jz 0.6.0 → 0.7.0

package/src/optimize/index.js

@@ -59,12 +59,12 @@ const FALSE_BITS = atomNanHex(4)
  *   3 — level 2 + larger array/hash initial caps + `hoistConstantPool` off
  *       (inline `f64.const` over mutable globals); trades size for speed.
  *
- * String aliases (the size↔speed tradeoff lives entirely in the unroll/scalar
- * knobs; watr is on for all three):
- *   'size'     — loop/const unroll + lane vectorization off, tight scalar-replacement
- *                caps. Smallest wasm.
- *   'balanced' — the default (= level 2).
- *   'speed'    — full nested unroll + lane vectorization (= level 3).
+ * String presets (the size↔speed tradeoff lives entirely in the unroll/scalar
+ * knobs; watr is on for both):
+ *   'size'  — loop/const unroll + lane vectorization off, tight scalar-replacement
+ *             caps. Smallest wasm.
+ *   'speed' — full nested unroll + lane vectorization (= level 3).
+ * The default (level 2) has no string name — omit `optimize` or pass `2`.
  *
  * # Two-layer contract (this file vs src/wat/optimize.js)
  * Both layers walk the same S-expression IR; the boundary is KNOWLEDGE, not
@@ -143,9 +143,9 @@ const LEVEL_PRESETS = Object.freeze({
   // closures). Inline `f64.const` is the minimal lowering: V8 CSEs identical
   // constants for free. Measured −3% on jessie parse for +14% binary — exactly
   // the size↔speed trade 'speed' exists to make.
-  3: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8 }),
-  // 'balanced' = level 2; 'size' tightens scalar/unroll caps; 'speed' = level 3.
-  balanced: Object.freeze({ ...ALL_ON, nestedSmallConstForUnroll: 'auto' }),
+  3: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8, reduceUnroll: true, relaxedSimd: true, inlineFns: true }),
+  // 'size' tightens scalar/unroll caps; 'speed' = level 3. There is no 'balanced'
+  // preset — it was a pure synonym for the default level 2 (omit `optimize` or pass 2).
   size: Object.freeze({
     ...ALL_ON,
     smallConstForUnroll: false, nestedSmallConstForUnroll: false, vectorizeLaneLocal: false, splitCharScan: false,
@@ -154,7 +154,16 @@ const LEVEL_PRESETS = Object.freeze({
     scalarTypedLoopUnroll: 4, scalarTypedNestedUnroll: 8, scalarTypedArrayLen: 8,
   }),
   // 'speed' === level 3: full watr (inlining on) + L3 cap/hash tuning, pool off.
-  speed: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8 }),
+  // reduceUnroll: vectorize reductions with N independent accumulators (ILP/latency
+  // hiding, ~3x on dot/FIR sums) — a size↔speed trade like the pool-off above, so
+  // speed-only; level 2 / balanced / size keep the single-accumulator reduce.
+  // relaxedSimd: fold f64x2 dot-pairs to f64x2.relaxed_madd (single fused VFMADD,
+  // one rounding) — faster + more accurate, but the fused result diverges bit-for-bit
+  // from the non-fused JS/native reference (bench `fma` parity class). speed-only.
+  // (The stencil + outer-strip vectorizers are NOT level-gated here: they're bit-exact pure wins
+  // like the base lane vectorizer, so they run whenever it does — default-on at level 2+ via
+  // `cfg.experimentalStencil !== false` at the call site, not a speed-only size/precision trade.)
+  speed: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8, reduceUnroll: true, relaxedSimd: true, inlineFns: true }),
 })
 
 /**
@@ -163,7 +172,7 @@ const LEVEL_PRESETS = Object.freeze({
  *   resolveOptimize(undefined | true)         → level 2 stable defaults
  *   resolveOptimize(false | 0)                → all off
  *   resolveOptimize(1 | 2 | 3)                → preset for that level
- *   resolveOptimize('size' | 'speed' | 'balanced') → named alias preset
+ *   resolveOptimize('size' | 'speed')         → named preset ('speed' = level 3)
  *   resolveOptimize({ level: 1, watr: true }) → level 1 base, with watr forced on
  *   resolveOptimize({ level: 'size', vectorizeLaneLocal: true }) → 'size' base, override
  *   resolveOptimize({ hoistAddrBase: false }) → level 2 base, hoistAddrBase off
@@ -433,6 +442,24 @@ export function hoistAddrBase(fn) {
 // loop-invariant __jss_length in the same loop condition CAN hoist).
 const SAFE_OFFSET_CALLS = new Set(['$__ptr_offset', '$__ptr_type', '$__ptr_aux', '$__len', '$__jss_length', '$__jss_charCodeAt'])
 
+// Calls that don't modify EXISTING heap memory: they may allocate (bump the heap
+// pointer) or do tag dispatch, but they never write to an address a hoisted
+// __typed_idx/__str_idx element read would revisit. Their presence must not
+// block readonly-mem-call LICM (else any `s += unknown` — which dispatches via
+// __is_str_key/__str_concat — would pin every invariant array element in-loop:
+// the jagged-array `grid[i][j]` deopt).
+const NON_MUTATING_CALLS = new Set(['$__is_str_key', '$__str_concat', '$__to_num', '$__to_str', '$__str_byteLen'])
+
+// Read-only HEAP-MEMORY calls: like SAFE_OFFSET_CALLS but they read element
+// storage that a direct f64.store/i32.store in the loop could alias. Safe to
+// hoist only when the loop has no mutating call AND no direct store at all (we
+// can't do alias analysis at WAT level). __typed_idx/__str_idx read arr[i] /
+// s[i]; plain-array element writes go through calls (caught by hasUnsafeCall),
+// and typed-array writes are direct stores (caught by hasDirectStore) — so the
+// guard covers both. This is what lets LICM hoist `grid[i]` out of a read-only
+// `for(j) { ... grid[i][j] ... }` inner loop (the jagged-array deopt).
+const READONLY_MEM_CALLS = new Set(['$__typed_idx', '$__str_idx'])
+
 export function hoistInvariantPtrOffset(fn) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
@@ -550,6 +577,22 @@ const HARD_OPS = new Set([
 ])
 const hasHardOp = (n) => Array.isArray(n) && (HARD_OPS.has(n[0]) || n.some((c, i) => i > 0 && hasHardOp(c)))
 
+// The inline typed-array base decode `(i32.wrap_i64 (i64.and (i64.reinterpret_f64
+// (local|global X)) 0xFFFFFFFF))` — what `typedBase` emits for a NaN-boxed pointer.
+// V8's wasm tier does NOT reliably LICM this i64 reinterpret chain, and it carries no
+// HARD_OP, so without this it stays per-element inside the loop. It is the typed-read
+// equivalent of the `__ptr_offset` call (a HARD_OP) that hoistGlobalPtrOffset hoists at
+// function scope; admitting it here also covers a pointer reassigned ELSEWHERE in the
+// function (the ping-pong double-buffer `a = b` in wireworld / any CA), where the base
+// is invariant within each loop but not function-wide.
+const isPtrBaseDecode = (n) =>
+  Array.isArray(n) && n[0] === 'i32.wrap_i64' && n.length === 2 &&
+  Array.isArray(n[1]) && n[1][0] === 'i64.and' && n[1].length === 3 &&
+  Array.isArray(n[1][2]) && n[1][2][0] === 'i64.const' &&
+  (typeof n[1][2][1] === 'string' ? Number(n[1][2][1]) : n[1][2][1]) === LAYOUT.OFFSET_MASK &&
+  Array.isArray(n[1][1]) && n[1][1][0] === 'i64.reinterpret_f64' && n[1][1].length === 2 &&
+  Array.isArray(n[1][1][1]) && (n[1][1][1][0] === 'local.get' || n[1][1][1][0] === 'global.get')
+
 const PURE_LICM_OPS = new Set([
   'f64.add', 'f64.sub', 'f64.mul', 'f64.div', 'f64.neg', 'f64.abs', 'f64.sqrt',
   'f64.min', 'f64.max', 'f64.ceil', 'f64.floor', 'f64.trunc', 'f64.nearest', 'f64.copysign',
@@ -613,7 +656,27 @@ export function hoistInvariantLoop(fn) {
     if (!Array.isArray(node)) return null
     const op = node[0]
     if (op === 'select') return resultType(node[1])
-    if (op === 'call') return SAFE_OFFSET_CALLS.has(node[1]) ? 'i32' : null  // whitelist all return i32
+    if (op === 'if') {
+      // (if (result T) cond (then ...) (else ...)) — type is the result clause.
+      for (let i = 1; i < node.length; i++) {
+        const c = node[i]
+        if (Array.isArray(c) && c[0] === 'result') return c[1]
+      }
+      return null
+    }
+    if (op === 'block') {
+      for (let i = 1; i < node.length; i++) {
+        const c = node[i]
+        if (Array.isArray(c) && c[0] === 'result') return c[1]
+      }
+      return null
+    }
+    if (op === 'call') {
+      // SAFE_OFFSET_CALLS all return i32; READONLY_MEM_CALLS return f64 (NaN-boxed element)
+      if (SAFE_OFFSET_CALLS.has(node[1])) return 'i32'
+      if (READONLY_MEM_CALLS.has(node[1])) return 'f64'
+      return null
+    }
     if (op === 'local.get' || op === 'local.tee') return localTypes.get(node[1]) ?? null
     const dot = op.indexOf('.')
     if (dot < 0) return null
@@ -644,23 +707,27 @@ export function hoistInvariantLoop(fn) {
   const newLocals = []
   const refcount = buildRefcount(fn)
 
-  const processLoop = (loopNode) => {
+  const processLoop = (loopNode, nested) => {
     // Inner loops first (bottom-up) — an inner hoist creates a local.get the
-    // outer level can hoist further.
+    // outer level can hoist further. Children run in a nested context.
     for (let i = 1; i < loopNode.length; i++)
-      if (Array.isArray(loopNode[i])) processNode(loopNode[i], loopNode, i)
+      if (Array.isArray(loopNode[i])) processNode(loopNode[i], loopNode, i, true)
 
     // The loop's effect summary (scans nested loops too — conservative).
     const locals = new Set(), globals = new Set(), storedCells = new Set()
-    let hasUnsafeCall = false, hasAnyCall = false
+    let hasUnsafeCall = false, hasAnyCall = false, hasDirectStore = false, hasV128 = false
     const scan = (node) => {
       if (!Array.isArray(node)) return
       const op = node[0]
+      // A vectorized loop (lane/v128 ops) is already register-tight and hand-tuned;
+      // extra scalar hoisting there only adds spill pressure — keep it conservative.
+      if (op.startsWith('v128.') || /^[if]\d+x\d+\./.test(op)) hasV128 = true
       if (op === 'local.set' || op === 'local.tee') { if (typeof node[1] === 'string') locals.add(node[1]); for (let i = 2; i < node.length; i++) scan(node[i]); return }
       if (op === 'global.set') { if (typeof node[1] === 'string') globals.add(node[1]); for (let i = 2; i < node.length; i++) scan(node[i]); return }
-      if (op === 'call') { hasAnyCall = true; if (!SAFE_OFFSET_CALLS.has(node[1])) hasUnsafeCall = true; for (let i = 2; i < node.length; i++) scan(node[i]); return }
+      if (op === 'call') { hasAnyCall = true; if (!SAFE_OFFSET_CALLS.has(node[1]) && !READONLY_MEM_CALLS.has(node[1]) && !NON_MUTATING_CALLS.has(node[1])) hasUnsafeCall = true; for (let i = 2; i < node.length; i++) scan(node[i]); return }
       if (op === 'call_ref' || op === 'call_indirect') { hasAnyCall = hasUnsafeCall = true; for (let i = 1; i < node.length; i++) scan(node[i]); return }
       if ((op === 'f64.store' || op === 'i32.store') && node.length >= 3) {
+        hasDirectStore = true
         const a = node[1]
         if (Array.isArray(a) && a[0] === 'local.get' && typeof a[1] === 'string' && a[1].startsWith(CELL_PREFIX)) storedCells.add(a[1])
       }
@@ -731,7 +798,27 @@ export function hoistInvariantLoop(fn) {
         return Array.isArray(a) && a[0] === 'local.get' && typeof a[1] === 'string' && a[1].startsWith(CELL_PREFIX)
           && !hasAnyCall && !storedCells.has(a[1]) && (bound.has(a[1]) || !locals.has(a[1]))
       }
-      if (op === 'call') return SAFE_OFFSET_CALLS.has(node[1]) && !hasUnsafeCall && node.slice(2).every(c => pureGiven(c, bound))
+      if (op === 'call') {
+        if (SAFE_OFFSET_CALLS.has(node[1]))
+          return !hasUnsafeCall && node.slice(2).every(c => pureGiven(c, bound))
+        // Read-only heap reads: additionally require no direct store (alias-safe).
+        if (READONLY_MEM_CALLS.has(node[1]))
+          return !hasUnsafeCall && !hasDirectStore && node.slice(2).every(c => pureGiven(c, bound))
+        return false
+      }
+      // A value-producing `if` whose condition and both arms are pure is itself
+      // pure — the tag-dispatch idiom `(if (result f64) tag-check (then read-A)
+      // (else read-B))` that wraps __typed_idx/__str_idx element access.
+      if (op === 'if') {
+        for (let i = 1; i < node.length; i++) {
+          const c = node[i]
+          if (!Array.isArray(c)) continue
+          if (c[0] === 'result') continue
+          if (c[0] === 'then' || c[0] === 'else') { if (!c.slice(1).every(x => pureGiven(x, bound))) return false }
+          else if (!pureGiven(c, bound)) return false   // the condition
+        }
+        return true
+      }
       if (PURE_LICM_OPS.has(op)) return node.slice(1).every(c => pureGiven(c, bound))
       return false
     }
@@ -745,9 +832,14 @@ export function hoistInvariantLoop(fn) {
       // Every local the subtree writes must be private to it (no other use in the
       // loop) — else moving the write to the pre-header changes another reader.
       for (const b of bound) if (localCount.get(b) !== countsOf(node).get(b)) return false
-      // Only hoist what V8's wasm tier won't (a HARD_OP) — leave pure arithmetic
-      // for V8's own LICM and the lane-vectorizer.
-      return hasHardOp(node) && pureGiven(node, bound)
+      // Top-level loops: only hoist what V8's wasm tier won't — a HARD_OP or the
+      // inline typed-array base decode — and leave plain pure arithmetic to V8's own
+      // LICM (which handles single-level loops well). NESTED (inner) loops are
+      // different: V8's wasm tier under-hoists invariants out of them (a nested
+      // rasterizer/convolution recomputes triangle/row-invariant subexpressions every
+      // iteration), so hoist any pure-invariant subtree there. Soundness is unchanged —
+      // `pureGiven` already proves the subtree is loop-invariant and side-effect-free.
+      return ((nested && !hasV128) || hasHardOp(node) || isPtrBaseDecode(node)) && pureGiven(node, bound)
     }
 
     // Maximal extraction: take the largest hoistable subtree; don't descend into
@@ -780,17 +872,17 @@ export function hoistInvariantLoop(fn) {
     return snaps
   }
 
-  const processNode = (node, parent, idx) => {
+  const processNode = (node, parent, idx, nested = false) => {
     if (!Array.isArray(node)) return
     if (node[0] === 'loop') {
-      const snaps = processLoop(node)
+      const snaps = processLoop(node, nested)
       if (snaps.length) parent.splice(idx, 0, ...snaps)
       return
     }
-    for (let i = 0; i < node.length; i++) processNode(node[i], node, i)
+    for (let i = 0; i < node.length; i++) processNode(node[i], node, i, nested)
   }
 
-  for (let i = bodyStart; i < fn.length; i++) processNode(fn[i], fn, i)
+  for (let i = bodyStart; i < fn.length; i++) processNode(fn[i], fn, i, false)
   if (newLocals.length) fn.splice(bodyStart, 0, ...newLocals)
 }
 
@@ -1768,23 +1860,52 @@ export function hoistGlobalPtrOffset(fn, stablePtrGlobals, reachableWrites) {
   const bodyStart = findBodyStart(fn)
   if (bodyStart < 0) return
 
-  // `(call $__ptr_offset (i64.reinterpret_f64 (global.get $G)))` → G, or null.
-  const siteGlobal = (n) =>
-    Array.isArray(n) && n[0] === 'call' && n[1] === '$__ptr_offset' && n.length === 3
-      && Array.isArray(n[2]) && n[2][0] === 'i64.reinterpret_f64'
-      && Array.isArray(n[2][1]) && n[2][1][0] === 'global.get' && typeof n[2][1][1] === 'string'
-      ? n[2][1][1] : null
+  // `(i64.reinterpret_f64 (global.get $G))` → G, or null.
+  const reintGlobal = (n) =>
+    Array.isArray(n) && n[0] === 'i64.reinterpret_f64'
+      && Array.isArray(n[1]) && n[1][0] === 'global.get' && typeof n[1][1] === 'string'
+      ? n[1][1] : null
+  // A stable-pointee global's byte-base reaches us in two interchangeable shapes:
+  //   • forwarding-aware  `(call $__ptr_offset (i64.reinterpret_f64 (global.get $G)))`
+  //   • inline typed read `(i32.wrap_i64 (i64.and (i64.reinterpret_f64 (global.get $G)) MASK))`
+  // The inline form is what typed-array reads emit (a fixed-size typed array never
+  // relocates, so they skip __ptr_offset's forwarding follow — see module/typedarray.js
+  // `typedBase`). For a never-forwarding pointee both yield the identical offset, so
+  // either site hoists to the one `__ptr_offset` entry snapshot. Matching only the
+  // call form left typed-array globals re-decoding the NaN-box per element in stencil
+  // sweeps (watercolor's pressure solve: 5 reads/cell × millions of cells). → G, or null.
+  const siteGlobal = (n) => {
+    if (!Array.isArray(n)) return null
+    if (n[0] === 'call' && n[1] === '$__ptr_offset' && n.length === 3) return reintGlobal(n[2])
+    if (n[0] === 'i32.wrap_i64' && n.length === 2 && Array.isArray(n[1]) && n[1][0] === 'i64.and' && n[1].length === 3) {
+      const mask = n[1][2]
+      if (Array.isArray(mask) && mask[0] === 'i64.const'
+          && (typeof mask[1] === 'string' ? Number(mask[1]) : mask[1]) === LAYOUT.OFFSET_MASK)
+        return reintGlobal(n[1][1])
+    }
+    return null
+  }
 
   // Per-global: static site count AND whether any site sits inside a loop. A
   // single in-loop site is a per-ITERATION resolve (lenia's convolution reads
   // each of kdx/kdy/kw at one site × ~14M taps/frame), so loop placement beats
   // site count as the hoist criterion.
   const counts = new Map(), inLoop = new Set(), ownWrites = new Set(), ownCallees = new Set()
+  // Globals seen via the `__ptr_offset` call form (vs. only the inline typed mask).
+  // The snapshot reuses an EXISTING form so it never resurrects a treeshaken helper:
+  // a typed-array-only module emits no `__ptr_offset` call, so snapping one in would
+  // reference a function that isn't in the module.
+  const ptrOffsetForm = new Set()
   let hasIndirect = false
   const scan = (n, loopDepth) => {
     if (!Array.isArray(n)) return
     const g = siteGlobal(n)
-    if (g != null) { counts.set(g, (counts.get(g) || 0) + 1); if (loopDepth > 0) inLoop.add(g); return }
+    if (g != null) {
+      counts.set(g, (counts.get(g) || 0) + 1)
+      if (loopDepth > 0) inLoop.add(g)
+      if (n[0] === 'call') ptrOffsetForm.add(g)
+      return
+    }
     if (n[0] === 'global.set' && typeof n[1] === 'string') ownWrites.add(n[1])
     else if ((n[0] === 'call' || n[0] === 'return_call') && typeof n[1] === 'string') ownCallees.add(n[1])
     else if (n[0] === 'call_indirect' || n[0] === 'call_ref' || n[0] === 'return_call_indirect') hasIndirect = true
@@ -1833,7 +1954,13 @@ export function hoistGlobalPtrOffset(fn, stablePtrGlobals, reachableWrites) {
   const decls = [], snaps = []
   for (const [g, name] of chosen) {
     decls.push(['local', name, 'i32'])
-    snaps.push(['local.set', name, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['global.get', g]]]])
+    // Match an existing site's form so we never reference a treeshaken helper.
+    // For a never-forwarding pointee both forms compute the same offset, so the
+    // inline mask is a safe (and call-free) snapshot when no __ptr_offset site exists.
+    const snap = ptrOffsetForm.has(g)
+      ? ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['global.get', g]]]
+      : ['i32.wrap_i64', ['i64.and', ['i64.reinterpret_f64', ['global.get', g]], ['i64.const', LAYOUT.OFFSET_MASK]]]
+    snaps.push(['local.set', name, snap])
   }
   fn.splice(bodyStart, 0, ...decls, ...snaps)
 }
@@ -2374,6 +2501,146 @@ export function sortStrPoolByFreq(funcs, strPoolRef, strDedupMap) {
   }
 }
 
+/**
+ * Fold dead string-dispatch blocks when the tested operand is a proven-f64 local.
+ *
+ * jz's `+` emitter produces, for every binary addition whose right operand has an
+ * unresolved valType, the pattern:
+ *
+ *   (block (result f64)
+ *     (local.set $B EXPR_A)
+ *     (if (result f64)
+ *       (call $__is_str_key (i64.reinterpret_f64 (local.tee $C (local.get $P))))
+ *       (then (call $__str_concat …))
+ *       (else (f64.add (local.get $B) (local.get $C)))))
+ *
+ * When $P is a proven-f64 local (an f64 param, or an f64-typed local provably set
+ * only from f64 arithmetic) it can never hold a string-key NaN-box, so the
+ * `$__is_str_key` test is provably false and the `then` branch is dead.
+ * Replace the whole block with `(f64.add EXPR_A (local.get $P))`.
+ *
+ * SOUND: f64 params can never hold a string-key NaN-box by construction (jz
+ * only allows strings in f64 slots via explicit mkptr boxing, never a bare
+ * param). This fold is additive/gated (only runs when vectorizeLaneLocal is on)
+ * and only removes provably-dead string-dispatch overhead.
+ *
+ * Called in the 'post' phase of optimizeFunc, before vectorizeLaneLocal, so the
+ * cleaned IR is what the vectorizer pattern-matches.
+ */
+export function foldStrDispatchF64(fn) {
+  if (!Array.isArray(fn) || fn[0] !== 'func') return
+  const bodyStart = findBodyStart(fn)
+  if (bodyStart < 0) return
+
+  // Collect all f64 params — provably never hold a string-key NaN-box.
+  const rawF64 = new Set()
+  for (let i = 2; i < bodyStart; i++) {
+    const d = fn[i]
+    if (Array.isArray(d) && d[0] === 'param' && typeof d[1] === 'string' && d[2] === 'f64')
+      rawF64.add(d[1])
+  }
+  if (!rawF64.size) return  // no f64 params → nothing to fold
+
+  // Transitively extend rawF64: an f64 local set only via f64 arithmetic over rawF64
+  // members is itself provably non-string. One forward pass suffices for DAG-shaped
+  // straight-line code (the common case); a fixed-point loop covers rare mutual defs.
+  // Collect local types first.
+  const localTypeMap = new Map()
+  for (let i = 2; i < bodyStart; i++) {
+    const d = fn[i]
+    if (Array.isArray(d) && (d[0] === 'param' || d[0] === 'local') && typeof d[1] === 'string')
+      localTypeMap.set(d[1], d[2])
+  }
+  // An expression is rawF64-valued if it only uses ops that stay in f64 and
+  // reads only rawF64 locals (or f64.const). Stops early — we only need the
+  // closed set for the pattern's $P operand.
+  const isRawF64Expr = (n) => {
+    if (!Array.isArray(n)) return false
+    const op = n[0]
+    if (op === 'f64.const') return true
+    if (op === 'local.get' && typeof n[1] === 'string') return rawF64.has(n[1])
+    if (op === 'local.tee' && typeof n[1] === 'string') return rawF64.has(n[1]) && isRawF64Expr(n[2])
+    if (op === 'f64.add' || op === 'f64.sub' || op === 'f64.mul' || op === 'f64.div' ||
+        op === 'f64.neg' || op === 'f64.abs' || op === 'f64.sqrt') {
+      return n.slice(1).every(isRawF64Expr)
+    }
+    return false
+  }
+
+  // Single forward pass: a local.set $v EXPR where EXPR is rawF64-valued makes $v rawF64.
+  // Repeat until stable (handles ordering edge cases in non-DAG code).
+  let changed = true
+  while (changed) {
+    changed = false
+    const scan = (node) => {
+      if (!Array.isArray(node)) return
+      if ((node[0] === 'local.set' || node[0] === 'local.tee') && typeof node[1] === 'string' &&
+          localTypeMap.get(node[1]) === 'f64' && !rawF64.has(node[1]) && isRawF64Expr(node[2])) {
+        rawF64.add(node[1]); changed = true
+      }
+      for (let i = 1; i < node.length; i++) scan(node[i])
+    }
+    for (let i = bodyStart; i < fn.length; i++) scan(fn[i])
+  }
+
+  // Pattern-match and fold in-place (bottom-up recursive walk so nested blocks resolve).
+  const foldNode = (node) => {
+    if (!Array.isArray(node)) return node
+    // Recurse children first (bottom-up).
+    for (let i = 0; i < node.length; i++) {
+      const c = node[i]
+      if (Array.isArray(c)) node[i] = foldNode(c)
+    }
+    // Match:
+    //   ['block', ['result','f64'],
+    //     ['local.set', $B, EXPR_A],
+    //     ['if', ['result','f64'],
+    //       ['call','$__is_str_key', ['i64.reinterpret_f64', ['local.tee',$C,['local.get',$P]]]],
+    //       ['then', ['call','$__str_concat',...]],
+    //       ['else', ['f64.add', ['local.get',$B], ['local.get',$C]]]]]
+    if (node[0] !== 'block') return node
+    if (!Array.isArray(node[1]) || node[1][0] !== 'result' || node[1][1] !== 'f64') return node
+    if (node.length !== 4) return node
+    const setStmt = node[2], ifStmt = node[3]
+    if (!Array.isArray(setStmt) || setStmt[0] !== 'local.set' || typeof setStmt[1] !== 'string') return node
+    const B = setStmt[1], exprA = setStmt[2]
+    if (!Array.isArray(ifStmt) || ifStmt[0] !== 'if') return node
+    // if must have: (result f64), cond, then, else — total 5 elements
+    if (ifStmt.length !== 5) return node
+    if (!Array.isArray(ifStmt[1]) || ifStmt[1][0] !== 'result' || ifStmt[1][1] !== 'f64') return node
+    const cond = ifStmt[2], thenB = ifStmt[3], elseB = ifStmt[4]
+    // cond: ['call','$__is_str_key',['i64.reinterpret_f64',['local.tee',$C,['local.get',$P]]]]
+    if (!Array.isArray(cond) || cond[0] !== 'call' || cond[1] !== '$__is_str_key' || cond.length !== 3) return node
+    const reinterpArg = cond[2]
+    if (!Array.isArray(reinterpArg) || reinterpArg[0] !== 'i64.reinterpret_f64' || reinterpArg.length !== 2) return node
+    const teeNode = reinterpArg[1]
+    if (!Array.isArray(teeNode) || teeNode[0] !== 'local.tee' || typeof teeNode[1] !== 'string' || teeNode.length !== 3) return node
+    const C = teeNode[1]
+    const getP = teeNode[2]
+    if (!Array.isArray(getP) || getP[0] !== 'local.get' || typeof getP[1] !== 'string') return node
+    const P = getP[1]
+    // $P must be a proven f64 local (never a string-key NaN-box)
+    if (!rawF64.has(P)) return node
+    // then: ['then', ['call','$__str_concat',...]]
+    if (!Array.isArray(thenB) || thenB[0] !== 'then') return node
+    // else: ['else', ['f64.add', ['local.get',$B], ['local.get',$C]]]
+    if (!Array.isArray(elseB) || elseB[0] !== 'else' || elseB.length !== 2) return node
+    const addExpr = elseB[1]
+    if (!Array.isArray(addExpr) || addExpr[0] !== 'f64.add' || addExpr.length !== 3) return node
+    // The two operands of f64.add must be local.get $B and local.get $C (in either order)
+    const [lhsAdd, rhsAdd] = [addExpr[1], addExpr[2]]
+    const lhsIsB = Array.isArray(lhsAdd) && lhsAdd[0] === 'local.get' && lhsAdd[1] === B
+    const rhsIsC = Array.isArray(rhsAdd) && rhsAdd[0] === 'local.get' && rhsAdd[1] === C
+    const lhsIsC = Array.isArray(lhsAdd) && lhsAdd[0] === 'local.get' && lhsAdd[1] === C
+    const rhsIsB = Array.isArray(rhsAdd) && rhsAdd[0] === 'local.get' && rhsAdd[1] === B
+    if (!((lhsIsB && rhsIsC) || (lhsIsC && rhsIsB))) return node
+    // Match confirmed. Fold to: (f64.add EXPR_A (local.get $P))
+    return ['f64.add', exprA, ['local.get', P]]
+  }
+
+  for (let i = bodyStart; i < fn.length; i++) fn[i] = foldNode(fn[i])
+}
+
 /**
  * Run all per-function IR optimizations on a single function node.
  * hoistPtrType runs first — it introduces new locals (`$__ptN`) that the fused
@@ -2432,7 +2699,11 @@ export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals, phase = 'pre
   if (cfg && cfg.vectorizeLaneLocal === true) {
     const fullWatr = cfg.watr === true || typeof cfg.watr === 'object'
     const runVectorizer = (fullWatr && phase === 'post') || (!fullWatr && phase !== 'post')
-    if (runVectorizer) vectorizeLaneLocal(fn)
+    // Phase 1: fold dead string-dispatch blocks on proven-f64 locals BEFORE
+    // the vectorizer pattern-matches — dead __is_str_key calls in $fbm-style
+    // functions (param f64 + op f64) block liftPPC from recognizing them as pure.
+    if (runVectorizer) foldStrDispatchF64(fn)
+    if (runVectorizer) vectorizeLaneLocal(fn, cfg.reduceUnroll === true, cfg.relaxedSimd === true, cfg.blurMultiPixel !== false, cfg.whyNotSimd === true, cfg.experimentalStencil !== false, cfg.experimentalOuterStrip !== false, cfg._pureFuncMap || null, cfg.experimentalToneMap !== false)
   }
   if (!cfg || cfg.sortLocalsByUse !== false) sortLocalsByUse(fn, cfg && cfg.fusedRewrite !== false ? counts : null)
   // An optimizer pass that emits a malformed local — the class that otherwise dies
@@ -2836,6 +3107,13 @@ export function treeshake(funcSections, allModuleNodes, opts) {
     for (let i = 2; i < fn.length; i++)
       if (Array.isArray(fn[i]) && fn[i][0] === 'export') { addRoot(name); break }
 
+  // When user funcs are NOT being reclaimed (O0/O1 keep declared-but-uncalled ones), they
+  // all survive — so they're roots for the *internal*-func reachability below. Otherwise an
+  // unreachable user func that's kept would still call a `__helper`, yet that helper would be
+  // pruned as unreached-from-exports, leaving a dangling `call $__helper`.
+  if (!removeDead && opts && opts.userFuncs)
+    for (const name of opts.userFuncs) addRoot(name)
+
   const findRoots = (node) => {
     if (!Array.isArray(node)) return
     if (node[0] === 'start' && typeof node[1] === 'string') addRoot(node[1])
@@ -2863,24 +3141,43 @@ export function treeshake(funcSections, allModuleNodes, opts) {
   for (const fn of allFuncs) if (typeof fn[1] !== 'string') visitCalls(fn)
   while (stack.length) visitCalls(funcByName.get(stack.pop()))
 
+  // Compiler-internal funcs (stdlib helpers, allocator wrappers — everything not in the
+  // user's own `ctx.func.list`) carry no source meaning, so an unreachable one is reclaimed
+  // at EVERY opt level: it's never a live-coding aid, just over-production (e.g. `s + '!'`
+  // pulls the alloc trio's `__alloc_hdr`, which string concat never calls, and a dead-branch
+  // dep like `__str_len`). User funcs are reclaimed only when DCE is on, so O0/O1 keep a
+  // declared-but-uncalled user function. Absent the set, fall back to gating everything.
+  const userFuncs = opts && opts.userFuncs
+  const isUserFunc = (name) => userFuncs ? userFuncs.has(name) : true
   let removed = 0
-  if (removeDead) {
+  if (removeDead || userFuncs) {
     for (const { arr } of funcSections) {
       for (let i = arr.length - 1; i >= 0; i--) {
         const n = arr[i]
-        if (Array.isArray(n) && n[0] === 'func' && typeof n[1] === 'string' && !reachable.has(n[1])) {
+        if (Array.isArray(n) && n[0] === 'func' && typeof n[1] === 'string' && !reachable.has(n[1]) &&
+            (removeDead || !isUserFunc(n[1]))) {
           arr.splice(i, 1); removed++
         }
       }
     }
   }
 
-  // Dead-global elimination: after dead funcs are gone, drop `(global $g …)` decls
-  // that nothing references (a `global.get`/`global.set` in a remaining func, a kept
-  // global's init expr, a data/elem offset, or an `(export … (global $g))`). Imported
-  // globals live in `allModuleNodes`, not in `opts.globals`, so they're never touched.
-  // Fixpoint: a kept global's init may reference another global.
-  const globals = removeDead && opts && Array.isArray(opts.globals) ? opts.globals : null
+  // Dead-global elimination: drop `(global $g …)` decls that nothing references
+  // (a `global.get`/`global.set` in a remaining func, a kept global's init expr, a
+  // data/elem offset, or an `(export … (global $g))`). Imported globals live in
+  // `allModuleNodes`, not in `opts.globals`, so they're never touched. Fixpoint: a
+  // kept global's init may reference another global.
+  //
+  // Compiler-internal globals (support state the user never wrote — e.g. core's
+  // `__heap_start` or the math module's `rng_state`, declared eagerly but read
+  // only by specific fast paths) are reclaimed at *every* level: leaving an
+  // unreferenced one in the output is pure noise, never a live-coding aid. User
+  // globals are reclaimed only when DCE is on, so O0/O1 still preserve declared-
+  // but-unused user bindings. `userGlobals` (names sans `$`) draws the line; absent
+  // it, fall back to the `$__` reserved-prefix heuristic.
+  const userGlobals = opts && opts.userGlobals
+  const isUserGlobal = (name) => userGlobals ? userGlobals.has(name.slice(1)) : !name.startsWith('$__')
+  const globals = opts && Array.isArray(opts.globals) ? opts.globals : null
   if (globals) {
     const collectGlobalRefs = (node, refd) => {
       if (!Array.isArray(node)) return
@@ -2897,9 +3194,11 @@ export function treeshake(funcSections, allModuleNodes, opts) {
       for (const g of globals) collectGlobalRefs(g, refd)
       for (let i = globals.length - 1; i >= 0; i--) {
         const g = globals[i]
-        if (Array.isArray(g) && g[0] === 'global' && typeof g[1] === 'string' && !refd.has(g[1])) {
-          globals.splice(i, 1); changed = true
-        }
+        if (!Array.isArray(g) || g[0] !== 'global' || typeof g[1] !== 'string' || refd.has(g[1])) continue
+        // An inline `(export …)` on the decl pins it — it's part of the module's
+        // JS-host surface (e.g. `__heap`), referenced from outside the wasm.
+        if (g.some(c => Array.isArray(c) && c[0] === 'export')) continue
+        if (removeDead || !isUserGlobal(g[1])) { globals.splice(i, 1); changed = true }
       }
     }
   }