jz 0.6.0 → 0.8.0

package/src/compile/emit.js

@@ -25,8 +25,10 @@ import {
   commaList, T, isBlockBody, isReassigned, mutatesArrayLength, isConstLiteral, constLiteralHoistable,
   hasOwnContinue, hasLabeledContinueTo, hasOwnBreakOrContinue, extractParams, classifyParam, JZ_UNDEF, TYPEOF,
 } from '../ast.js'
-import { ctx, err, inc, PTR } from '../ctx.js'
-import { nonNegIntLiteral, staticPropertyKey } from '../static.js'
+import { ctx, err, inc, warnDeopt, PTR } from '../ctx.js'
+import { includeForStringOnly } from '../autoload.js'
+import { FITS_I32_MAX } from '../widen.js'
+import { nonNegIntLiteral, intLiteralValue, staticPropertyKey } from '../static.js'
 import { findFreeVars } from './analyze.js'
 import {
   containsNestedClosure, containsNestedLoop, nestedSmallLoopBudget,
@@ -41,7 +43,7 @@ import {
   NULL_IR, nullExpr, undefExpr, MAX_CLOSURE_ARITY,
   WASM_OPS, SPREAD_MUTATORS, BOXED_MUTATORS,
   mkPtrIR, ptrOffsetIR, ptrTypeIR, ptrTypeEq, dispatchByPtrType, sidecarOverride, valKindToPtr,
-  isLit, litVal, isNullishLit, isPureIR, emitNum, f64rem, toNumF64, toStrI64,
+  isLit, litVal, isNullishLit, isPureIR, emitNum, f64rem, toNumF64, toStrI64, maskBound,
   truthyIR, toBoolFromEmitted, isPostfix,
   isGlobal, isConst, usesDynProps, needsDynShadow,
   temp, tempI32, tempI64, allocPtr,
@@ -76,7 +78,45 @@ const stringOps = (node) => {
 // instead route through ToNumber (`toNumF64`), which performs ToPrimitive.
 const isI32Num = (v) => v.type === 'i32' && v.ptrKind == null
 
+// Peel an emitted operand back to its raw i32 value when it carries one: a value already
+// typed i32 (integer literals included — they emit as i32.const), or an integer read wrapped
+// in f64.convert_i32_s/u (typed-array / i32-global reads default to the f64 rep). Else null.
+const peelI32 = (v) =>
+  isI32Num(v) ? v
+    : (Array.isArray(v) && (v[0] === 'f64.convert_i32_s' || v[0] === 'f64.convert_i32_u'))
+      ? (Array.isArray(v[1]) ? typed(v[1], 'i32') : v[1])
+      : null
+
+// Native wrapping i32 arithmetic for `+`/`-`/`*` whose result is consumed as i32. Peels the
+// f64.convert_i32_s/u that integer reads (`DX[i]`, a global Int32Array) wrap their load in, so
+// `ax = ax + DX[i]` (ax and DX[i] both i32) lowers to one i32.add instead of the
+// convert → f64.add → trunc_sat round-trip that doubled hot integer loops (ulam's spiral walk,
+// ring-buffer indexing). Bit-identical for an i32 result: ToInt32(exact) ≡ two's-complement wrap.
+// Gated on exprType(whole expr)==='i32' so an f64-consumed sum — or an unsigned-wide (uint32)
+// operand, which exprType already reports as f64 — still widens. Returns null when inapplicable.
+const tryI32Arith = (wasmOp, astOp, a, b, va, vb) => {
+  const pa = peelI32(va); if (pa == null) return null
+  const pb = peelI32(vb); if (pb == null) return null
+  if (exprType([astOp, a, b], ctx.func.locals) !== 'i32') return null
+  return typed([wasmOp, pa, pb], 'i32')
+}
+
+// f64 arithmetic that can MINT a sign-nondeterministic NaN (0/0, ∞−∞, 0·∞, x%0): on x86
+// these are 0xFFF8…, on arm 0x7FF8…. sqrt/min/max/neg are NOT here — they canon at their
+// own emit (math.js / unary `-`), so they reach canonNum already canonical.
+const NAN_MINTING = new Set(['f64.div', 'f64.add', 'f64.sub', 'f64.mul'])
+
 const canonNum = (node) => {
+  // Fold a possibly-non-canonical NaN to the canonical number-NaN before it reaches a
+  // bit-comparing consumer (__is_truthy / untyped === / typeof), which match the canonical
+  // NaN by bits and so misread x86's 0xFFF8 as truthy. ONLY an un-canon'd NaN-minting
+  // arithmetic op can carry such a value — literals, i32-conversions, opaque locals/calls
+  // (canonical by the canon-at-source invariant) and already-canon'd shapes don't — so
+  // skipping everything else keeps the size win. (The broken middle ground was
+  // `02873d0`'s `isNumericIR` skip, which dropped canon for f64.div too → x86 miscompile.)
+  const arith = Array.isArray(node) &&
+    (NAN_MINTING.has(node[0]) || (node[0] === 'call' && node[1] === '$__rem'))
+  if (!arith) return node
   const t = temp('cn')
   return typed(['block', ['result', 'f64'],
     ['local.set', `$${t}`, node],
@@ -86,6 +126,21 @@ const canonNum = (node) => {
       ['f64.ne', ['local.get', `$${t}`], ['local.get', `$${t}`]]]], 'f64')
 }
 
+// Is an emitted arm `v` (AST `node`) a plain NUMBER? The predicate the two-arm merges
+// (?:, ??) share to decide canon: an i32 number, NUMBER-tagged IR, or a NUMBER
+// value-type qualifies; a pointer/opaque arm does not. `vt` is the node's resolved
+// value-type — pass it when already computed to avoid the re-resolve.
+const isNumArm = (v, node, vt = resolveValType(node, valTypeOf, lookupValType)) =>
+  isI32Num(v) || v.valKind === VAL.NUMBER || vt === VAL.NUMBER
+
+// One arm of a two-arm f64 merge (?:, ??, ||, &&) whose result may be bit-tested while
+// untyped. Canon (canonNum, a no-op unless the arm is NaN-minting arithmetic) ONLY a
+// LONE numeric arm: when both arms are numeric the merge is value-typed NUMBER and read
+// NaN-by-value (no canon); when the other arm is opaque the result is untyped, so a
+// non-canonical NaN here would be misread by __is_truthy — fold it. A pointer arm
+// (isNum=false) is never touched (canon would destroy its NaN-box).
+const canonArm = (f, isNum, otherNum) => isNum && !otherNum ? canonNum(f) : f
+
 // Host globals auto-imported as `(import "env" "name" (global … i64))` when
 // referenced as a value. Drained from ctx.core.hostGlobals at assembly.
 const HOST_GLOBALS = new Set(['WebAssembly', 'globalThis', 'self', 'window', 'global', 'process'])
@@ -98,6 +153,36 @@ const HOST_GLOBALS = new Set(['WebAssembly', 'globalThis', 'self', 'window', 'gl
 // use — wrapping is exactly its intended semantics, so it stays on the i32 path.
 const widensUnsigned = (v) => v.unsigned && !v.wrapSafe
 
+// Strip a redundant NaN-canon wrapper (math.js `canon`) from an operand that
+// feeds a NaN-propagating f64 op. `f64.sqrt`/`min`/`max` mint a sign-nondeterministic
+// NaN that math.js canon-izes so it can't be bit-confused with a NaN-boxed pointer in
+// `===`/`typeof`. But when the result flows straight into `f64.add`/`sub`/`mul`/`div`,
+// the consumer propagates that NaN identically and is itself canon-ized if IT escapes —
+// so the inner per-op canon (local.set + select + f64.ne, ~3 ops) is dead on the
+// critical path. This is THE gap that put sqrt-heavy kernels ~23% behind V8
+// (julia/raymarcher/boids); stripping it makes them match native JS.
+const stripCanon = (v) => {
+  if (!v) return v
+  if (v.canonOf != null) return typed(v.canonOf, 'f64')
+  // A NaN-canon nested in the VALUE arm of a `select` / `(if result f64)` is equally
+  // dead: the consumer that called stripCanon (f64.add/sub/mul/div, or a math call)
+  // propagates the NaN identically and the outermost escape re-canon-izes. Recurse into
+  // the arms so `(cond ? x : -x) + v` (the Perlin-gradient sign-select, and every other
+  // conditional negation) drops the per-neg select+f64.ne, same as a bare `x + -y`.
+  if (Array.isArray(v)) {
+    if (v[0] === 'select' && v.length === 4) {
+      const a = stripCanon(v[1]), b = stripCanon(v[2])
+      if (a !== v[1] || b !== v[2]) return typed(['select', a, b, v[3]], 'f64')
+    } else if (v[0] === 'if' && Array.isArray(v[1]) && v[1][0] === 'result' && v[1][1] === 'f64'
+               && Array.isArray(v[3]) && v[3][0] === 'then' && v[3].length === 2
+               && Array.isArray(v[4]) && v[4][0] === 'else' && v[4].length === 2) {
+      const t = stripCanon(v[3][1]), e = stripCanon(v[4][1])
+      if (t !== v[3][1] || e !== v[4][1]) return typed(['if', v[1], v[2], ['then', t], ['else', e]], 'f64')
+    }
+  }
+  return v
+}
+
 const FIRST_CLASS_UNARY_MATH = {
   'math.abs': 'f64.abs',
   'math.sqrt': 'f64.sqrt',
@@ -137,10 +222,17 @@ const emitNeg = (a) => {
   // flipped NaN reads as a tagged value (truthy / not-NaN). Fold any NaN result back
   // to canonical — the same invariant math.sqrt/min/max keep via `canon` (module/math.js).
   const t = temp('ng')
-  return typed(['block', ['result', 'f64'],
-    ['local.set', `$${t}`, ['f64.neg', toNumF64(a, v)]],
+  const raw = ['f64.neg', toNumF64(a, v)]
+  const ir = typed(['block', ['result', 'f64'],
+    ['local.set', `$${t}`, raw],
     ['select', ['f64.const', 'nan'], ['local.get', `$${t}`],
       ['f64.ne', ['local.get', `$${t}`], ['local.get', `$${t}`]]]], 'f64')
+  // Tag the un-canon'd `f64.neg` so a NaN-propagating consumer (f64.add/sub/mul/div, which
+  // canon-ize on their OWN escape) strips this redundant inner canon — same contract as the
+  // sqrt/min/max canons in math.js. A bare `x * -y` / `a - -b` then drops the per-neg
+  // select + f64.ne instead of carrying it into the multiply/add.
+  ir.canonOf = raw
+  return ir
 }
 
 /** Try constant-folding binary arith: returns emitNum(result) or null. */
@@ -154,14 +246,37 @@ const foldConst = (va, vb, fn, guard) =>
 
 // JS `*` is an f64 multiply; `i32.mul` yields only the exact product mod 2^32.
 // Those agree under a ToInt32/ToUint32 sink (and as plain numbers) while the
-// exact product stays f64-exact, i.e. |product| <= 2^53. Two i32 operands can
-// reach 2^62, so `i32.mul` is sound only when one side is a literal small
-// enough that, against the full i32 range (2^31) of the other, the product
-// holds within 2^53 — i.e. |literal| <= 2^22. Keeps index arithmetic (`i*4`,
-// `row*16`) on `i32.mul` while routing hash-mix-scale products to `f64.mul`.
+// exact product stays f64-exact. A literal qualifies directly; so does a masked
+// operand (`x & 63`, `x >>> k`) whose value is provably bounded. Keeps index
+// arithmetic (`i*4`) and bitwise-masked scales (bytebeat's `t*(m&63)`) on
+// `i32.mul` while routing hash-mix-scale products to `f64.mul`. The FITS_I32_MAX
+// threshold (and the soundness contract with type.js exprType) lives in widen.js.
 const mulFitsI32 = (va, vb) =>
-  (isLit(va) && Math.abs(litVal(va)) <= 0x400000) ||
-  (isLit(vb) && Math.abs(litVal(vb)) <= 0x400000)
+  (isLit(va) && Math.abs(litVal(va)) <= FITS_I32_MAX) ||
+  (isLit(vb) && Math.abs(litVal(vb)) <= FITS_I32_MAX) ||
+  (!isLit(va) && maskBound(va) <= FITS_I32_MAX) ||
+  (!isLit(vb) && maskBound(vb) <= FITS_I32_MAX)
+
+// Max |value| of an i32-typed operand from a narrowing typed-array load width — the
+// element-read twin of maskBound's `x & 0xff` case (load8_u and `x & 0xff` carry the
+// SAME [0,255] range). Infinity when the magnitude is unbounded. Signed loads reach
+// −2^(w−1), so the magnitude bound is 2^(w−1).
+const I32_LOAD_MAG = { 'i32.load8_s': 128, 'i32.load8_u': 255, 'i32.load16_s': 32768, 'i32.load16_u': 65535 }
+const i32Mag = (v) =>
+  !Array.isArray(v) ? Infinity :
+  v[0] in I32_LOAD_MAG ? I32_LOAD_MAG[v[0]] :
+  (v[0] === 'i32.const' && typeof v[1] === 'number') ? Math.abs(v[1]) :
+  (v[0] === 'i32.and' || v[0] === 'i32.shr_u') ? maskBound(v) :
+  Infinity
+// `int8[i]*int8[j]` and friends: a product of two range-bounded integer typed-array
+// elements whose magnitudes multiply to ≤ 2^31−1 is FAITHFUL as i32.mul — the exact
+// product fits signed i32, so i32.mul == the true value in EVERY consumer context
+// (i32 sink AND f64 value), independent of the widen pass. Covers i8/u8/i16 pairs and
+// i16×u16 (32768·65535 < 2^31); correctly EXCLUDES u16×u16 (65535² > 2^31). JS `*` of
+// two such reads — the int-conv / correlation / quantised-MAC kernel shape — then rides
+// the i32 ABI (one op, no f64 round-trip) on V8 / JSC / wasmtime alike, and the i32
+// product is lane-vectorizable where the f64 form was not.
+const mulBoundedFaithful = (va, vb) => i32Mag(va) * i32Mag(vb) <= 0x7fffffff
 
 /** Emit typeof comparison: typeof x == typeCode → type-aware check. */
 export function emitTypeofCmp(a, b, cmpOp) {
@@ -307,6 +422,13 @@ function intIndexIR(key) {
  */
 const I32_INDEX_OP = { '+': 'i32.add', '-': 'i32.sub', '*': 'i32.mul' }
 function tryI32Index(e) {
+  // Integer literal first — a prepare-wrapped literal `[null, k]` (and a const-int
+  // name) is itself an Array, so the operator dispatch below would reject it and
+  // bail the WHOLE index to the f64 round-trip. The classic victim is the `+ 1` /
+  // `(j + 1)` of a bilinear/stencil gather (`a[(j+1)*W + i + 1]`): one literal leaf
+  // forced `convert_i32 … f64.mul/add … trunc_sat_f64_s` across every term.
+  const lit = nonNegIntLiteral(e)
+  if (lit != null) return typed(['i32.const', lit], 'i32')
   if (Array.isArray(e)) {
     const inner = I32_INDEX_OP[e[0]]
     if (inner && e[2] != null) {
@@ -316,12 +438,31 @@ function tryI32Index(e) {
     }
     return null
   }
-  const lit = nonNegIntLiteral(e)
-  if (lit != null) return ['i32.const', lit]
   return exprType(e, ctx.func.locals) === 'i32' ? asI32(emit(e)) : null
 }
 export const emitIndex = (idx) => tryI32Index(idx) ?? asI32(emit(idx))
 
+/**
+ * True when `e` is a pure integer `+`/`-`/`*` tree whose leaves are all i32-typed
+ * names/globals or integer literals — no calls, member reads, or indexed reads, so
+ * emitting it twice (or in a different rep) is side-effect-free. Used to recognise
+ * an i32-local initializer that `tryI32Index` can lower to native wrapping i32
+ * arithmetic instead of the f64 round-trip (`convert … f64.mul/add … trunc_sat`).
+ * The same residue-mod-2^32 argument as `tryI32Index`: ToInt32 of the exact integer
+ * value equals two's-complement wrapping i32, so for an i32 destination the two are
+ * bit-identical — even when an intermediate product overflows.
+ */
+function isI32ArithTree(e) {
+  if (typeof e === 'number') return Number.isInteger(e)
+  if (typeof e === 'string') return exprType(e, ctx.func.locals) === 'i32'
+  if (!Array.isArray(e)) return false
+  const op = e[0]
+  if (op == null) return isI32ArithTree(e[1])                 // literal wrapper [, v]
+  if ((op === '+' || op === '-' || op === '*') && e[2] != null)
+    return isI32ArithTree(e[1]) && isI32ArithTree(e[2])
+  return false
+}
+
 function emitSingleCharIndexCmp(a, b, negate = false) {
   const leftLit = stringLiteral(a)
   const rightLit = stringLiteral(b)
@@ -448,6 +589,55 @@ function emitSubstringEqCmp(a, b, negate = false) {
       ['i64.reinterpret_f64', ['local.get', `$${o}`]]])], 'i32')
 }
 
+// One half of a two-sided range test against a compile-time constant, normalized to
+// an inclusive bound on a *local* `x`: `{ x, lo }` (x ≥ lo) or `{ x, hi }` (x ≤ hi).
+// `>`/`<` fold to the inclusive neighbor; a const on either side is accepted. Returns
+// null for anything else (so the caller leaves the expression untouched).
+function rangeBound(n) {
+  if (!Array.isArray(n) || n.length !== 3) return null
+  const lc = intLiteralValue(n[1]), rc = intLiteralValue(n[2])
+  if (rc != null && typeof n[1] === 'string') {        // x  op  CONST
+    if (n[0] === '>=') return { x: n[1], lo: rc }
+    if (n[0] === '>') return { x: n[1], lo: rc + 1 }
+    if (n[0] === '<=') return { x: n[1], hi: rc }
+    if (n[0] === '<') return { x: n[1], hi: rc - 1 }
+  }
+  if (lc != null && typeof n[2] === 'string') {        // CONST  op  x
+    if (n[0] === '<=') return { x: n[2], lo: lc }
+    if (n[0] === '<') return { x: n[2], lo: lc + 1 }
+    if (n[0] === '>=') return { x: n[2], hi: lc }
+    if (n[0] === '>') return { x: n[2], hi: lc - 1 }
+  }
+  return null
+}
+
+// `x >= LO && x <= HI` (x a pure i32 local, LO ≤ HI constants) → `(x - LO) <=u (HI - LO)`.
+// One subtract + one unsigned compare replaces two signed compares, an AND, and the
+// short-circuit branch — the classic range-check trick (valid for any integers via
+// wrapping subtraction). Returns the fused IR, or null to leave `&&` lowering unchanged.
+function fuseRangeCheck(a, b) {
+  const ba = rangeBound(a), bb = rangeBound(b)
+  if (!ba || !bb || ba.x !== bb.x || (ba.lo != null) === (bb.lo != null)) return null
+  const lo = ba.lo ?? bb.lo, hi = ba.hi ?? bb.hi
+  if (lo > hi) return null
+  const xv = emit(ba.x)
+  if (xv.type !== 'i32') return null                   // f64 (fractional) would mis-fuse
+  return typed(['i32.le_u', ['i32.sub', xv, ['i32.const', lo]], ['i32.const', hi - lo]], 'i32')
+}
+
+// The complement: `x < LO || x > HI` (the two outside half-checks — one upper-bounded,
+// one lower-bounded, with a gap between) → `(x - LO) >u (HI - LO)`, where [LO, HI] is the
+// inside range. Same trick, negated; returns null to leave `||` lowering unchanged.
+function fuseRangeCheckOr(a, b) {
+  const ba = rangeBound(a), bb = rangeBound(b)
+  if (!ba || !bb || ba.x !== bb.x || (ba.lo != null) === (bb.lo != null)) return null
+  const insideLo = (ba.hi ?? bb.hi) + 1, insideHi = (ba.lo ?? bb.lo) - 1
+  if (insideLo > insideHi) return null
+  const xv = emit(ba.x)
+  if (xv.type !== 'i32') return null
+  return typed(['i32.gt_u', ['i32.sub', xv, ['i32.const', insideLo]], ['i32.const', insideHi - insideLo]], 'i32')
+}
+
 // Flow-sensitive type refinement moved to ./flow-types.js (extractRefinements,
 // predicateRefinement, mergeRefinement, withRefinements). emit.js imports them
 // from there — see the import block at the top of this file.
@@ -469,6 +659,80 @@ function unrollSmallConstFor(init, cond, step, body) {
   return out
 }
 
+// Max distinct keys a for-in unrolls over (bounds code size; larger key sets keep
+// the pooled-keys loop, which is already allocation-free via __keys_ro).
+const FORIN_UNROLL_MAX = 16
+// Total-expansion ceiling: unroll emits one body copy per key, so the size cost is
+// keys × body, not keys alone. A large body over many keys (e.g. watr's 15-key
+// schema loop) blows up code size for no deopt win — the pooled fallback is already
+// allocation-free. Cap keys × nodeSize(body); past it, keep the loop. (Tuned above
+// every unroll the corpus actually wants — the 16-key cap test lands at 80.)
+const FORIN_UNROLL_BUDGET = 128
+const forInBodyCost = (node) => {
+  if (!Array.isArray(node)) return 1
+  let n = 1
+  for (let i = 1; i < node.length; i++) n += forInBodyCost(node[i])
+  return n
+}
+
+// Pull the for-in source out of prepare's keys expression: either a bare
+// `__keys_ro(src)` call or the nullish-guarded `cond ? [] : __keys_ro(src)`.
+function keysRoSrc(node) {
+  if (!Array.isArray(node)) return null
+  if (node[0] === '()' && node[1] === '__keys_ro') return node[2]
+  if (node[0] === '?:' || node[0] === '?') {
+    const last = node[node.length - 1]
+    if (Array.isArray(last) && last[0] === '()' && last[1] === '__keys_ro') return last[2]
+  }
+  return null
+}
+
+// Unroll `for (k in o)` over a static schema. Prepare lowers for-in to a plain
+// for-loop whose key array comes from the for-in-exclusive `__keys_ro` intrinsic,
+// so a loop carrying it IS a for-in. When `o` is a bare OBJECT var with a complete
+// static schema (no computed-key writes — same gate as __keys_ro pooling), replace
+// the loop with one substituted copy of the body per key: the loop variable becomes
+// a string literal, so `o[k]` folds to a static schema slot — no keys array, no
+// per-element dynamic get. Falls back (returns null) to the pooled loop otherwise.
+function unrollForIn(init, cond, step, body) {
+  if (!Array.isArray(init) || init[0] !== 'let' || !Array.isArray(init[1]) || init[1][0] !== '=') return null
+  const ksVar = init[1][1]
+  const src = keysRoSrc(init[1][2])
+  if (typeof src !== 'string') return null
+  if (!Array.isArray(cond) || cond[0] !== '<') return null
+  const ixVar = cond[1]
+  if (!Array.isArray(step) || step[0] !== '++' || step[1] !== ixVar) return null
+  // body = [';', ['let', ['=', target, ['[]', ksVar, ixVar]]], ...realBody]
+  if (!Array.isArray(body) || body[0] !== ';') return null
+  const bind = body[1]
+  if (!Array.isArray(bind) || bind[0] !== 'let' || !Array.isArray(bind[1]) || bind[1][0] !== '=') return null
+  const target = bind[1][1]
+  const acc = bind[1][2]
+  if (!Array.isArray(acc) || acc[0] !== '[]' || acc[1] !== ksVar || acc[2] !== ixVar) return null
+
+  // Unroll only with PROOF the schema is complete: a computed-key write adds
+  // enumerable keys, so bail if `src` takes one — or if the fact is unavailable
+  // (no proof ⇒ no unroll; unrolling drops the dynamic path, so erring safe matters).
+  if (!ctx.types.dynWriteVars || ctx.types.dynWriteVars.has(src)) return null
+  if (lookupValType(src) !== VAL.OBJECT) return null
+  const keys = ctx.schema.resolve(src)
+  if (!keys || !keys.length || keys.length > FORIN_UNROLL_MAX) return null
+
+  const rest = body.slice(2)
+  const realBody = rest.length === 1 ? rest[0] : [';', ...rest]
+  // Keep the pooled loop when unrolling would multiply a heavy body across many keys.
+  if (keys.length * forInBodyCost(realBody) > FORIN_UNROLL_BUDGET) return null
+  // Substitution safety, mirroring unrollSmallConstFor: no reassignment/redeclare
+  // of the loop var, no nested closure capturing it (cloneWithSubst skips `=>`),
+  // and no break/continue targeting this loop.
+  if (hasOwnBreakOrContinue(realBody) || containsNestedClosure(realBody) || containsDeclOf(realBody, target)) return null
+  if (isReassigned(realBody, target)) return null
+
+  const out = []
+  for (const key of keys) out.push(...emitVoid(cloneWithSubst(realBody, new Map([[target, ['str', key]]]))))
+  return out.length ? out : ['nop']
+}
+
 function canThrow(body, seen = new Set()) {
   if (!Array.isArray(body)) return false
   const op = body[0]
@@ -581,6 +845,40 @@ export function toBool(node) {
   return toBoolFromEmitted(emit(node))
 }
 
+// `(a / b) | 0` (the JS integer-division idiom) → i32.div_s. jz otherwise lowers `/`
+// to f64.div + ToInt32, paying two i32→f64 converts and the trunc; i32.div_s is
+// direct and lets the wasm backend magic-multiply a constant divisor. Bit-exact for
+// all i32 a,b: |a|<2³³≪2⁵³ so the f64 quotient never rounds across the truncation
+// boundary — EXCEPT b=0 (`(a/0)|0` is ToInt32(±Inf)=0, but i32.div_s traps) and
+// INT_MIN/-1 (ToInt32 wraps to INT_MIN, i32.div_s traps); both guarded. A constant
+// divisor folds the guards away. `exprType==='i32'` excludes unsigned operands
+// (those return 'f64'), where div_s would misread the sign. Returns IR or null.
+const INT_MIN_I32 = -2147483648
+function tryIntDivTrunc(aNode, bNode) {
+  const o = ctx.transform.optimize
+  if (!o || o.intDivLower === false) return null
+  const L = ctx.func.locals
+  if (exprType(aNode, L) !== 'i32' || exprType(bNode, L) !== 'i32') return null
+  const dv = intLiteralValue(bNode)
+  if (dv != null) {                         // constant divisor — no runtime guard
+    const va = asI32(emit(aNode))
+    if (dv === 0) return typed(['block', ['result', 'i32'], ['drop', va], ['i32.const', 0]], 'i32')
+    if (dv === -1) return typed(['i32.sub', ['i32.const', 0], va], 'i32')  // -a, wraps at INT_MIN
+    return typed(['i32.div_s', va, ['i32.const', dv | 0]], 'i32')
+  }
+  // Runtime divisor needs a,b repeated across the guard; only intercept when both are
+  // simple re-emittable operands (var / literal) so re-emit is pure and side-effect-free.
+  const simple = (n) => typeof n === 'string' || intLiteralValue(n) != null
+  if (!simple(aNode) || !simple(bNode)) return null
+  const A = () => asI32(emit(aNode)), B = () => asI32(emit(bNode))
+  return typed(['if', ['result', 'i32'], ['i32.eqz', B()],
+    ['then', ['i32.const', 0]],
+    ['else', ['if', ['result', 'i32'],
+      ['i32.and', ['i32.eq', A(), ['i32.const', INT_MIN_I32]], ['i32.eq', B(), ['i32.const', -1]]],
+      ['then', A()],
+      ['else', ['i32.div_s', A(), B()]]]]], 'i32')
+}
+
 /** Coerce an emitted arg IR to match a callee param. Param may carry ptrKind (pointer-ABI
  *  i32 offset), else falls back to numeric WASM type coercion. */
 function coerceArg(ir, param) {
@@ -721,7 +1019,7 @@ export function emitDecl(...inits) {
     // Monotonic-extension fields (`o.newProp = …`) carry no literal value —
     // they init to undefined so a read before the write matches JS.
     const flatDecl = ctx.func.flatObjects?.get(name)
-    if (flatDecl && Array.isArray(init) && init[0] === '{}') {
+    if (flatDecl && Array.isArray(init) && (init[0] === '{}' || init[0] === '[' || init[0] === '[]')) {
       for (let j = 0; j < flatDecl.names.length; j++)
         result.push(['local.set', `$${name}#${j}`,
           flatDecl.values[j] === undefined ? undefExpr() : asF64(emit(flatDecl.values[j]))])
@@ -790,6 +1088,17 @@ export function emitDecl(...inits) {
       if (!ctx.func.directClosures) ctx.func.directClosures = new Map()
       ctx.func.directClosures.set(name, val.closureBodyName)
     }
+    // Copy propagation of a direct closure: `let g = add`, where `add` is a non-escaping
+    // directly-callable closure, makes `g` directly callable too — `g` holds the same
+    // closure value, so `g(…)` calls add's body with g's value as env. This is what
+    // devirtualizes `let arr = [add]; arr[0](…)`: array scalarization rewrites it to
+    // `let g = add; g(…)` before emit (D3), and also covers the explicit `let g = arr[0]`.
+    // Same soundness gate as the direct-closure case: stable binding (not reassigned),
+    // not boxed, not global.
+    if (typeof init === 'string' && ctx.func.directClosures?.has(init) && !ctx.func.boxed.has(name)
+        && !isGlobal(name) && ctx.func.body && !isReassigned(ctx.func.body, name)) {
+      ctx.func.directClosures.set(name, ctx.func.directClosures.get(init))
+    }
     if (ctx.func.boxed.has(name)) {
       const cell = ctx.func.boxed.get(name)
       ctx.func.locals.set(cell, 'i32')
@@ -862,11 +1171,23 @@ export function emitDecl(...inits) {
         updateRep(name, { ptrAux: val.closureFuncIdx })
       coerced = val.ptrKind === ptrKind ? val
         : typed(['i32.wrap_i64', ['i64.reinterpret_f64', asF64(val)]], 'i32')
+    } else if (localType === 'i32' && val.type !== 'i32' && isI32ArithTree(init)) {
+      // Integer index feeder (`let idx = py*W + qx`) bound to an i32 local: compute
+      // it in native wrapping i32 instead of the f64 round-trip + trunc_sat. Bit-
+      // identical for an i32 destination (ToInt32 ≡ two's-complement wrap), and the
+      // i32.mul is hoistable when loop-invariant. Falls back to toI32 defensively.
+      coerced = tryI32Index(init) ?? toI32(val)
     } else {
       coerced = localType === 'v128' ? val : localType === 'f64' ? asF64(val) : val.type === 'i32' ? val : toI32(val)
     }
-    if (!(isLit(coerced) && coerced[1] === 0 && !Object.is(coerced[1], -0) && !ctx.func.stack.length))
+    // `let x = 0` at function scope is normally elided — WASM zero-inits locals. But loop
+    // unrolling flattens iteration bodies into one scope, so the 2nd+ `let x = 0` are
+    // genuine RE-inits between iterations (e.g. a nested reduce's accumulator). Elide only
+    // the FIRST per name; emit the rest as resets. (Names are preserved — no renaming.)
+    const zeroInit = isLit(coerced) && coerced[1] === 0 && !Object.is(coerced[1], -0) && !ctx.func.stack.length
+    if (!zeroInit || ctx.func.zeroInitSeen?.has(name))
       result.push(['local.set', `$${name}`, coerced])
+    else (ctx.func.zeroInitSeen ??= new Set()).add(name)
 
     const schemaId = ctx.schema.idOf?.(name)
     if (ctx.func.localProps?.has(name) && schemaId != null) {
@@ -912,12 +1233,22 @@ function emitSpreadCopy(dest, posLocal, srcLocal, srcLenLocal, staticVT) {
     const sidx = `${T}sidx${ctx.func.uniq++}`
     ctx.func.locals.set(sidx, 'i32')
     const loopId = ctx.func.uniq++
-    const elem = ctx.module.modules['string']
-      ? ['if', ['result', 'f64'],
+    // When the source is statically known to be a typed array, __typed_idx suffices.
+    // Otherwise (STRING, or unknown type whose runtime value may be a string) dispatch on
+    // ptr_type: STRING→__str_idx, else→__typed_idx.
+    // The old gate (ctx.module.modules['string']) was wrong: for `[...s]` with an untyped
+    // param the string module is never loaded, so __typed_idx was used for strings —
+    // __typed_idx calls __len which returns 0 for strings, making i>=len always true and
+    // storing UNDEF into every element slot. Pull in the string module here so __str_idx
+    // is registered before inc() adds it to the dependency set.
+    const elem = staticVT === VAL.TYPED
+      ? (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])
+      : (includeForStringOnly(),
+        ['if', ['result', 'f64'],
           ['i32.eq', ['call', '$__ptr_type', srcI64()], ['i32.const', PTR.STRING]],
           ['then', (inc('__str_idx'), ['call', '$__str_idx', srcI64(), ['local.get', `$${sidx}`]])],
-          ['else', (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])]]
-      : (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])
+          ['else', (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])]
+        ])
     // Reset the counter on each entry — WASM zeroes locals once at function
     // entry, but this loop re-executes when the spread sits inside a JS loop;
     // a stale `sidx` (= prior srcLen) would skip the copy entirely.
@@ -1019,8 +1350,25 @@ export function buildArrayWithSpreads(items) {
       // emitSpreadCopy resolve its kind at runtime via its one-time __ptr_type branch.
       sec.val = n ? undefined : valTypeOf(srcExpr)
       ir.push(['local.set', `$${sec.local}`, n ? materializeMulti(sec.expr) : asF64(emit(srcExpr))])
-      // Cache __len once per spread; reused below for total-len sum and the copy.
-      ir.push(['local.set', `$${sec.lenLocal}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${sec.local}`]]]])
+      // Cache the source length once per spread (reused for the total-len sum and the
+      // copy). `__len` is ARRAY/typed length — WRONG for a STRING (returns 0, so `[...str]`
+      // spreads an empty array). Pick the length to MATCH emitSpreadCopy's element decode:
+      // a known string counts chars (__str_len, paired with the __str_idx per-char copy); a
+      // statically-unknown source — `[...x]` / `[...fnParam]`, the compiler's own
+      // `[...key]` — dispatches once at runtime (STRING→__str_len, else→__len), mirroring
+      // emitSpreadCopy's ARRAY-vs-scalar branch. (Not __length: its `off>=8` guard returns
+      // undefined for host/static typed arrays.) Known array/typed/multi keep plain __len.
+      const srcI64 = () => ['i64.reinterpret_f64', ['local.get', `$${sec.local}`]]
+      const lenIR = sec.val === VAL.STRING
+        ? (inc('__str_len'), ['call', '$__str_len', srcI64()])
+        : (sec.val === VAL.ARRAY || sec.val === VAL.TYPED || n)
+          ? (inc('__len'), ['call', '$__len', srcI64()])
+          : (inc('__str_len', '__len', '__ptr_type'),
+            ['if', ['result', 'i32'],
+              ['i32.eq', ['call', '$__ptr_type', srcI64()], ['i32.const', PTR.STRING]],
+              ['then', ['call', '$__str_len', srcI64()]],
+              ['else', ['call', '$__len', srcI64()]]])
+      ir.push(['local.set', `$${sec.lenLocal}`, lenIR])
     }
   }
 
@@ -1163,6 +1511,48 @@ const STRICT_PRIM = new Set([VAL.NUMBER, VAL.BOOL, VAL.STRING, VAL.BIGINT])
 const nullableOperand = (n) =>
   typeof n === 'string' && !!(repOf(n)?.nullable || repOfGlobal(n)?.nullable)
 
+// An emitted value whose bit pattern is an i32, paired with how it widens to f64: a
+// `f64.convert_i32_s/u(x)` peels to its i32 source `x`; a bare i32 widens signed. Used to compare
+// two integer-backed operands directly in i32 instead of widening both to f64.
+const peelIntCmp = (v) => {
+  if (Array.isArray(v) && (v[0] === 'f64.convert_i32_s' || v[0] === 'f64.convert_i32_u'))
+    return { src: Array.isArray(v[1]) ? typed(v[1], 'i32') : v[1], sign: v[0] === 'f64.convert_i32_u' ? 'u' : 's' }
+  if (v && v.type === 'i32') return { src: v, sign: 's' }
+  return null
+}
+// The value's top bit is provably 0 (so its signed and unsigned readings agree): a u8/u16 load,
+// `>>>` (always clears the sign bit), `& m` with m a non-negative small const, or a small const.
+const i32TopBitClear = (n) => {
+  if (typeof n === 'number') return n >= 0 && n < 0x80000000
+  if (!Array.isArray(n)) return false
+  if (n[0] == null) return typeof n[1] === 'number' && n[1] >= 0 && n[1] < 0x80000000
+  if (n[0] === 'i32.load8_u' || n[0] === 'i32.load16_u') return true
+  if (n[0] === 'i32.const') return typeof n[1] === 'number' ? (n[1] >= 0 && n[1] < 0x80000000) : false
+  if (n[0] === 'i32.shr_u' || n[0] === '>>>') return true
+  if (n[0] === 'i32.and' || n[0] === '&') return i32TopBitClear(n[1]) || i32TopBitClear(n[2])
+  return false
+}
+// i32.eq/ne over the peeled sources equals the f64-widened compare when the signs match, or — for
+// a mixed signed/unsigned pair — when the unsigned-read source is top-bit-clear (then both readings
+// of equal bits agree, and unequal bits stay unequal under both).
+const i32EqSound = (pa, pb) => pa.sign === pb.sign ||
+  i32TopBitClear((pa.sign === 'u' ? pa : pb).src)
+
+// A memory-free, trap-free, side-effect-free expression — safe to evaluate UNCONDITIONALLY (as a
+// `select` arm does) and cheap enough that doing so never loses to a branch. Locals/consts and
+// arithmetic/bitwise/compare/logical over them. Excludes loads (`[]`, may read OOB when the guard
+// was protecting the access), calls, `.`/`?.` (dispatch), `/` `%` (int trap on 0), assignments.
+const CHEAP_PURE_OPS = new Set(['+', '-', '*', 'u-', 'u+', '&', '|', '^', '<<', '>>', '>>>', '~',
+  '<', '<=', '>', '>=', '==', '!=', '===', '!==', '&&', '||', '!', '?:'])
+const isCheapPureVal = (n) => {
+  if (typeof n === 'string' || typeof n === 'number') return true
+  if (!Array.isArray(n)) return false
+  if (n[0] == null) return true                              // boxed literal [, v]
+  if (n[0] === 'local.get') return true
+  if (CHEAP_PURE_OPS.has(n[0])) { for (let i = 1; i < n.length; i++) if (!isCheapPureVal(n[i])) return false; return true }
+  return false
+}
+
 function emitLooseEq(a, b, negate) {
   const eqOp = negate ? 'ne' : 'eq'
   const sentinel = emitNum(negate ? 1 : 0)
@@ -1181,6 +1571,12 @@ function emitLooseEq(a, b, negate) {
   const tc = emitTypeofCmp(a, b, eqOp); if (tc) return tc
   const va = emit(a), vb = emit(b)
   if (va.type === 'i32' && vb.type === 'i32') return typed([`i32.${eqOp}`, va, vb], 'i32')
+  // Both operands integer-backed (e.g. an i32 local vs a `b[j]` u8 read materialized as f64):
+  // compare the i32 sources directly, skipping the per-op widen to f64. Recovers `intElem ===
+  // intElem` in hot loops (levenshtein's DP cell, where `a[i-1] === b[j-1]` was an f64.eq + 2
+  // converts every iteration). Sound only when the widen can't change the answer (see i32EqSound).
+  const pa = peelIntCmp(va), pb = peelIntCmp(vb)
+  if (pa && pb && i32EqSound(pa, pb)) return typed([`i32.${eqOp}`, pa.src, pb.src], 'i32')
   // Either side known-pure NUMBER (literal or typed) → f64.eq/ne is correct regardless
   // of the other side: jz's `==` is strict (prepare.js:868), and every NaN-boxed pointer
   // reinterprets to a quiet NaN (0x7FF8… prefix) so f64.eq with any normal float is false.
@@ -1201,6 +1597,43 @@ function emitLooseEq(a, b, negate) {
   if (vta && vta === vtb && REF_EQ_KINDS.has(vta)) {
     return typed([`i64.${eqOp}`, ['i64.reinterpret_f64', asF64(va)], ['i64.reinterpret_f64', asF64(vb)]], 'i32')
   }
+  // String-equality specialization — the hot `node[0] === 'literal'` AST-tag dispatch,
+  // the compiler's single most-emitted comparison (5579 of its 6487 __eq sites). When one
+  // side is statically a STRING, skip the generic __eq NaN-box dispatch (the #1 self-host
+  // hot helper). jz's ==/=== never coerce (number-vs-string is false in __eq), so this is
+  // sound for both. Two shapes by what the OTHER side is known to be:
+  //   both STRING        → __str_eq directly (no number/NaN/tag test needed at all).
+  //   STRING vs unknown  → i64.eq fast ? equal : (__is_str_key(u) ? __str_eq : not-equal).
+  // Soundness of the fast path: the known string is a non-NaN STRING NaN-box, so a bit
+  // match can ONLY be that same string (a normal f64 can't alias those bits). On bit
+  // MISMATCH the unknown can still content-match — a heap string from `'i'+'f'` shares
+  // content but not bits — so the fallback __str_eq stays (pure i64.eq is unsound here).
+  // __is_str_key rejects the number-whose-bits-alias-the-STRING-tag case that a bare
+  // __ptr_type would misroute into a wild __str_eq deref (see __eq's own guard).
+  // INLINED (not a helper call): a single $__str_eq_lit helper measured 2.4% slower on
+  // the corpus — V8 keeps the call at the hot miss path; inlining lets the optimizer fold
+  // __is_str_key/__str_eq's prefix in, which is where the tag dispatch spends its time.
+  // Behaviorally identical to __eq when one side is a string — proven by a 4584-case
+  // spec-on/spec-off differential (zero divergence at optimize 0 and 2).
+  const strEqResult = (r) => negate ? typed(['i32.eqz', r], 'i32') : r
+  const aStr = rawA === VAL.STRING, bStr = rawB === VAL.STRING
+  if (aStr && bStr) {
+    inc('__str_eq')
+    return strEqResult(typed(['call', '$__str_eq', asI64(va), asI64(vb)], 'i32'))
+  }
+  if ((bStr && rawA == null) || (aStr && rawB == null)) {
+    const uVal = bStr ? va : vb, lVal = bStr ? vb : va   // u: unknown side, l: known string
+    inc('__is_str_key', '__str_eq')
+    const u = tempI64('seq'), l = tempI64('seq'), uG = ['local.get', `$${u}`], lG = ['local.get', `$${l}`]
+    return strEqResult(typed(['block', ['result', 'i32'],
+      ['local.set', `$${u}`, asI64(uVal)],
+      ['local.set', `$${l}`, asI64(lVal)],
+      ['if', ['result', 'i32'], ['i64.eq', uG, lG],
+        ['then', ['i32.const', 1]],
+        ['else', ['if', ['result', 'i32'], ['call', '$__is_str_key', uG],
+          ['then', ['call', '$__str_eq', uG, lG]],
+          ['else', ['i32.const', 0]]]]]], 'i32'))
+  }
   inc('__eq')
   const call = typed(['call', '$__eq', asI64(va), asI64(vb)], 'i32')
   return negate ? typed(['i32.eqz', call], 'i32') : call
@@ -1472,6 +1905,13 @@ function emitSpreadElementLoop(spreadExpr, bodyFn, { reverse = false } = {}) {
   ]
 }
 
+function emitAsValue(fn) {
+  const prev = ctx.func._expect
+  ctx.func._expect = null
+  try { return fn() }
+  finally { ctx.func._expect = prev }
+}
+
 function emitSingleSpreadMethodCall(objArg, parsed, method, methodEmitter) {
   const inPlace = SPREAD_MUTATORS.has(method)
   // unshift prepends each arg to the front — forward iteration reverses intent.
@@ -1480,11 +1920,11 @@ function emitSingleSpreadMethodCall(objArg, parsed, method, methodEmitter) {
   ctx.func.locals.set(acc, 'f64')
   const ir = [['local.set', `$${acc}`, asF64(emit(objArg))]]
   if (parsed.normal.length > 0) {
-    const r = asF64(methodEmitter(objArg, ...parsed.normal))
+    const r = asF64(emitAsValue(() => methodEmitter(objArg, ...parsed.normal)))
     ir.push(inPlace ? ['drop', r] : ['local.set', `$${acc}`, r])
   }
   ir.push(...emitSpreadElementLoop(parsed.spreads[0].expr, (arr, idx) => {
-    const body = asF64(methodEmitter(inPlace ? objArg : acc, ['[]', arr, idx]))
+    const body = asF64(emitAsValue(() => methodEmitter(inPlace ? objArg : acc, ['[]', arr, idx])))
     return [inPlace ? ['drop', body] : ['local.set', `$${acc}`, body]]
   }, { reverse }))
   ir.push(inPlace ? asF64(emit(objArg)) : ['local.get', `$${acc}`])
@@ -1506,7 +1946,7 @@ function emitMultiSpreadMethodCall(objArg, parsed, method, methodEmitter) {
   let batch = []
   const flushBatch = () => {
     if (!batch.length) return
-    const r = asF64(methodEmitter(recv, ...batch))
+    const r = asF64(emitAsValue(() => methodEmitter(recv, ...batch)))
     ir.push(inPlace ? ['drop', r] : ['local.set', `$${acc}`, r])
     batch = []
   }
@@ -1514,7 +1954,7 @@ function emitMultiSpreadMethodCall(objArg, parsed, method, methodEmitter) {
     if (Array.isArray(item) && item[0] === '__spread') {
       flushBatch()
       ir.push(...emitSpreadElementLoop(item[1], (arr, idx) => {
-        const body = asF64(methodEmitter(recv, ['[]', arr, idx]))
+        const body = asF64(emitAsValue(() => methodEmitter(recv, ['[]', arr, idx])))
         return [inPlace ? ['drop', body] : ['local.set', `$${acc}`, body]]
       }))
     } else {
@@ -1591,7 +2031,7 @@ function tryCharCodeAtFast(callee, obj, method, parsed) {
       return typed(['call', '$__jss_charCodeAt', recv, asI32(emit(parsed.normal[0]))], 'i32')
     }
     return typed(stringOps(obj).charCodeAt(
-      asF64(recv), asI32(emit(parsed.normal[0])), ctx, false), 'i32')
+      asF64(recv), asI32(emit(parsed.normal[0])), ctx, false, true), 'i32')
   }
 }
 
@@ -1705,7 +2145,9 @@ function tryStaticDispatch({ obj, method, vt, callMethod }) {
 // emitter which already knows how to handle them.
 function tryRuntimeStringFork({ obj, method, vt, callMethod }) {
   const strKey = `.string:${method}`, genKey = `.${method}`
-  if ((!vt || vt === VAL.ARRAY) && ctx.core.emit[strKey] && ctx.core.emit[genKey]) {
+  // VAL.ARRAY is structurally incompatible with PTR.STRING — no fork needed.
+  // Only fork when vt is truly unknown (!vt), not for proven types.
+  if (!vt && ctx.core.emit[strKey] && ctx.core.emit[genKey]) {
     const t = `${T}rt${ctx.func.uniq++}`, tt = `${T}rtt${ctx.func.uniq++}`
     ctx.func.locals.set(t, 'f64'); ctx.func.locals.set(tt, 'i32')
     const strEmitter = ctx.core.emit[strKey]
@@ -1840,6 +2282,7 @@ function externalMethodFallback({ obj, method, parsed }) {
   // can target js and wasi from one source; users who want fail-fast
   // pass `strict: true` (handled above).
   if (ctx.transform.host === 'wasi') return undefExpr()
+  warnDeopt('deopt-method', `method call \`${typeof obj === 'string' ? obj : '<expr>'}.${method}(…)\` on a value whose type couldn't be resolved dispatches through the JS host (\`__ext_call\`) — a wasm→JS round-trip per call, orders of magnitude slower than a direct call. Restructure so the receiver's type is provable, or keep it off the hot path.`)
   inc('__ext_call')
   ctx.features.external = true
   const combined = reconstructArgsWithSpreads(parsed.normal, parsed.spreads)
@@ -2018,9 +2461,21 @@ function tryDirectClosureCall(callee, parsed) {
   // export-param path gives. An arg we can't prove numeric poisons the slot to false.
   const pt = (ctx.closure.paramTypes ||= new Map())
   let row = pt.get(bodyName); if (!row) pt.set(bodyName, row = [])
+  // Parallel typed-array ctor lattice: a param passed the SAME typed-array ctor at
+  // every direct call site is a TYPED param, so its body reads (`buf[i]`) take the
+  // typed fast-path instead of the dynamic `__typed_idx`/`__len` route that drags in
+  // the string runtime. `null` (sticky) once two sites disagree or an arg isn't a
+  // known typed array — the same monotone meet as the numeric row. Mirrors the named-fn
+  // applyTypedPointerParamAbi, restricted to non-escaping (directly-called) closures.
+  const tc = (ctx.closure.paramTypedCtors ||= new Map())
+  let tcRow = tc.get(bodyName); if (!tcRow) tc.set(bodyName, tcRow = [])
   for (let i = 0; i < n; i++) {
     const numeric = valTypeOf(parsed.normal[i]) === VAL.NUMBER
     row[i] = row[i] === undefined ? numeric : (row[i] && numeric)
+    const arg = parsed.normal[i]
+    const ctor = typeof arg === 'string' && valTypeOf(arg) === VAL.TYPED ? (ctx.types.typedElem?.get(arg) ?? null) : null
+    if (tcRow[i] === undefined) tcRow[i] = ctor
+    else if (tcRow[i] !== ctor) tcRow[i] = null
   }
   // Track the fewest args any call passed: a slot at index ≥ minArgc is omitted by some call
   // site (padded with UNDEF_NAN), so it may be undefined — emitClosureBody flags it nullable.
@@ -2373,9 +2828,22 @@ export const emitter = {
       // A BOOL operand renders "true"/"false" rather than its 0/1 carrier.
       const strOperand = (vt, n) => vt === VAL.OBJECT ? typed(['f64.reinterpret_i64', toStrI64(n, emit(n))], 'f64')
         : vt === VAL.BOOL ? emitBoolStr(n) : asF64(emit(n))
-      const ea = strOperand(vtA, a)
-      const eb = strOperand(vtB, b)
-      return typed(ctx.abi.string.ops.cat(ea, eb, ctx), 'f64')
+      // Coercion-free sides are already strings: a known STRING is raw; OBJECT/BOOL
+      // were stringified by `strOperand`. An unknown side still needs ToString, but
+      // we can apply it *once* (explicit `__to_str` via `strI64`) and join with
+      // concatRaw — equivalent to `__str_concat`'s internal `__to_str` on that side,
+      // while NOT re-coercing the already-string side. This drops the redundant
+      // per-append `__to_str` on the accumulator in `s += part` (s proven STRING):
+      //   - both coercion-free  → concatRaw(ea, eb)
+      //   - one unknown         → concatRaw(known, __to_str(unknown))
+      //   - both unknown        → cat (unchanged; its runtime __to_str covers both)
+      const coercionFree = (vt) => vt === VAL.STRING || vt === VAL.OBJECT || vt === VAL.BOOL
+      const cfA = coercionFree(vtA), cfB = coercionFree(vtB)
+      const strI64 = (n) => typed(['f64.reinterpret_i64', toStrI64(n, emit(n))], 'f64')
+      if (cfA && cfB) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strOperand(vtB, b), ctx), 'f64')
+      if (cfA) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strI64(b), ctx), 'f64')
+      if (cfB) return typed(ctx.abi.string.ops.concatRaw(strI64(a), strOperand(vtB, b), ctx), 'f64')
+      return typed(ctx.abi.string.ops.cat(strOperand(vtA, a), strOperand(vtB, b), ctx), 'f64')
     }
     if (vtA === VAL.BIGINT || vtB === VAL.BIGINT)
       return fromI64(['i64.add', asI64(emit(a)), asI64(emit(b))])
@@ -2409,7 +2877,8 @@ export const emitter = {
     // op whose result can exceed i32, so `i32.add` would wrap (4294967295+1→0).
     // Widen to f64 — never wrap — matching spec. Only `>>>0`/`|0`/imul wrap.
     if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb)) return typed(['i32.add', va, vb], 'i32')
-    return typed(['f64.add', toNumF64(a, va), toNumF64(b, vb)], 'f64')
+    const i32add = tryI32Arith('i32.add', '+', a, b, va, vb); if (i32add) return i32add
+    return typed(['f64.add', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   '-': (a, b) => {
     if (ctx.func._expect === 'void' && isPostfix(a, '++', b)) return emit(a, 'void')
@@ -2424,7 +2893,8 @@ export const emitter = {
     // Unsigned uint32 operand: JS `-` is float (can go negative / exceed i32),
     // so avoid the wrapping i32.sub fast-path. See `+` above.
     if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb)) return typed(['i32.sub', va, vb], 'i32')
-    return typed(['f64.sub', toNumF64(a, va), toNumF64(b, vb)], 'f64')
+    const i32sub = tryI32Arith('i32.sub', '-', a, b, va, vb); if (i32sub) return i32sub
+    return typed(['f64.sub', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   'u+': a => {
     if (valTypeOf(a) === VAL.BIGINT)
@@ -2453,8 +2923,9 @@ export const emitter = {
     if (isLit(va) && litVal(va) === 0 && finiteFactor(vb)) return isLit(vb) ? va : typed(['block', ['result', va.type], vb, 'drop', va], va.type)
     // `.unsigned` operand is a uint32 ([0, 2^32)); its product can exceed i32, so
     // `i32.mul` would wrap ((2^32-1)*2 → -2). Widen to f64 — see `+` above.
-    if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb) && mulFitsI32(va, vb)) return typed(['i32.mul', va, vb], 'i32')
-    return typed(['f64.mul', toNumF64(a, va), toNumF64(b, vb)], 'f64')
+    if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb) && (mulFitsI32(va, vb) || mulBoundedFaithful(va, vb))) return typed(['i32.mul', va, vb], 'i32')
+    const i32mul = tryI32Arith('i32.mul', '*', a, b, va, vb); if (i32mul) return i32mul
+    return typed(['f64.mul', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   '/': (a, b) => {
     if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
@@ -2462,7 +2933,7 @@ export const emitter = {
     const va = emit(a), vb = emit(b), _f = foldConst(va, vb, (a, b) => a / b, b => b !== 0)
     if (_f) return _f
     if (isLit(vb) && litVal(vb) === 1) return toNumF64(a, va)
-    return typed(['f64.div', toNumF64(a, va), toNumF64(b, vb)], 'f64')
+    return typed(['f64.div', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   '%': (a, b) => {
     if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
@@ -2539,6 +3010,15 @@ export const emitter = {
     const elseRefs = extractRefinements(a, new Map(), false)
     const vb = withRefinements(thenRefs, b, () => emit(b))
     const vc = withRefinements(elseRefs, c, () => emit(c))
+    // `cond ? 1 : 0` is the condition bit itself; `cond ? 0 : 1` its negation. `cond`
+    // (truthyIR) is already canonical 0/1, so the select + two const arms collapse to
+    // the bit. (Both arms are literals here, so dropping their emitted IR is side-effect
+    // free.) Mirrors what `+(x > 0)` already produces.
+    if (isLit(vb) && isLit(vc)) {
+      const lb = litVal(vb), lc = litVal(vc)
+      if (lb === 1 && lc === 0) return typed(cond, 'i32')
+      if (lb === 0 && lc === 1) return typed(['i32.eqz', cond], 'i32')
+    }
     // L: Use WASM select for pure ternaries — branchless, smaller bytecode
     if (vb.type === 'i32' && vc.type === 'i32') {
       // A single i32 select is only sound when BOTH arms' i32 carriers mean the same
@@ -2577,10 +3057,24 @@ export const emitter = {
     const refPayload = (vtb && vtb === vtc && REF_EQ_KINDS.has(vtb))
       || vb.closureFuncIdx != null || vc.closureFuncIdx != null
       || isNaNBoxLit(fb) || isNaNBoxLit(fc)
-    const numericB = isI32Num(vb) || vb.valKind === VAL.NUMBER || vtb === VAL.NUMBER
-    const numericC = isI32Num(vc) || vc.valKind === VAL.NUMBER || vtc === VAL.NUMBER
-    const branchB = numericB && !numericC ? canonNum(fb) : fb
-    const branchC = numericC && !numericB ? canonNum(fc) : fc
+    const numericB = isNumArm(vb, b, vtb)
+    const numericC = isNumArm(vc, c, vtc)
+    // Peephole: `cond ? 1 : 0` (or `cond ? 0 : 1`) is just `f64.convert_i32_s(cond)` —
+    // the select collapses because cond is already 0/1. Saves 5 instructions.
+    const isOneZero = (one, zero) => {
+      const o = one, z = zero
+      return o.type === 'i32' && Array.isArray(o) && o[0] === 'i32.const' && o[1] === 1 &&
+             z.type === 'i32' && Array.isArray(z) && z[0] === 'i32.const' && z[1] === 0
+    }
+    if ((isOneZero(vb, vc) || isOneZero(vc, vb)) && !numericB && !numericC) {
+      const condBool = truthyIR(emit(a))
+      const n = isOneZero(vb, vc)
+        ? typed(['f64.convert_i32_s', condBool], 'f64')
+        : typed(['f64.convert_i32_s', ['i32.eqz', condBool]], 'f64')
+      n.valKind = VAL.NUMBER
+      return n
+    }
+    const branchB = canonArm(fb, numericB, numericC), branchC = canonArm(fc, numericC, numericB)
     const markNumeric = (n) => {
       if (numericB && numericC) n.valKind = VAL.NUMBER
       return n
@@ -2599,6 +3093,14 @@ export const emitter = {
   },
 
   '&&': (a, b) => {
+    // Range-check fusion: `x >= LO && x <= HI` (x a pure i32 local, LO ≤ HI compile-time
+    // constants) collapses to one unsigned compare `(x - LO) <=u (HI - LO)` — a subtract
+    // plus a branch instead of two compares, an AND, and a short-circuit branch. This is
+    // the per-char cost in scanners/parsers (digit/alpha classification) and in any
+    // two-sided bounds check. Restricted to a local `x` so evaluating it once (the fused
+    // form) matches the original's twice-read, side-effect-free semantics.
+    const fused = fuseRangeCheck(a, b)
+    if (fused) return fused
     const va = emit(a)
     // Constant-folded literal: pre-bind under truthy refinements (b runs only when a was truthy).
     if (isLit(va)) {
@@ -2630,14 +3132,24 @@ export const emitter = {
         ['else', typed(['f64.convert_i32_s', ['local.get', `$${t}`]], 'f64')]], 'f64')
     }
     const t = temp()
-    const teed = typed(['local.tee', `$${t}`, asF64(va)], 'f64')
-    return typed(['if', ['result', 'f64'],
-      toBoolFromEmitted(teed),
-      ['then', asF64(emitRight())],
+    const numA = isNumArm(va, a)
+    const vb = emitRight(), numB = isNumArm(vb, b)
+    // `a` is the else-arm result (returned when falsy — incl NaN), so canon a lone-numeric
+    // `a` before the tee: `$t` then feeds both the result and the cond canonically.
+    const teed = typed(['local.tee', `$${t}`, canonArm(asF64(va), numA, numB)], 'f64')
+    // A numeric left arm tests truthiness NaN-by-value (not __is_truthy, which mis-reads
+    // x86's sign-set NaN as truthy) — tag it so truthyIR takes that path.
+    if (numA) teed.valKind = VAL.NUMBER
+    return typed(['if', ['result', 'f64'], toBoolFromEmitted(teed),
+      ['then', canonArm(asF64(vb), numB, numA)],
       ['else', ['local.get', `$${t}`]]], 'f64')
   },
 
   '||': (a, b) => {
+    // Outside-range fusion (the complement of `&&`): `x < LO || x > HI` → one unsigned
+    // compare `(x - LO) >u (HI - LO)`. Common in validation (`if (c < 'a' || c > 'z') …`).
+    const fusedOr = fuseRangeCheckOr(a, b)
+    if (fusedOr) return fusedOr
     const va = emit(a)
     // Constant-folded literal: pre-bind under falsy refinements (b runs only when a was falsy).
     if (isLit(va)) {
@@ -2665,22 +3177,30 @@ export const emitter = {
         ['else', asF64(vb)]], 'f64')
     }
     const t = temp()
+    const numA = isNumArm(va, a)
+    const vb = emitRight(), numB = isNumArm(vb, b)
+    // `a` (then-arm) is returned only when truthy — hence never NaN — so it needs no canon;
+    // the cond's NaN-safety comes from the valKind tag. Only the else (b) arm can surface
+    // as a numeric NaN.
     const teed = typed(['local.tee', `$${t}`, asF64(va)], 'f64')
-    return typed(['if', ['result', 'f64'],
-      toBoolFromEmitted(teed),
+    if (numA) teed.valKind = VAL.NUMBER   // numeric left arm: NaN-safe truthiness (see `&&`)
+    return typed(['if', ['result', 'f64'], toBoolFromEmitted(teed),
       ['then', ['local.get', `$${t}`]],
-      ['else', asF64(emitRight())]], 'f64')
+      ['else', canonArm(asF64(vb), numB, numA)]], 'f64')
   },
 
   // a ?? b: returns b only if a is nullish
   '??': (a, b) => {
-    const va = emit(a)
+    const va = emit(a), vb = emit(b)
     const t = temp()
+    const numA = isNumArm(va, a), numB = isNumArm(vb, b)
+    // Both arms can surface as the (untyped) result — `a` when non-nullish (a NaN is not
+    // nullish, so it IS returned), `b` otherwise. Canon a lone-numeric arm; `a` before the
+    // tee so `local.get $t` is canonical. The cond is isNullish, robust to non-canon NaN.
     return typed(['if', ['result', 'f64'],
-      // Check: is a NOT nullish?
-      ['i32.eqz', isNullish(['local.tee', `$${t}`, asF64(va)])],
+      ['i32.eqz', isNullish(['local.tee', `$${t}`, canonArm(asF64(va), numA, numB)])],
       ['then', ['local.get', `$${t}`]],
-      ['else', asF64(emit(b))]], 'f64')
+      ['else', canonArm(asF64(vb), numB, numA)]], 'f64')
   },
 
   'void': a => {
@@ -2725,6 +3245,10 @@ export const emitter = {
   ].map(([op, fn]) => [op, (a, b) => {
     if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
       return fromI64([`i64.${fn}`, asI64(emit(a)), asI64(emit(b))])
+    if (op === '|') {  // `(x / y) | 0` integer-division idiom → i32.div_s
+      const divN = intLiteralValue(b) === 0 ? a : intLiteralValue(a) === 0 ? b : null
+      if (Array.isArray(divN) && divN[0] === '/') { const r = tryIntDivTrunc(divN[1], divN[2]); if (r) return r }
+    }
     const va = emit(a), vb = emit(b)
     if (isLit(va) && isLit(vb)) {
       const la = litVal(va), lb = litVal(vb)
@@ -2770,6 +3294,17 @@ export const emitter = {
       if (els != null) return emitVoid(els)
       return null
     }
+    // If-conversion (speed tier): `if (cond) x = <cheap pure value>` (no else) → `x = cond ? value
+    // : x`, which lowers to a branchless `select`. Removes the data-dependent branch (and its
+    // misprediction) from min/max/clamp reductions — e.g. levenshtein's `if (ins < m) m = ins`,
+    // ~27% faster. Gated to the same speed tier as boolConvertToSelect (the select latency/size
+    // trade). Restricted to a plain assignment of a memory-/trap-free expr to a simple local, so
+    // the unconditional false-case eval is free and identical in effect.
+    if (els == null && ctx.transform.optimize?.boolConvertToSelect && isCheapPureVal(cond)) {
+      const asg = Array.isArray(then) && then[0] === ';' && then.length === 2 ? then[1] : then
+      if (Array.isArray(asg) && asg[0] === '=' && typeof asg[1] === 'string' && isCheapPureVal(asg[2]))
+        return emitVoid(['=', asg[1], ['?:', cond, asg[2], asg[1]]])   // cond cheap-pure → re-emit is free
+    }
     const c = ce.type === 'i32' ? ce : toBoolFromEmitted(ce)
     // Flow-sensitive type refinement: narrow types within each branch based on the guard.
     const thenRefs = extractRefinements(cond, new Map(), true)
@@ -2794,6 +3329,12 @@ export const emitter = {
       const unrolled = unrollSmallConstFor(init, cond, step, body)
       if (unrolled) return unrolled
     }
+    // for-in over a static schema → unroll with key-literal substitution (folds
+    // o[k] to schema slots). Recognized via the for-in-exclusive __keys_ro intrinsic.
+    if (!labeledContinue && (!ctx.transform.optimize || ctx.transform.optimize.forInUnroll !== false)) {
+      const fu = unrollForIn(init, cond, step, body)
+      if (fu) return fu
+    }
     // Lift constant array/object literals out of the loop (allocate once, not per
     // iteration) when they are read-only + non-escaping inside it. Strip them from the
     // body up front so freshBoxed / continue analysis see the reduced body.