jz 0.5.1 → 0.7.0

package/src/prepare/lift-iife.js

@@ -0,0 +1,149 @@
+/**
+ * Lambda-lift immediately-invoked arrow literals (IIFEs).
+ *
+ * `(params => body)(args)` is lowered by jz's default path as a CLOSURE value invoked
+ * via `call_indirect` through the uniform-f64 closure ABI. That ABI can't carry a
+ * `v128`, so a SIMD IIFE — `(() => f32x4.…)()` — emits invalid wasm; it also pays a
+ * closure alloc + indirect call for what is really a direct, single call.
+ *
+ * This pass rewrites each such IIFE into a TOP-LEVEL function whose free variables are
+ * appended as parameters, and replaces the call with a direct call passing those vars:
+ *
+ *   let r = (() => { let t = f32x4.mul(a, a); return f32x4.add(t, …) })()   // captures a
+ *     ⇓
+ *   let ⟨lift⟩ = (a) => { let t = f32x4.mul(a, a); return f32x4.add(t, …) }  // hoisted to top
+ *   let r = ⟨lift⟩(a)                                                        // direct call
+ *
+ * The lifted function flows through jz's monomorphic typed-function path (like any
+ * `let f = (x) => …; f(v)`), so a captured/returned `v128` is typed `v128` from the
+ * single call site — and `inlineOnce` then folds the single-caller body back in, so
+ * there's no residual call. Capture is BY VALUE, which is exact for a synchronous
+ * immediate invocation (the value at the call instant == what the closure would read);
+ * the one divergence — a capture MUTATED inside the body, which a closure writes back
+ * through its cell — is the bail below.
+ *
+ * Bails (leaving the closure path untouched) on: non-plain params (rest / default /
+ * destructured), or a body that assigns any captured variable. Everything else folds.
+ *
+ * @module prepare/lift-iife
+ */
+import { T, extractParams, classifyParam } from '../ast.js'
+import { findFreeVars, findMutations } from '../compile/analyze-scans.js'
+
+// Build a comma-list operand node (the parser's shape) from an array of nodes.
+const commaList = (items) =>
+  items.length === 0 ? null : items.length === 1 ? items[0] : [',', ...items]
+
+// Unwrap parenthesis nodes (`['()', x]`, length 2) to reach the inner expression.
+const unwrapParens = (n) => {
+  while (Array.isArray(n) && n[0] === '()' && n.length === 2) n = n[1]
+  return n
+}
+
+// `['()', callee, args]` (length 3) whose callee unwraps to an arrow literal → that arrow.
+const iifeArrow = (n) => {
+  if (!Array.isArray(n) || n[0] !== '()' || n.length !== 3) return null
+  const callee = unwrapParens(n[1])
+  return Array.isArray(callee) && callee[0] === '=>' ? callee : null
+}
+
+// Plain-name params only; anything else (rest/default/destructure) → null (bail).
+const plainParamNames = (arrow) => {
+  const out = []
+  for (const p of extractParams(arrow[1])) {
+    const c = classifyParam(p)
+    if (c.kind !== 'plain' || typeof c.name !== 'string') return null
+    out.push(c.name)
+  }
+  return out
+}
+
+// Names a function binds: its plain params + every let/const name in its body, NOT
+// descending into nested arrows (their locals are their own). Over-approximating
+// within a frame is safe — a free ident only resolves to one of these if it's
+// actually in scope at the reference. Used to scope captures to enclosing LOCALS
+// (module-level names stay global refs in the lifted body, never captured).
+const collectDeclNames = (decl, out) => {
+  if (!Array.isArray(decl)) return
+  if (decl[0] === '=' && typeof decl[1] === 'string') out.add(decl[1])
+  else if (decl[0] === '=' && Array.isArray(decl[1])) collectPatternNames(decl[1], out)
+  else if (typeof decl[1] === 'string') out.add(decl[1])
+}
+const collectPatternNames = (pat, out) => {
+  if (typeof pat === 'string') { out.add(pat); return }
+  if (!Array.isArray(pat)) return
+  for (let i = 1; i < pat.length; i++) collectPatternNames(pat[i], out)
+}
+function functionLocals(paramNodes, body) {
+  const names = new Set()
+  for (const p of paramNodes) { const c = classifyParam(p); if (typeof c.name === 'string') names.add(c.name); else if (c.pattern) collectPatternNames(c.pattern, names) }
+  const scan = (n) => {
+    if (!Array.isArray(n)) return
+    if (n[0] === '=>') return
+    if (n[0] === 'let' || n[0] === 'const') for (const d of n.slice(1)) collectDeclNames(d, names)
+    for (let i = 1; i < n.length; i++) scan(n[i])
+  }
+  scan(body)
+  return names
+}
+
+export function liftIIFEs(ast) {
+  if (!Array.isArray(ast)) return ast
+  const lifted = []        // hoisted `['let', ['=', name, arrow]]` decls
+  let uid = 0
+
+  // Copy non-index node metadata (parser `.loc`, etc.) onto a rebuilt node so error
+  // source-locations survive the transform.
+  const copyMeta = (to, from) => { for (const k of Object.keys(from)) if (isNaN(+k)) to[k] = from[k]; return to }
+
+  // `locals` = union of every enclosing FUNCTION frame's bound names. The transform
+  // is post-order (inner IIFEs fold first) so an outer lift sees already-direct inner
+  // calls; scope tracking is top-down so each IIFE sees the right enclosing locals.
+  // Identity-preserving: a node with no lifted descendant is returned unchanged.
+  const visit = (node, locals) => {
+    if (!Array.isArray(node)) return node
+
+    // Descend into an arrow body with the frame extended by this arrow's locals.
+    if (node[0] === '=>') {
+      const inner = new Set(locals)
+      for (const n of functionLocals(extractParams(node[1]), node[2])) inner.add(n)
+      let changed = false
+      const out = node.map((c, i) => { if (i === 0) return c; const v = visit(c, inner); if (v !== c) changed = true; return v })
+      return changed ? copyMeta(out, node) : node
+    }
+
+    // Transform children first (post-order).
+    let changed = false
+    const mapped = node.map((c, i) => { if (i === 0) return c; const v = visit(c, locals); if (v !== c) changed = true; return v })
+    const base = changed ? copyMeta(mapped, node) : node
+
+    const arrow = iifeArrow(base)
+    if (!arrow) return base
+
+    const paramNames = plainParamNames(arrow)
+    if (paramNames === null) return base                // bail: non-plain params
+
+    const callArgs = base[2] == null ? [] : (Array.isArray(base[2]) && base[2][0] === ',') ? base[2].slice(1) : [base[2]]
+    if (callArgs.some(a => Array.isArray(a) && a[0] === '...')) return base   // bail: spread into a fixed-arity direct call
+
+    const body = arrow[2]
+    const captures = []
+    findFreeVars(body, new Set(paramNames), captures, locals)
+
+    const mutated = new Set()
+    findMutations(body, new Set(captures), mutated)
+    if (mutated.size) return base                       // bail: a captured var is written
+
+    // Lift: `(…params, …captures) => body`, hoisted to module top; call passes captures.
+    const name = `${T}lift${uid++}`
+    lifted.push(['let', ['=', name, ['=>', ['()', commaList([...paramNames, ...captures])], body]]])
+    return copyMeta(['()', name, commaList([...callArgs, ...captures])], base)
+  }
+
+  const result = visit(ast, new Set())
+  if (!lifted.length) return result
+
+  // Prepend the lifted decls to the module body (`[';', …stmts]`).
+  if (Array.isArray(result) && result[0] === ';') return [';', ...lifted, ...result.slice(1)]
+  return [';', ...lifted, result]
+}

package/src/reps.js

@@ -0,0 +1,116 @@
+/**
+ * ValueRep storage + VAL lattice lookups (ctx-backed, cycle-free).
+ *
+ * Thin accessors shared by ir, emit, stdlib, and analyze. Keeps heavy AST
+ * walkers in analyze.js without pulling them into ir.js.
+ *
+ * ## Lookup priority (lookupValType / lookupNotString)
+ *
+ * A single binding can carry several pieces of type knowledge, set at different
+ * lifecycle phases. Accessors resolve them in this fixed order — first hit wins:
+ *
+ *   1. `ctx.func.refinements`           flow-sensitive (typeof/instanceof guard)
+ *   2. `ctx.func.localValTypesOverlay`  call-site / loop-iter overlay (transient)
+ *   3. `ctx.func.localReps`             per-function plan/analyze fact (durable)
+ *   4. `ctx.scope.globalValTypes`       module-level binding (durable)
+ *
+ * Writes go through `updateRep` (#3 mutator) / `updateGlobalRep` (#4 mutator).
+ * Refinements (#1) are managed by `withRefinements` in emit; overlay (#2) is
+ * scoped by call/loop-emit code and torn down when the scope exits.
+ *
+ * Mutation sites by phase:
+ *   plan.js          — initial reps from prepare-pass typing
+ *   analyze.js       — boxing decisions, schema bindings, sched facts
+ *   compile/index.js — closure-arg upgrades, propagation across calls
+ *   emit.js          — withRefinements / overlay, transient narrowing only
+ *
+ * @module reps
+ */
+
+import { ctx } from './ctx.js'
+
+/** Value kinds — method dispatch, schema, carrier selection. */
+export const VAL = {
+  NUMBER: 'number', ARRAY: 'array', STRING: 'string',
+  OBJECT: 'object', HASH: 'hash', SET: 'set', MAP: 'map',
+  CLOSURE: 'closure', TYPED: 'typed', REGEX: 'regex',
+  BIGINT: 'bigint', BUFFER: 'buffer', DATE: 'date',
+  BOOL: 'boolean',
+}
+
+/**
+ * A binding's inferred representation. Every field optional; absence = "unknown".
+ * Written only through updateRep / updateGlobalRep, plus a few direct r.wasm /
+ * r.typedCtor mutations in narrow.js's signature fixpoint. This is the *closed*
+ * shape: REP_FIELDS is the single source of truth — it gates updateRep in debug
+ * mode and drives repView, so a typo'd key surfaces loudly instead of silently
+ * vanishing into the open `{...prev, ...fields}` spread.
+ *
+ * @typedef {Object} ValueRep
+ * @property {string}  [val]              VAL.* kind (number/array/string/…).
+ * @property {number}  [ptrKind]          PTR.* pointer class for NaN-box rebox.
+ * @property {number}  [ptrAux]           aux bits in the NaN-box (schema id / elem type).
+ * @property {number}  [schemaId]         object-shape id (OBJECT kind).
+ * @property {number}  [intConst]         proven constant integer value.
+ * @property {boolean} [intCertain]       integer-valued on every path.
+ * @property {boolean} [notString]        proven not a string (skips string-path guards).
+ * @property {number}  [arrayElemSchema]  element object-schema id for arrays.
+ * @property {string}  [arrayElemValType] element VAL.* kind for arrays.
+ * @property {string}  [arrayElemElemValType] nested element VAL.* kind (`X[i][j]`) for arrays of arrays.
+ * @property {string}  [carrier]          abi carrier id override (e.g. 'jsstring').
+ * @property {boolean} [unsigned]         i32 carries an unsigned value (`>>>` result).
+ * @property {*}       [jsonShape]        inferred shape for the JSON.stringify fast path.
+ * @property {string}  [typedCtor]        TypedArray ctor name (TYPED kind); null = bimorphic.
+ * @property {string}  [wasm]             wasm storage type 'i32'|'f64' (narrow.js fixpoint).
+ * @property {boolean} [nullable]         binding can hold null/undefined on some path
+ *   (init or an assignment was a nullish literal) — suppresses the `=== null` /
+ *   `=== undefined` constant-fold even when `val` is a definite non-null kind.
+ */
+export const REP_FIELDS = new Set([
+  'val', 'ptrKind', 'ptrAux', 'schemaId', 'intConst', 'intCertain', 'notString',
+  'arrayElemSchema', 'arrayElemValType', 'arrayElemElemValType', 'carrier', 'unsigned', 'jsonShape',
+  'typedCtor', 'wasm', 'nullable', 'neverGrown',
+])
+
+const DBG_REPS = typeof process !== 'undefined' && process.env?.JZ_DEBUG_INVARIANTS === '1'
+const assertRepFields = (name, fields) => {
+  for (const k in fields)
+    if (!REP_FIELDS.has(k))
+      throw new Error(`updateRep('${name}', {${k}}): unknown ValueRep field — typo, or add it to REP_FIELDS in reps.js`)
+}
+
+/** @returns {ValueRep|undefined} */
+export const repOf = name => ctx.func.localReps?.get(name)
+
+export const updateRep = (name, fields) => {
+  if (DBG_REPS) assertRepFields(name, fields)
+  const m = ctx.func.localReps ||= new Map()
+  const prev = m.get(name) || {}
+  const next = { ...prev, ...fields }
+  for (const k of Object.keys(next)) if (next[k] === undefined) delete next[k]
+  if (Object.keys(next).length === 0) m.delete(name)
+  else m.set(name, next)
+}
+
+export const repOfGlobal = name => ctx.scope.globalReps?.get(name)
+
+export const updateGlobalRep = (name, fields) => {
+  if (DBG_REPS) assertRepFields(name, fields)
+  const m = ctx.scope.globalReps ||= new Map()
+  const prev = m.get(name)
+  m.set(name, prev ? { ...prev, ...fields } : { ...fields })
+}
+
+export const lookupValType = name => {
+  const r = ctx.func.refinements
+  if (r?.size) { const v = r.get(name)?.val; if (v) return v }
+  const ov = ctx.func.localValTypesOverlay
+  if (ov) { const v = ov.get(name); if (v) return v }
+  return ctx.func.localReps?.get(name)?.val || ctx.scope.globalValTypes?.get(name) || null
+}
+
+export const lookupNotString = name => {
+  const r = ctx.func.refinements
+  if (r?.size && r.get(name)?.notString) return true
+  return ctx.func.localReps?.get(name)?.notString === true
+}

package/src/resolve.js

@@ -14,9 +14,18 @@ import { readFileSync, existsSync } from 'fs'
 import { dirname, resolve, join } from 'path'
 import { execFileSync } from 'child_process'
 
-// Matches both `import` and `export ... from` statements (statement position).
-// Lazy `[^'"]*?` consumes whatever sits between the keyword and the first quote.
-const importRe = /^\s*(?:import|export)\s+[^'"]*?['"]([^'"]+)['"]/gm
+// Matches real module imports/exports at statement position — and ONLY those:
+//   import 'x'                         (bare side-effect import)
+//   import … from 'x'                  (default/named/namespace)
+//   export … from 'x' / export * from  (re-export)
+// The specifier MUST follow `from` (or be a bare `import`'s string). The old
+// `(?:import|export)\s+[^'"]*?['"]…` matched any post-keyword string because
+// `[^'"]` spans newlines, so `export const X = [⏎ 'lit'` was read as `export …
+// 'lit'` — bundling then rewrote the bare string literal `'lit'` to a module path.
+// (Self-host fallout: `PASS_NAMES = ['watr', …]` had `'watr'` rewritten to
+// `…/node_modules/watr/watr.js`, corrupting every `'watr'` constant — and so the
+// kernel's whole optimize config, since `cfg.watr` then read that path.)
+const importRe = /^\s*(?:import\b[^'"]*?\bfrom\s*|import\s+|export\b[^'"]*?\bfrom\s*)['"]([^'"]+)['"]/gm
 
 /**
  * @param {string} entryFile - absolute or cwd-relative path to the entry module.

package/src/static.js

@@ -0,0 +1,208 @@
+/**
+ * Compile-time static evaluation — literals, property keys, schema ids.
+ * @module static
+ */
+import { I32_MIN, I32_MAX } from './ast.js'
+import { ctx } from './ctx.js'
+import { repOf, VAL } from './reps.js'
+
+/** Extract integer value from AST literal node. Returns null if not a 32-bit integer. */
+export function intLiteralValue(expr) {
+  let v = null
+  if (typeof expr === 'number') v = expr
+  else if (Array.isArray(expr) && expr[0] == null && typeof expr[1] === 'number') v = expr[1]
+  else if (Array.isArray(expr) && expr[0] === 'u-' && typeof expr[1] === 'number') v = -expr[1]
+  else if (typeof expr === 'string') v = repOf(expr)?.intConst ?? ctx.scope.constInts?.get(expr) ?? null
+  return v != null && Number.isInteger(v) && v >= I32_MIN && v <= I32_MAX ? v : null
+}
+
+/** Non-negative integer literal — used for string/typed-array index bounds. */
+export const nonNegIntLiteral = (node) => { const n = intLiteralValue(node); return n != null && n >= 0 ? n : null }
+
+/** Flat-array slot key for a *bare* non-negative integer index literal `[null, k]`
+ *  — returns the stringified index ("0","1",…) so an array `a[k]` resolves through
+ *  the same SRoA `name#i` machinery as an object `o.key`. Only a literal index
+ *  qualifies (not a const-folded identifier): the key must be unambiguous at scan
+ *  time, before any rep is known. Null for dynamic / non-integer / huge indices. */
+export const staticIndexKey = (node) =>
+  Array.isArray(node) && node[0] == null && Number.isInteger(node[1]) && node[1] >= 0 && node[1] < 0x100000000
+    ? String(node[1]) : null
+
+/** Fold compile-time integer expressions (literals, const bindings, + - * <<). */
+export function constIntExpr(node) {
+  let lit = intLiteralValue(node)
+  if (lit == null && typeof node === 'number' && Number.isInteger(node)) lit = node
+  if (lit == null && Array.isArray(node) && node[0] == null && Number.isInteger(node[1])) lit = node[1]
+  if (lit != null) return lit
+  if (typeof node === 'string') return repOf(node)?.intConst ?? ctx.scope.constInts?.get(node) ?? null
+  if (!Array.isArray(node)) return null
+  const op = node[0]
+  if (op === 'u-') {
+    const v = constIntExpr(node[1])
+    return v == null ? null : -v
+  }
+  if (node.length !== 3) return null
+  const a = constIntExpr(node[1]), b = constIntExpr(node[2])
+  if (a == null || b == null) return null
+  if (op === '+') return a + b
+  if (op === '-') return a - b
+  if (op === '*') return a * b
+  if (op === '<<') return a << b
+  return null
+}
+
+
+export const NO_VALUE = Symbol('no-static-property-key')
+
+export function staticPropertyKey(node) {
+  const value = staticValue(node)
+  return value === NO_VALUE ? null : String(value)
+}
+
+export function staticValue(node) {
+  if (node === undefined) return undefined
+  if (node === null || typeof node === 'number' || typeof node === 'boolean') return node
+  if (typeof node === 'string') return ctx.scope.constStrs?.get(node) ?? NO_VALUE
+  if (!Array.isArray(node)) return NO_VALUE
+
+  const [op, ...args] = node
+  if (op == null) return args.length ? args[0] : undefined
+  if (op === 'str') return args[0]
+  // Self-host kernel boundary marks a literal bool as `['bool', 1|0]` (interop
+  // normalizeBigints), where native keeps `[, true]` (caught by op==null above).
+  // Recover the boolean from its 0/1 carrier so const-folded keys/conditions
+  // resolve on the kernel leg (e.g. `{ [true ? 3 : 4]: 5 }`).
+  if (op === 'bool') { const c = staticValue(args[0]); return c === NO_VALUE ? NO_VALUE : !!c }
+  if (op === '[]' && args.length === 1) return staticValue(args[0])
+  if (op === '()' && args[0] === 'String' && args.length === 2) {
+    const value = staticValue(args[1])
+    return value === NO_VALUE ? NO_VALUE : String(value)
+  }
+  if (op === '()' && args[0] === 'Number' && args.length === 2) {
+    const value = staticValue(args[1])
+    return value === NO_VALUE ? NO_VALUE : Number(value)
+  }
+  if (op === '?:' || op === '?') {
+    const cond = staticValue(args[0])
+    return cond === NO_VALUE ? NO_VALUE : staticValue(cond ? args[1] : args[2])
+  }
+  if (op === '&&' || op === '||') {
+    const left = staticValue(args[0])
+    if (left === NO_VALUE) return NO_VALUE
+    return op === '&&' ? (left ? staticValue(args[1]) : left) : (left ? left : staticValue(args[1]))
+  }
+  if (op === '??') {
+    const left = staticValue(args[0])
+    return left === NO_VALUE ? NO_VALUE : left == null ? staticValue(args[1]) : left
+  }
+
+  if (args.length === 1) {
+    const value = staticValue(args[0])
+    if (value === NO_VALUE) return NO_VALUE
+    // Parser emits raw `-`/`+` for both unary and binary; prep later normalizes
+    // unary to `u-`/`u+`, but staticPropertyKey runs on raw parser AST.
+    if (op === 'u+' || op === '+') return +value
+    if (op === 'u-' || op === '-') return -value
+    if (op === '!') return !value
+    if (op === '~') return ~value
+    return NO_VALUE
+  }
+
+  if (args.length === 2) {
+    const left = staticValue(args[0])
+    const right = staticValue(args[1])
+    if (left === NO_VALUE || right === NO_VALUE) return NO_VALUE
+    switch (op) {
+      case '+': return typeof left === 'string' || typeof right === 'string' ? String(left) + String(right) : Number(left) + Number(right)
+      case '-': return Number(left) - Number(right)
+      case '*': return Number(left) * Number(right)
+      case '/': return Number(left) / Number(right)
+      case '%': return Number(left) % Number(right)
+      case '**': return Number(left) ** Number(right)
+      case '&': return Number(left) & Number(right)
+      case '|': return Number(left) | Number(right)
+      case '^': return Number(left) ^ Number(right)
+      case '<<': return Number(left) << Number(right)
+      case '>>': return Number(left) >> Number(right)
+      case '>>>': return Number(left) >>> Number(right)
+      default: return NO_VALUE
+    }
+  }
+
+  return NO_VALUE
+}
+
+/** Decode a `['{}', ...]` AST's children into `{names, values}`, or null if any
+ *  property is non-static-key (computed key, spread, shorthand). Matches the
+ *  emitter's flatten rule for comma-grouped props. Used by collectProgramFacts,
+ *  narrowSignatures, and objLiteralSchemaId; the emitter (module/object.js)
+ *  does its own decoding because it must handle the spread/computed-key paths. */
+export function staticObjectProps(args) {
+  const raw = args.length === 1 && Array.isArray(args[0]) && args[0][0] === ',' ? args[0].slice(1) : args
+  const names = [], values = []
+  for (const p of raw) {
+    if (!Array.isArray(p) || p[0] !== ':' || typeof p[1] !== 'string') return null
+    names.push(p[1]); values.push(p[2])
+  }
+  return names.length ? { names, values } : null
+}
+
+export function staticArrayElems(expr) {
+  if (!Array.isArray(expr)) return null
+  if (expr[0] === '[') return expr.slice(1)
+  if (expr[0] !== '[]' || expr.length >= 3) return null
+  const arg = expr[1]
+  if (arg == null) return []
+  return Array.isArray(arg) && arg[0] === ',' ? arg.slice(1) : [arg]
+}
+
+/** Schema-id for an object literal expression. Returns null on dynamic keys, spread, shorthand. */
+export function objLiteralSchemaId(expr) {
+  if (!Array.isArray(expr) || expr[0] !== '{}' || !ctx.schema?.register) return null
+  const parsed = staticObjectProps(expr.slice(1))
+  return parsed ? ctx.schema.register(parsed.names) : null
+}
+
+/** Resolve schemaId of an expression, given a per-function schemaId map for locals.
+ *  Used for both intra-function arr elem-schema observation and func.arrayElemSchema
+ *  return inference. Recognizes: object literals, var names with bound schemaId,
+ *  user fn calls with narrowed result schema, ?: / && / || when both branches agree. */
+export function exprSchemaId(expr, localSchemaMap) {
+  if (typeof expr === 'string') {
+    if (localSchemaMap?.has(expr)) return localSchemaMap.get(expr)
+    return ctx.schema?.idOf?.(expr) ?? null
+  }
+  if (!Array.isArray(expr)) return null
+  const op = expr[0]
+  if (op === '{}') return objLiteralSchemaId(expr)
+  if (op === '()' && typeof expr[1] === 'string') {
+    const f = ctx.func.map?.get(expr[1])
+    if (f?.valResult === VAL.OBJECT && f.sig?.ptrAux != null) return f.sig.ptrAux
+    return null
+  }
+  if (op === '?:') {
+    const a = exprSchemaId(expr[2], localSchemaMap)
+    const b = exprSchemaId(expr[3], localSchemaMap)
+    return a != null && a === b ? a : null
+  }
+  if (op === '&&' || op === '||') {
+    const a = exprSchemaId(expr[1], localSchemaMap)
+    const b = exprSchemaId(expr[2], localSchemaMap)
+    return a != null && a === b ? a : null
+  }
+  return null
+}
+
+export function inlineArraySid(name) {
+  if (typeof name !== 'string') return null
+  // structInline is keyed on the per-function `localReps` rep, so it is only
+  // consistent for a *function-local* array — a write site and a read site in the
+  // same frame agree. A module-global array is read across functions whose frames
+  // carry no rep for it, so the carrier would diverge: `G.push({a,b})` in one
+  // function flattens the struct into K cells, while `G.length` / `G[i].a` in
+  // another sees a plain array (K=1) and reads garbage. Never inline a global's
+  // element struct — the plain Array<ptr> representation is consistent everywhere.
+  if (ctx.scope.globals?.has(name)) return null
+  const sid = ctx.func.localReps?.get(name)?.arrayElemSchema
+  return sid != null && ctx.schema.inlineArray?.has(sid) ? sid : null
+}