jz 0.5.1 → 0.7.0

package/src/emit.js

@@ -1,3040 +0,0 @@
-/**
- * AST → WASM IR emission.
- *
- * # Stage contract
- *   IN:  prepared AST node + ctx state (func.locals, func.localReps, types.typedElem, etc.)
- *   OUT: IR node (array) with `.type` ('i32' | 'f64' | 'void'). For statements, a flat
- *        list of WASM instructions (no type tag).
- *   NO-MUTATE: emit does not rewrite the AST. Side effects go to ctx.runtime.*,
- *        ctx.core.includes (via inc()), ctx.func.uniq (local naming), and ctx.features.*.
- *
- * # Dispatch
- *   `emit(node, expect?)` handles literals inline and routes arrays to ctx.core.emit[op].
- *   `emitFlat(node)` emits + drops any value (statement context; routes block bodies to emitBody).
- *   `emitBody(node)` unwraps a `{}` block and concatenates flat statement IR.
- *
- * The emitter table (`emitter` export) is copied into ctx.core.emit by reset();
- * language modules add/override entries to extend dispatch.
- *
- * Low-level IR construction helpers (typed/asF64/allocPtr/readVar/…) live in compile.js
- * and are imported below.
- *
- * @module emit
- */
-
-import { ctx, err, inc, PTR } from './ctx.js'
-import {
-  T, VAL, nonNegIntLiteral, valTypeOf, lookupValType, extractParams, classifyParam, findFreeVars, STMT_OPS, repOf, updateRep, repOfGlobal, staticPropertyKey,
-  // AST predicates (formerly in src/ast.js)
-  isReassigned, hasOwnContinue, hasOwnBreakOrContinue, containsNestedClosure,
-  containsNestedLoop, nestedSmallLoopBudget, containsDeclOf, cloneWithSubst,
-  containsKnownTypedArrayIndex, smallConstForTripCount, isTerminator,
-  inBoundsCharCodeAt,
-  MAX_SMALL_FOR_UNROLL, MAX_NESTED_FOR_UNROLL,
-} from './analyze.js'
-import {
-  typed, asF64, asI32, asI64, asPtrOffset, asParamType, toI32, fromI64,
-  NULL_IR, nullExpr, undefExpr, MAX_CLOSURE_ARITY,
-  WASM_OPS, SPREAD_MUTATORS, BOXED_MUTATORS,
-  mkPtrIR, ptrOffsetIR, ptrTypeIR,
-  isLit, litVal, isNullishLit, isPureIR, emitNum, f64rem, toNumF64, toStrI64,
-  truthyIR, toBoolFromEmitted, isPostfix,
-  isGlobal, isConst, keyValType, usesDynProps, needsDynShadow,
-  temp, tempI32, tempI64, allocPtr,
-  boxedAddr, readVar, writeVar, isNullish, isBoolAtom,
-  isLiteralStr, resolveValType, isFuncRef,
-  multiCount, loopTop, flat,
-  reconstructArgsWithSpreads, tcoTailRewrite,
-} from './ir.js'
-import { typeofPredicate } from './infer.js'
-
-// Current emission "expect" mode ('void' or null); set by emit(), read by compound-assignment emitters
-// to decide whether to emit a value-returning or side-effect-only form.
-let _expect = null
-
-// A genuine i32 *number* — safe for the i32 fast path in arithmetic/bitwise
-// operators. An unboxed pointer (object/array/string/closure local kept as a
-// raw i32 handle) is *also* i32-typed but carries `.ptrKind`; treating it as a
-// number would compute on raw pointer bits. A ptrKind-carrying operand must
-// instead route through ToNumber (`toNumF64`), which performs ToPrimitive.
-const isI32Num = (v) => v.type === 'i32' && v.ptrKind == null
-
-// An operand whose uint32 value can be *observed as a JS number* — a `>>>`
-// result, an `unsignedResult` call, or an unsigned i32.const. Its magnitude can
-// exceed signed-i32 range, so wrapping i32 arithmetic would corrupt it; widen to
-// f64 instead. A `.wrapSafe` operand is also unsigned but is a `narrowUint32`
-// accumulator read proven to be re-truncated by a `>>>` (ToUint32) sink at every
-// use — wrapping is exactly its intended semantics, so it stays on the i32 path.
-const widensUnsigned = (v) => v.unsigned && !v.wrapSafe
-
-const FIRST_CLASS_UNARY_MATH = {
-  'math.abs': 'f64.abs',
-  'math.sqrt': 'f64.sqrt',
-  'math.ceil': 'f64.ceil',
-  'math.floor': 'f64.floor',
-  'math.trunc': 'f64.trunc',
-}
-
-function builtinFunctionValue(name) {
-  const op = FIRST_CLASS_UNARY_MATH[name]
-  if (!op) err(`Builtin function '${name}' cannot be used as a first-class value`)
-  if (!ctx.closure.table) err(`Builtin function '${name}' used as value requires closure support`)
-  const fn = `${T}builtin_${name.replace(/\W/g, '_')}`
-  if (!ctx.core.stdlib[fn]) {
-    const width = ctx.closure.width ?? MAX_CLOSURE_ARITY
-    const params = ['(param $__env f64)', '(param $__argc i32)']
-    for (let i = 0; i < width; i++) params.push(`(param $__a${i} f64)`)
-    ctx.core.stdlib[fn] = `(func $${fn} ${params.join(' ')} (result f64) (${op} (local.get $__a0)))`
-    inc(fn)
-  }
-  let idx = ctx.closure.table.indexOf(fn)
-  if (idx < 0) { idx = ctx.closure.table.length; ctx.closure.table.push(fn) }
-  const ir = mkPtrIR(PTR.CLOSURE, idx, 0)
-  ir.closureFuncIdx = idx
-  return ir
-}
-
-/** Emit unary negation: constant-fold, or i32 sub from 0 / f64.neg. */
-const emitNeg = (a) => {
-  if (valTypeOf(a) === VAL.BIGINT) return fromI64(['i64.sub', ['i64.const', 0], asI64(emit(a))])
-  const v = emit(a)
-  return isLit(v) ? emitNum(-litVal(v)) : isI32Num(v)
-    ? typed(['i32.sub', typed(['i32.const', 0], 'i32'), v], 'i32')
-    : typed(['f64.neg', toNumF64(a, v)], 'f64')
-}
-
-/** Try constant-folding binary arith: returns emitNum(result) or null. */
-// `.unsigned` literals carry a uint32 value whose i32 `litVal` is its *signed* bit
-// pattern (e.g. `-1` for 4294967295), so folding them through `fn` numerically would
-// be wrong. Bail to the runtime path — the arithmetic handlers widen unsigned operands
-// to f64 (convert_i32_u), reproducing the JS-spec result.
-const foldConst = (va, vb, fn, guard) =>
-  isLit(va) && isLit(vb) && !va.unsigned && !vb.unsigned && (!guard || guard(litVal(vb)))
-    ? emitNum(fn(litVal(va), litVal(vb))) : null
-
-// JS `*` is an f64 multiply; `i32.mul` yields only the exact product mod 2^32.
-// Those agree under a ToInt32/ToUint32 sink (and as plain numbers) while the
-// exact product stays f64-exact, i.e. |product| <= 2^53. Two i32 operands can
-// reach 2^62, so `i32.mul` is sound only when one side is a literal small
-// enough that, against the full i32 range (2^31) of the other, the product
-// holds within 2^53 — i.e. |literal| <= 2^22. Keeps index arithmetic (`i*4`,
-// `row*16`) on `i32.mul` while routing hash-mix-scale products to `f64.mul`.
-const mulFitsI32 = (va, vb) =>
-  (isLit(va) && Math.abs(litVal(va)) <= 0x400000) ||
-  (isLit(vb) && Math.abs(litVal(vb)) <= 0x400000)
-
-/** Emit typeof comparison: typeof x == typeCode → type-aware check. */
-export function emitTypeofCmp(a, b, cmpOp) {
-  let typeofExpr, code
-  if (Array.isArray(a) && a[0] === 'typeof' && typeof b === 'number') { typeofExpr = a[1]; code = b }
-  else if (Array.isArray(a) && a[0] === 'typeof' && Array.isArray(b) && b[0] == null) { typeofExpr = a[1]; code = b[1] }
-  else return null
-  if (typeof code !== 'number') return null
-
-  const t = temp()
-  const va = asF64(emit(typeofExpr))
-  const eq = cmpOp === 'eq'
-
-  if (code === -1) {
-    // A VAL.BOOL value rides in the f64 0/1 carrier, so it would pass the
-    // `v===v` number test — but it is typeof "boolean", not "number".
-    if (resolveValType(typeofExpr, valTypeOf, lookupValType) === VAL.BOOL)
-      return typed(['i32.const', eq ? 0 : 1], 'i32')
-    return typed(eq
-      ? ['f64.eq', ['local.tee', `$${t}`, va], ['local.get', `$${t}`]]
-      : ['f64.ne', ['local.tee', `$${t}`, va], ['local.get', `$${t}`]], 'i32')
-  }
-  if (code === -2) {
-    inc('__ptr_type')
-    const isPtr = ['f64.ne', ['local.tee', `$${t}`, va], ['local.get', `$${t}`]]
-    const isStr = ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${t}`]]], ['i32.const', PTR.STRING]]
-    return typed(eq ? ['i32.and', isPtr, isStr]
-      : ['i32.or', ['i32.eqz', isPtr], ['i32.eqz', isStr]], 'i32')
-  }
-  if (code === -3) {
-    const check = isNullish(va)
-    return typed(eq ? check : ['i32.eqz', check], 'i32')
-  }
-  if (code === -4) {
-    // boolean. Statically VAL.BOOL → true; any other known type → false.
-    const vt = resolveValType(typeofExpr, valTypeOf, lookupValType)
-    if (vt) return typed(['i32.const', (vt === VAL.BOOL) === eq ? 1 : 0], 'i32')
-    // Unknown static type: boolean iff the carrier is a boxed-boolean atom.
-    const isBool = isBoolAtom(['local.tee', `$${t}`, va])
-    return typed(eq ? isBool : ['i32.eqz', isBool], 'i32')
-  }
-  if (code === -5) {
-    inc('__ptr_type')
-    const isPtr = ['f64.ne', ['local.tee', `$${t}`, va], ['local.get', `$${t}`]]
-    const tt = `${T}${ctx.func.uniq++}`; ctx.func.locals.set(tt, 'i32')
-    const notStrFn = ['i32.and',
-      ['i32.ne', ['local.tee', `$${tt}`, ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]], ['i32.const', PTR.STRING]],
-      ['i32.ne', ['local.get', `$${tt}`], ['i32.const', PTR.CLOSURE]]]
-    const notNullish = ['i32.eqz', isNullish(['local.get', `$${t}`])]
-    const check = ['i32.and', ['i32.and', isPtr, notStrFn], notNullish]
-    return typed(eq ? check : ['i32.eqz', check], 'i32')
-  }
-  if (code === -6) {
-    inc('__ptr_type')
-    const isPtr = ['f64.ne', ['local.tee', `$${t}`, va], ['local.get', `$${t}`]]
-    const isFn = ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${t}`]]], ['i32.const', PTR.CLOSURE]]
-    return typed(eq ? ['i32.and', isPtr, isFn] : ['i32.or', ['i32.eqz', isPtr], ['i32.eqz', isFn]], 'i32')
-  }
-  if (code === -7) {
-    const vt = resolveValType(typeofExpr, valTypeOf, lookupValType)
-    if (vt) return typed(['i32.const', (vt === VAL.BIGINT) === eq ? 1 : 0], 'i32')
-    const n = ['local.tee', `$${t}`, va]
-    const isBigInt = ['i32.and',
-      ['f64.eq', n, ['local.get', `$${t}`]],
-      ['i32.and',
-        ['f64.ne', ['local.get', `$${t}`], ['f64.const', 0]],
-        ['f64.lt', ['f64.abs', ['local.get', `$${t}`]], ['f64.const', 2.2250738585072014e-308]]]]
-    return typed(eq ? isBigInt : ['i32.eqz', isBigInt], 'i32')
-  }
-  if (code >= 0) {
-    inc('__ptr_type')
-    const isPtr = ['f64.ne', ['local.tee', `$${t}`, va], ['local.get', `$${t}`]]
-    const check = ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${t}`]]], ['i32.const', code]]
-    return typed(eq ? ['i32.and', isPtr, check] : ['i32.or', ['i32.eqz', isPtr], ['i32.eqz', check]], 'i32')
-  }
-  return null
-}
-
-/** Stringify a VAL.BOOL operand to "true"/"false" (f64 string pointer). The
- *  boolean rides the cheap 0/1 carrier, so we runtime-select between the two
- *  interned literals; a constant operand folds to a single literal downstream. */
-export const emitBoolStr = (node) =>
-  typed(['select', asF64(emit(['str', 'true'])), asF64(emit(['str', 'false'])), truthyIR(emit(node))], 'f64')
-
-const CMP_SET = new Set(['>', '<', '>=', '<=', '==', '!=', '!'])
-const isCmp = n => Array.isArray(n) && CMP_SET.has(n[0])
-
-// Map/Set methods whose generic (`.${method}`) emitter assumes a collection
-// receiver and dereferences a key/value argument. Every one needs ≥1 argument
-// (`.get(k)` / `.has(v)` / `.add(v)` / `.delete(v)` / `.set(k[,v])`), so a
-// zero-arg call on a not-proven-collection receiver cannot be the collection
-// op — it is a user/closure method and must not reach the collection emitter.
-const COLLECTION_METHODS = new Set(['get', 'set', 'has', 'add', 'delete'])
-
-// Pointer kinds for which JS `==` / `!=` is pure reference equality — i.e. i64 bit
-// compare of the NaN-box is equivalent to __eq. Excludes STRING (content compare for
-// heap strings) and BIGINT (content compare).
-const REF_EQ_KINDS = new Set([
-  VAL.ARRAY, VAL.OBJECT, VAL.SET, VAL.MAP,
-  VAL.BUFFER, VAL.TYPED, VAL.CLOSURE, VAL.REGEX, VAL.DATE,
-])
-
-function stringLiteral(node) {
-  if (Array.isArray(node) && node[0] === 'str' && typeof node[1] === 'string') return node[1]
-  if (Array.isArray(node) && node[0] == null && typeof node[1] === 'string') return node[1]
-  return null
-}
-
-// Index expressions where peepholing `s[k] === 'X'` to char-byte compare is
-// semantics-preserving: must produce a non-negative *integer* at run time so
-// `__str_byteLen u> k` bounds-checks the same range JS would. Out-of-range
-// (negative or ≥ len) falls into the `else 0` arm — matches `undefined === 'X'`.
-function intIndexIR(key) {
-  const lit = nonNegIntLiteral(key)
-  if (lit != null) return ['i32.const', lit]
-  // intCertain name: forward-prop says every defining RHS is integer-shaped.
-  // Captures loop variables (`for(let i=0;;i++)`), `let k = j + 1`, etc.
-  if (typeof key === 'string' && repOf(key)?.intCertain) return asI32(emit(key))
-  // intCertain schema slot read `o.x`: every observed write is integer-shaped,
-  // so the loaded f64 represents an int — fold into the byte-compare fast path.
-  if (Array.isArray(key) && key[0] === '.' && typeof key[1] === 'string' && typeof key[2] === 'string' &&
-      ctx.schema.slotIntCertainAt?.(key[1], key[2]) === true) return asI32(emit(key))
-  return null
-}
-
-function emitSingleCharIndexCmp(a, b, negate = false) {
-  const leftLit = stringLiteral(a)
-  const rightLit = stringLiteral(b)
-  const aIdx = Array.isArray(a) && a[0] === '[]'
-  const bIdx = Array.isArray(b) && b[0] === '[]'
-  let indexed, lit
-  if (bIdx && leftLit != null) { indexed = b; lit = leftLit }
-  else if (aIdx && rightLit != null) { indexed = a; lit = rightLit }
-  else return null
-
-  if (lit.length === 0) return null
-  if ([...lit].some(c => c.charCodeAt(0) > 0x7F)) return null
-
-  const [, obj, key] = indexed
-  const idxIR = intIndexIR(key)
-  if (idxIR == null) return null
-
-  const vt = typeof obj === 'string' ? lookupValType(obj) : valTypeOf(obj)
-  if (vt && vt !== VAL.STRING) return null
-
-  const finish = expr => negate ? ['i32.eqz', expr] : expr
-
-  // Known STRING: s[i] always returns 1-char SSO. Multi-char literal → always false.
-  if (vt === VAL.STRING && lit.length > 1) return emitNum(negate ? 1 : 0)
-
-  // Single-char literal: compare byte directly, skipping __str_idx allocation.
-  if (lit.length !== 1 || !ctx.core.stdlib['__char_at'] || !ctx.core.stdlib['__str_byteLen']) return null
-
-  // Stash the index in a local when it isn't a constant — bounds + load both reference it.
-  const isConstIdx = Array.isArray(idxIR) && idxIR[0] === 'i32.const'
-  let idxRefIR = idxIR, idxBindIR = null
-  if (!isConstIdx) {
-    const idxTmp = tempI32('si')
-    idxBindIR = ['local.set', `$${idxTmp}`, idxIR]
-    idxRefIR = ['local.get', `$${idxTmp}`]
-  }
-
-  const ptr = temp('sc')
-  inc('__str_byteLen', '__char_at')
-  const charEq = ['if', ['result', 'i32'],
-    ['i32.gt_u', ['call', '$__str_byteLen', ['i64.reinterpret_f64', ['local.get', `$${ptr}`]]], idxRefIR],
-    ['then', ['i32.eq', ['call', '$__char_at', ['i64.reinterpret_f64', ['local.get', `$${ptr}`]], idxRefIR], ['i32.const', lit.charCodeAt(0)]]],
-    ['else', ['i32.const', 0]]]
-
-  const prelude = idxBindIR ? [['local.set', `$${ptr}`, asF64(emit(obj))], idxBindIR] : [['local.set', `$${ptr}`, asF64(emit(obj))]]
-
-  if (vt === VAL.STRING) {
-    return typed(['block', ['result', 'i32'], ...prelude, finish(charEq)], 'i32')
-  }
-
-  inc('__ptr_type', '__typed_idx', '__eq')
-  const genericEq = ['call', '$__eq',
-    ['i64.reinterpret_f64', ['call', '$__typed_idx', ['i64.reinterpret_f64', ['local.get', `$${ptr}`]], idxRefIR]],
-    asI64(emit(['str', lit]))]
-  const cmp = ['if', ['result', 'i32'],
-    ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${ptr}`]]], ['i32.const', PTR.STRING]],
-    ['then', charEq],
-    ['else', genericEq]]
-  return typed(['block', ['result', 'i32'], ...prelude, finish(cmp)], 'i32')
-}
-
-// `<str>.{substr,substring,slice}(...) === <other>` whose substring is consumed
-// only by the equality: materialising it (an __alloc + byte copy) is pure waste.
-// Fuse to __str_{substring,slice}_eq, which clamp the range like the method then
-// byte-compare it against `other` in place. Sibling to emitSingleCharIndexCmp,
-// tried at the same `==`/`!=` sites. Motivating hot path: the parser keyword
-// scan, `cur.substr(i,l) === keyword`.
-function emitSubstringEqCmp(a, b, negate = false) {
-  // Post-prepare a multi-arg call keeps its args as one comma list; a single
-  // arg sits bare. Normalise either (and a flat tail, defensively) to a list.
-  const callInfo = node => {
-    if (!Array.isArray(node) || node[0] !== '()') return null
-    const callee = node[1]
-    if (!Array.isArray(callee) || callee[0] !== '.') return null
-    const method = callee[2]
-    if (method !== 'substr' && method !== 'substring' && method !== 'slice') return null
-    let args = node.slice(2)
-    if (args.length === 1 && Array.isArray(args[0]) && args[0][0] === ',') args = args[0].slice(1)
-    while (args.length && args[args.length - 1] == null) args = args.slice(0, -1)
-    return { recv: callee[1], method, args }
-  }
-
-  let info = callInfo(a), other = b, callIsLeft = true
-  if (!info) { info = callInfo(b); other = a; callIsLeft = false }
-  if (!info) return null
-  const { recv, method, args } = info
-  if (args.length > 2) return null
-  if (!ctx.core.stdlib['__char_at'] || !ctx.core.stdlib['__str_byteLen']) return null
-
-  // The receiver must be a string. `substr`/`substring` name string-only methods,
-  // so an unknown receiver is safe — the normal `.substr`/`.substring` emitter
-  // assumes a string too. `slice` is also Array.prototype.slice — require a
-  // statically-known STRING there. A known non-string receiver bails always.
-  const vt = resolveValType(recv, valTypeOf, lookupValType)
-  if (vt && vt !== VAL.STRING) return null
-  if (method === 'slice' && vt !== VAL.STRING) return null
-
-  const helper = method === 'slice' ? '__str_slice_eq' : '__str_substring_eq'
-  inc(helper)
-
-  // Absent end → byteLen: pass i32 max — every clamp arm floors it to the length.
-  const TO_END = ['i32.const', 0x7FFFFFFF]
-  let startIR, endIR
-  if (method === 'substr' && args[1] != null) {
-    // substr's 2nd arg is a length: end = start + length, so start reads twice.
-    const s = tempI32('subS')
-    startIR = ['local.tee', `$${s}`, args[0] == null ? ['i32.const', 0] : asI32(emit(args[0]))]
-    endIR = ['i32.add', ['local.get', `$${s}`], asI32(emit(args[1]))]
-  } else {
-    startIR = args[0] == null ? ['i32.const', 0] : asI32(emit(args[0]))
-    endIR = args[1] == null ? TO_END : asI32(emit(args[1]))
-  }
-
-  const finish = expr => negate ? ['i32.eqz', expr] : expr
-
-  if (callIsLeft)
-    return typed(finish(['call', `$${helper}`, asI64(emit(recv)), startIR, endIR, asI64(emit(other))]), 'i32')
-
-  // `other` is the source-left operand — evaluate it first to preserve order.
-  const o = temp('subO')
-  return typed(['block', ['result', 'i32'],
-    ['local.set', `$${o}`, asF64(emit(other))],
-    finish(['call', `$${helper}`, asI64(emit(recv)), startIR, endIR,
-      ['i64.reinterpret_f64', ['local.get', `$${o}`]]])], 'i32')
-}
-
-// === Flow-sensitive type refinement ===
-// Map typeof code (from resolveTypeof in prepare.js) → VAL kind. Undef/boolean/object have no
-// single VAL refinement, so they're excluded. String/number/function do.
-const TYPEOF_CODE_TO_VAL = { [-1]: VAL.NUMBER, [-2]: VAL.STRING, [-6]: VAL.CLOSURE }
-
-/** Extract refinements from a boolean condition AST.
- *  `sense`: true = refine for then-branch, false = refine for else-branch (i.e. cond inverted).
- *  Returns a Map<name, {val?: VAL, notString?: true}>. Walks && / || / ! accordingly. */
-function extractRefinements(cond, out, sense = true) {
-  if (!Array.isArray(cond)) return out
-  const op = cond[0]
-  // ! flips sense
-  if (op === '!') return extractRefinements(cond[1], out, !sense)
-  // && under positive sense refines with union of both branches.
-  // || under negative sense (De Morgan) similarly refines the else-branch.
-  if (op === '&&' && sense)  { extractRefinements(cond[1], out, true);  extractRefinements(cond[2], out, true);  return out }
-  if (op === '||' && !sense) { extractRefinements(cond[1], out, false); extractRefinements(cond[2], out, false); return out }
-  // typeof x == 'number' | 'string' | 'function' — sense must be positive for "==", negative for "!="
-  if ((op === '==' || op === '===' || op === '!=' || op === '!==')) {
-    const tp = typeofPredicate(cond)
-    if (tp) {
-      const wantPositive = tp.eq ? sense : !sense
-      if (wantPositive) {
-        const val = TYPEOF_CODE_TO_VAL[tp.code]
-        if (val) mergeRefinement(out, tp.name, { val })
-      } else if (tp.code === 'string' || tp.code === -2) {
-        // Negative branch of typeof-string guard (e.g. post `if (typeof x === 'string') return`)
-        // proves the binding is not a primitive string in the suffix scope — feeds B4's
-        // length / subscript dispatch elision the same way write-shape evidence does.
-        mergeRefinement(out, tp.name, { notString: true })
-      }
-    }
-    return out
-  }
-  // Type-predicate calls under positive sense — refine by the asserted VAL.
-  // Callee may be the flattened string 'Array.isArray' or the raw ['.', 'Array',
-  // 'isArray'] pair; __is_map / __is_set / __is_typed come from jzify's
-  // instanceof lowering as a bare string callee.
-  if (op === '()' && sense && typeof cond[2] === 'string') {
-    const callee = cond[1]
-    const val = predicateRefinement(callee)
-    if (val != null) { mergeRefinement(out, cond[2], { val }); return out }
-  }
-  return out
-}
-
-/** Map a call-callee shape to the VAL kind it asserts under positive sense, or null. */
-function predicateRefinement(callee) {
-  if (callee === 'Array.isArray') return VAL.ARRAY
-  if (Array.isArray(callee) && callee[0] === '.' && callee[1] === 'Array' && callee[2] === 'isArray')
-    return VAL.ARRAY
-  if (callee === '__is_map') return VAL.MAP
-  if (callee === '__is_set') return VAL.SET
-  if (callee === '__is_typed') return VAL.TYPED
-  return null
-}
-
-/** Merge a refinement fact into the per-name slot. Later facts override; non-overlapping
- *  fields union. Keeps the call-side simple (always assign through this). */
-function mergeRefinement(out, name, fact) {
-  const cur = out.get(name)
-  out.set(name, cur ? { ...cur, ...fact } : fact)
-}
-
-function unrollSmallConstFor(init, cond, step, body) {
-  const end = smallConstForTripCount(init, cond, step)
-  if (end == null) return null
-  const name = init[1][1]
-  if (containsNestedLoop(body)) {
-    const nestedMode = ctx.transform.optimize?.nestedSmallConstForUnroll
-    if (nestedMode !== true && (nestedMode !== 'auto' || !containsKnownTypedArrayIndex(body))) return null
-    if (end * nestedSmallLoopBudget(body) > MAX_NESTED_FOR_UNROLL) return null
-  }
-  if (hasOwnBreakOrContinue(body) || containsNestedClosure(body) || containsDeclOf(body, name)) return null
-  if (isReassigned(body, name)) return null
-
-  const out = []
-  for (let i = 0; i < end; i++) out.push(...emitFlat(cloneWithSubst(body, name, i)))
-  return out
-}
-
-function canThrow(body, seen = new Set()) {
-  if (!Array.isArray(body)) return false
-  const op = body[0]
-  if (op === 'throw') return true
-  if (op === '=>') return false
-  if (op === '()') {
-    const callee = body[1]
-    // A call can throw unless we can see the whole callee and prove it can't:
-    // only direct calls into a resolvable, non-raw function body are traceable.
-    // Indirect/method/builtin calls (callee not a plain name, or a name we can't
-    // resolve) are conservatively throwing — a user `try` must wrap them.
-    if (typeof callee !== 'string') return true
-    const bodyName = ctx.func.directClosures?.get(callee)
-    const f = ctx.func.map?.get(bodyName || callee)
-    if (!f?.body || f.raw) return true
-    if (!seen.has(f.name)) {
-      seen.add(f.name)
-      if (canThrow(f.body, seen)) return true
-    }
-  }
-  for (let i = 1; i < body.length; i++) if (canThrow(body[i], seen)) return true
-  return false
-}
-
-const isBoundName = name =>
-  ctx.func.locals?.has(name) || ctx.func.current?.params?.some(p => p.name === name)
-
-// A source-defined function (carries a body) — as opposed to an imported name,
-// which `ctx.func.names` also holds but which has no body and may legitimately
-// share a name with a built-in emitter (e.g. an imported `parseInt`).
-const isUserFunc = name => !!ctx.func.map.get(name)?.body
-
-/** Emit pending `finally` cleanups for an abrupt control-flow exit.
- *  Inner cleanups run before outer cleanups. While emitting each cleanup, remove
- *  it from the active stack so `return` inside `finally` does not re-enter it. */
-function emitFinalizers() {
-  const stack = ctx.func.finallyStack || []
-  if (stack.length === 0) return []
-  const saved = stack.slice()
-  const out = []
-  for (let i = saved.length - 1; i >= 0; i--) {
-    ctx.func.finallyStack = saved.slice(0, i)
-    out.push(...emitFlat(saved[i]))
-  }
-  ctx.func.finallyStack = saved
-  return out
-}
-
-function withFinallyStack(stack, fn) {
-  const prev = ctx.func.finallyStack || []
-  ctx.func.finallyStack = stack
-  try { return fn() }
-  finally { ctx.func.finallyStack = prev }
-}
-
-/** Apply refinements for the duration of `fn()`. Restores prior state on return/throw. */
-function withRefinements(refs, body, fn) {
-  if (!refs || refs.size === 0) return fn()
-  const cur = ctx.func.refinements
-  // Drop names that are reassigned in the body — refinement would be unsound.
-  const saved = []
-  for (const [name, val] of refs) {
-    if (isReassigned(body, name)) continue
-    saved.push([name, cur.get(name)])
-    cur.set(name, val)
-  }
-  try { return fn() }
-  finally {
-    for (const [name, prev] of saved) {
-      if (prev === undefined) cur.delete(name); else cur.set(name, prev)
-    }
-  }
-}
-
-/** Coerce an AST node to an i32 boolean, folding && / || at the boolean boundary. */
-export function toBool(node) {
-  const op = Array.isArray(node) ? node[0] : null
-  if (CMP_SET.has(op)) return emit(node)
-  if (op === '&&') {
-    const la = toBool(node[1]), lb = toBool(node[2])
-    if (isCmp(node[1]) && isCmp(node[2])) return typed(['i32.and', la, lb], 'i32')
-    return typed(['if', ['result', 'i32'], la, ['then', lb], ['else', ['i32.const', 0]]], 'i32')
-  }
-  if (op === '||') {
-    const la = toBool(node[1]), lb = toBool(node[2])
-    if (isCmp(node[1]) && isCmp(node[2])) return typed(['i32.or', la, lb], 'i32')
-    return typed(['if', ['result', 'i32'], la, ['then', ['i32.const', 1]], ['else', lb]], 'i32')
-  }
-  return toBoolFromEmitted(emit(node))
-}
-
-/** Coerce an emitted arg IR to match a callee param. Param may carry ptrKind (pointer-ABI
- *  i32 offset), else falls back to numeric WASM type coercion. */
-function emitArgForParam(ir, param) {
-  if (param?.ptrKind != null) return ptrOffsetIR(ir, param.ptrKind)
-  return asParamType(ir, param?.type)
-}
-
-/**
- * Materialize a multi-value function call as a heap array.
- * Call → store each result in temp → copy to allocated array → return pointer.
- */
-export function materializeMulti(callNode) {
-  const name = callNode[1]
-  const func = ctx.func.map.get(name)
-  const n = func.sig.results.length
-  const rawArgs = callNode.slice(2)
-  const argList = rawArgs.length === 1 && Array.isArray(rawArgs[0]) && rawArgs[0][0] === ','
-    ? rawArgs[0].slice(1) : rawArgs
-  const emittedArgs = argList.map((a, k) => emitArgForParam(emit(a), func.sig.params[k]))
-  while (emittedArgs.length < func.sig.params.length)
-    emittedArgs.push(func.sig.params[emittedArgs.length].type === 'i32' ? typed(['i32.const', 0], 'i32') : undefExpr())
-  const temps = Array.from({ length: n }, () => temp())
-  const out = allocPtr({ type: 1, len: n, tag: 'marr' })
-  const ir = [out.init, ['call', `$${name}`, ...emittedArgs]]
-  for (let k = n - 1; k >= 0; k--) ir.push(['local.set', `$${temps[k]}`])
-  for (let k = 0; k < n; k++)
-    ir.push(['f64.store', ['i32.add', ['local.get', `$${out.local}`], ['i32.const', k * 8]], ['local.get', `$${temps[k]}`]])
-  ir.push(out.ptr)
-  return typed(['block', ['result', 'f64'], ...ir], 'f64')
-}
-
-/** Emit let/const initializations as typed local.set instructions. */
-export function emitDecl(...inits) {
-  const result = []
-  for (let ii = 0; ii < inits.length; ii++) {
-    const i = inits[ii]
-    if (typeof i === 'string') {
-      const undef = undefExpr()
-      if (ctx.func.boxed.has(i)) {
-        const cell = ctx.func.boxed.get(i)
-        ctx.func.locals.set(cell, 'i32')
-        if (!ctx.func.preboxed?.has(i))
-          result.push(['local.set', `$${cell}`, ['call', '$__alloc', ['i32.const', 8]]])
-        result.push(['f64.store', ['local.get', `$${cell}`], undef])
-        continue
-      }
-      if (isGlobal(i)) {
-        if (!ctx.scope.globalTypes.has(i)) result.push(['global.set', `$${i}`, undef])
-        continue
-      }
-      result.push(['local.set', `$${i}`, undef])
-      continue
-    }
-    if (!Array.isArray(i) || i[0] !== '=') continue
-    const [, name, init] = i
-    if (typeof name !== 'string' || init == null) continue
-
-    // SRoA flat object: `let o = {a:1, b:2}` — dissolve fields into `o#i`
-    // locals, no heap alloc. Each field local ← asF64(value). Reads/writes are
-    // rewritten by the `.`/`[]` flat hooks. See scanFlatObjects (analyze.js).
-    // Monotonic-extension fields (`o.newProp = …`) carry no literal value —
-    // they init to undefined so a read before the write matches JS.
-    const flatDecl = ctx.func.flatObjects?.get(name)
-    if (flatDecl && Array.isArray(init) && init[0] === '{}') {
-      for (let j = 0; j < flatDecl.names.length; j++)
-        result.push(['local.set', `$${name}#${j}`,
-          flatDecl.values[j] === undefined ? undefExpr() : asF64(emit(flatDecl.values[j]))])
-      continue
-    }
-
-    // Multi-value ephemeral destructuring — skip heap alloc when temp is
-    // assigned from a multi-value call then immediately destructured element-by-element.
-    if (name.startsWith(T) && Array.isArray(init) && init[0] === '()' && typeof init[1] === 'string'
-      && ctx.func.names?.has(init[1])) {
-      const func = ctx.func.map.get(init[1])
-      const n = func?.sig.results.length
-      if (n > 1) {
-        const targets = []
-        let match = true
-        for (let k = 0; k < n && match; k++) {
-          const next = inits[ii + 1 + k]
-          if (!Array.isArray(next) || next[0] !== '=' || typeof next[1] !== 'string') { match = false; break }
-          const rhs = next[2]
-          if (!Array.isArray(rhs) || rhs[0] !== '[]' || rhs[1] !== name) { match = false; break }
-          const idx = rhs[2]
-          if (!Array.isArray(idx) || idx[0] != null || idx[1] !== k) { match = false; break }
-          if (ctx.func.boxed.has(next[1]) || isGlobal(next[1])) { match = false; break }
-          targets.push(next[1])
-        }
-        if (match && targets.length === n) {
-          const rawArgs = init.slice(2)
-          const argList = rawArgs.length === 1 && Array.isArray(rawArgs[0]) && rawArgs[0][0] === ','
-            ? rawArgs[0].slice(1) : rawArgs
-          const emittedArgs = argList.map((a, k) => emitArgForParam(emit(a), func.sig.params[k]))
-          while (emittedArgs.length < func.sig.params.length)
-            emittedArgs.push(func.sig.params[emittedArgs.length].type === 'i32' ? typed(['i32.const', 0], 'i32') : undefExpr())
-          result.push(['call', `$${init[1]}`, ...emittedArgs])
-          for (let k = n - 1; k >= 0; k--)
-            result.push(['local.set', `$${targets[k]}`])
-          ii += n
-          continue
-        }
-      }
-    }
-    // No-copy slice view: `let t = s.slice(...)` whose result scanSliceViews
-    // proved never escapes — lower the initializer to a SLICE_BIT view instead
-    // of a copying slice. Everything downstream treats `t` as an ordinary
-    // string. Gated here (not in the analysis) on a statically-known STRING
-    // receiver — param types are settled only by emit time — and on plain-local
-    // carriers (boxed/global escape); any miss falls back to the copying slice.
-    let viewInit = null
-    if (ctx.func.sliceViews?.has(name) && !ctx.func.boxed.has(name) && !isGlobal(name)
-        && Array.isArray(init) && init[0] === '()'
-        && Array.isArray(init[1]) && init[1][0] === '.' && init[1][2] === 'slice') {
-      const recv = init[1][1]
-      const recvVt = typeof recv === 'string' ? keyValType(recv) : valTypeOf(recv)
-      if (recvVt === VAL.STRING) {
-        const raw = init[2]
-        const sa = raw == null ? [] : Array.isArray(raw) && raw[0] === ',' ? raw.slice(1) : [raw]
-        viewInit = ctx.core.emit['.string:slice#view'](recv, sa[0], sa[1])
-      }
-    }
-
-    const isObjLit = Array.isArray(init) && init[0] === '{}'
-    if (isObjLit) ctx.schema.targetStack.push({ name, active: true })
-    const val = viewInit || emit(init)
-    if (isObjLit) ctx.schema.targetStack.pop()
-    // Direct-call dispatch for const-bound, non-escaping local closures: skip call_indirect.
-    // Gate: not boxed (no mutable cross-fn capture), not global, not reassigned in this body.
-    // isReassigned is conservative across nested arrow shadows — we miss the optimization
-    // rather than emit a wrong direct call.
-    if (Array.isArray(init) && init[0] === '=>' && val?.closureBodyName && !ctx.func.boxed.has(name) && !isGlobal(name)
-        && ctx.func.body && !isReassigned(ctx.func.body, name)) {
-      if (!ctx.func.directClosures) ctx.func.directClosures = new Map()
-      ctx.func.directClosures.set(name, val.closureBodyName)
-    }
-    if (ctx.func.boxed.has(name)) {
-      const cell = ctx.func.boxed.get(name)
-      ctx.func.locals.set(cell, 'i32')
-      if (!ctx.func.preboxed?.has(name))
-        result.push(['local.set', `$${cell}`, ['call', '$__alloc', ['i32.const', 8]]])
-      result.push(['f64.store', ['local.get', `$${cell}`], asF64(val)])
-      continue
-    }
-    if (isGlobal(name)) {
-      // Unboxed pointer const globals carry the raw i32 offset; init coerces via asPtrOffset.
-      const grep = repOfGlobal(name)
-      if (grep?.ptrKind != null) {
-        result.push(['global.set', `$${name}`, asPtrOffset(val, grep.ptrKind)])
-        continue
-      }
-      // Pre-folded numeric const globals have their init baked into the decl — skip.
-      if (ctx.scope.globalTypes.has(name)) continue
-      result.push(['global.set', `$${name}`, asF64(val)])
-      continue
-    }
-    const localType = ctx.func.locals.get(name) || 'f64'
-    let ptrKind = repOf(name)?.ptrKind
-    // Emit-time rep mutation (lifecycle: analysis → emit transition).
-    // Inherit ptrKind from a pointer-ABI RHS: destructure temps (`__d0 = v`) and other
-    // fresh let-bindings whose init is already an unboxed pointer. Without this, readVar
-    // returns an untyped i32 local.get and later `asF64` emits a numeric convert instead
-    // of a ptr-rebox. Safe because emitDecl runs once per let/const binding — no prior
-    // emit-time read could have observed the unset rep.
-    if (ptrKind == null && val.ptrKind != null && localType === 'i32' && !ctx.func.boxed?.has(name)) {
-      updateRep(name, { ptrKind: val.ptrKind })
-      ptrKind = val.ptrKind
-      if (val.ptrAux != null) {
-        updateRep(name, { ptrAux: val.ptrAux })
-        // OBJECT-only: aux *is* the schemaId; mirror to ctx.schema.vars + rep.schemaId so
-        // .prop slot resolution sees a precise binding. TYPED/CLOSURE aux carries other
-        // semantics (elem code / funcIdx) and must not leak into schema lookups.
-        if (val.ptrKind === VAL.OBJECT && !ctx.schema.vars?.has(name)) {
-          ctx.schema.vars.set(name, val.ptrAux)
-          updateRep(name, { schemaId: val.ptrAux })
-        }
-      }
-    }
-    let coerced
-    if (ptrKind != null) {
-      // Unboxed pointer local — extract i32 offset from NaN-boxed f64 via reinterpret, not numeric trunc.
-      // CLOSURE init carries funcIdx in val.closureFuncIdx; persist it on the rep so a later
-      // asF64 (escape: store, return, indirect-call rebox) reconstructs the correct table slot.
-      // Emit-time mutation — analyzeValTypes never sees closureFuncIdx.
-      if (ptrKind === VAL.CLOSURE && val.closureFuncIdx != null && repOf(name)?.ptrAux == null)
-        updateRep(name, { ptrAux: val.closureFuncIdx })
-      coerced = val.ptrKind === ptrKind ? val
-        : typed(['i32.wrap_i64', ['i64.reinterpret_f64', asF64(val)]], 'i32')
-    } else {
-      coerced = localType === 'f64' ? asF64(val) : val.type === 'i32' ? val : toI32(val)
-    }
-    if (!(isLit(coerced) && coerced[1] === 0 && !Object.is(coerced[1], -0) && !ctx.func.stack.length))
-      result.push(['local.set', `$${name}`, coerced])
-
-    const schemaId = ctx.schema.idOf?.(name)
-    if (ctx.func.localProps?.has(name) && schemaId != null) {
-      const schema = ctx.schema.resolve(name)
-      if (schema?.[0] === '__inner__') {
-        inc('__alloc_hdr', '__mkptr')
-        const bt = `${T}bx${ctx.func.uniq++}`
-        ctx.func.locals.set(bt, 'i32')
-        const innerName = `${name}${T}inner`
-        ctx.func.locals.set(innerName, 'f64')
-        result.push(
-          ['local.set', `$${innerName}`, ['local.get', `$${name}`]],
-          ['local.set', `$${bt}`, ['call', '$__alloc_hdr', ['i32.const', 0], ['i32.const', Math.max(1, schema.length)]]],
-          ['f64.store', ['local.get', `$${bt}`], ['local.get', `$${name}`]],
-          ...schema.slice(1).map((_, j) =>
-            ['f64.store', ['i32.add', ['local.get', `$${bt}`], ['i32.const', (j + 1) * 8]], ['f64.const', 0]]),
-          ['local.set', `$${name}`, mkPtrIR(PTR.OBJECT, schemaId, ['local.get', `$${bt}`])])
-      }
-    }
-  }
-  return result.length === 0 ? null : result.length === 1 ? result[0] : result
-}
-
-/**
- * Copy a spread source's elements into a destination array.
- *
- * `dest` is the destination data-base i32 local; `posLocal` the element index to
- * start writing at — advanced by the source length on exit. An ARRAY source is a
- * contiguous block of f64 NaN-boxes, so it copies with a single `memory.copy`; a
- * string/typed source needs a per-element decode. The source's *type* is
- * loop-invariant — it cannot change while the spread runs — so when it is not
- * statically known it is resolved exactly once (one `__ptr_type`) and branched,
- * never re-checked per element. Returns a list of IR instructions.
- */
-function emitSpreadCopy(dest, posLocal, srcLocal, srcLenLocal, staticVT) {
-  const srcI64 = () => ['i64.reinterpret_f64', ['local.get', `$${srcLocal}`]]
-  const destAddr = idx => ['i32.add', ['local.get', `$${dest}`], ['i32.shl', idx, ['i32.const', 3]]]
-  const arrCopy = () => (inc('__ptr_offset'),
-    ['memory.copy', destAddr(['local.get', `$${posLocal}`]),
-      ['call', '$__ptr_offset', srcI64()],
-      ['i32.shl', ['local.get', `$${srcLenLocal}`], ['i32.const', 3]]])
-  const scalarLoop = () => {
-    const sidx = `${T}sidx${ctx.func.uniq++}`
-    ctx.func.locals.set(sidx, 'i32')
-    const loopId = ctx.func.uniq++
-    const elem = ctx.module.modules['string']
-      ? ['if', ['result', 'f64'],
-          ['i32.eq', ['call', '$__ptr_type', srcI64()], ['i32.const', PTR.STRING]],
-          ['then', (inc('__str_idx'), ['call', '$__str_idx', srcI64(), ['local.get', `$${sidx}`]])],
-          ['else', (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])]]
-      : (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])
-    // Reset the counter on each entry — WASM zeroes locals once at function
-    // entry, but this loop re-executes when the spread sits inside a JS loop;
-    // a stale `sidx` (= prior srcLen) would skip the copy entirely.
-    return ['block', `$break${loopId}`,
-      ['local.set', `$${sidx}`, ['i32.const', 0]],
-      ['loop', `$loop${loopId}`,
-        ['br_if', `$break${loopId}`, ['i32.ge_s', ['local.get', `$${sidx}`], ['local.get', `$${srcLenLocal}`]]],
-        ['f64.store', destAddr(['i32.add', ['local.get', `$${posLocal}`], ['local.get', `$${sidx}`]]), elem],
-        ['local.set', `$${sidx}`, ['i32.add', ['local.get', `$${sidx}`], ['i32.const', 1]]],
-        ['br', `$loop${loopId}`]]]
-  }
-  const advance = ['local.set', `$${posLocal}`,
-    ['i32.add', ['local.get', `$${posLocal}`], ['local.get', `$${srcLenLocal}`]]]
-  if (staticVT === VAL.ARRAY) return [arrCopy(), advance]
-  if (staticVT === VAL.STRING || staticVT === VAL.TYPED) return [scalarLoop(), advance]
-  inc('__ptr_type')
-  return [['if',
-    ['i32.eq', ['call', '$__ptr_type', srcI64()], ['i32.const', PTR.ARRAY]],
-    ['then', arrCopy()],
-    ['else', scalarLoop()]], advance]
-}
-
-/**
- * Build an array from items, handling ['__spread', expr] markers.
- * Split into sections (normal arrays and spreads), then copy all into result.
- */
-export function buildArrayWithSpreads(items) {
-  const spreads = []
-  for (let i = 0; i < items.length; i++) {
-    if (Array.isArray(items[i]) && items[i][0] === '__spread') {
-      spreads.push({ pos: i, expr: items[i][1] })
-    }
-  }
-
-  if (spreads.length === 0) {
-    return emit(['[', ...items])
-  }
-
-  const sections = []
-  let currentArray = []
-
-  for (let i = 0; i < items.length; i++) {
-    if (Array.isArray(items[i]) && items[i][0] === '__spread') {
-      if (currentArray.length > 0) {
-        sections.push({ type: 'array', items: currentArray })
-        currentArray = []
-      }
-      sections.push({ type: 'spread', expr: items[i][1] })
-    } else {
-      currentArray.push(items[i])
-    }
-  }
-  if (currentArray.length > 0) {
-    sections.push({ type: 'array', items: currentArray })
-  }
-
-  // A single all-normal section is a plain literal — defer to the `[` emitter.
-  // A single *spread* section is NOT shortcut to `emit(sec.expr)`: that would
-  // alias the source, but `[...x]` must yield a fresh array. It falls through
-  // to the alloc + emitSpreadCopy path below, which copies.
-  if (sections.length === 1 && sections[0].type === 'array') {
-    return emit(['[', ...sections[0].items])
-  }
-
-  const len = tempI32('len')
-  const pos = tempI32('pos')
-  const out = allocPtr({ type: 1, len: ['local.get', `$${len}`], tag: 'arr' })
-  const result = out.local
-
-  const ir = []
-  inc('__len')
-
-  // Pass 1 — evaluate every section IN SOURCE ORDER into temps. JS spread keeps
-  // strict left-to-right order: a later spread whose source mutates an earlier
-  // element's input must still observe the pre-mutation value. Array items
-  // become per-item f64 temps; spreads become a ptr temp + a cached __len.
-  for (const sec of sections) {
-    if (sec.type === 'array') {
-      sec.itemLocals = []
-      for (let i = 0; i < sec.items.length; i++) {
-        const it = `${T}ai${ctx.func.uniq++}`
-        ctx.func.locals.set(it, 'f64')
-        sec.itemLocals.push(it)
-        ir.push(['local.set', `$${it}`, asF64(emit(sec.items[i]))])
-      }
-    } else {
-      sec.local = `${T}sp${ctx.func.uniq++}`
-      ctx.func.locals.set(sec.local, 'f64')
-      sec.lenLocal = `${T}spl${ctx.func.uniq++}`
-      ctx.func.locals.set(sec.lenLocal, 'i32')
-      // A materialized multi-value is not a statically-typed pointer — let
-      // emitSpreadCopy resolve its kind at runtime via its one-time __ptr_type branch.
-      sec.val = multiCount(sec.expr) ? undefined : valTypeOf(sec.expr)
-      const n = multiCount(sec.expr)
-      ir.push(['local.set', `$${sec.local}`, n ? materializeMulti(sec.expr) : asF64(emit(sec.expr))])
-      // Cache __len once per spread; reused below for total-len sum and the copy.
-      ir.push(['local.set', `$${sec.lenLocal}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${sec.local}`]]]])
-    }
-  }
-
-  // Pass 2 — total length (array sections statically sized, spreads cached above).
-  ir.push(['local.set', `$${len}`, ['i32.const', 0]])
-  for (const sec of sections) {
-    if (sec.type === 'array') {
-      ir.push(['local.set', `$${len}`, ['i32.add', ['local.get', `$${len}`], ['i32.const', sec.items.length]]])
-    } else {
-      ir.push(['local.set', `$${len}`, ['i32.add', ['local.get', `$${len}`], ['local.get', `$${sec.lenLocal}`]]])
-    }
-  }
-
-  // Pass 3 — allocate exact, then store the pre-evaluated temps.
-  ir.push(out.init, ['local.set', `$${pos}`, ['i32.const', 0]])
-  for (const sec of sections) {
-    if (sec.type === 'array') {
-      for (const it of sec.itemLocals) {
-        ir.push(
-          ['f64.store',
-            ['i32.add', ['local.get', `$${result}`], ['i32.shl', ['local.get', `$${pos}`], ['i32.const', 3]]],
-            ['local.get', `$${it}`]],
-          ['local.set', `$${pos}`, ['i32.add', ['local.get', `$${pos}`], ['i32.const', 1]]]
-        )
-      }
-    } else {
-      ir.push(...emitSpreadCopy(result, pos, sec.local, sec.lenLocal, sec.val))
-    }
-  }
-
-  ir.push(out.ptr)
-  return typed(['block', ['result', 'f64'], ...ir], 'f64')
-}
-
-/** Check if node is a block body (statement list, not object literal/expression) */
-const isBlockBody = n => Array.isArray(n) && n[0] === '{}' && n.length === 2 && Array.isArray(n[1]) && STMT_OPS.has(n[1]?.[0])
-
-/** Emit node in void context: emit + drop any value. Block bodies route through emitBody. */
-export function emitFlat(node) {
-  if (isBlockBody(node)) return emitBody(node)
-  const ir = emit(node, 'void')
-  const items = flat(ir)
-  if (ir?.type && ir.type !== 'void') items.push('drop')
-  return items
-}
-
-/** Emit block body as flat list of WASM instructions. Unwraps {} and delegates to emitFlat per statement.
- *  Also drives early-return refinement: `if (!guard) return/throw` narrows `guard` for the
- *  rest of the enclosing block. Refinements added here are rolled back on block exit. */
-export function emitBody(node) {
-  const inner = node[1]
-  const stmts = Array.isArray(inner) && inner[0] === ';' ? inner.slice(1) : [inner]
-  const out = []
-  const accumulated = []
-  for (let i = 0; i < stmts.length; i++) {
-    const s = stmts[i]
-    if (s == null || typeof s === 'number') continue
-    out.push(...emitFlat(s))
-    // After an `if (cond) terminator` (no else), narrow types from !cond for subsequent statements.
-    // Skip names that are reassigned later — refinement would be unsound past the assignment.
-    if (Array.isArray(s) && s[0] === 'if' && s[3] == null && isTerminator(s[2])) {
-      const refs = extractRefinements(s[1], new Map(), false)
-      for (const [name, fact] of refs) {
-        let reassigned = false
-        for (let j = i + 1; j < stmts.length; j++)
-          if (isReassigned(stmts[j], name)) { reassigned = true; break }
-        if (reassigned) continue
-        const cur = ctx.func.refinements.get(name)
-        accumulated.push([name, cur])
-        // Merge so sibling early-returns layering on the same name compose
-        // (e.g. `if (typeof x === 'string') return; if (Array.isArray(x)) return;`
-        // leaves both `notString: true` and would-be array exclusion stacked).
-        ctx.func.refinements.set(name, cur ? { ...cur, ...fact } : fact)
-      }
-    }
-  }
-  // Restore prior refinements on block exit.
-  for (let i = accumulated.length - 1; i >= 0; i--) {
-    const [name, prev] = accumulated[i]
-    if (prev === undefined) ctx.func.refinements.delete(name); else ctx.func.refinements.set(name, prev)
-  }
-  return out
-}
-
-// A VAL.BOOL value rides the cheap 0/1 numeric carrier, and `ToNumber(bool)` is
-// exactly that carrier — so for relational / loose-equality coercion a boolean
-// behaves identically to a number. Normalize it before the type-directed compare
-// dispatch (the BOOL fact still drives typeof / String / boundary boxing; only
-// these arithmetic-shaped operators read it as numeric).
-const numericVal = vt => vt === VAL.BOOL ? VAL.NUMBER : vt
-
-// Primitive value-type classes for strict-equality type-mismatch folding. Two
-// operands of different known classes — when at least one is a primitive — can
-// never be `===` (number/boolean/string/bigint don't cross-coerce under `===`).
-// Two *reference* kinds (array vs object, …) fall through to the shared ref-eq
-// path instead, which already resolves distinct pointers to `false`.
-const STRICT_PRIM = new Set([VAL.NUMBER, VAL.BOOL, VAL.STRING, VAL.BIGINT])
-
-/**
- * Strict `===`/`!==`. Unlike loose `==`, no coercion: a statically-known type
- * mismatch folds to a constant (`true === 1` → false, `"1" === 1` → false). When
- * the types match — or one side is statically unknown — the result is bit-for-bit
- * identical to loose `==` on same-type operands, so we delegate to it.
- *
- * Two carrier-level limitations remain (documented gaps, not regressions):
- *  • booleans and numbers share the 0/1 carrier, so `1 === trueDynamic` can only
- *    be told apart when the boolean's type is statically known;
- *  • jz unifies `null` and `undefined` into one NaN-boxed sentinel, so
- *    `null === undefined` is `true` (same as `==`).
- */
-function emitStrictEq(a, b, negate) {
-  // `typeof x === 'type'` (prepare rewrote the literal to a numeric code) — typeof
-  // always yields a string, so strict and loose agree; reuse the loose lowering.
-  const tc = emitTypeofCmp(a, b, negate ? 'ne' : 'eq'); if (tc) return tc
-  // Known, differing primitive classes can never be strictly equal.
-  const rawA = resolveValType(a, valTypeOf, lookupValType)
-  const rawB = resolveValType(b, valTypeOf, lookupValType)
-  if (rawA && rawB && rawA !== rawB && (STRICT_PRIM.has(rawA) || STRICT_PRIM.has(rawB)))
-    return emitNum(negate ? 1 : 0)
-  // Same type (or dynamic-unknown): identical bits to loose `==`/`!=`.
-  return emitter[negate ? '!=' : '=='](a, b)
-}
-
-/** Comparison op factory with constant folding. */
-const cmpOp = (i32op, f64op, fn) => (a, b) => {
-  const va = emit(a), vb = emit(b)
-  // Skip the const-fold for `.unsigned` operands: `litVal` is the signed bit pattern
-  // (-1, not 4294967295), so folding the order would be wrong. Fall through to the
-  // f64 widen path below, which converts each operand by its own signedness.
-  if (isLit(va) && isLit(vb) && !va.unsigned && !vb.unsigned) return emitNum(fn(litVal(va), litVal(vb)) ? 1 : 0)
-  // String compare: NaN-boxed string pointers compare as NaN under f64.lt/gt
-  // (always false), so without this the spec-correct `"a" < "b"` returns 0.
-  // Route both-STRING operands through __str_cmp's three-way result, then apply
-  // the same i32 sign op as numeric (lt_s/gt_s/le_s/ge_s vs 0).
-  const vta = numericVal(resolveValType(a, valTypeOf, lookupValType))
-  const vtb = numericVal(resolveValType(b, valTypeOf, lookupValType))
-  if (vta === VAL.BIGINT || vtb === VAL.BIGINT) {
-    const op = bigintUnsignedBound(a) || bigintUnsignedBound(b) ? i32op.replace('_s', '_u') : i32op
-    return typed([`i64.${op}`, asI64(va), asI64(vb)], 'i32')
-  }
-  if (vta === VAL.STRING && vtb === VAL.STRING) {
-    return typed([`i32.${i32op}`, ctx.abi.string.ops.cmp(asF64(va), asF64(vb), ctx), ['i32.const', 0]], 'i32')
-  }
-  // Exactly one operand is a known string; the other has no static type, so it
-  // may hold a string pointer at runtime (e.g. `c >= '0'` where `c` came from
-  // `s[i]` on an untyped receiver). JS relational compare is lexicographic only
-  // when *both* sides are strings, else it ToNumbers both. The f64 path below
-  // would compare the unknown side's NaN-boxed string bits as a float (NaN ⇒
-  // always false), so dispatch at runtime on the unknown side: string → __str_cmp
-  // three-way; else ToNumber both. Mirrors `+`'s __is_str_key string dispatch.
-  // Gated on a *known-string* counterpart, so numeric loops (`i < n`) never pay
-  // the check — comparing against a string literal signals string intent.
-  if (((vta === VAL.STRING && vtb == null) || (vtb === VAL.STRING && vta == null)) && ctx.abi.string?.ops?.cmp) {
-    const unkIsA = vta == null
-    const ta = temp('cmp'), tb = temp('cmp')
-    inc('__is_str_key')
-    const getA = typed(['local.get', `$${ta}`], 'f64'), getB = typed(['local.get', `$${tb}`], 'f64')
-    const check = ['call', '$__is_str_key', ['i64.reinterpret_f64', ['local.get', `$${unkIsA ? ta : tb}`]]]
-    const strCmp = [`i32.${i32op}`, ctx.abi.string.ops.cmp(getA, getB, ctx), ['i32.const', 0]]
-    const numCmp = [`f64.${f64op}`, toNumF64(a, getA), toNumF64(b, getB)]
-    return typed(['block', ['result', 'i32'],
-      ['local.set', `$${ta}`, asF64(va)],
-      ['local.set', `$${tb}`, asF64(vb)],
-      ['if', ['result', 'i32'], check, ['then', strCmp], ['else', numCmp]]], 'i32')
-  }
-  if (vta === VAL.DATE || vtb === VAL.DATE) {
-    const dateNum = (node, v, vt) => {
-      if (vt !== VAL.DATE) return toNumF64(node, v)
-      const ptr = v.ptrKind === VAL.DATE
-        ? v
-        : ['i32.wrap_i64', ['i64.reinterpret_f64', asF64(v)]]
-      return typed(['f64.load', ptr], 'f64')
-    }
-    return typed([`f64.${f64op}`, dateNum(a, va, vta), dateNum(b, vb, vtb)], 'i32')
-  }
-  if (vtb === VAL.NUMBER && needsRelationalToNumber(a, vta))
-    return typed([`f64.${f64op}`, toNumF64(a, va), asF64(vb)], 'i32')
-  if (vta === VAL.NUMBER && needsRelationalToNumber(b, vtb))
-    return typed([`f64.${f64op}`, asF64(va), toNumF64(b, vb)], 'i32')
-  // An `.unsigned` i32 operand ([0, 2^32)) can't share a signed i32 compare with a
-  // possibly-signed one: mixed sign inverts the order (3 < 0xFFFFFFFF unsigned, but
-  // 3 > -1 signed). Widen to f64, where asF64 converts each operand by its own
-  // signedness (convert_i32_u for unsigned, _s otherwise) to its true numeric value.
-  if (!va.unsigned && !vb.unsigned) {
-    const ai = intConstValue(a), bi = intConstValue(b)
-    if (va.type === 'i32' && bi != null) return typed([`i32.${i32op}`, va, ['i32.const', bi]], 'i32')
-    if (vb.type === 'i32' && ai != null) return typed([`i32.${i32op}`, ['i32.const', ai], vb], 'i32')
-    if (va.type === 'i32' && vb.type === 'i32') return typed([`i32.${i32op}`, va, vb], 'i32')
-  }
-  return typed([`f64.${f64op}`, asF64(va), asF64(vb)], 'i32')
-}
-
-function needsRelationalToNumber(expr, vt) {
-  if (vt === VAL.STRING) return true
-  if (vt != null) return false
-  return mayReadBoxedValue(expr)
-}
-
-function needsLooseEqualityToNumber(expr, vt) {
-  if (vt === VAL.STRING) return true
-  if (vt != null) return false
-  return mayReadBoxedValue(expr)
-}
-
-function looseNumberEq(numIR, otherNode, otherIR, negate = false) {
-  const t = temp('eq')
-  const other = typed(['local.get', `$${t}`], 'f64')
-  const cmp = ['f64.eq', asF64(numIR), toNumF64(otherNode, other)]
-  return typed(['block', ['result', 'i32'],
-    ['local.set', `$${t}`, asF64(otherIR)],
-    ['if', ['result', 'i32'], isNullish(other),
-      ['then', ['i32.const', negate ? 1 : 0]],
-      ['else', negate ? ['i32.eqz', cmp] : cmp]]], 'i32')
-}
-
-function mayReadBoxedValue(expr) {
-  return Array.isArray(expr) && (expr[0] === '.' || expr[0] === '[]' || expr[0] === '?.' || expr[0] === '?.[]')
-}
-
-function intConstValue(expr) {
-  if (typeof expr === 'number' && Number.isInteger(expr)) return expr
-  if (Array.isArray(expr) && expr[0] == null && typeof expr[1] === 'number' && Number.isInteger(expr[1])) return expr[1]
-  if (typeof expr === 'string') {
-    const v = repOf(expr)?.intConst
-    if (v != null) return v
-  }
-  return null
-}
-
-function bigintUnsignedBound(expr) {
-  const n = bigintConstValue(expr)
-  return n != null && n > 0x7fffffffffffffffn && n <= 0xffffffffffffffffn
-}
-
-function bigintConstValue(expr) {
-  if (typeof expr === 'bigint') return expr
-  if (!Array.isArray(expr)) return null
-  if (expr[0] == null && typeof expr[1] === 'bigint') return expr[1]
-  if (expr[0] === 'u-') {
-    const n = bigintConstValue(expr[1])
-    return n == null ? null : -n
-  }
-  return null
-}
-
-function arrayIndexKey(key) {
-  const n = Number(key)
-  const u = n >>> 0
-  return String(u) === key && u !== 0xffffffff ? u : null
-}
-
-/** Compound assignment: read → op → write back (via readVar/writeVar). */
-function compoundAssign(name, val, f64op, i32op) {
-  if (typeof name === 'string' && isConst(name)) err(`Assignment to const '${name}'`)
-  const void_ = _expect === 'void'
-  const va = readVar(name), vb = emit(val)
-  // Peel f64.convert_i32_s/u when va is i32 — typed-array integer reads wrap their
-  // i32.load in convert_i32_* by default, but the i32 arithmetic path can use the
-  // raw i32 directly (eliminates per-iter widen + saturating-trunc roundtrip on
-  // hot accumulator loops like `let s = 0; for (...) s += i32arr[i]`).
-  let vbi = vb
-  if (i32op && va.type === 'i32' && vb.type !== 'i32' &&
-      Array.isArray(vb) && (vb[0] === 'f64.convert_i32_s' || vb[0] === 'f64.convert_i32_u')) {
-    const inner = vb[1]
-    vbi = Array.isArray(inner) ? typed(inner, 'i32') : inner
-  }
-  if (i32op && va.type === 'i32' && vbi.type === 'i32')
-    return writeVar(name, i32op(va, vbi), void_)
-  return writeVar(name, f64op(asF64(va), asF64(vb)), void_)
-}
-
-/**
- * Core emitter table. Maps AST ops to WASM IR generators.
- * ctx.core.emit is seeded with a flat copy of this object on reset;
- * modules add or override ops on ctx.core.emit directly.
- * @type {Record<string, (...args: any[]) => Array>}
- */
-export const emitter = {
-  // === Spread operator ===
-  // Note: spread is handled specially in call contexts; this catches stray uses
-  '...': () => err('Spread (...) can only be used in function/method calls or array literals'),
-
-  // === Statements ===
-
-  ';': (...args) => {
-    const out = []
-    for (const a of args) {
-      out.push(...emitFlat(a))
-    }
-    return out
-  },
-  '{': (...args) => args.map(emit).filter(x => x != null),
-  ',': (...args) => {
-    const results = args.map(emit).filter(x => x != null)
-    if (results.length === 0) return null
-    if (results.length === 1) return results[0]
-    const last = results[results.length - 1]
-    // Flatten: multi-instruction arrays (from ';') need spreading, typed nodes need drop
-    const spread = r => Array.isArray(r) && Array.isArray(r[0]) ? r : [r]
-    const dropSpread = r => r.type ? [['drop', r]] : spread(r)
-    // If last expression is void (store, etc.), add explicit return value
-    if (!last.type) {
-      return typed(['block', ['result', 'f64'],
-        ...results.flatMap(dropSpread),
-        ['f64.const', 0]], 'f64')
-    }
-    return typed(['block', ['result', last.type],
-      ...results.slice(0, -1).flatMap(dropSpread), last], last.type)
-  },
-  'let': emitDecl,
-  'const': emitDecl,
-  'export': () => null,
-  // 'block' can appear from jzify transforming labeled blocks or as WASM block IR
-  'block': (...args) => {
-    // WASM block IR: first arg is ['result', type] → pass through, preserve type
-    if (Array.isArray(args[0]) && args[0][0] === 'result')
-      return typed(['block', ...args], args[0][1])
-    const inner = args.length === 1 ? args[0] : [';', ...args]
-    return emitFlat(['{}', inner])
-  },
-
-  'throw': expr => {
-    ctx.runtime.throws = ctx.runtime.userThrows = true
-    const thrown = temp()
-    return typed(['block',
-      ['local.set', `$${thrown}`, asF64(emit(expr))],
-      ['global.set', '$__jz_last_err_bits', ['i64.reinterpret_f64', ['local.get', `$${thrown}`]]],
-      ['throw', '$__jz_err', ['local.get', `$${thrown}`]]], 'void')
-  },
-
-  'catch': (body, errName, handler) => {
-    if (!canThrow(body)) return emitFlat(body)
-
-    ctx.runtime.throws = ctx.runtime.userThrows = true
-    const id = ctx.func.uniq++
-    ctx.func.locals.set(errName, 'f64')
-    const prev = ctx.func.inTry; ctx.func.inTry = true
-    let bodyIR; try { bodyIR = emitFlat(body) } finally { ctx.func.inTry = prev }
-    const handlerIR = emitFlat(handler)
-    return typed(['block', `$outer${id}`, ['result', 'f64'],
-      ['block', `$catch${id}`, ['result', 'f64'],
-        ['try_table', ['catch', '$__jz_err', `$catch${id}`],
-          ...bodyIR],
-        ['f64.const', 0],
-        ['br', `$outer${id}`]],
-      ['local.set', `$${errName}`],
-      ...handlerIR,
-      ['f64.const', 0]], 'f64')
-  },
-
-  'finally': (body, cleanup) => {
-    if (!canThrow(body)) {
-      const parentStack = ctx.func.finallyStack || []
-      const activeStack = parentStack.concat([cleanup])
-      const bodyIR = withFinallyStack(activeStack, () => emitFlat(body))
-      const cleanupIR = isTerminator(body) ? [] : withFinallyStack(parentStack, () => emitFlat(cleanup))
-      return [...bodyIR, ...cleanupIR]
-    }
-
-    ctx.runtime.throws = ctx.runtime.userThrows = true
-    const id = ctx.func.uniq++
-    const errLocal = temp('err')
-    const parentStack = ctx.func.finallyStack || []
-    const activeStack = parentStack.concat([cleanup])
-
-    const prevTry = ctx.func.inTry
-    ctx.func.inTry = true
-    const bodyIR = withFinallyStack(activeStack, () => {
-      try { return emitFlat(body) }
-      finally { ctx.func.inTry = prevTry }
-    })
-    const normalCleanup = withFinallyStack(parentStack, () => emitFlat(cleanup))
-    const throwCleanup = withFinallyStack(parentStack, () => emitFlat(cleanup))
-
-    return ['block', `$fin_done${id}`,
-      ['block', `$fin_catch${id}`, ['result', 'f64'],
-        ['try_table', ['catch', '$__jz_err', `$fin_catch${id}`],
-          ...bodyIR],
-        ...normalCleanup,
-        ['br', `$fin_done${id}`]],
-      ['local.set', `$${errLocal}`],
-      ...throwCleanup,
-      ['global.set', '$__jz_last_err_bits', ['i64.reinterpret_f64', ['local.get', `$${errLocal}`]]],
-      ['throw', '$__jz_err', ['local.get', `$${errLocal}`]]]
-  },
-
-  'return': expr => {
-    const finalizers = emitFinalizers()
-    const finalizerBlock = () => [['block', ...finalizers]]
-    if (ctx.func.current?.results.length > 1 && Array.isArray(expr) && expr[0] === '[') {
-      const vals = expr.slice(1).map(e => asF64(emit(e)))
-      if (finalizers.length === 0) return typed(['return', ...vals], 'void')
-      const names = vals.map(() => temp('ret'))
-      return [
-        ...vals.map((v, i) => ['local.set', `$${names[i]}`, v]),
-        ...finalizerBlock(),
-        typed(['return', ...names.map(n => ['local.get', `$${n}`])], 'void'),
-      ]
-    }
-    if (expr == null) return [...finalizers, typed(['return', NULL_IR], 'void')]
-    const rt = ctx.func.current?.results[0] || 'f64'
-    const pk = ctx.func.current?.ptrKind
-    const ir = pk != null ? asPtrOffset(emit(expr), pk) : asParamType(emit(expr), rt)
-    const ty = pk != null ? 'i32' : rt
-    const tcoed = tcoTailRewrite(ir, ty)
-    if (Array.isArray(tcoed) && tcoed[0] === 'return_call' && finalizers.length === 0) {
-      return typed(tcoed, 'void')
-    }
-    if (finalizers.length > 0) {
-      const name = ty === 'i32' ? tempI32('ret') : ty === 'i64' ? tempI64('ret') : temp('ret')
-      return [
-        ['local.set', `$${name}`, tcoed],
-        ...finalizerBlock(),
-        typed(['return', ['local.get', `$${name}`]], 'void'),
-      ]
-    }
-    return typed(['return', tcoed], 'void')
-  },
-
-  // === Assignment ===
-
-  '=': (name, val) => {
-    if (typeof name === 'string' && isConst(name)) err(`Assignment to const '${name}'`)
-    const void_ = _expect === 'void'
-    // Array index assignment: arr[i] = x
-    if (Array.isArray(name) && name[0] === '[]') {
-      const [, arr, idx] = name
-      const keyType = keyValType(idx)
-      // A provably-numeric index name — an int-certain loop counter or a
-      // NUMBER-typed local — can never be a string key, so the runtime
-      // `__is_str_key` → `__dyn_set` dispatch is dead. Mirrors the index *read*
-      // path (`intIndexIR`), closing the read/write asymmetry on `arr[i] = …`
-      // inside refined-array loops (e.g. watr's recursive AST walkers).
-      const idxNumericName = typeof idx === 'string' &&
-        (repOf(idx)?.intCertain === true || repOf(idx)?.val === VAL.NUMBER)
-      const useRuntimeKeyDispatch = !idxNumericName &&
-        (keyType == null || (typeof idx === 'string' && keyType !== VAL.STRING))
-      const keyExpr = asF64(emit(idx))
-      const valueExpr = asF64(emit(val))
-      const storeArrayValue = (arrExpr, idxNode, persist) => {
-        const arrTmp = `${T}asi${ctx.func.uniq++}`
-        const idxTmp = `${T}asj${ctx.func.uniq++}`
-        const valTmp = `${T}asv${ctx.func.uniq++}`
-        ctx.func.locals.set(arrTmp, 'f64')
-        ctx.func.locals.set(idxTmp, 'i32')
-        ctx.func.locals.set(valTmp, 'f64')
-        inc('__arr_set_idx_ptr')
-        const body = [
-          ['local.set', `$${arrTmp}`, arrExpr],
-          ['local.set', `$${idxTmp}`, asI32(typed(idxNode, 'f64'))],
-          ['local.set', `$${valTmp}`, valueExpr],
-          ['local.set', `$${arrTmp}`, ['call', '$__arr_set_idx_ptr', ['i64.reinterpret_f64', ['local.get', `$${arrTmp}`]], ['local.get', `$${idxTmp}`], ['local.get', `$${valTmp}`]]],
-        ]
-        if (persist) body.push(persist(['local.get', `$${arrTmp}`]))
-        body.push(['local.get', `$${valTmp}`])
-        return typed(['block', ['result', 'f64'], ...body], 'f64')
-      }
-      const setDyn = () => {
-        if (ctx.transform.strict)
-          err(`strict mode: dynamic property assignment \`${typeof arr === 'string' ? arr : '<expr>'}[<expr>] = ...\` falls back to __dyn_set. Use a literal key or known array/typed-array numeric index, or pass { strict: false }.`)
-        inc('__dyn_set')
-        return typed(['f64.reinterpret_i64', ['call', '$__dyn_set', asI64(emit(arr)), asI64(keyExpr), asI64(valueExpr)]], 'f64')
-      }
-      const dispatchKey = (numericIR) => {
-        if (ctx.transform.strict)
-          err(`strict mode: dynamic property assignment \`${typeof arr === 'string' ? arr : '<expr>'}[<expr>] = ...\` falls back to __dyn_set. Use a literal key or known array/typed-array numeric index, or pass { strict: false }.`)
-        const keyTmp = temp()
-        return typed(['block', ['result', 'f64'],
-          ['local.set', `$${keyTmp}`, keyExpr],
-          ['if', ['result', 'f64'], ['call', '$__is_str_key', ['i64.reinterpret_f64', ['local.get', `$${keyTmp}`]]],
-            ['then', ['f64.reinterpret_i64', ['call', '$__dyn_set', asI64(emit(arr)), ['i64.reinterpret_f64', ['local.get', `$${keyTmp}`]], asI64(valueExpr)]]],
-            ['else', numericIR(['local.get', `$${keyTmp}`])]]], 'f64')
-      }
-      // Literal string key on schema-known object → direct payload slot write (skip __dyn_set)
-      const litKey = isLiteralStr(idx) ? idx[1]
-        : typeof arr === 'string' && lookupValType(arr) === VAL.OBJECT ? staticPropertyKey(idx)
-        : null
-      // SRoA flat object: `o['k'] = x` → `local.set $o#i` (no heap store).
-      if (litKey != null && typeof arr === 'string' && ctx.func.flatObjects?.has(arr)) {
-        const fo = ctx.func.flatObjects.get(arr)
-        const fi = fo.names.indexOf(litKey)
-        if (fi >= 0) {
-          const t = temp()
-          return typed(['block', ['result', 'f64'],
-            ['local.set', `$${t}`, valueExpr],
-            ['local.set', `$${arr}#${fi}`, ['local.get', `$${t}`]],
-            ['local.get', `$${t}`]], 'f64')
-        }
-      }
-      if (litKey != null && typeof arr === 'string' && ctx.schema.find) {
-        const slot = ctx.schema.find(arr, litKey)
-        if (slot >= 0) {
-          const t = temp()
-          return typed(['block', ['result', 'f64'],
-            ['local.set', `$${t}`, valueExpr],
-            ctx.abi.object.ops.store(ptrOffsetIR(asF64(emit(arr)), lookupValType(arr) || VAL.OBJECT), slot, ['local.get', `$${t}`]),
-            ['local.get', `$${t}`]], 'f64')
-        }
-      }
-      const arrIndex = litKey != null ? arrayIndexKey(litKey) : null
-      if (arrIndex != null && typeof arr === 'string' && keyValType(arr) === VAL.ARRAY) {
-        const persist = ptr => {
-          if (ctx.func.boxed?.has(arr)) return ['f64.store', boxedAddr(arr), ptr]
-          if (isGlobal(arr)) return ['global.set', `$${arr}`, ptr]
-          return ['local.set', `$${arr}`, ptr]
-        }
-        return storeArrayValue(asF64(emit(arr)), typed(['f64.const', arrIndex], 'f64'), persist)
-      }
-      if (keyType === VAL.STRING) return setDyn()
-      if (typeof arr === 'string' && ctx.core.emit['.typed:[]='] &&
-          lookupValType(arr) === 'typed') {
-        const r = ctx.core.emit['.typed:[]=']?.(arr, idx, val, void_)
-        if (r) return r
-        // Element ctor unknown — runtime aux-byte dispatch. __typed_set_idx
-        // returns the stored value as f64, used directly as the expr result.
-        inc('__typed_set_idx')
-        return typed(['call', '$__typed_set_idx',
-          asI64(emit(arr)), asI32(emit(idx)), valueExpr], 'f64')
-      }
-      if (typeof arr === 'string' && ctx.schema.isBoxed?.(arr)) {
-        const inner = ctx.schema.emitInner(arr)
-        const arrVT = lookupValType(arr) || VAL.OBJECT
-        const storeNumeric = keyNode => storeArrayValue(inner, keyNode, ptr =>
-          ['f64.store', ptrOffsetIR(asF64(emit(arr)), arrVT), ptr])
-        if (useRuntimeKeyDispatch) {
-          inc('__dyn_set', '__is_str_key')
-          return dispatchKey(storeNumeric)
-        }
-        return typed(storeNumeric(keyExpr), 'f64')
-      }
-      const va = emit(arr), vi = asI32(emit(idx)), vv = valueExpr, t = temp()
-      if (typeof arr === 'string' && keyValType(arr) === VAL.ARRAY) {
-        const persist = ptr => {
-          if (ctx.func.boxed?.has(arr)) return ['f64.store', boxedAddr(arr), ptr]
-          if (isGlobal(arr)) return ['global.set', `$${arr}`, ptr]
-          return ['local.set', `$${arr}`, ptr]
-        }
-        if (useRuntimeKeyDispatch) {
-          inc('__dyn_set', '__is_str_key')
-          return dispatchKey(keyNode => storeArrayValue(asF64(va), keyNode, persist))
-        }
-        return storeArrayValue(asF64(va), keyExpr, persist)
-      }
-      // arr is non-ARRAY here (VAL.ARRAY branch was taken above); safe to skip forwarding.
-      const knownArrVT = typeof arr === 'string' ? lookupValType(arr) : null
-      const arrVT = knownArrVT || VAL.OBJECT
-      if (useRuntimeKeyDispatch) {
-        inc('__dyn_set', '__is_str_key')
-        // When arr type is unknown (could be TypedArray) and __typed_set_idx is
-        // available, dispatch the numeric branch through __ptr_type so TypedArray
-        // writes go by element type. Without this, ternary-typed arrays (e.g.
-        // `num === 4 ? new Uint32Array(4) : new Uint8Array(16)`) would silently
-        // f64.store boxed bytes regardless of element width.
-        const hasTypedSet = !!ctx.core.stdlib['__typed_set_idx']
-        if (knownArrVT == null && hasTypedSet) {
-          const objTmp = temp('asu')
-          const idxTmp = tempI32('asi')
-          inc('__ptr_type', '__typed_set_idx')
-          return dispatchKey(keyNode => {
-            const keyI32 = asI32(typed(keyNode, 'f64'))
-            return ['block', ['result', 'f64'],
-              ['local.set', `$${objTmp}`, asF64(va)],
-              ['local.set', `$${idxTmp}`, keyI32],
-              ['local.set', `$${t}`, vv],
-              ['if', ['result', 'f64'],
-                ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]]], ['i32.const', PTR.TYPED]],
-                ['then', ['call', '$__typed_set_idx', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]], ['local.get', `$${idxTmp}`], ['local.get', `$${t}`]]],
-                ['else', ['block', ['result', 'f64'],
-                  ['f64.store', ['i32.add', ptrOffsetIR(['local.get', `$${objTmp}`], arrVT), ['i32.shl', ['local.get', `$${idxTmp}`], ['i32.const', 3]]], ['local.get', `$${t}`]],
-                  ['local.get', `$${t}`]]]]]
-          })
-        }
-        return dispatchKey(keyNode => {
-          const keyI32 = asI32(typed(keyNode, 'f64'))
-          return ['block', ['result', 'f64'],
-            ['local.set', `$${t}`, vv],
-            ['f64.store', ['i32.add', ptrOffsetIR(asF64(va), arrVT), ['i32.shl', keyI32, ['i32.const', 3]]], ['local.get', `$${t}`]],
-            ['local.get', `$${t}`]]
-        })
-      }
-      if (typeof arr !== 'string') {
-        const objTmp = temp('asu')
-        const idxTmp = tempI32('asi')
-        const ptrTmp = temp('asp')
-        const hasTypedSet = !!ctx.core.stdlib['__typed_set_idx']
-        inc('__ptr_type', '__arr_set_idx_ptr')
-        if (hasTypedSet) inc('__typed_set_idx')
-        return typed(['block', ['result', 'f64'],
-          ['local.set', `$${objTmp}`, asF64(va)],
-          ['local.set', `$${idxTmp}`, vi],
-          ['local.set', `$${t}`, vv],
-          ['if', ['result', 'f64'],
-            ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]]], ['i32.const', PTR.ARRAY]],
-            ['then', ['block', ['result', 'f64'],
-              ['local.set', `$${ptrTmp}`, ['call', '$__arr_set_idx_ptr', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]], ['local.get', `$${idxTmp}`], ['local.get', `$${t}`]]],
-              ['local.get', `$${t}`]]],
-            ['else', hasTypedSet ? ['if', ['result', 'f64'],
-              ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]]], ['i32.const', PTR.TYPED]],
-              ['then', ['call', '$__typed_set_idx', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]], ['local.get', `$${idxTmp}`], ['local.get', `$${t}`]]],
-              ['else', ['block', ['result', 'f64'],
-                ['f64.store', ['i32.add', ptrOffsetIR(['local.get', `$${objTmp}`], arrVT), ['i32.shl', ['local.get', `$${idxTmp}`], ['i32.const', 3]]], ['local.get', `$${t}`]],
-                ['local.get', `$${t}`]]]] : ['block', ['result', 'f64'],
-              ['f64.store', ['i32.add', ptrOffsetIR(['local.get', `$${objTmp}`], arrVT), ['i32.shl', ['local.get', `$${idxTmp}`], ['i32.const', 3]]], ['local.get', `$${t}`]],
-              ['local.get', `$${t}`]]]]], 'f64')
-      }
-      if (typeof arr === 'string' && knownArrVT == null) {
-        const objTmp = temp('asu')
-        const idxTmp = tempI32('asi')
-        const ptrTmp = temp('asp')
-        const hasTypedSet = !!ctx.core.stdlib['__typed_set_idx']
-        inc('__ptr_type', '__arr_set_idx_ptr')
-        if (hasTypedSet) inc('__typed_set_idx')
-        const persist = ptr => {
-          if (ctx.func.boxed?.has(arr)) return ['f64.store', boxedAddr(arr), ptr]
-          if (isGlobal(arr)) return ['global.set', `$${arr}`, ptr]
-          return ['local.set', `$${arr}`, ptr]
-        }
-        return typed(['block', ['result', 'f64'],
-          ['local.set', `$${objTmp}`, asF64(va)],
-          ['local.set', `$${idxTmp}`, vi],
-          ['local.set', `$${t}`, vv],
-          ['if', ['result', 'f64'],
-            ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]]], ['i32.const', PTR.ARRAY]],
-            ['then', ['block', ['result', 'f64'],
-              ['local.set', `$${ptrTmp}`, ['call', '$__arr_set_idx_ptr', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]], ['local.get', `$${idxTmp}`], ['local.get', `$${t}`]]],
-              persist(['local.get', `$${ptrTmp}`]),
-              ['local.get', `$${t}`]]],
-            ['else', hasTypedSet ? ['if', ['result', 'f64'],
-              ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]]], ['i32.const', PTR.TYPED]],
-              ['then', ['call', '$__typed_set_idx', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]], ['local.get', `$${idxTmp}`], ['local.get', `$${t}`]]],
-              ['else', ['block', ['result', 'f64'],
-                ['f64.store', ['i32.add', ptrOffsetIR(['local.get', `$${objTmp}`], arrVT), ['i32.shl', ['local.get', `$${idxTmp}`], ['i32.const', 3]]], ['local.get', `$${t}`]],
-                ['local.get', `$${t}`]]]] : ['block', ['result', 'f64'],
-              ['f64.store', ['i32.add', ptrOffsetIR(['local.get', `$${objTmp}`], arrVT), ['i32.shl', ['local.get', `$${idxTmp}`], ['i32.const', 3]]], ['local.get', `$${t}`]],
-              ['local.get', `$${t}`]]]]], 'f64')
-      }
-      return typed(['block', ['result', 'f64'],
-        ['local.set', `$${t}`, vv],
-        ['f64.store', ['i32.add', ptrOffsetIR(asF64(va), arrVT), ['i32.shl', vi, ['i32.const', 3]]], ['local.get', `$${t}`]],
-        ['local.get', `$${t}`]], 'f64')
-    }
-    // Object property assignment: obj.prop = x
-    if (Array.isArray(name) && name[0] === '.') {
-      const [, obj, prop] = name
-      // SRoA flat object: `o.prop = x` → `local.set $o#i` (no heap store).
-      const flatW = typeof obj === 'string' ? ctx.func.flatObjects?.get(obj) : null
-      if (flatW) {
-        const fi = flatW.names.indexOf(prop)
-        if (fi >= 0) {
-          const t = temp()
-          return typed(['block', ['result', 'f64'],
-            ['local.set', `$${t}`, asF64(emit(val))],
-            ['local.set', `$${obj}#${fi}`, ['local.get', `$${t}`]],
-            ['local.get', `$${t}`]], 'f64')
-        }
-      }
-      // Schema-based object → f64.store at fixed offset.
-      if (typeof obj === 'string' && ctx.schema.find) {
-        const idx = ctx.schema.find(obj, prop)
-        if (idx >= 0) {
-          const va = emit(obj), vv = asF64(emit(val)), t = temp()
-          const shadow = needsDynShadow(obj)
-          if (shadow) inc('__dyn_set')
-          const stmts = [
-            ['local.set', `$${t}`, vv],
-            ctx.abi.object.ops.store(ptrOffsetIR(asF64(va), lookupValType(obj) || VAL.OBJECT), idx, ['local.get', `$${t}`]),
-          ]
-          if (shadow)
-            stmts.push(['drop', ['call', '$__dyn_set', asI64(va), asI64(emit(['str', prop])), ['i64.reinterpret_f64', ['local.get', `$${t}`]]]])
-          stmts.push(['local.get', `$${t}`])
-          return typed(['block', ['result', 'f64'], ...stmts], 'f64')
-        }
-      }
-      if (typeof obj === 'string') {
-        const objType = keyValType(obj)
-        // OBJECT receivers (incl. JSON.parse-derived bindings) with off-schema
-        // properties go through __dyn_set, which writes to the per-OBJECT
-        // propsPtr at off-16 — same path as object-literal dyn shadow writes
-        // (module/object.js). __hash_set assumes HASH bucket layout and would
-        // corrupt OBJECT memory.
-        if (usesDynProps(objType) || objType === VAL.OBJECT) {
-          inc('__dyn_set')
-          return typed(['f64.reinterpret_i64', ['call', '$__dyn_set', asI64(emit(obj)), asI64(emit(['str', prop])), asI64(emit(val))]], 'f64')
-        }
-        if (ctx.func.names.has(obj) && !ctx.func.locals?.has(obj) && !ctx.func.current?.params?.some(p => p.name === obj)) {
-          inc('__dyn_set')
-          return typed(['f64.reinterpret_i64', ['call', '$__dyn_set', asI64(emit(obj)), asI64(emit(['str', prop])), asI64(emit(val))]], 'f64')
-        }
-        if (objType == null && ctx.transform.host !== 'wasi') {
-          ctx.features.external = true
-        }
-        inc('__hash_set')
-        const setCall = typed(['f64.reinterpret_i64', ['call', '$__hash_set', asI64(emit(obj)), asI64(emit(['str', prop])), asI64(emit(val))]], 'f64')
-        if (isGlobal(obj)) return typed(['block', ['result', 'f64'],
-          ['global.set', `$${obj}`, setCall], ['global.get', `$${obj}`]], 'f64')
-        // Closure-captured (boxed) locals store the value at the cell address — local.tee
-        // would write to the i32 cell pointer, not the f64 value. Route through writeVar.
-        if (ctx.func.boxed?.has(obj)) return writeVar(obj, setCall, false)
-        return typed(['local.tee', `$${obj}`, setCall], 'f64')
-      }
-      if (ctx.transform.host !== 'wasi') ctx.features.external = true
-      inc('__dyn_set')
-      return typed(['f64.reinterpret_i64', ['call', '$__dyn_set', asI64(emit(obj)), asI64(emit(['str', prop])), asI64(emit(val))]], 'f64')
-    }
-    if (typeof name !== 'string') err(`Assignment to non-variable: ${JSON.stringify(name)}`)
-    if (Array.isArray(val) && val[0] === 'u+' && val[1] === name) {
-      inc('__to_num')
-      return writeVar(name, typed(['call', '$__to_num', asI64(emit(name))], 'f64'), void_)
-    }
-    return writeVar(name, emit(val), void_)
-  },
-
-  // Compound assignments: read-modify-write with type coercion
-  '+=': (name, val) => {
-    // Complex LHS (obj.prop, arr[i]) → desugar to side-effect-safe `name = name + val`
-    if (typeof name !== 'string') return emit(['=', name, ['+', name, val]])
-    // String concatenation: desugar to name = name + val (+ handler knows about strings).
-    // Also desugar when either side has unknown type — the `+` operator picks runtime
-    // string/numeric dispatch (`__is_str_key`); compoundAssign would force f64.add and
-    // silently corrupt string concatenations through unknown-typed values.
-    const vt = typeof name === 'string' ? keyValType(name) : null
-    const vtB = keyValType(val)
-    if (vt === VAL.STRING || vtB === VAL.STRING) return emit(['=', name, ['+', name, val]])
-    if ((vt == null || vtB == null) && ctx.core.stdlib['__str_concat']) return emit(['=', name, ['+', name, val]])
-    return compoundAssign(name, val, (a, b) => typed(['f64.add', a, b], 'f64'), (a, b) => typed(['i32.add', a, b], 'i32'))
-  },
-  ...Object.fromEntries([
-    ['-=', 'sub'], ['*=', 'mul'], ['/=', 'div'],
-  ].map(([op, fn]) => [op, (name, val) => {
-    if (typeof name !== 'string') return emit(['=', name, [op.slice(0, -1), name, val]])
-    return compoundAssign(name, val,
-      (a, b) => typed([`f64.${fn}`, a, b], 'f64'),
-      fn === 'div' ? null : (a, b) => typed([`i32.${fn}`, a, b], 'i32')
-    )
-  }])),
-  '%=': (name, val) => {
-    if (typeof name !== 'string') return emit(['=', name, ['%', name, val]])
-    return compoundAssign(name, val, f64rem, (a, b) => typed(['i32.rem_s', a, b], 'i32'))
-  },
-
-  // Bitwise compound assignments: i32 normally, i64 when either operand is BigInt
-  ...Object.fromEntries([
-    ['&=', 'and'], ['|=', 'or'], ['^=', 'xor'],
-    ['>>=', 'shr_s'], ['<<=', 'shl'], ['>>>=', 'shr_u'],
-  ].map(([op, fn]) => [op, (name, val) => {
-    if (typeof name !== 'string') return emit(['=', name, [op.slice(0, -1), name, val]])
-    if (valTypeOf(name) === VAL.BIGINT || valTypeOf(val) === VAL.BIGINT) {
-      const void_ = _expect === 'void'
-      const result = fromI64([`i64.${fn}`, asI64(readVar(name)), asI64(emit(val))])
-      return writeVar(name, result, void_)
-    }
-    return compoundAssign(name, val,
-      (a, b) => asF64(typed([`i32.${fn}`, toI32(a), toI32(b)], 'i32')),
-      (a, b) => typed([`i32.${fn}`, a, b], 'i32')
-    )
-  }])),
-
-  // Logical compound assignments: a ||= b → a = a || b, a &&= b → a = a && b
-  // Logical/nullish compound assignments: read → check → conditionally write
-  // For complex LHS (obj.prop, arr[i]): emit as check(read(lhs)) ? write(lhs, val) : read(lhs)
-  ...Object.fromEntries(['||=', '&&=', '??='].map(op => [op, (name, val) => {
-    // Complex LHS → desugar (side-effect-safe since obj/arr/idx are locals)
-    if (typeof name !== 'string') {
-      const baseOp = op.slice(0, -1) // '||', '&&', '??'
-      return emit([baseOp, name, ['=', name, val]])
-    }
-    if (isConst(name)) err(`Assignment to const '${name}'`)
-    const void_ = _expect === 'void'
-    const t = temp()
-    const va = readVar(name)
-    // Condition: ||= → truthy check, &&= → truthy check, ??= → nullish check
-    const lhs = typed(['local.tee', `$${t}`, asF64(va)], 'f64')
-    const cond = op === '??=' ? isNullish(lhs) : truthyIR(lhs)
-    // &&= and ??= assign when cond is true (truthy / nullish); ||= assigns when cond is false
-    const [thenExpr, elseExpr] = op === '||='
-      ? [['local.get', `$${t}`], asF64(emit(val))]
-      : [asF64(emit(val)), ['local.get', `$${t}`]]
-    const result = typed(['if', ['result', 'f64'], cond, ['then', thenExpr], ['else', elseExpr]], 'f64')
-    // Write back (handles boxed/global/local)
-    if (ctx.func.boxed?.has(name)) {
-      const bt = temp()
-      return typed(['block', ['result', 'f64'],
-        ['local.set', `$${bt}`, result],
-        ['f64.store', boxedAddr(name), ['local.get', `$${bt}`]],
-        ['local.get', `$${bt}`]], 'f64')
-    }
-    return writeVar(name, result, void_)
-  }])),
-
-  // === Increment/Decrement ===
-  // Postfix resolved in prepare: i++ → (++i) - 1
-
-  ...Object.fromEntries([['++', 'add'], ['--', 'sub']].map(([op, fn]) => [op, name => {
-    if (typeof name === 'string' && isConst(name)) err(`Assignment to const '${name}'`)
-    const void_ = _expect === 'void'
-    const v = readVar(name)
-    const one = v.type === 'i32' ? ['i32.const', 1] : ['f64.const', 1]
-    return writeVar(name, typed([`${v.type}.${fn}`, v, one], v.type), void_)
-  }])),
-
-  // === Arithmetic (type-preserving) ===
-
-  // Postfix in void: (++i)-1 / (--i)+1 → just ++i / --i
-  '+': (a, b) => {
-    if (_expect === 'void' && isPostfix(a, '--', b)) return emit(a, 'void')
-    // String concatenation: pure string operands skip generic ToString coercion.
-    const vtA = keyValType(a)
-    const vtB = keyValType(b)
-    if (vtA === VAL.STRING && vtB === VAL.STRING) {
-      // Fused append-byte: `buf += s[i]` skips 1-char SSO construction +
-      // generic concat dispatch when rhs is a string-index. The byte flows
-      // straight from __char_at into memory, and the bump-extend path elides
-      // the alloc+copy when lhs is the heap-top STRING.
-      if (Array.isArray(b) && b[0] === '[]' && ctx.core.stdlib['__str_append_byte'] && ctx.core.stdlib['__char_at']) {
-        if (keyValType(b[1]) === VAL.STRING) {
-          inc('__str_append_byte', '__char_at')
-          return typed(['call', '$__str_append_byte',
-            asI64(emit(a)),
-            ctx.abi.string.ops.charCodeAt(asF64(emit(b[1])), asI32(emit(b[2])), ctx),
-          ], 'f64')
-        }
-      }
-      return typed(ctx.abi.string.ops.concatRaw(asF64(emit(a)), asF64(emit(b)), ctx), 'f64')
-    }
-    if (vtA === VAL.STRING || vtB === VAL.STRING) {
-      // An OBJECT operand coerces via ToPrimitive(string) at compile time —
-      // __str_concat's runtime __to_str cannot invoke a user-defined toString.
-      // A BOOL operand renders "true"/"false" rather than its 0/1 carrier.
-      const strOperand = (vt, n) => vt === VAL.OBJECT ? typed(['f64.reinterpret_i64', toStrI64(n, emit(n))], 'f64')
-        : vt === VAL.BOOL ? emitBoolStr(n) : asF64(emit(n))
-      const ea = strOperand(vtA, a)
-      const eb = strOperand(vtB, b)
-      return typed(ctx.abi.string.ops.concat(ea, eb, ctx), 'f64')
-    }
-    if (vtA === VAL.BIGINT || vtB === VAL.BIGINT)
-      return fromI64(['i64.add', asI64(emit(a)), asI64(emit(b))])
-    // Runtime string dispatch when at least one side could be a string. When one side has
-    // a known non-STRING vtype, skip its `__is_str_key` (statically false). Common in
-    // chained additions `s + a*b + c.d` — left grows as `+` (=NUMBER), only the new right
-    // operand needs the runtime check.
-    if ((vtA == null || vtB == null) && ctx.core.stdlib['__str_concat']) {
-      const tA = temp('add'), tB = temp('add')
-      inc('__str_concat', '__is_str_key')
-      const checkA = vtA == null ? ['call', '$__is_str_key', ['i64.reinterpret_f64', ['local.tee', `$${tA}`, asF64(emit(a))]]] : null
-      const checkB = vtB == null ? ['call', '$__is_str_key', ['i64.reinterpret_f64', ['local.tee', `$${tB}`, asF64(emit(b))]]] : null
-      const concat = ['call', '$__str_concat', ['i64.reinterpret_f64', ['local.get', `$${tA}`]], ['i64.reinterpret_f64', ['local.get', `$${tB}`]]]
-      const add    = ['f64.add', ['local.get', `$${tA}`], ['local.get', `$${tB}`]]
-      if (checkA && checkB) {
-        return typed(['if', ['result', 'f64'], ['i32.or', checkA, checkB], ['then', concat], ['else', add]], 'f64')
-      }
-      // Exactly one side is checked. Pre-eval the known side first, then the if branches on the unknown.
-      const preEval = vtA == null ? ['local.set', `$${tB}`, asF64(emit(b))] : ['local.set', `$${tA}`, asF64(emit(a))]
-      return typed(['block', ['result', 'f64'],
-        preEval,
-        ['if', ['result', 'f64'], checkA ?? checkB, ['then', concat], ['else', add]]
-      ], 'f64')
-    }
-    const va = emit(a), vb = emit(b), _f = foldConst(va, vb, (a, b) => a + b)
-    if (_f) return _f
-    // Neither side is a string here (string paths handled above), but either may
-    // still be null/undefined/pointer — numeric `+` performs ToNumber like `-`/`*`.
-    if (isLit(vb) && litVal(vb) === 0) return toNumF64(a, va)
-    if (isLit(va) && litVal(va) === 0) return toNumF64(b, vb)
-    // An `.unsigned` operand is a uint32 (range [0, 2^32)); JS `+` is a float
-    // op whose result can exceed i32, so `i32.add` would wrap (4294967295+1→0).
-    // Widen to f64 — never wrap — matching spec. Only `>>>0`/`|0`/imul wrap.
-    if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb)) return typed(['i32.add', va, vb], 'i32')
-    return typed(['f64.add', toNumF64(a, va), toNumF64(b, vb)], 'f64')
-  },
-  '-': (a, b) => {
-    if (_expect === 'void' && isPostfix(a, '++', b)) return emit(a, 'void')
-    if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
-      return b === undefined
-        ? fromI64(['i64.sub', ['i64.const', 0], asI64(emit(a))])
-        : fromI64(['i64.sub', asI64(emit(a)), asI64(emit(b))])
-    if (b === undefined) return emitNeg(a)
-    const va = emit(a), vb = emit(b), _f = foldConst(va, vb, (a, b) => a - b)
-    if (_f) return _f
-    if (isLit(vb) && litVal(vb) === 0) return toNumF64(a, va)
-    // Unsigned uint32 operand: JS `-` is float (can go negative / exceed i32),
-    // so avoid the wrapping i32.sub fast-path. See `+` above.
-    if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb)) return typed(['i32.sub', va, vb], 'i32')
-    return typed(['f64.sub', toNumF64(a, va), toNumF64(b, vb)], 'f64')
-  },
-  'u+': a => {
-    if (valTypeOf(a) === VAL.BIGINT)
-      return typed(['f64.convert_i64_s', asI64(emit(a))], 'f64')
-    const v = emit(a)
-    if (v.type === 'i32') return asF64(v)
-    if (valTypeOf(a) === VAL.NUMBER) return toNumF64(a, v)
-    inc('__to_num')
-    return typed(['call', '$__to_num', asI64(v)], 'f64')
-  },
-  'u-': a => emitNeg(a),
-  '*': (a, b) => {
-    if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
-      return fromI64(['i64.mul', asI64(emit(a)), asI64(emit(b))])
-    const va = emit(a), vb = emit(b), _f = foldConst(va, vb, (a, b) => a * b)
-    if (_f) return _f
-    if (isLit(vb) && litVal(vb) === 1) return toNumF64(a, va)
-    if (isLit(va) && litVal(va) === 1) return toNumF64(b, vb)
-    if (isLit(vb) && litVal(vb) === 0) return isLit(va) ? vb : typed(['block', ['result', vb.type], va, 'drop', vb], vb.type)
-    if (isLit(va) && litVal(va) === 0) return isLit(vb) ? va : typed(['block', ['result', va.type], vb, 'drop', va], va.type)
-    // `.unsigned` operand is a uint32 ([0, 2^32)); its product can exceed i32, so
-    // `i32.mul` would wrap ((2^32-1)*2 → -2). Widen to f64 — see `+` above.
-    if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb) && mulFitsI32(va, vb)) return typed(['i32.mul', va, vb], 'i32')
-    return typed(['f64.mul', toNumF64(a, va), toNumF64(b, vb)], 'f64')
-  },
-  '/': (a, b) => {
-    if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
-      return fromI64(['i64.div_s', asI64(emit(a)), asI64(emit(b))])
-    const va = emit(a), vb = emit(b), _f = foldConst(va, vb, (a, b) => a / b, b => b !== 0)
-    if (_f) return _f
-    if (isLit(vb) && litVal(vb) === 1) return toNumF64(a, va)
-    return typed(['f64.div', toNumF64(a, va), toNumF64(b, vb)], 'f64')
-  },
-  '%': (a, b) => {
-    if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
-      return fromI64(['i64.rem_s', asI64(emit(a)), asI64(emit(b))])
-    const va = emit(a), vb = emit(b), _f = foldConst(va, vb, (a, b) => a % b, b => b !== 0)
-    if (_f) return _f
-    // ES remainder by zero is NaN; only the f64 path yields that (a - trunc(a/0)*0).
-    // The i32.rem_s fast path traps on a zero divisor, so divert a literal-zero divisor.
-    if (isLit(vb) && litVal(vb) === 0) return emitNum(NaN)
-    // `.unsigned` operand: `i32.rem_s` reads the uint32 as a negative signed value
-    // ((2^32-1)%7 → rem_s(-1,7) = -1, not 3). Widen to f64 — see `+` above.
-    if (isI32Num(va) && isI32Num(vb) && !va.unsigned && !vb.unsigned) return typed(['i32.rem_s', va, vb], 'i32')
-    return f64rem(toNumF64(a, va), toNumF64(b, vb))
-  },
-  // === Comparisons (always i32 result) ===
-
-  '==': (a, b) => {
-    const charCmp = emitSingleCharIndexCmp(a, b)
-    if (charCmp) return charCmp
-    const subCmp = emitSubstringEqCmp(a, b)
-    if (subCmp) return subCmp
-    // JS loose nullish equality: x == null / x == undefined.
-    // If the non-literal side has a known non-null VAL type, fold to 0.
-    if (isNullishLit(a)) {
-      if (valTypeOf(b)) return emitNum(0)
-      return isNullish(asF64(emit(b)))
-    }
-    if (isNullishLit(b)) {
-      if (valTypeOf(a)) return emitNum(0)
-      return isNullish(asF64(emit(a)))
-    }
-    // typeof x == 'string' → compile-time type check (prepare rewrites string to type code)
-    const tc = emitTypeofCmp(a, b, 'eq'); if (tc) return tc
-    const va = emit(a), vb = emit(b)
-    if (va.type === 'i32' && vb.type === 'i32') return typed(['i32.eq', va, vb], 'i32')
-    // Either side known-pure NUMBER (literal or typed) → f64.eq is correct regardless
-    // of the other side: jz's `==` is strict (prepare.js:868), and every NaN-boxed pointer
-    // reinterprets to a quiet NaN (0x7FF8… prefix) so f64.eq with any normal float is false.
-    // Catches `closureVar === 34` in jzified hot loops where the unknown side has no VAL.
-    const vta = numericVal(resolveValType(a, valTypeOf, lookupValType))
-    const vtb = numericVal(resolveValType(b, valTypeOf, lookupValType))
-    if (vta === VAL.NUMBER && needsLooseEqualityToNumber(b, vtb)) return looseNumberEq(va, b, vb)
-    if (vtb === VAL.NUMBER && needsLooseEqualityToNumber(a, vta)) return looseNumberEq(vb, a, va)
-    if (vta === VAL.NUMBER || vtb === VAL.NUMBER) return typed(['f64.eq', asF64(va), asF64(vb)], 'i32')
-    // Reference-equal pointer kinds (same kind, non-STRING, non-BIGINT): i64 bit equality.
-    // JS `==` on objects/arrays/sets/maps/etc. is pure reference equality — no content path.
-    // STRING needs __eq (heap strings can be equal by content but different pointers).
-    // BIGINT needs __eq (heap-allocated, content compare).
-    if (vta && vta === vtb && REF_EQ_KINDS.has(vta)) {
-      return typed(['i64.eq', ['i64.reinterpret_f64', asF64(va)], ['i64.reinterpret_f64', asF64(vb)]], 'i32')
-    }
-    inc('__eq')
-    return typed(['call', '$__eq', asI64(va), asI64(vb)], 'i32')
-  },
-  '!=': (a, b) => {
-    const charCmp = emitSingleCharIndexCmp(a, b, true)
-    if (charCmp) return charCmp
-    const subCmp = emitSubstringEqCmp(a, b, true)
-    if (subCmp) return subCmp
-    if (isNullishLit(a)) {
-      if (valTypeOf(b)) return emitNum(1)
-      return typed(['i32.eqz', isNullish(asF64(emit(b)))], 'i32')
-    }
-    if (isNullishLit(b)) {
-      if (valTypeOf(a)) return emitNum(1)
-      return typed(['i32.eqz', isNullish(asF64(emit(a)))], 'i32')
-    }
-    const tc = emitTypeofCmp(a, b, 'ne'); if (tc) return tc
-    const va = emit(a), vb = emit(b)
-    if (va.type === 'i32' && vb.type === 'i32') return typed(['i32.ne', va, vb], 'i32')
-    const vta = numericVal(resolveValType(a, valTypeOf, lookupValType))
-    const vtb = numericVal(resolveValType(b, valTypeOf, lookupValType))
-    if (vta === VAL.NUMBER && needsLooseEqualityToNumber(b, vtb)) return looseNumberEq(va, b, vb, true)
-    if (vtb === VAL.NUMBER && needsLooseEqualityToNumber(a, vta)) return looseNumberEq(vb, a, va, true)
-    if (vta === VAL.NUMBER || vtb === VAL.NUMBER) return typed(['f64.ne', asF64(va), asF64(vb)], 'i32')
-    if (vta && vta === vtb && REF_EQ_KINDS.has(vta)) {
-      return typed(['i64.ne', ['i64.reinterpret_f64', asF64(va)], ['i64.reinterpret_f64', asF64(vb)]], 'i32')
-    }
-    inc('__eq')
-    return typed(['i32.eqz', ['call', '$__eq', asI64(va), asI64(vb)]], 'i32')
-  },
-  '===': (a, b) => emitStrictEq(a, b, false),
-  '!==': (a, b) => emitStrictEq(a, b, true),
-  '<':  cmpOp('lt_s', 'lt', (a, b) => a < b),
-  '>':  cmpOp('gt_s', 'gt', (a, b) => a > b),
-  '<=': cmpOp('le_s', 'le', (a, b) => a <= b),
-  '>=': cmpOp('ge_s', 'ge', (a, b) => a >= b),
-
-  // === Logical ===
-
-  '!': a => {
-    const v = emit(a)
-    if (v.type === 'i32') return typed(['i32.eqz', v], 'i32')
-    // Unboxed pointer offsets: falsy iff zero offset.
-    if (v.ptrKind != null) return typed(['i32.eqz', v], 'i32')
-    // Known pointer-kinded operand: `!x` is just `x is nullish` (null/undefined).
-    // Excludes STRING — empty string '' is a valid (non-null) pointer but is falsy.
-    // VAL.BOOL rides the 0/1 numeric carrier (not a pointer), so normalize it to
-    // NUMBER and let it fall to the truthy path — `!false` must be `true`.
-    const vt = numericVal(resolveValType(a, valTypeOf, lookupValType))
-    if (vt && vt !== VAL.NUMBER && vt !== VAL.BIGINT && vt !== VAL.STRING) {
-      return isNullish(asF64(v))
-    }
-    inc('__is_truthy')
-    return typed(['i32.eqz', ['call', '$__is_truthy', asI64(v)]], 'i32')
-  },
-
-  '?:': (a, b, c) => {
-    // Constant condition → emit only the live branch
-    const ca = emit(a)
-    if (isLit(ca)) { const v = litVal(ca); return (v !== 0 && v === v) ? emit(b) : emit(c) }
-    const cond = toBoolFromEmitted(ca)
-    // Flow-sensitive refinement: each arm sees narrowing consistent with `a` being truthy / falsy.
-    const thenRefs = extractRefinements(a, new Map(), true)
-    const elseRefs = extractRefinements(a, new Map(), false)
-    const vb = withRefinements(thenRefs, b, () => emit(b))
-    const vc = withRefinements(elseRefs, c, () => emit(c))
-    // L: Use WASM select for pure ternaries — branchless, smaller bytecode
-    if (vb.type === 'i32' && vc.type === 'i32') {
-      // Propagate matching ptrKind/ptrAux so a downstream asF64 takes the NaN-rebox
-      // path instead of `f64.convert_i32_s`. Mismatched kinds drop both — caller's
-      // asF64 will treat the i32 as numeric, which is correct for non-pointer i32s.
-      // ptrKind matches but ptrAux differs (e.g. polymorphic OBJECT with two
-      // distinct schemaIds, or TYPED with two element types) — fall through to
-      // the f64 path. There each arm reboxes independently, preserving its own
-      // aux in the NaN-box. The single-i32 path can only carry one aux on the
-      // result, so `boxPtrIR` would default to 0 and lose the runtime schema /
-      // elemType bits needed by downstream lookups (e.g. __dyn_get's OBJECT-
-      // schema fallback uses receiver aux to resolve `.prop`).
-      const auxMismatch = vb.ptrKind != null && vb.ptrKind === vc.ptrKind
-        && (vb.ptrAux ?? null) !== (vc.ptrAux ?? null)
-      if (!auxMismatch) {
-        const tagPtr = (n) => {
-          if (vb.ptrKind != null && vb.ptrKind === vc.ptrKind) {
-            n.ptrKind = vb.ptrKind
-            if (vb.ptrAux != null && vb.ptrAux === vc.ptrAux) n.ptrAux = vb.ptrAux
-          }
-          return n
-        }
-        if (isPureIR(vb) && isPureIR(vc))
-          return tagPtr(typed(['select', vb, vc, cond], 'i32'))
-        return tagPtr(typed(['if', ['result', 'i32'], cond, ['then', vb], ['else', vc]], 'i32'))
-      }
-    }
-    const fb = asF64(vb), fc = asF64(vc)
-    const vtb = resolveValType(b, valTypeOf, lookupValType)
-    const vtc = resolveValType(c, valTypeOf, lookupValType)
-    const isNaNBoxLit = n => Array.isArray(n) && n[0] === 'f64.const' && typeof n[1] === 'string' && n[1].startsWith('nan:')
-    const refPayload = (vtb && vtb === vtc && REF_EQ_KINDS.has(vtb))
-      || vb.closureFuncIdx != null || vc.closureFuncIdx != null
-      || isNaNBoxLit(fb) || isNaNBoxLit(fc)
-    if (refPayload) {
-      const ib = ['i64.reinterpret_f64', fb]
-      const ic = ['i64.reinterpret_f64', fc]
-      const bits = isPureIR(fb) && isPureIR(fc)
-        ? ['select', ib, ic, cond]
-        : ['if', ['result', 'i64'], cond, ['then', ib], ['else', ic]]
-      return typed(['f64.reinterpret_i64', bits], 'f64')
-    }
-    if (!refPayload && isPureIR(fb) && isPureIR(fc))
-      return typed(['select', fb, fc, cond], 'f64')
-    return typed(['if', ['result', 'f64'], cond, ['then', fb], ['else', fc]], 'f64')
-  },
-
-  '&&': (a, b) => {
-    const va = emit(a)
-    // Constant-folded literal: pre-bind under truthy refinements (b runs only when a was truthy).
-    if (isLit(va)) {
-      const v = litVal(va)
-      if (v !== 0 && v === v) {
-        const refs = extractRefinements(a, new Map(), true)
-        return withRefinements(refs, b, () => emit(b))
-      }
-      return va
-    }
-    // a is truthy in the right-arm — narrow b accordingly. Matches `?:`'s then-arm threading
-    // (`Array.isArray(x) && x[0]` → x[0] sees x as ARRAY, eliding union-rep fallbacks).
-    const rightRefs = extractRefinements(a, new Map(), true)
-    const emitRight = () => withRefinements(rightRefs, b, () => emit(b))
-    // i32 fast path: use i32 tee as cond directly (nonzero=truthy in wasm `if`),
-    // skip f64 round-trip and __is_truthy call entirely.
-    if (va.type === 'i32') {
-      const vb = emitRight()
-      const t = tempI32()
-      if (vb.type === 'i32') {
-        return typed(['if', ['result', 'i32'],
-          ['local.tee', `$${t}`, va],
-          ['then', vb],
-          ['else', ['local.get', `$${t}`]]], 'i32')
-      }
-      return typed(['if', ['result', 'f64'],
-        ['local.tee', `$${t}`, va],
-        ['then', asF64(vb)],
-        ['else', typed(['f64.convert_i32_s', ['local.get', `$${t}`]], 'f64')]], 'f64')
-    }
-    const t = temp()
-    const teed = typed(['local.tee', `$${t}`, asF64(va)], 'f64')
-    return typed(['if', ['result', 'f64'],
-      toBoolFromEmitted(teed),
-      ['then', asF64(emitRight())],
-      ['else', ['local.get', `$${t}`]]], 'f64')
-  },
-
-  '||': (a, b) => {
-    const va = emit(a)
-    // Constant-folded literal: pre-bind under falsy refinements (b runs only when a was falsy).
-    if (isLit(va)) {
-      const v = litVal(va)
-      if (v !== 0 && v === v) return va
-      const refs = extractRefinements(a, new Map(), false)
-      return withRefinements(refs, b, () => emit(b))
-    }
-    // a is falsy in the right-arm — `x == null || ...` proves x is null/undefined in b;
-    // De Morgan'd via the sense=false branch of extractRefinements (mirrors the ?: else-arm).
-    const rightRefs = extractRefinements(a, new Map(), false)
-    const emitRight = () => withRefinements(rightRefs, b, () => emit(b))
-    if (va.type === 'i32') {
-      const vb = emitRight()
-      const t = tempI32()
-      if (vb.type === 'i32') {
-        return typed(['if', ['result', 'i32'],
-          ['local.tee', `$${t}`, va],
-          ['then', ['local.get', `$${t}`]],
-          ['else', vb]], 'i32')
-      }
-      return typed(['if', ['result', 'f64'],
-        ['local.tee', `$${t}`, va],
-        ['then', typed(['f64.convert_i32_s', ['local.get', `$${t}`]], 'f64')],
-        ['else', asF64(vb)]], 'f64')
-    }
-    const t = temp()
-    const teed = typed(['local.tee', `$${t}`, asF64(va)], 'f64')
-    return typed(['if', ['result', 'f64'],
-      toBoolFromEmitted(teed),
-      ['then', ['local.get', `$${t}`]],
-      ['else', asF64(emitRight())]], 'f64')
-  },
-
-  // a ?? b: returns b only if a is nullish
-  '??': (a, b) => {
-    const va = emit(a)
-    const t = temp()
-    return typed(['if', ['result', 'f64'],
-      // Check: is a NOT nullish?
-      ['i32.eqz', isNullish(['local.tee', `$${t}`, asF64(va)])],
-      ['then', ['local.get', `$${t}`]],
-      ['else', asF64(emit(b))]], 'f64')
-  },
-
-  'void': a => {
-    const v = emit(a)
-    const dropAndUndef = (instr) => typed(['block', ['result', 'f64'], instr, 'drop', undefExpr()], 'f64')
-    if (v == null) return undefExpr()
-    const op = Array.isArray(v) ? v[0] : null
-    const wasmVoid = op === 'local.set' || (typeof op === 'string' && op.endsWith('.store'))
-      || op === 'memory.copy' || op === 'global.set'
-    if (wasmVoid)
-      return typed(['block', ['result', 'f64'], v, undefExpr()], 'f64')
-    if (v.type && v.type !== 'void')
-      return dropAndUndef(v)
-    return typed(['block', ['result', 'f64'], ...flat(v), undefExpr()], 'f64')
-  },
-
-  '(': a => emit(a),
-
-  // === Bitwise (i32 for numbers, i64 for BigInt) ===
-
-  // Per ECMAScript ToInt32, bitwise ops first ToNumber-coerce non-numeric operands.
-  // i32 / lit values are already numeric — the toNumF64 wrap is skipped to keep
-  // the numeric fast path at one wasm instruction. Non-numeric (NaN-boxed string,
-  // unknown type) routes through __to_num so "2026" | 0 === 2026.
-  // `~~x` is the idiomatic int32 truncation: the two xor-with-(-1) cancel, leaving
-  // a single toI32 (whose NaN/Infinity guard runs once, unchanged). Fold it here so
-  // DSP/bytebeat `~~` doesn't emit a dead double-xor watr won't remove.
-  '~':   a => {
-    if (Array.isArray(a) && a[0] === '~') {
-      const inner = a[1], iv = emit(inner)
-      return isLit(iv) ? emitNum(~~litVal(iv)) : typed(toI32(isI32Num(iv) ? iv : toNumF64(inner, iv)), 'i32')
-    }
-    const v = emit(a); return isLit(v) ? emitNum(~litVal(v)) : typed(['i32.xor', toI32(isI32Num(v) ? v : toNumF64(a, v)), typed(['i32.const', -1], 'i32')], 'i32')
-  },
-  ...Object.fromEntries([
-    ['&', 'and'], ['|', 'or'], ['^', 'xor'], ['<<', 'shl'], ['>>', 'shr_s'],
-  ].map(([op, fn]) => [op, (a, b) => {
-    if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
-      return fromI64([`i64.${fn}`, asI64(emit(a)), asI64(emit(b))])
-    const va = emit(a), vb = emit(b)
-    if (isLit(va) && isLit(vb)) {
-      const la = litVal(va), lb = litVal(vb)
-      if (op === '&') return emitNum(la & lb); if (op === '|') return emitNum(la | lb)
-      if (op === '^') return emitNum(la ^ lb); if (op === '<<') return emitNum(la << lb)
-      if (op === '>>') return emitNum(la >> lb)
-    }
-    const ca = isI32Num(va) || isLit(va) ? va : toNumF64(a, va)
-    const cb = isI32Num(vb) || isLit(vb) ? vb : toNumF64(b, vb)
-    return typed([`i32.${fn}`, toI32(ca), toI32(cb)], 'i32')
-  }])),
-  '>>>': (a, b) => {
-    const va = emit(a), vb = emit(b)
-    if (isLit(va) && isLit(vb)) {
-      const r = litVal(va) >>> litVal(vb) // JS uint32 result ∈ [0, 2^32)
-      // ≥ 2^31 doesn't fit signed i32: materialize the wrapped bits as an i32 const
-      // tagged `.unsigned` so `asF64` lifts via `convert_i32_u`. Emitting `f64.const r`
-      // here (the old foldConst path) would `trunc_sat_f64_s`-saturate to INT32_MAX
-      // when the enclosing function narrows to an i32 result. Values < 2^31 fold to a
-      // plain i32 const (signed == unsigned, stays foldable downstream).
-      if (r >= 0x80000000) { const node = typed(['i32.const', r | 0], 'i32'); node.unsigned = true; return node }
-      return emitNum(r)
-    }
-    // F: Mark unsigned so `asF64` lifts via `f64.convert_i32_u` (preserving the
-    // [0, 2^32) value range). Without this, `(s >>> 0) / 4294967296` would convert
-    // signed for negative-high-bit s values, flipping sign and breaking the
-    // canonical "uint32 → f64" idiom used in PRNGs and bit-manipulation code.
-    const ca = isI32Num(va) || isLit(va) ? va : toNumF64(a, va)
-    const cb = isI32Num(vb) || isLit(vb) ? vb : toNumF64(b, vb)
-    const node = typed(['i32.shr_u', toI32(ca), toI32(cb)], 'i32')
-    node.unsigned = true
-    return node
-  },
-
-  // === Control flow ===
-
-  'if': (cond, then, els) => {
-    // Dead branch elimination: constant condition → emit only the live branch
-    const ce = emit(cond)
-    if (isLit(ce)) {
-      const v = litVal(ce), truthy = v !== 0 && v === v
-      if (truthy) return emitFlat(then)
-      if (els != null) return emitFlat(els)
-      return null
-    }
-    const c = ce.type === 'i32' ? ce : toBoolFromEmitted(ce)
-    // Flow-sensitive type refinement: narrow types within each branch based on the guard.
-    const thenRefs = extractRefinements(cond, new Map(), true)
-    const elseRefs = extractRefinements(cond, new Map(), false)
-    const thenBody = withRefinements(thenRefs, then, () => emitFlat(then))
-    if (els != null) {
-      const elseBody = withRefinements(elseRefs, els, () => emitFlat(els))
-      return ['if', c, ['then', ...thenBody], ['else', ...elseBody]]
-    }
-    return ['if', c, ['then', ...thenBody]]
-  },
-
-  'for': (init, cond, step, body) => {
-    if (body === undefined) return err('for-in/for-of not supported')
-    if (!ctx.transform.optimize || ctx.transform.optimize.smallConstForUnroll !== false) {
-      const unrolled = unrollSmallConstFor(init, cond, step, body)
-      if (unrolled) return unrolled
-    }
-    const id = ctx.func.uniq++
-    const brk = `$brk${id}`, loop = `$loop${id}`
-    // The cont wrapper is only needed if the body has a `continue` AND there is a step
-    // expression — `continue` must jump to before the step. Without a step, `continue`
-    // can target the loop label directly, saving a redundant `block`.
-    const needsCont = step && hasOwnContinue(body)
-    const cont = needsCont ? `$cont${id}` : loop
-    ctx.func.stack.push({ brk, loop: cont })
-    const result = []
-    if (init != null) result.push(...emitFlat(init))
-    const loopBody = []
-    if (cond) loopBody.push(['br_if', brk, ['i32.eqz', toBool(cond)]])
-    if (needsCont) loopBody.push(['block', cont, ...emitFlat(body)])
-    else loopBody.push(...emitFlat(body))
-    if (step) loopBody.push(...emitFlat(step))
-    loopBody.push(['br', loop])
-    result.push(['block', brk, ['loop', loop, ...loopBody]])
-    ctx.func.stack.pop()
-    return result.length === 1 ? result[0] : result
-  },
-
-  'switch': (discriminant, ...cases) => {
-    const disc = `${T}disc${ctx.func.uniq++}`
-    ctx.func.locals.set(disc, 'f64')
-
-    const result = [['local.set', `$${disc}`, asF64(emit(discriminant))]]
-
-    for (const c of cases) {
-      if (c[0] === 'case') {
-        const [, test, body] = c
-        const skip = `$skip${ctx.func.uniq++}`
-        // Block: skip if discriminant != test, otherwise execute body
-        result.push(['block', skip,
-          ['br_if', skip, typed(['f64.ne', typed(['local.get', `$${disc}`], 'f64'), asF64(emit(test))], 'i32')],
-          ...emitFlat(body)])
-      } else if (c[0] === 'default') {
-        result.push(...emitFlat(c[1]))
-      }
-    }
-
-    return result
-  },
-
-  'while': (cond, body) => emitter['for'](null, cond, null, body),
-  'label': (name, body) => {
-    const brk = `$label${ctx.func.uniq++}`
-    ctx.func.stack.push({ label: name, brk })
-    const result = ['block', brk, ...emitFlat(body)]
-    ctx.func.stack.pop()
-    return result
-  },
-  'break': (label) => {
-    const target = label == null
-      ? loopTop().brk
-      : ctx.func.stack.findLast(frame => frame.label === label)?.brk
-    if (!target) err(`break label '${label}' is not in scope`)
-    return [...emitFinalizers(), ['br', target]]
-  },
-  'continue': (label) => {
-    if (label != null) err(`continue label '${label}' is not supported`)
-    return [...emitFinalizers(), ['br', loopTop().loop]]
-  },
-
-  // === Call ===
-
-  // Arrow as value → closure
-  '=>': (rawParams, body) => {
-    if (!ctx.closure.make) err('Closures require fn module (auto-included)')
-
-    const raw = extractParams(rawParams)
-    const params = [], defaults = {}
-    let restParam = null, bodyPrefix = []
-    for (const r of raw) {
-      const c = classifyParam(r)
-      if (c.kind === 'rest') { restParam = c.name; params.push(c.name) }
-      else if (c.kind === 'plain') params.push(c.name)
-      else if (c.kind === 'default') { params.push(c.name); defaults[c.name] = c.defValue }
-      else {
-        const tmp = `${T}p${ctx.func.uniq++}`
-        params.push(tmp)
-        if (c.kind === 'destruct-default') defaults[tmp] = c.defValue
-        bodyPrefix.push(['let', ['=', c.pattern, tmp]])
-      }
-    }
-
-    // Prepend destructuring to body (if any destructured params)
-    if (bodyPrefix.length) {
-      if (Array.isArray(body) && body[0] === '{}' && Array.isArray(body[1]) && body[1][0] === ';')
-        body = ['{}', [';', ...bodyPrefix, ...body[1].slice(1)]]
-      else if (Array.isArray(body) && body[0] === '{}')
-        body = ['{}', [';', ...bodyPrefix, body[1]]]
-      else body = ['{}', [';', ...bodyPrefix, ['return', body]]]
-    }
-
-    // Find free variables in body that aren't params → captures
-    const paramSet = new Set(params)
-    const captures = []
-    findFreeVars(body, paramSet, captures)
-    for (const def of Object.values(defaults)) findFreeVars(def, paramSet, captures)
-
-    // Pass closure info including rest param and defaults
-    const closureInfo = { params, body, captures, restParam }
-    if (Object.keys(defaults).length) closureInfo.defaults = defaults
-    return ctx.closure.make(closureInfo)
-  },
-
-  '()': (callee, callArgs) => {
-    let argList = Array.isArray(callArgs)
-      ? (callArgs[0] === ',' ? callArgs.slice(1) : [callArgs])
-      : callArgs ? [callArgs] : []
-
-    // Helper: expand spread arguments into flat list of normal arguments + spread markers
-    // Returns { normal: [...], spreads: [(pos, expr), ...] }
-    const parseArgs = (args) => {
-      const normal = []
-      const spreads = []
-      for (let i = 0; i < args.length; i++) {
-        const arg = args[i]
-        if (Array.isArray(arg) && arg[0] === '...') {
-          spreads.push({ pos: normal.length, expr: arg[1] })
-        } else {
-          normal.push(arg)
-        }
-      }
-      return { normal, spreads, hasSpread: spreads.length > 0 }
-    }
-
-    const parsed = parseArgs(argList)
-
-    // Closure devirtualization: a callee that is a module global proven (by
-    // plan.js) to hold one statically-known function for the whole post-init
-    // program rewrites to that function — the known-top-level-function branch
-    // below then emits a direct `call`, dropping the indirect/trampoline path.
-    if (typeof callee === 'string' && ctx.func.globalDevirt?.has(callee))
-      callee = ctx.func.globalDevirt.get(callee)
-
-    // Optional method call: obj?.method(args) — null if obj is nullish, else
-    // obj.method(args). The parser shapes this as ['()', ['?.', obj, method], args],
-    // distinct from the regular method call's ['.', obj, method] callee. Receiver
-    // hoists into a temp so the nullish check and the method dispatch below see
-    // the same evaluation; recursion with a synthetic '.'-callee reuses the type-
-    // aware method-dispatch in this same handler rather than duplicating it.
-    if (Array.isArray(callee) && callee[0] === '?.') {
-      const [, obj, method] = callee
-      const t = `${T}om${ctx.func.uniq++}`
-      ctx.func.locals.set(t, 'f64')
-      const va = asF64(emit(obj))
-      const methodCall = emitter['()'](['.', t, method], callArgs)
-      return typed(['block', ['result', 'f64'],
-        ['local.set', `$${t}`, va],
-        ['if', ['result', 'f64'],
-          ['i32.eqz', isNullish(typed(['local.get', `$${t}`], 'f64'))],
-          ['then', asF64(methodCall)],
-          ['else', nullExpr()]]], 'f64')
-    }
-
-    // Method call: obj.method(args) → type-aware dispatch
-    if (Array.isArray(callee) && callee[0] === '.') {
-      const [, obj, method] = callee
-
-      // charCodeAt with a statically in-bounds index — emit the i32
-      // (OOB-impossible) contract directly; the generic path keeps the
-      // f64/NaN JS-spec result. See analyze.js inBoundsCharCodeAt.
-      if (method === 'charCodeAt' && !parsed.hasSpread && parsed.normal.length === 1
-          && ctx.abi.string?.ops?.charCodeAt && inBoundsCharCodeAt(ctx).has(callee)) {
-        const recv = emit(obj)
-        // jsstring carrier: receiver is an externref boundary param. Route to
-        // `wasm:js-string.charCodeAt` directly — the in-bounds proof rules out
-        // the OOB trap the builtin would otherwise raise.
-        if (recv?.type === 'externref') {
-          ctx.core.jsstring.add('charCodeAt')
-          return typed(['call', '$__jss_charCodeAt', recv, asI32(emit(parsed.normal[0]))], 'i32')
-        }
-        return typed(ctx.abi.string.ops.charCodeAt(
-          asF64(recv), asI32(emit(parsed.normal[0])), ctx, false), 'i32')
-      }
-
-      // Function property call: fn.prop(args) → direct call to fn$prop.
-      // Skipped when the property was reassigned (wrapper composition) — then
-      // it is a mutable slot and must be read dynamically before the call.
-      if (typeof obj === 'string' && ctx.func.names.has(obj) && !ctx.func.multiProp.has(`${obj}.${method}`)) {
-        const fname = `${obj}$${method}`
-        if (ctx.func.names.has(fname)) {
-          const func = ctx.func.map.get(fname)
-          const emittedArgs = parsed.normal.map((a, k) => emitArgForParam(emit(a), func.sig.params[k]))
-          while (emittedArgs.length < func.sig.params.length)
-            emittedArgs.push(func.sig.params[emittedArgs.length].type === 'i32' ? typed(['i32.const', 0], 'i32') : undefExpr())
-          const callIR = typed(['call', `$${fname}`, ...emittedArgs], func.sig.results[0])
-          if (func.sig.ptrKind != null) callIR.ptrKind = func.sig.ptrKind
-          if (func.sig.ptrAux != null) callIR.ptrAux = func.sig.ptrAux
-          if (func.sig.unsignedResult) callIR.unsigned = true
-          return callIR
-        }
-      }
-
-      let vt = keyValType(obj)
-      // A reassigned slice/concat receiver may carry a stale `vt` — a reassignment
-      // inside a nested closure escapes analyzeValTypes' poisoning (its walk stops
-      // at `=>`). Drop to runtime dispatch, but only for guessy types: STRING/ARRAY
-      // dispatch correctly either way, and BUFFER/TYPED are construction proofs
-      // (`new ArrayBuffer`/`new XxxArray`) — the runtime String/Array fallback has
-      // no branch for them, so nulling `vt` would miscompile `ab.slice()` into an
-      // f64-array copy. jzify also splits every `var x = init` into `let x; x = init`,
-      // marking single-assignment vars "reassigned"; keeping definite BUFFER/TYPED
-      // is what keeps `var`-declared buffers correct.
-      if (typeof obj === 'string' && isReassigned(ctx.func.body, obj)
-        && (method === 'slice' || method === 'concat')
-        && vt !== VAL.STRING && vt !== VAL.ARRAY
-        && vt !== VAL.BUFFER && vt !== VAL.TYPED) vt = null
-
-      // Helper to call method with arguments (handles spread expansion)
-      const callMethod = (objArg, methodEmitter) => {
-        if (!parsed.hasSpread) {
-          return methodEmitter(objArg, ...parsed.normal)
-        }
-
-        // Bulk push fast path: `obj.push(...src)` — single spread, no normal args, named obj.
-        // The generic single-spread loop below calls methodEmitter per iteration, which expands
-        // to a full .push (grow check + ptr_offset + store + set_len) every step. Amortising the
-        // grow + set_len across the whole spread eliminates ~3 stdlib calls per byte in watr's
-        // hot `out.push(...HANDLER[op](...))` path (~24M bytes/iter on raycast).
-        if (method === 'push' && parsed.normal.length === 0 &&
-            parsed.spreads.length === 1 && typeof objArg === 'string') {
-          const spreadExpr = parsed.spreads[0].expr
-          inc('__len'); inc('__arr_grow'); inc('__set_len'); inc('__ptr_offset')
-          const o = `${T}po${ctx.func.uniq++}`,
-                sa = `${T}psa${ctx.func.uniq++}`,
-                sl = `${T}psl${ctx.func.uniq++}`,
-                ol = `${T}pol${ctx.func.uniq++}`,
-                si = `${T}psi${ctx.func.uniq++}`,
-                base = `${T}pb${ctx.func.uniq++}`
-          ctx.func.locals.set(o, 'f64'); ctx.func.locals.set(sa, 'f64')
-          ctx.func.locals.set(sl, 'i32'); ctx.func.locals.set(ol, 'i32')
-          ctx.func.locals.set(si, 'i32'); ctx.func.locals.set(base, 'i32')
-
-          const objIsArr = lookupValType(objArg) === VAL.ARRAY
-          // A materialized multi-value is not a statically-typed pointer — let
-          // emitSpreadCopy resolve its kind once at runtime.
-          const srcVT = multiCount(spreadExpr) ? undefined : valTypeOf(spreadExpr)
-          const n = multiCount(spreadExpr)
-          const ir = []
-          ir.push(['local.set', `$${o}`, asF64(emit(objArg))])
-          ir.push(['local.set', `$${sa}`, n ? materializeMulti(spreadExpr) : asF64(emit(spreadExpr))])
-          ir.push(['local.set', `$${sl}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${sa}`]]]])
-          // Old length: inline as `i32.load (off-8)` if obj is known ARRAY (matches .push handler).
-          if (objIsArr) {
-            ir.push(['local.set', `$${ol}`,
-              ['i32.load', ['i32.sub', ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${o}`]]], ['i32.const', 8]]]])
-          } else {
-            ir.push(['local.set', `$${ol}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${o}`]]]])
-          }
-          // Single grow for the full spread (vs per-element grow check in the generic loop).
-          ir.push(['local.set', `$${o}`, ['call', '$__arr_grow', ['i64.reinterpret_f64', ['local.get', `$${o}`]],
-            ['i32.add', ['local.get', `$${ol}`], ['local.get', `$${sl}`]]]])
-          // base captured AFTER grow (grow may relocate the array).
-          ir.push(['local.set', `$${base}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${o}`]]]])
-          // Bulk-copy the spread: an ARRAY source is a contiguous f64 block → memory.copy.
-          ir.push(['local.set', `$${si}`, ['local.get', `$${ol}`]])
-          ir.push(...emitSpreadCopy(base, si, sa, sl, srcVT))
-          // Single set_len for the full spread.
-          ir.push(['call', '$__set_len', ['i64.reinterpret_f64', ['local.get', `$${o}`]],
-            ['i32.add', ['local.get', `$${ol}`], ['local.get', `$${sl}`]]])
-          // Update source variable: grow may have moved the pointer.
-          if (ctx.func.boxed?.has(objArg)) {
-            ir.push(['f64.store', ['local.get', `$${ctx.func.boxed.get(objArg)}`], ['local.get', `$${o}`]])
-          } else if (ctx.scope.globals.has(objArg) && !ctx.func.locals?.has(objArg)) {
-            ir.push(['global.set', `$${objArg}`, ['local.get', `$${o}`]])
-          } else {
-            ir.push(['local.set', `$${objArg}`, ['local.get', `$${o}`]])
-          }
-          ir.push(['f64.convert_i32_s', ['i32.add', ['local.get', `$${ol}`], ['local.get', `$${sl}`]]])
-          return typed(['block', ['result', 'f64'], ...ir], 'f64')
-        }
-
-        // Single spread at end: call method with normal args, then loop spread elements
-        if (parsed.spreads.length === 1 && parsed.spreads[0].pos === parsed.normal.length) {
-          const spreadExpr = parsed.spreads[0].expr
-          const acc = `${T}acc${ctx.func.uniq++}`, arr = `${T}sp${ctx.func.uniq++}`, len = `${T}splen${ctx.func.uniq++}`, idx = `${T}spidx${ctx.func.uniq++}`
-          ctx.func.locals.set(acc, 'f64'); ctx.func.locals.set(arr, 'f64')
-          ctx.func.locals.set(len, 'i32'); ctx.func.locals.set(idx, 'i32')
-          // Emit-time rep seeding for a fresh spread-staging local (no prior reader).
-          // Without this, the loop body's `[]` read on `arr` falls back to polymorphic
-          // dispatch — VAL.* on the rep elides STRING gate for ARRAY/TYPED spreads.
-          const spreadVT = valTypeOf(spreadExpr)
-          if (spreadVT) updateRep(arr, { val: spreadVT })
-
-          // In-place spread methods modify target; accumulating methods (concat) return new values
-          const inPlace = SPREAD_MUTATORS.has(method)
-          // unshift prepends each arg to the front — iterating forward reverses the
-          // intended order, so walk the spread from end to start.
-          const reverseIter = method === 'unshift'
-          const ir = []
-          ir.push(['local.set', `$${acc}`, asF64(emit(objArg))])
-          if (parsed.normal.length > 0) {
-            const r = asF64(methodEmitter(objArg, ...parsed.normal))
-            ir.push(inPlace ? ['drop', r] : ['local.set', `$${acc}`, r])
-          }
-
-          inc('__len')
-          const n = multiCount(spreadExpr)
-          ir.push(['local.set', `$${arr}`, n ? materializeMulti(spreadExpr) : asF64(emit(spreadExpr))])
-          ir.push(['local.set', `$${len}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${arr}`]]]])
-          ir.push(['local.set', `$${idx}`,
-            reverseIter ? ['i32.sub', ['local.get', `$${len}`], ['i32.const', 1]] : ['i32.const', 0]])
-          const loopId = ctx.func.uniq++
-          const loopBody = asF64(methodEmitter(inPlace ? objArg : acc, ['[]', arr, idx]))
-          ir.push(['block', `$break${loopId}`,
-            ['loop', `$continue${loopId}`,
-              ['br_if', `$break${loopId}`,
-                reverseIter
-                  ? ['i32.lt_s', ['local.get', `$${idx}`], ['i32.const', 0]]
-                  : ['i32.ge_u', ['local.get', `$${idx}`], ['local.get', `$${len}`]]],
-              inPlace ? ['drop', loopBody] : ['local.set', `$${acc}`, loopBody],
-              ['local.set', `$${idx}`, ['i32.add', ['local.get', `$${idx}`], ['i32.const', reverseIter ? -1 : 1]]],
-              ['br', `$continue${loopId}`]]])
-
-          ir.push(inPlace ? asF64(emit(objArg)) : ['local.get', `$${acc}`])
-          return typed(['block', ['result', 'f64'], ...ir], 'f64')
-        }
-
-        // General spread case: iterate args in original order, batch contiguous normal
-        // args into a single call, emit a per-element loop for each spread.
-        //
-        // inPlace methods (push/unshift/add/set): call methodEmitter(objArg, ...) each
-        // time so the source variable's local gets updated (else heap grow/realloc
-        // wouldn't be visible to subsequent uses of the variable). Final value is objArg.
-        //
-        // non-inPlace (concat, etc.): chain via temp acc since return value is the new
-        // collection.
-        const inPlaceG = SPREAD_MUTATORS.has(method)
-        const combinedG = reconstructArgsWithSpreads(parsed.normal, parsed.spreads)
-        inc('__len')
-
-        if (inPlaceG) {
-          const irG = []
-          let batch = []
-          const flushBatch = () => {
-            if (!batch.length) return
-            irG.push(['drop', asF64(methodEmitter(objArg, ...batch))])
-            batch = []
-          }
-          for (const item of combinedG) {
-            if (Array.isArray(item) && item[0] === '__spread') {
-              flushBatch()
-              const spreadExpr = item[1]
-              const arrL = `${T}sp${ctx.func.uniq++}`, lenL = `${T}splen${ctx.func.uniq++}`, idxL = `${T}spidx${ctx.func.uniq++}`
-              ctx.func.locals.set(arrL, 'f64'); ctx.func.locals.set(lenL, 'i32'); ctx.func.locals.set(idxL, 'i32')
-              // Emit-time rep seeding for fresh spread-staging local (see arr-spread comment above).
-              const spreadVT = valTypeOf(spreadExpr)
-              if (spreadVT) updateRep(arrL, { val: spreadVT })
-              const n = multiCount(spreadExpr)
-              irG.push(
-                ['local.set', `$${arrL}`, n ? materializeMulti(spreadExpr) : asF64(emit(spreadExpr))],
-                ['local.set', `$${lenL}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${arrL}`]]]],
-                ['local.set', `$${idxL}`, ['i32.const', 0]])
-              const loopId = ctx.func.uniq++
-              const loopBody = asF64(methodEmitter(objArg, ['[]', arrL, idxL]))
-              irG.push(['block', `$break${loopId}`,
-                ['loop', `$continue${loopId}`,
-                  ['br_if', `$break${loopId}`, ['i32.ge_u', ['local.get', `$${idxL}`], ['local.get', `$${lenL}`]]],
-                  ['drop', loopBody],
-                  ['local.set', `$${idxL}`, ['i32.add', ['local.get', `$${idxL}`], ['i32.const', 1]]],
-                  ['br', `$continue${loopId}`]]])
-            } else {
-              batch.push(item)
-            }
-          }
-          flushBatch()
-          irG.push(asF64(emit(objArg)))
-          return typed(['block', ['result', 'f64'], ...irG], 'f64')
-        }
-
-        const accG = `${T}acc${ctx.func.uniq++}`
-        ctx.func.locals.set(accG, 'f64')
-        const irG = [['local.set', `$${accG}`, asF64(emit(objArg))]]
-        let batch = []
-        const flushBatch = () => {
-          if (!batch.length) return
-          irG.push(['local.set', `$${accG}`, asF64(methodEmitter(accG, ...batch))])
-          batch = []
-        }
-        for (const item of combinedG) {
-          if (Array.isArray(item) && item[0] === '__spread') {
-            flushBatch()
-            const spreadExpr = item[1]
-            const arrL = `${T}sp${ctx.func.uniq++}`, lenL = `${T}splen${ctx.func.uniq++}`, idxL = `${T}spidx${ctx.func.uniq++}`
-            ctx.func.locals.set(arrL, 'f64'); ctx.func.locals.set(lenL, 'i32'); ctx.func.locals.set(idxL, 'i32')
-            const spreadVT = valTypeOf(spreadExpr)
-            if (spreadVT) updateRep(arrL, { val: spreadVT })
-            const n = multiCount(spreadExpr)
-            irG.push(
-              ['local.set', `$${arrL}`, n ? materializeMulti(spreadExpr) : asF64(emit(spreadExpr))],
-              ['local.set', `$${lenL}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${arrL}`]]]],
-              ['local.set', `$${idxL}`, ['i32.const', 0]])
-            const loopId = ctx.func.uniq++
-            const loopBody = asF64(methodEmitter(accG, ['[]', arrL, idxL]))
-            irG.push(['block', `$break${loopId}`,
-              ['loop', `$continue${loopId}`,
-                ['br_if', `$break${loopId}`, ['i32.ge_u', ['local.get', `$${idxL}`], ['local.get', `$${lenL}`]]],
-                ['local.set', `$${accG}`, loopBody],
-                ['local.set', `$${idxL}`, ['i32.add', ['local.get', `$${idxL}`], ['i32.const', 1]]],
-                ['br', `$continue${loopId}`]]])
-          } else {
-            batch.push(item)
-          }
-        }
-        flushBatch()
-        irG.push(['local.get', `$${accG}`])
-        return typed(['block', ['result', 'f64'], ...irG], 'f64')
-      }
-
-      // Boxed object: delegate method to inner value (slot 0)
-      if (typeof obj === 'string' && ctx.schema.isBoxed?.(obj)) {
-        const innerVt = repOf(obj)?.val
-        const emitter = ctx.core.emit[`.${innerVt}:${method}`] || ctx.core.emit[`.${method}`]
-        if (emitter) {
-          const innerName = `${obj}${T}inner`
-          if (!ctx.func.locals.has(innerName)) ctx.func.locals.set(innerName, 'f64')
-          const boxBase = tempI32('bb')
-          // Load current inner value from boxed object's slot 0 (may have been updated by prior mutations)
-          // Boxed handle is OBJECT-kind, never ARRAY — skip forwarding.
-          const loadInner = [
-            ['local.set', `$${boxBase}`, ptrOffsetIR(asF64(emit(obj)), lookupValType(obj) || VAL.OBJECT)],
-            ['local.set', `$${innerName}`, ctx.abi.object.ops.load(['local.get', `$${boxBase}`], 0)]]
-          const result = callMethod(innerName, emitter)
-          // Mutating methods may reallocate; writeback inner value to boxed slot
-          if (BOXED_MUTATORS.has(method)) {
-            const wb = ctx.abi.object.ops.store(['local.get', `$${boxBase}`], 0, ['local.get', `$${innerName}`])
-            return typed(['block', ['result', 'f64'], ...loadInner, asF64(result), wb], 'f64')
-          }
-          // Non-mutating: just load inner and call
-          return typed(['block', ['result', 'f64'], ...loadInner, asF64(result)], 'f64')
-        }
-      }
-
-      // valueOf/toString are ToPrimitive hooks (ES2024 7.1.1) that an own data
-      // property shadows. An assigned `obj.valueOf`/`obj.toString` must win over
-      // the builtin emitter for any receiver that can carry a dynamic-prop
-      // sidecar — a sidecar-bearing static type (array/typed/object) OR a
-      // statically-unknown receiver (e.g. an array-element read `arr[0]`, whose
-      // type is only known at runtime). Probe the sidecar and call it when it
-      // holds a closure, else fall back to the builtin (generic when untyped:
-      // `.valueOf` returns the receiver, `.toString` runs type-aware __to_str).
-      // Parallels the member-READ check in module/core.js emitPropAccess (which
-      // stays scoped to known sidecar types). (watr's `str()` attaches
-      // `bytes.valueOf = () => s`, recovered via `.valueOf()`.)
-      if ((method === 'valueOf' || method === 'toString') && ctx.closure.call
-          && !parsed.hasSpread && parsed.normal.length === 0
-          && (vt === VAL.ARRAY || vt === VAL.TYPED || vt === VAL.OBJECT || !vt)) {
-        const builtin = (vt && ctx.core.emit[`.${vt}:${method}`]) || ctx.core.emit[`.${method}`]
-        if (builtin) {
-          const objTmp = temp('vobj'), propTmp = temp('vprop')
-          inc('__dyn_get_expr', '__ptr_type')
-          return typed(['block', ['result', 'f64'],
-            ['local.set', `$${objTmp}`, asF64(emit(obj))],
-            ['local.set', `$${propTmp}`, ['f64.reinterpret_i64',
-              ['call', '$__dyn_get_expr', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]], asI64(emit(['str', method]))]]],
-            ['if', ['result', 'f64'],
-              ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${propTmp}`]]], ['i32.const', PTR.CLOSURE]],
-              ['then', ctx.closure.call(typed(['local.get', `$${propTmp}`], 'f64'), [])],
-              ['else', asF64(callMethod(objTmp, builtin))]]], 'f64')
-        }
-      }
-
-      // Known type → static dispatch
-      if (vt && ctx.core.emit[`.${vt}:${method}`]) {
-        return callMethod(obj, ctx.core.emit[`.${vt}:${method}`])
-      }
-
-      // Unknown / guessed-array type, both string + generic exist → runtime dispatch by ptr type.
-      // analyze.js defaults untyped `.slice()` results to VAL.ARRAY, which is a guess, not a proof;
-      // runtime dispatch resolves whether the operand is actually a string or an array.
-      // Concretely-typed non-string values (BUFFER, TYPED, MAP, …) fall through to the generic
-      // emitter which already knows how to handle them.
-      const strKey = `.string:${method}`, genKey = `.${method}`
-      if ((!vt || vt === VAL.ARRAY) && ctx.core.emit[strKey] && ctx.core.emit[genKey]) {
-        const t = `${T}rt${ctx.func.uniq++}`, tt = `${T}rtt${ctx.func.uniq++}`
-        ctx.func.locals.set(t, 'f64'); ctx.func.locals.set(tt, 'i32')
-        const strEmitter = ctx.core.emit[strKey]
-        const genEmitter = ctx.core.emit[genKey]
-        return typed(['block', ['result', 'f64'],
-          ['local.set', `$${t}`, asF64(emit(obj))],
-          ['local.set', `$${tt}`, ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]],
-          ['if', ['result', 'f64'],
-            ['i32.eq', ['local.get', `$${tt}`], ['i32.const', PTR.STRING]],
-            ['then', callMethod(t, strEmitter)],
-            ['else', callMethod(t, genEmitter)]]], 'f64')
-      }
-
-      // Schema property function call: x.prop(args) where prop is a closure in boxed schema
-      if (typeof obj === 'string' && ctx.schema.find && ctx.closure.call) {
-        const idx = ctx.schema.find(obj, method)
-        if (idx >= 0 && !ctx.schema.isBoxed?.(obj)) {
-          const propRead = typed(ctx.abi.object.ops.load(ptrOffsetIR(asF64(emit(obj)), lookupValType(obj) || VAL.OBJECT), idx), 'f64')
-          if (parsed.hasSpread) {
-            const combined = reconstructArgsWithSpreads(parsed.normal, parsed.spreads)
-            return ctx.closure.call(propRead, [buildArrayWithSpreads(combined)], true)
-          }
-          return ctx.closure.call(propRead, parsed.normal)
-        }
-      }
-
-      // Schema property function call: x.prop(args) where prop is a closure in boxed schema
-      if (typeof obj === 'string' && ctx.schema.find && ctx.closure.call && ctx.schema.isBoxed?.(obj)) {
-        const idx = ctx.schema.find(obj, method)
-        if (idx >= 0) {
-          const propRead = typed(ctx.abi.object.ops.load(ptrOffsetIR(asF64(emit(obj)), lookupValType(obj) || VAL.OBJECT), idx), 'f64')
-          return ctx.closure.call(propRead, parsed.normal)
-        }
-      }
-
-      // Generic only — but a collection emitter (`.get`/`.set`/`.has`/`.add`/
-      // `.delete`) assumes a Map/Set receiver: a proven collection already
-      // dispatched via `.${vt}:${method}` above, so reaching here means the
-      // receiver is not a proven collection. A zero-arg call then cannot be the
-      // collection op (each needs ≥1 key/value arg) — it is a user/closure
-      // method (e.g. `new C().get()`). Skip the collection emitter so it falls
-      // through to closure/dynamic dispatch instead of crashing on `emit(key)`.
-      const collectionMisfit = COLLECTION_METHODS.has(method) &&
-        !parsed.hasSpread && parsed.normal.length === 0
-      if (ctx.core.emit[genKey] && !collectionMisfit) {
-        return callMethod(obj, ctx.core.emit[genKey])
-      }
-
-      // Dynamic property function call on non-external values.
-      if (ctx.closure.call) {
-        if (ctx.transform.strict)
-          err(`strict mode: method call \`${typeof obj === 'string' ? obj : '<expr>'}.${method}(...)\` on a value of unknown type pulls dynamic dispatch stdlib. Annotate the receiver type or pass { strict: false }.`)
-        const objTmp = `${T}mobj${ctx.func.uniq++}`
-        ctx.func.locals.set(objTmp, 'f64')
-        const combined = reconstructArgsWithSpreads(parsed.normal, parsed.spreads)
-        const arrayIR = buildArrayWithSpreads(combined)
-        const propRead = typed(['f64.reinterpret_i64', ['call', '$__dyn_get_expr', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]], asI64(emit(['str', method]))]], 'f64')
-        const propTmp = `${T}mprop${ctx.func.uniq++}`
-        ctx.func.locals.set(propTmp, 'f64')
-        if (usesDynProps(vt)) {
-          inc('__dyn_get_expr', '__ptr_type')
-          return typed(['block', ['result', 'f64'],
-            ['local.set', `$${objTmp}`, asF64(emit(obj))],
-            ['local.set', `$${propTmp}`, propRead],
-            ['if', ['result', 'f64'],
-              ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${propTmp}`]]], ['i32.const', PTR.CLOSURE]],
-              ['then', ctx.closure.call(typed(['local.get', `$${propTmp}`], 'f64'), [arrayIR], true)],
-              ['else', undefExpr()]]], 'f64')
-        }
-        // WASI: no PTR.EXTERNAL values; closure-only dispatch is correct.
-        if (ctx.transform.host === 'wasi') {
-          inc('__dyn_get_expr', '__ptr_type')
-          return typed(['block', ['result', 'f64'],
-            ['local.set', `$${objTmp}`, asF64(emit(obj))],
-            ['local.set', `$${propTmp}`, propRead],
-            ['if', ['result', 'f64'],
-              ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${propTmp}`]]], ['i32.const', PTR.CLOSURE]],
-              ['then', ctx.closure.call(typed(['local.get', `$${propTmp}`], 'f64'), [arrayIR], true)],
-              ['else', undefExpr()]]], 'f64')
-        }
-        inc('__dyn_get_expr', '__ext_call', '__ptr_type')
-        ctx.features.external = true
-        return typed(['block', ['result', 'f64'],
-          ['local.set', `$${objTmp}`, asF64(emit(obj))],
-          ['local.set', `$${propTmp}`, propRead],
-          ['if', ['result', 'f64'],
-            ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${propTmp}`]]], ['i32.const', PTR.CLOSURE]],
-            ['then', ctx.closure.call(typed(['local.get', `$${propTmp}`], 'f64'), [arrayIR], true)],
-            ['else', ['if', ['result', 'f64'],
-              ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]]], ['i32.const', PTR.EXTERNAL]],
-              ['then', ['f64.reinterpret_i64', ['call', '$__ext_call',
-                ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]],
-                ['i64.reinterpret_f64', asF64(emit(['str', method]))],
-                ['i64.reinterpret_f64', arrayIR]]]],
-              ['else', undefExpr()]]]]], 'f64')
-      }
-
-      // Unknown callee - assume external method
-      if (ctx.transform.strict)
-        err(`strict mode: method call \`${typeof obj === 'string' ? obj : '<expr>'}.${method}(...)\` on a value of unknown type falls through to host \`__ext_call\`. Annotate the receiver type or pass { strict: false }.`)
-      // Under wasi there is no host `__ext_call` — the call lowers to a
-      // no-op returning `undefined`. This is by-design so polymorphic code
-      // can target js and wasi from one source; users who want fail-fast
-      // pass `strict: true` (handled above).
-      if (ctx.transform.host === 'wasi') return undefExpr()
-      inc('__ext_call')
-      ctx.features.external = true
-      const combined = reconstructArgsWithSpreads(parsed.normal, parsed.spreads)
-      const arrayIR = buildArrayWithSpreads(combined)
-      return typed(['f64.reinterpret_i64', ['call', '$__ext_call',
-        ['i64.reinterpret_f64', asF64(emit(obj))],
-        ['i64.reinterpret_f64', asF64(emit(['str', method]))],
-        ['i64.reinterpret_f64', arrayIR]]], 'f64');
-    }
-
-    if (typeof callee === 'string' && ctx.core.emit[callee] && !isBoundName(callee) && !isUserFunc(callee)) {
-      // Pass spread args through to emitter (e.g. Math.max(...arr))
-      if (parsed.hasSpread) {
-        const allArgs = []
-        let ni = 0
-        for (const s of parsed.spreads) {
-          while (ni < s.pos) allArgs.push(parsed.normal[ni++])
-          allArgs.push(['...', s.expr])
-        }
-        while (ni < parsed.normal.length) allArgs.push(parsed.normal[ni++])
-        return ctx.core.emit[callee](...allArgs)
-      }
-      return ctx.core.emit[callee](...parsed.normal)
-    }
-
-    // Direct call if callee is a known top-level function
-    if (typeof callee === 'string' && ctx.func.names.has(callee) && !isBoundName(callee)) {
-      const func = ctx.func.map.get(callee)
-
-      // Rest param case: collect all args (including expanded spreads) into array
-      if (func?.rest) {
-        const fixedParamCount = func.sig.params.length - 1
-        const fixedArgs = parsed.normal.slice(0, fixedParamCount)
-        // Pad missing fixed args with `undefined` so default-param init triggers per spec.
-        const emittedFixed = fixedArgs.map((a, k) => emitArgForParam(emit(a), func.sig.params[k]))
-        while (emittedFixed.length < fixedParamCount)
-          emittedFixed.push(func.sig.params[emittedFixed.length].type === 'i32' ? typed(['i32.const', 0], 'i32') : undefExpr())
-
-        // Reconstruct with spreads, then take rest args
-        const combined = reconstructArgsWithSpreads(parsed.normal, parsed.spreads)
-        const restArgsFinal = combined.slice(fixedParamCount)
-
-        // Build array: emit code for normal args + code to expand spreads
-        const arrayIR = buildArrayWithSpreads(restArgsFinal)
-        const callIR = typed(['call', `$${callee}`,
-          ...emittedFixed,
-          arrayIR], func.sig.results[0])
-        if (func.sig.ptrKind != null) callIR.ptrKind = func.sig.ptrKind
-        if (func.sig.ptrAux != null) callIR.ptrAux = func.sig.ptrAux
-        if (func.sig.unsignedResult) callIR.unsigned = true
-        return callIR
-      }
-
-      // Regular function call without rest params
-      if (parsed.hasSpread) err(`Spread not supported in calls to non-variadic function ${callee}`)
-      // Pad missing args with `undefined` so default-param init triggers per spec
-      // (only undefined, not null, should trigger defaults). Drop extras to match
-      // JS calling convention — emitting them anyway produces an invalid call
-      // when the callee is a fixed-arity import (e.g. `_interp`-registered host
-      // stubs) since wasm validates arg count. Use ?? rather than || so a
-      // legitimate 0-arity callee isn't bypassed.
-      const args = parsed.normal.map((a, k) => emitArgForParam(emit(a), func?.sig.params[k]))
-      const expected = func?.sig.params.length ?? args.length
-      while (args.length < expected) args.push(func?.sig.params[args.length]?.type === 'i32' ? typed(['i32.const', 0], 'i32') : undefExpr())
-      if (args.length > expected) args.length = expected
-      // Multi-value return: materialize as heap array (caller expects single pointer)
-      if (func?.sig.results.length > 1) return materializeMulti(['()', callee, ...parsed.normal])
-      const callIR = typed(['call', `$${callee}`, ...args], func?.sig.results[0] || 'f64')
-      if (func?.sig.ptrKind != null) callIR.ptrKind = func.sig.ptrKind
-      if (func?.sig.ptrAux != null) callIR.ptrAux = func.sig.ptrAux
-      // Unsigned-uint32 result (every tail was `>>>`): consumer's asF64 must use
-      // `f64.convert_i32_u` instead of `_s`, preserving the [0, 2^32) range.
-      if (func?.sig.unsignedResult) callIR.unsigned = true
-      return callIR
-    }
-
-    // A3: const-bound, non-escaping closure → direct call to body (skip call_indirect).
-    // emitDecl registered name → bodyName when it saw the closure.make IR. Body signature
-    // is uniform $ftN: (env f64, argc i32, a0..a{W-1} f64) → f64. We pass the closure
-    // NaN-box itself as env (body extracts captures via __ptr_offset(__env)).
-    if (typeof callee === 'string' && !parsed.hasSpread
-        && ctx.func.directClosures?.has(callee)) {
-      const bodyName = ctx.func.directClosures.get(callee)
-      const W = ctx.closure.width ?? MAX_CLOSURE_ARITY
-      const n = parsed.normal.length
-      if (n <= W) {
-        const slots = parsed.normal.map(a => asF64(emit(a)))
-        while (slots.length < W) slots.push(undefExpr())
-        return typed(['call', `$${bodyName}`,
-          asF64(emit(callee)),
-          typed(['i32.const', n], 'i32'),
-          ...slots], 'f64')
-      }
-    }
-
-    // Closure call: callee is a variable holding a NaN-boxed closure pointer
-    // Uniform convention: fn.call packs all args into an array
-    if (ctx.closure.call) {
-      if (parsed.hasSpread) {
-        // Spread: build the args array directly (handles __spread markers)
-        const combined = reconstructArgsWithSpreads(parsed.normal, parsed.spreads)
-        const arrayIR = buildArrayWithSpreads(combined)
-        // Pass pre-built array as single already-emitted arg
-        return ctx.closure.call(emit(callee), [arrayIR], true)
-      }
-      return ctx.closure.call(emit(callee), parsed.normal)
-    }
-
-    // Unknown callee — assume direct call. Match arg count to the declared
-    // signature when the callee is a registered env import (e.g. `_interp`-
-    // wired host stubs). JS calling convention drops extras and pads missing;
-    // wasm requires exact arity, so emitting raw argList against a fixed-arity
-    // import would invalidate the module.
-    let calleeArity = null
-    if (typeof callee === 'string') {
-      const imp = ctx.module.imports?.find(i =>
-        Array.isArray(i) && i[0] === 'import' && i[3]?.[0] === 'func' && i[3]?.[1] === `$${callee}`)
-      if (imp) {
-        let n = 0
-        for (let k = 2; k < imp[3].length; k++) if (Array.isArray(imp[3][k]) && imp[3][k][0] === 'param') n++
-        calleeArity = n
-      }
-    }
-    const emittedArgs = argList.map(a => asF64(emit(a)))
-    if (calleeArity != null) {
-      while (emittedArgs.length < calleeArity) emittedArgs.push(undefExpr())
-      if (emittedArgs.length > calleeArity) emittedArgs.length = calleeArity
-    }
-    return typed(['call', `$${callee}`, ...emittedArgs], 'f64')
-  },
-}
-
-// === Emit dispatch ===
-
-// Optional-chain continuation: `a?.b.c` → if `a` nullish then undefined, else `a.b.c`.
-// Per ECMAScript, an optional access short-circuits the entire continuation, not just
-// its own access. Without this, `a?.b.c` parses as `(a?.b).c` and `.c` runs on the
-// nullish result of `a?.b`, returning a wrong value (or trapping in typed lowerings).
-//
-// At the outermost `.` / `[]` / `()` whose leftmost descent contains an optional, hoist
-// the deepest such optional's head into a temp, nullish-guard, and rebuild the chain
-// with that optional replaced by a regular access. The single guard short-circuits the
-// whole continuation. Nested optionals further inside the chain are left intact and
-// handle their own short-circuiting on recursion.
-function liftOptionalChain(node) {
-  const path = []
-  let cur = node
-  while (Array.isArray(cur) && (cur[0] === '.' || cur[0] === '[]' || cur[0] === '()' ||
-                                 cur[0] === '?.' || cur[0] === '?.[]' || cur[0] === '?.()')) {
-    path.push(cur)
-    cur = cur[1]
-  }
-  // Find the deepest optional with continuation outside it. optIdx === 0 means the
-  // chain root itself is optional with no continuation — handled by the regular
-  // `?.` / `?.[]` / `?.()` emitters.
-  let optIdx = -1
-  for (let i = path.length - 1; i >= 1; i--) {
-    if (path[i][0] === '?.' || path[i][0] === '?.[]' || path[i][0] === '?.()') {
-      optIdx = i
-      break
-    }
-  }
-  if (optIdx <= 0) return null
-  const opt = path[optIdx]
-  const headExpr = opt[1]
-  const t = temp('oc')
-  let rebuilt
-  if (opt[0] === '?.') rebuilt = ['.', t, opt[2]]
-  else if (opt[0] === '?.[]') rebuilt = ['[]', t, opt[2]]
-  else rebuilt = ['()', t, ...opt.slice(2)]
-  for (let i = optIdx - 1; i >= 0; i--) {
-    const outer = path[i]
-    rebuilt = [outer[0], rebuilt, ...outer.slice(2)]
-  }
-  return typed(['block', ['result', 'f64'],
-    ['local.set', `$${t}`, asF64(emit(headExpr))],
-    ['if', ['result', 'f64'],
-      ['i32.eqz', isNullish(typed(['local.get', `$${t}`], 'f64'))],
-      ['then', asF64(emit(rebuilt))],
-      ['else', undefExpr()]]], 'f64')
-}
-
-/**
- * Emit single AST node to typed WASM IR.
- * Every returned node has .type = 'i32' | 'f64'.
- * @param {import('./prepare.js').ASTNode} node
- * @returns {Array} typed WASM S-expression
- */
-export function emit(node, expect) {
-  _expect = expect || null
-  if (Array.isArray(node)) {
-    ctx.error.node = node
-    if (node.loc != null) ctx.error.loc = node.loc
-  }
-  if (node == null) return null
-  // Boolean literals carry VAL.BOOL for type observation (valTypeOf reads the
-  // AST), but their working representation is the plain number 0/1 — identical
-  // codegen to the pre-carrier `[, 1]`/`[, 0]` folding, so no perf is paid.
-  if (node === true) return emitNum(1)
-  if (node === false) return emitNum(0)
-  if (typeof node === 'symbol') // JZ_NULL sentinel → null NaN
-    return nullExpr()
-  if (typeof node === 'bigint') {
-    // Truncate to 64 bits — `BigInt.asUintN(64, …)` semantics, same as the
-    // explicit mask `node & 0xFFFFFFFFFFFFFFFFn`. Decimal form (vs. the prior
-    // unsigned-hex dance) is enough now that watr's optimize.js getConst
-    // handles signed strings correctly (4.6.8 W5 fix).
-    return typed(['f64.reinterpret_i64', ['i64.const', BigInt.asUintN(64, node).toString()]], 'f64')
-  }
-  if (typeof node === 'number') return emitNum(node)
-  if (typeof node === 'string') {
-    // Variable read: boxed / local / param / global (check before emitter table to avoid name collisions)
-    if (ctx.func.boxed?.has(node) || ctx.func.locals?.has(node) || ctx.func.current?.params?.some(p => p.name === node) || isGlobal(node) || repOf(node)?.intConst != null)
-      return readVar(node)
-    // Top-level function used as value → wrap as closure pointer for call_indirect
-    if (ctx.func.names.has(node) && !ctx.func.locals?.has(node) && !ctx.func.current?.params?.some(p => p.name === node) && ctx.closure.table) {
-      // Trampoline signature: uniform closure ABI (env f64, argc i32, a0..a{MAX-1} f64) → f64.
-      // Forwards the first N inline slots to $func where N = func's fixed param count.
-      const func = ctx.func.map.get(node)
-      const sigParams = func?.sig.params || []
-      if (sigParams.length > MAX_CLOSURE_ARITY) err(`Function ${node} used as closure value has ${sigParams.length} params, exceeds MAX_CLOSURE_ARITY=${MAX_CLOSURE_ARITY}`)
-      const trampolineName = `${T}tramp_${node}`
-      if (!ctx.core.stdlib[trampolineName]) {
-        const W = ctx.closure.width ?? MAX_CLOSURE_ARITY
-        const paramDecls = ['(param $__env f64)', '(param $__argc i32)']
-        for (let i = 0; i < W; i++) paramDecls.push(`(param $__a${i} f64)`)
-        // Forward fixed slots; if func expects i32, convert via trunc_sat
-        const fwd = sigParams.map((p, i) =>
-          p.type === 'i32'
-            ? `(i32.trunc_sat_f64_s (local.get $__a${i}))`
-            : `(local.get $__a${i})`).join(' ')
-        if ((func?.sig.results.length || 1) > 1) {
-          const n = func.sig.results.length
-          const arr = `${T}retarr`
-          const temps = Array.from({ length: n }, (_, i) => `${T}ret${i}`)
-          const tempLocals = temps.map(name => `(local $${name} f64)`).join(' ')
-          const stores = temps.map((name, i) =>
-            `(f64.store (i32.add (local.get $${arr}) (i32.const ${i * 8})) (local.get $${name}))`
-          ).join(' ')
-          const capture = temps.slice().reverse().map(name => `(local.set $${name})`).join(' ')
-          ctx.core.stdlib[trampolineName] = `(func $${trampolineName} ${paramDecls.join(' ')} (result f64) (local $${arr} i32) ${tempLocals} (call $${node} ${fwd}) ${capture} (local.set $${arr} (call $__alloc (i32.const ${n * 8 + 8}))) (i32.store (local.get $${arr}) (i32.const ${n})) (i32.store (i32.add (local.get $${arr}) (i32.const 4)) (i32.const ${n})) (local.set $${arr} (i32.add (local.get $${arr}) (i32.const 8))) ${stores} (call $__mkptr (i32.const 1) (i32.const 0) (local.get $${arr})))`
-          inc(trampolineName, '__alloc', '__mkptr')
-        } else {
-          // Convert i32/i64 results back to f64 — uniform closure ABI returns f64.
-          const resType = func?.sig.results[0]
-          const callExpr = `(call $${node} ${fwd})`
-          const wrapped = resType === 'i32'
-            ? (func.sig.unsignedResult ? `(f64.convert_i32_u ${callExpr})` : `(f64.convert_i32_s ${callExpr})`)
-            : resType === 'i64'
-              ? `(f64.reinterpret_i64 ${callExpr})`
-              : callExpr
-          ctx.core.stdlib[trampolineName] = `(func $${trampolineName} ${paramDecls.join(' ')} (result f64) ${wrapped})`
-          inc(trampolineName)
-        }
-      }
-      let idx = ctx.closure.table.indexOf(trampolineName)
-      if (idx < 0) { idx = ctx.closure.table.length; ctx.closure.table.push(trampolineName) }
-      const ir = mkPtrIR(PTR.CLOSURE, idx, 0)
-      ir.closureFuncIdx = idx
-      return ir
-    }
-    // Emitter table: only namespace-resolved names (contain '.', e.g. 'math.PI') — safe from user variable collision
-    if (node.includes('.') && ctx.core.emit[node]) {
-      const handler = ctx.core.emit[node]
-      return handler.length > 0 ? builtinFunctionValue(node) : handler()
-    }
-    // Auto-import known host globals (WebAssembly, globalThis, etc.)
-    const HOST_GLOBALS = new Set(['WebAssembly', 'globalThis', 'self', 'window', 'global', 'process'])
-    if (HOST_GLOBALS.has(node) && !ctx.func.locals?.has(node) && !ctx.func.current?.params?.some(p => p.name === node) && !isGlobal(node)) {
-      if (ctx.transform.host === 'wasi') err(`host:'wasi': reference to host global \`${node}\` requires an env import. Remove the reference or use host:'js'.`)
-      ctx.features.external = true
-      ctx.scope.globals.set(node, null)
-      // Carrier is i64 (not f64) so V8 can't canonicalize the NaN-boxed
-      // external-ref payload across the wasm↔JS global boundary (same hazard
-      // as env.print/setTimeout — see module/console.js header). asF64()
-      // reinterprets to f64 at every read site.
-      ctx.module.imports.push(['import', '"env"', `"${node}"`, ['global', `$${node}`, 'i64']])
-      ctx.scope.globalTypes.set(node, 'i64')
-      return typed(['global.get', `$${node}`], 'i64')
-    }
-    const t = ctx.func.locals?.get(node) || ctx.func.current?.params.find(p => p.name === node)?.type || 'f64'
-    return typed(['local.get', `$${node}`], t)
-  }
-  if (!Array.isArray(node)) return typed(['f64.const', 0], 'f64')
-
-  const [op, ...args] = node
-  // WASM IR passthrough: internally-generated IR nodes (from statement flattening) pass through
-  if (typeof op === 'string' && !ctx.core.emit[op] && (op.includes('.') || WASM_OPS.has(op))) return node
-
-  // Literal node [, value] — handle null/undefined values
-  if (op == null && args.length === 1) {
-    const v = args[0]
-    return v === undefined ? undefExpr() : v === null ? nullExpr() : emit(v)
-  }
-
-  // Optional-chain continuation: `a?.b.c` → if `a` nullish then undefined else `a.b.c`.
-  // Lift before dispatch so the regular `.` / `[]` / `()` handler sees the rebuilt chain
-  // with the optional already replaced by a non-optional access on a guarded temp.
-  if (op === '.' || op === '[]' || op === '()') {
-    const lifted = liftOptionalChain(node)
-    if (lifted) return lifted
-  }
-
-  const handler = ctx.core.emit[op]
-  if (!handler) err(`Unknown op: ${op}`)
-  return handler(...args)
-}