jz 0.6.0 → 0.7.0

package/src/compile/plan/index.js

@@ -29,6 +29,7 @@ import { collectProgramFacts, refreshProgramFacts } from '../program-facts.js'
 import narrowSignatures, {
   specializeBimorphicTyped, refineDynKeys,
   applyJsstringBoundaryCarrierStandalone, narrowBoolResults,
+  strictBoundaryTypeCheck,
 } from '../narrow.js'
 
 import { optimizing } from './common.js'
@@ -94,6 +95,7 @@ export default function plan(ast, profiler) {
     sweep('scalarizeTypedArrays', () => scalarizeFunctionTypedArrays(programFacts))
   }
   ctx.types.dynKeyVars = programFacts.dynVars
+  ctx.types.dynWriteVars = programFacts.dynWriteVars
   ctx.types.anyDynKey = programFacts.anyDyn
 
   t('materializeAutoBoxSchemas', () => materializeAutoBoxSchemas(programFacts))
@@ -105,6 +107,7 @@ export default function plan(ast, profiler) {
     // fact, so `export let f = (a) => a > 2` boxes its boundary atom.
     applyJsstringBoundaryCarrierStandalone(programFacts)
     narrowBoolResults()
+    strictBoundaryTypeCheck(programFacts)
     adviseProgram(programFacts)
     return programFacts
   }
@@ -112,6 +115,7 @@ export default function plan(ast, profiler) {
   t('narrowSignatures', () => narrowSignatures(programFacts, ast))
   t('specializeBimorphicTyped', () => specializeBimorphicTyped(programFacts))
   t('refineDynKeys', () => refineDynKeys(programFacts))
+  strictBoundaryTypeCheck(programFacts)
 
   adviseProgram(programFacts)
   return programFacts

package/src/compile/plan/inline.js

@@ -359,12 +359,15 @@ export const inlineHotInternalCalls = (programFacts, ast) => {
       if (some(func.body, n => n[0] === '()' && typeof n[1] === 'string' && ctx.func.names.has(n[1]))) continue
       // Per-iteration call overhead dwarfs body-size bloat when EVERY site sits
       // inside a caller's loop (game-of-life's rot: ~40 nodes × 2 sites, fired
-      // for most of 260k cells/frame). V8's pre-Turboshaft wasm tiers never
+      // for most of 260k cells/frame; cloth's relax: ~160 nodes × 2 sites, fired
+      // per link every relaxation pass). V8's pre-Turboshaft wasm tiers never
       // inline cross-function, so an out-of-line leaf in a hot loop is a hard
       // per-cell tax on Node ≤ 22 — and still saves call setup on newer tiers.
+      // The in-loop cap is generous because the gate above bounds non-tiny leaves
+      // to ≤2 sites, so the spliced duplication is at most ~2× a bounded body.
       const allSitesInLoop = sites.every(site =>
         site.callerFunc?.body && containsNode(site.callerFunc.body, site.node, false))
-      if (nodeSize(func.body) > (allSitesInLoop ? 80 : 30)) continue
+      if (nodeSize(func.body) > (allSitesInLoop ? 200 : 30)) continue
     }
     if (some(func.body, n => n[0] === '()' && n[1] === func.name)) continue
     // Kernels with nested loops (depth ≥ 2) are typically large and the inner

package/src/compile/plan/literals.js

@@ -25,7 +25,7 @@
 
 import { ctx } from '../../ctx.js'
 import {
-  some, T, stmtList, refsName, ASSIGN_OPS, isReassigned, hasControlTransfer,
+  some, T, stmtList, refsName, REFS_IN_EXPR, ASSIGN_OPS, isReassigned, hasControlTransfer,
 } from '../../ast.js'
 import {
   intLiteralValue, constIntExpr, staticObjectProps, staticPropertyKey,
@@ -90,7 +90,7 @@ const safeScalarArrayUse = (node, name, len, parentOp = null) => {
   const op = node[0]
   if (ASSIGN_TARGET_OPS.has(op) && node[1] === name) return false
   if (isMemberWriteTarget(op, node, name)) return false
-  if ((op === 'let' || op === 'const') && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
+  if (isDeclOp(op) && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
   if ((op === '.' || op === '?.') && node[1] === name) return node[2] === 'length'
   // Element write `name[idx] (op)= v` / `name[idx]++`: an out-of-bounds index
   // grows the array (sparse-array semantics), which the fixed scalar slot set
@@ -141,7 +141,7 @@ const safeScalarObjectUse = (node, name, keys) => {
   if (!Array.isArray(node)) return true
   const op = node[0]
   if (ASSIGN_TARGET_OPS.has(op) && node[1] === name) return false
-  if ((op === 'let' || op === 'const') && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
+  if (isDeclOp(op) && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
   if ((op === '.' || op === '?.') && node[1] === name) return keys.has(node[2])
   if (op === '[]' && node[1] === name) {
     const key = staticPropertyKey(node[2])
@@ -181,7 +181,7 @@ const safeScalarTypedArrayUse = (node, name, len, coerce = '') => {
   if (typeof node === 'string') return node !== name
   if (!Array.isArray(node)) return true
   const op = node[0]
-  if ((op === 'let' || op === 'const') && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
+  if (isDeclOp(op) && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
   if (isMemberWriteTarget(op, node, name)) return false
   if ((op === '.' || op === '?.') && node[1] === name) return node[2] === 'length'
   if (op === '[]' && node[1] === name) return typedArraySlotIndex(node[2], len) != null
@@ -200,6 +200,34 @@ const safeScalarTypedArrayUse = (node, name, len, coerce = '') => {
   for (let i = 1; i < node.length; i++) if (!safeScalarTypedArrayUse(node[i], name, len, coerce)) return false
   return true
 }
+
+// `name`'s reference used as a bare VALUE — anywhere except as the base of `name[i]`,
+// `name.prop`, or `name.method(...)`. That captures a second handle to its backing memory.
+const refsAsValue = (node, name) => {
+  if (node === name) return true
+  if (!Array.isArray(node)) return false
+  if (node[0] === '[]' && node[1] === name) return refsAsValue(node[2], name)   // name[i]: vet the index only
+  if ((node[0] === '.' || node[0] === '?.') && node[1] === name) return false    // name.prop / name.method()
+  if (node[0] === '()') return false                                             // a call RESULT, not name itself
+  return node.slice(1).some(e => refsAsValue(e, name))
+}
+
+// True when `name`'s backing memory ESCAPES into a persistent alias: bound to another
+// variable (`let b = name`), stored into a field or literal (`o.x = name`, `[name]`), or
+// captured as a `.subarray(...)` view. Mirrored scalarization syncs scalars↔memory only
+// AROUND each unsafe statement, so a write through the captured alias in a LATER statement
+// never reaches `name`'s scalar slots (and vice-versa) — the array must stay memory-backed.
+// A bare `name` passed only as a call ARGUMENT is transient (the callee touches it during
+// the call, already covered by the surrounding sync), so it is NOT a capture.
+const createsTypedArrayAlias = (node, name) => {
+  if (!Array.isArray(node)) return false
+  if (node[0] === '()' && Array.isArray(node[1]) && node[1][0] === '.'
+      && node[1][1] === name && node[1][2] === 'subarray') return true           // zero-copy view
+  if (node[0] === '=' && refsAsValue(node[2], name)) return true                  // let b = name / x = name
+  if ((node[0] === '[' || node[0] === '{}') && node.slice(1).some(e => refsAsValue(e, name))) return true  // [name] / {k:name}
+  for (let i = 1; i < node.length; i++) if (createsTypedArrayAlias(node[i], name)) return true
+  return false
+}
 const rewriteScalarTypedArrayUses = (node, arrays) => {
   if (!Array.isArray(node)) return node
   const op = node[0]
@@ -286,14 +314,16 @@ const scalarizeTypedArrayLiteralSeq = (seq) => {
     const fixed = fixedScalarTypedArray(decl[2])
     if (fixed == null) continue
     const { len, coerce } = fixed
-    let hasSafeUse = false, hasUnsafeUse = false
+    let hasSafeUse = false, hasUnsafeUse = false, hasAliasUse = false
     for (let j = 0; j < stmts.length; j++) {
       if (j === i) continue
       if (!refsName(stmts[j], decl[1])) continue
       const safe = safeScalarTypedArrayUse(stmts[j], decl[1], len, coerce)
       hasSafeUse ||= safe
       hasUnsafeUse ||= !safe
+      hasAliasUse ||= createsTypedArrayAlias(stmts[j], decl[1])
     }
+    if (hasAliasUse) continue   // persistent aliasing view (subarray) — keep memory-backed
     if (hasUnsafeUse && (!hasSafeUse || coerce)) continue
     if (!hasUnsafeUse) candidates.set(decl[1], { index: i, len, coerce, mirrored: false })
     else mirrored.set(decl[1], { index: i, len, coerce, mirrored: true })
@@ -621,6 +651,191 @@ function scalarizeObjectLiterals(node, escapes) {
   return changed ? { node: out, changed: true } : { node, changed: false }
 }
 
+// === Whole-program constant fold of module-scope aggregate literals ===
+//
+// `var x = [1,2,3]; export const y = x[0]` materializes a data-segment array and
+// indexes it through __arr_idx_known (bounds + grow-forwarding) — all dead weight
+// for a never-grown constant. When EVERY reference to a module-scope const aggregate
+// is a static READ, replace each `x[k]` / `x.length` / `o.key` by its literal value
+// program-wide; the now-unused decl is dropped, so no array is built (no data, no
+// memory, no index helper) and the global is never declared. The per-function
+// scalarizers can't do this: the decl lives at module scope and may be read from
+// several function bodies, so the check must span the whole program.
+
+const ASSIGN_OR_UPDATE = (op) => ASSIGN_TARGET_OPS.has(op) || op === '++' || op === '--'
+// Module-scope binding ops. `var` survives to compile at module scope (jzify only
+// lowers it to `let` inside functions), so fold it too — the reassignment guard
+// below keeps a re-bound `var` heap-backed.
+const isDeclOp = (op) => op === 'let' || op === 'const' || op === 'var'
+
+// Reject `delete x`, `delete x.k`, `delete x[k]` — a deletion mutates the aggregate.
+const isDeleteOf = (node, name) =>
+  node[0] === 'delete' && (node[1] === name || (Array.isArray(node[1]) && node[1][1] === name))
+
+// A reference is fold-safe only if it READS `name` via a static index/key (or
+// `.length` for arrays). Any write/update/delete, reassignment, second declaration,
+// bare value use (escape), spread, dynamic key, or non-own member (method / proto
+// chain) escapes the literal model and disqualifies the binding.
+const foldSafeArrayUse = (node, name, len) => {
+  if (typeof node === 'string') return node !== name
+  if (!Array.isArray(node)) return true
+  const op = node[0]
+  if (isDeclOp(op) && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
+  if (isDeleteOf(node, name)) return false
+  if (ASSIGN_OR_UPDATE(op)) {
+    const t = node[1]
+    if (t === name) return false
+    if (Array.isArray(t) && (t[0] === '[]' || t[0] === '.' || t[0] === '?.') && t[1] === name) return false
+  }
+  if ((op === '.' || op === '?.') && node[1] === name) return node[2] === 'length'
+  if (op === '[]' && node[1] === name) return constIntExpr(node[2]) != null
+  if (op === '...' && node[1] === name) return false
+  for (let i = 1; i < node.length; i++) if (!foldSafeArrayUse(node[i], name, len)) return false
+  return true
+}
+
+const foldSafeObjectUse = (node, name, keys) => {
+  if (typeof node === 'string') return node !== name
+  if (!Array.isArray(node)) return true
+  const op = node[0]
+  if (isDeclOp(op) && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
+  if (isDeleteOf(node, name)) return false
+  if (ASSIGN_OR_UPDATE(op)) {
+    const t = node[1]
+    if (t === name) return false
+    if (Array.isArray(t) && (t[0] === '[]' || t[0] === '.' || t[0] === '?.') && t[1] === name) return false
+  }
+  if ((op === '.' || op === '?.') && node[1] === name) return keys.has(node[2])   // own key only — proto-safe
+  if (op === '[]' && node[1] === name) { const k = staticPropertyKey(node[2]); return k != null && keys.has(k) }
+  if (op === '...' && node[1] === name) return false
+  for (let i = 1; i < node.length; i++) if (!foldSafeObjectUse(node[i], name, keys)) return false
+  return true
+}
+
+const moduleStmtsOf = (seq) =>
+  Array.isArray(seq) && seq[0] === ';' ? seq.slice(1)
+  : Array.isArray(seq) && isDeclOp(seq[0]) ? [seq]
+  : []
+
+export function foldStaticConstAggregates(ast) {
+  // Span the main module AST and every bundled sub-module init — a const declared in
+  // one can be read from another or from a function body (mirrors the constInts fold).
+  const seqs = [ast, ...(ctx.module.moduleInits || [])]
+  const moduleStmts = seqs.flatMap(moduleStmtsOf)
+  const funcs = ctx.func.list.filter(f => f.body && !f.raw)
+  // A function parameter named `x` rebinds `x` for the whole body — its `x[…]` reads
+  // the param, not the module binding (params live on `f.sig`, separate from `.body`,
+  // so the body scan can't see them). Such a function is skipped (scan) / excluded
+  // (rewrite) for that name.
+  const paramNames = (f) => (f.sig?.params || []).map(p => p.name)
+  // Every AST a function can reference an outer binding from: its body PLUS each
+  // default-parameter expression (`(v = x[0]) => …`), which prepare extracts to
+  // `f.defaults` — separate from the body, so the body scan/rewrite would miss it.
+  const funcNodes = (f) => f.defaults ? [f.body, ...Object.values(f.defaults)] : [f.body]
+
+  // Classify module statements. A binding's value comes from an inline decl
+  // (`const x = […]`) OR — for `var`, which jzify lowers to `let x; x = […]` — a
+  // lone module-scope assignment after an uninitialized decl. The init statement(s)
+  // are excluded from the read-only scan and dropped on fold.
+  const inlineInit = new Map()    // name -> {value, stmt} | null (poisoned: >1 decl)
+  const assigns = new Map()       // name -> [assignStmt…]
+  const uninitDecl = new Map()    // name -> declStmt  (`let x` / `var x`, string declarator)
+  for (const stmt of moduleStmts) {
+    if (!Array.isArray(stmt)) continue
+    const op = stmt[0]
+    if (isDeclOp(op) && stmt.length === 2 && Array.isArray(stmt[1]) && stmt[1][0] === '=' && typeof stmt[1][1] === 'string') {
+      const name = stmt[1][1]
+      inlineInit.set(name, inlineInit.has(name) ? null : { value: stmt[1][2], stmt })
+    } else if (isDeclOp(op) && stmt.length === 2 && typeof stmt[1] === 'string') {
+      uninitDecl.set(stmt[1], stmt)
+    } else if (op === '=' && typeof stmt[1] === 'string') {
+      (assigns.get(stmt[1]) ?? assigns.set(stmt[1], []).get(stmt[1])).push(stmt)
+    }
+  }
+
+  // index of each statement in module-execution order — used to prove a `var`'s
+  // assignment dominates its reads.
+  const pos = new Map()
+  moduleStmts.forEach((s, i) => pos.set(s, i))
+
+  const arr = new Map(), obj = new Map(), initStmts = new Map()
+  const consider = (name, value, init) => {
+    if (ctx.func.exports?.[name]) return                 // exported → escapes to JS
+    const elems = scalarArrayElems(value)
+    if (elems) { arr.set(name, elems); initStmts.set(name, init); return }
+    const props = scalarObjectProps(value)
+    if (props) { obj.set(name, props); initStmts.set(name, init) }
+  }
+  for (const [name, info] of inlineInit) {
+    // a decl-initialized binding that is ALSO assigned is reassigned → not constant.
+    if (info && !assigns.has(name)) consider(name, info.value, new Set([info.stmt]))
+  }
+  for (const [name, list] of assigns) {
+    // `var` lowering: exactly one assignment, a matching uninit decl, and no
+    // competing inline decl. The assignment must dominate every read — conservatively,
+    // it precedes all other module references and the name is unused in any function
+    // body (a function could run before the assignment). `let`/`const` need no such
+    // guard (TDZ forbids use-before-init).
+    if (inlineInit.has(name) || list.length !== 1 || !uninitDecl.has(name)) continue
+    const assign = list[0], at = pos.get(assign)
+    const refsBefore = moduleStmts.some((s, i) => i < at && s !== uninitDecl.get(name) && refsName(s, name, REFS_IN_EXPR))
+    const refsInFn = funcs.some(f => !paramNames(f).includes(name) && funcNodes(f).some(n => refsName(n, name, REFS_IN_EXPR)))
+    if (refsBefore || refsInFn) continue
+    consider(name, assign[2], new Set([assign, uninitDecl.get(name)]))
+  }
+  if (!arr.size && !obj.size) return false
+
+  // Every mention outside the binding's init statement(s) — across all module
+  // statements and all function bodies — must be a fold-safe static read.
+  const checkAll = (name, pred) => {
+    const skip = initStmts.get(name)
+    return moduleStmts.every(s => skip.has(s) || pred(s))
+      && funcs.every(f => paramNames(f).includes(name) || funcNodes(f).every(pred))
+  }
+  for (const [name, elems] of [...arr]) if (!checkAll(name, n => foldSafeArrayUse(n, name, elems.length))) arr.delete(name)
+  for (const [name, props] of [...obj]) {
+    const keys = new Set(props.names)
+    if (!checkAll(name, n => foldSafeObjectUse(n, name, keys))) obj.delete(name)
+  }
+  if (!arr.size && !obj.size) return false
+
+  const objects = new Map()
+  for (const [name, props] of obj) {
+    const fields = new Map()
+    props.names.forEach((k, i) => fields.set(k, props.values[i]))
+    objects.set(name, fields)
+  }
+  const rewrite = (n) => rewriteScalarObjectUses(rewriteScalarArrayUses(n, arr), objects)
+  // Every init statement (the decl and, for `var`, its lone assignment) is dropped —
+  // nothing reads the binding anymore, so no aggregate is built.
+  const dropped = new Set()
+  for (const name of [...arr.keys(), ...obj.keys()]) for (const s of initStmts.get(name)) dropped.add(s)
+
+  // Rewrite + drop init statements in each module sequence (mutate in place so
+  // callers holding `ast`/moduleInits references see the result).
+  for (const seq of seqs) {
+    if (!Array.isArray(seq) || seq[0] !== ';') continue
+    const kept = []
+    for (const stmt of seq.slice(1)) {
+      if (dropped.has(stmt)) continue
+      kept.push(rewrite(stmt))
+    }
+    seq.splice(1, seq.length - 1, ...kept)
+  }
+  // Rewrite each function body AND its default-parameter expressions, excluding the
+  // folded names its params shadow.
+  for (const f of funcs) {
+    const pn = paramNames(f)
+    const shadows = pn.some(p => arr.has(p) || objects.has(p))
+    const rw = shadows
+      ? (n) => rewriteScalarObjectUses(rewriteScalarArrayUses(n, new Map([...arr].filter(([k]) => !pn.includes(k)))), new Map([...objects].filter(([k]) => !pn.includes(k))))
+      : rewrite
+    f.body = rw(f.body)
+    if (f.defaults) for (const k of Object.keys(f.defaults)) f.defaults[k] = rw(f.defaults[k])
+  }
+  return true
+}
+
 function scalarizeArrayLiterals(node) {
   if (!Array.isArray(node)) return { node, changed: false }
   if (node[0] === '=>') {

package/src/compile/plan/scope.js

@@ -44,62 +44,138 @@ import { invalidateProgramFactsCache } from '../program-facts.js'
 // mixed ctors) clears the candidacy, keeping the read site polymorphic.
 export const inferModuleLetTypes = (ast) => {
   if (!ctx.scope.userGlobals) return
-  // candidates: name → { ctor: string|null, valid: true } | { valid: false }
-  // valid=true with ctor=null means "still no positive evidence"; we promote
-  // only when ctor is non-null at the end. Assignments to nullish (undef/null)
-  // don't change ctor — they're consistent with any typed-array value.
-  // Per-candidate state in PARALLEL maps, not a shared mutable `{ctor, valid}` object
-  // per name: `ctorOf` holds the positive ctor evidence (name absent ⇒ not a candidate),
-  // `invalid` the demoted names. A prior shape stored one mutable object per name in a
-  // Map; under self-host those per-name objects aliased (every candidate ended up sharing
-  // one record), so a second global of a different kind invalidated the typed one and any
-  // two-global program lost its typed-array fast path. String/Set values can't alias.
-  const ctorOf = new Map()
-  const invalid = new Set()
-  for (const name of ctx.scope.userGlobals) ctorOf.set(name, null)
+  // Build an assignment/alias graph over EVERY `=`/`let`/`const` binding in the
+  // program (globals and locals alike), then resolve each global's typed-array
+  // ctor by least-fixed-point. A single forward pass can't see the double-buffer
+  // swap idiom — `let tmp = a; a = b; b = tmp` assigns `a` from `b` and `b` from
+  // a local `tmp` that aliases `a`, so neither ref resolves until its sibling is
+  // already known. The fixpoint closes that cycle: `a`/`b` each anchor on their
+  // `new Float64Array(...)` decl, the alias edges carry the ctor around the loop,
+  // and they promote to VAL.TYPED. Without it the swap poisoned both globals and
+  // every `a[i]` read forked __str_idx/__typed_idx, every `+` forked __str_concat.
+  //
+  // Lattice (per name): null (no evidence) < ctor < MIXED. `bad` evidence (a non-
+  // typed, non-alias RHS — number, string, call, arithmetic, compound-assign) jumps
+  // straight to MIXED; conflicting ctors join to MIXED. We promote a global only
+  // when its fixed point is a single concrete ctor — sound: every assignment then
+  // provably yields that typed-array kind or nullish.
+  const MIXED = MIXED_CTORS
+  const defs = new Map()  // name → { ctors:Set<string>, refs:Set<string>, bad:bool }
+  const getDef = (name) => {
+    let d = defs.get(name)
+    if (!d) defs.set(name, d = { ctors: new Set(), refs: new Set(), bad: false })
+    return d
+  }
 
   const isNullishLit = (e) => e == null || e === 'undefined' || e === 'null'
     || (Array.isArray(e) && e[0] == null && (e[1] === undefined || e[1] === null))
 
-  const observe = (name, rhs) => {
-    if (!ctorOf.has(name) || invalid.has(name)) return
+  // User-function names — a call to one is an alias edge to its return value
+  // (virtual node `@ret:<fn>`, populated from each `return`). Lets a global
+  // assigned `a = makeBuffer(n)` inherit makeBuffer's typed-array ctor without
+  // relying on the call being inlined (locals get it via inlining; globals,
+  // typed before inlining runs, did not). `@`/`:` can't occur in a JS identifier,
+  // so the virtual key never collides with a real binding.
+  const fnames = new Set()
+  for (const f of ctx.func.list) if (f.body && !f.raw && typeof f.name === 'string') fnames.add(f.name)
+  // Typed-array methods that preserve the receiver's element ctor: `.subarray`
+  // and `.slice` (same-kind view/copy), `.map` (same-kind, per propagateTyped).
+  const CTOR_PRESERVING = new Set(['subarray', 'slice', 'map'])
+
+  // Record one assignment `name = rhs` as evidence. Nullish contributes nothing
+  // (consistent with any typed-array value); a bare identifier, a ctor-preserving
+  // method on a name, or a call to a user function are alias edges; anything else
+  // that isn't a typed ctor poisons the name.
+  // Scope-qualified binding key. A module global is ONE node program-wide (bare
+  // name); a function-local is unique to its scope `sid`. Keying locals by bare
+  // name made a numeric counter `let s = 0` in one function poison a typed
+  // swap-temp `let s = a` in another — cascading MIXED into the double-buffer
+  // globals so every `a[i]` fell back to runtime __str_idx/__typed_idx dispatch
+  // (lbm: 3.9× slower than JS). `@ret:` virtual nodes stay bare (module-wide
+  // return-value anchors).
+  const key = (name, sid) => name[0] === '@' || ctx.scope.userGlobals.has(name) ? name : sid + '\x00' + name
+
+  const observe = (name, rhs, sid) => {
+    const d = getDef(key(name, sid))
     if (isNullishLit(rhs)) return
-    // Resolve typed-array ctor from `new TypedArrayCtor(...)`, ternary of typed,
-    // or a reference to a name we already know is typed.
-    let ctor = typedElemCtor(rhs) ?? ternaryCtorOfRhs(rhs)
-    if (ctor === MIXED_CTORS) { invalid.add(name); return }
-    if (!ctor && typeof rhs === 'string') {
-      if (ctx.scope.globalValTypes?.get(rhs) === VAL.TYPED)
-        ctor = ctx.scope.globalTypedElem?.get(rhs) ?? null
+    const ctor = typedElemCtor(rhs) ?? ternaryCtorOfRhs(rhs)
+    if (ctor === MIXED) { d.bad = true; return }
+    if (ctor) { d.ctors.add(ctor); return }
+    if (typeof rhs === 'string') { d.refs.add(key(rhs, sid)); return }
+    if (Array.isArray(rhs) && rhs[0] === '()') {
+      const callee = rhs[1]
+      // `recv.subarray(...)` / `recv.slice(...)` / `recv.map(...)` → inherit recv's ctor.
+      if (Array.isArray(callee) && callee[0] === '.' && typeof callee[1] === 'string'
+        && CTOR_PRESERVING.has(callee[2])) { d.refs.add(key(callee[1], sid)); return }
+      // `fn(...)` to a user function → inherit its return ctor.
+      if (typeof callee === 'string' && fnames.has(callee)) { d.refs.add('@ret:' + callee); return }
     }
-    if (!ctor) { invalid.add(name); return }
-    const prev = ctorOf.get(name)
-    if (prev && prev !== ctor) { invalid.add(name); return }
-    ctorOf.set(name, ctor)
+    d.bad = true
   }
 
-  const walk = (node) => {
+  // Scope-aware walk. Every `=>` opens a fresh scope so same-named locals across
+  // functions (and sibling closures) stay distinct. A function bound to a name
+  // descends in a name-stable scope (`fn\0name`) so the ast descent and the
+  // func.list sweep below visit it identically (idempotent), and so `return`
+  // exprs anchor on `@ret:name`.
+  let sidc = 0
+  const walk = (node, sid, retFn) => {
     if (!Array.isArray(node)) return
     const op = node[0]
-    if (op === '=' && typeof node[1] === 'string' && ctorOf.has(node[1])) observe(node[1], node[2])
+    if (op === '=>') { walk(node[2], 's' + (++sidc), null); return }
+    if (op === 'return' && retFn != null) observe('@ret:' + retFn, node[1], sid)
+    const assign = (name, rhs) => {
+      if (Array.isArray(rhs) && rhs[0] === '=>') { observe(name, rhs, sid); enterFn(rhs[2], name); return }
+      observe(name, rhs, sid); walk(rhs, sid, retFn)
+    }
+    if (op === '=' && typeof node[1] === 'string') return assign(node[1], node[2])
     if ((op === 'let' || op === 'const') && node.length > 1) {
       for (let i = 1; i < node.length; i++) {
         const d = node[i]
-        if (Array.isArray(d) && d[0] === '=' && typeof d[1] === 'string' && ctorOf.has(d[1]))
-          observe(d[1], d[2])
+        if (Array.isArray(d) && d[0] === '=' && typeof d[1] === 'string') assign(d[1], d[2])
+        else walk(d, sid, retFn)
       }
+      return
+    }
+    // Compound-assigns (`+=`, `++`, …) can't preserve a typed-array kind — poison.
+    if (ASSIGN_OPS.has(op) && typeof node[1] === 'string') { getDef(key(node[1], sid)).bad = true; walk(node[2], sid, retFn); return }
+    for (let i = 1; i < node.length; i++) walk(node[i], sid, retFn)
+  }
+  // Descend into a function body anchored on `@ret:fn`. An arrow expr-body IS the
+  // implicit return (`(n) => new Float64Array(n)`); a `{}` block uses explicit
+  // `return` nodes (captured in walk). Without the implicit-return capture, a
+  // global assigned `a = mk(n)` from an expr-body fn never inherited mk's ctor.
+  const enterFn = (body, fn) => {
+    if (Array.isArray(body) && body[0] !== '{}') observe('@ret:' + fn, body, 'fn\x00' + fn)
+    walk(body, 'fn\x00' + fn, fn)
+  }
+  walk(ast, 'mod', null)
+  // Defensive sweep: cover any func.list body not reachable by descent from `ast`
+  // (hoisted / submodule). Name-stable scope keeps it idempotent with the descent.
+  for (const f of ctx.func.list) if (f.body && !f.raw) enterFn(f.body, f.name)
+
+  // Least-fixed-point over the alias graph. join: null is bottom, MIXED is top.
+  const join = (a, b) => a === MIXED || b === MIXED ? MIXED : a == null ? b : b == null ? a : a === b ? a : MIXED
+  const state = new Map()  // name → null | ctor | MIXED
+  // A ref to a name with no tracked defs resolves via an already-known typed
+  // global (const typed array / earlier-recorded rep); otherwise it's opaque → MIXED.
+  const refState = (r) => defs.has(r) ? (state.get(r) ?? null)
+    : ctx.scope.globalValTypes?.get(r) === VAL.TYPED ? (ctx.scope.globalTypedElem?.get(r) ?? MIXED)
+    : MIXED
+  let changed = true
+  while (changed) {
+    changed = false
+    for (const [name, d] of defs) {
+      let cur = d.bad ? MIXED : null
+      if (cur !== MIXED) for (const c of d.ctors) cur = join(cur, c)
+      if (cur !== MIXED) for (const r of d.refs) cur = join(cur, refState(r))
+      if (cur !== (state.get(name) ?? null)) { state.set(name, cur); changed = true }
     }
-    // Compound-assigns (`+=`, etc.) to a typed-array binding can't preserve
-    // the typed-array kind — invalidate.
-    if (ASSIGN_OPS.has(op) && op !== '=' && typeof node[1] === 'string' && ctorOf.has(node[1]))
-      invalid.add(node[1])
-    for (let i = 1; i < node.length; i++) walk(node[i])
   }
-  walk(ast)
-  for (const f of ctx.func.list) if (f.body && !f.raw) walk(f.body)
 
-  for (const [name, ctor] of ctorOf) {
-    if (invalid.has(name) || !ctor) continue
+  for (const name of ctx.scope.userGlobals) {
+    const ctor = state.get(name)
+    if (!ctor || ctor === MIXED) continue
     if (ctx.scope.globalValTypes?.get(name) === VAL.TYPED) continue
     ;(ctx.scope.globalValTypes ||= new Map()).set(name, VAL.TYPED)
     ;(ctx.scope.globalTypedElem ||= new Map()).set(name, ctor)

package/src/compile/program-facts.js

@@ -23,6 +23,24 @@ export function observeNodeFacts(node, f) {
   if (PROP_WRITE_OPS.has(op) && Array.isArray(args[0]) &&
       (args[0][0] === '.' || args[0][0] === '?.') && typeof args[0][2] === 'string')
     f.writtenProps.add(args[0][2])
+  // Computed-key WRITES (`o[k]=v`, `o[k]+=v`, `o[k]++`) are the ONLY operations
+  // that add ENUMERABLE keys beyond the static schema — computed reads and dot-adds
+  // (`o.b=2`) do not enumerate in jz. Tracked separately from `dynVars` (which also
+  // counts reads) so for-in / Object.keys key pooling can trust the static schema
+  // for a receiver that is only computed-READ. (`isLiteralStr` excludes literal
+  // string keys, which place in fixed schema slots.)
+  if (PROP_WRITE_OPS.has(op) && Array.isArray(args[0]) && args[0][0] === '[]') {
+    const [, wobj, widx] = args[0]
+    // Flag the ROOT array var. `o[k]=v` → o; a NESTED write `o[i][j]=v` mutates an
+    // element of o, so walk the receiver chain to its root identifier and flag that
+    // too — else o's recorded (nested) element types would be wrongly trusted at a
+    // later `o[i][j]` read. Strictly more conservative for every dynWriteVars consumer.
+    if (!isLiteralStr(widx)) {
+      let root = wobj
+      while (Array.isArray(root) && root[0] === '[]') root = root[1]
+      if (typeof root === 'string') f.dynWriteVars?.add(root)
+    }
+  }
   if (op === '[]') {
     const [obj, idx] = args
     if (!isLiteralStr(idx)) { f.anyDyn = true; if (typeof obj === 'string') f.dynVars.add(obj) }
@@ -68,7 +86,7 @@ export function invalidateProgramFactsCache(...roots) {
 
 function emptyWalkFacts() {
   return {
-    dynVars: new Set(), anyDyn: false, hasSchemaLiterals: false,
+    dynVars: new Set(), dynWriteVars: new Set(), anyDyn: false, hasSchemaLiterals: false,
     maxDef: 0, maxCall: 0, hasRest: false, hasSpread: false,
     propMap: new Map(), valueUsed: new Set(), callSites: [],
     writtenProps: new Set(),
@@ -78,6 +96,7 @@ function emptyWalkFacts() {
 function mergeWalkFacts(into, from) {
   if (from.anyDyn) into.anyDyn = true
   for (const v of from.dynVars) into.dynVars.add(v)
+  for (const v of from.dynWriteVars) into.dynWriteVars.add(v)
   if (from.hasSchemaLiterals) into.hasSchemaLiterals = true
   if (from.maxDef > into.maxDef) into.maxDef = from.maxDef
   if (from.maxCall > into.maxCall) into.maxCall = from.maxCall
@@ -234,7 +253,7 @@ export function collectProgramFacts(ast) {
   // ctx — a mutated prop name anywhere disqualifies sharing a static instance.
   ctx.module.writtenProps = f.writtenProps
   return {
-    dynVars: f.dynVars, anyDyn: f.anyDyn, propMap, valueUsed, callSites,
+    dynVars: f.dynVars, dynWriteVars: f.dynWriteVars, anyDyn: f.anyDyn, propMap, valueUsed, callSites,
     maxDef: f.maxDef, maxCall: f.maxCall, hasRest: f.hasRest, hasSpread: f.hasSpread,
     paramReps, hasSchemaLiterals: f.hasSchemaLiterals, writtenProps: f.writtenProps,
   }