jz 0.8.0 → 0.9.0

package/src/abi/string.js

@@ -59,9 +59,14 @@ const ssoI64 = (sF64) => ['i64.reinterpret_f64', sF64]
 import { isReassigned, isLeaf } from '../ast.js'
 import { LAYOUT, oobNanIR, ssoBitI64Hex } from '../../layout.js'
 
-/** Pre-shifted SSO discriminator — layout.js is cycle-free; memoized at first use. */
-let _ssoBitI64 = null
-const ssoBitI64 = () => _ssoBitI64 ??= ssoBitI64Hex()
+/** Pre-shifted SSO discriminator — layout.js is cycle-free; the thunk exists for
+ *  load-order laziness ONLY. Deliberately NOT memoized: a module-level memo of a
+ *  runtime-BUILT string dangles across the self-host kernel's `_clear()` arena
+ *  rewind (warm compile #2 interpolated the stale pointer's garbage bytes into
+ *  `(i64.const …)` → watr "Bad int") — the same dangling-cache class as DOLLAR /
+ *  stdlibParseCache (see scripts/self.js setupSelf). Recomputing is a few ops at
+ *  emit time; correctness over a micro-memo. */
+const ssoBitI64 = () => ssoBitI64Hex()
 
 /** Allocate a fresh i64 local in the current function. Replicated here (not
  *  imported from `src/ir.js`) to keep this module loadable during ctx.js
@@ -127,8 +132,12 @@ function emitDecompCharRead(dec, iI32, ctx, oobNan, inBounds = false) {
  *  reaching here via type error) gets `len=0` so every bounds check trips and
  *  every `charCodeAt` returns 0 — same shape as the legacy `__char_at`. */
 export function emitCharDecompPrologue(dec) {
-  const param = dec.param
-  const ptr = ['i64.reinterpret_f64', ['local.get', `$${param}`]]
+  // Receiver expression: a param's local slot (shape-1 classic) or a stable
+  // module global (dec.recvGlobal — the parser-state shape: `cur.charCodeAt(idx)`
+  // against a global assigned only outside the scanning function). Built fresh
+  // (IR nodes must not be structurally shared; also the self-host kernel
+  // compiles this file — stick to constructs jz itself supports).
+  const ptr = ['i64.reinterpret_f64', dec.recvGlobal ? ['global.get', dec.recvGlobal] : ['local.get', `$${dec.param}`]]
   const ssoTest = ['i64.ne',
     ['i64.and', ptr, ['i64.const', ssoBitI64()]],
     ['i64.const', 0]]
@@ -162,6 +171,24 @@ export function emitCharDecompPrologue(dec) {
   ]
 }
 
+// True iff every call expression in `body` is a `.charCodeAt` member call and
+// no suspension point (yield/await) or `new` appears — the stability proof for
+// shape-1b global decomposition: nothing that runs during this function can
+// reassign a module global. Escaped arrows are safe to ignore beyond their
+// visible call nodes: they only run when called, and every call here is
+// charCodeAt (single-threaded).
+export function bodyOnlyCharCodeAtCalls(body) {
+  if (!Array.isArray(body)) return true
+  const op = body[0]
+  if (op === 'yield' || op === 'await' || op === 'new') return false
+  if (op === '()' || op === '?.()') {
+    const callee = body[1]
+    if (!(Array.isArray(callee) && (callee[0] === '.' || callee[0] === '?.') && callee[2] === 'charCodeAt')) return false
+  }
+  for (let i = 1; i < body.length; i++) if (!bodyOnlyCharCodeAtCalls(body[i])) return false
+  return true
+}
+
 export const sso = {
   // Wasm slot type a string value occupies under this carrier: the f64
   // NaN-boxed slot (PTR.STRING tag in the high bits, SSO inline data or
@@ -272,6 +299,45 @@ export const sso = {
         }
       }
 
+      // Shape 1b: receiver is a `global.get` of a module global that is STABLE
+      // within this function — the layered-parser hot shape (`cur.charCodeAt(idx)`
+      // in subscript's space/peek/next loops, where `cur` is module state written
+      // only by parse() entry, never by the scanning function). Same entry
+      // decomposition as the param path. Soundness gates:
+      //   - the global is never assigned in this function's body, AND
+      //   - the body's only call expressions are `.charCodeAt` member calls (so
+      //     no user call can transitively reassign the global mid-function), AND
+      //   - no yield/await (a suspension point lets foreign code write it).
+      // Gated on charDecompGlobals — only emitFunc's named-function path drains
+      // the prologue (closure bodies have no collectParamInits; an undrained
+      // decomposition would read len=0 and misreport every char as OOB).
+      if (Array.isArray(sF64) && sF64[0] === 'global.get' && ctx.func.charDecompGlobals) {
+        const raw = typeof sF64[1] === 'string' ? sF64[1] : ''
+        const name = raw.startsWith('$') ? raw.slice(1) : raw
+        if (name && ctx.func.body
+            && !isReassigned(ctx.func.body, name)
+            && bodyOnlyCharCodeAtCalls(ctx.func.body)) {
+          if (!ctx.func.charDecomp) ctx.func.charDecomp = new Map()
+          const key = `#g:${name}`
+          let dec = ctx.func.charDecomp.get(key)
+          if (!dec) {
+            const base = `${name}$ccbase`
+            const len = `${name}$cclen`
+            const sso = `${name}$ccsso`
+            const loadbase = `${name}$ccldb`
+            const ptr64 = `${name}$ccp64`
+            ctx.func.locals.set(base, 'i32')
+            ctx.func.locals.set(len, 'i32')
+            ctx.func.locals.set(sso, 'i32')
+            ctx.func.locals.set(loadbase, 'i32')
+            ctx.func.locals.set(ptr64, 'i64')
+            dec = { base, len, sso, loadbase, ptr64, param: name, recvGlobal: `$${name}`, global: true }
+            ctx.func.charDecomp.set(key, dec)
+          }
+          return emitDecompCharRead(dec, iI32, ctx, oobNan, inBounds)
+        }
+      }
+
       // Shape 2: generic inline form for non-param receivers.
       //
       // Both the receiver `sF64` and the index `iI32` are duplicated across the
@@ -373,15 +439,20 @@ export const sso = {
      *  dispatcher's string/array runtime guess (emit.js) would hijack it into a
      *  bogus array concat. A non-builtin name routes through dynamic property
      *  dispatch (load the closure slot, call it) correctly. */
-    cat: (aF64, bF64, ctx) => {
-      ctx.core.includes.add('__str_concat')
-      return ['call', '$__str_concat', ssoI64(aF64), ssoI64(bF64)]
+    // `ext` (default false) opts into the bump-EXTEND fast path — sound only when emit
+    // proves `a` is dead-after (a self-accumulation `x = x + …`). Otherwise the _fresh twin
+    // alloc+copies, never mutating the live `a` operand. (See __str_concat in module/string.js.)
+    cat: (aF64, bF64, ctx, ext = false) => {
+      const fn = ext ? '__str_concat' : '__str_concat_fresh'
+      ctx.core.includes.add(fn)
+      return ['call', '$' + fn, ssoI64(aF64), ssoI64(bF64)]
     },
 
     /** Concat assuming both sides are already strings (skip ToString). */
-    concatRaw: (aF64, bF64, ctx) => {
-      ctx.core.includes.add('__str_concat_raw')
-      return ['call', '$__str_concat_raw', ssoI64(aF64), ssoI64(bF64)]
+    concatRaw: (aF64, bF64, ctx, ext = false) => {
+      const fn = ext ? '__str_concat_raw' : '__str_concat_raw_fresh'
+      ctx.core.includes.add(fn)
+      return ['call', '$' + fn, ssoI64(aF64), ssoI64(bF64)]
     },
   },
 }

package/src/ast.js

@@ -39,7 +39,7 @@ export const isI32 = (v) => Number.isInteger(v) && v >= I32_MIN && v <= I32_MAX
 
 /** Statement operators — distinguish block bodies from object literals. */
 export const STMT_OPS = new Set([';', 'let', 'const', 'return', 'if', 'for', 'for-in', 'while', 'break', 'continue', 'switch',
-  '=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '>>=', '<<=', '>>>=', '||=', '&&=', '??=',
+  '=', '+=', '-=', '*=', '/=', '%=', '**=', '&=', '|=', '^=', '>>=', '<<=', '>>>=', '||=', '&&=', '??=',
   'throw', 'try', 'catch', 'finally', '++', '--', '()'])
 
 /** jzify superset: pre-lowered JS shapes before prepare strips them. */
@@ -74,7 +74,7 @@ export const isLeaf = n => Array.isArray(n) && (n[0] === 'local.get' || n[0] ===
 // === Assignment / reassignment ===
 
 /** Assignment operators — shared across analyze, plan, emit, abi. */
-export const ASSIGN_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '>>=', '<<=', '>>>=', '||=', '&&=', '??='])
+export const ASSIGN_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '**=', '&=', '|=', '^=', '>>=', '<<=', '>>>=', '||=', '&&=', '??='])
 
 /** Detect whether `name` is written to (=, +=, ++, --, etc.) anywhere within `body`. */
 export function isReassigned(body, name) {
@@ -397,14 +397,20 @@ export function cloneNode(node) {
 // identically and compare equal — an unsound merge (SLP packs `[Inf,-Inf]` as one
 // splat lane; CSE/LICM dedups distinct invariants). Tag each so it round-trips with
 // Object.is semantics.
-export const stableKey = (_k, v) => {
+// Recursive keyer, NOT JSON.stringify with a replacer: the kernel's stringify
+// silently dropped the replacer, so in-kernel nodeEqual collapsed the very
+// constants the tagging exists to distinguish (a latent unsound SLP merge,
+// host≠kernel). A plain walk behaves identically on both sides.
+export function stableNodeKey(v) {
+  if (Array.isArray(v)) { let s = '['; for (let i = 0; i < v.length; i++) s += (i ? ',' : '') + stableNodeKey(v[i]); return s + ']' }
   if (typeof v === 'bigint') return `${v}n`
   if (typeof v === 'number' && (v !== v || v === Infinity || v === -Infinity || Object.is(v, -0)))
     return v !== v ? '#NaN' : v === Infinity ? '#Inf' : v === -Infinity ? '#-Inf' : '#-0'
-  return v
+  if (typeof v === 'string') return JSON.stringify(v)
+  return String(v)  // numbers, booleans, null, undefined — all distinct spellings
 }
 export function nodeEqual(a, b) {
-  return JSON.stringify(a, stableKey) === JSON.stringify(b, stableKey)
+  return stableNodeKey(a) === stableNodeKey(b)
 }
 
 /** Property entries of an object-literal AST node (`['{}', …]`). */

package/src/autoload.js

@@ -5,7 +5,7 @@ import * as mods from '../module/index.js'
 
 const dict = obj => Object.assign(Object.create(null), obj)
 
-export const MOD_ALIAS = { Number: 'number', Array: 'array', Object: 'object', Symbol: 'symbol', JSON: 'json', Date: 'date', BigInt: 'number', Error: 'core', TextEncoder: 'string', TextDecoder: 'string',
+export const MOD_ALIAS = { Number: 'number', Array: 'array', Object: 'object', Symbol: 'symbol', JSON: 'json', Date: 'date', BigInt: 'number', Error: 'core', TextEncoder: 'string', TextDecoder: 'string', Atomics: 'atomics',
   // SIMD intrinsic namespaces (f32x4/i32x4/f64x2/v128) all live in the `simd` module.
   f32x4: 'simd', i32x4: 'simd', f64x2: 'simd', v128: 'simd' }
 
@@ -17,6 +17,7 @@ export const PROP_MODULES = Object.assign(Object.create(null), {
   findLast: ['core', 'array'], findLastIndex: ['core', 'array'],
   every: ['core', 'array'], some: ['core', 'array'], flat: ['core', 'array'], flatMap: ['core', 'array'],
   join: ['core', 'array'], copyWithin: ['core', 'array'], at: ['core', 'string', 'array'],
+  toSorted: ['core', 'array'], toReversed: ['core', 'array'], with: ['core', 'array'],
   charAt: ['core', 'string'], charCodeAt: ['core', 'string'], codePointAt: ['core', 'string'],
   toUpperCase: ['core', 'string'], toLowerCase: ['core', 'string'], toLocaleLowerCase: ['core', 'string'], trim: ['core', 'string'],
   trimStart: ['core', 'string'], trimEnd: ['core', 'string'],
@@ -26,6 +27,10 @@ export const PROP_MODULES = Object.assign(Object.create(null), {
   matchAll: ['core', 'string'], match: ['core', 'string'],
   substring: ['core', 'string'], substr: ['core', 'string'],
   add: ['core', 'collection'], clear: ['core', 'collection'],
+  union: ['core', 'collection'], intersection: ['core', 'collection'],
+  difference: ['core', 'collection'], symmetricDifference: ['core', 'collection'],
+  isSubsetOf: ['core', 'collection'], isSupersetOf: ['core', 'collection'],
+  isDisjointFrom: ['core', 'collection'],
   slice: ['core', 'string', 'array'], concat: ['core', 'string', 'array'],
   indexOf: ['core', 'string', 'array'], lastIndexOf: ['core', 'string', 'array'],
   includes: ['core', 'string', 'array'],
@@ -48,6 +53,7 @@ export const OP_MODULES = {
   'delete': ['core', 'collection', 'string'],
   '//': ['core', 'string', 'regex'],
   '**': ['math'],
+  '**=': ['math'],  // desugars to `name = name ** val` at emit — needs the same module
 }
 
 export const TYPED_CTORS = ['Float64Array','Float32Array','Int32Array','Uint32Array','Int16Array','Uint16Array','Int8Array','Uint8Array','BigInt64Array','BigUint64Array','ArrayBuffer','DataView']
@@ -77,6 +83,22 @@ export const CALL_MODULES = dict({
   'Object.values': ['core', 'object', 'string'],
   'Object.entries': ['core', 'object', 'string'],
   'Object.hasOwn': ['core', 'object', 'string', 'collection'],
+  'Object.groupBy': ['core', 'collection', 'object', 'string', 'array', 'fn'],
+  'Map.groupBy': ['core', 'collection', 'array', 'fn'],
+  'RegExp.escape': ['core', 'string', 'regex'],
+  structuredClone: ['core', 'collection', 'array'],
+  'Atomics.load': ['core', 'typedarray', 'atomics'],
+  'Atomics.store': ['core', 'typedarray', 'atomics'],
+  'Atomics.add': ['core', 'typedarray', 'atomics'],
+  'Atomics.sub': ['core', 'typedarray', 'atomics'],
+  'Atomics.and': ['core', 'typedarray', 'atomics'],
+  'Atomics.or': ['core', 'typedarray', 'atomics'],
+  'Atomics.xor': ['core', 'typedarray', 'atomics'],
+  'Atomics.exchange': ['core', 'typedarray', 'atomics'],
+  'Atomics.compareExchange': ['core', 'typedarray', 'atomics'],
+  'Atomics.notify': ['core', 'typedarray', 'atomics'],
+  'Atomics.isLockFree': ['core', 'typedarray', 'atomics'],
+  'Atomics.wait': ['core', 'typedarray', 'atomics', 'number', 'string'],
   'Object.freeze': ['core', 'object'],
   'Object.assign': ['core', 'object'],
   'Object.create': ['core', 'object'],
@@ -87,11 +109,15 @@ export const CALL_MODULES = dict({
   'Date.now': ['core', 'console'],
   'performance.now': ['core', 'console'],
   'readStdin': ['core', 'console'],
+  'fs.read': ['core', 'string', 'fs'],
+  'fetch': ['core', 'web'],
+  'fs.write': ['core', 'string', 'fs'],
   'String.fromCharCode': ['core', 'string'],
   'String.fromCodePoint': ['core', 'string'],
   'BigInt.asIntN': ['number'],
   'BigInt.asUintN': ['number'],
   ...Object.fromEntries(TYPED_CTORS.filter(n => n.endsWith('Array')).map(n => [`${n}.from`, ['core', 'typedarray', 'array']])),
+  'Array.of': ['core', 'array'],
   'ArrayBuffer.isView': ['core', 'typedarray'],
   // instanceof Map / Set / TypedArray predicates (synthesized by jzify).
   '__is_map': ['core', 'collection'],
@@ -118,6 +144,7 @@ export const TIMER_NAMES = new Set(['setTimeout', 'clearTimeout', 'setInterval',
 
 const MOD_DEPS = {
   number: ['core', 'string'],
+  atomics: ['core', 'typedarray'],
   string: ['core', 'number'],
   array: ['core'],
   object: ['core'],

package/src/bridge.js

@@ -9,7 +9,7 @@
  */
 
 import { ctx, emitter } from './ctx.js'
-import { typed, asF64, asI32, asI64 } from './ir.js'
+import { typed, asF64, asI32, asI64, carrierF64 } from './ir.js'
 
 export { emitter } from './ctx.js'
 
@@ -83,8 +83,13 @@ export const dual = (wrap, core, fast) => {
 
 const cast = { I: asI64, F: asF64, i: asI32 }
 
+// 'I' is the boxed-value slot (receivers, collection keys/values) — a boolean
+// crosses it as its TRUE/FALSE atom so identity survives the container round-trip
+// (typeof / String / strict-eq); 'F'/'i' are numeric positions and stay raw.
 const coerce = (sig, nodes) =>
-  sig.split('').map((c, i) => cast[c](emit(nodes[i])))
+  sig.split('').map((c, i) => c === 'I'
+    ? asI64(carrierF64(nodes[i], emit(nodes[i])))
+    : cast[c](emit(nodes[i])))
 
 const wrap = (fmt, call) => {
   if (fmt === 'i64') return typed(['f64.reinterpret_i64', call], 'f64')

package/src/compile/analyze-scans.js

@@ -149,15 +149,27 @@ export const USE = {
   DELETE_MEMBER: 11, // `delete name.member`
   BARE: 12,          // any other value position — the conservative catch-all
 }
-const _bindingUsesCache = new WeakMap()
+let _bindingUsesCache = new WeakMap()
+// Self-host-only: see resetProgramFactsCache (program-facts.js) — swap in a fresh
+// WeakMap so a warm-instance compile-clear-compile loop never reads a dangling
+// arena pointer out of the old backing storage.
+export function resetBindingUsesCache() { _bindingUsesCache = new WeakMap() }
 const _CMP_OPS = new Set(['==', '!=', '===', '!==', '<', '>', '<=', '>='])
 const _isNullishLit = (e) =>
   e === 'null' || e === 'undefined' ||
   (Array.isArray(e) && e[0] == null && (e[1] === null || e[1] === undefined))
 
-export function scanBindingUses(body) {
-  const hit = _bindingUsesCache.get(body)
-  if (hit) return hit
+// `trackNames` (optional): also report uses of these names even though they're
+// never `let`/`const`-declared IN THIS body — the program-wide dyn-fn-table scan
+// (compile/dyn-closure-tables.js) uses this to see a GLOBAL's uses inside every
+// function body, not just its one module-scope declaration site. Bypasses the
+// cache (a different `trackNames` on the same body would otherwise read a stale
+// entry keyed only by `body`) — fine, this path is a one-shot pre-pass, not hot.
+export function scanBindingUses(body, trackNames) {
+  if (!trackNames) {
+    const hit = _bindingUsesCache.get(body)
+    if (hit) return hit
+  }
 
   const summary = new Map()                    // name → { decls, initRhs, uses }
   const slot = (name) => {
@@ -323,8 +335,11 @@ export function scanBindingUses(body) {
 
   walk(body, false)
 
-  for (const [name, s] of summary) if (s.decls === 0) summary.delete(name)
-  _bindingUsesCache.set(body, summary)
+  for (const [name, s] of summary) if (s.decls === 0 && !trackNames?.has(name)) summary.delete(name)
+  // `body` can be null (a module whose every top-level statement got lifted
+  // into ctx.func.list, e.g. a single `export const f = () => …` leaves
+  // nothing at module scope) — WeakMap keys must be objects.
+  if (!trackNames && body != null && typeof body === 'object') _bindingUsesCache.set(body, summary)
   return summary
 }
 
@@ -481,7 +496,7 @@ export function scanSliceViews(body) {
  * `a[0].push(x)`, never relocates `a` itself, so `a` stays eligible — see safeReads.)
  */
 const grownOrEscapes = (op) => ASSIGN_OPS.has(op) || op === '++' || op === '--' || op === 'delete'
-function safeReads(node, name) {
+export function safeReads(node, name) {
   if (typeof node === 'string') return node !== name            // bare value use → escape
   if (!Array.isArray(node)) return true
   const op = node[0]

package/src/compile/analyze.js

@@ -23,7 +23,7 @@ import { ctx, err } from '../ctx.js'
 import { VAL, repOf, repOfGlobal, updateRep, updateGlobalRep, lookupValType, lookupNotString } from '../reps.js'
 import { valTypeOf, jsonConstString, shapeOf, shapeOfObjectLiteralAst } from '../kind.js'
 import { intLiteralValue, nonNegIntLiteral, constIntExpr, NO_VALUE, staticPropertyKey, staticValue, staticObjectProps, staticArrayElems, objLiteralSchemaId, exprSchemaId, inlineArraySid } from '../static.js'
-import { typedElemCtor, MIXED_CTORS, isCondExpr, ternaryCtorOfRhs, scanBoundedLoops, inBoundsCharCodeAt, exprType, intCertainMap } from '../type.js'
+import { typedElemCtor, typedStaticLen, MIXED_CTORS, isCondExpr, ternaryCtorOfRhs, scanBoundedLoops, inBoundsCharCodeAt, exprType, intCertainMap } from '../type.js'
 import { TYPED_ELEM_CODE, TYPED_ELEM_VIEW_FLAG, TYPED_ELEM_BIGINT_FLAG, encodeTypedElemAux, typedElemAux, TYPED_ELEM_NAMES, ctorFromElemAux } from '../../layout.js'
 
 // ValueRep field docs + ParamReps lattice helpers — storage lives in src/reps.js.
@@ -81,7 +81,13 @@ import {
 
 export { findFreeVars, findMutations, boxedCaptures } from './analyze-scans.js'
 
-const _bodyFactsCache = new WeakMap()
+let _bodyFactsCache = new WeakMap()
+// Self-host-only: see resetProgramFactsCache (program-facts.js) — the WeakMap's own
+// backing storage is an arena allocation that a warm-instance `_clear` rewinds, so
+// a compile-clear-compile loop must swap in a fresh instance, not just rely on
+// per-body identity misses (which natively is enough since AST nodes are fresh
+// each compile and the old WeakMap contents just become GC-unreachable).
+export function resetBodyFactsCache() { _bodyFactsCache = new WeakMap() }
 
 // Per-name monotone fact trackers over a pluggable {get,set,delete} store. First
 // observation wins; a conflicting later one poisons the name (and clears the store
@@ -104,9 +110,9 @@ const makeValTracker = (get, set, del) => {
     set(name, vt)
   }
 }
-const makeTypedTracker = (get, set, del) => {
+const makeTypedTracker = (get, set, del, getLen, setLen, delLen) => {
   const poison = new Set()
-  const invalidate = (name) => { poison.add(name); del(name) }
+  const invalidate = (name) => { poison.add(name); del(name); if (delLen) delLen(name) }
   // Resolve a variable-name ternary branch to its known typed-array ctor: a
   // local typed binding (`get`), or a module global promoted typed by plan
   // (`inferModuleLetTypes` populates `globalTypedElem`, copied into
@@ -125,7 +131,21 @@ const makeTypedTracker = (get, set, del) => {
       if (typeof c === 'string' && c.endsWith('.view')) ctx.features.typedView = true
       const prev = get(name)
       if (prev && prev !== c) invalidate(name)
-      else set(name, c)
+      else {
+        set(name, c)
+        // Static length rides the ctor's stability (fixed-length arrays): a redef
+        // with an unknown or conflicting length drops the entry — typedStaticLen is
+        // null for subarray/copy/ternary/computed rhs, so those invalidate for free.
+        // Same live-closure style as get/set/del (call-time ctx deref, per the
+        // makeValTracker comment above — a captured Map would orphan on the
+        // per-function ctx.types reset).
+        if (setLen) {
+          const len = typedStaticLen(rhs)
+          const prevLen = getLen(name)
+          if (len == null || (prevLen !== undefined && prevLen !== len)) delLen(name)
+          else setLen(name, len)
+        }
+      }
     }
     const ctor = typedElemCtor(rhs)
     if (ctor) return setOrInvalidate(ctor)
@@ -148,6 +168,15 @@ const makeTypedTracker = (get, set, del) => {
       }
       return
     }
+    // Field provenance: `const tw = plan.twRe` where the receiver's schema slot
+    // holds one typed-array kind program-wide and the prop is never written
+    // (gate inside slotTypedCtorAt) — the binding keeps the concrete kind, so
+    // hot-loop reads stay on the typed path (bench: provenance, fftplan).
+    if (Array.isArray(rhs) && (rhs[0] === '.' || rhs[0] === '?.') &&
+        typeof rhs[1] === 'string' && typeof rhs[2] === 'string' && ctx.schema?.slotTypedCtorAt) {
+      const fc = ctx.schema.slotTypedCtorAt(rhs[1], rhs[2])
+      if (fc) return setOrInvalidate(fc)
+    }
     // Heterogeneous ternary (`n===16 ? new Uint8Array(16) : new Uint16Array(8)`):
     // ctors that don't unify must invalidate so a sibling-scope decl can't lock in
     // the wrong store width.
@@ -194,6 +223,7 @@ export function analyzeBody(body) {
   // resolve as that typed array so `arr[i][j]` / `let o = arr[i]; o[j]` inline.
   const arrElemTypedCtors = new Map()
   const typedElems = new Map()
+  const typedLens = new Map()
   const escapes = new Map() // name → bool: local holds allocation, true if it escapes
 
   const doSchemas = !!ctx.schema?.register
@@ -274,7 +304,8 @@ export function analyzeBody(body) {
 
   // Local-Map slices: bind the Map's get/set/delete as the tracker's three ops.
   const trackVal = makeValTracker(n => valTypes.get(n), (n, vt) => valTypes.set(n, vt), n => valTypes.delete(n))
-  const trackTyped = makeTypedTracker(n => typedElems.get(n), (n, c) => typedElems.set(n, c), n => typedElems.delete(n))
+  const trackTyped = makeTypedTracker(n => typedElems.get(n), (n, c) => typedElems.set(n, c), n => typedElems.delete(n),
+    n => typedLens.get(n), (n, l) => typedLens.set(n, l), n => typedLens.delete(n))
 
   // === Per-decl observation (called for each `let`/`const` `name = rhs`) ===
   const processDecl = (name, rhs) => {
@@ -630,7 +661,7 @@ export function analyzeBody(body) {
   // Never-relocated array bindings — reads may skip the realloc-forwarding follow.
   const neverGrown = doSchemas ? scanNeverGrown(body) : new Set()
 
-  const result = { locals, valTypes, arrElemSchemas, arrElemValTypes, arrElemTypedCtors, typedElems, escapes, flatObjects, sliceViews, unsignedLocals, neverGrown, numericFill }
+  const result = { locals, valTypes, arrElemSchemas, arrElemValTypes, arrElemTypedCtors, typedElems, typedLens, escapes, flatObjects, sliceViews, unsignedLocals, neverGrown, numericFill }
   _bodyFactsCache.set(body, result)
   return result
 }
@@ -659,7 +690,21 @@ export function analyzeBody(body) {
  */
 function widenLocalTypes(body, locals) {
   const i32SafeIdx = collectI32SafeIndexVars(body, locals)
-  const intCounters = intCertainMap(body)
+  // Names this scope's own locals map might be reassigned FROM INSIDE A NESTED
+  // ARROW — a captured, mutated variable. analyzeBody runs before boxedCaptures
+  // populates ctx.func.boxed, so recompute the same "some arrow writes this
+  // name" fact locally via findMutations (which already doesn't skip `=>`).
+  // Threaded into intCertainMap and both widening walks below: none of them
+  // used to look past a `=>` boundary, so `let env = 0; let set = () => { env
+  // = 1.5 }` never saw the closure-body float write — `env` stayed provably-int
+  // (keepI32 exempted it from Pass A, Pass B never re-checked its only visible
+  // def, the never-a-def-of-1.5 one), and the ENCLOSING FUNCTION's own result
+  // then narrowed to i32 (narrowI32Results trusts this same `locals` map),
+  // silently truncating the return. Gated on nestedNames.size so the common
+  // case (no nested reassignment anywhere) keeps the original, cheaper walk.
+  const nestedNames = new Set()
+  findMutations(body, new Set(locals.keys()), nestedNames)
+  const intCounters = intCertainMap(body, nestedNames)
   const f64IdxVars = collectF64StridedIndexVars(body, locals)  // counters that trunc anyway — don't keep i32
   const keepI32 = (name) => i32SafeIdx.has(name) || (intCounters.get(name) === true && !f64IdxVars.has(name))
   const CMP_OPS = new Set(['<', '>', '<=', '>=', '==', '!='])
@@ -672,7 +717,8 @@ function widenLocalTypes(body, locals) {
       if (ta === 'i32' && tb === 'f64' && typeof a === 'string' && locals.has(a) && !keepI32(a)) locals.set(a, 'f64')
       if (tb === 'i32' && ta === 'f64' && typeof b === 'string' && locals.has(b) && !keepI32(b)) locals.set(b, 'f64')
     }
-    if (op !== '=>') for (const a of args) widenPass(a)
+    if (op === '=>') { if (nestedNames.size) widenPass(args[1]) }
+    else for (const a of args) widenPass(a)
   }
   widenPass(body)
 
@@ -682,7 +728,7 @@ function widenLocalTypes(body, locals) {
     const recheck = (node) => {
       if (!Array.isArray(node)) return
       const op = node[0]
-      if (op === '=>') return
+      if (op === '=>') { if (nestedNames.size) recheck(node[2]); return }
       if (op === 'let' || op === 'const') {
         for (let i = 1; i < node.length; i++) {
           const a = node[i]
@@ -724,18 +770,46 @@ export function invalidateLocalsCache(body) {
   if (body && typeof body === 'object') _bodyFactsCache.delete(body)
 }
 
-// Can this RHS expression produce null/undefined? A direct nullish literal
-// (`[null, null]` covers both null and undefined), or a `?:`/`&&`/`||` with a
-// nullish branch. Drives the `nullable` rep flag so `x === null` on a binding
-// that was ever assigned null isn't constant-folded to false (emit.js
-// strictSentinel). Conservative — opaque sources (calls, member reads) aren't
-// flagged; the fold they'd suppress is rare and a runtime nullish check is cheap.
-function mayBeNullish(n) {
-  if (!Array.isArray(n)) return false
-  if (n.length === 2 && n[0] == null && n[1] == null) return true
-  if (n[0] === '?' || n[0] === '?:') return mayBeNullish(n[2]) || mayBeNullish(n[3])
-  if (n[0] === '&&' || n[0] === '||') return mayBeNullish(n[1]) || mayBeNullish(n[2])
-  return false
+// Can this RHS expression produce null/undefined? FAIL-CLOSED: anything not
+// STRUCTURALLY provable non-nullish counts nullable. The flag's only effect
+// is suppressing emit.js's strictSentinel constant fold (the comparison pays
+// a cheap runtime nullish check instead) plus capture propagation — while a
+// wrong non-nullable verdict FOLDS AWAY a real miss guard. The old shape
+// list (nullish literals + ternary arms only) was sound while opaque sources
+// carried no value kind (no kind ⇒ no fold); the Map/element value-kind
+// inference broke that assumption: the self-host kernel's own
+// `autoCache.get(name) !== undefined` cache probe folded to TRUE (the get's
+// rep carried the map's value kind, non-nullable) and every autoDepsOf call
+// returned the miss sentinel unconditionally — the byte-parity root.
+const NEVER_NULLISH_OPS = new Set([
+  'str', '//', '{}', '[', '=>', 'new', 'bool',
+  '+', '-', '*', '/', '%', '**', '|', '&', '^', '~', '<<', '>>', '>>>',
+  '==', '!=', '===', '!==', '<', '>', '<=', '>=', '!', 'u-', 'u+',
+  'typeof', 'in', 'instanceof', '++', '--',
+])
+// `nameNullable` resolves a bare-name read; the default reads the CURRENT
+// function's rep (emit-time callers). narrow.js passes its own resolver — at
+// plan time no caller's ctx.func is installed, so it re-derives nullability
+// from the caller body's writes instead. Exported for exactly that consumer.
+export function mayBeNullish(n, nameNullable = (name) => !!repOf(name)?.nullable) {
+  if (typeof n === 'number' || typeof n === 'boolean') return false
+  // name read: inherit the source binding's settled flag (best-effort — an
+  // unsettled rep reads false, matching the old behavior for plain aliases)
+  if (typeof n === 'string') return nameNullable(n)
+  if (!Array.isArray(n)) return true
+  const op = n[0]
+  if (op == null) return n[1] == null                    // [null, v] literal value
+  if (op === '?' || op === '?:') return mayBeNullish(n[2], nameNullable) || mayBeNullish(n[3], nameNullable)
+  // `a && b` yields a (when falsy — possibly nullish) or b; `a || b` / `a ?? b`
+  // yield a only when truthy/non-nullish, so only b's nullability matters.
+  if (op === '&&') return mayBeNullish(n[1], nameNullable) || mayBeNullish(n[2], nameNullable)
+  if (op === '||' || op === '??') return mayBeNullish(n[2], nameNullable)
+  if (op === '=') return mayBeNullish(n[2], nameNullable) // assignment expression yields its rhs
+  if (op === ',') return mayBeNullish(n[n.length - 1], nameNullable)
+  if (typeof op === 'string' && (NEVER_NULLISH_OPS.has(op) || op.startsWith('new.'))) return false
+  // calls (incl. `.get()` misses), member/element reads, optional chains,
+  // and anything unrecognized: missable — fail closed.
+  return true
 }
 
 /**
@@ -800,6 +874,9 @@ export function analyzeValTypes(body) {
     (n) => ctx.types.typedElem?.get(n),
     (n, c) => (ctx.types.typedElem ??= new Map()).set(n, c),
     (n) => ctx.types.typedElem?.delete(n),
+    (n) => ctx.types.typedLen?.get(n),
+    (n, l) => (ctx.types.typedLen ??= new Map()).set(n, l),
+    (n) => ctx.types.typedLen?.delete(n),
   )
   // Total write count for `name` across the whole body, recursing into nested
   // closures so a closure that reassigns the var is also counted. Capped at 2 —
@@ -955,9 +1032,21 @@ export function analyzeValTypes(body) {
   }
 }
 
-/** Forward-propagate `intCertain` on local bindings. Fixpoint lives in type.js. */
+/** Forward-propagate `intCertain` on local bindings. Fixpoint lives in type.js.
+ *  Threads the settled slot census as the `.prop`-read resolver — without it a
+ *  binding built from an int-certain slot (`const x = hitX ? p.x : nx`) stayed
+ *  uncertain and every consumer re-paid the ToNumber guard. */
 export function analyzeIntCertain(body) {
-  for (const [name, intC] of intCertainMap(body)) {
+  const slotIntOf = ctx.schema?.slotIntCertainAt
+    ? (obj, prop) => {
+      const id = ctx.schema.idOf?.(obj)
+      if (id == null) return null
+      const idx = ctx.schema.list[id]?.indexOf(prop)
+      if (idx == null || idx < 0) return null
+      return ctx.schema.slotIntCertainAt(obj, prop)
+    }
+    : undefined
+  for (const [name, intC] of intCertainMap(body, undefined, slotIntOf)) {
     if (intC) updateRep(name, { intCertain: true })
   }
 }
@@ -1550,6 +1639,16 @@ export function analyzeStructInline(funcFacts, programFacts) {
  *     (direct calls, no storage at all).
  *   - otherwise → a mutable f64 module global (`global.get` / `global.set`).
  *
+ * Escape-as-CALLEE vs escape-as-TABLE: `f`/`f.PROP` appearing as a call's
+ * callee (`f(...)`, `f?.(...)`, `f.prop(...)`, `f.prop?.(...)`) or as the
+ * exported value (`export`) hands out only the invoked/callable function
+ * VALUE — never a handle onto f's property table — so neither disqualifies.
+ * Every other bare mention of `f` (stored into a data structure, aliased
+ * `let g = f`, compared, an argument to anything but treated as a plain call
+ * position, `f[computed]`/`f?.[computed]`) COULD leak a reference the table
+ * is reachable through, so it still disqualifies (`start strict`: this is
+ * deliberately not trying to prove higher-order callback safety yet).
+ *
  * Returns `Map<funcName, { disq, props:Set, valRead:Set,
  * writes:Map<prop,[{rhs,atInit}]> }>` — `valRead` is the subset of props read
  * as a value (not merely called). `flattenFuncNamespaces` (plan.js) turns it
@@ -1620,22 +1719,29 @@ export function analyzeFuncNamespaces(ast) {
       return
     }
 
-    if (op === '()') {
+    // `f(...)` / `f?.(...)` and `f.PROP(...)` / `f.PROP?.(...)` — escape-as-
+    // CALLEE, not escape-as-table. Calling f (or a prop of f) hands the host/
+    // callee only the invoked function VALUE, never f's property table, so
+    // neither shape disqualifies. `prep()` keeps `?.()` a distinct op from
+    // `()` (same flattened-args shape — see prepare/index.js's `'?.()'`
+    // handler) — mirror both here, exactly as `boundSafeCalls` does.
+    if (op === '()' || op === '?.()') {
       const m = memberOf(node[1])
       if (m) rec(m[1]).props.add(m[2])
-      else if (!isFuncRef(node[1], funcNames)) visit(node[1], false)  // bare f(...) ok
+      else if (!isFuncRef(node[1], funcNames)) visit(node[1], false)  // bare f(...)/f?.(...) ok
       for (let i = 2; i < node.length; i++) visit(node[i], false)
       return
     }
 
     // `f.PROP` / `f?.PROP` as a plain value (read) — not the callee of a call
-    // (those are handled by the `()` branch above). A value-read means the
-    // property's stored value must stay retrievable; devirt cannot drop it.
+    // (those are handled by the `()`/`?.()` branch above). A value-read means
+    // the property's stored value must stay retrievable; devirt cannot drop it.
     const m = memberOf(node)
     if (m) { const r = rec(m[1]); r.props.add(m[2]); r.valRead.add(m[2]); return }
 
-    // Computed `f[k]` — the key set is no longer static.
-    if (op === '[]' && isFuncRef(node[1], funcNames)) {
+    // Computed `f[k]` / `f?.[k]` — the key set is no longer static: a genuine
+    // table escape (unlike computed CALL args, this reaches arbitrary props).
+    if ((op === '[]' || op === '?.[]') && isFuncRef(node[1], funcNames)) {
       rec(node[1]).disq = true
       for (let i = 2; i < node.length; i++) visit(node[i], false)
       return