jz 0.8.0 → 0.9.0

package/module/json.js

@@ -14,7 +14,8 @@ import { valTypeOf } from '../src/kind.js'
 import { T } from '../src/ast.js'
 import { VAL } from '../src/reps.js'
 import { err, inc, PTR, LAYOUT, declGlobal } from '../src/ctx.js'
-import { strHashLiteral } from './collection.js'
+import { i64Hex } from '../layout.js'
+import { strHashLiteral, heapResetWat } from './collection.js'
 
 function jsonConstString(ctx, expr) {
   if (Array.isArray(expr) && expr[0] === 'str' && typeof expr[1] === 'string') return expr[1]
@@ -142,12 +143,22 @@ export default (ctx) => {
     __jindent: ['__jput'],
     __json_val: ['__ptr_type', '__len', '__ptr_offset', '__jput', '__jindent', '__jput_num', '__jput_str', '__json_enter', '__json_leave', '__json_hash', '__json_obj'],
     __json_hash: ['__ptr_offset', '__jput', '__jindent', '__jput_str', '__json_omit', '__json_enter', '__json_leave', '__json_val', '__coll_order'],
-    __json_obj: ['__ptr_offset', '__ptr_aux', '__len', '__jput', '__jindent', '__jput_str', '__json_omit', '__json_enter', '__json_leave', '__json_val', '__coll_order'],
-    __jput_num: ['__ftoa'],
-    __jput_str: ['__char_at', '__str_byteLen'],
+    // Durable-receiver global-table merge (see __json_obj's body) pulls in
+    // __ihash_get_local/__is_nullish only when collection.js's dyn-props
+    // machinery is actually part of this build (mirrors array.js's
+    // needsArrayDynMove-gated deps thunks) — a program that never writes a
+    // dynamic prop anywhere never loads collection.js.
+    __json_obj: () => [...(ctx.schema.dateSid != null ? ['__date_to_iso_string'] : []),
+      '__ptr_offset', '__ptr_aux', '__len', '__jput', '__jindent', '__jput_str', '__json_omit', '__json_enter', '__json_leave', '__json_val', '__coll_order',
+      ...(ctx.scope.globals.has('__dyn_props') ? ['__ihash_get_local', '__is_nullish'] : [])],
+    // Chain edges ($__jput_num → $__jput_str → $__jput): each body CALLS the
+    // next stage; without the explicit edge they ride the auto-dep scan, which
+    // silently yields nothing under self-host (test/selfhost-includes.js).
+    __jput_num: ['__ftoa', '__jput_str'],
+    __jput_str: ['__char_at', '__str_byteLen', '__jput'],
     __jp: ['__jp_val', '__jp_str', '__jp_num', '__jp_arr', '__jp_obj', '__sso_char', '__ptr_aux', '__ptr_type', '__ptr_offset', '__str_byteLen'],
     __jp_val: ['__jp_str', '__jp_num', '__jp_arr', '__jp_obj'],
-    __jp_str: ['__sso_char', '__char_at', '__str_byteLen', '__hex4', '__ishex', '__utf8_enc'],
+    __jp_str: ['__sso_char', '__char_at', '__str_byteLen', '__hex4', '__ishex', '__utf8_enc', '__sso_norm'],
     __hex4: ['__hex1'],
     __jp_num: ['__pow10'],
     __jp_arr: ['__jp_val'],
@@ -187,6 +198,12 @@ export default (ctx) => {
         return mkPtrIR(PTR.OBJECT, 0, ['call', '$__alloc_hdr', ['i32.const', 0], ['i32.const', ctx.abi.object.ops.allocSlots(0)]])
       }
       const schemaId = ctx.schema.register(keys)
+      // Extern-write belt: these slot stores bypass the write censuses (they
+      // are IR, not AST `{}` literals). plan's hazard scan (jsonParseKeysets)
+      // normally kind-safe-marks this sid earlier; a sid it MISSED gets a
+      // null-kinds entry so every reader belt fails closed on it.
+      const hzLive = ctx.schema.slotWriteHazards
+      if (hzLive && !hzLive.kindSafeSids.has(schemaId)) hzLive.kindSafeSids.set(schemaId, null)
       const t = tempI32('jobj')
       const body = [
         ['local.set', `$${t}`, ['call', '$__alloc_hdr', ['i32.const', 0], ['i32.const', ctx.abi.object.ops.allocSlots(keys.length)]]],
@@ -475,13 +492,35 @@ export default (ctx) => {
   // Schema name table: global $__schema_tbl → array of f64 pointers.
   //   schema_tbl[schemaId * 8] = f64 pointer to jz Array of key name strings.
   // Object props are sequential f64 at ptr_offset, indexed same as schema.
-  ctx.core.stdlib['__json_obj'] = `(func $__json_obj (param $val i64)
+  // Thunked (not a plain template string) so heapResetWat()/the __dyn_props
+  // presence check below read the FINAL declaration state — see collection.js's
+  // heapResetWat comment for why (module load order isn't otherwise settled
+  // at the time this string would eagerly evaluate).
+  ctx.core.stdlib['__json_obj'] = () => `(func $__json_obj (param $val i64)
     (local $off i32) (local $sid i32) (local $keys i32) (local $nkeys i32)
     (local $i i32) (local $koff i32) (local $first i32) (local $pv i64)
-    (local $props i64) (local $poff i32) (local $pcap i32) (local $dn i32) (local $slot i32) (local $ord i32)
-    (local $j i32) (local $skip i32)
+    (local $props i64) (local $slot i32) (local $j i32) (local $skip i32)
+    ;; Two dyn-prop sources for a DURABLE receiver — see collection.js's
+    ;; heapResetWat and module/object.js's emitEnumerateObject for the full
+    ;; rationale: G(lobal) holds runtime/post-init keys, S(idecar) holds
+    ;; init-time keys. An EPHEMERAL receiver only ever populates S.
+    (local $poffG i32) (local $pcapG i32) (local $dnG i32) (local $ordG i32)
+    (local $poffS i32) (local $pcapS i32) (local $dnS i32) (local $ordS i32)
     (local.set $off (call $__ptr_offset (local.get $val)))
     (local.set $sid (call $__ptr_aux (local.get $val)))
+    ${ctx.schema.dateSid != null ? `
+    ;; Branded Date (module/date.js schema): serialize as its toJSON — the ISO
+    ;; string, or null for an invalid date — matching host JSON.stringify(date).
+    (if (i32.eq (local.get $sid) (i32.const ${ctx.schema.dateSid}))
+      (then
+        (if (f64.ne (f64.load (local.get $off)) (f64.load (local.get $off)))
+          (then
+            (call $__jput (i32.const 110)) (call $__jput (i32.const 117))
+            (call $__jput (i32.const 108)) (call $__jput (i32.const 108)) (return)))
+        (call $__jput (i32.const 34))
+        (call $__jput_str (i64.reinterpret_f64 (call $__date_to_iso_string (f64.load (local.get $off)))))
+        (call $__jput (i32.const 34))
+        (return)))` : ''}
     ;; Schema keys: schema_tbl + sid*8. Dyn-only programs (empty {} + computed
     ;; o[k]=v) never allocate __schema_tbl, leaving it 0 — guard the read so the
     ;; dyn-prop walk below still runs.
@@ -513,41 +552,73 @@ export default (ctx) => {
           (call $__json_val (local.get $pv))))
       (local.set $i (i32.add (local.get $i) (i32.const 1)))
       (br $l)))
-    ;; Dynamic (off-schema) properties: heap OBJECTs carry a HASH propsPtr at
-    ;; off-16 (set by __dyn_set). Walk it in insertion order via __coll_order —
-    ;; schema-only enumeration would drop computed props (e.g. {} then o.a=1).
-    ;; Skip propsPtr entries whose key already appears in the schema: object
-    ;; literals with needsDynShadow(target)=true shadow-write each schema key
-    ;; into propsPtr so dyn-key reads can resolve via hash lookup. That mirror
-    ;; is a runtime acceleration, not an enumeration entity — without dedup,
-    ;; JSON output emits each schema key twice. Schema-key interns equal the
-    ;; keys we shadow-write (same compile-time string literal), so i64.eq matches.
+    ;; Dynamic (off-schema) properties: heap OBJECTs carry a HASH propsPtr
+    ;; either at off-16 (populated by an init-time write, or by any write at
+    ;; all on an EPHEMERAL receiver — one allocated after the post-init
+    ;; high-water mark, per the durable-receiver policy) or in the global
+    ;; __dyn_props table keyed by offset (populated by a RUNTIME/post-init
+    ;; write on a DURABLE receiver; see collection.js's heapResetWat for the
+    ;; full policy). A durable receiver can carry BOTH — gather each into its
+    ;; own (poff/pcap/dn) pair; G(lobal) and S(idecar) below. Static-segment
+    ;; objects (off < __heap_start) have no header at all — guard both reads
+    ;; on off >= __heap_start so neither ever reads neighbor static data.
     (if (i32.ge_u (local.get $off) (global.get $__heap_start))
       (then
-        (local.set $props (i64.load (i32.sub (local.get $off) (i32.const 16))))
-        (if (i32.eq
-              (i32.wrap_i64 (i64.and (i64.shr_u (local.get $props) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK})))
-              (i32.const ${PTR.HASH}))
+    ;; mask bit0 — durable words may carry the runtime-shadowed marker
+    ;; (collection.js __dyn_set); unmasked, the resolved sidecar off is odd.
+    (local.set $props (i64.and (i64.load (i32.sub (local.get $off) (i32.const 16))) (i64.const -2)))
+    (if (i32.eq
+          (i32.wrap_i64 (i64.and (i64.shr_u (local.get $props) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK})))
+          (i32.const ${PTR.HASH}))
+      (then
+        (local.set $poffS (call $__ptr_offset (local.get $props)))
+        (local.set $pcapS (i32.load (i32.sub (local.get $poffS) (i32.const 4))))
+        (local.set $dnS (i32.load (i32.sub (local.get $poffS) (i32.const 8))))))))${ctx.scope.globals.has('__dyn_props') ? `
+    ;; Global (runtime keys on a durable receiver) — independent of the sidecar
+    ;; gate above: STATIC-SEGMENT receivers (off < __heap_start, no header) also
+    ;; store their dyn writes here, and the probe is keyed by offset alone.
+    (if (i32.lt_u (local.get $off) ${heapResetWat()})
+      (then
+        (if (f64.ne (global.get $__dyn_props) (f64.const 0))
           (then
-            (local.set $poff (call $__ptr_offset (local.get $props)))
-            (local.set $pcap (i32.load (i32.sub (local.get $poff) (i32.const 4))))
-            (local.set $dn (i32.load (i32.sub (local.get $poff) (i32.const 8))))
-            (local.set $ord (call $__coll_order (local.get $poff) (local.get $pcap) (i32.const 24)))
+            (local.set $props (call $__ihash_get_local (i64.reinterpret_f64 (global.get $__dyn_props)) (i64.reinterpret_f64 (f64.convert_i32_s (local.get $off)))))
+            (if (i32.eqz (call $__is_nullish (local.get $props)))
+              (then
+                (local.set $poffG (call $__ptr_offset (local.get $props)))
+                (local.set $pcapG (i32.load (i32.sub (local.get $poffG) (i32.const 4))))
+                (local.set $dnG (i32.load (i32.sub (local.get $poffG) (i32.const 8))))))))))` : ''}
+    ;; Walk in insertion order via __coll_order — schema-only enumeration
+    ;; would drop computed props (e.g. {} then o.a=1). Skip entries whose key
+    ;; already appears in the schema: object literals with
+    ;; needsDynShadow(target)=true shadow-write each schema key into propsPtr
+    ;; so dyn-key reads can resolve via hash lookup. That mirror is a runtime
+    ;; acceleration, not an enumeration entity — without dedup, JSON output
+    ;; emits each schema key twice. Schema-key interns equal the keys we
+    ;; shadow-write (same compile-time string literal), so i64.eq matches.
+    ;; G walks first (schema-dedup only); S walks second (schema-dedup AND
+    ;; G-dedup, so a key present in both — reassigned at runtime after being
+    ;; set at init — emits once, from the authoritative G copy).
+    (if (i32.ne (local.get $poffG) (i32.const 0))
+      (then (local.set $ordG (call $__coll_order (local.get $poffG) (local.get $pcapG) (i32.const 24)))))
+    (if (i32.ne (local.get $poffS) (i32.const 0))
+      (then (local.set $ordS (call $__coll_order (local.get $poffS) (local.get $pcapS) (i32.const 24)))))
+    (if (i32.ne (local.get $dnG) (i32.const 0))
+      (then
             (local.set $i (i32.const 0))
-            (block $dd (loop $dl
-              (br_if $dd (i32.ge_s (local.get $i) (local.get $dn)))
-              (local.set $slot (i32.load (i32.add (local.get $ord) (i32.shl (local.get $i) (i32.const 2)))))
+            (block $gd (loop $gl
+              (br_if $gd (i32.ge_s (local.get $i) (local.get $dnG)))
+              (local.set $slot (i32.load (i32.add (local.get $ordG) (i32.shl (local.get $i) (i32.const 2)))))
               (local.set $pv (i64.load (i32.add (local.get $slot) (i32.const 16))))
               (local.set $skip (i32.const 0))
               (local.set $j (i32.const 0))
-              (block $sd (loop $sl
-                (br_if $sd (i32.ge_s (local.get $j) (local.get $nkeys)))
+              (block $gsd (loop $gsl
+                (br_if $gsd (i32.ge_s (local.get $j) (local.get $nkeys)))
                 (if (i64.eq
                       (i64.load (i32.add (local.get $slot) (i32.const 8)))
                       (i64.load (i32.add (local.get $koff) (i32.shl (local.get $j) (i32.const 3)))))
-                  (then (local.set $skip (i32.const 1)) (br $sd)))
+                  (then (local.set $skip (i32.const 1)) (br $gsd)))
                 (local.set $j (i32.add (local.get $j) (i32.const 1)))
-                (br $sl)))
+                (br $gsl)))
               (if (i32.and (i32.eqz (local.get $skip)) (i32.eqz (call $__json_omit (local.get $pv))))
                 (then
                   (if (i32.eqz (local.get $first)) (then (call $__jput (i32.const 44))))
@@ -560,7 +631,48 @@ export default (ctx) => {
                   (if (global.get $__jgaplen) (then (call $__jput (i32.const 32))))
                   (call $__json_val (local.get $pv))))
               (local.set $i (i32.add (local.get $i) (i32.const 1)))
-              (br $dl)))))))
+              (br $gl)))))
+    (if (i32.ne (local.get $dnS) (i32.const 0))
+      (then
+            (local.set $i (i32.const 0))
+            (block $sd (loop $sl
+              (br_if $sd (i32.ge_s (local.get $i) (local.get $dnS)))
+              (local.set $slot (i32.load (i32.add (local.get $ordS) (i32.shl (local.get $i) (i32.const 2)))))
+              (local.set $pv (i64.load (i32.add (local.get $slot) (i32.const 16))))
+              (local.set $skip (i32.const 0))
+              (local.set $j (i32.const 0))
+              (block $ssd (loop $ssl
+                (br_if $ssd (i32.ge_s (local.get $j) (local.get $nkeys)))
+                (if (i64.eq
+                      (i64.load (i32.add (local.get $slot) (i32.const 8)))
+                      (i64.load (i32.add (local.get $koff) (i32.shl (local.get $j) (i32.const 3)))))
+                  (then (local.set $skip (i32.const 1)) (br $ssd)))
+                (local.set $j (i32.add (local.get $j) (i32.const 1)))
+                (br $ssl)))
+              (if (i32.eqz (local.get $skip))
+                (then
+                  (local.set $j (i32.const 0))
+                  (block $sgd (loop $sgl
+                    (br_if $sgd (i32.ge_s (local.get $j) (local.get $dnG)))
+                    (if (i64.eq
+                          (i64.load (i32.add (local.get $slot) (i32.const 8)))
+                          (i64.load (i32.add (i32.load (i32.add (local.get $ordG) (i32.shl (local.get $j) (i32.const 2)))) (i32.const 8))))
+                      (then (local.set $skip (i32.const 1)) (br $sgd)))
+                    (local.set $j (i32.add (local.get $j) (i32.const 1)))
+                    (br $sgl)))))
+              (if (i32.and (i32.eqz (local.get $skip)) (i32.eqz (call $__json_omit (local.get $pv))))
+                (then
+                  (if (i32.eqz (local.get $first)) (then (call $__jput (i32.const 44))))
+                  (local.set $first (i32.const 0))
+                  (call $__jindent)
+                  (call $__jput (i32.const 34))
+                  (call $__jput_str (i64.load (i32.add (local.get $slot) (i32.const 8))))
+                  (call $__jput (i32.const 34))
+                  (call $__jput (i32.const 58))
+                  (if (global.get $__jgaplen) (then (call $__jput (i32.const 32))))
+                  (call $__json_val (local.get $pv))))
+              (local.set $i (i32.add (local.get $i) (i32.const 1)))
+              (br $sl)))))
     (global.set $__jdepth (i32.sub (global.get $__jdepth) (i32.const 1)))
     (if (i32.eqz (local.get $first)) (then (call $__jindent)))
     (call $__jput (i32.const 125))
@@ -585,10 +697,14 @@ export default (ctx) => {
   declGlobal('__jpstr', 'i32')  // input string offset
   declGlobal('__jplen', 'i32')  // input length
   declGlobal('__jppos', 'i32')  // current parse position
-  // Side-channel hash for the most-recently-parsed string. __jp_str folds an
-  // FNV-1a pass into its scan loop; __jp_obj forwards it to __hash_set_local_h
-  // and skips the redundant __str_hash call inside the generic insert. 0 is a
-  // sentinel meaning "string had escapes — recompute via __str_hash".
+  // Side-channel hash for the most-recently-parsed string. __jp_str folds a
+  // byte-FNV-1a pass into its scan loop; __jp_obj mixes it straight into the
+  // schema-cache's key-SEQUENCE hash ($hh, __jp_schema_get's probe key) — an
+  // independent hash from __str_hash, so it need not agree bit-for-bit with the
+  // runtime string hash (a schema-cache hit is verified by direct i64 key-array
+  // comparison, not by hash equality). 0 is a sentinel meaning "string had
+  // escapes"; it still mixes into $hh (a false schema-cache collision is caught
+  // by the verify step, never silently wrong).
   declGlobal('__jp_keyh', 'i32')
   // Sticky syntax-error flag. Set by any parser sub-routine on malformed input;
   // checked once by __jp after the top-level value, which throws if it is set.
@@ -636,9 +752,10 @@ export default (ctx) => {
 
   // Parse string (after opening " consumed). Single-pass scan that folds three
   // concerns into one byte loop: simplicity flag (no escapes / no high-bit),
-  // SSO byte packing for ≤4-char ASCII keys, and FNV-1a hash. The hash is
-  // stashed in $__jp_keyh so __jp_obj can use the prehashed insert and skip
-  // a redundant __str_hash call.
+  // SSO byte packing for ≤4-char ASCII keys, and byte-FNV-1a hash. The hash is
+  // stashed in $__jp_keyh so __jp_obj can mix it into the schema-cache sequence
+  // hash without re-scanning the key bytes (see the $__jp_keyh declaration above
+  // for why it need not match __str_hash's SSO-mix output).
   // Hex nibble: '0'-'9' / 'a'-'f' / 'A'-'F' → 0..15; anything else → 0 (lenient).
   ctx.core.stdlib['__hex1'] = `(func $__hex1 (param $c i32) (result i32)
     (if (i32.le_u (i32.sub (local.get $c) (i32.const 48)) (i32.const 9))
@@ -724,8 +841,11 @@ export default (ctx) => {
     ;; Loop exited on the closing quote (34) or EOF (-1); the latter means an
     ;; unterminated string literal.
     (if (i32.eq (local.get $ch) (i32.const -1)) (then (global.set $__jp_err (i32.const 1))))
-    ;; Stash hash. 0/1 bumped to 2 to match __str_hash convention; escape strings
-    ;; (simple==0) get sentinel 0 so __jp_obj falls back to non-prehashed insert.
+    ;; Stash hash. 0/1 bumped to 2 to match __str_hash's clamp convention (kept for
+    ;; sentinel consistency, though __jp_obj's consumer — the schema sequence hash —
+    ;; doesn't itself need agreement with __str_hash). Escape strings (simple==0) get
+    ;; sentinel 0, which still mixes into $hh (harmless: __jp_schema_get verifies by
+    ;; key-array compare, not hash equality).
     (global.set $__jp_keyh
       (if (result i32) (local.get $simple)
         (then (if (result i32) (i32.le_s (local.get $h) (i32.const 1))
@@ -738,13 +858,14 @@ export default (ctx) => {
         (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.or (i32.const ${LAYOUT.SSO_BIT}) (i32.shl (local.get $len) (i32.const 10))) (local.get $sso)))))
     ;; Simple STRING fast path: no escapes, len > 4 — bulk memcpy from parse buffer,
     ;; skip rewind + per-byte escape-decode loop. Hits 5+ char keys without escapes.
+    ;; 5-6 char ASCII results route through __sso_norm (string-module invariant).
     (if (local.get $simple)
       (then
         (local.set $off (call $__alloc (i32.add (i32.const 4) (local.get $len))))
         (local.set $off (i32.add (local.get $off) (i32.const 4)))
         (i32.store (i32.sub (local.get $off) (i32.const 4)) (local.get $len))
         (memory.copy (local.get $off) (i32.add (global.get $__jpstr) (local.get $start)) (local.get $len))
-        (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))))
+        (return (call $__sso_norm (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off))))))
     ;; Copy chars to new string (handles escapes inline)
     (local.set $off (call $__alloc (i32.add (i32.const 4) (local.get $len))))
     (local.set $off (i32.add (local.get $off) (i32.const 4)))
@@ -795,7 +916,8 @@ export default (ctx) => {
     ${ADV(1)}  ;; skip closing "
     ;; Store actual length in header
     (i32.store (i32.sub (local.get $off) (i32.const 4)) (local.get $len))
-    (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`
+    ;; escape-decoded result may be short ASCII ("\\n" → 1 char) → normalize (invariant)
+    (call $__sso_norm (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off))))`
 
   // Parse number
   ctx.core.stdlib['__jp_num'] = `(func $__jp_num (result f64)
@@ -949,8 +1071,8 @@ export default (ctx) => {
       (i32.store (i32.add (local.get $entry) (i32.const 4)) (local.get $sid)))
     (local.get $sid))`
 
-  // Parse object → OBJECT (schema-tagged, slot-based) when key sequence has a
-  // cached/registerable shape; falls back to HASH only on extreme key counts.
+  // Parse object → OBJECT (schema-tagged, slot-based), always, via the runtime
+  // schema cache (no HASH fallback in this build — every key sequence gets a sid).
   // Builds a transient (key, val) buffer during parse, then resolves a sid via
   // the runtime schema cache, allocs an OBJECT, and copies values into slots.
   // Walk-side `obj.prop` accesses then route through the OBJECT fast path
@@ -1090,7 +1212,7 @@ export default (ctx) => {
     if (cached) return cached
 
     const name = `__jp_shape_${ctx.runtime.jsonShapeParsers.size}`
-    const locals = new Map([['len', 'i32'], ['buf', 'i32'], ['i', 'i32'], ['ch', 'i32']])
+    const locals = new Map([['len', 'i32'], ['buf', 'i32'], ['i', 'i32'], ['ch', 'i32'], ['kp', 'i32']])
     let uniq = 0
     const local = (p, t) => {
       const n = `${p}${uniq++}`
@@ -1100,7 +1222,38 @@ export default (ctx) => {
     const fail = `(return (call $__jp (local.get $str)))`
     const expect = (byte) => `(if (i32.ne ${PEEK} (i32.const ${byte})) (then ${fail}))
     ${ADV(1)}`
-    const expectText = (text) => [...text].map(c => expect(c.charCodeAt(0))).join('\n    ')
+    // SWAR text match: a known ≥2-byte ASCII run (schema keys, null/true/false)
+    // compares as 8/4/2/1-byte chunks against packed little-endian constants —
+    // one load + compare + branch per CHUNK instead of per character, and ONE
+    // pos advance. In-bounds by construction: the entry allocates len+8 and
+    // stores an 8-byte 0xFF sentinel, so any chunk starting inside the text
+    // ends within the buffer, and a chunk overlapping the sentinel simply
+    // fails the compare (0xFF matches no ASCII) into the generic-reparse fail,
+    // exactly like the per-byte path. ASCII-only (a multi-byte char's UTF-8
+    // bytes would need encoding here) — non-ASCII keys keep per-byte expects.
+    const expectText = (text) => {
+      const bytes = [...text].map(c => c.charCodeAt(0))
+      if (bytes.length < 2 || bytes.some(b => b > 127))
+        return [...text].map(c => expect(c.charCodeAt(0))).join('\n    ')
+      const le = (arr) => arr.reduce((a, b, k) => a | (BigInt(b) << BigInt(8 * k)), 0n)
+      const at = (i) => (i ? `offset=${i} ` : '') + '(local.get $kp)'
+      const out = [`(local.set $kp (i32.add (global.get $__jpstr) (global.get $__jppos)))`]
+      let i = 0
+      for (; bytes.length - i >= 8; i += 8)
+        out.push(`(if (i64.ne (i64.load ${at(i)}) (i64.const ${i64Hex(le(bytes.slice(i, i + 8)))})) (then ${fail}))`)
+      if (bytes.length - i >= 4) {
+        out.push(`(if (i32.ne (i32.load ${at(i)}) (i32.const ${Number(le(bytes.slice(i, i + 4)))})) (then ${fail}))`)
+        i += 4
+      }
+      if (bytes.length - i >= 2) {
+        out.push(`(if (i32.ne (i32.load16_u ${at(i)}) (i32.const ${Number(le(bytes.slice(i, i + 2)))})) (then ${fail}))`)
+        i += 2
+      }
+      if (i < bytes.length)
+        out.push(`(if (i32.ne (i32.load8_u ${at(i)}) (i32.const ${bytes[i]})) (then ${fail}))`)
+      out.push(ADV(bytes.length))
+      return out.join('\n    ')
+    }
     // Forward-declared with `let` (assigned below) so `parse` captures a boxed
     // cell, not a not-yet-initialized `const` binding — the self-host kernel
     // miscompiles the latter capture in this deeply-nested mutually-recursive
@@ -1123,6 +1276,10 @@ export default (ctx) => {
       const obj = local('obj', 'i32')
       const val = local('val', 'f64')
       const sid = ctx.schema.register(keys)
+      // Extern-write belt (see emitJsonConstValue): a shaped-parser sid the
+      // plan hook missed fails closed via a null-kinds entry.
+      const hzLive = ctx.schema.slotWriteHazards
+      if (hzLive && !hzLive.kindSafeSids.has(sid)) hzLive.kindSafeSids.set(sid, null)
       let body = `${WS()}
     ${expect(123)}
     (local.set $${obj} (call $__alloc_hdr (i32.const 0) (i32.const ${Math.max(1, keys.length)})))`
@@ -1292,6 +1449,10 @@ ${localDecls}
     }
     const folded = foldStringify(x, replacer, space)
     if (folded !== undefined) return folded
+    // A real replacer that the const-fold could not absorb would be silently
+    // IGNORED by the runtime walker — a wrong result, not a slow one. Reject.
+    if (!noReplacer)
+      err('JSON.stringify with a runtime replacer is not supported — the constant-foldable case works; otherwise filter/map the value before stringifying')
     // Scalar boolean: the working-rep is the 0/1 number carrier, so the runtime
     // tag-walker would emit "0"/"1". A boolean's JSON is the bare word
     // true/false — exactly bool. Guard on no replacer: a replacer function may
@@ -1335,12 +1496,72 @@ ${localDecls}
       if (sp === NOT_LIT) return undefined
     }
 
+    // Array replacer = a per-level property whitelist (ES SerializeJSONObject
+    // step: PropertyList). Applied by a hand-rolled pre-filter, NOT the host
+    // stringify's replacer param — the kernel's stringify drops replacers, so
+    // in-kernel folds would silently ignore the filter (host≠kernel).
+    let picked = val
+    if (rep !== undefined && rep != null) {
+      const keys = rep.map(String)
+      const pick = (v) => {
+        if (Array.isArray(v)) return v.map(pick)
+        if (v !== null && typeof v === 'object') {
+          const o = {}
+          for (const k of keys) if (k in v) o[k] = pick(v[k])
+          return o
+        }
+        return v
+      }
+      picked = pick(val)
+    }
     let result
-    try { result = JSON.stringify(val, rep, sp) }
+    try { result = JSON.stringify(picked, null, sp) }
     catch { return undefined }
     return result === undefined ? undefExpr() : asF64(emit(['str', result]))
   }
 
+  // Plan-time mirror of the JSON.parse emit dispatch below: resolve the same
+  // const/shape sources and return `{keys, kinds}` for every object key-set
+  // the parser could WRITE into a compile-time schema (const fold or shaped
+  // parser). The generic runtime parser needs no entry — it mints sids from
+  // $__schema_next, seeded past the compile-time table (assemble.js), so it
+  // can never alias a censused sid. `kinds` are the SAMPLE's per-slot VAL
+  // kinds — trustworthy because both emit paths are shape-guarded: the const
+  // fold bakes exactly these values, and the shaped parser falls back to the
+  // generic parser (disjoint sids) on ANY text/structure divergence, so an
+  // object carrying the sid always matches the sample's kinds. A null kind
+  // (sample `null` value) poisons just that slot. Consumed by plan's
+  // collectSlotWriteHazards BEFORE any census consumer bakes a decision.
+  const JSON_KIND = (v) => v == null ? null
+    : typeof v === 'number' ? VAL.NUMBER
+    : typeof v === 'string' ? VAL.STRING
+    : typeof v === 'boolean' ? VAL.BOOL
+    : Array.isArray(v) ? VAL.ARRAY
+    : VAL.OBJECT
+  ctx.schema.jsonParseKeysets = (x) => {
+    if (x === undefined || (Array.isArray(x) && x[0] == null && typeof x[1] !== 'string')) return []
+    const out = []
+    const collect = (v) => {
+      if (v == null || typeof v !== 'object') return
+      if (Array.isArray(v)) { for (const e of v) collect(e); return }
+      const keys = Object.keys(v)
+      if (keys.length) out.push({ keys, kinds: keys.map(k => JSON_KIND(v[k])) })
+      for (const k of keys) collect(v[k])
+    }
+    const src = jsonConstString(ctx, x)
+    if (src != null) {
+      try { collect(JSON.parse(src)); return out } catch { /* emitter falls through the same way */ }
+    }
+    const shapeSrcs = jsonShapeStrings(ctx, x)
+    if (shapeSrcs) {
+      try {
+        const parsed = shapeSrcs.map(s => JSON.parse(s))
+        if (parsed.every(v => sameJsonShape(parsed[0], v))) collect(parsed[0])
+      } catch { /* generic parser — disjoint runtime sids */ }
+    }
+    return out
+  }
+
   ctx.core.emit['JSON.parse'] = (x) => {
     // A non-string primitive literal argument is coerced via ToString, then
     // parsed: JSON.parse(0) → "0", JSON.parse(null) → "null", JSON.parse() →