jz 0.6.0 → 0.8.0

package/package.json

@@ -1,17 +1,22 @@
 {
   "name": "jz",
-  "version": "0.6.0",
-  "description": "Functional JS subset compiling to WASM",
+  "version": "0.8.0",
+  "description": "Ahead-of-time compiler for the numeric core of JavaScript (DSP, audio, math, parsers) to lean GC-free WASM — valid jz is valid JS, no type annotations, no runtime.",
   "main": "index.js",
+  "types": "index.d.ts",
   "type": "module",
   "exports": {
-    ".": "./index.js",
+    ".": {
+      "types": "./index.d.ts",
+      "default": "./index.js"
+    },
     "./wasi": "./wasi.js",
     "./interop": "./interop.js",
     "./transform": "./transform.js"
   },
   "files": [
     "index.js",
+    "index.d.ts",
     "cli.js",
     "wasi.js",
     "interop.js",
@@ -20,6 +25,8 @@
     "jzify",
     "src",
     "module",
+    "dist/jz.js",
+    "dist/interop.js",
     "README.md",
     "jz.svg",
     "alternatives.svg",
@@ -48,9 +55,14 @@
     "bench:size": "node scripts/bench-size.mjs",
     "bench:compile": "node scripts/bench-compile.mjs",
     "bench:startup": "node scripts/bench-startup.mjs",
+    "bench:self": "node scripts/bench-selfhost.mjs",
+    "bench:readme": "node scripts/bench-readme.mjs",
+    "audit:as": "node scripts/audit-assemblyscript.mjs",
     "build": "node scripts/build-dist.mjs",
-    "build:examples": "for dir in examples/*/; do [ -f \"$dir/build.mjs\" ] && node \"$dir/build.mjs\"; done",
-    "prepublishOnly": "npm test && npm run test:self"
+    "build:examples": "node examples/build.mjs all",
+    "prepublishOnly": "npm test && npm run build && npm run test:self",
+    "prepare": "npm run build",
+    "audit:fixpoint": "node scripts/audit-fixpoint.mjs"
   },
   "repository": {
     "type": "git",
@@ -64,7 +76,7 @@
   "license": "MIT",
   "dependencies": {
     "subscript": "^10.4.17",
-    "watr": "^4.6.10"
+    "watr": "^4.7.1"
   },
   "keywords": [
     "javascript",
@@ -81,10 +93,17 @@
     "audio",
     "creative-coding",
     "assemblyscript",
-    "porffor"
+    "porffor",
+    "numeric",
+    "signal-processing",
+    "math",
+    "audio-worklet",
+    "js-to-wasm",
+    "performance"
   ],
   "devDependencies": {
     "esbuild": "^0.28.0",
+    "sprae": "^13.3.8",
     "tst": "^9.4.0"
   }
 }

package/src/abi/string.js

@@ -56,7 +56,7 @@
 // take. Kept as a one-liner so each op reads as a single `call`.
 const ssoI64 = (sF64) => ['i64.reinterpret_f64', sF64]
 
-import { isReassigned } from '../ast.js'
+import { isReassigned, isLeaf } from '../ast.js'
 import { LAYOUT, oobNanIR, ssoBitI64Hex } from '../../layout.js'
 
 /** Pre-shifted SSO discriminator — layout.js is cycle-free; memoized at first use. */
@@ -79,10 +79,6 @@ const allocLocalI32 = (ctx, tag) => {
   return name
 }
 
-const _isLeaf = (n) => Array.isArray(n) &&
-  (n[0] === 'local.get' || n[0] === 'global.get' ||
-   n[0] === 'i32.const' || n[0] === 'i64.const' ||
-   n[0] === 'f64.const' || n[0] === 'f32.const')
 
 /** Per-use cheap form of `charCodeAt` against a pre-decomposed param receiver
  *  (shape 1): a bounds check plus a 2-arm SSO/heap byte select reading the four
@@ -90,22 +86,29 @@ const _isLeaf = (n) => Array.isArray(n) &&
  *  side-effecting `iI32` is spilled to a scratch local first — leaves are safe
  *  to duplicate. `oobNan` picks the OOB contract / result type exactly as in
  *  the generic path. */
-function emitDecompCharRead(dec, iI32, ctx, oobNan) {
+function emitDecompCharRead(dec, iI32, ctx, oobNan, inBounds = false) {
   const rt = oobNan ? 'f64' : 'i32'
   let idx = iI32, spill = null
-  if (!_isLeaf(iI32)) { spill = allocLocalI32(ctx, 'ci'); idx = ['local.get', `$${spill}`] }
-  const ssoByteExpr = ['i32.and',
-    ['i32.shr_u', ['local.get', `$${dec.base}`], ['i32.shl', idx, ['i32.const', 3]]],
-    ['i32.const', 0xFF]]
+  if (!isLeaf(iI32)) { spill = allocLocalI32(ctx, 'ci'); idx = ['local.get', `$${spill}`] }
+  const ssoByteExpr = ['i32.wrap_i64', ['i64.and',
+    ['i64.shr_u', ['local.get', `$${dec.ptr64}`], ['i64.mul', ['i64.extend_i32_u', idx], ['i64.const', 7]]],
+    ['i64.const', '0x7f']]]
   const heapByteExpr = ['i32.load8_u', ['i32.add', ['local.get', `$${dec.loadbase}`], idx]]
   const ccByte = ['if', ['result', 'i32'],
     ['local.get', `$${dec.sso}`],
     ['then', ssoByteExpr],
     ['else', heapByteExpr]]
-  const use = ['if', ['result', rt],
-    ['i32.ge_u', idx, ['local.get', `$${dec.len}`]],
-    ['then', oobNan ? oobNanIR() : ['i32.const', 0]],
-    ['else', oobNan ? ['f64.convert_i32_u', ccByte] : ccByte]]
+  // `inBounds`: the index is proven in [0, len) by an enclosing canonical scan
+  // (analyze.js inBoundsCharCodeAt / splitCharScanLoops' in-bounds main loop), so
+  // the OOB arm is dead — drop the per-char `i >= len` compare. This is what turns
+  // a split char-scan loop into a bare load (the `if(sso)` arm is loop-invariant and
+  // V8-folds), matching AS/native on tokenizer-shape scans. Otherwise keep the guard.
+  const use = inBounds
+    ? (oobNan ? ['f64.convert_i32_u', ccByte] : ccByte)
+    : ['if', ['result', rt],
+        ['i32.ge_u', idx, ['local.get', `$${dec.len}`]],
+        ['then', oobNan ? oobNanIR() : ['i32.const', 0]],
+        ['else', oobNan ? ['f64.convert_i32_u', ccByte] : ccByte]]
   return spill
     ? ['block', ['result', rt], ['local.set', `$${spill}`, iI32], use]
     : use
@@ -131,9 +134,8 @@ export function emitCharDecompPrologue(dec) {
     ['i64.const', 0]]
   const offMask = `0x${LAYOUT.OFFSET_MASK.toString(16).toUpperCase()}`
   const off = ['i32.wrap_i64', ['i64.and', ptr, ['i64.const', offMask]]]
-  const ssoLen = ['i32.and',
-    ['i32.wrap_i64', ['i64.shr_u', ptr, ['i64.const', LAYOUT.AUX_SHIFT]]],
-    ['i32.const', LAYOUT.SSO_BIT - 1]]
+  // SSO length lives at payload bits 42-44 (7-bit-codec layout; see module/string.js).
+  const ssoLen = ['i32.wrap_i64', ['i64.and', ['i64.shr_u', ptr, ['i64.const', 42]], ['i64.const', 7]]]
   // Heap length is `i32.load(off - 4)`; guard against off<4 (corrupt/non-string
   // payload) so the load doesn't trap on a wrapped-negative address.
   const heapLen = ['if', ['result', 'i32'],
@@ -146,6 +148,7 @@ export function emitCharDecompPrologue(dec) {
       ['then',
         ['local.set', `$${dec.sso}`, ['i32.const', 1]],
         ['local.set', `$${dec.base}`, off],
+        ['local.set', `$${dec.ptr64}`, ptr],   // full payload: SSO chars are 7-bit, span into aux
         ['local.set', `$${dec.len}`, ssoLen],
         // SSO: route every per-iter load to address 0 (always valid, byte
         // discarded by the outer select).
@@ -212,7 +215,7 @@ export const sso = {
      *  `src/compile.js#emitFunc` — it drains `ctx.func.charDecomp` after the
      *  body emit completes and splices an init block between the boxed-param
      *  inits and the user statements. */
-    charCodeAt: (sF64, iI32, ctx, oobNan = false) => {
+    charCodeAt: (sF64, iI32, ctx, oobNan = false, inBounds = false) => {
       // `oobNan` selects the out-of-bounds semantics and result type:
       //   - false (default): OOB → `i32.const 0`, result i32 — the raw-byte
       //     primitive used by the `buf += s[i]` append-byte fast path.
@@ -256,14 +259,16 @@ export const sso = {
             // discards it). Pre-computing it in the prologue removes a
             // per-iter `select` and lets V8 fold the add into the load.
             const loadbase = `${name}$ccldb`
+            const ptr64 = `${name}$ccp64`
             ctx.func.locals.set(base, 'i32')
             ctx.func.locals.set(len, 'i32')
             ctx.func.locals.set(sso, 'i32')
             ctx.func.locals.set(loadbase, 'i32')
-            dec = { base, len, sso, loadbase, param: name }
+            ctx.func.locals.set(ptr64, 'i64')   // full SSO payload for 7-bit char extraction
+            dec = { base, len, sso, loadbase, ptr64, param: name }
             ctx.func.charDecomp.set(name, dec)
           }
-          return emitDecompCharRead(dec, iI32, ctx, oobNan)
+          return emitDecompCharRead(dec, iI32, ctx, oobNan, inBounds)
         }
       }
 
@@ -277,9 +282,6 @@ export const sso = {
       // so we MUST spill anything that isn't side-effect-free to a local
       // before referencing it more than once. Leaves (`local.get`, `*.const`,
       // `global.get`) are safe to duplicate; everything else is spilled.
-      const isLeaf = (n) => Array.isArray(n) &&
-        (n[0] === 'local.get' || n[0] === 'global.get' ||
-         n[0] === 'i32.const' || n[0] === 'i64.const' || n[0] === 'f64.const' || n[0] === 'f32.const')
       const sLeaf = isLeaf(sF64)
       const iLeaf = isLeaf(iI32)
       const ptrI64Expr = ssoI64(sF64)
@@ -301,12 +303,10 @@ export const sso = {
       }
       const offMask = `0x${LAYOUT.OFFSET_MASK.toString(16).toUpperCase()}`
       const offExpr = () => ['i32.wrap_i64', ['i64.and', getPtr(), ['i64.const', offMask]]]
-      const ssoLen = ['i32.and',
-        ['i32.wrap_i64', ['i64.shr_u', getPtr(), ['i64.const', LAYOUT.AUX_SHIFT]]],
-        ['i32.const', LAYOUT.SSO_BIT - 1]]
-      const ssoByte = ['i32.and',
-        ['i32.shr_u', offExpr(), ['i32.mul', getIdx(), ['i32.const', 8]]],
-        ['i32.const', 0xFF]]
+      const ssoLen = ['i32.wrap_i64', ['i64.and', ['i64.shr_u', getPtr(), ['i64.const', 42]], ['i64.const', 7]]]
+      const ssoByte = ['i32.wrap_i64', ['i64.and',
+        ['i64.shr_u', getPtr(), ['i64.mul', ['i64.extend_i32_u', getIdx()], ['i64.const', 7]]],
+        ['i64.const', '0x7f']]]
       const ssoBranch = ['if', ['result', rt],
         ['i32.ge_u', getIdx(), ssoLen],
         ['then', mkOob()],

package/src/ast.js

@@ -66,6 +66,11 @@ export const isBlockBody = (body) =>
 export const isLiteralStr = idx => Array.isArray(idx) && idx[0] === 'str' && typeof idx[1] === 'string'
 export const isFuncRef = (node, funcNames) => typeof node === 'string' && funcNames.has(node)
 
+/** A value-leaf IR instruction — `local.get`/`global.get`/any `*.const`. Cheap and
+ *  side-effect-free, so safe to duplicate without spilling to a temp. The one
+ *  source of truth for "is this trivially duplicatable" across ir/abi/optimize. */
+export const isLeaf = n => Array.isArray(n) && (n[0] === 'local.get' || n[0] === 'global.get' || n[0].endsWith('.const'))
+
 // === Assignment / reassignment ===
 
 /** Assignment operators — shared across analyze, plan, emit, abi. */
@@ -385,9 +390,21 @@ export function cloneNode(node) {
 /** Structural equality via JSON. AST nodes are JSON-serializable except i64.const
  *  BigInt payloads (NaN-box prefixes — dcbb433 routes pointer offsets through boxed
  *  forms); the replacer stringifies those as `<n>n` (cf. formatErrorNode in ctx.js). */
-export const bigintSafeKey = (_k, v) => typeof v === 'bigint' ? `${v}n` : v
+// Replacer for structural node-equality / dedup keys. JSON.stringify is the fast
+// path, but it silently collapses values it can't round-trip: bigint throws, and —
+// the subtle one — Infinity / -Infinity / NaN ALL stringify to `null` while -0
+// stringifies to `0`. Two nodes differing ONLY in such a constant then serialize
+// identically and compare equal — an unsound merge (SLP packs `[Inf,-Inf]` as one
+// splat lane; CSE/LICM dedups distinct invariants). Tag each so it round-trips with
+// Object.is semantics.
+export const stableKey = (_k, v) => {
+  if (typeof v === 'bigint') return `${v}n`
+  if (typeof v === 'number' && (v !== v || v === Infinity || v === -Infinity || Object.is(v, -0)))
+    return v !== v ? '#NaN' : v === Infinity ? '#Inf' : v === -Infinity ? '#-Inf' : '#-0'
+  return v
+}
 export function nodeEqual(a, b) {
-  return JSON.stringify(a, bigintSafeKey) === JSON.stringify(b, bigintSafeKey)
+  return JSON.stringify(a, stableKey) === JSON.stringify(b, stableKey)
 }
 
 /** Property entries of an object-literal AST node (`['{}', …]`). */

package/src/autoload.js

@@ -127,6 +127,9 @@ const MOD_DEPS = {
   date: ['core', 'number', 'string'],
   console: ['core', 'string', 'number'],
   regex: ['core', 'string', 'array'],
+  // f64x2.sin/cos lower to math's $math.sin2/$math.cos2 WAT helpers; pull math in so
+  // they're registered. Unused math helpers are pruned by reachability — no output cost.
+  simd: ['math'],
 }
 
 export function includeModule(name) {

package/src/compile/analyze-scans.js

@@ -5,7 +5,7 @@
 
 import { ASSIGN_OPS, collectParamNames, extractParams, REFS_IN_EXPR, refsName, T, isLiteralStr } from '../ast.js'
 import { ctx } from '../ctx.js'
-import { staticObjectProps } from '../static.js'
+import { staticObjectProps, staticArrayElems, staticIndexKey, staticValue, NO_VALUE } from '../static.js'
 import { exprType } from '../type.js'
 
 export function findFreeVars(node, bound, free, scope) {
@@ -168,7 +168,7 @@ export function scanBindingUses(body) {
   const use = (name, kind, extra) => slot(name).uses.push(extra ? { kind, ...extra } : { kind })
 
   // Static string key of a `[]` index node, else null (computed).
-  const litKey = (k) => (Array.isArray(k) && k[0] === 'str' && typeof k[1] === 'string') ? k[1] : null
+  const litKey = (k) => (Array.isArray(k) && k[0] === 'str' && typeof k[1] === 'string') ? k[1] : staticIndexKey(k)
 
   // A child sitting in a value position. A bare string there is a real use —
   // `walk` alone silently drops non-array children, so every value-position
@@ -350,6 +350,10 @@ export function scanBindingUses(body) {
  * Field `i` of binding `o` lives in WASM local `o#${i}` (`#` cannot occur in a
  * jz identifier, so the name is collision-free).
  */
+// Largest array literal that dissolves into scalar slots. Beyond this a single
+// constant data segment is cheaper than N locals (+ the per-slot init prologue).
+const FLAT_ARRAY_MAX = 8
+
 export function scanFlatObjects(body) {
   const cand = new Map()                 // name → {names, values}
 
@@ -357,19 +361,48 @@ export function scanFlatObjects(body) {
   // slots). Used only to reject a self-referential initializer — a literal
   // whose own field values mention the binding is not a self-contained object.
   for (const [name, s] of scanBindingUses(body)) {
-    if (s.decls !== 1 || !Array.isArray(s.initRhs) || s.initRhs[0] !== '{}') continue
-    const props = staticObjectProps(s.initRhs.slice(1))
+    if (s.decls !== 1 || !Array.isArray(s.initRhs)) continue
+    // Candidate aggregate: an object literal `{…}` (string keys) or a small array
+    // literal `[…]` (index keys "0","1",…). An array dissolves into `name#i` scalar
+    // locals exactly like an object — same `.`/`[]` flat hooks, no heap alloc — when
+    // every use is a static-index read/write. Capped at FLAT_ARRAY_MAX: a larger
+    // literal belongs in one constant data-segment region, not N spilled locals.
+    let props
+    if (s.initRhs[0] === '{}') {
+      props = staticObjectProps(s.initRhs.slice(1))
+    } else if (s.initRhs[0] === '[' || s.initRhs[0] === '[]') {
+      const elems = staticArrayElems(s.initRhs)
+      if (!elems || !elems.length || elems.length > FLAT_ARRAY_MAX) continue
+      // Holes (`[1,,3]`) and spreads (`[...x]`) aren't a fixed positional schema.
+      if (elems.some(e => e == null || (Array.isArray(e) && e[0] === '...'))) continue
+      // Only compile-time-constant *value* elements dissolve — number/string/bool/null
+      // ("arrays hold JSON values"). A non-literal element (identifier, call, closure,
+      // arithmetic on a runtime var) can carry a function/closure whose call-indirect
+      // table index binds to the array, not a scalar local — dissolving the slot
+      // desyncs the `elem` section. Conservative: any non-constant element keeps the
+      // array heap-backed.
+      if (!elems.every(e => staticValue(e) !== NO_VALUE)) continue
+      props = { names: elems.map((_, i) => String(i)), values: elems }
+    } else continue
+    const isArr = s.initRhs[0] !== '{}'
     if (!props || new Set(props.names).size !== props.names.length) continue
     if (props.values.some(v => refsName(v, name, REFS_IN_EXPR))) continue
 
-    // Schema = literal keys ∪ plain literal-key member writes. Such a write
-    // monotonically extends the static field universe (the new field reads
-    // `undefined` until the write runs, exactly as JS does); the schema stays
-    // closed because any computed/off-schema access disqualifies below.
+    // Schema = literal keys ∪ plain literal-key member writes. For an OBJECT such a
+    // write monotonically extends the static field universe (the new field reads
+    // `undefined` until the write runs, exactly as JS does). An ARRAY has a *fixed*
+    // positional schema: `a.length = …` / `a[n] = …` (off the literal indices) resize
+    // or grow it — not a field add — so arrays never extend, and any off-schema write
+    // (including `.length`, which isn't a slot) disqualifies below.
+    // `written` = the keys a MEMBER_W reassigns — a slot is write-once (its
+    // value-type is exactly its literal initializer's) iff its key is absent here.
     const schema = new Set(props.names)
+    const written = new Set()
     for (const u of s.uses)
-      if (u.kind === USE.MEMBER_W && !u.compound && !u.computed && u.key != null)
-        schema.add(u.key)
+      if (u.kind === USE.MEMBER_W && !u.compound && !u.computed && u.key != null) {
+        if (!isArr) schema.add(u.key)
+        written.add(u.key)
+      }
 
     // Flat iff every mention is an in-schema literal-key `.`/`[]` READ, or an
     // in-schema literal-key plain `.`/`[]` WRITE. Any other use kind — `?.`,
@@ -385,7 +418,7 @@ export function scanFlatObjects(body) {
     const names = props.names.slice(), values = props.values.slice()
     for (const k of schema)
       if (!names.includes(k)) { names.push(k); values.push(undefined) }
-    cand.set(name, { names, values })
+    cand.set(name, { names, values, written })
   }
   return cand
 }
@@ -432,6 +465,136 @@ export function scanSliceViews(body) {
   return views
 }
 
+/**
+ * Never-relocated array bindings — reads through them may skip the realloc-forwarding
+ * follow (`__ptr_offset`). A fresh array-literal binding is never relocated iff EVERY
+ * occurrence of it is a pure READ — `a[i]` (any index) or `a.length`. Anything else
+ * grows or escapes it: a grow method (push/unshift/shift/splice), a `.length`/element
+ * write (incl. compound `a.length += 1`), a bare value use (alias `let b=a`, store
+ * `w.x=a`, return, call argument, spread), a reassignment, or a dynamic call
+ * `a[i]()`/`a.m()`.
+ *
+ * MEMORY-SAFETY CRITICAL and so DEFAULT-DENY + self-contained: it does NOT trust the
+ * `escapes` map, which misses member-write RHS (`w.data = a`) and compound assigns. If
+ * the analysis is wrong and the array IS relocated, a read through the stale base
+ * corrupts memory — so any unrecognized use disqualifies. (Growing an INNER array,
+ * `a[0].push(x)`, never relocates `a` itself, so `a` stays eligible — see safeReads.)
+ */
+const grownOrEscapes = (op) => ASSIGN_OPS.has(op) || op === '++' || op === '--' || op === 'delete'
+function safeReads(node, name) {
+  if (typeof node === 'string') return node !== name            // bare value use → escape
+  if (!Array.isArray(node)) return true
+  const op = node[0]
+  // `a(…)` / `a.m(…)` / `a[i](…)` — calling `a` or a method/element of it may grow/escape it.
+  if (op === '()') {
+    const c = node[1]
+    if (c === name) return false
+    if (Array.isArray(c) && (c[0] === '.' || c[0] === '?.' || c[0] === '[]' || c[0] === '?.[]') && c[1] === name) return false
+  }
+  // write / update / delete on `a`, `a[..]`, or `a.x` (incl. `a.length = …` and compounds)
+  if (grownOrEscapes(op)) {
+    const t = node[1]
+    if (t === name) return false
+    if (Array.isArray(t) && (t[0] === '[]' || t[0] === '.' || t[0] === '?.') && t[1] === name) return false
+  }
+  // declaration: check each initializer RHS (so `let b = a` aliasing disqualifies);
+  // the bound names themselves are definitions, not uses (skips `a`'s own decl).
+  if (op === 'let' || op === 'const' || op === 'var') {
+    for (let i = 1; i < node.length; i++) {
+      const d = node[i]
+      if (Array.isArray(d) && d[0] === '=' && !safeReads(d[2], name)) return false
+    }
+    return true
+  }
+  // the only safe forms: `a.length` read, and `a[i]` index read (recurse the index expr).
+  if ((op === '.' || op === '?.') && node[1] === name) return node[2] === 'length'
+  if (op === '[]' && node[1] === name) return safeReads(node[2], name)
+  if (op === '...' && node[1] === name) return false            // spread → escape
+  for (let i = 1; i < node.length; i++) if (!safeReads(node[i], name)) return false
+  return true
+}
+
+export function scanNeverGrown(body) {
+  const out = new Set()
+  for (const [name, s] of scanBindingUses(body)) {
+    // Candidate: a single-declaration binding initialized from a fresh array literal.
+    if (s.decls !== 1 || !Array.isArray(s.initRhs)) continue
+    if (s.initRhs[0] !== '[' && !(s.initRhs[0] === '[]' && s.initRhs.length <= 2)) continue
+    if (safeReads(body, name)) out.add(name)
+  }
+  return out
+}
+
+/**
+ * Numeric-fill arrays — the construct-then-fill counterpart of an all-number array
+ * literal. A fresh `Array(n)` / `new Array(n)` / `[]` binding whose EVERY element write
+ * stores a provably-NUMBER value, and which never escapes, aliases, is reassigned, grows
+ * by method, or takes a non-numeric / compound element write, holds only Numbers (unwritten
+ * holes read as 0 in jz, also a Number). So its `a[i]` reads can skip the polymorphic
+ * `__to_num` coercion — exactly the win `[1,2,3]` already gets, extended to the dominant
+ * numeric-kernel shape `let a = Array(n); for (..) a[i] = expr`.
+ *
+ * Default-deny and self-contained, like scanNeverGrown (the same memory-safety discipline):
+ * any occurrence that isn't a pure index/length READ or a NUMBER-valued `a[i] = …` write
+ * disqualifies — so `w.x = a`, `f(a)`, `let b = a`, `a.push(x)`, `a[i] += x` all bail.
+ * `isNumericRhs` injects the value-type judgement (valTypeOf === VAL.NUMBER) the syntactic
+ * scan can't make itself.
+ */
+// Both `Array(n)` and `new Array(n)` normalize to a `new.Array` call by prepare; an
+// empty literal stays `['[]', null]`. (Typed ctors become `new.Float64Array` etc. — the
+// exact-match on `new.Array` keeps them out.)
+const isFreshArrayCtor = (rhs) =>
+  Array.isArray(rhs) && (
+    (rhs[0] === '[]' && rhs.length <= 2) ||             // empty `[]`
+    (rhs[0] === '()' && rhs[1] === 'new.Array')         // `Array(n)` / `new Array(n)` / `Array()`
+  )
+
+function numFillSafe(node, name, isNumericRhs) {
+  if (typeof node === 'string') return node !== name              // bare value use → escape
+  if (!Array.isArray(node)) return true
+  const op = node[0]
+  // `a[i] = rhs` — the fill write. Allowed iff rhs is provably NUMBER; recurse the index
+  // and rhs so a stray `a` inside either still disqualifies. (Compound `a[i] += …` is NOT
+  // matched here, so it falls through to the deny below — conservative for v1.)
+  if (op === '=' && Array.isArray(node[1]) && node[1][0] === '[]' && node[1][1] === name)
+    return isNumericRhs(node[2], name) &&
+      numFillSafe(node[1][2], name, isNumericRhs) && numFillSafe(node[2], name, isNumericRhs)
+  // calling `a`, `a.m(…)`, `a[i](…)` may grow/escape it
+  if (op === '()') {
+    const c = node[1]
+    if (c === name) return false
+    if (Array.isArray(c) && (c[0] === '.' || c[0] === '?.' || c[0] === '[]' || c[0] === '?.[]') && c[1] === name) return false
+  }
+  // any other write/update/delete on `a`, `a[..]`, `a.x` (incl. `a.length = …`, compounds)
+  if (grownOrEscapes(op)) {
+    const t = node[1]
+    if (t === name) return false
+    if (Array.isArray(t) && (t[0] === '[]' || t[0] === '.' || t[0] === '?.') && t[1] === name) return false
+  }
+  if (op === 'let' || op === 'const' || op === 'var') {
+    for (let i = 1; i < node.length; i++) {
+      const d = node[i]
+      if (Array.isArray(d) && d[0] === '=' && !numFillSafe(d[2], name, isNumericRhs)) return false
+    }
+    return true
+  }
+  // the only safe forms: `a.length` read, and `a[i]` index read (recurse the index expr).
+  if ((op === '.' || op === '?.') && node[1] === name) return node[2] === 'length'
+  if (op === '[]' && node[1] === name) return numFillSafe(node[2], name, isNumericRhs)
+  if (op === '...' && node[1] === name) return false              // spread → escape
+  for (let i = 1; i < node.length; i++) if (!numFillSafe(node[i], name, isNumericRhs)) return false
+  return true
+}
+
+export function scanNumericFill(body, isNumericRhs) {
+  const out = new Set()
+  for (const [name, s] of scanBindingUses(body)) {
+    if (s.decls !== 1 || !isFreshArrayCtor(s.initRhs)) continue
+    if (numFillSafe(body, name, isNumericRhs)) out.add(name)
+  }
+  return out
+}
+
 /**
  * Narrow uint32 accumulator locals to unsigned i32. A local qualifies when its
  * initializer is a non-negative integer literal in [0, 2^32), every