jz 0.7.0 → 0.8.1

package/src/compile/loop-recurrence.js

@@ -0,0 +1,167 @@
+// Partial unroll (×2) + scalar replacement of a unit-stride ARRAY RECURRENCE.
+//
+// A DP/scan loop that reads `arr[j-1]` and writes `arr[j]` (unit stride) carries the
+// just-written value to the next iteration THROUGH MEMORY: it stores `arr[j]`, then the next
+// iteration loads `arr[j-1]` — the very cell it just wrote. V8/TurboFan forwards that store→load
+// and unrolls the loop internally; Cranelift/wasmtime and the baseline tiers do neither, so the
+// loop pays a store→load round trip plus full per-iteration overhead on every cell. clang/gcc
+// fix exactly this with this transform — measured 2.15× on wasmtime for the Levenshtein DP
+// (V8-neutral, bit-exact).
+//
+// Recognized (post-prepare AST): a unit-stride `for (let j = LO; j </<= HI; j++)` whose body, for
+// ONE array `arr`, has a single store `arr[j] = <var>` and ≥1 read `arr[j-1]`, accesses `arr` at
+// no other index, never aliases `arr` elsewhere, and contains no call / nested loop / break /
+// continue / return / closure. The `arr[j-1]` read becomes a scalar `left` seeded from `arr[LO-1]`
+// and refreshed after each store; the body is then unrolled ×2 (with a 1-cell tail) so the carry
+// between the paired cells lives in a register and the loop overhead is halved. A `LO <= HI` guard
+// keeps the seed load in step with the original (which reads `arr[LO-1]` only when it iterates),
+// and falls back to the untouched loop on the empty range — sound for any trip count.
+
+import { findMutations } from './analyze-scans.js'
+import { litVal, litN, unitIncVar, normalizeLoop, freshLoopId } from './loop-model.js'
+import { rewriteBlocks, closureMutatedVars } from './loop-model.js'
+
+const isArr = (n) => Array.isArray(n)   // wrap (not alias): the self-host kernel rejects a builtin used as a first-class value
+const clone = (n) => isArr(n) ? n.map(clone) : n
+const isIvMinus1 = (n, iv) => isArr(n) && n[0] === '-' && n[1] === iv && litN(n[2], 1)   // (iv - 1)
+
+// Ops whose presence makes duplicating the body in place unsound (control that escapes the cell,
+// or a call that could alias/mutate `arr` or reorder side effects).
+const REJECT = new Set(['for', 'while', 'do', 'for-in', 'for-of', 'break', 'continue', 'return',
+  'throw', 'switch', 'try', 'catch', 'finally', '=>', 'label'])
+const hasUnsafe = (n) => {
+  if (!isArr(n)) return false
+  if (REJECT.has(n[0])) return true
+  if (n[0] === '()' && typeof n[1] === 'string') return true   // function call `f(args)`
+  return n.some(hasUnsafe)
+}
+
+// Substitute every value-reference of `iv` with (iv + 1); leave the op slot and property keys.
+const subPlus1 = (n, iv) => {
+  if (n === iv) return ['+', iv, 1]
+  if (!isArr(n)) return n
+  if (n[0] === '.' && n.length === 3) return ['.', subPlus1(n[1], iv), n[2]]
+  return [n[0], ...n.slice(1).map(c => subPlus1(c, iv))]
+}
+
+// Rename every let/const-DECLARED var in `stmts` with a suffix, throughout — so the 2nd unrolled
+// cell's locals don't collide with the 1st. Loop-carried outer vars (assigned, not declared here)
+// are untouched, so the recurrence still threads through them.
+function renameDecls(stmts, suf) {
+  const declared = new Set()
+  const collect = (n) => {
+    if (!isArr(n)) return
+    if (n[0] === 'let' || n[0] === 'const')
+      for (let k = 1; k < n.length; k++) if (isArr(n[k]) && n[k][0] === '=' && typeof n[k][1] === 'string') declared.add(n[k][1])
+    n.forEach(collect)
+  }
+  stmts.forEach(collect)
+  if (!declared.size) return stmts
+  const ren = (n) => {
+    if (typeof n === 'string') return declared.has(n) ? n + suf : n
+    if (!isArr(n)) return n
+    if (n[0] === '.' && n.length === 3) return ['.', ren(n[1]), n[2]]
+    return [n[0], ...n.slice(1).map(ren)]
+  }
+  return stmts.map(ren)
+}
+
+// Replace `arr[iv-1]` reads with `left`; keep the store; emit `left = storeVal` after each store.
+function scalarReplace(stmts, arr, iv, left, storeVal) {
+  const repl = (n) => {
+    if (!isArr(n)) return n
+    if (n[0] === '[]' && n[1] === arr && isIvMinus1(n[2], iv)) return left
+    if (n[0] === '.' && n.length === 3) return ['.', repl(n[1]), n[2]]
+    return [n[0], ...n.slice(1).map(repl)]
+  }
+  const out = []
+  for (const s of stmts) {
+    out.push(repl(s))
+    if (isArr(s) && s[0] === '=' && isArr(s[1]) && s[1][0] === '[]' && s[1][1] === arr && s[1][2] === iv)
+      out.push(['=', left, storeVal])
+  }
+  return out
+}
+
+function tryUnroll(stmt, cm) {
+  const L = normalizeLoop(stmt)
+  if (!L || L.kind !== 'for') return null
+  const body = L.body
+  if (!isArr(body) || body[0] !== ';') return null
+  const iv = unitIncVar(L.step)
+  if (!iv) return null
+
+  // init `let iv = LO`, LO a literal ≥ 1 (so arr[LO-1] is a valid in-bounds index)
+  if (!(isArr(L.init) && L.init[0] === 'let' && isArr(L.init[1]) && L.init[1][0] === '=' && L.init[1][1] === iv)) return null
+  const LO = L.init[1][2], loVal = litVal(LO)
+  if (loVal == null || loVal < 1) return null
+
+  // cond `iv <= HI` / `iv < HI`, HI loop-invariant
+  if (!(isArr(L.cond) && (L.cond[0] === '<=' || L.cond[0] === '<') && L.cond[1] === iv)) return null
+  const cmpOp = L.cond[0], HI = L.cond[2]
+  if (!(typeof HI === 'string' || litVal(HI) != null)) return null
+
+  if (hasUnsafe(body)) return null
+  const stmts = body.slice(1)
+
+  // exactly one store `arr[iv] = <var>` — the recurrence array + carried value
+  let arr = null, storeVal = null, nStore = 0
+  for (const s of stmts)
+    if (isArr(s) && s[0] === '=' && isArr(s[1]) && s[1][0] === '[]' && s[1][2] === iv) {
+      if (typeof s[2] !== 'string') return null
+      arr = s[1][1]; storeVal = s[2]; nStore++
+    }
+  if (nStore !== 1 || typeof arr !== 'string') return null
+  if (storeVal === iv || storeVal === arr) return null
+
+  // every `arr[...]` is `arr[iv]` or `arr[iv-1]`, the only write is the store, ≥1 recurrence read,
+  // and `arr` never appears bare (passed/aliased)
+  let hasRec = false, bad = false
+  const scan = (n) => {
+    if (!isArr(n)) return
+    if (n[0] === '[]' && n[1] === arr) {
+      if (n[2] === iv) {} else if (isIvMinus1(n[2], iv)) hasRec = true; else bad = true
+    }
+    if (n[0] === '=' && isArr(n[1]) && n[1][0] === '[]' && n[1][1] === arr && n[1][2] !== iv) bad = true
+    if (!(n[0] === '[]' || n[0] === '.')) for (let k = 1; k < n.length; k++) if (n[k] === arr) bad = true
+    n.forEach(scan)
+  }
+  scan(body)
+  if (bad || !hasRec) return null
+
+  // The carry `left = storeVal` is emitted right after the store, so a recurrence read AFTER the
+  // store would see this cell's value, not arr[iv-1]. Require every arr[iv-1] read to precede it.
+  const storeIdx = stmts.findIndex(s => isArr(s) && s[0] === '=' && isArr(s[1]) && s[1][0] === '[]' && s[1][1] === arr && s[1][2] === iv)
+  const readsRec = (n) => isArr(n) && ((n[0] === '[]' && n[1] === arr && isIvMinus1(n[2], iv)) || n.some(readsRec))
+  for (let k = storeIdx + 1; k < stmts.length; k++) if (readsRec(stmts[k])) return null
+
+  // iv assigned only by the step; iv/arr/HI loop-invariant (not mutated, incl. via a closure call)
+  const ivMut = new Set(); findMutations(body, new Set([iv]), ivMut)
+  if (ivMut.has(iv)) return null
+  if (cm.has(iv) || cm.has(arr)) return null
+  if (typeof HI === 'string') { const hiMut = new Set(); findMutations(body, new Set([HI]), hiMut); if (hiMut.has(HI) || cm.has(HI)) return null }
+
+  // --- transform ---
+  const id = freshLoopId()
+  const left = `__rec${id}`
+  const bodyS = scalarReplace(stmts, arr, iv, left, storeVal)
+  const cellJ = () => bodyS.map(clone)
+  const cellJ1 = renameDecls(bodyS.map(s => subPlus1(clone(s), iv)), `$r${id}`)
+
+  const seed = ['let', ['=', left, ['[]', arr, loVal - 1]]]          // left = arr[LO-1]
+  const letIv = ['let', ['=', iv, clone(LO)]]                        // let iv = LO
+  const twoFit = cmpOp === '<=' ? ['<', iv, clone(HI)] : ['<', iv, ['-', clone(HI), 1]]
+  const main = ['while', twoFit,
+    [';', ['{}', [';', ...cellJ()]], ['{}', [';', ...cellJ1]], ['=', iv, ['+', iv, 2]]]]
+  const tail = ['if', [cmpOp, iv, clone(HI)],
+    ['{}', [';', ...cellJ(), ['=', iv, ['+', iv, 1]]]]]
+  const block = ['{}', [';', letIv, seed, main, tail]]
+  // Run the unrolled form only on a non-empty range (so the seed's arr[LO-1] load matches the
+  // original, which reads it only when it iterates); otherwise the untouched loop.
+  return [['if', [cmpOp, clone(LO), clone(HI)], block, stmt]]
+}
+
+export function unrollRecurrence(body) {
+  const cm = closureMutatedVars(body)
+  return rewriteBlocks(body, stmt => tryUnroll(stmt, cm))
+}

package/src/compile/loop-square.js

@@ -0,0 +1,102 @@
+// Bounded-square narrowing: carry `i*i` as i32 inside a loop guarded by `i*i < CONST`.
+//
+// A PRODUCT `i*i` is f64 in unhinted JS — the integer-overflow contract: a product can
+// exceed 2³¹, where JS keeps a Number, so jz can't blindly use i32.mul (it would wrap).
+// In a Sieve-of-Eratosthenes `for(i=2; i*i<LIMIT; i++) for(j=i*i; j<LIMIT; j+=i) …`, that
+// makes the outer bound, the inner counter `j`'s init, and the whole index chain f64 —
+// each typed-array access then pays an f64→i32 convert.
+//
+// But when the loop GUARD is `i*i < CONST` with CONST a compile-time constant ≤ 2³⁰, the
+// counter is i ≤ ⌈√CONST⌉ ≤ 2¹⁵ throughout the body (the loop is still running, and i is
+// only incremented by +1), so EVERY `i*i` there is < 2³⁰ < 2³¹ and `Math.imul(i,i) == i*i`
+// exactly. The exit overshoot (the first i with i*i ≥ CONST, evaluated in the condition)
+// is ≤ CONST + 2√CONST+1 < 2³¹ for CONST ≤ 2³⁰, so the condition narrows soundly too. The
+// hard cap is 2³⁰ — well under the 2³¹ overflow point, with margin for the overshoot.
+//
+// So we rewrite those `i*i` to `Math.imul(i,i)` (jz's i32 multiply): semantically identical
+// in the proven range, and it lets the EXISTING i32 machinery carry the index chain as i32
+// — the inner `j` (init now i32, step `j+i` i32, bound `j<CONST` i32) cascades on its own.
+//
+// Sound iff: the loop condition is `(i*i) </≤ CONST` (CONST ≤ 2³⁰), and the IV `i` is
+// incremented by +1 and NOT otherwise mutated (so within a body iteration i ∈ {entry, +1},
+// both squares < 2³¹). Mirrors strength-reduce-divmod's structure (post-prepare `while`).
+
+import { findMutations } from './analyze-scans.js'
+import { includeMods } from '../autoload.js'
+import { ctx } from '../ctx.js'
+import { litVal, unitIncVar, normalizeLoop, closureMutatedVars, rewriteBlocks } from './loop-model.js'
+
+const SQUARE_BOUND_MAX = 2 ** 30
+// The constant numeric value of a bound: a literal, OR a module const folded to an int
+// (`const LIMIT = 1<<20` → ctx.scope.constInts.get('LIMIT') = 1048576 — the bench form).
+const boundVal = (n) => {
+  const lit = litVal(n)
+  if (lit != null) return lit
+  if (typeof n === 'string') { const v = ctx.scope.constInts?.get(n); return typeof v === 'number' ? v : null }
+  return null
+}
+// `i * i` — the IV squared.
+const isSquare = (n, iv) => Array.isArray(n) && n[0] === '*' && n[1] === iv && n[2] === iv && typeof iv === 'string'
+// Math.imul(i, i) in CANONICAL post-prepare form: prepare resolves `Math.imul` → the string
+// ref `'math.imul'`, so the call is `['()', 'math.imul', [',', i, i]]`. math.imul emits a
+// primitive `i32.mul` (no stdlib helper / module include needed).
+const imulOf = (iv) => ['()', 'math.imul', [',', iv, iv]]
+
+// The IV of a `(i*i) </≤ CONST` (or mirrored `CONST >/≥ (i*i)`) guard, CONST ≤ 2³⁰, else null.
+function boundedSquareIV(cond) {
+  if (!Array.isArray(cond)) return null
+  let prod, bound
+  if (cond[0] === '<' || cond[0] === '<=') { prod = cond[1]; bound = cond[2] }
+  else if (cond[0] === '>' || cond[0] === '>=') { prod = cond[2]; bound = cond[1] }
+  else return null
+  if (!isSquare(prod, prod && prod[1])) return null
+  const b = boundVal(bound)
+  if (b == null || b < 0 || b > SQUARE_BOUND_MAX) return null
+  return prod[1]
+}
+
+// Narrow a `for`/`while` whose guard is `(i*i) </≤ CONST` (CONST ≤ 2³⁰) and whose IV `i` is
+// incremented by +1 and not otherwise mutated — then within any body iteration i ∈ {entry,
+// entry+1}, entry ≤ ⌈√CONST⌉ ≤ 2¹⁵, so every `i*i` (and the exit overshoot) is < 2³¹ and
+// Math.imul(i,i) == i*i. Rewrites those products; the dependent counter chain cascades to i32.
+// `cm` is the function's closure-mutated-vars set (an IV in it has an unprovable entry value).
+function tryNarrow(stmt, cm) {
+  const L = normalizeLoop(stmt)
+  if (!L) return null
+  const { kind, cond, step, body } = L, isFor = kind === 'for'
+
+  const iv = boundedSquareIV(cond)
+  if (!iv) return null
+  if (cm.has(iv)) return null   // mutable via a closure call — entry value unprovable
+
+  if (isFor) {
+    // The `for` update is the IV's sole, +1 mutation; the body must not reassign i.
+    if (unitIncVar(step) !== iv) return null
+    const ivMut = new Set(); findMutations(body, new Set([iv]), ivMut)
+    if (ivMut.has(iv)) return null
+  } else {
+    // `while`: the increment lives in the body (exactly one +1; nothing else mutates i).
+    if (!Array.isArray(body) || body[0] !== ';') return null
+    let ivIdx = -1
+    for (let k = 1; k < body.length; k++) if (unitIncVar(body[k]) === iv) { if (ivIdx >= 0) return null; ivIdx = k }
+    if (ivIdx < 0) return null
+    const ivMut = new Set()
+    findMutations([';', ...body.slice(1).filter((_, k) => k !== ivIdx - 1)], new Set([iv]), ivMut)
+    if (ivMut.has(iv)) return null
+  }
+
+  // We're injecting `math.imul` after prepare's auto-import step, so ensure the math module
+  // (which registers the `math.imul` → i32.mul primitive emitter) is included.
+  includeMods('math')
+  // Rewrite every `i*i` in the condition + body to Math.imul(i,i) (NOT init/update — they're
+  // `i=2` / `i++`). The inner counter whose init this feeds cascades to i32 on its own.
+  const rw = (n) => !Array.isArray(n) ? n : isSquare(n, iv) ? imulOf(iv) : n.map(rw)
+  return [isFor
+    ? ['for', L.init, rw(cond), step, rw(body)]
+    : ['while', rw(cond), rw(body)]]
+}
+
+export function narrowBoundedSquare(body) {
+  const cm = closureMutatedVars(body)
+  return rewriteBlocks(body, stmt => tryNarrow(stmt, cm))
+}

package/src/compile/narrow.js

@@ -28,6 +28,10 @@ import {
 } from './infer.js'
 
 const PTR_ABI_KINDS = new Set([VAL.OBJECT, VAL.SET, VAL.MAP, VAL.BUFFER])
+// Integer-preserving ops: an expr over integers stays integer (ToInt32-consistent) through these.
+// Excludes /, %, ** (fractional). Used to recognize a recursive arg whose i32-ness follows from
+// its inputs' i32-ness (`f(n - 1)`), so it carries no independent type evidence.
+const RECUR_INT_OPS = new Set(['+', '-', '*', 'u-', 'u+', '&', '|', '^', '<<', '>>', '>>>', '~'])
 
 
 function filterLiveCallSites(callSites, valueUsed) {
@@ -58,12 +62,17 @@ function filterLiveCallSites(callSites, valueUsed) {
 
 function buildCallerCtx() {
   const callerCtx = new Map()
-  callerCtx.set(null, { callerLocals: ctx.scope.globalTypes, callerValTypes: ctx.scope.globalValTypes })
+  const globalTE = ctx.scope.globalTypedElem || new Map()
+  callerCtx.set(null, { callerLocals: ctx.scope.globalTypes, callerValTypes: ctx.scope.globalValTypes, callerTypedElems: globalTE })
   for (const func of ctx.func.list) {
     if (!func.body || func.raw) continue
     const facts = analyzeBody(func.body)
     for (const p of func.sig.params) if (!facts.locals.has(p.name)) facts.locals.set(p.name, p.type)
-    callerCtx.set(func, { callerLocals: facts.locals, callerValTypes: facts.valTypes })
+    // Shadow-aware local+global typed-array map: a `const buf = new Int32Array(…)`
+    // local makes `buf[i]` arg reads type i32 at this caller's sites, so a callee
+    // param fed only such elements narrows (else it stays f64 and `1 << p` drags in
+    // __to_num → the whole string↔number stdlib). Mirrors callerTypedElemsFor.
+    callerCtx.set(func, { callerLocals: facts.locals, callerValTypes: facts.valTypes, callerTypedElems: callerTypedElemsFor(func, globalTE) })
   }
   return callerCtx
 }
@@ -165,9 +174,10 @@ function refreshCallerValTypes(callerCtx) {
 // it is the same single typed-array ctor (scope.js invalidates on any conflict),
 // so it can't denote a different kind at the call site.
 function callerTypedElemsFor(func, globalTE) {
-  const local = analyzeBody(func.body).typedElems
+  const facts = analyzeBody(func.body)
+  const local = facts.typedElems
   if (!globalTE.size) return local
-  const shadowed = new Set(analyzeBody(func.body).locals.keys())
+  const shadowed = new Set(facts.locals.keys())
   for (const p of func.sig?.params || []) shadowed.add(p.name)
   const merged = new Map()
   for (const [k, v] of globalTE) if (!shadowed.has(k)) merged.set(k, v)
@@ -223,6 +233,7 @@ function enrichCallerValTypesFromPointerParams(callerCtx) {
 }
 
 function refreshCallerLocals(callerCtx) {
+  const prevTE = ctx.types.typedElem
   for (const func of ctx.func.list) {
     if (!func.body || func.raw) continue
     // Seed pointer-narrowed params' val-kind so analyzeBody recognises e.g.
@@ -232,13 +243,24 @@ function refreshCallerLocals(callerCtx) {
     // (heapsort→siftDown's `end`). analyzeFuncForEmit re-seeds + re-invalidates at
     // emit time, so this transient localReps doesn't leak past narrowing.
     ctx.func.localReps = new Map()
-    for (const p of func.sig.params) if (p.ptrKind != null) ctx.func.localReps.set(p.name, { val: p.ptrKind })
+    // Seed the typedElem overlay with this func's TYPED-pointer params (element ctor from
+    // ptrAux), exactly as analyzeFuncForEmit does at emit time. Without it, a local bound to
+    // an integer typed-array PARAM element — `aa = perm[perm[X]+Y]` (noise), perm an Int32
+    // pointer param — types f64 here, so a callee fed it (`grad(aa,…)`, used only as `aa&3`)
+    // never narrows its param to i32. Mirrors emit so narrow-time callerLocals agree with it.
+    const te = ctx.scope.globalTypedElem ? new Map(ctx.scope.globalTypedElem) : new Map()
+    for (const p of func.sig.params) {
+      if (p.ptrKind != null) ctx.func.localReps.set(p.name, { val: p.ptrKind })
+      if (p.ptrKind === VAL.TYPED && p.ptrAux != null) { const c = ctorFromElemAux(p.ptrAux); if (c != null) te.set(p.name, c) }
+    }
+    ctx.types.typedElem = te
     invalidateLocalsCache(func.body)
     const fresh = analyzeBody(func.body).locals
     for (const p of func.sig.params) if (!fresh.has(p.name)) fresh.set(p.name, p.type)
     callerCtx.get(func).callerLocals = fresh
   }
   ctx.func.localReps = null
+  ctx.types.typedElem = prevTE
 }
 
 function resetParamWasmFacts(paramReps) {
@@ -280,6 +302,35 @@ function narrowI32Results(funcs) {
     e[0] === '>>>' ||
     (e[0] === '()' && typeof e[1] === 'string' && ctx.func.map?.get(e[1])?.sig?.unsignedResult === true)
   )
+  const callsSelf = (n, name) => Array.isArray(n) && ((n[0] === '()' && n[1] === name) || n.some(c => callsSelf(c, name)))
+  // Classify a func's return tails as all-v128 / all-i32 (+ sign) under the CURRENT sig.results.
+  const evalTails = (func, body, exprs) => {
+    const savedCurrent = ctx.func.current
+    ctx.func.current = func.sig
+    const locals = isBlockBody(body) ? analyzeBody(body).locals : new Map()
+    for (const p of func.sig.params) if (!locals.has(p.name)) locals.set(p.name, p.type)
+    // Seed the typedElem overlay with this func's TYPED-pointer params so a return tail
+    // reading a typed-array element — `return vals[h]`, vals an Int32Array param (dict's
+    // `lookup`) — types as i32, not NaN-boxed f64. Without it the call site keeps the full
+    // __typed_idx/ToNumber unbox dispatch (491520× per dict kernel run). Mirrors
+    // refreshCallerLocals + analyzeFuncForEmit. Only meaningful once Phase G has tagged params
+    // ptrKind=TYPED (the I2 re-run below); harmless before (no typed params → overlay untouched).
+    const savedTE = ctx.types.typedElem
+    let te = null
+    for (const p of func.sig.params) {
+      if (p.ptrKind === VAL.TYPED && p.ptrAux != null) {
+        const c = ctorFromElemAux(p.ptrAux)
+        if (c != null) { if (!te) te = savedTE ? new Map(savedTE) : new Map(); te.set(p.name, c) }
+      }
+    }
+    if (te) ctx.types.typedElem = te
+    const allV128 = exprs.every(e => exprType(e, locals) === 'v128')
+    const allI32 = !allV128 && exprs.every(e => exprType(e, locals) === 'i32')
+    if (te) ctx.types.typedElem = savedTE
+    const r = { allV128, allI32, anyUnsigned: exprs.some(isUnsignedTail), allUnsigned: exprs.every(isUnsignedTail) }
+    ctx.func.current = savedCurrent
+    return r
+  }
   let changed = true
   while (changed) {
     changed = false
@@ -289,22 +340,40 @@ function narrowI32Results(funcs) {
       if (isBlockBody(body) && hasBareReturn(body)) continue
       const exprs = returnExprs(body)
       if (!exprs.length) continue
-      const savedCurrent = ctx.func.current
-      ctx.func.current = func.sig
-      const locals = isBlockBody(body) ? analyzeBody(body).locals : new Map()
-      for (const p of func.sig.params) if (!locals.has(p.name)) locals.set(p.name, p.type)
-      const allV128 = exprs.every(e => exprType(e, locals) === 'v128')
-      const allI32 = !allV128 && exprs.every(e => exprType(e, locals) === 'i32')
-      const anyUnsigned = exprs.some(isUnsignedTail)
-      const allUnsigned = exprs.every(isUnsignedTail)
-      ctx.func.current = savedCurrent
+      let r = evalTails(func, body, exprs)
+      // Recursive result cycle: a self-call in a return tail — or feeding a returned local
+      // (nqueens' `cnt = cnt + solve(…); return cnt`) — reads solve's own not-yet-narrowed
+      // f64 result, so `cnt` widens to f64 and the i32 narrowing never fires. Break the cycle
+      // optimistically: tentatively assume the i32 result, re-analyze, and keep it ONLY if every
+      // tail is then i32 (else revert). Sound — committed only when self-consistent.
+      if (!r.allI32 && !r.allV128 && callsSelf(body, func.name)) {
+        const saved = func.sig.results
+        func.sig.results = ['i32']
+        invalidateLocalsCache(body)
+        const opt = evalTails(func, body, exprs)
+        if (opt.allI32 && (!opt.anyUnsigned || opt.allUnsigned)) {
+          if (opt.allUnsigned) func.sig.unsignedResult = true
+          changed = true
+          continue
+        }
+        func.sig.results = saved
+        invalidateLocalsCache(body)
+        r = evalTails(func, body, exprs)
+      }
       // SIMD: every tail returns a lane vector → v128 result.
-      if (allV128) {
+      if (r.allV128) {
         func.sig.results = ['v128']
         changed = true
-      } else if (allI32 && (!anyUnsigned || allUnsigned)) {   // sign-consistent i32 tails
+      } else if (r.allI32 && (!r.anyUnsigned || r.allUnsigned)) {   // sign-consistent i32 tails
         func.sig.results = ['i32']
-        if (allUnsigned) func.sig.unsignedResult = true
+        if (r.allUnsigned) func.sig.unsignedResult = true
+        // A committed i32 result is a genuine NUMBER, so stamp valResult for the call-site
+        // VAL dispatch — E2 (narrowValResults) ran ABOVE the param lattice and so couldn't
+        // type a `return typedArrayParam[idx]` tail (hashjoin's `probe` → `vals[h]`), leaving
+        // valResult unset → the hot `sum + probe()` stayed the polymorphic string-or-number
+        // `+`. Only-if-unset: an UNBOXED-pointer i32 result already carries its ARRAY/OBJECT/
+        // TYPED valResult (the unboxing ABI needs it), so this never overwrites a pointer kind.
+        if (func.valResult == null) func.valResult = VAL.NUMBER
         changed = true
       }
     }
@@ -661,6 +730,7 @@ export default function narrowSignatures(programFacts, ast) {
       callee, callerFunc, argList, func, restIdx,
       callerLocals: ctxEntry.callerLocals,
       callerValTypes: ctxEntry.callerValTypes,
+      callerTypedElems: ctxEntry.callerTypedElems,
       callerParamFacts(key) {
         if (!paramFacts.has(key)) paramFacts.set(key, paramFactsOf(paramReps, callerFunc, key))
         return paramFacts.get(key)
@@ -672,10 +742,20 @@ export default function narrowSignatures(programFacts, ast) {
       const state = siteState(callSites[s])
       if (!state) continue
       const { func, argList } = state
+      const recursive = state.callee === state.callerFunc?.name
       for (let k = 0; k < func.sig.params.length; k++) {
         const r = ensureParamRep(paramReps, state.callee, k)
         if (k >= argList.length) { for (const rule of rules) rule.missing(r, k, state); continue }
-        for (const rule of rules) rule.apply(r, argList[k], k, state)
+        const arg = argList[k]
+        // Recursive identity arg — `f(…, p, …)` calling itself with its own param p threaded
+        // through at the same position — is a fixpoint identity: it carries whatever type p
+        // settles to, so it constrains nothing. Skip it, else exprType(p) reads p's not-yet-
+        // narrowed f64 and the meet poisons the type the non-recursive call sites would prove
+        // (nqueens' `solve(all, …)` — `all` stuck f64 while cols/d1/d2, passed as i32 bitwise
+        // exprs, narrowed fine).
+        const pname = func.sig.params[k].name
+        if (recursive && (arg === pname || (Array.isArray(arg) && arg[0] === 'local.get' && arg[1] === pname))) continue
+        for (const rule of rules) rule.apply(r, arg, k, state)
       }
     }
   }
@@ -743,6 +823,49 @@ export default function narrowSignatures(programFacts, ast) {
       mergeParamFact(r, field, v)
     },
   })
+  // WASM type of a call arg. exprType resolves most shapes, but an INTEGER typed-array
+  // element read `intArr[idx]` (and arithmetic over it, `intArr[idx]+1`) types f64 here:
+  // exprType's `[]` rule reads the typedElem OVERLAY, which doesn't see a typedCtor-narrowed
+  // PARAM array at fixpoint time — yet the element is a 32-bit machine integer. Install the
+  // caller's resolved param-typedCtors (+ module globals) as that overlay for the duration
+  // of the type query, so a param fed only such integer elements (dict's key `k` ← src[i],
+  // threaded through Math.imul / === keys[h] / keys[h]=k) narrows to i32 instead of paying
+  // convert + f64-compare + trunc round-trips through its probe loop.
+  // A value built ONLY from the callee's own params + already-i32 locals + integer constants via
+  // integer-preserving ops. Its i32-ness follows from its inputs' — for a recursive self-call it
+  // carries no INDEPENDENT evidence about whether the params are i32. Used for the optimism below.
+  const isRecurIntExpr = (n, pnames, callerLocals) => {
+    if (typeof n === 'string') return pnames.has(n) || callerLocals?.get?.(n) === 'i32'
+    if (typeof n === 'number') return Number.isInteger(n)
+    if (!Array.isArray(n)) return false
+    if (n[0] == null) return typeof n[1] === 'number' && Number.isInteger(n[1])           // boxed int literal
+    if (n[0] === 'local.get') return pnames.has(n[1]) || callerLocals?.get?.(n[1]) === 'i32'
+    if (RECUR_INT_OPS.has(n[0])) return n.slice(1).every(c => isRecurIntExpr(c, pnames, callerLocals))
+    return false
+  }
+  const argWasmType = (arg, state) => {
+    // Recursive self-call: an arg built only from the callee's own params + already-i32 locals +
+    // int constants (`f(n - 1)`, `f(n - 1 - i)`) is i32 IFF those params are i32 — a fixpoint
+    // identity carrying no INDEPENDENT type evidence. Optimistically type it i32 so the NON-
+    // recursive call sites decide: all i32 ⇒ the param narrows; any f64 ⇒ the meet still poisons
+    // it. Lets a plain decreasing recursion narrow with no `|0` source crutch. (The bare-identity
+    // arg `f(n)` is already skipped wholesale in runCallsiteLattice.)
+    if (state.callee === state.callerFunc?.name &&
+        isRecurIntExpr(arg, new Set(state.func.sig.params.map(p => p.name)), state.callerLocals)) return 'i32'
+    if (!state._teOverlay) {
+      // Caller's typed arrays (locals + non-shadowed globals, precomputed shadow-aware
+      // in buildCallerCtx) so a LOCAL `const buf = new Int32Array(…)` makes `buf[i]`
+      // type i32 here — not just module globals / typedCtor-narrowed params.
+      const m = new Map(state.callerTypedElems || ctx.scope.globalTypedElem || [])
+      const pf = state.callerParamFacts('typedCtor')
+      if (pf) for (const [name, ctor] of pf) if (ctor != null) m.set(name, ctor)
+      state._teOverlay = m
+    }
+    const prev = ctx.func.localTypedElemsOverlay
+    ctx.func.localTypedElemsOverlay = state._teOverlay
+    try { return exprType(arg, state.callerLocals) }
+    finally { ctx.func.localTypedElemsOverlay = prev }
+  }
   const runFixpoint = () => runCallsiteLattice([
     // val runs SOFT (monotone): a TYPED param's val only becomes inferable after the
     // typedCtor fixpoint + pointer-ABI enrichment, so an early hard merge would
@@ -754,7 +877,7 @@ export default function narrowSignatures(programFacts, ast) {
       missing: poison('wasm'),
       apply(r, arg, _k, state) {
         if (r.wasm === null) return
-        const wt = exprType(arg, state.callerLocals)
+        const wt = argWasmType(arg, state)
         if (r.wasm === undefined) r.wasm = wt
         else if (r.wasm !== wt) r.wasm = null
       },
@@ -919,6 +1042,16 @@ export default function narrowSignatures(programFacts, ast) {
   // (callback bench: mix is FNV — params and result all i32-shaped, but inferred
   // only after E phase narrowed mix's result).
   phase.refreshLocals()
+  // I2: Re-narrow i32 RESULTS now that Phase G (applyTypedPointerParamAbi) has tagged
+  // typed-array params ptrKind=TYPED. Phase E ran before G, so a function returning a
+  // typed-array element — dict's `lookup = (keys, vals, k) => { … return vals[h] }` with
+  // vals an Int32Array param — had its return tail type as NaN-boxed f64 (vals not yet a
+  // typed pointer), leaving sig.results f64 and the call site running the full
+  // __typed_idx/ToNumber unbox on every probe step (491520× per dict kernel run). Now that
+  // evalTails seeds the typed-param overlay and params carry ptrAux, the fixpoint catches
+  // `vals[h]` as i32, narrows the result, and the dispatch vanishes; the runFixpoint below
+  // then propagates the i32 result into `let v = lookup(...)` at the call sites.
+  narrowI32Results(funcsWithNarrowableResult)
   // Reset wasm field unconditionally — first pass populated it from stale callerLocals
   // (where `let h = mix(...)` widened h to f64 because mix's result wasn't narrowed
   // yet). clearStickyNull only resets null; here we need to reset f64-observed too
@@ -1334,25 +1467,37 @@ export function specializeBimorphicTyped(programFacts) {
 
     // Build one clone per distinct combo.
     const cloneByKey = new Map()
-    for (const [key, combo] of distinct) {
-      const suffix = combo.map(c => c.replace(/^new\./, '').replace(/\./g, '_')).join('$')
+    for (const [dkey, cmb] of distinct) {
+      // NB: this loop variable must NOT reuse the name `combo` (declared twice above, at the
+      // site loop and the distinct-building loop). The self-host miscompiles a for-of loop
+      // variable whose name collides with an earlier block-scoped declaration — it aliases the
+      // prior binding instead of rebinding per iteration, so `combo` would stay stuck at the
+      // last site's ctor and every clone would get the same (wrong) element type → silent
+      // garbage. A unique name gets a clean per-iteration binding.
+      const suffix = cmb.map(c => c.replace(/^new\./, '').replace(/\./g, '_')).join('$')
       let cloneName = `${func.name}$${suffix}`
       let n = 0
       while (ctx.func.names.has(cloneName)) cloneName = `${func.name}$${suffix}$${++n}`
 
+      // Build cloneSig with clean, fully-formed object literals — never by spreading a
+      // live object and then overriding/extending its keys. A MULTI-prop spread of a
+      // member-access source (`{ ...func.sig, params, results }`) takes the static
+      // allKnown OBJECT-merge path, which trusts func.sig's COMPILE-TIME schema; sig
+      // objects are polymorphic (some carry result/ptrKind/unsignedResult), so that
+      // schema can be a subset of the runtime shape and the slot-copy then faults a
+      // later `sig.params` read out of bounds in the self-host. (The single-unknown
+      // `{ ...x }` clone is fixed at the root — __obj_clone — but the allKnown merge
+      // path is a separate hazard.) Constructing each param with its pointer ABI baked
+      // in sidesteps it; output is unchanged on the host.
       const cloneSig = {
-        ...func.sig,
-        params: func.sig.params.map(p => ({ ...p })),
+        params: func.sig.params.map((p, idx) => {
+          const bi = bimorphic.indexOf(idx)
+          return bi < 0
+            ? { ...p }
+            : { name: p.name, type: 'i32', ptrKind: VAL.TYPED, ptrAux: typedElemAux(cmb[bi]) }
+        }),
         results: [...func.sig.results],
       }
-      for (let i = 0; i < bimorphic.length; i++) {
-        const k = bimorphic[i]
-        const aux = typedElemAux(combo[i])
-        const p = cloneSig.params[k]
-        p.type = 'i32'
-        p.ptrKind = VAL.TYPED
-        p.ptrAux = aux
-      }
       const clone = { ...func, name: cloneName, sig: cloneSig }
       ctx.func.list.push(clone)
       ctx.func.map.set(cloneName, clone)
@@ -1360,19 +1505,20 @@ export function specializeBimorphicTyped(programFacts) {
 
       // Mirror per-param reps under the clone's name with mono ctors at bimorphic
       // positions. emitFunc's preseed reads typedCtor → seeds typedElem map →
-      // `arr[i]` lowers to direct typed load.
+      // `arr[i]` lowers to direct typed load. Each `{ ...r }` is a true clone, so
+      // pinning typedCtor on it leaves the source rep untouched (__obj_clone).
       const cloneReps = new Map()
       for (const [k, r] of reps) cloneReps.set(k, { ...r })
       for (let i = 0; i < bimorphic.length; i++) {
         const k = bimorphic[i]
         const r = cloneReps.get(k) || {}
-        r.typedCtor = combo[i]
+        r.typedCtor = cmb[i]
         r.val = VAL.TYPED
         cloneReps.set(k, r)
       }
       paramReps.set(cloneName, cloneReps)
 
-      cloneByKey.set(key, clone)
+      cloneByKey.set(dkey, clone)
     }
 
     // Rewrite each site's call AST to point at the matching clone.