jz 0.6.0 → 0.8.0

package/src/compile/plan/scope.js

@@ -44,62 +44,138 @@ import { invalidateProgramFactsCache } from '../program-facts.js'
 // mixed ctors) clears the candidacy, keeping the read site polymorphic.
 export const inferModuleLetTypes = (ast) => {
   if (!ctx.scope.userGlobals) return
-  // candidates: name → { ctor: string|null, valid: true } | { valid: false }
-  // valid=true with ctor=null means "still no positive evidence"; we promote
-  // only when ctor is non-null at the end. Assignments to nullish (undef/null)
-  // don't change ctor — they're consistent with any typed-array value.
-  // Per-candidate state in PARALLEL maps, not a shared mutable `{ctor, valid}` object
-  // per name: `ctorOf` holds the positive ctor evidence (name absent ⇒ not a candidate),
-  // `invalid` the demoted names. A prior shape stored one mutable object per name in a
-  // Map; under self-host those per-name objects aliased (every candidate ended up sharing
-  // one record), so a second global of a different kind invalidated the typed one and any
-  // two-global program lost its typed-array fast path. String/Set values can't alias.
-  const ctorOf = new Map()
-  const invalid = new Set()
-  for (const name of ctx.scope.userGlobals) ctorOf.set(name, null)
+  // Build an assignment/alias graph over EVERY `=`/`let`/`const` binding in the
+  // program (globals and locals alike), then resolve each global's typed-array
+  // ctor by least-fixed-point. A single forward pass can't see the double-buffer
+  // swap idiom — `let tmp = a; a = b; b = tmp` assigns `a` from `b` and `b` from
+  // a local `tmp` that aliases `a`, so neither ref resolves until its sibling is
+  // already known. The fixpoint closes that cycle: `a`/`b` each anchor on their
+  // `new Float64Array(...)` decl, the alias edges carry the ctor around the loop,
+  // and they promote to VAL.TYPED. Without it the swap poisoned both globals and
+  // every `a[i]` read forked __str_idx/__typed_idx, every `+` forked __str_concat.
+  //
+  // Lattice (per name): null (no evidence) < ctor < MIXED. `bad` evidence (a non-
+  // typed, non-alias RHS — number, string, call, arithmetic, compound-assign) jumps
+  // straight to MIXED; conflicting ctors join to MIXED. We promote a global only
+  // when its fixed point is a single concrete ctor — sound: every assignment then
+  // provably yields that typed-array kind or nullish.
+  const MIXED = MIXED_CTORS
+  const defs = new Map()  // name → { ctors:Set<string>, refs:Set<string>, bad:bool }
+  const getDef = (name) => {
+    let d = defs.get(name)
+    if (!d) defs.set(name, d = { ctors: new Set(), refs: new Set(), bad: false })
+    return d
+  }
 
   const isNullishLit = (e) => e == null || e === 'undefined' || e === 'null'
     || (Array.isArray(e) && e[0] == null && (e[1] === undefined || e[1] === null))
 
-  const observe = (name, rhs) => {
-    if (!ctorOf.has(name) || invalid.has(name)) return
+  // User-function names — a call to one is an alias edge to its return value
+  // (virtual node `@ret:<fn>`, populated from each `return`). Lets a global
+  // assigned `a = makeBuffer(n)` inherit makeBuffer's typed-array ctor without
+  // relying on the call being inlined (locals get it via inlining; globals,
+  // typed before inlining runs, did not). `@`/`:` can't occur in a JS identifier,
+  // so the virtual key never collides with a real binding.
+  const fnames = new Set()
+  for (const f of ctx.func.list) if (f.body && !f.raw && typeof f.name === 'string') fnames.add(f.name)
+  // Typed-array methods that preserve the receiver's element ctor: `.subarray`
+  // and `.slice` (same-kind view/copy), `.map` (same-kind, per propagateTyped).
+  const CTOR_PRESERVING = new Set(['subarray', 'slice', 'map'])
+
+  // Record one assignment `name = rhs` as evidence. Nullish contributes nothing
+  // (consistent with any typed-array value); a bare identifier, a ctor-preserving
+  // method on a name, or a call to a user function are alias edges; anything else
+  // that isn't a typed ctor poisons the name.
+  // Scope-qualified binding key. A module global is ONE node program-wide (bare
+  // name); a function-local is unique to its scope `sid`. Keying locals by bare
+  // name made a numeric counter `let s = 0` in one function poison a typed
+  // swap-temp `let s = a` in another — cascading MIXED into the double-buffer
+  // globals so every `a[i]` fell back to runtime __str_idx/__typed_idx dispatch
+  // (lbm: 3.9× slower than JS). `@ret:` virtual nodes stay bare (module-wide
+  // return-value anchors).
+  const key = (name, sid) => name[0] === '@' || ctx.scope.userGlobals.has(name) ? name : sid + '\x00' + name
+
+  const observe = (name, rhs, sid) => {
+    const d = getDef(key(name, sid))
     if (isNullishLit(rhs)) return
-    // Resolve typed-array ctor from `new TypedArrayCtor(...)`, ternary of typed,
-    // or a reference to a name we already know is typed.
-    let ctor = typedElemCtor(rhs) ?? ternaryCtorOfRhs(rhs)
-    if (ctor === MIXED_CTORS) { invalid.add(name); return }
-    if (!ctor && typeof rhs === 'string') {
-      if (ctx.scope.globalValTypes?.get(rhs) === VAL.TYPED)
-        ctor = ctx.scope.globalTypedElem?.get(rhs) ?? null
+    const ctor = typedElemCtor(rhs) ?? ternaryCtorOfRhs(rhs)
+    if (ctor === MIXED) { d.bad = true; return }
+    if (ctor) { d.ctors.add(ctor); return }
+    if (typeof rhs === 'string') { d.refs.add(key(rhs, sid)); return }
+    if (Array.isArray(rhs) && rhs[0] === '()') {
+      const callee = rhs[1]
+      // `recv.subarray(...)` / `recv.slice(...)` / `recv.map(...)` → inherit recv's ctor.
+      if (Array.isArray(callee) && callee[0] === '.' && typeof callee[1] === 'string'
+        && CTOR_PRESERVING.has(callee[2])) { d.refs.add(key(callee[1], sid)); return }
+      // `fn(...)` to a user function → inherit its return ctor.
+      if (typeof callee === 'string' && fnames.has(callee)) { d.refs.add('@ret:' + callee); return }
     }
-    if (!ctor) { invalid.add(name); return }
-    const prev = ctorOf.get(name)
-    if (prev && prev !== ctor) { invalid.add(name); return }
-    ctorOf.set(name, ctor)
+    d.bad = true
   }
 
-  const walk = (node) => {
+  // Scope-aware walk. Every `=>` opens a fresh scope so same-named locals across
+  // functions (and sibling closures) stay distinct. A function bound to a name
+  // descends in a name-stable scope (`fn\0name`) so the ast descent and the
+  // func.list sweep below visit it identically (idempotent), and so `return`
+  // exprs anchor on `@ret:name`.
+  let sidc = 0
+  const walk = (node, sid, retFn) => {
     if (!Array.isArray(node)) return
     const op = node[0]
-    if (op === '=' && typeof node[1] === 'string' && ctorOf.has(node[1])) observe(node[1], node[2])
+    if (op === '=>') { walk(node[2], 's' + (++sidc), null); return }
+    if (op === 'return' && retFn != null) observe('@ret:' + retFn, node[1], sid)
+    const assign = (name, rhs) => {
+      if (Array.isArray(rhs) && rhs[0] === '=>') { observe(name, rhs, sid); enterFn(rhs[2], name); return }
+      observe(name, rhs, sid); walk(rhs, sid, retFn)
+    }
+    if (op === '=' && typeof node[1] === 'string') return assign(node[1], node[2])
     if ((op === 'let' || op === 'const') && node.length > 1) {
       for (let i = 1; i < node.length; i++) {
         const d = node[i]
-        if (Array.isArray(d) && d[0] === '=' && typeof d[1] === 'string' && ctorOf.has(d[1]))
-          observe(d[1], d[2])
+        if (Array.isArray(d) && d[0] === '=' && typeof d[1] === 'string') assign(d[1], d[2])
+        else walk(d, sid, retFn)
       }
+      return
+    }
+    // Compound-assigns (`+=`, `++`, …) can't preserve a typed-array kind — poison.
+    if (ASSIGN_OPS.has(op) && typeof node[1] === 'string') { getDef(key(node[1], sid)).bad = true; walk(node[2], sid, retFn); return }
+    for (let i = 1; i < node.length; i++) walk(node[i], sid, retFn)
+  }
+  // Descend into a function body anchored on `@ret:fn`. An arrow expr-body IS the
+  // implicit return (`(n) => new Float64Array(n)`); a `{}` block uses explicit
+  // `return` nodes (captured in walk). Without the implicit-return capture, a
+  // global assigned `a = mk(n)` from an expr-body fn never inherited mk's ctor.
+  const enterFn = (body, fn) => {
+    if (Array.isArray(body) && body[0] !== '{}') observe('@ret:' + fn, body, 'fn\x00' + fn)
+    walk(body, 'fn\x00' + fn, fn)
+  }
+  walk(ast, 'mod', null)
+  // Defensive sweep: cover any func.list body not reachable by descent from `ast`
+  // (hoisted / submodule). Name-stable scope keeps it idempotent with the descent.
+  for (const f of ctx.func.list) if (f.body && !f.raw) enterFn(f.body, f.name)
+
+  // Least-fixed-point over the alias graph. join: null is bottom, MIXED is top.
+  const join = (a, b) => a === MIXED || b === MIXED ? MIXED : a == null ? b : b == null ? a : a === b ? a : MIXED
+  const state = new Map()  // name → null | ctor | MIXED
+  // A ref to a name with no tracked defs resolves via an already-known typed
+  // global (const typed array / earlier-recorded rep); otherwise it's opaque → MIXED.
+  const refState = (r) => defs.has(r) ? (state.get(r) ?? null)
+    : ctx.scope.globalValTypes?.get(r) === VAL.TYPED ? (ctx.scope.globalTypedElem?.get(r) ?? MIXED)
+    : MIXED
+  let changed = true
+  while (changed) {
+    changed = false
+    for (const [name, d] of defs) {
+      let cur = d.bad ? MIXED : null
+      if (cur !== MIXED) for (const c of d.ctors) cur = join(cur, c)
+      if (cur !== MIXED) for (const r of d.refs) cur = join(cur, refState(r))
+      if (cur !== (state.get(name) ?? null)) { state.set(name, cur); changed = true }
     }
-    // Compound-assigns (`+=`, etc.) to a typed-array binding can't preserve
-    // the typed-array kind — invalidate.
-    if (ASSIGN_OPS.has(op) && op !== '=' && typeof node[1] === 'string' && ctorOf.has(node[1]))
-      invalid.add(node[1])
-    for (let i = 1; i < node.length; i++) walk(node[i])
   }
-  walk(ast)
-  for (const f of ctx.func.list) if (f.body && !f.raw) walk(f.body)
 
-  for (const [name, ctor] of ctorOf) {
-    if (invalid.has(name) || !ctor) continue
+  for (const name of ctx.scope.userGlobals) {
+    const ctor = state.get(name)
+    if (!ctor || ctor === MIXED) continue
     if (ctx.scope.globalValTypes?.get(name) === VAL.TYPED) continue
     ;(ctx.scope.globalValTypes ||= new Map()).set(name, VAL.TYPED)
     ;(ctx.scope.globalTypedElem ||= new Map()).set(name, ctor)

package/src/compile/program-facts.js

@@ -23,6 +23,24 @@ export function observeNodeFacts(node, f) {
   if (PROP_WRITE_OPS.has(op) && Array.isArray(args[0]) &&
       (args[0][0] === '.' || args[0][0] === '?.') && typeof args[0][2] === 'string')
     f.writtenProps.add(args[0][2])
+  // Computed-key WRITES (`o[k]=v`, `o[k]+=v`, `o[k]++`) are the ONLY operations
+  // that add ENUMERABLE keys beyond the static schema — computed reads and dot-adds
+  // (`o.b=2`) do not enumerate in jz. Tracked separately from `dynVars` (which also
+  // counts reads) so for-in / Object.keys key pooling can trust the static schema
+  // for a receiver that is only computed-READ. (`isLiteralStr` excludes literal
+  // string keys, which place in fixed schema slots.)
+  if (PROP_WRITE_OPS.has(op) && Array.isArray(args[0]) && args[0][0] === '[]') {
+    const [, wobj, widx] = args[0]
+    // Flag the ROOT array var. `o[k]=v` → o; a NESTED write `o[i][j]=v` mutates an
+    // element of o, so walk the receiver chain to its root identifier and flag that
+    // too — else o's recorded (nested) element types would be wrongly trusted at a
+    // later `o[i][j]` read. Strictly more conservative for every dynWriteVars consumer.
+    if (!isLiteralStr(widx)) {
+      let root = wobj
+      while (Array.isArray(root) && root[0] === '[]') root = root[1]
+      if (typeof root === 'string') f.dynWriteVars?.add(root)
+    }
+  }
   if (op === '[]') {
     const [obj, idx] = args
     if (!isLiteralStr(idx)) { f.anyDyn = true; if (typeof obj === 'string') f.dynVars.add(obj) }
@@ -68,7 +86,7 @@ export function invalidateProgramFactsCache(...roots) {
 
 function emptyWalkFacts() {
   return {
-    dynVars: new Set(), anyDyn: false, hasSchemaLiterals: false,
+    dynVars: new Set(), dynWriteVars: new Set(), anyDyn: false, hasSchemaLiterals: false,
     maxDef: 0, maxCall: 0, hasRest: false, hasSpread: false,
     propMap: new Map(), valueUsed: new Set(), callSites: [],
     writtenProps: new Set(),
@@ -78,6 +96,7 @@ function emptyWalkFacts() {
 function mergeWalkFacts(into, from) {
   if (from.anyDyn) into.anyDyn = true
   for (const v of from.dynVars) into.dynVars.add(v)
+  for (const v of from.dynWriteVars) into.dynWriteVars.add(v)
   if (from.hasSchemaLiterals) into.hasSchemaLiterals = true
   if (from.maxDef > into.maxDef) into.maxDef = from.maxDef
   if (from.maxCall > into.maxCall) into.maxCall = from.maxCall
@@ -234,7 +253,7 @@ export function collectProgramFacts(ast) {
   // ctx — a mutated prop name anywhere disqualifies sharing a static instance.
   ctx.module.writtenProps = f.writtenProps
   return {
-    dynVars: f.dynVars, anyDyn: f.anyDyn, propMap, valueUsed, callSites,
+    dynVars: f.dynVars, dynWriteVars: f.dynWriteVars, anyDyn: f.anyDyn, propMap, valueUsed, callSites,
     maxDef: f.maxDef, maxCall: f.maxCall, hasRest: f.hasRest, hasSpread: f.hasSpread,
     paramReps, hasSchemaLiterals: f.hasSchemaLiterals, writtenProps: f.writtenProps,
   }

package/src/ctx.js

@@ -8,7 +8,7 @@
  */
 
 import { makeAbi } from './abi/index.js'
-export { HEAP, LAYOUT, PTR, ATOM, nanPrefixHex, atomNanHex, ssoBitI64Hex, sliceBitI64Hex, ptrNanHex, ptrBoxPrefixBigInt, encodePtrHi, decodePtrType, decodePtrAux, ATOM_HI, oobNanLiteral, oobNanIR, followForwardingWat } from '../layout.js'
+export { HEAP, LAYOUT, PTR, ATOM, FORWARDING_MASK, nanPrefixHex, atomNanHex, ssoBitI64Hex, sliceBitI64Hex, ptrNanHex, ptrBoxPrefixBigInt, encodePtrHi, decodePtrType, decodePtrAux, ATOM_HI, oobNanLiteral, oobNanIR, followForwardingWat } from '../layout.js'
 
 // === Carrier layout ===
 // Canonical bit layout lives in layout.js (compiler-free). Re-exported above for
@@ -38,11 +38,11 @@ export { HEAP, LAYOUT, PTR, ATOM, nanPrefixHex, atomNanHex, ssoBitI64Hex, sliceB
 // |-----------|----------|---------------------------------|---------------------------|
 // | core      | compile  | reset, modules, inc(), emit*    | emit, compile, modules    |
 // | module    | compile  | prepare, index.js               | prepare, compile, emit    |
-// | scope     | compile  | analyze, compile, plan, modules | compile, emit             |
-// | func      | function | compile, narrow                 | emit, modules             |
+// | scope     | compile  | analyze, compile, plan, modules, assemble | compile, emit   |
+// | func      | function | compile, narrow, assemble       | emit, modules             |
 // | types     | function | analyze, plan                   | emit, modules             |
 // | schema    | compile  | prepare, analyze, compile       | prepare, analyze, emit    |
-// | closure   | init     | modules (fn plugin)             | emit, compile             |
+// | closure   | init     | modules (fn plugin), plan, emit | emit, compile             |
 // | runtime   | compile  | emit, modules                   | emit, compile             |
 // | memory    | compile  | index.js                        | compile                   |
 // | error     | compile  | prepare, compile, emit          | err()                     |
@@ -63,6 +63,11 @@ export { HEAP, LAYOUT, PTR, ATOM, nanPrefixHex, atomNanHex, ssoBitI64Hex, sliceB
 // narrow-phase writers: narrowSignatures (under plan) temporarily swaps
 //   ctx.func.{localReps, locals, current} per-function with save/restore
 //   so per-call-site signature inference sees the right scope.
+// assemble-phase writers: buildStartFn (wat/assemble.js) re-owns the ctx.func frame
+//   (locals/stack/refinements/…) to emit the module-init `start` fn, save/restoring
+//   around it; the data pass also const-folds ctx.scope.globals (mut→false) and
+//   declares the __heap* globals. emit seeds ctx.closure.{paramTypes,paramTypedCtors}
+//   at direct-call sites (read by emitClosureBody); plan sets ctx.closure.{floor,width}.
 export const ctx = {
   core: {},       // emitter table + stdlib registry (seeded by reset + modules)
   module: {},     // module graph: imports, resolved sources, module-init blocks
@@ -92,9 +97,14 @@ export const ctx = {
                   // the defaults; see reset() for the field list and who flips each.
 }
 
-/** Create a child scope via shallow flat copy (metacircular-safe: no prototype chain).
+/** Create a child scope via shallow flat copy with NO prototype chain. Critical:
+ *  `{ ...parent }` would inherit Object.prototype in V8 (jz.js), so a name-keyed lookup
+ *  like `chain['valueOf']`/`emit['toString']` returns the inherited method instead of
+ *  undefined — corrupting resolution of any identifier named like an Object method. The
+ *  kernel's jz objects are already prototype-less, so this was a jz.js-ONLY footgun. A
+ *  prototype-less dict (Object.create(null) + assign) is correct in both engines.
  *  Mutations to the child do not affect the parent; lookups work via direct property access. */
-export const derive = (parent) => ({ ...parent })
+export const derive = (parent) => Object.assign(Object.create(null), parent)
 
 /** Include stdlib names for emission. */
 export const inc = (...names) => names.forEach(n => ctx.core.includes.add(n))
@@ -133,29 +143,63 @@ export const emitter = (deps, fn) => {
  *  carry it as `.argc`; bare ones expose it as the function's own `.length`. */
 export const emitArity = (h) => h?.argc ?? h?.length
 
-/** Tag an emit handler as a property getter — it yields a value when the
- *  property is *read* (`re.source`, `m.size`), so the `.`-read path may fire it.
- *  Untagged handlers are methods: a bare read of `m.values` must not invoke them
- *  (that would materialize a view instead of reading the `"values"` property);
- *  they fire only from the method-call path. Apply outermost: `getter(emitter(…))`. */
-export const getter = (fn) => (fn.getter = true, fn)
+/** Register `fn` as a property-GETTER emitter for `key` — it yields a value when
+ *  the property is *read* (`re.source`, `m.size`, `a.byteOffset`), so the `.`-read
+ *  path fires it. (Untagged `ctx.core.emit` handlers are methods: a bare read of
+ *  `m.values` must NOT invoke them — that would materialize a view — they fire only
+ *  from the method-call path.) Getter-ness lives in `ctx.core.getters` (a plain Set),
+ *  NOT as a flag on the emitter closure: the self-host kernel can't reliably read a
+ *  dynamic property off a closure returned via a dynamic-key lookup, so a closure tag
+ *  silently read `undefined` and every getter fell through to `__dyn_get`. A Set
+ *  key-lookup is kernel-safe. Dispatch (module/core.js) checks `ctx.core.getters.has(key)`. */
+export const registerGetter = (key, fn) => {
+  ctx.core.emit[key] = fn
+  ctx.core.getters.add(key)
+}
 
 /** Expand ctx.core.includes transitively via ctx.core.stdlibDeps. Call before WASM assembly.
  *  Each module co-locates its own deps with its stdlib registrations at init time. */
 export function resolveIncludes() {
   const graph = ctx.core.stdlibDeps
+  const stdlib = ctx.core.stdlib
+  // Auto-derived deps: a stdlib template that calls `$__foo` (a registered stdlib
+  // func) depends on it, whether or not the hand-maintained `deps()` list says so.
+  // Scanning the *realized* template keeps the graph honest, so a missing manual
+  // entry can't silently drop a transitively-needed helper (the bug class the old
+  // blanket `inc('__mkptr','__alloc')` masked). Factory templates are realized
+  // (called) so feature-gated branches — `${hasExt ? '(call $__ext_prop …)' : ''}`
+  // — resolve before scanning; reading raw source would over-pull the dead branch.
+  // jz's templates are pure string builders, so realizing here (and again at
+  // emission) is side-effect-free. A `$__foo` naming a global (not a stdlib func)
+  // is skipped. Realization can fail if called before its inputs are ready — then
+  // we return nothing *without caching*, so a later pass retries. Memoized per compile.
+  const autoCache = ctx.core._autoDeps ??= new Map()
+  const autoDepsOf = (name) => {
+    let found = autoCache.get(name)
+    if (found !== undefined) return found
+    const v = stdlib[name]
+    let text
+    if (typeof v === 'string') text = v
+    else if (typeof v === 'function') { try { text = v() } catch { return [] } }
+    if (typeof text !== 'string') return (autoCache.set(name, []), [])
+    found = []
+    const seen = new Set()
+    for (const m of text.matchAll(/\$(__[A-Za-z0-9_]+)/g)) {
+      const d = m[1]
+      if (d !== name && stdlib[d] && !seen.has(d)) { seen.add(d); found.push(d) }
+    }
+    autoCache.set(name, found)
+    return found
+  }
   let changed = true
   while (changed) {
     changed = false
     for (const name of [...ctx.core.includes]) {
       const entry = graph[name]
       const deps = typeof entry === 'function' ? entry() : entry
-      if (deps) for (const dep of deps) {
-        if (!ctx.core.includes.has(dep)) {
-          ctx.core.includes.add(dep)
-          changed = true
-        }
-      }
+      const add = (dep) => { if (!ctx.core.includes.has(dep)) { ctx.core.includes.add(dep); changed = true } }
+      if (deps) for (const dep of deps) add(dep)
+      for (const dep of autoDepsOf(name)) add(dep)
     }
   }
 }
@@ -180,6 +224,13 @@ export function reset(proto, globals, bridge) {
                             // `(import "env" "name" (global $name i64))` at assembly. Same
                             // usage-gated pattern as jsstring — emit records, assembly owns
                             // the ctx.module.imports write.
+    getters: new Set(), // keys of emit entries that are property getters — the
+                        // kernel-safe authority for getter dispatch (a closure-attached
+                        // flag was unreadable in the self-host kernel after a dynamic-key
+                        // lookup, so every getter silently fell through to __dyn_get).
+                        // MUST remain last: adding fields before stdlib/stdlibDeps/… shifts
+                        // their slot indices and breaks the self-host compiled kernel's reads.
+                        // Populated by registerGetter(); checked by module/core.js dispatch.
   }
 
 
@@ -207,6 +258,10 @@ export function reset(proto, globals, bridge) {
     globalTypedElem: null,
     globalReps: null, // Map<name, ValueRep> — module-level pointer reps (TYPED const globals stored as raw i32 offset, etc.)
     consts: null,
+    constInts: null,      // Map<name, int> — module const folded to an integer literal (prepare/plan seed; static/ir read)
+    constStrs: null,      // Map<name, string> — module const folded to a string literal
+    shapeStrs: null,      // Map<expr, string> / shapeStrArrays: Map<name, string[]> — schema-shape string folds
+    shapeStrArrays: null,
   }
 
   ctx.func = {
@@ -214,7 +269,7 @@ export function reset(proto, globals, bridge) {
     names: new Set(),  // Set<string> — known func names (list + imported funcs); populated at compile() start
     map: new Map(),    // Map<string, func> — name → func entry; populated at compile() start
     multiProp: new Set(),  // Set<"obj.prop"> — function-properties assigned >1× (wrapper composition); suppresses the static fn.prop() direct call
-    exports: {},
+    exports: Object.create(null),  // name-keyed: prototype-less (see derive) — `export let valueOf` must not hit Object.prototype
     current: null,
     locals: new Map(),
     localReps: null,
@@ -241,6 +296,7 @@ export function reset(proto, globals, bridge) {
   ctx.types = {
     typedElem: null,
     dynKeyVars: null,
+    dynWriteVars: null,
     anyDynKey: false,
   }
 
@@ -296,6 +352,8 @@ export function reset(proto, globals, bridge) {
     minArgc: null,        // Map<closureBodyName, number> — fewest args any direct call passed.
                           // A slot at index ≥ minArgc is omitted by some call (→ may be undefined),
                           // so it must NOT be typed NUMBER, else `x === undefined` mis-folds to false.
+    floor: null,          // min closure-table arity (modules: fn/timer/typedarray/array; read in plan). null ⇒ 0.
+    width: null,          // closure call/make signature width (plan/scope sets; emit/assemble read). null ⇒ MAX_CLOSURE_ARITY.
   }
 
   ctx.runtime = {
@@ -316,6 +374,7 @@ export function reset(proto, globals, bridge) {
   ctx.memory = {
     shared: false,
     pages: 0,
+    max: 0,         // 0 = unbounded; >0 emits a maximum on the memory type (cap growth)
   }
 
   ctx.error = {
@@ -341,6 +400,15 @@ export function reset(proto, globals, bridge) {
     inspect: false,     // when true, compile() additionally populates ctx.inspect with the inferred
                         // per-function signatures, locals, and JSON shapes — readable by editor
                         // hosts for inlay hints / hover types without re-running the analyzer.
+    helperCounters: false, // internal profiling mode: export mutable i64 counters for selected
+                           // runtime helpers and instrument their entry blocks. Build-time opt-in
+                           // only; normal output is byte-identical and pays no counter cost.
+    helperCallsites: false, // profiling-only: export mutable i64 counters for selected runtime
+                            // helper callsites after optimization, so hot helpers can be traced
+                            // back to the compiled function that calls them.
+    loopXformId: 0,     // monotonic id for the per-function loop transforms' generated locals
+                        // (loop-model freshLoopId). Per-compile (reset here), not a module-global —
+                        // so compile(P) is deterministic regardless of prior compiles in the process.
   }
 
   // Inspection sink. Populated by compile() only when transform.inspect is true.
@@ -440,6 +508,15 @@ export function warn(code, message, meta = {}, loc = null) {
   ctx.warnings.sink.entries.push(entry)
 }
 
+/** Advise that an emit site fell back to generic runtime dispatch (the slow,
+ *  un-inferred path). Called from the actual emission point so it fires only when
+ *  inference/optimization truly couldn't fold it — never a false positive on a
+ *  case that vectorized/unrolled/slot-folded. `ctx.error.loc` is the current AST
+ *  node's byte offset (kept up to date by the emit walk), giving line/column. */
+export function warnDeopt(code, message) {
+  warn(code, message, { fn: ctx.func.current?.name }, ctx.error.loc)
+}
+
 /** Throw with source location context. */
 export function err(msg, cause) {
   let detail = msg

package/src/helper-counters.js

@@ -0,0 +1,137 @@
+import { ctx, declGlobal, inc } from './ctx.js'
+import { findBodyStart } from './ir.js'
+
+export const HELPER_COUNTERS = [
+  ['__eq', 'eq'],
+  ['__same_value_zero', 'same_value_zero'],
+  ['__is_truthy', 'is_truthy'],
+  ['__ptr_type', 'ptr_type'],
+  ['__ptr_offset', 'ptr_offset'],
+  ['__len', 'len'],
+  ['__length', 'length'],
+  ['__typed_idx', 'typed_idx'],
+  ['__str_len', 'str_len'],
+  ['__str_eq', 'str_eq'],
+  ['__str_eq_cold', 'str_eq_cold'],
+  ['__str_hash', 'str_hash'],
+  ['__map_hash', 'map_hash'],
+  ['__hash_get_local', 'hash_get_local'],
+  ['__hash_set_local', 'hash_set_local'],
+  ['__ihash_get_local', 'ihash_get_local'],
+  ['__ihash_set_local', 'ihash_set_local'],
+  ['__dyn_get', 'dyn_get'],
+  ['__dyn_get_t', 'dyn_get_t'],
+  ['__dyn_get_t_h', 'dyn_get_t_h'],
+  ['__dyn_set', 'dyn_set'],
+  ['__arr_grow', 'arr_grow'],
+  ['__arr_grow_known', 'arr_grow_known'],
+  ['__arr_push1', 'arr_push1'],
+  ['__arr_shift', 'arr_shift'],
+  ['__alloc', 'alloc'],
+  ['__alloc_hdr', 'alloc_hdr'],
+  ['__alloc_hdr_n', 'alloc_hdr_n'],
+  ['__memgrow', 'memgrow'],
+]
+
+const COUNTER_BY_HELPER = new Map(HELPER_COUNTERS.map(([helper, label]) => [helper, `__hc_${label}`]))
+const LABEL_BY_WAT_HELPER = new Map(HELPER_COUNTERS.map(([helper, label]) => [`$${helper}`, label]))
+
+export const HELPER_SITE_PREFIX = '__hcs_'
+
+export const helperCounterName = helper => COUNTER_BY_HELPER.get(helper)
+
+export function installHelperCounters() {
+  if (!ctx.transform.helperCounters) return
+  for (const counter of COUNTER_BY_HELPER.values()) {
+    if (!ctx.scope.globals.has(counter)) declGlobal(counter, 'i64', 0, { export: counter })
+  }
+  ctx.core.stdlib.__helper_counts_reset = `(func $__helper_counts_reset (export "__helper_counts_reset")
+${[...COUNTER_BY_HELPER.values()].map(counter => `    (global.set $${counter} (i64.const 0))`).join('\n')})`
+  inc('__helper_counts_reset')
+}
+
+// Bump the helper's counter once on entry. NOTE the semantics: this counts FUNCTION
+// ENTRIES at runtime — a call site that jz inlined or specialized away (fusedRewrite,
+// specializeMkptr/specializePtrBase, …) never enters the function and is NOT counted. So
+// the numbers are a relative ranking / lower bound for picking hot helpers, not exact
+// operation counts. Good enough to choose targets; don't read them as call totals.
+export function instrumentHelperCounter(helper, fn) {
+  const counter = ctx.transform.helperCounters && helperCounterName(helper)
+  if (!counter || !Array.isArray(fn) || fn[0] !== 'func') return fn
+  fn.splice(findBodyStart(fn), 0,
+    ['global.set', `$${counter}`, ['i64.add', ['global.get', `$${counter}`], ['i64.const', 1]]])
+  return fn
+}
+
+const safeExportPart = name => String(name || 'anon')
+  .replace(/^\$/, '')
+  .replace(/[^A-Za-z0-9_.-]+/g, '_')
+  .slice(0, 80) || 'anon'
+
+const helperSiteFilter = () => {
+  const opt = ctx.transform.helperCallsites
+  if (opt === true) return null
+  const raw = Array.isArray(opt) ? opt : String(opt || '').split(',')
+  const labels = raw.map(s => String(s).trim()).filter(Boolean).map(s => s.replace(/^\$?__/, ''))
+  return labels.length ? new Set(labels) : null
+}
+
+const funcResults = fn => {
+  const out = []
+  if (!Array.isArray(fn) || fn[0] !== 'func') return out
+  for (let i = 2; i < fn.length; i++) {
+    const n = fn[i]
+    if (Array.isArray(n) && n[0] === 'result') out.push(...n.slice(1))
+  }
+  return out
+}
+
+const bumpCounter = counter =>
+  ['global.set', `$${counter}`, ['i64.add', ['global.get', `$${counter}`], ['i64.const', 1]]]
+
+// Profiling-only helper-callsite counters. Unlike instrumentHelperCounter(), this
+// answers "which compiled function executed the helper call?" by wrapping each
+// final `(call $__helper ...)` with a tiny counter block:
+//   (block (result T) (global.set $__hcs_N ...) (call $__helper ...))
+//
+// This intentionally runs after whole-module optimization. The profile should
+// observe final codegen, while production output remains byte-identical because
+// ctx.transform.helperCallsites is build-time opt-in.
+export function instrumentHelperCallsites(funcs) {
+  if (!ctx.transform.helperCallsites) return 0
+  const only = helperSiteFilter()
+
+  const resultsByName = new Map()
+  for (const fn of funcs) {
+    if (Array.isArray(fn) && fn[0] === 'func' && typeof fn[1] === 'string')
+      resultsByName.set(fn[1], funcResults(fn))
+  }
+
+  let id = 0
+  const wrap = (node, owner) => {
+    if (!Array.isArray(node)) return node
+    for (let i = 1; i < node.length; i++) node[i] = wrap(node[i], owner)
+
+    if (node[0] !== 'call' || typeof node[1] !== 'string') return node
+    const label = LABEL_BY_WAT_HELPER.get(node[1])
+    if (!label) return node
+    if (only && !only.has(label) && !only.has(node[1].replace(/^\$?__/, ''))) return node
+    const results = resultsByName.get(node[1])
+    if (!results) return node
+
+    const counter = `${HELPER_SITE_PREFIX}${id++}`
+    const ownerPart = safeExportPart(owner)
+    declGlobal(counter, 'i64', 0, { export: `${counter}:${label}:${ownerPart}` })
+    const block = ['block']
+    for (const type of results) block.push(['result', type])
+    block.push(bumpCounter(counter), node)
+    return block
+  }
+
+  for (const fn of funcs) {
+    if (!Array.isArray(fn) || fn[0] !== 'func' || typeof fn[1] !== 'string') continue
+    const bodyStart = findBodyStart(fn)
+    for (let i = bodyStart; i < fn.length; i++) fn[i] = wrap(fn[i], fn[1])
+  }
+  return id
+}