jz 0.7.0 → 0.8.0

package/src/optimize/index.js

@@ -29,13 +29,15 @@
 
 import { LAYOUT, ctx } from '../ctx.js'
 import { VAL } from '../reps.js'
-import { findBodyStart, buildRefcount, nextLocalId, verifyFn } from '../ir.js'
+import { findBodyStart, buildRefcount, nextLocalId, verifyFn, isPureIR, f64Range, I32_MIN, I32_MAX } from '../ir.js'
 
 // Debug-mode IR structural check (JZ_DEBUG_INVARIANTS=1). Zero production cost.
 const DBG_IR = typeof process !== 'undefined' && process.env?.JZ_DEBUG_INVARIANTS === '1'
-import { T } from '../ast.js'
+import { T, isLeaf, stableKey } from '../ast.js'
 import { vectorizeLaneLocal } from './vectorize.js'
-import { nanPrefixHex, atomNanHex, STR_INTERN_BIT } from '../../layout.js'
+import { recursionUnroll } from './recurse.js'
+export { SIMD_PINNED } from './vectorize.js'
+import { nanPrefixHex, atomNanHex, STR_INTERN_BIT, ptrBits, i64Hex, PTR, TYPED_ELEM_CODE, TYPED_ELEM_VIEW_FLAG } from '../../layout.js'
 
 const MEMOP = /^[fi](32|64)\.(load|store)(\d+(_[su])?)?$/
 const NAN_BITS = nanPrefixHex()
@@ -66,7 +68,7 @@ const FALSE_BITS = atomNanHex(4)
  *   'speed' — full nested unroll + lane vectorization (= level 3).
  * The default (level 2) has no string name — omit `optimize` or pass `2`.
  *
- * # Two-layer contract (this file vs src/wat/optimize.js)
+ * # Two-layer contract (this file vs watr/optimize)
  * Both layers walk the same S-expression IR; the boundary is KNOWLEDGE, not
  * representation:
  *   - THIS layer owns every pass that needs jz semantics — NaN-box layout
@@ -74,7 +76,7 @@ const FALSE_BITS = atomNanHex(4)
  *     func nodes (cseScalarLoad's cseLoadBases whitelist), loop shapes as emit
  *     produces them (narrowLoopBound, hoistInvariantLoop, vectorizeLaneLocal),
  *     and ctx-derived module facts (hoistGlobalPtrOffset's typed-global set).
- *   - wat/optimize.js owns generic structural rewrites — const folding,
+ *   - watr/optimize owns generic structural rewrites — const folding,
  *     copy-prop, branch/DCE/vacuum, dedupe, treeshake, and inlineOnce. One
  *     deliberate exception: guardRefine lives there despite NaN-box knowledge,
  *     because the dead tag-dispatch shapes it folds only EXIST after that
@@ -98,8 +100,10 @@ export const PASS_NAMES = [
   'hoistGlobalPtrOffset',     // stable typed GLOBALS: __ptr_offset resolve → once per function (post-watr, module-level)
   'fusedRewrite',             // peephole + ptr-helper inline + memarg fold
   'hoistAddrBase',
+  'boolConvertToSelect',      // f64 ± (cond?1:0) → branchless select (kills i32↔f64 domain cross on recurrences)
   'cseScalarLoad',
   'csePureExpr',
+  'unswitchTypedParamLoop',   // Float64Array param loop-unswitch → base-hoisted f64.load/store fast path (vectorizes)
   'dropDeadZeroInit',
   'deadStoreElim',
   'promoteGlobals',          // read-only global.get → local for multi-read globals
@@ -113,6 +117,7 @@ export const PASS_NAMES = [
   'smallConstForUnroll',
   'nestedSmallConstForUnroll',
   'vectorizeLaneLocal',       // SIMD-128 lift for lane-pure typed-array loops
+  'recursionUnroll',          // inline a single non-tail self-call to depth N (tree-recursion call-overhead)
   'arenaRewind',              // per-call heap rewind for no-arg scalar allocator kernels
   'treeshake',
   'jsstring',                 // boundary opt-in: flip exported string params to externref
@@ -127,7 +132,9 @@ const LEVEL_PRESETS = Object.freeze({
   // force 'light' mode here (inline / inlineOnce / coalesce all off) to dodge the
   // W1a/W1b miscompiles; watr 4.6.9 fixes both, and the L2 default now runs the full
   // watr pipeline. `inline` stays off by watr's own default — opt-in only.
-  2: Object.freeze({ ...ALL_ON, nestedSmallConstForUnroll: 'auto' }),
+  // boolConvertToSelect off at the default level: it's a latency-for-size trade (adds a
+  // const + op per site) that only pays off on serial recurrences — speed-tier only.
+  2: Object.freeze({ ...ALL_ON, nestedSmallConstForUnroll: 'auto', boolConvertToSelect: false, recursionUnroll: false }),
   // L3/'speed' trades a bit of heap headroom for fewer __arr_grow / __hash growth
   // cycles. arrayMinCap=16 means `[]` and `new Array()` skip the first two doublings
   // (0→2→4→8→16); hashSmallInitCap=8 keeps per-object __dyn_props at the same load
@@ -143,12 +150,15 @@ const LEVEL_PRESETS = Object.freeze({
   // closures). Inline `f64.const` is the minimal lowering: V8 CSEs identical
   // constants for free. Measured −3% on jessie parse for +14% binary — exactly
   // the size↔speed trade 'speed' exists to make.
-  3: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8, reduceUnroll: true, relaxedSimd: true, inlineFns: true }),
+  3: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8, reduceUnroll: true, relaxedSimd: true, inlineFns: true, rotateLoops: true }),
   // 'size' tightens scalar/unroll caps; 'speed' = level 3. There is no 'balanced'
   // preset — it was a pure synonym for the default level 2 (omit `optimize` or pass 2).
   size: Object.freeze({
     ...ALL_ON,
     smallConstForUnroll: false, nestedSmallConstForUnroll: false, vectorizeLaneLocal: false, splitCharScan: false,
+    recursionUnroll: false,   // body tripling is a size regression — speed-only
+
+    boolConvertToSelect: false,  // adds a const + op per site — speed-only latency trade
     devirtIndirect: false,    // guards + duplicated args grow bytes — speed-only trade
     internStrings: false,     // the intern index costs ~16 B per eligible literal — speed-only trade
     scalarTypedLoopUnroll: 4, scalarTypedNestedUnroll: 8, scalarTypedArrayLen: 8,
@@ -163,7 +173,7 @@ const LEVEL_PRESETS = Object.freeze({
   // (The stencil + outer-strip vectorizers are NOT level-gated here: they're bit-exact pure wins
   // like the base lane vectorizer, so they run whenever it does — default-on at level 2+ via
   // `cfg.experimentalStencil !== false` at the call site, not a speed-only size/precision trade.)
-  speed: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8, reduceUnroll: true, relaxedSimd: true, inlineFns: true }),
+  speed: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8, reduceUnroll: true, relaxedSimd: true, inlineFns: true, rotateLoops: true }),
 })
 
 /**
@@ -201,6 +211,11 @@ export function resolveOptimize(opt) {
     }
     // Preserve non-pass tuning keys (e.g. plan.js thresholds)
     for (const k of Object.keys(opt)) if (!PASS_NAMES.includes(k)) out[k] = opt[k]
+    // noSimd: suppress EVERY jz-emitted v128 — both the lane vectorizer AND the SLP
+    // store-pair packer. First-class here so `{ level:'speed', noSimd:true }` is a TRUE
+    // scalar baseline whether passed nested or via the top-level opts.noSimd flag; the
+    // SIMD-vs-scalar correctness oracles depend on it actually disabling SLP.
+    if (out.noSimd) { out.vectorizeLaneLocal = false; out.experimentalSlp = false }
     return out
   }
   return { ...ALL_ON }
@@ -399,12 +414,39 @@ function regionTrackCSE(fn, { matchSite, localPrefix, localType }) {
  * Must run AFTER fusedRewrite — relies on shl-distribution + assoc-lift +
  * foldMemargOffsets having normalized the base shape.
  */
+// Pure i32 ops whose value is a function of locals/consts alone — no memory read,
+// no call, no global. A subscript expression built only from these is invariant
+// between two sites as long as none of its local deps is rewritten between them,
+// so CSE-ing the WHOLE address (base + shl(idx)) is value-safe — even when `idx`
+// is a compound stencil offset like `(i32.sub (i32.add idx W) 1)` for `arr[idx+W-1]`.
+const PURE_I32_ADDR_OPS = new Set([
+  'i32.add', 'i32.sub', 'i32.mul', 'i32.shl', 'i32.shr_s', 'i32.shr_u',
+  'i32.and', 'i32.or', 'i32.xor', 'i32.wrap_i64',
+])
+// Serialize a pure-i32 subscript to a stable key, accumulating its local deps.
+// Returns null if any leaf isn't a local.get / i32.const / pure-i32 op (a load,
+// call, or global.get could change between sites — not CSE-safe by local tracking).
+function pureI32AddrKey(node, deps) {
+  if (!Array.isArray(node)) return null
+  const op = node[0]
+  if (op === 'local.get' && typeof node[1] === 'string') { deps.add(node[1]); return `$${node[1]}` }
+  if (op === 'i32.const' && typeof node[1] === 'number') return `#${node[1]}`
+  if (!PURE_I32_ADDR_OPS.has(op)) return null
+  let key = op + '('
+  for (let i = 1; i < node.length; i++) {
+    const sub = pureI32AddrKey(node[i], deps)
+    if (sub == null) return null
+    key += sub + ','
+  }
+  return key + ')'
+}
+
 export function hoistAddrBase(fn) {
   return regionTrackCSE(fn, {
     matchSite(node) {
       if (node[0] !== 'i32.add' || node.length !== 3) return null
       const a = node[1], b = node[2]
-      // Two orderings: (add (get A) (shl (get B) (const K))) or (add (shl …) (get A))
+      // Two orderings: (add (get A) (shl IDX (const K))) or (add (shl …) (get A))
       let baseGet, shlNode
       if (Array.isArray(a) && a[0] === 'local.get' && typeof a[1] === 'string' &&
           Array.isArray(b) && b[0] === 'i32.shl' && b.length === 3) {
@@ -414,15 +456,88 @@ export function hoistAddrBase(fn) {
         baseGet = b; shlNode = a
       } else return null
       const idx = shlNode[1], shamt = shlNode[2]
-      if (!Array.isArray(idx) || idx[0] !== 'local.get' || typeof idx[1] !== 'string') return null
       if (!Array.isArray(shamt) || shamt[0] !== 'i32.const' || typeof shamt[1] !== 'number') return null
-      return { key: `${baseGet[1]}|${idx[1]}|${shamt[1]}`, deps: [baseGet[1], idx[1]] }
+      // idx may be a plain `local.get` (the original biquad case) or any compound
+      // pure-i32 subscript (stencil neighbour `arr[idx+W-1]`); both CSE the same way.
+      const deps = new Set([baseGet[1]])
+      const idxKey = pureI32AddrKey(idx, deps)
+      if (idxKey == null) return null
+      return { key: `${baseGet[1]}|${idxKey}|${shamt[1]}`, deps: [...deps] }
     },
     localPrefix: 'ab',
     localType: 'i32',
   })
 }
 
+// wasm comparison ops — each yields an i32 that is exactly 0 or 1.
+const BOOL_RESULT_OPS = new Set([
+  'i32.eqz', 'i64.eqz',
+  'i32.eq', 'i32.ne', 'i32.lt_s', 'i32.lt_u', 'i32.gt_s', 'i32.gt_u', 'i32.le_s', 'i32.le_u', 'i32.ge_s', 'i32.ge_u',
+  'i64.eq', 'i64.ne', 'i64.lt_s', 'i64.lt_u', 'i64.gt_s', 'i64.gt_u', 'i64.le_s', 'i64.le_u', 'i64.ge_s', 'i64.ge_u',
+  'f32.eq', 'f32.ne', 'f32.lt', 'f32.gt', 'f32.le', 'f32.ge',
+  'f64.eq', 'f64.ne', 'f64.lt', 'f64.gt', 'f64.le', 'f64.ge',
+])
+
+/**
+ * `f64 ± (cond ? 1 : 0)` → branchless f64 `select`, killing the i32↔f64 domain cross.
+ *
+ * `err = old - (old >= t)` and friends compile to `f64.sub(X, f64.convert_i32_s(cmp))`.
+ * The convert (cvtsi2sd) round-trips the comparison result out of a GPR back into an
+ * XMM register — a domain-crossing op that sits ON the value's def chain. In the
+ * per-pixel error-diffusion sweeps (Floyd–Steinberg / Atkinson / JJN) and scalar IIR
+ * thresholds this chain is the loop-carried critical path, so that one cross roughly
+ * doubles the per-step latency (V8 keeps the JS threshold entirely in the FP domain).
+ *
+ * `X - (B?1:0) ≡ (B ? X-1 : X) ≡ select(X-1, X, B)`  (likewise `+` → `select(X+1, X, B)`),
+ * which never leaves the f64 domain. `select` evaluates BOTH arms, so X must be a
+ * side-effect-free duplicable leaf (a `local.get`/const); B is the i32 condition,
+ * evaluated once (exactly as the convert did). A pure win on latency-bound recurrences;
+ * speed-gated (it adds a const + an arithmetic op — a size↔speed trade) — off at 'size'.
+ */
+function boolConvertToSelect(fn) {
+  if (!Array.isArray(fn) || fn[0] !== 'func') return
+  // Pass 1 — a local whose SOLE definition is a comparison carries a value ∈ {0,1};
+  // `err = old - on` (on reused by putBW) reaches us as `convert(local.get $on)`.
+  // A param is EXCLUDED even if reassigned once by a comparison: its incoming arg is
+  // unconstrained, so a read before the reassignment isn't 0/1. (A plain local read
+  // before its def is safe — wasm zero-inits it to 0 = false, which select preserves.)
+  const params = new Set()
+  for (let i = 2; i < fn.length; i++) if (Array.isArray(fn[i]) && fn[i][0] === 'param') params.add(fn[i][1])
+  const defCount = new Map(), defIsCmp = new Map()
+  const scan = (n) => {
+    if (!Array.isArray(n)) return
+    if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') {
+      defCount.set(n[1], (defCount.get(n[1]) || 0) + 1)
+      const cmp = Array.isArray(n[2]) && BOOL_RESULT_OPS.has(n[2][0])
+      defIsCmp.set(n[1], (defIsCmp.has(n[1]) ? defIsCmp.get(n[1]) : true) && cmp)
+    }
+    for (let i = 1; i < n.length; i++) scan(n[i])
+  }
+  scan(fn)
+  const boolLocals = new Set()
+  for (const [name, c] of defCount) if (c === 1 && defIsCmp.get(name) && !params.has(name)) boolLocals.add(name)
+
+  const isBool01 = (n) => Array.isArray(n) &&
+    (BOOL_RESULT_OPS.has(n[0]) || (n[0] === 'local.get' && boolLocals.has(n[1])))
+  const dup = (n) => Array.isArray(n) ? n.map(dup) : n
+
+  // Pass 2 — bottom-up rewrite.
+  const rewrite = (n) => {
+    if (!Array.isArray(n)) return n
+    for (let i = 1; i < n.length; i++) n[i] = rewrite(n[i])
+    if ((n[0] === 'f64.sub' || n[0] === 'f64.add') && n.length === 3) {
+      const conv = (m) => Array.isArray(m) && (m[0] === 'f64.convert_i32_s' || m[0] === 'f64.convert_i32_u') && isBool01(m[1])
+      // `X - bool`, `X + bool`, or (add is commutative) `bool + X`.
+      let X = null, B = null
+      if (conv(n[2]) && isLeaf(n[1])) { X = n[1]; B = n[2][1] }
+      else if (n[0] === 'f64.add' && conv(n[1]) && isLeaf(n[2])) { X = n[2]; B = n[1][1] }
+      if (X) return ['select', [n[0], dup(X), ['f64.const', 1]], dup(X), B]
+    }
+    return n
+  }
+  rewrite(fn)
+}
+
 /**
  * Hoist `(call $__ptr_offset (local.get $X))` to a function-entry snapshot
  * when X is an f64-NaN-boxed parameter that's never reassigned and only ever
@@ -442,6 +557,20 @@ export function hoistAddrBase(fn) {
 // loop-invariant __jss_length in the same loop condition CAN hoist).
 const SAFE_OFFSET_CALLS = new Set(['$__ptr_offset', '$__ptr_type', '$__ptr_aux', '$__len', '$__jss_length', '$__jss_charCodeAt'])
 
+// wasm comparison-op mantissas (the part after the `.`): they yield i32 regardless of
+// operand width (i64.eq, f64.lt, i32.ge_s, …). `eq`/`ne` are sign-agnostic; the ordered
+// compares carry `_s`/`_u` for the integer types and none for f64. Used by resultType to
+// type a hoisted subtree by its root op. A Set membership test, NOT a regex
+// (`/^(eq|ne|lt|gt|le|ge)(_[su])?$/`): the regex mis-anchored under self-host −O2 — `nearest`
+// (the f64.nearest mantissa, from Math.round) starts with `ne`, and the embedded −O2 build
+// matched it as a comparison → the LICM hoist local got typed i32, so `local.set $__li
+// (f64.nearest …)` emitted invalid wasm (f64 into i32) only in the kernel. Explicit string
+// membership is both self-host-robust and cheaper in this LICM-hot path.
+const CMP_MANTISSA = new Set([
+  'eqz', 'eq', 'ne', 'lt', 'gt', 'le', 'ge',
+  'lt_s', 'lt_u', 'gt_s', 'gt_u', 'le_s', 'le_u', 'ge_s', 'ge_u',
+])
+
 // Calls that don't modify EXISTING heap memory: they may allocate (bump the heap
 // pointer) or do tag dispatch, but they never write to an address a hoisted
 // __typed_idx/__str_idx element read would revisit. Their presence must not
@@ -610,6 +739,136 @@ const PURE_LICM_OPS = new Set([
   'f64.promote_f32', 'f32.demote_f64', 'select',
 ])
 
+// Resolve a load/store address back to the single typed-array PARAM it derives from — through
+// `local.get`, the arithmetic in PURE_LICM_OPS, and single-def snap locals ($__li/$__ab) — or
+// null if not exactly one / unprovable (a multi-def or unknown local in the address). Built once
+// per function over the proven-distinct `distinctParams` set; the alias substrate both LICM
+// passes query to hoist a read-only input load across a distinct-buffer store (raytrace's spheres
+// vs framebuffer — the alias-analysis LICM rust/clang get for free).
+function buildBaseParamOf(fn, bodyStart, distinctParams) {
+  if (!distinctParams) return () => null
+  const paramNames = new Set()
+  for (let i = 2; i < bodyStart; i++)
+    if (Array.isArray(fn[i]) && fn[i][0] === 'param' && typeof fn[i][1] === 'string') paramNames.add(fn[i][1])
+  const singleDef = new Map(), defCount = new Map()
+  const scanDefs = (n) => {
+    if (!Array.isArray(n)) return
+    if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') {
+      defCount.set(n[1], (defCount.get(n[1]) || 0) + 1); singleDef.set(n[1], n[2]); scanDefs(n[2]); return
+    }
+    for (let i = 1; i < n.length; i++) scanDefs(n[i])
+  }
+  for (let i = bodyStart; i < fn.length; i++) scanDefs(fn[i])
+  for (const [k, c] of defCount) if (c > 1) singleDef.delete(k)   // multi-def → can't trust the resolution
+  return (addr) => {
+    const found = new Set(); const seen = new Set(); let bad = false
+    const walk = (n) => {
+      if (bad || !Array.isArray(n)) return
+      if (n[0] === 'local.get' && typeof n[1] === 'string') {
+        if (paramNames.has(n[1])) found.add(n[1])
+        else if (singleDef.has(n[1]) && !seen.has(n[1])) { seen.add(n[1]); walk(singleDef.get(n[1])) }
+        else bad = true   // a written/unknown local in the address → base unprovable
+        return
+      }
+      for (let i = 1; i < n.length; i++) walk(n[i])
+    }
+    walk(addr)
+    return !bad && found.size === 1 ? [...found][0] : null
+  }
+}
+
+// Per-loop invariance/purity analysis — the single proven predicate both LICM passes share.
+// Scans the loop into an effect summary (locals/globals it writes, cells/buffers it stores to,
+// whether it has any call / unsafe call / direct store / v128 op), then closes `pureGiven(node,
+// bound)` over it: true iff `node` is side-effect-free AND loop-invariant, given that the locals
+// in `bound` are private to the candidate (a `local.get` of a bound local reads the in-subtree
+// teed invariant; a free `local.get` must be unwritten by the loop). Memory leaves are admitted
+// only under the summary: a `$__cell_`/distinct-param load iff no aliasing store + no call; a
+// SAFE_OFFSET/READONLY_MEM call iff no unsafe call (+ no direct store for heap reads).
+function loopInvariance(loopNode, { distinctParams, baseParamOf }) {
+  const locals = new Set(), globals = new Set(), storedCells = new Set(), storedBases = new Set()
+  let hasUnsafeCall = false, hasAnyCall = false, hasDirectStore = false, hasV128 = false
+  const scan = (node) => {
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    // A vectorized loop (lane/v128 ops) is already register-tight and hand-tuned;
+    // extra scalar hoisting there only adds spill pressure — keep it conservative.
+    if (op.startsWith('v128.') || /^[if]\d+x\d+\./.test(op)) hasV128 = true
+    if (op === 'local.set' || op === 'local.tee') { if (typeof node[1] === 'string') locals.add(node[1]); for (let i = 2; i < node.length; i++) scan(node[i]); return }
+    if (op === 'global.set') { if (typeof node[1] === 'string') globals.add(node[1]); for (let i = 2; i < node.length; i++) scan(node[i]); return }
+    if (op === 'call') { hasAnyCall = true; if (!SAFE_OFFSET_CALLS.has(node[1]) && !READONLY_MEM_CALLS.has(node[1]) && !NON_MUTATING_CALLS.has(node[1])) hasUnsafeCall = true; for (let i = 2; i < node.length; i++) scan(node[i]); return }
+    if (op === 'call_ref' || op === 'call_indirect') { hasAnyCall = hasUnsafeCall = true; for (let i = 1; i < node.length; i++) scan(node[i]); return }
+    if ((op === 'f64.store' || op === 'i32.store') && node.length >= 3) {
+      hasDirectStore = true
+      const a = node[1]
+      if (Array.isArray(a) && a[0] === 'local.get' && typeof a[1] === 'string' && a[1].startsWith(CELL_PREFIX)) storedCells.add(a[1])
+      if (distinctParams) { const sb = baseParamOf(a); if (sb) storedBases.add(sb) }   // alias: which buffers this loop writes
+    }
+    for (let i = 1; i < node.length; i++) scan(node[i])
+  }
+  for (let i = 1; i < loopNode.length; i++) scan(loopNode[i])
+
+  const pureGiven = (node, bound) => {
+    if (!Array.isArray(node)) return true   // bare operand string/number
+    const op = node[0]
+    if (op === 'i32.const' || op === 'i64.const' || op === 'f64.const' || op === 'f32.const') return true
+    if (op === 'local.get') return typeof node[1] === 'string' && (bound.has(node[1]) || !locals.has(node[1]))
+    // A global is invariant only if not set directly AND no call in the loop —
+    // any callee may mutate it (no interprocedural effect analysis). (Locals are
+    // frame-private, so calls can't touch them; only direct local.set matters.)
+    if (op === 'global.get') return typeof node[1] === 'string' && !globals.has(node[1]) && !hasAnyCall
+    if (op === 'local.tee') {
+      if (typeof node[1] !== 'string') return false
+      // The operand is evaluated BEFORE the tee writes $X, so a `local.get $X` inside
+      // it reads the loop-carried (previous-iteration) value, not the teed one. Drop
+      // $X from `bound` for the operand: `local.tee $X (… $X …)` is a loop recurrence
+      // (X = f(X) — e.g. the `while ((nn = nn >>> 1))` induction), NOT invariant.
+      const inner = bound.has(node[1]) ? new Set([...bound].filter(b => b !== node[1])) : bound
+      return pureGiven(node[2], inner)
+    }
+    if ((op === 'f64.load' || op === 'i32.load') && node.length === 2) {
+      const a = node[1]
+      if (Array.isArray(a) && a[0] === 'local.get' && typeof a[1] === 'string' && a[1].startsWith(CELL_PREFIX)
+        && !hasAnyCall && !storedCells.has(a[1]) && (bound.has(a[1]) || !locals.has(a[1]))) return true
+      // Alias-analysis LICM: a load from a typed-array param PROVEN distinct from every buffer
+      // this loop writes (base ∉ storedBases) is loop-invariant when its address is invariant —
+      // even across the loop's stores, because they can't alias it. This is what lets rust/clang
+      // hoist read-only input arrays out of a write loop (raytrace's spheres vs the framebuffer).
+      // `pureGiven(a, bound)` proves the address itself invariant (base param unwritten + invariant
+      // offset); the calls guard rules out callee memory mutation.
+      if (distinctParams && !hasAnyCall) {
+        const base = baseParamOf(a)
+        if (base && distinctParams.has(base) && !storedBases.has(base) && pureGiven(a, bound)) return true
+      }
+      return false
+    }
+    if (op === 'call') {
+      if (SAFE_OFFSET_CALLS.has(node[1]))
+        return !hasUnsafeCall && node.slice(2).every(c => pureGiven(c, bound))
+      // Read-only heap reads: additionally require no direct store (alias-safe).
+      if (READONLY_MEM_CALLS.has(node[1]))
+        return !hasUnsafeCall && !hasDirectStore && node.slice(2).every(c => pureGiven(c, bound))
+      return false
+    }
+    // A value-producing `if` whose condition and both arms are pure is itself
+    // pure — the tag-dispatch idiom `(if (result f64) tag-check (then read-A)
+    // (else read-B))` that wraps __typed_idx/__str_idx element access.
+    if (op === 'if') {
+      for (let i = 1; i < node.length; i++) {
+        const c = node[i]
+        if (!Array.isArray(c)) continue
+        if (c[0] === 'result') continue
+        if (c[0] === 'then' || c[0] === 'else') { if (!c.slice(1).every(x => pureGiven(x, bound))) return false }
+        else if (!pureGiven(c, bound)) return false   // the condition
+      }
+      return true
+    }
+    if (PURE_LICM_OPS.has(op)) return node.slice(1).every(c => pureGiven(c, bound))
+    return false
+  }
+  return { pureGiven, locals, globals, storedCells, storedBases, hasUnsafeCall, hasAnyCall, hasDirectStore, hasV128 }
+}
+
 /**
  * Unified loop-invariant code motion. One principle replaces the three former
  * pattern hoists (ToInt32 / __ptr_offset / cell-load): a MAXIMAL pure subtree
@@ -630,6 +889,160 @@ const PURE_LICM_OPS = new Set([
  * watr's shared CSE subtrees, snaps spliced before the loop, decls at bodyStart.
  * Idempotent: re-running sees only `(local.get $__liN)` and finds nothing to do.
  */
+// SSA-split loop-private straight-line multi-def scratch so the LICM below can hoist
+// the invariant versions. jz's unroller MERGES each unrolled iteration's `const x`
+// into one multi-def local (e.g. raytrace's sphere loop unrolls 8× sharing $ox/$c),
+// which the LICM cannot hoist — so the per-sphere invariant `c_i = sx_i²+sy_i²+sz_i²
+// −sr_i²` recomputes every pixel instead of once (the 1.24× rust-wasm gap; rust/LLVM
+// keeps them as distinct SSA values and hoists each). Renaming each def to its own
+// version makes them single-def → hoistInvariantLoop lifts the loop-invariant ones.
+//
+// BIT-EXACT: pure renaming + invariant code motion — the same value computed fewer
+// times, no reassociation. Gated to loops with NO v128, so it never disturbs a
+// vectorized loop (whose unrolled shared names the lane/dot vectorizer relies on).
+//
+// SOUND only for a local that, within the loop body, (a) is referenced NOWHERE else in
+// the function (loop-local lifetime — else a post-loop read of the merged name breaks),
+// (b) has every occurrence STRAIGHT-LINE (never under a nested if/block/loop, so a
+// linear walk assigns each use its unique dominating def), (c) is first accessed by a
+// WRITE (no value carried across the back-edge), (d) is only ever `local.set` (never
+// `local.tee`/conditionally defined). Each condition rejects a class that would miscompile.
+export function splitLoopPrivateScratch(fn) {
+  if (!Array.isArray(fn) || fn[0] !== 'func') return
+  const bodyStart = findBodyStart(fn)
+  if (bodyStart < 0) return
+  const SCALAR = new Set(['i32', 'i64', 'f64', 'f32'])
+  const localTypes = new Map()
+  for (let i = 2; i < bodyStart; i++) {
+    const c = fn[i]
+    if (Array.isArray(c) && (c[0] === 'param' || c[0] === 'local') && typeof c[1] === 'string') localTypes.set(c[1], c[2])
+  }
+  // Whole-function reference count per local (to verify a candidate is loop-local).
+  const fnRefs = new Map()
+  const countRefs = (n) => {
+    if (!Array.isArray(n)) return
+    if ((n[0] === 'local.get' || n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string')
+      fnRefs.set(n[1], (fnRefs.get(n[1]) || 0) + 1)
+    for (let i = 1; i < n.length; i++) countRefs(n[i])
+  }
+  for (let i = bodyStart; i < fn.length; i++) countRefs(fn[i])
+  // Same proven alias substrate hoistInvariantLoop uses (re-attached after watOptimize, so it
+  // survives into this 'post' pass) — lets pureGiven prove a read-only input-array load distinct
+  // from the loop's output store, the SOUND replacement for the old address-local-disjointness
+  // heuristic (which assumed two loads/stores in different locals never alias — false in general).
+  const distinctParams = fn.distinctParams || null
+  const baseParamOf = buildBaseParamOf(fn, bodyStart, distinctParams)
+
+  const hasV128 = (n) => {
+    let f = false
+    const w = (x) => { if (f || !Array.isArray(x)) return; const o = x[0]; if (typeof o === 'string' && (o.startsWith('v128') || /x(2|4|8|16)\b/.test(o) || o.includes('x2.') || o.includes('x4.') || o.includes('x8.') || o.includes('x16.'))) { f = true; return } for (let i = 1; i < x.length; i++) w(x[i]) }
+    w(n); return f
+  }
+  let minted = 0
+  const newDecls = []
+
+  const processLoop = (loop, parent, idx) => {
+    if (loop[0] !== 'loop' || hasV128(loop)) return
+    // Candidate names: locals set somewhere directly in the loop's statement list.
+    const seen = new Set()
+    for (let i = 2; i < loop.length; i++) {
+      const s = loop[i]
+      if (Array.isArray(s) && s[0] === 'local.set' && typeof s[1] === 'string') seen.add(s[1])
+    }
+    // Stage 1 — collect SAFE candidates (loop-local, straight-line, first-write, set-only,
+    // ≥2 defs) and record each one's def RHS list for the invariance fixpoint.
+    const cand = new Map()  // name → { defs: [rhs…] }
+    for (const name of seen) {
+      if (!SCALAR.has(localTypes.get(name))) continue
+      let inLoop = 0
+      const cnt = (n) => { if (!Array.isArray(n)) return; if ((n[0] === 'local.get' || n[0] === 'local.set' || n[0] === 'local.tee') && n[1] === name) inLoop++; for (let i = 1; i < n.length; i++) cnt(n[i]) }
+      cnt(loop)
+      if (inLoop !== (fnRefs.get(name) || 0)) continue
+      let safe = true, first = null, defs = []
+      const scan = (n, depth) => {
+        if (!safe || !Array.isArray(n)) return
+        const op = n[0]
+        if (op === 'local.tee' && n[1] === name) { safe = false; return }
+        if (op === 'local.set' && n[1] === name) {
+          if (depth > 0) { safe = false; return }
+          if (first === null) first = 'w'
+          defs.push(n[2])
+          scan(n[2], depth)
+          return
+        }
+        if (op === 'local.get' && n[1] === name) {
+          if (depth > 0) { safe = false; return }
+          if (first === null) first = 'r'
+          return
+        }
+        const ctrl = op === 'if' || op === 'then' || op === 'else' || op === 'block' || op === 'loop'
+        for (let i = 1; i < n.length; i++) scan(n[i], depth + (ctrl ? 1 : 0))
+      }
+      for (let i = 2; i < loop.length; i++) scan(loop[i], 0)
+      if (safe && first === 'w' && defs.length >= 2) cand.set(name, defs)
+    }
+    if (!cand.size) return
+    // Stage 2 — invariance fixpoint over the SHARED proven predicate. `pureGiven(def, hoistable)`
+    // decides loop-invariance with hoistInvariantLoop's exact model: a `$__cell_`/distinct-param
+    // read-only load is invariant across the loop's stores (sound alias analysis), a global is
+    // invariant only without a loop write or call, and the `bound` set (here `hoistable`) carries
+    // the cascade — a def reading an already-split sibling is invariant once that sibling moves out
+    // (c = ox²+… invariant only after ox hoists). `motionSafe` adds the one extra obligation a
+    // whole-assignment MOTION needs beyond value-invariance: no `local.tee` writing a local read
+    // elsewhere (pureGiven already rejects set/store/global.set/unsafe-call). This replaces the old
+    // address-local-disjointness load test, which was unsound in general (two distinct locals can
+    // hold the same address) and only worked by luck on the bench shapes.
+    const { pureGiven } = loopInvariance(loop, { distinctParams, baseParamOf })
+    const motionSafe = (n) => { if (!Array.isArray(n)) return true; if (n[0] === 'local.tee') return false; for (let i = 1; i < n.length; i++) if (!motionSafe(n[i])) return false; return true }
+    const hoistable = new Set()
+    let changed = true
+    while (changed) {
+      changed = false
+      for (const [name, defs] of cand) {
+        if (hoistable.has(name)) continue
+        if (defs.every(d => motionSafe(d) && pureGiven(d, hoistable))) { hoistable.add(name); changed = true }
+      }
+    }
+    // Stage 3 — one linear pass over the loop body: each hoistable def is RENAMED to a
+    // fresh version and MOVED OUT of the loop (before it), in source order so the cascade's
+    // data deps stay intact (c = ox²+… emitted after ox). The cheap arithmetic AND the load
+    // both leave the loop; gets stay, rebound to the moved version. (hoistInvariantLoop only
+    // snapshots expensive subexprs, not whole invariant assignments — so we do the motion.)
+    const curOf = new Map()
+    const rewriteGets = (n) => {
+      if (!Array.isArray(n)) return n
+      if (n[0] === 'local.get' && curOf.has(n[1])) return ['local.get', curOf.get(n[1])]
+      return n.map((c, i) => i === 0 ? c : rewriteGets(c))
+    }
+    const hoisted = []
+    const kept = loop.slice(0, 2)  // 'loop' + label
+    for (let i = 2; i < loop.length; i++) {
+      const s = loop[i]
+      if (Array.isArray(s) && s[0] === 'local.set' && hoistable.has(s[1])) {
+        const name = s[1], ty = localTypes.get(name)
+        const nv = `$${name.replace(/^\$/, '')}__sr${minted++}`
+        newDecls.push(['local', nv, ty]); localTypes.set(nv, ty)
+        hoisted.push(['local.set', nv, rewriteGets(s[2])])
+        curOf.set(name, nv)
+      } else {
+        kept.push(rewriteGets(s))
+      }
+    }
+    loop.length = 0
+    for (const x of kept) loop.push(x)
+    parent.splice(idx, 0, ...hoisted)
+  }
+  const walk = (parent, idx) => {
+    const n = parent[idx]
+    if (!Array.isArray(n)) return
+    // Recurse first so an inner loop's hoists land before we process the outer loop.
+    for (let i = 1; i < n.length; i++) walk(n, i)
+    if (n[0] === 'loop') processLoop(n, parent, idx)
+  }
+  for (let i = bodyStart; i < fn.length; i++) walk(fn, i)
+  if (newDecls.length) fn.splice(bodyStart, 0, ...newDecls)
+}
+
 export function hoistInvariantLoop(fn) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
@@ -683,7 +1096,7 @@ export function hoistInvariantLoop(fn) {
     // Comparisons and `eqz` yield i32 regardless of operand type (i64.eq, f64.lt,
     // i64.eqz, …) — so the operand-type prefix would mistype them. Catch first.
     const m = op.slice(dot + 1)
-    if (m === 'eqz' || /^(eq|ne|lt|gt|le|ge)(_[su])?$/.test(m)) return 'i32'
+    if (CMP_MANTISSA.has(m)) return 'i32'
     const p = op.slice(0, dot)
     if (p === 'i32' || p === 'i64' || p === 'f64' || p === 'f32') return p
     return null
@@ -707,33 +1120,23 @@ export function hoistInvariantLoop(fn) {
   const newLocals = []
   const refcount = buildRefcount(fn)
 
+  // Alias-analysis substrate for hoisting typed-array PARAM element loads across distinct-base
+  // stores. `distinctParams` (stamped by compile/index.js from the param-distinctness pass) is the
+  // set of typed-array params PROVEN to be mutually-distinct buffers at every call site. To use it,
+  // resolve a load/store address back to the single param it derives from — through `local.get`,
+  // `i32.add/sub`, and single-def snap locals ($__li/$__ab from prior ptr-offset hoisting).
+  const distinctParams = fn.distinctParams || null
+  const baseParamOf = buildBaseParamOf(fn, bodyStart, distinctParams)
+
   const processLoop = (loopNode, nested) => {
     // Inner loops first (bottom-up) — an inner hoist creates a local.get the
     // outer level can hoist further. Children run in a nested context.
     for (let i = 1; i < loopNode.length; i++)
       if (Array.isArray(loopNode[i])) processNode(loopNode[i], loopNode, i, true)
 
-    // The loop's effect summary (scans nested loops too — conservative).
-    const locals = new Set(), globals = new Set(), storedCells = new Set()
-    let hasUnsafeCall = false, hasAnyCall = false, hasDirectStore = false, hasV128 = false
-    const scan = (node) => {
-      if (!Array.isArray(node)) return
-      const op = node[0]
-      // A vectorized loop (lane/v128 ops) is already register-tight and hand-tuned;
-      // extra scalar hoisting there only adds spill pressure — keep it conservative.
-      if (op.startsWith('v128.') || /^[if]\d+x\d+\./.test(op)) hasV128 = true
-      if (op === 'local.set' || op === 'local.tee') { if (typeof node[1] === 'string') locals.add(node[1]); for (let i = 2; i < node.length; i++) scan(node[i]); return }
-      if (op === 'global.set') { if (typeof node[1] === 'string') globals.add(node[1]); for (let i = 2; i < node.length; i++) scan(node[i]); return }
-      if (op === 'call') { hasAnyCall = true; if (!SAFE_OFFSET_CALLS.has(node[1]) && !READONLY_MEM_CALLS.has(node[1]) && !NON_MUTATING_CALLS.has(node[1])) hasUnsafeCall = true; for (let i = 2; i < node.length; i++) scan(node[i]); return }
-      if (op === 'call_ref' || op === 'call_indirect') { hasAnyCall = hasUnsafeCall = true; for (let i = 1; i < node.length; i++) scan(node[i]); return }
-      if ((op === 'f64.store' || op === 'i32.store') && node.length >= 3) {
-        hasDirectStore = true
-        const a = node[1]
-        if (Array.isArray(a) && a[0] === 'local.get' && typeof a[1] === 'string' && a[1].startsWith(CELL_PREFIX)) storedCells.add(a[1])
-      }
-      for (let i = 1; i < node.length; i++) scan(node[i])
-    }
-    for (let i = 1; i < loopNode.length; i++) scan(loopNode[i])
+    // The loop's effect summary + the proven invariance/purity predicate (shared with
+    // splitLoopPrivateScratch — see loopInvariance). `locals` is the loop's whole write-set.
+    const { pureGiven, locals, hasV128 } = loopInvariance(loopNode, { distinctParams, baseParamOf })
 
     // Per-subtree local-occurrence counts and write-sets, memoized bottom-up —
     // the tee-privacy check queries them for EVERY candidate node, and the old
@@ -772,57 +1175,6 @@ export function hoistInvariantLoop(fn) {
     for (let i = 1; i < loopNode.length; i++)
       for (const [k, v] of countsOf(loopNode[i])) localCount.set(k, (localCount.get(k) || 0) + v)
 
-    // Pure & invariant given `bound` (locals written *within* the candidate, hence
-    // local to it). A read of a bound local is OK (its in-subtree value is the
-    // teed invariant). A free read must be unwritten by the loop.
-    const pureGiven = (node, bound) => {
-      if (!Array.isArray(node)) return true   // bare operand string/number
-      const op = node[0]
-      if (op === 'i32.const' || op === 'i64.const' || op === 'f64.const' || op === 'f32.const') return true
-      if (op === 'local.get') return typeof node[1] === 'string' && (bound.has(node[1]) || !locals.has(node[1]))
-      // A global is invariant only if not set directly AND no call in the loop —
-      // any callee may mutate it (no interprocedural effect analysis). (Locals are
-      // frame-private, so calls can't touch them; only direct local.set matters.)
-      if (op === 'global.get') return typeof node[1] === 'string' && !globals.has(node[1]) && !hasAnyCall
-      if (op === 'local.tee') {
-        if (typeof node[1] !== 'string') return false
-        // The operand is evaluated BEFORE the tee writes $X, so a `local.get $X` inside
-        // it reads the loop-carried (previous-iteration) value, not the teed one. Drop
-        // $X from `bound` for the operand: `local.tee $X (… $X …)` is a loop recurrence
-        // (X = f(X) — e.g. the `while ((nn = nn >>> 1))` induction), NOT invariant.
-        const inner = bound.has(node[1]) ? new Set([...bound].filter(b => b !== node[1])) : bound
-        return pureGiven(node[2], inner)
-      }
-      if ((op === 'f64.load' || op === 'i32.load') && node.length === 2) {
-        const a = node[1]
-        return Array.isArray(a) && a[0] === 'local.get' && typeof a[1] === 'string' && a[1].startsWith(CELL_PREFIX)
-          && !hasAnyCall && !storedCells.has(a[1]) && (bound.has(a[1]) || !locals.has(a[1]))
-      }
-      if (op === 'call') {
-        if (SAFE_OFFSET_CALLS.has(node[1]))
-          return !hasUnsafeCall && node.slice(2).every(c => pureGiven(c, bound))
-        // Read-only heap reads: additionally require no direct store (alias-safe).
-        if (READONLY_MEM_CALLS.has(node[1]))
-          return !hasUnsafeCall && !hasDirectStore && node.slice(2).every(c => pureGiven(c, bound))
-        return false
-      }
-      // A value-producing `if` whose condition and both arms are pure is itself
-      // pure — the tag-dispatch idiom `(if (result f64) tag-check (then read-A)
-      // (else read-B))` that wraps __typed_idx/__str_idx element access.
-      if (op === 'if') {
-        for (let i = 1; i < node.length; i++) {
-          const c = node[i]
-          if (!Array.isArray(c)) continue
-          if (c[0] === 'result') continue
-          if (c[0] === 'then' || c[0] === 'else') { if (!c.slice(1).every(x => pureGiven(x, bound))) return false }
-          else if (!pureGiven(c, bound)) return false   // the condition
-        }
-        return true
-      }
-      if (PURE_LICM_OPS.has(op)) return node.slice(1).every(c => pureGiven(c, bound))
-      return false
-    }
-
     const isHoistable = (node) => {
       if (!Array.isArray(node)) return false
       const op = node[0]
@@ -849,9 +1201,10 @@ export function hoistInvariantLoop(fn) {
       if (!Array.isArray(node)) return
       if (node[0] === 'loop') return  // already processed bottom-up
       if (isHoistable(node) && (refcount.get(node) || 0) <= 1 && (refcount.get(parent) || 0) <= 1) {
-        // BigInt-safe: hoistable boxed-pointer subtrees carry i64.const NaN-box prefixes
-        // (BigInt values) that plain JSON.stringify can't serialize — see ast.bigintSafeKey.
-        const key = JSON.stringify(node, (_k, v) => typeof v === 'bigint' ? `${v}n` : v)
+        // stableKey: hoistable boxed-pointer subtrees carry i64.const NaN-box prefixes
+        // (BigInt) that plain JSON.stringify can't serialize, and it also collapses
+        // Infinity/-Infinity/NaN→null & -0→0 — both would dedup distinct invariants.
+        const key = JSON.stringify(node, stableKey)
         let arr = sites.get(key); if (!arr) { arr = []; sites.set(key, arr) }
         arr.push({ parent, idx, node })
         return
@@ -983,16 +1336,17 @@ export function narrowLoopBound(fn) {
   const newLocals = []
   const refcount = buildRefcount(fn)
 
-  // `(f64.lt (f64.convert_i32_s (local.get $i)) (local.get $n))` or mirrored
-  // `(f64.gt (local.get $n) (f64.convert_i32_s (local.get $i)))`.
+  // `i <  bound` as `(f64.lt (convert i) bound)` or mirrored `(f64.gt bound (convert i))`.
+  // `i <= bound` as `(f64.le (convert i) bound)` or mirrored `(f64.ge bound (convert i))`.
   const match = (n) => {
-    const conv = n[0] === 'f64.lt' ? n[1] : n[0] === 'f64.gt' ? n[2] : null
-    const bnd = n[0] === 'f64.lt' ? n[2] : n[0] === 'f64.gt' ? n[1] : null
+    const lt = n[0] === 'f64.lt', gt = n[0] === 'f64.gt', le = n[0] === 'f64.le', ge = n[0] === 'f64.ge'
+    const conv = lt || le ? n[1] : gt || ge ? n[2] : null
+    const bnd = lt || le ? n[2] : gt || ge ? n[1] : null
     if (!Array.isArray(conv) || conv[0] !== 'f64.convert_i32_s') return null
     const ig = conv[1]
     if (!Array.isArray(ig) || ig[0] !== 'local.get' || typeof ig[1] !== 'string') return null
     if (!Array.isArray(bnd) || bnd[0] !== 'local.get' || typeof bnd[1] !== 'string') return null
-    return { ctr: ig[1], bound: bnd[1] }
+    return { ctr: ig[1], bound: bnd[1], op: le || ge ? 'le' : 'lt' }
   }
 
   const processLoop = (loopNode) => {
@@ -1022,18 +1376,34 @@ export function narrowLoopBound(fn) {
     }
     for (let i = 1; i < loopNode.length; i++) collect(loopNode[i])
 
-    const snapFor = new Map()  // bound name → snap local (one per distinct bound)
+    // One snap per distinct (bound, op): `i < n` and `i <= n` of the SAME bound
+    // need different snapped i32 values (ceil vs floor).
+    const snapFor = new Map()
     const snaps = []
+    const I32_MIN = -2147483648
     for (const { node, m } of sites) {
-      let snap = snapFor.get(m.bound)
+      const key = `${m.bound}|${m.op}`
+      let snap = snapFor.get(key)
       if (!snap) {
         snap = freshLb()
-        snapFor.set(m.bound, snap)
+        snapFor.set(key, snap)
         newLocals.push(['local', snap, 'i32'])
-        snaps.push(['local.set', snap, ['i32.trunc_sat_f64_s', ['f64.ceil', ['local.get', m.bound]]]])
+        // `i < n`  ⟺ `i < ceil(n)`: trunc_sat(NaN)=0 makes `i<0` false — matches `i<NaN`;
+        //   ±Inf → I32_MAX/I32_MIN, both correct. NaN-safe for free.
+        // `i <= n` ⟺ `i <= floor(n)`, BUT trunc_sat(floor(NaN))=0 would make `i<=0` run
+        //   one iteration at i=0, while JS (`i<=NaN` is false) runs zero. Guard the NaN
+        //   case to I32_MIN (below any non-negative counter ⇒ zero iterations). ±Inf are
+        //   already correct (floor(+Inf)→I32_MAX, floor(-Inf)→I32_MIN; Inf==Inf is true).
+        snaps.push(['local.set', snap, m.op === 'le'
+          ? ['select',
+              ['i32.trunc_sat_f64_s', ['f64.floor', ['local.get', m.bound]]],
+              ['i32.const', I32_MIN],
+              ['f64.eq', ['local.get', m.bound], ['local.get', m.bound]]]
+          : ['i32.trunc_sat_f64_s', ['f64.ceil', ['local.get', m.bound]]]])
       }
       node.length = 3
-      node[0] = 'i32.lt_s'; node[1] = ['local.get', m.ctr]; node[2] = ['local.get', snap]
+      node[0] = m.op === 'le' ? 'i32.le_s' : 'i32.lt_s'
+      node[1] = ['local.get', m.ctr]; node[2] = ['local.get', snap]
     }
     return snaps
   }
@@ -1260,6 +1630,19 @@ export function cseScalarLoad(fn) {
 // the two passes cover deliberately different op sets.
 const COMMUTATIVE = new Set(['f64.mul', 'f64.add', 'i32.mul', 'i32.add', 'i32.and', 'i32.or', 'i32.xor', 'i64.mul', 'i64.add', 'i64.and', 'i64.or', 'i64.xor'])
 
+// Presence of one of these arms csePureExprLoop (it CSEs redundant pure f64/i32
+// arithmetic within the loop; the gate is just "is this loop expensive enough to
+// be worth the pass"). The whole class of transcendental helpers qualifies — each
+// is a multi-instruction polynomial approximation, so a loop built around exp/log/
+// pow deserves the same arithmetic-CSE a trig loop already got. Gating on the class,
+// not a benchmark shape; the CSE itself is bit-exact (pure-subexpr dedup only).
+const LOOP_CSE_EXPENSIVE = new Set([
+  '$math.sin', '$math.cos', '$math.tan', '$math.sin_core', '$math.cos_core',
+  '$math.exp', '$math.expm1', '$math.log', '$math.log2', '$math.log10', '$math.log1p',
+  '$math.pow', '$math.atan', '$math.asin', '$math.acos', '$math.atan2',
+  '$math.sinh', '$math.cosh', '$math.tanh', '$math.cbrt', '$math.hypot',
+])
+
 export function csePureExpr(fn) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
@@ -1396,16 +1779,15 @@ export function csePureExprLoop(fn) {
   if (bodyStart < 0) return
 
   let hasLoop = false
-  let hasTrigCall = false
+  let hasExpensiveCall = false
   const scanShape = (n) => {
     if (!Array.isArray(n)) return
     if (n[0] === 'loop') hasLoop = true
-    if (n[0] === 'call' && (n[1] === '$math.sin' || n[1] === '$math.cos'
-        || n[1] === '$math.sin_core' || n[1] === '$math.cos_core')) hasTrigCall = true
+    if (n[0] === 'call' && LOOP_CSE_EXPENSIVE.has(n[1])) hasExpensiveCall = true
     for (let i = 1; i < n.length; i++) scanShape(n[i])
   }
   for (let i = bodyStart; i < fn.length; i++) scanShape(fn[i])
-  if (!hasLoop || !hasTrigCall) return
+  if (!hasLoop || !hasExpensiveCall) return
 
   let snapId = nextLocalId(fn, 'pe')
   const newLocals = []
@@ -2100,15 +2482,8 @@ function inferTypeFromContext(fn, gName, bodyStart) {
           }
           if (pOp === 'i32.store' && idx === 2) { inferred = 'i32'; return }  // addr
           if (pOp === 'f64.store' && idx === 2) { inferred = 'f64'; return }  // addr can be i32, but value is f64
-          if (pOp === 'i32.eq' || pOp === 'i32.ne' || pOp === 'i32.lt_s' || pOp === 'i32.lt_u' ||
-              pOp === 'i32.gt_s' || pOp === 'i32.gt_u' || pOp === 'i32.le_s' || pOp === 'i32.le_u' ||
-              pOp === 'i32.ge_s' || pOp === 'i32.ge_u') {
-            // Comparison — could be i32, but in jz NaN-boxing scheme most globals are f64
-            // Only if we can confirm from local.set context
-          }
-          if (pOp === 'local.set' && idx === 0) {
-            // Can't determine local type from here easily
-          }
+          // i32 comparisons already matched the `i32.` prefix above; a `local.set`
+          // parent tells us nothing here — both fall through to the f64 default.
         }
       }
       // Default: f64 (the NaN-boxing carrier)
@@ -2132,22 +2507,33 @@ function inferTypeFromContext(fn, gName, bodyStart) {
  *
  * Mutates `funcs` in place; writes new global decls via `addGlobal(name, constLiteral)`.
  */
+// `String(number)` keeps only ~9 significant digits in the self-host kernel (jz's number
+// formatter — see README "differences"). The old pool keyed constants by `n:${c[1]}` (a toString)
+// and emitted them via that same string, so in the kernel a constant both LOST precision
+// (0.041666666666666664 → 0x1.5555558325751p-5) and could MERGE with a distinct value sharing its
+// 9-digit prefix. Key by the exact 64 bits instead (a Float64Array/Uint32Array union — the
+// numHashLiteral pattern, which self-hosts; the sign bit distinguishes -0/+0 for free) and emit
+// the original NUMBER, which `declGlobal` lowers to a binary `f64.const` (exact, no string).
+const _FCB = new Float64Array(1), _FCBu = new Uint32Array(_FCB.buffer)
+const f64BitsKey = (n) => { _FCB[0] = n; return `n:${_FCBu[0]}:${_FCBu[1]}` }
+
 export function hoistConstantPool(funcs, addGlobal) {
   const MIN_USES = 2
   // Single walk: count occurrences AND record each f64.const site for direct rewrite.
   // Avoids a second full-AST traversal in the rewrite phase.
   const counts = new Map()
+  // NOTE: not `valueOf` — a local named like an Object method self-host-miscompiles (the
+  // kernel's dynamic dispatch confuses it). key → exact original c[1] (number, or source string).
+  const exactVal = new Map()
   const sites = []  // { parent, idx, key }
   const walk = (node) => {
     if (!Array.isArray(node)) return
     for (let i = 0; i < node.length; i++) {
       const c = node[i]
       if (Array.isArray(c) && c[0] === 'f64.const' && (typeof c[1] === 'number' || typeof c[1] === 'string')) {
-        // Distinguish -0 from +0 by sign: template literal collapses both to "0".
-        const k = typeof c[1] === 'number'
-          ? (Object.is(c[1], -0) ? 'n:-0' : `n:${c[1]}`)
-          : `s:${c[1]}`
+        const k = typeof c[1] === 'number' ? f64BitsKey(c[1]) : `s:${c[1]}`
         counts.set(k, (counts.get(k) || 0) + 1)
+        if (!exactVal.has(k)) exactVal.set(k, c[1])
         sites.push({ parent: node, idx: i, key: k })
       }
       walk(c)
@@ -2160,8 +2546,9 @@ export function hoistConstantPool(funcs, addGlobal) {
   let gId = 0
   for (const [k] of sorted) {
     const name = `__fc${gId++}`
-    const lit = k.slice(2)
-    addGlobal(name, lit)
+    // The EXACT original c[1] (a number → binary f64.const; or a source hex/decimal string),
+    // never the lossy k-derived toString.
+    addGlobal(name, exactVal.get(k))
     hoist.set(k, name)
   }
   if (!hoist.size) return
@@ -2269,9 +2656,7 @@ export function specializeMkptr(funcs, addFunc, parseWat) {
     // $__mkptr inline fast path: bake (type, aux) literals into i64.const template.
     if (target === '$__mkptr' && spec.inline && parts[0].startsWith('L:') && parts[1].startsWith('L:')) {
       const type = +parts[0].slice(2), aux = +parts[1].slice(2)
-      const tmpl = LAYOUT.NAN_PREFIX_BITS
-        | ((BigInt(type) & BigInt(LAYOUT.TAG_MASK)) << BigInt(LAYOUT.TAG_SHIFT))
-        | ((BigInt(aux) & BigInt(LAYOUT.AUX_MASK)) << BigInt(LAYOUT.AUX_SHIFT))
+      const tmpl = ptrBits(type, aux)  // box prefix (offset OR'd in at runtime below)
       // Third arg (offset) may also be literal — emit (f64.const nan:…) then.
       if (parts[2].startsWith('L:')) {
         // Fully literal: all sites can be f64.const — no helper needed, handled in rewrite below.
@@ -2313,11 +2698,7 @@ export function specializeMkptr(funcs, addFunc, parseWat) {
     // $__mkptr fully literal (rare — mkPtrIR usually folds these ahead of us, but defensive):
     if (target === '$__mkptr' && parts[0].startsWith('L:') && parts[1].startsWith('L:') && parts[2].startsWith('L:')) {
       const type = +parts[0].slice(2), aux = +parts[1].slice(2), off = +parts[2].slice(2)
-      const bits = LAYOUT.NAN_PREFIX_BITS
-        | ((BigInt(type) & BigInt(LAYOUT.TAG_MASK)) << BigInt(LAYOUT.TAG_SHIFT))
-        | ((BigInt(aux) & BigInt(LAYOUT.AUX_MASK)) << BigInt(LAYOUT.AUX_SHIFT))
-        | (BigInt(off >>> 0) & BigInt(LAYOUT.OFFSET_MASK))
-      const n = ['f64.const', 'nan:0x' + bits.toString(16).toUpperCase().padStart(16, '0')]
+      const n = ['f64.const', 'nan:' + i64Hex(ptrBits(type, aux, off))]
       n.type = 'f64'
       parent[idx] = n
       continue
@@ -2641,6 +3022,174 @@ export function foldStrDispatchF64(fn) {
   for (let i = bodyStart; i < fn.length; i++) fn[i] = foldNode(fn[i])
 }
 
+/**
+ * Loop-unswitch a polymorphic typed-array PARAM loop on the pointer type so the
+ * Float64Array case hoists its base and vectorizes.
+ *
+ * `export function f(buf,n){ for(let i=0;i<n;i++) buf[i]=g(buf[i],i) }` emits a
+ * per-iteration POLYMORPHIC store `(drop (if tag(buf)==ARRAY (then __arr_set_idx_ptr;
+ * local.set $buf) (else f64.store __ptr_offset(buf)+i<<3)))` and a read
+ * `__to_num(reinterpret(__typed_idx(reinterpret(buf), i)))` — re-decoding the NaN-box
+ * base every iteration. The `local.set $buf` realloc reassign marks the param unsafe,
+ * so hoistInvariantPtrOffset bails and the loop never vectorizes.
+ *
+ * Insert a ONCE-before-loop test "is buf a (non-BigInt) Float64Array?": yes → a fast
+ * loop with the base hoisted to an i32 local, the read collapsed to `f64.load`, and the
+ * polymorphic store replaced by a direct `f64.store` (no calls) — which vectorizeLaneLocal
+ * then lifts to f64x2. no → the original block verbatim (bit-exact fallback for ARRAY and
+ * every other element width). Float64Array (owned aux=7 or view aux=15) is the ONLY gated
+ * type: the else-branch f64.store is 8-byte, valid only for f64 elements; Int32Array /
+ * Uint8Array / BigInt64Array (aux 4 / 1 / 23) all fall to the verbatim path. The global-
+ * Float64Array path already lowers reads to f64.load, proving f64.load == the __to_num
+ * read for f64 elements (bit-exact, incl. NaN). All helpers are nested function decls
+ * (no ctx param) per the self-host discipline.
+ */
+export function unswitchTypedParamLoop(fn) {
+  if (!Array.isArray(fn) || fn[0] !== 'func') return
+  const bodyStart = findBodyStart(fn)
+  if (bodyStart < 0) return
+  const f64Params = new Set()
+  for (let i = 2; i < bodyStart; i++) {
+    const c = fn[i]
+    if (Array.isArray(c) && c[0] === 'param' && typeof c[1] === 'string' && c[2] === 'f64') f64Params.add(c[1])
+  }
+  if (!f64Params.size) return
+
+  const F64 = TYPED_ELEM_CODE.Float64Array, F64V = F64 | TYPED_ELEM_VIEW_FLAG
+  const newLocals = []
+  let baseId = nextLocalId(fn, 'utb')
+
+  const clone = (n) => Array.isArray(n) ? n.map(clone) : n
+  const has = (n, pred) => Array.isArray(n) && (pred(n) || n.some((c, i) => i > 0 && has(c, pred)))
+  const writes = (n, name) => has(n, (x) => (x[0] === 'local.set' || x[0] === 'local.tee') && x[1] === name)
+  const reintParam = (n, p) => Array.isArray(n) && n[0] === 'i64.reinterpret_f64' && Array.isArray(n[1]) && n[1][0] === 'local.get' && n[1][1] === p
+  const typedIdx = (n, p) => Array.isArray(n) && n[0] === 'call' && n[1] === '$__typed_idx' && n.length >= 4 && reintParam(n[2], p)
+
+  // Clone, collapsing the typed-array read to a direct f64.load(base + IND<<3):
+  //   __to_num(reinterpret(__typed_idx(reinterpret P, IND)))  — and the bare form too.
+  function cloneRead(n, p, base) {
+    if (!Array.isArray(n)) return n
+    if (n[0] === 'call' && n[1] === '$__to_num' && n.length === 3
+        && Array.isArray(n[2]) && n[2][0] === 'i64.reinterpret_f64' && typedIdx(n[2][1], p))
+      return ['f64.load', ['i32.add', ['local.get', base], ['i32.shl', clone(n[2][1][3]), ['i32.const', 3]]]]
+    if (typedIdx(n, p))
+      return ['f64.load', ['i32.add', ['local.get', base], ['i32.shl', clone(n[3]), ['i32.const', 3]]]]
+    return n.map((c, i) => i === 0 ? c : cloneRead(c, p, base))
+  }
+
+  function processBlock(blockNode, parent, idx) {
+    if (!Array.isArray(blockNode) || blockNode[0] !== 'block') return
+    let loopNode = null, blockLabel = null
+    const preamble = []
+    for (let i = 1; i < blockNode.length; i++) {
+      const c = blockNode[i]
+      if (i === 1 && typeof c === 'string' && c.startsWith('$')) { blockLabel = c; continue }
+      if (Array.isArray(c) && c[0] === 'loop') { if (loopNode) return; loopNode = c }
+      else if (Array.isArray(c) && c[0] === 'local.set' && !loopNode) preamble.push(c)
+      else if (Array.isArray(c)) return
+    }
+    if (!loopNode || !blockLabel) return
+    const loopLabel = typeof loopNode[1] === 'string' && loopNode[1].startsWith('$') ? loopNode[1] : null
+    if (!loopLabel) return
+    const endIdx = loopNode.length - 1
+    if (!(Array.isArray(loopNode[endIdx]) && loopNode[endIdx][0] === 'br' && loopNode[endIdx][1] === loopLabel)) return
+    const incNode = loopNode[endIdx - 1]
+    if (!Array.isArray(incNode) || incNode[0] !== 'local.set' || !Array.isArray(incNode[2]) || incNode[2][0] !== 'i32.add') return
+    const incVar = incNode[1], inc = incNode[2]
+    if (!(Array.isArray(inc[1]) && inc[1][0] === 'local.get' && inc[1][1] === incVar && Array.isArray(inc[2]) && inc[2][0] === 'i32.const' && inc[2][1] === 1)) return
+    const body = loopNode.slice(3, endIdx - 1)
+    if (body.length < 4) return
+
+    // Find the polymorphic-store `if` by scanning (it's followed by a `drop` of its
+    // f64 result; in the IR the two are separate statements, not (drop (if …))).
+    let storeIdx = -1, paramName = null, elseStore = null
+    for (let i = 0; i < body.length; i++) {
+      const c = body[i]
+      if (!Array.isArray(c) || c[0] !== 'if' || !Array.isArray(c[1]) || c[1][0] !== 'result' || c[1][1] !== 'f64') continue
+      let thenArm = null, elseArm = null
+      for (let k = 2; k < c.length; k++) { const a = c[k]; if (Array.isArray(a)) { if (a[0] === 'then') thenArm = a; else if (a[0] === 'else') elseArm = a } }
+      if (!thenArm || !elseArm) continue
+      let p = null
+      for (let k = 1; k < thenArm.length; k++) { const a = thenArm[k]; if (Array.isArray(a) && a[0] === 'local.set' && f64Params.has(a[1]) && Array.isArray(a[2]) && a[2][0] === 'local.get') p = a[1] }
+      if (!p || !has(thenArm, (x) => x[0] === 'call' && x[1] === '$__arr_set_idx_ptr')) continue
+      // The bare `f64.store(__ptr_offset(o)+i<<3)` is the non-ARRAY fallback. It may be
+      // nested under an OBJECT/HASH → __dyn_set guard (emitPolymorphicElementStore's
+      // dyn-prop safety fork) — descend to find it; the fast path replaces the whole
+      // store with a direct f64.load/store anyway (a proven Float64Array is never an
+      // OBJECT, so its dyn arm is dead there). Still bail on the 3-way __typed_set_idx
+      // form (mixed element widths — the f64.store fallback isn't the sole non-ARRAY case).
+      const findRawStore = (n) => {
+        if (!Array.isArray(n)) return null
+        if (n[0] === 'f64.store' && Array.isArray(n[1]) && n[1][0] === 'i32.add' &&
+            Array.isArray(n[1][2]) && n[1][2][0] === 'i32.shl' &&
+            has(n[1], (x) => x[0] === 'call' && x[1] === '$__ptr_offset')) return n
+        for (let k = 1; k < n.length; k++) { const r = findRawStore(n[k]); if (r) return r }
+        return null
+      }
+      if (has(elseArm, (x) => x[0] === 'call' && x[1] === '$__typed_set_idx')) continue
+      const es = findRawStore(elseArm)
+      if (!es) continue
+      storeIdx = i; paramName = p; elseStore = es; break
+    }
+    if (storeIdx < 0) return
+    const shiftIdx = elseStore[1][2][1]  // the index from the store's (i32.shl IDX 3)
+    // The read uses the IV directly; the store uses a snapshot `$asi = $iv`. Emit the
+    // store against the IV too so the vectorizer unifies the load/store lanes — bit-exact
+    // ($asi == $iv). Bail if the store index isn't the IV or a snapshot of it.
+    let storeIdxName = null
+    if (Array.isArray(shiftIdx) && shiftIdx[0] === 'local.get') storeIdxName = shiftIdx[1]
+    if (storeIdxName !== incVar &&
+        !body.some((st) => Array.isArray(st) && st[0] === 'local.set' && st[1] === storeIdxName && Array.isArray(st[2]) && st[2][0] === 'local.get' && st[2][1] === incVar)) return
+    // The store-if pushes f64; a following `drop` (bare string in stack-style IR, or a
+    // `['drop', …]` node) pops it. The fast store pushes nothing, so the drop must go too.
+    const isDrop = (s) => s === 'drop' || (Array.isArray(s) && s[0] === 'drop')
+    const hasDrop = storeIdx + 1 < body.length && isDrop(body[storeIdx + 1])
+
+    // The stored value is the else-store's operand (a local the body computed); take it
+    // from the store itself, not by guessing which local reads buf — the read may be
+    // nested in a split computation (`$t = buf[i]; $v = $t*2`) whose result is a DIFFERENT
+    // local. cloneRead rewrites any buf reads in that computation to f64.load.
+    if (!(Array.isArray(elseStore[2]) && elseStore[2][0] === 'local.get')) return
+    const valName = elseStore[2][1]
+    // GUARD: param reassigned ONLY inside the matched store-if (else the hoisted base goes stale).
+    for (let i = 0; i < body.length; i++) { if (i === storeIdx) continue; if (writes(body[i], paramName)) return }
+    for (const s of preamble) { if (writes(s, paramName)) return }
+
+    const base = `$__utb${baseId++}`
+    newLocals.push(['local', base, 'i32'])
+    const reint = () => ['i64.reinterpret_f64', ['local.get', paramName]]
+    const tag = ['i32.and', ['i32.wrap_i64', ['i64.shr_u', reint(), ['i64.const', LAYOUT.TAG_SHIFT]]], ['i32.const', LAYOUT.TAG_MASK]]
+    const auxOf = () => ['i32.and', ['i32.wrap_i64', ['i64.shr_u', reint(), ['i64.const', LAYOUT.AUX_SHIFT]]], ['i32.const', LAYOUT.AUX_MASK]]
+    const gate = ['i32.and', ['i32.eq', tag, ['i32.const', PTR.TYPED]],
+      ['i32.or', ['i32.eq', auxOf(), ['i32.const', F64]], ['i32.eq', auxOf(), ['i32.const', F64V]]]]
+    const baseSnap = ['local.set', base, ['call', '$__ptr_offset', reint()]]
+    const fastStore = ['f64.store', ['i32.add', ['local.get', base], ['i32.shl', ['local.get', incVar], ['i32.const', 3]]], ['local.get', valName]]
+    // Fast body: keep every statement except the store-if (→ fastStore) and its trailing
+    // drop (the fast store pushes nothing), with the typed-array read collapsed to f64.load.
+    const fastStmts = []
+    for (let i = 0; i < body.length; i++) {
+      if (i === storeIdx) { fastStmts.push(fastStore); continue }
+      if (hasDrop && i === storeIdx + 1) continue
+      fastStmts.push(cloneRead(body[i], paramName, base))
+    }
+    const fastLoop = ['block', blockLabel, ...preamble.map(clone),
+      ['loop', loopLabel, clone(loopNode[2]), ...fastStmts, clone(incNode), clone(loopNode[endIdx])]]
+    parent[idx] = ['if', gate, ['then', baseSnap, fastLoop], ['else', blockNode]]
+  }
+
+  function walk(node, parent, idx) {
+    if (!Array.isArray(node)) return
+    if (node[0] === 'block') {
+      const before = parent[idx]
+      processBlock(node, parent, idx)
+      if (parent[idx] !== before) return
+    }
+    for (let i = 0; i < node.length; i++) walk(node[i], node, i)
+  }
+  for (let i = bodyStart; i < fn.length; i++) walk(fn[i], fn, i)
+  if (newLocals.length) fn.splice(bodyStart, 0, ...newLocals)
+}
+
 /**
  * Run all per-function IR optimizations on a single function node.
  * hoistPtrType runs first — it introduces new locals (`$__ptN`) that the fused
@@ -2670,6 +3219,11 @@ export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals, phase = 'pre
       cfg.promoteGlobals === false &&
       cfg.sortLocalsByUse === false &&
       cfg.vectorizeLaneLocal === false) return
+  // Recursion-unrolling runs first in 'pre': self-calls are still clean `call`
+  // nodes (watr's inliner hasn't reshaped them) and the freshly-inlined body then
+  // rides every pass below (LICM, fold, sort). Speed-tier only; 'pre' only (so the
+  // post-watr re-optimize doesn't unroll a second time).
+  if (cfg && cfg.recursionUnroll === true && phase === 'pre') recursionUnroll(fn)
   if (!cfg || cfg.hoistPtrType !== false) hoistPtrType(fn)
   if (!cfg || cfg.hoistInvariantPtrOffset !== false) hoistInvariantPtrOffset(fn)
   // Before LICM: the snapped i32 bound is itself a hoistable hard-op subtree, so
@@ -2681,6 +3235,7 @@ export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals, phase = 'pre
   if (!cfg || cfg.hoistInvariantLoop !== false) hoistInvariantLoop(fn)
   const counts = new Map()
   if (!cfg || cfg.fusedRewrite !== false) fusedRewrite(fn, counts)
+  if (cfg && cfg.boolConvertToSelect === true) boolConvertToSelect(fn)
   if (!cfg || cfg.hoistAddrBase !== false) hoistAddrBase(fn)
   if (!cfg || cfg.hoistInvariantLoop !== false) hoistInvariantLoop(fn)
   if (!cfg || cfg.cseScalarLoad !== false) cseScalarLoad(fn)
@@ -2702,9 +3257,45 @@ export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals, phase = 'pre
     // Phase 1: fold dead string-dispatch blocks on proven-f64 locals BEFORE
     // the vectorizer pattern-matches — dead __is_str_key calls in $fbm-style
     // functions (param f64 + op f64) block liftPPC from recognizing them as pure.
+    if (runVectorizer && (!cfg || cfg.unswitchTypedParamLoop !== false)) unswitchTypedParamLoop(fn)
     if (runVectorizer) foldStrDispatchF64(fn)
-    if (runVectorizer) vectorizeLaneLocal(fn, cfg.reduceUnroll === true, cfg.relaxedSimd === true, cfg.blurMultiPixel !== false, cfg.whyNotSimd === true, cfg.experimentalStencil !== false, cfg.experimentalOuterStrip !== false, cfg._pureFuncMap || null, cfg.experimentalToneMap !== false)
+    if (runVectorizer) vectorizeLaneLocal(fn, {
+      multiAcc: cfg.reduceUnroll === true,
+      relaxedFma: cfg.relaxedSimd === true,
+      blurMP: cfg.blurMultiPixel !== false,
+      whyNot: cfg.whyNotSimd === true,
+      stencil: cfg.experimentalStencil !== false,
+      outerStrip: cfg.experimentalOuterStrip !== false,
+      pureFuncMap: cfg._pureFuncMap || null,
+      toneMap: cfg.experimentalToneMap !== false,
+      slp: cfg.experimentalSlp !== false,  // SLP default-on (testing single-use fix)
+    })
+    // The vectorizer emits `v128.load/store (i32.add base K)` for the unrolled
+    // multi-accumulator reduction (a[i],a[i+2],a[i+4]…) and stencil/strided reads.
+    // fusedRewrite's memarg fold already ran (above, before vectorize), so fold the
+    // freshly-created v128 memargs now — one fewer i32.add per accumulator per
+    // iteration, the hot-loop waste audit-fixpoint.mjs flagged on dot/sum.
+    if (runVectorizer) foldV128Memargs(fn)
+  }
+  // SSA-split loop-private unrolled scratch (post-vectorize: vectorized loops now carry
+  // v128 and are skipped) so the LICM below hoists the per-iteration invariants the
+  // unroller's name-merging hid — rust/LLVM's free-after-unroll register hoist (closes
+  // the raytrace per-sphere `c_i` recompute). Bit-exact; re-run LICM to lift the splits.
+  if (phase === 'post' && (!cfg || cfg.hoistInvariantLoop !== false)) {
+    splitLoopPrivateScratch(fn)
+    // Iterate LICM for the dependency cascade: c = ox²+… is invariant only once ox is
+    // itself hoisted out, which the single-pass hoister can't see in one go. 4 climbs
+    // covers the deepest scratch chain; idempotent, so it self-terminates.
+    for (let k = 0; k < 4; k++) hoistInvariantLoop(fn)
   }
+  // Loop rotation — the LAST shape pass (post-watr only, so no later pass reverts
+  // it and the v128 loops are already formed for the skip-guard). Speed-tier: it
+  // duplicates the loop condition for a fused conditional back-edge (1.35× on the
+  // lz/qoi scalar scans — see rotateLoops).
+  if (cfg && cfg.rotateLoops === true && phase === 'post') rotateLoops(fn)
+  // Canonicalize boolean conditions (strip redundant `!= 0` / double-`eqz`) — after
+  // rotateLoops so its fused back-edges get cleaned too. Tied to the peephole pass.
+  if (!cfg || cfg.fusedRewrite !== false) simplifyBoolContexts(fn)
   if (!cfg || cfg.sortLocalsByUse !== false) sortLocalsByUse(fn, cfg && cfg.fusedRewrite !== false ? counts : null)
   // An optimizer pass that emits a malformed local — the class that otherwise dies
   // as an opaque watr "Duplicate/Unknown local $x" several phases on — is caught
@@ -2712,6 +3303,180 @@ export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals, phase = 'pre
   if (DBG_IR) { const bad = verifyFn(fn); if (bad) throw new Error(`[ir verify] optimize produced invalid IR in ${fn[1]}: ${bad}`) }
 }
 
+// Fold `(v128.load/store (i32.add base K) …)` → `(… offset=K base …)`. Same logic as
+// walkRewrite's scalar foldMemargOffsets (MEMOP path), but for the v128 loads/stores the
+// lane vectorizer creates AFTER fusedRewrite has already run — so they'd otherwise keep a
+// per-iteration i32.add. Bottom-up, in place; an addr already in offset=/align= form is left.
+function foldV128Memargs(node) {
+  if (!Array.isArray(node)) return
+  const op = node[0]
+  if (op === 'v128.load' || op === 'v128.store') {
+    const m1 = node[1]
+    if (!(typeof m1 === 'string' && (m1.startsWith('offset=') || m1.startsWith('align='))) &&
+        Array.isArray(m1) && m1[0] === 'i32.add' && m1.length === 3) {
+      const a = m1[1], b = m1[2]
+      let base, offset
+      if (Array.isArray(b) && b[0] === 'i32.const' && typeof b[1] === 'number' && b[1] >= 0 && b[1] < 0x100000000) { base = a; offset = b[1] }
+      else if (Array.isArray(a) && a[0] === 'i32.const' && typeof a[1] === 'number' && a[1] >= 0 && a[1] < 0x100000000) { base = b; offset = a[1] }
+      if (base != null) { node[1] = `offset=${offset}`; node.splice(2, 0, base) }
+    }
+  }
+  for (let i = 1; i < node.length; i++) foldV128Memargs(node[i])
+}
+
+// i32 comparison/eqz negations — used to flip a break-condition into the
+// loop-continue condition. f64 compares are deliberately ABSENT: ¬(a<b) ≠ (a≥b)
+// across NaN, so those fall through to the `i32.eqz` wrap below.
+const ROT_NEG = {
+  'i32.eqz': null, // sentinel: strip the eqz (handled specially)
+  'i32.eq': 'i32.ne', 'i32.ne': 'i32.eq',
+  'i32.lt_s': 'i32.ge_s', 'i32.ge_s': 'i32.lt_s', 'i32.gt_s': 'i32.le_s', 'i32.le_s': 'i32.gt_s',
+  'i32.lt_u': 'i32.ge_u', 'i32.ge_u': 'i32.lt_u', 'i32.gt_u': 'i32.le_u', 'i32.le_u': 'i32.gt_u',
+}
+
+// Boolean-context canonicalization. At a true zero/nonzero position — a `br_if`,
+// `if`, `i32.eqz`, or `select` CONDITION — these are all equivalent to the inner
+// value: `i32.ne(X, 0) → X`, `i32.ne(0, X) → X`, `i32.eqz(i32.eqz(X)) → X`. jz
+// emits the redundant compare from `while (x !== 0)` lowering and from rotateLoops'
+// `negate` (which strips one `eqz` but leaves the `i32.ne`). V8 happens to fold it,
+// but JSC/wasmtime needn't — so strip it for MINIMAL output regardless of engine.
+// Only applied at proven boolean positions (never on a value-position `ne`/`eqz`,
+// which produce a real 0/1).
+const boolSimp = (n) => {
+  for (;;) {
+    if (!Array.isArray(n)) return n
+    if (n[0] === 'i32.ne' && n.length === 3) {
+      if (Array.isArray(n[2]) && n[2][0] === 'i32.const' && n[2][1] === 0) { n = n[1]; continue }
+      if (Array.isArray(n[1]) && n[1][0] === 'i32.const' && n[1][1] === 0) { n = n[2]; continue }
+    }
+    if (n[0] === 'i32.eqz' && Array.isArray(n[1]) && n[1][0] === 'i32.eqz' && n[1].length === 2) { n = n[1][1]; continue }
+    return n
+  }
+}
+function simplifyBoolContexts(fn) {
+  const walk = (node) => {
+    if (!Array.isArray(node)) return
+    for (let i = 1; i < node.length; i++) walk(node[i])
+    const op = node[0]
+    if (op === 'br_if' && node.length === 3) node[2] = boolSimp(node[2])
+    else if (op === 'i32.eqz' && node.length === 2) node[1] = boolSimp(node[1])
+    else if (op === 'if') { const ci = (Array.isArray(node[1]) && node[1][0] === 'result') ? 2 : 1; if (Array.isArray(node[ci])) node[ci] = boolSimp(node[ci]) }
+    else if (op === 'select' && node.length === 4 && Array.isArray(node[3])) node[3] = boolSimp(node[3])
+  }
+  const bodyStart = findBodyStart(fn)
+  for (let i = bodyStart; i < fn.length; i++) walk(fn[i])
+}
+
+/**
+ * Loop rotation (loop inversion). Convert jz's top-test loop idiom
+ *   (block $brk (loop $loop (br_if $brk ¬C) BODY… (br $loop)))
+ * into a guarded bottom-test loop with a FUSED conditional back-edge:
+ *   (block $brk (br_if $brk ¬C) (loop $loop BODY… (br_if $loop C)))
+ *
+ * V8/TurboFan lowers the fused `br_if $loop C` to one hardware loop branch — the
+ * shape LLVM gives rust/zig, and the reason their hot scalar loops (lz's greedy
+ * match-scan, qoi's run-length scan) beat jz's top-test form, which compiles to a
+ * forward exit-branch PLUS a separate unconditional back-jump. Measured 1.35× on
+ * the lz inner loop; nothing else jz runs reaches this shape — watr's `loopify`
+ * collapses to `loop { if C { …; br } }`, whose back-jump stays UNfused (no win).
+ *
+ * Evaluation count of C is unchanged: guard-once + one back-edge per iteration ==
+ * the top-test form's once-per-loop-top — so it's sound even when C has side
+ * effects (a `local.tee` recurrence, a call). The condition is duplicated only in
+ * the EMITTED text (guard + back-edge), a small size-for-speed trade — speed-tier.
+ *
+ * Conservative skips:
+ *   - any v128/SIMD op in the loop — already register-tight; reshaping risks
+ *     disturbing the lane structure (mirrors hoistInvariantLoop's hasV128 guard).
+ *   - a body that branches to $loop: a `continue` with no step lands on the loop
+ *     label, which after rotation sits BEFORE the back-edge test — rotating would
+ *     skip it. (jz wraps continue-with-step in a `$cont` block → targets that, not
+ *     $loop → still rotatable.)
+ */
+function rotateLoops(fn) {
+  if (!Array.isArray(fn) || fn[0] !== 'func') return
+  const bodyStart = findBodyStart(fn)
+  if (bodyStart < 0) return
+
+  const clone = (n) => Array.isArray(n) ? n.map(clone) : n
+  // Break-condition C → loop-continue condition ¬C for the back-edge. Fold the
+  // i32 forms so the back-edge stays ONE fused compare-and-branch (a wrapping
+  // `i32.eqz` would add an op inside the hot loop); everything else wraps.
+  const negate = (c) => {
+    if (Array.isArray(c) && c[0] === 'i32.eqz' && c.length === 2) return c[1]
+    if (Array.isArray(c) && c.length === 3 && ROT_NEG[c[0]]) return [ROT_NEG[c[0]], c[1], c[2]]
+    return ['i32.eqz', c]
+  }
+  const targetsLabel = (n, label) => {
+    if (!Array.isArray(n)) return false
+    const op = n[0]
+    if (op === 'br' || op === 'br_if') { if (n[1] === label) return true }
+    else if (op === 'br_table') { for (let i = 1; i < n.length; i++) if (n[i] === label) return true }
+    for (let i = 1; i < n.length; i++) if (targetsLabel(n[i], label)) return true
+    return false
+  }
+  const hasV128 = (n) => Array.isArray(n) && (
+    (typeof n[0] === 'string' && (n[0].startsWith('v128.') || /^[if]\d+x\d+\./.test(n[0]))) ||
+    n.some((c, i) => i > 0 && hasV128(c)))
+
+  const tryRotate = (blk) => {
+    let bi = 1, blockLabel = null
+    if (typeof blk[1] === 'string' && blk[1][0] === '$') { blockLabel = blk[1]; bi = 2 }
+    if (!blockLabel) return null
+    // The loop must be the block's final child; LICM may hoist invariant snaps into
+    // a `local.set` pre-header before it — keep those ahead of the guard (the guard
+    // condition can read them). Bail on anything else (typed blocks, side computations).
+    const preamble = []
+    let loop = null
+    for (let i = bi; i < blk.length; i++) {
+      const c = blk[i]
+      if (Array.isArray(c) && c[0] === 'loop') { if (loop || i !== blk.length - 1) return null; loop = c }
+      else if (Array.isArray(c) && c[0] === 'local.set' && !loop) preamble.push(c)
+      else return null
+    }
+    if (!loop) return null
+    let li = 1, loopLabel = null
+    if (typeof loop[1] === 'string' && loop[1][0] === '$') { loopLabel = loop[1]; li = 2 }
+    if (!loopLabel) return null
+    const loopHeader = []
+    while (li < loop.length) {
+      const c = loop[li]
+      if (Array.isArray(c) && c[0] === 'type') { loopHeader.push(c); li++; continue }
+      if (Array.isArray(c) && (c[0] === 'param' || c[0] === 'result')) return null
+      break
+    }
+    const body = loop.slice(li)
+    if (body.length < 2) return null
+    const head = body[0], tail = body[body.length - 1]
+    if (!(Array.isArray(head) && head[0] === 'br_if' && head[1] === blockLabel && head.length === 3)) return null
+    if (!(Array.isArray(tail) && tail[0] === 'br' && tail[1] === loopLabel && tail.length === 2)) return null
+    const inner = body.slice(1, -1)
+    if (inner.some((s) => targetsLabel(s, loopLabel))) return null   // continue → loop top: unsafe
+    if (hasV128(head) || inner.some(hasV128)) return null            // vectorized: leave tight
+    const cond = head[2]
+    return ['block', blockLabel, ...preamble,
+      ['br_if', blockLabel, clone(cond)],
+      ['loop', loopLabel, ...loopHeader, ...inner, ['br_if', loopLabel, negate(cond)]]]
+  }
+
+  // Rotate a (block …) at container[i] in place, else descend. Returns true if it fired.
+  const tryAt = (container, i) => {
+    const c = container[i]
+    if (!Array.isArray(c) || c[0] !== 'block') return false
+    const rot = tryRotate(c)
+    if (!rot) return false
+    container[i] = rot
+    walk(rot)
+    return true
+  }
+  const walk = (node) => {
+    if (!Array.isArray(node)) return
+    for (let i = 0; i < node.length; i++) if (!tryAt(node, i)) walk(node[i])
+  }
+  // Top-level statements (a loop block can BE fn[i], not just nested under one).
+  for (let i = bodyStart; i < fn.length; i++) if (!tryAt(fn, i)) walk(fn[i])
+}
+
 // The i32 form of an integer-valued f64 expression, or null. Used to push ToInt32
 // through a conditional and to collapse the f64 round-trip on integer `+`/`-`.
 // Lossless by construction: `convert_i32(X) → X`; integer `f64.const → i32.const`
@@ -2732,6 +3497,17 @@ function toI32(n) {
     const a = toI32(n[1]), b = toI32(n[2])
     if (a && b) return [op === 'f64.add' ? 'i32.add' : 'i32.sub', a, b]
   }
+  // ToInt32 distributes through a conditional: ToInt32(if C A B) == if(result i32) C
+  // ToInt32(A) ToInt32(B). Recursive — a nested integer `?:` like `((3<a)?(2&a):((7<a)?a:1))|0`
+  // narrows whole to i32 (each arm folded by toI32, incl. nested ifs), so the lane vectorizer
+  // lifts it as i32x4 bitselect instead of bailing on the f64 result. Only reached from
+  // ToInt32 sinks (the select idiom / toI32 recursion), so the i32 result is always wanted.
+  if (op === 'if' && Array.isArray(n[1]) && n[1][0] === 'result' && n[1][1] === 'f64'
+      && Array.isArray(n[3]) && n[3][0] === 'then' && n[3].length === 2
+      && Array.isArray(n[4]) && n[4][0] === 'else' && n[4].length === 2) {
+    const t = toI32(n[3][1]), e = toI32(n[4][1])
+    if (t && e) return ['if', ['result', 'i32'], n[2], ['then', t], ['else', e]]
+  }
   return null
 }
 
@@ -2771,18 +3547,38 @@ function fusedRewrite(fn, counts) {
   }
   const freshI64 = () => { const n = `$__eqt${scratchN++}`; newDecls.push(['local', n, 'i64']); return n }
   const freshF64 = () => { const n = `$__eqf${scratchN++}`; newDecls.push(['local', n, 'f64']); return n }
+  // Single-textual-def locals → their defining value node, so the trunc_sat range fold (below)
+  // can see through the temps inlining introduces when proving an index/packed value fits i32.
+  // Multi-def (incl. loop-carried self-referential) locals are excluded: their value is not the
+  // one def's, so its range wouldn't bound them. Pure read of the IR — value-preserving rewrites
+  // during this same walk keep the captured def's RANGE intact, so a lazily-built map stays sound.
+  // Built on first query only (most functions carry no guarded-trunc form → zero cost).
+  let defVal
+  const get = (name) => {
+    if (defVal === undefined) {
+      defVal = new Map(); const defCnt = new Map()
+      const scanDefs = (n) => {
+        if (!Array.isArray(n)) return
+        if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') { defCnt.set(n[1], (defCnt.get(n[1]) || 0) + 1); defVal.set(n[1], n[2]) }
+        for (let i = 1; i < n.length; i++) scanDefs(n[i])
+      }
+      for (let i = bodyStart; i < fn.length; i++) scanDefs(fn[i])
+      for (const [k, c] of defCnt) if (c > 1) defVal.delete(k)
+    }
+    return defVal.get(name) || null
+  }
   for (let i = bodyStart; i < fn.length; i++) {
     const c = fn[i]
-    if (Array.isArray(c)) fn[i] = walkRewrite(c, !skipInline, counts, freshI64, freshF64)
+    if (Array.isArray(c)) fn[i] = walkRewrite(c, !skipInline, counts, freshI64, freshF64, get)
   }
   if (newDecls.length) fn.splice(bodyStart, 0, ...newDecls)
 }
 
-function walkRewrite(node, doInline, counts, freshI64, freshF64) {
+function walkRewrite(node, doInline, counts, freshI64, freshF64, get) {
   if (!Array.isArray(node)) return node
   for (let i = 0; i < node.length; i++) {
     const c = node[i]
-    if (Array.isArray(c)) node[i] = walkRewrite(c, doInline, counts, freshI64, freshF64)
+    if (Array.isArray(c)) node[i] = walkRewrite(c, doInline, counts, freshI64, freshF64, get)
   }
   const op = node[0]
   // Piggyback local-ref counting for sortLocalsByUse. `counts` may be undefined
@@ -2963,16 +3759,20 @@ function walkRewrite(node, doInline, counts, freshI64, freshF64) {
     if (Array.isArray(v) && v[0] === 'i32.wrap_i64' && Array.isArray(v[1]) && v[1][0] === 'i64.trunc_sat_f64_s' && v[1].length === 2) {
       let inner = v[1][1]
       if (Array.isArray(inner) && inner[0] === 'local.tee' && inner.length === 3) inner = inner[2]
-      // ToInt32(if (result f64) C A B) → if (result i32) C toI32(A) toI32(B), when both arms are integer-valued.
-      if (Array.isArray(inner) && inner[0] === 'if' && Array.isArray(inner[1]) && inner[1][0] === 'result' && inner[1][1] === 'f64'
-          && Array.isArray(inner[3]) && inner[3][0] === 'then' && inner[3].length === 2
-          && Array.isArray(inner[4]) && inner[4][0] === 'else' && inner[4].length === 2) {
-        const t = toI32(inner[3][1]), e = toI32(inner[4][1])
-        if (t && e) return ['if', ['result', 'i32'], inner[2], ['then', t], ['else', e]]
-      }
-      // ToInt32(integer-valued f64 expr) → its i32 form (covers (i32±i32)|0 sums and nests).
+      // ToInt32(integer-valued f64 expr) → its i32 form: covers (i32±i32)|0 sums AND the
+      // conditional `?:` (toI32 distributes through `(if result f64)`, recursively).
       const i = toI32(inner)
       if (i) return i
+      // Range fallback for the NON-integer-ring values toI32 rejects (`floor(scale·v)`,
+      // `base + scale·v` — every grid/lattice/colour index): when the def chain — resolved
+      // through single-def inlining temps via `get` — provably yields a finite i32-range value,
+      // the +∞ guard is dead AND trunc_sat can't saturate, so the whole guarded select collapses
+      // to one `i32.trunc_sat_f64_s`. SOUND: f64Range admits only pure nodes and proves
+      // finiteness (kills the guard) + in-range (kills saturation), so the result is identical
+      // ToInt32 on every value the program can produce. Drops the i64 round-trip + guard on all
+      // runtimes (this is the post-inline twin of the emit-time fold at ir.js toI32).
+      const rng = f64Range(inner, get)
+      if (rng && rng.lo >= I32_MIN && rng.hi <= I32_MAX) return ['i32.trunc_sat_f64_s', inner]
     }
   }
   // (i32.or X 0) / (i32.or 0 X) → X — drops the redundant source-level `|0` clamp left
@@ -2983,6 +3783,30 @@ function walkRewrite(node, doInline, counts, freshI64, freshF64) {
     if (Array.isArray(a) && a[0] === 'i32.const' && a[1] === 0) return b
   }
 
+  // if→select for a value-producing f64 `if` with PURE arms: (if (result f64) COND (then A)
+  // (else B)) → (select A B COND). This is the branchless `cmov` lowering LLVM/clang apply to
+  // every `cond ? a : b` — it removes the conditional branch (and its misprediction cost on
+  // data-unpredictable conditions) on the whole class of float sign/clamp/reflect ternaries.
+  // The flagship: noise's gradient `(h & 1) === 0 ? x : -x` (8 per perlin × 5 octaves × 65k px).
+  // SOUND: wasm `select` evaluates BOTH arms unconditionally, and `isPureIR` admits only
+  // side-effect-free, non-trapping ops (no load/call/div/rem) — so eager evaluation is safe; it
+  // is the exact predicate emit.js uses for the same fold at emit time, now applied post-watr
+  // where the arms (e.g. `f64.neg (local.get $x)`) are clean after canon-DCE. Gated to NOT fire
+  // when BOTH arms are i32-narrowable — those stay an `if` for the ToInt32-through-if fold +
+  // the i32x4-bitselect conditional-map vectorizer (don't steal the integer path).
+  if (op === 'if' && node.length === 5 && Array.isArray(node[1]) && node[1][0] === 'result' && node[1][1] === 'f64'
+      && Array.isArray(node[3]) && node[3][0] === 'then' && node[3].length === 2
+      && Array.isArray(node[4]) && node[4][0] === 'else' && node[4].length === 2) {
+    const a = node[3][1], b = node[4][1], cond = node[2]
+    // The COND must also be pure: `if` evaluates cond FIRST then one arm, but wasm `select`
+    // evaluates its arms BEFORE the cond. A short-circuit lowering like `a || b` =
+    // `(if (result f64) is_truthy(local.tee $t a) (then get $t)(else b))` hides a `tee` in the
+    // cond that the then-arm reads — reordering it after the arms reads $t stale. Requiring
+    // isPureIR(cond) excludes every tee/call/short-circuit cond while admitting the pure
+    // comparison conds of real float ternaries (noise's `(h & 1) === 0`).
+    if (isPureIR(a) && isPureIR(b) && isPureIR(cond) && !(toI32(a) && toI32(b))) return ['select', a, b, cond]
+  }
+
   // f64.CMP(convert_i32 A, convert_i32 B) → i32.CMP(A, B). Comparing two i32 values is
   // identical whether done in exact f64 or in i32 (the converts are lossless and
   // order-preserving), so an integer comparison over typed-array loads (reads are f64)