jz 0.6.0 → 0.8.0

package/src/compile/index.js

@@ -27,7 +27,8 @@
 
 import parseWat from 'watr/parse'
 import { ctx, err, inc, resolveIncludes, PTR, LAYOUT, declGlobal } from '../ctx.js'
-import { T, isBlockBody, isReassigned, refsName, REFS_IN_EXPR } from '../ast.js'
+import { T, isBlockBody, isReassigned, refsName, REFS_IN_EXPR, returnExprs } from '../ast.js'
+import { valTypeOf } from '../kind.js'
 import { intLiteralValue } from '../static.js'
 import {
   analyzeBody, unboxablePtrs, cseSafeLoadBases, boxedCaptures,
@@ -37,6 +38,14 @@ import { typedElemAux } from '../../layout.js'
 import { VAL, updateRep, REP_FIELDS } from '../reps.js'
 import { inferLocals } from './infer.js'
 import { optimizeFunc, treeshake } from '../optimize/index.js'
+import { strengthReduceLoopDivMod } from './loop-divmod.js'
+import { narrowBoundedSquare } from './loop-square.js'
+import { peelClampedStencil } from './peel-stencil.js'
+import { cseLoads } from './cse-load.js'
+
+// Monotonic across all functions so a CSE temp never collides (even after later inlining).
+let __cseCtr = 0
+const freshCseName = () => `${T}cse${__cseCtr++}`
 import { emit, emitter, emitVoid, emitBlockBody } from './emit.js'
 import { emitCharDecompPrologue, JSS_IMPORT_SIGS } from '../abi/string.js'
 import {
@@ -54,10 +63,12 @@ import {
   I32_MIN, I32_MAX, dollar,
 } from '../ir.js'
 import plan from './plan/index.js'
+import { foldStaticConstAggregates } from './plan/literals.js'
 import {
   buildStartFn, dedupClosureBodies, finalizeClosureTable,
-  pullStdlib, syncImports, optimizeModule, stripStaticDataPrefix,
+  pullStdlib, syncImports, optimizeModule, stripStaticDataPrefix, hoistConstGlobalInits, stripDeadElTable,
 } from '../wat/assemble.js'
+import { instrumentHelperCallsites } from '../helper-counters.js'
 
 // =============================================================================
 // Single-source export semantics
@@ -130,15 +141,21 @@ const timePhase = (profiler, name, fn) => profiler?.time ? profiler.time(name, f
  * fractional Number gets the same truncation it would get from `arr[n]`).
  */
 const isBoundaryWrapped = (func) => {
-  if (!isExported(func) || func.raw || func.sig.results.length !== 1) return false
+  if (!isExported(func) || func.raw) return false
+  // Multi-value return: every lane is an f64 NaN-box carrier (the `return [a,b,…]` emit forces
+  // asF64 per lane; result narrowing only touches single-result funcs), so any lane may hold a
+  // box whose NaN payload JSC/V8 erases at the boundary — wrap to i64-carry every lane.
+  if (func.sig.results.length !== 1) return true
   if (func.sig.results[0] !== 'f64' || func.sig.ptrKind != null) return true
-  // A boolean result rides the 0/1 number carrier internally; the export thunk
-  // boxes it to the TRUE_NAN/FALSE_NAN atom so the host sees a real boolean.
-  if (func.valResult === VAL.BOOL) return true
-  // A bigint result rides the i64-reinterpreted-f64 carrier internally; the export thunk converts
-  // it to a real Number so a JS host doesn't see raw i64 bits (`() => 100n` was returning 4.94e-322).
-  if (func.valResult === VAL.BIGINT) return true
-  return func.sig.params.some(p => p.type !== 'f64' || p.ptrKind != null)
+  // Any result that isn't a proven plain number can be a NaN-box — a heap pointer,
+  // a null/undef/bool atom, a bigint carrier, or a dynamic value — so it crosses as
+  // i64 and JSC (Safari) can't canonicalize the payload away. A proven-number result
+  // stays f64: free, and a number is never a NaN-box. `_resultNumeric` is set in
+  // analyzeFuncForEmit (covers value-bound arrows narrowValResults skips).
+  if (!func._resultNumeric) return true
+  // Number result, but a param may still carry a box — a pointer-ABI param, or a
+  // dynamic f64 param flagged `boundaryI64` during analyze — so wrap for i64 params.
+  return func.sig.params.some(p => p.type !== 'f64' || p.ptrKind != null || p.boundaryI64)
 }
 
 // Static-string intern index (the `internStrings` pass). Open-addressing table
@@ -209,20 +226,39 @@ const ensureThrowRuntime = (sec) => {
     sec.tags.push(['export', '"__jz_last_err_bits"', ['global', '$__jz_last_err_bits']])
 }
 
-// Drop the $__jz_err tag + __jz_last_err_bits globals when optimization
-// eliminated every actual throw site. ensureThrowRuntime runs before
-// optimizeModule so dead-throw analysis can see the tag/global as live; once
-// opt has finished, an unused tag still forces consumers (wasmtime, wasm2c) to
-// enable the exceptions proposal just to parse the module. User-written
-// throw/try/catch/finally is an ABI contract (JS-side may inspect
-// __jz_last_err_bits), so `userThrows` keeps the runtime declared regardless;
-// the prune fires only when `throws` was set purely by stdlib pattern matching
-// or compiler-internal coercion sites.
+// Drop the $__jz_err tag + __jz_last_err_bits globals when no throw can be CAUGHT.
+// ensureThrowRuntime runs before optimizeModule so dead-throw analysis sees the
+// tag/global as live; once opt has finished, an unused tag still forces consumers
+// (wasmtime, wasm2c, wabt) to enable the exceptions proposal just to PARSE the module.
+//
+// When `!userThrows`, every `throw` is compiler-internal (bounds / coercion / type
+// errors) and — with no user try/catch — uncatchable: nothing inspects the thrown
+// value, so it is semantically a trap. The exceptions proposal is needed only to
+// DECLARE the tag a `throw` references; lowering each surviving uncatchable throw to
+// `unreachable` keeps the module in the wasm MVP, so every runtime can parse it
+// (V8 alone enables exceptions by default, which masked this). A pure-recursion or
+// typed-array kernel (nqueens, anything pulling __to_num) thus stops emitting a Tag
+// section it can never use. User-written throw/try/catch/finally is an ABI contract
+// (JS-side may inspect __jz_last_err_bits), so `userThrows` keeps the runtime intact.
 const pruneUnusedThrowRuntime = (sec) => {
   if (!ctx.runtime.throws || ctx.runtime.userThrows) return
-  const hasThrow = (n) => Array.isArray(n) && (n[0] === 'throw' || n.some(hasThrow))
+  // A catch handler (try_table) appears only under userThrows; defensively bail if one
+  // is present so a caught throw is never silently turned into a trap.
+  const hasCatch = (n) => Array.isArray(n) &&
+    (n[0] === 'try_table' || n[0] === 'catch' || n[0] === 'catch_all' || n.some(hasCatch))
+  for (const arr of [sec.funcs, sec.stdlib, sec.start])
+    for (const f of arr) if (hasCatch(f)) return
+  // Rewrite every surviving `(throw $__jz_err …)` to `(unreachable)` (same polymorphic
+  // stack type — a drop-in in any position). The thrown operand is side-effect-free
+  // (a local read / const), so dropping it loses nothing.
+  const lowerThrows = (n) => {
+    if (!Array.isArray(n)) return n
+    if (n[0] === 'throw') return ['unreachable']
+    for (let i = 1; i < n.length; i++) n[i] = lowerThrows(n[i])
+    return n
+  }
   for (const arr of [sec.funcs, sec.stdlib, sec.start])
-    for (const f of arr) if (hasThrow(f)) return
+    for (let i = 0; i < arr.length; i++) arr[i] = lowerThrows(arr[i])
   sec.tags = sec.tags.filter(t => !(Array.isArray(t) &&
     ((t[0] === 'tag' && t[1] === '$__jz_err') ||
      (t[0] === 'export' && t[1] === '"__jz_last_err_bits"'))))
@@ -346,7 +382,9 @@ function scanAndTagNonEscapingClosures(body) {
 // their synthetic labels can't collide with the parent frame's.
 function enterFunc(sig, body, { uniq = 0, directClosures = null } = {}) {
   ctx.func.stack = []
+  ctx.func.zeroInitSeen = new Set()   // names whose `let x=0` zero-init was elided once; a 2nd is a real re-init (unrolled bodies)
   ctx.func.maybeNullish = new Set()   // bindings assigned a nullish literal → coerce in arithmetic (null-flow)
+  ctx.func.refinements = new Map()     // flow-sensitive type facts (typeof/instanceof guards) — per-function; clear so none leak across bodies
   ctx.func.pendingLabel = null        // label awaiting its loop, for `continue <label>`
   ctx.func.uniq = uniq
   ctx.func.current = sig
@@ -379,6 +417,19 @@ function analyzeFuncForEmit(func, programFacts) {
   const { paramReps } = programFacts
   if (func.raw) return null
 
+  // Strength-reduce per-iteration `i % w` / `(i/w)|0` to incremental i32 counters
+  // (idempotent: a reduced loop has no modulo left to match). Before analyze so the
+  // counters are typed/narrowed like any i32 local. Off at L0 / `loopIVDivMod:false`.
+  const _o = ctx.transform.optimize
+  if (_o && _o.loopIVDivMod !== false && isBlockBody(func.body)) func.body = strengthReduceLoopDivMod(func.body)
+  // Bounded-square narrowing: `i*i` under an `i*i < CONST` (CONST ≤ 2³⁰) guard → Math.imul,
+  // so the sieve's product/counter chain carries i32 instead of f64. Before analyze so the
+  // Math.imul typed/narrows like any i32. Off at L0 / `loopSquare:false`.
+  if (_o && _o.loopSquare !== false && isBlockBody(func.body)) func.body = narrowBoundedSquare(func.body)
+  // Edge-clamp peeling: split a clamped stencil loop into clamp-free interior + edges
+  // (the interior then lifts to SIMD). Before analyze so the new loops are analyzed.
+  if (_o && _o.clampPeel !== false && isBlockBody(func.body)) func.body = peelClampedStencil(func.body)
+
   const { name, body, sig } = func
   enterFunc(sig, body)
 
@@ -412,15 +463,28 @@ function analyzeFuncForEmit(func, programFacts) {
   // ToNumber string-parse dep tree (`__to_str`→`__itoa`/`__toExp`/`__mkstr`/…)
   // treeshake away — a ~4× module shrink that, decisively, lets V8 tier the hot
   // fill loop up properly (the bloated module JITs the *identical* loop ~2× slower).
-  if (func.exported && block) {
+  // Block AND expression bodies: value-bound arrows (`export let f = (a,b) => a*b`) are
+  // skipped by narrowValResults, so without trusting their params here they'd fall to the
+  // i64 boundary carrier. The closure path runs the same proof at line ~1300.
+  if (func.exported) {
     for (const p of sig.params) {
       if (p.type === 'f64' && p.ptrKind == null && !p.jsstring
           && !func.defaults?.[p.name] && !ctx.func.boxed?.has(p.name)
           && !ctx.func.localReps?.get(p.name)?.val
-          && paramAllUsesNumeric(body, p.name))
+          // Numeric either by PROOF (ToNumber-forcing uses) or by the export
+          // boundary contract (never used as a string → wrapVal guarantees a
+          // number). The latter catches `acc + cre` float kernels whose `+` would
+          // otherwise pull a per-iteration string-concat fork (julia, floatbeats).
+          && (paramAllUsesNumeric(body, p.name) || paramNeverString(body, p.name)))
         updateRep(p.name, { val: VAL.NUMBER })
     }
   }
+  // Sound load-CSE: cache a repeated pure typed-array load `arr[idx]` when every intervening
+  // store writes a provably-different element (idx2 ≠ idx). Recovers the fft butterfly's redundant
+  // `re[a]` load. Before analyze so the introduced temp is typed/narrowed like any local.
+  if (_o && _o.loadCSE !== false && block && ctx.types.typedElem?.size)
+    cseLoads(body, n => ctx.types.typedElem.has(n), freshCseName)
+
   if (block) {
     seedLocalIntConsts(body)
   }
@@ -434,6 +498,8 @@ function analyzeFuncForEmit(func, programFacts) {
   if (bodyFacts?.valTypes) {
     for (const [name, vt] of bodyFacts.valTypes) updateRep(name, { val: vt })
   }
+  // Never-relocated array bindings — the `[]` reader skips the forwarding follow.
+  if (bodyFacts?.neverGrown) for (const name of bodyFacts.neverGrown) updateRep(name, { neverGrown: true })
   // Proven uint32 accumulator locals — readVar tags reads `.unsigned` so the
   // f64 round-trip widens with convert_i32_u (not _s).
   if (bodyFacts?.unsignedLocals) for (const n of bodyFacts.unsignedLocals) updateRep(n, { unsigned: true })
@@ -512,6 +578,32 @@ function analyzeFuncForEmit(func, programFacts) {
     if (ctx.func.localReps?.get(name)?.intCertain === true) cellTypes.add(name)
   }
 
+  // Snapshot each param's JS-boundary carrier while reps are live — synthesizeBoundaryWrappers
+  // runs after they're torn down. A dynamic f64 param crosses as i64 (the carrier JSC can't
+  // canonicalize) iff it can hold a NaN-box, i.e. it isn't proven numeric. Numeric (NUMBER /
+  // BOOL → 0/1) params keep f64; pointer-ABI (ptrKind, type i32) and jsstring params are
+  // classified directly in the wrapper, so leave their flag false here.
+  if (isExported(func)) for (const p of sig.params) {
+    if (p.jsstring || p.ptrKind != null || p.type !== 'f64') { p.boundaryI64 = false; continue }
+    const rv = ctx.func.localReps?.get(p.name)?.val
+    p.boundaryI64 = rv !== VAL.NUMBER && rv !== VAL.BOOL
+  }
+
+  // Result-numeric proof for the boundary carrier. Block bodies get func.valResult from
+  // narrowValResults; value-bound arrows (`export let f = (a,b) => a*b`) don't, so prove via
+  // the return expression(s) with params now trusted numeric. A proven-number f64 result
+  // never carries a NaN-box → crosses as plain f64; anything else rides i64 (Safari-safe).
+  if (isExported(func))
+    func._resultNumeric = func.valResult === VAL.NUMBER ||
+      (func.valResult == null && sig.results[0] === 'f64' &&
+        (() => {
+          const rex = returnExprs(body)
+          // Void body (falls off → undefined, which callers ignore) keeps the f64 carrier:
+          // undefined isn't a reference, so no i64 is needed and wrapping every void export
+          // is pure overhead. A non-empty set must be all-NUMBER to stay f64.
+          return rex.length === 0 || rex.every(e => valTypeOf(e) === VAL.NUMBER)
+        })())
+
   return {
     block,
     locals: new Map(ctx.func.locals),
@@ -520,27 +612,61 @@ function analyzeFuncForEmit(func, programFacts) {
     flatObjects: new Map(ctx.func.flatObjects),
     sliceViews: new Set(ctx.func.sliceViews),
     cseLoadBases,
+    distinctParams: func.distinctParams || null,
     typedElem: ctx.types.typedElem ? new Map(ctx.types.typedElem) : null,
     localReps: cloneRepMap(ctx.func.localReps),
   }
 }
 
 function seedLocalIntConsts(body) {
+  // Fold each never-reassigned local `const`/`let NAME = EXPR` to a known i32, so a
+  // divisor / bound / size built from earlier consts (`rr = R|0; win = 2*rr+1`) becomes
+  // a compile-time literal — which lets the int-divide lowering hand the wasm backend a
+  // constant divisor to magic-multiply (no runtime sdiv), array bounds resolve, etc.
+  // Mirrors the module-scope fold (evalConst above); a string ref resolves through the
+  // intConst already recorded on its rep, and the fixpoint lets a later const see an
+  // earlier one regardless of declaration order. Skips nested functions (own scope).
+  const evalC = (n) => {
+    if (typeof n === 'number') return Number.isInteger(n) ? n : null
+    if (Array.isArray(n) && n[0] == null && typeof n[1] === 'number') return Number.isInteger(n[1]) ? n[1] : null
+    if (typeof n === 'string') return intLiteralValue(n)   // a seeded intConst / literal local
+    if (!Array.isArray(n)) return null
+    const [op, a, b] = n
+    const va = evalC(a); if (va == null) return null
+    if (op === 'u-' || (op === '-' && b === undefined)) return -va
+    const vb = evalC(b); if (vb == null) return null
+    switch (op) {
+      case '+': return va + vb; case '-': return va - vb; case '*': return va * vb
+      case '&': return va & vb; case '|': return va | vb; case '^': return va ^ vb
+      case '<<': return va << vb; case '>>': return va >> vb; case '>>>': return va >>> vb
+      default: return null
+    }
+  }
+  const decls = []
   const walk = (node) => {
     if (!Array.isArray(node)) return
     const [op, ...args] = node
     if (op === '=>') return
     if (op === 'let' || op === 'const') {
-      for (const decl of args) {
-        if (!Array.isArray(decl) || decl[0] !== '=' || typeof decl[1] !== 'string') continue
-        const value = intLiteralValue(decl[2])
-        if (value != null && !isReassigned(body, decl[1])) updateRep(decl[1], { intConst: value })
-      }
+      for (const decl of args)
+        if (Array.isArray(decl) && decl[0] === '=' && typeof decl[1] === 'string' && !isReassigned(body, decl[1])) decls.push(decl)
       return
     }
     for (const arg of args) walk(arg)
   }
   walk(body)
+  const seeded = new Set()
+  let changed = true
+  while (changed) {
+    changed = false
+    for (const decl of decls) {
+      if (seeded.has(decl[1])) continue
+      const value = evalC(decl[2])
+      if (value != null && Number.isInteger(value) && value >= I32_MIN && value <= I32_MAX) {
+        updateRep(decl[1], { intConst: value }); seeded.add(decl[1]); changed = true
+      }
+    }
+  }
 }
 
 // ── Loop-invariant exported-param coercion hoist ────────────────────────────
@@ -562,21 +688,47 @@ function seedLocalIntConsts(body) {
 const PARAM_REASSIGN_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=',
   '^=', '>>=', '<<=', '>>>=', '||=', '&&=', '??=', '++', '--'])
 // Binary ops that unconditionally ToNumber BOTH operands, so a bare param operand
-// is a pure numeric use. `+` is excluded (may concatenate); comparisons / `===`
-// are excluded (they branch on type, never coerce a string operand to number).
+// is a pure numeric use. `+` is excluded (may concatenate); `===`/`==` are excluded
+// (they branch on type, never coerce a string operand to number).
 const NUM_BIN_OPS = new Set(['*', '/', '%', '**', '&', '|', '^', '<<', '>>', '>>>'])
-
-/** True iff every use of param `name` in `body` is an unconditional-numeric
- *  operand, so coercing it to a number once at entry is observationally exact.
- *  Rejects conservatively: reassignment and any appearance outside a numeric
- *  operator (member/index/call-arg/return/compare/concat). Two transparencies:
+// Relational ops: jz has no lexicographic compare for an untyped operand — `<`
+// lowers to `f64.lt`, taking the string path only when a *known-string* operand
+// is present (emit.js cmpOp). So a bare param compared against a non-string is a
+// pure numeric use, same as NUM_BIN_OPS. A string-literal counterpart (`x < "m"`)
+// signals string intent and is rejected (handled in the walk below).
+const REL_OPS = new Set(['<', '<=', '>', '>='])
+// A string literal/template operand poisons relational numeric inference.
+const isStrLiteral = (n) => Array.isArray(n) && (n[0] === 'str' || n[0] === 'template')
+
+/** True iff every use of param `name` in `body` is numeric-COMPATIBLE *and* at
+ *  least one use is numeric-PROVING — so coercing it to a number once at entry is
+ *  observationally exact. Two verdict levels guard against a polymorphic slot
+ *  passing on absence of evidence:
+ *   - PROVING (`proven=true`): arithmetic / relational / bitwise / unary operand —
+ *     JS ToNumbers these, and a string/array value would have shown a disqualifying
+ *     use elsewhere.
+ *   - COMPATIBLE-ONLY: the length slot of `new TypedArray(x)` / `new ArrayBuffer(x)`.
+ *     A number sizes the buffer, but an array is COPIED and a buffer VIEWED — so a
+ *     bare param here proves nothing. A param used *solely* as `new Float64Array(arr)`
+ *     stays unproven and keeps the polymorphic ctor dispatch (else array-copy is lost).
+ *  Any other appearance (member/call-arg/return/concat/`===`/reassignment) rejects.
+ *  Two transparencies:
  *   - copy aliases: `let x = name` makes `x` carry the same value, so `x`'s uses
  *     must be numeric too (fixpoint-collected). Catches `let T = t` then `…T…`.
  *   - captured closures: a non-shadowing inner arrow captures the binding by
  *     reference, so its body's uses count — we recurse instead of rejecting.
  *     Catches floatbeat helpers `let s=(f)=>…t…` that read the param numerically. */
-function paramAllUsesNumeric(body, name) {
+// requireProof=true (default): the param has a ToNumber-FORCING use (PROVES numeric).
+// requireProof=false: the param merely has NO string-requiring use (numeric-COMPATIBLE).
+// Forwarding recursions use the latter — a callee receiving the param need only be
+// string-free (e.g. fbm's `ph`, used additively inside Math.sin), since the OUTER
+// param earns its own proof from its own uses; requiring the callee be self-proven
+// wrongly rejected forwards into additive-only params.
+function paramAllUsesNumeric(body, name, _seen = new Set(), requireProof = true) {
   if (body == null) return false
+  // Local closure defs (`let f = (p,…) => …`) so a call `f(name)` can be judged by
+  // f's own param numericity (see the call-arg handler in the walk).
+  const closures = new Map()  // name → { params:[string], body }
   // Fixpoint-collect copy aliases: `let/const x = <name-or-alias>`.
   const names = new Set([name])
   for (let grew = true; grew;) {
@@ -584,15 +736,25 @@ function paramAllUsesNumeric(body, name) {
     const collect = (node) => {
       if (!Array.isArray(node)) return
       if ((node[0] === 'let' || node[0] === 'const') && node.length === 2
-          && Array.isArray(node[1]) && node[1][0] === '=' && typeof node[1][1] === 'string'
-          && typeof node[1][2] === 'string' && names.has(node[1][2]) && !names.has(node[1][1])) {
-        names.add(node[1][1]); grew = true
+          && Array.isArray(node[1]) && node[1][0] === '=' && typeof node[1][1] === 'string') {
+        const init = node[1][2]
+        if (typeof init === 'string' && names.has(init) && !names.has(node[1][1])) { names.add(node[1][1]); grew = true }
+        else if (Array.isArray(init) && init[0] === '=>' && !closures.has(node[1][1])) {
+          const ps = Array.isArray(init[1]) ? init[1].slice(1) : [init[1]]   // ['()', p0, p1] → [p0,p1]
+          if (ps.every(p => typeof p === 'string')) closures.set(node[1][1], { params: ps, body: init[2] })
+        }
       }
       for (let i = 1; i < node.length; i++) collect(node[i])
     }
     collect(body)
   }
-  let ok = true
+  let ok = true, proven = false
+  // A param in a numeric-operand slot is a PROVING use; recurse into a non-param sub-expr.
+  const numOperand = (n) => { if (names.has(n)) proven = true; else walk(n) }
+  // Positional call args, flattening the `(, a b c)` node multi-arg calls parse to —
+  // without this a forward like `fbm(x, y, t, …)` never matched its param positions.
+  const flat1 = (a) => Array.isArray(a) && a[0] === ',' ? a.slice(1).flatMap(flat1) : [a]
+  const callArgList = (n) => n.slice(2).flatMap(flat1)
   const walk = (node) => {
     if (!ok) return
     if (typeof node === 'string') { if (names.has(node)) ok = false; return }  // bare use → reject
@@ -617,19 +779,161 @@ function paramAllUsesNumeric(body, name) {
     }
     if (PARAM_REASSIGN_OPS.has(op) && names.has(node[1])) { ok = false; return }
     if (NUM_BIN_OPS.has(op) && node.length === 3) {     // numeric binary: operands are ToNumber'd
+      numOperand(node[1]); numOperand(node[2])
+      return
+    }
+    if (REL_OPS.has(op) && node.length === 3) {         // relational: numeric unless a known string is present
+      if (isStrLiteral(node[1]) || isStrLiteral(node[2])) { ok = false; return }
+      numOperand(node[1]); numOperand(node[2])
+      return
+    }
+    // `new TypedArray(x)` / `new ArrayBuffer(x)`: the length argument is ToNumber'd
+    // on the alloc path, but a pointer arg is copied (array) or viewed (buffer).
+    // A bare param in the length slot is numeric-COMPATIBLE but not PROVING — skip it
+    // (no reject, no proof); other args walk normally. A param used *solely* as
+    // `new Float64Array(param)` thus stays unproven → keeps the polymorphic ctor (so
+    // `f(arr)` copies the array instead of mis-sizing a zero buffer).
+    if (op === '()' && typeof node[1] === 'string' && node[1].startsWith('new.')
+        && (node[1].endsWith('Array') || node[1] === 'new.ArrayBuffer')) {
+      for (let i = 2; i < node.length; i++) if (!names.has(node[i])) walk(node[i])
+      return
+    }
+    // Call of a LOCAL closure `f(…name…)`: forwarding the param flows its value into
+    // f's positional param. If that param is itself all-numeric (recursively, with a
+    // cycle guard), `name` in that slot is numeric-COMPATIBLE — neither rejected nor
+    // proving (so a param used *only* as a forwarded arg stays unproven, like the ctor
+    // length slot). Unknown / non-numeric callees fall through and reject (a string
+    // could flow in). Covers heapsort's `heapify(n)` and crc32's `crc32(buf)`.
+    if (op === '()' && typeof node[1] === 'string' && closures.has(node[1]) && !_seen.has(node[1])) {
+      const cl = closures.get(node[1])
+      const args = callArgList(node)
+      for (let i = 0; i < args.length; i++) {
+        if (!names.has(args[i])) { walk(args[i]); continue }
+        const param = cl.params[i]
+        if (param == null || !paramAllUsesNumeric(cl.body, param, new Set([..._seen, node[1]]), false)) { ok = false; return }
+      }
+      return
+    }
+    // Same forwarding judgement for a call to a MODULE-LEVEL user function (sibling,
+    // not a body-local closure): `frame` passing its param into a helper `fbm(x,y,t,…)`.
+    // Without this the bare arg fell through and rejected, leaving an exported numeric
+    // param (plasma/raymarcher's `t`) unproven → per-pixel `__to_num` + polymorphic-`+`
+    // string forks. Judge by the callee param's own numericity (recursive, cycle-guarded).
+    if (op === '()' && typeof node[1] === 'string' && !_seen.has(node[1])) {
+      const fn = ctx.func.map?.get(node[1])
+      if (fn && fn.body && !fn.raw && Array.isArray(fn.sig?.params) && !fn.rest) {
+        const args = callArgList(node)
+        for (let i = 0; i < args.length; i++) {
+          if (!names.has(args[i])) { walk(args[i]); continue }
+          const p = fn.sig.params[i]
+          if (!p || !paramAllUsesNumeric(fn.body, p.name, new Set([..._seen, node[1]]), false)) { ok = false; return }
+        }
+        return
+      }
+    }
+    // `Math.f(...)` ToNumbers every argument (Math operates on numbers), so a bare
+    // param in any arg slot is a PROVING numeric use — same contract as `*`/`-`.
+    // Without this, `Math.sin(t)` rejected the param via the generic-call fallthrough,
+    // so a numeric kernel like `Math.sin(tick) + …` lost its NUMBER proof and paid a
+    // per-use `__to_num` + a polymorphic-`+` string-concat fork (interference example).
+    // The callee is the lowered `math.sin` string at emit time (post-autoload), or the
+    // raw `(. Math sin)` member pre-lowering — match both.
+    const isMathCall = op === '()' && (
+      (typeof node[1] === 'string' && node[1].startsWith('math.')) ||
+      (Array.isArray(node[1]) && node[1][0] === '.' && node[1][1] === 'Math'))
+    if (isMathCall) {
+      const numArg = (a) => { if (Array.isArray(a) && a[0] === ',') { numArg(a[1]); numArg(a[2]) } else numOperand(a) }
+      for (let i = 2; i < node.length; i++) numArg(node[i])
+      return
+    }
+    // Binary `+` is overloaded (numeric add | string concat). A string-literal
+    // operand means concat intent → reject. Otherwise it is numeric-COMPATIBLE but
+    // not self-PROVING (a string param would concat) — recurse the non-param operand
+    // and treat a bare param as compatible (neither prove nor reject), exactly like
+    // paramNeverString. The numeric proof must still come from a ToNumber-forcing use
+    // (`*`, `Math.*`, …); a param used ONLY in `+` stays unproven (sound).
+    if (op === '+' && node.length === 3) {
+      if (isStrLiteral(node[1]) || isStrLiteral(node[2])) { ok = false; return }
       if (!names.has(node[1])) walk(node[1])
       if (!names.has(node[2])) walk(node[2])
       return
     }
-    if (op === '-' && node.length === 2) { if (!names.has(node[1])) walk(node[1]); return }  // unary negate
-    if (op === '-' && node.length === 3) { if (!names.has(node[1])) walk(node[1]); if (!names.has(node[2])) walk(node[2]); return }
+    if (op === '-' && node.length === 2) { numOperand(node[1]); return }  // unary negate
+    if (op === '-' && node.length === 3) { numOperand(node[1]); numOperand(node[2]); return }
     // `u-`/`u+` are the normalized unary minus/plus (prepare rewrites `-x`/`+x`); both ToNumber.
-    if ((op === 'u-' || op === 'u+') && node.length === 2) { if (!names.has(node[1])) walk(node[1]); return }
-    if (op === '+' && node.length === 2) { if (!names.has(node[1])) walk(node[1]); return }  // unary + = ToNumber
-    if (op === '~' && node.length === 2) { if (!names.has(node[1])) walk(node[1]); return }
+    if ((op === 'u-' || op === 'u+') && node.length === 2) { numOperand(node[1]); return }
+    if (op === '+' && node.length === 2) { numOperand(node[1]); return }  // unary + = ToNumber
+    if (op === '~' && node.length === 2) { numOperand(node[1]); return }
     for (let i = 1; i < node.length; i++) walk(node[i])  // bare param reaching here → rejected above
   }
   walk(body)
+  return requireProof ? (ok && proven) : ok
+}
+
+// String methods whose receiver MUST be a string — their presence proves the
+// param is (sometimes) string and disqualifies the boundary-numeric trust.
+const STRING_RECV_METHODS = new Set([
+  'charCodeAt', 'charAt', 'codePointAt', 'startsWith', 'endsWith', 'toUpperCase',
+  'toLowerCase', 'normalize', 'localeCompare', 'padStart', 'padEnd', 'repeat',
+  'trim', 'trimStart', 'trimEnd', 'split', 'match', 'matchAll', 'replace',
+  'replaceAll', 'substring', 'substr', 'concat', 'indexOf', 'lastIndexOf',
+  'includes', 'slice',
+])
+
+/** True iff no use of exported f64 param `name` REQUIRES it to be a string — so
+ *  the interop boundary contract (`wrapVal` passes a JS number straight to an f64
+ *  param; a string arg is a type misuse already unsupported, returning NaN) makes
+ *  it provably numeric. Weaker than `paramAllUsesNumeric`: that PROVES numericity
+ *  from ToNumber-forcing ops, this DISPROVES stringness so binary `+` (the common
+ *  `accumulator + cre` shape) no longer pessimistically pulls the string-concat
+ *  fork into a pure float kernel. Only sound under the export boundary — never use
+ *  for locals/closures, whose values can genuinely be strings.
+ *
+ *  Disqualifying (string-requiring) uses:
+ *   - `+` with a string-literal/template operand (`"px" + name`) — concat intent
+ *   - a string-receiver method call (`name.charCodeAt(…)`, `name.split(…)`)
+ *   - `name[k]` / `name.length` is NOT disqualifying (works on arrays/typed too,
+ *     but an f64 param is neither — so a member access means the caller passed a
+ *     pointer, out of the f64-number contract; conservatively we reject it)
+ *   - passing `name` to a call / returning it / storing into an aggregate: the
+ *     value escapes where it could be ToString'd; reject conservatively. */
+function paramNeverString(body, name) {
+  if (body == null) return false
+  let ok = true
+  const walk = (node) => {
+    if (!ok || node == null) return
+    if (typeof node === 'string') { if (node === name) ok = false; return }  // bare escape → reject
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    if (op === '=>') return                                  // shadowing-safe: closure handled conservatively (escape)
+    // `+` (binary): a string-literal/template operand makes it concat → reject.
+    // Otherwise the param is in an arithmetic add; recurse the non-name operand.
+    if (op === '+' && node.length === 3) {
+      if (isStrLiteral(node[1]) || isStrLiteral(node[2])) { ok = false; return }
+      for (let i = 1; i <= 2; i++) if (node[i] !== name) walk(node[i])
+      return
+    }
+    // Numeric/relational/bitwise binary + unary: param operand is fine, recurse rest.
+    if ((NUM_BIN_OPS.has(op) || REL_OPS.has(op)) && node.length === 3) {
+      for (let i = 1; i <= 2; i++) if (node[i] !== name) walk(node[i])
+      return
+    }
+    if ((op === 'u-' || op === 'u+' || op === '~') && node.length === 2) {
+      if (node[1] !== name) walk(node[1]); return
+    }
+    if (op === '-' && (node.length === 2 || node.length === 3)) {
+      for (let i = 1; i < node.length; i++) if (node[i] !== name) walk(node[i])
+      return
+    }
+    // Member access / method call on the param → it's a pointer, not an f64 number:
+    // reject (out of contract). `.`/`?.`/`[]` with the name as receiver.
+    if ((op === '.' || op === '?.' || op === '[]') && node[1] === name) { ok = false; return }
+    // `=`/compound reassignment of the param to a non-numeric value: reject if it
+    // could become a string. A reassignment makes the param mutable — conservatively
+    // require the RHS to be string-free too (recurse), and the target isn't a use.
+    for (let i = 1; i < node.length; i++) walk(node[i])
+  }
+  walk(body)
   return ok
 }
 
@@ -728,6 +1032,11 @@ function emitFunc(func, funcFacts, programFacts) {
   // it the pass is a no-op. `$`-prefixed to match WAT local names directly.
   if (funcFacts.cseLoadBases?.size)
     fn.cseLoadBases = new Set([...funcFacts.cseLoadBases].map(n => `$${n}`))
+  // Param-distinctness fact (alias analysis): typed-array params proven mutually-distinct buffers
+  // at every call site. `$`-prefixed to match WAT param names; read by hoistInvariantLoop to hoist
+  // a load from one such param across a store to another (they can't alias).
+  if (funcFacts.distinctParams?.size)
+    fn.distinctParams = new Set([...funcFacts.distinctParams].map(n => `$${n}`))
   // Inline `(export ...)` attribute only for the syntactic inline-export
   // form (`export function foo`, snapshot in `func.exported` at defFunc
   // time). Re-exports (`function foo; export { foo }`) and aliases (`export
@@ -868,17 +1177,26 @@ function synthesizeBoundaryWrappers() {
   for (const func of ctx.func.list) {
     if (!isBoundaryWrapped(func)) continue
     const { name, sig } = func
-    // Quiet NaN-box ABI: every boundary value is f64. A number is a plain f64; a
-    // tagged value (heap pointer, null/undef/bool atom) is an f64 whose quiet-NaN
-    // (0x7FF8…) payload carries the tag. Quiet-NaN payloads are preserved across the
-    // JS↔wasm call boundary by every real engine (and non-JS hosts don't canonicalize
-    // at all), so no i64 carrier is needed — the wasm signature is self-describing
-    // (f64 everywhere) and a consumer discriminates a tagged value by the NaN prefix.
-    // Env requirement: a non-canonicalizing NaN boundary. To support a canonicalizing
-    // engine, a per-position i64 carrier would re-enter here (param/result type i64 +
-    // `i64.reinterpret_f64`) plus a `jz:i64exp` section for interop.js.
-    const resultBool = func.valResult === VAL.BOOL && sig.ptrKind == null
-    const resultBigint = func.valResult === VAL.BIGINT && sig.ptrKind == null
+    // i64 boundary carrier (Safari-safe). A genuine number is never a NaN-box, so it crosses
+    // as plain f64 (zero cost). Everything that can be a NaN-box — heap pointer, null/undef/
+    // bool atom, bigint carrier, or a dynamic value — crosses as i64: JSC (Safari) canonicalizes
+    // f64 NaN payloads at the JS↔wasm boundary, erasing the box. The wasm signature is
+    // self-describing; interop.js wrap() reinterprets BigInt↔f64 by bits, driven by the
+    // `jz:i64exp` section emitted below. Non-JS hosts (WASI) read the same signature — i64 is
+    // just int64 there, no BigInt.
+    const resultPtr = sig.ptrKind != null
+    const resultBool = func.valResult === VAL.BOOL && !resultPtr
+    const resultBigint = func.valResult === VAL.BIGINT && !resultPtr
+    // Dynamic f64 result: not pointer/bool/bigint and not a proven number → may be a NaN-box
+    // at runtime, so i64. (An i32-carrier result is numeric → stays f64 via convert below.)
+    const resultDynamic = !resultPtr && !resultBool && !resultBigint
+      && sig.results[0] === 'f64' && !func._resultNumeric
+    const resultI64 = resultPtr || resultBool || resultBigint || resultDynamic
+    // jz:i64exp `r` marks results interop must reinterpret then `mem.read`. A bigint result is
+    // i64 too, but the BigInt *is* the value (no reinterpret) — so it stays unmarked.
+    const resultReinterpret = resultPtr || resultBool || resultDynamic
+    // i64 carrier per param: pointer-ABI (offset) or a dynamic f64 param (boundaryI64).
+    const paramIsI64 = (p) => !p.jsstring && (p.ptrKind != null || p.boundaryI64)
     // Inline `(export ...)` attribute only when the func decl carried the
     // inline-export keyword (`export function foo`). For re-exports
     // (`function foo; export { foo as bar }`) the `name` is the *internal*
@@ -888,26 +1206,58 @@ function synthesizeBoundaryWrappers() {
     const wrapNode = func.exported
       ? ['func', `$${name}$exp`, ['export', `"${name}"`]]
       : ['func', `$${name}$exp`]
-    // jsstring params flow as externref end-to-end; every other boundary value is f64.
-    sig.params.forEach((p) => {
-      wrapNode.push(['param', `$${p.name}`, p.jsstring ? 'externref' : 'f64'])
+    // jsstring params flow as externref end-to-end; boxed params ride i64; numbers f64.
+    const i64Params = []
+    sig.params.forEach((p, i) => {
+      wrapNode.push(['param', `$${p.name}`, p.jsstring ? 'externref' : paramIsI64(p) ? 'i64' : 'f64'])
+      if (paramIsI64(p)) i64Params.push(i)
     })
-    wrapNode.push(['result', resultBigint ? 'i64' : 'f64'])
+    // Track externref param positions so interop.js can pass JS values raw (skipping
+    // `mem.wrapVal`) at those slots — today only `jsstring` params; future externref carriers
+    // wire here too. `extParams` is per-slot: false | { def: '...' } for a JS-side default.
+    const extParams = sig.params.map(p => !p.jsstring ? false : p.jsstringDefault != null ? { def: p.jsstringDefault } : true)
+    if (extParams.some(Boolean)) func._exportExtParams = extParams
+    // Inner→wrapper argument list, shared by both single- and multi-value result shapes.
     const args = sig.params.map((p) => {
       const get = ['local.get', `$${p.name}`]
-      // jsstring: externref flows through unchanged — inner func also takes externref.
-      if (p.jsstring) return get
-      // ptrKind param: the f64 NaN-box carries the pointer — extract the i32 offset.
-      if (p.ptrKind != null) return ['i32.wrap_i64', ['i64.reinterpret_f64', get]]
+      if (p.jsstring) return get                              // externref flows through unchanged
+      if (p.ptrKind != null) return ['i32.wrap_i64', get]     // ptr param: inner takes the i32 offset
+      if (p.boundaryI64) return ['f64.reinterpret_i64', get]  // dynamic boxed param → f64 NaN-box carrier
       if (p.type === 'f64') return get
-      // Numeric narrowing: f64 → i32 truncate
-      return ['i32.trunc_sat_f64_s', get]
+      return ['i32.trunc_sat_f64_s', get]                     // numeric narrowing f64 → i32
     })
     const callIR = ['call', `$${name}`, ...args]
+    // Multi-value return: each lane is an f64 NaN-box carrier (every `return [a,b,…]` lane is
+    // asF64; narrowing only touches single-result funcs). A boxed lane's NaN payload is erased
+    // at the JS boundary, so cross EVERY lane as i64 — capture the inner call's N lanes into f64
+    // locals (last result on top of the stack ⇒ pop in reverse) and re-push each reinterpreted.
+    // interop reads the lane tuple via mem.read / decode (both map over an array result).
+    if (sig.results.length > 1) {
+      sig.results.forEach(() => wrapNode.push(['result', 'i64']))
+      // Lane temporaries — guaranteed distinct from the wrapper's params (jz doesn't reserve
+      // `__`, so a user param could be `__mlane0`): bump the prefix until no lane name collides.
+      const pnames = new Set(sig.params.map((p) => p.name))
+      let pfx = '__mlane'
+      while (sig.results.some((_, i) => pnames.has(`${pfx}${i}`))) pfx = `_${pfx}`
+      const lanes = sig.results.map((_, i) => `$${pfx}${i}`)
+      lanes.forEach((n) => wrapNode.push(['local', n, 'f64']))
+      const stmts = [callIR]
+      for (let i = lanes.length - 1; i >= 0; i--) stmts.push(['local.set', lanes[i]])
+      for (const n of lanes) stmts.push(['i64.reinterpret_f64', ['local.get', n]])
+      wrapNode.push(...stmts)
+      // `m` (lane count) marks a multi-value result so interop / the test adapter decode each
+      // lane (vs `r`'s single reinterpret). Always recorded — even with no i64 params — so the
+      // numeric-only `(a,b)=>[a+1,b+2]` tuple still gets its lanes turned back into numbers.
+      func._exportI64 = { p: i64Params, m: sig.results.length }
+      wrappers.push(wrapNode)
+      continue
+    }
+    wrapNode.push(['result', resultI64 ? 'i64' : 'f64'])
+    const toI64 = (n) => ['i64.reinterpret_f64', n]
     let body
-    if (sig.ptrKind != null) {
+    if (resultPtr) {
       const ptrType = valKindToPtr(sig.ptrKind)
-      body = mkPtrIR(ptrType, sig.ptrAux ?? 0, callIR)
+      body = toI64(mkPtrIR(ptrType, sig.ptrAux ?? 0, callIR))
     } else if (resultBool) {
       // The inner func returns a clean 0/1 boolean carrier — never NaN. The i32
       // carrier already takes truthyIR's identity path; the f64 carrier would
@@ -917,28 +1267,22 @@ function synthesizeBoundaryWrappers() {
       const carrier = sig.results[0] === 'i32'
         ? typed(callIR, 'i32')
         : typed(['f64.ne', callIR, ['f64.const', 0]], 'i32')
-      body = boolBoxIR(carrier)
-    } else if (resultBigint) {
-      // BigInt rides the i64-reinterpret-f64 carrier internally; expose the raw i64 at the JS
-      // boundary so the host receives a real, lossless BigInt (wasm i64 <-> JS BigInt). Internal
-      // callers use `$name` (the f64 carrier) untouched; only the `$exp` export result is i64.
-      body = ['i64.reinterpret_f64', callIR]
+      body = toI64(boolBoxIR(carrier))
+    } else if (resultBigint || resultDynamic) {
+      // BigInt rides the i64-reinterpret-f64 carrier internally; a dynamic result is already an
+      // f64 NaN-box carrier. Either way expose the raw i64 at the JS boundary for a lossless
+      // value. Internal callers use `$name` (the f64 carrier) untouched; only `$exp` is i64.
+      body = toI64(callIR)
     } else if (sig.results[0] === 'i32') {
       body = [sig.unsignedResult ? 'f64.convert_i32_u' : 'f64.convert_i32_s', callIR]
     } else {
       body = callIR
     }
     wrapNode.push(body)
-    // Track externref param positions so interop.js can pass JS values
-    // raw (skipping `mem.wrapVal`) at those slots. Today this only fires
-    // for `jsstring`-tagged params; future externref carriers wire here too.
-    // `extParams` is per-slot: false (non-ext) | { def: '...' }-bearing object
-    // for jsstring params with a JS-side default substitution.
-    const extParams = sig.params.map(p => {
-      if (!p.jsstring) return false
-      return p.jsstringDefault != null ? { def: p.jsstringDefault } : true
-    })
-    if (extParams.some(Boolean)) func._exportExtParams = extParams
+    // Record the i64 carrier map for interop.js (jz:i64exp). A pure-numeric export
+    // (no i64 params, f64 result) records nothing — zero footprint off the box path.
+    if (i64Params.length || resultReinterpret)
+      func._exportI64 = { p: i64Params, r: resultReinterpret ? 1 : 0 }
     wrappers.push(wrapNode)
   }
   return wrappers
@@ -1025,6 +1369,32 @@ function emitClosureBody(cb) {
     if (ptRow[i] === true && !ctx.func.localReps?.get(cb.params[i])?.val)
       updateRep(cb.params[i], i < minArgc ? { val: VAL.NUMBER } : { val: VAL.NUMBER, nullable: true })
   }
+  // A param passed the same typed-array ctor at every direct call site is TYPED:
+  // register its element ctor so `buf[i]` reads use the typed load (it stays an f64
+  // NaN-box in the closure ABI, but knowing the kind avoids the dynamic `__typed_idx`
+  // /`__len` dispatch that pulls the string runtime). Numeric trust (above) wins if it
+  // already classified the slot — they're disjoint anyway (NUMBER vs TYPED arg).
+  const tcRow = ctx.closure.paramTypedCtors?.get(cb.name)
+  if (tcRow) for (let i = 0; i < cb.params.length; i++) {
+    const ctor = tcRow[i]
+    if (ctor && !ctx.func.localReps?.get(cb.params[i])?.val) {
+      updateRep(cb.params[i], { val: VAL.TYPED })
+      ;(ctx.types.typedElem ||= new Map()).set(cb.params[i], ctor)
+    }
+  }
+  // Body-usage numeric trust for closure params — the same proof the export path
+  // applies (paramAllUsesNumeric). A nested helper like heapsort's `heapify(n)` whose
+  // param is used only in arithmetic/relational positions is VAL.NUMBER, so `(n>>1)-1`
+  // skips the `__to_num` coercion that would otherwise drag the ToNumber string-parse
+  // tree into a pure-integer kernel. paramAllUsesNumeric walks any AST node, so this
+  // also covers expression-bodied arrows (`(m) => m | 0`) — the common closure shape
+  // whose dynamic param would otherwise emit a polymorphic add/coerce that pulls the
+  // whole string runtime in. Call-site evidence (ptRow) already covers the monomorphic
+  // case; this also catches params the lattice left unobserved.
+  for (const p of cb.params) {
+    if (!ctx.func.localReps?.get(p)?.val && !cb.defaults?.[p] && paramAllUsesNumeric(cb.body, p))
+      updateRep(p, { val: VAL.NUMBER })
+  }
 
   // Register captured variable locals: boxed = i32 cell pointer, otherwise f64 value
   for (let i = 0; i < cb.captures.length; i++) {
@@ -1308,6 +1678,11 @@ export default function compile(ast, profiler) {
     }
   }
 
+  // Whole-program constant fold of module-scope aggregate literals — `var x=[1,2,3];
+  // y=x[0]` → `y=1`, dropping the array (no data segment, no __arr_idx_known) when
+  // every reference is a static read. The scalar analog of the constInts fold above.
+  timePhase(profiler, 'foldAggregates', () => foldStaticConstAggregates(ast))
+
   const programFacts = timePhase(profiler, 'plan', () => plan(ast, profiler))
 
   // Inspect sink: editor hosts opt in via { inspect: true } to read inferred shapes.
@@ -1448,13 +1823,35 @@ export default function compile(ast, profiler) {
   ensureThrowRuntime(sec)
 
   timePhase(profiler, 'optimizeModule', () => optimizeModule(sec, profiler))
+  if (ctx.transform.helperCallsites) instrumentHelperCallsites([...sec.funcs, ...sec.stdlib, ...sec.start])
+
+  // Fold constant `__start` global inits into immutable inline decls (drops the
+  // store, and `__start` with it when that empties it). Runs HERE — after
+  // stripStaticDataPrefix and optimizeModule — so any data-segment offset a hoisted
+  // pointer carries is already in its final, shifted form (hoisting earlier would
+  // freeze a pre-strip offset the shift pass never revisits in the global decl).
+  hoistConstGlobalInits(sec)
 
   // Populate globals (after __start — const folding may update declarations).
   // Records build IR directly — no WAT-text parse-back.
-  sec.globals.push(...[...ctx.scope.globals].filter(([, g]) => g).map(([n, g]) => ['global', `$${n}`,
-    ...(g.export ? [['export', `"${g.export}"`]] : []),
-    g.mut ? ['mut', g.type] : g.type,
-    [`${g.type}.const`, g.init]]))
+  // The wasm type comes from globalTypes (the canonical name→type map declGlobal
+  // maintains alongside the entry), falling back to the entry's own `.type`. They
+  // are normally identical, but a global whose entry object is later rebuilt (e.g.
+  // hoistConstGlobalInits' `{...g, …}` spread) must not depend on that rebuild
+  // preserving `.type` — globalTypes is the stable source, so an entry that lost
+  // its `.type` still emits a well-typed `(global …)` rather than `(undefined.const)`.
+  sec.globals.push(...[...ctx.scope.globals].filter(([, g]) => g).map(([n, g]) => {
+    const ty = ctx.scope.globalTypes.get(n) ?? g.type
+    return ['global', `$${n}`,
+      ...(g.export ? [['export', `"${g.export}"`]] : []),
+      g.mut ? ['mut', ty] : ty,
+      [`${ty}.const`, g.init]]
+  }))
+
+  // Drop the Eisel-Lemire decimal table if no live code parses decimals at runtime — must
+  // run after sec.globals/funcs are final (exact reachability) and before the data segment
+  // below serializes ctx.runtime.data. See stripDeadElTable.
+  stripDeadElTable(sec)
 
   // Data segments (after emit — string literals append to ctx.runtime.data / strPool during emit)
   // Active segment at address 0 — skipped for shared memory (would collide across modules)
@@ -1540,6 +1937,23 @@ export default function compile(ast, profiler) {
   if (extExports.length)
     sec.customs.push(['@custom', '"jz:extparam"', `"${JSON.stringify(extExports).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`])
 
+  // jz:i64exp — per-export i64 carrier map (NaN-canonicalization dodging). Each entry
+  // `{name, p:[i64 param indices], r:1? | m:N?}`: `p` lists params interop must pass as BigInt
+  // (f64ToI64); `r` marks a single result to reinterpret (i64ToF64) before mem.read; `m` marks
+  // an N-lane multi-value result whose lanes interop/the adapter decode element-wise. Pure-
+  // numeric single-result exports emit no entry. A bigint result is i64 but unmarked (the BigInt
+  // is the value). Written under every JS-visible alias, like jz:extparam. Each shape is built as
+  // a direct literal (no spread) — the self-host kernel's fixed schemas don't enumerate post-hoc keys.
+  const i64Exports = []
+  for (const f of ctx.func.list) {
+    if (!isExported(f) || !isBoundaryWrapped(f) || !f._exportI64) continue
+    const { p, r, m } = f._exportI64
+    for (const exportName of exportNamesOf(f.name))
+      i64Exports.push(m ? { name: exportName, p, m } : r ? { name: exportName, p, r } : { name: exportName, p })
+  }
+  if (i64Exports.length)
+    sec.customs.push(['@custom', '"jz:i64exp"', `"${JSON.stringify(i64Exports).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`])
+
   // Named export aliases: export { name } or export { source as alias }
   for (const [name, val] of Object.entries(ctx.func.exports)) {
     if (wasiCommandExports.has(name)) continue
@@ -1564,7 +1978,8 @@ export default function compile(ast, profiler) {
   const { callCount } = treeshake(
     [{ arr: sec.stdlib }, { arr: sec.funcs }, { arr: sec.start }],
     [...sec.start, ...sec.elem, ...sec.customs, ...sec.extStdlib, ...sec.imports, ...sec.tags],
-    { removeDead: !optCfg || optCfg.treeshake !== false, globals: sec.globals }
+    { removeDead: !optCfg || optCfg.treeshake !== false, globals: sec.globals, userGlobals: ctx.scope.userGlobals,
+      userFuncs: new Set(ctx.func.list.map(f => `$${f.name}`)) }
   )
 
   pruneUnusedThrowRuntime(sec)