jz 0.6.0 → 0.8.0

package/src/ir.js

@@ -21,8 +21,8 @@
  */
 
 import { ctx, err, inc, PTR, LAYOUT } from './ctx.js'
-import { ptrBoxPrefixBigInt, atomNanHex, nanPrefixHex } from '../layout.js'
-import { I32_MIN, I32_MAX, isI32, isLiteralStr, isFuncRef } from './ast.js'
+import { ptrBoxPrefixBigInt, ptrBits, i64Hex, atomNanHex, nanPrefixHex } from '../layout.js'
+import { I32_MIN, I32_MAX, isI32, isLiteralStr, isFuncRef, isLeaf } from './ast.js'
 import { VAL, lookupValType, repOf, repOfGlobal } from './reps.js'
 import { valTypeOf } from './kind.js'
 import { T } from './ast.js'
@@ -55,6 +55,15 @@ function boxPtrIR(i32node, ptrType, aux = 0) {
  *  `(x >>> 0)` uint32 idiom converts to a positive f64 in [0, 2^32) instead of sign-flipping. */
 export const asF64 = n => {
   if (n == null) err(`compiler internal: expected emitted IR value in ${ctx.func.current?.name || '<module>'}, got empty value`)
+  // A v128 (SIMD) value can't be NaN-boxed into the uniform f64 closure ABI — there is no
+  // lossless f64 carrier for 128 bits. This is reached only at a closure boundary: a SIMD
+  // value captured by, passed to, returned from, or flowing through a `(…)=>…` used as a
+  // VALUE — most commonly an IIFE `(() => f32x4.…)()`, which jz lowers via the closure path.
+  // Without this guard the coercion emits `f64.convert_i32_s(<v128>)` and dies in the wasm
+  // validator with an opaque type error. Keep SIMD inside a NAMED top-level function called
+  // directly (`let sdf = (x) => f32x4.…; sdf(v)` lowers to a typed v128 `call`, no boxing),
+  // and extract scalars with `f64x2.lane` / `f32x4.lane` before crossing a closure boundary.
+  if (n.type === 'v128') err(`SIMD (v128) values can't cross a closure/IIFE boundary — closures use the uniform f64 ABI. Move the SIMD into a named top-level function called directly, or extract a lane (f64x2.lane / f32x4.lane) to an f64 first.`)
   if (n.ptrKind != null) return boxPtrIR(n, valKindToPtr(n.ptrKind), n.ptrAux || 0)
   if (n.type === 'f64') return n
   if (n.type === 'i64') {
@@ -97,6 +106,22 @@ export const asPtrOffset = (n, ptrKind) => {
 /** Coerce emitted IR to a target WASM param type ('i32' | 'i64' | 'f64'). */
 export const asParamType = (n, t) => t === 'i32' ? asI32(n) : t === 'i64' ? asI64(n) : t === 'v128' ? n : asF64(n)
 
+// Sound upper bound on the value of a masking expr (`&` / `>>>`), so a product
+// against it can be proven < 2^53 and narrow to i32.mul instead of the guarded f64
+// path. `& m` with a non-negative mask m clamps the result to [0, m] (regardless of
+// the other operand's sign); `>>> k` is logical, so it's ≤ 2^(32−k). Anything else
+// (signed shift, plain locals, negative mask) stays the full i32 range.
+export const maskBound = (x) => {
+  if (!Array.isArray(x)) return 2 ** 31
+  if (x[0] === 'i32.const') return x[1] >= 0 ? x[1] : 2 ** 31
+  if (x[0] === 'i32.and') return Math.min(maskBound(x[1]), maskBound(x[2]))
+  if (x[0] === 'i32.shr_u') {
+    const k = Array.isArray(x[2]) && x[2][0] === 'i32.const' ? (x[2][1] & 31) : 0
+    return k > 0 ? 2 ** (32 - k) : 2 ** 31
+  }
+  return 2 ** 31
+}
+
 /**
  * Narrow an f64 arithmetic tree under ToInt32 — the general int-accumulator path.
  *
@@ -157,6 +182,82 @@ const narrowI32 = (x, isRoot) => {
   return null
 }
 
+// Conservative VALUE-RANGE for a pure f64 expression tree: returns { lo, hi } bounding
+// every value the node can take, or null when unknown. SOUND by construction — each rule
+// over-approximates using the SAME f64 ops the runtime uses (f64 +/−/× are monotone in
+// each argument, so combining endpoint-bounds with plain JS doubles yields bounds that
+// contain the true value). A null/non-finite endpoint anywhere collapses to null, so a
+// non-null result also PROVES the value is finite (never NaN, never ±∞). Used by toI32 to
+// drop the +∞-guard `select` (and the i64 round-trip when the value fits i32) — the guard
+// exists only to remap +∞→0, so a proof of finiteness retires it.
+const fin = (lo, hi) => (Number.isFinite(lo) && Number.isFinite(hi) && lo <= hi) ? { lo, hi } : null
+// Range of the i32 that feeds an `f64.convert_i32_*`, refined by a narrowing load width.
+const convRange = (child, signed) => {
+  if (Array.isArray(child)) {
+    const o = child[0]
+    if (o === 'i32.load8_u') return { lo: 0, hi: 255 }
+    if (o === 'i32.load8_s') return { lo: -128, hi: 127 }
+    if (o === 'i32.load16_u') return { lo: 0, hi: 65535 }
+    if (o === 'i32.load16_s') return { lo: -32768, hi: 32767 }
+    if (o === 'i32.const' && typeof child[1] === 'number') return signed ? { lo: child[1] | 0, hi: child[1] | 0 } : { lo: child[1] >>> 0, hi: child[1] >>> 0 }
+  }
+  return signed ? { lo: I32_MIN, hi: I32_MAX } : { lo: 0, hi: 4294967295 }
+}
+// `get`, when supplied, resolves a `(local.get $V)` to $V's single defining value node
+// (a `name → defExpr | null` map/function built from a one-def-per-local scan). This lets the
+// range see through the temps that inlining introduces — e.g. `floor(mul(convert($px),0.03125))`
+// stashed in `$xi` before truncation — so the i32-fit proof survives the indirection. SOUND
+// without code motion: a single-textual-def local holds exactly the value its def computes, so
+// the def's range bounds every value the local can take, even if the def's inputs vary across
+// iterations. A self-referential (loop-carried) single def is caught by the `seen` cycle guard
+// and yields null (unknown), which is conservative.
+export const f64Range = (n, get) => {
+  const seen = get ? new Set() : null
+  const r = (n) => {
+    if (!Array.isArray(n)) return null
+    const op = n[0]
+    if (op === 'local.get' && get && typeof n[1] === 'string') {
+      if (seen.has(n[1])) return null               // loop-carried / cyclic def → unknown
+      const def = typeof get === 'function' ? get(n[1]) : get.get(n[1])
+      if (!def) return null
+      seen.add(n[1]); const rng = r(def); seen.delete(n[1])
+      return rng
+    }
+    if (op === 'f64.const') return typeof n[1] === 'number' ? fin(n[1], n[1]) : null   // `nan:…`/Inf literal strings → null
+    if (op === 'f64.convert_i32_s') return convRange(n[1], true)
+    if (op === 'f64.convert_i32_u') return convRange(n[1], false)
+    if (op === 'f64.neg') { const a = r(n[1]); return a && fin(-a.hi, -a.lo) }
+    if (op === 'f64.abs') { const a = r(n[1]); return a && fin(a.lo > 0 ? a.lo : a.hi < 0 ? -a.hi : 0, Math.max(-a.lo, a.hi)) }
+    if (op === 'f64.sqrt') { const a = r(n[1]); return a && a.lo >= 0 && fin(Math.sqrt(a.lo), Math.sqrt(a.hi)) }
+    // Rounding ops preserve finiteness and are monotonic, so the range maps elementwise. This lets
+    // `Math.floor(x)|0` over a bounded x (every grid/image/audio index: `px*scale`, perm[] lookups)
+    // drop the +∞-guard + i64 round-trip in toI32 down to a single i32.trunc_sat_f64_s. `nearest`
+    // (round-half-to-even) lands in {floor,ceil} so its bounds are floor(lo)..ceil(hi).
+    if (op === 'f64.floor') { const a = r(n[1]); return a && fin(Math.floor(a.lo), Math.floor(a.hi)) }
+    if (op === 'f64.ceil')  { const a = r(n[1]); return a && fin(Math.ceil(a.lo), Math.ceil(a.hi)) }
+    if (op === 'f64.trunc') { const a = r(n[1]); return a && fin(Math.trunc(a.lo), Math.trunc(a.hi)) }
+    if (op === 'f64.nearest') { const a = r(n[1]); return a && fin(Math.floor(a.lo), Math.ceil(a.hi)) }
+    if (op === 'f64.add') { const a = r(n[1]), b = r(n[2]); return a && b && fin(a.lo + b.lo, a.hi + b.hi) }
+    if (op === 'f64.sub') { const a = r(n[1]), b = r(n[2]); return a && b && fin(a.lo - b.hi, a.hi - b.lo) }
+    if (op === 'f64.mul') {
+      const a = r(n[1]), b = r(n[2]); if (!a || !b) return null
+      const p = [a.lo * b.lo, a.lo * b.hi, a.hi * b.lo, a.hi * b.hi]
+      return fin(Math.min(...p), Math.max(...p))
+    }
+    if (op === 'f64.div') {
+      const c = Array.isArray(n[2]) && n[2][0] === 'f64.const' && typeof n[2][1] === 'number' ? n[2][1] : null
+      if (c == null || c === 0) return null               // variable / zero divisor → may be ±∞
+      const a = r(n[1]); if (!a) return null
+      const p = [a.lo / c, a.hi / c]
+      return fin(Math.min(...p), Math.max(...p))
+    }
+    if (op === 'f64.min') { const a = r(n[1]), b = r(n[2]); return a && b && fin(Math.min(a.lo, b.lo), Math.min(a.hi, b.hi)) }
+    if (op === 'f64.max') { const a = r(n[1]), b = r(n[2]); return a && b && fin(Math.max(a.lo, b.lo), Math.max(a.hi, b.hi)) }
+    return null
+  }
+  return r(n)
+}
+
 /** Coerce node to i32 with wrapping (JS `|0` semantics: values > 2^31 wrap to negative).
  *  Per ECMAScript ToInt32, NaN and ±∞ map to 0. `i64.trunc_sat_f64_s` handles NaN
  *  and -∞ correctly, but +∞ saturates to i64_max which wraps to -1 — guard +∞ via
@@ -179,15 +280,27 @@ export const toI32 = n => {
   // computes in i32 (mod-2^32 ring) — no trunc/guard at all.
   const nw = narrowI32(n, true)
   if (nw) return nw.node
+  // Value-range narrowing: a NON-integer f64 tree (e.g. `10 + 200·(u8[i]/255)`) the ring
+  // path rejects, but whose value is PROVABLY FINITE — so the +∞-guard `select` is dead.
+  // When the value also provably fits i32, a single `i32.trunc_sat_f64_s` IS exact ToInt32
+  // (no saturation can fire in-range, no NaN, no ±∞) — dropping the i64 round-trip AND the
+  // guard. Pervasive in pixel/colour packing: `(base + scale·v)|0`.
+  const rng = f64Range(n)
+  if (rng) {
+    if (rng.lo >= I32_MIN && rng.hi <= I32_MAX) return typed(['i32.trunc_sat_f64_s', n], 'i32')
+    // Finite and within (−2^63, 2^63): keep the mod-2^32 wrap, drop the (now-dead) +∞ guard.
+    // i64.trunc_sat does not saturate in this window, so wrap_i64 == ToInt32. Beyond ±2^63 we
+    // fall through to the guarded path (which already saturates there — the documented boundary).
+    if (rng.lo >= -9223372036854775808 && rng.hi < 9223372036854775808)
+      return typed(['i32.wrap_i64', ['i64.trunc_sat_f64_s', n]], 'i32')
+  }
   // Leaf nodes are cheap to duplicate; for everything else, evaluate once via local.tee.
-  const isLeaf = Array.isArray(n) && n.length <= 2 &&
-    (n[0] === 'f64.const' || n[0] === 'local.get' || n[0] === 'global.get')
   // `i32.wrap_i64(i64.trunc_sat_f64_s x)` is exact ToInt32 for |x| < 2^63 (the
   // overwhelming common range), maps NaN/−∞→0, and +∞ is guarded to 0 by the
   // select. For |x| ≥ 2^63 it saturates rather than wrapping mod 2^32 — a
   // deliberately-allowed asm.js-style boundary (no per-`|0` helper/guard cost).
   const wrap = x => typed(['i32.wrap_i64', ['i64.trunc_sat_f64_s', x]], 'i32')
-  if (isLeaf) {
+  if (isLeaf(n)) {
     return typed(['select', wrap(n), ['i32.const', 0], ['f64.ne', n, ['f64.const', Infinity]]], 'i32')
   }
   const t = temp('inf')
@@ -292,13 +405,7 @@ export const BOXED_MUTATORS = new Set(['push', 'pop', 'shift', 'unshift', 'splic
 const litI32 = n => Array.isArray(n) && n[0] === 'i32.const' && typeof n[1] === 'number' ? n[1] : null
 
 /** Pack (type, aux, offset) into the f64 NaN-box bit pattern as a hex string. */
-function packPtrBits(type, aux, offset) {
-  const bits = LAYOUT.NAN_PREFIX_BITS
-    | ((BigInt(type) & BigInt(LAYOUT.TAG_MASK)) << BigInt(LAYOUT.TAG_SHIFT))
-    | ((BigInt(aux) & BigInt(LAYOUT.AUX_MASK)) << BigInt(LAYOUT.AUX_SHIFT))
-    | (BigInt(offset >>> 0) & BigInt(LAYOUT.OFFSET_MASK))
-  return '0x' + bits.toString(16).toUpperCase().padStart(16, '0')
-}
+const packPtrBits = (type, aux, offset) => i64Hex(ptrBits(type, aux, offset))
 
 /** Build `__mkptr(type, aux, offset)` IR. Folds to `(f64.const nan:0x...)` — 9 bytes
  *  vs 12 for `f64.reinterpret_i64 (i64.const ...)` — when all args are i32 literals.
@@ -359,7 +466,7 @@ export function ptrTypeIR(valIR, valType) {
 // op on it misdispatches; BigInt64Array/BigUint64Array views and
 // DataView.{get,set}BigUint64 are a legacy f64-value shim there. Strings are
 // tagged and survive every boundary; BigInt math happens only inside single
-// expressions. (Same contract as wat/optimize.js's i64 VALUE CONTRACT.)
+// expressions. (Same contract as watr/optimize's i64 VALUE CONTRACT.)
 const _F64_BITS_BUF = new ArrayBuffer(8)
 const _F64_BITS_F = new Float64Array(_F64_BITS_BUF)
 const _F64_BITS_U32 = new Uint32Array(_F64_BITS_BUF)  // LE halves: [0]=lo, [1]=hi
@@ -459,7 +566,7 @@ const PURE_F64_OPS = new Set([
  *  is correctly NOT numeric, while `cond ? n*2 : n*3` is. Conservative: any shape
  *  not provably numeric (property gets, user calls, local.get, f64.const nan:…)
  *  returns false, so the caller keeps the __to_num coercion. */
-const isNumericIR = (r) => {
+export const isNumericIR = (r) => {
   if (!Array.isArray(r)) return false
   const op = r[0]
   if (PURE_F64_OPS.has(op)) return true
@@ -550,19 +657,21 @@ export function buildRefcount(fn) {
  *  existing ids in a single walk. Replaces the per-pass
  *  `while (fn.some(... === $__prefixK)) k++` (O(K·N)) with one O(N) scan. */
 export function nextLocalId(fn, prefix) {
-  const seen = new Set()
+  // HIGH-WATER mark (max existing + 1), NOT the first free id. Callers allocate sequentially
+  // (id++), so a first-gap start would walk straight into an existing higher local once watr's
+  // coalesce has left non-contiguous numbering (e.g. $__pe0,$__pe1,$__pe5 → start at 2, then
+  // mint 3,4,5 and collide on $__pe5 = "Duplicate local"). High-water is always collision-free.
   const needle = `$__${prefix}`
+  let id = 0
   const walk = (n) => {
     if (!Array.isArray(n)) return
     if (n[0] === 'local' && typeof n[1] === 'string' && n[1].startsWith(needle)) {
       const tail = n[1].slice(needle.length)
-      if (/^\d+$/.test(tail)) seen.add(+tail)
+      if (/^\d+$/.test(tail)) { const k = +tail; if (k >= id) id = k + 1 }
     }
     for (let i = 0; i < n.length; i++) walk(n[i])
   }
   walk(fn)
-  let id = 0
-  while (seen.has(id)) id++
   return id
 }
 
@@ -731,10 +840,15 @@ export function toNumF64(node, v) {
     if (ctx.schema.slotIntCertainAt?.(node[1], node[2]) === true) return asF64(v)
   }
   // IR-level shapes that produce real f64 numbers (never NaN-boxed pointers):
-  // i32→f64 conversions, stdlib clock helper. Skip the __to_num call wrapper.
+  // i32→f64 conversions, stdlib clock helper, length/ptr helpers.
+  // Skip the __to_num call wrapper for these — they always return plain f64.
   if (Array.isArray(v)) {
     if (v[0] === 'f64.convert_i32_s' || v[0] === 'f64.convert_i32_u') return v
     if (v[0] === 'call' && v[1] === '$__time_ms') return v
+    // __length, __str_len return f64.convert_i32_s of an i32 — never a boxed pointer.
+    if (v[0] === 'call' && (v[1] === '$__length' || v[1] === '$__len' || v[1] === '$__str_len')) return v
+    // __ptr_type returns i32 tag, __ptr_offset returns i32 offset — both numeric.
+    if (v[0] === 'call' && (v[1] === '$__ptr_type' || v[1] === '$__ptr_offset')) return v
   }
   // f64 arithmetic ops and math intrinsics never produce NaN-boxed pointers — the
   // result is always a plain f64 number. Skip __to_num for these, eliminating the
@@ -785,6 +899,14 @@ export function toStrI64(node, v) {
       return typed(['call', '$__to_str', prim], 'i64')
     }
   }
+  // Provably-integer operand → render with the i32-only formatter, bypassing __to_str's
+  // float machinery (__ftoa/__toExp/__pow10, ~2 KB). A raw i32 value (`n|0`, a bitwise
+  // result, a loop counter) carries no NaN-box, so its ToString is just digits + sign.
+  // ptrKind != null means it's an unboxed pointer (i32 offset), NOT a number — exclude.
+  if (v.type === 'i32' && v.ptrKind == null) {
+    inc('__i32_to_str')
+    return typed(['i64.reinterpret_f64', ['call', '$__i32_to_str', v]], 'i64')
+  }
   inc('__to_str')
   return typed(['call', '$__to_str', asI64(v)], 'i64')
 }
@@ -809,8 +931,16 @@ const numericTruthy = e => {
 
 // i32 ops whose result is already a 0/1 boolean (comparisons + eqz) — safe to use
 // directly as a truthiness without a redundant `!= 0`.
+// Ops whose result is already a canonical i32 boolean (0 or 1) — a condition built
+// from one needs no `i32.ne(_, 0)` normalization. Every wasm comparison returns 0/1,
+// so the f64/f32/i64 relations belong here too (they were missing — a `a > b ? …`
+// f64 compare was wrapped in a dead `i32.ne(f64.gt …, 0)` in every branch/select).
 const I32_BOOL_OPS = new Set(['i32.eq', 'i32.ne', 'i32.lt_s', 'i32.lt_u', 'i32.gt_s', 'i32.gt_u',
-  'i32.le_s', 'i32.le_u', 'i32.ge_s', 'i32.ge_u', 'i32.eqz'])
+  'i32.le_s', 'i32.le_u', 'i32.ge_s', 'i32.ge_u', 'i32.eqz',
+  'f64.eq', 'f64.ne', 'f64.lt', 'f64.gt', 'f64.le', 'f64.ge',
+  'f32.eq', 'f32.ne', 'f32.lt', 'f32.gt', 'f32.le', 'f32.ge',
+  'i64.eq', 'i64.ne', 'i64.lt_s', 'i64.lt_u', 'i64.gt_s', 'i64.gt_u',
+  'i64.le_s', 'i64.le_u', 'i64.ge_s', 'i64.ge_u', 'i64.eqz'])
 
 export function truthyIR(e) {
   // An i32 *constant* is a concrete number, not a known 0/1 boolean — fold it to its
@@ -961,6 +1091,13 @@ export function readVar(name) {
     return typed(['f64.load', boxedAddr(name)], 'f64')
   }
   if (isGlobal(name)) {
+    // A module-level integer const (`const N = 16384`) is an immutable compile-time
+    // value: emit i32.const directly (when it fits i32) so `x % N` / `x & N` / `x / N`
+    // and counters bounded by N take the native integer path, instead of the global
+    // folding to an f64 constant and routing through the f64 round-trip. Value-preserving
+    // — an f64 consumer widens the i32.const via convert, which folds back to f64.const.
+    const ci = ctx.scope.constInts?.get?.(name)
+    if (ci != null && isI32(ci)) return typed(['i32.const', ci], 'i32')
     const gt = ctx.scope.globalTypes.get(name) || 'f64'
     const node = typed(['global.get', dollar(name)], gt)
     const grep = repOfGlobal(name)

package/src/kind-traits.js

@@ -5,9 +5,13 @@
 
 import { VAL } from './reps.js'
 
-export const BOOL_OPS = new Set([
-  '!', '<', '<=', '>', '>=', '==', '!=', '===', '!==', 'in', 'instanceof',
-])
+// Comparison / logical-not ops — result is a 0|1 boolean carried as i32. The one
+// source of truth for "this operator yields a boolean": valTypeOf reads it as
+// VAL.BOOL, exprType/isIntExpr read it as integer-certain. `in`/`instanceof` also
+// yield a boolean but are membership ops, kept out of the integer-certainty set
+// (they throw on BigInt operands and never reach numeric analysis).
+export const CMP_OPS = new Set(['!', '<', '<=', '>', '>=', '==', '!=', '===', '!=='])
+export const BOOL_OPS = new Set([...CMP_OPS, 'in', 'instanceof'])
 
 export const NUMERIC_BINARY_OPS = ['-', 'u-', '*', '/', '%', '&', '|', '^', '<<', '>>']
 export const NUMERIC_UNARY_OPS = new Set(['**', '++', '--', '~', '>>>', 'u+'])
@@ -94,9 +98,36 @@ export function methodValType(method, obj, objType, ctx) {
     if (objType === VAL.STRING || objType === VAL.ARRAY || objType === VAL.TYPED) return objType
     return null
   }
+  // .subarray / .toReversed / .toSorted / .with all return a typed array of the same kind.
+  if (method === 'subarray' || method === 'toReversed' || method === 'toSorted' || method === 'with')
+    return objType === VAL.TYPED ? VAL.TYPED : null
   return null
 }
 
+// Built-in PROPERTY val-types — the property-read mirror of methodValType.
+// These are language invariants: `.length` is always a number on the sized
+// value kinds, `.size` on Set/Map, `.byteLength`/`.byteOffset` on typed arrays.
+// Without this, `arr.length + x` sees `.length` as untyped and routes `+`
+// through the __is_str_key string-concat dispatch — even though `.length` can
+// never be a string on a known sized kind. (Object schema slots override this
+// earlier in VT['.'], so `{length:'x'}.length` keeps its true slot type.)
+//
+// Gate on a known objType: an untyped receiver could be an object with a
+// string-valued shadow of the same name, so leave it null there (conservative).
+// null-proto: user code reads `.valueOf`, `.toString` etc. — a plain `{}` would
+// expose inherited Object.prototype members as bogus "numeric props".
+const NUMERIC_PROPS = Object.assign(Object.create(null), {
+  length: new Set([VAL.STRING, VAL.ARRAY, VAL.TYPED]),
+  byteLength: new Set([VAL.TYPED, VAL.BUFFER]),
+  byteOffset: new Set([VAL.TYPED]),
+  size: new Set([VAL.SET, VAL.MAP]),
+})
+export function propValType(prop, objType) {
+  if (objType == null) return null
+  const kinds = NUMERIC_PROPS[prop]
+  return kinds && kinds.has(objType) ? VAL.NUMBER : null
+}
+
 export function typedCtorElemValType(ctor) {
   if (!ctor) return null
   const isView = ctor.endsWith('.view')

package/src/kind.js

@@ -8,10 +8,10 @@
 
 import { ctx } from './ctx.js'
 import { VAL, lookupValType } from './reps.js'
-import { intLiteralValue } from './static.js'
+import { intLiteralValue, staticIndexKey } from './static.js'
 import {
   BOOL_OPS, NUMERIC_BINARY_OPS, NUMERIC_UNARY_OPS, COMPOUND_NUMERIC_OPS,
-  calleeValType, methodValType, typedCtorElemValType,
+  calleeValType, methodValType, propValType, typedCtorElemValType,
 } from './kind-traits.js'
 
 export { typedCtorElemValType } from './kind-traits.js'
@@ -137,7 +137,16 @@ VT['?:'] = (args) => {
   const truthy = literalTruthiness(args[0])
   if (truthy != null) return valTypeOf(truthy ? args[1] : args[2])
   const ta = valTypeOf(args[1]), tb = valTypeOf(args[2])
-  return ta && ta === tb ? ta : null
+  if (ta && ta === tb) return ta
+  // A boolean branch coerces to 0/1 in numeric context (same rule as &&/||/?? below):
+  // when the other branch has a known non-boolean type, the conditional carries it.
+  // Without this, `num + (cond ? num : num>k)` sees a null-typed operand and emits the
+  // polymorphic string-concat dispatch on two pure-numeric subexprs — which pins the
+  // whole number→string formatter (__str_concat → __to_str → __static_str), a pure-int
+  // program ballooning 1 → ~19 funcs (see test/wat-invariants.js, .work/todo.md).
+  if (ta === VAL.BOOL && tb && tb !== VAL.BOOL) return tb
+  if (tb === VAL.BOOL && ta && ta !== VAL.BOOL) return ta
+  return null
 }
 
 // Value-preserving logical: `&&`/`||` return one of their operands.
@@ -145,7 +154,11 @@ VT['?:'] = (args) => {
 // (a condition/guard) and the other has a known non-boolean type,
 // return the non-boolean type — common in `condition && numericValue`
 // guard patterns where the falsey boolean is coerced to 0 in numeric context.
-VT['&&'] = VT['||'] = (args) => {
+// `a && b` / `a || b` / `a ?? b` all yield one of the two operands, so the result
+// type is their common type (else unknown). Giving `??` a type — not just ||/&& —
+// lets `numA ?? numB` read NaN-safe (value-typed NUMBER → f64.eq) instead of routing
+// through the bit-comparing __is_truthy, which mis-reads a non-canonical NaN.
+VT['&&'] = VT['||'] = VT['??'] = (args) => {
   const ta = valTypeOf(args[0]), tb = valTypeOf(args[1])
   if (ta && ta === tb) return ta
   if (ta === VAL.BOOL && tb && tb !== VAL.BOOL) return tb
@@ -158,6 +171,24 @@ VT['&&'] = VT['||'] = (args) => {
 // Index access:  `arr[i]` → ['[]', arr, i].
 VT['[]'] = (args) => {
   if (args.length < 2) return VAL.ARRAY
+  // A literal NEGATIVE index is always out of range → reads undefined, not the
+  // element type. Returning a numeric elem type here would let `a[-1] === undefined`
+  // fold to false (a NUMBER can't be undefined), silently dropping the guard.
+  { const li = intLiteralValue(args[1]); if (li != null && li < 0) return null }
+  // SRoA flat-array slot read: `a[k]` (static index) where `a` dissolved into
+  // scalar `a#i` locals (scanFlatObjects). A write-once slot's value-type is its
+  // element literal's — same numeric-binding as the `VT['.']` object case, so
+  // `a[0] * 2` stays a plain f64 op instead of the polymorphic ToNumber battery.
+  if (typeof args[0] === 'string') {
+    const flat = ctx.func.flatObjects?.get(args[0])
+    if (flat) {
+      const k = staticIndexKey(args[1])
+      if (k != null && !flat.written?.has(k)) {
+        const i = flat.names.indexOf(k)
+        if (i >= 0 && flat.values[i] !== undefined) return valTypeOf(flat.values[i])
+      }
+    }
+  }
   // Indexed read on a known typed-array receiver yields Number except for
   // BigInt64Array/BigUint64Array, whose i64 carriers must stay BigInt-typed.
   if (typeof args[0] === 'string' && lookupValType(args[0]) === VAL.TYPED)
@@ -170,6 +201,25 @@ VT['[]'] = (args) => {
   if (typeof args[0] === 'string') {
     const elemVt = ctx.func.localReps?.get(args[0])?.arrayElemValType
     if (elemVt) return elemVt
+    // Module-level const array (a numeric/uniform table): its element val-type was
+    // recorded on the global rep at decl time. Trust it only when no function element-
+    // writes the array — dynWriteVars holds every var written via a non-named-property
+    // index, so a `X[i]=str` anywhere disables this and falls back to the untyped read.
+    if (!ctx.func.localReps?.has(args[0])) {
+      const gElem = ctx.scope.globalReps?.get(args[0])?.arrayElemValType
+      if (gElem && !ctx.types?.dynWriteVars?.has(args[0])) return gElem
+    }
+  }
+  // Direct double-index on a module-level nested numeric table — `C[i][j]` where
+  // `C = [[…number…], …]`. The receiver is itself a single-index read of a global
+  // array whose nested element kind was recorded at decl time. Same dynWriteVars
+  // guard (now root-aware, so a `C[i][j]=…` write anywhere disables it).
+  if (Array.isArray(args[0]) && args[0][0] === '[]' && args[0].length === 3 && typeof args[0][1] === 'string') {
+    const base = args[0][1]
+    if (!ctx.func.localReps?.has(base)) {
+      const gNested = ctx.scope.globalReps?.get(base)?.arrayElemElemValType
+      if (gNested && !ctx.types?.dynWriteVars?.has(base)) return gNested
+    }
   }
   // Indexed read on an inline all-numeric array literal — `[2,4,2,9][i]` (floatbeat
   // chord/pattern tables; literal op is `[`, elements inline). Every element is a
@@ -183,6 +233,21 @@ VT['[]'] = (args) => {
 
 VT['.'] = (args) => {
   if (typeof args[1] !== 'string') return null
+  // SRoA flat-object slot read: `p.x` where `p` dissolved into scalar `p#i`
+  // locals (scanFlatObjects). A write-once slot's value-type IS its literal
+  // initializer's, so bind by it — exactly as a plain `let slot = value` local
+  // would. Without this `p.x * 2` looks like "could be anything" and pulls the
+  // ToNumber + string-format battery, though it can only be numeric. Computed
+  // on-demand (not cached at analyze time) because param val-types — `{x:n}`'s
+  // `n` is numeric-by-divergence — are only seeded at emit. A reassigned slot
+  // (`p.x = …`) stays untyped: its runtime value may differ from the literal.
+  if (typeof args[0] === 'string') {
+    const flat = ctx.func.flatObjects?.get(args[0])
+    if (flat && !flat.written?.has(args[1])) {
+      const i = flat.names.indexOf(args[1])
+      if (i >= 0 && flat.values[i] !== undefined) return valTypeOf(flat.values[i])
+    }
+  }
   // Schema slot read: when `varName` has a bound schemaId and `.prop` resolves
   // to a slot whose VAL kind is monomorphic across program-wide observations,
   // return that kind. Lets `+`, `===`, method dispatch skip runtime str-key
@@ -200,6 +265,14 @@ VT['.'] = (args) => {
     const child = sh.props[args[1]]
     if (child) return child.val
   }
+  // Built-in property on a known sized kind — `.length` on STRING/ARRAY/TYPED,
+  // `.size` on SET/MAP, `.byteLength`/`.byteOffset` on TYPED/BUFFER. These are
+  // language invariants (the property is always a number on that kind), so typing
+  // them NUMBER lets `+` skip the string-concat dispatch. Object schema slots
+  // resolved above override this, keeping user-defined same-name slots sound.
+  const objType = typeof args[0] === 'string' ? lookupValType(args[0]) : valTypeOf(args[0])
+  const pvt = propValType(args[1], objType)
+  if (pvt) return pvt
   return null
 }
 
@@ -248,6 +321,8 @@ VT['()'] = (args) => {
     const t = valTypeOf(args[1])
     return t === VAL.SET || t === VAL.MAP ? VAL.ARRAY : t
   }
+  // for-in's read-only key list (src/prepare) — always an Array of key strings.
+  if (callee === '__keys_ro') return VAL.ARRAY
   // Ternary is parsed as call to '?' operator: ['()', ['?', cond, a, b]]
   if (Array.isArray(callee) && callee[0] === '?') {
     const truthy = literalTruthiness(callee[1])

package/src/op-policy.js

@@ -22,7 +22,10 @@ export const REJECT_OPS = {
 }
 
 /** Bare identifiers prepare rejects (no jzify lowering). */
-export const REJECT_IDENTS = {
+// Prototype-less (Object.create(null)): a plain `{}` inherits Object.prototype in V8, so
+// `REJECT_IDENTS['valueOf']` would return the inherited method (truthy) and wrongly reject
+// a user identifier named like an Object method. Kernel objects are already prototype-less.
+export const REJECT_IDENTS = Object.assign(Object.create(null), {
   with: '`with` not supported',
   class: '`class` not supported',
   yield: '`yield` not supported',
@@ -36,7 +39,7 @@ export const REJECT_IDENTS = {
   // identifier in sloppy JS (`var let = 5`), so rejecting it would refuse valid JS
   // (test262 language/expressions/object/let-non-strict-*).
   const: '`const` is a reserved word, not a valid name',
-}
+})
 
 /** jzify-only errors for class lowering (no prepare counterpart). */
 export const JZIFY_CLASS_ERRORS = {

package/src/ops.js

@@ -0,0 +1,119 @@
+// === AST op tags — integer-tagged-union representation ===
+// internOps (prepare->compile boundary) converts array node[0] from op STRING to its
+// integer tag; the compile half then dispatches via integer-keyed (eventually array)
+// tables, removing the per-node string-hash lookup in the self-host kernel.
+// OP: string -> int (1-based; 0 reserved => a missing tag is falsy). OPS: int -> string.
+export const OP = {
+  "!": 1,
+  "!=": 2,
+  "!==": 3,
+  "%": 4,
+  "%=": 5,
+  "&": 6,
+  "&&": 7,
+  "&&=": 8,
+  "&=": 9,
+  "(": 10,
+  "()": 11,
+  "*": 12,
+  "**": 13,
+  "*=": 14,
+  "+": 15,
+  "++": 16,
+  "+=": 17,
+  ",": 18,
+  "-": 19,
+  "--": 20,
+  "-=": 21,
+  ".": 22,
+  "...": 23,
+  "/": 24,
+  "//": 25,
+  "/=": 26,
+  ";": 27,
+  "<": 28,
+  "<<": 29,
+  "<<=": 30,
+  "<=": 31,
+  "=": 32,
+  "==": 33,
+  "===": 34,
+  "=>": 35,
+  ">": 36,
+  ">=": 37,
+  ">>": 38,
+  ">>=": 39,
+  ">>>": 40,
+  ">>>=": 41,
+  "?": 42,
+  "?:": 43,
+  "??": 44,
+  "??=": 45,
+  "[": 46,
+  "[]": 47,
+  "^": 48,
+  "^=": 49,
+  "async": 50,
+  "await": 51,
+  "bigint": 52,
+  "block": 53,
+  "bool": 54,
+  "break": 55,
+  "call": 56,
+  "catch": 57,
+  "const": 58,
+  "continue": 59,
+  "default": 60,
+  "delete": 61,
+  "export": 62,
+  "finally": 63,
+  "for": 64,
+  "if": 65,
+  "import": 66,
+  "in": 67,
+  "instanceof": 68,
+  "label": 69,
+  "let": 70,
+  "nan": 71,
+  "new": 72,
+  "return": 73,
+  "spread": 74,
+  "str": 75,
+  "strcat": 76,
+  "switch": 77,
+  "throw": 78,
+  "typeof": 79,
+  "u+": 80,
+  "u-": 81,
+  "void": 82,
+  "while": 83,
+  "yield": 84,
+  "{": 85,
+  "{}": 86,
+  "|": 87,
+  "|=": 88,
+  "||": 89,
+  "||=": 90,
+  "~": 91,
+}
+export const OPS = [null, "!", "!=", "!==", "%", "%=", "&", "&&", "&&=", "&=", "(", "()", "*", "**", "*=", "+", "++", "+=", ",", "-", "--", "-=", ".", "...", "/", "//", "/=", ";", "<", "<<", "<<=", "<=", "=", "==", "===", "=>", ">", ">=", ">>", ">>=", ">>>", ">>>=", "?", "?:", "??", "??=", "[", "[]", "^", "^=", "async", "await", "bigint", "block", "bool", "break", "call", "catch", "const", "continue", "default", "delete", "export", "finally", "for", "if", "import", "in", "instanceof", "label", "let", "nan", "new", "return", "spread", "str", "strcat", "switch", "throw", "typeof", "u+", "u-", "void", "while", "yield", "{", "{}", "|", "|=", "||", "||=", "~"]
+export const OP_COUNT = 92
+
+// Normalize an op tag to its string form for op-Set membership / switch checks,
+// so `SET.has(opStr(node[0]))` and `switch (opStr(op))` work whether node[0] is
+// still a string (intern off / non-interned op like ':') or an integer (intern
+// on). Self-host-safe: the typeof guard avoids indexing the OPS array by a string
+// (jz arrays trap on non-integer indices), and it never grows a Set.
+export const opStr = (op) => typeof op === "number" ? OPS[op] : op
+
+// Convert array node[0] from op-STRING to integer tag, recursively. Once per node at
+// the prepare boundary. Unknown op-strings stay strings (dual-keyed tables handle them
+// until the int-only phase). node[0]===null (numeric literal) stays null; identifiers
+// (bare strings at n[1+]) untouched.
+export const internOps = (n) => {
+  if (!Array.isArray(n)) return n
+  const t = n[0]
+  if (typeof t === "string") { const id = OP[t]; if (id !== undefined) n[0] = id }
+  for (let i = 1; i < n.length; i++) if (Array.isArray(n[i])) internOps(n[i])
+  return n
+}