jz 0.6.0 → 0.7.0

package/src/compile/emit.js

@@ -25,8 +25,8 @@ import {
   commaList, T, isBlockBody, isReassigned, mutatesArrayLength, isConstLiteral, constLiteralHoistable,
   hasOwnContinue, hasLabeledContinueTo, hasOwnBreakOrContinue, extractParams, classifyParam, JZ_UNDEF, TYPEOF,
 } from '../ast.js'
-import { ctx, err, inc, PTR } from '../ctx.js'
-import { nonNegIntLiteral, staticPropertyKey } from '../static.js'
+import { ctx, err, inc, warnDeopt, PTR } from '../ctx.js'
+import { nonNegIntLiteral, intLiteralValue, staticPropertyKey } from '../static.js'
 import { findFreeVars } from './analyze.js'
 import {
   containsNestedClosure, containsNestedLoop, nestedSmallLoopBudget,
@@ -41,7 +41,7 @@ import {
   NULL_IR, nullExpr, undefExpr, MAX_CLOSURE_ARITY,
   WASM_OPS, SPREAD_MUTATORS, BOXED_MUTATORS,
   mkPtrIR, ptrOffsetIR, ptrTypeIR, ptrTypeEq, dispatchByPtrType, sidecarOverride, valKindToPtr,
-  isLit, litVal, isNullishLit, isPureIR, emitNum, f64rem, toNumF64, toStrI64,
+  isLit, litVal, isNullishLit, isPureIR, emitNum, f64rem, toNumF64, toStrI64, maskBound,
   truthyIR, toBoolFromEmitted, isPostfix,
   isGlobal, isConst, usesDynProps, needsDynShadow,
   temp, tempI32, tempI64, allocPtr,
@@ -76,7 +76,22 @@ const stringOps = (node) => {
 // instead route through ToNumber (`toNumF64`), which performs ToPrimitive.
 const isI32Num = (v) => v.type === 'i32' && v.ptrKind == null
 
+// f64 arithmetic that can MINT a sign-nondeterministic NaN (0/0, ∞−∞, 0·∞, x%0): on x86
+// these are 0xFFF8…, on arm 0x7FF8…. sqrt/min/max/neg are NOT here — they canon at their
+// own emit (math.js / unary `-`), so they reach canonNum already canonical.
+const NAN_MINTING = new Set(['f64.div', 'f64.add', 'f64.sub', 'f64.mul'])
+
 const canonNum = (node) => {
+  // Fold a possibly-non-canonical NaN to the canonical number-NaN before it reaches a
+  // bit-comparing consumer (__is_truthy / untyped === / typeof), which match the canonical
+  // NaN by bits and so misread x86's 0xFFF8 as truthy. ONLY an un-canon'd NaN-minting
+  // arithmetic op can carry such a value — literals, i32-conversions, opaque locals/calls
+  // (canonical by the canon-at-source invariant) and already-canon'd shapes don't — so
+  // skipping everything else keeps the size win. (The broken middle ground was
+  // `02873d0`'s `isNumericIR` skip, which dropped canon for f64.div too → x86 miscompile.)
+  const arith = Array.isArray(node) &&
+    (NAN_MINTING.has(node[0]) || (node[0] === 'call' && node[1] === '$__rem'))
+  if (!arith) return node
   const t = temp('cn')
   return typed(['block', ['result', 'f64'],
     ['local.set', `$${t}`, node],
@@ -86,6 +101,21 @@ const canonNum = (node) => {
       ['f64.ne', ['local.get', `$${t}`], ['local.get', `$${t}`]]]], 'f64')
 }
 
+// Is an emitted arm `v` (AST `node`) a plain NUMBER? The predicate the two-arm merges
+// (?:, ??) share to decide canon: an i32 number, NUMBER-tagged IR, or a NUMBER
+// value-type qualifies; a pointer/opaque arm does not. `vt` is the node's resolved
+// value-type — pass it when already computed to avoid the re-resolve.
+const isNumArm = (v, node, vt = resolveValType(node, valTypeOf, lookupValType)) =>
+  isI32Num(v) || v.valKind === VAL.NUMBER || vt === VAL.NUMBER
+
+// One arm of a two-arm f64 merge (?:, ??, ||, &&) whose result may be bit-tested while
+// untyped. Canon (canonNum, a no-op unless the arm is NaN-minting arithmetic) ONLY a
+// LONE numeric arm: when both arms are numeric the merge is value-typed NUMBER and read
+// NaN-by-value (no canon); when the other arm is opaque the result is untyped, so a
+// non-canonical NaN here would be misread by __is_truthy — fold it. A pointer arm
+// (isNum=false) is never touched (canon would destroy its NaN-box).
+const canonArm = (f, isNum, otherNum) => isNum && !otherNum ? canonNum(f) : f
+
 // Host globals auto-imported as `(import "env" "name" (global … i64))` when
 // referenced as a value. Drained from ctx.core.hostGlobals at assembly.
 const HOST_GLOBALS = new Set(['WebAssembly', 'globalThis', 'self', 'window', 'global', 'process'])
@@ -98,6 +128,16 @@ const HOST_GLOBALS = new Set(['WebAssembly', 'globalThis', 'self', 'window', 'gl
 // use — wrapping is exactly its intended semantics, so it stays on the i32 path.
 const widensUnsigned = (v) => v.unsigned && !v.wrapSafe
 
+// Strip a redundant NaN-canon wrapper (math.js `canon`) from an operand that
+// feeds a NaN-propagating f64 op. `f64.sqrt`/`min`/`max` mint a sign-nondeterministic
+// NaN that math.js canon-izes so it can't be bit-confused with a NaN-boxed pointer in
+// `===`/`typeof`. But when the result flows straight into `f64.add`/`sub`/`mul`/`div`,
+// the consumer propagates that NaN identically and is itself canon-ized if IT escapes —
+// so the inner per-op canon (local.set + select + f64.ne, ~3 ops) is dead on the
+// critical path. This is THE gap that put sqrt-heavy kernels ~23% behind V8
+// (julia/raymarcher/boids); stripping it makes them match native JS.
+const stripCanon = (v) => (v && v.canonOf != null) ? typed(v.canonOf, 'f64') : v
+
 const FIRST_CLASS_UNARY_MATH = {
   'math.abs': 'f64.abs',
   'math.sqrt': 'f64.sqrt',
@@ -155,13 +195,18 @@ const foldConst = (va, vb, fn, guard) =>
 // JS `*` is an f64 multiply; `i32.mul` yields only the exact product mod 2^32.
 // Those agree under a ToInt32/ToUint32 sink (and as plain numbers) while the
 // exact product stays f64-exact, i.e. |product| <= 2^53. Two i32 operands can
-// reach 2^62, so `i32.mul` is sound only when one side is a literal small
-// enough that, against the full i32 range (2^31) of the other, the product
-// holds within 2^53 — i.e. |literal| <= 2^22. Keeps index arithmetic (`i*4`,
-// `row*16`) on `i32.mul` while routing hash-mix-scale products to `f64.mul`.
+// reach 2^62, so `i32.mul` is sound only when one side is bounded small enough
+// that, against the full i32 range (2^31) of the other, the product holds within
+// 2^53 — i.e. its magnitude <= 2^22. A literal qualifies directly; so does a
+// masked operand (`x & 63`, `x >>> k`) whose value is provably bounded. Keeps
+// index arithmetic (`i*4`) and bitwise-masked scales (bytebeat's `t*(m&63)`) on
+// `i32.mul` while routing hash-mix-scale products to `f64.mul`.
+const FITS_I32_MAX = 0x400000  // 2^22 — see derivation above
 const mulFitsI32 = (va, vb) =>
-  (isLit(va) && Math.abs(litVal(va)) <= 0x400000) ||
-  (isLit(vb) && Math.abs(litVal(vb)) <= 0x400000)
+  (isLit(va) && Math.abs(litVal(va)) <= FITS_I32_MAX) ||
+  (isLit(vb) && Math.abs(litVal(vb)) <= FITS_I32_MAX) ||
+  (!isLit(va) && maskBound(va) <= FITS_I32_MAX) ||
+  (!isLit(vb) && maskBound(vb) <= FITS_I32_MAX)
 
 /** Emit typeof comparison: typeof x == typeCode → type-aware check. */
 export function emitTypeofCmp(a, b, cmpOp) {
@@ -307,6 +352,13 @@ function intIndexIR(key) {
  */
 const I32_INDEX_OP = { '+': 'i32.add', '-': 'i32.sub', '*': 'i32.mul' }
 function tryI32Index(e) {
+  // Integer literal first — a prepare-wrapped literal `[null, k]` (and a const-int
+  // name) is itself an Array, so the operator dispatch below would reject it and
+  // bail the WHOLE index to the f64 round-trip. The classic victim is the `+ 1` /
+  // `(j + 1)` of a bilinear/stencil gather (`a[(j+1)*W + i + 1]`): one literal leaf
+  // forced `convert_i32 … f64.mul/add … trunc_sat_f64_s` across every term.
+  const lit = nonNegIntLiteral(e)
+  if (lit != null) return typed(['i32.const', lit], 'i32')
   if (Array.isArray(e)) {
     const inner = I32_INDEX_OP[e[0]]
     if (inner && e[2] != null) {
@@ -316,8 +368,6 @@ function tryI32Index(e) {
     }
     return null
   }
-  const lit = nonNegIntLiteral(e)
-  if (lit != null) return ['i32.const', lit]
   return exprType(e, ctx.func.locals) === 'i32' ? asI32(emit(e)) : null
 }
 export const emitIndex = (idx) => tryI32Index(idx) ?? asI32(emit(idx))
@@ -448,6 +498,55 @@ function emitSubstringEqCmp(a, b, negate = false) {
       ['i64.reinterpret_f64', ['local.get', `$${o}`]]])], 'i32')
 }
 
+// One half of a two-sided range test against a compile-time constant, normalized to
+// an inclusive bound on a *local* `x`: `{ x, lo }` (x ≥ lo) or `{ x, hi }` (x ≤ hi).
+// `>`/`<` fold to the inclusive neighbor; a const on either side is accepted. Returns
+// null for anything else (so the caller leaves the expression untouched).
+function rangeBound(n) {
+  if (!Array.isArray(n) || n.length !== 3) return null
+  const lc = intLiteralValue(n[1]), rc = intLiteralValue(n[2])
+  if (rc != null && typeof n[1] === 'string') {        // x  op  CONST
+    if (n[0] === '>=') return { x: n[1], lo: rc }
+    if (n[0] === '>') return { x: n[1], lo: rc + 1 }
+    if (n[0] === '<=') return { x: n[1], hi: rc }
+    if (n[0] === '<') return { x: n[1], hi: rc - 1 }
+  }
+  if (lc != null && typeof n[2] === 'string') {        // CONST  op  x
+    if (n[0] === '<=') return { x: n[2], lo: lc }
+    if (n[0] === '<') return { x: n[2], lo: lc + 1 }
+    if (n[0] === '>=') return { x: n[2], hi: lc }
+    if (n[0] === '>') return { x: n[2], hi: lc - 1 }
+  }
+  return null
+}
+
+// `x >= LO && x <= HI` (x a pure i32 local, LO ≤ HI constants) → `(x - LO) <=u (HI - LO)`.
+// One subtract + one unsigned compare replaces two signed compares, an AND, and the
+// short-circuit branch — the classic range-check trick (valid for any integers via
+// wrapping subtraction). Returns the fused IR, or null to leave `&&` lowering unchanged.
+function fuseRangeCheck(a, b) {
+  const ba = rangeBound(a), bb = rangeBound(b)
+  if (!ba || !bb || ba.x !== bb.x || (ba.lo != null) === (bb.lo != null)) return null
+  const lo = ba.lo ?? bb.lo, hi = ba.hi ?? bb.hi
+  if (lo > hi) return null
+  const xv = emit(ba.x)
+  if (xv.type !== 'i32') return null                   // f64 (fractional) would mis-fuse
+  return typed(['i32.le_u', ['i32.sub', xv, ['i32.const', lo]], ['i32.const', hi - lo]], 'i32')
+}
+
+// The complement: `x < LO || x > HI` (the two outside half-checks — one upper-bounded,
+// one lower-bounded, with a gap between) → `(x - LO) >u (HI - LO)`, where [LO, HI] is the
+// inside range. Same trick, negated; returns null to leave `||` lowering unchanged.
+function fuseRangeCheckOr(a, b) {
+  const ba = rangeBound(a), bb = rangeBound(b)
+  if (!ba || !bb || ba.x !== bb.x || (ba.lo != null) === (bb.lo != null)) return null
+  const insideLo = (ba.hi ?? bb.hi) + 1, insideHi = (ba.lo ?? bb.lo) - 1
+  if (insideLo > insideHi) return null
+  const xv = emit(ba.x)
+  if (xv.type !== 'i32') return null
+  return typed(['i32.gt_u', ['i32.sub', xv, ['i32.const', insideLo]], ['i32.const', insideHi - insideLo]], 'i32')
+}
+
 // Flow-sensitive type refinement moved to ./flow-types.js (extractRefinements,
 // predicateRefinement, mergeRefinement, withRefinements). emit.js imports them
 // from there — see the import block at the top of this file.
@@ -469,6 +568,80 @@ function unrollSmallConstFor(init, cond, step, body) {
   return out
 }
 
+// Max distinct keys a for-in unrolls over (bounds code size; larger key sets keep
+// the pooled-keys loop, which is already allocation-free via __keys_ro).
+const FORIN_UNROLL_MAX = 16
+// Total-expansion ceiling: unroll emits one body copy per key, so the size cost is
+// keys × body, not keys alone. A large body over many keys (e.g. watr's 15-key
+// schema loop) blows up code size for no deopt win — the pooled fallback is already
+// allocation-free. Cap keys × nodeSize(body); past it, keep the loop. (Tuned above
+// every unroll the corpus actually wants — the 16-key cap test lands at 80.)
+const FORIN_UNROLL_BUDGET = 128
+const forInBodyCost = (node) => {
+  if (!Array.isArray(node)) return 1
+  let n = 1
+  for (let i = 1; i < node.length; i++) n += forInBodyCost(node[i])
+  return n
+}
+
+// Pull the for-in source out of prepare's keys expression: either a bare
+// `__keys_ro(src)` call or the nullish-guarded `cond ? [] : __keys_ro(src)`.
+function keysRoSrc(node) {
+  if (!Array.isArray(node)) return null
+  if (node[0] === '()' && node[1] === '__keys_ro') return node[2]
+  if (node[0] === '?:' || node[0] === '?') {
+    const last = node[node.length - 1]
+    if (Array.isArray(last) && last[0] === '()' && last[1] === '__keys_ro') return last[2]
+  }
+  return null
+}
+
+// Unroll `for (k in o)` over a static schema. Prepare lowers for-in to a plain
+// for-loop whose key array comes from the for-in-exclusive `__keys_ro` intrinsic,
+// so a loop carrying it IS a for-in. When `o` is a bare OBJECT var with a complete
+// static schema (no computed-key writes — same gate as __keys_ro pooling), replace
+// the loop with one substituted copy of the body per key: the loop variable becomes
+// a string literal, so `o[k]` folds to a static schema slot — no keys array, no
+// per-element dynamic get. Falls back (returns null) to the pooled loop otherwise.
+function unrollForIn(init, cond, step, body) {
+  if (!Array.isArray(init) || init[0] !== 'let' || !Array.isArray(init[1]) || init[1][0] !== '=') return null
+  const ksVar = init[1][1]
+  const src = keysRoSrc(init[1][2])
+  if (typeof src !== 'string') return null
+  if (!Array.isArray(cond) || cond[0] !== '<') return null
+  const ixVar = cond[1]
+  if (!Array.isArray(step) || step[0] !== '++' || step[1] !== ixVar) return null
+  // body = [';', ['let', ['=', target, ['[]', ksVar, ixVar]]], ...realBody]
+  if (!Array.isArray(body) || body[0] !== ';') return null
+  const bind = body[1]
+  if (!Array.isArray(bind) || bind[0] !== 'let' || !Array.isArray(bind[1]) || bind[1][0] !== '=') return null
+  const target = bind[1][1]
+  const acc = bind[1][2]
+  if (!Array.isArray(acc) || acc[0] !== '[]' || acc[1] !== ksVar || acc[2] !== ixVar) return null
+
+  // Unroll only with PROOF the schema is complete: a computed-key write adds
+  // enumerable keys, so bail if `src` takes one — or if the fact is unavailable
+  // (no proof ⇒ no unroll; unrolling drops the dynamic path, so erring safe matters).
+  if (!ctx.types.dynWriteVars || ctx.types.dynWriteVars.has(src)) return null
+  if (lookupValType(src) !== VAL.OBJECT) return null
+  const keys = ctx.schema.resolve(src)
+  if (!keys || !keys.length || keys.length > FORIN_UNROLL_MAX) return null
+
+  const rest = body.slice(2)
+  const realBody = rest.length === 1 ? rest[0] : [';', ...rest]
+  // Keep the pooled loop when unrolling would multiply a heavy body across many keys.
+  if (keys.length * forInBodyCost(realBody) > FORIN_UNROLL_BUDGET) return null
+  // Substitution safety, mirroring unrollSmallConstFor: no reassignment/redeclare
+  // of the loop var, no nested closure capturing it (cloneWithSubst skips `=>`),
+  // and no break/continue targeting this loop.
+  if (hasOwnBreakOrContinue(realBody) || containsNestedClosure(realBody) || containsDeclOf(realBody, target)) return null
+  if (isReassigned(realBody, target)) return null
+
+  const out = []
+  for (const key of keys) out.push(...emitVoid(cloneWithSubst(realBody, new Map([[target, ['str', key]]]))))
+  return out.length ? out : ['nop']
+}
+
 function canThrow(body, seen = new Set()) {
   if (!Array.isArray(body)) return false
   const op = body[0]
@@ -581,6 +754,40 @@ export function toBool(node) {
   return toBoolFromEmitted(emit(node))
 }
 
+// `(a / b) | 0` (the JS integer-division idiom) → i32.div_s. jz otherwise lowers `/`
+// to f64.div + ToInt32, paying two i32→f64 converts and the trunc; i32.div_s is
+// direct and lets the wasm backend magic-multiply a constant divisor. Bit-exact for
+// all i32 a,b: |a|<2³³≪2⁵³ so the f64 quotient never rounds across the truncation
+// boundary — EXCEPT b=0 (`(a/0)|0` is ToInt32(±Inf)=0, but i32.div_s traps) and
+// INT_MIN/-1 (ToInt32 wraps to INT_MIN, i32.div_s traps); both guarded. A constant
+// divisor folds the guards away. `exprType==='i32'` excludes unsigned operands
+// (those return 'f64'), where div_s would misread the sign. Returns IR or null.
+const INT_MIN_I32 = -2147483648
+function tryIntDivTrunc(aNode, bNode) {
+  const o = ctx.transform.optimize
+  if (!o || o.intDivLower === false) return null
+  const L = ctx.func.locals
+  if (exprType(aNode, L) !== 'i32' || exprType(bNode, L) !== 'i32') return null
+  const dv = intLiteralValue(bNode)
+  if (dv != null) {                         // constant divisor — no runtime guard
+    const va = asI32(emit(aNode))
+    if (dv === 0) return typed(['block', ['result', 'i32'], ['drop', va], ['i32.const', 0]], 'i32')
+    if (dv === -1) return typed(['i32.sub', ['i32.const', 0], va], 'i32')  // -a, wraps at INT_MIN
+    return typed(['i32.div_s', va, ['i32.const', dv | 0]], 'i32')
+  }
+  // Runtime divisor needs a,b repeated across the guard; only intercept when both are
+  // simple re-emittable operands (var / literal) so re-emit is pure and side-effect-free.
+  const simple = (n) => typeof n === 'string' || intLiteralValue(n) != null
+  if (!simple(aNode) || !simple(bNode)) return null
+  const A = () => asI32(emit(aNode)), B = () => asI32(emit(bNode))
+  return typed(['if', ['result', 'i32'], ['i32.eqz', B()],
+    ['then', ['i32.const', 0]],
+    ['else', ['if', ['result', 'i32'],
+      ['i32.and', ['i32.eq', A(), ['i32.const', INT_MIN_I32]], ['i32.eq', B(), ['i32.const', -1]]],
+      ['then', A()],
+      ['else', ['i32.div_s', A(), B()]]]]], 'i32')
+}
+
 /** Coerce an emitted arg IR to match a callee param. Param may carry ptrKind (pointer-ABI
  *  i32 offset), else falls back to numeric WASM type coercion. */
 function coerceArg(ir, param) {
@@ -721,7 +928,7 @@ export function emitDecl(...inits) {
     // Monotonic-extension fields (`o.newProp = …`) carry no literal value —
     // they init to undefined so a read before the write matches JS.
     const flatDecl = ctx.func.flatObjects?.get(name)
-    if (flatDecl && Array.isArray(init) && init[0] === '{}') {
+    if (flatDecl && Array.isArray(init) && (init[0] === '{}' || init[0] === '[' || init[0] === '[]')) {
       for (let j = 0; j < flatDecl.names.length; j++)
         result.push(['local.set', `$${name}#${j}`,
           flatDecl.values[j] === undefined ? undefExpr() : asF64(emit(flatDecl.values[j]))])
@@ -790,6 +997,17 @@ export function emitDecl(...inits) {
       if (!ctx.func.directClosures) ctx.func.directClosures = new Map()
       ctx.func.directClosures.set(name, val.closureBodyName)
     }
+    // Copy propagation of a direct closure: `let g = add`, where `add` is a non-escaping
+    // directly-callable closure, makes `g` directly callable too — `g` holds the same
+    // closure value, so `g(…)` calls add's body with g's value as env. This is what
+    // devirtualizes `let arr = [add]; arr[0](…)`: array scalarization rewrites it to
+    // `let g = add; g(…)` before emit (D3), and also covers the explicit `let g = arr[0]`.
+    // Same soundness gate as the direct-closure case: stable binding (not reassigned),
+    // not boxed, not global.
+    if (typeof init === 'string' && ctx.func.directClosures?.has(init) && !ctx.func.boxed.has(name)
+        && !isGlobal(name) && ctx.func.body && !isReassigned(ctx.func.body, name)) {
+      ctx.func.directClosures.set(name, ctx.func.directClosures.get(init))
+    }
     if (ctx.func.boxed.has(name)) {
       const cell = ctx.func.boxed.get(name)
       ctx.func.locals.set(cell, 'i32')
@@ -865,8 +1083,14 @@ export function emitDecl(...inits) {
     } else {
       coerced = localType === 'v128' ? val : localType === 'f64' ? asF64(val) : val.type === 'i32' ? val : toI32(val)
     }
-    if (!(isLit(coerced) && coerced[1] === 0 && !Object.is(coerced[1], -0) && !ctx.func.stack.length))
+    // `let x = 0` at function scope is normally elided — WASM zero-inits locals. But loop
+    // unrolling flattens iteration bodies into one scope, so the 2nd+ `let x = 0` are
+    // genuine RE-inits between iterations (e.g. a nested reduce's accumulator). Elide only
+    // the FIRST per name; emit the rest as resets. (Names are preserved — no renaming.)
+    const zeroInit = isLit(coerced) && coerced[1] === 0 && !Object.is(coerced[1], -0) && !ctx.func.stack.length
+    if (!zeroInit || ctx.func.zeroInitSeen?.has(name))
       result.push(['local.set', `$${name}`, coerced])
+    else (ctx.func.zeroInitSeen ??= new Set()).add(name)
 
     const schemaId = ctx.schema.idOf?.(name)
     if (ctx.func.localProps?.has(name) && schemaId != null) {
@@ -1705,7 +1929,9 @@ function tryStaticDispatch({ obj, method, vt, callMethod }) {
 // emitter which already knows how to handle them.
 function tryRuntimeStringFork({ obj, method, vt, callMethod }) {
   const strKey = `.string:${method}`, genKey = `.${method}`
-  if ((!vt || vt === VAL.ARRAY) && ctx.core.emit[strKey] && ctx.core.emit[genKey]) {
+  // VAL.ARRAY is structurally incompatible with PTR.STRING — no fork needed.
+  // Only fork when vt is truly unknown (!vt), not for proven types.
+  if (!vt && ctx.core.emit[strKey] && ctx.core.emit[genKey]) {
     const t = `${T}rt${ctx.func.uniq++}`, tt = `${T}rtt${ctx.func.uniq++}`
     ctx.func.locals.set(t, 'f64'); ctx.func.locals.set(tt, 'i32')
     const strEmitter = ctx.core.emit[strKey]
@@ -1840,6 +2066,7 @@ function externalMethodFallback({ obj, method, parsed }) {
   // can target js and wasi from one source; users who want fail-fast
   // pass `strict: true` (handled above).
   if (ctx.transform.host === 'wasi') return undefExpr()
+  warnDeopt('deopt-method', `method call \`${typeof obj === 'string' ? obj : '<expr>'}.${method}(…)\` on a value whose type couldn't be resolved dispatches through the JS host (\`__ext_call\`) — a wasm→JS round-trip per call, orders of magnitude slower than a direct call. Restructure so the receiver's type is provable, or keep it off the hot path.`)
   inc('__ext_call')
   ctx.features.external = true
   const combined = reconstructArgsWithSpreads(parsed.normal, parsed.spreads)
@@ -2018,9 +2245,21 @@ function tryDirectClosureCall(callee, parsed) {
   // export-param path gives. An arg we can't prove numeric poisons the slot to false.
   const pt = (ctx.closure.paramTypes ||= new Map())
   let row = pt.get(bodyName); if (!row) pt.set(bodyName, row = [])
+  // Parallel typed-array ctor lattice: a param passed the SAME typed-array ctor at
+  // every direct call site is a TYPED param, so its body reads (`buf[i]`) take the
+  // typed fast-path instead of the dynamic `__typed_idx`/`__len` route that drags in
+  // the string runtime. `null` (sticky) once two sites disagree or an arg isn't a
+  // known typed array — the same monotone meet as the numeric row. Mirrors the named-fn
+  // applyTypedPointerParamAbi, restricted to non-escaping (directly-called) closures.
+  const tc = (ctx.closure.paramTypedCtors ||= new Map())
+  let tcRow = tc.get(bodyName); if (!tcRow) tc.set(bodyName, tcRow = [])
   for (let i = 0; i < n; i++) {
     const numeric = valTypeOf(parsed.normal[i]) === VAL.NUMBER
     row[i] = row[i] === undefined ? numeric : (row[i] && numeric)
+    const arg = parsed.normal[i]
+    const ctor = typeof arg === 'string' && valTypeOf(arg) === VAL.TYPED ? (ctx.types.typedElem?.get(arg) ?? null) : null
+    if (tcRow[i] === undefined) tcRow[i] = ctor
+    else if (tcRow[i] !== ctor) tcRow[i] = null
   }
   // Track the fewest args any call passed: a slot at index ≥ minArgc is omitted by some call
   // site (padded with UNDEF_NAN), so it may be undefined — emitClosureBody flags it nullable.
@@ -2373,9 +2612,22 @@ export const emitter = {
       // A BOOL operand renders "true"/"false" rather than its 0/1 carrier.
       const strOperand = (vt, n) => vt === VAL.OBJECT ? typed(['f64.reinterpret_i64', toStrI64(n, emit(n))], 'f64')
         : vt === VAL.BOOL ? emitBoolStr(n) : asF64(emit(n))
-      const ea = strOperand(vtA, a)
-      const eb = strOperand(vtB, b)
-      return typed(ctx.abi.string.ops.cat(ea, eb, ctx), 'f64')
+      // Coercion-free sides are already strings: a known STRING is raw; OBJECT/BOOL
+      // were stringified by `strOperand`. An unknown side still needs ToString, but
+      // we can apply it *once* (explicit `__to_str` via `strI64`) and join with
+      // concatRaw — equivalent to `__str_concat`'s internal `__to_str` on that side,
+      // while NOT re-coercing the already-string side. This drops the redundant
+      // per-append `__to_str` on the accumulator in `s += part` (s proven STRING):
+      //   - both coercion-free  → concatRaw(ea, eb)
+      //   - one unknown         → concatRaw(known, __to_str(unknown))
+      //   - both unknown        → cat (unchanged; its runtime __to_str covers both)
+      const coercionFree = (vt) => vt === VAL.STRING || vt === VAL.OBJECT || vt === VAL.BOOL
+      const cfA = coercionFree(vtA), cfB = coercionFree(vtB)
+      const strI64 = (n) => typed(['f64.reinterpret_i64', toStrI64(n, emit(n))], 'f64')
+      if (cfA && cfB) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strOperand(vtB, b), ctx), 'f64')
+      if (cfA) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strI64(b), ctx), 'f64')
+      if (cfB) return typed(ctx.abi.string.ops.concatRaw(strI64(a), strOperand(vtB, b), ctx), 'f64')
+      return typed(ctx.abi.string.ops.cat(strOperand(vtA, a), strOperand(vtB, b), ctx), 'f64')
     }
     if (vtA === VAL.BIGINT || vtB === VAL.BIGINT)
       return fromI64(['i64.add', asI64(emit(a)), asI64(emit(b))])
@@ -2409,7 +2661,7 @@ export const emitter = {
     // op whose result can exceed i32, so `i32.add` would wrap (4294967295+1→0).
     // Widen to f64 — never wrap — matching spec. Only `>>>0`/`|0`/imul wrap.
     if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb)) return typed(['i32.add', va, vb], 'i32')
-    return typed(['f64.add', toNumF64(a, va), toNumF64(b, vb)], 'f64')
+    return typed(['f64.add', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   '-': (a, b) => {
     if (ctx.func._expect === 'void' && isPostfix(a, '++', b)) return emit(a, 'void')
@@ -2424,7 +2676,7 @@ export const emitter = {
     // Unsigned uint32 operand: JS `-` is float (can go negative / exceed i32),
     // so avoid the wrapping i32.sub fast-path. See `+` above.
     if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb)) return typed(['i32.sub', va, vb], 'i32')
-    return typed(['f64.sub', toNumF64(a, va), toNumF64(b, vb)], 'f64')
+    return typed(['f64.sub', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   'u+': a => {
     if (valTypeOf(a) === VAL.BIGINT)
@@ -2454,7 +2706,7 @@ export const emitter = {
     // `.unsigned` operand is a uint32 ([0, 2^32)); its product can exceed i32, so
     // `i32.mul` would wrap ((2^32-1)*2 → -2). Widen to f64 — see `+` above.
     if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb) && mulFitsI32(va, vb)) return typed(['i32.mul', va, vb], 'i32')
-    return typed(['f64.mul', toNumF64(a, va), toNumF64(b, vb)], 'f64')
+    return typed(['f64.mul', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   '/': (a, b) => {
     if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
@@ -2462,7 +2714,7 @@ export const emitter = {
     const va = emit(a), vb = emit(b), _f = foldConst(va, vb, (a, b) => a / b, b => b !== 0)
     if (_f) return _f
     if (isLit(vb) && litVal(vb) === 1) return toNumF64(a, va)
-    return typed(['f64.div', toNumF64(a, va), toNumF64(b, vb)], 'f64')
+    return typed(['f64.div', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   '%': (a, b) => {
     if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
@@ -2539,6 +2791,15 @@ export const emitter = {
     const elseRefs = extractRefinements(a, new Map(), false)
     const vb = withRefinements(thenRefs, b, () => emit(b))
     const vc = withRefinements(elseRefs, c, () => emit(c))
+    // `cond ? 1 : 0` is the condition bit itself; `cond ? 0 : 1` its negation. `cond`
+    // (truthyIR) is already canonical 0/1, so the select + two const arms collapse to
+    // the bit. (Both arms are literals here, so dropping their emitted IR is side-effect
+    // free.) Mirrors what `+(x > 0)` already produces.
+    if (isLit(vb) && isLit(vc)) {
+      const lb = litVal(vb), lc = litVal(vc)
+      if (lb === 1 && lc === 0) return typed(cond, 'i32')
+      if (lb === 0 && lc === 1) return typed(['i32.eqz', cond], 'i32')
+    }
     // L: Use WASM select for pure ternaries — branchless, smaller bytecode
     if (vb.type === 'i32' && vc.type === 'i32') {
       // A single i32 select is only sound when BOTH arms' i32 carriers mean the same
@@ -2577,10 +2838,24 @@ export const emitter = {
     const refPayload = (vtb && vtb === vtc && REF_EQ_KINDS.has(vtb))
       || vb.closureFuncIdx != null || vc.closureFuncIdx != null
       || isNaNBoxLit(fb) || isNaNBoxLit(fc)
-    const numericB = isI32Num(vb) || vb.valKind === VAL.NUMBER || vtb === VAL.NUMBER
-    const numericC = isI32Num(vc) || vc.valKind === VAL.NUMBER || vtc === VAL.NUMBER
-    const branchB = numericB && !numericC ? canonNum(fb) : fb
-    const branchC = numericC && !numericB ? canonNum(fc) : fc
+    const numericB = isNumArm(vb, b, vtb)
+    const numericC = isNumArm(vc, c, vtc)
+    // Peephole: `cond ? 1 : 0` (or `cond ? 0 : 1`) is just `f64.convert_i32_s(cond)` —
+    // the select collapses because cond is already 0/1. Saves 5 instructions.
+    const isOneZero = (one, zero) => {
+      const o = one, z = zero
+      return o.type === 'i32' && Array.isArray(o) && o[0] === 'i32.const' && o[1] === 1 &&
+             z.type === 'i32' && Array.isArray(z) && z[0] === 'i32.const' && z[1] === 0
+    }
+    if ((isOneZero(vb, vc) || isOneZero(vc, vb)) && !numericB && !numericC) {
+      const condBool = truthyIR(emit(a))
+      const n = isOneZero(vb, vc)
+        ? typed(['f64.convert_i32_s', condBool], 'f64')
+        : typed(['f64.convert_i32_s', ['i32.eqz', condBool]], 'f64')
+      n.valKind = VAL.NUMBER
+      return n
+    }
+    const branchB = canonArm(fb, numericB, numericC), branchC = canonArm(fc, numericC, numericB)
     const markNumeric = (n) => {
       if (numericB && numericC) n.valKind = VAL.NUMBER
       return n
@@ -2599,6 +2874,14 @@ export const emitter = {
   },
 
   '&&': (a, b) => {
+    // Range-check fusion: `x >= LO && x <= HI` (x a pure i32 local, LO ≤ HI compile-time
+    // constants) collapses to one unsigned compare `(x - LO) <=u (HI - LO)` — a subtract
+    // plus a branch instead of two compares, an AND, and a short-circuit branch. This is
+    // the per-char cost in scanners/parsers (digit/alpha classification) and in any
+    // two-sided bounds check. Restricted to a local `x` so evaluating it once (the fused
+    // form) matches the original's twice-read, side-effect-free semantics.
+    const fused = fuseRangeCheck(a, b)
+    if (fused) return fused
     const va = emit(a)
     // Constant-folded literal: pre-bind under truthy refinements (b runs only when a was truthy).
     if (isLit(va)) {
@@ -2630,14 +2913,24 @@ export const emitter = {
         ['else', typed(['f64.convert_i32_s', ['local.get', `$${t}`]], 'f64')]], 'f64')
     }
     const t = temp()
-    const teed = typed(['local.tee', `$${t}`, asF64(va)], 'f64')
-    return typed(['if', ['result', 'f64'],
-      toBoolFromEmitted(teed),
-      ['then', asF64(emitRight())],
+    const numA = isNumArm(va, a)
+    const vb = emitRight(), numB = isNumArm(vb, b)
+    // `a` is the else-arm result (returned when falsy — incl NaN), so canon a lone-numeric
+    // `a` before the tee: `$t` then feeds both the result and the cond canonically.
+    const teed = typed(['local.tee', `$${t}`, canonArm(asF64(va), numA, numB)], 'f64')
+    // A numeric left arm tests truthiness NaN-by-value (not __is_truthy, which mis-reads
+    // x86's sign-set NaN as truthy) — tag it so truthyIR takes that path.
+    if (numA) teed.valKind = VAL.NUMBER
+    return typed(['if', ['result', 'f64'], toBoolFromEmitted(teed),
+      ['then', canonArm(asF64(vb), numB, numA)],
       ['else', ['local.get', `$${t}`]]], 'f64')
   },
 
   '||': (a, b) => {
+    // Outside-range fusion (the complement of `&&`): `x < LO || x > HI` → one unsigned
+    // compare `(x - LO) >u (HI - LO)`. Common in validation (`if (c < 'a' || c > 'z') …`).
+    const fusedOr = fuseRangeCheckOr(a, b)
+    if (fusedOr) return fusedOr
     const va = emit(a)
     // Constant-folded literal: pre-bind under falsy refinements (b runs only when a was falsy).
     if (isLit(va)) {
@@ -2665,22 +2958,30 @@ export const emitter = {
         ['else', asF64(vb)]], 'f64')
     }
     const t = temp()
+    const numA = isNumArm(va, a)
+    const vb = emitRight(), numB = isNumArm(vb, b)
+    // `a` (then-arm) is returned only when truthy — hence never NaN — so it needs no canon;
+    // the cond's NaN-safety comes from the valKind tag. Only the else (b) arm can surface
+    // as a numeric NaN.
     const teed = typed(['local.tee', `$${t}`, asF64(va)], 'f64')
-    return typed(['if', ['result', 'f64'],
-      toBoolFromEmitted(teed),
+    if (numA) teed.valKind = VAL.NUMBER   // numeric left arm: NaN-safe truthiness (see `&&`)
+    return typed(['if', ['result', 'f64'], toBoolFromEmitted(teed),
       ['then', ['local.get', `$${t}`]],
-      ['else', asF64(emitRight())]], 'f64')
+      ['else', canonArm(asF64(vb), numB, numA)]], 'f64')
   },
 
   // a ?? b: returns b only if a is nullish
   '??': (a, b) => {
-    const va = emit(a)
+    const va = emit(a), vb = emit(b)
     const t = temp()
+    const numA = isNumArm(va, a), numB = isNumArm(vb, b)
+    // Both arms can surface as the (untyped) result — `a` when non-nullish (a NaN is not
+    // nullish, so it IS returned), `b` otherwise. Canon a lone-numeric arm; `a` before the
+    // tee so `local.get $t` is canonical. The cond is isNullish, robust to non-canon NaN.
     return typed(['if', ['result', 'f64'],
-      // Check: is a NOT nullish?
-      ['i32.eqz', isNullish(['local.tee', `$${t}`, asF64(va)])],
+      ['i32.eqz', isNullish(['local.tee', `$${t}`, canonArm(asF64(va), numA, numB)])],
       ['then', ['local.get', `$${t}`]],
-      ['else', asF64(emit(b))]], 'f64')
+      ['else', canonArm(asF64(vb), numB, numA)]], 'f64')
   },
 
   'void': a => {
@@ -2725,6 +3026,10 @@ export const emitter = {
   ].map(([op, fn]) => [op, (a, b) => {
     if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
       return fromI64([`i64.${fn}`, asI64(emit(a)), asI64(emit(b))])
+    if (op === '|') {  // `(x / y) | 0` integer-division idiom → i32.div_s
+      const divN = intLiteralValue(b) === 0 ? a : intLiteralValue(a) === 0 ? b : null
+      if (Array.isArray(divN) && divN[0] === '/') { const r = tryIntDivTrunc(divN[1], divN[2]); if (r) return r }
+    }
     const va = emit(a), vb = emit(b)
     if (isLit(va) && isLit(vb)) {
       const la = litVal(va), lb = litVal(vb)
@@ -2794,6 +3099,12 @@ export const emitter = {
       const unrolled = unrollSmallConstFor(init, cond, step, body)
       if (unrolled) return unrolled
     }
+    // for-in over a static schema → unroll with key-literal substitution (folds
+    // o[k] to schema slots). Recognized via the for-in-exclusive __keys_ro intrinsic.
+    if (!labeledContinue && (!ctx.transform.optimize || ctx.transform.optimize.forInUnroll !== false)) {
+      const fu = unrollForIn(init, cond, step, body)
+      if (fu) return fu
+    }
     // Lift constant array/object literals out of the loop (allocate once, not per
     // iteration) when they are read-only + non-escaping inside it. Strip them from the
     // body up front so freshBoxed / continue analysis see the reduced body.