32.shr_s', 'i32.shr_u', 'i32.rotl', 'i32.rotr', 'i32.clz', 'i32.ctz', 'i32.popcnt', 'i32.eqz',
+  'i64.add', 'i64.sub', 'i64.mul', 'i64.and', 'i64.or', 'i64.xor',
+  'i64.shl', 'i64.shr_s', 'i64.shr_u', 'i64.rotl', 'i64.rotr', 'i64.eqz',
+  'f64.eq', 'f64.ne', 'f64.lt', 'f64.gt', 'f64.le', 'f64.ge',
+  'i32.eq', 'i32.ne', 'i32.lt_s', 'i32.lt_u', 'i32.gt_s', 'i32.gt_u', 'i32.le_s', 'i32.le_u', 'i32.ge_s', 'i32.ge_u',
+  'i64.eq', 'i64.ne', 'i64.lt_s', 'i64.lt_u', 'i64.gt_s', 'i64.gt_u', 'i64.le_s', 'i64.le_u', 'i64.ge_s', 'i64.ge_u',
+  'f64.convert_i32_s', 'f64.convert_i32_u', 'f64.convert_i64_s', 'f64.convert_i64_u',
+  'i32.trunc_sat_f64_s', 'i32.trunc_sat_f64_u', 'i64.trunc_sat_f64_s', 'i64.trunc_sat_f64_u',
+  'i32.wrap_i64', 'i64.extend_i32_s', 'i64.extend_i32_u',
+  'f64.reinterpret_i64', 'i64.reinterpret_f64', 'f32.reinterpret_i32', 'i32.reinterpret_f32',
+  'f64.promote_f32', 'f32.demote_f64', 'select',
+])
+
 /**
- * Per-loop hoist of `(call $__ptr_offset (local.get X))` for locals X that are
- * loop-invariant (no `local.set/local.tee` to X anywhere in the loop body, no
- * non-safe call inside the loop). Mirrors `hoistInvariantCellLoads`.
+ * Unified loop-invariant code motion. One principle replaces the three former
+ * pattern hoists (ToInt32 / __ptr_offset / cell-load): a MAXIMAL pure subtree
+ * whose every free input is loop-invariant is computed once before the loop, in
+ * a fresh snap local.
  *
- * The function-level pass above only handles params (single hoist at func
- * entry). This pass handles assigned locals that go invariant within a loop
- * scope — the aos pattern: `let rows = []; for (...) rows.push(...)` — outside
- * the build loop, `rows` is no longer reassigned, so `__ptr_offset(rows)` is
- * loop-invariant in the consumer loop.
+ * Invariance/purity (`pureGiven`) is closed over PURE_LICM_OPS plus two memory-
+ * touching leaves admitted only under the loop's effect summary (`collectMutations`):
+ *   - (f64.load (local.get $cell_X))   iff no f64.store to $cell_X and no call in loop
+ *   - (call $__ptr_offset|__ptr_type|__ptr_aux|__len …)  iff no non-whitelisted call
+ * — exactly the old per-pass barriers, generalized. A subtree may also WRITE a
+ * local via (local.tee P E) iff P is private to the subtree (occurs nowhere else
+ * in the loop); this hoists the guarded-ToInt32 form
+ *   (select (i32.wrap_i64 (i64.trunc_sat_f64_s (local.tee P E))) 0 (f64.ne (get P) G))
+ * as a unit — which the old leaf-only matcher could not (it needed a bare local).
  *
- * Inside-out: inner loops first. After an inner-loop hoist, the outer loop now
- * contains a `(local.set $__pol (call $__ptr_offset ...))` whose call gets
- * hoisted again at the outer level, climbing the snap up to the outermost loop
- * where X is invariant. Cleanup of the chained `local.set` movs is handled by
- * watr CSE/DCE.
+ * Bottom-up (inner loops first → progressive climbing), refcount-guarded against
+ * watr's shared CSE subtrees, snaps spliced before the loop, decls at bodyStart.
+ * Idempotent: re-running sees only `(local.get $__liN)` and finds nothing to do.
  */
-export function hoistInvariantPtrOffsetLoop(fn) {
+export function hoistInvariantLoop(fn) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
   if (bodyStart < 0) return
 
-  let snapId = 0
-  while (fn.some(n => Array.isArray(n) && n[0] === 'local' && n[1] === `$__pol${snapId}`)) snapId++
-  const newLocals = []
+  // Cheap early-out: no loop ⇒ nothing to hoist (skip the buildRefcount walk).
+  let hasLoop = false
+  const scanLoop = (n) => {
+    if (!Array.isArray(n) || hasLoop) return
+    if (n[0] === 'loop') { hasLoop = true; return }
+    for (let i = 1; i < n.length && !hasLoop; i++) scanLoop(n[i])
+  }
+  for (let i = bodyStart; i < fn.length && !hasLoop; i++) scanLoop(fn[i])
+  if (!hasLoop) return
 
-  // Refcount across the whole fn to skip shared subtrees (watr CSE may leave them).
-  const refcount = new Map()
-  const countRefs = (node) => {
-    if (!Array.isArray(node)) return
-    const n = (refcount.get(node) || 0) + 1
-    refcount.set(node, n)
-    if (n > 1) return
-    for (let i = 0; i < node.length; i++) countRefs(node[i])
+  // Result wasm type of a hoistable node (for the snap local decl). null ⇒ can't
+  // type it ⇒ don't hoist. Param/local types come from the func header.
+  const localTypes = new Map()
+  for (let i = 2; i < bodyStart; i++) {
+    const c = fn[i]
+    if (Array.isArray(c) && (c[0] === 'param' || c[0] === 'local') && typeof c[1] === 'string') localTypes.set(c[1], c[2])
+  }
+  const resultType = (node) => {
+    if (!Array.isArray(node)) return null
+    const op = node[0]
+    if (op === 'select') return resultType(node[1])
+    if (op === 'if') {
+      // (if (result T) cond (then ...) (else ...)) — type is the result clause.
+      for (let i = 1; i < node.length; i++) {
+        const c = node[i]
+        if (Array.isArray(c) && c[0] === 'result') return c[1]
+      }
+      return null
+    }
+    if (op === 'block') {
+      for (let i = 1; i < node.length; i++) {
+        const c = node[i]
+        if (Array.isArray(c) && c[0] === 'result') return c[1]
+      }
+      return null
+    }
+    if (op === 'call') {
+      // SAFE_OFFSET_CALLS all return i32; READONLY_MEM_CALLS return f64 (NaN-boxed element)
+      if (SAFE_OFFSET_CALLS.has(node[1])) return 'i32'
+      if (READONLY_MEM_CALLS.has(node[1])) return 'f64'
+      return null
+    }
+    if (op === 'local.get' || op === 'local.tee') return localTypes.get(node[1]) ?? null
+    const dot = op.indexOf('.')
+    if (dot < 0) return null
+    // Comparisons and `eqz` yield i32 regardless of operand type (i64.eq, f64.lt,
+    // i64.eqz, …) — so the operand-type prefix would mistype them. Catch first.
+    const m = op.slice(dot + 1)
+    if (m === 'eqz' || /^(eq|ne|lt|gt|le|ge)(_[su])?$/.test(m)) return 'i32'
+    const p = op.slice(0, dot)
+    if (p === 'i32' || p === 'i64' || p === 'f64' || p === 'f32') return p
+    return null
   }
-  countRefs(fn)
 
-  const processLoop = (loopNode) => {
-    // Recurse into inner loops first (bottom-up).
-    for (let i = 1; i < loopNode.length; i++) {
-      const child = loopNode[i]
-      if (!Array.isArray(child)) continue
-      processNode(child, loopNode, i)
-    }
-
-    // Scan loop body (including nested loops) for writes to any local and for
-    // any non-safe call. Non-safe calls could realloc/move the underlying
-    // array storage and invalidate cached offsets.
-    const writes = new Set()
-    let unsafe = false
+  // Collision-proof snap ids: skip EVERY existing $__li id, not just start at the
+  // lowest free one. watr can renumber/coalesce locals between the pre- and
+  // post-watr optimize phases, leaving a non-contiguous $__li set; a lowest-free +
+  // sequential-increment scheme would then re-issue an in-use id (Duplicate local).
+  const usedLi = new Set()
+  const scanLi = (n) => {
+    if (!Array.isArray(n)) return
+    if (n[0] === 'local' && typeof n[1] === 'string' && n[1].startsWith('$__li')) {
+      const t = n[1].slice(5); if (/^\d+$/.test(t)) usedLi.add(+t)
+    }
+    for (let i = 0; i < n.length; i++) scanLi(n[i])
+  }
+  scanLi(fn)
+  let snapCounter = 0
+  const freshSnap = () => { while (usedLi.has(snapCounter)) snapCounter++; const id = snapCounter++; usedLi.add(id); return `$__li${id}` }
+  const newLocals = []
+  const refcount = buildRefcount(fn)
+
+  const processLoop = (loopNode, nested) => {
+    // Inner loops first (bottom-up) — an inner hoist creates a local.get the
+    // outer level can hoist further. Children run in a nested context.
+    for (let i = 1; i < loopNode.length; i++)
+      if (Array.isArray(loopNode[i])) processNode(loopNode[i], loopNode, i, true)
+
+    // The loop's effect summary (scans nested loops too — conservative).
+    const locals = new Set(), globals = new Set(), storedCells = new Set()
+    let hasUnsafeCall = false, hasAnyCall = false, hasDirectStore = false, hasV128 = false
     const scan = (node) => {
       if (!Array.isArray(node)) return
       const op = node[0]
-      if (op === 'local.set' || op === 'local.tee') {
-        if (typeof node[1] === 'string') writes.add(node[1])
-        for (let i = 2; i < node.length; i++) scan(node[i])
-        return
+      // A vectorized loop (lane/v128 ops) is already register-tight and hand-tuned;
+      // extra scalar hoisting there only adds spill pressure — keep it conservative.
+      if (op.startsWith('v128.') || /^[if]\d+x\d+\./.test(op)) hasV128 = true
+      if (op === 'local.set' || op === 'local.tee') { if (typeof node[1] === 'string') locals.add(node[1]); for (let i = 2; i < node.length; i++) scan(node[i]); return }
+      if (op === 'global.set') { if (typeof node[1] === 'string') globals.add(node[1]); for (let i = 2; i < node.length; i++) scan(node[i]); return }
+      if (op === 'call') { hasAnyCall = true; if (!SAFE_OFFSET_CALLS.has(node[1]) && !READONLY_MEM_CALLS.has(node[1]) && !NON_MUTATING_CALLS.has(node[1])) hasUnsafeCall = true; for (let i = 2; i < node.length; i++) scan(node[i]); return }
+      if (op === 'call_ref' || op === 'call_indirect') { hasAnyCall = hasUnsafeCall = true; for (let i = 1; i < node.length; i++) scan(node[i]); return }
+      if ((op === 'f64.store' || op === 'i32.store') && node.length >= 3) {
+        hasDirectStore = true
+        const a = node[1]
+        if (Array.isArray(a) && a[0] === 'local.get' && typeof a[1] === 'string' && a[1].startsWith(CELL_PREFIX)) storedCells.add(a[1])
+      }
+      for (let i = 1; i < node.length; i++) scan(node[i])
+    }
+    for (let i = 1; i < loopNode.length; i++) scan(loopNode[i])
+
+    // Per-subtree local-occurrence counts and write-sets, memoized bottom-up —
+    // the tee-privacy check queries them for EVERY candidate node, and the old
+    // per-query re-walk (countIn/gatherBound) was quadratic on watr-scale loop
+    // bodies (the single largest compile-time hotspot, ~200ms/compile). All
+    // queries happen during `collect`, before any splice mutates the loop, so
+    // the memo cannot go stale; it is dropped with this processLoop frame.
+    const countsMemo = new Map()  // node → Map(local → occurrences in subtree)
+    const writesMemoL = new Map() // node → Set(locals written in subtree)
+    const EMPTY_COUNTS = new Map(), EMPTY_WRITES = new Set()
+    const countsOf = (node) => {
+      if (!Array.isArray(node)) return EMPTY_COUNTS
+      let m = countsMemo.get(node)
+      if (m) return m
+      m = new Map()
+      const op = node[0]
+      if ((op === 'local.get' || op === 'local.set' || op === 'local.tee') && typeof node[1] === 'string')
+        m.set(node[1], 1)
+      for (let i = 1; i < node.length; i++)
+        for (const [k, v] of countsOf(node[i])) m.set(k, (m.get(k) || 0) + v)
+      countsMemo.set(node, m)
+      return m
+    }
+    const writesIn = (node) => {
+      if (!Array.isArray(node)) return EMPTY_WRITES
+      let s = writesMemoL.get(node)
+      if (s) return s
+      s = new Set()
+      if ((node[0] === 'local.set' || node[0] === 'local.tee') && typeof node[1] === 'string') s.add(node[1])
+      for (let i = 1; i < node.length; i++) for (const w of writesIn(node[i])) s.add(w)
+      writesMemoL.set(node, s)
+      return s
+    }
+    // Whole-loop counts (the former countLocals walk) — one memoized query.
+    const localCount = new Map()
+    for (let i = 1; i < loopNode.length; i++)
+      for (const [k, v] of countsOf(loopNode[i])) localCount.set(k, (localCount.get(k) || 0) + v)
+
+    // Pure & invariant given `bound` (locals written *within* the candidate, hence
+    // local to it). A read of a bound local is OK (its in-subtree value is the
+    // teed invariant). A free read must be unwritten by the loop.
+    const pureGiven = (node, bound) => {
+      if (!Array.isArray(node)) return true   // bare operand string/number
+      const op = node[0]
+      if (op === 'i32.const' || op === 'i64.const' || op === 'f64.const' || op === 'f32.const') return true
+      if (op === 'local.get') return typeof node[1] === 'string' && (bound.has(node[1]) || !locals.has(node[1]))
+      // A global is invariant only if not set directly AND no call in the loop —
+      // any callee may mutate it (no interprocedural effect analysis). (Locals are
+      // frame-private, so calls can't touch them; only direct local.set matters.)
+      if (op === 'global.get') return typeof node[1] === 'string' && !globals.has(node[1]) && !hasAnyCall
+      if (op === 'local.tee') {
+        if (typeof node[1] !== 'string') return false
+        // The operand is evaluated BEFORE the tee writes $X, so a `local.get $X` inside
+        // it reads the loop-carried (previous-iteration) value, not the teed one. Drop
+        // $X from `bound` for the operand: `local.tee $X (… $X …)` is a loop recurrence
+        // (X = f(X) — e.g. the `while ((nn = nn >>> 1))` induction), NOT invariant.
+        const inner = bound.has(node[1]) ? new Set([...bound].filter(b => b !== node[1])) : bound
+        return pureGiven(node[2], inner)
+      }
+      if ((op === 'f64.load' || op === 'i32.load') && node.length === 2) {
+        const a = node[1]
+        return Array.isArray(a) && a[0] === 'local.get' && typeof a[1] === 'string' && a[1].startsWith(CELL_PREFIX)
+          && !hasAnyCall && !storedCells.has(a[1]) && (bound.has(a[1]) || !locals.has(a[1]))
       }
       if (op === 'call') {
-        if (!SAFE_OFFSET_CALLS.has(node[1])) unsafe = true
-        for (let i = 2; i < node.length; i++) scan(node[i])
-        return
+        if (SAFE_OFFSET_CALLS.has(node[1]))
+          return !hasUnsafeCall && node.slice(2).every(c => pureGiven(c, bound))
+        // Read-only heap reads: additionally require no direct store (alias-safe).
+        if (READONLY_MEM_CALLS.has(node[1]))
+          return !hasUnsafeCall && !hasDirectStore && node.slice(2).every(c => pureGiven(c, bound))
+        return false
       }
-      if (op === 'call_ref' || op === 'call_indirect') {
-        unsafe = true
-        for (let i = 1; i < node.length; i++) scan(node[i])
-        return
+      // A value-producing `if` whose condition and both arms are pure is itself
+      // pure — the tag-dispatch idiom `(if (result f64) tag-check (then read-A)
+      // (else read-B))` that wraps __typed_idx/__str_idx element access.
+      if (op === 'if') {
+        for (let i = 1; i < node.length; i++) {
+          const c = node[i]
+          if (!Array.isArray(c)) continue
+          if (c[0] === 'result') continue
+          if (c[0] === 'then' || c[0] === 'else') { if (!c.slice(1).every(x => pureGiven(x, bound))) return false }
+          else if (!pureGiven(c, bound)) return false   // the condition
+        }
+        return true
       }
-      for (let i = 1; i < node.length; i++) scan(node[i])
+      if (PURE_LICM_OPS.has(op)) return node.slice(1).every(c => pureGiven(c, bound))
+      return false
     }
-    for (let i = 1; i < loopNode.length; i++) scan(loopNode[i])
-    if (unsafe) return []
 
-    // Collect call sites for invariant locals. Skip nested loops (already
-    // processed) but recurse through everything else.
-    const sites = new Map()  // localName → [{ parent, idx }]
+    const isHoistable = (node) => {
+      if (!Array.isArray(node)) return false
+      const op = node[0]
+      // Skip trivial leaves: hoisting a bare get/const buys nothing.
+      if (op === 'local.get' || op === 'global.get' || op === 'i32.const' || op === 'i64.const' || op === 'f64.const' || op === 'f32.const') return false
+      const bound = writesIn(node)
+      // Every local the subtree writes must be private to it (no other use in the
+      // loop) — else moving the write to the pre-header changes another reader.
+      for (const b of bound) if (localCount.get(b) !== countsOf(node).get(b)) return false
+      // Top-level loops: only hoist what V8's wasm tier won't — a HARD_OP or the
+      // inline typed-array base decode — and leave plain pure arithmetic to V8's own
+      // LICM (which handles single-level loops well). NESTED (inner) loops are
+      // different: V8's wasm tier under-hoists invariants out of them (a nested
+      // rasterizer/convolution recomputes triangle/row-invariant subexpressions every
+      // iteration), so hoist any pure-invariant subtree there. Soundness is unchanged —
+      // `pureGiven` already proves the subtree is loop-invariant and side-effect-free.
+      return ((nested && !hasV128) || hasHardOp(node) || isPtrBaseDecode(node)) && pureGiven(node, bound)
+    }
+
+    // Maximal extraction: take the largest hoistable subtree; don't descend into
+    // it. Dedup structurally so a repeated invariant expr shares one snap local.
+    const sites = new Map()  // structural key → [{ parent, idx, node }]
     const collect = (node, parent, idx) => {
       if (!Array.isArray(node)) return
-      const op = node[0]
-      if (op === 'loop') return
-      if (op === 'call' && node[1] === '$__ptr_offset' && node.length === 3) {
-        const a = node[2]
-        const inner = (Array.isArray(a) && a[0] === 'i64.reinterpret_f64' && a.length === 2) ? a[1] : a
-        if (Array.isArray(inner) && inner[0] === 'local.get' && typeof inner[1] === 'string'
-            && !writes.has(inner[1])
-            && (refcount.get(node) || 0) <= 1
-            && (refcount.get(parent) || 0) <= 1) {
-          let arr = sites.get(inner[1])
-          if (!arr) { arr = []; sites.set(inner[1], arr) }
-          arr.push({ parent, idx })
-        }
+      if (node[0] === 'loop') return  // already processed bottom-up
+      if (isHoistable(node) && (refcount.get(node) || 0) <= 1 && (refcount.get(parent) || 0) <= 1) {
+        // BigInt-safe: hoistable boxed-pointer subtrees carry i64.const NaN-box prefixes
+        // (BigInt values) that plain JSON.stringify can't serialize — see ast.bigintSafeKey.
+        const key = JSON.stringify(node, (_k, v) => typeof v === 'bigint' ? `${v}n` : v)
+        let arr = sites.get(key); if (!arr) { arr = []; sites.set(key, arr) }
+        arr.push({ parent, idx, node })
         return
       }
       for (let i = 0; i < node.length; i++) collect(node[i], node, i)
@@ -675,190 +861,203 @@ export function hoistInvariantPtrOffsetLoop(fn) {
     for (let i = 1; i < loopNode.length; i++) collect(loopNode[i], loopNode, i)
 
     const snaps = []
-    for (const [X, arr] of sites) {
-      if (arr.length < 1) continue
-      const snapName = `$__pol${snapId++}`
-      newLocals.push(['local', snapName, 'i32'])
-      snaps.push(['local.set', snapName, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', X]]]])
-      for (const { parent, idx } of arr) {
-        parent[idx] = ['local.get', snapName]
-      }
+    for (const [, arr] of sites) {
+      const type = resultType(arr[0].node)
+      if (type == null) continue
+      const snapName = freshSnap()
+      newLocals.push(['local', snapName, type])
+      snaps.push(['local.set', snapName, arr[0].node])  // reuse first node verbatim
+      for (const { parent, idx } of arr) parent[idx] = ['local.get', snapName]
     }
     return snaps
   }
 
-  const processNode = (node, parent, idx) => {
+  const processNode = (node, parent, idx, nested = false) => {
     if (!Array.isArray(node)) return
-    const op = node[0]
-    if (op === 'loop') {
-      const snaps = processLoop(node)
+    if (node[0] === 'loop') {
+      const snaps = processLoop(node, nested)
       if (snaps.length) parent.splice(idx, 0, ...snaps)
       return
     }
-    for (let i = 0; i < node.length; i++) processNode(node[i], node, i)
+    for (let i = 0; i < node.length; i++) processNode(node[i], node, i, nested)
   }
 
-  for (let i = bodyStart; i < fn.length; i++) processNode(fn[i], fn, i)
-
+  for (let i = bodyStart; i < fn.length; i++) processNode(fn[i], fn, i, false)
   if (newLocals.length) fn.splice(bodyStart, 0, ...newLocals)
 }
 
 /**
- * Hoist loop-invariant boxed-cell reads out of loops.
+ * Narrow an f64 loop bound to i32. `for (let i = 0; i < n; i++)` with an f64
+ * param `n` emits `(f64.lt (f64.convert_i32_s $i) (local.get $n))` — an f64
+ * convert+compare every iteration that ALSO blocks the lane-vectorizer (it
+ * requires an i32-governed trip count). The naive-DSP export shape
+ * `(ptr, n) => { for (i = 0; i < n; i++) … }` therefore never vectorized
+ * without a hand-written `n|0`. This pass is that annotation, as a proof.
  *
- * Boxed-capture cells (`$cell_X`, allocated by the closure-capture pass) are
- * private to the enclosing function — no other code path can write to that
- * memory. So if a loop body contains `(f64.load (local.get $cell_X))` reads
- * and *no* `(f64.store (local.get $cell_X) …)` writes, the load is loop-
- * invariant and can be hoisted to a snapshot local set just before the loop.
+ * When $i is a proven-non-negative i32 counter and $n is loop-invariant:
+ *   convert_i32_s(i) < n  ⟺  i < trunc_sat(ceil(n))      for all i ≥ 0
+ *   - fractional n rounds up (i < 5.5 ⟺ i < 6); integral n exact
+ *   - NaN: ceil→NaN, trunc_sat→0 ⇒ `i < 0` false — matches the false f64 compare
+ *     (THIS case is why i ≥ 0 must be proven: a negative i would flip it true)
+ *   - n ≤ −2³¹ saturates to INT32_MIN ⇒ always false — matches
+ *   - n ≥ 2³¹ saturates to INT32_MAX ⇒ terminates after 2³¹−1 iterations where
+ *     the original wrapped $i negative and spun forever — the only divergence,
+ *     pathological in both versions (a JS double counter would keep counting).
+ * Non-negativity proof: $i is a non-param i32 local whose EVERY write in the
+ * function (counters get re-zeroed between loops) is a non-negative i32.const
+ * or `$i + positive-const`. Wrap-around past 2³¹ needs 2³¹ agreeing iterations
+ * first, so trajectories are identical in every non-pathological program.
  *
- * Necessary because V8's wasm tier doesn't perform LICM across f64.load:
- * memory may alias with f64.stores in the loop body, and even though we
- * know the cell can't alias with array stores, the engine has to assume it
- * can. Hand-hoisting unblocks register-keeping of the captured value.
- *
- * Inside-out per-loop processing — inner loops handled first, so reads
- * already replaced by snap-locals don't appear as cell reads at outer levels.
+ * Snap `(local.set $__lbK (i32.trunc_sat_f64_s (f64.ceil (local.get $n))))`
+ * goes in the loop pre-header (re-snapped per outer iteration when nested —
+ * trunc_sat/ceil are total, safe even for zero-trip loops); the compare becomes
+ * `(i32.lt_s $i $__lbK)` — the exact shape the lane-vectorizer matches.
+ * Bottom-up, refcount-guarded, idempotent (rewritten conds no longer match).
  */
-export function hoistInvariantCellLoads(fn) {
+export function narrowLoopBound(fn) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
   if (bodyStart < 0) return
 
-  let snapId = 0
-  while (fn.some(n => Array.isArray(n) && n[0] === 'local' && n[1] === `$__sc${snapId}`)) snapId++
+  // Cheap early-out: no loop ⇒ nothing to narrow.
+  let hasLoop = false
+  const scanLoop = (n) => {
+    if (!Array.isArray(n) || hasLoop) return
+    if (n[0] === 'loop') { hasLoop = true; return }
+    for (let i = 1; i < n.length && !hasLoop; i++) scanLoop(n[i])
+  }
+  for (let i = bodyStart; i < fn.length && !hasLoop; i++) scanLoop(fn[i])
+  if (!hasLoop) return
+
+  // Header types. Params are excluded as counters: their init is caller-supplied,
+  // so non-negativity is unprovable.
+  const localTypes = new Map(), params = new Set()
+  for (let i = 2; i < bodyStart; i++) {
+    const c = fn[i]
+    if (!Array.isArray(c) || typeof c[1] !== 'string') continue
+    if (c[0] === 'param') params.add(c[1])
+    if (c[0] === 'param' || c[0] === 'local') localTypes.set(c[1], c[2])
+  }
+
+  // Every write per local across the WHOLE function — not just in-loop: a counter
+  // reused by a later loop is re-zeroed between them, and a negative write
+  // anywhere voids the proof.
+  const writes = new Map()
+  const collectWrites = (n) => {
+    if (!Array.isArray(n)) return
+    if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') {
+      let arr = writes.get(n[1]); if (!arr) writes.set(n[1], arr = [])
+      arr.push(n[2])
+    }
+    for (let i = 1; i < n.length; i++) collectWrites(n[i])
+  }
+  for (let i = bodyStart; i < fn.length; i++) collectWrites(fn[i])
+
+  const constVal = (n) => Array.isArray(n) && n[0] === 'i32.const' ? Number(n[1]) : NaN
+  const nonNegCounter = (name) => {
+    if (params.has(name) || localTypes.get(name) !== 'i32') return false
+    const ws = writes.get(name)
+    if (!ws) return true  // never written ⇒ stays at default 0
+    return ws.every(v => {
+      if (!Array.isArray(v)) return false
+      if (v[0] === 'i32.const') return Number(v[1]) >= 0
+      if (v[0] !== 'i32.add') return false
+      if (Array.isArray(v[1]) && v[1][0] === 'local.get' && v[1][1] === name) return constVal(v[2]) > 0
+      if (Array.isArray(v[2]) && v[2][0] === 'local.get' && v[2][1] === name) return constVal(v[1]) > 0
+      return false
+    })
+  }
+
+  // Collision-proof snap ids (same scheme as hoistInvariantLoop's $__li).
+  const usedLb = new Set()
+  const scanLb = (n) => {
+    if (!Array.isArray(n)) return
+    if (n[0] === 'local' && typeof n[1] === 'string' && n[1].startsWith('$__lb')) {
+      const t = n[1].slice(5); if (/^\d+$/.test(t)) usedLb.add(+t)
+    }
+    for (let i = 0; i < n.length; i++) scanLb(n[i])
+  }
+  scanLb(fn)
+  let lbCounter = 0
+  const freshLb = () => { while (usedLb.has(lbCounter)) lbCounter++; const id = lbCounter++; usedLb.add(id); return `$__lb${id}` }
   const newLocals = []
+  const refcount = buildRefcount(fn)
 
-  // Build refcount of array nodes: how many positions in `fn` reference each
-  // array. Earlier passes (fusedRewrite, hoistAddrBase) introduce shared
-  // subtrees; mutating `parent[idx]` for a shared parent would also affect
-  // references outside the current loop. Sites whose immediate parent has
-  // refcount > 1 are skipped.
-  const refcount = new Map()
-  const countRefs = (node) => {
-    if (!Array.isArray(node)) return
-    const n = (refcount.get(node) || 0) + 1
-    refcount.set(node, n)
-    if (n > 1) return  // already counted children below
-    for (let i = 0; i < node.length; i++) countRefs(node[i])
+  // `(f64.lt (f64.convert_i32_s (local.get $i)) (local.get $n))` or mirrored
+  // `(f64.gt (local.get $n) (f64.convert_i32_s (local.get $i)))`.
+  const match = (n) => {
+    const conv = n[0] === 'f64.lt' ? n[1] : n[0] === 'f64.gt' ? n[2] : null
+    const bnd = n[0] === 'f64.lt' ? n[2] : n[0] === 'f64.gt' ? n[1] : null
+    if (!Array.isArray(conv) || conv[0] !== 'f64.convert_i32_s') return null
+    const ig = conv[1]
+    if (!Array.isArray(ig) || ig[0] !== 'local.get' || typeof ig[1] !== 'string') return null
+    if (!Array.isArray(bnd) || bnd[0] !== 'local.get' || typeof bnd[1] !== 'string') return null
+    return { ctr: ig[1], bound: bnd[1] }
   }
-  countRefs(fn)
 
-  // Process one loop node: find cell_X reads, check no writes, hoist.
-  // Returns { snapDecls } — list of (local.set $snap (f64.load (local.get $cell_X))) IR
-  // to emit before the loop in its parent.
   const processLoop = (loopNode) => {
-    // Recurse first — inner loops handled bottom-up. Each inner-loop processor
-    // returns a list of pre-loop snap decls; we splice them just before the inner
-    // loop within this loop's body.
-    for (let i = 1; i < loopNode.length; i++) {
-      const child = loopNode[i]
-      if (!Array.isArray(child)) continue
-      processNode(child, loopNode, i)
-    }
-
-    // Scan this loop's body for cell reads & writes (excluding nested loop bodies,
-    // since their reads were already hoisted at their level).
-    const reads = new Map()  // cellName → array of {parent, idx}
-    const writes = new Set()
-    let hasCall = false
-    const scanWrites = (node) => {
-      if (!Array.isArray(node)) return
-      const op = node[0]
-      if (op === 'call' || op === 'call_ref' || op === 'call_indirect') {
-        hasCall = true
-      }
-      // DESCEND into nested loops here — we need to know if any nested-loop
-      // body writes to cell_X (which would invalidate hoisting THIS loop's reads).
-      if (op === 'f64.store' && node.length >= 3) {
-        const addr = node[1]
-        if (Array.isArray(addr) && addr[0] === 'local.get' && typeof addr[1] === 'string'
-            && addr[1].startsWith('$cell_')) {
-          writes.add(addr[1])
-        }
-        // Continue scan into value expr
-        for (let i = 2; i < node.length; i++) scanWrites(node[i])
-        return
-      }
-      if (op === 'f64.load' && node.length === 2) {
-        const addr = node[1]
-        if (Array.isArray(addr) && addr[0] === 'local.get' && typeof addr[1] === 'string'
-            && addr[1].startsWith('$cell_')) {
-          // Defer; we'll handle in a parent-tracking second pass.
-        }
-      }
-      for (let i = 1; i < node.length; i++) scanWrites(node[i])
+    // Inner loops first — their sites belong to their own pre-header (the bound
+    // may be written by THIS loop between inner runs).
+    for (let i = 1; i < loopNode.length; i++)
+      if (Array.isArray(loopNode[i])) processNode(loopNode[i], loopNode, i)
+
+    // Locals written anywhere in this loop (incl. nested) — bound invariance.
+    const written = new Set()
+    const scanW = (n) => {
+      if (!Array.isArray(n)) return
+      if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') written.add(n[1])
+      for (let i = 1; i < n.length; i++) scanW(n[i])
     }
-    for (let i = 1; i < loopNode.length; i++) scanWrites(loopNode[i])
-    // Sound bailout: a call inside the loop could mutate a captured cell
-    // via a closure we can't see. Without escape analysis we can't prove
-    // non-aliasing, so we skip hoisting from any loop containing calls.
-    if (hasCall) return []
+    for (let i = 1; i < loopNode.length; i++) scanW(loopNode[i])
 
-    // Parent-tracking pass to collect read sites.
-    const collect = (node, parent, idx) => {
+    const sites = []
+    const collect = (node) => {
       if (!Array.isArray(node)) return
-      const op = node[0]
-      if (op === 'loop') return
-      if (op === 'f64.load' && node.length === 2) {
-        const addr = node[1]
-        if (Array.isArray(addr) && addr[0] === 'local.get' && typeof addr[1] === 'string'
-            && addr[1].startsWith('$cell_')) {
-          const cell = addr[1]
-          // Skip if the f64.load node or its immediate parent is shared
-          // (refcount>1): mutating parent[idx] would propagate the rewrite to
-          // references outside this loop.
-          if (!writes.has(cell)
-              && (refcount.get(node) || 0) <= 1
-              && (refcount.get(parent) || 0) <= 1) {
-            let arr = reads.get(cell)
-            if (!arr) { arr = []; reads.set(cell, arr) }
-            arr.push({ parent, idx })
-          }
-          return
-        }
-      }
-      for (let i = 0; i < node.length; i++) collect(node[i], node, i)
+      if (node[0] === 'loop') return  // already processed bottom-up
+      const m = match(node)
+      if (m && (refcount.get(node) || 0) <= 1
+            && localTypes.get(m.bound) === 'f64' && !written.has(m.bound)
+            && nonNegCounter(m.ctr)) { sites.push({ node, m }); return }
+      for (let i = 1; i < node.length; i++) collect(node[i])
     }
-    for (let i = 1; i < loopNode.length; i++) collect(loopNode[i], loopNode, i)
+    for (let i = 1; i < loopNode.length; i++) collect(loopNode[i])
 
-    // For each cell with reads but no writes (and confirmed no calls above),
-    // hoist a snap. Single-read hoist is fine semantically: the cell address
-    // doesn't change once allocated, and snap is loaded unconditionally before
-    // the loop, then the body uses the snap local.
+    const snapFor = new Map()  // bound name → snap local (one per distinct bound)
     const snaps = []
-    for (const [cell, sites] of reads) {
-      if (sites.length < 1) continue
-      const snapName = `$__sc${snapId++}`
-      newLocals.push(['local', snapName, 'f64'])
-      snaps.push(['local.set', snapName, ['f64.load', ['local.get', cell]]])
-      for (const { parent, idx } of sites) {
-        parent[idx] = ['local.get', snapName]
+    for (const { node, m } of sites) {
+      let snap = snapFor.get(m.bound)
+      if (!snap) {
+        snap = freshLb()
+        snapFor.set(m.bound, snap)
+        newLocals.push(['local', snap, 'i32'])
+        snaps.push(['local.set', snap, ['i32.trunc_sat_f64_s', ['f64.ceil', ['local.get', m.bound]]]])
       }
+      node.length = 3
+      node[0] = 'i32.lt_s'; node[1] = ['local.get', m.ctr]; node[2] = ['local.get', snap]
     }
     return snaps
   }
 
-  // Recursive node walker that splices snap decls before nested loops.
   const processNode = (node, parent, idx) => {
     if (!Array.isArray(node)) return
-    const op = node[0]
-    if (op === 'loop') {
+    // Break-block idiom `(block $brk (loop …))`: snaps go BEFORE the block —
+    // any statement between the block label and the loop is "foreign content"
+    // to the lane-vectorizer's matcher and would defeat the whole point.
+    if (node[0] === 'block' && typeof node[1] === 'string' && node.length === 3
+        && Array.isArray(node[2]) && node[2][0] === 'loop') {
+      const snaps = processLoop(node[2])
+      if (snaps.length) parent.splice(idx, 0, ...snaps)
+      return
+    }
+    if (node[0] === 'loop') {
       const snaps = processLoop(node)
-      if (snaps.length) {
-        // Splice snaps just before this loop in its parent. The parent could be
-        // a `block` or a top-level func body or any other container.
-        parent.splice(idx, 0, ...snaps)
-      }
+      if (snaps.length) parent.splice(idx, 0, ...snaps)
       return
     }
     for (let i = 0; i < node.length; i++) processNode(node[i], node, i)
   }
 
-  for (let i = bodyStart; i < fn.length; i++) {
-    processNode(fn[i], fn, i)
-  }
-
+  for (let i = bodyStart; i < fn.length; i++) processNode(fn[i], fn, i)
   if (newLocals.length) fn.splice(bodyStart, 0, ...newLocals)
 }
 
@@ -900,8 +1099,7 @@ export function cseScalarLoad(fn) {
   const bases = fn.cseLoadBases
   if (!(bases instanceof Set) || bases.size === 0) return
 
-  let snapId = 0
-  while (fn.some(n => Array.isArray(n) && n[0] === 'local' && n[1] === `$__cs${snapId}`)) snapId++
+  let snapId = nextLocalId(fn, 'cs')
   const newLocals = []
 
   // CSE table: key `${X}|${K}` → { snapName | null, anchorParent, anchorIdx }
@@ -1057,6 +1255,11 @@ export function cseScalarLoad(fn) {
  *     the surrounding `local.set/tee` handles that)
  *   - `br/br_if/br_table/return/unreachable` → NO clear (pure values still valid)
  */
+// Commutative WASM binops — shared by csePureExpr + csePureExprLoop for canonical
+// operand-key ordering (a*b and b*a hash to one entry). OP_TYPE tables stay local:
+// the two passes cover deliberately different op sets.
+const COMMUTATIVE = new Set(['f64.mul', 'f64.add', 'i32.mul', 'i32.add', 'i32.and', 'i32.or', 'i32.xor', 'i64.mul', 'i64.add', 'i64.and', 'i64.or', 'i64.xor'])
+
 export function csePureExpr(fn) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
@@ -1073,8 +1276,8 @@ export function csePureExpr(fn) {
     if (m) { const k = +m[1]; if (k >= snapId) snapId = k + 1 }
   }
   const newLocals = []
+  let refcount = null   // lazily built on the first dedup — most fns never CSE
 
-  const COMMUTATIVE = new Set(['f64.mul', 'f64.add', 'i32.mul', 'i32.add', 'i32.and', 'i32.or', 'i32.xor', 'i64.mul', 'i64.add', 'i64.and', 'i64.or', 'i64.xor'])
   const TARGET_OPS = new Set([
     'f64.mul', 'f64.add', 'f64.sub',
     'i32.mul', 'i32.add', 'i32.sub', 'i32.shl', 'i32.shr_u', 'i32.shr_s', 'i32.and', 'i32.or', 'i32.xor',
@@ -1149,6 +1352,12 @@ export function csePureExpr(fn) {
         const entry = table.get(key)
         if (entry) {
           if (!entry.snapName) {
+            // A shared (DAG) anchor breaks the in-place tee: the `%` fast-path emits
+            // `a - trunc(a/b)*b` reusing ONE `a` node object, so the anchor and the
+            // local.get replacement land on the SAME physical slot and the local.get
+            // clobbers the tee — orphaning $__pe (reads 0). Skip when the anchor's
+            // parent is shared; watr's DAG-aware CSE still dedupes. Mirrors csePureExprLoop.
+            if (((refcount ??= buildRefcount(fn)).get(entry.anchorParent) || 0) > 1) return
             const snapName = `$__pe${snapId++}`
             entry.snapName = snapName
             newLocals.push(['local', snapName, OP_TYPE[op] || 'f64'])
@@ -1176,6 +1385,189 @@ export function csePureExpr(fn) {
   if (newLocals.length) fn.splice(bodyStart, 0, ...newLocals)
 }
 
+/**
+ * Post-watr nested CSE for hot fill loops (loop + trig). Reuses `$__pe` locals from
+ * the pre-watr leaf pass. Deferred to the `phase === 'post'` run so watr's typed-array
+ * inlining is not confused by pre-watr IR rewrites (test/mem.js).
+ */
+export function csePureExprLoop(fn) {
+  if (!Array.isArray(fn) || fn[0] !== 'func') return
+  const bodyStart = findBodyStart(fn)
+  if (bodyStart < 0) return
+
+  let hasLoop = false
+  let hasTrigCall = false
+  const scanShape = (n) => {
+    if (!Array.isArray(n)) return
+    if (n[0] === 'loop') hasLoop = true
+    if (n[0] === 'call' && (n[1] === '$math.sin' || n[1] === '$math.cos'
+        || n[1] === '$math.sin_core' || n[1] === '$math.cos_core')) hasTrigCall = true
+    for (let i = 1; i < n.length; i++) scanShape(n[i])
+  }
+  for (let i = bodyStart; i < fn.length; i++) scanShape(fn[i])
+  if (!hasLoop || !hasTrigCall) return
+
+  let snapId = nextLocalId(fn, 'pe')
+  const newLocals = []
+
+  const refcount = buildRefcount(fn)
+  const canMutateSite = (parent, node) =>
+    (refcount.get(node) || 0) <= 1 && (refcount.get(parent) || 0) <= 1
+
+  const PURE_F64_BIN = new Set(['f64.mul', 'f64.add', 'f64.sub', 'f64.div'])
+  const PURE_F64_UNARY = new Set(['f64.neg', 'f64.abs', 'f64.convert_i32_s', 'f64.convert_i32_u'])
+  const PURE_I32_BIN = new Set(['i32.mul', 'i32.add', 'i32.sub', 'i32.shl', 'i32.shr_u', 'i32.shr_s', 'i32.and', 'i32.or', 'i32.xor'])
+  const PURE_I32_UNARY = new Set(['i32.eqz', 'i32.clz', 'i32.ctz', 'i32.popcnt'])
+  const OP_TYPE = {
+    'f64.mul': 'f64', 'f64.add': 'f64', 'f64.sub': 'f64', 'f64.div': 'f64', 'f64.neg': 'f64', 'f64.abs': 'f64',
+    'f64.convert_i32_s': 'f64', 'f64.convert_i32_u': 'f64',
+    'i32.mul': 'i32', 'i32.add': 'i32', 'i32.sub': 'i32', 'i32.shl': 'i32', 'i32.shr_u': 'i32', 'i32.shr_s': 'i32',
+    'i32.and': 'i32', 'i32.or': 'i32', 'i32.xor': 'i32', 'i32.eqz': 'i32',
+  }
+
+  const table = new Map()
+  const keyLocals = new Set()
+  const keyGlobals = new Set()
+
+  const invalidateLocal = (X) => {
+    for (const [key, entry] of table) {
+      if (entry.locals.has(X)) table.delete(key)
+    }
+  }
+
+  const invalidateGlobal = (G) => {
+    for (const [key, entry] of table) {
+      if (entry.globals.has(G)) table.delete(key)
+    }
+  }
+
+  const pureKeyI32 = (n) => {
+    if (!Array.isArray(n)) return null
+    const op = n[0]
+    if (op === 'local.get' && typeof n[1] === 'string') { keyLocals.add(n[1]); return `L:${n[1]}` }
+    if (op === 'global.get' && typeof n[1] === 'string') { keyGlobals.add(n[1]); return `G:${n[1]}` }
+    if (op === 'i32.const' || op === 'i64.const') return `C:${op}:${n[1]}`
+    if (PURE_I32_UNARY.has(op) && n.length === 2) {
+      const k = pureKeyI32(n[1]); return k ? `${op}|${k}` : null
+    }
+    if (PURE_I32_BIN.has(op) && n.length === 3) {
+      const ka = pureKeyI32(n[1]), kb = pureKeyI32(n[2])
+      if (!ka || !kb) return null
+      return COMMUTATIVE.has(op) && ka > kb ? `${op}|${kb}|${ka}` : `${op}|${ka}|${kb}`
+    }
+    if (op === 'i32.wrap_i64' && n.length === 2) {
+      const k = pureKeyI32(n[1]); return k ? `wrap|${k}` : null
+    }
+    return null
+  }
+
+  const pureKeyF64 = (n) => {
+    if (!Array.isArray(n)) return null
+    const op = n[0]
+    if (op === 'local.get' && typeof n[1] === 'string') { keyLocals.add(n[1]); return `L:${n[1]}` }
+    if (op === 'global.get' && typeof n[1] === 'string') { keyGlobals.add(n[1]); return `G:${n[1]}` }
+    if (op === 'f64.const' || op === 'f32.const') return `C:${op}:${n[1]}`
+    if (PURE_F64_UNARY.has(op) && n.length === 2) {
+      if (op === 'f64.convert_i32_s' || op === 'f64.convert_i32_u') {
+        const k = pureKeyI32(n[1]); return k ? `${op}|${k}` : null
+      }
+      const k = pureKeyF64(n[1]); return k ? `${op}|${k}` : null
+    }
+    if (PURE_F64_BIN.has(op) && n.length === 3) {
+      const ka = pureKeyF64(n[1]), kb = pureKeyF64(n[2])
+      if (!ka || !kb) return null
+      return COMMUTATIVE.has(op) && ka > kb ? `${op}|${kb}|${ka}` : `${op}|${ka}|${kb}`
+    }
+    if (op === 'call' && n[1] === '$__to_num' && n.length === 3) {
+      const a = n[2]
+      if (Array.isArray(a) && a[0] === 'i64.reinterpret_f64' && a.length === 2) {
+        const k = pureKeyF64(a[1]); return k ? `tonum|${k}` : null
+      }
+    }
+    return null
+  }
+
+  const tryCse = (node, parent, idx) => {
+    const op = node[0]
+    if (op === 'local.get' || op === 'global.get' || op === 'f64.const' || op === 'f32.const') return
+    if (!canMutateSite(parent, node)) return
+    keyLocals.clear()
+    keyGlobals.clear()
+    const key = pureKeyF64(node)
+    if (!key) return
+    const locals = new Set(keyLocals)
+    const globals = new Set(keyGlobals)
+    const entry = table.get(key)
+    if (entry) {
+      if (!entry.snapName) {
+        if ((refcount.get(entry.anchorParent) || 0) > 1) return
+        const snapName = `$__pe${snapId++}`
+        entry.snapName = snapName
+        newLocals.push(['local', snapName, OP_TYPE[node[0]] || 'f64'])
+        const orig = entry.anchorParent[entry.anchorIdx]
+        entry.anchorParent[entry.anchorIdx] = ['local.tee', snapName, orig]
+      }
+      parent[idx] = ['local.get', entry.snapName]
+    } else {
+      table.set(key, { snapName: null, anchorParent: parent, anchorIdx: idx, locals, globals })
+    }
+  }
+
+  const walk = (node, parent, idx) => {
+    if (!Array.isArray(node)) return
+    const op = node[0]
+
+    if (op === 'loop') {
+      table.clear()
+      for (let i = 1; i < node.length; i++) walk(node[i], node, i)
+      table.clear()
+      return
+    }
+
+    if (op === 'if') {
+      table.clear()
+      for (let i = 1; i < node.length; i++) walk(node[i], node, i)
+      table.clear()
+      return
+    }
+
+    if (op === 'then' || op === 'else') {
+      table.clear()
+      for (let i = 1; i < node.length; i++) walk(node[i], node, i)
+      table.clear()
+      return
+    }
+
+    if (op === 'call' || op === 'call_ref' || op === 'call_indirect') {
+      for (let i = 1; i < node.length; i++) walk(node[i], node, i)
+      return
+    }
+
+    if (op === 'local.set' || op === 'local.tee') {
+      for (let i = 2; i < node.length; i++) walk(node[i], node, i)
+      const X = node[1]
+      if (typeof X === 'string') invalidateLocal(X)
+      return
+    }
+
+    if (op === 'global.set') {
+      for (let i = 2; i < node.length; i++) walk(node[i], node, i)
+      const G = node[1]
+      if (typeof G === 'string') invalidateGlobal(G)
+      return
+    }
+
+    for (let i = 1; i < node.length; i++) {
+      if (Array.isArray(node[i])) walk(node[i], node, i)
+    }
+    tryCse(node, parent, idx)
+  }
+
+  for (let i = bodyStart; i < fn.length; i++) walk(fn[i], fn, i)
+
+  if (newLocals.length) fn.splice(bodyStart, 0, ...newLocals)
+}
+
 /**
  * Drop redundant zero-initialisation of fresh function-scope locals.
  *
@@ -1297,7 +1689,7 @@ export function deadStoreElim(fn) {
       // an implicit stack value (e.g. a `try_table` catch payload) — removing it
       // would unbalance the stack.
       if (op === 'drop' && node.length === 2 && isPure(node[1])) {
-        dead.push({ parent: items, idx: i, drop: true })
+        dead.push({ parent: items, node, drop: true })
       }
 
       // Local write tracking
@@ -1308,10 +1700,9 @@ export function deadStoreElim(fn) {
           // if its RHS is pure — `local.set $x (call f …)` where `f` mutates
           // memory must still run. (A `local.tee` is always safe: removal demotes
           // it to its value expression, so any side effects there are preserved.)
-          const pn = prev.parent[prev.idx]
-          if (pn[0] === 'local.tee' || isPure(pn[2])) dead.push(prev)
+          if (prev.node[0] === 'local.tee' || isPure(prev.node[2])) dead.push(prev)
         }
-        lastWrite.set(node[1], { parent: items, idx: i })
+        lastWrite.set(node[1], { parent: items, node })
       }
 
       // Recurse into nested blocks with fresh state
@@ -1336,20 +1727,20 @@ export function deadStoreElim(fn) {
 
   scanBlock(fn, bodyStart, fn.length)
 
-  // Remove in reverse order so indices stay valid
-  for (let i = dead.length - 1; i >= 0; i--) {
-    const d = dead[i]
-    if (d.drop) {
-      d.parent.splice(d.idx, 1)
+  // Removal is IDENTITY-based: entries are pushed at SUPERSEDE time, so
+  // same-parent indices are not monotonic (name A's earlier write can be
+  // superseded after name B's later one). Index-order splicing then shifts
+  // remaining entries onto innocent neighbors — the self-host L2 divergence
+  // deleted a typed-literal f64.store exactly this way. Re-locating each
+  // captured node at removal time is immune to any ordering or prior splice.
+  for (const d of dead) {
+    const at = d.parent.indexOf(d.node)
+    if (at < 0) continue  // already removed (nested duplicate) — nothing to do
+    if (!d.drop && d.node[0] === 'local.tee') {
+      // tee in statement position: replace with just the value (implicitly dropped)
+      d.parent[at] = d.node[2]
     } else {
-      const node = d.parent[d.idx]
-      if (node[0] === 'local.tee') {
-        // tee in statement position: replace with just the value (implicitly dropped)
-        d.parent[d.idx] = node[2]
-      } else {
-        // set in statement position: remove entirely
-        d.parent.splice(d.idx, 1)
-      }
+      d.parent.splice(at, 1)
     }
   }
 }
@@ -1384,6 +1775,196 @@ export function collectVolatileGlobals(funcs) {
   return volatile
 }
 
+/**
+ * Transitive global-write sets per function: name → Set of globals the function
+ * writes directly OR through any (transitively) called function. The precise
+ * complement to `collectVolatileGlobals`' coarse module-wide set — a global
+ * written only by `init` is volatile module-wide, yet perfectly stable inside
+ * a function whose call graph never reaches `init`.
+ *
+ * Unknown callees (imports — absent from the module's func list) write nothing:
+ * wasm imports cannot touch module globals. `call_indirect`/`call_ref` targets
+ * are unknown wasm functions — treat as writing every global any function
+ * writes (the sound over-approximation).
+ */
+export function collectReachableGlobalWrites(funcs) {
+  const writes = new Map(), callees = new Map(), indirect = new Set(), all = new Set()
+  for (const fn of funcs) {
+    if (!Array.isArray(fn) || fn[0] !== 'func' || typeof fn[1] !== 'string') continue
+    const w = new Set(), c = new Set()
+    const scan = (n) => {
+      if (!Array.isArray(n)) return
+      if (n[0] === 'global.set' && typeof n[1] === 'string') { w.add(n[1]); all.add(n[1]) }
+      else if ((n[0] === 'call' || n[0] === 'return_call') && typeof n[1] === 'string') c.add(n[1])
+      else if (n[0] === 'call_indirect' || n[0] === 'call_ref' || n[0] === 'return_call_indirect') indirect.add(fn[1])
+      for (let i = 1; i < n.length; i++) scan(n[i])
+    }
+    for (let i = 2; i < fn.length; i++) scan(fn[i])
+    writes.set(fn[1], w); callees.set(fn[1], c)
+  }
+  // Worklist fixpoint over the call graph.
+  let changed = true
+  while (changed) {
+    changed = false
+    for (const [name, w] of writes) {
+      const before = w.size
+      if (indirect.has(name)) for (const g of all) w.add(g)
+      for (const callee of callees.get(name)) {
+        const cw = writes.get(callee)
+        if (cw) for (const g of cw) w.add(g)
+      }
+      if (w.size !== before) changed = true
+    }
+  }
+  return writes
+}
+
+/**
+ * Hoist `__ptr_offset` resolution of stable typed-array GLOBALS to one resolve
+ * per function. Locals get their pointer unboxed once at bind time, but a
+ * module-global typed array (`let x; init = () => { x = new Float64Array(n) }`
+ * — the idiomatic DSP-state shape: rfft, game-of-life, diffusion)
+ * re-resolves on EVERY element access:
+ *   (call $__ptr_offset (i64.reinterpret_f64 (global.get $x)))
+ * — 68 such calls in rfft's transform alone, ~7× slower than V8. LICM can't
+ * hoist them out of loops: its global-invariance rule requires a call-free
+ * loop, and the resolve itself is a call. promoteGlobals can't either: `init`
+ * writes the global, so it's volatile module-wide.
+ *
+ * The precise facts make it sound here: TYPED pointees never forward (only
+ * ARRAY/SET/MAP do — same bits ⇒ same offset), so the snapshot is stable iff
+ * the global's VALUE is stable through the function — i.e. the function
+ * neither writes G itself nor (transitively) calls anything that does
+ * (`collectReachableGlobalWrites`). The entry-time resolve is total
+ * (`__ptr_offset` bounds-checks garbage to itself), so hoisting past a
+ * zero-trip loop or an early return is safe.
+ *
+ * @param {Array} fn - func IR node
+ * @param {Set<string>} stablePtrGlobals - '$name's of VAL.TYPED module globals
+ * @param {Map<string,Set<string>>} reachableWrites - from collectReachableGlobalWrites
+ */
+// Never-forwarding pointee kinds: every PTR tag outside __ptr_offset's
+// forwarding set {ARRAY, HASH, SET, MAP} — same bits ⇒ same offset.
+export const STABLE_PTR_VALS = new Set([VAL.TYPED, VAL.STRING, VAL.OBJECT, VAL.BUFFER, VAL.CLOSURE])
+
+/** '$name' set of stable-pointee module globals (hoistGlobalPtrOffset targets). */
+export const stablePtrGlobalNames = () => {
+  const out = new Set()
+  if (ctx.scope.globalValTypes)
+    for (const [k, v] of ctx.scope.globalValTypes) if (STABLE_PTR_VALS.has(v)) out.add(`$${k}`)
+  return out
+}
+
+export function hoistGlobalPtrOffset(fn, stablePtrGlobals, reachableWrites) {
+  if (!Array.isArray(fn) || fn[0] !== 'func' || !stablePtrGlobals?.size) return
+  const bodyStart = findBodyStart(fn)
+  if (bodyStart < 0) return
+
+  // `(i64.reinterpret_f64 (global.get $G))` → G, or null.
+  const reintGlobal = (n) =>
+    Array.isArray(n) && n[0] === 'i64.reinterpret_f64'
+      && Array.isArray(n[1]) && n[1][0] === 'global.get' && typeof n[1][1] === 'string'
+      ? n[1][1] : null
+  // A stable-pointee global's byte-base reaches us in two interchangeable shapes:
+  //   • forwarding-aware  `(call $__ptr_offset (i64.reinterpret_f64 (global.get $G)))`
+  //   • inline typed read `(i32.wrap_i64 (i64.and (i64.reinterpret_f64 (global.get $G)) MASK))`
+  // The inline form is what typed-array reads emit (a fixed-size typed array never
+  // relocates, so they skip __ptr_offset's forwarding follow — see module/typedarray.js
+  // `typedBase`). For a never-forwarding pointee both yield the identical offset, so
+  // either site hoists to the one `__ptr_offset` entry snapshot. Matching only the
+  // call form left typed-array globals re-decoding the NaN-box per element in stencil
+  // sweeps (watercolor's pressure solve: 5 reads/cell × millions of cells). → G, or null.
+  const siteGlobal = (n) => {
+    if (!Array.isArray(n)) return null
+    if (n[0] === 'call' && n[1] === '$__ptr_offset' && n.length === 3) return reintGlobal(n[2])
+    if (n[0] === 'i32.wrap_i64' && n.length === 2 && Array.isArray(n[1]) && n[1][0] === 'i64.and' && n[1].length === 3) {
+      const mask = n[1][2]
+      if (Array.isArray(mask) && mask[0] === 'i64.const'
+          && (typeof mask[1] === 'string' ? Number(mask[1]) : mask[1]) === LAYOUT.OFFSET_MASK)
+        return reintGlobal(n[1][1])
+    }
+    return null
+  }
+
+  // Per-global: static site count AND whether any site sits inside a loop. A
+  // single in-loop site is a per-ITERATION resolve (lenia's convolution reads
+  // each of kdx/kdy/kw at one site × ~14M taps/frame), so loop placement beats
+  // site count as the hoist criterion.
+  const counts = new Map(), inLoop = new Set(), ownWrites = new Set(), ownCallees = new Set()
+  // Globals seen via the `__ptr_offset` call form (vs. only the inline typed mask).
+  // The snapshot reuses an EXISTING form so it never resurrects a treeshaken helper:
+  // a typed-array-only module emits no `__ptr_offset` call, so snapping one in would
+  // reference a function that isn't in the module.
+  const ptrOffsetForm = new Set()
+  let hasIndirect = false
+  const scan = (n, loopDepth) => {
+    if (!Array.isArray(n)) return
+    const g = siteGlobal(n)
+    if (g != null) {
+      counts.set(g, (counts.get(g) || 0) + 1)
+      if (loopDepth > 0) inLoop.add(g)
+      if (n[0] === 'call') ptrOffsetForm.add(g)
+      return
+    }
+    if (n[0] === 'global.set' && typeof n[1] === 'string') ownWrites.add(n[1])
+    else if ((n[0] === 'call' || n[0] === 'return_call') && typeof n[1] === 'string') ownCallees.add(n[1])
+    else if (n[0] === 'call_indirect' || n[0] === 'call_ref' || n[0] === 'return_call_indirect') hasIndirect = true
+    const d = n[0] === 'loop' ? loopDepth + 1 : loopDepth
+    for (let i = 1; i < n.length; i++) scan(n[i], d)
+  }
+  for (let i = bodyStart; i < fn.length; i++) scan(fn[i], 0)
+  if (!counts.size) return
+
+  const calleeWrites = (g) => {
+    if (hasIndirect) return true  // unknown targets — assume they write
+    for (const c of ownCallees) if (reachableWrites?.get(c)?.has(g)) return true
+    return false
+  }
+
+  // Collision-proof snap ids (same scheme as hoistInvariantLoop's $__li).
+  const used = new Set()
+  const scanIds = (n) => {
+    if (!Array.isArray(n)) return
+    if (n[0] === 'local' && typeof n[1] === 'string' && n[1].startsWith('$__go')) {
+      const t = n[1].slice(5); if (/^\d+$/.test(t)) used.add(+t)
+    }
+    for (let i = 0; i < n.length; i++) scanIds(n[i])
+  }
+  scanIds(fn)
+  let idCounter = 0
+  const freshId = () => { while (used.has(idCounter)) idCounter++; const id = idCounter++; used.add(id); return `$__go${id}` }
+
+  const chosen = new Map()  // global → snap local
+  for (const [g, c] of counts) {
+    if ((c < 2 && !inLoop.has(g)) || !stablePtrGlobals.has(g) || ownWrites.has(g) || calleeWrites(g)) continue
+    chosen.set(g, freshId())
+  }
+  if (!chosen.size) return
+
+  const replace = (n) => {
+    if (!Array.isArray(n)) return
+    for (let i = 1; i < n.length; i++) {
+      const g = siteGlobal(n[i])
+      if (g != null && chosen.has(g)) n[i] = ['local.get', chosen.get(g)]
+      else replace(n[i])
+    }
+  }
+  for (let i = bodyStart; i < fn.length; i++) replace(fn[i])
+
+  const decls = [], snaps = []
+  for (const [g, name] of chosen) {
+    decls.push(['local', name, 'i32'])
+    // Match an existing site's form so we never reference a treeshaken helper.
+    // For a never-forwarding pointee both forms compute the same offset, so the
+    // inline mask is a safe (and call-free) snapshot when no __ptr_offset site exists.
+    const snap = ptrOffsetForm.has(g)
+      ? ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['global.get', g]]]
+      : ['i32.wrap_i64', ['i64.and', ['i64.reinterpret_f64', ['global.get', g]], ['i64.const', LAYOUT.OFFSET_MASK]]]
+    snaps.push(['local.set', name, snap])
+  }
+  fn.splice(bodyStart, 0, ...decls, ...snaps)
+}
+
 /**
  * Promote read-only globals to locals within each function.
  *
@@ -1408,7 +1989,7 @@ export function collectVolatileGlobals(funcs) {
  * @param {Map<string,string>} [globalTypes] - Optional: global name → wasm type ('i32'|'f64'|'i64'|'funcref')
  * @param {Set<string>} [volatileGlobals] - Optional: globals mutated outside `$__start` (see collectVolatileGlobals)
  */
-export function promoteGlobals(fn, globalTypes, volatileGlobals) {
+export function promoteGlobals(fn, globalTypes, volatileGlobals, reachableWrites) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
   if (bodyStart < 0) return
@@ -1416,8 +1997,8 @@ export function promoteGlobals(fn, globalTypes, volatileGlobals) {
   // Collect global.get counts, detect any global.set, and note whether the
   // function makes a call (a callee may mutate a volatile global between reads).
   const getCounts = new Map()  // globalName → count
-  const written = new Set()
-  let hasCall = false
+  const written = new Set(), callees = new Set()
+  let hasCall = false, hasIndirect = false
 
   const scan = (node) => {
     if (!Array.isArray(node)) return
@@ -1431,7 +2012,8 @@ export function promoteGlobals(fn, globalTypes, volatileGlobals) {
       if (node[2]) scan(node[2])
       return
     }
-    if (op === 'call' || op === 'call_indirect') hasCall = true
+    if (op === 'call' || op === 'return_call') { hasCall = true; if (typeof node[1] === 'string') callees.add(node[1]) }
+    else if (op === 'call_indirect' || op === 'call_ref' || op === 'return_call_indirect') { hasCall = true; hasIndirect = true }
     for (let i = 1; i < node.length; i++) scan(node[i])
   }
 
@@ -1452,7 +2034,12 @@ export function promoteGlobals(fn, globalTypes, volatileGlobals) {
   for (const [gName, count] of getCounts) {
     if (count < 3 || written.has(gName)) continue
     // Unsound to cache a callee-mutable global across a call in this function.
-    if (hasCall && volatileGlobals && volatileGlobals.has(gName)) continue
+    // With reachableWrites the test is exact per call edge (a global written
+    // only by init stays promotable in functions whose call graph never
+    // reaches init); without it, fall back to the coarse module-wide set.
+    if (hasCall && (reachableWrites
+      ? (hasIndirect || [...callees].some(c => reachableWrites.get(c)?.has(gName)))
+      : volatileGlobals?.has(gName))) continue
     // Determine type: use provided map, or infer from context
     const type = globalTypes?.get(gName) || inferTypeFromContext(fn, gName, bodyStart)
     if (!type) continue  // can't determine type, skip
@@ -1543,7 +2130,7 @@ function inferTypeFromContext(fn, gName, bodyStart) {
  * Pool entries sorted by usage descending, so hottest get lowest indices (1-byte LEB128).
  * Break-even: N ≥ 2 uses (pool cost: 11 B global decl + 2N bytes vs 9N original).
  *
- * Mutates `funcs` in place; writes new global decls via `addGlobal(name, watString)`.
+ * Mutates `funcs` in place; writes new global decls via `addGlobal(name, constLiteral)`.
  */
 export function hoistConstantPool(funcs, addGlobal) {
   const MIN_USES = 2
@@ -1574,7 +2161,7 @@ export function hoistConstantPool(funcs, addGlobal) {
   for (const [k] of sorted) {
     const name = `__fc${gId++}`
     const lit = k.slice(2)
-    addGlobal(name, `(global $${name} (mut f64) (f64.const ${lit}))`)
+    addGlobal(name, lit)
     hoist.set(k, name)
   }
   if (!hoist.size) return
@@ -1623,7 +2210,12 @@ export function specializeMkptr(funcs, addFunc, parseWat) {
     '$__typed_idx': { params: ['i64', 'i32'],        result: 'f64' },
     '$__str_idx':   { params: ['i64', 'i32'],        result: 'f64' },
   }
-  const MIN_USES = 5
+  // 4 is the measured break-even: a specialized helper (trampoline / inline i64.const
+  // template) costs ~12 B to define and saves ~2–4 B per site, so 4 sites amortize it.
+  // Lower (3) net-inflates the watr self-host; 5 leaves 4-use combos on the table. The
+  // sibling specializePtrBase threshold (20) is already optimal — its combos cluster far
+  // above 20 (the ~2 k-site $__strBase relativization) with nothing in the 5–19 band.
+  const MIN_USES = 4
 
   // Build literal-arg signature key for a call node. Returns null if no args are literal.
   // Key format: 'T:V' per literal arg, 'D' per dynamic; indexed by position.
@@ -1909,6 +2501,146 @@ export function sortStrPoolByFreq(funcs, strPoolRef, strDedupMap) {
   }
 }
 
+/**
+ * Fold dead string-dispatch blocks when the tested operand is a proven-f64 local.
+ *
+ * jz's `+` emitter produces, for every binary addition whose right operand has an
+ * unresolved valType, the pattern:
+ *
+ *   (block (result f64)
+ *     (local.set $B EXPR_A)
+ *     (if (result f64)
+ *       (call $__is_str_key (i64.reinterpret_f64 (local.tee $C (local.get $P))))
+ *       (then (call $__str_concat …))
+ *       (else (f64.add (local.get $B) (local.get $C)))))
+ *
+ * When $P is a proven-f64 local (an f64 param, or an f64-typed local provably set
+ * only from f64 arithmetic) it can never hold a string-key NaN-box, so the
+ * `$__is_str_key` test is provably false and the `then` branch is dead.
+ * Replace the whole block with `(f64.add EXPR_A (local.get $P))`.
+ *
+ * SOUND: f64 params can never hold a string-key NaN-box by construction (jz
+ * only allows strings in f64 slots via explicit mkptr boxing, never a bare
+ * param). This fold is additive/gated (only runs when vectorizeLaneLocal is on)
+ * and only removes provably-dead string-dispatch overhead.
+ *
+ * Called in the 'post' phase of optimizeFunc, before vectorizeLaneLocal, so the
+ * cleaned IR is what the vectorizer pattern-matches.
+ */
+export function foldStrDispatchF64(fn) {
+  if (!Array.isArray(fn) || fn[0] !== 'func') return
+  const bodyStart = findBodyStart(fn)
+  if (bodyStart < 0) return
+
+  // Collect all f64 params — provably never hold a string-key NaN-box.
+  const rawF64 = new Set()
+  for (let i = 2; i < bodyStart; i++) {
+    const d = fn[i]
+    if (Array.isArray(d) && d[0] === 'param' && typeof d[1] === 'string' && d[2] === 'f64')
+      rawF64.add(d[1])
+  }
+  if (!rawF64.size) return  // no f64 params → nothing to fold
+
+  // Transitively extend rawF64: an f64 local set only via f64 arithmetic over rawF64
+  // members is itself provably non-string. One forward pass suffices for DAG-shaped
+  // straight-line code (the common case); a fixed-point loop covers rare mutual defs.
+  // Collect local types first.
+  const localTypeMap = new Map()
+  for (let i = 2; i < bodyStart; i++) {
+    const d = fn[i]
+    if (Array.isArray(d) && (d[0] === 'param' || d[0] === 'local') && typeof d[1] === 'string')
+      localTypeMap.set(d[1], d[2])
+  }
+  // An expression is rawF64-valued if it only uses ops that stay in f64 and
+  // reads only rawF64 locals (or f64.const). Stops early — we only need the
+  // closed set for the pattern's $P operand.
+  const isRawF64Expr = (n) => {
+    if (!Array.isArray(n)) return false
+    const op = n[0]
+    if (op === 'f64.const') return true
+    if (op === 'local.get' && typeof n[1] === 'string') return rawF64.has(n[1])
+    if (op === 'local.tee' && typeof n[1] === 'string') return rawF64.has(n[1]) && isRawF64Expr(n[2])
+    if (op === 'f64.add' || op === 'f64.sub' || op === 'f64.mul' || op === 'f64.div' ||
+        op === 'f64.neg' || op === 'f64.abs' || op === 'f64.sqrt') {
+      return n.slice(1).every(isRawF64Expr)
+    }
+    return false
+  }
+
+  // Single forward pass: a local.set $v EXPR where EXPR is rawF64-valued makes $v rawF64.
+  // Repeat until stable (handles ordering edge cases in non-DAG code).
+  let changed = true
+  while (changed) {
+    changed = false
+    const scan = (node) => {
+      if (!Array.isArray(node)) return
+      if ((node[0] === 'local.set' || node[0] === 'local.tee') && typeof node[1] === 'string' &&
+          localTypeMap.get(node[1]) === 'f64' && !rawF64.has(node[1]) && isRawF64Expr(node[2])) {
+        rawF64.add(node[1]); changed = true
+      }
+      for (let i = 1; i < node.length; i++) scan(node[i])
+    }
+    for (let i = bodyStart; i < fn.length; i++) scan(fn[i])
+  }
+
+  // Pattern-match and fold in-place (bottom-up recursive walk so nested blocks resolve).
+  const foldNode = (node) => {
+    if (!Array.isArray(node)) return node
+    // Recurse children first (bottom-up).
+    for (let i = 0; i < node.length; i++) {
+      const c = node[i]
+      if (Array.isArray(c)) node[i] = foldNode(c)
+    }
+    // Match:
+    //   ['block', ['result','f64'],
+    //     ['local.set', $B, EXPR_A],
+    //     ['if', ['result','f64'],
+    //       ['call','$__is_str_key', ['i64.reinterpret_f64', ['local.tee',$C,['local.get',$P]]]],
+    //       ['then', ['call','$__str_concat',...]],
+    //       ['else', ['f64.add', ['local.get',$B], ['local.get',$C]]]]]
+    if (node[0] !== 'block') return node
+    if (!Array.isArray(node[1]) || node[1][0] !== 'result' || node[1][1] !== 'f64') return node
+    if (node.length !== 4) return node
+    const setStmt = node[2], ifStmt = node[3]
+    if (!Array.isArray(setStmt) || setStmt[0] !== 'local.set' || typeof setStmt[1] !== 'string') return node
+    const B = setStmt[1], exprA = setStmt[2]
+    if (!Array.isArray(ifStmt) || ifStmt[0] !== 'if') return node
+    // if must have: (result f64), cond, then, else — total 5 elements
+    if (ifStmt.length !== 5) return node
+    if (!Array.isArray(ifStmt[1]) || ifStmt[1][0] !== 'result' || ifStmt[1][1] !== 'f64') return node
+    const cond = ifStmt[2], thenB = ifStmt[3], elseB = ifStmt[4]
+    // cond: ['call','$__is_str_key',['i64.reinterpret_f64',['local.tee',$C,['local.get',$P]]]]
+    if (!Array.isArray(cond) || cond[0] !== 'call' || cond[1] !== '$__is_str_key' || cond.length !== 3) return node
+    const reinterpArg = cond[2]
+    if (!Array.isArray(reinterpArg) || reinterpArg[0] !== 'i64.reinterpret_f64' || reinterpArg.length !== 2) return node
+    const teeNode = reinterpArg[1]
+    if (!Array.isArray(teeNode) || teeNode[0] !== 'local.tee' || typeof teeNode[1] !== 'string' || teeNode.length !== 3) return node
+    const C = teeNode[1]
+    const getP = teeNode[2]
+    if (!Array.isArray(getP) || getP[0] !== 'local.get' || typeof getP[1] !== 'string') return node
+    const P = getP[1]
+    // $P must be a proven f64 local (never a string-key NaN-box)
+    if (!rawF64.has(P)) return node
+    // then: ['then', ['call','$__str_concat',...]]
+    if (!Array.isArray(thenB) || thenB[0] !== 'then') return node
+    // else: ['else', ['f64.add', ['local.get',$B], ['local.get',$C]]]
+    if (!Array.isArray(elseB) || elseB[0] !== 'else' || elseB.length !== 2) return node
+    const addExpr = elseB[1]
+    if (!Array.isArray(addExpr) || addExpr[0] !== 'f64.add' || addExpr.length !== 3) return node
+    // The two operands of f64.add must be local.get $B and local.get $C (in either order)
+    const [lhsAdd, rhsAdd] = [addExpr[1], addExpr[2]]
+    const lhsIsB = Array.isArray(lhsAdd) && lhsAdd[0] === 'local.get' && lhsAdd[1] === B
+    const rhsIsC = Array.isArray(rhsAdd) && rhsAdd[0] === 'local.get' && rhsAdd[1] === C
+    const lhsIsC = Array.isArray(lhsAdd) && lhsAdd[0] === 'local.get' && lhsAdd[1] === C
+    const rhsIsB = Array.isArray(rhsAdd) && rhsAdd[0] === 'local.get' && rhsAdd[1] === B
+    if (!((lhsIsB && rhsIsC) || (lhsIsC && rhsIsB))) return node
+    // Match confirmed. Fold to: (f64.add EXPR_A (local.get $P))
+    return ['f64.add', exprA, ['local.get', P]]
+  }
+
+  for (let i = bodyStart; i < fn.length; i++) fn[i] = foldNode(fn[i])
+}
+
 /**
  * Run all per-function IR optimizations on a single function node.
  * hoistPtrType runs first — it introduces new locals (`$__ptN`) that the fused
@@ -1921,14 +2653,16 @@ export function sortStrPoolByFreq(funcs, strPoolRef, strDedupMap) {
  * @param cfg optional resolved config from resolveOptimize() — when omitted, all on.
  * @param globalTypes optional global name → wasm type map (for promoteGlobals)
  * @param volatileGlobals optional set of callee-mutable globals (see collectVolatileGlobals)
+ * @param phase 'pre' (default, pre-watr leaf pass) or 'post' (re-run after watr) —
+ *        gates the passes that only pay off once watr has reshaped the IR.
  */
-export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals) {
+export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals, phase = 'pre', reachableWrites) {
   if (cfg && cfg.hoistPtrType === false &&
       cfg.hoistInvariantPtrOffset === false &&
-      cfg.hoistInvariantPtrOffsetLoop === false &&
+      cfg.hoistInvariantLoop === false &&
+      cfg.narrowLoopBound === false &&
       cfg.fusedRewrite === false &&
       cfg.hoistAddrBase === false &&
-      cfg.hoistInvariantCellLoads === false &&
       cfg.cseScalarLoad === false &&
       cfg.csePureExpr === false &&
       cfg.dropDeadZeroInit === false &&
@@ -1938,27 +2672,67 @@ export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals) {
       cfg.vectorizeLaneLocal === false) return
   if (!cfg || cfg.hoistPtrType !== false) hoistPtrType(fn)
   if (!cfg || cfg.hoistInvariantPtrOffset !== false) hoistInvariantPtrOffset(fn)
-  if (!cfg || cfg.hoistInvariantPtrOffsetLoop !== false) hoistInvariantPtrOffsetLoop(fn)
+  // Before LICM: the snapped i32 bound is itself a hoistable hard-op subtree, so
+  // an outer loop's LICM can lift it further when the bound is outer-invariant.
+  if (!cfg || cfg.narrowLoopBound !== false) narrowLoopBound(fn)
+  // Unified LICM (replaces hoistInvariantToInt32 / PtrOffsetLoop / CellLoads).
+  // Run at both maturity points (idempotent): pre-fusedRewrite catches the raw
+  // ToInt32/ptr-offset/arithmetic shapes; post-hoistAddrBase catches cell loads.
+  if (!cfg || cfg.hoistInvariantLoop !== false) hoistInvariantLoop(fn)
   const counts = new Map()
   if (!cfg || cfg.fusedRewrite !== false) fusedRewrite(fn, counts)
   if (!cfg || cfg.hoistAddrBase !== false) hoistAddrBase(fn)
-  if (!cfg || cfg.hoistInvariantCellLoads !== false) hoistInvariantCellLoads(fn)
+  if (!cfg || cfg.hoistInvariantLoop !== false) hoistInvariantLoop(fn)
   if (!cfg || cfg.cseScalarLoad !== false) cseScalarLoad(fn)
-  if (!cfg || cfg.csePureExpr !== false) csePureExpr(fn)
+  if (!cfg || cfg.csePureExpr !== false) {
+    if (cfg && (cfg.watr === true || typeof cfg.watr === 'object') && phase === 'post') csePureExprLoop(fn)
+    else csePureExpr(fn)
+  }
   if (!cfg || cfg.dropDeadZeroInit !== false) dropDeadZeroInit(fn)
   if (!cfg || cfg.deadStoreElim !== false) deadStoreElim(fn)
-  if (!cfg || cfg.promoteGlobals !== false) promoteGlobals(fn, globalTypes, volatileGlobals)
+  if (!cfg || cfg.promoteGlobals !== false) promoteGlobals(fn, globalTypes, volatileGlobals, reachableWrites)
   // Vectorizer runs PRE-watr unless full watr is enabled (`watr: true`). For full watr,
   // defer to post — full passes (notably `inlineOnce` + the post-inline `propagate`
   // sweep) reshape the IR so much that pre-watr SIMD patterns get scrambled. Light
   // watr (or no watr) leaves the lane locals intact for vectorize to pattern-match,
   // and lets a non-trivial chunk of SIMD survive the propagate+fold pipeline.
   if (cfg && cfg.vectorizeLaneLocal === true) {
-    const fullWatr = cfg.watr === true
-    const runVectorizer = (fullWatr && cfg.__phase === 'post') || (!fullWatr && cfg.__phase !== 'post')
-    if (runVectorizer) vectorizeLaneLocal(fn)
+    const fullWatr = cfg.watr === true || typeof cfg.watr === 'object'
+    const runVectorizer = (fullWatr && phase === 'post') || (!fullWatr && phase !== 'post')
+    // Phase 1: fold dead string-dispatch blocks on proven-f64 locals BEFORE
+    // the vectorizer pattern-matches — dead __is_str_key calls in $fbm-style
+    // functions (param f64 + op f64) block liftPPC from recognizing them as pure.
+    if (runVectorizer) foldStrDispatchF64(fn)
+    if (runVectorizer) vectorizeLaneLocal(fn, cfg.reduceUnroll === true, cfg.relaxedSimd === true, cfg.blurMultiPixel !== false, cfg.whyNotSimd === true, cfg.experimentalStencil !== false, cfg.experimentalOuterStrip !== false, cfg._pureFuncMap || null, cfg.experimentalToneMap !== false)
   }
   if (!cfg || cfg.sortLocalsByUse !== false) sortLocalsByUse(fn, cfg && cfg.fusedRewrite !== false ? counts : null)
+  // An optimizer pass that emits a malformed local — the class that otherwise dies
+  // as an opaque watr "Duplicate/Unknown local $x" several phases on — is caught
+  // here, pinned to the function and the bad name.
+  if (DBG_IR) { const bad = verifyFn(fn); if (bad) throw new Error(`[ir verify] optimize produced invalid IR in ${fn[1]}: ${bad}`) }
+}
+
+// The i32 form of an integer-valued f64 expression, or null. Used to push ToInt32
+// through a conditional and to collapse the f64 round-trip on integer `+`/`-`.
+// Lossless by construction: `convert_i32(X) → X`; integer `f64.const → i32.const`
+// (ToInt32); `f64.add/sub` of i32-valued operands → `i32.add/sub` (mod-2³² is a ring
+// homomorphism, and each i32±i32 < 2³² < 2⁵³ so the f64 op is exact). EXCLUDES `mul`
+// (products can exceed 2⁵³, so the f64 op loses precision and i32.mul wouldn't match)
+// and anything non-integer or unprovable. Address `local.tee`s inside operands are
+// preserved (kept as-is in the returned i32 tree).
+function toI32(n) {
+  if (!Array.isArray(n)) return null
+  const op = n[0]
+  if ((op === 'f64.convert_i32_s' || op === 'f64.convert_i32_u') && n.length === 2) return n[1]
+  // i32-range consts only: keeps every leaf within i32 so f64 add/sub of leaves stays exact
+  // (< 2^53) and ToInt32-homomorphic. A larger const would round in f64.add or saturate in
+  // trunc_sat differently from JS `|0`, breaking the fold.
+  if (op === 'f64.const' && typeof n[1] === 'number' && (n[1] | 0) === n[1]) return ['i32.const', n[1]]
+  if ((op === 'f64.add' || op === 'f64.sub') && n.length === 3) {
+    const a = toI32(n[1]), b = toI32(n[2])
+    if (a && b) return [op === 'f64.add' ? 'i32.add' : 'i32.sub', a, b]
+  }
+  return null
 }
 
 // Fused bottom-up walk applying three orthogonal pattern sets at each node:
@@ -1973,7 +2747,7 @@ function fusedRewrite(fn, counts) {
     if (Array.isArray(fn)) {
       for (let i = 0; i < fn.length; i++) {
         const c = fn[i]
-        if (Array.isArray(c)) fn[i] = walkRewrite(c, true, counts)
+        if (Array.isArray(c)) fn[i] = walkRewrite(c, true, counts, null, null)
       }
     }
     return
@@ -1982,17 +2756,33 @@ function fusedRewrite(fn, counts) {
   const name = typeof fn[1] === 'string' ? fn[1] : null
   const skipInline = !!(name && (name.startsWith('$__ptr_') || name === '$__is_nullish' || name === '$__is_truthy' || name === '$__is_null'))
   const bodyStart = findBodyStart(fn)
+  // i64 scratch allocator for the literal-eq inline: any-shaped operand is
+  // tee'd once instead of duplicated. Decls splice in after the walk.
+  const newDecls = []
+  // pre+post phases both run this pass — continue numbering past any scratch
+  // locals the earlier phase already declared, or the decls collide.
+  let scratchN = 0
+  for (let i = 2; i < fn.length; i++) {
+    const d = fn[i]
+    if (Array.isArray(d) && d[0] === 'local' && typeof d[1] === 'string') {
+      const m = d[1].match(/^\$__eq[tf](\d+)$/)
+      if (m) scratchN = Math.max(scratchN, +m[1] + 1)
+    }
+  }
+  const freshI64 = () => { const n = `$__eqt${scratchN++}`; newDecls.push(['local', n, 'i64']); return n }
+  const freshF64 = () => { const n = `$__eqf${scratchN++}`; newDecls.push(['local', n, 'f64']); return n }
   for (let i = bodyStart; i < fn.length; i++) {
     const c = fn[i]
-    if (Array.isArray(c)) fn[i] = walkRewrite(c, !skipInline, counts)
+    if (Array.isArray(c)) fn[i] = walkRewrite(c, !skipInline, counts, freshI64, freshF64)
   }
+  if (newDecls.length) fn.splice(bodyStart, 0, ...newDecls)
 }
 
-function walkRewrite(node, doInline, counts) {
+function walkRewrite(node, doInline, counts, freshI64, freshF64) {
   if (!Array.isArray(node)) return node
   for (let i = 0; i < node.length; i++) {
     const c = node[i]
-    if (Array.isArray(c)) node[i] = walkRewrite(c, doInline, counts)
+    if (Array.isArray(c)) node[i] = walkRewrite(c, doInline, counts, freshI64, freshF64)
   }
   const op = node[0]
   // Piggyback local-ref counting for sortLocalsByUse. `counts` may be undefined
@@ -2000,6 +2790,74 @@ function walkRewrite(node, doInline, counts) {
   if (counts && (op === 'local.get' || op === 'local.set' || op === 'local.tee') && typeof node[1] === 'string')
     counts.set(node[1], (counts.get(node[1]) || 0) + 1)
 
+  // Generic-equality bit-eq fast path: $__eq's own first branch hoisted to the
+  // site when both args duplicate cheaply (local.get / reinterpret of one).
+  // Identical bits ⇒ equal-unless-canonical-NaN; static-literal dedup + SSO +
+  // slice interning make the hit dominant in tree-walking code (tag compares),
+  // so most sites skip the call. The else arm keeps the original call.
+  if (doInline && op === 'call' && (node[1] === '$__eq' || node[1] === '$__str_eq')
+      && node.length === 4 && !node._eqFast) {
+    const cheap = (n) => Array.isArray(n) &&
+      (n[0] === 'local.get' ||
+        (n[0] === 'i64.reinterpret_f64' && Array.isArray(n[1]) && n[1][0] === 'local.get'))
+    // i64.const whose bits decode to a CANONICAL interned string (STRING tag,
+    // INTERN_BIT set, SSO/SLICE clear) — i.e. a static-literal operand.
+    const internedLit = (n) => {
+      // (i64.const 0x…) or its f64-carrier form (i64.reinterpret_f64 (f64.const nan:0x…))
+      let tok = null
+      if (Array.isArray(n) && n[0] === 'i64.const') tok = n[1]
+      else if (Array.isArray(n) && n[0] === 'i64.reinterpret_f64' && Array.isArray(n[1])
+        && n[1][0] === 'f64.const' && typeof n[1][1] === 'string' && n[1][1].startsWith('nan:'))
+        tok = n[1][1].slice(4)
+      if (tok == null) return false
+      let v
+      try { v = BigInt(tok) } catch { return false }
+      if (v < 0n) v += 1n << 64n
+      if (((v >> 47n) & 0xFn) !== 4n) return false
+      return ((v >> 32n) & 0x6001n) === BigInt(STR_INTERN_BIT)
+    }
+    // Literal-vs-X inline: bit-eq → 1; X carrying the canonical aux pattern →
+    // 0 (only a canonical string can content-equal a canonical literal, and
+    // canonicals are deduped; every NON-string kind is ≠ a string under ===
+    // as well, so answering 0 on the pattern is sound for ANY value). Slices,
+    // SSO, fresh heap strings and NaN fall through to the call. This is what
+    // makes `op === 'literal'` dispatch ladders cost ~3 ops per rung instead
+    // of a helper call — the V8 interned-pointer-compare equivalent.
+    const a = node[2], b = node[3]
+    const lit = internedLit(b) ? b : internedLit(a) ? a : null
+    const x = lit === b ? a : b
+    if (lit && (cheap(x) || freshI64)) {
+      node._eqFast = true
+      // Cheap operands duplicate; anything else evaluates ONCE into an i64
+      // scratch (tee in the first use), so the inline applies to un-hoisted
+      // shapes like `node[0] === 'lit'` too.
+      let first = x, reuse = x
+      if (!cheap(x)) {
+        const t = freshI64()
+        first = ['local.tee', t, x]
+        reuse = ['local.get', t]
+        node[2] = lit === b ? reuse : lit
+        node[3] = lit === b ? lit : reuse
+      }
+      const auxPat = ['i32.eq',
+        ['i32.and', ['i32.wrap_i64', ['i64.shr_u', reuse, ['i64.const', 32]]], ['i32.const', 0x6001]],
+        ['i32.const', STR_INTERN_BIT]]
+      return ['if', ['result', 'i32'],
+        ['i64.eq', first, lit],
+        ['then', ['i32.const', 1]],
+        ['else', ['if', ['result', 'i32'], auxPat,
+          ['then', ['i32.const', 0]],
+          ['else', node]]]]
+    }
+    if (node[1] === '$__eq' && cheap(a) && cheap(b)) {
+      node._eqFast = true   // pre+post phases both run this walk — wrap once
+      return ['if', ['result', 'i32'],
+        ['i64.eq', a, b],
+        ['then', ['i64.ne', a, ['i64.const', NAN_BITS]]],
+        ['else', node]]
+    }
+  }
+
   // Inline-ptr-helpers: $__ptr_type / $__ptr_aux / $__is_nullish / $__is_null / $__is_truthy
   if (doInline && op === 'call' && node.length === 3 && typeof node[1] === 'string') {
     const fname = node[1]
@@ -2014,6 +2872,14 @@ function walkRewrite(node, doInline, counts) {
         && Array.isArray(node[2][1]) && node[2][1][0] === 'local.get') return ['i32.or',
       ['i64.eq', node[2], ['i64.const', NULL_BITS]],
       ['i64.eq', node[2], ['i64.const', UNDEF_BITS]]]
+    // Expression-arg __is_truthy: evaluate once into an f64 scratch via tee —
+    // the local.tee form below then expands inline (covers `(c = next()) || …`
+    // and every condition the emitter didn't pre-hoist).
+    if (fname === '$__is_truthy' && freshF64 && Array.isArray(node[2]) && node[2][0] === 'i64.reinterpret_f64'
+        && Array.isArray(node[2][1])
+        && node[2][1][0] !== 'local.get' && node[2][1][0] !== 'local.tee') {
+      node[2] = ['i64.reinterpret_f64', ['local.tee', freshF64(), node[2][1]]]
+    }
     if (fname === '$__is_truthy' && Array.isArray(node[2]) && node[2][0] === 'i64.reinterpret_f64'
         && Array.isArray(node[2][1]) && (node[2][1][0] === 'local.get' || node[2][1][0] === 'local.tee')) {
       // `local.tee $x SRC` evaluates SRC once, stores to $x, returns the value —
@@ -2025,16 +2891,21 @@ function walkRewrite(node, doInline, counts) {
       const lget = ['local.get', lname]
       const first = ref[0] === 'local.tee' ? ref : lget
       const bits = ['i64.reinterpret_f64', lget]
+      // Mirror $__is_truthy (module/core.js) exactly: FIVE falsy patterns —
+      // canonical NaN, null, undefined, the empty SSO string, AND boolean
+      // false. Omitting FALSE made inlined `x || y` treat false as truthy.
       return ['if', ['result', 'i32'],
         ['f64.eq', first, lget],
         ['then', ['f64.ne', lget, ['f64.const', 0]]],
         ['else', ['i32.and',
           ['i32.and',
-            ['i64.ne', bits, ['i64.const', NAN_BITS]],
-            ['i64.ne', bits, ['i64.const', NULL_BITS]]],
-          ['i32.and',
-            ['i64.ne', bits, ['i64.const', UNDEF_BITS]],
-            ['i64.ne', bits, ['i64.const', '0x7FFA400000000000']]]]]]
+            ['i32.and',
+              ['i64.ne', bits, ['i64.const', NAN_BITS]],
+              ['i64.ne', bits, ['i64.const', NULL_BITS]]],
+            ['i32.and',
+              ['i64.ne', bits, ['i64.const', UNDEF_BITS]],
+              ['i64.ne', bits, ['i64.const', '0x7FFA400000000000']]]],
+          ['i64.ne', bits, ['i64.const', FALSE_BITS]]]]]
     }
   }
 
@@ -2078,6 +2949,65 @@ function walkRewrite(node, doInline, counts) {
       return a[1]
   }
 
+  // Push ToInt32 through integer expressions and conditionals. The universal value model
+  // computes integer `+`/`-` and `?:` in f64, then ToInt32-clamps — emitting
+  //   (select (i32.wrap_i64 (i64.trunc_sat_f64_s [local.tee T] X)) FALLBACK COND)
+  // whose three arms all compute ToInt32(X). When X is an integer-valued f64 expression,
+  // ToInt32(X) == its i32 form (exact); and ToInt32 distributes through a conditional:
+  //   ToInt32(if C A B) == if(result i32) C ToInt32(A) ToInt32(B).
+  // Folding here drops the f64 round-trip AND turns int `s += a[i]` reductions and
+  // `a[i] = cond ? … : …` conditional maps into pure i32 the vectorizer lifts (i32x4.add /
+  // i32x4 bitselect). FALLBACK/COND (which recompute the same ToInt32 from T) are dropped.
+  if (op === 'select' && node.length >= 4) {
+    const v = node[1]
+    if (Array.isArray(v) && v[0] === 'i32.wrap_i64' && Array.isArray(v[1]) && v[1][0] === 'i64.trunc_sat_f64_s' && v[1].length === 2) {
+      let inner = v[1][1]
+      if (Array.isArray(inner) && inner[0] === 'local.tee' && inner.length === 3) inner = inner[2]
+      // ToInt32(if (result f64) C A B) → if (result i32) C toI32(A) toI32(B), when both arms are integer-valued.
+      if (Array.isArray(inner) && inner[0] === 'if' && Array.isArray(inner[1]) && inner[1][0] === 'result' && inner[1][1] === 'f64'
+          && Array.isArray(inner[3]) && inner[3][0] === 'then' && inner[3].length === 2
+          && Array.isArray(inner[4]) && inner[4][0] === 'else' && inner[4].length === 2) {
+        const t = toI32(inner[3][1]), e = toI32(inner[4][1])
+        if (t && e) return ['if', ['result', 'i32'], inner[2], ['then', t], ['else', e]]
+      }
+      // ToInt32(integer-valued f64 expr) → its i32 form (covers (i32±i32)|0 sums and nests).
+      const i = toI32(inner)
+      if (i) return i
+    }
+  }
+  // (i32.or X 0) / (i32.or 0 X) → X — drops the redundant source-level `|0` clamp left
+  // after the fold above, so the accumulator update is a bare i32.add the recognizer matches.
+  if (op === 'i32.or' && node.length === 3) {
+    const a = node[1], b = node[2]
+    if (Array.isArray(b) && b[0] === 'i32.const' && b[1] === 0) return a
+    if (Array.isArray(a) && a[0] === 'i32.const' && a[1] === 0) return b
+  }
+
+  // f64.CMP(convert_i32 A, convert_i32 B) → i32.CMP(A, B). Comparing two i32 values is
+  // identical whether done in exact f64 or in i32 (the converts are lossless and
+  // order-preserving), so an integer comparison over typed-array loads (reads are f64)
+  // drops its f64 round-trip. eq/ne are sign-agnostic; ordered compares need matching
+  // signedness; an integer comparand constant works for the signed case. Both operands
+  // are kept, so any address `local.tee` inside them survives. Prerequisite for i32
+  // conditional-lane vectorization (the mask becomes an i32x4 compare).
+  if (op === 'f64.eq' || op === 'f64.ne' || op === 'f64.lt' || op === 'f64.gt' || op === 'f64.le' || op === 'f64.ge') {
+    const base = op.slice(4)
+    const cv = (x) => Array.isArray(x) && (x[0] === 'f64.convert_i32_s' || x[0] === 'f64.convert_i32_u') && x.length === 2 ? x : null
+    const intK = (x) => Array.isArray(x) && x[0] === 'f64.const' && Number.isInteger(x[1]) && x[1] >= -2147483648 && x[1] <= 2147483647 ? x[1] : null
+    const a = node[1], b = node[2], ca = cv(a), cb = cv(b)
+    if (ca && cb) {
+      const sa = ca[0] === 'f64.convert_i32_s', sb = cb[0] === 'f64.convert_i32_s'
+      if (base === 'eq' || base === 'ne') return ['i32.' + base, ca[1], cb[1]]
+      if (sa === sb) return ['i32.' + base + (sa ? '_s' : '_u'), ca[1], cb[1]]
+    } else if (ca && ca[0] === 'f64.convert_i32_s') {
+      const k = intK(b)
+      if (k != null) return base === 'eq' || base === 'ne' ? ['i32.' + base, ca[1], ['i32.const', k]] : ['i32.' + base + '_s', ca[1], ['i32.const', k]]
+    } else if (cb && cb[0] === 'f64.convert_i32_s') {
+      const k = intK(a)
+      if (k != null) return base === 'eq' || base === 'ne' ? ['i32.' + base, ['i32.const', k], cb[1]] : ['i32.' + base + '_s', ['i32.const', k], cb[1]]
+    }
+  }
+
   // shl-distribute-over-add: (i32.shl (i32.add x (i32.const K)) (i32.const S))
   // → (i32.add (i32.shl x S) (i32.const K<<S)). Overflow-safe — both forms wrap
   // mod 2^32 identically. Unlocks memarg offset= folding for biquad-style
@@ -2177,6 +3107,13 @@ export function treeshake(funcSections, allModuleNodes, opts) {
     for (let i = 2; i < fn.length; i++)
       if (Array.isArray(fn[i]) && fn[i][0] === 'export') { addRoot(name); break }
 
+  // When user funcs are NOT being reclaimed (O0/O1 keep declared-but-uncalled ones), they
+  // all survive — so they're roots for the *internal*-func reachability below. Otherwise an
+  // unreachable user func that's kept would still call a `__helper`, yet that helper would be
+  // pruned as unreached-from-exports, leaving a dangling `call $__helper`.
+  if (!removeDead && opts && opts.userFuncs)
+    for (const name of opts.userFuncs) addRoot(name)
+
   const findRoots = (node) => {
     if (!Array.isArray(node)) return
     if (node[0] === 'start' && typeof node[1] === 'string') addRoot(node[1])
@@ -2204,24 +3141,43 @@ export function treeshake(funcSections, allModuleNodes, opts) {
   for (const fn of allFuncs) if (typeof fn[1] !== 'string') visitCalls(fn)
   while (stack.length) visitCalls(funcByName.get(stack.pop()))
 
+  // Compiler-internal funcs (stdlib helpers, allocator wrappers — everything not in the
+  // user's own `ctx.func.list`) carry no source meaning, so an unreachable one is reclaimed
+  // at EVERY opt level: it's never a live-coding aid, just over-production (e.g. `s + '!'`
+  // pulls the alloc trio's `__alloc_hdr`, which string concat never calls, and a dead-branch
+  // dep like `__str_len`). User funcs are reclaimed only when DCE is on, so O0/O1 keep a
+  // declared-but-uncalled user function. Absent the set, fall back to gating everything.
+  const userFuncs = opts && opts.userFuncs
+  const isUserFunc = (name) => userFuncs ? userFuncs.has(name) : true
   let removed = 0
-  if (removeDead) {
+  if (removeDead || userFuncs) {
     for (const { arr } of funcSections) {
       for (let i = arr.length - 1; i >= 0; i--) {
         const n = arr[i]
-        if (Array.isArray(n) && n[0] === 'func' && typeof n[1] === 'string' && !reachable.has(n[1])) {
+        if (Array.isArray(n) && n[0] === 'func' && typeof n[1] === 'string' && !reachable.has(n[1]) &&
+            (removeDead || !isUserFunc(n[1]))) {
           arr.splice(i, 1); removed++
         }
       }
     }
   }
 
-  // Dead-global elimination: after dead funcs are gone, drop `(global $g …)` decls
-  // that nothing references (a `global.get`/`global.set` in a remaining func, a kept
-  // global's init expr, a data/elem offset, or an `(export … (global $g))`). Imported
-  // globals live in `allModuleNodes`, not in `opts.globals`, so they're never touched.
-  // Fixpoint: a kept global's init may reference another global.
-  const globals = removeDead && opts && Array.isArray(opts.globals) ? opts.globals : null
+  // Dead-global elimination: drop `(global $g …)` decls that nothing references
+  // (a `global.get`/`global.set` in a remaining func, a kept global's init expr, a
+  // data/elem offset, or an `(export … (global $g))`). Imported globals live in
+  // `allModuleNodes`, not in `opts.globals`, so they're never touched. Fixpoint: a
+  // kept global's init may reference another global.
+  //
+  // Compiler-internal globals (support state the user never wrote — e.g. core's
+  // `__heap_start` or the math module's `rng_state`, declared eagerly but read
+  // only by specific fast paths) are reclaimed at *every* level: leaving an
+  // unreferenced one in the output is pure noise, never a live-coding aid. User
+  // globals are reclaimed only when DCE is on, so O0/O1 still preserve declared-
+  // but-unused user bindings. `userGlobals` (names sans `$`) draws the line; absent
+  // it, fall back to the `$__` reserved-prefix heuristic.
+  const userGlobals = opts && opts.userGlobals
+  const isUserGlobal = (name) => userGlobals ? userGlobals.has(name.slice(1)) : !name.startsWith('$__')
+  const globals = opts && Array.isArray(opts.globals) ? opts.globals : null
   if (globals) {
     const collectGlobalRefs = (node, refd) => {
       if (!Array.isArray(node)) return
@@ -2238,9 +3194,11 @@ export function treeshake(funcSections, allModuleNodes, opts) {
       for (const g of globals) collectGlobalRefs(g, refd)
       for (let i = globals.length - 1; i >= 0; i--) {
         const g = globals[i]
-        if (Array.isArray(g) && g[0] === 'global' && typeof g[1] === 'string' && !refd.has(g[1])) {
-          globals.splice(i, 1); changed = true
-        }
+        if (!Array.isArray(g) || g[0] !== 'global' || typeof g[1] !== 'string' || refd.has(g[1])) continue
+        // An inline `(export …)` on the decl pins it — it's part of the module's
+        // JS-host surface (e.g. `__heap`), referenced from outside the wasm.
+        if (g.some(c => Array.isArray(c) && c[0] === 'export')) continue
+        if (removeDead || !isUserGlobal(g[1])) { globals.splice(i, 1); changed = true }
       }
     }
   }
@@ -2258,7 +3216,8 @@ export function sortLocalsByUse(fn, precomputedCounts) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const localIdxs = []
   let totalDecls = 0
-  for (let i = 2; i < fn.length; i++) {
+  let i
+  for (i = 2; i < fn.length; i++) {
     const c = fn[i]
     if (!Array.isArray(c)) continue
     if (c[0] === 'param' || c[0] === 'result') { totalDecls++; continue }