jz 0.6.0 → 0.7.0

package/src/prepare/index.js

@@ -44,7 +44,7 @@ import { recordGlobalRep } from '../compile/infer.js'
 import { isFuncRef } from '../ir.js'
 import {
   CTORS, COLLECTION_CTORS, TIMER_NAMES,
-  hasModule, includeModule,
+  hasModule, includeModule, includeMods,
   includeForArrayAccess, includeForArrayLiteral, includeForArrayPattern, includeForCallableValue,
   includeForGenericMethod, includeForKnownKeyIteration, includeForNamedCall, includeForNumericCoercion,
   includeForObjectLiteral, includeForObjectPattern, includeForOp, includeForProperty, includeForRuntimeCtor,
@@ -321,6 +321,30 @@ function lookupStaticStringArray(name) {
   return ctx.scope.shapeStrArrays?.get(resolved) ?? null
 }
 
+/** Evaluate a constant numeric expression (number literals + basic arithmetic) for
+ *  compile-time string/template folding. Returns null when it isn't a pure-number
+ *  constant — string `+` and dynamic parts fall through to the caller's runtime path. */
+function constNum(node) {
+  if (Array.isArray(node) && node[0] == null && typeof node[1] === 'number') return node[1]
+  if (!Array.isArray(node)) return null
+  const [op, a, b] = node
+  if ((op === 'u-' || op === '-' || op === '+') && b === undefined) {
+    const x = constNum(a)
+    return x == null ? null : op === 'u-' || op === '-' ? -x : +x
+  }
+  const x = constNum(a), y = constNum(b)
+  if (x == null || y == null) return null
+  switch (op) {
+    case '+': return x + y
+    case '-': return x - y
+    case '*': return x * y
+    case '/': return y === 0 ? null : x / y
+    case '%': return y === 0 ? null : x % y
+    case '**': return x ** y
+  }
+  return null
+}
+
 function staticStringExpr(node) {
   const lit = stringValue(node)
   if (lit != null) return lit
@@ -341,7 +365,11 @@ function staticStringExpr(node) {
   if (op === '`') {
     let out = ''
     for (const part of args) {
-      const s = staticStringExpr(part)
+      let s = staticStringExpr(part)
+      // A numeric interpolation (`${123}`, `${1+2}`) is a constant in string context —
+      // ToString it so a fully-static template folds to one literal instead of a runtime
+      // concat. (Only the template case stringifies numbers; `+` stays polymorphic.)
+      if (s == null) { const n = constNum(part); if (n != null) s = String(n) }
       if (s == null) return null
       out += s
     }
@@ -383,7 +411,7 @@ function resolveImportMeta(spec) {
 
 function recordModuleInitFacts(root) {
   const facts = ctx.module.initFacts ||= {
-    dynVars: new Set(), anyDyn: false, hasSchemaLiterals: false,
+    dynVars: new Set(), dynWriteVars: new Set(), anyDyn: false, hasSchemaLiterals: false,
     hasFuncValue: false, timerNames: new Set(),
     maxDef: 0, maxCall: 0, hasRest: false, hasSpread: false,
     writtenProps: new Set(),
@@ -458,6 +486,11 @@ export default function prepare(node) {
   // import would cycle (autoload imports every module via module/index.js).
   ctx.module.include = includeModule
   includeModule('core')
+  // Empty or whitespace-only source parses to a bare '' — an empty program, not an
+  // identifier reference. Normalize to an empty statement so it compiles to a bare
+  // `(module)` instead of a `(local.get $)` against a zero-length name. (A non-empty
+  // bare identifier like `foo` parses to `'foo'` and stays a real reference.)
+  if (node === '') node = [';']
   validateCoalesceMixing(node)  // ES2020: reject unparenthesized `??` mixed with `||`/`&&`
   normalizeIdents(node)
   fuseSparseMapReads(node)  // AST-level fusion; needs pre-resolution shape — defined at end of file
@@ -1246,7 +1279,7 @@ function foldNamespaceIntrospection(callee, args) {
 // Compiler-internal synthetic callees: emit-handled intrinsics, never user
 // function values — so a bare reference must not pull in the callable-value
 // (function table / closure) machinery.
-const INTRINSIC_CALLEES = new Set(['__iter_arr'])
+const INTRINSIC_CALLEES = new Set(['__iter_arr', '__keys_ro'])
 
 function resolveCallee(callee, args) {
   if (typeof callee === 'string') {
@@ -1427,6 +1460,10 @@ const handlers = {
 
   // Template literal: [``, part, ...] → fused single-allocation string concat.
   '`'(...parts) {
+    // Fully-static template (`a${123}b`, `hello ${1+2} world`) folds to a single string
+    // literal — a static data segment / SSO box, no runtime concat and no heap machinery.
+    const folded = staticStringExpr(['`', ...parts])
+    if (folded != null) return staticString(folded)
     includeForStringValue()
     const nodes = parts.map(p =>
       Array.isArray(p) && p[0] == null && typeof p[1] === 'string' ? ['str', p[1]] : prep(p))
@@ -1628,6 +1665,15 @@ const handlers = {
       for (const i of decl.slice(1))
         if (Array.isArray(i) && i[0] === '=' && typeof i[1] === 'string')
           ctx.func.exports[i[1]] = true
+    // export name → bare-identifier re-export (shorthand for `export { name }`).
+    // Register the binding and emit nothing; without this the name falls through
+    // to `prep(decl)` below and compiles as a dead `global.get; drop` statement
+    // while the export itself is silently lost.
+    if (typeof decl === 'string') {
+      const resolved = ctx.scope.chain[decl]
+      ctx.func.exports[decl] = (resolved && resolved !== decl) ? resolved : decl
+      return null
+    }
     // export { name, name as alias } from './mod' or export * from './mod'
     if (Array.isArray(decl) && decl[0] === 'from') {
       const mod = decl[2]?.[1]
@@ -1821,7 +1867,11 @@ const handlers = {
     // alone wrongly folds `-5n`, and negating the bigint here yields garbage (-2^63+5).
     // `typeof !== 'bigint'` excludes it in both engines (real JS: 'bigint'; jz: matches
     // 'bigint'). Bigint negation then flows to emit's i64.sub(0,·) path correctly.
-    if (b === undefined) { const na = prep(a); return isLit(na) && typeof na[1] === 'number' && typeof na[1] !== 'bigint' ? [, -na[1]] : ['u-', na] }
+    // `-0` is NOT folded: the self-host kernel evaluates the constant `-na[1]` with
+    // i32 negation (i32 has no signed zero), collapsing -0→+0 — observable via sort's
+    // -0<+0 tiebreak, Object.is, and 1/x. Leaving it as a runtime `u-` emits f64.neg,
+    // which preserves the sign in both engines; V8 re-folds it, so no native cost.
+    if (b === undefined) { const na = prep(a); return isLit(na) && typeof na[1] === 'number' && typeof na[1] !== 'bigint' && na[1] !== 0 ? [, -na[1]] : ['u-', na] }
     return ['-', prep(a), prep(b)]
   },
 
@@ -2123,10 +2173,17 @@ const handlers = {
       // `[null, null]`, `undefined` is `[null]` (empty value slot). A numeric/string literal
       // `[null, v]` has a non-nullish value slot, so `src[1] == null` discriminates them.
       const nullish = Array.isArray(src) && src[0] == null && src[1] == null
+      // `__keys_ro` is for-in's read-only key list: identical to Object.keys, but
+      // when the receiver has a complete static schema the keys are a compile-time
+      // constant, so it pools ONE static-data array instead of allocating a fresh
+      // one each evaluation — the per-iteration heap-growth cliff (jz#deopt-forin).
+      // Sound only because for-in reads ks[i]/ks.length and never mutates (unlike
+      // user Object.keys, which permits in-place `.sort()`/`.reverse()`).
+      includeMods('core', 'object', 'string')
       const keysExpr = nullish ? ['[]', null]
         : typeof src === 'string'
-          ? ['?', ['==', src, [null, null]], ['[]', null], ['()', ['.', 'Object', 'keys'], src]]
-          : ['()', ['.', 'Object', 'keys'], src]
+          ? ['?', ['==', src, [null, null]], ['[]', null], ['()', '__keys_ro', src]]
+          : ['()', '__keys_ro', src]
       const ks = `${T}fik${ctx.func.uniq++}`, ix = `${T}fii${ctx.func.uniq++}`, lenV = `${T}fil${ctx.func.uniq++}`
       const decls = ['let',
         ['=', ks, keysExpr],

package/src/prepare/lift-iife.js

@@ -0,0 +1,149 @@
+/**
+ * Lambda-lift immediately-invoked arrow literals (IIFEs).
+ *
+ * `(params => body)(args)` is lowered by jz's default path as a CLOSURE value invoked
+ * via `call_indirect` through the uniform-f64 closure ABI. That ABI can't carry a
+ * `v128`, so a SIMD IIFE — `(() => f32x4.…)()` — emits invalid wasm; it also pays a
+ * closure alloc + indirect call for what is really a direct, single call.
+ *
+ * This pass rewrites each such IIFE into a TOP-LEVEL function whose free variables are
+ * appended as parameters, and replaces the call with a direct call passing those vars:
+ *
+ *   let r = (() => { let t = f32x4.mul(a, a); return f32x4.add(t, …) })()   // captures a
+ *     ⇓
+ *   let ⟨lift⟩ = (a) => { let t = f32x4.mul(a, a); return f32x4.add(t, …) }  // hoisted to top
+ *   let r = ⟨lift⟩(a)                                                        // direct call
+ *
+ * The lifted function flows through jz's monomorphic typed-function path (like any
+ * `let f = (x) => …; f(v)`), so a captured/returned `v128` is typed `v128` from the
+ * single call site — and `inlineOnce` then folds the single-caller body back in, so
+ * there's no residual call. Capture is BY VALUE, which is exact for a synchronous
+ * immediate invocation (the value at the call instant == what the closure would read);
+ * the one divergence — a capture MUTATED inside the body, which a closure writes back
+ * through its cell — is the bail below.
+ *
+ * Bails (leaving the closure path untouched) on: non-plain params (rest / default /
+ * destructured), or a body that assigns any captured variable. Everything else folds.
+ *
+ * @module prepare/lift-iife
+ */
+import { T, extractParams, classifyParam } from '../ast.js'
+import { findFreeVars, findMutations } from '../compile/analyze-scans.js'
+
+// Build a comma-list operand node (the parser's shape) from an array of nodes.
+const commaList = (items) =>
+  items.length === 0 ? null : items.length === 1 ? items[0] : [',', ...items]
+
+// Unwrap parenthesis nodes (`['()', x]`, length 2) to reach the inner expression.
+const unwrapParens = (n) => {
+  while (Array.isArray(n) && n[0] === '()' && n.length === 2) n = n[1]
+  return n
+}
+
+// `['()', callee, args]` (length 3) whose callee unwraps to an arrow literal → that arrow.
+const iifeArrow = (n) => {
+  if (!Array.isArray(n) || n[0] !== '()' || n.length !== 3) return null
+  const callee = unwrapParens(n[1])
+  return Array.isArray(callee) && callee[0] === '=>' ? callee : null
+}
+
+// Plain-name params only; anything else (rest/default/destructure) → null (bail).
+const plainParamNames = (arrow) => {
+  const out = []
+  for (const p of extractParams(arrow[1])) {
+    const c = classifyParam(p)
+    if (c.kind !== 'plain' || typeof c.name !== 'string') return null
+    out.push(c.name)
+  }
+  return out
+}
+
+// Names a function binds: its plain params + every let/const name in its body, NOT
+// descending into nested arrows (their locals are their own). Over-approximating
+// within a frame is safe — a free ident only resolves to one of these if it's
+// actually in scope at the reference. Used to scope captures to enclosing LOCALS
+// (module-level names stay global refs in the lifted body, never captured).
+const collectDeclNames = (decl, out) => {
+  if (!Array.isArray(decl)) return
+  if (decl[0] === '=' && typeof decl[1] === 'string') out.add(decl[1])
+  else if (decl[0] === '=' && Array.isArray(decl[1])) collectPatternNames(decl[1], out)
+  else if (typeof decl[1] === 'string') out.add(decl[1])
+}
+const collectPatternNames = (pat, out) => {
+  if (typeof pat === 'string') { out.add(pat); return }
+  if (!Array.isArray(pat)) return
+  for (let i = 1; i < pat.length; i++) collectPatternNames(pat[i], out)
+}
+function functionLocals(paramNodes, body) {
+  const names = new Set()
+  for (const p of paramNodes) { const c = classifyParam(p); if (typeof c.name === 'string') names.add(c.name); else if (c.pattern) collectPatternNames(c.pattern, names) }
+  const scan = (n) => {
+    if (!Array.isArray(n)) return
+    if (n[0] === '=>') return
+    if (n[0] === 'let' || n[0] === 'const') for (const d of n.slice(1)) collectDeclNames(d, names)
+    for (let i = 1; i < n.length; i++) scan(n[i])
+  }
+  scan(body)
+  return names
+}
+
+export function liftIIFEs(ast) {
+  if (!Array.isArray(ast)) return ast
+  const lifted = []        // hoisted `['let', ['=', name, arrow]]` decls
+  let uid = 0
+
+  // Copy non-index node metadata (parser `.loc`, etc.) onto a rebuilt node so error
+  // source-locations survive the transform.
+  const copyMeta = (to, from) => { for (const k of Object.keys(from)) if (isNaN(+k)) to[k] = from[k]; return to }
+
+  // `locals` = union of every enclosing FUNCTION frame's bound names. The transform
+  // is post-order (inner IIFEs fold first) so an outer lift sees already-direct inner
+  // calls; scope tracking is top-down so each IIFE sees the right enclosing locals.
+  // Identity-preserving: a node with no lifted descendant is returned unchanged.
+  const visit = (node, locals) => {
+    if (!Array.isArray(node)) return node
+
+    // Descend into an arrow body with the frame extended by this arrow's locals.
+    if (node[0] === '=>') {
+      const inner = new Set(locals)
+      for (const n of functionLocals(extractParams(node[1]), node[2])) inner.add(n)
+      let changed = false
+      const out = node.map((c, i) => { if (i === 0) return c; const v = visit(c, inner); if (v !== c) changed = true; return v })
+      return changed ? copyMeta(out, node) : node
+    }
+
+    // Transform children first (post-order).
+    let changed = false
+    const mapped = node.map((c, i) => { if (i === 0) return c; const v = visit(c, locals); if (v !== c) changed = true; return v })
+    const base = changed ? copyMeta(mapped, node) : node
+
+    const arrow = iifeArrow(base)
+    if (!arrow) return base
+
+    const paramNames = plainParamNames(arrow)
+    if (paramNames === null) return base                // bail: non-plain params
+
+    const callArgs = base[2] == null ? [] : (Array.isArray(base[2]) && base[2][0] === ',') ? base[2].slice(1) : [base[2]]
+    if (callArgs.some(a => Array.isArray(a) && a[0] === '...')) return base   // bail: spread into a fixed-arity direct call
+
+    const body = arrow[2]
+    const captures = []
+    findFreeVars(body, new Set(paramNames), captures, locals)
+
+    const mutated = new Set()
+    findMutations(body, new Set(captures), mutated)
+    if (mutated.size) return base                       // bail: a captured var is written
+
+    // Lift: `(…params, …captures) => body`, hoisted to module top; call passes captures.
+    const name = `${T}lift${uid++}`
+    lifted.push(['let', ['=', name, ['=>', ['()', commaList([...paramNames, ...captures])], body]]])
+    return copyMeta(['()', name, commaList([...callArgs, ...captures])], base)
+  }
+
+  const result = visit(ast, new Set())
+  if (!lifted.length) return result
+
+  // Prepend the lifted decls to the module body (`[';', …stmts]`).
+  if (Array.isArray(result) && result[0] === ';') return [';', ...lifted, ...result.slice(1)]
+  return [';', ...lifted, result]
+}

package/src/reps.js

@@ -56,6 +56,7 @@ export const VAL = {
  * @property {boolean} [notString]        proven not a string (skips string-path guards).
  * @property {number}  [arrayElemSchema]  element object-schema id for arrays.
  * @property {string}  [arrayElemValType] element VAL.* kind for arrays.
+ * @property {string}  [arrayElemElemValType] nested element VAL.* kind (`X[i][j]`) for arrays of arrays.
  * @property {string}  [carrier]          abi carrier id override (e.g. 'jsstring').
  * @property {boolean} [unsigned]         i32 carries an unsigned value (`>>>` result).
  * @property {*}       [jsonShape]        inferred shape for the JSON.stringify fast path.
@@ -67,8 +68,8 @@ export const VAL = {
  */
 export const REP_FIELDS = new Set([
   'val', 'ptrKind', 'ptrAux', 'schemaId', 'intConst', 'intCertain', 'notString',
-  'arrayElemSchema', 'arrayElemValType', 'carrier', 'unsigned', 'jsonShape',
-  'typedCtor', 'wasm', 'nullable',
+  'arrayElemSchema', 'arrayElemValType', 'arrayElemElemValType', 'carrier', 'unsigned', 'jsonShape',
+  'typedCtor', 'wasm', 'nullable', 'neverGrown',
 ])
 
 const DBG_REPS = typeof process !== 'undefined' && process.env?.JZ_DEBUG_INVARIANTS === '1'

package/src/static.js

@@ -19,6 +19,15 @@ export function intLiteralValue(expr) {
 /** Non-negative integer literal — used for string/typed-array index bounds. */
 export const nonNegIntLiteral = (node) => { const n = intLiteralValue(node); return n != null && n >= 0 ? n : null }
 
+/** Flat-array slot key for a *bare* non-negative integer index literal `[null, k]`
+ *  — returns the stringified index ("0","1",…) so an array `a[k]` resolves through
+ *  the same SRoA `name#i` machinery as an object `o.key`. Only a literal index
+ *  qualifies (not a const-folded identifier): the key must be unambiguous at scan
+ *  time, before any rep is known. Null for dynamic / non-integer / huge indices. */
+export const staticIndexKey = (node) =>
+  Array.isArray(node) && node[0] == null && Number.isInteger(node[1]) && node[1] >= 0 && node[1] < 0x100000000
+    ? String(node[1]) : null
+
 /** Fold compile-time integer expressions (literals, const bindings, + - * <<). */
 export function constIntExpr(node) {
   let lit = intLiteralValue(node)

package/src/type.js

@@ -401,16 +401,20 @@ export function exprType(expr, locals) {
 
   // Always f64
   if (op === '/' || op === '**' || op === '[' || op === '{}' || op === 'str') return 'f64'
-  // arr[i] — typed integer arrays return i32. Only Int8/Uint8/Int16/Uint16/Int32
-  // (every value fits in signed i32). Skip Uint32: 0..2^32-1 overflows signed.
-  // During analyzeBody the in-progress typedElems is in localTypedElemsOverlay;
-  // post-analyze passes read from ctx.types.typedElem.
+  // arr[i] — integer typed arrays (Int8/Uint8/Int16/Uint16/Int32/Uint32, aux 0..5) read as i32:
+  // the element IS a 32-bit machine integer, so a binding used in integer/bitwise ops stays i32
+  // instead of round-tripping i32.load → f64 → trunc back (the deopt that made packed-pixel fade
+  // loops like lorenz slow). Uint32 reads carry the full 0..2^32-1 range as the i32 bit-pattern;
+  // ToInt32-coercing uses (& | ^ << >> >>>, i32.store) are bit-exact, and value uses that need the
+  // unsigned magnitude (compare, f64 convert) go through the elem-aux's unsigned path. Floats
+  // (Float32/Float64, aux 6/7) genuinely yield f64. typedElems: in-progress reads come from
+  // localTypedElemsOverlay during analyzeBody; post-analyze passes read ctx.types.typedElem.
   if (op === '[]') {
     if (typeof args[0] === 'string') {
       const ctor = ctx.func.localTypedElemsOverlay?.get(args[0]) ?? ctx.types.typedElem?.get(args[0])
       if (ctor) {
         const aux = typedElemAux(ctor)
-        if (aux != null && (aux & 7) <= 4) return 'i32'
+        if (aux != null && (aux & 7) <= 5) return 'i32'
       }
     }
     return 'f64'
@@ -501,7 +505,7 @@ export function exprType(expr, locals) {
     // hand a scalar back (i32x4.lane / v128.anyTrue / v128.allTrue → i32;
     // f32x4.lane → f64). See module/simd.js.
     if (typeof args[0] === 'string' && (args[0].startsWith('f32x4.') || args[0].startsWith('i32x4.') || args[0].startsWith('f64x2.') || args[0].startsWith('v128.'))) {
-      if (args[0] === 'f32x4.lane') return 'f64'
+      if (args[0] === 'f32x4.lane' || args[0] === 'f64x2.lane') return 'f64'
       if (args[0] === 'i32x4.lane' || args[0] === 'v128.anyTrue' || args[0] === 'v128.allTrue') return 'i32'
       return 'v128'
     }

package/src/wat/assemble.js

@@ -37,7 +37,7 @@ import { T } from '../ast.js'
 import { analyzeValTypes, analyzeBody } from '../compile/analyze.js'
 import { VAL } from '../reps.js'
 import { optimizeFunc, collectVolatileGlobals, collectReachableGlobalWrites, hoistGlobalPtrOffset, stablePtrGlobalNames, hoistConstantPool, specializeMkptr, specializePtrBase, sortStrPoolByFreq, arenaRewindModule } from '../optimize/index.js'
-import { emit } from '../compile/emit.js'
+import { emit, emitVoid } from '../compile/emit.js'
 import { mkPtrIR, MAX_CLOSURE_ARITY, MEM_OPS, findBodyStart } from '../ir.js'
 
 // NaN-prefix top-13-bits as BigInt — used by the static-prefix-strip pass
@@ -153,6 +153,11 @@ export function buildStartFn(ast, sec, closureFuncs, compilePendingClosures) {
   analyzeValTypes(ast)
   const normalizeIR = ir => !ir?.length ? [] : Array.isArray(ir[0]) ? ir : [ir]
 
+  // Mark module-scope emission: top-level statements run exactly once, so a constant
+  // array/object literal here is a single instance that can safely live in a static
+  // data segment (no per-call freshness to violate). Function bodies — compiled
+  // separately, and the late closures below — leave this unset and alloc fresh.
+  ctx.func.atModuleScope = true
   const moduleInits = []
   if (ctx.module.moduleInits) {
     for (const mi of ctx.module.moduleInits) {
@@ -162,7 +167,13 @@ export function buildStartFn(ast, sec, closureFuncs, compilePendingClosures) {
     }
   }
   seedGeneratedLocals(ast)
-  const init = emit(ast)
+  // __start has no result: emit the top-level program in void context so a stray
+  // value is dropped. `ast` is normally a `;` statement-sequence (each statement
+  // already void-dropped), but jzify unwraps a single-statement program to its
+  // bare expression — emitting that in value context leaves a value on the stack
+  // and the start function fails validation. emitVoid handles both shapes.
+  const init = emitVoid(ast)
+  ctx.func.atModuleScope = false
 
   // Module-scope object literals can create closure bodies while `emit(ast)`
   // runs. Those late closures may pull in stdlib helpers (notably JSON.parse)
@@ -285,6 +296,47 @@ export function buildStartFn(ast, sec, closureFuncs, compilePendingClosures) {
     sec.funcs.unshift(...closureFuncs.slice(beforeLateClosures))
 }
 
+/**
+ * Hoist constant global initializers out of `__start` into immutable inline decls.
+ *
+ * A top-level `const x = <constant>` for a non-numeric value (atom `true`/`null`/
+ * `undefined`/`NaN`, an SSO or static-string NaN-box, a folded pointer) emits a
+ * `(global.set $x (f64.const …))` into `__start`, because only *numeric* consts are
+ * folded ahead of emit. But the value is a compile-time constant, so it belongs in
+ * the decl itself — `(global $x f64 (f64.const …))` — exactly like the numeric path.
+ * That drops the store, and when it empties `__start` the start function and its
+ * directive go too. Gated to single-assignment user `const`s so we never freeze a
+ * binding something else writes.
+ */
+export function hoistConstGlobalInits(sec) {
+  const startFn = sec.start.find(n => Array.isArray(n) && n[0] === 'func' && n[1] === '$__start')
+  if (!startFn) return
+  const writes = new Map()
+  const scan = (node) => {
+    if (!Array.isArray(node)) return
+    if (node[0] === 'global.set' && typeof node[1] === 'string') writes.set(node[1], (writes.get(node[1]) || 0) + 1)
+    for (const c of node) scan(c)
+  }
+  for (const arr of [sec.funcs, sec.stdlib, sec.start]) for (const fn of arr) scan(fn)
+  for (let i = startFn.length - 1; i >= findBodyStart(startFn); i--) {
+    const stmt = startFn[i]
+    if (!Array.isArray(stmt) || stmt[0] !== 'global.set' || writes.get(stmt[1]) !== 1) continue
+    const name = typeof stmt[1] === 'string' && stmt[1][0] === '$' ? stmt[1].slice(1) : null
+    const g = name && ctx.scope.globals.get(name)
+    const c = stmt[2]
+    if (!g || !g.mut || !ctx.scope.consts?.has(name) || !ctx.scope.userGlobals?.has(name)) continue
+    if (!Array.isArray(c) || c[0] !== `${g.type}.const`) continue
+    ctx.scope.globals.set(name, { ...g, mut: false, init: c[1] })
+    startFn.splice(i, 1)
+  }
+  // Hoisting can empty `__start`. The O2 watr pass prunes a bodyless start, but at
+  // O0/O1 nothing else does — drop it (func + directive) here so a const-only module
+  // carries no start at all.
+  if (findBodyStart(startFn) >= startFn.length)
+    for (let j = sec.start.length - 1; j >= 0; j--)
+      if (Array.isArray(sec.start[j]) && sec.start[j][1] === '$__start') sec.start.splice(j, 1)
+}
+
 /**
  * Phase: closure-body dedup.
  *
@@ -420,24 +472,154 @@ export function finalizeClosureTable(sec) {
   for (const fn of sec.start) rewriteCalls(fn)
 }
 
+/**
+ * Stdlib funcs actually reachable from the emitted program. Seeds from real
+ * `call`/`return_call`/`ref.func` sites in the user funcs, `__start`, and the elem
+ * table, then closes transitively over the stdlib call graph (each reached helper's
+ * template references). Conservative by construction — a template `$__foo` in a
+ * feature-dead branch is kept, never dropped — so it's safe to gate inclusion and the
+ * memory/allocator decision on it. An eagerly-`inc`'d helper that nothing calls is
+ * absent, which is the whole point.
+ */
+function reachableStdlib(sec) {
+  const stdlib = ctx.core.stdlib
+  const reach = new Set(), stack = []
+  // Track every reached name (module-namespace `math.sin` included), but only follow
+  // those with a stdlib template. Names match `$foo`, `$__foo`, `$math.sin_core` — the
+  // dotted module funcs are the ones the `$__`-only regex used to miss, pruning live code.
+  const add = (name) => { if (!reach.has(name)) { reach.add(name); if (stdlib[name] != null) stack.push(name) } }
+  const scanIR = (node) => {
+    if (!Array.isArray(node)) return
+    if ((node[0] === 'call' || node[0] === 'return_call' || node[0] === 'ref.func') &&
+        typeof node[1] === 'string' && node[1][0] === '$') add(node[1].slice(1))
+    for (const c of node) scanIR(c)
+  }
+  for (const fn of sec.funcs) scanIR(fn)
+  for (const fn of sec.start) scanIR(fn)
+  for (const e of sec.elem)               // closure table: bare `$fn` func refs
+    if (Array.isArray(e)) for (const c of e) if (typeof c === 'string' && c[0] === '$') add(c.slice(1))
+  // A stdlib func that self-exports (`(export "__invoke_closure")`) is a host-facing
+  // entry point — the JS host calls it directly, so it's a root even when nothing in
+  // the wasm calls it. Mirrors treeshake's inline-export rooting.
+  for (const n of ctx.core.includes) {
+    const v = stdlib[n]
+    let t = ''
+    try { t = typeof v === 'function' ? v() : v } catch { t = '' }
+    if (typeof t === 'string' && t.includes('(export "')) add(n)
+  }
+  while (stack.length) {
+    const v = stdlib[stack.pop()]
+    let text = ''
+    try { text = typeof v === 'function' ? v() : v } catch { text = '' }
+    if (typeof text === 'string') for (const m of text.matchAll(/\$([A-Za-z_][A-Za-z0-9_.]*)/g)) add(m[1])
+  }
+  return reach
+}
+
+// The f64x2 stdlib mirrors the lane vectorizer (optimize/vectorize.js) injects in the LATE 'post'
+// pass — after the stdlib was pulled + treeshaken. Keep in sync with that pass's call-rewrite map
+// (PPC_CALL2). These are the ONLY helpers appendLateStdlib may add; restricting to them avoids
+// touching helpers that live in other module sections (ext-stdlib, imports) where a blind
+// referenced-but-absent scan would wrongly re-append and duplicate them.
+const LATE_VEC_HELPERS = new Set(['math.sin2', 'math.cos2', 'math.pow2', 'math.atan2_2', 'math.hypot_2', 'math.log_v', 'math.exp_v', 'math.exp2_v'])
+
+// A late pass can reference one of the f64x2 mirrors that wasn't present when the stdlib was first
+// assembled. Append any referenced-but-missing mirror body (fixpoint over their own calls, though
+// the trig mirrors call nothing). moduleArr is mutated in place; non-mirror references are left for
+// watr to resolve (a genuine missing helper is the kernel's own pull, already satisfied).
+export function appendLateStdlib(moduleArr) {
+  const stdlib = ctx.core.stdlib
+  const have = new Set()
+  for (const n of moduleArr) if (Array.isArray(n) && n[0] === 'func' && typeof n[1] === 'string') have.add(n[1])
+  let added = true
+  while (added) {
+    added = false
+    const refs = new Set()
+    const scan = (n) => { if (!Array.isArray(n)) return; if ((n[0] === 'call' || n[0] === 'return_call' || n[0] === 'ref.func') && typeof n[1] === 'string' && n[1][0] === '$') refs.add(n[1]); for (const c of n) scan(c) }
+    for (const n of moduleArr) scan(n)
+    for (const ref of refs) {
+      const name = ref.slice(1)
+      if (have.has(ref) || !LATE_VEC_HELPERS.has(name) || stdlib[name] == null) continue
+      const node = parseTemplate(typeof stdlib[name] === 'function' ? stdlib[name]() : stdlib[name])
+      moduleArr.push(node[0] === 'module' ? node[1] : node)
+      have.add(ref)
+      added = true
+    }
+  }
+}
+
 /**
  * Phase: pull stdlib + memory.
  */
 export function pullStdlib(sec) {
   resolveIncludes()
 
-  const needsMemory = [...ctx.core.includes].some(n => ctx.core.stdlib[n] && MEM_OPS.test(ctx.core.stdlib[n]))
-  if (!needsMemory) ctx.scope.globals.delete('__heap')
+  // Reachability, not inclusion, decides what the output needs. `ctx.core.includes`
+  // accumulates everything a module *might* use (eager module-load `inc`s + transitive
+  // deps), but a const array / static string literal calls none of it. So we seed from
+  // the actual call sites in the emitted funcs + __start (+ elem table) and close
+  // transitively over the stdlib call graph. An eagerly-included helper that nothing
+  // calls never enters this set — so allocator, memory, and exports reflect real use.
+  const reachable = reachableStdlib(sec)
+  const realize = (n) => { const v = ctx.core.stdlib[n]; try { return typeof v === 'function' ? v() : v } catch { return '' } }
+
+  // Two distinct needs, kept separate:
+  //  · needsAlloc — the program allocates at runtime: an allocator func is reachable,
+  //    or shared-mem string literals seed a pool __start allocs. Drives the bump
+  //    allocator (`__alloc`/`__alloc_hdr`/`__clear`), the `__heap` pointer, and the
+  //    `_alloc`/`_clear` marshalling exports.
+  //  · needsMemory — linear memory must merely *exist*: we allocate, OR a literal lives
+  //    in a static data segment (a const pointer, no allocator behind it), OR a reached
+  //    helper / inline body does a load/store, OR `__ptr_type` is reached (the module
+  //    discriminates heap tags — an `instanceof`/`typeof x==='object'` whose argument the
+  //    host marshals across the boundary). A data segment with no memory is invalid wasm,
+  //    so memory can't be gated on allocation alone.
+  const ALLOC_FUNCS = ['__alloc', '__alloc_hdr', '__alloc_hdr_n']
+  const needsAlloc = !!ctx.runtime.strPool || ALLOC_FUNCS.some(a => reachable.has(a))
+  // Memory ops can be emitted *inline* into user/start funcs (a heap-path char read
+  // loads without calling a stdlib helper), so scan the emitted bodies too.
+  const hasMemOp = (node) => Array.isArray(node) &&
+    ((typeof node[0] === 'string' && MEM_OPS.test(node[0])) || node.some(hasMemOp))
+  // `ctx.runtime.data` is never empty here — the number module seeds a static stringify
+  // prefix (`NaNInfinity…`) at offset 0; stripStaticDataPrefix removes it when unused, so
+  // the real question is whether any data lives *beyond* that strippable prefix.
+  // An explicit `{ memory: pages }` / shared-memory option is a caller request to own
+  // linear memory (e.g. to marshal host values in), independent of what the wasm itself
+  // reaches — honour it even for an otherwise-memoryless program.
+  const explicitMemory = ctx.memory.pages > 0 || !!ctx.memory.shared
+  const needsMemory = needsAlloc || explicitMemory ||
+    (ctx.runtime.data?.length || 0) > (ctx.runtime.staticDataLen || 0) ||
+    reachable.has('__ptr_type') ||
+    [...reachable].some(n => MEM_OPS.test(realize(n))) ||
+    sec.funcs.some(hasMemOp) || sec.start.some(hasMemOp)
+  // Emit only what's reachable: drop every eagerly-`inc`'d *internal* helper the program
+  // never calls. This is what lets a const-array / static-string / atom module shed the
+  // allocator, pointer dispatchers, and length helpers that an array/object module load
+  // pulled in wholesale — and it keeps the dead allocator from dangling on the `$__heap`
+  // we delete below. Scoped to `__`-prefixed names: module-namespace funcs (`math.sin`)
+  // are pulled in on demand, never eagerly, so they're already minimal and never pruned
+  // here (guarding against any reachability blind spot in a dotted-name template).
+  for (const n of [...ctx.core.includes]) if (n.startsWith('__') && !reachable.has(n)) ctx.core.includes.delete(n)
+  if (!needsAlloc) ctx.scope.globals.delete('__heap')
   if (needsMemory && ctx.module.modules.core) {
-    for (const fn of ['__alloc', '__alloc_hdr', '__clear']) ctx.core.includes.add(fn)
-    // Late-add of allocators may pull in transitive deps (__alloc → __memgrow,
-    // etc.) that the initial resolveIncludes did not yet see; re-resolve.
-    // No-op when the alloc trio was already present.
-    resolveIncludes()
-    const pages = ctx.memory.pages || 1
-    if (ctx.memory.shared) sec.imports.push(['import', '"env"', '"memory"', ['memory', pages]])
-    else sec.memory.push(['memory', ['export', '"memory"'], pages])
-    if (ctx.transform.alloc !== false && ctx.core._allocRawFuncs)
+    if (needsAlloc) {
+      for (const fn of ['__alloc', '__alloc_hdr', '__clear']) ctx.core.includes.add(fn)
+      // Late-add of allocators may pull in transitive deps (__alloc → __memgrow,
+      // etc.) that the initial resolveIncludes did not yet see; re-resolve.
+      // No-op when the alloc trio was already present.
+      resolveIncludes()
+    }
+    // Initial pages must cover the static data segment (it loads at instantiation), not
+    // just the default 1 — otherwise a module whose constants exceed 64 KiB emits a data
+    // segment that overflows its own memory. The heap grows past this on demand via
+    // __memgrow. (Shared memory loads literals via memory.init into allocated space, so
+    // its initial size isn't pinned by the data length.)
+    const dataPages = ctx.memory.shared ? 0 : Math.ceil((ctx.runtime.data?.length || 0) / 65536)
+    const pages = Math.max(ctx.memory.pages || 1, dataPages)
+    const max = ctx.memory.max || 0   // 0 = no maximum (unbounded growth)
+    if (ctx.memory.shared) sec.imports.push(['import', '"env"', '"memory"', max ? ['memory', pages, max] : ['memory', pages]])
+    else sec.memory.push(max ? ['memory', ['export', '"memory"'], pages, max] : ['memory', ['export', '"memory"'], pages])
+    if (needsAlloc && ctx.transform.alloc !== false && ctx.core._allocRawFuncs)
       sec.funcs.push(...ctx.core._allocRawFuncs.map(parseTemplate))
   }