jz 0.6.0 → 0.7.0

package/src/optimize/vectorize.js

@@ -1,4 +1,5 @@
 import { findBodyStart } from '../ir.js'
+import { warn } from '../ctx.js'
 
 /**
  * Lane-local SIMD-128 vectorizer.
@@ -191,19 +192,27 @@ const matchF64DotSeq = (stmts, i) => {
 
 const f64x2Pair = (lo, hi) => ['f64x2.replace_lane', 1, ['f64x2.splat', ['local.get', lo]], ['local.get', hi]]
 
-const dotPairExpr = (a, pairs) => {
+// Build the 2-lane dot expression `a0*p0 + a1*p1 + a2*p2 + a3*p3`.
+// Default: explicit mul/add pairs (one rounding per op) — bit-identical to the
+// scalar `a*b+c` a JS engine emits. With `useRelaxedFma`, each accumulate folds
+// to `f64x2.relaxed_madd(splat(a[i]), p[i], acc)` — one VFMADD instruction with
+// a single rounding. Faster and more accurate, but the fused rounding diverges
+// from the non-fused reference (the bench `fma` parity class). Opt-in only.
+const dotPairExpr = (a, pairs, useRelaxedFma = false) => {
   let expr = ['f64x2.mul', ['f64x2.splat', ['local.get', a[0]]], pairs[0]]
   for (let i = 1; i < 4; i++) {
-    expr = ['f64x2.add', expr, ['f64x2.mul', ['f64x2.splat', ['local.get', a[i]]], pairs[i]]]
+    expr = useRelaxedFma
+      ? ['f64x2.relaxed_madd', ['f64x2.splat', ['local.get', a[i]]], pairs[i], expr]
+      : ['f64x2.add', expr, ['f64x2.mul', ['f64x2.splat', ['local.get', a[i]]], pairs[i]]]
   }
   return expr
 }
 
-const vectorizeStraightLineF64DotPairsIn = (node, fnLocals, freshIdRef, newLocalDecls) => {
+const vectorizeStraightLineF64DotPairsIn = (node, fnLocals, freshIdRef, newLocalDecls, useRelaxedFma = false) => {
   if (!isArr(node)) return
   for (let i = 0; i < node.length; i++) {
     const child = node[i]
-    if (isArr(child)) vectorizeStraightLineF64DotPairsIn(child, fnLocals, freshIdRef, newLocalDecls)
+    if (isArr(child)) vectorizeStraightLineF64DotPairsIn(child, fnLocals, freshIdRef, newLocalDecls, useRelaxedFma)
   }
   const addendTemps = new Map()
   const pairTemps = new Map()
@@ -246,7 +255,7 @@ const vectorizeStraightLineF64DotPairsIn = (node, fnLocals, freshIdRef, newLocal
       }
       pairs.push(['local.get', tmp])
     }
-    const dot = dotPairExpr(a.left, pairs)
+    const dot = dotPairExpr(a.left, pairs, useRelaxedFma)
     const expr = addend ? ['f64x2.add', dot, ['f64x2.splat', addend]] : dot
     node.splice(i, b.end - i,
       ...prefix,
@@ -505,6 +514,20 @@ function matchInc1(stmt) {
   return x
 }
 
+/**
+ * Match increment shape `(local.set $X (i32.add (local.get $X) (i32.const C)))`
+ * for any constant C. Returns { name, c } or null. Generalizes matchInc1 to the
+ * strided-pointer bumps (`p += stride`) the ramp-map recognizer must scale.
+ */
+function matchIncN(stmt) {
+  if (!isArr(stmt) || stmt[0] !== 'local.set' || stmt.length !== 3) return null
+  const x = stmt[1], v = stmt[2]
+  if (!isArr(v) || v[0] !== 'i32.add' || v.length !== 3) return null
+  if (!isLocalGet(v[1], x)) return null
+  const c = constNum(v[2])
+  return c == null ? null : { name: x, c }
+}
+
 /**
  * Match `(br_if $LABEL (i32.eqz (i32.lt_{s,u} (local.get $I) BOUND)))`.
  * Returns { ind, bound } or null.
@@ -661,62 +684,116 @@ const hasGlobalSet = (node) => {
   return false
 }
 
+// True if EXPR carries any side effect — a call, a memory store/op, or a global
+// write. Used to reject an impure preamble we would otherwise clone (run twice).
+const hasSideEffect = (node) => {
+  if (!isArr(node)) return false
+  const op = node[0]
+  if (op === 'call' || op === 'call_indirect' || op === 'global.set'
+    || (typeof op === 'string' && (op.includes('.store') || op.startsWith('memory.')))) return true
+  for (let i = 1; i < node.length; i++) if (hasSideEffect(node[i])) return true
+  return false
+}
+
 // ---- Recognize a (block (loop)) pair --------------------------------------
 
 /**
- * Try to vectorize the inner loop. Returns the replacement node array
- * (synthetic outer block) or null on no match.
+ * Match the canonical vectorizable loop SCAFFOLD shared by every inner-loop
+ * recognizer:
+ *   (block $blk [preamble…]
+ *     (loop $loop
+ *       (br_if $blk (i32.eqz (i32.lt_{s,u} $i BOUND)))   ; exit guard
+ *       BODY…
+ *       (local.set $i (i32.add $i 1))                     ; bottom increment
+ *       (br $loop)))
+ *
+ * Returns the structural FACTS only — no policy — or null when the shape
+ * doesn't match:
+ *   { blockNode, blockLabel, loopNode, loopLabel, endIdx, incIdx, incVar,
+ *     exitInfo, bound, boundLocal, body, preamble }
+ *   - `blockNode` is the original block, embedded verbatim as the scalar tail by
+ *     each lifter's wrapper (the never-miscompile remainder loop).
+ *   - `body`       = loopNode.slice(3, incIdx) (between exit guard and increment)
+ *   - `bound`      = the raw BOUND expr; `boundLocal` = its local name when it is
+ *     `(local.get $L)`, else null. Bound shape is NOT rejected here — callers that
+ *     require a local-or-const bound check it themselves (tryStrengthReduceIV is
+ *     bound-shape-agnostic, so baking a rejection in would change its behavior).
+ *
+ * `opts.allowPreamble` (default false): when true, LICM-hoisted invariant
+ *   `(local.set $__li* EXPR)` statements BEFORE the loop are collected into
+ *   `preamble` (pure & loop-invariant by construction — safe to clone/re-run);
+ *   a non-`$__li` preamble, an impure value, or any array content AFTER the loop
+ *   bails. When false, ANY non-loop array content in the block bails.
  */
-function tryVectorize(blockNode, fnLocals, freshIdRef) {
+function matchBlockLoop(blockNode, opts = {}) {
   if (!isArr(blockNode) || blockNode[0] !== 'block') return null
-  // Find label and inner loop.
-  let blockLabel = null
-  let loopIdx = -1, loopNode = null
+  const allowPreamble = !!opts.allowPreamble
+  let blockLabel = null, loopNode = null
+  const preamble = []
   for (let i = 1; i < blockNode.length; i++) {
     const c = blockNode[i]
-    if (typeof c === 'string' && c.startsWith('$') && blockLabel == null && i === 1) {
-      blockLabel = c; continue
-    }
+    if (typeof c === 'string' && c.startsWith('$') && blockLabel == null && i === 1) { blockLabel = c; continue }
     if (isArr(c) && c[0] === 'loop') {
       if (loopNode) return null  // multiple loops
-      loopIdx = i; loopNode = c
+      loopNode = c
     } else if (isArr(c)) {
-      return null  // foreign content alongside the loop
+      // `loopNode` truthy ⇒ this content is AFTER the loop ⇒ bail (even for a $__li set).
+      // A LICM-hoisted invariant is `$__liN`; INLINING renames it (e.g. `$__inl7___li0`). Default
+      // accepts only un-inlined `$__li*` (keeps the existing recognizers byte-identical);
+      // `allowInlinedLi` (gated callers only) also accepts the `__liN` marker anywhere — both are
+      // pure & loop-invariant by construction (belt-and-suspenders: hasSideEffect guard).
+      // Under allowInlinedLi a block preamble is loop-invariant by construction (jz hoists only
+      // invariants before the loop; IV-dependent work lives in the body), so any PURE local.set is
+      // safe to clone ahead of the SIMD — covers $__inl*__li* (schrodinger) AND $_pg0-style
+      // peephole-hoisted bounds (slime). The hasSideEffect guard rejects impure setups.
+      const liOk = typeof c[1] === 'string' && (opts.allowInlinedLi ? true : c[1].startsWith('$__li'))
+      if (!allowPreamble || loopNode || c[0] !== 'local.set' || !liOk || hasSideEffect(c[2])) return null
+      preamble.push(c)
     }
   }
   if (!loopNode || !blockLabel) return null
 
-  // Loop layout: ['loop', '$label', ...stmts]
   const loopLabel = typeof loopNode[1] === 'string' && loopNode[1].startsWith('$') ? loopNode[1] : null
   if (!loopLabel) return null
 
-  // Find induction increment + back-branch at the END.
-  let endIdx = loopNode.length - 1
+  const endIdx = loopNode.length - 1
   if (!(isArr(loopNode[endIdx]) && loopNode[endIdx][0] === 'br' && loopNode[endIdx][1] === loopLabel)) return null
   const incIdx = endIdx - 1
-  const incVar = matchInc1(loopNode[incIdx])
+  let incVar = matchInc1(loopNode[incIdx])
+  // CSE'd increment (gated): O3 may fold `x+1` into a body tee (the `xe = x+1` wrap) and write the
+  // increment as `x = $t` reusing it. Recover the IV when `$t` is `(tee/set $t (i32.add x 1))` in body.
+  if (!incVar && opts.allowInlinedLi) {
+    const inc = loopNode[incIdx]
+    if (isArr(inc) && inc[0] === 'local.set' && inc.length === 3 && isLocalGet(inc[2])) {
+      const copyOf = inc[2][1], iv = inc[1]
+      const findInc1 = (m) => isArr(m) && (((m[0] === 'local.set' || m[0] === 'local.tee') && m[1] === copyOf && isArr(m[2]) && m[2][0] === 'i32.add' && isLocalGet(m[2][1], iv) && constNum(m[2][2]) === 1) || m.some(findInc1))
+      if (loopNode.slice(3, incIdx).some(findInc1)) incVar = iv
+    }
+  }
   if (!incVar) return null
 
-  // First stmt must be the exit br_if.
   const exitInfo = matchExitBrIf(loopNode[2], blockLabel)
-  if (!exitInfo) return null
-  if (exitInfo.ind !== incVar) return null
+  if (!exitInfo || exitInfo.ind !== incVar) return null
 
-  // Body = stmts between exit and increment.
-  const body = []
-  for (let i = 3; i < incIdx; i++) body.push(loopNode[i])
-
-  // Bound must be loop-invariant. For now, accept (local.get $L) where $L
-  // is declared but not written inside the body, OR (i32.const N).
-  let bound = exitInfo.bound
-  let boundLocal = null
-  if (isArr(bound) && bound[0] === 'local.get' && typeof bound[1] === 'string') {
-    boundLocal = bound[1]
-  } else if (isI32Const(bound)) {
-    // ok
-  } else {
-    return null
-  }
+  const bound = exitInfo.bound
+  const boundLocal = isArr(bound) && bound[0] === 'local.get' && typeof bound[1] === 'string' ? bound[1] : null
+  const body = loopNode.slice(3, incIdx)
+  return { blockNode, blockLabel, loopNode, loopLabel, endIdx, incIdx, incVar, exitInfo, bound, boundLocal, body, preamble }
+}
+
+/**
+ * Try to vectorize the inner loop. Returns the replacement node array
+ * (synthetic outer block) or null on no match.
+ */
+function tryVectorize(bl, fnLocals, freshIdRef) {
+  // Consumes the shared scaffold descriptor (matchBlockLoop, computed once by the
+  // dispatch). The LICM `$__li` preamble is cloned ahead of the SIMD block; each
+  // set is pure & loop-invariant, so the kept scalar tail harmlessly re-runs it.
+  if (!bl) return null
+  const { incVar, bound, boundLocal, body, preamble } = bl
+
+  // Bound must be loop-invariant: (local.get $L) or (i32.const N).
+  if (!boundLocal && !isI32Const(bound)) return null
 
   // Detect lane type from the FIRST load in body.
   let laneType = null
@@ -839,7 +916,7 @@ function tryVectorize(blockNode, fnLocals, freshIdRef) {
   // Build lifted body. If anything fails to lift, bail.
   const newLanedLocals = new Map()  // origName → { laneName, simdType }
   const extraLocals = []  // canon temps allocated during lift
-  const ctx = { laneType, incVar, localKind, newLanedLocals, extraLocals, freshIdRef, fail: false, failReason: null }
+  const ctx = { laneType, incVar, rampVar: null, rampTemp: null, widenLoads: false, localKind, newLanedLocals, extraLocals, freshIdRef, fail: false, failReason: null }
   const lifted = []
   for (const s of body) {
     const r = liftStmt(s, ctx)
@@ -881,8 +958,10 @@ function tryVectorize(blockNode, fnLocals, freshIdRef) {
     ['i32.and', boundExpr, ['i32.const', mask]]]
 
   // Synthetic outer wrapper — has no result, no label, just sequences.
-  // The original block is preserved unchanged as the tail.
-  const wrapper = ['block', boundSetup, simdBlock, blockNode]
+  // A clone of any LICM-hoisted preamble runs first (so the SIMD block sees the
+  // invariant); the original block is preserved unchanged as the scalar tail (which
+  // re-runs the preamble harmlessly — it is loop-invariant).
+  const wrapper = ['block', ...preamble.map(cloneNode), boundSetup, simdBlock, bl.blockNode]
 
   // Locals to add to function header.
   const newLocalDecls = [
@@ -894,6 +973,292 @@ function tryVectorize(blockNode, fnLocals, freshIdRef) {
   return { wrapper, newLocalDecls }
 }
 
+// ---- Stencil recognizer (neighbour loads: a[i±δ], a[c±δ], a[rn+x]) --------
+//
+// Vectorizes a map whose loads read NEIGHBOURING elements — `b[i] = f(a[i-1],
+// a[i], a[i+1])` and the 2-D form `b[c] = f(a[c-1], a[c+1], a[rn+x], …)` where
+// `c = rc + x` is a derived induction var (rc loop-invariant, x the IV).
+//
+// The lift is bit-exact BY CONSTRUCTION: a scalar `f64.load` at `base+(idx<<K)`
+// becomes `v128.load` at the SAME address; for f64x2 lanes (x, x+1) that covers
+// `(elem[idx], elem[idx+1])` — exactly the bytes the two scalar iterations read.
+// No new memory is touched (scalar tail handles the remainder) ⇒ no boundary
+// special-casing, no new OOB. The neighbour `a[i+1]` arrives as
+// `(f64.load offset=8 …)` → `v128.load offset=8` (the +1-shifted pair). Stride-1
+// in the IV is required (consecutive lanes ⇒ consecutive elements): every index
+// must be affine in the IV with coefficient exactly 1 (`ivCoeff`).
+//
+// Correctness gates:
+//   • f64/f32 lanes only — float data locals vs i32 index/address locals are
+//     type-distinct, so localKind is by type. An i32-used-as-data case bails in
+//     the lifter (never miscompiles). Integer-lane stencils (types collide) decline.
+//   • In-place bail: if the WRITTEN base is also accessed at a DIFFERENT element,
+//     SIMD reads the old value where scalar reads the just-written one (loop-
+//     carried) ⇒ null. Offset-0 read of the written array is safe.
+//   • Distinct base subtrees ⇒ assumed non-aliasing — the SAME assumption the
+//     plain map path already relies on. A ping-pong buffer swap (waves) is OUTSIDE
+//     the loop, so in-loop bases stay distinct globals — safe without a runtime guard.
+//   • Reassociation: summing neighbours reorders f64 adds across lanes (ulp, like
+//     float reductions) — gated behind cfg.experimentalStencil until proven.
+function tryStencil(node, fnLocals, freshIdRef, enabled) {
+  if (!enabled) return null
+  // Gated, so match here with allowInlinedLi (accepts inlined LICM preambles `$__inl7___li*` —
+  // grid loops like schrodinger's stepR carry the row-base `y*w` as such a hoisted invariant).
+  const bl = matchBlockLoop(node, { allowPreamble: true, allowInlinedLi: true })
+  if (!bl) return null
+  const { incVar, bound, body, preamble } = bl   // preamble: LICM-hoisted $__li invariants
+  if (body.some(hasGlobalSet)) return null
+
+  // Leaf-stencil guard: a stencil body is pure array arithmetic. A NESTED LOOP (the outer loop of a
+  // 2-D sweep, whose body contains the inner loop) or a non-$math call must NOT be lifted as a
+  // stencil — its "neighbour reads" would be the nested loop's loads, misaligned. waves/schrodinger/
+  // metaballs bodies are pure arithmetic (math calls allowed), so they pass.
+  const hasNestedLoopOrCall = (n) => isArr(n) && (n[0] === 'loop'
+    || (n[0] === 'call' && (typeof n[1] !== 'string' || !n[1].startsWith('$math.'))) || n[0] === 'call_indirect'
+    || n.some(hasNestedLoopOrCall))
+  if (body.some(hasNestedLoopOrCall)) return null
+
+  const writes = new Set()
+  for (const s of body) collectWrites(s, writes)
+
+  // Bound is re-evaluated for the SIMD guard, so it must be a PURE loop-invariant
+  // i32 expression (const / unwritten local / global / +,-,* thereof). Unlike the
+  // plain-map path (bare local-or-const only), stencils commonly bound by `w-1`.
+  const boundPureInv = (n) =>
+    isI32Const(n) ? true
+    : isLocalGet(n) ? !writes.has(n[1])
+    : (isArr(n) && n[0] === 'global.get') ? true
+    : (isArr(n) && (n[0] === 'i32.add' || n[0] === 'i32.sub' || n[0] === 'i32.mul') && n.length === 3)
+      ? boundPureInv(n[1]) && boundPureInv(n[2])
+    : false
+  if (!boundPureInv(bound)) return null
+
+  // Element-index coefficient in the IV: 0 (loop-invariant), 1 (stride-1 affine —
+  // IV, a derived IV, or either ± invariant), or null (anything else).
+  const derived = new Set()
+  let needsPeel = false
+  const rightBs = []
+  const unTee = (b) => (isArr(b) && b[0] === 'local.tee' && b.length === 3) ? b[2] : b   // CSE folds x±1 into a tee
+  const isStep = (b, op) => { b = unTee(b); return isArr(b) && b[0] === op && b.length === 3 && isLocalGet(b[1], incVar) && isI32Const(b[2]) && constNum(b[2]) === 1 }
+  const isZeroGuard = (g) => isArr(g) && ((g[0] === 'i32.eqz' && isLocalGet(g[1], incVar)) || (g[0] === 'i32.eq' && isLocalGet(g[1], incVar) && isI32Const(g[2]) && constNum(g[2]) === 0))
+  // Toroidal wrap-select: `xw = x>0?x-1:w-1` / `xe = x<w-1?x+1:0`. Fires its wrap value only at a
+  // boundary column the peel covers — LEFT (interior x-1) at x=0, RIGHT (interior x+1) at x=B.
+  // Returns null | {dir:'L'} | {dir:'R',B}. Sound for ANY B: simdBound caps at min(bound,…B)-(lanes-1)
+  // so no chunk reaches x=B (no need to prove B==bound-1, which may be hoisted out of reach).
+  const isWrapSelect = (e) => {
+    if (!isArr(e) || e[0] !== 'select' || e.length !== 4) return null
+    const g = e[3]
+    if (isStep(e[1], 'i32.sub') && ivCoeff(e[2]) === 0 && isArr(g) && g[0] === 'i32.gt_s' && isLocalGet(g[1], incVar) && isI32Const(g[2]) && constNum(g[2]) === 0) return { dir: 'L' }
+    if (isStep(e[2], 'i32.sub') && ivCoeff(e[1]) === 0 && isZeroGuard(g)) return { dir: 'L' }
+    if (isStep(e[1], 'i32.add') && ivCoeff(e[2]) === 0 && isArr(g) && g[0] === 'i32.lt_s' && isLocalGet(g[1], incVar)) return { dir: 'R', B: g[2] }
+    if (isStep(e[2], 'i32.add') && ivCoeff(e[1]) === 0 && isArr(g) && g[0] === 'i32.eq' && isLocalGet(g[1], incVar)) return { dir: 'R', B: g[2] }
+    return null
+  }
+  const ivCoeff = (n) => {
+    if (isLocalGet(n)) {
+      const nm = n[1]
+      if (nm === incVar || derived.has(nm)) return 1
+      return writes.has(nm) ? null : 0          // unwritten ⇒ loop-invariant
+    }
+    if (isI32Const(n)) return 0
+    if (isArr(n) && n[0] === 'global.get') return 0
+    if (isArr(n) && (n[0] === 'i32.add' || n[0] === 'i32.sub') && n.length === 3) {
+      const a = ivCoeff(n[1]), b = ivCoeff(n[2])
+      if (a == null || b == null) return null
+      const c = n[0] === 'i32.add' ? a + b : a - b
+      return c === 0 || c === 1 ? c : null
+    }
+    // `y*w` (inline row base, e.g. idx = y*w + x): invariant×invariant ⇒ coeff 0.
+    // Any IV-dependent factor would be non-unit-stride (stride-w) ⇒ reject.
+    if (isArr(n) && (n[0] === 'i32.mul' || n[0] === 'f64.mul') && n.length === 3)
+      return ivCoeff(n[1]) === 0 && ivCoeff(n[2]) === 0 ? 0 : null
+    // Float-derived index (grid loops compute the row base `y*w` in f64): the index arrives as
+    // `idx = select(wrap(trunc_sat(INV + convert(x))), 0, ≠Inf)`. For an integer counter x,
+    // trunc(C + x) = trunc(C) + x ⇒ stride-1 (the i32 lane offset is added before the trunc); the
+    // Infinity-canon select takes the trunc branch for finite coords (grid indices are finite).
+    // f64.add/sub mirror i32.add/sub; convert/wrap/trunc_sat/tee are coeff-transparent.
+    if (isArr(n) && (n[0] === 'f64.add' || n[0] === 'f64.sub') && n.length === 3) {
+      const a = ivCoeff(n[1]), b = ivCoeff(n[2])
+      if (a == null || b == null) return null
+      const c = n[0] === 'f64.add' ? a + b : a - b
+      return c === 0 || c === 1 ? c : null
+    }
+    if (isArr(n) && (n[0] === 'f64.convert_i32_s' || n[0] === 'i32.wrap_i64' || n[0] === 'i64.trunc_sat_f64_s') && n.length === 2)
+      return ivCoeff(n[1])
+    if (isArr(n) && n[0] === 'local.tee' && n.length === 3) return ivCoeff(n[2])
+    if (isArr(n) && n[0] === 'select') {
+      // Toroidal wrap-select (inline in an address or named): stride-1 interior; flag the peel.
+      const w = isWrapSelect(n)
+      if (w) { needsPeel = true; if (w.dir === 'R' && !rightBs.some(b => exprEq(b, w.B))) rightBs.push(w.B); return 1 }
+      // jz overflow-canon `select(wrap(trunc_sat(…)), 0, ≠Inf)`: finite (grids) ⇒ the trunc branch.
+      if (n.length === 4 && isI32Const(n[2]) && isArr(n[3]) && n[3][0] === 'f64.ne' && isArr(n[3][2]) && n[3][2][0] === 'f64.const' && /inf/i.test(String(n[3][2][1])))
+        return ivCoeff(n[1])
+    }
+    return null
+  }
+  const countSets = (name) => {
+    let k = 0
+    const w = (x) => { if (!isArr(x)) return; if ((x[0] === 'local.set' || x[0] === 'local.tee') && x[1] === name) k++; for (let i = 1; i < x.length; i++) w(x[i]) }
+    for (const s of body) w(s)
+    return k
+  }
+  // Derived IVs: `c = INV + x` (coeff 1) or a toroidal wrap-select; set exactly once, first access a
+  // write. RECURSES into nested tees — O3 CSEs `rc+x` into `(local.tee $pe (i32.add rc x))` inside a
+  // load address, reused by the store. (ivCoeff returns 1 for a wrap-select and flags needsPeel.)
+  for (let pass = 0; pass < 4; pass++) {
+    let added = false
+    const consider = (name, def) => {
+      if (derived.has(name) || fnLocals.get(name) !== 'i32' || countSets(name) !== 1 || ivCoeff(def) !== 1) return
+      let fk = null; for (const t of body) { const k = firstAccess(t, name); if (k) { fk = k; break } }
+      if (fk === 'write') { derived.add(name); added = true }
+    }
+    const walk = (x) => { if (!isArr(x)) return; if ((x[0] === 'local.set' || x[0] === 'local.tee') && typeof x[1] === 'string' && x.length === 3) consider(x[1], x[2]); for (let i = 1; i < x.length; i++) walk(x[i]) }
+    for (const s of body) walk(s)
+    if (!added) break
+  }
+
+  // Scan loads/stores: address `base + (IDX<<K)`, ivCoeff(IDX)=1, base invariant.
+  let laneType = null, stride = -1
+  const offTees = new Map()    // $pe → IDX expr  (from $pe = IDX<<K)
+  const addrTees = new Map()   // $ab → { base, idx }
+  const sites = []             // { kind, base, idx, memBytes }
+  const isInvBase = (b) => (isArr(b) && b[0] === 'global.get') || (isLocalGet(b) && !writes.has(b[1]))
+  const matchAddr = (addr, expectStride = stride) => {
+    let teeName = null, n = addr
+    if (isArr(n) && n[0] === 'local.tee' && n.length === 3) { teeName = n[1]; n = n[2] }
+    if (isLocalGet(n) && addrTees.has(n[1])) { const e = addrTees.get(n[1]); if (teeName) addrTees.set(teeName, e); return e }
+    if (!isArr(n) || n[0] !== 'i32.add' || n.length !== 3) return null
+    const tryOff = (off) => {
+      let ot = null, o = off
+      if (isArr(o) && o[0] === 'local.tee' && o.length === 3) { ot = o[1]; o = o[2] }
+      if (isLocalGet(o) && offTees.has(o[1])) return { idx: offTees.get(o[1]) }
+      if (isArr(o) && o[0] === 'i32.shl' && o.length === 3 && isI32Const(o[2]) && (1 << o[2][1]) === expectStride && ivCoeff(o[1]) === 1) {
+        if (ot) offTees.set(ot, o[1])
+        return { idx: o[1] }
+      }
+      return null
+    }
+    for (const [bi, oi] of [[1, 2], [2, 1]]) {
+      if (!isInvBase(n[bi])) continue
+      const om = tryOff(n[oi])
+      if (om) { const e = { base: n[bi], idx: om.idx }; if (teeName) addrTees.set(teeName, e); return e }
+    }
+    return null
+  }
+  const scan = (node, parent, pi) => {
+    if (!isArr(node)) return true
+    const op = node[0]
+    if (LOAD_OPS[op]) {
+      let addr = node[1], memBytes = 0
+      if (typeof addr === 'string' && addr.startsWith('offset=')) { memBytes = +addr.slice(7); addr = node[2] }
+      const lt = LOAD_OPS[op]
+      if (laneType == null) { if (lt !== 'f64' && lt !== 'f32') return false; laneType = lt; stride = LANE_INFO[lt].stride }
+      else if (lt !== laneType && !(lt === 'f32' && laneType === 'f64')) return false   // f32→f64 widening OK
+      // Validate the address at the LOAD's own element stride (f64=8, widening f32=4); the index
+      // must still be stride-1 in elements (ivCoeff===1). The f32 load is promoted in liftExprV.
+      const m = matchAddr(addr, LANE_INFO[lt].stride)
+      if (!m) return false
+      sites.push({ kind: 'load', base: m.base, idx: m.idx, memBytes })
+      return true
+    }
+    if (STORE_OPS[op]) {
+      if (node.length !== 3) return false
+      const st = STORE_OPS[op]
+      if (laneType == null) { if (st !== 'f64' && st !== 'f32') return false; laneType = st; stride = LANE_INFO[st].stride }
+      else if (st !== laneType) return false
+      const m = matchAddr(node[1])
+      if (!m) return false
+      sites.push({ kind: 'store', base: m.base, idx: m.idx, memBytes: 0 })
+      return scan(node[2], node, 2)                        // value child only
+    }
+    if ((op === 'local.set' || op === 'local.tee') && typeof node[1] === 'string' && node.length === 3) {
+      const v = node[2]
+      if (isArr(v) && v[0] === 'i32.shl' && v.length === 3 && isI32Const(v[2]) && stride > 0 && (1 << v[2][1]) === stride && ivCoeff(v[1]) === 1) offTees.set(node[1], v[1])
+      else matchAddr(['local.tee', node[1], v])
+    }
+    for (let i = 1; i < node.length; i++) if (!scan(node[i], node, i)) return false
+    return true
+  }
+  for (const s of body) if (!scan(s, null, -1)) return null
+  if (!laneType || !sites.some(s => s.kind === "store") || !sites.some(s => s.kind === "load")) return null
+
+  // In-place / loop-carried gate: every access to a WRITTEN base must touch the
+  // SAME element (idx + memarg). Else SIMD reads stale data vs scalar.
+  const elemKey = (s) => `${JSON.stringify(normTee(s.idx))}@${s.memBytes / stride}`
+  for (const st of sites) {
+    if (st.kind !== 'store') continue
+    for (const s of sites) if (exprEq(normTee(s.base), normTee(st.base)) && elemKey(s) !== elemKey(st)) return null
+  }
+  // A pure offset-0 map (every access the same element, no memarg) is tryVectorize's
+  // job — it ran first. Nothing stencil-specific here. (Defensive; ?? order ensures it.)
+  const k0 = elemKey(sites[0])
+  if (sites.every(s => elemKey(s) === k0)) return null
+
+  // Classify locals by TYPE: i32 → addr (index/address, kept scalar), laneType
+  // written → lane (first access must be a write), laneType unwritten → invariant.
+  const referenced = new Set()
+  const collectRefs = (n) => { if (!isArr(n)) return; if ((n[0] === 'local.get' || n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') referenced.add(n[1]); for (let i = 1; i < n.length; i++) collectRefs(n[i]) }
+  for (const s of body) collectRefs(s)
+  const localKind = new Map()
+  for (const name of referenced) {
+    if (name === incVar) continue
+    const ty = fnLocals.get(name)
+    if (ty === 'i32') { localKind.set(name, 'addr'); continue }
+    if (ty === laneType) {
+      if (writes.has(name)) {
+        let fk = null; for (const s of body) { const k = firstAccess(s, name); if (k) { fk = k; break } }
+        if (fk === 'read') return null                    // loop-carried float local
+        localKind.set(name, 'lane')
+      } else localKind.set(name, 'invariant')
+      continue
+    }
+    if (!writes.has(name)) { localKind.set(name, 'invariant'); continue }
+    return null                                            // written non-i32 non-lane local
+  }
+
+  // Lift through the shared lifter (addresses kept verbatim; loads → v128.load).
+  const newLanedLocals = new Map(), extraLocals = []
+  const ctx = { laneType, incVar, rampVar: null, rampTemp: null, widenLoads: false, localKind, newLanedLocals, extraLocals, freshIdRef, fail: false, failReason: null }
+  const lifted = []
+  for (const s of body) {
+    const r = liftStmt(s, ctx)
+    if (ctx.fail) return null
+    if (r != null) { if (Array.isArray(r) && r[0] === '__seq__') lifted.push(...r.slice(1)); else lifted.push(r) }
+  }
+  if (!lifted.length) return null
+
+  const id = freshIdRef.next++
+  const simdBoundName = `$__simd_bound${id}`, simdBrkLabel = `$__simd_brk${id}`, simdLoopLabel = `$__simd_loop${id}`
+  const info = LANE_INFO[laneType], lanes = info.lanes
+  const boundExpr = cloneNode(bound)   // cloned: also lives in the scalar-tail exit guard
+  // Overshoot-safe bound: a full lanes-wide chunk [x,x+lanes) must stay < bound for
+  // ANY start x (stencils start at 1). `bound-(lanes-1)` — NOT `& ~(lanes-1)`, which
+  // overshoots for a non-multiple start. SIMD reads ⊆ scalar reads ⇒ no new OOB.
+  // A toroidal-wrap stencil additionally PEELS both boundary columns scalar: cap the SIMD at
+  // `min(bound, …rightWrapBoundaries) - (lanes-1)` so no chunk reaches a right-wrap column x=B,
+  // and run x=0 scalar below (where the left wrap fires) so the SIMD starts in the wrap-free interior.
+  const simdCap = rightBs.reduce((acc, b) => ['select', cloneNode(b), acc, ['i32.lt_s', cloneNode(b), acc]], boundExpr)
+  const boundSetup = ['local.set', simdBoundName, ['i32.sub', simdCap, ['i32.const', lanes - 1]]]
+  const simdBlock = ['block', simdBrkLabel,
+    ['loop', simdLoopLabel,
+      ['br_if', simdBrkLabel, ['i32.eqz', ['i32.lt_s', ['local.get', incVar], ['local.get', simdBoundName]]]],
+      ...lifted,
+      ['local.set', incVar, ['i32.add', ['local.get', incVar], ['i32.const', lanes]]],
+      ['br', simdLoopLabel]]]
+  // Left-boundary peel for a wrap stencil: run the original scalar body once for x=0 (where the wrap
+  // takes its WRAP branch), advancing x to 1 so the SIMD starts in the wrap-free interior. Guarded so
+  // an empty loop (x ≥ bound) is untouched. Right boundary + odd tail: the kept scalar tail (blockNode).
+  const peelStmts = needsPeel
+    ? [['if', ['i32.lt_s', ['local.get', incVar], cloneNode(bound)],
+        ['then', ...body.map(cloneNode), cloneNode(bl.loopNode[bl.incIdx])]]]
+    : []
+  // LICM-hoisted $__li invariants run ahead of the SIMD block (the scalar tail's
+  // copy inside bl.blockNode re-runs them harmlessly — pure & loop-invariant).
+  const wrapper = ['block', ...preamble.map(cloneNode), ...peelStmts, boundSetup, simdBlock, bl.blockNode]
+  const newLocalDecls = [['local', simdBoundName, 'i32'], ...[...newLanedLocals.values()].map(({ laneName }) => ['local', laneName, 'v128']), ...extraLocals]
+  return { wrapper, newLocalDecls }
+}
+
 // ---- Reduction recognizer -------------------------------------------------
 //
 // Matches inner loops of shape:
@@ -912,31 +1277,10 @@ function tryVectorize(blockNode, fnLocals, freshIdRef) {
 // Float adds are not strictly associative — vectorized reduction differs
 // from scalar reduction by ulps. Acceptable when bit-exact equality is not
 // required (which it isn't, by spec, in JS engines either).
-function tryReduceVectorize(blockNode, fnLocals, freshIdRef) {
-  if (!isArr(blockNode) || blockNode[0] !== 'block') return null
-
-  // Match outer (block (loop)) structure. Same loop-shape as tryVectorize.
-  let blockLabel = null
-  let loopNode = null
-  for (let i = 1; i < blockNode.length; i++) {
-    const c = blockNode[i]
-    if (typeof c === 'string' && c.startsWith('$') && blockLabel == null && i === 1) { blockLabel = c; continue }
-    if (isArr(c) && c[0] === 'loop') {
-      if (loopNode) return null
-      loopNode = c
-    } else if (isArr(c)) return null
-  }
-  if (!loopNode || !blockLabel) return null
-  const loopLabel = typeof loopNode[1] === 'string' && loopNode[1].startsWith('$') ? loopNode[1] : null
-  if (!loopLabel) return null
-  const endIdx = loopNode.length - 1
-  if (!(isArr(loopNode[endIdx]) && loopNode[endIdx][0] === 'br' && loopNode[endIdx][1] === loopLabel)) return null
-  const incIdx = endIdx - 1
-  const incVar = matchInc1(loopNode[incIdx])
-  if (!incVar) return null
-  const exitInfo = matchExitBrIf(loopNode[2], blockLabel)
-  if (!exitInfo) return null
-  if (exitInfo.ind !== incVar) return null
+function tryReduceVectorize(bl, fnLocals, freshIdRef, multiAcc = false) {
+  // Same scaffold as tryVectorize, but no preamble: a reduction block is just the loop.
+  if (!bl || bl.preamble.length) return null
+  const { loopNode, incIdx, incVar } = bl
 
   // Body is either a bare single-statement reduction —
   //   (local.set $acc (OP (local.get $acc) EXPR))            add/xor/and/or
@@ -1016,6 +1360,41 @@ function tryReduceVectorize(blockNode, fnLocals, freshIdRef) {
     exprNode = rhs[2]
   } else return null
 
+  // Offset-indexed reductions (matmul `s += A[ai+k]*Bt[bj+k]`): the index `ai+k`
+  // lowers to `(i32.shl (i32.add ai i) K)`, which matchLaneAddr rejects (the IV is
+  // not the bare shift operand). Fold the loop-invariant part into the base —
+  //   (base + (INV+i)<<K)  →  ((base + INV<<K) + i<<K)
+  // so the offset is the bare IV the matcher/lifter already accept. The byte address
+  // is unchanged, so the v128.load reads the same consecutive pair → bit-exact. INV
+  // must be loop-invariant (not written in the loop) and IV-free (coefficient 1).
+  {
+    const writtenInLoop = new Set()
+    ;(function wr(n) { if (!isArr(n)) return; if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') writtenInLoop.add(n[1]); for (let i = 1; i < n.length; i++) wr(n[i]) })(loopNode)
+    const invFree = (n) => !isArr(n) || (!(n[0] === 'local.get' && (n[1] === incVar || writtenInLoop.has(n[1]))) && n.every((c, i) => i === 0 || invFree(c)))
+    let folded = false
+    const foldAddr = (n) => {
+      if (!isArr(n)) return n
+      if (n[0] === 'i32.add' && n.length === 3) {
+        for (const [base, off] of [[n[1], n[2]], [n[2], n[1]]]) {
+          if (isArr(off) && off[0] === 'i32.shl' && off.length === 3 && isArr(off[1]) && off[1][0] === 'i32.add' && off[1].length === 3) {
+            const k = constNum(off[2]), x = off[1][1], y = off[1][2]
+            const xIV = isLocalGet(x, incVar), yIV = isLocalGet(y, incVar)
+            if (k != null && k >= 0 && k <= 3 && xIV !== yIV) {
+              const inv = xIV ? y : x
+              if (invFree(inv)) {
+                folded = true
+                return ['i32.add', ['i32.add', foldAddr(base), ['i32.shl', inv, ['i32.const', k]]], ['i32.shl', ['local.get', incVar], ['i32.const', k]]]
+              }
+            }
+          }
+        }
+      }
+      return n.map(foldAddr)
+    }
+    const fe = foldAddr(exprNode)
+    if (folded) exprNode = fe
+  }
+
   // Accumulator's declared local type must match the lane element type.
   // Exception: the widening byte/short sum — i32 accumulator fed by ONE bare
   // narrow load (`s += u8[i]`), whose LANE type is i8/i16 but reduces into i32.
@@ -1043,11 +1422,9 @@ function tryReduceVectorize(blockNode, fnLocals, freshIdRef) {
   }
   if (!widen && accType !== (reduceEntry.accI32 ? 'i32' : reduceEntry.accF64 ? 'f64' : reduceEntry.laneType)) return null
 
-  // Bound classification (same as tryVectorize).
-  let bound = exitInfo.bound
-  let boundLocal = null
-  if (isArr(bound) && bound[0] === 'local.get' && typeof bound[1] === 'string') boundLocal = bound[1]
-  else if (!isI32Const(bound)) return null
+  // Bound must be loop-invariant: (local.get $L) or (i32.const N).
+  const { bound, boundLocal } = bl
+  if (!boundLocal && !isI32Const(bound)) return null
 
   // Scan EXPR for lane-aligned loads. Stores forbidden. Re-references of
   // accName forbidden (the accumulator only appears in the outer wrapper).
@@ -1100,7 +1477,7 @@ function tryReduceVectorize(blockNode, fnLocals, freshIdRef) {
   for (const name of addrLocals.keys()) localKind.set(name, 'addr')
   for (const name of offsetTees.keys()) localKind.set(name, 'addr')
 
-  const ctx = { laneType, incVar, localKind, newLanedLocals: new Map(), extraLocals: [], freshIdRef, fail: false, failReason: null }
+  const ctx = { laneType, incVar, rampVar: null, rampTemp: null, widenLoads: false, localKind, newLanedLocals: new Map(), extraLocals: [], freshIdRef, fail: false, failReason: null }
   const liftedExpr = liftExprV(exprNode, ctx)
   if (ctx.fail) return null
   if (ctx.newLanedLocals.size > 0 || ctx.extraLocals.length > 0) return null
@@ -1108,28 +1485,55 @@ function tryReduceVectorize(blockNode, fnLocals, freshIdRef) {
   // Synthesize SIMD prefix block + horizontal reduce + (preserved scalar tail).
   const id = freshIdRef.next++
   const simdBoundName = `$__simd_bound${id}`
-  const simdAccName = `$__simd_acc${id}`
+  const simdAccName = `$__simd_acc${id}`   // accumulator 0 — the one the merge folds
   const simdBrkLabel = `$__simd_brk${id}`
   const simdLoopLabel = `$__simd_loop${id}`
   const info = LANE_INFO[laneType]
   const lanes = info.lanes
   const boundExpr = boundLocal ? ['local.get', boundLocal] : bound
 
+  // Multi-accumulator unroll. A reduction's loop-carried accumulator is a latency
+  // chain — each iteration's op waits on the previous result, so a single vector
+  // accumulator runs at FP-op latency, not throughput. N INDEPENDENT accumulators
+  // (each summing every Nth lane-chunk, combined at the end) expose instruction-
+  // level parallelism and hide the latency — ~2x on a dot/FIR reduction. It is
+  // DETERMINISTIC: only the reduction's reassociation widens (8 partial sums vs 2),
+  // the same kind the existing 2-lane fold already does, identical on every engine.
+  // Restricted to the plain horizontal-fold FP path (not min/max-select, the
+  // narrow-widening sums, or NaN-canon — those have their own fold shapes).
+  const plainReduce = !reduceEntry.minmaxSelect && !widen && canonC == null
+  const NACC = (multiAcc && plainReduce && (laneType === 'f64' || laneType === 'f32')) ? 4 : 1
+  const accK = (k) => k === 0 ? simdAccName : `$__simd_acc${id}_${k}`
+  const laneBytes = lanes * stride
+
   // Widening sum: the ACCUMULATOR vector is i32x4 regardless of the (narrow)
   // lane type; each iteration's 16-byte load collapses via extadd_pairwise.
   const accSplat = widen ? 'i32x4.splat' : info.splat
   const accumOperand = widen ? widen.steps.reduce((e, s) => [s, e], liftedExpr) : liftedExpr
-  const initAcc = ['local.set', simdAccName, [accSplat, reduceEntry.constNode ?? reduceEntry.identity]]
+  // Accumulator k reads the same lane-aligned data as acc 0, shifted by k chunks
+  // (k·laneBytes). Acc 0 keeps the address tees (it sets them); acc k>0 reads the
+  // tee'd address (normTee → local.get) and adds the byte offset to each load.
+  const offsetLoads = (node, off) => !isArr(node) ? node
+    : node[0] === 'v128.load' ? ['v128.load', ['i32.add', node[1], ['i32.const', off]]]
+    : node.map(c => offsetLoads(c, off))
+  const accOperandFor = (k) => k === 0 ? accumOperand : offsetLoads(normTee(accumOperand), k * laneBytes)
+
+  const initAcc = []
+  for (let k = 0; k < NACC; k++) initAcc.push(['local.set', accK(k), [accSplat, reduceEntry.constNode ?? reduceEntry.identity]])
+  const loopBody = []
+  for (let k = 0; k < NACC; k++) loopBody.push(['local.set', accK(k), [reduceEntry.simd, ['local.get', accK(k)], accOperandFor(k)]])
+  loopBody.push(['local.set', incVar, ['i32.add', ['local.get', incVar], ['i32.const', lanes * NACC]]])
   const simdBlock = ['block', simdBrkLabel,
     ['loop', simdLoopLabel,
       ['br_if', simdBrkLabel,
         ['i32.eqz', ['i32.lt_s', ['local.get', incVar], ['local.get', simdBoundName]]]],
-      ['local.set', simdAccName,
-        [reduceEntry.simd, ['local.get', simdAccName], accumOperand]],
-      ['local.set', incVar, ['i32.add', ['local.get', incVar], ['i32.const', lanes]]],
+      ...loopBody,
       ['br', simdLoopLabel]
     ]
   ]
+  // Combine the N accumulators into acc 0 (lane-wise) before the horizontal fold.
+  const combineAccs = []
+  for (let k = 1; k < NACC; k++) combineAccs.push(['local.set', simdAccName, [reduceEntry.simd, ['local.get', simdAccName], ['local.get', accK(k)]]])
 
   // Horizontal fold + merge into the live accumulator.
   const extraDecls = []
@@ -1181,25 +1585,126 @@ function tryReduceVectorize(blockNode, fnLocals, freshIdRef) {
   // at i=1, which `& ~(lanes-1)` masking would run one lane past the end). For
   // a lane-aligned start this yields the same iteration set as masking; the
   // scalar tail (original `i<bound` guard) cleans up regardless.
-  const boundSetup = ['local.set', simdBoundName, ['i32.sub', boundExpr, ['i32.const', lanes - 1]]]
+  // A full N·lanes-wide step (all N accumulators) must stay in range.
+  const boundSetup = ['local.set', simdBoundName, ['i32.sub', boundExpr, ['i32.const', lanes * NACC - 1]]]
 
   // Narrow-widened entries seed the vector acc with a LANE-domain neutral (e.g.
   // 0 for u8-max) — only neutral once real lanes fold in. Guard the whole SIMD
   // prefix incl. the merge so a zero-iteration range can't clamp the live acc
   // toward the identity. Full-width entries use absolute neutrals; unguarded.
+  // (The guarded path is always NACC=1 — accI32/accF64 are non-plain reductions.)
   const core = reduceEntry.accI32 || reduceEntry.accF64
     ? [['if', ['i32.lt_s', ['local.get', incVar], ['local.get', simdBoundName]],
-        ['then', initAcc, simdBlock, ...mergeStmts]]]
-    : [initAcc, simdBlock, ...mergeStmts]
-  const wrapper = ['block', boundSetup, ...core, blockNode]
+        ['then', ...initAcc, simdBlock, ...combineAccs, ...mergeStmts]]]
+    : [...initAcc, simdBlock, ...combineAccs, ...mergeStmts]
+  const wrapper = ['block', boundSetup, ...core, bl.blockNode]
   const newLocalDecls = [
     ['local', simdBoundName, 'i32'],
     ['local', simdAccName, 'v128'],
+    ...Array.from({ length: NACC - 1 }, (_, k) => ['local', accK(k + 1), 'v128']),
     ...extraDecls,
   ]
   return { wrapper, newLocalDecls }
 }
 
+// Bit-exact f64 map-reduce (the direct-summation n-body force loop). A loop that
+// accumulates one or more f64 reductions whose per-iteration contribution is computed
+// INDEPENDENTLY of the accumulators. Process 2 iterations per step in f64x2 — every lane
+// op (sub/mul/add/div/sqrt) is IEEE-754-identical to scalar f64 (no FMA in non-relaxed
+// SIMD) — then accumulate each accumulator's two lane contributions IN SCALAR ORDER, so
+// the reduction is BIT-EXACT (unlike the reassociating tryReduceVectorize). Wins when the
+// per-element compute is expensive (a sqrt + reciprocal) so the 2-wide arithmetic
+// outweighs the serial lane-accumulation. The original block is preserved as the ≤1
+// scalar remainder, continuing the accumulators. Returns {wrapper, newLocalDecls} or null.
+function tryMapReduceVectorize(bl, fnLocals, freshIdRef) {
+  if (!bl || bl.preamble.length) return null
+  const { incVar, bound, boundLocal, body } = bl
+  if (!boundLocal && !isI32Const(bound)) return null
+  if (body.length < 2) return null
+
+  // Every body stmt must be `(local.set $x EXPR)`. An accumulator reads its own target
+  // through `f64.add` (`acc = acc + EXPR`); the rest are per-iteration lane locals. (One
+  // write per acc — duplicate writes would break the per-acc ordering.)
+  for (const s of body) if (!(isArr(s) && s[0] === 'local.set' && typeof s[1] === 'string' && s.length === 3)) return null
+  const accSet = new Set()
+  for (const s of body) if (isArr(s[2]) && s[2][0] === 'f64.add' && isLocalGet(s[2][1], s[1])) accSet.add(s[1])
+  if (!accSet.size) return null
+  const writeCount = new Map()
+  for (const s of body) writeCount.set(s[1], (writeCount.get(s[1]) || 0) + 1)
+  for (const a of accSet) { if (writeCount.get(a) !== 1 || fnLocals.get(a) !== 'f64') return null }
+
+  // Address tees: locals that equal `ind << K`. f64 loads must be stride-8 (K=3) so one
+  // f64x2.load (16 bytes) covers iterations j and j+1 — consecutive elements.
+  const offsetTees = new Map()
+  const allNames = new Set()
+  const gather = (n) => { if (!isArr(n)) return; if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') allNames.add(n[1]); for (let i = 1; i < n.length; i++) gather(n[i]) }
+  for (const s of body) gather(s)
+  for (const name of allNames) { const k = _offsetLocalStride(body, name, incVar); if (k != null) offsetTees.set(name, k) }
+
+  // f64x2 lift: load → f64x2.load (2 consecutive), const/invariant → splat, a lane local
+  // → its f64x2 temp, sub/mul/add/div → f64x2.OP, sqrt → f64x2.sqrt. Anything else bails.
+  const laneV = new Map()
+  const newLocalDecls = []
+  const fresh = () => { const n = `$__mr${freshIdRef.next++}`; newLocalDecls.push(['local', n, 'v128']); return n }
+  let bad = false
+  const lift = (e) => {
+    if (bad || !isArr(e)) { bad = true; return null }
+    const op = e[0]
+    if (op === 'f64.const') return ['f64x2.splat', e]
+    if (op === 'f64.load') {
+      const m = matchLaneAddr(e[1], incVar, new Map(), offsetTees)
+      if (!m || m.strideLog2 !== 3) { bad = true; return null }
+      return ['v128.load', e[1]]   // 16 bytes = 2 consecutive f64s; the f64x2 op reads them
+    }
+    if (op === 'local.get' && typeof e[1] === 'string') {
+      if (e[1] === incVar || accSet.has(e[1])) { bad = true; return null }   // IV-as-data / acc-dependent contribution
+      if (laneV.has(e[1])) return ['local.get', laneV.get(e[1])]
+      if (writeCount.has(e[1])) { bad = true; return null }   // a body local used BEFORE its set this iteration → loop-carried, not a fresh lane
+      return ['f64x2.splat', e]   // genuine loop-invariant scalar (xi, …)
+    }
+    if ((op === 'f64.add' || op === 'f64.sub' || op === 'f64.mul' || op === 'f64.div') && e.length === 3)
+      return [op.replace('f64.', 'f64x2.'), lift(e[1]), lift(e[2])]
+    if (op === 'f64.sqrt' && e.length === 2) return ['f64x2.sqrt', lift(e[1])]
+    bad = true; return null
+  }
+
+  // Lifted body: setup lanes → f64x2 temps (in order, so the offset tee in the first load
+  // is set before later loads read it); each accumulator → a temp + two in-order adds.
+  const lifted = []
+  for (const s of body) {
+    if (accSet.has(s[1])) {
+      const cV = fresh()
+      const v = lift(s[2][2])
+      if (bad) return null
+      lifted.push(['local.set', cV, v],
+        ['local.set', s[1], ['f64.add', ['local.get', s[1]], ['f64x2.extract_lane', 0, ['local.get', cV]]]],
+        ['local.set', s[1], ['f64.add', ['local.get', s[1]], ['f64x2.extract_lane', 1, ['local.get', cV]]]])
+    } else {
+      const tv = fresh()
+      laneV.set(s[1], tv)
+      const v = lift(s[2])
+      if (bad) return null
+      lifted.push(['local.set', tv, v])
+    }
+  }
+  if (bad || !lifted.length) return null
+
+  // SIMD prefix over the even prefix [0, bound & ~1); the original block is the ≤1 scalar
+  // remainder (continues j and the accumulators). IV advances by 2.
+  const id = freshIdRef.next++
+  const simdBoundName = `$__mrb${id}`, simdBrk = `$__mrbrk${id}`, simdLoop = `$__mrl${id}`
+  const boundExpr = boundLocal ? ['local.get', boundLocal] : ['i32.const', constNum(bound)]
+  const simdBlock = ['block', simdBrk,
+    ['loop', simdLoop,
+      ['br_if', simdBrk, ['i32.eqz', ['i32.lt_s', ['local.get', incVar], ['local.get', simdBoundName]]]],
+      ...lifted,
+      ['local.set', incVar, ['i32.add', ['local.get', incVar], ['i32.const', 2]]],
+      ['br', simdLoop]]]
+  const boundSetup = ['local.set', simdBoundName, ['i32.and', boundExpr, ['i32.const', -2]]]
+  const wrapper = ['block', boundSetup, simdBlock, bl.blockNode]
+  return { wrapper, newLocalDecls: [['local', simdBoundName, 'i32'], ...newLocalDecls] }
+}
+
 // Scalar locals that are ALWAYS computed as `(i32.add base (i32.shl ind K))`
 // or aliased to such an address are "address tees", not lane data. They stay
 // scalar i32 in the lifted body.
@@ -1259,13 +1764,30 @@ function liftCanon(coreV, C, ctx, info) {
     ['v128.bitselect', splatC, g, [laneNe, g, g]]]
 }
 
+// --why-not-simd diagnostics. `_whyNotActive` is armed only for the duration of a
+// vectorizeLaneLocal call made with the flag on (cleared on exit — never leaks into
+// codegen, which never reads it). `_whyNotReason` captures the FIRST (deepest) lift
+// bail for the block currently under the recognizer chain; the walk reads it after.
+let _whyNotActive = false
+let _whyNotReason = null
+
+// Mark a lift bail and record its reason. First-write-wins: the innermost failing op
+// sets ctx.failReason; outer frames see ctx.fail already set and return without
+// overwriting, so the reason names the actual blocking op, not a wrapper.
+const liftFail = (ctx, reason) => {
+  ctx.fail = true
+  if (ctx.failReason == null) ctx.failReason = reason
+  if (_whyNotActive && _whyNotReason == null) _whyNotReason = reason
+  return null
+}
+
 /** Lift a statement. Returns lifted stmt, or null to skip, or ['__seq__', ...] for multiple. */
 function liftStmt(stmt, ctx) {
   if (!isArr(stmt)) {
     // Bare strings like "drop" — produced by stack-form WAT. We unwrap value-blocks
     // separately so an isolated "drop" should not appear here, but tolerate it.
     if (stmt === 'drop') return null
-    ctx.fail = true; return null
+    return liftFail(ctx, 'non-array statement')
   }
   const op = stmt[0]
 
@@ -1282,7 +1804,7 @@ function liftStmt(stmt, ctx) {
       if (ctx.fail) return null
       return ['local.set', laneName, v]
     }
-    ctx.fail = true; return null
+    return liftFail(ctx, `local.set ${name}: loop-carried or unclassified local`)
   }
 
   if (STORE_OPS[op]) {
@@ -1292,7 +1814,7 @@ function liftStmt(stmt, ctx) {
     if (ctx.fail) return null
     // Handle memarg if present (last positional after addr/val): unlikely in
     // pre-watr IR for this shape; bail if more than 3 children.
-    if (stmt.length !== 3) { ctx.fail = true; return null }
+    if (stmt.length !== 3) return liftFail(ctx, `${op} with memarg`)
     return [simdStore, addr, val]
   }
 
@@ -1319,19 +1841,86 @@ function liftStmt(stmt, ctx) {
     return out
   }
 
+  // Standalone conditional store: `if (COND) { …inter; store(addr,A) } [else { …inter; store(addr,B) }]`.
+  // Both arms end in a store to the SAME address; a missing else keeps the current value. Speculatively
+  // lift both arms (intermediate sets become lane locals; masked lanes are discarded — lane-pure ops
+  // are trap-free) and emit ONE store of `bitselect(A, B, mask(COND))`. Unlocks per-pixel conditional
+  // maps like lorenz's i32x4 trail fade (`if (p & 0xffffff) px[i] = fade(p)`).
+  if (op === 'if' && isArr(stmt[2]) && stmt[2][0] === 'then') {
+    const armOf = (arm) => {
+      let body = arm.slice(1)
+      if (body.length === 1 && isArr(body[0]) && body[0][0] === 'block') {   // unwrap a single block arm
+        const b = body[0]; let i = 1
+        if (typeof b[i] === 'string' && b[i].startsWith('$')) i++
+        if (isArr(b[i]) && b[i][0] === 'result') i++
+        body = b.slice(i)
+      }
+      const last = body[body.length - 1]
+      if (!isArr(last) || !STORE_OPS[last[0]] || last.length !== 3) return null
+      return { inter: body.slice(0, -1), addr: last[1], val: last[2], store: last[0] }
+    }
+    const thenA = armOf(stmt[2]), elseA = (isArr(stmt[3]) && stmt[3][0] === 'else') ? armOf(stmt[3]) : null
+    if (!thenA || (isArr(stmt[3]) && !elseA)) return liftFail(ctx, 'if-store: arm is not a conditional store')
+    if (elseA && (JSON.stringify(thenA.addr) !== JSON.stringify(elseA.addr) || thenA.store !== elseA.store)) return liftFail(ctx, 'if-store: arms store differently')
+    // mask from COND: a lane comparison, or (i32) a truthy test `lift(cond) != 0`.
+    let cond = stmt[1]
+    if (isArr(cond) && cond[0] === 'i32.ne' && isI32Const(cond[2]) && cond[2][1] === 0) cond = cond[1]
+    const cmp = isArr(cond) && cond.length === 3 ? LANE_COMPARE[ctx.laneType]?.[cond[0]] : null
+    let mask
+    if (cmp) { const ca = liftExprV(cond[1], ctx); if (ctx.fail) return null; const cb = liftExprV(cond[2], ctx); if (ctx.fail) return null; mask = [cmp, ca, cb] }
+    else if (ctx.laneType === 'i32') { const lc = liftExprV(cond, ctx); if (ctx.fail) return null; mask = ['i32x4.ne', lc, ['i32x4.splat', ['i32.const', 0]]] }
+    else return liftFail(ctx, 'if-store: non-comparison condition')
+    const out = ['__seq__']
+    const liftInter = (arm) => { for (const s of arm.inter) { const l = liftStmt(s, ctx); if (ctx.fail) return false; if (l != null) { if (Array.isArray(l) && l[0] === '__seq__') out.push(...l.slice(1)); else out.push(l) } } return true }
+    if (!liftInter(thenA)) return null
+    if (elseA && !liftInter(elseA)) return null
+    const thenVal = liftExprV(thenA.val, ctx); if (ctx.fail) return null
+    const elseVal = elseA ? liftExprV(elseA.val, ctx) : ['v128.load', thenA.addr]   // no else ⇒ keep current value
+    if (ctx.fail) return null
+    const mtmp = `$__mask${ctx.freshIdRef.next++}`
+    ctx.extraLocals.push(['local', mtmp, 'v128'])
+    out.push(['local.set', mtmp, mask], ['v128.store', thenA.addr, ['v128.bitselect', thenVal, elseVal, ['local.get', mtmp]]])
+    return out
+  }
+
   // Standalone expression-as-statement (e.g. a load that gets dropped) — bail.
-  ctx.fail = true; return null
+  return liftFail(ctx, `standalone ${op} statement`)
 }
 
 /** Lift a value expression into v128 context. */
 function liftExprV(expr, ctx) {
-  if (!isArr(expr)) { ctx.fail = true; return null }
+  if (!isArr(expr)) return liftFail(ctx, 'non-expression operand')
   const op = expr[0]
   const info = LANE_INFO[ctx.laneType]
 
+  // Widening byte-map: a narrow UNSIGNED load feeding i32-lane arithmetic. Load
+  // the 4 elements as a partial vector and zero-extend to i32x4. Only the
+  // widening recognizer sets ctx.widenLoads; tryVectorize ties the lane type to
+  // the load width and never reaches here with a narrow load under i32 lanes.
+  if (ctx.widenLoads && ctx.laneType === 'i32') {
+    if (op === 'i32.load8_u')
+      return ['i32x4.extend_low_i16x8_u', ['i16x8.extend_low_i8x16_u', ['v128.load32_zero', expr[1]]]]
+    if (op === 'i32.load16_u')
+      return ['i32x4.extend_low_i16x8_u', ['v128.load64_zero', expr[1]]]
+  }
+
+  // Widening f32→f64 load: a Float32Array read promoted to f64 (`f64.promote_f32(f32.load …)`,
+  // e.g. schrodinger's f32 potential `V[idx]` inside an f64 stencil). Load the 2 f32 lanes
+  // (load64_zero = 8 bytes = V[idx],V[idx+1]) and promote to f64x2 — the consecutive pair the
+  // two f64 lanes need. Only in f64-lane context; bit-exact (same promote the scalar does).
+  if (op === 'f64.promote_f32' && ctx.laneType === 'f64' && isArr(expr[1]) && expr[1][0] === 'f32.load') {
+    const ld = expr[1]
+    const addr = typeof ld[1] === 'string' && ld[1].startsWith('offset=') ? ['v128.load64_zero', ld[1], ld[2]] : ['v128.load64_zero', ld[1]]
+    return ['f64x2.promote_low_f32x4', addr]
+  }
+
   // Loads → v128.load (preserving address, including any local.tee).
   if (LOAD_OPS[op]) {
-    if (LOAD_OPS[op] !== ctx.laneType) { ctx.fail = true; return null }
+    if (LOAD_OPS[op] !== ctx.laneType) return liftFail(ctx, `${op}: load type ≠ lane type ${ctx.laneType}`)
+    // memarg form `(T.load offset=N addr)` — the stencil neighbour `a[i+1]` jz folds
+    // onto `a[i]`'s address tee. `v128.load offset=N` reads the N-byte-shifted vector,
+    // i.e. the (a[i+1], a[i+2]) pair — exactly the δ-shifted lane data. Preserve it.
+    if (typeof expr[1] === 'string' && expr[1].startsWith('offset=')) return ['v128.load', expr[1], expr[2]]
     return ['v128.load', expr[1]]
   }
 
@@ -1343,6 +1932,14 @@ function liftExprV(expr, ctx) {
   // local.get
   if (op === 'local.get' && typeof expr[1] === 'string') {
     const name = expr[1]
+    // Induction variable used AS DATA (ramp-map) → splat to a ramp vector
+    // [i, i+1, … i+LANES-1]. Only set by tryRampMap (i32 lanes); other
+    // recognizers leave ctx.rampVar undefined, so the IV stays address-only.
+    if (name === ctx.rampVar) {
+      // The ramp [i, i+1, i+2, i+3] is materialized once per iteration into
+      // ctx.rampTemp (set at the top of the lifted body); every use reads it.
+      return ['local.get', ctx.rampTemp]
+    }
     const kind = ctx.localKind.get(name)
     if (kind === 'lane') {
       const { laneName } = getOrAllocLanedLocal(name, ctx)
@@ -1352,9 +1949,9 @@ function liftExprV(expr, ctx) {
       return [info.splat, ['local.get', name]]
     }
     if (kind === 'addr' || name === ctx.incVar) {
-      ctx.fail = true; return null  // can't be in a value position
+      return liftFail(ctx, `${name}: address/induction var used as lane data`)
     }
-    ctx.fail = true; return null
+    return liftFail(ctx, `${name}: unclassified local in value position`)
   }
 
   // Loop-invariant global (e.g. a hoistConstantPool'd const, or any global the
@@ -1364,6 +1961,15 @@ function liftExprV(expr, ctx) {
     return [info.splat, expr]
   }
 
+  // `f64(invariant i32)` — e.g. `x[i] / N` with N an i32 global/invariant: the convert is a
+  // loop-invariant scalar, so compute once and splat (== scalar-then-splat, bit-exact). Unblocks
+  // pure-f64 maps that scale/divide by an integer count (rfft cepstrum `cep[i] = x[i] / N`).
+  if ((op === 'f64.convert_i32_s' || op === 'f64.convert_i32_u') && expr.length === 2) {
+    const inner = expr[1]
+    const inv = isArr(inner) && (inner[0] === 'global.get' || (inner[0] === 'local.get' && ctx.localKind.get(inner[1]) === 'invariant'))
+    if (inv) return [info.splat, expr]
+  }
+
   // NaN-canonicalization wrapper (float lanes only; integer lanes never carry
   // it). Both the flattened `select` form and the un-flattened `block` form
   // lift to a per-lane v128.bitselect — canonical value in NaN lanes, X
@@ -1371,13 +1977,13 @@ function liftExprV(expr, ctx) {
   if (ctx.laneType === 'f64' || ctx.laneType === 'f32') {
     if (op === 'select') {
       const m = matchCanonSelect(expr, ctx.laneType)
-      if (!m) { ctx.fail = true; return null }
+      if (!m) return liftFail(ctx, 'non-canonical select (not a NaN-canon idiom)')
       const coreV = liftExprV(m.val, ctx)
       return ctx.fail ? null : liftCanon(coreV, m.C, ctx, info)
     }
     if (op === 'block') {
       const m = matchCanonBlock(expr, ctx.laneType)
-      if (!m) { ctx.fail = true; return null }
+      if (!m) return liftFail(ctx, 'non-canonical value-block')
       const coreV = liftExprV(m.core, ctx)
       return ctx.fail ? null : liftCanon(coreV, m.C, ctx, info)
     }
@@ -1392,14 +1998,14 @@ function liftExprV(expr, ctx) {
   // evaluates X,Y before its 3rd operand, but any address `local.tee` lives in
   // COND and must run before the branches read it (matching scalar order).
   if (op === 'if') {
-    if (!isArr(expr[1]) || expr[1][0] !== 'result' || expr[1][1] !== ctx.laneType) { ctx.fail = true; return null }
+    if (!isArr(expr[1]) || expr[1][0] !== 'result' || expr[1][1] !== ctx.laneType) return liftFail(ctx, 'conditional without lane-typed result')
     const thenN = expr[3], elseN = expr[4]
-    if (!isArr(thenN) || thenN[0] !== 'then' || thenN.length !== 2) { ctx.fail = true; return null }
-    if (!isArr(elseN) || elseN[0] !== 'else' || elseN.length !== 2) { ctx.fail = true; return null }
+    if (!isArr(thenN) || thenN[0] !== 'then' || thenN.length !== 2) return liftFail(ctx, 'malformed conditional then-branch')
+    if (!isArr(elseN) || elseN[0] !== 'else' || elseN.length !== 2) return liftFail(ctx, 'malformed conditional else-branch')
     let cond = expr[2]
     if (isArr(cond) && cond[0] === 'i32.ne' && isI32Const(cond[2]) && cond[2][1] === 0) cond = cond[1]  // strip `!= 0`
     const cmpSimd = isArr(cond) && cond.length === 3 ? LANE_COMPARE[ctx.laneType]?.[cond[0]] : null
-    if (!cmpSimd) { ctx.fail = true; return null }
+    if (!cmpSimd) return liftFail(ctx, `${isArr(cond) ? cond[0] : 'condition'}: not a lane-vectorizable comparison`)
     const ca = liftExprV(cond[1], ctx); if (ctx.fail) return null
     const cb = liftExprV(cond[2], ctx); if (ctx.fail) return null
     const x = liftExprV(thenN[1], ctx); if (ctx.fail) return null
@@ -1421,7 +2027,7 @@ function liftExprV(expr, ctx) {
       // Second operand stays scalar i32 — must be const or invariant local.
       const b = expr[2]
       if (!isI32Const(b) && !(isArr(b) && b[0] === 'local.get' && ctx.localKind.get(b[1]) === 'invariant')) {
-        ctx.fail = true; return null
+        return liftFail(ctx, `${op}: shift amount not a constant or loop-invariant`)
       }
       return [entry.simd, a, b]
     }
@@ -1433,7 +2039,7 @@ function liftExprV(expr, ctx) {
     return [entry.simd, a, b]
   }
 
-  ctx.fail = true; return null
+  return liftFail(ctx, `${op}: no lane-pure SIMD mapping for ${ctx.laneType}`)
 }
 
 // ---- Induction-variable strength reduction --------------------------------
@@ -1467,25 +2073,12 @@ function matchAffineAddr(node, ind) {
  * `br_if` to the *block* label, i.e. an early break, is fine: the loop is exiting). Runs
  * only where the vectorizer runs (speed levels), so it never grows the size-tuned build.
  */
-function tryStrengthReduceIV(blockNode, fnLocals, freshIdRef) {
-  if (!isArr(blockNode) || blockNode[0] !== 'block') return null
-  let blockLabel = null, loopNode = null
-  for (let i = 1; i < blockNode.length; i++) {
-    const c = blockNode[i]
-    if (typeof c === 'string' && c.startsWith('$') && blockLabel == null && i === 1) { blockLabel = c; continue }
-    if (isArr(c) && c[0] === 'loop') { if (loopNode) return null; loopNode = c }
-    else if (isArr(c)) return null
-  }
-  if (!loopNode || !blockLabel) return null
-  const loopLabel = typeof loopNode[1] === 'string' && loopNode[1].startsWith('$') ? loopNode[1] : null
-  if (!loopLabel) return null
-  const endIdx = loopNode.length - 1
-  if (!(isArr(loopNode[endIdx]) && loopNode[endIdx][0] === 'br' && loopNode[endIdx][1] === loopLabel)) return null
-  const incIdx = endIdx - 1
-  const incVar = matchInc1(loopNode[incIdx])
-  if (!incVar) return null
-  const exitInfo = matchExitBrIf(loopNode[2], blockLabel)
-  if (!exitInfo || exitInfo.ind !== incVar) return null
+function tryStrengthReduceIV(bl, fnLocals, freshIdRef) {
+  // Bound-shape-agnostic: strength-reduces address arithmetic, not the loop bound,
+  // so it accepts any scaffold (no local-or-const bound check). No preamble (was
+  // allowPreamble:false).
+  if (!bl || bl.preamble.length) return null
+  const { loopNode, loopLabel, incIdx, incVar } = bl
 
   // Scan the body (stmts between the exit br_if and the bottom increment): collect
   // affine-address sites, track every written local, and bail on a loop-label branch.
@@ -1529,7 +2122,7 @@ function tryStrengthReduceIV(blockNode, fnLocals, freshIdRef) {
     for (const s of g.sites) s.parent[s.idx] = ['local.get', p]
   }
   loopNode.splice(incIdx + 1, 0, ...bumps)   // after the induction increment, before the br
-  return { wrapper: ['block', ...preInits, blockNode], newLocalDecls }
+  return { wrapper: ['block', ...preInits, bl.blockNode], newLocalDecls }
 }
 
 // ---- memory.copy / memory.fill loop idioms ---------------------------------
@@ -1574,27 +2167,12 @@ const MEMOP_STORES = {
  *  - In-bounds for the same reason the lane vectorizer's wide loads are: the
  *    moved window is exactly the byte range the scalar iterations touch.
  */
-function tryMemCopyFill(blockNode, fnLocals, freshIdRef) {
-  if (!isArr(blockNode) || blockNode[0] !== 'block') return null
-  let blockLabel = null, loopNode = null
-  for (let i = 1; i < blockNode.length; i++) {
-    const c = blockNode[i]
-    if (typeof c === 'string' && c.startsWith('$') && blockLabel == null && i === 1) { blockLabel = c; continue }
-    if (isArr(c) && c[0] === 'loop') { if (loopNode) return null; loopNode = c }
-    else if (isArr(c)) return null
-  }
-  if (!loopNode || !blockLabel) return null
-  const loopLabel = typeof loopNode[1] === 'string' && loopNode[1].startsWith('$') ? loopNode[1] : null
-  if (!loopLabel) return null
+function tryMemCopyFill(bl, fnLocals, freshIdRef) {
+  if (!bl || bl.preamble.length) return null   // no-preamble policy (was allowPreamble:false)
+  const { loopNode, incVar, bound } = bl
   // Shape: [loop, $l, boundExit, (set,)? store, inc, br] — 1- or 2-statement body.
   if (loopNode.length !== 6 && loopNode.length !== 7) return null
-  const endIdx = loopNode.length - 1
-  if (!(isArr(loopNode[endIdx]) && loopNode[endIdx][0] === 'br' && loopNode[endIdx][1] === loopLabel)) return null
-  const incVar = matchInc1(loopNode[endIdx - 1])
-  if (!incVar) return null
-  const exitInfo = matchExitBrIf(loopNode[2], blockLabel)
-  if (!exitInfo || exitInfo.ind !== incVar) return null
-  const bound = exitInfo.bound
+  // Bound: const or an invariant local that is not the IV itself.
   if (!(isI32Const(bound) || (isArr(bound) && bound[0] === 'local.get' && typeof bound[1] === 'string' && bound[1] !== incVar))) return null
 
   // Body shapes (emit produces the two-statement form with a temp + shared
@@ -1679,7 +2257,7 @@ function tryMemCopyFill(blockNode, fnLocals, freshIdRef) {
       ['then',
         ['memory.copy', ['local.get', dstA], ['local.get', srcA], ['local.get', lenB]],
         ...finish],
-      ['else', blockNode]]]
+      ['else', bl.blockNode]]]
   }
 
   const wrapper = ['block',
@@ -1737,25 +2315,13 @@ function matchByteCompare(node, ind) {
  * reads too. (charCodeAt over a jz string is out of scope — it lowers to per-char
  * bounds/SSO/heap/decode branches, not a flat byte load.)
  */
-function tryByteScan(blockNode, fnLocals, freshIdRef) {
-  if (!isArr(blockNode) || blockNode[0] !== 'block') return null
-  let blockLabel = null, loopNode = null
-  for (let i = 1; i < blockNode.length; i++) {
-    const c = blockNode[i]
-    if (typeof c === 'string' && c.startsWith('$') && blockLabel == null && i === 1) { blockLabel = c; continue }
-    if (isArr(c) && c[0] === 'loop') { if (loopNode) return null; loopNode = c }
-    else if (isArr(c)) return null
-  }
-  if (!loopNode || !blockLabel) return null
-  const loopLabel = typeof loopNode[1] === 'string' && loopNode[1].startsWith('$') ? loopNode[1] : null
-  if (!loopLabel) return null
-  // Exact shape: [loop, $l, boundExit, matchExit, inc, br] — nothing else.
+function tryByteScan(bl, fnLocals, freshIdRef) {
+  if (!bl || bl.preamble.length) return null
+  const { blockLabel, loopNode, incVar, exitInfo } = bl
+  // Exact shape: [loop, $l, boundExit, matchExit, inc, br] — nothing else. The
+  // scaffold already verified boundExit/inc/back-branch; only the extra match-exit
+  // br_if at loopNode[3] and the strict length remain.
   if (loopNode.length !== 6) return null
-  if (!(isArr(loopNode[5]) && loopNode[5][0] === 'br' && loopNode[5][1] === loopLabel)) return null
-  const incVar = matchInc1(loopNode[4])
-  if (!incVar) return null
-  const exitInfo = matchExitBrIf(loopNode[2], blockLabel)    // (br_if $b (eqz (i < bound)))
-  if (!exitInfo || exitInfo.ind !== incVar) return null
   const matchExit = loopNode[3]
   if (!(isArr(matchExit) && matchExit[0] === 'br_if' && matchExit[1] === blockLabel && matchExit.length === 3)) return null
   const bc = matchByteCompare(matchExit[2], incVar)
@@ -1819,32 +2385,2216 @@ function tryByteScan(blockNode, fnLocals, freshIdRef) {
 
 const cloneNode = (n) => Array.isArray(n) ? n.map(cloneNode) : n
 
-// ---- Pass entry ------------------------------------------------------------
+// ---- Channel-reduction recognizer (RGBA box-filter accumulation) -----------
+//
+// The image-convolution hot shape: 4 adjacent-byte accumulators summed over a
+// window, then divided + stored — `for k: sr+=src[p]; sg+=src[p+1]; …` (blur,
+// box filters, separable convolutions). The 4 channels are 4 i32x4 lanes, the
+// 4-byte load is one widening v128.load32_zero. We vectorize ONLY the inner
+// accumulation (integer add → associative/exact → bit-identical) and extract the
+// lane sums back to the scalars; the edge-clamp address math and the per-pixel
+// divide+store stay scalar, untouched. So no float-reduction reordering, no
+// lane-juggled divide — just the dense inner loop lifted, safely.
+//
+// Operates on the OUTER pixel-loop block: its body is [exit, 4×(acc=0), …setup,
+// (block (loop INNER)), …uses-of-acc, inc, br]. INNER's body accumulates the 4
+// channels off a shared base address.
 
-/**
- * Walk a function looking for vectorizable (block (loop)) pairs, in-place.
- * Adds new locals to the function header.
- */
-export function vectorizeLaneLocal(fn) {
-  if (!isArr(fn) || fn[0] !== 'func') return
-  const bodyStart = findBodyStart(fn)
-  if (bodyStart < 0) return
+// Match `(local.set $ACC (i32.add (local.get $ACC) (i32.load8_u ADDR)))` where
+// ADDR is `(local.get $base)` or `(local.tee $base EXPR)` at byte offset `off`.
+// Returns { acc, base, off, teeExpr? } or null.
+function matchChannelAccum(stmt, off) {
+  if (!isArr(stmt) || stmt[0] !== 'local.set' || stmt.length !== 3) return null
+  const acc = stmt[1]
+  const add = stmt[2]
+  if (!isArr(add) || add[0] !== 'i32.add' || add.length !== 3) return null
+  if (!isLocalGet(add[1], acc)) return null
+  const load = add[2]
+  if (!isArr(load) || load[0] !== 'i32.load8_u') return null
+  // memarg offset: bare load → off 0; `i32.load8_u offset=N addr` → off N.
+  let addr = load[1], loadOff = 0
+  if (typeof load[1] === 'string' && /^offset=/.test(load[1])) { loadOff = +load[1].slice(7); addr = load[2] }
+  if (loadOff !== off) return null
+  if (isArr(addr) && addr[0] === 'local.tee' && addr.length === 3) return { acc, base: addr[1], off, teeExpr: addr[2] }
+  if (isLocalGet(addr)) return { acc, base: addr[1], off }
+  return null
+}
 
-  // Build local-name → wasm-type map.
-  const fnLocals = new Map()
-  for (let i = 2; i < bodyStart; i++) {
-    const d = fn[i]
-    if (isArr(d) && d[0] === 'local' && typeof d[1] === 'string' && typeof d[2] === 'string') {
-      fnLocals.set(d[1], d[2])
-    } else if (isArr(d) && d[0] === 'param' && typeof d[1] === 'string' && typeof d[2] === 'string') {
-      fnLocals.set(d[1], d[2])
+// Recognize, inside the inner loop body, four consecutive channel accumulations
+// `acc0+=base[0]; acc1+=base[1]; acc2+=base[2]; acc3+=base[3]` over ONE shared
+// base. Returns { accs:[a0..a3], baseLocal, teeExpr, idx } (idx = position of the
+// first accum stmt in `body`) or null.
+function matchChannelGroup(body) {
+  for (let i = 0; i + 3 < body.length; i++) {
+    const m0 = matchChannelAccum(body[i], 0)
+    if (!m0 || m0.teeExpr == null) continue   // first load carries the address tee
+    const ms = [m0]
+    let ok = true
+    for (let c = 1; c < 4; c++) {
+      const m = matchChannelAccum(body[i + c], c)
+      if (!m || m.base !== m0.base || m.teeExpr != null) { ok = false; break }
+      ms.push(m)
     }
+    if (!ok) continue
+    const accs = ms.map(m => m.acc)
+    if (new Set(accs).size !== 4) continue   // four distinct accumulators
+    return { accs, baseLocal: m0.base, teeExpr: m0.teeExpr, idx: i }
   }
+  return null
+}
 
-  const freshIdRef = { next: 0 }
-  const newLocalDeclsAll = []
-
-  vectorizeStraightLineF64DotPairsIn(fn, fnLocals, freshIdRef, newLocalDeclsAll)
+// ---- Byte-map recognizer (ramp + widening loads) ---------------------------
+//
+// Vectorize `for (i = 0; i < N; i++) out[i] = NARROW(f_i32(…))` where the i32
+// value is built from the induction variable used AS DATA (an i32x4 RAMP
+// `[i, i+1, i+2, i+3]`) and/or WIDENED narrow loads (`u8[i]` zero-extended to
+// i32x4). tryVectorize can't express either: it derives the lane type from an
+// input load and ties the compute width to it, so a byte LUT-free map whose
+// arithmetic overflows a byte (mul, shifts) — or that has no load at all —
+// falls through to here, where everything lifts to i32x4 and narrow-stores.
+//   • pure ramp (no loads, i8 store) → 16-wide pack (bytebeat)
+//   • widening u8 loads → 4-wide (alpha blend, brightness/color/threshold)
+//
+// Matches the post-strength-reduction shape (the IV strength-reducer runs
+// before this pass): the loop carries the logical IV (`i`, in the exit test,
+// += 1) plus one or more strided output pointers (`p += C`). Each increment is
+// scaled by LANES; the store narrows i32x4 back to the element width.
+//
+// Narrowing is truncation-exact for ANY i32 value (matching scalar store8/16):
+// `i8x16.shuffle` selects the low byte of each lane — never saturates — so no
+// value-range assumption is needed.
+function tryRampMap(blockNode, fnLocals, freshIdRef) {
+  if (!isArr(blockNode) || blockNode[0] !== 'block') return null
+  // Envelope: (block $brk (loop $L …)) — identical to tryVectorize.
+  let blockLabel = null, loopNode = null
+  for (let i = 1; i < blockNode.length; i++) {
+    const c = blockNode[i]
+    if (typeof c === 'string' && c.startsWith('$') && blockLabel == null && i === 1) { blockLabel = c; continue }
+    if (isArr(c) && c[0] === 'loop') { if (loopNode) return null; loopNode = c }
+    else if (isArr(c)) return null
+  }
+  if (!loopNode || !blockLabel) return null
+  const loopLabel = typeof loopNode[1] === 'string' && loopNode[1].startsWith('$') ? loopNode[1] : null
+  if (!loopLabel) return null
+
+  // End = (br $L); preceded by a run of trailing `x += C` increments.
+  const endIdx = loopNode.length - 1
+  if (!(isArr(loopNode[endIdx]) && loopNode[endIdx][0] === 'br' && loopNode[endIdx][1] === loopLabel)) return null
+  const increments = []
+  let bodyEnd = endIdx - 1
+  while (bodyEnd >= 2) {
+    const inc = matchIncN(loopNode[bodyEnd])
+    if (!inc) break
+    increments.unshift(inc)
+    bodyEnd--
+  }
+  if (!increments.length) return null
+
+  // First stmt = exit guard → logical IV + bound. IV must advance by exactly 1.
+  const exitInfo = matchExitBrIf(loopNode[2], blockLabel)
+  if (!exitInfo) return null
+  const ivName = exitInfo.ind
+  const ivInc = increments.find(x => x.name === ivName)
+  if (!ivInc || ivInc.c !== 1) return null
+  let bound = exitInfo.bound, boundLocal = null
+  if (isArr(bound) && bound[0] === 'local.get' && typeof bound[1] === 'string') boundLocal = bound[1]
+  else if (!isI32Const(bound)) return null
+
+  const body = []
+  for (let i = 3; i <= bodyEnd; i++) body.push(loopNode[i])
+  if (!body.length) return null
+  if (body.some(hasGlobalSet)) return null
+
+  // Find exactly one store. Its address is the inline lane address
+  // `base + (i << K)` — the IV strength-reducer runs AFTER this pass, so the
+  // pointer is still expressed in terms of the IV. We keep the address verbatim
+  // (scalar i32) and advance the IV by LANES, so `base + (i<<K)` lands on the
+  // next group's first element each SIMD step — for any element width.
+  let storeStmt = null, storeIdx = -1
+  for (let i = 0; i < body.length; i++) {
+    const s = body[i]
+    if (isArr(s) && STORE_OPS[s[0]]) {
+      if (storeStmt) return null
+      storeStmt = s; storeIdx = i
+    }
+  }
+  if (!storeStmt) return null
+  const storeOp = storeStmt[0]
+  if (storeStmt.length !== 3) return null
+  const elemLog2 = { 'i32.store8': 0, 'i32.store': 2 }[storeOp]
+  if (elemLog2 === undefined) return null
+  if (increments.some(x => x.name !== ivName)) return null
+
+  // CSE'd lane offsets: a local written ONLY as `i << K` (or bare `i`) is the
+  // shared offset the IV stage threads across base pointers (src[i], dst[i],
+  // out[i] all reuse one `(local.tee $p (local.get i))`). Resolve them so the
+  // load/store address matchers accept the `(local.get $p)` reuses.
+  const offsetTees = new Map()
+  const allNames = new Set()
+  const gatherNames = (n) => { if (!isArr(n)) return; if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') allNames.add(n[1]); for (let i = 1; i < n.length; i++) gatherNames(n[i]) }
+  for (const s of body) gatherNames(s)
+  for (const name of allNames) { const k = _offsetLocalStride(body, name, ivName); if (k != null) offsetTees.set(name, k) }
+
+  const storeAddr = storeStmt[1]
+  const addrM = matchLaneAddr(storeAddr, ivName, new Map(), offsetTees)
+  if (!addrM || addrM.strideLog2 !== elemLog2) return null
+
+  // Memory loads turn this into a widening byte-map: out[i] = narrow(f(widen(a[i])…)).
+  // Only the u8 shape is supported — every load must be a narrow UNSIGNED u8 load
+  // of the same 4 elements the store writes (base + i; the IV strength-reducer
+  // runs later). Full-width i32 maps are tryVectorize's job; mixed widths bail.
+  let hasLoads = false, loadsOk = true
+  const checkLoad = (n) => {
+    if (!isArr(n)) return
+    if (LOAD_OPS[n[0]]) {
+      hasLoads = true
+      if (storeOp !== 'i32.store8' || n[0] !== 'i32.load8_u') { loadsOk = false; return }
+      const m = matchLaneAddr(n[1], ivName, new Map(), offsetTees)
+      if (!m || m.strideLog2 !== 0) loadsOk = false
+      return  // address validated; the IV-strided subtree is not data
+    }
+    for (let i = 1; i < n.length; i++) checkLoad(n[i])
+  }
+  for (const s of body) checkLoad(s)
+  if (!loadsOk) return null
+
+  // Every other body stmt must be `(local.set $lane EXPR)` — straight-line lane
+  // locals feeding the store. Classify locals for the lift.
+  const writes = new Set()
+  for (const s of body) collectWrites(s, writes)
+  if (boundLocal && writes.has(boundLocal)) return null
+  const referenced = new Set()
+  const collectRefs = (n) => {
+    if (!isArr(n)) return
+    if ((n[0] === 'local.get' || n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') referenced.add(n[1])
+    for (let i = 1; i < n.length; i++) collectRefs(n[i])
+  }
+  for (const s of body) collectRefs(s)
+
+  const localKind = new Map()
+  for (const name of referenced) {
+    if (name === ivName) continue
+    if (writes.has(name)) {
+      let firstKind = null
+      for (const s of body) { const kAcc = firstAccess(s, name); if (kAcc) { firstKind = kAcc; break } }
+      if (firstKind === 'read') return null   // loop-carried → reduction/stencil, not a pure map
+      localKind.set(name, 'lane')
+    } else {
+      localKind.set(name, 'invariant')
+    }
+  }
+
+  // Lift. lane type is always i32 (the ramp and all narrow stores compute in i32).
+  const newLanedLocals = new Map()
+  const extraLocals = []
+  const freshV128 = (tag) => { const n = `$__${tag}${freshIdRef.next++}`; extraLocals.push(['local', n, 'v128']); return n }
+  const ctx = { laneType: 'i32', incVar: ivName, rampVar: ivName, rampTemp: null, widenLoads: true, localKind, newLanedLocals, extraLocals, freshIdRef, fail: false, failReason: null }
+
+  // A byte store fed by one value expression (inline, or via a single lane-local
+  // temp `tw = EXPR; store(addr, tw)`) carries no loop-carried state, so we can
+  // run the lane group 4× (16 samples) per iteration off four offset ramps and
+  // pack the low bytes into ONE i8x16 v128.store — amortizing store + loop
+  // overhead the way clang/zig's 16-wide NEON does. wideValueExpr is the
+  // expression to lift per offset; null (i32 stores, multi-stmt bodies, or
+  // widening loads — whose addresses would need per-offset advancing) → 4-wide.
+  // The single byte-value expression feeding the store — inline, or via one lane-local
+  // temp `tw = EXPR; store(addr, tw)`. Shared by both 16-wide paths below.
+  const byteValueExpr = (() => {
+    if (storeOp !== 'i32.store8') return null
+    if (body.length === 1 && storeIdx === 0) return storeStmt[2]
+    if (body.length === 2 && storeIdx === 1) {
+      const set = body[0], sv = storeStmt[2]
+      if (isArr(set) && set[0] === 'local.set' && set.length === 3 &&
+          isLocalGet(sv, set[1]) && localKind.get(set[1]) === 'lane') return set[2]
+    }
+    return null
+  })()
+  // With u8 loads, the byte map can go 16-wide in i16x8 (the alpha-blend shape: out[i] =
+  // (src[i]*A + dst[i]*B + bias) >> s) — load 16, extend_low/high, the affine arithmetic
+  // in i16x8, narrow_u, store 16 — exactly clang's NEON. Sound ONLY when every
+  // intermediate provably fits u16 ([0,65535], so i16x8 mod-2^16 never wraps and shr_u ==
+  // the scalar shr_s on a non-negative value) and the result fits a byte ([0,255], so
+  // narrow_u never saturates). `byteValueRange` returns [min,max] or null when any node
+  // is unanalyzable, can go negative, or exceeds u16. An invariant local of unknown
+  // magnitude (local.get) → null → falls back to the bit-exact 4-wide path.
+  const byteValueRange = (e) => {
+    if (!isArr(e)) return null
+    const op = e[0]
+    let r
+    if (op === 'i32.const') { const v = constNum(e); r = [v, v] }
+    else if (op === 'i32.load8_u') r = [0, 255]
+    else if (op === 'i32.add') { const a = byteValueRange(e[1]), b = byteValueRange(e[2]); if (!a || !b) return null; r = [a[0] + b[0], a[1] + b[1]] }
+    else if (op === 'i32.sub') { const a = byteValueRange(e[1]), b = byteValueRange(e[2]); if (!a || !b) return null; r = [a[0] - b[1], a[1] - b[0]] }
+    else if (op === 'i32.mul') { const a = byteValueRange(e[1]), b = byteValueRange(e[2]); if (!a || !b) return null; const p = [a[0] * b[0], a[0] * b[1], a[1] * b[0], a[1] * b[1]]; r = [Math.min(...p), Math.max(...p)] }
+    else if ((op === 'i32.shr_u' || op === 'i32.shr_s') && isI32Const(e[2])) { const a = byteValueRange(e[1]); if (!a || a[0] < 0) return null; const s = constNum(e[2]); if (s < 0 || s > 16) return null; r = [a[0] >> s, a[1] >> s] }
+    else if (op === 'i32.and' && isI32Const(e[2])) { const a = byteValueRange(e[1]); if (!a) return null; const m = constNum(e[2]); if (m < 0) return null; r = [0, Math.min(a[1], m)] }
+    else return null
+    return (r[0] < 0 || r[1] > 65535) ? null : r
+  }
+  const wideValueExpr = (!hasLoads && byteValueExpr) ? byteValueExpr : null   // pure ramp → 16-wide pack
+  const widenRange = (hasLoads && byteValueExpr) ? byteValueRange(byteValueExpr) : null
+  const WIDEN16 = widenRange != null && widenRange[1] <= 255   // result fits a byte ⇒ narrow_u exact
+  const WIDE16 = wideValueExpr != null
+  const LANES = (WIDE16 || WIDEN16) ? 16 : 4
+  const ramp = (off) => ['i32x4.add', ['i32x4.splat', ['local.get', ivName]],
+    ['v128.const', 'i32x4', String(off), String(off + 1), String(off + 2), String(off + 3)]]
+
+  let lifted
+  if (WIDEN16) {
+    // 16-wide widening byte-map: load each u8 input once (v128.load of 16 bytes),
+    // extend_low/high to two i16x8 halves, run the affine map in i16x8 on each half,
+    // narrow_u the two result halves to one i8x16, store 16. Each load is hoisted to a
+    // temp (so extend_low + extend_high share one load); the loads run in source order,
+    // so the offset `local.tee` in the first one is set before later loads read it.
+    const loadTemps = new Map()
+    const loadSets = []
+    const collectLoads = (e) => {
+      if (!isArr(e)) return
+      if (e[0] === 'i32.load8_u') {
+        const k = JSON.stringify(e[1])
+        if (!loadTemps.has(k)) { const t = freshV128('win'); loadTemps.set(k, t); loadSets.push(['local.set', t, ['v128.load', e[1]]]) }
+      } else for (let i = 1; i < e.length; i++) collectLoads(e[i])
+    }
+    collectLoads(byteValueExpr)
+    const liftW = (e, half) => {
+      const op = e[0]
+      if (op === 'i32.const') return ['i16x8.splat', e]
+      if (op === 'i32.load8_u') return [`i16x8.extend_${half}_i8x16_u`, ['local.get', loadTemps.get(JSON.stringify(e[1]))]]
+      if (op === 'i32.add') return ['i16x8.add', liftW(e[1], half), liftW(e[2], half)]
+      if (op === 'i32.sub') return ['i16x8.sub', liftW(e[1], half), liftW(e[2], half)]
+      if (op === 'i32.mul') return ['i16x8.mul', liftW(e[1], half), liftW(e[2], half)]
+      if (op === 'i32.shr_u' || op === 'i32.shr_s') return ['i16x8.shr_u', liftW(e[1], half), e[2]]
+      if (op === 'i32.and') return ['v128.and', liftW(e[1], half), ['i16x8.splat', e[2]]]
+      return null   // byteValueRange already proved every op is one of the above
+    }
+    lifted = [...loadSets,
+      ['v128.store', storeAddr, ['i8x16.narrow_i16x8_u', liftW(byteValueExpr, 'low'), liftW(byteValueExpr, 'high')]]]
+  } else if (WIDE16) {
+    lifted = []
+    const vv = []
+    for (let j = 0; j < 4; j++) {
+      const rt = freshV128('ramp')
+      lifted.push(['local.set', rt, ramp(j * 4)])
+      ctx.rampTemp = rt
+      const v = liftExprV(wideValueExpr, ctx)
+      if (ctx.fail) return null
+      const vn = freshV128('rampv')
+      lifted.push(['local.set', vn, v])
+      vv.push(vn)
+    }
+    // Pack the low byte of all 16 i32 lanes (4 vectors) into one i8x16, in order.
+    const g = (n) => ['local.get', n]
+    const sh = (a, b, idx) => ['i8x16.shuffle', ...idx.map(String), a, b]
+    const lo = freshV128('ramplo'), hi = freshV128('ramphi')
+    lifted.push(['local.set', lo, sh(g(vv[0]), g(vv[1]), [0, 4, 8, 12, 16, 20, 24, 28, 0, 0, 0, 0, 0, 0, 0, 0])])
+    lifted.push(['local.set', hi, sh(g(vv[2]), g(vv[3]), [0, 4, 8, 12, 16, 20, 24, 28, 0, 0, 0, 0, 0, 0, 0, 0])])
+    lifted.push(['v128.store', storeAddr, sh(g(lo), g(hi), [0, 1, 2, 3, 4, 5, 6, 7, 16, 17, 18, 19, 20, 21, 22, 23])])
+  } else {
+    ctx.rampTemp = freshV128('ramp')
+    // ramp = [i, i+1, i+2, i+3], computed once per SIMD iteration.
+    lifted = [['local.set', ctx.rampTemp, ramp(0)]]
+    for (let i = 0; i < body.length; i++) {
+      if (i === storeIdx) {
+        const vval = liftExprV(storeStmt[2], ctx)
+        if (ctx.fail) return null
+        lifted.push(buildRampStore(storeOp, storeAddr, vval, ctx))
+      } else {
+        const r = liftStmt(body[i], ctx)
+        if (ctx.fail) return null
+        if (r != null) { if (Array.isArray(r) && r[0] === '__seq__') lifted.push(...r.slice(1)); else lifted.push(r) }
+      }
+    }
+  }
+  if (!lifted.length) return null
+
+  const id = freshIdRef.next++
+  const simdBoundName = `$__simd_bound${id}`
+  const simdBrkLabel = `$__simd_brk${id}`
+  const simdLoopLabel = `$__simd_loop${id}`
+  const boundExpr = boundLocal ? ['local.get', boundLocal] : bound
+
+  const scaledIncs = increments.map(({ name, c }) =>
+    ['local.set', name, ['i32.add', ['local.get', name], ['i32.const', c * LANES]]])
+
+  const simdBlock = ['block', simdBrkLabel,
+    ['loop', simdLoopLabel,
+      ['br_if', simdBrkLabel, ['i32.eqz', ['i32.lt_s', ['local.get', ivName], ['local.get', simdBoundName]]]],
+      ...lifted,
+      ...scaledIncs,
+      ['br', simdLoopLabel]]]
+  const boundSetup = ['local.set', simdBoundName, ['i32.and', boundExpr, ['i32.const', -LANES]]]
+  const wrapper = ['block', boundSetup, simdBlock, blockNode]
+  const newLocalDecls = [
+    ['local', simdBoundName, 'i32'],
+    ...[...newLanedLocals.values()].map(({ laneName }) => ['local', laneName, 'v128']),
+    ...extraLocals,
+  ]
+  return { wrapper, newLocalDecls }
+}
+
+// Build the store for a ramp-map iteration: i32x4 `vval` → element width of
+// `storeOp` at scalar address `addr`. i32.store is the full vector; i32.store8
+// truncates (low byte of each lane) via i8x16.shuffle — exactly matching scalar
+// store8, with no value-range assumption (shuffle selects, never saturates).
+function buildRampStore(storeOp, addr, vval, ctx) {
+  if (storeOp === 'i32.store') return ['v128.store', addr, vval]   // 4 i32 lanes → 16 bytes
+  // i32.store8: hoist vval to a temp so the shuffle reads it once; low byte of
+  // each of 4 lanes → bytes 0..3 → one i32.store (4 bytes). Shuffle lane indices
+  // are string tokens for watr's binary encoder.
+  const tmp = `$__rampv${ctx.freshIdRef.next++}`
+  ctx.extraLocals.push(['local', tmp, 'v128'])
+  const g = ['local.get', tmp]
+  const packed = ['i8x16.shuffle', ...[0, 4, 8, 12, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0].map(String), g, g]
+  return ['block', ['local.set', tmp, vval], ['i32.store', addr, ['i32x4.extract_lane', 0, packed]]]
+}
+
+// Pivot-stride analysis for the multi-pixel lift. The lift reads 16 source bytes
+// (4 RGBA pixels) with ONE v128.load at the address for output pixel `pivot`, so the
+// 4 outputs are correct ONLY if consecutive output pixels read consecutive source
+// pixels — the load address must advance by EXACTLY 4 bytes per pivot step. Build, in
+// program order, each local's value-delta per unit-pivot increment (`pivot` → 1, every
+// other local → its assigned expr's delta, unknown/outer locals → 0 = pivot-invariant).
+// `delta(e)` returns that constant byte-delta, or null when the dependence is non-
+// constant (e.g. x*k) or uses an op we don't model — both of which must bail.
+// Index arithmetic is often f64-lowered (JS number `*`): `(yi*ww + x)` becomes
+// `(f64(yi)*ww + f64(x)) |0` = trunc_sat with a NaN-guard `select`. We model those
+// passthrough/arith ops too, so a runtime-dimension vblur (x carried through f64)
+// analyses the same as a literal-dimension one (x in plain i32). The select is the
+// `|0` coercion (value branch when the index is finite — always so for an integer
+// array index); we take the value branch's delta. Multiplies need a compile-time
+// constant factor on the pivot-bearing side (else the stride isn't constant).
+function buildPivotCoeff(loopNode, pivot) {
+  const coeff = new Map([[pivot, 1]])
+  const cval = (n) => isI32Const(n) ? constNum(n) : (isArr(n) && n[0] === 'f64.const' && n[1] != null ? Number(n[1]) : null)
+  const delta = (e) => {
+    if (isI32Const(e)) return 0
+    if (isLocalGet(e)) return coeff.has(e[1]) ? coeff.get(e[1]) : 0
+    if (!isArr(e)) return null
+    const [op, a, b] = e
+    switch (op) {
+      case 'i32.add': case 'f64.add': { const x = delta(a), y = delta(b); return x == null || y == null ? null : x + y }
+      case 'i32.sub': case 'f64.sub': { const x = delta(a), y = delta(b); return x == null || y == null ? null : x - y }
+      case 'i32.shl': { const c = cval(b), x = delta(a); return c == null || x == null ? null : x << c }
+      case 'i32.mul': case 'f64.mul': {
+        const ca = cval(a), cb = cval(b), x = delta(a), y = delta(b)
+        if (x == null || y == null) return null
+        if (ca != null) return ca * y          // const × expr
+        if (cb != null) return cb * x          // expr × const
+        return x === 0 && y === 0 ? 0 : null    // var × var: pivot-dependent ⇒ non-constant
+      }
+      // value-preserving conversions: passthrough. `local.tee $v EXPR` yields EXPR.
+      case 'f64.convert_i32_s': case 'f64.convert_i32_u': case 'i64.trunc_sat_f64_s':
+      case 'i64.trunc_sat_f64_u': case 'i32.wrap_i64': case 'i64.extend_i32_s':
+        return delta(a)
+      case 'local.tee': return delta(b)
+      // the `(expr)|0` NaN/Inf-guard `select(value, 0, finite?)`: take the value branch
+      // (the index is a finite integer in any real blur). Only when the else-branch is
+      // the const-0 guard — a general ternary index whose arms differ in stride bails.
+      case 'select': return isI32Const(e[2]) && constNum(e[2]) === 0 ? delta(a) : null
+      default: return null                     // any other op (and/or/div/…) ⇒ unanalyzable
+    }
+  }
+  const visit = (n) => {
+    if (!isArr(n)) return
+    if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') { coeff.set(n[1], delta(n[2])); visit(n[2]); return }
+    n.forEach(visit)
+  }
+  visit(loopNode)
+  return delta
+}
+
+// Vectorize the inner accumulation of an RGBA box-filter pixel loop. See the
+// matchChannelGroup header. Returns { wrapper, newLocalDecls } or null.
+// Multi-pixel SIMD lift of a clamp-free RGBA box-filter interior (produced by the
+// clamp-peel pass). Processes 4 output pixels per iteration: at tap k the 4 outputs
+// read 4 CONSECUTIVE source pixels — one 16-byte v128.load whose lanes map DIRECTLY
+// to the 4 accumulators (no shuffle). Sums (≤ win·255 < 2^16) accumulate in two
+// i16x8 vectors; the divide+store reuses the scalar store templates per pixel.
+// Validated bit-exact + 4.34× vs scalar. Bails (→ tryChannelReduce 1-pixel lift)
+// unless the body is exactly: clamp-free `xi=x+k; p=(row+xi)<<2; acc_c += u8[base+c]`
+// over a unit-stride x, then a 4-byte RGBA store `dst[ab1+c] = f(acc_c)`. r≥127 →
+// i16 overflow → bail. Leaves a scalar remainder loop for the ≤3 trailing pixels.
+function tryBlurMultiPixel(blockNode, fnLocals, freshIdRef) {
+  if (!isArr(blockNode) || blockNode[0] !== 'block') return null
+  let blockLabel = null, loopNode = null
+  for (let i = 1; i < blockNode.length; i++) {
+    const c = blockNode[i]
+    if (typeof c === 'string' && c.startsWith('$') && blockLabel == null && i === 1) { blockLabel = c; continue }
+    if (isArr(c) && c[0] === 'loop') { if (loopNode) return null; loopNode = c }
+  }
+  if (!loopNode || !blockLabel) return null
+  const loopLabel = typeof loopNode[1] === 'string' && loopNode[1].startsWith('$') ? loopNode[1] : null
+  if (!loopLabel) return null
+  const endIdx = loopNode.length - 1
+  if (!(isArr(loopNode[endIdx]) && loopNode[endIdx][0] === 'br' && loopNode[endIdx][1] === loopLabel)) return null
+  // exit guard: br_if $brk (i32.eqz (i32.lt_s x BOUND))
+  const exit = loopNode[2]
+  if (!(isArr(exit) && exit[0] === 'br_if' && isArr(exit[2]) && exit[2][0] === 'i32.eqz'
+    && isArr(exit[2][1]) && exit[2][1][0] === 'i32.lt_s' && isLocalGet(exit[2][1][1]))) return null
+  const pivot = exit[2][1][1][1]          // pixel IV $x
+  const bound = exit[2][1][2]              // interior bound (expr)
+  const bodyEnd = endIdx - 1
+  // increment must be `x = x + 1`
+  const inc = loopNode[bodyEnd]
+  if (!(isArr(inc) && inc[0] === 'local.set' && inc[1] === pivot && isArr(inc[2]) && inc[2][0] === 'i32.add'
+    && isLocalGet(inc[2][1], pivot) && isI32Const(inc[2][2]) && constNum(inc[2][2]) === 1)) return null
+
+  // four `acc_c = 0` inits
+  let initIdx = -1, accInits = null
+  for (let i = 3; i + 3 <= bodyEnd; i++) {
+    const z = []
+    for (let c = 0; c < 4; c++) { const s = loopNode[i + c]; if (isArr(s) && s[0] === 'local.set' && s.length === 3 && isI32Const(s[2]) && constNum(s[2]) === 0) z.push(s[1]); else break }
+    if (z.length === 4 && new Set(z).size === 4) { initIdx = i; accInits = z; break }
+  }
+  if (initIdx < 0) return null
+  // the tap accumulation loop
+  let innerIdx = -1, innerBlock = null
+  for (let i = initIdx + 4; i <= bodyEnd; i++) {
+    const s = loopNode[i]
+    if (isArr(s) && s[0] === 'block' && s.slice(1).some(c => isArr(c) && c[0] === 'loop')) { innerIdx = i; innerBlock = s; break }
+    if (isArr(s) && s[0] === 'loop') { innerIdx = i; innerBlock = ['block', s]; break }
+  }
+  if (!innerBlock) return null
+  const innerLoop = innerBlock.find(c => isArr(c) && c[0] === 'loop')
+  if (!innerLoop) return null
+  const ilEnd = innerLoop.length - 1
+  if (!(isArr(innerLoop[ilEnd]) && innerLoop[ilEnd][0] === 'br')) return null
+  const innerBody = innerLoop.slice(3, ilEnd - 1)
+  const grp = matchChannelGroup(innerBody)
+  if (!grp) return null
+  if (grp.accs.slice().sort().join('\x00') !== accInits.slice().sort().join('\x00')) return null
+  // CLAMP-FREE: nothing before the channel group may be an `if` (the edge clamp).
+  for (let i = 0; i < grp.idx; i++) if (isArr(innerBody[i]) && innerBody[i][0] === 'if') return null
+  // The tap loop must be the i32 form `k <= r`; extract the radius r (reused in the
+  // runtime overflow guard below). f64-typed tap loops (f64 dims) bail to scalar.
+  const ic = innerLoop[2]
+  if (!(isArr(ic) && ic[0] === 'br_if' && isArr(ic[2]) && ic[2][0] === 'i32.eqz'
+    && isArr(ic[2][1]) && ic[2][1][0] === 'i32.le_s' && isLocalGet(ic[2][1][1]))) return null
+  const rBound = ic[2][1][2]
+  if (!(isLocalGet(rBound) || isI32Const(rBound))) return null
+
+  // the RGBA store: 4 consecutive i32.store8 at `ab1 + c`, ab1 tee'd in the first.
+  let storeIdx = -1
+  for (let i = innerIdx + 1; i + 3 <= bodyEnd; i++) {
+    const s0 = loopNode[i]
+    if (isArr(s0) && s0[0] === 'i32.store8' && s0.length === 3 && isArr(s0[1]) && s0[1][0] === 'local.tee') { storeIdx = i; break }
+  }
+  if (storeIdx < 0) return null
+  const s0 = loopNode[storeIdx]
+  const ab1 = s0[1][1], dstExpr = s0[1][2]      // ab1 local, its address expr
+  const storeVals = [s0[2]]
+  for (let c = 1; c < 4; c++) {
+    const s = loopNode[storeIdx + c]
+    if (!(isArr(s) && s[0] === 'i32.store8' && s[1] === `offset=${c}` && isLocalGet(s[2], ab1))) return null
+    storeVals.push(s[3])
+  }
+  // each store value must read its accumulator (the divided sum)
+  for (let c = 0; c < 4; c++) if (!readsVar(storeVals[c], accInits[c])) return null
+
+  // ── Soundness guards for the 4-pixels-per-load lift ──────────────────────────
+  // Scope the stride analysis to THIS pixel loop. A peeled interior is one segment ⇒
+  // one inner tap loop, so there is no sibling same-named-`p` ambiguity, and the scope
+  // still captures the LICM preamble where the x-dependent index term is hoisted out of
+  // the tap loop (e.g. `__li = f64(x)` — x is invariant w.r.t. the tap IV k).
+  const pivotDelta = buildPivotCoeff(loopNode, pivot)
+  // (a) Source unit-stride: the v128.load address (array base + byte index) must
+  // advance by exactly 4 bytes (one RGBA pixel) per output-pixel step, else the
+  // 16-byte load spans the wrong source pixels. Bails on strided indices
+  // ((xi*2+row)<<2) and non-constant ones ((yi*W + x + k*x)<<2 → x*(1+k)).
+  if (pivotDelta(grp.teeExpr) !== 4) return null
+  // (b) No dropped pivot-dependent setup: statements before the inits (loopNode[3..
+  // initIdx)) are NOT carried into the 4-pixel loop, so a per-pixel value computed
+  // there (e.g. `x2 = x*2`) would go stale. Bail if any such statement is pivot-
+  // dependent. (Statements between the inits and the inner loop ARE carried.)
+  for (let i = 3; i < initIdx; i++) {
+    let bad = false
+    const chk = (n) => { if (!isArr(n)) return; if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string' && pivotDelta(n[2]) !== 0) bad = true; n.forEach(chk) }
+    chk(loopNode[i])
+    if (bad) return null
+  }
+  // (c) Store values must read only the accumulators (set per-pixel by the epilogue)
+  // and pivot-invariants — never a per-pixel local like the pivot itself, since the
+  // store template is reused verbatim for all 4 pixels (`dst[o]=(sr+x)&255` would use
+  // the group-base x for pixels 1-3).
+  const perPixel = new Set()
+  const collectSet = (n) => { if (!isArr(n)) return; if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') perPixel.add(n[1]); n.forEach(collectSet) }
+  collectSet(loopNode)
+  for (const a of grp.accs) perPixel.delete(a)   // accumulators are repopulated per pixel
+  const readsPerPixel = (n) => isArr(n) ? ((n[0] === 'local.get' && perPixel.has(n[1])) || n.some(readsPerPixel)) : false
+  for (let c = 0; c < 4; c++) if (readsPerPixel(storeVals[c])) return null
+
+  // ── Lift ───────────────────────────────────────────────────────────────────
+  const id = freshIdRef.next++
+  const accLo = `$__bmplo${id}`, accHi = `$__bmphi${id}`, b4 = `$__bmpb${id}`
+  const newLocalDecls = [['local', accLo, 'v128'], ['local', accHi, 'v128'], ['local', b4, 'i32']]
+  const Z = ['v128.const', 'i64x2', '0', '0']
+  // inner body: 4 channel adds → 2 i16 widening adds off the same tee'd base.
+  const newInner = []
+  for (let i = 0; i < innerBody.length; i++) {
+    if (i === grp.idx) {
+      newInner.push(['local.set', accLo, ['i16x8.add', ['local.get', accLo], ['i16x8.extend_low_i8x16_u', ['v128.load', ['local.tee', grp.baseLocal, grp.teeExpr]]]]])
+      newInner.push(['local.set', accHi, ['i16x8.add', ['local.get', accHi], ['i16x8.extend_high_i8x16_u', ['v128.load', ['local.get', grp.baseLocal]]]]])
+    } else if (i > grp.idx && i <= grp.idx + 3) continue
+    else newInner.push(innerBody[i])
+  }
+  const newInnerLoop = [...innerLoop.slice(0, 3), ...newInner, ...innerLoop.slice(ilEnd - 1)]
+  const newInnerBlock = innerBlock.map(c => c === innerLoop ? newInnerLoop : c)
+  // store epilogue: the o=(row+x)<<2 setup, then ab1, then per pixel j set acc_c to
+  // its lane and reuse the scalar store template at byte offset j*4+c.
+  const preStore = loopNode.slice(innerIdx + 1, storeIdx)   // `o = (row+x)<<2` etc.
+  const epilogue = [...preStore, ['local.set', ab1, dstExpr]]
+  for (let j = 0; j < 4; j++) {
+    const vec = j < 2 ? accLo : accHi, base = (j % 2) * 4
+    // lane base+c summed source byte at offset c → grp.accs[c] (the accumulator
+    // tied to read-offset c), NOT accInits[c] (zero-init order); see tryChannelReduce.
+    for (let c = 0; c < 4; c++) epilogue.push(['local.set', grp.accs[c], ['i16x8.extract_lane_u', String(base + c), ['local.get', vec]]])
+    for (let c = 0; c < 4; c++) epilogue.push(['i32.store8', `offset=${j * 4 + c}`, ['local.get', ab1], storeVals[c]])
+  }
+  // 4-pixel loop body: splat inits, the tap-IV init, the lifted inner loop, the
+  // lifted store, x += 4.
+  const v4label = `$__bmpx${id}`, v4brk = `$__bmpe${id}`
+  const fourBody = [
+    ['br_if', v4brk, ['i32.eqz', ['i32.lt_s', ['local.get', pivot], ['local.get', b4]]]],
+    ['local.set', accLo, Z], ['local.set', accHi, Z],
+    ...loopNode.slice(initIdx + 4, innerIdx),
+    newInnerBlock,
+    ...epilogue,
+    ['local.set', pivot, ['i32.add', ['local.get', pivot], ['i32.const', 4]]],
+    ['br', v4label],
+  ]
+  // Deep-clone the 4-pixel loop: it reuses sub-trees (inner body, store templates,
+  // dst expr) that also live in the scalar remainder below — sharing would let a
+  // later pass mutating one corrupt the other.
+  const dc = (n) => isArr(n) ? n.map(dc) : n
+  const fourLoop = dc(['block', v4brk, ['loop', v4label, ...fourBody]])
+  // b4 = x + (r<128 ? ((bound-x) & ~3) : 0): the 4-aligned end of the interior from
+  // the entry x. The r<128 guard is the i16-overflow check (win·255 < 2^16 ⇔ r<128);
+  // when r≥128 the 4-pixel loop runs zero iterations and the scalar remainder covers
+  // the whole interior — sound for any runtime r, no duplicated loop body.
+  const b4set = ['local.set', b4, ['i32.add', ['local.get', pivot],
+    ['select', ['i32.and', ['i32.sub', dc(bound), ['local.get', pivot]], ['i32.const', -4]], ['i32.const', 0],
+      ['i32.lt_s', dc(rBound), ['i32.const', 128]]]]]
+  // The interior block may carry a LICM-hoisted invariant preamble (e.g. `k=-r`'s
+  // value) that the lifted body reads but which the original sets only on block
+  // entry — run a clone of it first so the 4-pixel loop sees it. Then b4 setup, the
+  // 4-pixel loop, then the ORIGINAL block unchanged (the ≤3-pixel scalar remainder;
+  // x continues from b4).
+  const loopPos = blockNode.indexOf(loopNode)
+  const preamble = blockNode.slice(2, loopPos).map(dc)
+  const wrapper = ['block', ...preamble, b4set, fourLoop, blockNode]
+  return { wrapper, newLocalDecls }
+}
+
+function tryChannelReduce(blockNode, fnLocals, freshIdRef) {
+  if (!isArr(blockNode) || blockNode[0] !== 'block') return null
+  // Outer pixel loop: (block $brk [invariant preamble…] (loop $L …)). When the
+  // pixel loop is nested in an outer row loop, LICM hoists the invariant edge-clamp
+  // bound (`w-1`) into this block ahead of the loop; allow any such non-loop
+  // preamble — it is preserved verbatim by the wrapper rebuild, which rewrites only
+  // the loop. Exactly one loop is still required (a second → bail).
+  let blockLabel = null, loopNode = null
+  for (let i = 1; i < blockNode.length; i++) {
+    const c = blockNode[i]
+    if (typeof c === 'string' && c.startsWith('$') && blockLabel == null && i === 1) { blockLabel = c; continue }
+    if (isArr(c) && c[0] === 'loop') { if (loopNode) return null; loopNode = c }
+  }
+  if (!loopNode || !blockLabel) return null
+  const loopLabel = typeof loopNode[1] === 'string' && loopNode[1].startsWith('$') ? loopNode[1] : null
+  if (!loopLabel) return null
+  const endIdx = loopNode.length - 1
+  if (!(isArr(loopNode[endIdx]) && loopNode[endIdx][0] === 'br' && loopNode[endIdx][1] === loopLabel)) return null
+
+  // Pixel-loop body (between the exit guard and the back-branch). Find: four
+  // `acc_c = 0` inits and the inner accumulation loop that sums into them.
+  const bodyStart = 3, bodyEnd = endIdx - 1   // [exit] at 2, [inc?][br] at the end
+  // The four zero-inits must be consecutive `(local.set $acc (i32.const 0))`.
+  let initIdx = -1, accInits = null
+  for (let i = bodyStart; i + 3 <= bodyEnd; i++) {
+    const z = []
+    for (let c = 0; c < 4; c++) {
+      const s = loopNode[i + c]
+      if (isArr(s) && s[0] === 'local.set' && s.length === 3 && isI32Const(s[2]) && constNum(s[2]) === 0 && typeof s[1] === 'string') z.push(s[1])
+      else break
+    }
+    if (z.length === 4 && new Set(z).size === 4) { initIdx = i; accInits = z; break }
+  }
+  if (initIdx < 0) return null
+
+  // The inner accumulation loop is the (block (loop)) appearing after the inits.
+  let innerIdx = -1, innerBlock = null
+  for (let i = initIdx + 4; i <= bodyEnd; i++) {
+    const s = loopNode[i]
+    if (isArr(s) && s[0] === 'block' && s.slice(1).some(c => isArr(c) && c[0] === 'loop')) { innerIdx = i; innerBlock = s; break }
+    if (isArr(s) && s[0] === 'loop') { innerIdx = i; innerBlock = ['block', s]; break }
+  }
+  if (!innerBlock) return null
+  // Locate the loop within the inner block and its body.
+  const innerLoop = innerBlock.find(c => isArr(c) && c[0] === 'loop')
+  if (!innerLoop) return null
+  const ilEnd = innerLoop.length - 1
+  if (!(isArr(innerLoop[ilEnd]) && innerLoop[ilEnd][0] === 'br')) return null
+  const innerBody = innerLoop.slice(3, ilEnd - 1)   // between exit guard and the (k+=1)(br)
+
+  const grp = matchChannelGroup(innerBody)
+  if (!grp) return null
+  // The four accumulators summed must be exactly the four that were zero-inited
+  // (same set, in any order).
+  if (grp.accs.slice().sort().join('\x00') !== accInits.slice().sort().join('\x00')) return null
+
+  // ── Lift. accv (v128) holds the four channel sums.
+  const id = freshIdRef.next++
+  const accv = `$__chv${id}`
+  const newLocalDecls = [['local', accv, 'v128']]
+  // Zero-init → one splat.
+  const zeroInit = ['local.set', accv, ['v128.const', 'i32x4', '0', '0', '0', '0']]
+  // Inner accumulation: keep the address-producing stmts, replace the 4 channel
+  // adds with one widening add off the shared base. The base address is the
+  // tee'd expr of the first load (re-tee'd so any later `local.get base` still
+  // resolves — though the other channel loads are gone).
+  const widen = ['i32x4.extend_low_i16x8_u', ['i16x8.extend_low_i8x16_u',
+    ['v128.load32_zero', ['local.tee', grp.baseLocal, grp.teeExpr]]]]
+  const newInner = []
+  for (let i = 0; i < innerBody.length; i++) {
+    if (i === grp.idx) newInner.push(['local.set', accv, ['i32x4.add', ['local.get', accv], widen]])
+    else if (i > grp.idx && i <= grp.idx + 3) continue   // drop the other 3 channel adds
+    else newInner.push(innerBody[i])
+  }
+  // Rebuild the inner loop with the lifted body.
+  const newInnerLoop = [...innerLoop.slice(0, 3), ...newInner, ...innerLoop.slice(ilEnd - 1)]
+  const newInnerBlock = innerBlock.map(c => c === innerLoop ? newInnerLoop : c)
+  // After the inner loop, extract the four lane sums back to the scalar
+  // accumulators the divide+store code reads. Lane c summed source byte
+  // `base+c`, so it must land in grp.accs[c] — the accumulator matchChannelGroup
+  // tied to read-offset c — NOT accInits[c] (zero-init order). They coincide only
+  // when the program inits/sums in offset order (every real blur); a channel-
+  // permuted program (sums offset 0 into a var stored at a later offset) needs the
+  // offset-order mapping or the lanes mis-map.
+  const extracts = grp.accs.map((acc, c) => ['local.set', acc, ['i32x4.extract_lane', c, ['local.get', accv]]])
+
+  // Reassemble the pixel-loop body: replace the 4 inits with the splat, the inner
+  // block with the lifted one, and insert the extracts right after it.
+  const newLoop = [...loopNode]
+  newLoop.splice(innerIdx, 1, newInnerBlock, ...extracts)   // inner block → lifted + extracts
+  newLoop.splice(initIdx, 4, zeroInit)                       // 4 inits → 1 splat (do last; lower index)
+  const wrapper = blockNode.map(c => c === loopNode ? newLoop : c)
+  return { wrapper, newLocalDecls }
+}
+
+/**
+ * Divergent escape-time vectorizer — 2-wide f64x2, bit-exact with scalar f64.
+ *
+ * Recognizes the fractal escape-time nest (mandelbrot / julia / burning-ship / …):
+ *
+ *   for (qx = 0; qx < W; qx++) {              // outer pixel loop; ≥1 i32 pixel IVs
+ *     cx = <expr in qx>                       // per-pixel coordinate(s)
+ *     x = 0; y = 0; it = 0                     // loop-carried f64 + i32 counter
+ *     while (it < MAXIT) {                     // inner escape loop (it-limited)
+ *       <f64 updates to x,y (+ temps); one `if (|z|² > T) break`, ANY position>
+ *       it++
+ *     }
+ *     <epilogue: store(it)  OR  smooth-colour(x,y,it) → store>
+ *   }
+ *
+ * Two adjacent pixels run in f64x2 lockstep with a per-lane active mask. A lane is
+ * frozen (v128.bitselect) the instant it would escape or reach MAXIT, so its
+ * it/x/y stay bit-identical to the scalar loop — f64x2 add/sub/mul/abs are IEEE-
+ * identical to scalar f64 (no FMA fusion). The body is emitted statement-by-
+ * statement in source order, so the escape mask lands exactly where the scalar
+ * `break` is (before OR after the z-update), and the per-lane state freezes at the
+ * matching point. iter is kept as f64x2 (an i32 `it` is exact in f64), so the
+ * limit compare and the (possibly fractional) colour math both stay bitwise-exact.
+ *
+ * Loop-carried vars (first body access is a READ) freeze via bitselect; within-
+ * iteration temps (first access a WRITE — inlined squares, `xt`) recompute raw.
+ * The colour epilogue runs scalar, twice — once per lane — reading each lane's
+ * extracted x/y/it, with the pixel IVs advanced by +0/+1. Odd widths and extra
+ * lanes fall through to the original scalar pixel loop (the exact tail).
+ */
+const CMP_NEG = {  // comparison → its logical negation (active lanes are finite → NaN-free)
+  'f64.gt': 'f64.le', 'f64.ge': 'f64.lt', 'f64.lt': 'f64.ge', 'f64.le': 'f64.gt', 'f64.eq': 'f64.ne', 'f64.ne': 'f64.eq',
+  'i32.lt_s': 'i32.ge_s', 'i32.ge_s': 'i32.lt_s', 'i32.gt_s': 'i32.le_s', 'i32.le_s': 'i32.gt_s',
+  'i32.lt_u': 'i32.ge_u', 'i32.ge_u': 'i32.lt_u', 'i32.gt_u': 'i32.le_u', 'i32.le_u': 'i32.gt_u',
+}
+const CMP_LANE = {  // f64/i32 scalar compare → f64x2 lane compare (iter is f64x2; z-compares are f64)
+  'f64.gt': 'f64x2.gt', 'f64.ge': 'f64x2.ge', 'f64.lt': 'f64x2.lt', 'f64.le': 'f64x2.le', 'f64.eq': 'f64x2.eq', 'f64.ne': 'f64x2.ne',
+  'i32.lt_s': 'f64x2.lt', 'i32.le_s': 'f64x2.le', 'i32.ge_s': 'f64x2.ge', 'i32.gt_s': 'f64x2.gt',
+  'i32.lt_u': 'f64x2.lt', 'i32.le_u': 'f64x2.le', 'i32.ge_u': 'f64x2.ge', 'i32.gt_u': 'f64x2.gt',
+}
+const readsVar = (n, v) => isArr(n) && ((n[0] === 'local.get' && n[1] === v) || n.some(c => readsVar(c, v)))
+const writesName = (n, name) => isArr(n) && (((n[0] === 'local.set' || n[0] === 'local.tee' || n[0] === 'global.set') && n[1] === name) || n.some(c => writesName(c, name)))
+// Pixel induction variables may be i32 (const-bound loops) or f64 (param-bound loops,
+// e.g. `for (x=0; x<width; ++x)` with f64 `width`). Match `v += 1` and `v < bound` for both.
+const matchPixelInc = (stmt) => {
+  if (!isArr(stmt) || stmt[0] !== 'local.set' || stmt.length !== 3) return null
+  const x = stmt[1], v = stmt[2]
+  if (!isArr(v) || v.length !== 3 || !isLocalGet(v[1], x)) return null
+  if (v[0] === 'i32.add' && constNum(v[2]) === 1) return { name: x, type: 'i32' }
+  if (v[0] === 'f64.add' && isArr(v[2]) && v[2][0] === 'f64.const' && Number(v[2][1]) === 1) return { name: x, type: 'f64' }
+  return null
+}
+const matchPixelExit = (stmt, label) => {
+  if (!isArr(stmt) || stmt[0] !== 'br_if' || stmt[1] !== label) return null
+  const cond = stmt[2]
+  if (!isArr(cond) || cond[0] !== 'i32.eqz') return null
+  const cmp = cond[1]
+  if (!isArr(cmp) || !isLocalGet(cmp[1])) return null
+  if (cmp[0] === 'i32.lt_s' || cmp[0] === 'i32.lt_u') return { ind: cmp[1][1], bound: cmp[2], cmpOp: cmp[0], type: 'i32' }
+  if (cmp[0] === 'f64.lt') return { ind: cmp[1][1], bound: cmp[2], cmpOp: cmp[0], type: 'f64' }
+  return null
+}
+
+/**
+ * Match the OUTER per-pixel loop scaffold shared by tryDivergentEscapeVectorize
+ * (inner escape loop) and tryPerPixelColor (straight-line body):
+ *   (block $o [preamble: pure local.set…]
+ *     (loop $l (br_if $o (i32.eqz (IV < WIDTH))) OBODY… (pxIV += 1)… (br $l)))
+ * One-or-more trailing `v += 1` are pixel induction vars (the bound IV plus any
+ * parallel counters like `j`); the exit bounds one of them by an invariant width.
+ *
+ * Returns the shared FACTS, or null:
+ *   { oLabel, loopNode, preamble, pixelIVs, pivStart, pxVar, widthBound, pivType,
+ *     obody }  — obody = loopNode.slice(3, pivStart), the per-pixel work between
+ *   the exit guard and the IV bumps. Both consumers branch on `obody` afterward.
+ * The bound is re-evaluated for the SIMD guard, so it must be invariant + pure:
+ *   a constant, or a local/global the loop nest never writes (`writesName`).
+ */
+function matchOuterPixelLoop(blockNode) {
+  if (!isArr(blockNode) || blockNode[0] !== 'block') return null
+  const oLabel = (typeof blockNode[1] === 'string' && blockNode[1].startsWith('$')) ? blockNode[1] : null
+  if (!oLabel) return null
+  let loopNode = null, loopPos = -1
+  for (let i = 2; i < blockNode.length; i++) {
+    const c = blockNode[i]
+    if (!isArr(c)) return null
+    if (c[0] === 'loop') { if (loopNode) return null; loopNode = c; loopPos = i }
+    else if (loopNode) return null              // statement after the loop → bail
+    else if (c[0] !== 'local.set') return null  // preamble must be pure local.set
+  }
+  if (!loopNode) return null
+  const preamble = blockNode.slice(2, loopPos)
+  const llabel = (typeof loopNode[1] === 'string' && loopNode[1].startsWith('$')) ? loopNode[1] : null
+  if (!llabel) return null
+  const oEnd = loopNode.length - 1
+  if (!(isArr(loopNode[oEnd]) && loopNode[oEnd][0] === 'br' && loopNode[oEnd][1] === llabel)) return null
+  const pixelIVs = []   // [{ name, type }]
+  let pivStart = oEnd
+  for (let i = oEnd - 1; i >= 3; i--) {
+    const m = matchPixelInc(loopNode[i])
+    if (!m) break
+    pixelIVs.unshift(m); pivStart = i
+  }
+  if (!pixelIVs.length) return null
+  const oExit = matchPixelExit(loopNode[2], oLabel)
+  const pxIV = oExit && pixelIVs.find(p => p.name === oExit.ind && p.type === oExit.type)
+  if (!pxIV) return null
+  const widthBound = oExit.bound
+  const pivType = new Map(pixelIVs.map(p => [p.name, p.type]))
+  if (isI32Const(widthBound)) { /* ok */ }
+  else if (isArr(widthBound) && (widthBound[0] === 'local.get' || widthBound[0] === 'global.get')) {
+    if (writesName(loopNode, widthBound[1])) return null
+  } else return null
+  const obody = loopNode.slice(3, pivStart)     // between exit guard and the pixel-IV bumps
+  return { oLabel, loopNode, preamble, pixelIVs, pivStart, pxVar: oExit.ind, widthBound, pivType, obody, oExit }
+}
+
+function tryDivergentEscapeVectorize(blockNode, fnLocals, freshIdRef) {
+  // Outer per-pixel scaffold (+ LICM preamble feeding both SIMD path and tail).
+  const outer = matchOuterPixelLoop(blockNode)
+  if (!outer) return null
+  const { oLabel, loopNode, preamble, pixelIVs, pxVar, widthBound, pivType, obody, oExit } = outer
+
+  let innerIdx = -1, innerBlock = null
+  for (let i = 0; i < obody.length; i++) {
+    const s = obody[i]
+    if (isArr(s) && s[0] === 'block' && s.slice(1).some(c => isArr(c) && c[0] === 'loop')) {
+      if (innerBlock) return null
+      innerBlock = s; innerIdx = i
+    }
+  }
+  if (!innerBlock) return null
+  const iLabel = (typeof innerBlock[1] === 'string' && innerBlock[1].startsWith('$')) ? innerBlock[1] : null
+  if (!iLabel || innerBlock.length < 3) return null
+  const innerLoop = innerBlock[innerBlock.length - 1]
+  if (!isArr(innerLoop) || innerLoop[0] !== 'loop') return null
+  const ilLabel = (typeof innerLoop[1] === 'string' && innerLoop[1].startsWith('$')) ? innerLoop[1] : null
+  if (!ilLabel) return null
+  // The inner block may also carry LICM-hoisted invariants (e.g. BAILOUT) before the loop.
+  // They must be pixel-pair-invariant (read only outer-invariants) so one copy feeds both
+  // lanes; hoist them ahead of the SIMD loop.
+  const innerPre = innerBlock.slice(2, innerBlock.length - 1)
+  for (const s of innerPre) {
+    if (!isArr(s) || s[0] !== 'local.set' || s.length !== 3) return null
+    const inv = (n) => !isArr(n) || ((n[0] === 'local.get' || n[0] === 'global.get') ? !writesName(loopNode, n[1]) : n.every((c, i) => i === 0 || inv(c)))
+    if (!inv(s[2])) return null
+  }
+
+  // ---- inner escape loop: a top while-cond + body (f64 updates + one mid-break) + it++.
+  // The two continue/break conditions are an `it < MAXIT` limit and a `|z|² vs T` escape,
+  // in EITHER order (mandelbrot/ship: limit at top; example-mandelbrot: escape at top). ----
+  const iEnd = innerLoop.length - 1
+  if (!(isArr(innerLoop[iEnd]) && innerLoop[iEnd][0] === 'br' && innerLoop[iEnd][1] === ilLabel)) return null
+  const itVar = matchInc1(innerLoop[iEnd - 1])
+  if (!itVar || fnLocals.get(itVar) !== 'i32') return null
+
+  // A break statement (br_if, or `if BC (then (br iLabel))`) → its break-when condition.
+  // breakCond: does this statement break the inner loop?  Returns { cond, assigns } where
+  // `assigns` is a list of { name, val } local.set stmts extracted from the then-block
+  // BEFORE the final br.  Existing single-br form → assigns=[].  Multi-stmt then form (Newton:
+  // `if(cond)(then (local.set $root K)(br $iLabel))`) → assigns=[{name,val}].
+  const breakCond = (s) => {
+    if (!isArr(s)) return null
+    if (s[0] === 'br_if' && s[1] === iLabel) return { cond: s[2], assigns: [] }
+    if (s[0] !== 'if' || s.length !== 3 || !isArr(s[2]) || s[2][0] !== 'then') return null
+    const then = s[2]
+    // then-block must end with (br $iLabel); all preceding stmts must be local.set
+    if (!isArr(then[then.length - 1]) || then[then.length - 1][0] !== 'br' || then[then.length - 1][1] !== iLabel) return null
+    const assigns = []
+    for (let k = 1; k < then.length - 1; k++) {
+      const st = then[k]
+      if (!isArr(st) || st[0] !== 'local.set' || st.length !== 3) return null
+      assigns.push({ name: st[1], val: st[2] })
+    }
+    return { cond: s[1], assigns }
+  }
+  // keep (continue) condition vs the break-when condition. A while-guard `(i32.eqz CONT)`
+  // keeps on CONT directly; a mid-break `if (X) break` keeps on ¬X. We must NOT lower ¬X by
+  // flipping the comparison (f64.gt→f64.le): for NaN, scalar `NOT(NaN>T)` is TRUE but
+  // `NaN<=T` is FALSE — they disagree, so an orbit that reaches NaN without escaping would
+  // wrongly deactivate. Instead keep the DIRECT comparison and negate the lane mask with
+  // v128.not (NaN-exact: gt is false on NaN, ¬false = keep, matching scalar).
+  const keepOf = (bc) => {
+    if (!isArr(bc)) return null
+    if (bc[0] === 'i32.eqz' && isArr(bc[1]) && CMP_LANE[bc[1][0]]) return { cmp: bc[1], negate: false }
+    if (CMP_NEG[bc[0]]) return { cmp: bc, negate: true }
+    return null
+  }
+  const topBcR = breakCond(innerLoop[2])
+  const topBc = topBcR?.cond   // raw condition expr (backward-compat name for compound-top checks)
+  let keepTop = topBcR && keepOf(topBcR.cond)
+  const ibody = innerLoop.slice(3, iEnd - 1)
+  let midIdx = -1, keepMid = null, compoundTop = false
+  // Compound while-guard `while (it<MAX && |z|²<T)` → `eqz(and(A,B))`: two keep conditions, both
+  // at the top (continue while A AND B). The Julia set is written this way. Split A,B into the two
+  // keeps; the body is then pure updates (no mid-break).
+  if (!keepTop && isArr(topBc) && topBc[0] === 'i32.eqz' && isArr(topBc[1]) && topBc[1][0] === 'i32.and'
+      && isArr(topBc[1][1]) && CMP_LANE[topBc[1][1][0]] && isArr(topBc[1][2]) && CMP_LANE[topBc[1][2][0]]) {
+    keepTop = { cmp: topBc[1][1], negate: false }
+    keepMid = { cmp: topBc[1][2], negate: false }
+    compoundTop = true
+  }
+  if (!keepTop) return null
+  // Collect mid-breaks.  The existing single-break path requires exactly one.
+  // The new multi-break path (Newton-style convergence) allows several outcome breaks
+  // — each `if(COND)(then (local.set $X K)(br $iLabel))` — when the top guard is the
+  // sole limit condition and ALL mid-breaks are escape-kind with i32 outcome assigns.
+  const midBreaks = []   // [{ idx, keep, assigns }]
+  if (compoundTop) {
+    for (let i = 0; i < ibody.length; i++)
+      if (!(isArr(ibody[i]) && ibody[i][0] === 'local.set' && ibody[i].length === 3 && fnLocals.get(ibody[i][1]) === 'f64')) return null
+  } else {
+    for (let i = 0; i < ibody.length; i++) {
+      const bcR = breakCond(ibody[i])
+      if (bcR) {
+        const k = keepOf(bcR.cond)
+        if (!k) return null
+        midBreaks.push({ idx: i, keep: k, assigns: bcR.assigns })
+      } else if (!(isArr(ibody[i]) && ibody[i][0] === 'local.set' && ibody[i].length === 3 && fnLocals.get(ibody[i][1]) === 'f64')) return null
+    }
+    if (midBreaks.length === 0) return null
+    if (midBreaks.length === 1) {
+      // single-break: preserve exact existing behaviour
+      midIdx = midBreaks[0].idx; keepMid = midBreaks[0].keep
+    }
+    // multi-break: handled below after classification
+  }
+
+  // classify f64 vars written across [top-guard, …body…]: loop-carried (first access a READ)
+  // vs within-iteration temp (first access a WRITE — including squares tee'd in the guard).
+  const seq = [innerLoop[2], ...ibody]
+  const written = new Set()
+  const collectW = (n) => { if (!isArr(n)) return; if ((n[0] === 'local.set' || n[0] === 'local.tee') && fnLocals.get(n[1]) === 'f64') written.add(n[1]); for (let i = 1; i < n.length; i++) collectW(n[i]) }
+  seq.forEach(collectW)
+  const carried = new Set(), temp = new Set(), seen = new Set()
+  const classify = (n) => {
+    if (!isArr(n)) return
+    if (n[0] === 'local.get') { const v = n[1]; if (written.has(v) && !seen.has(v)) { seen.add(v); carried.add(v) }; return }
+    if (n[0] === 'local.set' || n[0] === 'local.tee') { classify(n[2]); const v = n[1]; if (written.has(v) && !seen.has(v)) { seen.add(v); temp.add(v) }; return }
+    for (let i = 1; i < n.length; i++) classify(n[i])
+  }
+  seq.forEach(classify)
+
+  // hoist tees out of the keep conditions into explicit temp computations
+  const tees = []
+  const detee = (n) => isArr(n) ? (n[0] === 'local.tee' ? (tees.push({ tgt: n[1], expr: detee(n[2]) }), ['local.get', n[1]]) : n.map(detee)) : n
+  const keepTopC = { cmp: [keepTop.cmp[0], detee(keepTop.cmp[1]), detee(keepTop.cmp[2])], negate: keepTop.negate }
+  const teeTop = tees.length
+  const keepMidC = keepMid ? { cmp: [keepMid.cmp[0], detee(keepMid.cmp[1]), detee(keepMid.cmp[2])], negate: keepMid.negate } : null
+
+  // each keep is an it-limit (mentions `it` directly or via convert) or a z-escape; need one of each
+  const isIt = (n) => isLocalGet(n, itVar) || (isArr(n) && n[0] === 'f64.convert_i32_s' && isLocalGet(n[1], itVar))
+  const kindOf = (k) => (isIt(k.cmp[1]) || isIt(k.cmp[2])) ? 'limit' : 'escape'
+  const kTop = kindOf(keepTopC)
+  const limitKeep = keepTopC   // initialised here; may be reassigned below for single-break
+  let kMid = null, boundExpr, boundI32, itLeft
+  if (midBreaks.length === 1) {
+    kMid = kindOf(keepMidC)
+    if (kTop === kMid) return null
+    const lk = kTop === 'limit' ? keepTopC : keepMidC
+    itLeft = isIt(lk.cmp[1])
+    boundExpr = itLeft ? lk.cmp[2] : lk.cmp[1]
+    boundI32 = lk.cmp[0].startsWith('i32.')
+  } else if (midBreaks.length > 1) {
+    // Multi-break path: top must be the sole limit; all mid-breaks must be escape-kind.
+    if (kTop !== 'limit') return null
+    for (const mb of midBreaks) if (kindOf(mb.keep) !== 'escape') return null
+    itLeft = isIt(keepTopC.cmp[1])
+    boundExpr = itLeft ? keepTopC.cmp[2] : keepTopC.cmp[1]
+    boundI32 = keepTopC.cmp[0].startsWith('i32.')
+  }
+  // limit bound must be loop-invariant (splatted once per pair): no carried/temp ref, not written
+  for (const v of [...carried, ...temp]) if (readsVar(boundExpr, v)) return null
+  const boundInvariant = (n) => !isArr(n) || ((n[0] !== 'local.get' && n[0] !== 'global.get') || !writesName(loopNode, n[1])) && n.every((c, i) => i === 0 || boundInvariant(c))
+  if (!boundInvariant(boundExpr)) return null
+
+  // c-vars: f64 locals read in the lifted exprs but never written there (per-pixel/invariant inputs).
+  // Also allow loop-invariant global.get (e.g. module constants like R3 in newton) — splatted inline.
+  const cVars = new Set()
+  const liftable = (n) => {
+    if (!isArr(n)) return false
+    if (n[0] === 'local.get') {
+      const v = n[1]
+      if (v !== itVar && !carried.has(v) && !temp.has(v)) { if (fnLocals.get(v) !== 'f64') return false; cVars.add(v) }
+      return true
+    }
+    if (n[0] === 'f64.const') return true
+    if (n[0] === 'global.get') return !writesName(loopNode, n[1])   // loop-invariant global → splat
+    if (LANE_PURE.f64.has(n[0])) { for (let i = 1; i < n.length; i++) if (!liftable(n[i])) return false; return true }
+    return false
+  }
+  const midIdxSet = new Set(midBreaks.map(mb => mb.idx))
+  for (const t of tees) if (!liftable(t.expr)) return null
+  for (let i = 0; i < ibody.length; i++) if (!midIdxSet.has(i) && !liftable(ibody[i][2])) return null
+  if (midBreaks.length === 1) {
+    const escapeKeep = kTop === 'escape' ? keepTopC : keepMidC
+    if (!liftable(escapeKeep.cmp[1]) || !liftable(escapeKeep.cmp[2])) return null
+  } else {
+    // multi-break: each break's escape condition arguments must be liftable
+    for (const mb of midBreaks) {
+      const mbC = { cmp: [mb.keep.cmp[0], detee(mb.keep.cmp[1]), detee(mb.keep.cmp[2])], negate: mb.keep.negate }
+      mb.keepC = mbC   // store deteed keepC on mb for use in emit
+      if (!liftable(mbC.cmp[1]) || !liftable(mbC.cmp[2])) return null
+    }
+  }
+
+  // ---- pre-inner inits + epilogue ----
+  // i32 outcome variables assigned by multi-break outcome stmts (e.g. $root in Newton).
+  // Their pre-inner `local.set $root 0` default-init is valid and must not be rejected.
+  const outcomeVarSetEarly = new Set(midBreaks.flatMap(mb => mb.assigns.map(a => a.name)))
+  const carriedInit = new Map()   // carried var → its f64.const seed (before the loop)
+  const perPxInit = new Map()     // c-var → its per-pixel init expr
+  for (let i = 0; i < innerIdx; i++) {
+    const s = obody[i]
+    if (!isArr(s) || s[0] !== 'local.set' || s.length !== 3) return null
+    const tgt = s[1]
+    if (carried.has(tgt)) {
+      // z₀ seed: a constant (mandelbrot/burning-ship z₀=0) OR a per-pixel expr (Julia set, where
+      // z₀ = the pixel and c is constant — the dual of mandelbrot). liftCLane handles both at emit.
+      carriedInit.set(tgt, s[2])
+    } else if (temp.has(tgt)) { /* recomputed each iteration — init ignored */ }
+    else if (tgt === itVar) { if (constNum(s[2]) !== 0) return null }
+    else if (cVars.has(tgt)) perPxInit.set(tgt, s[2])
+    else if (outcomeVarSetEarly.has(tgt)) { /* i32 outcome var default init — ignored, handled per-lane */ }
+    else return null
+  }
+  for (const c of carried) if (!carriedInit.has(c)) return null
+  const epilogue = obody.slice(innerIdx + 1)
+  // The epilogue runs scalar per lane; it may only read carried/it/pixel-IV/invariant
+  // values (each statement's reads, before that statement's writes). A read of an
+  // inner-loop temp or a per-pixel c-var has no post-loop per-lane value → bail.
+  {
+    const written = new Set()
+    for (const s of epilogue) {
+      const r = new Set(); (function rd(n){ if(!isArr(n)) return; if(n[0]==='local.get') r.add(n[1]); else for(const c of n) rd(c) })(s)
+      for (const v of r) if (!written.has(v) && (temp.has(v) || perPxInit.has(v))) return null
+      ;(function wr(n){ if(!isArr(n)) return; if((n[0]==='local.set'||n[0]==='local.tee')&&typeof n[1]==='string') written.add(n[1]); for(const c of n.slice(2)) wr(c) })(s)
+    }
+    if (!epilogue.length) return null
+  }
+
+  // ============================ emit ============================
+  const id = freshIdRef.next++
+  const nm = (s) => `$__esc${id}_${s}`
+  const shadow = new Map()                       // carried/temp f64 var → v128 shadow
+  for (const v of [...carried, ...temp]) shadow.set(v, nm('z' + v.replace(/\W/g, '')))
+  const cLane = new Map()
+  for (const cv of cVars) cLane.set(cv, nm('c' + cv.replace(/\W/g, '')))
+  const iterV = nm('iter'), activeV = nm('act'), maxitLane = nm('lim')
+  const newLocalDecls = []
+  for (const n of [...shadow.values(), ...cLane.values()]) newLocalDecls.push(['local', n, 'v128'])
+
+  const lift = (n) => {
+    if (n[0] === 'local.get') return ['local.get', shadow.has(n[1]) ? shadow.get(n[1]) : cLane.get(n[1])]
+    if (n[0] === 'f64.const') return ['f64x2.splat', n]
+    if (n[0] === 'global.get') return ['f64x2.splat', n]   // loop-invariant module global (e.g. R3)
+    return [LANE_PURE.f64.get(n[0]).simd, ...n.slice(1).map(lift)]
+  }
+  const bump = (n, k) => k === 0 ? n           // substitute every pixel-IV with (IV + k), in its type
+    : (isArr(n) && n[0] === 'local.get' && pivType.has(n[1]))
+      ? [pivType.get(n[1]) + '.add', n, [pivType.get(n[1]) + '.const', k]]
+      : (isArr(n) ? n.map(c => bump(c, k)) : n)
+
+  // Build a per-pixel c-var's two lanes by lifting its init to f64x2: the pixel IV becomes the
+  // ramp [v, v+1], a dependency on another c-var resolves to that c-var's already-built lane
+  // (so chains like `bail = 4 + cx*cx` get the right per-lane value — NOT the px=0 value from a
+  // bump that can't follow `cx`), and everything else (grid constants) splats. Returns null if
+  // the init reads inner-loop state or an op we can't lift, in which case we decline.
+  const liftCLane = (n) => {
+    if (!isArr(n)) return null
+    if (n[0] === 'local.get' || n[0] === 'global.get') {
+      const v = n[1]
+      if (n[0] === 'local.get') {
+        if (cLane.has(v)) return ['local.get', cLane.get(v)]                 // another c-var's lane
+        if (carried.has(v) || temp.has(v)) return null                       // inner-loop state — must not appear
+        if (pivType.get(v) === 'f64') return ['f64x2.replace_lane', 1, ['f64x2.splat', n], ['f64.add', n, ['f64.const', 1]]]
+      }
+      if (writesName(loopNode, v)) return null                               // a per-pixel value we can't ramp → decline
+      return ['f64x2.splat', n]                                              // loop-invariant local/global
+    }
+    if (n[0] === 'f64.const') return ['f64x2.splat', n]
+    if (n[0] === 'f64.convert_i32_s' && isArr(n[1]) && n[1][0] === 'local.get' && pivType.get(n[1][1]) === 'i32') {
+      const piv = n[1]
+      return ['f64x2.replace_lane', 1, ['f64x2.splat', ['f64.convert_i32_s', piv]], ['f64.convert_i32_s', ['i32.add', piv, ['i32.const', 1]]]]
+    }
+    if (LANE_PURE.f64.has(n[0])) { const ks = n.slice(1).map(liftCLane); return ks.some(k => k === null) ? null : [LANE_PURE.f64.get(n[0]).simd, ...ks] }
+    return null
+  }
+  // c-lanes in dependency order: invariants splat first, then per-pixel inits in source (obody) order
+  const cOrder = [...cVars].filter(cv => !perPxInit.has(cv))
+  for (let i = 0; i < innerIdx; i++) { const s = obody[i]; if (isArr(s) && s[0] === 'local.set' && perPxInit.has(s[1])) cOrder.push(s[1]) }
+  const pre = []
+  for (const cv of cOrder) {
+    if (perPxInit.has(cv)) {
+      const lane = liftCLane(perPxInit.get(cv))
+      if (!lane) return null
+      pre.push(['local.set', cLane.get(cv), lane])
+    } else pre.push(['local.set', cLane.get(cv), ['f64x2.splat', ['local.get', cv]]])
+  }
+  // Seed each carried lane in dependency order. Seeds reading only non-carried values (z₀ = a
+  // const, or a per-pixel ramp for the Julia set) build their lanes via liftCLane. Seeds reading
+  // a carried var — the cached squares `zx2 = zx*zx` in Julia's compound guard — lift through the
+  // already-built shadow lanes instead.
+  const seedDeps = (e) => [...carried].some(c => readsVar(e, c))
+  const depLiftable = (n) => !isArr(n) ? false
+    : n[0] === 'local.get' ? shadow.has(n[1])
+    : n[0] === 'f64.const' ? true
+    : (LANE_PURE.f64.has(n[0]) && n.slice(1).every(depLiftable))
+  for (const v of carried) if (!seedDeps(carriedInit.get(v))) {
+    const lane = liftCLane(carriedInit.get(v))
+    if (!lane) return null
+    pre.push(['local.set', shadow.get(v), lane])
+  }
+  for (const v of carried) if (seedDeps(carriedInit.get(v))) {
+    if (!depLiftable(carriedInit.get(v))) return null
+    pre.push(['local.set', shadow.get(v), lift(carriedInit.get(v))])
+  }
+  const teeStmts = (range) => range.map(t => ['local.set', shadow.get(t.tgt), lift(t.expr)])
+  const sIn = nm('ib'), sIl = nm('il'), sOut = nm('ob'), sOl = nm('ol')
+
+  // FAST PATH — the common escape-time shape `while (it<MAX){ …updates…; if (|z|²>T) break }`:
+  // break the pair the instant the FIRST lane escapes (no per-iteration freeze/mask), keep `it`
+  // a scalar i32, raw f64x2 updates. A short scalar tail then finishes whichever lane lagged (≈0
+  // iterations when the pair is coherent, which adjacent pixels overwhelmingly are). Inside-set
+  // pixels (both lanes to MAX) run clean 2× with zero mask overhead — exactly where the masked
+  // loop bled its speedup. Other shapes (escape-at-top, body after the break) take the masked path.
+  // escape-at-MID: `…updates…; if (|z|²>T) break` (burning-ship). escape-at-TOP: the escape gates
+  // the loop head — a `while (|z|²<T)` (mandelbrot) or the second half of a compound `while (it<MAX
+  // && |z|²<T)` (Julia). Both take the fast path; only the tail's `it` resume point differs.
+  const escAtMid = !compoundTop && kMid === 'escape' && midIdx === ibody.length - 1
+  const escAtTop = compoundTop || kTop === 'escape'
+  const fastPath = escAtMid || escAtTop
+  let simdInner, epiLane, postLoop = []
+
+  if (fastPath) {
+    const shIt = nm('shit'), escF = nm('escf')
+    newLocalDecls.push(['local', shIt, 'i32'], ['local', escF, 'i32'])
+    pre.push(['local.set', itVar, ['i32.const', 0]], ['local.set', escF, ['i32.const', 0]])
+    const limOf = (keepC) => keepC.negate ? [CMP_NEG[keepC.cmp[0]], keepC.cmp[1], keepC.cmp[2]] : keepC.cmp
+    // emit a keep at its source position: a LIMIT (it is shared) → a scalar i32 guard; an ESCAPE
+    // → an any_true break. `escF` records whether the loop exited via an escape (vs the limit) —
+    // they can BOTH land at it=MAX (escape-at-top fires before the limit-at-mid's final update),
+    // so `it < MAX` alone can't tell them apart; the tail must run only on an escape exit.
+    const fastKeep = (keepC, kind, teeRange) => {
+      const out = teeStmts(teeRange)
+      if (kind === 'limit') out.push(['br_if', sIn, ['i32.eqz', limOf(keepC)]])
+      else {
+        const escL = [CMP_LANE[keepC.cmp[0]], lift(keepC.cmp[1]), lift(keepC.cmp[2])]
+        out.push(['local.set', escF, ['i32.const', 1]])
+        out.push(['br_if', sIn, ['v128.any_true', keepC.negate ? escL : ['v128.not', escL]]])
+        out.push(['local.set', escF, ['i32.const', 0]])
+      }
+      return out
+    }
+    const sbody = [...fastKeep(keepTopC, kTop, tees.slice(0, teeTop))]
+    if (compoundTop) sbody.push(...fastKeep(keepMidC, kMid, tees.slice(teeTop)))   // second top keep
+    for (let i = 0; i < ibody.length; i++) {
+      if (!compoundTop && i === midIdx) sbody.push(...fastKeep(keepMidC, kMid, tees.slice(teeTop)))
+      else sbody.push(['local.set', shadow.get(ibody[i][1]), lift(ibody[i][2])])   // raw update, no freeze
+    }
+    sbody.push(['local.set', itVar, ['i32.add', ['local.get', itVar], ['i32.const', 1]]])
+    simdInner = ['block', sIn, ['loop', sIl, ...sbody, ['br', sIl]]]
+    postLoop = [['local.set', shIt, ['local.get', itVar]]]   // capture the break `it` AFTER the block exits
+
+    // a fresh-labelled copy of the inner block, to finish a lagging lane's remaining iterations
+    let copyN = 0
+    const relabelInner = () => {
+      const ni = nm('tb' + copyN), nl = nm('tl' + copyN); copyN++
+      const rl = (n) => !isArr(n) ? n
+        : ((n[0] === 'block' || n[0] === 'loop' || n[0] === 'br' || n[0] === 'br_if') && (n[1] === iLabel || n[1] === ilLabel))
+          ? [n[0], n[1] === iLabel ? ni : nl, ...n.slice(2).map(rl)]
+          : n.map(rl)
+      return rl(innerBlock)
+    }
+    const escKeepC = compoundTop ? keepMidC : (kTop === 'escape' ? keepTopC : keepMidC)
+    const escTees = (kTop === 'escape' ? tees.slice(0, teeTop) : tees.slice(teeTop)).map(t => ['local.set', t.tgt, t.expr])
+    const notEsc = escKeepC.negate ? ['i32.eqz', escKeepC.cmp] : escKeepC.cmp
+    epiLane = (k) => {
+      const out = []
+      // Extract carried AND temp lanes: the escape compare may read a temp (the optimizer
+      // copy-propagates `x = xt` so `x*x` becomes `xt*xt`); the skip test below needs it.
+      for (const v of [...carried, ...temp]) out.push(['local.set', v, ['f64x2.extract_lane', k, ['local.get', shadow.get(v)]]])
+      for (let i = 0; i < innerIdx; i++) { const s = obody[i]; if (isArr(s) && s[0] === 'local.set' && perPxInit.has(s[1])) out.push(bump(s, k)) }
+      out.push(['local.set', itVar, ['local.get', shIt]])
+      out.push(['if', ['local.get', escF], ['then',                 // exited via escape (not the limit)…
+        ...escTees,
+        ['if', notEsc, ['then',                                      // …and THIS lane hadn't escaped → finish it
+          // escape-at-MID already ran this iteration's update, so step past it before resuming;
+          // escape-at-TOP tests before the update, so resume at the same it.
+          ...(escAtMid ? [['local.set', itVar, ['i32.add', ['local.get', itVar], ['i32.const', 1]]]] : []),
+          relabelInner()]]]])
+      for (const s of epilogue) out.push(bump(s, k))
+      return out
+    }
+  } else if (midBreaks.length > 1) {
+    // ---- MULTI-OUTCOME masked path (Newton-style convergence loops) ----
+    // Each mid-break `if(COND)(then (local.set $X K)(br))` converges a subset of lanes per
+    // iteration.  We track which lanes are still running in `activeV` and per-lane outcomes
+    // in i32x4 shadow vectors (one per distinct i32 outcome variable).  The break mask for
+    // each convergence condition is: v128.and(activeV, breakMaskOf(keepC)).
+    // Bit-exactness: i32x4 layout has 4 lanes of 32 bits.  f64x2 has 2 lanes of 64 bits.
+    // For f64 lane k, i32 lane 2*k carries the outcome (lower 32 bits of the f64 lane).
+    // i32x4.splat(K) fills all 4 i32 lanes with K; v128.bitselect selects at bit level, so
+    // for a converged f64 lane (bits 64k…64k+63 = -1 in the mask) both i32 halves get K.
+    // i32x4.extract_lane(2*k, outcomeVec) recovers the scalar outcome per lane. ✓
+
+    // Collect distinct i32 outcome variables across all mid-breaks.
+    const outcomeVars = []    // distinct i32 local names that get assigned in outcome breaks
+    const outcomeVarSet = new Set()
+    for (const mb of midBreaks) {
+      for (const a of mb.assigns) {
+        // itVar is tracked by iterV (f64x2) directly — not as an i32x4 outcome shadow.
+        if (a.name !== itVar && !outcomeVarSet.has(a.name)) { outcomeVarSet.add(a.name); outcomeVars.push(a.name) }
+      }
+    }
+    // Each outcome var gets an i32x4 shadow vector (initial value 0 = "no convergence" default).
+    const outcomeVec = new Map()
+    for (const v of outcomeVars) { const sv = nm('out' + v.replace(/\W/g, '')); outcomeVec.set(v, sv); newLocalDecls.push(['local', sv, 'v128']) }
+
+    newLocalDecls.push(['local', iterV, 'v128'], ['local', activeV, 'v128'], ['local', maxitLane, 'v128'])
+    pre.push(['local.set', iterV, ['f64x2.splat', ['f64.const', 0]]])
+    pre.push(['local.set', activeV, ['v128.const', 'i32x4', '-1', '-1', '-1', '-1']])
+    pre.push(['local.set', maxitLane, ['f64x2.splat', boundI32 ? ['f64.convert_i32_s', boundExpr] : boundExpr]])
+    for (const sv of outcomeVec.values()) pre.push(['local.set', sv, ['v128.const', 'i32x4', '0', '0', '0', '0']])
+
+    // keepMask for the limit top-guard (iter < MAXIT)
+    const keepMask = (keep, isLimit) => {
+      const m = isLimit
+        ? [CMP_LANE[keep.cmp[0]], itLeft ? ['local.get', iterV] : ['local.get', maxitLane], itLeft ? ['local.get', maxitLane] : ['local.get', iterV]]
+        : [CMP_LANE[keep.cmp[0]], lift(keep.cmp[1]), lift(keep.cmp[2])]
+      return keep.negate ? ['v128.not', m] : m
+    }
+    // breakMaskOf: v128 where bits = -1 for lanes whose break condition is NOW true
+    // (opposite of keepMask: keep.negate=true → break is the positive compare).
+    const breakMaskOf = (keepC) => {
+      const m = [CMP_LANE[keepC.cmp[0]], lift(keepC.cmp[1]), lift(keepC.cmp[2])]
+      return keepC.negate ? m : ['v128.not', m]
+    }
+
+    const sbody = [
+      ...teeStmts(tees.slice(0, teeTop)),
+      ['local.set', activeV, ['v128.and', ['local.get', activeV], keepMask(keepTopC, true)]],
+      ['br_if', sIn, ['i32.eqz', ['v128.any_true', ['local.get', activeV]]]],
+    ]
+    for (let i = 0; i < ibody.length; i++) {
+      const mb = midBreaks.find(m => m.idx === i)
+      if (mb) {
+        // Convergence break: compute which lanes converge on THIS step.
+        const bm = breakMaskOf(mb.keepC)
+        const convV = nm('conv' + i)
+        newLocalDecls.push(['local', convV, 'v128'])
+        sbody.push(['local.set', convV, ['v128.and', ['local.get', activeV], bm]])
+        // Apply each outcome assignment via bitselect on converged-this-step mask.
+        for (const a of mb.assigns) {
+          if (a.name === itVar) {
+            // Assignment to the iteration counter (e.g. it=MAXIT before break): freeze iterV.
+            sbody.push(['local.set', iterV, ['v128.bitselect', ['local.get', maxitLane], ['local.get', iterV], ['local.get', convV]]])
+          } else if (outcomeVec.has(a.name)) {
+            // i32 outcome variable (e.g. root=1/2/3): bitselect into its i32x4 shadow.
+            // The scalar value K must be an i32 constant — splat it across all i32x4 lanes.
+            if (!isArr(a.val) || a.val[0] !== 'i32.const') return null
+            const sv = outcomeVec.get(a.name)
+            sbody.push(['local.set', sv, ['v128.bitselect', ['i32x4.splat', a.val], ['local.get', sv], ['local.get', convV]]])
+          } else return null   // unexpected assign target
+        }
+        // Remove newly-converged lanes from active set.
+        sbody.push(['local.set', activeV, ['v128.andnot', ['local.get', activeV], ['local.get', convV]]])
+      } else {
+        const v = ibody[i][1]
+        if (carried.has(v)) sbody.push(['local.set', shadow.get(v), ['v128.bitselect', lift(ibody[i][2]), ['local.get', shadow.get(v)], ['local.get', activeV]]])
+        else sbody.push(['local.set', shadow.get(v), lift(ibody[i][2])])
+      }
+    }
+    sbody.push(['local.set', iterV, ['v128.bitselect', ['f64x2.add', ['local.get', iterV], ['f64x2.splat', ['f64.const', 1]]], ['local.get', iterV], ['local.get', activeV]]])
+    simdInner = ['block', sIn, ['loop', sIl, ...sbody, ['br', sIl]]]
+    const carriedInEpi = [...carried].filter(v => epilogue.some(s => readsVar(s, v)))
+    epiLane = (k) => {
+      const out = []
+      for (const v of carriedInEpi) out.push(['local.set', v, ['f64x2.extract_lane', k, ['local.get', shadow.get(v)]]])
+      out.push(['local.set', itVar, ['i32.trunc_f64_s', ['f64x2.extract_lane', k, ['local.get', iterV]]]])
+      // Extract per-lane outcome variables from their i32x4 shadows (i32 lane = 2*k).
+      for (const [v, sv] of outcomeVec) out.push(['local.set', v, ['i32x4.extract_lane', 2 * k, ['local.get', sv]]])
+      for (const s of epilogue) out.push(bump(s, k))
+      return out
+    }
+  } else {
+    newLocalDecls.push(['local', iterV, 'v128'], ['local', activeV, 'v128'], ['local', maxitLane, 'v128'])
+    pre.push(['local.set', iterV, ['f64x2.splat', ['f64.const', 0]]])
+    pre.push(['local.set', activeV, ['v128.const', 'i32x4', '-1', '-1', '-1', '-1']])
+    pre.push(['local.set', maxitLane, ['f64x2.splat', boundI32 ? ['f64.convert_i32_s', boundExpr] : boundExpr]])
+    // AND a keep into the active mask: limit compares iter (f64x2) to the bound; escape lifts its
+    // z-comparison; a mid-break's ¬X is the DIRECT compare negated by v128.not (NaN-exact).
+    const keepMask = (keep, isLimit) => {
+      const m = isLimit
+        ? [CMP_LANE[keep.cmp[0]], itLeft ? ['local.get', iterV] : ['local.get', maxitLane], itLeft ? ['local.get', maxitLane] : ['local.get', iterV]]
+        : [CMP_LANE[keep.cmp[0]], lift(keep.cmp[1]), lift(keep.cmp[2])]
+      return keep.negate ? ['v128.not', m] : m
+    }
+    const sbody = [
+      ...teeStmts(tees.slice(0, teeTop)),
+      ['local.set', activeV, ['v128.and', ['local.get', activeV], keepMask(keepTopC, kTop === 'limit')]],
+      // compound `while (A && B)`: the second keep (B) also gates at the top, before the body
+      ...(compoundTop ? teeStmts(tees.slice(teeTop)).concat([['local.set', activeV, ['v128.and', ['local.get', activeV], keepMask(keepMidC, kMid === 'limit')]]]) : []),
+      ['br_if', sIn, ['i32.eqz', ['v128.any_true', ['local.get', activeV]]]],
+    ]
+    for (let i = 0; i < ibody.length; i++) {
+      if (!compoundTop && i === midIdx) {
+        sbody.push(...teeStmts(tees.slice(teeTop)))
+        sbody.push(['local.set', activeV, ['v128.and', ['local.get', activeV], keepMask(keepMidC, kMid === 'limit')]])
+      } else {
+        const v = ibody[i][1]
+        if (carried.has(v)) sbody.push(['local.set', shadow.get(v), ['v128.bitselect', lift(ibody[i][2]), ['local.get', shadow.get(v)], ['local.get', activeV]]])
+        else sbody.push(['local.set', shadow.get(v), lift(ibody[i][2])])
+      }
+    }
+    sbody.push(['local.set', iterV, ['v128.bitselect', ['f64x2.add', ['local.get', iterV], ['f64x2.splat', ['f64.const', 1]]], ['local.get', iterV], ['local.get', activeV]]])
+    simdInner = ['block', sIn, ['loop', sIl, ...sbody, ['br', sIl]]]
+    const carriedInEpi = [...carried].filter(v => epilogue.some(s => readsVar(s, v)))
+    epiLane = (k) => {
+      const out = []
+      for (const v of carriedInEpi) out.push(['local.set', v, ['f64x2.extract_lane', k, ['local.get', shadow.get(v)]]])
+      out.push(['local.set', itVar, ['i32.trunc_f64_s', ['f64x2.extract_lane', k, ['local.get', iterV]]]])
+      for (const s of epilogue) out.push(bump(s, k))
+      return out
+    }
+  }
+
+  // SIMD outer loop: process a pair while x+1 is still a valid pixel, then advance every pixel IV
+  // by 2. The scalar tail (original block) finishes any last odd pixel.
+  const simdOuter = ['block', sOut, ['loop', sOl,
+    ['br_if', sOut, ['i32.eqz', [oExit.cmpOp, bump(['local.get', pxVar], 1), widthBound]]],
+    ...pre, simdInner, ...postLoop, ...epiLane(0), ...epiLane(1),
+    ...pixelIVs.map(p => ['local.set', p.name, [p.type + '.add', ['local.get', p.name], [p.type + '.const', 2]]]),
+    ['br', sOl]]]
+
+  // wrapper: hoisted preambles once (outer + inner-block invariants like BAILOUT), then the
+  // SIMD even-pixel loop, then the original scalar block handles the odd-pixel tail.
+  const tailBlock = ['block', oLabel, loopNode]
+  const wrapper = ['block', nm('w'), ...preamble, ...innerPre, simdOuter, tailBlock]
+  return { wrapper, newLocalDecls }
+}
+
+// Math.sin/cos lower to `call $math.{sin,cos}_core` (the emit-time fast path, math.js:67); the
+// public `$math.{sin,cos}` wrap the same core. Their f64x2 mirrors $math.sin2/$math.cos2 (the
+// vectorized reduce+horner, module/math.js:543) are BIT-EXACT per lane to the scalar core — so we
+// can lift the call straight to the *2 helper. Phase-2 adds pow/log/atan2 here (see PPC_CALL2).
+// NOTE: scalar targets here must be kept out of inlineOnce's single-caller inlining (SIMD_PROTECTED
+// in src/wat/optimize.js) — else the call node is gone before this lift runs.
+const PPC_CALL2 = {
+  '$math.sin_core': '$math.sin2', '$math.cos_core': '$math.cos2',
+  '$math.sin': '$math.sin2', '$math.cos': '$math.cos2',
+  '$math.pow': '$math.pow2',   // 2-arg; bit-exact per-lane scalar (cancellation-sensitive — see module/math.js)
+  '$math.atan2': '$math.atan2_2', '$math.hypot': '$math.hypot_2',   // 2-arg; bit-exact extract/repack
+  // log/exp/exp2: TRUE f64x2 polys — both lanes one evaluation (≈2×, beats V8 native log). Bit-exact
+  // via hot-path-vectorized + scalar-edge-fallback ($math.log_v/exp_v/exp2_v, module/math.js).
+  '$math.log': '$math.log_v', '$math.exp': '$math.exp_v', '$math.exp2': '$math.exp2_v',
+}
+
+// Per-pixel-color vectorizer. The dual of tryDivergentEscapeVectorize for kernels with NO inner
+// escape loop: an outer pixel loop whose body computes an f64 value from the pixel index (via
+// cos/sin/sqrt/…), packs it to a u32 colour, and stores it — every pixel independent. We lift the
+// liftable f64 PREFIX of the body to f64x2 (two adjacent pixels per lane: the index becomes the
+// ramp [x, x+1]; transcendentals map to the bit-exact $math.*2 helpers; conditionals to bitselect),
+// then run the SCALAR pack+store once per lane (extract_lane → the original f64 local → the
+// untouched integer pack). The expensive transcendentals run 2-wide; the cheap pack stays scalar.
+// Bit-exact by construction: f64x2 arithmetic is per-lane IEEE-identical and extract_lane is exact.
+// A call we can't yet vectorize (pow in Phase 1) just ends the SIMD prefix — its lane local and the
+// rest fall to the scalar epilogue, so the kernel still partially vectorizes. The original scalar
+// loop, re-run as the tail, finishes the odd last pixel for free (its own `x < W` guard).
+function tryPerPixelColor(blockNode, fnLocals, freshIdRef, pureFuncMap) {
+  // Outer per-pixel scaffold — shared with tryDivergentEscapeVectorize; this pass
+  // takes the straight-line-body branch (no inner escape loop) below.
+  const outer = matchOuterPixelLoop(blockNode)
+  if (!outer) return null
+  const { oLabel, loopNode, preamble, pixelIVs, pxVar, widthBound, pivType, obody, oExit } = outer
+
+  // ---- body: straight-line (no inner escape loop), no impure call ----
+  for (const s of obody)
+    if (isArr(s) && s[0] === 'block' && s.slice(1).some(c => isArr(c) && c[0] === 'loop')) return null  // inner escape loop → tryDivergentEscapeVectorize's job
+  // A non-pure call (e.g. a ray-march helper that writes a scratch global / memory) can mutate state
+  // that a lane local — computed ONCE, before the per-lane epilogue runs the call — would then read
+  // stale, breaking bit-exactness. $math.* helpers are pure (no global/memory writes), so allow them.
+  // Pure user-defined functions in pureFuncMap are also safe: they have no side effects (verified
+  // when the map is built) and liftPPC inlines them expression-level rather than emitting a call.
+  const impureCall = (n) => isArr(n) && ((n[0] === 'call' && typeof n[1] === 'string' && !n[1].startsWith('$math.') && !(pureFuncMap && pureFuncMap.has(n[1]))) || n.some(impureCall))
+  if (obody.some(impureCall)) return null
+
+  // bump: substitute every pixel IV with (IV + k) in its own type — for the lane-k epilogue.
+  const bump = (n, k) => k === 0 ? n
+    : (isArr(n) && n[0] === 'local.get' && pivType.has(n[1]))
+      ? [pivType.get(n[1]) + '.add', n, [pivType.get(n[1]) + '.const', k]]
+      : (isArr(n) ? n.map(c => bump(c, k)) : n)
+
+  // Pixel-coordinate aliases: a local consistently CSE'd to `convert_i32_s(pixelIV)` (jz tees the f64
+  // pixel-x once — reused for the store address AND the per-pixel math — so it lives inside the i32
+  // offset stmt, out of reach as a lane local). Treat its reads as the ramp, recomputed per lane.
+  const pxAlias = new Map()
+  {
+    const defs = new Map()
+    const scan = (n) => { if (!isArr(n)) return; if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') { (defs.get(n[1]) || defs.set(n[1], []).get(n[1])).push(n[2]) } for (let i = 1; i < n.length; i++) scan(n[i]) }
+    obody.forEach(scan)
+    for (const [name, rhss] of defs) {
+      const j = JSON.stringify(rhss[0])
+      if (!rhss.every(r => JSON.stringify(r) === j)) continue   // multiple distinct defs → not a stable alias
+      const r = rhss[0]
+      if (isArr(r) && r[0] === 'f64.convert_i32_s' && isArr(r[1]) && r[1][0] === 'local.get' && pivType.get(r[1][1]) === 'i32') pxAlias.set(name, r[1][1])
+      else if (isArr(r) && r[0] === 'local.get' && pivType.get(r[1]) === 'f64') pxAlias.set(name, r[1])
+    }
+  }
+  // The two lanes of a pixel IV (or its alias): [v, v+1], in f64 (an i32 IV is converted per lane).
+  const rampOf = (piv) => pivType.get(piv) === 'f64'
+    ? ['f64x2.replace_lane', 1, ['f64x2.splat', ['local.get', piv]], ['f64.add', ['local.get', piv], ['f64.const', 1]]]
+    : ['f64x2.replace_lane', 1, ['f64x2.splat', ['f64.convert_i32_s', ['local.get', piv]]], ['f64.convert_i32_s', ['i32.add', ['local.get', piv], ['i32.const', 1]]]]
+
+  const id = freshIdRef.next++
+  const nm = (s) => `$__ppc${id}_${s}`
+  const laneMap = new Map()       // f64 lane-local name → its v128 shadow
+  const laneLifted = new Map()    // f64 lane-local name → its lifted f64x2 expr
+
+  // Inline a pure user function call into a lifted f64x2 expression.
+  // `callNode` is ['call', '$name', arg0, arg1, ...]; `outerLift` is the liftPPC fn.
+  // Walks the callee's body, substituting params with lifted args and inlined-local
+  // intermediates. Returns null if any step fails (bail → scalar epilogue).
+  // SOUND: only called when callee is in pureFuncMap (no stores/global.sets/impure
+  // calls); param names are read-only in the inlinee body (verified below).
+  const liftPPCInline = (callNode, outerLift) => {
+    const callee = pureFuncMap.get(callNode[1])
+    if (!callee) return null
+    const calleeBodyStart = findBodyStart(callee)
+    if (calleeBodyStart < 0) return null
+
+    // Collect callee params in order.
+    const calleeParams = []
+    for (let i = 2; i < calleeBodyStart; i++) {
+      const d = callee[i]
+      if (isArr(d) && d[0] === 'param' && typeof d[1] === 'string') calleeParams.push(d[1])
+    }
+    // Args supplied by the call site (call node children after the name).
+    const callArgs = callNode.slice(2)
+    if (callArgs.length !== calleeParams.length) return null
+
+    // Lift each arg with the outer liftPPC.
+    const substMap = new Map()
+    for (let i = 0; i < calleeParams.length; i++) {
+      const lifted = outerLift(callArgs[i])
+      if (lifted === null) return null
+      substMap.set(calleeParams[i], lifted)
+    }
+
+    // Verify no local.set on a param name inside the callee body (params are read-only).
+    for (const pname of calleeParams) {
+      if (writesName(callee.slice(calleeBodyStart), pname)) return null
+    }
+
+    // liftInline: lift a callee-body expression using substMap (params + inlined locals).
+    // Handles f64.const, local.get from substMap, LANE_PURE.f64 ops, and PPC_CALL2 calls.
+    // Returns null on any unsupported node.
+    const liftInline = (n) => {
+      if (!isArr(n)) return null
+      const op = n[0]
+      if (op === 'f64.const') return ['f64x2.splat', n]
+      if (op === 'local.get' && typeof n[1] === 'string') {
+        return substMap.has(n[1]) ? substMap.get(n[1]) : null
+      }
+      if (op === 'call') {
+        const v2 = PPC_CALL2[n[1]]
+        if (v2 && n.length === 3) { const a = liftInline(n[2]); return a && ['call', v2, a] }
+        if (v2 && n.length === 4) { const a = liftInline(n[2]), b = liftInline(n[3]); return (a && b) ? ['call', v2, a, b] : null }
+        return null
+      }
+      if (LANE_PURE.f64.has(op)) {
+        const ks = n.slice(1).map(liftInline)
+        return ks.some(k => k === null) ? null : [LANE_PURE.f64.get(op).simd, ...ks]
+      }
+      return null
+    }
+
+    // Walk callee body: local.set stmts define inlined locals; return stmt gives result.
+    for (let i = calleeBodyStart; i < callee.length; i++) {
+      const stmt = callee[i]
+      if (!isArr(stmt)) return null
+      if (stmt[0] === 'local.set' && typeof stmt[1] === 'string') {
+        const lifted = liftInline(stmt[2])
+        if (lifted === null) return null
+        substMap.set(stmt[1], lifted)
+        continue
+      }
+      if (stmt[0] === 'return') {
+        return liftInline(stmt[1])
+      }
+      // Any other statement type → bail (impure or unsupported structure).
+      return null
+    }
+    return null  // no return stmt found
+  }
+
+  // Lift a scalar f64 expression to f64x2: pixel IV → ramp [v, v+1]; an earlier lane local → its
+  // shadow; an invariant (local/global the loop never writes) → splat; transcendental call → the
+  // *2 helper; conditional → bitselect; LANE_PURE.f64 op → recurse. null = not liftable (the lift
+  // stops here and the rest becomes the scalar epilogue).
+  const liftPPC = (n) => {
+    if (!isArr(n)) return null
+    const op = n[0]
+    if (op === 'f64.const') return ['f64x2.splat', n]
+    if (op === 'local.get') {
+      const v = n[1]
+      if (laneMap.has(v)) return ['local.get', laneMap.get(v)]
+      if (pxAlias.has(v)) return rampOf(pxAlias.get(v))
+      if (pivType.get(v) === 'f64') return rampOf(v)
+      if (writesName(loopNode, v)) return null
+      return ['f64x2.splat', n]
+    }
+    if (op === 'local.tee') {   // CSE temp inside a lane expr (e.g. `dx` reused as dx*dx) → a v128 tee
+      const lifted = liftPPC(n[2])
+      if (lifted === null) return null
+      const lane = laneMap.get(n[1]) || nm('t' + n[1].replace(/\W/g, ''))
+      laneMap.set(n[1], lane)   // later local.get $v in this expr resolves to the tee's lane
+      return ['local.tee', lane, lifted]
+    }
+    if (op === 'global.get') return writesName(loopNode, n[1]) ? null : ['f64x2.splat', n]
+    if (op === 'f64.convert_i32_s' && isArr(n[1]) && n[1][0] === 'local.get' && pivType.get(n[1][1]) === 'i32') return rampOf(n[1][1])
+    if (op === 'call') {
+      const v2 = PPC_CALL2[n[1]]
+      if (v2 && n.length === 3) { const a = liftPPC(n[2]); return a && ['call', v2, a] }
+      if (v2 && n.length === 4) { const a = liftPPC(n[2]), b = liftPPC(n[3]); return (a && b) ? ['call', v2, a, b] : null }
+      // Pure user-function inline: substitute params with lifted args, walk body.
+      if (pureFuncMap && pureFuncMap.has(n[1])) return liftPPCInline(n, liftPPC)
+      return null
+    }
+    if (op === 'if') {   // `cond ? X : Y` (jz lowers to (if (result f64) COND (then X)(else Y))) → bitselect
+      if (!isArr(n[1]) || n[1][0] !== 'result' || n[1][1] !== 'f64') return null
+      const thenN = n[3], elseN = n[4]
+      if (!isArr(thenN) || thenN[0] !== 'then' || thenN.length !== 2) return null
+      if (!isArr(elseN) || elseN[0] !== 'else' || elseN.length !== 2) return null
+      let cond = n[2]
+      if (isArr(cond) && cond[0] === 'i32.ne' && isI32Const(cond[2]) && cond[2][1] === 0) cond = cond[1]
+      const cmp = isArr(cond) && cond.length === 3 ? CMP_LANE[cond[0]] : null
+      if (!cmp) return null
+      const ca = liftPPC(cond[1]), cb = liftPPC(cond[2]), x = liftPPC(thenN[1]), y = liftPPC(elseN[1])
+      if (!ca || !cb || !x || !y) return null
+      return ['v128.bitselect', x, y, [cmp, ca, cb]]
+    }
+    if (LANE_PURE.f64.has(op)) {
+      const ks = n.slice(1).map(liftPPC)
+      return ks.some(k => k === null) ? null : [LANE_PURE.f64.get(op).simd, ...ks]
+    }
+    return null
+  }
+
+  // Classify each body statement: a `local.set $v EXPR` with v an f64 whose EXPR fully lifts is a
+  // SIMD lane local (computed once per pair); everything else (the integer pack, the store, an
+  // un-liftable call like pow in Phase 1, a recomputed i32 offset) is a scalar EPILOGUE statement,
+  // re-run per lane. Lane locals need NOT be a contiguous prefix — `offset = w*y+x` (i32) commonly
+  // precedes the f64 work. Processed in source order so a lane local can reference an earlier one;
+  // liftPPC returns null on a read of any in-loop value that isn't already a lane local (incl. a
+  // later or epilogue local), so the classification self-enforces "lane locals depend only on
+  // IVs/invariants/earlier lane locals" — reordering all lane computes ahead of the epilogue is safe.
+  const epilogue = []
+  for (const s of obody) {
+    if (isArr(s) && s[0] === 'local.set' && s.length === 3 && fnLocals.get(s[1]) === 'f64') {
+      const before = new Set(laneMap.keys())
+      const lifted = liftPPC(s[2])
+      if (lifted !== null) { laneMap.set(s[1], nm('l' + s[1].replace(/\W/g, ''))); laneLifted.set(s[1], lifted); continue }
+      for (const k of [...laneMap.keys()]) if (!before.has(k)) laneMap.delete(k)   // roll back tee pollution from a failed lift
+    }
+    epilogue.push(s)
+  }
+  if (!laneMap.size) return null   // nothing lifted to f64x2
+  // HAZARD: a lane local re-written by an epilogue statement leaves its f64x2 shadow STALE.
+  // e.g. `let fx=0; if(denom>ε){fx=…}; let mag=hypot(fx,…)` — `fx=0` lifts to a lane local
+  // splat(0); the statement-form `if` lands in the scalar epilogue (updates only the SCALAR local),
+  // so the lifted `hypot(fx,…)` — emitted BEFORE the epilogue — reads the stale splat(0) → all-zero.
+  // Bail ONLY when the stale shadow actually feeds another LANE compute: a lane local whose shadow
+  // is CONSUMED by some laneLifted expr and is ALSO reassigned in the epilogue. (A lane local merely
+  // extracted for the scalar epilogue — e.g. `gv`, clamped by `if(gv<0)gv=0` then packed — is safe:
+  // the clamp runs per-lane after extraction, corrupting no other lane.)
+  {
+    const consumedShadows = new Set()
+    const scanShadow = (n) => { if (!isArr(n)) return; if (n[0] === 'local.get' && typeof n[1] === 'string') consumedShadows.add(n[1]); for (const c of n.slice(1)) scanShadow(c) }
+    for (const expr of laneLifted.values()) scanShadow(expr)
+    const hazard = (n) => isArr(n) && (((n[0] === 'local.set' || n[0] === 'local.tee') && laneMap.has(n[1]) && consumedShadows.has(laneMap.get(n[1]))) || n.slice(1).some(hazard))
+    if (epilogue.some(hazard)) return null
+  }
+  // Only worth the extract overhead if a costly op (a *2 transcendental or f64x2.sqrt) got lifted.
+  const heavy = (n) => isArr(n) && ((n[0] === 'call' && /\$math\.(sin2|cos2|pow2|log_v|atan2_2|hypot_2|exp2_2|tan2)/.test(n[1])) || n[0] === 'f64x2.sqrt' || n.some(heavy))
+  if (![...laneLifted.values()].some(heavy)) return null   // only cheap arithmetic lifted — not worth it
+
+  // Exactly one i32.store, found anywhere in the epilogue (jz wraps `mem[off]=…` in a `(block …)`).
+  let storeStmt = null
+  const findStore = (n) => { if (!isArr(n)) return; if (STORE_OPS[n[0]]) { if (storeStmt) storeStmt = false; else if (storeStmt !== false) storeStmt = n } for (const c of n) findStore(c) }
+  epilogue.forEach(findStore)
+  if (!storeStmt || storeStmt[0] !== 'i32.store') return null   // not exactly one u32 colour store
+  // The store cell must differ per lane, i.e. its address must depend on a pixel IV — directly
+  // (chladni's `px[j]`) or transitively through an epilogue local (interference's `mem[offset]`,
+  // offset=w*y+x). Follow the address's reads through epilogue local definitions to a pixel IV.
+  // Walk every child except a set's name slot (a def nested under an `(if … then)` must still be
+  // recorded — the n.slice(2)-everywhere form would miss it, conservatively bailing a valid kernel).
+  const epiDef = new Map()
+  const collect = (n) => { if (!isArr(n)) return; if (n[0] === 'local.set' && typeof n[1] === 'string' && !epiDef.has(n[1])) epiDef.set(n[1], n[2]); for (const c of (n[0] === 'local.set' ? n.slice(2) : n.slice(1))) collect(c) }
+  epilogue.forEach(collect)
+  const feedsIV = (n, seen = new Set()) => isArr(n) && (n[0] === 'local.get'
+    ? (pivType.has(n[1]) || (epiDef.has(n[1]) && !seen.has(n[1]) && (seen.add(n[1]), feedsIV(epiDef.get(n[1]), seen))))
+    : n.some(c => feedsIV(c, seen)))
+  if (!feedsIV(storeStmt[1])) return null   // store cell wouldn't vary per lane → can't pair
+
+  // ---- epilogue safety: runs scalar per lane (each statement bumped to pixel j+k). It may read a
+  // lane local (extracted below), an invariant/pixel-IV, or a value the epilogue itself computes —
+  // incl. within-statement tees (e.g. the Infinity-guard temp inside an `(if … |0)` pack). Straight-
+  // line source guarantees write-before-read, so it suffices that every read of an in-loop local is
+  // a lane local or written somewhere in the epilogue (a lane local read is satisfied by extraction). ----
+  {
+    const epiWritten = new Set()
+    const wr = (n) => { if (!isArr(n)) return; const st = (n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string'; if (st) epiWritten.add(n[1]); for (const c of (st ? n.slice(2) : n.slice(1))) wr(c) }
+    epilogue.forEach(wr)
+    const reads = new Set(); const rd = (n) => { if (!isArr(n)) return; if (n[0] === 'local.get') reads.add(n[1]); else for (const c of n) rd(c) }
+    epilogue.forEach(rd)
+    for (const v of reads) if (writesName(loopNode, v) && !laneMap.has(v) && !epiWritten.has(v) && !pivType.has(v)) return null   // reads an in-loop value with no per-lane source
+  }
+  const epiReads = [...laneMap.keys()].filter(v => epilogue.some(s => readsVar(s, v)))
+
+  // ============================ emit ============================
+  const newLocalDecls = [...laneMap.values()].map(n => ['local', n, 'v128'])
+  const laneCompute = [...laneLifted.keys()].map(v => ['local.set', laneMap.get(v), laneLifted.get(v)])
+  const epiLane = (k) => [
+    ...epiReads.map(v => ['local.set', v, ['f64x2.extract_lane', k, ['local.get', laneMap.get(v)]]]),
+    ...epilogue.map(s => bump(s, k)),
+  ]
+  const sOut = nm('ob'), sOl = nm('ol')
+  const simdOuter = ['block', sOut, ['loop', sOl,
+    ['br_if', sOut, ['i32.eqz', [oExit.cmpOp, bump(['local.get', pxVar], 1), widthBound]]],
+    ...laneCompute, ...epiLane(0), ...epiLane(1),
+    ...pixelIVs.map(p => ['local.set', p.name, [p.type + '.add', ['local.get', p.name], [p.type + '.const', 2]]]),
+    ['br', sOl]]]
+  const wrapper = ['block', nm('w'), ...preamble, simdOuter, ['block', oLabel, loopNode]]
+  return { wrapper, newLocalDecls }
+}
+
+// ---- Outer-loop strip-mine over an inner reduction (tryOuterStrip, experimental) ----
+//
+// The dual of tryPerPixelColor for pixel loops whose per-pixel value comes from an
+// INNER REDUCTION over invariant data — metaballs `sum += r²/((cx-bx[b])²+(cy-by[b])²+ε)`,
+// voronoi/lyapunov shapes. Strip-mine the OUTER pixel loop 2-wide: pixels (xi, xi+1) →
+// f64x2 lanes. The per-pixel coordinate (`cx = xi/W`) becomes a ramp `[cx, cx+1/W]`; the
+// inner loop's loads `bx[b]` are indexed by the INNER IV (same for both pixels) → splat;
+// the accumulator `sum` becomes an f64x2 carrying both lanes' running sums. After the inner
+// loop, each lane's sum is extracted and the scalar pack+store runs per lane (xi, xi+1).
+//
+// BIT-EXACT: each lane accumulates in the SAME scalar order as the original (f64x2.add is
+// per-lane IEEE-754-identical) — a per-lane reduction reorders nothing, unlike a horizontal
+// fold. The inner loop's trip count (b < count) is invariant, so its scaffold stays scalar;
+// only the f64 body lifts. Distinct base subtrees assumed non-aliasing (the standing model).
+// Gated behind cfg.experimentalOuterStrip until proven across the corpus.
+function tryOuterStrip(blockNode, fnLocals, freshIdRef, enabled) {
+  if (!enabled) return null
+  const outer = matchOuterPixelLoop(blockNode)
+  if (!outer) return null
+  const { oLabel, loopNode, preamble, pixelIVs, pxVar, widthBound, pivType, obody, oExit } = outer
+
+  // Exactly one inner loop in obody; it is the per-pixel reduction.
+  let innerIdx = -1, innerBlock = null
+  for (let i = 0; i < obody.length; i++) {
+    const s = obody[i]
+    if (isArr(s) && s[0] === 'block' && s.slice(1).some(c => isArr(c) && c[0] === 'loop')) {
+      if (innerBlock) return null
+      innerBlock = s; innerIdx = i
+    }
+  }
+  if (!innerBlock) return null
+  const ibl = matchBlockLoop(innerBlock, { allowPreamble: true })
+  if (!ibl) return null
+  if (ibl.preamble.length) return null
+  const innerIV = ibl.incVar, ibody = ibl.body
+  // No impure calls (a non-pure call would read stale state in the per-lane epilogue). $math.* pure.
+  const impureCall = (n) => isArr(n) && ((n[0] === 'call' && typeof n[1] === 'string' && !n[1].startsWith('$math.')) || n.some(impureCall))
+  if (obody.some(impureCall)) return null
+
+  const id = freshIdRef.next++
+  const nm = (s) => `$__os${id}_${s}`
+  const bump = (n, k) => k === 0 ? n
+    : (isArr(n) && n[0] === 'local.get' && pivType.has(n[1])) ? [pivType.get(n[1]) + '.add', n, [pivType.get(n[1]) + '.const', k]]
+    : (isArr(n) ? n.map(c => bump(c, k)) : n)
+  const rampOf = (piv) => pivType.get(piv) === 'f64'
+    ? ['f64x2.replace_lane', 1, ['f64x2.splat', ['local.get', piv]], ['f64.add', ['local.get', piv], ['f64.const', 1]]]
+    : ['f64x2.replace_lane', 1, ['f64x2.splat', ['f64.convert_i32_s', ['local.get', piv]]], ['f64.convert_i32_s', ['i32.add', ['local.get', piv], ['i32.const', 1]]]]
+  const readsName = (n, name) => isArr(n) && ((n[0] === 'local.get' && n[1] === name) || n.some(c => readsName(c, name)))
+
+  const laneMap = new Map()   // f64 lane-local (per-pixel-varying) name → its v128 shadow
+  // Lift a scalar f64 expr to f64x2 (null = not liftable). pxVar → ramp; lane local → shadow;
+  // pixel-invariant local/global → splat; pixel-invariant f64.load → splat(scalar load);
+  // $math.*2 transcendental; cond → bitselect; LANE_PURE.f64 op → recurse.
+  const liftOS = (n) => {
+    if (!isArr(n)) return null
+    const op = n[0]
+    if (op === 'f64.const') return ['f64x2.splat', n]
+    if (op === 'local.get') {
+      const v = n[1]
+      if (laneMap.has(v)) return ['local.get', laneMap.get(v)]
+      if (pivType.get(v) === 'f64') return rampOf(v)
+      if (writesName(loopNode, v)) return null
+      return ['f64x2.splat', n]
+    }
+    if (op === 'f64.convert_i32_s' && isArr(n[1]) && n[1][0] === 'local.get' && pivType.get(n[1][1]) === 'i32') return rampOf(n[1][1])
+    if (op === 'global.get') return writesName(loopNode, n[1]) ? null : ['f64x2.splat', n]
+    if (LOAD_OPS[op] === 'f64') {
+      // pixel-invariant load (address reads neither the pixel IV nor any per-pixel lane) is the
+      // same value for both lanes → load once, splat. A per-pixel gather is not supported.
+      const addr = typeof n[1] === 'string' && n[1].startsWith('offset=') ? n[2] : n[1]
+      if (readsName(addr, pxVar) || [...laneMap.keys()].some(lv => readsName(addr, lv))) return null
+      return ['f64x2.splat', n]
+    }
+    if (op === 'call') {
+      const v2 = PPC_CALL2[n[1]]
+      if (v2 && n.length === 3) { const a = liftOS(n[2]); return a && ['call', v2, a] }
+      if (v2 && n.length === 4) { const a = liftOS(n[2]), b = liftOS(n[3]); return (a && b) ? ['call', v2, a, b] : null }
+      return null
+    }
+    if (op === 'if') {
+      if (!isArr(n[1]) || n[1][0] !== 'result' || n[1][1] !== 'f64') return null
+      const thenN = n[3], elseN = n[4]
+      if (!isArr(thenN) || thenN[0] !== 'then' || thenN.length !== 2) return null
+      if (!isArr(elseN) || elseN[0] !== 'else' || elseN.length !== 2) return null
+      let cond = n[2]
+      if (isArr(cond) && cond[0] === 'i32.ne' && isI32Const(cond[2]) && cond[2][1] === 0) cond = cond[1]
+      const cmp = isArr(cond) && cond.length === 3 ? CMP_LANE[cond[0]] : null
+      if (!cmp) return null
+      const ca = liftOS(cond[1]), cb = liftOS(cond[2]), x = liftOS(thenN[1]), y = liftOS(elseN[1])
+      if (!ca || !cb || !x || !y) return null
+      return ['v128.bitselect', x, y, [cmp, ca, cb]]
+    }
+    if (LANE_PURE.f64.has(op)) {
+      const ks = n.slice(1).map(liftOS)
+      return ks.some(k => k === null) ? null : [LANE_PURE.f64.get(op).simd, ...ks]
+    }
+    return null
+  }
+
+  // ---- lift the inner loop body: temp f64 lane locals + f64 accumulator(s) `acc = acc + EXPR`,
+  // the inner IV bump stays scalar. Anything else (or an unliftable expr) → bail. ----
+  // Pre-scan: f64 accumulators `acc = acc + EXPR`. Assign their f64x2 shadows up front so laneInit
+  // can seed them and the lift can accumulate into them (order-independent of the inner body).
+  const accNames = new Set()
+  for (const s of ibody) {
+    if (!(isArr(s) && s[0] === 'local.set' && typeof s[1] === 'string' && s.length === 3)) continue
+    const name = s[1], rhs = s[2]
+    if (fnLocals.get(name) !== 'f64' || !isArr(rhs) || rhs[0] !== 'f64.add') continue
+    const addend = isLocalGet(rhs[1], name) ? rhs[2] : isLocalGet(rhs[2], name) ? rhs[1] : null
+    if (addend != null && !readsName(addend, name)) { accNames.add(name); laneMap.set(name, nm('acc' + name.replace(/\W/g, ''))) }
+  }
+  if (!accNames.size) return null
+
+  // ---- pre-inner-loop stmts (obody[<innerIdx]): per-pixel coord lanes (cx = f(xi) → ramp),
+  // accumulator seeds (→ splat), scalar inner-IV init. MUST run before the inner-body lift so the
+  // per-pixel coord lanes are registered when the inner loop references them. ----
+  const laneInit = []
+  for (let i = 0; i < innerIdx; i++) {
+    const s = obody[i]
+    if (!(isArr(s) && s[0] === 'local.set' && typeof s[1] === 'string' && s.length === 3)) { laneInit.push(s); continue }
+    const name = s[1]
+    if (accNames.has(name)) {                       // accumulator seed → splat
+      const seed = liftOS(s[2])
+      if (!seed) return null
+      laneInit.push(['local.set', laneMap.get(name), seed]); continue
+    }
+    if (fnLocals.get(name) === 'f64' && readsName(s[2], pxVar)) {   // per-pixel coord (cx = xi/W) → ramp lane
+      const lane = liftOS(s[2])
+      if (!lane) return null
+      const sh = nm('p' + name.replace(/\W/g, ''))
+      laneMap.set(name, sh)
+      laneInit.push(['local.set', sh, lane]); continue
+    }
+    laneInit.push(s)                                // scalar (inner IV init `b=0`, invariant setup)
+  }
+
+  // ---- lift the inner-loop body: temp f64 lane locals + accumulate into the acc shadows; the
+  // inner IV bump stays scalar. Per-pixel coords now resolve via laneMap. ----
+  const liftedInner = []
+  for (const s of ibody) {
+    if (matchInc1(s) === innerIV || matchIncN(s)?.name === innerIV) { liftedInner.push(s); continue }
+    if (!(isArr(s) && s[0] === 'local.set' && typeof s[1] === 'string' && s.length === 3)) return null
+    const name = s[1], rhs = s[2]
+    if (fnLocals.get(name) !== 'f64') return null
+    if (accNames.has(name)) {
+      const addend = isLocalGet(rhs[1], name) ? rhs[2] : rhs[1]
+      const lifted = liftOS(addend)
+      if (!lifted) return null
+      liftedInner.push(['local.set', laneMap.get(name), ['f64x2.add', ['local.get', laneMap.get(name)], lifted]]); continue
+    }
+    if (readsName(rhs, name)) return null   // loop-carried non-accumulator → bail
+    const lifted = liftOS(rhs)
+    if (!lifted) return null
+    const sh = laneMap.get(name) || nm('t' + name.replace(/\W/g, ''))
+    laneMap.set(name, sh)
+    liftedInner.push(['local.set', sh, lifted])
+  }
+
+  // ---- epilogue (obody[>innerIdx]): the per-pixel pack+store, run scalar per lane (bumped to xi+k),
+  // reading the extracted accumulator/lane values. Safety: every in-loop read must be a lane local,
+  // a pixel IV, or written within the epilogue itself. ----
+  const epilogue = obody.slice(innerIdx + 1)
+  {
+    const epiWritten = new Set()
+    const wr = (n) => { if (!isArr(n)) return; const st = (n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string'; if (st) epiWritten.add(n[1]); for (const c of (st ? n.slice(2) : n.slice(1))) wr(c) }
+    epilogue.forEach(wr)
+    const reads = new Set(); const rd = (n) => { if (!isArr(n)) return; if (n[0] === 'local.get') reads.add(n[1]); else for (const c of n) rd(c) }
+    epilogue.forEach(rd)
+    for (const v of reads) if (writesName(loopNode, v) && !laneMap.has(v) && !epiWritten.has(v) && !pivType.has(v)) return null
+  }
+  // store must exist + vary per lane
+  let hasStore = false
+  const findStore = (n) => { if (!isArr(n)) return; if (STORE_OPS[n[0]]) hasStore = true; n.forEach(findStore) }
+  epilogue.forEach(findStore)
+  if (!hasStore) return null
+
+  // ============================ emit ============================
+  const newLocalDecls = [...new Set(laneMap.values())].map(n => ['local', n, 'v128'])
+  const epiReads = [...laneMap.keys()].filter(v => epilogue.some(s => readsVar(s, v)))
+  // Rebuild the inner loop with its scalar scaffold (exit + the bottom IV bump, which lives at
+  // loopNode[incIdx] — NOT in `body`) and the lifted f64x2 body in between.
+  const innerLoopNode = ibl.loopNode
+  const iExit = innerLoopNode[2]                       // (br_if iBrk (eqz (b < count)))
+  const iInc = innerLoopNode[ibl.incIdx]               // (local.set b (i32.add b 1)) — scalar, kept
+  const iLabelB = innerBlock[1], iLabelL = innerLoopNode[1]
+  const innerSimd = ['block', iLabelB, ['loop', iLabelL, iExit, ...liftedInner, iInc, ['br', iLabelL]]]
+  const laneCompute = [...laneInit, innerSimd]
+  const epiLane = (k) => [
+    ...epiReads.map(v => ['local.set', v, ['f64x2.extract_lane', k, ['local.get', laneMap.get(v)]]]),
+    ...epilogue.map(s => bump(s, k)),
+  ]
+  const sOut = nm('ob'), sOl = nm('ol')
+  const simdOuter = ['block', sOut, ['loop', sOl,
+    ['br_if', sOut, ['i32.eqz', [oExit.cmpOp, bump(['local.get', pxVar], 1), widthBound]]],
+    ...laneCompute, ...epiLane(0), ...epiLane(1),
+    ...pixelIVs.map(p => ['local.set', p.name, [p.type + '.add', ['local.get', p.name], [p.type + '.const', 2]]]),
+    ['br', sOl]]]
+  const wrapper = ['block', nm('w'), ...preamble, simdOuter, ['block', oLabel, loopNode]]
+  return { wrapper, newLocalDecls }
+}
+
+// ---- Mixed-lane tone-map (tryToneMap, experimental) ------------------------
+//
+// Vectorizes the log-tonemap TAIL shared by fern / bifurcation / attractors:
+//   while (i<n){ let v=dens[i]; if(v>0){ g = trunc(min(log(v+1)*S, 255)) }
+//                px[i] = (255<<24)|(g<<16)|(g<<8)|g }
+// A flat 1-D loop that loads an i32 density, lifts it to f64 for a log, truncates
+// back to i32, packs an ARGB word, and stores it — i32 lanes wrapping an f64 ISLAND.
+// The single-lane-type lift can't carry an f64 intermediate inside an i32 store
+// (tryVectorize bails on `f64.mul: no lane-pure SIMD mapping for i32`), so this is a
+// dedicated 2-wide (f64x2) hybrid: load 2 u32 (`v128.load64_zero` → i32x4 low lanes),
+// `f64x2.convert_low_i32x4_s` into the island, `$math.log_v` + f64x2 arith + clamp,
+// `i32x4.trunc_sat_f64x2_s_zero` back out, the i32 pack, then a masked
+// `i64.store` of `i64x2.extract_lane 0` (the low 2 lanes = 2 pixels). 2 pixels/iter.
+//
+// BIT-EXACT by construction: each lane runs the scalar op (log_v is the per-lane
+// extract/repack mirror; the clamp keeps L finite & in [0,255] so `trunc_sat == |0`,
+// the ±Inf canon is a no-op and is dropped; the pack is element-wise). The conditional
+// masks are emitted in the SAME lane width as the data they select (`v>0` is i32 and
+// gates i32 stores/values; the `L>255` clamp is f64 and gates f64) — a width mismatch
+// bails. No cross-lane reordering, so no ulp drift. Speculatively-evaluated arms are
+// trap-free (log/convert/mul/min/trunc never trap; there is no div/rem). Gated until
+// proven across the corpus, then promoted like the stencil/outer-strip wins.
+
+const _toneStripTee = (n) => isArr(n) && n[0] === 'local.tee' && n.length === 3 ? n[2] : n
+
+// `(i32.wrap_i64 (i64.trunc_sat_f64_{s,u} X))` or `(i32.trunc_sat_f64_{s,u} X)` — the
+// f64→i32 `|0` bridge. Returns { inner, signed } (tee on X stripped) or null.
+function matchTruncF64(expr) {
+  if (!isArr(expr)) return null
+  if (expr[0] === 'i32.wrap_i64' && isArr(expr[1])) {
+    const t = expr[1]
+    if (t[0] === 'i64.trunc_sat_f64_s') return { inner: _toneStripTee(t[1]), signed: true }
+    if (t[0] === 'i64.trunc_sat_f64_u') return { inner: _toneStripTee(t[1]), signed: false }
+  }
+  if (expr[0] === 'i32.trunc_sat_f64_s') return { inner: _toneStripTee(expr[1]), signed: true }
+  if (expr[0] === 'i32.trunc_sat_f64_u') return { inner: _toneStripTee(expr[1]), signed: false }
+  return null
+}
+
+// The `|0` of a known-finite f64: `(select (trunc X) (i32.const 0) (f64.ne X' ±Inf))`.
+// Since the tonemap clamps L into [0,255] before the trunc, the `≠Inf` guard is always
+// true, so this lowers to a plain `trunc_sat` — returns the inner f64 to truncate.
+function matchInfCanonTone(sel) {
+  if (!isArr(sel) || sel[0] !== 'select' || sel.length !== 4) return null
+  if (!(isI32Const(sel[2]) && constNum(sel[2]) === 0)) return null
+  const c = sel[3]
+  if (!(isArr(c) && c[0] === 'f64.ne' && isArr(c[2]) && c[2][0] === 'f64.const' && /inf/i.test(String(c[2][1])))) return null
+  const tr = matchTruncF64(sel[1])
+  return tr ? tr.inner : null
+}
+
+// `base + (i<<2)` with `base` a loop-invariant array pointer (local or global). Returns
+// the base node (stride-4 ⇒ load64_zero/i64.store cover exactly 2 consecutive u32) or null.
+function matchToneAddr(addr, ind) {
+  if (!isArr(addr) || addr[0] !== 'i32.add' || addr.length !== 3) return null
+  const pair = (baseN, offN) => {
+    if (!isArr(baseN) || (baseN[0] !== 'local.get' && baseN[0] !== 'global.get')) return null
+    if (baseN[0] === 'local.get' && baseN[1] === ind) return null
+    if (isArr(offN) && offN[0] === 'i32.shl' && offN.length === 3 && isLocalGet(offN[1], ind) && constNum(offN[2]) === 2) return baseN
+    return null
+  }
+  return pair(addr[1], addr[2]) || pair(addr[2], addr[1])
+}
+
+const _toneUnwrapArm = (arm) => {  // arm = ['then'|'else', ...stmts]; unwrap a single nested block
+  let body = arm.slice(1)
+  if (body.length === 1 && isArr(body[0]) && body[0][0] === 'block') {
+    const b = body[0]; let i = 1
+    if (typeof b[i] === 'string' && b[i].startsWith('$')) i++
+    if (isArr(b[i]) && b[i][0] === 'result') i++
+    body = b.slice(i)
+  }
+  return body
+}
+
+const _toneAppears = (n, name) => isArr(n) && (((n[0] === 'local.get' || n[0] === 'local.set' || n[0] === 'local.tee') && n[1] === name) || n.some(c => _toneAppears(c, name)))
+
+// First WRITE of `name`: returns { stmtIdx, nested } (nested = inside an `if`) or null.
+function _toneFirstWrite(body, name) {
+  for (let i = 0; i < body.length; i++) {
+    let found = false, nested = false
+    const w = (n, depth) => {
+      if (found || !isArr(n)) return
+      if ((n[0] === 'local.set' || n[0] === 'local.tee') && n[1] === name) { found = true; nested = depth > 0; return }
+      const d = depth + (n[0] === 'if' ? 1 : 0)
+      for (let j = 1; j < n.length; j++) w(n[j], d)
+    }
+    w(body[i], 0)
+    if (found) return { stmtIdx: i, nested }
+  }
+  return null
+}
+
+// Mixed-lane log-tonemap: i32 dens[i] → f64 log → i32 pack → px[i]. See the block comment above.
+function tryToneMap(bl, fnLocals, freshIdRef, enabled) {
+  if (!enabled || !bl) return null
+  const { incVar, bound, boundLocal, body, preamble } = bl
+  if (!boundLocal && !isI32Const(bound)) return null   // bound must be loop-invariant
+
+  // Shape gate: exactly one i32.store + ≥1 i32.load, all at `base+(i<<2)`, plus the f64
+  // island signature (`f64.convert_i32_*`). Any other-width load/store declines. The
+  // f64-convert requirement is what distinguishes this from a plain i32 map (tryVectorize,
+  // which runs earlier and already owns those).
+  let hasConvert = false, storeCount = 0, loadCount = 0, ok = true
+  const scan = (n) => {
+    if (!ok || !isArr(n)) return
+    const o = n[0]
+    if (o === 'f64.convert_i32_s' || o === 'f64.convert_i32_u') hasConvert = true
+    if (o === 'i32.store') { storeCount++; if (!matchToneAddr(n[1], incVar)) ok = false; scan(n[2]); return }
+    if (o === 'i32.load') { loadCount++; if (!matchToneAddr(n[1], incVar)) ok = false; return }
+    if (LOAD_OPS[o] || STORE_OPS[o]) { ok = false; return }  // any wider/narrower memop → not this shape
+    for (let i = 1; i < n.length; i++) scan(n[i])
+  }
+  for (const s of body) scan(s)
+  // 1 store (unconditional, attractors) or 2 (the then/else arms of a conditional store,
+  // bifurcation/fern — both write the same pixel and collapse to one masked store).
+  if (!ok || !hasConvert || storeCount < 1 || storeCount > 2 || loadCount < 1) return null
+  if (body.some(hasGlobalSet)) return null
+
+  // Classify locals (mirrors tryVectorize): written ⇒ lane (first access must be a write,
+  // else loop-carried), unwritten ⇒ invariant.
+  const writes = new Set()
+  for (const s of body) collectWrites(s, writes)
+  if (boundLocal && writes.has(boundLocal)) return null
+  const referenced = new Set()
+  const collectRefs = (n) => {
+    if (!isArr(n)) return
+    if ((n[0] === 'local.get' || n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') referenced.add(n[1])
+    for (let i = 1; i < n.length; i++) collectRefs(n[i])
+  }
+  for (const s of body) collectRefs(s)
+  const localKind = new Map()
+  for (const name of referenced) {
+    if (name === incVar) continue
+    if (writes.has(name)) {
+      let firstKind = null
+      for (const s of body) { const k = firstAccess(s, name); if (k) { firstKind = k; break } }
+      if (firstKind === 'read') return null   // loop-carried
+      localKind.set(name, 'lane')
+    } else localKind.set(name, 'invariant')
+  }
+
+  // Liveness gate: a lane local first ASSIGNED inside an `if` is set speculatively
+  // (unconditionally) — sound only if it never leaks past that statement (else a false
+  // lane would read a value scalar never produced). Bail otherwise.
+  for (const [name, kind] of localKind) {
+    if (kind !== 'lane') continue
+    const fw = _toneFirstWrite(body, name)
+    if (fw && fw.nested) {
+      for (let i = 0; i < body.length; i++) if (i !== fw.stmtIdx && _toneAppears(body[i], name)) return null
+    }
+  }
+
+  const ctx = { extraLocals: [], fail: false, failReason: null }   // only liftFail (fail/failReason) + freshMask (extraLocals) read it
+  const newLanedLocals = new Map()       // origName → { laneName }
+  const toneSetBefore = new Set()         // lane locals already assigned (conditional-merge gate)
+  const laned = (name) => { let r = newLanedLocals.get(name); if (!r) { r = { laneName: `${name}__v` }; newLanedLocals.set(name, r) } return r.laneName }
+  const freshMask = () => { const mt = `$__mask${freshIdRef.next++}`; ctx.extraLocals.push(['local', mt, 'v128']); return mt }
+
+  // The ctx-using lifters are NESTED function declarations that CAPTURE the state above (like
+  // scanForLoadsStores) — taking `ctx` as a param instead would make jz's self-host inference
+  // mistype the recursive lifter's `ctx` (the recursive call site can't agree on i32, so it
+  // stays boxed f64 and its callers emit a bad i64.reinterpret_f64). Capturing sidesteps that.
+
+  // Result lane width of a value expr ('i32' | 'f64' | 'x') — keeps a conditional's mask the
+  // SAME width as the data it selects (a mismatch bails).
+  function toneWidth(e) {
+    if (!isArr(e)) return 'x'
+    const o = e[0]
+    if (o === 'f64.const' || o === 'f64.convert_i32_s' || o === 'f64.convert_i32_u' || o === 'call') return 'f64'
+    if (o === 'i32.const' || o === 'i32.wrap_i64' || o === 'i32.trunc_sat_f64_s' || o === 'i32.trunc_sat_f64_u') return 'i32'
+    if (o === 'local.get') return fnLocals.get(e[1]) === 'f64' ? 'f64' : 'i32'
+    if (o === 'select') return toneWidth(e[1])
+    if (o === 'if') return isArr(e[1]) && e[1][1] === 'f64' ? 'f64' : 'i32'
+    if (o.startsWith('f64.')) return 'f64'
+    if (o.startsWith('i32.')) return 'i32'
+    return 'x'
+  }
+
+  // Lift one value expression to v128. Result lane type comes from the op (f64.* → f64x2,
+  // i32.* → i32x4; convert/trunc bridge between them). Bit-exact per lane.
+  function liftV(expr) {
+    if (!isArr(expr)) return liftFail(ctx, 'tonemap: non-expression operand')
+    const op = expr[0]
+    if ((op === 'f64.convert_i32_s' || op === 'f64.convert_i32_u') && expr.length === 2) {
+      const inner = expr[1]
+      if (isArr(inner) && (inner[0] === 'global.get' || inner[0] === 'i32.const' ||
+          (inner[0] === 'local.get' && localKind.get(inner[1]) === 'invariant')))
+        return ['f64x2.splat', expr]   // loop-invariant convert: scalar-then-splat, bit-exact
+      const a = liftV(inner); if (ctx.fail) return null
+      return [op === 'f64.convert_i32_s' ? 'f64x2.convert_low_i32x4_s' : 'f64x2.convert_low_i32x4_u', a]
+    }
+    const tr = matchTruncF64(expr)   // f64 → i32 `|0` bridge
+    if (tr) { const a = liftV(tr.inner); if (ctx.fail) return null; return [tr.signed ? 'i32x4.trunc_sat_f64x2_s_zero' : 'i32x4.trunc_sat_f64x2_u_zero', a] }
+    if (op === 'i32.load' && expr.length === 2) return ['v128.load64_zero', expr[1]]   // address kept scalar
+    if (op === 'i32.const') return ['i32x4.splat', expr]
+    if (op === 'f64.const') return ['f64x2.splat', expr]
+    if (op === 'local.get' && typeof expr[1] === 'string') {
+      const name = expr[1], kind = localKind.get(name)
+      if (kind === 'lane') return ['local.get', laned(name)]
+      if (kind === 'invariant') return [fnLocals.get(name) === 'f64' ? 'f64x2.splat' : 'i32x4.splat', expr]
+      return liftFail(ctx, `tonemap: ${name} address/induction var used as lane data`)
+    }
+    if (op === 'call' && PPC_CALL2[expr[1]]) {   // transcendental → its 2-wide mirror
+      const args = []
+      for (let i = 2; i < expr.length; i++) { const a = liftV(expr[i]); if (ctx.fail) return null; args.push(a) }
+      return ['call', PPC_CALL2[expr[1]], ...args]
+    }
+    if (op === 'select' && expr.length === 4) {
+      const inf = matchInfCanonTone(expr)
+      if (inf) { const a = liftV(inf); if (ctx.fail) return null; return ['i32x4.trunc_sat_f64x2_s_zero', a] }
+      return liftSel(expr[1], expr[2], expr[3])
+    }
+    if (op === 'if' && isArr(expr[1]) && expr[1][0] === 'result' && isArr(expr[3]) && expr[3][0] === 'then' && isArr(expr[4]) && expr[4][0] === 'else')
+      return liftSel(expr[3][1], expr[4][1], expr[2])
+    const insl = op.startsWith('f64.') ? 'f64' : (op.startsWith('i32.') ? 'i32' : 'x')
+    const entry = LANE_PURE[insl]?.get(op)
+    if (entry) {
+      const a = liftV(expr[1]); if (ctx.fail) return null
+      if (entry.shamtScalar) {
+        const b = expr[2]
+        if (!isI32Const(b) && !(isArr(b) && b[0] === 'local.get' && localKind.get(b[1]) === 'invariant'))
+          return liftFail(ctx, `tonemap: ${op}: shift amount not constant/invariant`)
+        return [entry.simd, a, b]
+      }
+      if (expr.length === 2) return [entry.simd, a]
+      const b = liftV(expr[2]); if (ctx.fail) return null
+      return [entry.simd, a, b]
+    }
+    return liftFail(ctx, `tonemap: ${op}: no lane mapping`)
+  }
+
+  // Lane-comparison mask, required to match the selected data width (a LOCAL `c` — never
+  // reassign the param). Returns the mask expr or null on bail.
+  function liftMask(cond, dataTy) {
+    let c = cond
+    if (isArr(c) && c[0] === 'i32.ne' && isI32Const(c[2]) && c[2][1] === 0) c = c[1]
+    if (!isArr(c) || c.length !== 3) return liftFail(ctx, 'tonemap: condition is not a comparison')
+    const condTy = c[0].startsWith('f64.') ? 'f64' : (c[0].startsWith('i32.') ? 'i32' : 'x')
+    if (condTy !== dataTy) return liftFail(ctx, `tonemap: mask width ${condTy} ≠ data width ${dataTy}`)
+    const cmp = LANE_COMPARE[condTy]?.[c[0]]
+    if (!cmp) return liftFail(ctx, `tonemap: ${c[0]}: not a lane comparison`)
+    const ca = liftV(c[1]); if (ctx.fail) return null
+    const cb = liftV(c[2]); if (ctx.fail) return null
+    return [cmp, ca, cb]
+  }
+
+  // `cond ? a : b` → bitselect(a, b, mask(cond)); mask in the branch's lane width.
+  function liftSel(a, b, cond) {
+    const m = liftMask(cond, toneWidth(a)); if (ctx.fail) return null
+    const av = liftV(a); if (ctx.fail) return null
+    const bv = liftV(b); if (ctx.fail) return null
+    const mt = freshMask()
+    return ['block', ['result', 'v128'], ['local.set', mt, m], ['v128.bitselect', av, bv, ['local.get', mt]]]
+  }
+
+  // Lift one statement, pushing v128 stmts into `out`. Sets ctx.fail on any bail.
+  function liftS(stmt, out) {
+    if (!isArr(stmt)) { liftFail(ctx, 'tonemap: non-array statement'); return }
+    const op = stmt[0]
+    if (op === 'block') {
+      let i = 1
+      if (typeof stmt[i] === 'string' && stmt[i].startsWith('$')) i++
+      if (isArr(stmt[i]) && stmt[i][0] === 'result') i++
+      for (const s of stmt.slice(i)) { liftS(s, out); if (ctx.fail) return }
+      return
+    }
+    if (op === 'local.set' && typeof stmt[1] === 'string' && stmt.length === 3) {
+      const name = stmt[1]
+      if (localKind.get(name) !== 'lane') { liftFail(ctx, `tonemap: set of non-lane ${name}`); return }
+      const v = liftV(stmt[2]); if (ctx.fail) return
+      out.push(['local.set', laned(name), v]); toneSetBefore.add(name); return
+    }
+    if (STORE_OPS[op]) {   // i32.store ADDR VAL → masked i64.store of the low 2 lanes (2 pixels)
+      if (op !== 'i32.store' || stmt.length !== 3) { liftFail(ctx, `tonemap: unsupported store ${op}`); return }
+      const v = liftV(stmt[2]); if (ctx.fail) return
+      out.push(['i64.store', stmt[1], ['i64x2.extract_lane', 0, v]]); return
+    }
+    if (op === 'if' && isArr(stmt[2]) && stmt[2][0] === 'then') {
+      const hasElse = isArr(stmt[3]) && stmt[3][0] === 'else'
+      const thenStmts = _toneUnwrapArm(stmt[2])
+      const elseStmts = hasElse ? _toneUnwrapArm(stmt[3]) : null
+      const thenLast = thenStmts[thenStmts.length - 1]
+      const elseLast = elseStmts && elseStmts[elseStmts.length - 1]
+      const thenStore = isArr(thenLast) && STORE_OPS[thenLast[0]] && thenLast.length === 3
+      const elseStore = elseLast && isArr(elseLast) && STORE_OPS[elseLast[0]] && elseLast.length === 3
+      // (a) Conditional STORE — both arms (or then-only) end in a store to the same address.
+      if (thenStore && (elseStore || !hasElse)) {
+        if (elseStore && JSON.stringify(thenLast[1]) !== JSON.stringify(elseLast[1])) { liftFail(ctx, 'tonemap: arms store to different addresses'); return }
+        for (const s of thenStmts.slice(0, -1)) { liftS(s, out); if (ctx.fail) return }
+        if (hasElse) for (const s of elseStmts.slice(0, -1)) { liftS(s, out); if (ctx.fail) return }
+        const thenVal = liftV(thenLast[2]); if (ctx.fail) return
+        const elseVal = elseStore ? liftV(elseLast[2]) : ['v128.load64_zero', thenLast[1]]
+        if (ctx.fail) return
+        const m = liftMask(stmt[1], 'i32'); if (ctx.fail) return
+        const mt = freshMask()
+        out.push(['local.set', mt, m],
+          ['i64.store', thenLast[1], ['i64x2.extract_lane', 0, ['v128.bitselect', thenVal, elseVal, ['local.get', mt]]]])
+        return
+      }
+      // (b) Conditional VALUE update — `if (cond) { L = …; … }` (no else) updating lane locals.
+      if (!hasElse) {
+        for (const s of thenStmts) {
+          if (!(isArr(s) && s[0] === 'local.set' && typeof s[1] === 'string' && s.length === 3 && localKind.get(s[1]) === 'lane')) {
+            liftFail(ctx, 'tonemap: no-else arm is not a lane update'); return
+          }
+          const name = s[1], ty = fnLocals.get(name) === 'f64' ? 'f64' : 'i32'
+          const xv = liftV(s[2]); if (ctx.fail) return
+          const ln = laned(name)
+          if (toneSetBefore.has(name)) {
+            const m = liftMask(stmt[1], ty); if (ctx.fail) return   // conditional merge
+            const mt = freshMask()
+            out.push(['local.set', mt, m], ['local.set', ln, ['v128.bitselect', xv, ['local.get', ln], ['local.get', mt]]])
+          } else {
+            out.push(['local.set', ln, xv]); toneSetBefore.add(name)   // first, unconditional (liveness-gated)
+          }
+        }
+        return
+      }
+      liftFail(ctx, 'tonemap: unsupported if shape'); return
+    }
+    liftFail(ctx, `tonemap: unsupported statement ${op}`)
+  }
+
+  const lifted = []
+  for (const s of body) { liftS(s, lifted); if (ctx.fail) return null }
+  if (!lifted.length) return null
+
+  // 2-wide SIMD wrapper (LANES=2, the f64x2 island's width). Scalar tail = original block.
+  const LANES = 2
+  const id = freshIdRef.next++
+  const simdBoundName = `$__simd_bound${id}`, simdBrk = `$__simd_brk${id}`, simdLoop = `$__simd_loop${id}`
+  const boundExpr = boundLocal ? ['local.get', boundLocal] : bound
+  const simdBlock = ['block', simdBrk,
+    ['loop', simdLoop,
+      ['br_if', simdBrk, ['i32.eqz', ['i32.lt_s', ['local.get', incVar], ['local.get', simdBoundName]]]],
+      ...lifted,
+      ['local.set', incVar, ['i32.add', ['local.get', incVar], ['i32.const', LANES]]],
+      ['br', simdLoop]]]
+  const boundSetup = ['local.set', simdBoundName, ['i32.and', boundExpr, ['i32.const', -LANES]]]
+  const wrapper = ['block', ...preamble.map(cloneNode), boundSetup, simdBlock, bl.blockNode]
+  const newLocalDecls = [
+    ['local', simdBoundName, 'i32'],
+    ...[...newLanedLocals.values()].map(({ laneName }) => ['local', laneName, 'v128']),
+    ...ctx.extraLocals,
+  ]
+  return { wrapper, newLocalDecls }
+}
+
+// ---- Pass entry ------------------------------------------------------------
+
+/**
+ * Walk a function looking for vectorizable (block (loop)) pairs, in-place.
+ * Adds new locals to the function header.
+ */
+export function vectorizeLaneLocal(fn, multiAcc = false, relaxedFma = false, blurMP = true, whyNot = false, stencil = false, outerStrip = false, pureFuncMap = null, toneMap = false) {
+  if (!isArr(fn) || fn[0] !== 'func') return
+  const bodyStart = findBodyStart(fn)
+  if (bodyStart < 0) return
+  const fnName = typeof fn[1] === 'string' ? fn[1] : '(anon)'
+  let whyNotN = 0
+
+  // Build local-name → wasm-type map.
+  const fnLocals = new Map()
+  for (let i = 2; i < bodyStart; i++) {
+    const d = fn[i]
+    if (isArr(d) && d[0] === 'local' && typeof d[1] === 'string' && typeof d[2] === 'string') {
+      fnLocals.set(d[1], d[2])
+    } else if (isArr(d) && d[0] === 'param' && typeof d[1] === 'string' && typeof d[2] === 'string') {
+      fnLocals.set(d[1], d[2])
+    }
+  }
+
+  const freshIdRef = { next: 0 }
+  const newLocalDeclsAll = []
+
+  vectorizeStraightLineF64DotPairsIn(fn, fnLocals, freshIdRef, newLocalDeclsAll, relaxedFma)
 
   // Walk body recursively. Process inner-most matches first (post-order)
   // so we don't try to vectorize an outer loop whose inner is the lane-local one.
@@ -1855,20 +4605,56 @@ export function vectorizeLaneLocal(fn) {
       if (isArr(node[i])) walk(node, i)
     }
     if (node[0] === 'block') {
-      const r = tryMemCopyFill(node, fnLocals, freshIdRef)
-        ?? tryVectorize(node, fnLocals, freshIdRef)
-        ?? tryReduceVectorize(node, fnLocals, freshIdRef)
-        ?? tryByteScan(node, fnLocals, freshIdRef)
-        ?? tryStrengthReduceIV(node, fnLocals, freshIdRef)
+      if (_whyNotActive) _whyNotReason = null
+      // Recognition layer: match the canonical (block (loop)) scaffold ONCE; the
+      // inner-scaffold lifters (memcpy/map/reduce/map-reduce/byte-scan) consume the
+      // descriptor instead of each re-matching. The outer-pixel + special-shape
+      // recognizers (divergent-escape, ramp-map, blur, channel-reduce, per-pixel)
+      // do their own matching on the raw node. Order is preserved exactly — it is
+      // load-bearing (first match wins).
+      const bl = matchBlockLoop(node, { allowPreamble: true })
+      let r = tryDivergentEscapeVectorize(node, fnLocals, freshIdRef)
+        ?? tryMemCopyFill(bl, fnLocals, freshIdRef)
+        ?? tryVectorize(bl, fnLocals, freshIdRef)
+        ?? tryReduceVectorize(bl, fnLocals, freshIdRef, multiAcc)
+        ?? tryMapReduceVectorize(bl, fnLocals, freshIdRef)
+        ?? tryStencil(node, fnLocals, freshIdRef, stencil)
+        ?? tryRampMap(node, fnLocals, freshIdRef)
+        ?? (blurMP ? tryBlurMultiPixel(node, fnLocals, freshIdRef) : null)
+        ?? tryChannelReduce(node, fnLocals, freshIdRef)
+        ?? tryByteScan(bl, fnLocals, freshIdRef)
+        ?? tryPerPixelColor(node, fnLocals, freshIdRef, pureFuncMap)
+        ?? tryOuterStrip(node, fnLocals, freshIdRef, outerStrip)
+        ?? tryToneMap(bl, fnLocals, freshIdRef, toneMap)
+      // --why-not-simd: a canonical loop-shaped candidate that no SIMD pass took.
+      // Reported BEFORE the scalar strength-reduce fallback (which fires on most
+      // affine loops and would otherwise mask "didn't vectorize"). Diagnostic only.
+      if (!r && _whyNotActive && (bl || matchOuterPixelLoop(node))) {
+        whyNotN++
+        warn('simd-why-not',
+          `${fnName}: loop #${whyNotN} not vectorized — ${_whyNotReason || 'no SIMD-liftable shape (loop-carried dependency, non-affine address, or unsupported control flow)'}`,
+          { fn: `${fnName}#${whyNotN}` })
+      }
+      // Scalar IV strength-reduction is a non-SIMD fallback; it may still fire.
+      r = r ?? tryStrengthReduceIV(bl, fnLocals, freshIdRef)
       if (r) {
         parent[idx] = r.wrapper
         newLocalDeclsAll.push(...r.newLocalDecls)
       }
     }
   }
+  _whyNotActive = whyNot
   for (let i = bodyStart; i < fn.length; i++) walk(fn, i)
+  _whyNotActive = false
 
   if (newLocalDeclsAll.length) {
-    fn.splice(bodyStart, 0, ...newLocalDeclsAll)
+    // Sibling loops (and the straight-line dot pass) can each lift the SAME source
+    // local to an identically-named `$name__v` v128 scratch. Post-order vectorizes
+    // innermost-first and an outer loop bails once its inner became a wrapper block,
+    // so no two NESTED loops ever share a lift — every collision is between
+    // SEQUENTIAL loops, where one shared scratch is correct (each writes its lanes
+    // before reading). Declaring a local twice is invalid wasm ("duplicate local"),
+    // so keep one decl per name (all dups are the identical `['local', name, 'v128']`).
+    fn.splice(bodyStart, 0, ...new Map(newLocalDeclsAll.map(d => [d[1], d])).values())
   }
 }