jz 0.7.0 → 0.8.1

package/src/optimize/vectorize.js

@@ -1,5 +1,6 @@
 import { findBodyStart } from '../ir.js'
-import { warn } from '../ctx.js'
+import { warn, ctx } from '../ctx.js'
+import { nodeEqual as exprEq } from '../ast.js'
 
 /**
  * Lane-local SIMD-128 vectorizer.
@@ -48,7 +49,9 @@ import { warn } from '../ctx.js'
 
 const isArr = n => Array.isArray(n)
 
-const exprEq = (a, b) => JSON.stringify(a) === JSON.stringify(b)
+// Structural node equality — must be non-finite- AND bigint-safe: plain
+// JSON.stringify maps Infinity/-Infinity/NaN→null and -0→0, so it would equate a
+// `[Inf,-Inf]` lane pair and splat it (dropping -Inf). nodeEqual tags those.
 const localGetName = n => isArr(n) && n[0] === 'local.get' && typeof n[1] === 'string' ? n[1] : null
 const f64Zero = n => isArr(n) && n[0] === 'f64.const' && Number(n[1]) === 0
 
@@ -67,9 +70,16 @@ const isSplatConst = (n, constOp) =>
 function matchCanonSelect(sel, laneType) {
   if (!isArr(sel) || sel[0] !== 'select') return null
   const C = sel[1], val = sel[2], cond = sel[3]
-  const neOp = laneType === 'f32' ? 'f32.ne' : 'f64.ne'
-  if (!isSplatConst(C, LANE_INFO[laneType].constOp)) return null
-  if (!(isArr(cond) && cond[0] === neOp && exprEq(cond[1], val) && exprEq(cond[2], val))) return null
+  // f32 lane: jz computes the value in f64, so `Math.min/max` (and any NaN-canon'd
+  // f32 result) emit the canon with `f64.ne` + an f64 NaN const. Accept that
+  // alongside the native f32 form; liftCanon splats the const as f32.
+  const f64Canon = laneType === 'f32' && isArr(C) && C[0] === 'f64.const' && isArr(cond) && cond[0] === 'f64.ne'
+  if (!f64Canon) {
+    const neOp = laneType === 'f32' ? 'f32.ne' : 'f64.ne'
+    if (!isSplatConst(C, LANE_INFO[laneType].constOp)) return null
+    if (!(isArr(cond) && cond[0] === neOp)) return null
+  }
+  if (!(exprEq(cond[1], val) && exprEq(cond[2], val))) return null
   return { val, C }
 }
 
@@ -93,10 +103,11 @@ function normTee(n) {
 // RESULT — equal operands tie to the same value — so only the direction axis matters.
 function matchIntMinMaxReduce(rhs, accName) {
   if (!isArr(rhs)) return null
-  let cond, T, E
+  let cond, T, E, resTy = null
   if (rhs[0] === 'if') {
     let i = 1
-    if (!(isArr(rhs[i]) && rhs[i][0] === 'result' && rhs[i][1] === 'i32')) return null
+    if (!(isArr(rhs[i]) && rhs[i][0] === 'result' && (rhs[i][1] === 'i32' || rhs[i][1] === 'f64'))) return null
+    resTy = rhs[i][1]
     i++
     if (rhs.length !== i + 3) return null
     cond = rhs[i]
@@ -116,8 +127,12 @@ function matchIntMinMaxReduce(rhs, accName) {
   let cmp = cond
   if (isArr(cmp) && cmp[0] === 'i32.ne' && isI32Const(cmp[2]) && cmp[2][1] === 0) cmp = cmp[1]
   if (!isArr(cmp) || cmp.length !== 3) return null
-  const dir = { 'i32.gt_s': 'gt', 'i32.ge_s': 'gt', 'i32.lt_s': 'lt', 'i32.le_s': 'lt' }[cmp[0]]
+  // Integer (i32x4.max_s, exact) or float (f64x2.pmax, exact per-element incl NaN/±0) compare.
+  const dir = { 'i32.gt_s': 'gt', 'i32.ge_s': 'gt', 'i32.lt_s': 'lt', 'i32.le_s': 'lt',
+                'f64.gt': 'gt', 'f64.ge': 'gt', 'f64.lt': 'lt', 'f64.le': 'lt' }[cmp[0]]
   if (!dir) return null
+  const laneType = cmp[0].startsWith('f64.') ? 'f64' : 'i32'
+  if (resTy != null && resTy !== laneType) return null   // if-form result type must agree with the compare
   // Comparison operands must be {acc, EXPR}; take the non-acc side as the canonical lane
   // expr (it carries the address tee). exprIsLeftOfCmp records its position.
   let condExpr, exprIsLeftOfCmp
@@ -128,7 +143,7 @@ function matchIntMinMaxReduce(rhs, accName) {
   if (!exprEq(normTee(condExpr), normTee(exprBr))) return null
   // cond true ⟺ EXPR > acc  ⇒  picking EXPR-when-true is a max; picking-when-false a min.
   const predExprGreater = dir === 'gt' ? exprIsLeftOfCmp : !exprIsLeftOfCmp
-  return { exprNode: condExpr, isMax: takeExprWhenTrue === predExprGreater }
+  return { exprNode: condExpr, isMax: takeExprWhenTrue === predExprGreater, laneType }
 }
 
 // Match the un-flattened canon, emitted when a Math.* result feeds another op
@@ -175,19 +190,24 @@ const matchDotStore = (n, acc) => {
   return null
 }
 
+// Unroll width this dot-product recognizer expects: a `acc=0` reset, exactly this
+// many `acc += L[k]*R[k]` steps, then the store. Tied to the emitter's 4-wide dot
+// unroll — matchDotStore / f64x2Pair / dotPairExpr below are hardwired to it.
+const DOT_UNROLL = 4
+
 const matchF64DotSeq = (stmts, i) => {
   const reset = stmts[i]
   if (!isArr(reset) || reset[0] !== 'local.set' || typeof reset[1] !== 'string' || !f64Zero(reset[2])) return null
   const acc = reset[1]
   const left = [], right = []
-  for (let k = 0; k < 4; k++) {
+  for (let k = 0; k < DOT_UNROLL; k++) {
     const pair = matchAccumStep(stmts[i + 1 + k], acc)
     if (!pair) return null
     left.push(pair[0])
     right.push(pair[1])
   }
-  const store = matchDotStore(stmts[i + 5], acc)
-  return store ? { end: i + 6, acc, left, right, ...store } : null
+  const store = matchDotStore(stmts[i + 1 + DOT_UNROLL], acc)
+  return store ? { end: i + 2 + DOT_UNROLL, acc, left, right, ...store } : null
 }
 
 const f64x2Pair = (lo, hi) => ['f64x2.replace_lane', 1, ['f64x2.splat', ['local.get', lo]], ['local.get', hi]]
@@ -243,7 +263,7 @@ const vectorizeStraightLineF64DotPairsIn = (node, fnLocals, freshIdRef, newLocal
       addend = ['local.get', tmp]
     }
     const pairs = []
-    for (let k = 0; k < 4; k++) {
+    for (let k = 0; k < DOT_UNROLL; k++) {
       const key = `${a.right[k]}\0${b.right[k]}`
       let tmp = pairTemps.get(key)
       if (!tmp) {
@@ -267,6 +287,270 @@ const vectorizeStraightLineF64DotPairsIn = (node, fnLocals, freshIdRef, newLocal
   }
 }
 
+// =============================================================================
+// Loop-invariant partial-product hoist for unrolled f64 dot reductions.
+//
+// A fully-unrolled inner reduction over scalar-replaced array cells (mat4's
+// `out[r][c] = Σ a[r][k]·b[k][c]`) lives in the body of an OUTER loop that
+// mutates only a few of those cells (mat4: a[0],a[5],b[0],b[5]). Every product
+// whose two operands are both outer-loop-invariant is therefore the SAME every
+// iteration — yet the body recomputes all of them. rust/LLVM precomputes those
+// invariant partials in a loop prologue (mat4.rs → ~294 lines before its loop);
+// V8/wasmtime/JSC cannot, because at the wasm level they can't prove the cells
+// are loop-invariant (no aliasing model). So jz must hoist them itself.
+//
+// Splitting `s = t0+t1+t2+t3` into `INV = Σ(invariant tk)` (hoisted) + `Σ(variant
+// tk)` (kept) REASSOCIATES the float sum — invariant terms are summed first,
+// regardless of original position — so results differ by ULPs from the strict
+// left-to-right order. That is the SAME class of reorder jz already ships for
+// horizontal/multi-accumulator reductions (policy at lines ~620 and ~1584), and
+// rust itself does it at -O3 without fast-math. Gated to the relaxedFma/speed
+// tier exactly like those, so strict opts keep bit-exact order.
+//
+// Surgical by construction: fires only on a dot that MIXES invariant and variant
+// terms inside a loop. A pure-variant dot (a real matmul kernel, every operand
+// streaming) has no invariant term → untouched. Runs BEFORE the dot-pair
+// vectorizer; a hoisted dot has < DOT_UNROLL accumulate steps so matchF64DotSeq
+// no longer matches it — it stays the (faster here) scalar form, like rust.
+const hoistDotInvariant = (loop, parent, idx, fnLocals, freshIdRef, newLocalDecls) => {
+  const writeSet = new Set()
+  collectWrites(loop, writeSet)
+  const isInv = name => typeof name === 'string' && !writeSet.has(name) && fnLocals.get(name) === 'f64'
+  const invInits = []
+  const processList = (list) => {
+    for (let i = 0; i < list.length;) {
+      const seq = matchF64DotSeq(list, i)
+      if (!seq) { i++; continue }
+      const invKs = [], varKs = []
+      for (let k = 0; k < DOT_UNROLL; k++) (isInv(seq.left[k]) && isInv(seq.right[k]) ? invKs : varKs).push(k)
+      if (invKs.length === 0) { i = seq.end; continue }  // nothing loop-invariant — leave for the vectorizer
+      // INV = Σ invariant products, in original k-order, computed once before the loop.
+      let inv = ['f64.const', '0']
+      for (const k of invKs) inv = ['f64.add', inv, ['f64.mul', ['local.get', seq.left[k]], ['local.get', seq.right[k]]]]
+      const invName = `$__rinv_${freshIdRef.next++}`
+      newLocalDecls.push(['local', invName, 'f64']); fnLocals.set(invName, 'f64')
+      invInits.push(['local.set', invName, inv])
+      // In-loop: seed acc with INV, add only the variant products, then the unchanged store.
+      const repl = [['local.set', seq.acc, ['local.get', invName]]]
+      for (const k of varKs) repl.push(['local.set', seq.acc, ['f64.add', ['local.get', seq.acc], ['f64.mul', ['local.get', seq.left[k]], ['local.get', seq.right[k]]]]])
+      repl.push(['local.set', seq.out, seq.addend ? ['f64.add', ['local.get', seq.acc], seq.addend] : ['local.get', seq.acc]])
+      list.splice(i, seq.end - i, ...repl)
+      i += repl.length
+    }
+  }
+  const scan = (n) => { if (!isArr(n)) return; processList(n); for (let j = 0; j < n.length; j++) if (isArr(n[j])) scan(n[j]) }
+  scan(loop)
+  if (invInits.length) parent.splice(idx, 0, ...invInits)
+}
+
+// Walk a function, hoisting invariant reduction partials out of each loop. Inner
+// loops first (post-order) so a dot is hoisted relative to its tightest enclosing
+// loop, and an already-rewritten dot can't re-match in an outer pass.
+const hoistReductionInvariantsIn = (fn, fnLocals, freshIdRef, newLocalDecls) => {
+  const walk = (node, parent, idx) => {
+    if (!isArr(node)) return
+    for (let i = 0; i < node.length; i++) if (isArr(node[i])) walk(node[i], node, i)
+    if (node[0] === 'loop' && isArr(parent)) hoistDotInvariant(node, parent, idx, fnLocals, freshIdRef, newLocalDecls)
+  }
+  for (let i = 0; i < fn.length; i++) if (isArr(fn[i])) walk(fn[i], fn, i)
+}
+
+// =============================================================================
+// SLP (superword-level parallelism): pack two ADJACENT isomorphic f64 element
+// stores into one f64x2 store — the WITHIN-iteration 2-lane class the loop
+// vectorizer (which packs ACROSS iterations) structurally cannot reach.
+//
+// Soundness has TWO obligations, because the pack reorders memory: it materializes
+// BOTH lane values BEFORE either store, turning [read0, write0, read1, write1] into
+// [read0, read1, write0, write1].
+//   1. CROSS-base aliasing — guarded by one module fact: no typed-array VIEW exists
+//      (`ctx.features.typedView` false, checked at the dispatch). A view (subarray /
+//      buffer-backed ctor) is the only way two DISTINCT typed bases can overlap;
+//      without one, distinct bases own disjoint allocations and can't alias.
+//   2. WITHIN-base read-after-write — the high value (read1) must not load the low
+//      store's target (write0), or the pack reads write0's PRE-store value. This is a
+//      same-base hazard a view gate can't see (`o[k+1]=o[k]; o[k+2]=o[k+1]` forward
+//      shift); slpReadsOffset rejects it. The sound own-index map reads its OWN offset,
+//      never the sibling's, so it survives.
+// The pack is admitted ONLY when overhead-free (adjacent loads → v128.load,
+// identical pure scalar → splat, matching op → recurse); anything that would
+// need a per-lane `replace_lane` build bails, which makes the rewrite both
+// PROFITABLE and unable to grow code. Every f64x2 lane op is bit-identical to its
+// scalar f64 op (IEEE element-wise), so the result is byte-equal to the scalar form.
+// =============================================================================
+const F64X2_BIN = { 'f64.add': 'f64x2.add', 'f64.sub': 'f64x2.sub', 'f64.mul': 'f64x2.mul', 'f64.div': 'f64x2.div', 'f64.min': 'f64x2.min', 'f64.max': 'f64x2.max' }
+const F64X2_UN = { 'f64.neg': 'f64x2.neg', 'f64.abs': 'f64x2.abs', 'f64.sqrt': 'f64x2.sqrt' }
+
+// The subtree's value is the SAME evaluated once (splat) or twice (the two source
+// statements, which are adjacent — no store/reassign between): a pure, side-effect-free,
+// DETERMINISTIC expression. Rejects calls (a `new TypedArray()` alloc returns a fresh
+// pointer per call — splatting it would make the two lanes ALIAS, the array-literal
+// scatter miscompile), loads, and any store/set/memory op.
+const slpSplatSafe = (n) => {
+  if (!isArr(n)) return true
+  const op = n[0]
+  if (typeof op !== 'string') return false
+  if (op.startsWith('call') || op.includes('.load') || op.includes('.store')
+      || op === 'local.set' || op === 'local.tee' || op === 'global.set'
+      || op.startsWith('memory.') || op.includes('.atomic.')) return false
+  for (let i = 1; i < n.length; i++) if (!slpSplatSafe(n[i])) return false
+  return true
+}
+
+// Decompose a load/store node, normalizing the optional `offset=K` attribute jz
+// folds adjacent accesses into: `(op addr …)` → off 0, `(op offset=K addr …)` → K.
+const slpMem = (n) => {
+  if (!isArr(n)) return null
+  if (typeof n[1] === 'string' && n[1].startsWith('offset=')) return { off: +n[1].slice(7), addr: n[2], val: n[3] }
+  return { off: 0, addr: n[1], val: n[2] }
+}
+// The two accesses (x = low/first, y = high/second) provably address the SAME base
+// pointer. Sound shapes only — `y` must read what `x` produced, never redefine it:
+//   • x = (local.tee $X e), y = (local.get $X)  — x defines the shared ptr, y reuses it
+//   • x = (local.get $X),   y = (local.get $X)  — both read the same already-set local
+//   • exprEq(x, y) with NEITHER a tee            — identical side-effect-free addresses
+// REJECTS `(local.tee $X eA), (local.tee $X eB)` (y redefines $X to a different address
+// → the high lane would write the wrong place) and `(get $X), (tee $X e)` — the watr.js
+// self-host miscompile came from accepting those by name alone.
+const slpSameBase = (x, y) => {
+  if (!isArr(x) || !isArr(y)) return false
+  if (x[0] === 'local.tee' && y[0] === 'local.get' && typeof x[1] === 'string' && x[1] === y[1]) return true
+  if (x[0] === 'local.get' && y[0] === 'local.get' && typeof x[1] === 'string' && x[1] === y[1]) return true
+  return x[0] !== 'local.tee' && y[0] !== 'local.tee' && exprEq(x, y)
+}
+
+// Two address expressions name the SAME pointer base. Symmetric, tee/get-normalized
+// (a `local.tee $X` defines what a `local.get $X` reads, so they're one base); else
+// structural exprEq. Used by the RAW guard below — under the no-view gate, a different
+// base is a different allocation, so "not same base" ⇒ provably disjoint memory.
+const slpSameMem = (a, b) => {
+  if (!isArr(a) || !isArr(b)) return false
+  const an = (a[0] === 'local.tee' || a[0] === 'local.get') && typeof a[1] === 'string' ? a[1] : null
+  const bn = (b[0] === 'local.tee' || b[0] === 'local.get') && typeof b[1] === 'string' ? b[1] : null
+  if (an !== null || bn !== null) return an === bn
+  return exprEq(a, b)
+}
+
+// Does `value` load the element at (addr, off) — the slot u0 stores to? SLP materializes
+// BOTH packed values BEFORE either store, so if the high store's VALUE reads the low
+// store's TARGET, the original (which stored low first) and the pack (which reads low's
+// OLD value) diverge — a within-iteration read-after-write hazard. `o[k+1]=o[k]; o[k+2]=
+// o[k+1]` is the canonical miscompile: the second value reads o[k+1], which the first
+// store just wrote. (The sound own-index map `o[i]=…; o[i+1]=…` reads u1's OWN offset,
+// never u0's, so it never trips this.) f64 accesses are 8-byte and 8-aligned, so two
+// overlap iff their offsets are equal.
+const slpReadsOffset = (value, addr, off) => {
+  let hit = false
+  const walk = (n) => {
+    if (hit || !isArr(n)) return
+    if (n[0] === 'f64.load') {
+      const m = slpMem(n)
+      if (m && m.off === off && slpSameMem(m.addr, addr)) { hit = true; return }
+    }
+    for (let i = 1; i < n.length; i++) walk(n[i])
+  }
+  walk(value)
+  return hit
+}
+
+// Pack two isomorphic f64 trees [lo, hi] into an f64x2 value, or null if it isn't
+// overhead-free (adjacent loads → v128.load, identical pure scalar → splat, matching
+// op → recurse). The overhead-free restriction is what makes it both profitable and
+// unable to grow code; every f64x2 lane op is bit-identical to its scalar f64 op.
+const slpPackF64x2 = (lo, hi) => {
+  if (!isArr(lo) || !isArr(hi)) return null
+  if (lo[0] === 'f64.load' && hi[0] === 'f64.load') {
+    const a = slpMem(lo), b = slpMem(hi)
+    if (b.off - a.off !== 8 || !slpSameBase(a.addr, b.addr)) return null
+    return a.off ? ['v128.load', `offset=${a.off}`, a.addr] : ['v128.load', a.addr]
+  }
+  if (exprEq(lo, hi) && slpSplatSafe(lo)) return ['f64x2.splat', lo]
+  if (lo[0] === hi[0]) {
+    const bin = F64X2_BIN[lo[0]]
+    if (bin && lo.length === 3 && hi.length === 3) {
+      const x = slpPackF64x2(lo[1], hi[1]); if (!x) return null
+      const y = slpPackF64x2(lo[2], hi[2]); return y ? [bin, x, y] : null
+    }
+    const un = F64X2_UN[lo[0]]
+    if (un && lo.length === 2 && hi.length === 2) {
+      const x = slpPackF64x2(lo[1], hi[1]); return x ? [un, x] : null
+    }
+  }
+  return null
+}
+
+// Resolve the element store at `stmts[i]` to { off, addr, value, lo, hi } — the f64
+// value to pack and the inclusive statement span it occupies. jz emits an element
+// store in three shapes, all handled here so SLP fires both pre- and post-watr:
+//   • inline           (f64.store addr V)                                  → span [i,i]
+//   • flat tee'd        (local.set $t V) ; (f64.store addr (local.get $t)) → span [i-1,i]
+//   • block-wrapped     (block (local.set $t V) (f64.store addr (local.get $t)))
+// The tee'd value to pack is V (the definition), not the `(local.get $t)`.
+const slpUnitAt = (stmts, i, getCounts) => {
+  const s = stmts[i]
+  if (!isArr(s)) return null
+  if (s[0] === 'block' && s.length === 3
+      && isArr(s[1]) && s[1][0] === 'local.set' && isArr(s[2]) && s[2][0] === 'f64.store') {
+    const m = slpMem(s[2])
+    if (m && isArr(m.val) && m.val[0] === 'local.get' && m.val[1] === s[1][1]) return { off: m.off, addr: m.addr, value: s[1][2], lo: i, hi: i }
+    return null
+  }
+  if (s[0] !== 'f64.store') return null
+  const m = slpMem(s)
+  if (!m) return null
+  // Flat tee'd: `(local.set $t V) ; (f64.store … (local.get $t))`. Resolving the value
+  // to V and dropping the set is sound ONLY if $t is used nowhere else — otherwise a
+  // later `(local.get $t)` reads a value we deleted (the watr.js self-host miscompile).
+  if (isArr(m.val) && m.val[0] === 'local.get' && typeof m.val[1] === 'string'
+      && i > 0 && isArr(stmts[i - 1]) && stmts[i - 1][0] === 'local.set' && stmts[i - 1][1] === m.val[1]
+      && getCounts.get(m.val[1]) === 1)
+    return { off: m.off, addr: m.addr, value: stmts[i - 1][2], lo: i - 1, hi: i }
+  return { off: m.off, addr: m.addr, value: m.val, lo: i, hi: i }
+}
+
+// Count `(local.get NAME)` occurrences across the function, so the flat-tee'd
+// resolution above can confirm a store value's temp is single-use before removing it.
+const slpGetCounts = (fn) => {
+  const counts = new Map()
+  const walk = (n) => {
+    if (!isArr(n)) return
+    if (n[0] === 'local.get' && typeof n[1] === 'string') counts.set(n[1], (counts.get(n[1]) || 0) + 1)
+    for (let i = 1; i < n.length; i++) walk(n[i])
+  }
+  walk(fn)
+  return counts
+}
+
+// Rewrite two back-to-back element stores one f64 apart with isomorphic values into a
+// single v128 store. The packed value is computed into a fresh v128 local FIRST, then
+// stored — preserving jz's value-before-address evaluation order (the store address can
+// read a `local.tee` the value defines, e.g. the shared `i<<3` offset). base is the LOW
+// store's address (its tee that defines the shared pointer is kept); the high store +
+// its value dissolve into the high lane. Sound only under the no-view gate at dispatch.
+const slpStorePairsIn = (node, fnLocals, freshIdRef, newLocalDecls, getCounts) => {
+  if (!isArr(node)) return
+  for (let i = 0; i < node.length; i++) if (isArr(node[i])) slpStorePairsIn(node[i], fnLocals, freshIdRef, newLocalDecls, getCounts)
+  for (let i = 0; i < node.length; i++) {
+    const u0 = slpUnitAt(node, i, getCounts)
+    if (!u0) continue
+    const u1 = slpUnitAt(node, u0.hi + 1, getCounts)
+    if (!u1 || u1.lo !== u0.hi + 1) continue
+    if (u1.off - u0.off !== 8 || !slpSameBase(u0.addr, u1.addr)) continue
+    // RAW hazard: the high store's value must not read the low store's target — the pack
+    // would read its pre-store value. (u0 writes u0.off; reject if u1.value loads it.)
+    if (slpReadsOffset(u1.value, u0.addr, u0.off)) continue
+    const packed = slpPackF64x2(u0.value, u1.value)
+    if (!packed) continue
+    const t = `$__slp${freshIdRef.next++}`
+    newLocalDecls.push(['local', t, 'v128']); fnLocals.set(t, 'v128')
+    const store = u0.off
+      ? ['v128.store', `offset=${u0.off}`, u0.addr, ['local.get', t]]
+      : ['v128.store', u0.addr, ['local.get', t]]
+    node.splice(u0.lo, u1.hi - u0.lo + 1, ['local.set', t, packed], store)
+    i = u0.lo
+  }
+}
+
 // ---- Lane type tables ------------------------------------------------------
 
 const LANE_INFO = {
@@ -352,6 +636,13 @@ const LANE_PURE = {
     ['f32.neg', { simd: 'f32x4.neg' }],
     ['f32.abs', { simd: 'f32x4.abs' }],
     ['f32.sqrt', { simd: 'f32x4.sqrt' }],
+    // rounding: each f32x4.* rounds lane-for-lane identically to the scalar f32.* (same
+    // IEEE rounding mode), so the lift is bit-exact. Math.floor/ceil/trunc and the bare
+    // f64.nearest jz emits all reach here in a Float32Array kernel.
+    ['f32.floor', { simd: 'f32x4.floor' }],
+    ['f32.ceil', { simd: 'f32x4.ceil' }],
+    ['f32.trunc', { simd: 'f32x4.trunc' }],
+    ['f32.nearest', { simd: 'f32x4.nearest' }],
   ]),
   f64: new Map([
     ['f64.add', { simd: 'f64x2.add' }],
@@ -363,9 +654,37 @@ const LANE_PURE = {
     ['f64.neg', { simd: 'f64x2.neg' }],
     ['f64.abs', { simd: 'f64x2.abs' }],
     ['f64.sqrt', { simd: 'f64x2.sqrt' }],
+    // rounding: f64x2.* rounds each lane identically to the scalar f64.* op (same IEEE
+    // mode), so bit-exact. Unblocks `out[i] = Math.floor/ceil/trunc(f(in[i]))` f64 maps.
+    ['f64.floor', { simd: 'f64x2.floor' }],
+    ['f64.ceil', { simd: 'f64x2.ceil' }],
+    ['f64.trunc', { simd: 'f64x2.trunc' }],
+    ['f64.nearest', { simd: 'f64x2.nearest' }],
   ]),
 }
 
+// Integer-load → f32x4 widening, for `out[i] = intArr[i] (* k)` (Int16Array →
+// Float32Array decode/normalize, the canonical audio/image map). jz emits the
+// scalar as `f64.convert_i32_{s,u}(<intload>(addr))`; lift to: load `lanes` ints,
+// widen to i32x4, then f32x4.convert. `steps` are applied innermost-first.
+// `lossy`: i32→f32 rounds (the scalar converts via exact f64 then demotes — double
+// rounding differs by ≤1 ulp), so it needs relaxedSimd; i8/i16 are exact in f32.
+const INT_WIDEN_F32 = {
+  'i32.load':     { load: 'v128.load',        steps: [],                                                  cvt: 's', lossy: true },
+  'i32.load16_s': { load: 'v128.load64_zero', steps: ['i32x4.extend_low_i16x8_s'],                        cvt: 's', lossy: false },
+  'i32.load16_u': { load: 'v128.load64_zero', steps: ['i32x4.extend_low_i16x8_u'],                        cvt: 'u', lossy: false },
+  'i32.load8_s':  { load: 'v128.load32_zero', steps: ['i16x8.extend_low_i8x16_s', 'i32x4.extend_low_i16x8_s'], cvt: 's', lossy: false },
+  'i32.load8_u':  { load: 'v128.load32_zero', steps: ['i16x8.extend_low_i8x16_u', 'i32x4.extend_low_i16x8_u'], cvt: 'u', lossy: false },
+}
+
+// f64 scalar op → f32x4 SIMD op, for Float32Array arithmetic jz computes in f64
+// (promote→f64 op→demote). Used only in f32-lane context under relaxedSimd, since
+// the f64→f32 intermediate-precision drop is not bit-exact (see _relaxF32).
+const F64_TO_F32X4 = {
+  'f64.add': 'f32x4.add', 'f64.sub': 'f32x4.sub', 'f64.mul': 'f32x4.mul', 'f64.div': 'f32x4.div',
+  'f64.min': 'f32x4.min', 'f64.max': 'f32x4.max', 'f64.neg': 'f32x4.neg', 'f64.abs': 'f32x4.abs', 'f64.sqrt': 'f32x4.sqrt',
+}
+
 // Horizontal reductions: associative+commutative ops applied to one
 // loop-carried accumulator. Each entry maps the SCALAR op (which is also
 // the op used to combine the SIMD result back into the accumulator at the
@@ -807,19 +1126,45 @@ function tryVectorize(bl, fnLocals, freshIdRef) {
   // pointers (map loops over distinct arrays). Soundness re-checked post-scan.
   const offsetTees = new Map()
 
+  // The compute/lane type is the WIDEST FLOAT among all loads+stores. A narrower
+  // float/int LOAD is then a widening read (INT_WIDEN_F32 / f32→f64), a narrower
+  // float/int STORE a narrowing write (demote / trunc+wrap) — both sub-width memory
+  // ops around the float lane. Pinning it up front (vs whichever op the recursive
+  // scan hits first) is what lets a narrowing map `i16[i] = f32arr[i]*k` keep the
+  // f32 compute lane instead of locking onto the i16 store. No float → integer lane
+  // (set by the scan below, unchanged).
+  const isNarrowStore = (lane, sty) => (lane === 'f32' && (sty === 'i16' || sty === 'i8'))
+    || (lane === 'f64' && (sty === 'f32' || sty === 'i32'))
+  let preFloat = null
+  const scanFloatWidth = (n) => {
+    if (!isArr(n)) return
+    const t = LOAD_OPS[n[0]] || STORE_OPS[n[0]]
+    if (t === 'f64') preFloat = 'f64'
+    else if (t === 'f32' && preFloat == null) preFloat = 'f32'
+    for (let i = 1; i < n.length; i++) scanFloatWidth(n[i])
+  }
+  for (const s of body) scanFloatWidth(s)
+  if (preFloat) { laneType = preFloat; stride = LANE_INFO[preFloat].stride }
+
   function scanForLoadsStores(node, parent, pi) {
     if (!isArr(node)) return true
     const op = node[0]
     if (LOAD_OPS[op]) {
+      const lt = LOAD_OPS[op]
+      // int→f32 widening map (`out[i] = intArr[i] (*k)`): an integer load feeding a
+      // Float32Array store. Accept under the f32 lane and validate at the int element
+      // stride (the loop steps `lanes` f32 = 4 elements; load64_zero/load32_zero read
+      // exactly 4 ints). liftExprV widens via INT_WIDEN_F32.
+      const widenInt = laneType === 'f32' && lt !== 'f32' && INT_WIDEN_F32[op]
       if (laneType == null) {
-        laneType = LOAD_OPS[op]
+        laneType = lt
         stride = LANE_INFO[laneType].stride
-      } else if (LOAD_OPS[op] !== laneType) {
+      } else if (lt !== laneType && !widenInt) {
         return false
       }
       const m = matchLaneAddr(node[1], incVar, addrLocals, offsetTees)
       if (!m) return false
-      if ((1 << m.strideLog2) !== stride) return false
+      if ((1 << m.strideLog2) !== (widenInt ? LANE_INFO[lt].stride : stride)) return false
       if (m.teeName) addrLocals.set(m.teeName, { strideLog2: m.strideLog2, base: m.base })
       if (m.offsetTeeName) offsetTees.set(m.offsetTeeName, m.strideLog2)
       loadStoreSites.push({ parent, idx: pi, kind: 'load' })
@@ -827,11 +1172,15 @@ function tryVectorize(bl, fnLocals, freshIdRef) {
     }
     if (STORE_OPS[op]) {
       const sty = STORE_OPS[op]
-      if (laneType != null && sty !== laneType) return false
+      // narrowing store: a narrower element under a wider float lane (`o[i]=narrow(f(x))`,
+      // codec encode / downsample). Validate the store address at the narrow element stride
+      // (the loop steps `lanes` of the float lane; the partial store writes that many).
+      const narrowing = laneType != null && sty !== laneType && isNarrowStore(laneType, sty)
+      if (laneType != null && sty !== laneType && !narrowing) return false
       if (laneType == null) { laneType = sty; stride = LANE_INFO[laneType].stride }
       const m = matchLaneAddr(node[1], incVar, addrLocals, offsetTees)
       if (!m) return false
-      if ((1 << m.strideLog2) !== stride) return false
+      if ((1 << m.strideLog2) !== (narrowing ? LANE_INFO[sty].stride : stride)) return false
       if (m.teeName) addrLocals.set(m.teeName, { strideLog2: m.strideLog2, base: m.base })
       if (m.offsetTeeName) offsetTees.set(m.offsetTeeName, m.strideLog2)
       loadStoreSites.push({ parent, idx: pi, kind: 'store' })
@@ -913,12 +1262,35 @@ function tryVectorize(bl, fnLocals, freshIdRef) {
     }
   }
 
+  // A ToInt32 (`|0`) narrowing conversion is commonly CSE'd into its own lane-local just before
+  // the store (`set $t (…trunc_sat…); store addr (local.get $t)`), hiding it from the
+  // narrowing-store path (liftStmt would then lift the i32 wrap in the f64 lane and bail). When
+  // such a lane-local is read exactly once by a narrowing store, inline the conversion back into
+  // the store so peelNarrowConv/narrowStore handle it. The original set survives in the scalar
+  // remainder; this only reshapes the SIMD lift (and bails cleanly if liftStmt still declines).
+  let body2 = body
+  {
+    const getCount = new Map()
+    const countGets = (n) => { if (!isArr(n)) return; if (n[0] === 'local.get' && typeof n[1] === 'string') getCount.set(n[1], (getCount.get(n[1]) || 0) + 1); for (let i = 1; i < n.length; i++) countGets(n[i]) }
+    for (const s of body) countGets(s)
+    const dropped = new Set()
+    const inlined = body.map(s => {
+      if (isArr(s) && STORE_OPS[s[0]] && s.length === 3 && STORE_OPS[s[0]] !== laneType &&
+          isLocalGet(s[2]) && localKind.get(s[2][1]) === 'lane' && getCount.get(s[2][1]) === 1) {
+        const def = body.find(x => isArr(x) && x[0] === 'local.set' && x[1] === s[2][1] && x.length === 3)
+        if (def && peelNarrowConv(def[2], STORE_OPS[s[0]])) { dropped.add(def); return [s[0], s[1], def[2]] }
+      }
+      return s
+    })
+    if (dropped.size) body2 = inlined.filter(s => !dropped.has(s))
+  }
+
   // Build lifted body. If anything fails to lift, bail.
-  const newLanedLocals = new Map()  // origName → { laneName, simdType }
+  const newLanedLocals = new Map()  // origName → laneName (bare string; see getOrAllocLanedLocal)
   const extraLocals = []  // canon temps allocated during lift
-  const ctx = { laneType, incVar, rampVar: null, rampTemp: null, widenLoads: false, localKind, newLanedLocals, extraLocals, freshIdRef, fail: false, failReason: null }
+  const ctx = { laneType, incVar, rampVar: null, rampTemp: null, widenLoads: false, localKind, fnLocals, newLanedLocals, extraLocals, freshIdRef, fail: false, failReason: null }
   const lifted = []
-  for (const s of body) {
+  for (const s of body2) {
     const r = liftStmt(s, ctx)
     if (ctx.fail) return null
     if (r != null) {
@@ -966,7 +1338,7 @@ function tryVectorize(bl, fnLocals, freshIdRef) {
   // Locals to add to function header.
   const newLocalDecls = [
     ['local', simdBoundName, 'i32'],
-    ...[...newLanedLocals.values()].map(({ laneName }) => ['local', laneName, 'v128']),
+    ...[...newLanedLocals.values()].map(laneName => ['local', laneName, 'v128']),
     ...extraLocals,
   ]
 
@@ -1204,7 +1576,10 @@ function tryStencil(node, fnLocals, freshIdRef, enabled) {
     if (name === incVar) continue
     const ty = fnLocals.get(name)
     if (ty === 'i32') { localKind.set(name, 'addr'); continue }
-    if (ty === laneType) {
+    // A stencil temp computed in f64 then stored to an f32 array carries `ty === 'f64'`
+    // in an f32 lane (jz computes Float32Array math in f64). Treat it as lane/invariant
+    // data the same as a native-typed local — the lift lanes it as f32x4 (relaxedSimd).
+    if (ty === laneType || (laneType === 'f32' && ty === 'f64')) {
       if (writes.has(name)) {
         let fk = null; for (const s of body) { const k = firstAccess(s, name); if (k) { fk = k; break } }
         if (fk === 'read') return null                    // loop-carried float local
@@ -1218,7 +1593,7 @@ function tryStencil(node, fnLocals, freshIdRef, enabled) {
 
   // Lift through the shared lifter (addresses kept verbatim; loads → v128.load).
   const newLanedLocals = new Map(), extraLocals = []
-  const ctx = { laneType, incVar, rampVar: null, rampTemp: null, widenLoads: false, localKind, newLanedLocals, extraLocals, freshIdRef, fail: false, failReason: null }
+  const ctx = { laneType, incVar, rampVar: null, rampTemp: null, widenLoads: false, localKind, fnLocals, newLanedLocals, extraLocals, freshIdRef, fail: false, failReason: null }
   const lifted = []
   for (const s of body) {
     const r = liftStmt(s, ctx)
@@ -1255,7 +1630,7 @@ function tryStencil(node, fnLocals, freshIdRef, enabled) {
   // LICM-hoisted $__li invariants run ahead of the SIMD block (the scalar tail's
   // copy inside bl.blockNode re-runs them harmlessly — pure & loop-invariant).
   const wrapper = ['block', ...preamble.map(cloneNode), ...peelStmts, boundSetup, simdBlock, bl.blockNode]
-  const newLocalDecls = [['local', simdBoundName, 'i32'], ...[...newLanedLocals.values()].map(({ laneName }) => ['local', laneName, 'v128']), ...extraLocals]
+  const newLocalDecls = [['local', simdBoundName, 'i32'], ...[...newLanedLocals.values()].map(laneName => ['local', laneName, 'v128']), ...extraLocals]
   return { wrapper, newLocalDecls }
 }
 
@@ -1287,17 +1662,67 @@ function tryReduceVectorize(bl, fnLocals, freshIdRef, multiAcc = false) {
   // — or a NaN-canonicalized two-statement min/max reduction —
   //   (local.set $cn  (OP (local.get $acc) EXPR))
   //   (local.set $acc (select C (local.get $cn) (T.ne $cn $cn)))
-  const bodyLen = incIdx - 3
+  // A conditional-store min/max (`if (a[i] > m) m = a[i]`) is the SAME reduction as the ternary
+  // `m = a[i] > m ? a[i] : m`; rewrite it to the select-assign form so one recognizer covers both.
+  // Sound for recognition: the lane EXPR (an array load) is pure, and the SIMD lift reads it
+  // unconditionally anyway (pmax), while the scalar remainder keeps the original conditional store.
+  const asSelectAssign = (stmt) => {
+    if (isArr(stmt) && stmt[0] === 'if' && stmt.length === 3 && isArr(stmt[2]) && stmt[2][0] === 'then' && stmt[2].length === 2) {
+      const set = stmt[2][1]
+      if (isArr(set) && set[0] === 'local.set' && set.length === 3 && !hasSideEffect(set[2]))
+        return ['local.set', set[1], ['select', set[2], ['local.get', set[1]], stmt[1]]]
+    }
+    return stmt
+  }
+  const bodyStmts = []
+  for (let i = 3; i < incIdx; i++) bodyStmts.push(asSelectAssign(loopNode[i]))
+  // CSE collapse: `m = a[i] > m ? a[i] : m` hoists the load into its own `(local.set $t LOAD)`
+  // ahead of the reduction, making a 2-statement body the single-statement min/max recognizer
+  // misses. When $t is pure (no side effect, no accumulator reference) inline it back into the
+  // reduction so the canonical one-statement shape is recognized. Sound: the lift only consumes
+  // the inlined lane expr for the SIMD prefix; the original $t set survives in the scalar
+  // remainder (the unchanged blockNode), so $t stays defined wherever else it is read.
+  let body0 = bodyStmts
+  if (bodyStmts.length === 2) {
+    const [s1, s2] = bodyStmts
+    if (isArr(s1) && s1[0] === 'local.set' && typeof s1[1] === 'string' && s1.length === 3 &&
+        isArr(s2) && s2[0] === 'local.set' && typeof s2[1] === 'string' && s2.length === 3 && s1[1] !== s2[1]) {
+      const t = s1[1], expr = s1[2]
+      const usesName = (n, name) => isArr(n) && ((n[0] === 'local.get' && n[1] === name) || n.some(c => usesName(c, name)))
+      if (!hasSideEffect(expr) && !usesName(expr, s2[1]) && !usesName(expr, t)) {
+        const subst = (n) => isArr(n) ? (n[0] === 'local.get' && n[1] === t ? expr : n.map(subst)) : n
+        body0 = [['local.set', s2[1], subst(s2[2])]]
+      }
+    }
+  }
+  const bodyLen = body0.length
   let accName, opName, reduceEntry, exprNode, canonC = null
   if (bodyLen === 1) {
-    const stmt = loopNode[3]
+    const stmt = body0[0]
     if (!isArr(stmt) || stmt[0] !== 'local.set' || stmt.length !== 3) return null
     accName = stmt[1]
     if (typeof accName !== 'string') return null
     const rhs = stmt[2]
     if (!isArr(rhs)) return null
     const minmax = matchIntMinMaxReduce(rhs, accName)
-    if (minmax) {
+    if (minmax && minmax.laneType === 'f64') {
+      // Comparison min/max over an f64 array (`m = a[i] > m ? a[i] : m`). f64x2.pmax/pmin
+      // replicate the scalar `(a>m)?a:m` EXACTLY per element — pmax(m,a) = (m<a)?a:m keeps the
+      // accumulator on NaN (m<NaN is false) and on a ±0 tie, never NaN-poisoning the way
+      // f64x2.max would. They preserve the data's exact NaN bits (a selection, not a compute),
+      // so no canon is needed. The ONLY divergence from the sequential scalar is the SIGN of a
+      // zero RESULT when the extremum is hit by both +0 and −0 in different lanes (a cross-lane
+      // reorder) — strictly less than the ULP reassociation the sum reductions already accept,
+      // so it rides the relaxedSimd tier (on at 'speed'); strict callers opt out (scalar).
+      if (!_relaxF32) return null
+      reduceEntry = {
+        simd: minmax.isMax ? 'f64x2.pmax' : 'f64x2.pmin',
+        extract: 'f64x2.extract_lane', laneType: 'f64',
+        identity: ['f64.const', minmax.isMax ? '-inf' : 'inf'],
+        minmaxSelect: true, isMax: minmax.isMax, pmaxF64: true,
+      }
+      exprNode = minmax.exprNode
+    } else if (minmax) {
       // Synthetic entry: WASM has the SIMD i32x4.max_s/min_s but no scalar i32.max, so the
       // horizontal fold + merge below use select (flagged by minmaxSelect). Identity is the
       // op's neutral — INT_MIN for max, INT_MAX for min. A bare narrow load instead folds
@@ -1343,7 +1768,7 @@ function tryReduceVectorize(bl, fnLocals, freshIdRef, multiAcc = false) {
       exprNode = rhs[2]
     }
   } else if (bodyLen === 2) {
-    const s1 = loopNode[3], s2 = loopNode[4]
+    const s1 = body0[0], s2 = body0[1]
     if (!isArr(s1) || s1[0] !== 'local.set' || s1.length !== 3) return null
     if (!isArr(s2) || s2[0] !== 'local.set' || s2.length !== 3) return null
     const cnName = s1[1], rhs = s1[2]
@@ -1432,15 +1857,22 @@ function tryReduceVectorize(bl, fnLocals, freshIdRef, multiAcc = false) {
   const stride = LANE_INFO[laneType].stride
   const addrLocals = new Map()
   const offsetTees = new Map()
-  let loadCount = 0
+  let loadCount = 0, sawWidenF32 = false
   function scanExpr(node) {
     if (!isArr(node)) return true
     const op = node[0]
     if (LOAD_OPS[op]) {
-      if (LOAD_OPS[op] !== laneType) return false
+      // f32→f64 widening reduction (`s += f32arr[i]`, acc f64): liftExprV promotes
+      // the f32.load to f64x2.promote_low_f32x4, so accept it under an f64 lane and
+      // validate at the f32 element stride (4) — the loop still steps `lanes` (2)
+      // elements, advancing the f32 address by 8 bytes (the load64_zero the lift reads).
+      const ltw = LOAD_OPS[op]
+      const widenF32 = ltw === 'f32' && laneType === 'f64'
+      if (ltw !== laneType && !widenF32) return false
+      if (widenF32) sawWidenF32 = true
       const m = matchLaneAddr(node[1], incVar, addrLocals, offsetTees)
       if (!m) return false
-      if ((1 << m.strideLog2) !== stride) return false
+      if ((1 << m.strideLog2) !== (widenF32 ? 4 : stride)) return false
       if (m.teeName) addrLocals.set(m.teeName, { strideLog2: m.strideLog2, base: m.base })
       if (m.offsetTeeName) offsetTees.set(m.offsetTeeName, m.strideLog2)
       loadCount++
@@ -1477,9 +1909,14 @@ function tryReduceVectorize(bl, fnLocals, freshIdRef, multiAcc = false) {
   for (const name of addrLocals.keys()) localKind.set(name, 'addr')
   for (const name of offsetTees.keys()) localKind.set(name, 'addr')
 
-  const ctx = { laneType, incVar, rampVar: null, rampTemp: null, widenLoads: false, localKind, newLanedLocals: new Map(), extraLocals: [], freshIdRef, fail: false, failReason: null }
+  const ctx = { laneType, incVar, rampVar: null, rampTemp: null, widenLoads: false, localKind, fnLocals, newLanedLocals: new Map(), extraLocals: [], freshIdRef, fail: false, failReason: null }
+
   const liftedExpr = liftExprV(exprNode, ctx)
-  if (ctx.fail) return null
+  // liftExprV's contract is "null ⟺ ctx.fail"; under self-host (jz.wasm) it can diverge and
+  // return null WITHOUT the flag, which would otherwise splice a literal `null` operand into the
+  // emitted `(<reduce>.add acc null)` — invalid wasm ("not enough arguments on the stack"). Treat
+  // a null lift as a bail (the loop stays scalar — correct, just unvectorized on that leg).
+  if (ctx.fail || liftedExpr == null) return null
   if (ctx.newLanedLocals.size > 0 || ctx.extraLocals.length > 0) return null
 
   // Synthesize SIMD prefix block + horizontal reduce + (preserved scalar tail).
@@ -1501,7 +1938,9 @@ function tryReduceVectorize(bl, fnLocals, freshIdRef, multiAcc = false) {
   // the same kind the existing 2-lane fold already does, identical on every engine.
   // Restricted to the plain horizontal-fold FP path (not min/max-select, the
   // narrow-widening sums, or NaN-canon — those have their own fold shapes).
-  const plainReduce = !reduceEntry.minmaxSelect && !widen && canonC == null
+  // The f32→f64 widening sum uses half-width load64_zero loads; the multi-accumulator
+  // offsetLoads/laneBytes logic assumes full v128 loads, so keep it single-accumulator.
+  const plainReduce = !reduceEntry.minmaxSelect && !widen && !sawWidenF32 && canonC == null
   const NACC = (multiAcc && plainReduce && (laneType === 'f64' || laneType === 'f32')) ? 4 : 1
   const accK = (k) => k === 0 ? simdAccName : `$__simd_acc${id}_${k}`
   const laneBytes = lanes * stride
@@ -1539,14 +1978,17 @@ function tryReduceVectorize(bl, fnLocals, freshIdRef, multiAcc = false) {
   const extraDecls = []
   let mergeStmts
   if (reduceEntry.minmaxSelect) {
-    // No scalar i32.max/min — fold via select through an i32 temp (no exponential
-    // operand duplication): ht = lane0; ht = minmax(ht, lane_k); acc = minmax(acc, ht).
-    // `select(a,b,(gt|lt)_s a b)` = a when it's the larger/smaller, i.e. minmax(a,b).
-    const cmpOp = reduceEntry.isMax ? 'i32.gt_s' : 'i32.lt_s'
+    // No scalar max/min op — fold via select through a temp (no exponential operand
+    // duplication): ht = lane0; ht = minmax(ht, lane_k); acc = minmax(acc, ht). For int,
+    // `select(a,b,(gt|lt)_s a b)` = max/min(a,b). For the f64 pmax/pmin reduction the scalar
+    // equivalent is the pmax/pmin select — `pmax(a,b) = (a<b)?b:a` — so the merge keeps the
+    // same NaN/±0 tie semantics as the f64x2.pmax lanes.
     const ht = `$__simd_h${id}`
-    extraDecls.push(['local', ht, 'i32'])
+    extraDecls.push(['local', ht, reduceEntry.pmaxF64 ? 'f64' : 'i32'])
     const lane = (k) => [reduceEntry.extract, k, ['local.get', simdAccName]]
-    const minmaxSel = (a, b) => ['select', a, b, [cmpOp, a, b]]
+    const minmaxSel = reduceEntry.pmaxF64
+      ? (a, b) => reduceEntry.isMax ? ['select', b, a, ['f64.lt', a, b]] : ['select', b, a, ['f64.lt', b, a]]
+      : (a, b) => ['select', a, b, [reduceEntry.isMax ? 'i32.gt_s' : 'i32.lt_s', a, b]]
     mergeStmts = [['local.set', ht, lane(0)]]
     for (let k = 1; k < lanes; k++) mergeStmts.push(['local.set', ht, minmaxSel(lane(k), ['local.get', ht])])
     if (reduceEntry.accF64) {
@@ -1735,13 +2177,17 @@ function _isAddressLocal(body, name, ind) {
 
 // ---- Lifter ----------------------------------------------------------------
 
-function getOrAllocLanedLocal(name, ctx) {
-  let r = ctx.newLanedLocals.get(name)
-  if (!r) {
-    r = { laneName: `${name}__v`, origName: name }
-    ctx.newLanedLocals.set(name, r)
-  }
-  return r
+// Returns the v128 lane-local NAME (a string) for `name`, allocating once. We store the bare
+// string — NOT a `{laneName}` object — because a schema-object read back through the Map in a
+// DIFFERENT function returns undefined under self-host. Takes `newLanedLocals` directly
+// (not ctx) so callers don't need to pass the full ctx object to a helper at call-depth 2.
+function getOrAllocLanedLocal(name, newLanedLocals) {
+  let laneName = newLanedLocals.get(name)
+  if (!laneName) {
+    laneName = `${name}__v`
+    newLanedLocals.set(name, laneName)
+  }
+  return laneName
 }
 
 // Wrap an already-lifted v128 value `coreV` in per-lane NaN canonicalization:
@@ -1752,7 +2198,10 @@ function getOrAllocLanedLocal(name, ctx) {
 // Otherwise we materialize a fresh v128 temp so the core evaluates once.
 function liftCanon(coreV, C, ctx, info) {
   const laneNe = ctx.laneType === 'f32' ? 'f32x4.ne' : 'f64x2.ne'
-  const splatC = [info.splat, C]
+  // The f32-via-f64 canon carries an f64 NaN const — splat it as f32 (demote is
+  // exact for the canonical NaN, and the lane value coreV is already f32x4).
+  const cF = ctx.laneType === 'f32' && isArr(C) && C[0] === 'f64.const' ? ['f32.const', C[1]] : C
+  const splatC = [info.splat, cF]
   if (isArr(coreV) && coreV[0] === 'local.get') {
     return ['v128.bitselect', splatC, coreV, [laneNe, coreV, coreV]]
   }
@@ -1770,6 +2219,15 @@ function liftCanon(coreV, C, ctx, info) {
 // bail for the block currently under the recognizer chain; the walk reads it after.
 let _whyNotActive = false
 let _whyNotReason = null
+// Precision-relaxed f32 SIMD. jz computes Float32Array arithmetic in f64
+// (`f32.demote_f64 (f64.mul (f64.promote_f32 …) …)`); lifting that chain to
+// `f32x4.mul` over `v128.load` changes the intermediate from f64 to f32 — a
+// sub-ulp difference at f32 precision (inaudible for audio/DSP, the canonical
+// f32-SIMD trade every audio engine makes), but NOT bit-exact, so it is gated
+// on the same `relaxedSimd` opt-in that enables relaxed-FMA. The promote/demote
+// *strip* for a pure f32 copy (no arithmetic) round-trips losslessly and stays
+// on unconditionally. Armed for the duration of a vectorizeLaneLocal call.
+let _relaxF32 = false
 
 // Mark a lift bail and record its reason. First-write-wins: the innermost failing op
 // sets ctx.failReason; outer frames see ctx.fail already set and return without
@@ -1782,6 +2240,70 @@ const liftFail = (ctx, reason) => {
 }
 
 /** Lift a statement. Returns lifted stmt, or null to skip, or ['__seq__', ...] for multiple. */
+// Conditional lane-local assignment in a stencil/map body — the sibling of the
+// if-STORE path below, but the destination is a 'lane' LOCAL, not memory:
+//   if (C) L = A   [else L = B | else <nested if assigning L>]
+// the saturation / clamp shape (waves' amplitude clamp `if(nb>CAP)nb=CAP; else
+// if(nb<-CAP)nb=-CAP`). Built as ONE nested `v128.bitselect` EXPRESSION so every
+// mask reads the PRE-assignment lane value (no intermediate stores ⇒ order-free,
+// and bit-exact with the scalar select chain — a comparison mask is all-ones /
+// all-zeros per lane, so bitselect is an exact lane select), then a single
+// `local.set` of the laned local. Returns the lifted node, or null when `stmt` is
+// not a lane-assignment if (so the if-STORE path can try). Sets ctx.fail only once
+// committed (a lane-if shape that cannot be lifted).
+function tryLiftLaneIf(stmt, ctx) {
+  const armBody = (arm) => {
+    let body = arm.slice(1)
+    if (body.length === 1 && isArr(body[0]) && body[0][0] === 'block') {
+      const b = body[0]; let i = 1
+      if (typeof b[i] === 'string' && b[i].startsWith('$')) i++
+      if (isArr(b[i]) && b[i][0] === 'result') i++
+      body = b.slice(i)
+    }
+    return body
+  }
+  // The lane being assigned: the innermost then-arm's single local.set target.
+  const laneOf = (node) => {
+    if (!isArr(node)) return null
+    if (node[0] === 'local.set' && typeof node[1] === 'string' && ctx.localKind.get(node[1]) === 'lane') return node[1]
+    if (node[0] === 'if' && isArr(node[2]) && node[2][0] === 'then') {
+      const body = armBody(node[2])
+      if (body.length === 1) return laneOf(body[0])
+    }
+    return null
+  }
+  const lane = laneOf(stmt)
+  if (!lane) return null
+  // Recurse the if-chain into nested bitselects; each `local.set L = V` is a leaf value.
+  const buildVal = (node) => {
+    if (isArr(node) && node[0] === 'local.set' && node[1] === lane) return liftExprV(node[2], ctx)
+    if (isArr(node) && node[0] === 'if' && isArr(node[2]) && node[2][0] === 'then') {
+      const thenBody = armBody(node[2])
+      if (thenBody.length !== 1) return liftFail(ctx, 'lane-if: non-single then arm')
+      let cond = node[1]
+      if (isArr(cond) && cond[0] === 'i32.ne' && isI32Const(cond[2]) && cond[2][1] === 0) cond = cond[1]
+      const cmp = isArr(cond) && cond.length === 3 ? LANE_COMPARE[ctx.laneType]?.[cond[0]] : null
+      if (!cmp) return liftFail(ctx, 'lane-if: condition is not a lane comparison')
+      const ca = liftExprV(cond[1], ctx); if (ctx.fail) return null
+      const cb = liftExprV(cond[2], ctx); if (ctx.fail) return null
+      const thenVal = buildVal(thenBody[0]); if (ctx.fail) return null
+      const elseArm = (isArr(node[3]) && node[3][0] === 'else') ? armBody(node[3]) : null
+      let elseVal
+      if (elseArm) {
+        if (elseArm.length !== 1) return liftFail(ctx, 'lane-if: non-single else arm')
+        elseVal = buildVal(elseArm[0]); if (ctx.fail) return null
+      } else {
+        elseVal = ['local.get', getOrAllocLanedLocal(lane, ctx.newLanedLocals)]   // no else ⇒ keep current
+      }
+      return ['v128.bitselect', thenVal, elseVal, [cmp, ca, cb]]
+    }
+    return liftFail(ctx, 'lane-if: unrecognized arm shape')
+  }
+  const val = buildVal(stmt)
+  if (ctx.fail || val == null) return null
+  return ['local.set', getOrAllocLanedLocal(lane, ctx.newLanedLocals), val]
+}
+
 function liftStmt(stmt, ctx) {
   if (!isArr(stmt)) {
     // Bare strings like "drop" — produced by stack-form WAT. We unwrap value-blocks
@@ -1799,7 +2321,7 @@ function liftStmt(stmt, ctx) {
       return ['local.set', name, stmt[2]]
     }
     if (kind === 'lane') {
-      const { laneName } = getOrAllocLanedLocal(name, ctx)
+      const laneName = getOrAllocLanedLocal(name, ctx.newLanedLocals)
       const v = liftExprV(stmt[2], ctx)
       if (ctx.fail) return null
       return ['local.set', laneName, v]
@@ -1808,14 +2330,32 @@ function liftStmt(stmt, ctx) {
   }
 
   if (STORE_OPS[op]) {
-    const simdStore = 'v128.store'
     const addr = stmt[1]  // we leave addresses as-is (scalar i32 expressions)
-    const val = liftExprV(stmt[2], ctx)
-    if (ctx.fail) return null
     // Handle memarg if present (last positional after addr/val): unlikely in
     // pre-watr IR for this shape; bail if more than 3 children.
     if (stmt.length !== 3) return liftFail(ctx, `${op} with memarg`)
-    return [simdStore, addr, val]
+    const sty = STORE_OPS[op]
+    // Narrowing store: a narrower element written from a wider float lane (`o[i] =
+    // narrow(f(x))` — codec encode / downsample). The scalar store value carries a
+    // conversion (f32.demote_f64, or the float→int ToInt32 idiom); peel it, lift the
+    // inner float expr, and let narrowStore apply the SIMD narrow + low-byte store.
+    if (sty !== ctx.laneType) {
+      // Integer narrowing (`o[i] = (f(x)) | 0` into Int32Array/…) lowers via the saturating
+      // i32x4.trunc_sat_f64x2_s_zero, which clamps +Inf / |x|≥2³¹ to INT_MAX where scalar
+      // ToInt32 wraps mod 2³² — bit-exact for in-range finite values (every pixel/coordinate/
+      // typical-DSP value), divergent only at that edge, so it rides relaxedSimd. Float demote
+      // (f64→f32) is bit-exact (round-to-nearest both ways) and stays ungated.
+      if (sty !== 'f32' && !_relaxF32) return liftFail(ctx, `narrowing ${ctx.laneType}->${sty} store saturates out-of-range (needs relaxedSimd)`)
+      const inner = peelNarrowConv(stmt[2], sty)
+      if (!inner) return liftFail(ctx, `narrowing store ${ctx.laneType}->${sty}: unrecognized conversion`)
+      const innerV = liftExprV(inner, ctx)
+      if (ctx.fail) return null
+      const ns = narrowStore(addr, innerV, ctx.laneType, sty, ctx)
+      return ns || liftFail(ctx, `no narrowing ${ctx.laneType}->${sty}`)
+    }
+    const val = liftExprV(stmt[2], ctx)
+    if (ctx.fail) return null
+    return ['v128.store', addr, val]
   }
 
   // (block (result T) STMTS... TAIL_EXPR) followed by sibling "drop" — we get
@@ -1847,6 +2387,10 @@ function liftStmt(stmt, ctx) {
   // are trap-free) and emit ONE store of `bitselect(A, B, mask(COND))`. Unlocks per-pixel conditional
   // maps like lorenz's i32x4 trail fade (`if (p & 0xffffff) px[i] = fade(p)`).
   if (op === 'if' && isArr(stmt[2]) && stmt[2][0] === 'then') {
+    // First: conditional lane-LOCAL assignment (clamp/saturation) → bitselect into the laned local.
+    const laneLifted = tryLiftLaneIf(stmt, ctx)
+    if (ctx.fail) return null
+    if (laneLifted) return laneLifted
     const armOf = (arm) => {
       let body = arm.slice(1)
       if (body.length === 1 && isArr(body[0]) && body[0][0] === 'block') {   // unwrap a single block arm
@@ -1914,6 +2458,39 @@ function liftExprV(expr, ctx) {
     return ['f64x2.promote_low_f32x4', addr]
   }
 
+  // f32-lane: jz computes Float32Array arithmetic in f64, wrapping the f32 load in
+  // `f64.promote_f32` and the result in `f32.demote_f64`. The promote/demote are
+  // lane-space identities — strip them (a promote-of-load + demote round-trips
+  // losslessly: a pure `b[i]=a[i]` copy vectorizes bit-exactly, always). The f64
+  // arithmetic op and any f64 constant map to their f32x4 forms only under
+  // relaxedSimd, since computing in f32 (vs f64-then-demote) drops sub-ulp precision.
+  if (ctx.laneType === 'f32') {
+    if (op === 'f64.promote_f32') return liftExprV(expr[1], ctx)
+    if (op === 'f32.demote_f64') return liftExprV(expr[1], ctx)
+    // int→f32 widening load: `f64.convert_i32_{s,u}(<intload>(addr))` → load 4 ints,
+    // widen to i32x4, f32x4.convert. i8/i16 are exact in f32; i32 rounds (gated).
+    if ((op === 'f64.convert_i32_s' || op === 'f64.convert_i32_u') && isArr(expr[1]) && INT_WIDEN_F32[expr[1][0]]) {
+      const ld = expr[1], w = INT_WIDEN_F32[ld[0]]
+      if (w.lossy && !_relaxF32) return liftFail(ctx, `${ld[0]}→f32 SIMD rounds (i32 exceeds f32 mantissa) — needs relaxedSimd`)
+      const addr = typeof ld[1] === 'string' && ld[1].startsWith('offset=') ? [w.load, ld[1], ld[2]] : [w.load, ld[1]]
+      let v = addr
+      for (const step of w.steps) v = [step, v]
+      return [w.cvt === 'u' ? 'f32x4.convert_i32x4_u' : 'f32x4.convert_i32x4_s', v]
+    }
+    if (op === 'f64.const') {
+      if (!_relaxF32) return liftFail(ctx, 'f64 constant in f32 lane needs relaxedSimd (f32 round of the constant)')
+      return ['f32x4.splat', ['f32.const', expr[1]]]
+    }
+    const f32op = F64_TO_F32X4[op]
+    if (f32op) {
+      if (!_relaxF32) return liftFail(ctx, `${op}: f32 SIMD computes in f32 not f64 (sub-ulp) — needs relaxedSimd`)
+      const a = liftExprV(expr[1], ctx); if (ctx.fail) return null
+      if (expr.length === 2) return [f32op, a]                 // unary: neg / abs / sqrt
+      const b = liftExprV(expr[2], ctx); if (ctx.fail) return null
+      return [f32op, a, b]
+    }
+  }
+
   // Loads → v128.load (preserving address, including any local.tee).
   if (LOAD_OPS[op]) {
     if (LOAD_OPS[op] !== ctx.laneType) return liftFail(ctx, `${op}: load type ≠ lane type ${ctx.laneType}`)
@@ -1942,10 +2519,18 @@ function liftExprV(expr, ctx) {
     }
     const kind = ctx.localKind.get(name)
     if (kind === 'lane') {
-      const { laneName } = getOrAllocLanedLocal(name, ctx)
+      const laneName = getOrAllocLanedLocal(name, ctx.newLanedLocals)
       return ['local.get', laneName]
     }
     if (kind === 'invariant') {
+      // An invariant whose wasm type ≠ the lane element type needs a scalar
+      // convert before the splat. The common case: an f64 multiplier/gain splat
+      // into an f32 lane (`out[i] = in[i] * k`). Demoting k to f32 is the same
+      // precision relaxation as the f32 arithmetic itself, so gate it on relaxedSimd.
+      if (ctx.laneType === 'f32' && ctx.fnLocals?.get(name) === 'f64') {
+        if (!_relaxF32) return liftFail(ctx, `${name}: f64 invariant in f32 lane needs relaxedSimd`)
+        return [info.splat, ['f32.demote_f64', ['local.get', name]]]
+      }
       return [info.splat, ['local.get', name]]
     }
     if (kind === 'addr' || name === ctx.incVar) {
@@ -1974,19 +2559,44 @@ function liftExprV(expr, ctx) {
   // it). Both the flattened `select` form and the un-flattened `block` form
   // lift to a per-lane v128.bitselect — canonical value in NaN lanes, X
   // elsewhere — exactly reproducing the scalar canonicalization lane-by-lane.
-  if (ctx.laneType === 'f64' || ctx.laneType === 'f32') {
-    if (op === 'select') {
+  if (op === 'select') {
+    // NaN-canonicalization idiom `(select C X (T.ne X X))` — FLOAT lanes only (an
+    // integer lane never carries it, since no i32 value is NaN).
+    if (ctx.laneType === 'f64' || ctx.laneType === 'f32') {
       const m = matchCanonSelect(expr, ctx.laneType)
-      if (!m) return liftFail(ctx, 'non-canonical select (not a NaN-canon idiom)')
-      const coreV = liftExprV(m.val, ctx)
-      return ctx.fail ? null : liftCanon(coreV, m.C, ctx, info)
+      if (m) {
+        const coreV = liftExprV(m.val, ctx)
+        return ctx.fail ? null : liftCanon(coreV, m.C, ctx, info)
+      }
     }
-    if (op === 'block') {
-      const m = matchCanonBlock(expr, ctx.laneType)
-      if (!m) return liftFail(ctx, 'non-canonical value-block')
-      const coreV = liftExprV(m.core, ctx)
-      return ctx.fail ? null : liftCanon(coreV, m.C, ctx, info)
+    // General `select(X, Y, COND)` (wasm: X if COND else Y) — jz lowers a value
+    // ternary `COND ? X : Y` to this when both arms are cheap/pure. Lift to
+    // v128.bitselect(X, Y, mask) like the `if` form below — valid for EVERY lane type
+    // (i32 included: COND maps via LANE_COMPARE[laneType], NaN is irrelevant). Both
+    // arms are lane-pure (recursion forbids stores/sets) and trap-free, so evaluating
+    // both then selecting is sound. f32 lane promotes operands → f64.* compare → f32x4.
+    if (expr.length === 4) {
+      const cond = expr[3]
+      const cmpOp = isArr(cond) && ctx.laneType === 'f32' && typeof cond[0] === 'string' && cond[0].startsWith('f64.') ? 'f32.' + cond[0].slice(4) : (isArr(cond) ? cond[0] : null)
+      const cmpSimd = cmpOp && cond.length === 3 ? LANE_COMPARE[ctx.laneType]?.[cmpOp] : null
+      if (!cmpSimd) return liftFail(ctx, `select condition ${isArr(cond) ? cond[0] : '?'} not a lane comparison`)
+      const x = liftExprV(expr[1], ctx); if (ctx.fail) return null
+      const y = liftExprV(expr[2], ctx); if (ctx.fail) return null
+      const ca = liftExprV(cond[1], ctx); if (ctx.fail) return null
+      const cb = liftExprV(cond[2], ctx); if (ctx.fail) return null
+      const mtmp = `$__mask${ctx.freshIdRef.next++}`
+      ctx.extraLocals.push(['local', mtmp, 'v128'])
+      return ['block', ['result', 'v128'],
+        ['local.set', mtmp, [cmpSimd, ca, cb]],
+        ['v128.bitselect', x, y, ['local.get', mtmp]]]
     }
+    return liftFail(ctx, 'non-canonical select (not a NaN-canon idiom)')
+  }
+  if ((ctx.laneType === 'f64' || ctx.laneType === 'f32') && op === 'block') {
+    const m = matchCanonBlock(expr, ctx.laneType)
+    if (!m) return liftFail(ctx, 'non-canonical value-block')
+    const coreV = liftExprV(m.core, ctx)
+    return ctx.fail ? null : liftCanon(coreV, m.C, ctx, info)
   }
 
   // Conditional select — jz lowers `cond ? X : Y` to (if (result LT) COND (then X)
@@ -1998,13 +2608,21 @@ function liftExprV(expr, ctx) {
   // evaluates X,Y before its 3rd operand, but any address `local.tee` lives in
   // COND and must run before the branches read it (matching scalar order).
   if (op === 'if') {
-    if (!isArr(expr[1]) || expr[1][0] !== 'result' || expr[1][1] !== ctx.laneType) return liftFail(ctx, 'conditional without lane-typed result')
+    // jz lowers `cond ? X : Y` to (if (result T) COND (then X)(else Y)). In an f32
+    // lane it computes in f64 (promote/demote around the store), so the `if` carries
+    // `(result f64)` and COND is an `f64.*` compare — accept both, mapping to f32x4.
+    // The branch values are f32-mapped by recursion; gated by relaxedSimd via those.
+    const resTy = isArr(expr[1]) && expr[1][0] === 'result' ? expr[1][1] : null
+    if (resTy !== ctx.laneType && !(ctx.laneType === 'f32' && resTy === 'f64')) return liftFail(ctx, 'conditional without lane-typed result')
     const thenN = expr[3], elseN = expr[4]
     if (!isArr(thenN) || thenN[0] !== 'then' || thenN.length !== 2) return liftFail(ctx, 'malformed conditional then-branch')
     if (!isArr(elseN) || elseN[0] !== 'else' || elseN.length !== 2) return liftFail(ctx, 'malformed conditional else-branch')
     let cond = expr[2]
     if (isArr(cond) && cond[0] === 'i32.ne' && isI32Const(cond[2]) && cond[2][1] === 0) cond = cond[1]  // strip `!= 0`
-    const cmpSimd = isArr(cond) && cond.length === 3 ? LANE_COMPARE[ctx.laneType]?.[cond[0]] : null
+    // f32 lane: operands were promoted, so the compare is `f64.*` — use its f32x4 form
+    // (operands are exact f32→f64 promotions, so the lane comparison is unchanged).
+    const cmpOp = isArr(cond) && ctx.laneType === 'f32' && typeof cond[0] === 'string' && cond[0].startsWith('f64.') ? 'f32.' + cond[0].slice(4) : (isArr(cond) ? cond[0] : null)
+    const cmpSimd = cmpOp && cond.length === 3 ? LANE_COMPARE[ctx.laneType]?.[cmpOp] : null
     if (!cmpSimd) return liftFail(ctx, `${isArr(cond) ? cond[0] : 'condition'}: not a lane-vectorizable comparison`)
     const ca = liftExprV(cond[1], ctx); if (ctx.fail) return null
     const cb = liftExprV(cond[2], ctx); if (ctx.fail) return null
@@ -2510,15 +3128,17 @@ function tryRampMap(blockNode, fnLocals, freshIdRef) {
   // pointer is still expressed in terms of the IV. We keep the address verbatim
   // (scalar i32) and advance the IV by LANES, so `base + (i<<K)` lands on the
   // next group's first element each SIMD step — for any element width.
-  let storeStmt = null, storeIdx = -1
+  // Collect every store. One store → the original single-map paths (ramp pack / widening /
+  // 4-wide). Two or more independent store8s → a multi-channel in-place fade (boids' 4-channel
+  // u8 trail), handled by the multi-store WIDEN16 branch below; one pass over memory, N widening
+  // stores. Stores beyond the first don't reach the single-store paths.
+  const storeStmts = []
   for (let i = 0; i < body.length; i++) {
     const s = body[i]
-    if (isArr(s) && STORE_OPS[s[0]]) {
-      if (storeStmt) return null
-      storeStmt = s; storeIdx = i
-    }
+    if (isArr(s) && STORE_OPS[s[0]]) storeStmts.push({ stmt: s, idx: i })
   }
-  if (!storeStmt) return null
+  if (!storeStmts.length) return null
+  const storeStmt = storeStmts[0].stmt, storeIdx = storeStmts[0].idx
   const storeOp = storeStmt[0]
   if (storeStmt.length !== 3) return null
   const elemLog2 = { 'i32.store8': 0, 'i32.store': 2 }[storeOp]
@@ -2535,8 +3155,24 @@ function tryRampMap(blockNode, fnLocals, freshIdRef) {
   for (const s of body) gatherNames(s)
   for (const name of allNames) { const k = _offsetLocalStride(body, name, ivName); if (k != null) offsetTees.set(name, k) }
 
+  // CSE'd FULL lane address: an in-place map `a[i] = f(a[i])` shares one `(local.tee $A
+  // (i32.add base i))` between the load and the store, reused as `(local.get $A)`. Without
+  // resolving it the store/load address matchers reject the bare get (the empty-addrLocals
+  // bug that kept every in-place trail-fade scalar). Record each such tee — its lifted
+  // address (the tee) runs in the hoisted v128.load, so the store's get reads it back.
+  const addrLocals = new Map()
+  const recordAddrTees = (n) => {
+    if (!isArr(n)) return
+    if (n[0] === 'local.tee' && typeof n[1] === 'string' && isArr(n[2]) && n[2][0] === 'i32.add') {
+      const m = matchLaneAddr(n[2], ivName, addrLocals, offsetTees)
+      if (m && m.teeName == null) addrLocals.set(n[1], { strideLog2: m.strideLog2, base: m.base })
+    }
+    for (let i = 1; i < n.length; i++) recordAddrTees(n[i])
+  }
+  for (const s of body) recordAddrTees(s)
+
   const storeAddr = storeStmt[1]
-  const addrM = matchLaneAddr(storeAddr, ivName, new Map(), offsetTees)
+  const addrM = matchLaneAddr(storeAddr, ivName, addrLocals, offsetTees)
   if (!addrM || addrM.strideLog2 !== elemLog2) return null
 
   // Memory loads turn this into a widening byte-map: out[i] = narrow(f(widen(a[i])…)).
@@ -2549,7 +3185,7 @@ function tryRampMap(blockNode, fnLocals, freshIdRef) {
     if (LOAD_OPS[n[0]]) {
       hasLoads = true
       if (storeOp !== 'i32.store8' || n[0] !== 'i32.load8_u') { loadsOk = false; return }
-      const m = matchLaneAddr(n[1], ivName, new Map(), offsetTees)
+      const m = matchLaneAddr(n[1], ivName, addrLocals, offsetTees)
       if (!m || m.strideLog2 !== 0) loadsOk = false
       return  // address validated; the IV-strided subtree is not data
     }
@@ -2588,7 +3224,7 @@ function tryRampMap(blockNode, fnLocals, freshIdRef) {
   const newLanedLocals = new Map()
   const extraLocals = []
   const freshV128 = (tag) => { const n = `$__${tag}${freshIdRef.next++}`; extraLocals.push(['local', n, 'v128']); return n }
-  const ctx = { laneType: 'i32', incVar: ivName, rampVar: ivName, rampTemp: null, widenLoads: true, localKind, newLanedLocals, extraLocals, freshIdRef, fail: false, failReason: null }
+  const ctx = { laneType: 'i32', incVar: ivName, rampVar: ivName, rampTemp: null, widenLoads: true, localKind, fnLocals: null, newLanedLocals, extraLocals, freshIdRef, fail: false, failReason: null }
 
   // A byte store fed by one value expression (inline, or via a single lane-local
   // temp `tw = EXPR; store(addr, tw)`) carries no loop-carried state, so we can
@@ -2631,21 +3267,12 @@ function tryRampMap(blockNode, fnLocals, freshIdRef) {
     else return null
     return (r[0] < 0 || r[1] > 65535) ? null : r
   }
-  const wideValueExpr = (!hasLoads && byteValueExpr) ? byteValueExpr : null   // pure ramp → 16-wide pack
-  const widenRange = (hasLoads && byteValueExpr) ? byteValueRange(byteValueExpr) : null
-  const WIDEN16 = widenRange != null && widenRange[1] <= 255   // result fits a byte ⇒ narrow_u exact
-  const WIDE16 = wideValueExpr != null
-  const LANES = (WIDE16 || WIDEN16) ? 16 : 4
-  const ramp = (off) => ['i32x4.add', ['i32x4.splat', ['local.get', ivName]],
-    ['v128.const', 'i32x4', String(off), String(off + 1), String(off + 2), String(off + 3)]]
-
-  let lifted
-  if (WIDEN16) {
-    // 16-wide widening byte-map: load each u8 input once (v128.load of 16 bytes),
-    // extend_low/high to two i16x8 halves, run the affine map in i16x8 on each half,
-    // narrow_u the two result halves to one i8x16, store 16. Each load is hoisted to a
-    // temp (so extend_low + extend_high share one load); the loads run in source order,
-    // so the offset `local.tee` in the first one is set before later loads read it.
+  // The i16x8 widening byte-map emit for ONE store, factored so a multi-channel fade reuses it
+  // per channel: load each u8 input once (v128.load 16), extend_low/high to two i16x8 halves,
+  // run the affine map in i16x8 on each half, narrow_u to i8x16, store 16. Each load is hoisted
+  // (extend_low + extend_high share one load); loads run in source order, so an offset/address
+  // `local.tee` in a load is set before the store's `local.get` reads it.
+  const widen16Emit = (sAddr, valueExpr) => {
     const loadTemps = new Map()
     const loadSets = []
     const collectLoads = (e) => {
@@ -2655,7 +3282,7 @@ function tryRampMap(blockNode, fnLocals, freshIdRef) {
         if (!loadTemps.has(k)) { const t = freshV128('win'); loadTemps.set(k, t); loadSets.push(['local.set', t, ['v128.load', e[1]]]) }
       } else for (let i = 1; i < e.length; i++) collectLoads(e[i])
     }
-    collectLoads(byteValueExpr)
+    collectLoads(valueExpr)
     const liftW = (e, half) => {
       const op = e[0]
       if (op === 'i32.const') return ['i16x8.splat', e]
@@ -2667,45 +3294,87 @@ function tryRampMap(blockNode, fnLocals, freshIdRef) {
       if (op === 'i32.and') return ['v128.and', liftW(e[1], half), ['i16x8.splat', e[2]]]
       return null   // byteValueRange already proved every op is one of the above
     }
-    lifted = [...loadSets,
-      ['v128.store', storeAddr, ['i8x16.narrow_i16x8_u', liftW(byteValueExpr, 'low'), liftW(byteValueExpr, 'high')]]]
-  } else if (WIDE16) {
+    return [...loadSets,
+      ['v128.store', sAddr, ['i8x16.narrow_i16x8_u', liftW(valueExpr, 'low'), liftW(valueExpr, 'high')]]]
+  }
+
+  let lifted, LANES
+  if (storeStmts.length > 1) {
+    // MULTI-CHANNEL in-place byte fade: N independent store8s in one loop (boids' 4-channel u8
+    // trail). Each store must be a u8 store of a WIDEN16-eligible value (range ≤ 255); it emits
+    // its own load→i16x8→narrow→store sequence, all concatenated into ONE 16-wide pass — so the
+    // memory traffic stays single-pass (vs N separate vectorized loops). Every body statement
+    // must be a store or the lane-local set feeding one; any other (shared/invariant) compute
+    // bails to scalar, since it would be dropped.
+    LANES = 16
     lifted = []
-    const vv = []
-    for (let j = 0; j < 4; j++) {
-      const rt = freshV128('ramp')
-      lifted.push(['local.set', rt, ramp(j * 4)])
-      ctx.rampTemp = rt
-      const v = liftExprV(wideValueExpr, ctx)
-      if (ctx.fail) return null
-      const vn = freshV128('rampv')
-      lifted.push(['local.set', vn, v])
-      vv.push(vn)
-    }
-    // Pack the low byte of all 16 i32 lanes (4 vectors) into one i8x16, in order.
-    const g = (n) => ['local.get', n]
-    const sh = (a, b, idx) => ['i8x16.shuffle', ...idx.map(String), a, b]
-    const lo = freshV128('ramplo'), hi = freshV128('ramphi')
-    lifted.push(['local.set', lo, sh(g(vv[0]), g(vv[1]), [0, 4, 8, 12, 16, 20, 24, 28, 0, 0, 0, 0, 0, 0, 0, 0])])
-    lifted.push(['local.set', hi, sh(g(vv[2]), g(vv[3]), [0, 4, 8, 12, 16, 20, 24, 28, 0, 0, 0, 0, 0, 0, 0, 0])])
-    lifted.push(['v128.store', storeAddr, sh(g(lo), g(hi), [0, 1, 2, 3, 4, 5, 6, 7, 16, 17, 18, 19, 20, 21, 22, 23])])
+    const consumed = new Set()
+    for (const { stmt, idx } of storeStmts) {
+      if (stmt[0] !== 'i32.store8' || stmt.length !== 3) return null
+      const a = matchLaneAddr(stmt[1], ivName, addrLocals, offsetTees)
+      if (!a || a.strideLog2 !== 0) return null
+      consumed.add(idx)
+      let val = stmt[2]
+      if (isArr(val) && val[0] === 'local.get' && typeof val[1] === 'string' && localKind.get(val[1]) === 'lane') {
+        let setIdx = -1
+        for (let j = 0; j < idx; j++) { const s = body[j]; if (isArr(s) && s[0] === 'local.set' && s[1] === val[1] && s.length === 3) { setIdx = j; val = s[2] } }
+        if (setIdx < 0) return null
+        consumed.add(setIdx)
+      }
+      const rng = byteValueRange(val)
+      if (!rng || rng[1] > 255) return null   // not WIDEN16-eligible (overflows u16 or u8) → scalar
+      lifted.push(...widen16Emit(stmt[1], val))
+    }
+    if (consumed.size !== body.length) return null
   } else {
-    ctx.rampTemp = freshV128('ramp')
-    // ramp = [i, i+1, i+2, i+3], computed once per SIMD iteration.
-    lifted = [['local.set', ctx.rampTemp, ramp(0)]]
-    for (let i = 0; i < body.length; i++) {
-      if (i === storeIdx) {
-        const vval = liftExprV(storeStmt[2], ctx)
+    const wideValueExpr = (!hasLoads && byteValueExpr) ? byteValueExpr : null   // pure ramp → 16-wide pack
+    const widenRange = (hasLoads && byteValueExpr) ? byteValueRange(byteValueExpr) : null
+    const WIDEN16 = widenRange != null && widenRange[1] <= 255   // result fits a byte ⇒ narrow_u exact
+    const WIDE16 = wideValueExpr != null
+    LANES = (WIDE16 || WIDEN16) ? 16 : 4
+    const ramp = (off) => ['i32x4.add', ['i32x4.splat', ['local.get', ivName]],
+      ['v128.const', 'i32x4', String(off), String(off + 1), String(off + 2), String(off + 3)]]
+
+    if (WIDEN16) {
+      lifted = widen16Emit(storeAddr, byteValueExpr)
+    } else if (WIDE16) {
+      lifted = []
+      const vv = []
+      for (let j = 0; j < 4; j++) {
+        const rt = freshV128('ramp')
+        lifted.push(['local.set', rt, ramp(j * 4)])
+        ctx.rampTemp = rt
+        const v = liftExprV(wideValueExpr, ctx)
         if (ctx.fail) return null
-        lifted.push(buildRampStore(storeOp, storeAddr, vval, ctx))
-      } else {
-        const r = liftStmt(body[i], ctx)
-        if (ctx.fail) return null
-        if (r != null) { if (Array.isArray(r) && r[0] === '__seq__') lifted.push(...r.slice(1)); else lifted.push(r) }
+        const vn = freshV128('rampv')
+        lifted.push(['local.set', vn, v])
+        vv.push(vn)
+      }
+      // Pack the low byte of all 16 i32 lanes (4 vectors) into one i8x16, in order.
+      const g = (n) => ['local.get', n]
+      const sh = (a, b, idx) => ['i8x16.shuffle', ...idx.map(String), a, b]
+      const lo = freshV128('ramplo'), hi = freshV128('ramphi')
+      lifted.push(['local.set', lo, sh(g(vv[0]), g(vv[1]), [0, 4, 8, 12, 16, 20, 24, 28, 0, 0, 0, 0, 0, 0, 0, 0])])
+      lifted.push(['local.set', hi, sh(g(vv[2]), g(vv[3]), [0, 4, 8, 12, 16, 20, 24, 28, 0, 0, 0, 0, 0, 0, 0, 0])])
+      lifted.push(['v128.store', storeAddr, sh(g(lo), g(hi), [0, 1, 2, 3, 4, 5, 6, 7, 16, 17, 18, 19, 20, 21, 22, 23])])
+    } else {
+      ctx.rampTemp = freshV128('ramp')
+      // ramp = [i, i+1, i+2, i+3], computed once per SIMD iteration.
+      lifted = [['local.set', ctx.rampTemp, ramp(0)]]
+      for (let i = 0; i < body.length; i++) {
+        if (i === storeIdx) {
+          const vval = liftExprV(storeStmt[2], ctx)
+          if (ctx.fail) return null
+          lifted.push(buildRampStore(storeOp, storeAddr, vval, ctx))
+        } else {
+          const r = liftStmt(body[i], ctx)
+          if (ctx.fail) return null
+          if (r != null) { if (Array.isArray(r) && r[0] === '__seq__') lifted.push(...r.slice(1)); else lifted.push(r) }
+        }
       }
     }
   }
-  if (!lifted.length) return null
+  if (!lifted || !lifted.length) return null
 
   const id = freshIdRef.next++
   const simdBoundName = `$__simd_bound${id}`
@@ -2726,7 +3395,7 @@ function tryRampMap(blockNode, fnLocals, freshIdRef) {
   const wrapper = ['block', boundSetup, simdBlock, blockNode]
   const newLocalDecls = [
     ['local', simdBoundName, 'i32'],
-    ...[...newLanedLocals.values()].map(({ laneName }) => ['local', laneName, 'v128']),
+    ...[...newLanedLocals.values()].map(laneName => ['local', laneName, 'v128']),
     ...extraLocals,
   ]
   return { wrapper, newLocalDecls }
@@ -2736,6 +3405,62 @@ function tryRampMap(blockNode, fnLocals, freshIdRef) {
 // `storeOp` at scalar address `addr`. i32.store is the full vector; i32.store8
 // truncates (low byte of each lane) via i8x16.shuffle — exactly matching scalar
 // store8, with no value-range assumption (shuffle selects, never saturates).
+// Narrowing-map store: pack a wider float lane vector `val` down to a narrower
+// store element and write the low bytes (extract_lane 0 + scalar store, like
+// buildRampStore). f64→f32 demotes (bit-exact vs scalar); f64→i32 truncates;
+// f32→i16/i8 truncate to i32x4 then WRAP via i8x16.shuffle (low bytes = scalar
+// store{8,16}, never saturates). Returns the store stmt or null (unsupported).
+// Peel the scalar narrowing conversion off a store value, returning the inner float
+// expr to lift (narrowStore then applies the SIMD narrow). f32 store: f32.demote_f64(X).
+// int store: the ToInt32 idiom `i32.wrap_i64(X<0 ? trunc_sat_f64_s X : trunc_sat_f64_u X)`
+// (or a bare trunc_sat). The inner X is the f64/f32 lane value computed before the cast.
+function peelNarrowConv(val, sty) {
+  if (!isArr(val)) return null
+  if (sty === 'f32') return val[0] === 'f32.demote_f64' ? val[1] : null
+  // int element (i8/i16/i32): peel ToInt32 (`x | 0`). jz's general lowering is an
+  // Infinity-guarded saturating trunc:
+  //   (select (i32.wrap_i64 (i64.trunc_sat_f64_s X)) (i32.const 0) (f64.ne X' Inf))
+  // where X is `(local.tee $inf <f64 expr>)` and X' the matching get. Peel to the inner f64.
+  // (The SIMD narrow i32x4.trunc_sat_f64x2_s_zero saturates +Inf / |x|≥2³¹ to INT_MAX where
+  // ToInt32 wraps mod 2³² — caller gates the int narrowing on relaxedSimd for that edge.)
+  if (val[0] === 'select' && val.length === 4 && isI32Const(val[2]) && val[2][1] === 0 &&
+      isArr(val[1]) && val[1][0] === 'i32.wrap_i64' && isArr(val[1][1]) && val[1][1][0] === 'i64.trunc_sat_f64_s') {
+    let inner = val[1][1][1]   // the f64 operand of the trunc, captured in a `(local.tee $inf …)`
+    if (isArr(inner) && inner[0] === 'local.tee' && inner.length === 3) inner = inner[2]   // peel to the tee's VALUE
+    return inner
+  }
+  if (val[0] === 'i32.wrap_i64' && isArr(val[1]) && val[1][0] === 'if') {
+    const iff = val[1], thenA = iff[3], elseA = iff[4]
+    const s = isArr(thenA) && isArr(thenA[1]) && thenA[1][0] === 'i64.trunc_sat_f64_s' ? thenA[1][1] : null
+    const u = isArr(elseA) && isArr(elseA[1]) && elseA[1][0] === 'i64.trunc_sat_f64_u' ? elseA[1][1] : null
+    if (s && u && exprEq(s, u)) return s
+  }
+  if (val[0] === 'i32.trunc_sat_f64_s' || val[0] === 'i32.trunc_sat_f64_u') return val[1]
+  return null
+}
+
+// i8x16.shuffle masks that pack a 4×i32 vector down to the low bytes of each lane
+// (truncating-wrap = scalar store{8,16}), tail zero-filled: _I16 keeps the low 2
+// bytes of each lane (→ 8 bytes / i64.store), _I8 the low byte (→ 4 bytes / i32.store).
+const PACK_I32_TO_I16 = [0, 1, 4, 5, 8, 9, 12, 13, 0, 0, 0, 0, 0, 0, 0, 0]
+const PACK_I32_TO_I8 = [0, 4, 8, 12, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
+
+function narrowStore(addr, val, laneType, sty, ctx) {
+  const tmp = `$__nv${ctx.freshIdRef.next++}`
+  ctx.extraLocals.push(['local', tmp, 'v128'])
+  const g = ['local.get', tmp]
+  const sh = (idx) => ['i8x16.shuffle', ...idx.map(String), g, g]
+  let pre, lane8, store
+  if (laneType === 'f64' && sty === 'f32') { pre = ['f32x4.demote_f64x2_zero', val]; lane8 = g; store = 'i64.store' }
+  else if (laneType === 'f64' && sty === 'i32') { pre = ['i32x4.trunc_sat_f64x2_s_zero', val]; lane8 = g; store = 'i64.store' }
+  else if (laneType === 'f32' && sty === 'i16') { pre = ['i32x4.trunc_sat_f32x4_s', val]; lane8 = sh(PACK_I32_TO_I16); store = 'i64.store' }
+  else if (laneType === 'f32' && sty === 'i8')  { pre = ['i32x4.trunc_sat_f32x4_s', val]; lane8 = sh(PACK_I32_TO_I8); store = 'i32.store' }
+  else return null
+  // 8-byte stores extract an i64 lane; the 4-byte i8 pack extracts an i32 lane.
+  const packed = store === 'i64.store' ? ['i64x2.extract_lane', 0, lane8] : ['i32x4.extract_lane', 0, lane8]
+  return ['block', ['local.set', tmp, pre], [store, addr, packed]]
+}
+
 function buildRampStore(storeOp, addr, vval, ctx) {
   if (storeOp === 'i32.store') return ['v128.store', addr, vval]   // 4 i32 lanes → 16 bytes
   // i32.store8: hoist vval to a temp so the shuffle reads it once; low byte of
@@ -3336,6 +4061,16 @@ function tryDivergentEscapeVectorize(blockNode, fnLocals, freshIdRef) {
   const kTop = kindOf(keepTopC)
   const limitKeep = keepTopC   // initialised here; may be reassigned below for single-break
   let kMid = null, boundExpr, boundI32, itLeft
+  // Compound-top guard `while (A && B)`: classify the SECOND keep too. Left unclassified (kMid=null),
+  // the downstream lift/keepMask treats keepMidC as a per-lane f64 escape — right for the Julia order
+  // (limit, escape) but it then lifts the i32 LIMIT of the mandelbrot order (escape, `it<MAX`) into an
+  // f64 lane and crashes. Setting kMid routes the limit through the scalar guard instead; for the
+  // Julia order kMid='escape' is identical to the old null (both lift). Bail if neither keep is an
+  // escape — a two-limit guard has no per-lane divergence for this vectorizer to exploit.
+  if (compoundTop) {
+    kMid = kindOf(keepMidC)
+    if (kTop === 'limit' && kMid === 'limit') return null
+  }
   if (midBreaks.length === 1) {
     kMid = kindOf(keepMidC)
     if (kTop === kMid) return null
@@ -3726,8 +4461,8 @@ function tryDivergentEscapeVectorize(blockNode, fnLocals, freshIdRef) {
 // public `$math.{sin,cos}` wrap the same core. Their f64x2 mirrors $math.sin2/$math.cos2 (the
 // vectorized reduce+horner, module/math.js:543) are BIT-EXACT per lane to the scalar core — so we
 // can lift the call straight to the *2 helper. Phase-2 adds pow/log/atan2 here (see PPC_CALL2).
-// NOTE: scalar targets here must be kept out of inlineOnce's single-caller inlining (SIMD_PROTECTED
-// in src/wat/optimize.js) — else the call node is gone before this lift runs.
+// NOTE: scalar targets here must be kept out of watr's single-caller inlining — jz passes these
+// keys (SIMD_PINNED, below) as watOptimize's `pin` list, else the call node is gone before this lift runs.
 const PPC_CALL2 = {
   '$math.sin_core': '$math.sin2', '$math.cos_core': '$math.cos2',
   '$math.sin': '$math.sin2', '$math.cos': '$math.cos2',
@@ -3738,6 +4473,11 @@ const PPC_CALL2 = {
   '$math.log': '$math.log_v', '$math.exp': '$math.exp_v', '$math.exp2': '$math.exp2_v',
 }
 
+// Scalar transcendentals the auto-vectorizer rewrites to f64x2 mirrors above. watr's inline
+// passes must NOT dissolve their (single-caller) call nodes before this lift runs — jz passes
+// these to watOptimize's `pin` option (the protection policy lives here, not hardcoded in watr).
+export const SIMD_PINNED = Object.keys(PPC_CALL2)
+
 // Per-pixel-color vectorizer. The dual of tryDivergentEscapeVectorize for kernels with NO inner
 // escape loop: an outer pixel loop whose body computes an f64 value from the pixel index (via
 // cos/sin/sqrt/…), packs it to a u32 colour, and stores it — every pixel independent. We lift the
@@ -4134,13 +4874,19 @@ function tryOuterStrip(blockNode, fnLocals, freshIdRef, enabled) {
   // accumulator seeds (→ splat), scalar inner-IV init. MUST run before the inner-body lift so the
   // per-pixel coord lanes are registered when the inner loop references them. ----
   const laneInit = []
+  const seededAccs = new Set()
   for (let i = 0; i < innerIdx; i++) {
     const s = obody[i]
     if (!(isArr(s) && s[0] === 'local.set' && typeof s[1] === 'string' && s.length === 3)) { laneInit.push(s); continue }
     const name = s[1]
     if (accNames.has(name)) {                       // accumulator seed → splat
+      // The seed must be a FRESH per-pixel value, independent of the accumulator's own carry.
+      // A seed that reads `name` (e.g. `acc = acc * decay`) propagates the previous pixel's
+      // running value across pixels — that's a loop-carried recurrence, not a per-pixel reset.
+      if (readsName(s[2], name)) return null
       const seed = liftOS(s[2])
       if (!seed) return null
+      seededAccs.add(name)
       laneInit.push(['local.set', laneMap.get(name), seed]); continue
     }
     if (fnLocals.get(name) === 'f64' && readsName(s[2], pxVar)) {   // per-pixel coord (cx = xi/W) → ramp lane
@@ -4153,6 +4899,14 @@ function tryOuterStrip(blockNode, fnLocals, freshIdRef, enabled) {
     laneInit.push(s)                                // scalar (inner IV init `b=0`, invariant setup)
   }
 
+  // LEGALITY: every accumulator must be FRESHLY SEEDED inside the outer-loop body. An accumulator
+  // with no per-pixel seed is live-in — carried across outer iterations (a recurrence like the
+  // lorenz `x = x + S·(…)` evolving over the sample loop). The two pixel lanes are then DEPENDENT:
+  // lane xi+1 must continue from lane xi's final value, not restart from a splat of the shared
+  // carry. Strip-mining it runs both lanes from the same seed in lockstep — halving the real work
+  // and producing a wrong result (a bogus speedup on a serial recurrence). Reject.
+  for (const a of accNames) if (!seededAccs.has(a)) return null
+
   // ---- lift the inner-loop body: temp f64 lane locals + accumulate into the acc shadows; the
   // inner IV bump stays scalar. Per-pixel coords now resolve via laneMap. ----
   const liftedInner = []
@@ -4218,6 +4972,339 @@ function tryOuterStrip(blockNode, fnLocals, freshIdRef, enabled) {
   return { wrapper, newLocalDecls }
 }
 
+// ---- Per-pixel iterated-map reduction (tryIteratedReduce, experimental) ----------------------
+//
+// Generalizes the outer-strip to the ITERATED-MAP fractal shape — lyapunov, bifurcation, smooth-
+// escape attractors — whose per-pixel value runs a recurrence many times and accumulates a
+// transcendental. Beyond tryOuterStrip (one inner loop, a plain additive accumulator) it handles:
+//   • MULTIPLE inner loops carrying per-pixel f64 state between them (lyapunov warmup → accumulate),
+//   • loop-carried f64 RECURRENCES   x = r·x·(1−x)   (not just acc = acc + …),
+//   • lane-invariant scalar bookkeeping kept SCALAR — integer counters with wraparound and the
+//     forcing-sequence gather seq[si] (same index for both lanes → one scalar load),
+//   • a scalar-condition select   seq[si]<1 ? a : b   (a ramps per lane, b splats) → a scalar
+//     `if (result v128)`, and a per-lane conditional accumulate   if(d>0) L += log(d)   → bitselect.
+// Two adjacent pixels (xi, xi+1) run as f64x2 lanes; the colour pack+store runs scalar per lane,
+// and the original scalar loop, kept as the tail, finishes the odd last pixel.
+//
+// BIT-EXACT: f64x2 arithmetic is per-lane IEEE-identical, $math.log_v/exp_v are the per-lane mirrors
+// of the scalar polys, and the conditional accumulate adds bitselect(f(x), 0, mask) — exactly the
+// scalar add-or-skip. The speculatively-evaluated transcendental of a masked-out lane is discarded
+// (the helpers never trap). Gated behind cfg.experimentalOuterStrip; only fires when an inner loop
+// carries a transcendental (the latency-bound work SIMD actually accelerates — cheap-arithmetic
+// pixel loops are left to the scalar JIT, which already pipelines independent iterations).
+function tryIteratedReduce(blockNode, fnLocals, freshIdRef, enabled) {
+  if (!enabled) return null
+  const outer = matchOuterPixelLoop(blockNode)
+  if (!outer) return null
+  const { oLabel, loopNode, preamble, pixelIVs, pxVar, widthBound, pivType, obody, oExit } = outer
+
+  const innerIdxs = []
+  for (let i = 0; i < obody.length; i++) {
+    const s = obody[i]
+    if (isArr(s) && s[0] === 'block' && s.slice(1).some(c => isArr(c) && c[0] === 'loop')) innerIdxs.push(i)
+  }
+  if (!innerIdxs.length) return null
+  const lastInner = innerIdxs[innerIdxs.length - 1]
+  const innerSet = new Set(innerIdxs)
+
+  const impureCall = (n) => isArr(n) && ((n[0] === 'call' && typeof n[1] === 'string' && !n[1].startsWith('$math.')) || n.some(impureCall))
+  if (obody.some(impureCall)) return null
+
+  const id = freshIdRef.next++
+  const nm = (s) => `$__ir${id}_${s}`
+  const laneMap = new Map()       // f64 per-pixel local → its v128 shadow
+  const shadowOf = (v) => { let s = laneMap.get(v); if (!s) { s = nm(v.replace(/\W/g, '')); laneMap.set(v, s) } return s }
+  let sawHeavy = false            // a transcendental lifted inside a loop → SIMD is worth it
+
+  const bump = (n, k) => k === 0 ? n
+    : (isArr(n) && n[0] === 'local.get' && pivType.has(n[1])) ? [pivType.get(n[1]) + '.add', n, [pivType.get(n[1]) + '.const', k]]
+    : (isArr(n) ? n.map(c => bump(c, k)) : n)
+  const rampOf = (piv) => pivType.get(piv) === 'f64'
+    ? ['f64x2.replace_lane', 1, ['f64x2.splat', ['local.get', piv]], ['f64.add', ['local.get', piv], ['f64.const', 1]]]
+    : ['f64x2.replace_lane', 1, ['f64x2.splat', ['f64.convert_i32_s', ['local.get', piv]]], ['f64.convert_i32_s', ['i32.add', ['local.get', piv], ['i32.const', 1]]]]
+  const readsName = (n, name) => isArr(n) && ((n[0] === 'local.get' && n[1] === name) || n.some(c => readsName(c, name)))
+  // Lane-invariant: reads no per-pixel lane local and no pixel IV → identical value in both lanes.
+  const laneInvariant = (n) => !isArr(n) ? true
+    : n[0] === 'local.get' ? !(laneMap.has(n[1]) || pivType.has(n[1]))
+    : n.slice(1).every(laneInvariant)
+
+  // Build the f64x2 form of `cond ? x : y` from already-lifted arms `x`,`y` and the raw `cond`.
+  // A lane-INVARIANT cond (same both lanes — e.g. seq[si]<1) → a v128-typed scalar branch; a
+  // per-lane f64 compare → bitselect (x where cond, y elsewhere).
+  const liftSelect = (x, y, cond) => {
+    if (!x || !y) return null
+    if (isArr(cond) && cond[0] === 'i32.ne' && isI32Const(cond[2]) && cond[2][1] === 0) cond = cond[1]
+    if (laneInvariant(cond)) return ['if', ['result', 'v128'], cond, ['then', x], ['else', y]]
+    const cmp = isArr(cond) && cond.length === 3 ? CMP_LANE[cond[0]] : null
+    if (!cmp) return null
+    const ca = lift(cond[1]), cb = lift(cond[2])
+    return (ca && cb) ? ['v128.bitselect', x, y, [cmp, ca, cb]] : null
+  }
+  // Lift an f64 expression to f64x2 (null = not liftable).
+  const lift = (n) => {
+    if (!isArr(n)) return null
+    const op = n[0]
+    if (op === 'f64.const') return ['f64x2.splat', n]
+    if (op === 'local.get') {
+      const v = n[1]
+      if (laneMap.has(v)) return ['local.get', laneMap.get(v)]
+      if (pivType.get(v) === 'f64') return rampOf(v)
+      if (writesName(loopNode, v)) return null
+      return ['f64x2.splat', n]
+    }
+    if (op === 'f64.convert_i32_s' && isArr(n[1]) && n[1][0] === 'local.get' && pivType.get(n[1][1]) === 'i32') return rampOf(n[1][1])
+    if (op === 'global.get') return writesName(loopNode, n[1]) ? null : ['f64x2.splat', n]
+    if (LOAD_OPS[op] === 'f64') {
+      const addr = typeof n[1] === 'string' && n[1].startsWith('offset=') ? n[2] : n[1]
+      if (readsName(addr, pxVar) || [...laneMap.keys()].some(lv => readsName(addr, lv))) return null   // per-lane gather: unsupported
+      return ['f64x2.splat', n]
+    }
+    if (op === 'call') {
+      const v2 = PPC_CALL2[n[1]]
+      if (!v2) return null
+      if (n.length === 3) { const a = lift(n[2]); if (!a) return null; sawHeavy = true; return ['call', v2, a] }
+      if (n.length === 4) { const a = lift(n[2]), b = lift(n[3]); if (!a || !b) return null; sawHeavy = true; return ['call', v2, a, b] }
+      return null
+    }
+    if (op === 'if') {
+      if (!isArr(n[1]) || n[1][0] !== 'result' || n[1][1] !== 'f64') return null
+      const thenN = n[3], elseN = n[4]
+      if (!isArr(thenN) || thenN[0] !== 'then' || thenN.length !== 2) return null
+      if (!isArr(elseN) || elseN[0] !== 'else' || elseN.length !== 2) return null
+      let cond = n[2]
+      if (isArr(cond) && cond[0] === 'i32.ne' && isI32Const(cond[2]) && cond[2][1] === 0) cond = cond[1]
+      return liftSelect(lift(thenN[1]), lift(elseN[1]), cond)
+    }
+    // jz lowers `cond ? A : B` to a `select` (A if cond else B). Same two cases as the `if` form:
+    // lane-invariant cond → a scalar v128-typed branch; per-lane f64 compare → bitselect.
+    if (op === 'select' && n.length === 4) return liftSelect(lift(n[1]), lift(n[2]), n[3])
+    if (LANE_PURE.f64.has(op)) {
+      const ks = n.slice(1).map(lift)
+      return ks.some(k => k === null) ? null : [LANE_PURE.f64.get(op).simd, ...ks]
+    }
+    return null
+  }
+
+  // Lift one inner-loop body statement → its lifted form(s), or null to bail.
+  const liftInnerStmt = (s, innerIV) => {
+    if (matchInc1(s) === innerIV || matchIncN(s)?.name === innerIV) return [s]   // IV bump: scalar
+    if (isArr(s) && s[0] === 'local.set' && typeof s[1] === 'string' && s.length === 3) {
+      const name = s[1], rhs = s[2]
+      if (fnLocals.get(name) !== 'f64') return laneInvariant(rhs) ? [s] : null   // scalar i32 counter
+      const lifted = lift(rhs)   // recurrence (rhs reads name) resolves to the shadow — fine
+      return lifted ? [['local.set', shadowOf(name), lifted]] : null
+    }
+    // Lane-invariant scalar `if` (counter wraparound `if(si>=N) si=0`) → keep scalar.
+    if (isArr(s) && s[0] === 'if' && laneInvariant(s[1]) &&
+        s.slice(2).every(arm => isArr(arm) && (arm[0] === 'then' || arm[0] === 'else') &&
+          arm.slice(1).every(st => isArr(st) && st[0] === 'local.set' && fnLocals.get(st[1]) !== 'f64'))) return [s]
+    // Per-lane conditional accumulate `if(cond) acc = acc + E` → acc += bitselect(liftE, 0, mask).
+    if (isArr(s) && s[0] === 'if' && s.length === 3 && isArr(s[2]) && s[2][0] === 'then' && s[2].length === 2) {
+      const st = s[2][1]
+      if (isArr(st) && st[0] === 'local.set' && st.length === 3 && fnLocals.get(st[1]) === 'f64' && laneMap.has(st[1]) &&
+          isArr(st[2]) && st[2][0] === 'f64.add' && isLocalGet(st[2][1], st[1])) {
+        const cond = s[1], cmp = isArr(cond) && cond.length === 3 ? CMP_LANE[cond[0]] : null
+        if (!cmp || laneInvariant(cond)) return null   // need a per-lane mask
+        const liftE = lift(st[2][2]), ca = lift(cond[1]), cb = lift(cond[2])
+        if (!liftE || !ca || !cb) return null
+        const sh = laneMap.get(st[1])
+        return [['local.set', sh, ['f64x2.add', ['local.get', sh], ['v128.bitselect', liftE, ['f64x2.splat', ['f64.const', 0]], [cmp, ca, cb]]]]]
+      }
+    }
+    return null
+  }
+
+  const liftInnerLoop = (block) => {
+    const ibl = matchBlockLoop(block, { allowPreamble: true })
+    if (!ibl || ibl.preamble.length) return null
+    const lifted = []
+    for (const s of ibl.body) { const out = liftInnerStmt(s, ibl.incVar); if (!out) return null; lifted.push(...out) }
+    return ['block', ibl.blockLabel, ['loop', ibl.loopLabel, ibl.loopNode[2], ...lifted, ibl.loopNode[ibl.incIdx], ['br', ibl.loopLabel]]]
+  }
+
+  // ---- laneCompute = obody[0..lastInner]: f64 seeds → shadow lift; scalar seeds kept; loops lifted ----
+  const laneCompute = []
+  for (let i = 0; i <= lastInner; i++) {
+    const s = obody[i]
+    if (innerSet.has(i)) { const li = liftInnerLoop(s); if (!li) return null; laneCompute.push(li); continue }
+    if (isArr(s) && s[0] === 'local.set' && typeof s[1] === 'string' && s.length === 3) {
+      const name = s[1], rhs = s[2]
+      if (fnLocals.get(name) === 'f64') {
+        if (readsName(rhs, name)) return null   // self-reading seed = carry across the OUTER loop → reject
+        const lifted = lift(rhs); if (!lifted) return null
+        laneCompute.push(['local.set', shadowOf(name), lifted])
+      } else { if (!laneInvariant(rhs)) return null; laneCompute.push(s) }   // scalar counter seed
+      continue
+    }
+    return null
+  }
+  if (!sawHeavy || !laneMap.size) return null   // no transcendental reduction → leave to the scalar JIT
+
+  // ---- epilogue = obody[lastInner+1..]: colour pack+store, run scalar per lane ----
+  const epilogue = obody.slice(lastInner + 1)
+  let hasStore = false
+  const findStore = (n) => { if (!isArr(n)) return; if (STORE_OPS[n[0]]) hasStore = true; n.forEach(findStore) }
+  epilogue.forEach(findStore)
+  if (!hasStore) return null
+  const epiWritten = new Set()
+  const wr = (n) => { if (!isArr(n)) return; const st = (n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string'; if (st) epiWritten.add(n[1]); for (const c of (st ? n.slice(2) : n.slice(1))) wr(c) }
+  epilogue.forEach(wr)
+  const epiReadSet = new Set(); const rd = (n) => { if (!isArr(n)) return; if (n[0] === 'local.get') epiReadSet.add(n[1]); else for (const c of n) rd(c) }
+  epilogue.forEach(rd)
+  for (const v of epiReadSet) if (writesName(loopNode, v) && !laneMap.has(v) && !epiWritten.has(v) && !pivType.has(v)) return null
+  const epiReads = [...laneMap.keys()].filter(v => epiReadSet.has(v))
+  if (!epiReads.length) return null
+
+  // ============================ emit ============================
+  const newLocalDecls = [...new Set(laneMap.values())].map(n => ['local', n, 'v128'])
+  const epiLane = (k) => [
+    ...epiReads.map(v => ['local.set', v, ['f64x2.extract_lane', k, ['local.get', laneMap.get(v)]]]),
+    ...epilogue.map(s => bump(s, k)),
+  ]
+  const sOut = nm('ob'), sOl = nm('ol')
+  const simdOuter = ['block', sOut, ['loop', sOl,
+    ['br_if', sOut, ['i32.eqz', [oExit.cmpOp, bump(['local.get', pxVar], 1), widthBound]]],
+    ...laneCompute, ...epiLane(0), ...epiLane(1),
+    ...pixelIVs.map(p => ['local.set', p.name, [p.type + '.add', ['local.get', p.name], [p.type + '.const', 2]]]),
+    ['br', sOl]]]
+  const wrapper = ['block', nm('w'), ...preamble, simdOuter, ['block', oLabel, loopNode]]
+  return { wrapper, newLocalDecls }
+}
+
+// ---- Integer convolution column-strip-mine (tryConvColumn, experimental) ---------------------
+//
+// The int8 quantized convolution / dense-MAC kernel (conv2d): an OUTER output-pixel loop (ox)
+// whose body — after the inner receptive-field loops fully unroll at speed — is a straight-line
+// f64 reduction  acc = bias + Σ inp[…+ox]·wt[…]  over int8 taps, then requantize (acc>>SHIFT),
+// ReLU-clamp, and store one uint8. jz accumulates in f64, but every product is int8×int8 (≤ 16129)
+// and the sum fits i32, so the f64 carries an EXACT integer. That lets us strip-mine the column
+// loop 8-wide as pure integer SIMD: 8 adjacent outputs (ox..ox+7) in lanes. Per tap, the per-pixel
+// input gather inp[base+ox] is 8 CONTIGUOUS bytes — `v128.load64_zero` + `i16x8.extend_low_i8x16`
+// — and the (pixel-invariant) weight broadcasts via `i16x8.splat`; `i16x8.mul` forms 8 products
+// (each fits i16), widened (`i32x4.extend_low/high_i16x8_s`) into two i32x4 accumulators so 36 taps
+// never overflow. Requant + clamp + store run scalar per lane; the kept scalar loop is the <8 tail.
+//
+// BIT-EXACT: integer arithmetic reorders nothing — each lane's i32 sum equals the scalar f64's exact
+// integer, and ToInt32(acc)>>SHIFT == lane>>SHIFT. Gated behind cfg.experimentalOuterStrip. ~5×
+// over the scalar reduction (the serial f64 add-chain is latency-bound; 8 columns hide it).
+function tryConvColumn(blockNode, fnLocals, freshIdRef, enabled) {
+  if (!enabled) return null
+  const outer = matchOuterPixelLoop(blockNode)
+  if (!outer) return null
+  const { oLabel, loopNode, preamble, pixelIVs, pxVar, widthBound, pivType, obody, oExit } = outer
+  if (pivType.get(pxVar) !== 'i32') return null                 // strip-mine an integer column
+  for (const s of obody) if (isArr(s) && s[0] === 'block' && s.slice(1).some(c => isArr(c) && c[0] === 'loop')) return null  // body must be unrolled (no inner loop)
+  const impureCall = (n) => isArr(n) && ((n[0] === 'call' && typeof n[1] === 'string' && !n[1].startsWith('$math.')) || n.some(impureCall))
+  if (obody.some(impureCall)) return null
+  const readsName = (n, name) => isArr(n) && ((n[0] === 'local.get' && n[1] === name) || n.some(c => readsName(c, name)))
+
+  // Locals whose value depends on the column IV (transitively) — these address the per-pixel gather.
+  const oxDep = new Set([pxVar])
+  const allSets = []
+  const collectSets = (n) => { if (!isArr(n)) return; if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') allSets.push([n[1], n[2]]); for (const c of n.slice(1)) collectSets(c) }
+  obody.forEach(collectSets)
+  for (let changed = true; changed;) { changed = false; for (const [name, rhs] of allSets) if (!oxDep.has(name) && [...oxDep].some(d => readsName(rhs, d))) { oxDep.add(name); changed = true } }
+  const isGatherAddr = (addr) => [...oxDep].some(d => readsName(addr, d))
+
+  // A byte tap operand: convert_i32_{s,u}(i32.load8_{s,u}(addr)). Returns { load, addr, signed }.
+  const matchByteLoad = (n) => {
+    if (!isArr(n) || (n[0] !== 'f64.convert_i32_s' && n[0] !== 'f64.convert_i32_u') || !isArr(n[1])) return null
+    const ld = n[1]
+    if (ld[0] !== 'i32.load8_s' && ld[0] !== 'i32.load8_u') return null
+    const addr = (typeof ld[1] === 'string' && ld[1].startsWith('offset=')) ? ld[2] : ld[1]
+    return { load: ld, addr, signed: ld[0] === 'i32.load8_s' }
+  }
+  const load64 = (ld) => (typeof ld[1] === 'string' && ld[1].startsWith('offset=')) ? ['v128.load64_zero', ld[1], ld[2]] : ['v128.load64_zero', ld[1]]
+  // Lift a single product addend `inp·wt` (exactly one side gathers on ox) to an i16x8 of 8 products.
+  const liftProduct = (prod) => {
+    if (!isArr(prod) || prod[0] !== 'f64.mul') return null
+    const a = matchByteLoad(prod[1]), b = matchByteLoad(prod[2])
+    if (!a || !b) return null
+    const ag = isGatherAddr(a.addr), bg = isGatherAddr(b.addr)
+    const g = ag && !bg ? a : bg && !ag ? b : null            // exactly one per-pixel gather
+    if (!g) return null
+    const inv = g === a ? b : a
+    const gI16 = [g.signed ? 'i16x8.extend_low_i8x16_s' : 'i16x8.extend_low_i8x16_u', load64(g.load)]
+    return ['i16x8.mul', gI16, ['i16x8.splat', inv.load]]      // splat the invariant weight (fits i16)
+  }
+
+  // THE accumulator: an f64 local written as `acc = acc + product` (either operand order). Its FIRST
+  // write is the init — a plain invariant `acc = bias`, or (bias folded into the first tap by the
+  // reassociator) `acc = bias + product`.
+  const macAddend = (rhs, name) => (isArr(rhs) && rhs[0] === 'f64.add') ? (isLocalGet(rhs[1], name) ? rhs[2] : isLocalGet(rhs[2], name) ? rhs[1] : null) : null
+  let accName = null
+  for (const [name, rhs] of allSets) if (fnLocals.get(name) === 'f64' && macAddend(rhs, name) != null) { if (accName && accName !== name) return null; accName = name }
+  if (!accName) return null
+  const accIdx = []
+  for (let i = 0; i < obody.length; i++) { const s = obody[i]; if (isArr(s) && s[0] === 'local.set' && s[1] === accName && s.length === 3) accIdx.push(i) }
+  if (accIdx.length < 4) return null
+  const initIdx = accIdx[0], initRhs = obody[initIdx][2]
+  if (readsName(initRhs, accName)) return null                   // first write must not read acc
+
+  const id = freshIdRef.next++
+  const nm = (s) => `$__cv${id}_${s}`
+  const loV = nm('lo'), hiV = nm('hi'), pV = nm('p')
+  const splatI32 = (e) => ['i32x4.splat', (isArr(e) && (e[0] === 'f64.convert_i32_s' || e[0] === 'f64.convert_i32_u')) ? e[1] : ['i32.trunc_sat_f64_s', e]]
+  const accStmts = (prod) => [
+    ['local.set', pV, prod],
+    ['local.set', loV, ['i32x4.add', ['local.get', loV], ['i32x4.extend_low_i16x8_s', ['local.get', pV]]]],
+    ['local.set', hiV, ['i32x4.add', ['local.get', hiV], ['i32x4.extend_high_i16x8_s', ['local.get', pV]]]],
+  ]
+  // Init → lo/hi seeded to the invariant bias, plus the folded first tap (if the bias was fused in).
+  const initStmts = () => {
+    if (isArr(initRhs) && initRhs[0] === 'f64.add') {
+      const pA = liftProduct(initRhs[1]), pB = liftProduct(initRhs[2])
+      const bias = pA && !pB ? initRhs[2] : pB && !pA ? initRhs[1] : null
+      const prod = pA && !pB ? pA : pB && !pA ? pB : null
+      if (!prod || isGatherAddr(bias)) return null
+      return [['local.set', loV, splatI32(bias)], ['local.set', hiV, splatI32(bias)], ...accStmts(prod)]
+    }
+    if (isGatherAddr(initRhs)) return null                       // plain seed must be loop-invariant
+    return [['local.set', loV, splatI32(initRhs)], ['local.set', hiV, splatI32(initRhs)]]
+  }
+
+  // Build the SIMD body: keep scalar address setup; init→lo/hi seed; each MAC→i16x8 product → lo/hi.
+  const lastMac = accIdx[accIdx.length - 1]
+  const laneCompute = []
+  for (let i = 0; i <= lastMac; i++) {
+    const s = obody[i]
+    if (i === initIdx) { const init = initStmts(); if (!init) return null; laneCompute.push(...init); continue }
+    if (isArr(s) && s[0] === 'local.set' && s[1] === accName) {
+      const addend = macAddend(s[2], accName)
+      if (addend == null) return null                            // an acc write that isn't acc+product
+      const prod = liftProduct(addend); if (!prod) return null
+      laneCompute.push(...accStmts(prod)); continue
+    }
+    if (readsName(s, accName)) return null                       // scalar setup must not touch acc
+    laneCompute.push(s)
+  }
+
+  // Epilogue (requant + clamp + store) runs scalar per lane: acc ← the lane's i32 column sum.
+  const epilogue = obody.slice(lastMac + 1)
+  let hasStore = false
+  const findStore = (n) => { if (!isArr(n)) return; if (STORE_OPS[n[0]]) hasStore = true; n.forEach(findStore) }
+  epilogue.forEach(findStore)
+  if (!hasStore) return null
+  const bump = (n, k) => k === 0 ? n
+    : (isArr(n) && n[0] === 'local.get' && pivType.has(n[1])) ? [pivType.get(n[1]) + '.add', n, [pivType.get(n[1]) + '.const', k]]
+    : (isArr(n) ? n.map(c => bump(c, k)) : n)
+  const epiLane = (k) => [
+    ['local.set', accName, ['f64.convert_i32_s', ['i32x4.extract_lane', k & 3, ['local.get', k < 4 ? loV : hiV]]]],
+    ...epilogue.map(s => bump(s, k)),
+  ]
+
+  const newLocalDecls = [['local', loV, 'v128'], ['local', hiV, 'v128'], ['local', pV, 'v128']]
+  const sOut = nm('ob'), sOl = nm('ol')
+  // Guard requires 8 columns available (ox+7 < width); the kept scalar loop finishes the <8 tail.
+  const simdOuter = ['block', sOut, ['loop', sOl,
+    ['br_if', sOut, ['i32.eqz', [oExit.cmpOp, bump(['local.get', pxVar], 7), widthBound]]],
+    ...laneCompute, ...epiLane(0), ...epiLane(1), ...epiLane(2), ...epiLane(3), ...epiLane(4), ...epiLane(5), ...epiLane(6), ...epiLane(7),
+    ...pixelIVs.map(p => ['local.set', p.name, [p.type + '.add', ['local.get', p.name], [p.type + '.const', 8]]]),
+    ['br', sOl]]]
+  const wrapper = ['block', nm('w'), ...preamble, simdOuter, ['block', oLabel, loopNode]]
+  return { wrapper, newLocalDecls }
+}
+
 // ---- Mixed-lane tone-map (tryToneMap, experimental) ------------------------
 //
 // Vectorizes the log-tonemap TAIL shared by fern / bifurcation / attractors:
@@ -4269,14 +5356,31 @@ function matchInfCanonTone(sel) {
   return tr ? tr.inner : null
 }
 
-// `base + (i<<2)` with `base` a loop-invariant array pointer (local or global). Returns
-// the base node (stride-4 ⇒ load64_zero/i64.store cover exactly 2 consecutive u32) or null.
-function matchToneAddr(addr, ind) {
+// Loads tryToneMap accepts as the f64-island input. `i32.load` is the original (stride-4, no
+// widening). Narrow typed-array reads (Uint8/Int8/Uint16/Int16) are widened to the low two i32x4
+// lanes before the f64x2.convert — exactly the F/B/T `dist` term over an 8-bit/16-bit buffer.
+// `shift` = the address stride exponent (0/1/2). `over` = extra ELEMENTS the widening load reads
+// past its lane pair (u8 reads 4 bytes via load32_zero for 2 lanes) — the SIMD bound is shrunk by
+// it so the read never runs off the array; the scalar tail finishes the remainder. The widen step
+// signedness matches the load op, so the i32x4 lanes hold the exact scalar value.
+const TONE_LOAD = {
+  'i32.load':     { shift: 2, widen: null, over: 0 },
+  'i32.load8_u':  { shift: 0, widen: ['v128.load32_zero', ['i16x8.extend_low_i8x16_u', 'i32x4.extend_low_i16x8_u']], over: 2 },
+  'i32.load8_s':  { shift: 0, widen: ['v128.load32_zero', ['i16x8.extend_low_i8x16_s', 'i32x4.extend_low_i16x8_s']], over: 2 },
+  'i32.load16_u': { shift: 1, widen: ['v128.load32_zero', ['i32x4.extend_low_i16x8_u']], over: 0 },
+  'i32.load16_s': { shift: 1, widen: ['v128.load32_zero', ['i32x4.extend_low_i16x8_s']], over: 0 },
+}
+
+// `base + (i << shift)` (shift 0 ⇒ bare `base + i`) with `base` a loop-invariant array pointer.
+// The address shape for a load/store at its element stride: the u32 store uses shift 2 (stride-4 ⇒
+// load64_zero/i64.store cover exactly 2 consecutive u32); a narrow load uses its own stride (0/1).
+function matchToneAddrShift(addr, ind, shift) {
   if (!isArr(addr) || addr[0] !== 'i32.add' || addr.length !== 3) return null
   const pair = (baseN, offN) => {
     if (!isArr(baseN) || (baseN[0] !== 'local.get' && baseN[0] !== 'global.get')) return null
     if (baseN[0] === 'local.get' && baseN[1] === ind) return null
-    if (isArr(offN) && offN[0] === 'i32.shl' && offN.length === 3 && isLocalGet(offN[1], ind) && constNum(offN[2]) === 2) return baseN
+    if (shift === 0) return isLocalGet(offN, ind) ? baseN : null
+    if (isArr(offN) && offN[0] === 'i32.shl' && offN.length === 3 && isLocalGet(offN[1], ind) && constNum(offN[2]) === shift) return baseN
     return null
   }
   return pair(addr[1], addr[2]) || pair(addr[2], addr[1])
@@ -4321,14 +5425,20 @@ function tryToneMap(bl, fnLocals, freshIdRef, enabled) {
   // island signature (`f64.convert_i32_*`). Any other-width load/store declines. The
   // f64-convert requirement is what distinguishes this from a plain i32 map (tryVectorize,
   // which runs earlier and already owns those).
-  let hasConvert = false, storeCount = 0, loadCount = 0, ok = true
+  let hasConvert = false, storeCount = 0, loadCount = 0, overread = 0, ok = true
   const scan = (n) => {
     if (!ok || !isArr(n)) return
     const o = n[0]
     if (o === 'f64.convert_i32_s' || o === 'f64.convert_i32_u') hasConvert = true
-    if (o === 'i32.store') { storeCount++; if (!matchToneAddr(n[1], incVar)) ok = false; scan(n[2]); return }
-    if (o === 'i32.load') { loadCount++; if (!matchToneAddr(n[1], incVar)) ok = false; return }
-    if (LOAD_OPS[o] || STORE_OPS[o]) { ok = false; return }  // any wider/narrower memop → not this shape
+    if (o === 'i32.store') { storeCount++; if (!matchToneAddrShift(n[1], incVar, 2)) ok = false; scan(n[2]); return }
+    const ld = TONE_LOAD[o]
+    if (ld && n.length === 2) {   // i32 (stride-4) or a narrow typed-array read at its own stride
+      loadCount++
+      if (!matchToneAddrShift(n[1], incVar, ld.shift)) { ok = false; return }
+      if (ld.over > overread) overread = ld.over
+      return
+    }
+    if (LOAD_OPS[o] || STORE_OPS[o]) { ok = false; return }  // any other-width memop → not this shape
     for (let i = 1; i < n.length; i++) scan(n[i])
   }
   for (const s of body) scan(s)
@@ -4371,10 +5481,16 @@ function tryToneMap(bl, fnLocals, freshIdRef, enabled) {
     }
   }
 
-  const ctx = { extraLocals: [], fail: false, failReason: null }   // only liftFail (fail/failReason) + freshMask (extraLocals) read it
-  const newLanedLocals = new Map()       // origName → { laneName }
+  const newLanedLocals = new Map()       // origName → laneName (bare string; see getOrAllocLanedLocal)
+  // SAME field set + ORDER as the ctx in tryVectorize / tryReduceVectorize / tryRampMap. The
+  // self-host kernel infers ONE struct layout per shared callee, and `liftFail` is shared with
+  // liftExprV — so every ctx reaching it MUST have the identical shape, or the inferred layout is
+  // wrong for some and field reads corrupt (this is the exact regression 11657cf fixed; the
+  // tone-map's old 3-field ctx re-broke the ENTIRE self-host vectorizer). tryToneMap itself only
+  // reads fail/failReason/extraLocals, but the unused fields must still be present, in order.
+  const ctx = { laneType: 'f64', incVar, rampVar: null, rampTemp: null, widenLoads: false, localKind, fnLocals: null, newLanedLocals, extraLocals: [], freshIdRef, fail: false, failReason: null }
   const toneSetBefore = new Set()         // lane locals already assigned (conditional-merge gate)
-  const laned = (name) => { let r = newLanedLocals.get(name); if (!r) { r = { laneName: `${name}__v` }; newLanedLocals.set(name, r) } return r.laneName }
+  const laned = (name) => { let ln = newLanedLocals.get(name); if (!ln) { ln = `${name}__v`; newLanedLocals.set(name, ln) } return ln }
   const freshMask = () => { const mt = `$__mask${freshIdRef.next++}`; ctx.extraLocals.push(['local', mt, 'v128']); return mt }
 
   // The ctx-using lifters are NESTED function declarations that CAPTURE the state above (like
@@ -4412,7 +5528,13 @@ function tryToneMap(bl, fnLocals, freshIdRef, enabled) {
     }
     const tr = matchTruncF64(expr)   // f64 → i32 `|0` bridge
     if (tr) { const a = liftV(tr.inner); if (ctx.fail) return null; return [tr.signed ? 'i32x4.trunc_sat_f64x2_s_zero' : 'i32x4.trunc_sat_f64x2_u_zero', a] }
-    if (op === 'i32.load' && expr.length === 2) return ['v128.load64_zero', expr[1]]   // address kept scalar
+    if (TONE_LOAD[op] && expr.length === 2) {   // i32 → load64_zero (low 2 lanes); narrow → widen to i32x4 low lanes
+      const w = TONE_LOAD[op].widen
+      if (!w) return ['v128.load64_zero', expr[1]]   // address kept scalar
+      let v = [w[0], expr[1]]
+      for (let i = 0; i < w[1].length; i++) v = [w[1][i], v]
+      return v
+    }
     if (op === 'i32.const') return ['i32x4.splat', expr]
     if (op === 'f64.const') return ['f64x2.splat', expr]
     if (op === 'local.get' && typeof expr[1] === 'string') {
@@ -4421,6 +5543,15 @@ function tryToneMap(bl, fnLocals, freshIdRef, enabled) {
       if (kind === 'invariant') return [fnLocals.get(name) === 'f64' ? 'f64x2.splat' : 'i32x4.splat', expr]
       return liftFail(ctx, `tonemap: ${name} address/induction var used as lane data`)
     }
+    if (op === 'local.tee' && typeof expr[1] === 'string' && expr.length === 3) {
+      // `let v = X` reused in the same statement folds to `(local.tee $v X)`; lift it to set the
+      // lane local AND yield it (bit-exact — the scalar tee sets $v and returns the same value).
+      const name = expr[1]
+      if (localKind.get(name) !== 'lane') return liftFail(ctx, `tonemap: tee of non-lane ${name}`)
+      const v = liftV(expr[2]); if (ctx.fail) return null
+      toneSetBefore.add(name)
+      return ['local.tee', laned(name), v]
+    }
     if (op === 'call' && PPC_CALL2[expr[1]]) {   // transcendental → its 2-wide mirror
       const args = []
       for (let i = 2; i < expr.length; i++) { const a = liftV(expr[i]); if (ctx.fail) return null; args.push(a) }
@@ -4557,11 +5688,15 @@ function tryToneMap(bl, fnLocals, freshIdRef, enabled) {
       ...lifted,
       ['local.set', incVar, ['i32.add', ['local.get', incVar], ['i32.const', LANES]]],
       ['br', simdLoop]]]
-  const boundSetup = ['local.set', simdBoundName, ['i32.and', boundExpr, ['i32.const', -LANES]]]
+  // A widening narrow load reads more elements than its lane pair (u8: 4 bytes for 2 lanes), so shrink
+  // the SIMD bound by that over-read — the widest load stays in-bounds and the scalar tail finishes the
+  // remainder. (A negative bound from a tiny array just leaves the whole loop scalar — safe.)
+  const boundExprAdj = overread > 0 ? ['i32.sub', boundExpr, ['i32.const', overread]] : boundExpr
+  const boundSetup = ['local.set', simdBoundName, ['i32.and', boundExprAdj, ['i32.const', -LANES]]]
   const wrapper = ['block', ...preamble.map(cloneNode), boundSetup, simdBlock, bl.blockNode]
   const newLocalDecls = [
     ['local', simdBoundName, 'i32'],
-    ...[...newLanedLocals.values()].map(({ laneName }) => ['local', laneName, 'v128']),
+    ...[...newLanedLocals.values()].map(laneName => ['local', laneName, 'v128']),
     ...ctx.extraLocals,
   ]
   return { wrapper, newLocalDecls }
@@ -4573,7 +5708,12 @@ function tryToneMap(bl, fnLocals, freshIdRef, enabled) {
  * Walk a function looking for vectorizable (block (loop)) pairs, in-place.
  * Adds new locals to the function header.
  */
-export function vectorizeLaneLocal(fn, multiAcc = false, relaxedFma = false, blurMP = true, whyNot = false, stencil = false, outerStrip = false, pureFuncMap = null, toneMap = false) {
+// opts gates the recognizer set + lift variants (all default-safe so a bare
+// `vectorizeLaneLocal(fn)` is the conservative scalar-preserving pass):
+//   multiAcc, relaxedFma, blurMP, whyNot, stencil, outerStrip, pureFuncMap, toneMap.
+export function vectorizeLaneLocal(fn, opts = {}) {
+  const { multiAcc = false, relaxedFma = false, blurMP = true, whyNot = false,
+    stencil = false, outerStrip = false, pureFuncMap = null, toneMap = false, slp = false } = opts
   if (!isArr(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
   if (bodyStart < 0) return
@@ -4594,7 +5734,15 @@ export function vectorizeLaneLocal(fn, multiAcc = false, relaxedFma = false, blu
   const freshIdRef = { next: 0 }
   const newLocalDeclsAll = []
 
+  // Hoist loop-invariant partial products out of unrolled dot reductions (rust/LLVM's
+  // mat4 prologue trick). Reassociates the float sum, so tied to the relaxedFma tier;
+  // runs BEFORE the dot-pair vectorizer so a hoisted dot drops below DOT_UNROLL steps
+  // and stays scalar (faster here than the pack/extract SIMD form — see the lab).
+  if (relaxedFma) hoistReductionInvariantsIn(fn, fnLocals, freshIdRef, newLocalDeclsAll)
   vectorizeStraightLineF64DotPairsIn(fn, fnLocals, freshIdRef, newLocalDeclsAll, relaxedFma)
+  // SLP within-iteration store pairs. Sound only with no aliasing typed-array view
+  // in the module (else a shifted view could reorder-hazard the packed read/write).
+  if (slp && !ctx.features.typedView) slpStorePairsIn(fn, fnLocals, freshIdRef, newLocalDeclsAll, slpGetCounts(fn))
 
   // Walk body recursively. Process inner-most matches first (post-order)
   // so we don't try to vectorize an outer loop whose inner is the lane-local one.
@@ -4612,7 +5760,13 @@ export function vectorizeLaneLocal(fn, multiAcc = false, relaxedFma = false, blu
       // recognizers (divergent-escape, ramp-map, blur, channel-reduce, per-pixel)
       // do their own matching on the raw node. Order is preserved exactly — it is
       // load-bearing (first match wins).
-      const bl = matchBlockLoop(node, { allowPreamble: true })
+      // allowInlinedLi: accept an inlined LICM preamble (`$__inl*___li*`) too — jz's
+      // LICM hoists ToInt32/casts of loop-invariant params just before the loop (e.g.
+      // `a[i] & m` with a runtime `m`), and after inlining the snap is renamed off the
+      // bare `$__li*` form. The preamble is pure & loop-invariant by construction
+      // (hasSideEffect-guarded) and cloned ahead of the SIMD block, so this only widens
+      // which loops the recognizers see, never changes a lifted result.
+      const bl = matchBlockLoop(node, { allowPreamble: true, allowInlinedLi: true })
       let r = tryDivergentEscapeVectorize(node, fnLocals, freshIdRef)
         ?? tryMemCopyFill(bl, fnLocals, freshIdRef)
         ?? tryVectorize(bl, fnLocals, freshIdRef)
@@ -4625,6 +5779,8 @@ export function vectorizeLaneLocal(fn, multiAcc = false, relaxedFma = false, blu
         ?? tryByteScan(bl, fnLocals, freshIdRef)
         ?? tryPerPixelColor(node, fnLocals, freshIdRef, pureFuncMap)
         ?? tryOuterStrip(node, fnLocals, freshIdRef, outerStrip)
+        ?? tryIteratedReduce(node, fnLocals, freshIdRef, outerStrip)
+        ?? tryConvColumn(node, fnLocals, freshIdRef, outerStrip)
         ?? tryToneMap(bl, fnLocals, freshIdRef, toneMap)
       // --why-not-simd: a canonical loop-shaped candidate that no SIMD pass took.
       // Reported BEFORE the scalar strength-reduce fallback (which fires on most
@@ -4644,8 +5800,10 @@ export function vectorizeLaneLocal(fn, multiAcc = false, relaxedFma = false, blu
     }
   }
   _whyNotActive = whyNot
+  _relaxF32 = relaxedFma
   for (let i = bodyStart; i < fn.length; i++) walk(fn, i)
   _whyNotActive = false
+  _relaxF32 = false
 
   if (newLocalDeclsAll.length) {
     // Sibling loops (and the straight-line dot pass) can each lift the SAME source