jz 0.8.0 → 0.8.1

package/src/abi/string.js

@@ -373,15 +373,20 @@ export const sso = {
      *  dispatcher's string/array runtime guess (emit.js) would hijack it into a
      *  bogus array concat. A non-builtin name routes through dynamic property
      *  dispatch (load the closure slot, call it) correctly. */
-    cat: (aF64, bF64, ctx) => {
-      ctx.core.includes.add('__str_concat')
-      return ['call', '$__str_concat', ssoI64(aF64), ssoI64(bF64)]
+    // `ext` (default false) opts into the bump-EXTEND fast path — sound only when emit
+    // proves `a` is dead-after (a self-accumulation `x = x + …`). Otherwise the _fresh twin
+    // alloc+copies, never mutating the live `a` operand. (See __str_concat in module/string.js.)
+    cat: (aF64, bF64, ctx, ext = false) => {
+      const fn = ext ? '__str_concat' : '__str_concat_fresh'
+      ctx.core.includes.add(fn)
+      return ['call', '$' + fn, ssoI64(aF64), ssoI64(bF64)]
     },
 
     /** Concat assuming both sides are already strings (skip ToString). */
-    concatRaw: (aF64, bF64, ctx) => {
-      ctx.core.includes.add('__str_concat_raw')
-      return ['call', '$__str_concat_raw', ssoI64(aF64), ssoI64(bF64)]
+    concatRaw: (aF64, bF64, ctx, ext = false) => {
+      const fn = ext ? '__str_concat_raw' : '__str_concat_raw_fresh'
+      ctx.core.includes.add(fn)
+      return ['call', '$' + fn, ssoI64(aF64), ssoI64(bF64)]
     },
   },
 }

package/src/compile/emit.js

@@ -1553,6 +1553,41 @@ const isCheapPureVal = (n) => {
   return false
 }
 
+// Side-effect-free: no writes (assignment / ++ / --), no calls, no closures, no throw. UNLIKE
+// `isCheapPureVal` this ALLOWS loads, member reads, and `/` `%` — a side-effect-free expr may read
+// memory or trap. It is the right gate for an `if` CONDITION promoted to a `select` condition: the
+// condition is evaluated exactly once whether the lowering branches or selects (any trap fires the
+// same in both, the read order vs the pure value arm is immaterial), so it need only avoid MUTATING
+// state the value arm could read — i.e. be side-effect-free, not unconditionally-evaluable.
+const SIDE_EFFECT_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '>>=', '<<=',
+  '>>>=', '||=', '&&=', '??=', '++', '--', '()', '=>', 'throw', 'new', 'await', 'yield'])
+const isSideEffectFree = (n) => {
+  if (!Array.isArray(n)) return true
+  if (typeof n[0] === 'string' && SIDE_EFFECT_OPS.has(n[0])) return false
+  for (let i = 1; i < n.length; i++) if (!isSideEffectFree(n[i])) return false
+  return true
+}
+
+const isLit1 = (n) => Array.isArray(n) && n[0] == null && n[1] === 1
+// A void statement whose whole effect is `x = <cheap pure value>` for a simple local `x` — the
+// shape if→select can lower to `x = cond ? value : x`. Recognizes the plain assignment plus the
+// increment forms `++x`/`--x` and their postfix lowerings `(++x) - 1` / `(--x) + 1` (prepare turns
+// `x++` in statement position into the latter; the discarded ∓1 is dead in void context, so the
+// net effect is the increment). Returns `{ lhs, val }` or null.
+function matchVoidLocalStore(s) {
+  if (!Array.isArray(s)) return null
+  if (s[0] === '=' && typeof s[1] === 'string' && isCheapPureVal(s[2])) return { lhs: s[1], val: s[2] }
+  if ((s[0] === '++' || s[0] === '--') && typeof s[1] === 'string')
+    return { lhs: s[1], val: [s[0] === '++' ? '+' : '-', s[1], [, 1]] }
+  // postfix: `x++` → `(++x) - 1`, `x--` → `(--x) + 1`
+  if ((s[0] === '-' || s[0] === '+') && isLit1(s[2]) && Array.isArray(s[1])
+      && (s[1][0] === '++' || s[1][0] === '--') && typeof s[1][1] === 'string') {
+    const inc = s[1][0] === '++'
+    if ((inc && s[0] === '-') || (!inc && s[0] === '+')) return { lhs: s[1][1], val: [inc ? '+' : '-', s[1][1], [, 1]] }
+  }
+  return null
+}
+
 function emitLooseEq(a, b, negate) {
   const eqOp = negate ? 'ne' : 'eq'
   const sentinel = emitNum(negate ? 1 : 0)
@@ -2713,7 +2748,15 @@ export const emitter = {
       inc('__to_num')
       return writeVar(name, typed(['call', '$__to_num', asI64(emit(name))], 'f64'), void_)
     }
-    return writeVar(name, emit(val), void_)
+    // Self-accumulation `x = x + …` (incl. desugared `x += …`): the new value REPLACES x, so x's
+    // old buffer is dead — the one context where a string concat may bump-EXTEND it in place. The
+    // `+` handler reads this flag for its immediate concat; nested operands clear it (not the target).
+    const selfAccum = Array.isArray(val) && val[0] === '+' && val[1] === name
+    const prevSA = ctx.func._selfAccumConcat
+    ctx.func._selfAccumConcat = selfAccum ? name : null
+    const ev = emit(val)
+    ctx.func._selfAccumConcat = prevSA
+    return writeVar(name, ev, void_)
   },
 
   // Compound assignments: read-modify-write with type coercion
@@ -2803,15 +2846,18 @@ export const emitter = {
   // Postfix in void: (++i)-1 / (--i)+1 → just ++i / --i
   '+': (a, b) => {
     if (ctx.func._expect === 'void' && isPostfix(a, '--', b)) return emit(a, 'void')
+    // A self-accumulation `a = a + …` lets the concat bump-EXTEND `a` in place (a is dead-after).
+    // Read it for THIS concat, then clear so nested operands (not the accumulation target) stay fresh.
+    const selfAccum = typeof a === 'string' && a === ctx.func._selfAccumConcat
+    ctx.func._selfAccumConcat = null
     // String concatenation: pure string operands skip generic ToString coercion.
     const vtA = valTypeOf(a)
     const vtB = valTypeOf(b)
     if (vtA === VAL.STRING && vtB === VAL.STRING) {
-      // Fused append-byte: `buf += s[i]` skips 1-char SSO construction +
-      // generic concat dispatch when rhs is a string-index. The byte flows
-      // straight from __char_at into memory, and the bump-extend path elides
-      // the alloc+copy when lhs is the heap-top STRING.
-      if (Array.isArray(b) && b[0] === '[]' && ctx.core.stdlib['__str_append_byte'] && ctx.core.stdlib['__char_at']) {
+      // Fused append-byte: `buf += s[i]` skips 1-char SSO construction + generic concat dispatch
+      // when rhs is a string-index. The byte flows straight from __char_at into memory and bump-
+      // EXTENDS the heap-top lhs — so only when proven self-accumulating (else it mutates a live s).
+      if (selfAccum && Array.isArray(b) && b[0] === '[]' && ctx.core.stdlib['__str_append_byte'] && ctx.core.stdlib['__char_at']) {
         if (valTypeOf(b[1]) === VAL.STRING) {
           inc('__str_append_byte', '__char_at')
           return typed(['call', '$__str_append_byte',
@@ -2820,7 +2866,7 @@ export const emitter = {
           ], 'f64')
         }
       }
-      return typed(ctx.abi.string.ops.concatRaw(asF64(emit(a)), asF64(emit(b)), ctx), 'f64')
+      return typed(ctx.abi.string.ops.concatRaw(asF64(emit(a)), asF64(emit(b)), ctx, selfAccum), 'f64')
     }
     if (vtA === VAL.STRING || vtB === VAL.STRING) {
       // An OBJECT operand coerces via ToPrimitive(string) at compile time —
@@ -2840,10 +2886,10 @@ export const emitter = {
       const coercionFree = (vt) => vt === VAL.STRING || vt === VAL.OBJECT || vt === VAL.BOOL
       const cfA = coercionFree(vtA), cfB = coercionFree(vtB)
       const strI64 = (n) => typed(['f64.reinterpret_i64', toStrI64(n, emit(n))], 'f64')
-      if (cfA && cfB) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strOperand(vtB, b), ctx), 'f64')
-      if (cfA) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strI64(b), ctx), 'f64')
-      if (cfB) return typed(ctx.abi.string.ops.concatRaw(strI64(a), strOperand(vtB, b), ctx), 'f64')
-      return typed(ctx.abi.string.ops.cat(strOperand(vtA, a), strOperand(vtB, b), ctx), 'f64')
+      if (cfA && cfB) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strOperand(vtB, b), ctx, selfAccum), 'f64')
+      if (cfA) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strI64(b), ctx, selfAccum), 'f64')
+      if (cfB) return typed(ctx.abi.string.ops.concatRaw(strI64(a), strOperand(vtB, b), ctx, selfAccum), 'f64')
+      return typed(ctx.abi.string.ops.cat(strOperand(vtA, a), strOperand(vtB, b), ctx, selfAccum), 'f64')
     }
     if (vtA === VAL.BIGINT || vtB === VAL.BIGINT)
       return fromI64(['i64.add', asI64(emit(a)), asI64(emit(b))])
@@ -2853,6 +2899,12 @@ export const emitter = {
     // operand needs the runtime check.
     if ((vtA == null || vtB == null) && ctx.core.stdlib['__str_concat']) {
       const tA = temp('add'), tB = temp('add')
+      // Fully-untyped `+`: the string arm is a runtime-guarded cold path that the engine reaches
+      // only if BOTH operands are strings at runtime, so it keeps the bump-extend `__str_concat`
+      // (its body stays out-of-line — folding it to the smaller _fresh twin would inline this
+      // never-numeric branch into every hot integer loop). The demonstrated `t = s + "lit"` mutation
+      // is a TYPED concat (handled by concatRaw above); a both-untyped self-mutation stays the
+      // documented rare-aliasing tradeoff. Self-accumulation is still safe to extend.
       inc('__str_concat', '__is_str_key')
       const checkA = vtA == null ? ['call', '$__is_str_key', ['i64.reinterpret_f64', ['local.tee', `$${tA}`, asF64(emit(a))]]] : null
       const checkB = vtB == null ? ['call', '$__is_str_key', ['i64.reinterpret_f64', ['local.tee', `$${tB}`, asF64(emit(b))]]] : null
@@ -3297,13 +3349,17 @@ export const emitter = {
     // If-conversion (speed tier): `if (cond) x = <cheap pure value>` (no else) → `x = cond ? value
     // : x`, which lowers to a branchless `select`. Removes the data-dependent branch (and its
     // misprediction) from min/max/clamp reductions — e.g. levenshtein's `if (ins < m) m = ins`,
-    // ~27% faster. Gated to the same speed tier as boolConvertToSelect (the select latency/size
-    // trade). Restricted to a plain assignment of a memory-/trap-free expr to a simple local, so
-    // the unconditional false-case eval is free and identical in effect.
-    if (els == null && ctx.transform.optimize?.boolConvertToSelect && isCheapPureVal(cond)) {
+    // ~27% faster — and from heapsort's child pick `if (a[c] < a[c+1]) c++`, the canonical
+    // unpredictable compare that costs jz on x86 (Cranelift/V8-x64 keep the branch; Binaryen, which
+    // AS uses, selects it). The condition is evaluated exactly once whether we branch or select, so
+    // it need only be SIDE-EFFECT-FREE (loads allowed — sort's `a[c] < a[c+1]`); only the assigned
+    // VALUE is evaluated unconditionally, hence must be a cheap, trap-free pure expr. `x++`/`x--`
+    // are admitted as `x = x ± 1`. The already-emitted condition `ce` is reused (`__emitted`), so a
+    // load-bearing condition is not emitted twice.
+    if (els == null && ctx.transform.optimize?.boolConvertToSelect && isSideEffectFree(cond)) {
       const asg = Array.isArray(then) && then[0] === ';' && then.length === 2 ? then[1] : then
-      if (Array.isArray(asg) && asg[0] === '=' && typeof asg[1] === 'string' && isCheapPureVal(asg[2]))
-        return emitVoid(['=', asg[1], ['?:', cond, asg[2], asg[1]]])   // cond cheap-pure → re-emit is free
+      const sel = matchVoidLocalStore(asg)
+      if (sel) return emitVoid(['=', sel.lhs, ['?:', ['__emitted', ce], sel.val, sel.lhs]])
     }
     const c = ce.type === 'i32' ? ce : toBoolFromEmitted(ce)
     // Flow-sensitive type refinement: narrow types within each branch based on the guard.
@@ -3566,6 +3622,10 @@ export function emit(node, expect) {
     if (node.loc != null) ctx.error.loc = node.loc
   }
   if (node == null) return null
+  // Pre-emitted IR passthrough: `['__emitted', ir]` returns `ir` untouched. Lets a caller that
+  // already emitted a subtree (e.g. the `if` handler's condition) splice it into an AST-shaped
+  // re-emit (a `?:` for if→select conversion) without emitting it a second time.
+  if (Array.isArray(node) && node[0] === '__emitted') return node[1]
   // Boolean literals carry VAL.BOOL for type observation (valTypeOf reads the
   // AST), but their working representation is the plain number 0/1 — identical
   // codegen to the pre-carrier `[, 1]`/`[, 0]` folding, so no perf is paid.

package/src/compile/index.js

@@ -40,6 +40,7 @@ import { inferLocals } from './infer.js'
 import { optimizeFunc, treeshake } from '../optimize/index.js'
 import { strengthReduceLoopDivMod } from './loop-divmod.js'
 import { narrowBoundedSquare } from './loop-square.js'
+import { unrollRecurrence } from './loop-recurrence.js'
 import { peelClampedStencil } from './peel-stencil.js'
 import { cseLoads } from './cse-load.js'
 
@@ -426,6 +427,11 @@ function analyzeFuncForEmit(func, programFacts) {
   // so the sieve's product/counter chain carries i32 instead of f64. Before analyze so the
   // Math.imul typed/narrows like any i32. Off at L0 / `loopSquare:false`.
   if (_o && _o.loopSquare !== false && isBlockBody(func.body)) func.body = narrowBoundedSquare(func.body)
+  // Array-recurrence unroll: a unit-stride DP/scan that reads arr[j-1] and writes arr[j] carries
+  // its value through memory (store→load) and re-pays loop overhead per cell — both of which V8
+  // hides but Cranelift/baseline don't. Scalar-replace the recurrence + unroll ×2 (clang's fix).
+  // Off at L0 / `unrollRecurrence:false`.
+  if (_o && _o.unrollRecurrence !== false && isBlockBody(func.body)) func.body = unrollRecurrence(func.body)
   // Edge-clamp peeling: split a clamped stencil loop into clamp-free interior + edges
   // (the interior then lifts to SIMD). Before analyze so the new loops are analyzed.
   if (_o && _o.clampPeel !== false && isBlockBody(func.body)) func.body = peelClampedStencil(func.body)

package/src/compile/infer.js

@@ -130,11 +130,18 @@ export const inferParams = (body, candidates) => {
 // regardless of prior evidence — a later method call can't re-induce a shape
 // already contradicted by an earlier scalar assignment.
 
+// Methods that exist ONLY on String.prototype — seeing one on a bare binding proves
+// it is a string. `indexOf`/`includes`/`lastIndexOf`/`concat`/`slice`/`at` are NOT here:
+// Array.prototype has them too, so the receiver is genuinely ambiguous (and the argument
+// can't disambiguate — String coerces it, Arrays hold strings). Those keep the runtime
+// __ptr_type fork, which is correct for both; forcing `lastIndexOf` to string here used to
+// miscompile `arr.lastIndexOf(x)` to -1. A string-using param still narrows via any of the
+// real discriminators below (charCodeAt, a string assignment, a string-passing call site).
 const STRING_ONLY_METHODS = new Set([
   'charCodeAt', 'charAt', 'codePointAt', 'startsWith', 'endsWith',
   'toUpperCase', 'toLowerCase', 'toLocaleLowerCase', 'normalize', 'localeCompare',
   'padStart', 'padEnd', 'repeat', 'trimStart', 'trimEnd', 'trim',
-  'matchAll', 'match', 'replace', 'replaceAll', 'split', 'lastIndexOf',
+  'matchAll', 'match', 'replace', 'replaceAll', 'split',
 ])
 const ARRAY_ONLY_POISON = new Set([
   'push', 'pop', 'shift', 'unshift', 'splice', 'sort', 'fill', 'reverse',

package/src/compile/loop-recurrence.js

@@ -0,0 +1,167 @@
+// Partial unroll (×2) + scalar replacement of a unit-stride ARRAY RECURRENCE.
+//
+// A DP/scan loop that reads `arr[j-1]` and writes `arr[j]` (unit stride) carries the
+// just-written value to the next iteration THROUGH MEMORY: it stores `arr[j]`, then the next
+// iteration loads `arr[j-1]` — the very cell it just wrote. V8/TurboFan forwards that store→load
+// and unrolls the loop internally; Cranelift/wasmtime and the baseline tiers do neither, so the
+// loop pays a store→load round trip plus full per-iteration overhead on every cell. clang/gcc
+// fix exactly this with this transform — measured 2.15× on wasmtime for the Levenshtein DP
+// (V8-neutral, bit-exact).
+//
+// Recognized (post-prepare AST): a unit-stride `for (let j = LO; j </<= HI; j++)` whose body, for
+// ONE array `arr`, has a single store `arr[j] = <var>` and ≥1 read `arr[j-1]`, accesses `arr` at
+// no other index, never aliases `arr` elsewhere, and contains no call / nested loop / break /
+// continue / return / closure. The `arr[j-1]` read becomes a scalar `left` seeded from `arr[LO-1]`
+// and refreshed after each store; the body is then unrolled ×2 (with a 1-cell tail) so the carry
+// between the paired cells lives in a register and the loop overhead is halved. A `LO <= HI` guard
+// keeps the seed load in step with the original (which reads `arr[LO-1]` only when it iterates),
+// and falls back to the untouched loop on the empty range — sound for any trip count.
+
+import { findMutations } from './analyze-scans.js'
+import { litVal, litN, unitIncVar, normalizeLoop, freshLoopId } from './loop-model.js'
+import { rewriteBlocks, closureMutatedVars } from './loop-model.js'
+
+const isArr = (n) => Array.isArray(n)   // wrap (not alias): the self-host kernel rejects a builtin used as a first-class value
+const clone = (n) => isArr(n) ? n.map(clone) : n
+const isIvMinus1 = (n, iv) => isArr(n) && n[0] === '-' && n[1] === iv && litN(n[2], 1)   // (iv - 1)
+
+// Ops whose presence makes duplicating the body in place unsound (control that escapes the cell,
+// or a call that could alias/mutate `arr` or reorder side effects).
+const REJECT = new Set(['for', 'while', 'do', 'for-in', 'for-of', 'break', 'continue', 'return',
+  'throw', 'switch', 'try', 'catch', 'finally', '=>', 'label'])
+const hasUnsafe = (n) => {
+  if (!isArr(n)) return false
+  if (REJECT.has(n[0])) return true
+  if (n[0] === '()' && typeof n[1] === 'string') return true   // function call `f(args)`
+  return n.some(hasUnsafe)
+}
+
+// Substitute every value-reference of `iv` with (iv + 1); leave the op slot and property keys.
+const subPlus1 = (n, iv) => {
+  if (n === iv) return ['+', iv, 1]
+  if (!isArr(n)) return n
+  if (n[0] === '.' && n.length === 3) return ['.', subPlus1(n[1], iv), n[2]]
+  return [n[0], ...n.slice(1).map(c => subPlus1(c, iv))]
+}
+
+// Rename every let/const-DECLARED var in `stmts` with a suffix, throughout — so the 2nd unrolled
+// cell's locals don't collide with the 1st. Loop-carried outer vars (assigned, not declared here)
+// are untouched, so the recurrence still threads through them.
+function renameDecls(stmts, suf) {
+  const declared = new Set()
+  const collect = (n) => {
+    if (!isArr(n)) return
+    if (n[0] === 'let' || n[0] === 'const')
+      for (let k = 1; k < n.length; k++) if (isArr(n[k]) && n[k][0] === '=' && typeof n[k][1] === 'string') declared.add(n[k][1])
+    n.forEach(collect)
+  }
+  stmts.forEach(collect)
+  if (!declared.size) return stmts
+  const ren = (n) => {
+    if (typeof n === 'string') return declared.has(n) ? n + suf : n
+    if (!isArr(n)) return n
+    if (n[0] === '.' && n.length === 3) return ['.', ren(n[1]), n[2]]
+    return [n[0], ...n.slice(1).map(ren)]
+  }
+  return stmts.map(ren)
+}
+
+// Replace `arr[iv-1]` reads with `left`; keep the store; emit `left = storeVal` after each store.
+function scalarReplace(stmts, arr, iv, left, storeVal) {
+  const repl = (n) => {
+    if (!isArr(n)) return n
+    if (n[0] === '[]' && n[1] === arr && isIvMinus1(n[2], iv)) return left
+    if (n[0] === '.' && n.length === 3) return ['.', repl(n[1]), n[2]]
+    return [n[0], ...n.slice(1).map(repl)]
+  }
+  const out = []
+  for (const s of stmts) {
+    out.push(repl(s))
+    if (isArr(s) && s[0] === '=' && isArr(s[1]) && s[1][0] === '[]' && s[1][1] === arr && s[1][2] === iv)
+      out.push(['=', left, storeVal])
+  }
+  return out
+}
+
+function tryUnroll(stmt, cm) {
+  const L = normalizeLoop(stmt)
+  if (!L || L.kind !== 'for') return null
+  const body = L.body
+  if (!isArr(body) || body[0] !== ';') return null
+  const iv = unitIncVar(L.step)
+  if (!iv) return null
+
+  // init `let iv = LO`, LO a literal ≥ 1 (so arr[LO-1] is a valid in-bounds index)
+  if (!(isArr(L.init) && L.init[0] === 'let' && isArr(L.init[1]) && L.init[1][0] === '=' && L.init[1][1] === iv)) return null
+  const LO = L.init[1][2], loVal = litVal(LO)
+  if (loVal == null || loVal < 1) return null
+
+  // cond `iv <= HI` / `iv < HI`, HI loop-invariant
+  if (!(isArr(L.cond) && (L.cond[0] === '<=' || L.cond[0] === '<') && L.cond[1] === iv)) return null
+  const cmpOp = L.cond[0], HI = L.cond[2]
+  if (!(typeof HI === 'string' || litVal(HI) != null)) return null
+
+  if (hasUnsafe(body)) return null
+  const stmts = body.slice(1)
+
+  // exactly one store `arr[iv] = <var>` — the recurrence array + carried value
+  let arr = null, storeVal = null, nStore = 0
+  for (const s of stmts)
+    if (isArr(s) && s[0] === '=' && isArr(s[1]) && s[1][0] === '[]' && s[1][2] === iv) {
+      if (typeof s[2] !== 'string') return null
+      arr = s[1][1]; storeVal = s[2]; nStore++
+    }
+  if (nStore !== 1 || typeof arr !== 'string') return null
+  if (storeVal === iv || storeVal === arr) return null
+
+  // every `arr[...]` is `arr[iv]` or `arr[iv-1]`, the only write is the store, ≥1 recurrence read,
+  // and `arr` never appears bare (passed/aliased)
+  let hasRec = false, bad = false
+  const scan = (n) => {
+    if (!isArr(n)) return
+    if (n[0] === '[]' && n[1] === arr) {
+      if (n[2] === iv) {} else if (isIvMinus1(n[2], iv)) hasRec = true; else bad = true
+    }
+    if (n[0] === '=' && isArr(n[1]) && n[1][0] === '[]' && n[1][1] === arr && n[1][2] !== iv) bad = true
+    if (!(n[0] === '[]' || n[0] === '.')) for (let k = 1; k < n.length; k++) if (n[k] === arr) bad = true
+    n.forEach(scan)
+  }
+  scan(body)
+  if (bad || !hasRec) return null
+
+  // The carry `left = storeVal` is emitted right after the store, so a recurrence read AFTER the
+  // store would see this cell's value, not arr[iv-1]. Require every arr[iv-1] read to precede it.
+  const storeIdx = stmts.findIndex(s => isArr(s) && s[0] === '=' && isArr(s[1]) && s[1][0] === '[]' && s[1][1] === arr && s[1][2] === iv)
+  const readsRec = (n) => isArr(n) && ((n[0] === '[]' && n[1] === arr && isIvMinus1(n[2], iv)) || n.some(readsRec))
+  for (let k = storeIdx + 1; k < stmts.length; k++) if (readsRec(stmts[k])) return null
+
+  // iv assigned only by the step; iv/arr/HI loop-invariant (not mutated, incl. via a closure call)
+  const ivMut = new Set(); findMutations(body, new Set([iv]), ivMut)
+  if (ivMut.has(iv)) return null
+  if (cm.has(iv) || cm.has(arr)) return null
+  if (typeof HI === 'string') { const hiMut = new Set(); findMutations(body, new Set([HI]), hiMut); if (hiMut.has(HI) || cm.has(HI)) return null }
+
+  // --- transform ---
+  const id = freshLoopId()
+  const left = `__rec${id}`
+  const bodyS = scalarReplace(stmts, arr, iv, left, storeVal)
+  const cellJ = () => bodyS.map(clone)
+  const cellJ1 = renameDecls(bodyS.map(s => subPlus1(clone(s), iv)), `$r${id}`)
+
+  const seed = ['let', ['=', left, ['[]', arr, loVal - 1]]]          // left = arr[LO-1]
+  const letIv = ['let', ['=', iv, clone(LO)]]                        // let iv = LO
+  const twoFit = cmpOp === '<=' ? ['<', iv, clone(HI)] : ['<', iv, ['-', clone(HI), 1]]
+  const main = ['while', twoFit,
+    [';', ['{}', [';', ...cellJ()]], ['{}', [';', ...cellJ1]], ['=', iv, ['+', iv, 2]]]]
+  const tail = ['if', [cmpOp, iv, clone(HI)],
+    ['{}', [';', ...cellJ(), ['=', iv, ['+', iv, 1]]]]]
+  const block = ['{}', [';', letIv, seed, main, tail]]
+  // Run the unrolled form only on a non-empty range (so the seed's arr[LO-1] load matches the
+  // original, which reads it only when it iterates); otherwise the untouched loop.
+  return [['if', [cmpOp, clone(LO), clone(HI)], block, stmt]]
+}
+
+export function unrollRecurrence(body) {
+  const cm = closureMutatedVars(body)
+  return rewriteBlocks(body, stmt => tryUnroll(stmt, cm))
+}

package/src/compile/narrow.js

@@ -62,12 +62,17 @@ function filterLiveCallSites(callSites, valueUsed) {
 
 function buildCallerCtx() {
   const callerCtx = new Map()
-  callerCtx.set(null, { callerLocals: ctx.scope.globalTypes, callerValTypes: ctx.scope.globalValTypes })
+  const globalTE = ctx.scope.globalTypedElem || new Map()
+  callerCtx.set(null, { callerLocals: ctx.scope.globalTypes, callerValTypes: ctx.scope.globalValTypes, callerTypedElems: globalTE })
   for (const func of ctx.func.list) {
     if (!func.body || func.raw) continue
     const facts = analyzeBody(func.body)
     for (const p of func.sig.params) if (!facts.locals.has(p.name)) facts.locals.set(p.name, p.type)
-    callerCtx.set(func, { callerLocals: facts.locals, callerValTypes: facts.valTypes })
+    // Shadow-aware local+global typed-array map: a `const buf = new Int32Array(…)`
+    // local makes `buf[i]` arg reads type i32 at this caller's sites, so a callee
+    // param fed only such elements narrows (else it stays f64 and `1 << p` drags in
+    // __to_num → the whole string↔number stdlib). Mirrors callerTypedElemsFor.
+    callerCtx.set(func, { callerLocals: facts.locals, callerValTypes: facts.valTypes, callerTypedElems: callerTypedElemsFor(func, globalTE) })
   }
   return callerCtx
 }
@@ -725,6 +730,7 @@ export default function narrowSignatures(programFacts, ast) {
       callee, callerFunc, argList, func, restIdx,
       callerLocals: ctxEntry.callerLocals,
       callerValTypes: ctxEntry.callerValTypes,
+      callerTypedElems: ctxEntry.callerTypedElems,
       callerParamFacts(key) {
         if (!paramFacts.has(key)) paramFacts.set(key, paramFactsOf(paramReps, callerFunc, key))
         return paramFacts.get(key)
@@ -847,7 +853,10 @@ export default function narrowSignatures(programFacts, ast) {
     if (state.callee === state.callerFunc?.name &&
         isRecurIntExpr(arg, new Set(state.func.sig.params.map(p => p.name)), state.callerLocals)) return 'i32'
     if (!state._teOverlay) {
-      const m = new Map(ctx.scope.globalTypedElem || [])
+      // Caller's typed arrays (locals + non-shadowed globals, precomputed shadow-aware
+      // in buildCallerCtx) so a LOCAL `const buf = new Int32Array(…)` makes `buf[i]`
+      // type i32 here — not just module globals / typedCtor-narrowed params.
+      const m = new Map(state.callerTypedElems || ctx.scope.globalTypedElem || [])
       const pf = state.callerParamFacts('typedCtor')
       if (pf) for (const [name, ctor] of pf) if (ctor != null) m.set(name, ctor)
       state._teOverlay = m