jz 0.5.1 → 0.7.0

package/src/{prepare.js → prepare/index.js}

@@ -19,33 +19,70 @@
  * Each handler may touch multiple concerns, but helpers keep each concern self-contained.
  * Unhandled ops fall through to recursive prep() of their children.
  *
+ * # Forward seeding (the two compile/ imports — deliberate, not a layering leak)
+ * Prepare is the only pass that sees module-scope declarations in source order,
+ * so it seeds two compile-stage fact stores AS it walks (re-deriving them later
+ * would need a second whole-AST pass over information prepare already holds):
+ *   - `recordGlobalRep` (compile/infer.js)        — module-global value reps
+ *   - `observeNodeFacts` (compile/program-facts.js) — per-node program facts
+ * The contract is write-only: prepare never READS compile-stage state, so the
+ * stage remains re-runnable and compile owns every read path.
+ *
  * @module prepare
  */
 
-import { parse } from 'subscript/feature/jessie'
-import { ctx, err, derive } from './ctx.js'
-import { T, STMT_OPS, VAL, extractParams, collectParamNames, classifyParam, observeNodeFacts, staticObjectProps, staticPropertyKey } from './analyze.js'
-import { recordGlobalRep } from './infer.js'
-import { isFuncRef } from './ir.js'
+import { handlerArgs, refsName, ASSIGN_OPS, JZ_NULL, JZ_UNDEF, TYPEOF } from '../ast.js'
+import { ctx, err, derive, emitArity, declGlobal } from '../ctx.js'
+import { T } from '../ast.js'
+import { extractParams, collectParamNames, classifyParam } from '../ast.js'
+import { observeNodeFacts } from '../compile/program-facts.js'
+import { staticObjectProps, staticPropertyKey } from '../static.js'
+import { VAL } from '../reps.js'
+import { STMT_OPS } from '../ast.js'
+import { REJECT_IDENTS, REJECT_OPS, rejectHandlers } from '../op-policy.js'
+import { recordGlobalRep } from '../compile/infer.js'
+import { isFuncRef } from '../ir.js'
 import {
-  CTORS, TIMER_NAMES,
-  hasModule, includeModule,
+  CTORS, COLLECTION_CTORS, TIMER_NAMES,
+  hasModule, includeModule, includeMods,
   includeForArrayAccess, includeForArrayLiteral, includeForArrayPattern, includeForCallableValue,
   includeForGenericMethod, includeForKnownKeyIteration, includeForNamedCall, includeForNumericCoercion,
   includeForObjectLiteral, includeForObjectPattern, includeForOp, includeForProperty, includeForRuntimeCtor,
   includeForRuntimeKeyIteration, includeForStringOnly, includeForStringValue, includeForTimerRuntime,
-} from './autoload.js'
-
-let depth = 0  // arrow nesting depth (0=top-level, >0=inside function)
-let scopes = []  // block scope stack: [{names: Set, renames: Map}]
-let staticConstScopes = []  // lexical const facts: [{strings: Map, arrays: Map}]
-let assignedStaticGlobals = null
+} from '../autoload.js'
+
+// SIMD intrinsic namespaces — pure namespaces backed by the `simd` module.
+const SIMD_NS = new Set(['f32x4', 'i32x4', 'f64x2', 'v128'])
+
+// Module-level prepare state. Six independent stacks/scalars that together form
+// the prepare-pass working set. Lifecycle: reinitialized via `resetPrepState()`
+// at the top of `prepare()` (line ~368) — any throw inside prepare is cleared
+// on the next entry, so leak across compilations is impossible. Kept at module
+// scope (rather than ctx.prepare.*) because 78 read sites would mean a single
+// indirection on every scope query; the consolidated reset documents the set.
+let depth          // arrow nesting depth (0=top-level, >0=inside function)
+let scopes         // block scope stack: [{names: Set, renames: Map}]
+let staticConstScopes  // lexical const facts: [{strings: Map, arrays: Map}]
+let assignedStaticGlobals
 // Per-arrow set of names already declared anywhere in the function body. Used
 // to force a rename when the same identifier is declared in two sibling blocks
 // (else-if arms, separate { ... } chunks): without renaming, both decls lower
 // to the same WASM local, but downstream optimizations (directClosures) gate
 // on per-decl `isReassigned`, not per-WASM-local — they'd read a stale binding.
-let funcLocalNames = []
+let funcLocalNames
+// Per-arrow set of local names bound to a function literal (`let g = () => …`).
+// Lets the `.`-handler tell a function receiver — where `.caller`/`.callee` are
+// prohibited introspection — from a data object that merely has such a field.
+let funcValueNames
+
+const resetPrepState = () => {
+  depth = 0
+  scopes = []
+  staticConstScopes = []
+  assignedStaticGlobals = new Set()
+  funcLocalNames = [new Set()]
+  funcValueNames = [new Set()]
+}
 
 // ES spec: identifier with \uHHHH or \u{...} escape is equivalent to the decoded
 // form. subscript preserves raw spelling in the AST; normalize once before prep.
@@ -54,6 +91,55 @@ const decodeIdent = s => s.includes('\\u')
   ? s.replace(IDESC, (_, b, p) => String.fromCodePoint(parseInt(b || p, 16)))
   : s
 
+// A for-loop bound `arr.length` may be snapshotted into a pre-loop local only when
+// nothing in the loop can change it. Two ways it can change: a write to the receiver
+// (`arr = …`, `arr.length = …`, `arr[k] = …`) or a call — push/pop/splice mutate
+// directly, and any call can reach `arr` through an alias the compiler can't track
+// locally (compilePendingClosures grows ctx.closure.bodies this way). Both predicates
+// recurse the whole node; nested arrow *definitions* are harmless until invoked, and
+// an invocation is itself a call node, so `callFree` already covers escaped mutators.
+const callFree = node => {
+  if (!Array.isArray(node)) return true
+  if (node[0] === '()' || node[0] === 'new') return false
+  for (let i = 1; i < node.length; i++) if (!callFree(node[i])) return false
+  return true
+}
+// Calls that provably can't resize ANY receiver: read-only builtin methods
+// (no mutators, no callback-takers — a callback could close over the receiver
+// and push) and pure namespaces. Everything else (user fns, push/splice,
+// map/forEach) may reach the bound receiver through an alias — disqualifies
+// the length snapshot. A user object shadowing one of these names with a
+// mutating closure is a documented divergence (same class as for-of's).
+const _BOUND_PURE_NS = new Set(['Math', 'math', 'Number', 'String', 'JSON', 'console', 'Date', 'performance'])
+const _BOUND_RO_METHODS = new Set([
+  'charCodeAt', 'charAt', 'codePointAt', 'at', 'indexOf', 'lastIndexOf', 'includes',
+  'startsWith', 'endsWith', 'slice', 'substring', 'trim', 'toUpperCase', 'toLowerCase',
+  'join', 'concat', 'toString', 'get', 'has', 'now',
+])
+const boundSafeCalls = node => {
+  if (!Array.isArray(node)) return true
+  if (node[0] === 'new') return false
+  if (node[0] === '()' || node[0] === '?.()') {
+    const callee = node[1]
+    const safe = Array.isArray(callee) && (callee[0] === '.' || callee[0] === '?.') &&
+      (_BOUND_RO_METHODS.has(callee[2]) ||
+       (typeof callee[1] === 'string' && _BOUND_PURE_NS.has(callee[1])))
+    if (!safe) return false
+  }
+  for (let i = 1; i < node.length; i++) if (!boundSafeCalls(node[i])) return false
+  return true
+}
+const writesReceiver = (node, recv) => {
+  if (!Array.isArray(node)) return false
+  const op = node[0]
+  if ((ASSIGN_OPS.has(op) || op === '++' || op === '--') &&
+      (node[1] === recv ||
+       (Array.isArray(node[1]) && (node[1][0] === '[]' || node[1][0] === '.') && node[1][1] === recv)))
+    return true
+  for (let i = 1; i < node.length; i++) if (writesReceiver(node[i], recv)) return true
+  return false
+}
+
 const normalizeIdents = node => {
   if (!Array.isArray(node)) return
   // Literal-value wrapper [null, X] / [undefined, X]: X is a value, not an identifier
@@ -67,14 +153,26 @@ const normalizeIdents = node => {
 
 const hostReturnValType = spec => {
   if (!spec || typeof spec === 'function') return null
+  // Return type is the canonical string name ('number'/'string'/'bigint'/'f64').
+  // (Earlier this also accepted the constructor identity `ret === String` etc.,
+  // but that references host-only globals with no first-class value in jz — it
+  // broke self-hosting and was never used. String names are the portable form.)
   const ret = spec.returns ?? spec.return ?? spec.result
-  if (ret === 'number' || ret === 'f64' || ret === Number) return VAL.NUMBER
-  if (ret === 'string' || ret === String) return VAL.STRING
-  if (ret === 'bigint' || ret === BigInt) return VAL.BIGINT
+  if (ret === 'number' || ret === 'f64') return VAL.NUMBER
+  if (ret === 'string') return VAL.STRING
+  if (ret === 'bigint') return VAL.BIGINT
   return null
 }
 
 const addHostImport = (mod, name, alias, spec) => {
+  // A numeric host constant (e.g. `Math.PI` via `{ imports: { math: Math } }`) has no callable
+  // ABI — record it so references fold to an f64 literal (see prep's identifier resolution) instead
+  // of emitting a 0-arg func import that can't be read as a value ("'PI' is not in scope").
+  if (typeof spec === 'number') {
+    if (!ctx.scope.hostConsts) ctx.scope.hostConsts = {}
+    ctx.scope.hostConsts[alias] = spec
+    return
+  }
   const nParams = typeof spec === 'function' ? spec.length : (spec?.params || 0)
   // User-supplied imports carry NaN-boxed values via i64 (not f64) so V8 cannot
   // canonicalize the NaN payload across the wasm↔JS function boundary —
@@ -99,7 +197,6 @@ const stripBoolNot = c => {
   return c
 }
 const stringValue = node => Array.isArray(node) && node[0] == null && typeof node[1] === 'string' ? node[1] : null
-const flatArgs = args => args.length === 1 && Array.isArray(args[0]) && args[0][0] === ',' ? args[0].slice(1) : args
 const MUTATING_ARRAY_METHODS = new Set(['copyWithin', 'fill', 'pop', 'push', 'reverse', 'shift', 'sort', 'splice', 'unshift'])
 
 function staticStringArrayValues(expr) {
@@ -224,6 +321,30 @@ function lookupStaticStringArray(name) {
   return ctx.scope.shapeStrArrays?.get(resolved) ?? null
 }
 
+/** Evaluate a constant numeric expression (number literals + basic arithmetic) for
+ *  compile-time string/template folding. Returns null when it isn't a pure-number
+ *  constant — string `+` and dynamic parts fall through to the caller's runtime path. */
+function constNum(node) {
+  if (Array.isArray(node) && node[0] == null && typeof node[1] === 'number') return node[1]
+  if (!Array.isArray(node)) return null
+  const [op, a, b] = node
+  if ((op === 'u-' || op === '-' || op === '+') && b === undefined) {
+    const x = constNum(a)
+    return x == null ? null : op === 'u-' || op === '-' ? -x : +x
+  }
+  const x = constNum(a), y = constNum(b)
+  if (x == null || y == null) return null
+  switch (op) {
+    case '+': return x + y
+    case '-': return x - y
+    case '*': return x * y
+    case '/': return y === 0 ? null : x / y
+    case '%': return y === 0 ? null : x % y
+    case '**': return x ** y
+  }
+  return null
+}
+
 function staticStringExpr(node) {
   const lit = stringValue(node)
   if (lit != null) return lit
@@ -234,12 +355,21 @@ function staticStringExpr(node) {
   if (op === '+') {
     const a = staticStringExpr(args[0])
     const b = staticStringExpr(args[1])
-    return a != null && b != null ? a + b : null
+    // Accumulate from a fresh empty string (`'' + a + b`) rather than concatenating two
+    // source-derived substrings directly. Under self-host the latter can yield a string
+    // backed by transient parse-time storage that's invalid by the time emit['//'] reads
+    // it for regex compilation (OOB); forcing a fresh allocation, as the template-literal
+    // path already does, keeps it stable. Identical value in both legs.
+    return a != null && b != null ? '' + a + b : null
   }
   if (op === '`') {
     let out = ''
     for (const part of args) {
-      const s = staticStringExpr(part)
+      let s = staticStringExpr(part)
+      // A numeric interpolation (`${123}`, `${1+2}`) is a constant in string context —
+      // ToString it so a fully-static template folds to one literal instead of a runtime
+      // concat. (Only the template case stringifies numbers; `+` stays polymorphic.)
+      if (s == null) { const n = constNum(part); if (n != null) s = String(n) }
       if (s == null) return null
       out += s
     }
@@ -270,15 +400,21 @@ function importMetaUrl() {
 
 function resolveImportMeta(spec) {
   const base = importMetaUrl()
-  try { return new URL(spec, base).href }
+  // URL resolution is a host capability (WHATWG URL parsing), injected via
+  // ctx.transform.resolveUrl rather than referencing the `URL` global — the same
+  // inversion as ctx.transform.parse. Keeps the self-host kernel (which bundles
+  // its module graph and never resolves import.meta at runtime) free of `URL`.
+  if (!ctx.transform.resolveUrl) err('import.meta resolution requires ctx.transform.resolveUrl (injected by the jz pipeline)')
+  try { return ctx.transform.resolveUrl(spec, base) }
   catch { err(`Cannot resolve import.meta specifier '${spec}' from '${base}'`) }
 }
 
 function recordModuleInitFacts(root) {
   const facts = ctx.module.initFacts ||= {
-    dynVars: new Set(), anyDyn: false, hasSchemaLiterals: false,
+    dynVars: new Set(), dynWriteVars: new Set(), anyDyn: false, hasSchemaLiterals: false,
     hasFuncValue: false, timerNames: new Set(),
     maxDef: 0, maxCall: 0, hasRest: false, hasSpread: false,
+    writtenProps: new Set(),
   }
   const visitFuncValue = (node) => {
     if (facts.hasFuncValue || !Array.isArray(node)) return
@@ -323,13 +459,39 @@ function recordModuleInitFacts(root) {
  * @param {ASTNode} node - Raw AST from parser
  * @returns {ASTNode} Normalized AST
  */
+// ES2020 §13.13: the nullish-coalescing `??` cannot be combined with `||` or `&&`
+// without parentheses — V8 raises a SyntaxError. subscript/jessie doesn't enforce
+// it, so jz would otherwise silently accept (and pick its own parse for) the mix.
+// Run on the RAW input AST: a parenthesized operand parses as `['()', …]`, so a
+// bare `??`/`||`/`&&` child is exactly the illegal unparenthesized form — and at
+// this stage no compiler-synthesized `??` (e.g. destructuring defaults) exists yet,
+// so `let [a = b || c] = arr` can't false-positive.
+function validateCoalesceMixing(n) {
+  if (!Array.isArray(n)) return
+  const op = n[0]
+  if (op === '||' || op === '&&') {
+    for (let i = 1; i < n.length; i++) if (Array.isArray(n[i]) && n[i][0] === '??')
+      err(`'??' cannot be mixed with '${op}' without parentheses (ES2020) — wrap one side, e.g. (a ?? b) ${op} c`)
+  } else if (op === '??') {
+    for (let i = 1; i < n.length; i++) if (Array.isArray(n[i]) && (n[i][0] === '||' || n[i][0] === '&&'))
+      err(`'??' cannot be mixed with '||' / '&&' without parentheses (ES2020) — wrap one side, e.g. a ?? (b || c)`)
+  }
+  for (let i = 1; i < n.length; i++) validateCoalesceMixing(n[i])
+}
+
 export default function prepare(node) {
-  depth = 0
-  scopes = []
-  staticConstScopes = []
-  assignedStaticGlobals = new Set()
-  funcLocalNames = [new Set()]
+  resetPrepState()
+  // Inject the module-include primitive so stdlib modules can pull dependency
+  // modules (e.g. object → collection) without importing autoload.js — that
+  // import would cycle (autoload imports every module via module/index.js).
+  ctx.module.include = includeModule
   includeModule('core')
+  // Empty or whitespace-only source parses to a bare '' — an empty program, not an
+  // identifier reference. Normalize to an empty statement so it compiles to a bare
+  // `(module)` instead of a `(local.get $)` against a zero-length name. (A non-empty
+  // bare identifier like `foo` parses to `'foo'` and stays a real reference.)
+  if (node === '') node = [';']
+  validateCoalesceMixing(node)  // ES2020: reject unparenthesized `??` mixed with `||`/`&&`
   normalizeIdents(node)
   fuseSparseMapReads(node)  // AST-level fusion; needs pre-resolution shape — defined at end of file
   seedStaticGlobalAssignments(node)
@@ -426,9 +588,9 @@ export default function prepare(node) {
   return ast
 }
 
-// Named constants → numeric literals
-export const JZ_NULL = Symbol('null')
-const CONSTANTS = { 'true': true, 'false': false, 'null': JZ_NULL, 'undefined': JZ_NULL }
+// Named constants → numeric literals. The JZ_NULL/JZ_UNDEF atom sentinels live
+// in ast.js — shared with emit without crossing the prepare↔compile boundary.
+const CONSTANTS = { 'true': true, 'false': false, 'null': JZ_NULL, 'undefined': JZ_UNDEF }
 // NaN/Infinity stay as special f64 values in emit()
 const F64_CONSTANTS = { 'NaN': NaN, 'Infinity': Infinity }
 
@@ -472,7 +634,43 @@ function deleteStaticGlobal(name) {
   ctx.scope.shapeStrArrays?.delete(name)
 }
 
+// Schema id when prhs is a bare object literal with static keys, else null.
+function objLiteralSid(prhs) {
+  if (!Array.isArray(prhs) || prhs[0] !== '{}') return null
+  const props = staticObjectProps(prhs.slice(1))
+  return props ? ctx.schema.register(props.names) : null
+}
+
+// Shape-consensus accounting for every `name = …` assignment. `sid` is the
+// RHS literal's schema id (null for any non-literal source). A name's schema
+// binds only while ALL its assignments agree on that one literal shape: the
+// first literal binds; any disagreeing assignment — non-literal RHS or a
+// different-shape literal — unbinds and poisons. Poisoned names never rebind,
+// so compile-time fixed-slot reads can't be aimed at one shape while the
+// variable holds another (the misread class: `.x` returning a foreign
+// object's slot-0 value). Compile consumes the END state — order-insensitive.
+function bindAssignSchema(name, sid) {
+  const had = ctx.schema.vars.get(name)
+  if (had != null) {
+    if (had !== sid) { ctx.schema.vars.delete(name); ctx.schema.poisoned?.add(name) }
+  } else if (sid != null) {
+    if (!ctx.schema.poisoned?.has(name)) ctx.schema.vars.set(name, sid)
+  } else ctx.schema.poisoned?.add(name)
+}
+
 const hasFunc = name => ctx.func.names.has(name)
+// A builtin name (`Map`, `Array`, `Math`, …) is shadowed when the user bound it
+// as a local (let/const/param, via `isDeclared`), a top-level function (via
+// `hasFunc`), or a top-level let/const global (via `userGlobals`). A shadowed
+// name must resolve to the user binding, so the constructor / named-call
+// fast-paths bail and fall through to `resolveCallee`, which already routes a
+// declared name to its local value. Mirrors the guard in
+// `foldNamespaceIntrospection`.
+const shadowsBuiltin = name => typeof name === 'string' &&
+  ((scopes.length && isDeclared(name)) || hasFunc(name) || ctx.scope.userGlobals?.has?.(name))
+// A local bound to a function literal in any active arrow scope (the nested-
+// closure counterpart to `hasFunc`, which only knows depth-0 lifted functions).
+const isFuncValueLocal = name => typeof name === 'string' && funcValueNames.some(s => s.has(name))
 
 const renameFunc = (func, nextName) => {
   ctx.func.names.delete(func.name)
@@ -480,8 +678,8 @@ const renameFunc = (func, nextName) => {
   ctx.func.names.add(nextName)
 }
 
-/** Map JS typeof strings to jz type checks. Codes < 0 trigger specialized emitTypeofCmp paths. */
-const TYPEOF_MAP = { 'number': -1, 'string': -2, 'undefined': -3, 'boolean': -4, 'object': -5, 'function': -6, 'bigint': -7 }
+// `typeof`-string → code table lives in ast.js (TYPEOF) — shared with
+// emitTypeofCmp and flow-types so the codes have one home.
 // Spec §13.5.3: `typeof undeclared_x` returns 'undefined' without throwing.
 // True iff `name` is a bare identifier with no resolution path. Mirrors the
 // resolution chain inside `prep()` so we don't speculate emit-time failures.
@@ -489,7 +687,7 @@ function isUnresolvableBareIdent(name) {
   if (typeof name !== 'string') return false
   if (name in CONSTANTS || name in F64_CONSTANTS) return false
   if (name === 'Boolean' || name === 'Number') return false
-  if (PROHIBITED[name]) return false
+  if (REJECT_IDENTS[name]) return false
   if (scopes.length && isDeclared(name)) return false
   if (ctx.scope.chain[name]) return false
   if (GLOBALS[name]) return false
@@ -508,9 +706,9 @@ function staticTypeofString(x) {
   // Spec §13.5.3: unresolvable bare ref → 'undefined'.
   if (isUnresolvableBareIdent(x)) return 'undefined'
   // Bare callable global: parseInt, parseFloat, isNaN, isFinite, Error, BigInt, etc.
-  if (typeof x === 'string' && !ctx.func?.locals?.has(x) && GLOBALS[x] && ctx.core.emit?.[x]?.length > 0) return 'function'
+  if (typeof x === 'string' && !ctx.func?.locals?.has(x) && GLOBALS[x] && emitArity(ctx.core.emit?.[x]) > 0) return 'function'
   const px = prep(x)
-  if (typeof px === 'string' && px.includes('.') && ctx.core.emit?.[px]?.length > 0) return 'function'
+  if (typeof px === 'string' && px.includes('.') && emitArity(ctx.core.emit?.[px]) > 0) return 'function'
   return null
 }
 // Builtin-namespace constructors expose `prototype`/`length`/`name` as own
@@ -534,14 +732,14 @@ function resolveTypeof(node) {
   if (Array.isArray(a) && a[0] === 'typeof' && Array.isArray(b) && b[0] == null && typeof b[1] === 'string') {
     const known = staticTypeofString(a[1])
     if (known != null) return [, eqLike ? known === b[1] : known !== b[1]]
-    const code = TYPEOF_MAP[b[1]]
+    const code = TYPEOF[b[1]]
     if (code != null) return [op, ['typeof', a[1]], [, code]]
   }
   // 'string' == typeof x
   if (Array.isArray(b) && b[0] === 'typeof' && Array.isArray(a) && a[0] == null && typeof a[1] === 'string') {
     const known = staticTypeofString(b[1])
     if (known != null) return [, eqLike ? known === a[1] : known !== a[1]]
-    const code = TYPEOF_MAP[a[1]]
+    const code = TYPEOF[a[1]]
     if (code != null) return [op, ['typeof', b[1]], [, code]]
   }
   return node
@@ -602,11 +800,19 @@ function prep(node) {
     if (typeof node === 'string') {
       if (node in CONSTANTS) return [, CONSTANTS[node]]
       if (node in F64_CONSTANTS) return [, F64_CONSTANTS[node]]
-      if (PROHIBITED[node]) err(PROHIBITED[node])
+      if (REJECT_IDENTS[node]) err(REJECT_IDENTS[node])
       // Boolean/Number as value → identity arrow (for .filter(Boolean), .map(Number) etc.)
       if (node === 'Boolean' || node === 'Number') { includeForCallableValue(); return ['=>', 'x', 'x'] }
       // Block locals shadow module imports/globals, even when the local keeps the same name.
       if (scopes.length && isDeclared(node)) return resolveScope(node)
+      // A user top-level binding (`let Math = …`) shadows a same-named builtin
+      // namespace seeded into the scope chain (`Math → math`). Resolve to the
+      // user global, not the builtin. (Mangled globals drop their original name
+      // from userGlobals, so this fires only for un-renamed user bindings.)
+      if (ctx.scope.userGlobals?.has?.(node)) return node
+      // Host numeric constant (`Math.PI` etc.) → fold to its f64 literal. Placed after the
+      // local/user-global checks above so a same-named binding still shadows it.
+      if (ctx.scope.hostConsts && node in ctx.scope.hostConsts) return [, ctx.scope.hostConsts[node]]
       const resolved = ctx.scope.chain[node]
       if (resolved?.includes('.')) return resolved
       // Cross-module import: mangled name (e.g. __util_js$clone)
@@ -619,6 +825,10 @@ function prep(node) {
 
   const [op, ...args] = node
   if (op === 'void' && ctx.transform.strict) err('strict mode: `void` is prohibited. It diverges from JS by evaluating to 0.')
+  // jz's `==`/`!=` already never coerce (identical to `===`/`!==`), so default mode accepts them.
+  // strict enforces the canonical subset, where `===`/`!==` are the one spelling — reject the loose form.
+  if ((op === '==' || op === '!=') && ctx.transform.strict)
+    err(`strict mode: \`${op}\` is prohibited — use \`${op}=\`. (jz's \`${op}\` doesn't coerce, but the canonical subset is \`===\`/\`!==\` only.)`)
   if (op == null) {
     if (typeof args[0] === 'string') {
       includeForStringValue()
@@ -630,19 +840,9 @@ function prep(node) {
   return handler ? handler(...args) : [op, ...args.map(prep)]
 }
 
-// Strict-jz prohibitions. `class` and `arguments` are *also* listed here but
-// only reach this point when jzify is off — jzify lowers `class` to a factory
-// arrow and rewrites `arguments` to a rest param before prepare runs. The
-// remainder (`with`, `this`, `super`, `yield`, `eval`) have no safe lowering
-// and stay errors in both modes.
-const PROHIBITED = { 'with': '`with` not supported', 'class': '`class` not supported', 'yield': '`yield` not supported',
-  'this': '`this` not supported: use explicit parameter',
-  'super': '`super` not supported: no class inheritance',
-  'arguments': '`arguments` not supported: use rest params',
-  'eval': '`eval` not supported'
-}
+// Identifier prohibitions: op-policy.js REJECT_IDENTS (prep string nodes).
 
-// Predefined globals seeded into scope.chain at ctx.reset(). Value is the scope alias
+// Predefined globals seeded into scope.chain at ctx.reset().
 // used in ctx.core.emit[]. Dotted lookups (Math.sin) go through the '.' handler which
 // resolves via scope.chain → module 'math' → registers 'math.sin' emitter.
 // Not actually "implicit imports" — these are ambient globals that exist in every jz/JS
@@ -683,6 +883,13 @@ export const GLOBALS = {
 const patternItems = (node) => node?.[0] === ',' ? node.slice(1) : [node]
 const isDestructPattern = (node) => Array.isArray(node) && (node[0] === '[]' || node[0] === '{}')
 
+// Element count of a prepared inline array literal `['[', e0, e1, …]` with no
+// spread (spread → dynamic length). Returns null when not such a literal, so
+// destructuring a non-literal source keeps its runtime element reads.
+const inlineArrayLen = (e) =>
+  Array.isArray(e) && e[0] === '[' && !e.slice(1).some(x => Array.isArray(x) && x[0] === '...')
+    ? e.length - 1 : null
+
 const simpleArrayPatternItems = (pattern) => {
   if (!Array.isArray(pattern) || pattern[0] !== '[]' || pattern.length !== 2) return null
   const items = patternItems(pattern[1])
@@ -714,7 +921,7 @@ function scalarArrayDestruct(pattern, rhs) {
 function declareGlobal(name, user = true) {
   if (depth !== 0 || typeof name !== 'string') return name
   if (ctx.scope.globals.has(name)) err(`'${name}' conflicts with a compiler internal — choose a different name`)
-  ctx.scope.globals.set(name, `(global $${name} (mut f64) (f64.const 0))`)
+  declGlobal(name, 'f64')
   if (user) ctx.scope.userGlobals.add(name)
   return name
 }
@@ -749,7 +956,7 @@ function pushPatternAssign(target, valueExpr, out, decls = null) {
   out.push(['=', target, valueExpr])
 }
 
-function expandDestruct(pattern, source, out, decls = null) {
+function expandDestruct(pattern, source, out, decls = null, srcLen = null) {
   if (!isDestructPattern(pattern)) return
 
   if (pattern[0] === '[]') {
@@ -764,6 +971,15 @@ function expandDestruct(pattern, source, out, decls = null) {
         continue
       }
 
+      // Source is a known-length inline literal and this index is past its end →
+      // the element is statically `undefined` (so any `= default` applies). Folding
+      // it here skips a provably out-of-range read — which both avoids the runtime
+      // access and dodges an optimizer miscompile of the destructuring-temp shape.
+      if (srcLen != null && j >= srcLen) {
+        pushPatternAssign(item, [, JZ_UNDEF], out, decls)
+        continue
+      }
+
       pushPatternAssign(item, ['[]', source, [, j]], out, decls)
     }
     return
@@ -844,7 +1060,7 @@ function prepDecl(op, ...inits) {
           ctx.scope.chain[i] = declName
         }
         if (ctx.scope.globals.has(declName)) err(`'${declName}' conflicts with a compiler internal — choose a different name`)
-        ctx.scope.globals.set(declName, `(global $${declName} (mut f64) (f64.const 0))`)
+        declGlobal(declName, 'f64')
         ctx.scope.userGlobals.add(declName)
       } else if (typeof declName === 'string') {
         // Bare hoisted decl inside a function (var X jzified to `let X` at top
@@ -859,6 +1075,23 @@ function prepDecl(op, ...inits) {
       continue
     }
     const [, name, init] = i
+    // `const alias = fn` whose RHS is a bare identifier naming a known function
+    // is a compile-time function alias — the ES `export { fn as alias }` written
+    // in declaration form (a recurring kernel idiom: paramList = extractParams,
+    // toBoolFromEmitted = truthyIR …). Resolve `alias` straight to the function
+    // so calls compile to a direct call and the export table re-exports the same
+    // mangled func. Otherwise it would box a closure into a module global that a
+    // cross-module callee resolves to the bare, unmangled name → "not in scope".
+    // Module scope + `const` only: depth>0 aliases already work as closure values,
+    // and a reassignable `let` is a genuine value binding, not an alias.
+    if (op === 'const' && depth === 0 && typeof name === 'string' && typeof init === 'string') {
+      const fn = hasFunc(init) ? init : (hasFunc(ctx.scope.chain[init]) ? ctx.scope.chain[init] : null)
+      if (fn) {
+        ctx.scope.chain[name] = fn
+        if (name in ctx.func.exports) ctx.func.exports[name] = fn
+        continue
+      }
+    }
     const staticStr = op === 'const' ? staticStringExpr(init) : null
     const staticArr = op === 'const' ? staticStringArrayValues(init) : null
     const normed = prep(init)
@@ -894,7 +1127,7 @@ function prepDecl(op, ...inits) {
         const p = normed.slice(1).filter(p => Array.isArray(p) && p[0] === ':').map(p => p[1])
         if (p.length) ctx.schema.vars.set(tmp, ctx.schema.register(p))
       }
-      expandDestruct(name, tmp, rest)
+      expandDestruct(name, tmp, rest, null, inlineArrayLen(normed))
       continue
     }
 
@@ -912,6 +1145,10 @@ function prepDecl(op, ...inits) {
         scopes[scopes.length - 1].set(name, name)
       }
       if (typeof declName === 'string' && fnNames) fnNames.add(declName)
+      // A nested arrow stays a closure value (defFunc only lifts depth-0). Record
+      // the binding so `.caller`/`.callee` on it reads as prohibited introspection.
+      if (typeof declName === 'string' && Array.isArray(normed) && normed[0] === '=>')
+        funcValueNames[funcValueNames.length - 1]?.add(declName)
       if (op === 'const') bindStaticConst(declName, staticStr, staticArr)
       // Track const for reassignment checks — only module-scope consts (depth 0)
       if (typeof declName === 'string' && depth === 0) {
@@ -942,20 +1179,29 @@ function prepDecl(op, ...inits) {
       // Track object schemas (after prefix so schema is keyed to final name)
       if (typeof declName === 'string' && Array.isArray(normed) && normed[0] === '{}' && normed.length > 1) {
         const props = []
+        const addProp = n => { if (!props.includes(n)) props.push(n) }
+        let allKnown = true
         for (const p of normed.slice(1)) {
-          if (Array.isArray(p) && p[0] === ':') props.push(p[1])
+          // Dedupe every key (explicit AND spread-sourced) so a `k: v` that overrides
+          // a spread-provided key doesn't push a duplicate — that would shift the
+          // indices of later keys past emitObjectSpread's deduped slot assignment
+          // (its `addName` dedupes both), making `decl.laterKey` read the wrong slot.
+          if (Array.isArray(p) && p[0] === ':') addProp(p[1])
           else if (Array.isArray(p) && p[0] === '...') {
-            // Merge spread source schema into this object's schema
             const srcSchema = typeof p[1] === 'string' && ctx.schema.resolve(p[1])
-            if (srcSchema) for (const n of srcSchema) { if (!props.includes(n)) props.push(n) }
+            if (srcSchema) for (const n of srcSchema) addProp(n)
+            else allKnown = false
           }
         }
-        if (props.length && ctx.schema.register) ctx.schema.vars.set(declName, ctx.schema.register(props))
+        // An unknown spread source makes the value a runtime HASH (see
+        // emitObjectSpread). Binding a static schema would compile `decl.prop`
+        // to a fixed slot load that misreads the hash, so leave reads dynamic.
+        if (allKnown && props.length && ctx.schema.register) ctx.schema.vars.set(declName, ctx.schema.register(props))
       }
       // Module-scope variable → WASM global (mark as user-declared)
       if (depth === 0 && typeof declName === 'string') {
         if (ctx.scope.globals.has(declName)) err(`'${declName}' conflicts with a compiler internal — choose a different name`)
-        ctx.scope.globals.set(declName, `(global $${declName} (mut f64) (f64.const 0))`)
+        declGlobal(declName, 'f64')
         ctx.scope.userGlobals.add(declName)
       }
       rest.push(['=', declName, normed])
@@ -972,7 +1218,7 @@ function prepDecl(op, ...inits) {
 // `import.meta.resolve("spec")` → the resolved URL as a static string.
 function foldImportMetaResolve(callee, args) {
   if (!isImportMetaProp(callee, 'resolve')) return undefined
-  const callArgs = flatArgs(args).filter(a => a != null)
+  const callArgs = handlerArgs(args)
   if (callArgs.length !== 1) err('`import.meta.resolve` requires one string literal argument')
   const spec = stringValue(callArgs[0])
   if (spec == null) err('`import.meta.resolve` supports only string literal arguments')
@@ -986,8 +1232,11 @@ function foldImportMetaResolve(callee, args) {
 // Returns the replacement IR, or `undefined` for an ordinary call.
 function dispatchConstructorCall(callee, args) {
   if (typeof callee !== 'string') return undefined
+  // A user binding named like a constructor (`let Map = …`, `let Array = …`)
+  // shadows the builtin — don't lower `Map(x)` to `new.Map`.
+  if (shadowsBuiltin(callee)) return undefined
   if (callee === 'Array') {
-    const callArgs = flatArgs(args).filter(a => a != null)
+    const callArgs = handlerArgs(args)
     if (callArgs.length === 1) return handlers['new'](['()', callee, callArgs[0]])
   }
   if (CTORS.includes(callee)) return handlers['new'](['()', callee, ...args])
@@ -1005,7 +1254,7 @@ function foldNamespaceIntrospection(callee, args) {
   if (!Array.isArray(callee) || callee[0] !== '.') return undefined
   const [, obj, prop] = callee
   if (obj === 'Array' && prop === 'isArray') {
-    const cargs = flatArgs(args).filter(a => a != null)
+    const cargs = handlerArgs(args)
     const a0 = cargs.length === 1 ? cargs[0] : null
     if (typeof a0 === 'string' && GLOBALS[a0] && !(scopes.length && isDeclared(a0)) && !hasFunc(a0))
       return [, 0]
@@ -1013,7 +1262,7 @@ function foldNamespaceIntrospection(callee, args) {
   if (prop === 'hasOwnProperty' && typeof obj === 'string' && !(scopes.length && isDeclared(obj))) {
     const mod = ctx.scope.chain[obj]
     if (mod && !mod.includes('.') && hasModule(mod)) {
-      const cargs = flatArgs(args).filter(a => a != null)
+      const cargs = handlerArgs(args)
       const member = cargs.length === 1 ? stringValue(cargs[0]) : null
       // Include the module so its emit keys (the namespace's member set) are
       // registered; unreferenced emitters/data dead-strip in compile.
@@ -1027,6 +1276,11 @@ function foldNamespaceIntrospection(callee, args) {
 // way: a bare identifier through the scope chain, an `obj.prop` member call
 // through host imports / named-call / generic-method / namespace tables, and
 // any other expression through `prep` (a callable runtime value).
+// Compiler-internal synthetic callees: emit-handled intrinsics, never user
+// function values — so a bare reference must not pull in the callable-value
+// (function table / closure) machinery.
+const INTRINSIC_CALLEES = new Set(['__iter_arr', '__keys_ro'])
+
 function resolveCallee(callee, args) {
   if (typeof callee === 'string') {
     const local = scopes.length && isDeclared(callee)
@@ -1038,12 +1292,23 @@ function resolveCallee(callee, args) {
       if (hasModule(resolved) && !ctx.module.imports.some(i => i[3]?.[1] === `$${resolved}`)) includeModule(resolved)
       return callee
     }
-    if (depth > 0 && !resolved && !ctx.func.exports[callee] && !ctx.module.imports.some(i => i[3]?.[1] === `$${callee}`))
+    if (depth > 0 && !resolved && !INTRINSIC_CALLEES.has(callee) && !ctx.func.exports[callee] && !ctx.module.imports.some(i => i[3]?.[1] === `$${callee}`))
       includeForCallableValue()
     return callee
   }
   if (Array.isArray(callee) && callee[0] === '.') {
     const [, obj, prop] = callee
+    // A user binding named like a builtin namespace (`let Math = {…}`) shadows
+    // it — resolve `Math.max(…)` as a method call on the local value, not the
+    // builtin named-call. (Property reads route through the `.` handler's own
+    // shadow check.)
+    if (shadowsBuiltin(obj)) return prep(callee)
+    // SIMD intrinsic namespaces resolve members directly to their emit key, ahead of
+    // generic-method dispatch — they're pure namespaces (never runtime values), and
+    // names like `f32x4.add` must not be mistaken for the generic `.add` (Set/Map).
+    if (typeof obj === 'string' && typeof prop === 'string' && SIMD_NS.has(obj) && !(scopes.length && isDeclared(obj)) && !ctx.scope.userGlobals?.has?.(obj)) {
+      includeModule(obj); return `${obj}.${prop}`
+    }
     const key = typeof obj === 'string' && typeof prop === 'string' ? `${obj}.${prop}` : null
     if (key && ctx.module.hostImports?.[obj]?.[prop]) {
       const spec = ctx.module.hostImports[obj][prop]
@@ -1078,18 +1343,13 @@ function renestSoleCommaArg(args) {
 }
 
 const handlers = {
+  ...rejectHandlers(err),
   // Spread operator: [...expr] in arrays, f(...args) in calls, {...obj} in objects
   '...'(expr) {
     includeForArrayLiteral()
     return ['...', prep(expr)]
   },
 
-  // Prohibited ops — duplicated from jzify deliberately: .jz source bypasses jzify,
-  // so prepare is the actual defense. Messages here fire for both .js and .jz.
-  'async': () => err('async/await not supported: WASM is synchronous'),
-  'await': () => err('async/await not supported: WASM is synchronous'),
-  'class': () => err('class not supported: use object literals'),
-  'yield': () => err('generators not supported: use loops'),
   'debugger': () => null,
   // Static-key delete (.x, ["x"], [literal]) would change the fixed schema → reject.
   // Computed-key delete (obj[expr]) — including jessie's `delete ctx[k]` — lowers
@@ -1104,12 +1364,7 @@ const handlers = {
     err('delete not supported: object shape is fixed')
   },
   'in'(key, obj) { return ['in', prep(key), prep(obj)] },
-  'instanceof': () => err('instanceof not supported: use typeof'),
-  'with': () => err('`with` not supported: deprecated'),
-  ':': () => err('labeled statements not supported'),
   'label'(name, body) { return ['label', name, prep(body)] },
-  'var': () => err('`var` not supported: use let/const'),
-  'function': () => err('`function` not supported: use arrow functions'),
 
   // Destructuring assignment: [a, ...b] = expr or {x, y} = expr
   '='(lhs, rhs) {
@@ -1147,7 +1402,7 @@ const handlers = {
         // emit a dynamic property read + indirect call instead of a direct call.
         if (ctx.func.names.has(name)) {
           ctx.func.multiProp.add(`${fnBase}.${lhs[2]}`)
-          do name = `${fnBase}$${lhs[2]}$${ctx.func.uniq++}`; while (ctx.func.names.has(name))
+          do { name = `${fnBase}$${lhs[2]}$${ctx.func.uniq++}` } while (ctx.func.names.has(name))
         }
         // Build the target `.` node directly from the resolved base — re-`prep`ing
         // the lhs would resolve a multiProp `fn.prop` to an rvalue (closure
@@ -1165,22 +1420,25 @@ const handlers = {
         recordGlobalRep(plhs, prhs)
         if (Array.isArray(prhs) && prhs[0] === '{}') {
           const props = staticObjectProps(prhs.slice(1))
-          if (props) ctx.schema.vars.set(plhs, ctx.schema.register(props.names))
-        }
-      }
+          if (props) bindAssignSchema(plhs, ctx.schema.register(props.names))
+        } else bindAssignSchema(plhs, null)
+      } else bindAssignSchema(plhs, objLiteralSid(prhs))
       // Static string/array facts hold only while every assignment is constant.
       if (!assignedStaticGlobals.has(plhs) && (staticStr != null || staticArr)) bindStaticGlobal(plhs, staticStr, staticArr)
       else deleteStaticGlobal(plhs)
       assignedStaticGlobals.add(plhs)
     }
-    // Local object-literal assignment to a not-yet-shaped variable — e.g. a `var`
-    // that jzify hoisted into `let x; x = {…}`. Recording the schema here lets the
-    // binding behave like `let x = {…}`: fixed-slot field access and for-in unroll.
-    // First assignment fixes the shape (mirrors the global rule above).
-    else if (typeof plhs === 'string' && Array.isArray(prhs) && prhs[0] === '{}'
-        && !ctx.schema.vars.has(plhs)) {
-      const props = staticObjectProps(prhs.slice(1))
-      if (props) ctx.schema.vars.set(plhs, ctx.schema.register(props.names))
+    // Object-literal assignment to a variable — e.g. a `var` that jzify hoisted
+    // into `let x; x = {…}`. Recording the schema lets the binding behave like
+    // `let x = {…}`: fixed-slot field access and for-in unroll. SOUNDNESS: the
+    // shape holds only while EVERY assignment to the name agrees — one literal
+    // shape, no other sources. Any disagreeing assignment (non-literal RHS such
+    // as a table/Map lookup, or a different-shape literal) unbinds and poisons
+    // the name; fixed-slot reads against one literal's layout would misread the
+    // other sources' objects (e.g. `.x` returning another shape's slot-0 value).
+    // Compile reads the END state, so the conflict check is order-insensitive.
+    else if (typeof plhs === 'string') {
+      bindAssignSchema(plhs, objLiteralSid(prhs))
     }
     return ['=', plhs, prhs]
   },
@@ -1191,23 +1449,21 @@ const handlers = {
     const catchClause = clauses.find(c => Array.isArray(c) && c[0] === 'catch')
     const finallyClause = clauses.find(c => Array.isArray(c) && c[0] === 'finally')
     const tryBody = prep(body)
+    // prep(handler) ONCE — it has side effects (uniq++, scope pushes, includes), so
+    // the no-finally catch branch must reuse `caught`, not re-prep (FE-3 fix).
     const caught = catchClause
-      ? (() => {
-          const [, errName, handler] = catchClause
-          return ['catch', tryBody, errName, prep(handler)]
-        })()
+      ? ['catch', tryBody, catchClause[1], prep(catchClause[2])]
       : tryBody
-    if (finallyClause) return ['finally', caught, prep(finallyClause[1])]
-    if (catchClause) {
-      const [, errName, handler] = catchClause
-      return ['catch', tryBody, errName, prep(handler)]
-    }
-    return tryBody
+    return finallyClause ? ['finally', caught, prep(finallyClause[1])] : caught
   },
   'throw'(expr) { return ['throw', prep(expr)] },
 
   // Template literal: [``, part, ...] → fused single-allocation string concat.
   '`'(...parts) {
+    // Fully-static template (`a${123}b`, `hello ${1+2} world`) folds to a single string
+    // literal — a static data segment / SSO box, no runtime concat and no heap machinery.
+    const folded = staticStringExpr(['`', ...parts])
+    if (folded != null) return staticString(folded)
     includeForStringValue()
     const nodes = parts.map(p =>
       Array.isArray(p) && p[0] == null && typeof p[1] === 'string' ? ['str', p[1]] : prep(p))
@@ -1238,6 +1494,24 @@ const handlers = {
     return handlers['from'](fromNode[1], fromNode[2])
   },
 
+  // Mixed default+named import `import d, { n } from 'm'` — jessie emits it as a
+  // statement-level comma `[',', ['import', d], ['from', spec, src]]` (the default
+  // fragment lost its source). Reunite: bind the default, then the named specifiers,
+  // both against the shared source. (prepareModule caches by specifier, so preparing
+  // the source twice is a no-op — same as two separate `import` statements.)
+  // Any other comma is a sequence expression: fall through to generic prep.
+  ','(...items) {
+    if (items.length === 2
+      && Array.isArray(items[0]) && items[0][0] === 'import' && typeof items[0][1] === 'string'
+      && Array.isArray(items[1]) && items[1][0] === 'from') {
+      const source = items[1][2]
+      handlers['from'](items[0][1], source)
+      handlers['from'](items[1][1], source)
+      return null
+    }
+    return [',', ...items.map(prep)]
+  },
+
   'from'(specifiers, source) {
     const mod = source?.[1]
     if (!mod || typeof mod !== 'string') return err('Invalid import source')
@@ -1296,8 +1570,8 @@ const handlers = {
     }
 
     // Tier 2: Source module (bundling)
-    if (ctx.module.importSources?.[mod]) {
-      const resolved = prepareModule(mod, ctx.module.importSources[mod])
+    if (isBundledModule(mod)) {
+      const resolved = prepareModule(mod, ctx.module.importSources?.[mod])
       // Default import: import name from 'mod' → bind to default export
       if (typeof specifiers === 'string') {
         const mangled = resolved.exports.get('default')
@@ -1374,19 +1648,39 @@ const handlers = {
     pushScope(); const b = prep(body); popScope()
     return ['while', c, b]
   },
+  // do { body } while (cond) → flag-guarded while: `flag=true; while (flag||cond) { flag=false; body }`.
+  // jzify lowers this in default mode (jzify/transform.js), but strict mode skips jzify — without
+  // this prepare-stage twin, strict `do-while` reaches emit as a raw 'do' and dies ("Unknown op: do"),
+  // contradicting the README's strict-subset list. Re-prep the synthetic tree so scope/normalize apply.
+  'do': (body, cond) => {
+    const flag = `${T}do${ctx.func.uniq++}`
+    return prep([';',
+      ['let', ['=', flag, [null, true]]],
+      ['while', ['||', flag, cond],
+        ['{}', [';', ['=', flag, [null, false]], body]]]])
+  },
 
   'export': decl => {
     if (Array.isArray(decl) && (decl[0] === 'let' || decl[0] === 'const'))
       for (const i of decl.slice(1))
         if (Array.isArray(i) && i[0] === '=' && typeof i[1] === 'string')
           ctx.func.exports[i[1]] = true
+    // export name → bare-identifier re-export (shorthand for `export { name }`).
+    // Register the binding and emit nothing; without this the name falls through
+    // to `prep(decl)` below and compiles as a dead `global.get; drop` statement
+    // while the export itself is silently lost.
+    if (typeof decl === 'string') {
+      const resolved = ctx.scope.chain[decl]
+      ctx.func.exports[decl] = (resolved && resolved !== decl) ? resolved : decl
+      return null
+    }
     // export { name, name as alias } from './mod' or export * from './mod'
     if (Array.isArray(decl) && decl[0] === 'from') {
       const mod = decl[2]?.[1]
       if (!mod || typeof mod !== 'string') return null
       // Source module re-export
-      if (ctx.module.importSources?.[mod]) {
-        const resolved = prepareModule(mod, ctx.module.importSources[mod])
+      if (isBundledModule(mod)) {
+        const resolved = prepareModule(mod, ctx.module.importSources?.[mod])
         if (decl[1] === '*') {
           // export * from './mod' → register all exports
           for (const [name, mangled] of resolved.exports) {
@@ -1439,7 +1733,7 @@ const handlers = {
         if (defFunc('default', prep(val))) return null
       }
       // export default expr → create global 'default'
-      ctx.scope.globals.set('default', `(global $default (mut f64) (f64.const 0))`)
+      declGlobal('default', 'f64')
       ctx.scope.userGlobals.add('default')
       return ['=', 'default', prep(val)]
     }
@@ -1456,12 +1750,18 @@ const handlers = {
     depth++
     pushScope(fnScope)
     funcLocalNames.push(new Set(collectParamNames(raw)))
+    funcValueNames.push(new Set())
 
     const nextParams = []
     const bodyPrefix = []
     for (const r of raw) {
       const c = classifyParam(r)
       if (c.kind === 'rest') {
+        // A rest param is an array: the binding holds one, and every call site
+        // builds the rest array via `['[', …]`. Pull in the array emitter even
+        // when the body never names an array literal (e.g. `(...xs) => 0`),
+        // otherwise the call-site rest construction hits "Unknown op: [".
+        includeForArrayLiteral()
         nextParams.push(r)
         if (typeof c.name === 'string') fnScope.set(c.name, c.name)
       } else if (c.kind === 'plain') {
@@ -1497,6 +1797,7 @@ const handlers = {
     const result = ['=>', Array.isArray(params) && params[0] === '()' ? ['()', inner] : inner, preparedBody]
     popScope()
     funcLocalNames.pop()
+    funcValueNames.pop()
     depth--
     return result
   },
@@ -1516,9 +1817,13 @@ const handlers = {
     })]
   },
 
-  // Optional chaining / typeof — need ptr module
-  '?.'(obj, prop) { return ['?.', prep(obj), prop] },
-  '?.[]'(obj, idx) { return ['?.[]', prep(obj), prep(idx)] },
+  // Optional chaining / typeof — need ptr module. Optional member access pulls
+  // the same modules as plain `.`/`[]` (a method like `includes` needs string +
+  // array for emit's runtime dispatch); the only difference is the nullish guard,
+  // which is emit's concern. Without this, `obj?.m(…)` reaches emit missing the
+  // `.m` emitter and falls to the dynamic path that needs an unincluded module.
+  '?.'(obj, prop) { includeForProperty(prop); return ['?.', prep(obj), prop] },
+  '?.[]'(obj, idx) { includeForArrayAccess(); return ['?.[]', prep(obj), prep(idx)] },
   '?.()'(callee, callArgs) {
     // Parser wraps multi-args in a comma list, like '()'. Unwrap so emit gets flat positional args.
     const items = callArgs == null ? []
@@ -1557,7 +1862,16 @@ const handlers = {
     return ['+', pa, pb]
   },
   '-'(a, b) {
-    if (b === undefined) { const na = prep(a); return isLit(na) && typeof na[1] === 'number' ? [, -na[1]] : ['u-', na] }
+    // Fold `-<numeric literal>` to a literal, but NOT a bigint: jz's own `typeof` reports
+    // a bigint value as 'number' too (its carrier is an f64), so under self-host this test
+    // alone wrongly folds `-5n`, and negating the bigint here yields garbage (-2^63+5).
+    // `typeof !== 'bigint'` excludes it in both engines (real JS: 'bigint'; jz: matches
+    // 'bigint'). Bigint negation then flows to emit's i64.sub(0,·) path correctly.
+    // `-0` is NOT folded: the self-host kernel evaluates the constant `-na[1]` with
+    // i32 negation (i32 has no signed zero), collapsing -0→+0 — observable via sort's
+    // -0<+0 tiebreak, Object.is, and 1/x. Leaving it as a runtime `u-` emits f64.neg,
+    // which preserves the sign in both engines; V8 re-folds it, so no native cost.
+    if (b === undefined) { const na = prep(a); return isLit(na) && typeof na[1] === 'number' && typeof na[1] !== 'bigint' && na[1] !== 0 ? [, -na[1]] : ['u-', na] }
     return ['-', prep(a), prep(b)]
   },
 
@@ -1565,17 +1879,19 @@ const handlers = {
   '?'(cond, then, els) { return ['?:', prep(stripBoolNot(cond)), prep(then), prep(els)] },
 
   // ++/-- prefix vs postfix: parser sends trailing null for postfix
-  // Postfix i++ = (++i) - 1: increment happens, arithmetic recovers old value
-  // Property increment: obj.prop++ → obj.prop = obj.prop + 1
+  // Postfix i++ = (++i) - 1: increment happens, arithmetic recovers old value.
+  // Property obj.prop++ has no dedicated ++ node (the ++ emitter is name-based),
+  // so it lowers to `obj.prop = obj.prop + 1` (returns the NEW value) — and the
+  // same -1/+1 recovery wraps it for postfix to yield the OLD value.
   '++'(a, _post) {
     const n = prep(a)
-    if (Array.isArray(n) && (n[0] === '.' || n[0] === '[]')) return ['=', n, ['+', n, [, 1]]]
-    return _post !== undefined ? ['-', ['++', n], [, 1]] : ['++', n]
+    const inc = Array.isArray(n) && (n[0] === '.' || n[0] === '[]') ? ['=', n, ['+', n, [, 1]]] : ['++', n]
+    return _post !== undefined ? ['-', inc, [, 1]] : inc
   },
   '--'(a, _post) {
     const n = prep(a)
-    if (Array.isArray(n) && (n[0] === '.' || n[0] === '[]')) return ['=', n, ['-', n, [, 1]]]
-    return _post !== undefined ? ['+', ['--', n], [, 1]] : ['--', n]
+    const dec = Array.isArray(n) && (n[0] === '.' || n[0] === '[]') ? ['=', n, ['-', n, [, 1]]] : ['--', n]
+    return _post !== undefined ? ['+', dec, [, 1]] : dec
   },
 
   // Regex literal: ['//','pattern','flags?'] → include regex module, pass through
@@ -1583,13 +1899,22 @@ const handlers = {
     return ['//', pattern, flags]
   },
 
-  '**'(a, b) { return ['**', prep(a), prep(b)] },
+  '**'(a, b) {
+    // ES2016 §13.6: an unparenthesized unary expression cannot be the base of `**`
+    // — `-x**2`, `~x**2`, `!x**2`, `+x**2`, `typeof x**2`, `void x**2`, `delete o[k]**2`
+    // are all SyntaxErrors (the precedence is ambiguous). The parser leaves a grouping
+    // as `['()', …]`, so a parenthesized base `(-x)**2` (and `-(x**2)`, where the unary
+    // sits outside the `**`) arrives with a non-unary root op and is allowed.
+    if (Array.isArray(a) && a.length === 2 && (a[0] === '-' || a[0] === '+' || a[0] === '!' || a[0] === '~' || a[0] === 'typeof' || a[0] === 'void' || a[0] === 'delete'))
+      err(`Unary '${a[0]}' before '**' is a SyntaxError (ES2016 §13.6) — parenthesize: (${a[0]} x) ** 2 or ${a[0]} (x ** 2)`)
+    return ['**', prep(a), prep(b)]
+  },
 
   // Function call or grouping parens
 '()'(callee, ...args) {
     // Grouping: (expr) → ['()', expr] with no args. Call: f() → ['()', 'f', null] with null arg.
     if (args.length === 0) return prep(callee)
-    if (typeof callee === 'string' && PROHIBITED[callee]) err(PROHIBITED[callee])
+    if (typeof callee === 'string' && REJECT_IDENTS[callee]) err(REJECT_IDENTS[callee])
 
     // Compile-time folds: the callee names something resolvable now. Each fold
     // is gated by callee shape, so at most one of the three fires.
@@ -1607,7 +1932,14 @@ const handlers = {
         includeForCallableValue(); break
       }
     }
-    const result = ['()', callee, ...preppedArgs]
+    // A zero-arg call keeps its explicit `null` args slot: `['()', callee, null]`,
+    // not the slot-less `['()', callee]`. The latter is indistinguishable from a
+    // grouping `(expr)`, so a second `prep` pass (the destructuring-assignment
+    // lowering re-`prep`s its result) would re-read `x.pop()` as the grouping
+    // `(x.pop)` and drop the call. Keeping the slot makes `prep` idempotent for
+    // calls and matches `setCallArgs`'s canonical shape; `commaList(node[2])`
+    // reads it back as zero args everywhere downstream.
+    const result = preppedArgs.length ? ['()', callee, ...preppedArgs] : ['()', callee, null]
 
     if (callee === 'Object.assign' && ctx.schema.register) inferAssignSchema(result)
 
@@ -1649,9 +1981,11 @@ const handlers = {
   },
 
   // Object literal - flatten comma, expand shorthand
-  '{}'(inner) {
-    // Detect block body vs object literal
-    if (Array.isArray(inner) && STMT_OPS.has(inner[0])) {
+  '{}'(...args) {
+    const inner = args[0]
+    // Block body: a single statement-op child (object props always start with
+    // ':' or '...', never a statement op, so this never misfires on a literal).
+    if (args.length === 1 && Array.isArray(inner) && STMT_OPS.has(inner[0])) {
       // Block body: push block scope for let/const shadowing
       pushScope()
       const result = ['{}', prep(inner)]
@@ -1660,10 +1994,16 @@ const handlers = {
     }
 
     includeForObjectLiteral()
-    if (inner == null) return ['{}']
-    const items = Array.isArray(inner) && inner[0] === ','
-      ? inner.slice(1)
-      : [inner]
+    if (args.length === 0 || inner == null) return ['{}']
+    // The parser emits one comma-grouped child `['{}', [',', p1, p2]]`, but prep's
+    // own output is spread `['{}', p1, p2]` (see `result` below). Accept both so
+    // prep stays idempotent: the destructuring-assignment lowering ('=' handler)
+    // re-preps a wrapper that already holds a normalized literal, and reading only
+    // the first child here would drop every property but the first — mis-sizing the
+    // schema to cap-1 and losing the rest.
+    const items = args.length === 1
+      ? (Array.isArray(inner) && inner[0] === ',' ? inner.slice(1) : [inner])
+      : args
 
     // Computed keys: `{[k]: v}` where `k` isn't compile-time foldable. jz's
     // object layout is slot-based (fixed schema at the literal site), so a
@@ -1699,6 +2039,12 @@ const handlers = {
         if (key == null) err('computed property name not supported for fixed-shape object: use a compile-time string/number key')
         return [':', key, prep(p[2])]
       }
+      // Accessors (`{ get x() {…} }` / `{ set x(v) {…} }`) parse to ['get'|'set', …].
+      // jz objects are fixed-shape slot records with no accessor protocol, so they'd
+      // otherwise fall through and compile to dead code (0 schema slots → `o.x` reads
+      // undefined). Reject loudly — silent miscompile breaks "valid jz = valid JS".
+      if (Array.isArray(p) && (p[0] === 'get' || p[0] === 'set'))
+        err('object getter/setter not supported — jz objects have no accessors; use a method or a plain property + function')
       return prep(p)
     }
     let prepped = items.map(prop)
@@ -1725,27 +2071,56 @@ const handlers = {
   // For loop
   'for'(head, body) {
     pushScope()
+    // A comma/sequence Expression in a for-IN head RHS — `for (x in a, b)` — is valid (the RHS is
+    // an Expression): evaluate left-to-right for side effects, value as the last element. (for-OF's
+    // RHS is an AssignmentExpression — no comma — so it is left alone.) jzify lands it as a bare `,`
+    // node in the source slot. Don't wrap it in `()`: Object.keys((a, obj)) hides `obj` behind the
+    // sequence and loses its static schema (a non-escaping literal scalarizes → 0 keys). Instead take
+    // the LAST element as the (direct) iteration source and run the earlier elements once first.
+    let forInSeqPre = null
+    if (Array.isArray(head) && head[0] === 'in' && Array.isArray(head[2]) && head[2][0] === ',') {
+      const parts = head[2].slice(1)
+      head = [head[0], head[1], parts[parts.length - 1]]
+      if (parts.length > 2) forInSeqPre = [',', ...parts.slice(0, -1)]
+      else if (parts.length === 2) forInSeqPre = parts[0]
+    }
     let r
     if (Array.isArray(head) && head[0] === ';') {
       let [, init, cond, step] = head
       cond = stripBoolNot(cond)
-      // Hoist .length / .size / .byteLength from for-condition:
-      //   `i < arr.length` → `let __len = arr.length | 0; ... i < __len`
-      // The `| 0` forces i32 even for unknown-typed receivers (where __length
-      // returns f64). NaN→0 via i32.trunc_sat matches JS semantics: a NaN bound
-      // makes `i < NaN` false on both representations, so the loop is skipped
-      // either way. Keeping the hoisted bound i32 lets the counter `i` stay i32
-      // through the comparison and `i++`, eliminating the per-iteration
-      // f64.convert_i32_s + f64.lt + f64.add + i32.trunc_sat_f64_s sequence.
+      // Keep a `.length` / `.size` / `.byteLength` for-bound i32 without snapshotting it:
+      //   `i < arr.length` → `i < (arr.length | 0)`   (re-read every iteration)
+      // The `| 0` forces i32 even for unknown-typed receivers (where __length returns
+      // f64), so the counter `i` stays i32 through the comparison and `i++` — no
+      // per-iteration f64.convert_i32_s + f64.lt + f64.add + i32.trunc_sat round-trip.
+      // It must stay INLINE, not hoisted into a pre-loop local: JS re-reads the bound
+      // each step, and a loop body can grow/shrink the array mid-iteration — including
+      // through an alias the compiler can't see locally (e.g. `arr` shares identity with
+      // a field a called helper pushes to, as compilePendingClosures does over
+      // ctx.closure.bodies). A snapshot diverges from JS and silently truncates such loops.
       if (cond && Array.isArray(cond) && (cond[0] === '<' || cond[0] === '<=' || cond[0] === '>' || cond[0] === '>=')) {
         const lenExpr = cond[0] === '<' || cond[0] === '<=' ? cond[2] : cond[1]
         if (Array.isArray(lenExpr) && lenExpr[0] === '.' &&
             (lenExpr[2] === 'length' || lenExpr[2] === 'size' || lenExpr[2] === 'byteLength')) {
-          const lenVar = `${T}len${ctx.func.uniq++}`
-          const lenDecl = ['let', ['=', lenVar, ['|', lenExpr, [, 0]]]]
-          init = init ? [';', init, lenDecl] : lenDecl
-          if (cond[0] === '<' || cond[0] === '<=') cond = [cond[0], cond[1], lenVar]
-          else cond = [cond[0], lenVar, cond[2]]
+          const recv = lenExpr[1]
+          const bound = ['|', lenExpr, [, 0]]
+          const lengthStable = typeof recv === 'string' &&
+            boundSafeCalls(body) && boundSafeCalls(step) && !writesReceiver(body, recv) && !writesReceiver(step, recv)
+          if (lengthStable) {
+            // Body can't change the bound → snapshot it once into an i32 local. Keeps
+            // the counter `i` i32 through compare + `i++` (no per-iteration f64 round
+            // trip) and gives the vectorizer the hoisted trip count it matches on.
+            const lenVar = `${T}len${ctx.func.uniq++}`
+            const lenDecl = ['let', ['=', lenVar, bound]]
+            init = init ? [';', init, lenDecl] : lenDecl
+            if (cond[0] === '<' || cond[0] === '<=') cond = [cond[0], cond[1], lenVar]
+            else cond = [cond[0], lenVar, cond[2]]
+          } else {
+            // Body may grow/shrink the array (push/pop, or alias mutation through a
+            // call) → re-read every iteration, as JS does. Still `| 0` for an i32 bound.
+            if (cond[0] === '<' || cond[0] === '<=') cond = [cond[0], cond[1], bound]
+            else cond = [cond[0], bound, cond[2]]
+          }
         }
       }
       r = ['for', init ? prep(init) : null, cond ? prep(cond) : null, step ? prep(step) : null, prep(body)]
@@ -1757,61 +2132,71 @@ const handlers = {
       const varName = Array.isArray(decl) && (decl[0] === 'let' || decl[0] === 'const') ? decl[1] : decl
       const idx = `${T}i${ctx.func.uniq++}`
       const lenVar = `${T}len${ctx.func.uniq++}`
-      const trivial = typeof src === 'string'
-      const arrVar = trivial ? src : `${T}arr${ctx.func.uniq++}`
+      const arrVar = `${T}arr${ctx.func.uniq++}`
+      // Normalize the source to an index-iterable once: a Set→keys / Map→[k,v]
+      // array, while an Array/String/TypedArray passes through untouched (no
+      // copy). Without this, `coll[i]` on a Set/Map reads raw open-addressing
+      // slot words instead of live entries.
       // Wrap .length in `| 0` so the hoisted bound is i32 even for unknown
       // receivers (same rationale as the for-cond hoist above).
       const lenE = ['|', ['.', arrVar, 'length'], [, 0]]
-      const decls = trivial
-        ? ['let', ['=', idx, [, 0]], ['=', lenVar, lenE]]
-        : ['let', ['=', arrVar, src], ['=', idx, [, 0]], ['=', lenVar, lenE]]
+      const decls = ['let', ['=', arrVar, ['()', '__iter_arr', src]], ['=', idx, [, 0]], ['=', lenVar, lenE]]
       const cond = ['<', idx, lenVar]
       const step = ['++', idx]
       const inner = [';', ['let', ['=', varName, ['[]', arrVar, idx]]], body]
       r = prep(['for', [';', decls, cond, step], inner])
     } else if (Array.isArray(head) && head[0] === 'in') {
-      // for (let k in obj) → unroll at compile time when schema known, else HASH runtime iteration
+      // `for…in` relies on runtime key enumeration — outside the pure canonical subset. strict
+      // rejects it (consistent with `obj[k]` / unknown-receiver methods); use `Object.keys(obj)`.
+      if (ctx.transform.strict) err('strict mode: `for…in` is not in the canonical subset — it relies on runtime key enumeration. Iterate `Object.keys(obj)` explicitly instead.')
+      // for (let k in src) → enumerate src's own keys via Object.keys (schema ∪ any keys added
+      // later for objects; "0".."n-1" for arrays/strings; [] for Set/Map) and iterate the resulting
+      // array by index. One uniform path keeps for-in consistent with Object.keys (so dynamically
+      // added keys appear in both), and break/continue work as in any for-loop. Object.keys'
+      // enumeration stdlib is pulled only when for-in is actually used.
       const [, decl, src] = head
-      const varName = Array.isArray(decl) && (decl[0] === 'let' || decl[0] === 'const') ? decl[1] : decl
-      const srcName = typeof src === 'string' ? (ctx.scope.chain[src] || src) : null
-      const sid = typeof srcName === 'string' ? ctx.schema.vars.get(srcName) : null
-      if (sid != null) {
-        // Known schema → compile-time unrolling with string keys
-        const keys = ctx.schema.list[sid]
-        if (!keys || !keys.length) { popScope(); return null }
-        includeForKnownKeyIteration()
-        if (!hasLoopJump(body)) {
-          // No break/continue → flat unroll, no loop frame needed.
-          const stmts = []
-          for (let i = 0; i < keys.length; i++) {
-            stmts.push(i === 0
-              ? ['let', ['=', varName, [, keys[i]]]]
-              : ['=', varName, [, keys[i]]])
-            stmts.push(cloneNode(body))
-          }
-          r = prep([';', ...stmts])
-        } else {
-          // break/continue present → an unrolled loop still needs its frames.
-          // Wrap each iteration in a labeled block (continue target) and the
-          // whole run in an outer labeled block (break target): `break` exits
-          // the construct, `continue` falls through to the next iteration.
-          const brkL = `${T}fibrk${ctx.func.uniq++}`
-          const decl = prep(['let', ['=', varName, [, keys[0]]]])
-          const parts = [decl]
-          for (let i = 0; i < keys.length; i++) {
-            const contL = `${T}ficont${ctx.func.uniq++}`
-            const iter = prep(i === 0
-              ? cloneNode(body)
-              : [';', ['=', varName, [, keys[i]]], cloneNode(body)])
-            parts.push(['label', contL, retargetLoopJumps(iter, brkL, contL)])
-          }
-          r = ['label', brkL, [';', ...parts]]
-        }
-      } else {
-        // Dynamic object → HASH runtime iteration
-        includeForRuntimeKeyIteration()
-        r = ['for-in', varName, prep(src), prep(body)]
-      }
+      const isDecl = Array.isArray(decl) && (decl[0] === 'let' || decl[0] === 'const')
+      // `for ((x) in …)` — the LHS may be a cover-parenthesized identifier; unwrap to the target.
+      let lhs = decl; while (Array.isArray(lhs) && lhs[0] === '()') lhs = lhs[1]
+      const target = isDecl ? decl[1] : lhs
+      // A member/computed LHS (`for (x.y in …)`, `for (obj[k] in …)`) assigns each key into the
+      // existing place; let/const and a bare name take a fresh per-iteration `let` binding.
+      const isMemberTarget = Array.isArray(target) && (target[0] === '.' || target[0] === '[]')
+      // for-in over null/undefined is a no-op — ES ForIn/OfHeadEvaluation returns a break
+      // completion before enumerating — but Object.keys(null|undefined) throws. So a nullish
+      // source must enumerate the empty set. A static null (`[null,null]`) / undefined (`[]`)
+      // skips Object.keys entirely; a bare identifier is guarded by a runtime `== null` test
+      // (evaluated twice — side-effect-free — keeping Object.keys' *direct* receiver so its
+      // static key schema still resolves); object/array literals and other expressions, which
+      // are never nullish or carry no static schema to lose, stay direct.
+      // A nullish literal node is `[<nullish-op>, value]` with both slots nullish: `null` is
+      // `[null, null]`, `undefined` is `[null]` (empty value slot). A numeric/string literal
+      // `[null, v]` has a non-nullish value slot, so `src[1] == null` discriminates them.
+      const nullish = Array.isArray(src) && src[0] == null && src[1] == null
+      // `__keys_ro` is for-in's read-only key list: identical to Object.keys, but
+      // when the receiver has a complete static schema the keys are a compile-time
+      // constant, so it pools ONE static-data array instead of allocating a fresh
+      // one each evaluation — the per-iteration heap-growth cliff (jz#deopt-forin).
+      // Sound only because for-in reads ks[i]/ks.length and never mutates (unlike
+      // user Object.keys, which permits in-place `.sort()`/`.reverse()`).
+      includeMods('core', 'object', 'string')
+      const keysExpr = nullish ? ['[]', null]
+        : typeof src === 'string'
+          ? ['?', ['==', src, [null, null]], ['[]', null], ['()', '__keys_ro', src]]
+          : ['()', '__keys_ro', src]
+      const ks = `${T}fik${ctx.func.uniq++}`, ix = `${T}fii${ctx.func.uniq++}`, lenV = `${T}fil${ctx.func.uniq++}`
+      const decls = ['let',
+        ['=', ks, keysExpr],
+        ['=', ix, [, 0]],
+        ['=', lenV, ['|', ['.', ks, 'length'], [, 0]]]]
+      const bindEach = isMemberTarget
+        ? ['=', target, ['[]', ks, ix]]              // x.y = key / obj[k] = key
+        : ['let', ['=', target, ['[]', ks, ix]]]     // let k = key  (fresh per-iteration binding)
+      const forNode = ['for', [';', decls, ['<', ix, lenV], ['++', ix]],
+        [';', bindEach, body]]
+      // Run the dropped sequence prefix (earlier comma elements) once for side effects, before
+      // the loop. Built raw and prepped as a unit so prep inserts the value-drop on the prefix.
+      r = prep(forInSeqPre ? [';', forInSeqPre, forNode] : forNode)
     } else {
       // Some parser/jzify shapes for `for (;;)` and `for (; cond; )` arrive
       // as a null or bare-condition head instead of the canonical
@@ -1826,14 +2211,22 @@ const handlers = {
   // Property access - resolve namespaces or object/array properties
   '.'(obj, prop) {
     prop = typeof prop === 'string' ? prop : staticPropertyKey(prop)
-    if (prop === 'caller' || prop === 'callee') err('`.caller` and `.callee` are prohibited: deprecated stack introspection')
+    // `.caller`/`.callee` on a function value (or `arguments`) are deprecated
+    // stack introspection — prohibited as bad practice. On a plain data object
+    // they are ordinary field names (e.g. an ESTree call node's `.callee`), so
+    // the ban keys off a known-function receiver, not the bare property name.
+    if ((obj === 'arguments' || hasFunc(obj) || isFuncValueLocal(obj)) && (prop === 'caller' || prop === 'callee'))
+      err('`.caller`/`.callee` are prohibited: deprecated function stack introspection')
     if (prop === 'url' && isImportMeta(obj)) return staticString(importMetaUrl())
+    // A user binding named like a builtin namespace (`let Math = {…}`) shadows it
+    // — read the property off the local value, not the builtin namespace table.
+    if (shadowsBuiltin(obj)) { includeForProperty(prop); return ['.', prep(obj), prop] }
     const mod = ctx.scope.chain[obj]
     // Only treat as module namespace if it's a known built-in module (not a mangled import name)
     if (typeof obj === 'string' && mod && !mod.includes('.') && hasModule(mod)) {
       includeModule(mod)
       const key = mod + '.' + prop
-      if (ctx.core.emit[key]?.length > 0) includeForCallableValue()
+      if (emitArity(ctx.core.emit[key]) > 0) includeForCallableValue()
       return key
     }
     // Source module namespace: import * as X → X.prop resolved to mangled name
@@ -1849,7 +2242,22 @@ const handlers = {
   'new'(ctor, ...args) {
     let name = ctor, ctorArgs = args
     if (Array.isArray(ctor) && ctor[0] === '()') { name = ctor[1]; ctorArgs = ctor.slice(2) }
-    if (name === 'Date' && ctorArgs.length === 1 && ctorArgs[0] == null) ctorArgs = []
+    // No GC → weakness is unobservable, so we fold WeakSet/WeakMap to Set/Map right here:
+    // construction and every .add/.has/.get/.set/.delete reuse the concrete emit path.
+    // The fold lives in prepare, not jzify — so `strict` (which only skips jzify) wouldn't
+    // drop it on its own; we reject explicitly. It's a deviation anyway (accepts primitive
+    // keys, exposes .size/iteration), not a true subset member — there, use Set/Map directly.
+    if (name === 'WeakSet' || name === 'WeakMap') {
+      const concrete = name === 'WeakSet' ? 'Set' : 'Map'
+      if (ctx.transform.strict) err(`strict mode: ${name} is not in the canonical subset — use ${concrete} (jz has no GC, so weak references are unobservable).`)
+      name = concrete
+    }
+    // A lone `null` ctorArg is the parser's no-args sentinel (`new Map()`), and
+    // `new Map(null)`/`new Map(undefined)` are spec-equivalent to it (null/undefined
+    // → empty collection). Drop it so the emit hits the empty-collection fast path
+    // rather than lowering `prep(null)` → `[, 0]` and routing through `__map_from`.
+    // Typed arrays keep the sentinel: there `[, 0]` is a legitimate zero length.
+    if (ctorArgs.length === 1 && ctorArgs[0] == null && (name === 'Date' || COLLECTION_CTORS.includes(name))) ctorArgs = []
     // Flatten comma-grouped args: [',', a, b, c] → [a, b, c]
     if (ctorArgs.length === 1 && Array.isArray(ctorArgs[0]) && ctorArgs[0][0] === ',')
       ctorArgs = ctorArgs[0].slice(1)
@@ -2009,6 +2417,20 @@ function collectReturns(node, out) {
 
 const isLit = n => Array.isArray(n) && n[0] == null
 
+/** Self-host: pre-parsed module AST for a specifier, or undefined. Linear scan over
+ *  [specifier, ast] pairs — array indexing + string `===` are the ABI-safe primitives
+ *  the kernel can read off a host-marshalled argument (dynamic-key object reads aren't). */
+function moduleAstFor(specifier) {
+  const asts = ctx.module.importAsts
+  if (!asts) return undefined
+  for (let i = 0; i < asts.length; i++) if (asts[i][0] === specifier) return asts[i][1]
+  return undefined
+}
+
+/** True when `mod` is bundled in-process — as source (host parses it) or as a
+ *  pre-parsed AST (self-host kernel). Either path routes through prepareModule. */
+const isBundledModule = mod => !!ctx.module.importSources?.[mod] || moduleAstFor(mod) !== undefined
+
 /** Compile-time bundling: parse + prepare an imported module, collect exports. */
 function prepareModule(specifier, source) {
   includeModule('core')
@@ -2020,8 +2442,24 @@ function prepareModule(specifier, source) {
 
   ctx.module.moduleStack.push(specifier)
 
-  // Name mangling prefix: ./math.jz → _math_jz
-  const prefix = specifier.replace(/[^a-zA-Z0-9]/g, '_')
+  // Name mangling prefix. Long specifiers (the bundler keys modules by
+  // ABSOLUTE path — 40-60 byte '_Users_…' / '_home_runner_…' prefixes on every
+  // symbol) compact to 'm<N>_<basename>': symbol strings shrink ~4×, which is
+  // a direct hot-path win in the SELF-HOST — watr resolves every `call $name`
+  // and `local.get $name` through name-keyed maps, paying hash+compare per
+  // byte, and shared 35-byte path prefixes defeated the hash-probe early-outs.
+  // Deterministic per compile (registration order); short relative specifiers
+  // keep the readable form.
+  const sanitized = specifier.replace(/[^a-zA-Z0-9]/g, '_')
+  let prefix
+  if (sanitized.length <= 24) prefix = sanitized
+  else {
+    if (!ctx.module.prefixIds) ctx.module.prefixIds = new Map()
+    let id = ctx.module.prefixIds.get(specifier)
+    if (id == null) { id = ctx.module.prefixIds.size; ctx.module.prefixIds.set(specifier, id) }
+    const base = sanitized.replace(/_(js|mjs|jz)$/, '').match(/[a-zA-Z0-9]+$/)?.[0] ?? ''
+    prefix = `m${id}_${base.slice(-16)}`
+  }
 
   // Save caller state
   const savedScope = ctx.scope.chain, savedExports = ctx.func.exports
@@ -2031,8 +2469,18 @@ function prepareModule(specifier, source) {
   ctx.func.exports = {}
   ctx.module.currentPrefix = prefix
 
-  // Parse + prepare imported source (may trigger recursive imports)
-  let ast = parse(source)
+  try {
+  // Parse + prepare imported source (may trigger recursive imports). The parser
+  // is injected via ctx.transform.parse (the host pipeline sets it) rather than
+  // imported, so prepare carries no hard dependency on a concrete parser — the
+  // same inversion as ctx.transform.jzify. The self-host kernel can't parse, so it
+  // pre-parses the whole graph on the host and passes the ASTs via importAsts;
+  // we consult those first and only parse `source` when no AST was supplied.
+  let ast = moduleAstFor(specifier)
+  if (ast === undefined) {
+    if (!ctx.transform.parse) err('compile-time module bundling requires ctx.transform.parse (injected by the jz pipeline)')
+    ast = ctx.transform.parse(source)
+  }
   if (ctx.transform.jzify) ast = ctx.transform.jzify(ast)
   const savedDepth = depth; depth = 0
   const moduleInit = prep(ast)
@@ -2046,9 +2494,9 @@ function prepareModule(specifier, source) {
     const func = ctx.func.list.find(f => f.name === localName)
     if (func) { renameFunc(func, mangled); func._modulePrefix = prefix }
     if (ctx.scope.globals.has(localName)) {
-      const wat = ctx.scope.globals.get(localName).replace(`$${localName}`, `$${mangled}`)
+      // Records carry no name — a rename is a pure Map re-key.
+      ctx.scope.globals.set(mangled, ctx.scope.globals.get(localName))
       ctx.scope.globals.delete(localName)
-      ctx.scope.globals.set(mangled, wat)
       if (ctx.scope.userGlobals.has(localName)) { ctx.scope.userGlobals.delete(localName); ctx.scope.userGlobals.add(mangled) }
       if (ctx.scope.globalTypes.has(localName)) { ctx.scope.globalTypes.set(mangled, ctx.scope.globalTypes.get(localName)); ctx.scope.globalTypes.delete(localName) }
     }
@@ -2097,9 +2545,8 @@ function prepareModule(specifier, source) {
       const func = ctx.func.list.find(f => f.name === alias)
       if (func) renameFunc(func, mangled)
       if (ctx.scope.globals.has(alias)) {
-        const wat = ctx.scope.globals.get(alias).replace(`$${alias}`, `$${mangled}`)
+        ctx.scope.globals.set(mangled, ctx.scope.globals.get(alias))
         ctx.scope.globals.delete(alias)
-        ctx.scope.globals.set(mangled, wat)
         if (ctx.scope.userGlobals.has(alias)) { ctx.scope.userGlobals.delete(alias); ctx.scope.userGlobals.add(mangled) }
       }
     }
@@ -2165,15 +2612,18 @@ function prepareModule(specifier, source) {
     recordModuleInitFacts(moduleInit)
   }
 
-  // Restore caller state
-  ctx.scope.chain = savedScope
-  ctx.func.exports = savedExports
-  ctx.module.currentPrefix = savedModulePrefix
-  ctx.module.moduleStack.pop()
-
   const result = { exports: moduleExports }
   ctx.module.resolvedModules.set(specifier, result)
   return result
+  } finally {
+    // ALWAYS restore caller state (FE-6): if `prep(ast)` or a recursive import threw
+    // mid-prep, skipping this would leave ctx.scope/exports/prefix/moduleStack
+    // corrupted for the rest of the pipeline.
+    ctx.scope.chain = savedScope
+    ctx.func.exports = savedExports
+    ctx.module.currentPrefix = savedModulePrefix
+    ctx.module.moduleStack.pop()
+  }
 }
 
 // =============================================================================
@@ -2241,7 +2691,7 @@ function tryFusePair(decl, forNode, seq, declIdx) {
   if (!hasAnyIndexedRead(forBody, NAME) && !hasAnyIndexedRead(cond, NAME)) return null
   // `NAME` must not be read after the for-loop in the same block.
   for (let k = declIdx + 2; k < seq.length; k++) {
-    if (refsName(seq[k], NAME)) return null
+    if (refsName(seq[k], NAME, { skipArrow: false })) return null
   }
   // RECV must not be reassigned inside the for-loop (would invalidate substitution).
   if (assignsName(forNode, RECV) || assignsName(forNode, NAME)) return null
@@ -2283,12 +2733,6 @@ function hasAnyIndexedRead(n, NAME) {
   for (let i = 1; i < n.length; i++) if (hasAnyIndexedRead(n[i], NAME)) return true
   return false
 }
-function refsName(n, NAME) {
-  if (typeof n === 'string') return n === NAME
-  if (!Array.isArray(n)) return false
-  for (let i = 1; i < n.length; i++) if (refsName(n[i], NAME)) return true
-  return false
-}
 function assignsName(n, NAME) {
   if (!Array.isArray(n)) return false
   const op = n[0]