jz 0.8.0 → 0.9.0

package/module/object.js

@@ -7,12 +7,13 @@
  * @module object
  */
 
-import { typed, asF64, asI64, NULL_NAN, UNDEF_NAN, temp, tempI32, tempI64, block64, ptrTypeEq, dispatchByPtrType, allocPtr, needsDynShadow, mkPtrIR, extractF64Bits, appendStaticSlots, slotAddr, elemLoad, elemStore, boolBoxIR } from '../src/ir.js'
+import { typed, asF64, asI64, NULL_NAN, UNDEF_NAN, temp, tempI32, tempI64, block64, ptrTypeEq, dispatchByPtrType, allocPtr, needsDynShadow, mkPtrIR, extractF64Bits, appendStaticSlots, slotAddr, elemLoad, elemStore, boolBoxIR, carrierF64 } from '../src/ir.js'
 import { emit } from '../src/bridge.js'
 import { staticArrayPtr } from './array.js'
 import { valTypeOf, shapeOf } from '../src/kind.js'
 import { VAL, lookupValType, repOf, updateRep } from '../src/reps.js'
 import { ctx, err, inc, PTR, LAYOUT, declGlobal } from '../src/ctx.js'
+import { isReassigned } from '../src/ast.js'
 
 // Object.prototype.toString tag per value category. Matches what JS engines
 // return for primitive/built-in types; canonicalized from
@@ -39,7 +40,18 @@ const objectToStringTagForVal = (obj) => {
   return val ? OBJECT_TO_STRING_TAGS[val] : null
 }
 
-const storedValue = (node) => valTypeOf(node) === VAL.BOOL ? boolBoxIR(emit(node)) : asF64(emit(node))
+// emit(node) ONCE, before branching — same self-host miscompile class as emit.js's
+// 'return' handler (src/compile/emit.js): emit(node) called separately inline per
+// ternary arm, wrapped by a DIFFERENT coercion (boolBoxIR vs asF64) per arm, is
+// behaviorally identical in JS but self-host-fragile. See .work/todo.md (groundtruth archive).
+const storedValue = (node) => carrierF64(node, emit(node))
+
+// Array-IR twin of collection.js's heapResetWat (WAT-string form) — both MUST
+// gate identically. True when `off` is ephemeral (>= the post-init high-water
+// mark): only then does a receiver's off-16 header sidecar hold the live
+// dyn-prop truth. See collection.js's heapResetWat for the full durable-
+// receiver policy rationale.
+const heapResetIR = () => ctx.scope.globals.has('__heap_reset') ? ['global.get', '$__heap_reset'] : ['i32.const', 0]
 
 export default (ctx) => {
   inc('__mkptr', '__alloc', '__alloc_hdr', '__ptr_offset', '__len', '__ptr_type')
@@ -58,6 +70,20 @@ export default (ctx) => {
       // schema-slot writes to offsets >= 8 land out-of-bounds.
       const target = takeLiteralTarget()
       const merged = target ? ctx.schema.resolve(target) : null
+      // Dictionary mode: a `{}` whose binding takes ONLY computed-key access (no
+      // static prop ever — merged schema empty) is a string-keyed dictionary, not
+      // a fixed-shape record. Represent it as a real HASH so every get/set is one
+      // strict probe instead of the OBJECT dyn-sidecar detour, and the RMW fusion
+      // (`o[k] = f(o[k])`, emit-assign.js) can hold a slot address. The same
+      // heuristic V8 uses to send such objects to dictionary mode. Sound: all dyn
+      // paths dispatch on the runtime tag, and mem.Hash marshals it as a plain
+      // object at the boundary.
+      if (target && !merged?.length && ctx.types.dynWriteVars?.has(target)) {
+        ctx.module.include('collection')
+        inc('__hash_new_small')
+        updateRep(target, { val: VAL.HASH })
+        return typed(['call', '$__hash_new_small'], 'f64')
+      }
       // Register the empty schema so schemaId always indexes a real schema.list
       // entry — __json_obj and dyn-get load keys via $__schema_tbl[sid] and would
       // crash on an unregistered id 0 (table left uninitialized when list empty).
@@ -117,24 +143,38 @@ export default (ctx) => {
     // `map.get(k).n++` that no alias analysis could attribute — so a literal
     // whose schema intersects it allocates per-evaluation instead.
     const neverWritten = names.every(n => !ctx.module.writtenProps?.has(n))
-    if (neverWritten && values.length >= 2 && values.length === schema.length && !ctx.memory.shared) {
+    // `!shadow`: a computed-key write on the target (`o[k]=v`) mutates the object —
+    // a shared static instance would leak call N's writes into call N+1. The old
+    // shadow-mirror masked this by re-storing literal values through __dyn_set's
+    // schema-arm on every evaluation (an accidental reset that still leaked
+    // runtime-ADDED keys); with the mirror gone (tier 2), mutable literals must
+    // allocate fresh per evaluation — the runtime path below.
+    if (neverWritten && !shadow && values.length >= 2 && values.length === schema.length && !ctx.memory.shared) {
       const emitted = values.map(storedValue)
       // asF64 folds i32.const → f64.const so int-literal values also qualify.
       const slots = emitted.map(v => extractF64Bits(v))
       if (slots.every(b => b !== null)) {
         // Reorder into schema-slot order before laying out the static segment.
-        const ordered = emitted.map(() => null), orderedBits = emitted.map(() => null)
-        for (let i = 0; i < values.length; i++) { ordered[slotOf(i)] = emitted[i]; orderedBits[slotOf(i)] = slots[i] }
-        const off = appendStaticSlots(orderedBits)
-        const staticPtr = mkPtrIR(PTR.OBJECT, schemaId, off)
-        if (!shadow) return staticPtr
-        inc('__dyn_set')
-        const body = [['local.set', `$${ptr}`, staticPtr]]
-        for (let i = 0; i < schema.length; i++)
-          body.push(['drop', ['call', '$__dyn_set', ['i64.reinterpret_f64', ['local.get', `$${ptr}`]],
-            asI64(emit(['str', String(schema[i])])), asI64(ordered[i])]])
-        body.push(['local.get', `$${ptr}`])
-        return typed(['block', ['result', 'f64'], ...body], 'f64')
+        const orderedBits = emitted.map(() => null)
+        for (let i = 0; i < values.length; i++) orderedBits[slotOf(i)] = slots[i]
+        // Full 16-byte __alloc_hdr-shaped header ([props:8]=0, len=0, cap=slots):
+        // dyn machinery reads the off-16 props word — a headerless static object
+        // aliased whatever data preceded it (the durable-dangler garbage class),
+        // and a runtime dyn-set/delete on the shared instance now has a real,
+        // writable slot to install a sidecar into. No runtime shadow mirror
+        // either way (tier 2): dyn READS of schema props resolve through the
+        // schema-arm (__schema_tbl — itself static data now), so the old
+        // per-prop __dyn_set mirror was pure init cost — the block it emitted
+        // also made the literal non-const, forcing every ENCLOSING literal
+        // (`const A = [{…}, {…}]`) to build at runtime.
+        if (!ctx.runtime.data) ctx.runtime.data = ''
+        while (ctx.runtime.data.length % 8 !== 0) ctx.runtime.data += '\0'
+        const hdrOff = ctx.runtime.data.length
+        const hdr = new Uint8Array(16); const hdv = new DataView(hdr.buffer)
+        hdv.setInt32(12, ctx.abi.object.ops.allocSlots ? ctx.abi.object.ops.allocSlots(schema.length) : schema.length, true)
+        for (let i = 0; i < 16; i++) ctx.runtime.data += String.fromCharCode(hdr[i])
+        appendStaticSlots(orderedBits)
+        return mkPtrIR(PTR.OBJECT, schemaId, hdrOff + 16)
       }
     }
 
@@ -157,6 +197,11 @@ export default (ctx) => {
 
   // === Object static methods ===
 
+  // Object.freeze: identity passthrough — jz objects have no per-property
+  // metadata, so write-protection is not enforced (documented divergence).
+  // Call forms are folded away in prepare (which records the binding in
+  // ctx.runtime.frozenVars so isFrozen answers true for it); this emitter
+  // survives only for freeze-as-a-value (`arr.map(Object.freeze)`).
   ctx.core.emit['Object.freeze'] = (obj) => asF64(emit(obj))
 
   // Object.is(a, b) — SameValue, which on NaN-boxed f64 values is exact bit
@@ -180,14 +225,21 @@ export default (ctx) => {
     if (t === VAL.NUMBER || t === VAL.STRING || t === VAL.BIGINT) return { ext: 0, sealed: 1, frozen: 1 }
     return { ext: 1, sealed: 0, frozen: 0 }
   }
-  const objQuery = (pick) => (obj) => {
-    const v = pick(extKind(obj))
+  const objQuery = (pick, frozenAware = false) => (obj) => {
+    let v = pick(extKind(obj))
+    if (frozenAware) {
+      // A binding freeze() marked in prepare (composition unwraps to the same
+      // name there). Trustworthy only while never reassigned — a rebind points
+      // at a fresh, unfrozen object.
+      if (typeof obj === 'string' && ctx.runtime.frozenVars?.has(obj) &&
+        !isReassigned(ctx.func.body, obj)) v = 1
+    }
     if (obj == null) return typed(['f64.const', v], 'f64')
     return typed(['block', ['result', 'f64'], ['drop', asF64(emit(obj))], ['f64.const', v]], 'f64')
   }
   ctx.core.emit['Object.isExtensible'] = objQuery((k) => k.ext)
   ctx.core.emit['Object.isSealed'] = objQuery((k) => k.sealed)
-  ctx.core.emit['Object.isFrozen'] = objQuery((k) => k.frozen)
+  ctx.core.emit['Object.isFrozen'] = objQuery((k) => k.frozen, true)
 
   // RequireObjectCoercible: Object.keys/values/entries reject null & undefined
   // with a TypeError. A literal lowers to a [null, value] node — so `null` is
@@ -229,10 +281,18 @@ export default (ctx) => {
       out.ptr], 'f64')
   }
 
-  ctx.core.emit['Object.keys'] = (obj) => {
+  // Shared by Object.keys and __keys_ro. `ro` marks the for-in path: its result
+  // is read-only by construction (the lowering only reads ks[i]/ks.length), so
+  // the HASH arms may serve the shared enum-cache array (core.js __hash_keys_ro)
+  // instead of a fresh copy. Object.keys stays fresh — callers may mutate it.
+  const emitKeysGeneric = (obj, ro) => {
+    // Shared memory: cache globals are per-instance but the table is cross-thread,
+    // and shared's `__clear` (plain rewind, core.js) takes no reset injections —
+    // both break the cache's invalidation story. Serve the uncached path there.
+    if (ctx.memory.shared) ro = false
     const nullish = requireCoercible(obj)
     if (nullish) return nullish
-    if (isHashTyped(obj)) return emitHashKeys(obj)
+    if (isHashTyped(obj)) return ro ? emitHashKeysRO(obj) : emitHashKeys(obj)
     if (arrayValType(obj)) return idxKeys(obj, '__len')
     if (stringValType(obj)) return idxKeys(obj, '__str_len')
     const schema = resolveSchema(obj)
@@ -240,11 +300,12 @@ export default (ctx) => {
     // computed writes (`o[k]=v`) also carries props in its per-object dyn HASH
     // that the schema omits. Enumerate those live (schema ∪ dyn props) — the gap
     // that blocked metacircularity (the compiler grows dicts then enumerates).
-    if (schema && !mayHaveDynProps(obj)) return emitStringArray(schema)
+    if (schema && !mayHaveDynProps(obj) && !hasOutOfSchemaWrites(obj, schema)) return emitStringArray(schema)
     // Unknown receiver, or schema with possible dyn props: dispatch on ptr-type
     // at runtime (HASH probe table / OBJECT schema+dyn merge / else []).
-    return emitRuntimeKeys(obj)
+    return emitRuntimeKeys(obj, ro)
   }
+  ctx.core.emit['Object.keys'] = (obj) => emitKeysGeneric(obj, false)
   ctx.core.emit['Object.getOwnPropertyNames'] = ctx.core.emit['Object.keys']
 
   // for-in's read-only key enumeration (src/prepare for…in lowering). Identical to
@@ -258,18 +319,20 @@ export default (ctx) => {
   // Object.keys (evaluates the receiver, full runtime enumeration).
   ctx.core.emit['__keys_ro'] = (obj) => {
     // Pool only when the receiver's enumerable key set is provably the static
-    // schema: a bare var with NO computed-key writes (`o[k]=v`) — those are the
-    // only writes that add enumerable keys (computed reads / dot-adds don't).
+    // schema: a bare var with NO computed-key writes (`o[k]=v`) and no literal
+    // writes outside the schema — either kind adds enumerable keys the pool
+    // would drop (computed writes via dynWriteVars; out-of-schema literal
+    // writes land in the dyn sidecar — see hasOutOfSchemaWrites).
     // `mayHaveDynProps` is too coarse here — it also flags computed-READ receivers,
     // and for-in's own `o[k]` read would otherwise veto its own pooling.
     if (typeof obj === 'string' && !ctx.types.dynWriteVars?.has(obj) && !isHashTyped(obj) && !arrayValType(obj) && !stringValType(obj)) {
       const schema = resolveSchema(obj)
-      if (schema) {
+      if (schema && !hasOutOfSchemaWrites(obj, schema)) {
         const slots = schema.map(name => extractF64Bits(asF64(emit(['str', name]))))
         if (slots.every(b => b !== null)) return staticArrayPtr(slots)
       }
     }
-    return ctx.core.emit['Object.keys'](obj)
+    return emitKeysGeneric(obj, true)
   }
 
   // Object.prototype.hasOwnProperty(key) — own-property presence check.
@@ -362,7 +425,7 @@ export default (ctx) => {
     if (arrayValType(obj)) { inc('__arr_from'); return typed(['call', '$__arr_from', asI64(emit(obj))], 'f64') }
     if (isHashTyped(obj)) return emitHashValues(obj)
     const schema = resolveSchema(obj)
-    if (!schema || mayHaveDynProps(obj)) return emitRuntimeValues(obj)
+    if (!schema || mayHaveDynProps(obj) || hasOutOfSchemaWrites(obj, schema)) return emitRuntimeValues(obj)
     const va = asF64(emit(obj))
     const n = schema.length
     const t = temp('ov'), base = tempI32('vb')
@@ -425,7 +488,7 @@ export default (ctx) => {
     }
     if (isHashTyped(obj)) return emitHashEntries(obj)
     const schema = resolveSchema(obj)
-    if (!schema || mayHaveDynProps(obj)) return emitRuntimeEntries(obj)
+    if (!schema || mayHaveDynProps(obj) || hasOutOfSchemaWrites(obj, schema)) return emitRuntimeEntries(obj)
     const va = asF64(emit(obj))
     const n = schema.length
     const t = temp('oe'), pair = tempI32('op'), base = tempI32('eb')
@@ -458,6 +521,8 @@ export default (ctx) => {
         }
         const boxedSchema = ['__inner__', ...allProps]
         const schemaId = ctx.schema.register(boxedSchema)
+        // Extern-write belt: source slot values copied in below, unseen by the censuses.
+        ctx.schema.externSlotSids?.add(schemaId)
         ctx.schema.vars.set(target, schemaId)
         // Emit-time rep mutation: Object.assign's target gains a freshly-registered
         // boxed-schema binding here; downstream `.prop` reads in the same emit pass
@@ -489,6 +554,11 @@ export default (ctx) => {
     const sourceSchemas = sources.map(resolveSchema)
     if (!tSchema) return emitObjectAssignDynamic(target, sources)
     if (sourceSchemas.some(s => !s)) return emitDynamicAssign(target, sources, sourceSchemas)
+    // Extern-write belt: cross-schema slot copies into the TARGET's sid below
+    // (plan's hazard scan marks the same target when it resolves it).
+    const tSid = typeof target === 'string'
+      ? (repOf(target)?.schemaId ?? ctx.schema.vars.get(target)) : null
+    if (tSid != null) ctx.schema.externSlotSids?.add(tSid)
     const t = temp('at'), s = temp('as')
     const tBase = tempI32('tb'), sBase2 = tempI32('sb')
     // When the target carries a dynamic-props shadow (needsDynShadow), reads of an
@@ -585,9 +655,9 @@ export default (ctx) => {
         ['f64.store',
           ['i32.sub', ['local.get', `$${dstOff}`], ['i32.const', 16]],
           ['f64.load', ['i32.sub', ['local.get', `$${srcOff}`], ['i32.const', 16]]]],
-        ['call', '$__dyn_move',
+        ['drop', ['call', '$__dyn_move',
           ['local.get', `$${srcOff}`],
-          ['local.get', `$${dstOff}`]],
+          ['local.get', `$${dstOff}`]]],
         ['local.get', `$${dst}`]], 'f64')
     }
     const schema = resolveSchema(proto)
@@ -610,9 +680,9 @@ export default (ctx) => {
               ['f64.store',
                 ['i32.sub', ['local.get', `$${dstOff2}`], ['i32.const', 16]],
                 ['f64.load', ['i32.sub', ['local.get', `$${srcOff2}`], ['i32.const', 16]]]],
-              ['call', '$__dyn_move',
+              ['drop', ['call', '$__dyn_move',
                 ['local.get', `$${srcOff2}`],
-                ['local.get', `$${dstOff2}`]],
+                ['local.get', `$${dstOff2}`]]],
               ['local.get', `$${dst2}`]]],
             ['else', ['local.get', `$${value}`]]]] , 'f64')
       }
@@ -738,10 +808,35 @@ function emitObjectAssignDynamic(target, sources) {
 // them; callers route it through the runtime schema∪dyn-props merge instead.
 const mayHaveDynProps = (obj) => typeof obj === 'string' && !!ctx.types.dynKeyVars?.has(obj)
 
+// A literal-key write of a key OUTSIDE the receiver's schema lands in the
+// dyn-props sidecar (locals get no propMap/autoBox merge) — the static schema
+// fold would silently drop it from enumeration, so such receivers must take
+// the runtime merge path. Bare-var receivers only, mirroring dynWriteVars'
+// per-name precision (expression receivers are runtime-dispatched anyway).
+const hasOutOfSchemaWrites = (obj, schema) => {
+  if (typeof obj !== 'string') return false
+  const w = ctx.types.literalWriteKeys?.get(obj)
+  if (!w) return false
+  for (const k of w) if (!schema.includes(k)) return true
+  return false
+}
+
 function resolveSchema(obj) {
   if (typeof obj === 'string') return ctx.schema.resolve(obj)
-  if (Array.isArray(obj) && obj[0] === '{}')
-    return obj.slice(1).filter(p => Array.isArray(p) && p[0] === ':').map(p => p[1])
+  if (Array.isArray(obj) && obj[0] === '{}') {
+    // Comma-grouped children arrive as ['{}', [',', p1, p2, …]] — same unwrap
+    // as the '{}' emitter's, or a grouped literal resolves to zero keys.
+    const props = obj.length === 2 && Array.isArray(obj[1]) && obj[1][0] === ','
+      ? obj[1].slice(1) : obj.slice(1)
+    // A spread-bearing literal's schema is the MERGE emitObjectSpread builds
+    // (or null when any source is unknown → HASH result, runtime enumeration).
+    // Filtering to ':'-entries here made Object.keys({ ...S, z: 9 }) fold to
+    // ['z'] while the object's real slot layout carried S's keys too — the
+    // spread's keys vanished from keys/values/entries/for-in/JSON while
+    // remaining readable as properties (watr-in-kernel's normalize() cfg).
+    if (props.some(p => Array.isArray(p) && p[0] === '...')) return spreadLiteralSchema(props)
+    return props.filter(p => Array.isArray(p) && p[0] === ':').map(p => p[1])
+  }
   // JSON-shape inferred: JSON.parse(constStr) call or `.prop`/`[i]` chain
   // resolving to a known OBJECT shape carries its key list as `names`.
   const sh = shapeOf(obj)
@@ -774,22 +869,32 @@ function takeLiteralTarget() {
   return frame.name
 }
 
+// Merged static schema of a spread-bearing literal, or null when any spread
+// source's key set is unknown at compile time (→ HASH result). The SINGLE
+// source of truth for emitObjectSpread (which builds the object with exactly
+// this slot layout) and resolveSchema (which keys/values/entries/for-in fold
+// against) — the two MUST agree or enumeration drops the spread's keys.
+function spreadLiteralSchema(props) {
+  const names = []
+  const add = n => { if (!names.includes(n)) names.push(n) }
+  for (const p of props) {
+    if (Array.isArray(p) && p[0] === '...') {
+      const s = spreadSourceSchema(p[1])
+      if (!s) return null
+      for (const n of s) add(n)
+    } else if (Array.isArray(p) && p[0] === ':') add(p[1])
+  }
+  return names
+}
+
 function emitObjectSpread(props, spreadTarget = takeLiteralTarget()) {
   // Resolve every spread source's schema. A source with no static schema means
   // its full key set is unknown at compile time, so the merge result must be a
   // HASH (dynamic dict) — a fixed schema would silently drop the source's keys
   // it doesn't list. Only when EVERY source is known do we build the fixed-shape
   // OBJECT below.
-  const allNames = []
-  const addName = n => { if (!allNames.includes(n)) allNames.push(n) }
-  let allKnown = true
-  for (const p of props) {
-    if (Array.isArray(p) && p[0] === '...') {
-      const s = spreadSourceSchema(p[1])
-      if (s) for (const n of s) addName(n)
-      else allKnown = false
-    } else if (Array.isArray(p) && p[0] === ':') addName(p[1])
-  }
+  const allNames = spreadLiteralSchema(props)
+  const allKnown = allNames != null
   // Single unknown spread `{ ...src }` → shallow-clone src at runtime, preserving
   // its type (OBJECT→OBJECT, HASH→HASH). Aliasing src (the old shortcut) leaked
   // every later write to the result back into the source — a real correctness bug
@@ -804,6 +909,10 @@ function emitObjectSpread(props, spreadTarget = takeLiteralTarget()) {
   if (!allKnown) return emitDynamicSpread(props)
 
   const schemaId = ctx.schema.register(allNames)
+  // Extern-write belt: the spread slot-copies below write source-schema values
+  // into this sid outside the write censuses' view (collectSlotWriteHazards
+  // normally resolves the same merge at plan time; the belt covers divergence).
+  ctx.schema.externSlotSids?.add(schemaId)
   const schema = ctx.schema.list[schemaId]
   const t = tempI32('obj')
   const ptr = temp('objp')
@@ -918,6 +1027,28 @@ function emitHashKeys(obj) {
     hashKeysFromTemp(t)], 'f64')
 }
 
+// for-in over a statically-HASH receiver: serve keys through the shared enum
+// cache (core.js __hash_keys_ro) — read-only by the for-in lowering's contract.
+function emitHashKeysRO(obj) {
+  inc('__hash_keys_ro')
+  declEnumcGlobals()
+  return typed(['call', '$__hash_keys_ro', ['i64.reinterpret_f64', asF64(emit(obj))]], 'f64')
+}
+
+// __hash_keys_ro's cache globals — declared at emit time so the helper's text
+// resolves even in builds where collection.js (which also declares them for its
+// delete-hook) never loads. enumcConsumed marks that some enumeration site can
+// FILL the cache this build (the OBJECT arm is inline IR — reachability can't
+// see it), so assemble.js knows to reset it in `__clear` (ABA guard).
+function declEnumcGlobals() {
+  ctx.runtime.enumcConsumed = true
+  if (!ctx.scope.globals.has('__enumc_off')) {
+    declGlobal('__enumc_off', 'i32')
+    declGlobal('__enumc_len', 'i32')
+    declGlobal('__enumc_arr', 'f64')
+  }
+}
+
 function emitHashValues(obj) {
   const t = temp('hv')
   return typed(['block', ['result', 'f64'],
@@ -1017,30 +1148,39 @@ function hashEntriesFromTemp(t) {
 // compile time or lazily at runtime by JSON.parse via __jp_schema_get); other
 // types (ARRAY, nullish, primitives) return an empty array. The empty-array
 // fallback is allocated in all arms for type uniformity at the if boundary.
-function emitRuntimeKeys(obj) {
+function emitRuntimeKeys(obj, ro) {
   const t = temp('rk')
   return typed(['block', ['result', 'f64'],
     ['local.set', `$${t}`, asF64(emit(obj))],
-    runtimeKeysFromTemp(t, 'rk')], 'f64')
+    runtimeKeysFromTemp(t, 'rk', ro)], 'f64')
 }
 
-function runtimeKeysFromTemp(t, tag) {
+function runtimeKeysFromTemp(t, tag, ro) {
+  if (ctx.memory.shared) ro = false  // see emitKeysGeneric — no enum cache under shared memory
   inc('__ptr_type')
   // Ensure the schema table global exists even in programs that never use
   // JSON.parse or compile-time schemas — the OBJECT arm reads it at runtime
-  // and the watr resolver requires the symbol to be declared.
+  // and the watr resolver requires the symbol to be declared. Declaring is not
+  // enough: the OBJECT arm READS the table inline (no named helper to count),
+  // so mark consumption for assemble.js's needsSchemaTbl gate or the table
+  // stays 0 and enumeration silently yields zero schema keys.
   if (!ctx.scope.globals.has('__schema_tbl'))
     declGlobal('__schema_tbl', 'i32')
+  ctx.runtime.schemaTblConsumed = true
   const tt = tempI32(`${tag}t`)
   const empty = allocPtr({ type: PTR.ARRAY, len: 0, tag: `${tag}e` })
   return ['block', ['result', 'f64'],
     ['local.set', `$${tt}`, ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]],
     ['if', ['result', 'f64'],
       ['i32.eq', ['local.get', `$${tt}`], ['i32.const', PTR.HASH]],
-      ['then', hashKeysFromTemp(t)],
+      // for-in (ro): serve the shared enum-cache array — see emitHashKeysRO.
+      ['then', ro
+        ? (inc('__hash_keys_ro'), declEnumcGlobals(),
+          ['call', '$__hash_keys_ro', ['i64.reinterpret_f64', ['local.get', `$${t}`]]])
+        : hashKeysFromTemp(t)],
       ['else', ['if', ['result', 'f64'],
         ['i32.eq', ['local.get', `$${tt}`], ['i32.const', PTR.OBJECT]],
-        ['then', objectKeysFromTemp(t)],
+        ['then', objectKeysFromTemp(t, ro)],
         ['else', ['block', ['result', 'f64'], empty.init, empty.ptr]]]]]]
 }
 
@@ -1048,6 +1188,7 @@ function emitRuntimeValues(obj) {
   inc('__ptr_type')
   if (!ctx.scope.globals.has('__schema_tbl'))
     declGlobal('__schema_tbl', 'i32')
+  ctx.runtime.schemaTblConsumed = true
   const t = temp('rv'), tt = tempI32('rvt')
   const empty = allocPtr({ type: PTR.ARRAY, len: 0, tag: 'rve' })
   return typed(['block', ['result', 'f64'],
@@ -1066,6 +1207,7 @@ function emitRuntimeEntries(obj) {
   inc('__ptr_type')
   if (!ctx.scope.globals.has('__schema_tbl'))
     declGlobal('__schema_tbl', 'i32')
+  ctx.runtime.schemaTblConsumed = true
   const t = temp('re'), tt = tempI32('ret')
   const empty = allocPtr({ type: PTR.ARRAY, len: 0, tag: 'ree' })
   return typed(['block', ['result', 'f64'],
@@ -1098,17 +1240,88 @@ function emitRuntimeEntries(obj) {
 //
 // Callbacks receive the active locals as named fields so each variant can
 // reference what it needs without knowing the scaffold's layout.
-function emitEnumerateObject(t, emitStaticStore, emitDynStore) {
+function emitEnumerateObject(t, emitStaticStore, emitDynStore, ro) {
   inc('__alloc_hdr', '__ptr_offset', '__coll_order')
+  if (ro) declEnumcGlobals()
+  // Durable-receiver global-table merge (see below) only when collection.js's
+  // dyn-props machinery is actually part of this build — a program that never
+  // writes a dynamic prop anywhere never loads collection.js, so __dyn_props/
+  // __ihash_get_local wouldn't exist to reference.
+  const hasDynProps = ctx.scope.globals.has('__dyn_props')
+  if (hasDynProps) inc('__ihash_get_local', '__is_nullish')
   const sid = tempI32('oes'), src = tempI32('oesrc'), sn = tempI32('oen')
-  const base = tempI32('oebase'), props = tempI64('oepr'), poff = tempI32('oepo')
-  const pcap = tempI32('oepc'), dn = tempI32('oedn'), total = tempI32('oetot')
+  const base = tempI32('oebase'), props = tempI64('oepr')
+  // TWO dyn-prop sources for a DURABLE receiver: the off-16 sidecar (populated
+  // if this receiver got dyn props DURING init, while __heap_reset was still
+  // low) and the global __dyn_props table (populated by RUNTIME/post-init
+  // writes — see collection.js's heapResetWat). Either, both, or neither may
+  // be non-empty; enumerate whichever exist, deduping across schema ∪ global
+  // ∪ sidecar (in that priority — global shadows a sidecar entry with the
+  // same key, matching __dyn_get_t_h's read priority). An EPHEMERAL receiver
+  // only ever uses the sidecar slot (poffG stays 0 for it).
+  const poffG = tempI32('oepoG'), pcapG = tempI32('oepcG'), dnG = tempI32('oednG'), ordG = tempI32('oeordG')
+  const poffS = tempI32('oepoS'), pcapS = tempI32('oepcS'), dnS = tempI32('oednS'), ordS = tempI32('oeordS')
+  const total = tempI32('oetot')
   const out = tempI32('oeo'), i = tempI32('oei'), o = tempI32('oej')
-  const slot = tempI32('oesl'), ord = tempI32('oeord')
+  const slot = tempI32('oesl')
   const j = tempI32('oej2'), skip = tempI32('oesk'), pair = tempI32('oep')
   const id = ctx.func.uniq++
   const env = { out, o, src, base, i, slot, pair }
-  return ['block', ['result', 'f64'],
+  // for-in enum cache, OBJECT arm (see core.js __hash_keys_ro for the scheme).
+  // Key = (sidecar off, sidecar len): the sidecar identifies the object (one
+  // sidecar per object, offs unique), sid/schema are immutable per object, and
+  // every other key-set change clears the cache — sidecar inserts change dnS
+  // (natural miss), sidecar/global deletes and global dyn-prop inserts clear
+  // __enumc_off at their (cold) sites. Checked BEFORE the global __dyn_props
+  // probe, so a hit skips the ihash lookup too — sound because any global-side
+  // structural change since fill cleared the cache. poffS≠0 guard: an empty
+  // cache (off 0) must not match a sidecar-less object.
+  const roHit = ro ? [['if', ['i32.and',
+      ['i32.and',
+        ['i32.ne', ['local.get', `$${poffS}`], ['i32.const', 0]],
+        ['i32.eq', ['local.get', `$${poffS}`], ['global.get', '$__enumc_off']]],
+      ['i32.eq', ['local.get', `$${dnS}`], ['global.get', '$__enumc_len']]],
+    ['then', ['br', `$oed${id}`, ['global.get', '$__enumc_arr']]]]] : []
+  // Dedup-and-store one dyn source's dn live slots (at poff/pcap, ord already
+  // computed) against the schema (0..sn @ src) and, when `against` is given,
+  // a second dyn source's already-walked ord array (0..dn2 @ ord2).
+  const walkDyn = (label, dn, ord, against) => ['if', ['i32.ne', ['local.get', `$${dn}`], ['i32.const', 0]],
+    ['then',
+      ['local.set', `$${i}`, ['i32.const', 0]],
+      ['block', `$${label}brk${id}`, ['loop', `$${label}loop${id}`,
+        ['br_if', `$${label}brk${id}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${dn}`]]],
+        ['local.set', `$${slot}`, ['i32.load', ['i32.add', ['local.get', `$${ord}`],
+          ['i32.shl', ['local.get', `$${i}`], ['i32.const', 2]]]]],
+        ['local.set', `$${skip}`, ['i32.const', 0]],
+        ['local.set', `$${j}`, ['i32.const', 0]],
+        ['block', `$${label}skbrk${id}`, ['loop', `$${label}skloop${id}`,
+          ['br_if', `$${label}skbrk${id}`, ['i32.ge_s', ['local.get', `$${j}`], ['local.get', `$${sn}`]]],
+          ['if', ['i64.eq',
+              ['i64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 8]]],
+              ['i64.load', ['i32.add', ['local.get', `$${src}`], ['i32.shl', ['local.get', `$${j}`], ['i32.const', 3]]]]],
+            ['then', ['local.set', `$${skip}`, ['i32.const', 1]], ['br', `$${label}skbrk${id}`]]],
+          ['local.set', `$${j}`, ['i32.add', ['local.get', `$${j}`], ['i32.const', 1]]],
+          ['br', `$${label}skloop${id}`]]],
+        ...(against ? [
+          ['if', ['i32.eqz', ['local.get', `$${skip}`]],
+            ['then',
+              ['local.set', `$${j}`, ['i32.const', 0]],
+              ['block', `$${label}gdbrk${id}`, ['loop', `$${label}gdloop${id}`,
+                ['br_if', `$${label}gdbrk${id}`, ['i32.ge_s', ['local.get', `$${j}`], ['local.get', `$${against.dn}`]]],
+                ['if', ['i64.eq',
+                    ['i64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 8]]],
+                    ['i64.load', ['i32.add', ['i32.load', ['i32.add', ['local.get', `$${against.ord}`],
+                      ['i32.shl', ['local.get', `$${j}`], ['i32.const', 2]]]], ['i32.const', 8]]]],
+                  ['then', ['local.set', `$${skip}`, ['i32.const', 1]], ['br', `$${label}gdbrk${id}`]]],
+                ['local.set', `$${j}`, ['i32.add', ['local.get', `$${j}`], ['i32.const', 1]]],
+                ['br', `$${label}gdloop${id}`]]]]]] : []),
+        ['if', ['i32.eqz', ['local.get', `$${skip}`]],
+          ['then',
+            ...emitDynStore(env),
+            ['local.set', `$${o}`, ['i32.add', ['local.get', `$${o}`], ['i32.const', 1]]]]],
+        ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
+        ['br', `$${label}loop${id}`]]]]]
+  return ['block', `$oed${id}`, ['result', 'f64'],
     // Static schema row: sid (AUX bits) → __schema_tbl[sid] → src offset; n@src-8.
     // __schema_tbl is omitted when every program schema is empty (dyn-only dicts);
     // guard the read so empty-table programs see sn=0 here and still enumerate
@@ -1124,13 +1337,20 @@ function emitEnumerateObject(t, emitStaticStore, emitDynStore) {
           ['i64.load', ['i32.add', ['global.get', '$__schema_tbl'], ['i32.shl', ['local.get', `$${sid}`], ['i32.const', 3]]]],
           ['i64.const', LAYOUT.OFFSET_MASK]]]],
         ['local.set', `$${sn}`, ['i32.load', ['i32.sub', ['local.get', `$${src}`], ['i32.const', 8]]]]]],
-    // Dyn-props: heap OBJECTs (base >= __heap_start) carry a HASH propsPtr at
-    // base-16 (0 when none). Static-segment objects have no header, so they
-    // contribute no dyn keys (poff stays 0).
+    // Dyn-props: heap OBJECTs carry a HASH propsPtr either at base-16
+    // (populated by an init-time write, or by any write at all on an
+    // EPHEMERAL receiver — one allocated after the post-init high-water
+    // mark, per the durable-receiver policy) or in the global __dyn_props
+    // table keyed by offset (populated by a RUNTIME/post-init write on a
+    // DURABLE receiver; see collection.js's heapResetWat). Static-segment
+    // objects (base < __heap_start) have no header at all and predate any
+    // warm-reuse machinery, so they contribute no dyn keys either way.
     ['local.set', `$${base}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]],
-    ['local.set', `$${dn}`, ['i32.const', 0]],
-    ['local.set', `$${poff}`, ['i32.const', 0]],
-    ['if', ['i32.ge_u', ['local.get', `$${base}`], ['global.get', '$__heap_start']],
+    ['local.set', `$${dnG}`, ['i32.const', 0]],
+    ['local.set', `$${poffG}`, ['i32.const', 0]],
+    ['local.set', `$${dnS}`, ['i32.const', 0]],
+    ['local.set', `$${poffS}`, ['i32.const', 0]],
+    ['if', ['i32.ge_u', ['local.get', `$${base}`], heapResetIR()],
       ['then',
         ['local.set', `$${props}`, ['i64.load', ['i32.sub', ['local.get', `$${base}`], ['i32.const', 16]]]],
         ['if', ['i32.eq',
@@ -1139,12 +1359,56 @@ function emitEnumerateObject(t, emitStaticStore, emitDynStore) {
           ['then',
             // Resolve forward chain — HASH may have forwarded on grow; the raw
             // propsPtr offset would point at the forward record, not live slots.
-            ['local.set', `$${poff}`, ['call', '$__ptr_offset', ['local.get', `$${props}`]]],
-            ['local.set', `$${pcap}`, ['i32.load', ['i32.sub', ['local.get', `$${poff}`], ['i32.const', 4]]]],
-            ['local.set', `$${dn}`, ['i32.load', ['i32.sub', ['local.get', `$${poff}`], ['i32.const', 8]]]]]]]],
-    // Over-allocate sn+dn; patch length to actual `o` post-dedup so removed
-    // shadow-mirror slots never expose garbage tails.
-    ['local.set', `$${total}`, ['i32.add', ['local.get', `$${sn}`], ['local.get', `$${dn}`]]],
+            ['local.set', `$${poffS}`, ['call', '$__ptr_offset', ['local.get', `$${props}`]]],
+            ['local.set', `$${pcapS}`, ['i32.load', ['i32.sub', ['local.get', `$${poffS}`], ['i32.const', 4]]]],
+            ['local.set', `$${dnS}`, ['i32.load', ['i32.sub', ['local.get', `$${poffS}`], ['i32.const', 8]]]]]],
+        ...roHit],
+      ...(hasDynProps ? [['else',
+        // Sidecar (init-time keys, if any) — only for genuinely heap-allocated
+        // receivers (base >= __heap_start): static-segment objects have no
+        // header at all, so the off-16 read would hit neighboring static data.
+        // Durable words may carry the runtime-shadowed bit0 marker
+        // (collection.js __dyn_set) — mask it out or the resolved sidecar off
+        // is misaligned.
+        ['if', ['i32.ge_u', ['local.get', `$${base}`], ['global.get', '$__heap_start']],
+          ['then',
+        ['local.set', `$${props}`, ['i64.and',
+          ['i64.load', ['i32.sub', ['local.get', `$${base}`], ['i32.const', 16]]], ['i64.const', -2]]],
+        ['if', ['i32.eq',
+            ['i32.wrap_i64', ['i64.and', ['i64.shr_u', ['local.get', `$${props}`], ['i64.const', LAYOUT.TAG_SHIFT]], ['i64.const', LAYOUT.TAG_MASK]]],
+            ['i32.const', PTR.HASH]],
+          ['then',
+            ['local.set', `$${poffS}`, ['call', '$__ptr_offset', ['local.get', `$${props}`]]],
+            ['local.set', `$${pcapS}`, ['i32.load', ['i32.sub', ['local.get', `$${poffS}`], ['i32.const', 4]]]],
+            ['local.set', `$${dnS}`, ['i32.load', ['i32.sub', ['local.get', `$${poffS}`], ['i32.const', 8]]]]]]]],
+        ...roHit,
+        // Global (runtime-written keys, if any) — NO heap_start gate: __dyn_set
+        // routes writes on STATIC-SEGMENT receivers here too (they have no
+        // header, so the global table is their only storage), and the probe is
+        // keyed by offset, needing no header. Gating it on heap_start silently
+        // dropped `o.zz = 3` on a data-segment literal from enumeration.
+        ['if', ['f64.ne', ['global.get', '$__dyn_props'], ['f64.const', 0]],
+          ['then',
+            ['local.set', `$${props}`, ['call', '$__ihash_get_local',
+              ['i64.reinterpret_f64', ['global.get', '$__dyn_props']],
+              ['i64.reinterpret_f64', ['f64.convert_i32_s', ['local.get', `$${base}`]]]]],
+            ['if', ['i32.eqz', ['call', '$__is_nullish', ['local.get', `$${props}`]]],
+              ['then',
+                ['local.set', `$${poffG}`, ['call', '$__ptr_offset', ['local.get', `$${props}`]]],
+                ['local.set', `$${pcapG}`, ['i32.load', ['i32.sub', ['local.get', `$${poffG}`], ['i32.const', 4]]]],
+                ['local.set', `$${dnG}`, ['i32.load', ['i32.sub', ['local.get', `$${poffG}`], ['i32.const', 8]]]]]]]]]] : [])],
+    // for-in with no dyn sources at all: the enumeration IS the schema key
+    // array, and __schema_tbl[sid] already holds it as a static jz array —
+    // return it boxed directly. Read-only by for-in's contract, static by
+    // construction: no alloc, no cache, no invalidation.
+    ...(ro ? [['if', ['i32.and',
+        ['i32.and', ['i32.eqz', ['local.get', `$${dnG}`]], ['i32.eqz', ['local.get', `$${dnS}`]]],
+        ['i32.ne', ['local.get', `$${src}`], ['i32.const', 0]]],
+      ['then', ['br', `$oed${id}`, mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${src}`])]]]] : []),
+    // Over-allocate sn+dnG+dnS; patch length to actual `o` post-dedup so
+    // removed shadow-mirror/cross-source-duplicate slots never expose
+    // garbage tails.
+    ['local.set', `$${total}`, ['i32.add', ['local.get', `$${sn}`], ['i32.add', ['local.get', `$${dnG}`], ['local.get', `$${dnS}`]]]],
     ['local.set', `$${out}`, ['call', '$__alloc_hdr', ['local.get', `$${total}`], ['local.get', `$${total}`]]],
     ['local.set', `$${o}`, ['i32.const', 0]],
     // Static schema slots — no skip, schema keys are unique by construction.
@@ -1155,42 +1419,36 @@ function emitEnumerateObject(t, emitStaticStore, emitDynStore) {
       ['local.set', `$${o}`, ['i32.add', ['local.get', `$${o}`], ['i32.const', 1]]],
       ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
       ['br', `$sloop${id}`]]],
-    // Dyn-prop slots in insertion order (__coll_order sorts the dn live 24-byte
+    // Dyn-prop slots in insertion order (__coll_order sorts the live 24-byte
     // slots by packed seq; hash@+0, key@+8, value@+16). Skip entries whose key
     // is already in the schema — when an object literal has shadow=true (per
     // needsDynShadow), each schema key is mirrored into propsPtr at construction
     // so dyn-key reads hit the hash fast path; the mirror is not an enumeration
-    // entity, so we must not emit it twice.
-    ['if', ['i32.ne', ['local.get', `$${poff}`], ['i32.const', 0]],
-      ['then',
-        ['local.set', `$${ord}`, ['call', '$__coll_order', ['local.get', `$${poff}`], ['local.get', `$${pcap}`], ['i32.const', 24]]],
-        ['local.set', `$${i}`, ['i32.const', 0]],
-        ['block', `$dbrk${id}`, ['loop', `$dloop${id}`,
-          ['br_if', `$dbrk${id}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${dn}`]]],
-          ['local.set', `$${slot}`, ['i32.load', ['i32.add', ['local.get', `$${ord}`],
-            ['i32.shl', ['local.get', `$${i}`], ['i32.const', 2]]]]],
-          ['local.set', `$${skip}`, ['i32.const', 0]],
-          ['local.set', `$${j}`, ['i32.const', 0]],
-          ['block', `$skbrk${id}`, ['loop', `$skloop${id}`,
-            ['br_if', `$skbrk${id}`, ['i32.ge_s', ['local.get', `$${j}`], ['local.get', `$${sn}`]]],
-            ['if', ['i64.eq',
-                ['i64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 8]]],
-                ['i64.load', ['i32.add', ['local.get', `$${src}`], ['i32.shl', ['local.get', `$${j}`], ['i32.const', 3]]]]],
-              ['then', ['local.set', `$${skip}`, ['i32.const', 1]], ['br', `$skbrk${id}`]]],
-            ['local.set', `$${j}`, ['i32.add', ['local.get', `$${j}`], ['i32.const', 1]]],
-            ['br', `$skloop${id}`]]],
-          ['if', ['i32.eqz', ['local.get', `$${skip}`]],
-            ['then',
-              ...emitDynStore(env),
-              ['local.set', `$${o}`, ['i32.add', ['local.get', `$${o}`], ['i32.const', 1]]]]],
-          ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
-          ['br', `$dloop${id}`]]]]],
+    // entity, so we must not emit it twice. Global walks first (schema-dedup
+    // only); sidecar walks second (schema-dedup AND global-dedup, so a key
+    // present in both — reassigned at runtime after being set at init — is
+    // emitted once, from the authoritative global copy).
+    ['if', ['i32.ne', ['local.get', `$${poffG}`], ['i32.const', 0]],
+      ['then', ['local.set', `$${ordG}`, ['call', '$__coll_order', ['local.get', `$${poffG}`], ['local.get', `$${pcapG}`], ['i32.const', 24]]]]],
+    ['if', ['i32.ne', ['local.get', `$${poffS}`], ['i32.const', 0]],
+      ['then', ['local.set', `$${ordS}`, ['call', '$__coll_order', ['local.get', `$${poffS}`], ['local.get', `$${pcapS}`], ['i32.const', 24]]]]],
+    walkDyn('oeg', dnG, ordG, null),
+    walkDyn('oes', dnS, ordS, { dn: dnG, ord: ordG }),
     ['i32.store', ['i32.sub', ['local.get', `$${out}`], ['i32.const', 8]], ['local.get', `$${o}`]],
+    // Fill the enum cache (keyed by sidecar — see roHit above). Objects without
+    // a sidecar are either tier-1 (returned above) or global-only (rare; a 0 key
+    // would collide across objects, so leave them uncached).
+    ...(ro ? [['if', ['i32.ne', ['local.get', `$${poffS}`], ['i32.const', 0]],
+      ['then',
+        ['global.set', '$__enumc_off', ['local.get', `$${poffS}`]],
+        ['global.set', '$__enumc_len', ['local.get', `$${dnS}`]],
+        ['global.set', '$__enumc_arr', mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${out}`])]]]] : []),
     mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${out}`])]
 }
 
 // Object.keys for an OBJECT — copy schema key (i64@src+i*8) then dyn key (i64@slot+8).
-const objectKeysFromTemp = (t) => emitEnumerateObject(t,
+// ro (for-in): serve the static schema array / enum cache — see emitEnumerateObject.
+const objectKeysFromTemp = (t, ro) => emitEnumerateObject(t,
   ({ out, o, src, i }) => [
     ['i64.store',
       ['i32.add', ['local.get', `$${out}`], ['i32.shl', ['local.get', `$${o}`], ['i32.const', 3]]],
@@ -1198,7 +1456,7 @@ const objectKeysFromTemp = (t) => emitEnumerateObject(t,
   ({ out, o, slot }) => [
     ['i64.store',
       ['i32.add', ['local.get', `$${out}`], ['i32.shl', ['local.get', `$${o}`], ['i32.const', 3]]],
-      ['i64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 8]]]]])
+      ['i64.load', ['i32.add', ['local.get', `$${slot}`], ['i32.const', 8]]]]], ro)
 
 // Object.values for an OBJECT — copy schema value (f64@base+i*8) then dyn value (f64@slot+16).
 const objectValuesFromTemp = (t) => emitEnumerateObject(t,