jz 0.6.0 → 0.8.0

package/src/prepare/index.js

@@ -44,7 +44,7 @@ import { recordGlobalRep } from '../compile/infer.js'
 import { isFuncRef } from '../ir.js'
 import {
   CTORS, COLLECTION_CTORS, TIMER_NAMES,
-  hasModule, includeModule,
+  hasModule, includeModule, includeMods,
   includeForArrayAccess, includeForArrayLiteral, includeForArrayPattern, includeForCallableValue,
   includeForGenericMethod, includeForKnownKeyIteration, includeForNamedCall, includeForNumericCoercion,
   includeForObjectLiteral, includeForObjectPattern, includeForOp, includeForProperty, includeForRuntimeCtor,
@@ -169,7 +169,7 @@ const addHostImport = (mod, name, alias, spec) => {
   // ABI — record it so references fold to an f64 literal (see prep's identifier resolution) instead
   // of emitting a 0-arg func import that can't be read as a value ("'PI' is not in scope").
   if (typeof spec === 'number') {
-    if (!ctx.scope.hostConsts) ctx.scope.hostConsts = {}
+    if (!ctx.scope.hostConsts) ctx.scope.hostConsts = Object.create(null)  // name-keyed: prototype-less (see derive)
     ctx.scope.hostConsts[alias] = spec
     return
   }
@@ -321,6 +321,30 @@ function lookupStaticStringArray(name) {
   return ctx.scope.shapeStrArrays?.get(resolved) ?? null
 }
 
+/** Evaluate a constant numeric expression (number literals + basic arithmetic) for
+ *  compile-time string/template folding. Returns null when it isn't a pure-number
+ *  constant — string `+` and dynamic parts fall through to the caller's runtime path. */
+function constNum(node) {
+  if (Array.isArray(node) && node[0] == null && typeof node[1] === 'number') return node[1]
+  if (!Array.isArray(node)) return null
+  const [op, a, b] = node
+  if ((op === 'u-' || op === '-' || op === '+') && b === undefined) {
+    const x = constNum(a)
+    return x == null ? null : op === 'u-' || op === '-' ? -x : +x
+  }
+  const x = constNum(a), y = constNum(b)
+  if (x == null || y == null) return null
+  switch (op) {
+    case '+': return x + y
+    case '-': return x - y
+    case '*': return x * y
+    case '/': return y === 0 ? null : x / y
+    case '%': return y === 0 ? null : x % y
+    case '**': return x ** y
+  }
+  return null
+}
+
 function staticStringExpr(node) {
   const lit = stringValue(node)
   if (lit != null) return lit
@@ -341,7 +365,11 @@ function staticStringExpr(node) {
   if (op === '`') {
     let out = ''
     for (const part of args) {
-      const s = staticStringExpr(part)
+      let s = staticStringExpr(part)
+      // A numeric interpolation (`${123}`, `${1+2}`) is a constant in string context —
+      // ToString it so a fully-static template folds to one literal instead of a runtime
+      // concat. (Only the template case stringifies numbers; `+` stays polymorphic.)
+      if (s == null) { const n = constNum(part); if (n != null) s = String(n) }
       if (s == null) return null
       out += s
     }
@@ -383,7 +411,7 @@ function resolveImportMeta(spec) {
 
 function recordModuleInitFacts(root) {
   const facts = ctx.module.initFacts ||= {
-    dynVars: new Set(), anyDyn: false, hasSchemaLiterals: false,
+    dynVars: new Set(), dynWriteVars: new Set(), anyDyn: false, hasSchemaLiterals: false,
     hasFuncValue: false, timerNames: new Set(),
     maxDef: 0, maxCall: 0, hasRest: false, hasSpread: false,
     writtenProps: new Set(),
@@ -458,6 +486,11 @@ export default function prepare(node) {
   // import would cycle (autoload imports every module via module/index.js).
   ctx.module.include = includeModule
   includeModule('core')
+  // Empty or whitespace-only source parses to a bare '' — an empty program, not an
+  // identifier reference. Normalize to an empty statement so it compiles to a bare
+  // `(module)` instead of a `(local.get $)` against a zero-length name. (A non-empty
+  // bare identifier like `foo` parses to `'foo'` and stays a real reference.)
+  if (node === '') node = [';']
   validateCoalesceMixing(node)  // ES2020: reject unparenthesized `??` mixed with `||`/`&&`
   normalizeIdents(node)
   fuseSparseMapReads(node)  // AST-level fusion; needs pre-resolution shape — defined at end of file
@@ -557,9 +590,13 @@ export default function prepare(node) {
 
 // Named constants → numeric literals. The JZ_NULL/JZ_UNDEF atom sentinels live
 // in ast.js — shared with emit without crossing the prepare↔compile boundary.
-const CONSTANTS = { 'true': true, 'false': false, 'null': JZ_NULL, 'undefined': JZ_UNDEF }
+// Prototype-less (Object.create(null)): a plain `{}` inherits Object.prototype in V8, so
+// `'valueOf' in CONSTANTS` / `CONSTANTS['toString']` would hit an inherited method and
+// mis-resolve a user identifier named like an Object method (jz.js-only — kernel objects
+// are already prototype-less). Same reason on F64_CONSTANTS / GLOBALS / REJECT_IDENTS.
+const CONSTANTS = Object.assign(Object.create(null), { 'true': true, 'false': false, 'null': JZ_NULL, 'undefined': JZ_UNDEF })
 // NaN/Infinity stay as special f64 values in emit()
-const F64_CONSTANTS = { 'NaN': NaN, 'Infinity': Infinity }
+const F64_CONSTANTS = Object.assign(Object.create(null), { 'NaN': NaN, 'Infinity': Infinity })
 
 /** Resolve variable name through block scope chain (innermost rename wins). */
 function resolveScope(name) {
@@ -815,7 +852,7 @@ function prep(node) {
 // Not actually "implicit imports" — these are ambient globals that exist in every jz/JS
 // program (they do not live in any module). jzify auto-injecting imports would still
 // need a list of these names to know what to emit, so the table lives here either way.
-export const GLOBALS = {
+export const GLOBALS = Object.assign(Object.create(null), {
   Math: 'math',
   Number: 'Number',
   Array: 'Array',
@@ -845,7 +882,7 @@ export const GLOBALS = {
   BigInt: 'BigInt',
   TextEncoder: 'TextEncoder',
   TextDecoder: 'TextDecoder',
-}
+})
 
 const patternItems = (node) => node?.[0] === ',' ? node.slice(1) : [node]
 const isDestructPattern = (node) => Array.isArray(node) && (node[0] === '[]' || node[0] === '{}')
@@ -1246,7 +1283,7 @@ function foldNamespaceIntrospection(callee, args) {
 // Compiler-internal synthetic callees: emit-handled intrinsics, never user
 // function values — so a bare reference must not pull in the callable-value
 // (function table / closure) machinery.
-const INTRINSIC_CALLEES = new Set(['__iter_arr'])
+const INTRINSIC_CALLEES = new Set(['__iter_arr', '__keys_ro'])
 
 function resolveCallee(callee, args) {
   if (typeof callee === 'string') {
@@ -1427,6 +1464,10 @@ const handlers = {
 
   // Template literal: [``, part, ...] → fused single-allocation string concat.
   '`'(...parts) {
+    // Fully-static template (`a${123}b`, `hello ${1+2} world`) folds to a single string
+    // literal — a static data segment / SSO box, no runtime concat and no heap machinery.
+    const folded = staticStringExpr(['`', ...parts])
+    if (folded != null) return staticString(folded)
     includeForStringValue()
     const nodes = parts.map(p =>
       Array.isArray(p) && p[0] == null && typeof p[1] === 'string' ? ['str', p[1]] : prep(p))
@@ -1546,7 +1587,7 @@ const handlers = {
       if (Array.isArray(specifiers) && specifiers[0] === 'as' && specifiers[1] === '*') {
         const alias = specifiers[2]
         // Store namespace mapping so '.' handler can resolve X.prop → mangled name
-        if (!ctx.module.namespaces) ctx.module.namespaces = {}
+        if (!ctx.module.namespaces) ctx.module.namespaces = Object.create(null)  // name-keyed: prototype-less (see derive)
         ctx.module.namespaces[alias] = resolved.exports
         return null
       }
@@ -1628,6 +1669,15 @@ const handlers = {
       for (const i of decl.slice(1))
         if (Array.isArray(i) && i[0] === '=' && typeof i[1] === 'string')
           ctx.func.exports[i[1]] = true
+    // export name → bare-identifier re-export (shorthand for `export { name }`).
+    // Register the binding and emit nothing; without this the name falls through
+    // to `prep(decl)` below and compiles as a dead `global.get; drop` statement
+    // while the export itself is silently lost.
+    if (typeof decl === 'string') {
+      const resolved = ctx.scope.chain[decl]
+      ctx.func.exports[decl] = (resolved && resolved !== decl) ? resolved : decl
+      return null
+    }
     // export { name, name as alias } from './mod' or export * from './mod'
     if (Array.isArray(decl) && decl[0] === 'from') {
       const mod = decl[2]?.[1]
@@ -1821,7 +1871,11 @@ const handlers = {
     // alone wrongly folds `-5n`, and negating the bigint here yields garbage (-2^63+5).
     // `typeof !== 'bigint'` excludes it in both engines (real JS: 'bigint'; jz: matches
     // 'bigint'). Bigint negation then flows to emit's i64.sub(0,·) path correctly.
-    if (b === undefined) { const na = prep(a); return isLit(na) && typeof na[1] === 'number' && typeof na[1] !== 'bigint' ? [, -na[1]] : ['u-', na] }
+    // `-0` is NOT folded: the self-host kernel evaluates the constant `-na[1]` with
+    // i32 negation (i32 has no signed zero), collapsing -0→+0 — observable via sort's
+    // -0<+0 tiebreak, Object.is, and 1/x. Leaving it as a runtime `u-` emits f64.neg,
+    // which preserves the sign in both engines; V8 re-folds it, so no native cost.
+    if (b === undefined) { const na = prep(a); return isLit(na) && typeof na[1] === 'number' && typeof na[1] !== 'bigint' && na[1] !== 0 ? [, -na[1]] : ['u-', na] }
     return ['-', prep(a), prep(b)]
   },
 
@@ -2123,10 +2177,17 @@ const handlers = {
       // `[null, null]`, `undefined` is `[null]` (empty value slot). A numeric/string literal
       // `[null, v]` has a non-nullish value slot, so `src[1] == null` discriminates them.
       const nullish = Array.isArray(src) && src[0] == null && src[1] == null
+      // `__keys_ro` is for-in's read-only key list: identical to Object.keys, but
+      // when the receiver has a complete static schema the keys are a compile-time
+      // constant, so it pools ONE static-data array instead of allocating a fresh
+      // one each evaluation — the per-iteration heap-growth cliff (jz#deopt-forin).
+      // Sound only because for-in reads ks[i]/ks.length and never mutates (unlike
+      // user Object.keys, which permits in-place `.sort()`/`.reverse()`).
+      includeMods('core', 'object', 'string')
       const keysExpr = nullish ? ['[]', null]
         : typeof src === 'string'
-          ? ['?', ['==', src, [null, null]], ['[]', null], ['()', ['.', 'Object', 'keys'], src]]
-          : ['()', ['.', 'Object', 'keys'], src]
+          ? ['?', ['==', src, [null, null]], ['[]', null], ['()', '__keys_ro', src]]
+          : ['()', '__keys_ro', src]
       const ks = `${T}fik${ctx.func.uniq++}`, ix = `${T}fii${ctx.func.uniq++}`, lenV = `${T}fil${ctx.func.uniq++}`
       const decls = ['let',
         ['=', ks, keysExpr],
@@ -2409,7 +2470,7 @@ function prepareModule(specifier, source) {
   const savedFuncCount = ctx.func.list.length  // track new funcs from this module
   const savedModulePrefix = ctx.module.currentPrefix
   ctx.scope.chain = derive(savedScope)  // inherit parent scope
-  ctx.func.exports = {}
+  ctx.func.exports = Object.create(null)  // name-keyed: prototype-less (see derive)
   ctx.module.currentPrefix = prefix
 
   try {

package/src/prepare/lift-iife.js

@@ -0,0 +1,149 @@
+/**
+ * Lambda-lift immediately-invoked arrow literals (IIFEs).
+ *
+ * `(params => body)(args)` is lowered by jz's default path as a CLOSURE value invoked
+ * via `call_indirect` through the uniform-f64 closure ABI. That ABI can't carry a
+ * `v128`, so a SIMD IIFE — `(() => f32x4.…)()` — emits invalid wasm; it also pays a
+ * closure alloc + indirect call for what is really a direct, single call.
+ *
+ * This pass rewrites each such IIFE into a TOP-LEVEL function whose free variables are
+ * appended as parameters, and replaces the call with a direct call passing those vars:
+ *
+ *   let r = (() => { let t = f32x4.mul(a, a); return f32x4.add(t, …) })()   // captures a
+ *     ⇓
+ *   let ⟨lift⟩ = (a) => { let t = f32x4.mul(a, a); return f32x4.add(t, …) }  // hoisted to top
+ *   let r = ⟨lift⟩(a)                                                        // direct call
+ *
+ * The lifted function flows through jz's monomorphic typed-function path (like any
+ * `let f = (x) => …; f(v)`), so a captured/returned `v128` is typed `v128` from the
+ * single call site — and `inlineOnce` then folds the single-caller body back in, so
+ * there's no residual call. Capture is BY VALUE, which is exact for a synchronous
+ * immediate invocation (the value at the call instant == what the closure would read);
+ * the one divergence — a capture MUTATED inside the body, which a closure writes back
+ * through its cell — is the bail below.
+ *
+ * Bails (leaving the closure path untouched) on: non-plain params (rest / default /
+ * destructured), or a body that assigns any captured variable. Everything else folds.
+ *
+ * @module prepare/lift-iife
+ */
+import { T, extractParams, classifyParam } from '../ast.js'
+import { findFreeVars, findMutations } from '../compile/analyze-scans.js'
+
+// Build a comma-list operand node (the parser's shape) from an array of nodes.
+const commaList = (items) =>
+  items.length === 0 ? null : items.length === 1 ? items[0] : [',', ...items]
+
+// Unwrap parenthesis nodes (`['()', x]`, length 2) to reach the inner expression.
+const unwrapParens = (n) => {
+  while (Array.isArray(n) && n[0] === '()' && n.length === 2) n = n[1]
+  return n
+}
+
+// `['()', callee, args]` (length 3) whose callee unwraps to an arrow literal → that arrow.
+const iifeArrow = (n) => {
+  if (!Array.isArray(n) || n[0] !== '()' || n.length !== 3) return null
+  const callee = unwrapParens(n[1])
+  return Array.isArray(callee) && callee[0] === '=>' ? callee : null
+}
+
+// Plain-name params only; anything else (rest/default/destructure) → null (bail).
+const plainParamNames = (arrow) => {
+  const out = []
+  for (const p of extractParams(arrow[1])) {
+    const c = classifyParam(p)
+    if (c.kind !== 'plain' || typeof c.name !== 'string') return null
+    out.push(c.name)
+  }
+  return out
+}
+
+// Names a function binds: its plain params + every let/const name in its body, NOT
+// descending into nested arrows (their locals are their own). Over-approximating
+// within a frame is safe — a free ident only resolves to one of these if it's
+// actually in scope at the reference. Used to scope captures to enclosing LOCALS
+// (module-level names stay global refs in the lifted body, never captured).
+const collectDeclNames = (decl, out) => {
+  if (!Array.isArray(decl)) return
+  if (decl[0] === '=' && typeof decl[1] === 'string') out.add(decl[1])
+  else if (decl[0] === '=' && Array.isArray(decl[1])) collectPatternNames(decl[1], out)
+  else if (typeof decl[1] === 'string') out.add(decl[1])
+}
+const collectPatternNames = (pat, out) => {
+  if (typeof pat === 'string') { out.add(pat); return }
+  if (!Array.isArray(pat)) return
+  for (let i = 1; i < pat.length; i++) collectPatternNames(pat[i], out)
+}
+function functionLocals(paramNodes, body) {
+  const names = new Set()
+  for (const p of paramNodes) { const c = classifyParam(p); if (typeof c.name === 'string') names.add(c.name); else if (c.pattern) collectPatternNames(c.pattern, names) }
+  const scan = (n) => {
+    if (!Array.isArray(n)) return
+    if (n[0] === '=>') return
+    if (n[0] === 'let' || n[0] === 'const') for (const d of n.slice(1)) collectDeclNames(d, names)
+    for (let i = 1; i < n.length; i++) scan(n[i])
+  }
+  scan(body)
+  return names
+}
+
+export function liftIIFEs(ast) {
+  if (!Array.isArray(ast)) return ast
+  const lifted = []        // hoisted `['let', ['=', name, arrow]]` decls
+  let uid = 0
+
+  // Copy non-index node metadata (parser `.loc`, etc.) onto a rebuilt node so error
+  // source-locations survive the transform.
+  const copyMeta = (to, from) => { for (const k of Object.keys(from)) if (isNaN(+k)) to[k] = from[k]; return to }
+
+  // `locals` = union of every enclosing FUNCTION frame's bound names. The transform
+  // is post-order (inner IIFEs fold first) so an outer lift sees already-direct inner
+  // calls; scope tracking is top-down so each IIFE sees the right enclosing locals.
+  // Identity-preserving: a node with no lifted descendant is returned unchanged.
+  const visit = (node, locals) => {
+    if (!Array.isArray(node)) return node
+
+    // Descend into an arrow body with the frame extended by this arrow's locals.
+    if (node[0] === '=>') {
+      const inner = new Set(locals)
+      for (const n of functionLocals(extractParams(node[1]), node[2])) inner.add(n)
+      let changed = false
+      const out = node.map((c, i) => { if (i === 0) return c; const v = visit(c, inner); if (v !== c) changed = true; return v })
+      return changed ? copyMeta(out, node) : node
+    }
+
+    // Transform children first (post-order).
+    let changed = false
+    const mapped = node.map((c, i) => { if (i === 0) return c; const v = visit(c, locals); if (v !== c) changed = true; return v })
+    const base = changed ? copyMeta(mapped, node) : node
+
+    const arrow = iifeArrow(base)
+    if (!arrow) return base
+
+    const paramNames = plainParamNames(arrow)
+    if (paramNames === null) return base                // bail: non-plain params
+
+    const callArgs = base[2] == null ? [] : (Array.isArray(base[2]) && base[2][0] === ',') ? base[2].slice(1) : [base[2]]
+    if (callArgs.some(a => Array.isArray(a) && a[0] === '...')) return base   // bail: spread into a fixed-arity direct call
+
+    const body = arrow[2]
+    const captures = []
+    findFreeVars(body, new Set(paramNames), captures, locals)
+
+    const mutated = new Set()
+    findMutations(body, new Set(captures), mutated)
+    if (mutated.size) return base                       // bail: a captured var is written
+
+    // Lift: `(…params, …captures) => body`, hoisted to module top; call passes captures.
+    const name = `${T}lift${uid++}`
+    lifted.push(['let', ['=', name, ['=>', ['()', commaList([...paramNames, ...captures])], body]]])
+    return copyMeta(['()', name, commaList([...callArgs, ...captures])], base)
+  }
+
+  const result = visit(ast, new Set())
+  if (!lifted.length) return result
+
+  // Prepend the lifted decls to the module body (`[';', …stmts]`).
+  if (Array.isArray(result) && result[0] === ';') return [';', ...lifted, ...result.slice(1)]
+  return [';', ...lifted, result]
+}

package/src/reps.js

@@ -56,6 +56,10 @@ export const VAL = {
  * @property {boolean} [notString]        proven not a string (skips string-path guards).
  * @property {number}  [arrayElemSchema]  element object-schema id for arrays.
  * @property {string}  [arrayElemValType] element VAL.* kind for arrays.
+ * @property {string}  [arrayElemElemValType] nested element VAL.* kind (`X[i][j]`) for arrays of arrays.
+ * @property {string}  [arrayElemTypedCtor] element TypedArray ctor (`new.Float32Array`) for an
+ *   array whose elements are all typed arrays of one ctor (`Array.from(n,()=>new Float32Array())`),
+ *   so `arr[i]` is a known typed array and `arr[i][j]` inlines instead of runtime aux-dispatch.
  * @property {string}  [carrier]          abi carrier id override (e.g. 'jsstring').
  * @property {boolean} [unsigned]         i32 carries an unsigned value (`>>>` result).
  * @property {*}       [jsonShape]        inferred shape for the JSON.stringify fast path.
@@ -67,8 +71,8 @@ export const VAL = {
  */
 export const REP_FIELDS = new Set([
   'val', 'ptrKind', 'ptrAux', 'schemaId', 'intConst', 'intCertain', 'notString',
-  'arrayElemSchema', 'arrayElemValType', 'carrier', 'unsigned', 'jsonShape',
-  'typedCtor', 'wasm', 'nullable',
+  'arrayElemSchema', 'arrayElemValType', 'arrayElemElemValType', 'arrayElemTypedCtor', 'carrier', 'unsigned', 'jsonShape',
+  'typedCtor', 'wasm', 'nullable', 'neverGrown',
 ])
 
 const DBG_REPS = typeof process !== 'undefined' && process.env?.JZ_DEBUG_INVARIANTS === '1'

package/src/static.js

@@ -19,6 +19,15 @@ export function intLiteralValue(expr) {
 /** Non-negative integer literal — used for string/typed-array index bounds. */
 export const nonNegIntLiteral = (node) => { const n = intLiteralValue(node); return n != null && n >= 0 ? n : null }
 
+/** Flat-array slot key for a *bare* non-negative integer index literal `[null, k]`
+ *  — returns the stringified index ("0","1",…) so an array `a[k]` resolves through
+ *  the same SRoA `name#i` machinery as an object `o.key`. Only a literal index
+ *  qualifies (not a const-folded identifier): the key must be unambiguous at scan
+ *  time, before any rep is known. Null for dynamic / non-integer / huge indices. */
+export const staticIndexKey = (node) =>
+  Array.isArray(node) && node[0] == null && Number.isInteger(node[1]) && node[1] >= 0 && node[1] < 0x100000000
+    ? String(node[1]) : null
+
 /** Fold compile-time integer expressions (literals, const bindings, + - * <<). */
 export function constIntExpr(node) {
   let lit = intLiteralValue(node)

package/src/type.js

@@ -12,8 +12,10 @@
  */
 import { isI32, isReassigned } from './ast.js'
 import { ctx } from './ctx.js'
+import { FITS_I32_MAX } from './widen.js'
 import { VAL, lookupValType } from './reps.js'
 import { valTypeOf } from './kind.js'
+import { propValType, CMP_OPS } from './kind-traits.js'
 import { NO_VALUE, staticValue, intLiteralValue } from './static.js'
 import { typedElemAux } from '../layout.js'
 
@@ -362,9 +364,24 @@ export function isTerminator(body) {
   return false
 }
 
-const isUnsignedI32Expr = (e) => Array.isArray(e) && (
+// Resolve a name's typed-array element ctor: in-progress local overlay (analyzeBody) →
+// per-func map (post-analyze) → module-global registry. The global fallback matters during
+// analyzeBody/narrow when the per-func map is null, so a read of a *global* typed array
+// (`DX[i]` with `let DX = new Int32Array(...)` at module scope) resolves its element type
+// instead of defaulting to f64. Guard against local shadows / dynamic rewrites (cf. kind.js).
+const typedElemCtorOf = (name, locals) =>
+  ctx.func.localTypedElemsOverlay?.get(name) ?? ctx.types.typedElem?.get(name)
+    ?? (!locals?.has?.(name) && !ctx.types?.dynWriteVars?.has?.(name)
+      ? ctx.scope?.globalTypedElem?.get(name) : undefined)
+
+// An expression whose i32 value carries the unsigned [0, 2^32) magnitude (not a signed i32):
+// `>>>`, an unsigned-result call, or a Uint32Array read (aux 5 — the only typed array whose
+// element can exceed signed-i32 range). The +/-/*/% rules widen these to f64 so `U[i] + 1`
+// near 2^32 doesn't wrap; bitwise/store consumers are ToInt32-exact and keep the i32 bits.
+const isUnsignedI32Expr = (e, locals) => Array.isArray(e) && (
   e[0] === '>>>' ||
-  (e[0] === '()' && typeof e[1] === 'string' && ctx.func.map?.get(e[1])?.sig?.unsignedResult === true)
+  (e[0] === '()' && typeof e[1] === 'string' && ctx.func.map?.get(e[1])?.sig?.unsignedResult === true) ||
+  (e[0] === '[]' && typeof e[1] === 'string' && typedElemAux(typedElemCtorOf(e[1], locals)) === 5)
 )
 
 /**
@@ -380,12 +397,16 @@ export function exprType(expr, locals) {
     if (locals?.has?.(expr)) return locals.get(expr)
     const paramType = ctx.func.current?.params?.find(p => p.name === expr)?.type
     if (paramType) return paramType
-    // Module-level numeric consts (top-level `const N = 128`) are emitted as
-    // wasm globals with a known wasm type. Without this lookup, references to
-    // them inside functions fall back to f64, widening counters bounded by the
-    // const (`for (let r = 0; r < N_ROUNDS; r++)`) to f64 via the comparison
-    // pass. Only propagate primitive numeric kinds — i64 globals are reserved
-    // for the NaN-box carrier ABI and shouldn't influence local typing.
+    // A module-level INTEGER const (`const N = 16384`) is an integer compile-time
+    // constant — type it i32 when it fits, regardless of the global's f64 (NaN-box)
+    // storage. Otherwise a counter bounded by it (`for (i=0; i<N; i++)`) widens to
+    // f64 and `x % N` / `x & N` / `x / N` take the f64 round-trip instead of the
+    // native integer path (i32.rem_s / i32.and / i32.shr). Mirrors a literal int.
+    const ci = ctx.scope?.constInts?.get?.(expr)
+    if (ci != null && isI32(ci)) return 'i32'
+    // Module-level numeric consts emitted as wasm globals with a known wasm type.
+    // Only propagate primitive numeric kinds — i64 globals are reserved for the
+    // NaN-box carrier ABI and shouldn't influence local typing.
     const gt = ctx.scope?.globalTypes?.get?.(expr)
     if (gt === 'i32' || gt === 'f64') return gt
     return 'f64'
@@ -401,44 +422,41 @@ export function exprType(expr, locals) {
 
   // Always f64
   if (op === '/' || op === '**' || op === '[' || op === '{}' || op === 'str') return 'f64'
-  // arr[i] — typed integer arrays return i32. Only Int8/Uint8/Int16/Uint16/Int32
-  // (every value fits in signed i32). Skip Uint32: 0..2^32-1 overflows signed.
-  // During analyzeBody the in-progress typedElems is in localTypedElemsOverlay;
-  // post-analyze passes read from ctx.types.typedElem.
+  // arr[i] — integer typed arrays (Int8/Uint8/Int16/Uint16/Int32/Uint32, aux 0..5) read as i32:
+  // the element IS a 32-bit machine integer, so a binding used in integer/bitwise ops stays i32
+  // instead of round-tripping i32.load → f64 → trunc back (the deopt that made packed-pixel fade
+  // loops like lorenz slow). Uint32 reads carry the full 0..2^32-1 range as the i32 bit-pattern;
+  // ToInt32-coercing uses (& | ^ << >> >>>, i32.store) are bit-exact, and value uses that need the
+  // unsigned magnitude (compare, f64 convert) go through the elem-aux's unsigned path. Floats
+  // (Float32/Float64, aux 6/7) genuinely yield f64. typedElems: in-progress reads come from
+  // localTypedElemsOverlay during analyzeBody; post-analyze passes read ctx.types.typedElem.
   if (op === '[]') {
     if (typeof args[0] === 'string') {
-      const ctor = ctx.func.localTypedElemsOverlay?.get(args[0]) ?? ctx.types.typedElem?.get(args[0])
+      // Resolve the element ctor across local overlay → per-func map → module-global registry
+      // (the global fallback is why `DX[i]` on a module-scope Int32Array types as i32 instead of
+      // f64-round-tripping integer accumulation like `ax = ax + DX[i]`). See typedElemCtorOf.
+      const ctor = typedElemCtorOf(args[0], locals)
       if (ctor) {
         const aux = typedElemAux(ctor)
-        if (aux != null && (aux & 7) <= 4) return 'i32'
+        if (aux != null && (aux & 7) <= 5) return 'i32'
       }
     }
     return 'f64'
   }
-  // `.length` on a known sized receiver returns i32 directly (__len/__str_byteLen
-  // both return i32). Letting it stay i32 lets analyzeBody keep the counter
-  // local i32 too, eliminating the per-iteration `f64.convert_i32_s` widen and
-  // the matching `i32.trunc_sat_f64_s` truncs at every `arr[i]` / `i*k` site.
-  // Only safe when receiver type is statically known to expose an integer length.
+  // A sized built-in property on a statically-known receiver (`.length` on
+  // STRING/ARRAY/TYPED, `.size` on SET/MAP, `.byteLength`/`.byteOffset` on
+  // TYPED/BUFFER) returns i32 directly (`__len`/`__str_byteLen` return i32).
+  // Keeping it i32 lets analyzeBody keep the counter local i32, eliminating the
+  // per-iteration `f64.convert_i32_s` widen and matching `arr[i]`/`i*k` truncs.
+  // The membership lives in one place — `propValType` (src/kind-traits.js).
   if (op === '.') {
-    if (args[1] === 'length' && typeof args[0] === 'string') {
-      const vt = lookupValType(args[0])
-      if (vt === VAL.TYPED || vt === VAL.ARRAY || vt === VAL.STRING || vt === VAL.BUFFER) return 'i32'
-    }
-    if (args[1] === 'size' && typeof args[0] === 'string') {
-      const vt = lookupValType(args[0])
-      if (vt === VAL.SET || vt === VAL.MAP) return 'i32'
-    }
-    if (args[1] === 'byteLength' && typeof args[0] === 'string') {
-      const vt = lookupValType(args[0])
-      if (vt === VAL.BUFFER || vt === VAL.TYPED) return 'i32'
-    }
+    if (typeof args[0] === 'string' && propValType(args[1], lookupValType(args[0])) === VAL.NUMBER) return 'i32'
     return 'f64'
   }
   // Comparisons, logical-not, and unsigned shift always yield an i32 — a boolean,
   // or a ToUint32 result. True even on BigInt operands (`>>>` throws on bigint, so
   // it never reaches here with one).
-  if (['>', '<', '>=', '<=', '==', '!=', '!', '>>>'].includes(op)) return 'i32'
+  if (CMP_OPS.has(op) || op === '>>>') return 'i32'
   // Bitwise & signed-shift: i32 on numbers, but f64 when operands are BigInt — the
   // result is a bigint carried in the i64-bits-as-f64 ABI, not a 32-bit int.
   if (['&', '|', '^', '~', '<<', '>>'].includes(op))
@@ -451,7 +469,7 @@ export function exprType(expr, locals) {
     // A uint32 operand ([0, 2^32)) makes the result exceed signed i32 range, so
     // emit widens to f64 (see emit.js `+`/`-`). exprType must agree — else
     // narrowing the result back to i32 would trunc_sat-saturate the f64 to INT32_MAX.
-    if (isUnsignedI32Expr(args[0]) || (args[1] != null && isUnsignedI32Expr(args[1]))) return 'f64'
+    if (isUnsignedI32Expr(args[0], locals) || (args[1] != null && isUnsignedI32Expr(args[1], locals))) return 'f64'
     return 'i32'
   }
   // `%` is i32 only when emit takes the i32.rem_s path: both operands i32, neither
@@ -461,7 +479,7 @@ export function exprType(expr, locals) {
   if (op === '%') {
     const ta = exprType(args[0], locals), tb = exprType(args[1], locals)
     if (ta !== 'i32' || tb !== 'i32') return 'f64'
-    if (isUnsignedI32Expr(args[0]) || isUnsignedI32Expr(args[1])) return 'f64'
+    if (isUnsignedI32Expr(args[0], locals) || isUnsignedI32Expr(args[1], locals)) return 'f64'
     const dv = staticValue(args[1])
     return (dv !== NO_VALUE && typeof dv === 'number' && dv !== 0 && Number.isInteger(dv)) ? 'i32' : 'f64'
   }
@@ -474,11 +492,15 @@ export function exprType(expr, locals) {
     const ta = exprType(args[0], locals), tb = exprType(args[1], locals)
     if (ta !== 'i32' || tb !== 'i32') return 'f64'
     // uint32 operand: product can exceed i32; emit widens to f64 (see emit.js `*`).
-    if (isUnsignedI32Expr(args[0]) || isUnsignedI32Expr(args[1])) return 'f64'
+    if (isUnsignedI32Expr(args[0], locals) || isUnsignedI32Expr(args[1], locals)) return 'f64'
     if (sv !== NO_VALUE && typeof sv === 'number') return isI32(sv) ? 'i32' : 'f64'
+    // Shared FITS_I32_MAX threshold (widen.js) keeps this in lock-step with emit's
+    // `mulFitsI32`. exprType only proves the static-literal case — a strict SUBSET of
+    // emit's i32 verdict (emit also admits masked-bound operands), which is the safe
+    // direction: never claim i32 where emit might widen to f64.
     const small = e => {
       const v = staticValue(e)
-      return v !== NO_VALUE && typeof v === 'number' && Math.abs(v) <= 0x400000
+      return v !== NO_VALUE && typeof v === 'number' && Math.abs(v) <= FITS_I32_MAX
     }
     return small(args[0]) || small(args[1]) ? 'i32' : 'f64'
   }
@@ -501,7 +523,7 @@ export function exprType(expr, locals) {
     // hand a scalar back (i32x4.lane / v128.anyTrue / v128.allTrue → i32;
     // f32x4.lane → f64). See module/simd.js.
     if (typeof args[0] === 'string' && (args[0].startsWith('f32x4.') || args[0].startsWith('i32x4.') || args[0].startsWith('f64x2.') || args[0].startsWith('v128.'))) {
-      if (args[0] === 'f32x4.lane') return 'f64'
+      if (args[0] === 'f32x4.lane' || args[0] === 'f64x2.lane') return 'f64'
       if (args[0] === 'i32x4.lane' || args[0] === 'v128.anyTrue' || args[0] === 'v128.allTrue') return 'i32'
       return 'v128'
     }
@@ -527,7 +549,6 @@ export function exprType(expr, locals) {
 // === Integer-certainty fixpoint (shared by analyzeIntCertain + program-facts) ===
 
 const INT_BIT_OPS = new Set(['|', '&', '^', '~', '<<', '>>', '>>>'])
-const INT_CMP_OPS = new Set(['<', '>', '<=', '>=', '==', '!=', '===', '!==', '!'])
 const INT_CLOSED_OPS = new Set(['+', '-', '*'])  // `%` handled separately — int only for nonzero divisor
 const INT_MATH_FNS = new Set(['imul', 'clz32', 'floor', 'ceil', 'round', 'trunc'])
 
@@ -548,7 +569,7 @@ function collectIntDefs(body) {
     } else if (op === '=' && typeof args[0] === 'string') {
       pushDef(args[0], args[1])
     } else if (typeof op === 'string' && op.length > 1 && op.endsWith('=') &&
-               !INT_CMP_OPS.has(op) && op !== '=>' && typeof args[0] === 'string') {
+               !CMP_OPS.has(op) && op !== '=>' && typeof args[0] === 'string') {
       pushDef(args[0], [op.slice(0, -1), args[0], args[1]])
     } else if ((op === '++' || op === '--') && typeof args[0] === 'string') {
       pushDef(args[0], [op === '++' ? '+' : '-', args[0], [null, 1]])
@@ -574,18 +595,9 @@ function makeIsIntExpr(intCertain) {
       if (typeof v === 'boolean') return true
       return false
     }
-    if (INT_BIT_OPS.has(op) || INT_CMP_OPS.has(op)) return true
-    if (op === '.') {
-      if ((args[1] === 'length' || args[1] === 'byteLength') && typeof args[0] === 'string') {
-        const vt = lookupValType(args[0])
-        return vt === VAL.TYPED || vt === VAL.ARRAY || vt === VAL.STRING || vt === VAL.BUFFER
-      }
-      if (args[1] === 'size' && typeof args[0] === 'string') {
-        const vt = lookupValType(args[0])
-        return vt === VAL.SET || vt === VAL.MAP
-      }
-      return false
-    }
+    if (INT_BIT_OPS.has(op) || CMP_OPS.has(op)) return true
+    if (op === '.')
+      return typeof args[0] === 'string' && propValType(args[1], lookupValType(args[0])) === VAL.NUMBER
     if (INT_CLOSED_OPS.has(op)) {
       const a = isIntExpr(args[0])
       const b = args[1] != null ? isIntExpr(args[1]) : a