jz 0.6.0 → 0.7.0

package/src/compile/index.js

@@ -37,6 +37,8 @@ import { typedElemAux } from '../../layout.js'
 import { VAL, updateRep, REP_FIELDS } from '../reps.js'
 import { inferLocals } from './infer.js'
 import { optimizeFunc, treeshake } from '../optimize/index.js'
+import { strengthReduceLoopDivMod } from './loop-divmod.js'
+import { peelClampedStencil } from './peel-stencil.js'
 import { emit, emitter, emitVoid, emitBlockBody } from './emit.js'
 import { emitCharDecompPrologue, JSS_IMPORT_SIGS } from '../abi/string.js'
 import {
@@ -54,9 +56,10 @@ import {
   I32_MIN, I32_MAX, dollar,
 } from '../ir.js'
 import plan from './plan/index.js'
+import { foldStaticConstAggregates } from './plan/literals.js'
 import {
   buildStartFn, dedupClosureBodies, finalizeClosureTable,
-  pullStdlib, syncImports, optimizeModule, stripStaticDataPrefix,
+  pullStdlib, syncImports, optimizeModule, stripStaticDataPrefix, hoistConstGlobalInits,
 } from '../wat/assemble.js'
 
 // =============================================================================
@@ -346,6 +349,7 @@ function scanAndTagNonEscapingClosures(body) {
 // their synthetic labels can't collide with the parent frame's.
 function enterFunc(sig, body, { uniq = 0, directClosures = null } = {}) {
   ctx.func.stack = []
+  ctx.func.zeroInitSeen = new Set()   // names whose `let x=0` zero-init was elided once; a 2nd is a real re-init (unrolled bodies)
   ctx.func.maybeNullish = new Set()   // bindings assigned a nullish literal → coerce in arithmetic (null-flow)
   ctx.func.pendingLabel = null        // label awaiting its loop, for `continue <label>`
   ctx.func.uniq = uniq
@@ -379,6 +383,15 @@ function analyzeFuncForEmit(func, programFacts) {
   const { paramReps } = programFacts
   if (func.raw) return null
 
+  // Strength-reduce per-iteration `i % w` / `(i/w)|0` to incremental i32 counters
+  // (idempotent: a reduced loop has no modulo left to match). Before analyze so the
+  // counters are typed/narrowed like any i32 local. Off at L0 / `loopIVDivMod:false`.
+  const _o = ctx.transform.optimize
+  if (_o && _o.loopIVDivMod !== false && isBlockBody(func.body)) func.body = strengthReduceLoopDivMod(func.body)
+  // Edge-clamp peeling: split a clamped stencil loop into clamp-free interior + edges
+  // (the interior then lifts to SIMD). Before analyze so the new loops are analyzed.
+  if (_o && _o.clampPeel !== false && isBlockBody(func.body)) func.body = peelClampedStencil(func.body)
+
   const { name, body, sig } = func
   enterFunc(sig, body)
 
@@ -417,7 +430,11 @@ function analyzeFuncForEmit(func, programFacts) {
       if (p.type === 'f64' && p.ptrKind == null && !p.jsstring
           && !func.defaults?.[p.name] && !ctx.func.boxed?.has(p.name)
           && !ctx.func.localReps?.get(p.name)?.val
-          && paramAllUsesNumeric(body, p.name))
+          // Numeric either by PROOF (ToNumber-forcing uses) or by the export
+          // boundary contract (never used as a string → wrapVal guarantees a
+          // number). The latter catches `acc + cre` float kernels whose `+` would
+          // otherwise pull a per-iteration string-concat fork (julia, floatbeats).
+          && (paramAllUsesNumeric(body, p.name) || paramNeverString(body, p.name)))
         updateRep(p.name, { val: VAL.NUMBER })
     }
   }
@@ -434,6 +451,8 @@ function analyzeFuncForEmit(func, programFacts) {
   if (bodyFacts?.valTypes) {
     for (const [name, vt] of bodyFacts.valTypes) updateRep(name, { val: vt })
   }
+  // Never-relocated array bindings — the `[]` reader skips the forwarding follow.
+  if (bodyFacts?.neverGrown) for (const name of bodyFacts.neverGrown) updateRep(name, { neverGrown: true })
   // Proven uint32 accumulator locals — readVar tags reads `.unsigned` so the
   // f64 round-trip widens with convert_i32_u (not _s).
   if (bodyFacts?.unsignedLocals) for (const n of bodyFacts.unsignedLocals) updateRep(n, { unsigned: true })
@@ -526,21 +545,54 @@ function analyzeFuncForEmit(func, programFacts) {
 }
 
 function seedLocalIntConsts(body) {
+  // Fold each never-reassigned local `const`/`let NAME = EXPR` to a known i32, so a
+  // divisor / bound / size built from earlier consts (`rr = R|0; win = 2*rr+1`) becomes
+  // a compile-time literal — which lets the int-divide lowering hand the wasm backend a
+  // constant divisor to magic-multiply (no runtime sdiv), array bounds resolve, etc.
+  // Mirrors the module-scope fold (evalConst above); a string ref resolves through the
+  // intConst already recorded on its rep, and the fixpoint lets a later const see an
+  // earlier one regardless of declaration order. Skips nested functions (own scope).
+  const evalC = (n) => {
+    if (typeof n === 'number') return Number.isInteger(n) ? n : null
+    if (Array.isArray(n) && n[0] == null && typeof n[1] === 'number') return Number.isInteger(n[1]) ? n[1] : null
+    if (typeof n === 'string') return intLiteralValue(n)   // a seeded intConst / literal local
+    if (!Array.isArray(n)) return null
+    const [op, a, b] = n
+    const va = evalC(a); if (va == null) return null
+    if (op === 'u-' || (op === '-' && b === undefined)) return -va
+    const vb = evalC(b); if (vb == null) return null
+    switch (op) {
+      case '+': return va + vb; case '-': return va - vb; case '*': return va * vb
+      case '&': return va & vb; case '|': return va | vb; case '^': return va ^ vb
+      case '<<': return va << vb; case '>>': return va >> vb; case '>>>': return va >>> vb
+      default: return null
+    }
+  }
+  const decls = []
   const walk = (node) => {
     if (!Array.isArray(node)) return
     const [op, ...args] = node
     if (op === '=>') return
     if (op === 'let' || op === 'const') {
-      for (const decl of args) {
-        if (!Array.isArray(decl) || decl[0] !== '=' || typeof decl[1] !== 'string') continue
-        const value = intLiteralValue(decl[2])
-        if (value != null && !isReassigned(body, decl[1])) updateRep(decl[1], { intConst: value })
-      }
+      for (const decl of args)
+        if (Array.isArray(decl) && decl[0] === '=' && typeof decl[1] === 'string' && !isReassigned(body, decl[1])) decls.push(decl)
       return
     }
     for (const arg of args) walk(arg)
   }
   walk(body)
+  const seeded = new Set()
+  let changed = true
+  while (changed) {
+    changed = false
+    for (const decl of decls) {
+      if (seeded.has(decl[1])) continue
+      const value = evalC(decl[2])
+      if (value != null && Number.isInteger(value) && value >= I32_MIN && value <= I32_MAX) {
+        updateRep(decl[1], { intConst: value }); seeded.add(decl[1]); changed = true
+      }
+    }
+  }
 }
 
 // ── Loop-invariant exported-param coercion hoist ────────────────────────────
@@ -562,21 +614,47 @@ function seedLocalIntConsts(body) {
 const PARAM_REASSIGN_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=',
   '^=', '>>=', '<<=', '>>>=', '||=', '&&=', '??=', '++', '--'])
 // Binary ops that unconditionally ToNumber BOTH operands, so a bare param operand
-// is a pure numeric use. `+` is excluded (may concatenate); comparisons / `===`
-// are excluded (they branch on type, never coerce a string operand to number).
+// is a pure numeric use. `+` is excluded (may concatenate); `===`/`==` are excluded
+// (they branch on type, never coerce a string operand to number).
 const NUM_BIN_OPS = new Set(['*', '/', '%', '**', '&', '|', '^', '<<', '>>', '>>>'])
-
-/** True iff every use of param `name` in `body` is an unconditional-numeric
- *  operand, so coercing it to a number once at entry is observationally exact.
- *  Rejects conservatively: reassignment and any appearance outside a numeric
- *  operator (member/index/call-arg/return/compare/concat). Two transparencies:
+// Relational ops: jz has no lexicographic compare for an untyped operand — `<`
+// lowers to `f64.lt`, taking the string path only when a *known-string* operand
+// is present (emit.js cmpOp). So a bare param compared against a non-string is a
+// pure numeric use, same as NUM_BIN_OPS. A string-literal counterpart (`x < "m"`)
+// signals string intent and is rejected (handled in the walk below).
+const REL_OPS = new Set(['<', '<=', '>', '>='])
+// A string literal/template operand poisons relational numeric inference.
+const isStrLiteral = (n) => Array.isArray(n) && (n[0] === 'str' || n[0] === 'template')
+
+/** True iff every use of param `name` in `body` is numeric-COMPATIBLE *and* at
+ *  least one use is numeric-PROVING — so coercing it to a number once at entry is
+ *  observationally exact. Two verdict levels guard against a polymorphic slot
+ *  passing on absence of evidence:
+ *   - PROVING (`proven=true`): arithmetic / relational / bitwise / unary operand —
+ *     JS ToNumbers these, and a string/array value would have shown a disqualifying
+ *     use elsewhere.
+ *   - COMPATIBLE-ONLY: the length slot of `new TypedArray(x)` / `new ArrayBuffer(x)`.
+ *     A number sizes the buffer, but an array is COPIED and a buffer VIEWED — so a
+ *     bare param here proves nothing. A param used *solely* as `new Float64Array(arr)`
+ *     stays unproven and keeps the polymorphic ctor dispatch (else array-copy is lost).
+ *  Any other appearance (member/call-arg/return/concat/`===`/reassignment) rejects.
+ *  Two transparencies:
  *   - copy aliases: `let x = name` makes `x` carry the same value, so `x`'s uses
  *     must be numeric too (fixpoint-collected). Catches `let T = t` then `…T…`.
  *   - captured closures: a non-shadowing inner arrow captures the binding by
  *     reference, so its body's uses count — we recurse instead of rejecting.
  *     Catches floatbeat helpers `let s=(f)=>…t…` that read the param numerically. */
-function paramAllUsesNumeric(body, name) {
+// requireProof=true (default): the param has a ToNumber-FORCING use (PROVES numeric).
+// requireProof=false: the param merely has NO string-requiring use (numeric-COMPATIBLE).
+// Forwarding recursions use the latter — a callee receiving the param need only be
+// string-free (e.g. fbm's `ph`, used additively inside Math.sin), since the OUTER
+// param earns its own proof from its own uses; requiring the callee be self-proven
+// wrongly rejected forwards into additive-only params.
+function paramAllUsesNumeric(body, name, _seen = new Set(), requireProof = true) {
   if (body == null) return false
+  // Local closure defs (`let f = (p,…) => …`) so a call `f(name)` can be judged by
+  // f's own param numericity (see the call-arg handler in the walk).
+  const closures = new Map()  // name → { params:[string], body }
   // Fixpoint-collect copy aliases: `let/const x = <name-or-alias>`.
   const names = new Set([name])
   for (let grew = true; grew;) {
@@ -584,15 +662,25 @@ function paramAllUsesNumeric(body, name) {
     const collect = (node) => {
       if (!Array.isArray(node)) return
       if ((node[0] === 'let' || node[0] === 'const') && node.length === 2
-          && Array.isArray(node[1]) && node[1][0] === '=' && typeof node[1][1] === 'string'
-          && typeof node[1][2] === 'string' && names.has(node[1][2]) && !names.has(node[1][1])) {
-        names.add(node[1][1]); grew = true
+          && Array.isArray(node[1]) && node[1][0] === '=' && typeof node[1][1] === 'string') {
+        const init = node[1][2]
+        if (typeof init === 'string' && names.has(init) && !names.has(node[1][1])) { names.add(node[1][1]); grew = true }
+        else if (Array.isArray(init) && init[0] === '=>' && !closures.has(node[1][1])) {
+          const ps = Array.isArray(init[1]) ? init[1].slice(1) : [init[1]]   // ['()', p0, p1] → [p0,p1]
+          if (ps.every(p => typeof p === 'string')) closures.set(node[1][1], { params: ps, body: init[2] })
+        }
       }
       for (let i = 1; i < node.length; i++) collect(node[i])
     }
     collect(body)
   }
-  let ok = true
+  let ok = true, proven = false
+  // A param in a numeric-operand slot is a PROVING use; recurse into a non-param sub-expr.
+  const numOperand = (n) => { if (names.has(n)) proven = true; else walk(n) }
+  // Positional call args, flattening the `(, a b c)` node multi-arg calls parse to —
+  // without this a forward like `fbm(x, y, t, …)` never matched its param positions.
+  const flat1 = (a) => Array.isArray(a) && a[0] === ',' ? a.slice(1).flatMap(flat1) : [a]
+  const callArgList = (n) => n.slice(2).flatMap(flat1)
   const walk = (node) => {
     if (!ok) return
     if (typeof node === 'string') { if (names.has(node)) ok = false; return }  // bare use → reject
@@ -617,19 +705,161 @@ function paramAllUsesNumeric(body, name) {
     }
     if (PARAM_REASSIGN_OPS.has(op) && names.has(node[1])) { ok = false; return }
     if (NUM_BIN_OPS.has(op) && node.length === 3) {     // numeric binary: operands are ToNumber'd
+      numOperand(node[1]); numOperand(node[2])
+      return
+    }
+    if (REL_OPS.has(op) && node.length === 3) {         // relational: numeric unless a known string is present
+      if (isStrLiteral(node[1]) || isStrLiteral(node[2])) { ok = false; return }
+      numOperand(node[1]); numOperand(node[2])
+      return
+    }
+    // `new TypedArray(x)` / `new ArrayBuffer(x)`: the length argument is ToNumber'd
+    // on the alloc path, but a pointer arg is copied (array) or viewed (buffer).
+    // A bare param in the length slot is numeric-COMPATIBLE but not PROVING — skip it
+    // (no reject, no proof); other args walk normally. A param used *solely* as
+    // `new Float64Array(param)` thus stays unproven → keeps the polymorphic ctor (so
+    // `f(arr)` copies the array instead of mis-sizing a zero buffer).
+    if (op === '()' && typeof node[1] === 'string' && node[1].startsWith('new.')
+        && (node[1].endsWith('Array') || node[1] === 'new.ArrayBuffer')) {
+      for (let i = 2; i < node.length; i++) if (!names.has(node[i])) walk(node[i])
+      return
+    }
+    // Call of a LOCAL closure `f(…name…)`: forwarding the param flows its value into
+    // f's positional param. If that param is itself all-numeric (recursively, with a
+    // cycle guard), `name` in that slot is numeric-COMPATIBLE — neither rejected nor
+    // proving (so a param used *only* as a forwarded arg stays unproven, like the ctor
+    // length slot). Unknown / non-numeric callees fall through and reject (a string
+    // could flow in). Covers heapsort's `heapify(n)` and crc32's `crc32(buf)`.
+    if (op === '()' && typeof node[1] === 'string' && closures.has(node[1]) && !_seen.has(node[1])) {
+      const cl = closures.get(node[1])
+      const args = callArgList(node)
+      for (let i = 0; i < args.length; i++) {
+        if (!names.has(args[i])) { walk(args[i]); continue }
+        const param = cl.params[i]
+        if (param == null || !paramAllUsesNumeric(cl.body, param, new Set([..._seen, node[1]]), false)) { ok = false; return }
+      }
+      return
+    }
+    // Same forwarding judgement for a call to a MODULE-LEVEL user function (sibling,
+    // not a body-local closure): `frame` passing its param into a helper `fbm(x,y,t,…)`.
+    // Without this the bare arg fell through and rejected, leaving an exported numeric
+    // param (plasma/raymarcher's `t`) unproven → per-pixel `__to_num` + polymorphic-`+`
+    // string forks. Judge by the callee param's own numericity (recursive, cycle-guarded).
+    if (op === '()' && typeof node[1] === 'string' && !_seen.has(node[1])) {
+      const fn = ctx.func.map?.get(node[1])
+      if (fn && fn.body && !fn.raw && Array.isArray(fn.sig?.params) && !fn.rest) {
+        const args = callArgList(node)
+        for (let i = 0; i < args.length; i++) {
+          if (!names.has(args[i])) { walk(args[i]); continue }
+          const p = fn.sig.params[i]
+          if (!p || !paramAllUsesNumeric(fn.body, p.name, new Set([..._seen, node[1]]), false)) { ok = false; return }
+        }
+        return
+      }
+    }
+    // `Math.f(...)` ToNumbers every argument (Math operates on numbers), so a bare
+    // param in any arg slot is a PROVING numeric use — same contract as `*`/`-`.
+    // Without this, `Math.sin(t)` rejected the param via the generic-call fallthrough,
+    // so a numeric kernel like `Math.sin(tick) + …` lost its NUMBER proof and paid a
+    // per-use `__to_num` + a polymorphic-`+` string-concat fork (interference example).
+    // The callee is the lowered `math.sin` string at emit time (post-autoload), or the
+    // raw `(. Math sin)` member pre-lowering — match both.
+    const isMathCall = op === '()' && (
+      (typeof node[1] === 'string' && node[1].startsWith('math.')) ||
+      (Array.isArray(node[1]) && node[1][0] === '.' && node[1][1] === 'Math'))
+    if (isMathCall) {
+      const numArg = (a) => { if (Array.isArray(a) && a[0] === ',') { numArg(a[1]); numArg(a[2]) } else numOperand(a) }
+      for (let i = 2; i < node.length; i++) numArg(node[i])
+      return
+    }
+    // Binary `+` is overloaded (numeric add | string concat). A string-literal
+    // operand means concat intent → reject. Otherwise it is numeric-COMPATIBLE but
+    // not self-PROVING (a string param would concat) — recurse the non-param operand
+    // and treat a bare param as compatible (neither prove nor reject), exactly like
+    // paramNeverString. The numeric proof must still come from a ToNumber-forcing use
+    // (`*`, `Math.*`, …); a param used ONLY in `+` stays unproven (sound).
+    if (op === '+' && node.length === 3) {
+      if (isStrLiteral(node[1]) || isStrLiteral(node[2])) { ok = false; return }
       if (!names.has(node[1])) walk(node[1])
       if (!names.has(node[2])) walk(node[2])
       return
     }
-    if (op === '-' && node.length === 2) { if (!names.has(node[1])) walk(node[1]); return }  // unary negate
-    if (op === '-' && node.length === 3) { if (!names.has(node[1])) walk(node[1]); if (!names.has(node[2])) walk(node[2]); return }
+    if (op === '-' && node.length === 2) { numOperand(node[1]); return }  // unary negate
+    if (op === '-' && node.length === 3) { numOperand(node[1]); numOperand(node[2]); return }
     // `u-`/`u+` are the normalized unary minus/plus (prepare rewrites `-x`/`+x`); both ToNumber.
-    if ((op === 'u-' || op === 'u+') && node.length === 2) { if (!names.has(node[1])) walk(node[1]); return }
-    if (op === '+' && node.length === 2) { if (!names.has(node[1])) walk(node[1]); return }  // unary + = ToNumber
-    if (op === '~' && node.length === 2) { if (!names.has(node[1])) walk(node[1]); return }
+    if ((op === 'u-' || op === 'u+') && node.length === 2) { numOperand(node[1]); return }
+    if (op === '+' && node.length === 2) { numOperand(node[1]); return }  // unary + = ToNumber
+    if (op === '~' && node.length === 2) { numOperand(node[1]); return }
     for (let i = 1; i < node.length; i++) walk(node[i])  // bare param reaching here → rejected above
   }
   walk(body)
+  return requireProof ? (ok && proven) : ok
+}
+
+// String methods whose receiver MUST be a string — their presence proves the
+// param is (sometimes) string and disqualifies the boundary-numeric trust.
+const STRING_RECV_METHODS = new Set([
+  'charCodeAt', 'charAt', 'codePointAt', 'startsWith', 'endsWith', 'toUpperCase',
+  'toLowerCase', 'normalize', 'localeCompare', 'padStart', 'padEnd', 'repeat',
+  'trim', 'trimStart', 'trimEnd', 'split', 'match', 'matchAll', 'replace',
+  'replaceAll', 'substring', 'substr', 'concat', 'indexOf', 'lastIndexOf',
+  'includes', 'slice',
+])
+
+/** True iff no use of exported f64 param `name` REQUIRES it to be a string — so
+ *  the interop boundary contract (`wrapVal` passes a JS number straight to an f64
+ *  param; a string arg is a type misuse already unsupported, returning NaN) makes
+ *  it provably numeric. Weaker than `paramAllUsesNumeric`: that PROVES numericity
+ *  from ToNumber-forcing ops, this DISPROVES stringness so binary `+` (the common
+ *  `accumulator + cre` shape) no longer pessimistically pulls the string-concat
+ *  fork into a pure float kernel. Only sound under the export boundary — never use
+ *  for locals/closures, whose values can genuinely be strings.
+ *
+ *  Disqualifying (string-requiring) uses:
+ *   - `+` with a string-literal/template operand (`"px" + name`) — concat intent
+ *   - a string-receiver method call (`name.charCodeAt(…)`, `name.split(…)`)
+ *   - `name[k]` / `name.length` is NOT disqualifying (works on arrays/typed too,
+ *     but an f64 param is neither — so a member access means the caller passed a
+ *     pointer, out of the f64-number contract; conservatively we reject it)
+ *   - passing `name` to a call / returning it / storing into an aggregate: the
+ *     value escapes where it could be ToString'd; reject conservatively. */
+function paramNeverString(body, name) {
+  if (body == null) return false
+  let ok = true
+  const walk = (node) => {
+    if (!ok || node == null) return
+    if (typeof node === 'string') { if (node === name) ok = false; return }  // bare escape → reject
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    if (op === '=>') return                                  // shadowing-safe: closure handled conservatively (escape)
+    // `+` (binary): a string-literal/template operand makes it concat → reject.
+    // Otherwise the param is in an arithmetic add; recurse the non-name operand.
+    if (op === '+' && node.length === 3) {
+      if (isStrLiteral(node[1]) || isStrLiteral(node[2])) { ok = false; return }
+      for (let i = 1; i <= 2; i++) if (node[i] !== name) walk(node[i])
+      return
+    }
+    // Numeric/relational/bitwise binary + unary: param operand is fine, recurse rest.
+    if ((NUM_BIN_OPS.has(op) || REL_OPS.has(op)) && node.length === 3) {
+      for (let i = 1; i <= 2; i++) if (node[i] !== name) walk(node[i])
+      return
+    }
+    if ((op === 'u-' || op === 'u+' || op === '~') && node.length === 2) {
+      if (node[1] !== name) walk(node[1]); return
+    }
+    if (op === '-' && (node.length === 2 || node.length === 3)) {
+      for (let i = 1; i < node.length; i++) if (node[i] !== name) walk(node[i])
+      return
+    }
+    // Member access / method call on the param → it's a pointer, not an f64 number:
+    // reject (out of contract). `.`/`?.`/`[]` with the name as receiver.
+    if ((op === '.' || op === '?.' || op === '[]') && node[1] === name) { ok = false; return }
+    // `=`/compound reassignment of the param to a non-numeric value: reject if it
+    // could become a string. A reassignment makes the param mutable — conservatively
+    // require the RHS to be string-free too (recurse), and the target isn't a use.
+    for (let i = 1; i < node.length; i++) walk(node[i])
+  }
+  walk(body)
   return ok
 }
 
@@ -1025,6 +1255,32 @@ function emitClosureBody(cb) {
     if (ptRow[i] === true && !ctx.func.localReps?.get(cb.params[i])?.val)
       updateRep(cb.params[i], i < minArgc ? { val: VAL.NUMBER } : { val: VAL.NUMBER, nullable: true })
   }
+  // A param passed the same typed-array ctor at every direct call site is TYPED:
+  // register its element ctor so `buf[i]` reads use the typed load (it stays an f64
+  // NaN-box in the closure ABI, but knowing the kind avoids the dynamic `__typed_idx`
+  // /`__len` dispatch that pulls the string runtime). Numeric trust (above) wins if it
+  // already classified the slot — they're disjoint anyway (NUMBER vs TYPED arg).
+  const tcRow = ctx.closure.paramTypedCtors?.get(cb.name)
+  if (tcRow) for (let i = 0; i < cb.params.length; i++) {
+    const ctor = tcRow[i]
+    if (ctor && !ctx.func.localReps?.get(cb.params[i])?.val) {
+      updateRep(cb.params[i], { val: VAL.TYPED })
+      ;(ctx.types.typedElem ||= new Map()).set(cb.params[i], ctor)
+    }
+  }
+  // Body-usage numeric trust for closure params — the same proof the export path
+  // applies (paramAllUsesNumeric). A nested helper like heapsort's `heapify(n)` whose
+  // param is used only in arithmetic/relational positions is VAL.NUMBER, so `(n>>1)-1`
+  // skips the `__to_num` coercion that would otherwise drag the ToNumber string-parse
+  // tree into a pure-integer kernel. paramAllUsesNumeric walks any AST node, so this
+  // also covers expression-bodied arrows (`(m) => m | 0`) — the common closure shape
+  // whose dynamic param would otherwise emit a polymorphic add/coerce that pulls the
+  // whole string runtime in. Call-site evidence (ptRow) already covers the monomorphic
+  // case; this also catches params the lattice left unobserved.
+  for (const p of cb.params) {
+    if (!ctx.func.localReps?.get(p)?.val && !cb.defaults?.[p] && paramAllUsesNumeric(cb.body, p))
+      updateRep(p, { val: VAL.NUMBER })
+  }
 
   // Register captured variable locals: boxed = i32 cell pointer, otherwise f64 value
   for (let i = 0; i < cb.captures.length; i++) {
@@ -1308,6 +1564,11 @@ export default function compile(ast, profiler) {
     }
   }
 
+  // Whole-program constant fold of module-scope aggregate literals — `var x=[1,2,3];
+  // y=x[0]` → `y=1`, dropping the array (no data segment, no __arr_idx_known) when
+  // every reference is a static read. The scalar analog of the constInts fold above.
+  timePhase(profiler, 'foldAggregates', () => foldStaticConstAggregates(ast))
+
   const programFacts = timePhase(profiler, 'plan', () => plan(ast, profiler))
 
   // Inspect sink: editor hosts opt in via { inspect: true } to read inferred shapes.
@@ -1449,12 +1710,28 @@ export default function compile(ast, profiler) {
 
   timePhase(profiler, 'optimizeModule', () => optimizeModule(sec, profiler))
 
+  // Fold constant `__start` global inits into immutable inline decls (drops the
+  // store, and `__start` with it when that empties it). Runs HERE — after
+  // stripStaticDataPrefix and optimizeModule — so any data-segment offset a hoisted
+  // pointer carries is already in its final, shifted form (hoisting earlier would
+  // freeze a pre-strip offset the shift pass never revisits in the global decl).
+  hoistConstGlobalInits(sec)
+
   // Populate globals (after __start — const folding may update declarations).
   // Records build IR directly — no WAT-text parse-back.
-  sec.globals.push(...[...ctx.scope.globals].filter(([, g]) => g).map(([n, g]) => ['global', `$${n}`,
-    ...(g.export ? [['export', `"${g.export}"`]] : []),
-    g.mut ? ['mut', g.type] : g.type,
-    [`${g.type}.const`, g.init]]))
+  // The wasm type comes from globalTypes (the canonical name→type map declGlobal
+  // maintains alongside the entry), falling back to the entry's own `.type`. They
+  // are normally identical, but a global whose entry object is later rebuilt (e.g.
+  // hoistConstGlobalInits' `{...g, …}` spread) must not depend on that rebuild
+  // preserving `.type` — globalTypes is the stable source, so an entry that lost
+  // its `.type` still emits a well-typed `(global …)` rather than `(undefined.const)`.
+  sec.globals.push(...[...ctx.scope.globals].filter(([, g]) => g).map(([n, g]) => {
+    const ty = ctx.scope.globalTypes.get(n) ?? g.type
+    return ['global', `$${n}`,
+      ...(g.export ? [['export', `"${g.export}"`]] : []),
+      g.mut ? ['mut', ty] : ty,
+      [`${ty}.const`, g.init]]
+  }))
 
   // Data segments (after emit — string literals append to ctx.runtime.data / strPool during emit)
   // Active segment at address 0 — skipped for shared memory (would collide across modules)
@@ -1564,7 +1841,8 @@ export default function compile(ast, profiler) {
   const { callCount } = treeshake(
     [{ arr: sec.stdlib }, { arr: sec.funcs }, { arr: sec.start }],
     [...sec.start, ...sec.elem, ...sec.customs, ...sec.extStdlib, ...sec.imports, ...sec.tags],
-    { removeDead: !optCfg || optCfg.treeshake !== false, globals: sec.globals }
+    { removeDead: !optCfg || optCfg.treeshake !== false, globals: sec.globals, userGlobals: ctx.scope.userGlobals,
+      userFuncs: new Set(ctx.func.list.map(f => `$${f.name}`)) }
   )
 
   pruneUnusedThrowRuntime(sec)

package/src/compile/infer.js

@@ -46,7 +46,7 @@
 import { ctx } from '../ctx.js'
 import { collectParamNames, ASSIGN_OPS } from '../ast.js'
 import { analyzeValTypes, analyzeIntCertain } from './analyze.js'
-import { staticObjectProps } from '../static.js'
+import { staticObjectProps, staticArrayElems } from '../static.js'
 import { typedElemCtor } from '../type.js'
 import { ctorFromElemAux } from '../../layout.js'
 import { shapeOfObjectLiteralAst, valTypeOf } from '../kind.js'
@@ -341,6 +341,41 @@ export function recordGlobalRep(name, expr) {
   }
   const ctor = typedElemCtor(expr)
   if (ctor) (ctx.scope.globalTypedElem ||= new Map()).set(name, ctor)
+  // Module-level const array literal with a uniform element val-type (e.g. a numeric
+  // table `const FREQS = [261.63, …]`): record it so `FREQS[i]` reads in any using
+  // function are typed (NUMBER) rather than untyped. Without this an untyped element
+  // read makes `s += FREQS[i]` take the polymorphic +/ToString path — dragging the
+  // entire string runtime (~5 kB) into a kernel that uses no strings. A function-local
+  // array gets this from analyzeValTypes; a module-level one is invisible to the using
+  // function's body walk, so capture it here. Soundness for a later `FREQS[i]=…` is the
+  // read-site dynWriteVars guard in valTypeOf (kind.js) — this is just the literal fact.
+  if (vt === VAL.ARRAY) {
+    const elems = staticArrayElems(expr)
+    if (elems && elems.length && elems.every(e => e != null)) {
+      let common = valTypeOf(elems[0])
+      for (let k = 1; k < elems.length && common != null; k++)
+        if (valTypeOf(elems[k]) !== common) common = null
+      if (common != null) updateGlobalRep(name, { arrayElemValType: common })
+      // Array-of-arrays numeric table (`const C = [[0,4,7], …]`): also record the
+      // nested element kind so `C[i][j]` (and `ch = C[i]; ch[j]`) reads stay typed —
+      // the same string-runtime drop as the flat case, one level down. Single-level
+      // (mirrors analyzeValTypes' local arrElemElemValTypes); deeper nesting falls back.
+      if (common === VAL.ARRAY) {
+        let nested = null, seen = false, ok = true
+        for (const el of elems) {
+          const inner = staticArrayElems(el)
+          if (!inner || !inner.length || !inner.every(e => e != null)) { ok = false; break }
+          for (const ie of inner) {
+            const ivt = valTypeOf(ie)
+            if (!seen) { nested = ivt; seen = true }
+            else if (ivt !== nested) { ok = false; break }
+          }
+          if (!ok) break
+        }
+        if (ok && nested != null) updateGlobalRep(name, { arrayElemElemValType: nested })
+      }
+    }
+  }
   // Static-shape capture for module-level object literals — lets `{ ...G.path }`
   // resolve its source schema by walking the global rep's shape tree at the
   // spread site (see shape walk in analyze.js / resolveSchema in object.js).